From cfa776c2338d39e757902df08d220aa556d3c7f2 Mon Sep 17 00:00:00 2001 From: Dan Lynch Date: Wed, 12 Aug 2026 14:37:48 -0700 Subject: [PATCH 01/11] feat(manifests): make the package the single source of operator versions MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Versions were declared in two places that could disagree, and did. The manifests package pinned Knative v1.15.0 while the regenerate workflow installed v1.20.0 — so the client was generated against one version and the package shipped manifests for another, with nothing to notice. Versions now live only in packages/manifests/scripts/pull-manifests.ts. The workflow installs whatever that package vendored, which makes the direction explicit: manifests decide what the cluster runs, the cluster decides what its OpenAPI says, and the OpenAPI decides what the client claims exists. Operators refreshed and aligned: knative-serving v1.15.0 -> v1.22.1 cert-manager v1.17.0 -> v1.21.1 cloudnative-pg pinned to the v1.25.2 tag rather than the release-1.25 branch, which could change under a fixed filename cilium 1.19.5 new — CiliumNetworkPolicy types were ungenerable traefik 34.4.1 new — previously fetched by the workflow only tekton-pipelines v1.15.0 new — same ingress-nginx removed, unused net-kourier now comes from knative-extensions rather than knative. The old path redirects, so both worked and neither looked wrong — which is how two consumers came to name different repos for the same file. The workflow's per-operator booleans are gone. Regeneration is all-or-nothing — the generator emits whatever the cluster advertises — so a disabled checkbox did not skip an operator's types, it dropped them. Six switches that each silently deleted a section of the client. The remaining input controls whether manifests are re-pulled from upstream first. The PR it opens now carries the manifests and generated objects alongside the client, since shipping one without the other reintroduces the drift. Co-Authored-By: Claude Claude-Session: https://claude.ai/code/session_01V6watrJsLurfsr3uhnqibB --- .github/workflows/regenerate-ops.yml | 166 +- .../manifests/operators/cert-manager.yaml | 8883 ++--- .../operators/cert-manager/v1.21.1.yaml | 14190 ++++++++ packages/manifests/operators/cilium.yaml | 1789 + .../manifests/operators/cilium/1.19.5.yaml | 1789 + .../manifests/operators/cloudnative-pg.yaml | 2 +- .../operators/cloudnative-pg/1.25.2.yaml | 2 +- .../manifests/operators/ingress-nginx.yaml | 784 - .../operators/ingress-nginx/4.11.2.yaml | 784 - .../manifests/operators/knative-serving.yaml | 1345 +- .../operators/knative-serving/v1.22.1.yaml | 10237 ++++++ .../operators/kube-prometheus-stack.yaml | 222 +- .../kube-prometheus-stack/77.5.0.yaml | 222 +- .../manifests/operators/minio-operator.yaml | 21 +- .../operators/minio-operator/7.1.1.yaml | 7 + .../manifests/operators/tekton-pipelines.yaml | 28155 ++++++++++++++++ .../operators/tekton-pipelines/v1.15.0.yaml | 28155 ++++++++++++++++ packages/manifests/operators/traefik.yaml | 16116 +++++++++ .../manifests/operators/traefik/34.4.1.yaml | 16116 +++++++++ packages/manifests/scripts/pull-manifests.ts | 82 +- .../manifests/src/generated/cert-manager.ts | 4147 ++- packages/manifests/src/generated/cilium.ts | 1608 + .../manifests/src/generated/cloudnative-pg.ts | 50 +- packages/manifests/src/generated/index.ts | 42 +- .../manifests/src/generated/ingress-nginx.ts | 805 - .../src/generated/knative-serving.ts | 1081 +- .../src/generated/kube-prometheus-stack.ts | 436 +- .../manifests/src/generated/minio-operator.ts | 20 +- .../src/generated/tekton-pipelines.ts | 23445 +++++++++++++ packages/manifests/src/generated/traefik.ts | 11292 +++++++ packages/manifests/src/index.ts | 7 - 31 files changed, 162179 insertions(+), 9821 deletions(-) create mode 100644 packages/manifests/operators/cert-manager/v1.21.1.yaml create mode 100644 packages/manifests/operators/cilium.yaml create mode 100644 packages/manifests/operators/cilium/1.19.5.yaml delete mode 100644 packages/manifests/operators/ingress-nginx.yaml delete mode 100644 packages/manifests/operators/ingress-nginx/4.11.2.yaml create mode 100644 packages/manifests/operators/knative-serving/v1.22.1.yaml create mode 100644 packages/manifests/operators/tekton-pipelines.yaml create mode 100644 packages/manifests/operators/tekton-pipelines/v1.15.0.yaml create mode 100644 packages/manifests/operators/traefik.yaml create mode 100644 packages/manifests/operators/traefik/34.4.1.yaml create mode 100644 packages/manifests/src/generated/cilium.ts delete mode 100644 packages/manifests/src/generated/ingress-nginx.ts create mode 100644 packages/manifests/src/generated/tekton-pipelines.ts create mode 100644 packages/manifests/src/generated/traefik.ts diff --git a/.github/workflows/regenerate-ops.yml b/.github/workflows/regenerate-ops.yml index 23061ce..83ad08d 100644 --- a/.github/workflows/regenerate-ops.yml +++ b/.github/workflows/regenerate-ops.yml @@ -3,56 +3,22 @@ name: Regenerate Ops Client on: workflow_dispatch: inputs: - tekton: - description: 'Install Tekton Pipelines' + pull_manifests: + description: 'Re-pull vendored manifests from upstream first' type: boolean default: true - traefik: - description: 'Install Traefik' - type: boolean - default: true - cert_manager: - description: 'Install cert-manager' - type: boolean - default: true - prometheus: - description: 'Install Prometheus Operator CRDs' - type: boolean - default: true - knative_serving: - description: 'Install Knative Serving' - type: boolean - default: true - cloudnative_pg: - description: 'Install CloudNative PG' - type: boolean - default: true - cilium: - description: 'Install Cilium (required for CiliumNetworkPolicy types)' - type: boolean - default: true - -# Pinned deliberately, rather than to whatever `latest` resolves to. +# Versions are NOT declared here. # -# The generated client describes whatever API the cluster below advertises, so -# these versions decide what `@kubernetesjs/ops` claims exists. Left on -# `latest`, the client changes whenever an upstream project cuts a release — -# silently, and only for whoever regenerates next. +# They live in packages/manifests/scripts/pull-manifests.ts, and this workflow +# installs whatever that package vendored. That direction matters: the +# manifests decide what the cluster runs, the cluster decides what its OpenAPI +# says, and the OpenAPI decides what the generated client claims exists. A +# version declared in two places is a version that can disagree with itself, +# which is exactly what happened when this workflow pinned Knative separately +# from the package it is supposed to describe. # -# Some of these are intentionally not the newest release, because they track -# the versions a downstream consumer deploys. Bumping one is a coordinated -# change: pin it here and downstream together, or the client and the cluster it -# describes drift apart. -env: - CERT_MANAGER_VERSION: 'v1.21.1' - PROMETHEUS_OPERATOR_VERSION: 'v0.93.1' - KNATIVE_VERSION: 'v1.20.0' - TEKTON_VERSION: 'v1.15.0' - TRAEFIK_CHART_VERSION: '34.4.1' - CNPG_VERSION: '1.25.0' - CILIUM_VERSION: '1.19.5' - CILIUM_CLI_VERSION: '0.19.7' +# To change a version: edit pull-manifests.ts, run this workflow, review the PR. permissions: contents: write @@ -94,6 +60,16 @@ jobs: with: version: v3.16.0 + # Refresh the vendored manifests from upstream, then regenerate the typed + # objects built from them. Both are inputs to everything below, so they + # run before the cluster exists rather than alongside it. + - name: Pull manifests + if: ${{ inputs.pull_manifests }} + run: pnpm --filter @kubernetesjs/manifests run pull:all + + - name: Regenerate operator objects + run: pnpm --filter @kubernetesjs/manifests run codegen + - name: Create Kind cluster uses: helm/kind-action@v1.12.0 with: @@ -101,74 +77,24 @@ jobs: kubectl_version: v1.31.3 wait: 300s - - name: Install cert-manager - if: ${{ inputs.cert_manager }} - run: | - kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/${CERT_MANAGER_VERSION}/cert-manager.yaml - kubectl wait --for=condition=Available deployment/cert-manager-webhook -n cert-manager --timeout=120s - - - name: Install Prometheus Operator CRDs - if: ${{ inputs.prometheus }} - run: | - kubectl apply --server-side -f https://github.com/prometheus-operator/prometheus-operator/releases/download/${PROMETHEUS_OPERATOR_VERSION}/stripped-down-crds.yaml - - - name: Install Knative Serving - if: ${{ inputs.knative_serving }} - run: | - kubectl apply -f https://github.com/knative/serving/releases/download/knative-${KNATIVE_VERSION}/serving-crds.yaml - kubectl apply -f https://github.com/knative/serving/releases/download/knative-${KNATIVE_VERSION}/serving-core.yaml - kubectl wait --for=condition=Available deployment/controller -n knative-serving --timeout=120s || true - - - name: Install Tekton Pipelines - if: ${{ inputs.tekton }} - run: | - kubectl apply -f https://github.com/tektoncd/pipeline/releases/download/${TEKTON_VERSION}/release.yaml - kubectl wait --for=condition=established --timeout=60s crd/pipelines.tekton.dev - kubectl wait --for=condition=established --timeout=60s crd/pipelineruns.tekton.dev - kubectl wait --for=condition=established --timeout=60s crd/tasks.tekton.dev - kubectl wait --for=condition=established --timeout=60s crd/taskruns.tekton.dev - - - name: Install Traefik CRDs - if: ${{ inputs.traefik }} - run: | - # Install CRDs directly (helm install --wait times out in Kind due to LoadBalancer) - helm repo add traefik https://traefik.github.io/charts - helm repo update - helm template traefik traefik/traefik --version "${TRAEFIK_CHART_VERSION}" | kubectl apply --server-side -f - || true - # Ensure Traefik CRDs are also applied from source (covers all CRDs) - kubectl apply --server-side -f https://raw.githubusercontent.com/traefik/traefik-helm-chart/v${TRAEFIK_CHART_VERSION}/traefik/crds/traefik.io_ingressroutes.yaml - kubectl apply --server-side -f https://raw.githubusercontent.com/traefik/traefik-helm-chart/v${TRAEFIK_CHART_VERSION}/traefik/crds/traefik.io_ingressroutetcps.yaml - kubectl apply --server-side -f https://raw.githubusercontent.com/traefik/traefik-helm-chart/v${TRAEFIK_CHART_VERSION}/traefik/crds/traefik.io_ingressrouteudps.yaml - kubectl apply --server-side -f https://raw.githubusercontent.com/traefik/traefik-helm-chart/v${TRAEFIK_CHART_VERSION}/traefik/crds/traefik.io_middlewares.yaml - kubectl apply --server-side -f https://raw.githubusercontent.com/traefik/traefik-helm-chart/v${TRAEFIK_CHART_VERSION}/traefik/crds/traefik.io_middlewaretcps.yaml - kubectl apply --server-side -f https://raw.githubusercontent.com/traefik/traefik-helm-chart/v${TRAEFIK_CHART_VERSION}/traefik/crds/traefik.io_serverstransports.yaml - kubectl apply --server-side -f https://raw.githubusercontent.com/traefik/traefik-helm-chart/v${TRAEFIK_CHART_VERSION}/traefik/crds/traefik.io_serverstransporttcps.yaml - kubectl apply --server-side -f https://raw.githubusercontent.com/traefik/traefik-helm-chart/v${TRAEFIK_CHART_VERSION}/traefik/crds/traefik.io_tlsoptions.yaml - kubectl apply --server-side -f https://raw.githubusercontent.com/traefik/traefik-helm-chart/v${TRAEFIK_CHART_VERSION}/traefik/crds/traefik.io_tlsstores.yaml - kubectl apply --server-side -f https://raw.githubusercontent.com/traefik/traefik-helm-chart/v${TRAEFIK_CHART_VERSION}/traefik/crds/traefik.io_traefikservices.yaml - kubectl wait --for=condition=established --timeout=60s crd/ingressroutes.traefik.io - - - name: Install CloudNative PG - if: ${{ inputs.cloudnative_pg }} - run: | - kubectl apply --server-side -f https://raw.githubusercontent.com/cloudnative-pg/cloudnative-pg/v${CNPG_VERSION}/releases/cnpg-${CNPG_VERSION}.yaml - kubectl wait --for=condition=established --timeout=60s crd/clusters.postgresql.cnpg.io || true - - - # Cilium last: it is the only component here that owns a dataplane, and - # this cluster already has one. `cilium install` against a cluster with a - # working CNI still registers its CRDs, which is all this job needs. - - name: Install Cilium - if: ${{ inputs.cilium }} - env: - GH_TOKEN: ${{ github.token }} + # Applied from the package, not from URLs. Every operator it vendors is + # installed, so the cluster and the manifests cannot describe different + # things — and adding an operator to the package is the only step needed + # to have its types generated. + - name: Install operators from the manifests package run: | - gh release download "v${CILIUM_CLI_VERSION}" \ - --repo cilium/cilium-cli \ - --pattern cilium-linux-amd64.tar.gz --output /tmp/cilium.tar.gz - sudo tar xzf /tmp/cilium.tar.gz -C /usr/local/bin - cilium install --version "${CILIUM_VERSION}" --wait - kubectl wait --for=condition=established --timeout=120s crd/ciliumnetworkpolicies.cilium.io + set -euo pipefail + shopt -s nullglob + for f in packages/manifests/operators/*.yaml; do + name=$(basename "$f" .yaml) + echo "::group::$name" + # --server-side: several of these carry CRDs large enough to exceed + # the annotation limit that client-side apply uses. + kubectl apply --server-side --force-conflicts -f "$f" || { + echo "::warning::$name did not apply cleanly" + } + echo "::endgroup::" + done - name: Wait for all CRDs to register run: | @@ -229,19 +155,17 @@ jobs: git config user.name "github-actions[bot]" git config user.email "github-actions[bot]@users.noreply.github.com" git checkout -b feat/regenerate-ops-client - git add packages/ops/scripts/swagger.json packages/ops/src/index.ts - git commit -m "feat(ops): regenerate client with updated CRD specs" + # Everything the chain produced, not only the client: the manifests + # are the input the client was generated from, so a PR carrying one + # without the other reintroduces the drift this workflow exists to + # remove. + git add packages/manifests/operators packages/manifests/src/generated \ + packages/ops/scripts/swagger.json packages/ops/src/index.ts + git commit -m "feat: regenerate manifests and ops client" git push --force-with-lease origin feat/regenerate-ops-client gh pr create \ --title "feat(ops): regenerate client with updated CRD specs" \ --body "Regenerated \`@kubernetesjs/ops\` client from a Kind cluster with: - - cert-manager: ${{ inputs.cert_manager }} - - Prometheus Operator: ${{ inputs.prometheus }} - - Knative Serving: ${{ inputs.knative_serving }} - - Tekton Pipelines: ${{ inputs.tekton }} - - Traefik: ${{ inputs.traefik }} - - CloudNative PG: ${{ inputs.cloudnative_pg }} - - Cilium: ${{ inputs.cilium }} Triggered by workflow_dispatch." \ --base main \ diff --git a/packages/manifests/operators/cert-manager.yaml b/packages/manifests/operators/cert-manager.yaml index 5ad6d83..6a83c36 100644 --- a/packages/manifests/operators/cert-manager.yaml +++ b/packages/manifests/operators/cert-manager.yaml @@ -1,4 +1,4 @@ -# Source: jetstack/cert-manager@v1.17.0 +# Source: jetstack/cert-manager@v1.21.1 --- # Added by pull-manifests.ts to ensure namespace exists apiVersion: v1 @@ -22,9 +22,10 @@ metadata: app.kubernetes.io/name: cainjector app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "cainjector" - app.kubernetes.io/version: "v1.17.0" + app.kubernetes.io/version: "v1.21.1" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.17.0 + helm.sh/chart: cert-manager-v1.21.1 + --- # Source: cert-manager/templates/serviceaccount.yaml apiVersion: v1 @@ -38,9 +39,10 @@ metadata: app.kubernetes.io/name: cert-manager app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "controller" - app.kubernetes.io/version: "v1.17.0" + app.kubernetes.io/version: "v1.21.1" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.17.0 + helm.sh/chart: cert-manager-v1.21.1 + --- # Source: cert-manager/templates/webhook-serviceaccount.yaml apiVersion: v1 @@ -54,83 +56,57 @@ metadata: app.kubernetes.io/name: webhook app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "webhook" - app.kubernetes.io/version: "v1.17.0" + app.kubernetes.io/version: "v1.21.1" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.17.0 + helm.sh/chart: cert-manager-v1.21.1 + --- -# Source: cert-manager/templates/crds.yaml -# -# START crd +# Source: cert-manager/templates/crd-acme.cert-manager.io_challenges.yaml apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: - name: certificaterequests.cert-manager.io - # START annotations + name: "challenges.acme.cert-manager.io" annotations: helm.sh/resource-policy: keep - # END annotations labels: - app: 'cert-manager' - app.kubernetes.io/name: 'cert-manager' - app.kubernetes.io/instance: 'cert-manager' - # Generated labels - app.kubernetes.io/version: "v1.17.0" + app: "cert-manager" + app.kubernetes.io/name: "cert-manager" + app.kubernetes.io/instance: "cert-manager" + app.kubernetes.io/component: "crds" + app.kubernetes.io/version: "v1.21.1" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.17.0 + helm.sh/chart: cert-manager-v1.21.1 spec: - group: cert-manager.io + group: acme.cert-manager.io names: - kind: CertificateRequest - listKind: CertificateRequestList - plural: certificaterequests - shortNames: - - cr - - crs - singular: certificaterequest categories: - cert-manager + - cert-manager-acme + kind: Challenge + listKind: ChallengeList + plural: challenges + singular: challenge scope: Namespaced versions: - - name: v1 - subresources: - status: {} - additionalPrinterColumns: - - jsonPath: .status.conditions[?(@.type=="Approved")].status - name: Approved - type: string - - jsonPath: .status.conditions[?(@.type=="Denied")].status - name: Denied - type: string - - jsonPath: .status.conditions[?(@.type=="Ready")].status - name: Ready - type: string - - jsonPath: .spec.issuerRef.name - name: Issuer + - additionalPrinterColumns: + - jsonPath: .status.state + name: State type: string - - jsonPath: .spec.username - name: Requester + - jsonPath: .spec.dnsName + name: Domain type: string - - jsonPath: .status.conditions[?(@.type=="Ready")].message - name: Status + - jsonPath: .status.reason + name: Reason priority: 1 type: string - - jsonPath: .metadata.creationTimestamp - description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. + - description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. + jsonPath: .metadata.creationTimestamp name: Age type: date + name: v1 schema: openAPIV3Schema: - description: |- - A CertificateRequest is used to request a signed certificate from one of the - configured issuers. - - All fields within the CertificateRequest's `spec` are immutable after creation. - A CertificateRequest will either succeed or fail, as denoted by its `Ready` status - condition and its `status.failureTime` field. - - A CertificateRequest is a one-shot resource, meaning it represents a single - point in time request for a certificate and cannot be re-used. - type: object + description: Challenge is a type to represent a Challenge request with an ACME server properties: apiVersion: description: |- @@ -150,1693 +126,615 @@ spec: metadata: type: object spec: - description: |- - Specification of the desired state of the CertificateRequest resource. - https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status - type: object - required: - - issuerRef - - request properties: - duration: + authorizationURL: description: |- - Requested 'duration' (i.e. lifetime) of the Certificate. Note that the - issuer may choose to ignore the requested duration, just like any other - requested attribute. + The URL to the ACME Authorization resource that this + challenge is a part of. type: string - extra: - description: |- - Extra contains extra attributes of the user that created the CertificateRequest. - Populated by the cert-manager webhook on creation and immutable. - type: object - additionalProperties: - type: array - items: - type: string - groups: - description: |- - Groups contains group membership of the user that created the CertificateRequest. - Populated by the cert-manager webhook on creation and immutable. - type: array - items: - type: string - x-kubernetes-list-type: atomic - isCA: + dnsName: description: |- - Requested basic constraints isCA value. Note that the issuer may choose - to ignore the requested isCA value, just like any other requested attribute. - - NOTE: If the CSR in the `Request` field has a BasicConstraints extension, - it must have the same isCA value as specified here. - - If true, this will automatically add the `cert sign` usage to the list - of requested `usages`. - type: boolean + dnsName is the identifier that this challenge is for, e.g., example.com. + If the requested DNSName is a 'wildcard', this field MUST be set to the + non-wildcard domain, e.g., for `*.example.com`, it must be `example.com`. + type: string issuerRef: description: |- - Reference to the issuer responsible for issuing the certificate. - If the issuer is namespace-scoped, it must be in the same namespace - as the Certificate. If the issuer is cluster-scoped, it can be used - from any namespace. - - The `name` field of the reference must always be specified. - type: object - required: - - name + References a properly configured ACME-type Issuer which should + be used to create this Challenge. + If the Issuer does not exist, processing will be retried. + If the Issuer is not an 'ACME' Issuer, an error will be returned and the + Challenge will be marked as failed. properties: group: - description: Group of the resource being referred to. + description: |- + Group of the issuer being referred to. + Defaults to 'cert-manager.io'. type: string kind: - description: Kind of the resource being referred to. + description: |- + Kind of the issuer being referred to. + Defaults to 'Issuer'. type: string name: - description: Name of the resource being referred to. + description: Name of the issuer being referred to. type: string - request: - description: |- - The PEM-encoded X.509 certificate signing request to be submitted to the - issuer for signing. - - If the CSR has a BasicConstraints extension, its isCA attribute must - match the `isCA` value of this CertificateRequest. - If the CSR has a KeyUsage extension, its key usages must match the - key usages in the `usages` field of this CertificateRequest. - If the CSR has a ExtKeyUsage extension, its extended key usages - must match the extended key usages in the `usages` field of this - CertificateRequest. - type: string - format: byte - uid: - description: |- - UID contains the uid of the user that created the CertificateRequest. - Populated by the cert-manager webhook on creation and immutable. - type: string - usages: - description: |- - Requested key usages and extended key usages. - - NOTE: If the CSR in the `Request` field has uses the KeyUsage or - ExtKeyUsage extension, these extensions must have the same values - as specified here without any additional values. - - If unset, defaults to `digital signature` and `key encipherment`. - type: array - items: - description: |- - KeyUsage specifies valid usage contexts for keys. - See: - https://tools.ietf.org/html/rfc5280#section-4.2.1.3 - https://tools.ietf.org/html/rfc5280#section-4.2.1.12 - - Valid KeyUsage values are as follows: - "signing", - "digital signature", - "content commitment", - "key encipherment", - "key agreement", - "data encipherment", - "cert sign", - "crl sign", - "encipher only", - "decipher only", - "any", - "server auth", - "client auth", - "code signing", - "email protection", - "s/mime", - "ipsec end system", - "ipsec tunnel", - "ipsec user", - "timestamping", - "ocsp signing", - "microsoft sgc", - "netscape sgc" - type: string - enum: - - signing - - digital signature - - content commitment - - key encipherment - - key agreement - - data encipherment - - cert sign - - crl sign - - encipher only - - decipher only - - any - - server auth - - client auth - - code signing - - email protection - - s/mime - - ipsec end system - - ipsec tunnel - - ipsec user - - timestamping - - ocsp signing - - microsoft sgc - - netscape sgc - username: - description: |- - Username contains the name of the user that created the CertificateRequest. - Populated by the cert-manager webhook on creation and immutable. - type: string - status: - description: |- - Status of the CertificateRequest. - This is set and managed automatically. - Read-only. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status - type: object - properties: - ca: - description: |- - The PEM encoded X.509 certificate of the signer, also known as the CA - (Certificate Authority). - This is set on a best-effort basis by different issuers. - If not set, the CA is assumed to be unknown/not available. - type: string - format: byte - certificate: + required: + - name + type: object + key: description: |- - The PEM encoded X.509 certificate resulting from the certificate - signing request. - If not set, the CertificateRequest has either not been completed or has - failed. More information on failure can be found by checking the - `conditions` field. + The ACME challenge key for this challenge + For HTTP01 challenges, this is the value that must be responded with to + complete the HTTP01 challenge in the format: + `.`. + For DNS01 challenges, this is the base64 encoded SHA256 sum of the + `.` + text that must be set as the TXT record content. type: string - format: byte - conditions: + solver: description: |- - List of status conditions to indicate the status of a CertificateRequest. - Known condition types are `Ready`, `InvalidRequest`, `Approved` and `Denied`. - type: array - items: - description: CertificateRequestCondition contains condition information for a CertificateRequest. - type: object - required: - - status - - type - properties: - lastTransitionTime: - description: |- - LastTransitionTime is the timestamp corresponding to the last status - change of this condition. - type: string - format: date-time - message: - description: |- - Message is a human readable description of the details of the last - transition, complementing reason. - type: string - reason: - description: |- - Reason is a brief machine readable explanation for the condition's last - transition. - type: string - status: - description: Status of the condition, one of (`True`, `False`, `Unknown`). - type: string - enum: - - "True" - - "False" - - Unknown - type: - description: |- - Type of the condition, known values are (`Ready`, `InvalidRequest`, - `Approved`, `Denied`). - type: string - x-kubernetes-list-map-keys: - - type - x-kubernetes-list-type: map - failureTime: - description: |- - FailureTime stores the time that this CertificateRequest failed. This is - used to influence garbage collection and back-off. - type: string - format: date-time - served: true - storage: true - -# END crd ---- -# Source: cert-manager/templates/crds.yaml -# START crd -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - name: certificates.cert-manager.io - # START annotations - annotations: - helm.sh/resource-policy: keep - # END annotations - labels: - app: 'cert-manager' - app.kubernetes.io/name: 'cert-manager' - app.kubernetes.io/instance: 'cert-manager' - # Generated labels - app.kubernetes.io/version: "v1.17.0" - app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.17.0 -spec: - group: cert-manager.io - names: - kind: Certificate - listKind: CertificateList - plural: certificates - shortNames: - - cert - - certs - singular: certificate - categories: - - cert-manager - scope: Namespaced - versions: - - name: v1 - subresources: - status: {} - additionalPrinterColumns: - - jsonPath: .status.conditions[?(@.type=="Ready")].status - name: Ready - type: string - - jsonPath: .spec.secretName - name: Secret - type: string - - jsonPath: .spec.issuerRef.name - name: Issuer - priority: 1 - type: string - - jsonPath: .status.conditions[?(@.type=="Ready")].message - name: Status - priority: 1 - type: string - - jsonPath: .metadata.creationTimestamp - description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. - name: Age - type: date - schema: - openAPIV3Schema: - description: |- - A Certificate resource should be created to ensure an up to date and signed - X.509 certificate is stored in the Kubernetes Secret resource named in `spec.secretName`. - - The stored certificate will be renewed before it expires (as configured by `spec.renewBefore`). - type: object - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: |- - Specification of the desired state of the Certificate resource. - https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status - type: object - required: - - issuerRef - - secretName - properties: - additionalOutputFormats: - description: |- - Defines extra output formats of the private key and signed certificate chain - to be written to this Certificate's target Secret. - - This is a Beta Feature enabled by default. It can be disabled with the - `--feature-gates=AdditionalCertificateOutputFormats=false` option set on both - the controller and webhook components. - type: array - items: - description: |- - CertificateAdditionalOutputFormat defines an additional output format of a - Certificate resource. These contain supplementary data formats of the signed - certificate chain and paired private key. - type: object - required: - - type - properties: - type: - description: |- - Type is the name of the format type that should be written to the - Certificate's target Secret. - type: string - enum: - - DER - - CombinedPEM - commonName: - description: |- - Requested common name X509 certificate subject attribute. - More info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.6 - NOTE: TLS clients will ignore this value when any subject alternative name is - set (see https://tools.ietf.org/html/rfc6125#section-6.4.4). - - Should have a length of 64 characters or fewer to avoid generating invalid CSRs. - Cannot be set if the `literalSubject` field is set. - type: string - dnsNames: - description: Requested DNS subject alternative names. - type: array - items: - type: string - duration: - description: |- - Requested 'duration' (i.e. lifetime) of the Certificate. Note that the - issuer may choose to ignore the requested duration, just like any other - requested attribute. - - If unset, this defaults to 90 days. - Minimum accepted duration is 1 hour. - Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration. - type: string - emailAddresses: - description: Requested email subject alternative names. - type: array - items: - type: string - encodeUsagesInRequest: - description: |- - Whether the KeyUsage and ExtKeyUsage extensions should be set in the encoded CSR. - - This option defaults to true, and should only be disabled if the target - issuer does not support CSRs with these X509 KeyUsage/ ExtKeyUsage extensions. - type: boolean - ipAddresses: - description: Requested IP address subject alternative names. - type: array - items: - type: string - isCA: - description: |- - Requested basic constraints isCA value. - The isCA value is used to set the `isCA` field on the created CertificateRequest - resources. Note that the issuer may choose to ignore the requested isCA value, just - like any other requested attribute. - - If true, this will automatically add the `cert sign` usage to the list - of requested `usages`. - type: boolean - issuerRef: - description: |- - Reference to the issuer responsible for issuing the certificate. - If the issuer is namespace-scoped, it must be in the same namespace - as the Certificate. If the issuer is cluster-scoped, it can be used - from any namespace. - - The `name` field of the reference must always be specified. - type: object - required: - - name - properties: - group: - description: Group of the resource being referred to. - type: string - kind: - description: Kind of the resource being referred to. - type: string - name: - description: Name of the resource being referred to. - type: string - keystores: - description: Additional keystore output formats to be stored in the Certificate's Secret. - type: object + Contains the domain solving configuration that should be used to + solve this challenge resource. properties: - jks: + dns01: description: |- - JKS configures options for storing a JKS keystore in the - `spec.secretName` Secret resource. - type: object - required: - - create + Configures cert-manager to attempt to complete authorizations by + performing the DNS01 challenge flow. properties: - alias: - description: |- - Alias specifies the alias of the key in the keystore, required by the JKS format. - If not provided, the default alias `certificate` will be used. - type: string - create: - description: |- - Create enables JKS keystore creation for the Certificate. - If true, a file named `keystore.jks` will be created in the target - Secret resource, encrypted using the password stored in - `passwordSecretRef` or `password`. - The keystore file will be updated immediately. - If the issuer provided a CA certificate, a file named `truststore.jks` - will also be created in the target Secret resource, encrypted using the - password stored in `passwordSecretRef` - containing the issuing Certificate Authority - type: boolean - password: - description: |- - Password provides a literal password used to encrypt the JKS keystore. - Mutually exclusive with passwordSecretRef. - One of password or passwordSecretRef must provide a password with a non-zero length. - type: string - passwordSecretRef: + acmeDNS: description: |- - PasswordSecretRef is a reference to a non-empty key in a Secret resource - containing the password used to encrypt the JKS keystore. - Mutually exclusive with password. - One of password or passwordSecretRef must provide a password with a non-zero length. - type: object - required: - - name + Use the 'ACME DNS' (https://github.com/joohoi/acme-dns) API to manage + DNS01 challenge records. properties: - key: - description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. - type: string - name: + accountSecretRef: description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + A reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + required: + - name + type: object + host: type: string - pkcs12: - description: |- - PKCS12 configures options for storing a PKCS12 keystore in the - `spec.secretName` Secret resource. - type: object - required: - - create - properties: - create: - description: |- - Create enables PKCS12 keystore creation for the Certificate. - If true, a file named `keystore.p12` will be created in the target - Secret resource, encrypted using the password stored in - `passwordSecretRef` or in `password`. - The keystore file will be updated immediately. - If the issuer provided a CA certificate, a file named `truststore.p12` will - also be created in the target Secret resource, encrypted using the - password stored in `passwordSecretRef` containing the issuing Certificate - Authority - type: boolean - password: - description: |- - Password provides a literal password used to encrypt the PKCS#12 keystore. - Mutually exclusive with passwordSecretRef. - One of password or passwordSecretRef must provide a password with a non-zero length. - type: string - passwordSecretRef: - description: |- - PasswordSecretRef is a reference to a non-empty key in a Secret resource - containing the password used to encrypt the PKCS#12 keystore. - Mutually exclusive with password. - One of password or passwordSecretRef must provide a password with a non-zero length. + required: + - accountSecretRef + - host type: object + akamai: + description: Use the Akamai DNS zone management API to manage DNS01 challenge records. + properties: + accessTokenSecretRef: + description: |- + A reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + required: + - name + type: object + clientSecretSecretRef: + description: |- + A reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + required: + - name + type: object + clientTokenSecretRef: + description: |- + A reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + required: + - name + type: object + serviceConsumerDomain: + type: string required: - - name + - accessTokenSecretRef + - clientSecretSecretRef + - clientTokenSecretRef + - serviceConsumerDomain + type: object + azureDNS: + description: Use the Microsoft Azure DNS API to manage DNS01 challenge records. properties: - key: + clientID: description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. + Auth: Azure Service Principal: + The ClientID of the Azure Service Principal used to authenticate with Azure DNS. + If set, ClientSecret and TenantID must also be set. type: string - name: + clientSecretSecretRef: description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + Auth: Azure Service Principal: + A reference to a Secret containing the password associated with the Service Principal. + If set, ClientID and TenantID must also be set. + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + required: + - name + type: object + environment: + description: name of the Azure environment (default AzurePublicCloud) + enum: + - AzurePublicCloud + - AzureChinaCloud + - AzureGermanCloud + - AzureUSGovernmentCloud type: string - profile: - description: |- - Profile specifies the key and certificate encryption algorithms and the HMAC algorithm - used to create the PKCS12 keystore. Default value is `LegacyRC2` for backward compatibility. + hostedZoneName: + description: name of the DNS zone that should be used + type: string + managedIdentity: + description: |- + Auth: Azure Workload Identity or Azure Managed Service Identity: + Settings to enable Azure Workload Identity or Azure Managed Service Identity + If set, ClientID, ClientSecret and TenantID must not be set. + properties: + clientID: + description: client ID of the managed identity, cannot be used at the same time as resourceID + type: string + resourceID: + description: |- + resource ID of the managed identity, cannot be used at the same time as clientID + Cannot be used for Azure Managed Service Identity + type: string + tenantID: + description: tenant ID of the managed identity, cannot be used at the same time as resourceID + type: string + type: object + resourceGroupName: + description: resource group the DNS zone is located in + type: string + subscriptionID: + description: ID of the Azure subscription + type: string + tenantID: + description: |- + Auth: Azure Service Principal: + The TenantID of the Azure Service Principal used to authenticate with Azure DNS. + If set, ClientID and ClientSecret must also be set. + type: string + zoneType: + description: |- + ZoneType determines which type of Azure DNS zone to use. - If provided, allowed values are: - `LegacyRC2`: Deprecated. Not supported by default in OpenSSL 3 or Java 20. - `LegacyDES`: Less secure algorithm. Use this option for maximal compatibility. - `Modern2023`: Secure algorithm. Use this option in case you have to always use secure algorithms - (eg. because of company policy). Please note that the security of the algorithm is not that important - in reality, because the unencrypted certificate and private key are also stored in the Secret. - type: string - enum: - - LegacyRC2 - - LegacyDES - - Modern2023 - literalSubject: - description: |- - Requested X.509 certificate subject, represented using the LDAP "String - Representation of a Distinguished Name" [1]. - Important: the LDAP string format also specifies the order of the attributes - in the subject, this is important when issuing certs for LDAP authentication. - Example: `CN=foo,DC=corp,DC=example,DC=com` - More info [1]: https://datatracker.ietf.org/doc/html/rfc4514 - More info: https://github.com/cert-manager/cert-manager/issues/3203 - More info: https://github.com/cert-manager/cert-manager/issues/4424 + Valid values are: + - AzurePublicZone (default): Use a public Azure DNS zone. + - AzurePrivateZone: Use an Azure Private DNS zone. - Cannot be set if the `subject` or `commonName` field is set. - type: string - nameConstraints: - description: |- - x.509 certificate NameConstraint extension which MUST NOT be used in a non-CA certificate. - More Info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.10 + If not specified, AzurePublicZone is used. - This is an Alpha Feature and is only enabled with the - `--feature-gates=NameConstraints=true` option set on both - the controller and webhook components. - type: object - properties: - critical: - description: if true then the name constraints are marked critical. - type: boolean - excluded: - description: |- - Excluded contains the constraints which must be disallowed. Any name matching a - restriction in the excluded field is invalid regardless - of information appearing in the permitted - type: object - properties: - dnsDomains: - description: DNSDomains is a list of DNS domains that are permitted or excluded. - type: array - items: - type: string - emailAddresses: - description: EmailAddresses is a list of Email Addresses that are permitted or excluded. - type: array - items: - type: string - ipRanges: - description: |- - IPRanges is a list of IP Ranges that are permitted or excluded. - This should be a valid CIDR notation. - type: array - items: - type: string - uriDomains: - description: URIDomains is a list of URI domains that are permitted or excluded. - type: array - items: - type: string - permitted: - description: Permitted contains the constraints in which the names must be located. - type: object - properties: - dnsDomains: - description: DNSDomains is a list of DNS domains that are permitted or excluded. - type: array - items: - type: string - emailAddresses: - description: EmailAddresses is a list of Email Addresses that are permitted or excluded. - type: array - items: - type: string - ipRanges: + Support for Azure Private DNS zones is currently + experimental and may change in future releases. + enum: + - AzurePublicZone + - AzurePrivateZone + type: string + required: + - resourceGroupName + - subscriptionID + type: object + cloudDNS: + description: Use the Google Cloud DNS API to manage DNS01 challenge records. + properties: + hostedZoneName: + description: |- + HostedZoneName is an optional field that tells cert-manager in which + Cloud DNS zone the challenge record has to be created. + If left empty cert-manager will automatically choose a zone. + type: string + project: + type: string + serviceAccountSecretRef: + description: |- + A reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + required: + - name + type: object + required: + - project + type: object + cloudflare: + description: Use the Cloudflare API to manage DNS01 challenge records. + properties: + apiKeySecretRef: + description: |- + API key to use to authenticate with Cloudflare. + Note: using an API token to authenticate is now the recommended method + as it allows greater control of permissions. + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + required: + - name + type: object + apiTokenSecretRef: + description: API token used to authenticate with Cloudflare. + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + required: + - name + type: object + email: + description: Email of the account, only required when using API key based authentication. + type: string + type: object + cnameStrategy: description: |- - IPRanges is a list of IP Ranges that are permitted or excluded. - This should be a valid CIDR notation. - type: array - items: - type: string - uriDomains: - description: URIDomains is a list of URI domains that are permitted or excluded. - type: array - items: - type: string - otherNames: - description: |- - `otherNames` is an escape hatch for SAN that allows any type. We currently restrict the support to string like otherNames, cf RFC 5280 p 37 - Any UTF8 String valued otherName can be passed with by setting the keys oid: x.x.x.x and UTF8Value: somevalue for `otherName`. - Most commonly this would be UPN set with oid: 1.3.6.1.4.1.311.20.2.3 - You should ensure that any OID passed is valid for the UTF8String type as we do not explicitly validate this. - type: array - items: - type: object - properties: - oid: - description: |- - OID is the object identifier for the otherName SAN. - The object identifier must be expressed as a dotted string, for - example, "1.2.840.113556.1.4.221". - type: string - utf8Value: - description: |- - utf8Value is the string value of the otherName SAN. - The utf8Value accepts any valid UTF8 string to set as value for the otherName SAN. - type: string - privateKey: - description: |- - Private key options. These include the key algorithm and size, the used - encoding and the rotation policy. - type: object - properties: - algorithm: - description: |- - Algorithm is the private key algorithm of the corresponding private key - for this certificate. - - If provided, allowed values are either `RSA`, `ECDSA` or `Ed25519`. - If `algorithm` is specified and `size` is not provided, - key size of 2048 will be used for `RSA` key algorithm and - key size of 256 will be used for `ECDSA` key algorithm. - key size is ignored when using the `Ed25519` key algorithm. - type: string - enum: - - RSA - - ECDSA - - Ed25519 - encoding: - description: |- - The private key cryptography standards (PKCS) encoding for this - certificate's private key to be encoded in. - - If provided, allowed values are `PKCS1` and `PKCS8` standing for PKCS#1 - and PKCS#8, respectively. - Defaults to `PKCS1` if not specified. - type: string - enum: - - PKCS1 - - PKCS8 - rotationPolicy: - description: |- - RotationPolicy controls how private keys should be regenerated when a - re-issuance is being processed. - - If set to `Never`, a private key will only be generated if one does not - already exist in the target `spec.secretName`. If one does exist but it - does not have the correct algorithm or size, a warning will be raised - to await user intervention. - If set to `Always`, a private key matching the specified requirements - will be generated whenever a re-issuance occurs. - Default is `Never` for backward compatibility. - type: string - enum: - - Never - - Always - size: - description: |- - Size is the key bit size of the corresponding private key for this certificate. - - If `algorithm` is set to `RSA`, valid values are `2048`, `4096` or `8192`, - and will default to `2048` if not specified. - If `algorithm` is set to `ECDSA`, valid values are `256`, `384` or `521`, - and will default to `256` if not specified. - If `algorithm` is set to `Ed25519`, Size is ignored. - No other values are allowed. - type: integer - renewBefore: - description: |- - How long before the currently issued certificate's expiry cert-manager should - renew the certificate. For example, if a certificate is valid for 60 minutes, - and `renewBefore=10m`, cert-manager will begin to attempt to renew the certificate - 50 minutes after it was issued (i.e. when there are 10 minutes remaining until - the certificate is no longer valid). - - NOTE: The actual lifetime of the issued certificate is used to determine the - renewal time. If an issuer returns a certificate with a different lifetime than - the one requested, cert-manager will use the lifetime of the issued certificate. - - If unset, this defaults to 1/3 of the issued certificate's lifetime. - Minimum accepted value is 5 minutes. - Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration. - Cannot be set if the `renewBeforePercentage` field is set. - type: string - renewBeforePercentage: - description: |- - `renewBeforePercentage` is like `renewBefore`, except it is a relative percentage - rather than an absolute duration. For example, if a certificate is valid for 60 - minutes, and `renewBeforePercentage=25`, cert-manager will begin to attempt to - renew the certificate 45 minutes after it was issued (i.e. when there are 15 - minutes (25%) remaining until the certificate is no longer valid). - - NOTE: The actual lifetime of the issued certificate is used to determine the - renewal time. If an issuer returns a certificate with a different lifetime than - the one requested, cert-manager will use the lifetime of the issued certificate. - - Value must be an integer in the range (0,100). The minimum effective - `renewBefore` derived from the `renewBeforePercentage` and `duration` fields is 5 - minutes. - Cannot be set if the `renewBefore` field is set. - type: integer - format: int32 - revisionHistoryLimit: - description: |- - The maximum number of CertificateRequest revisions that are maintained in - the Certificate's history. Each revision represents a single `CertificateRequest` - created by this Certificate, either when it was created, renewed, or Spec - was changed. Revisions will be removed by oldest first if the number of - revisions exceeds this number. - - If set, revisionHistoryLimit must be a value of `1` or greater. - If unset (`nil`), revisions will not be garbage collected. - Default value is `nil`. - type: integer - format: int32 - secretName: - description: |- - Name of the Secret resource that will be automatically created and - managed by this Certificate resource. It will be populated with a - private key and certificate, signed by the denoted issuer. The Secret - resource lives in the same namespace as the Certificate resource. - type: string - secretTemplate: - description: |- - Defines annotations and labels to be copied to the Certificate's Secret. - Labels and annotations on the Secret will be changed as they appear on the - SecretTemplate when added or removed. SecretTemplate annotations are added - in conjunction with, and cannot overwrite, the base set of annotations - cert-manager sets on the Certificate's Secret. - type: object - properties: - annotations: - description: Annotations is a key value map to be copied to the target Kubernetes Secret. - type: object - additionalProperties: - type: string - labels: - description: Labels is a key value map to be copied to the target Kubernetes Secret. - type: object - additionalProperties: - type: string - subject: - description: |- - Requested set of X509 certificate subject attributes. - More info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.6 + CNAMEStrategy configures how the DNS01 provider should handle CNAME + records when found in DNS zones. + enum: + - None + - Follow + type: string + digitalocean: + description: Use the DigitalOcean DNS API to manage DNS01 challenge records. + properties: + tokenSecretRef: + description: |- + A reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + required: + - name + type: object + required: + - tokenSecretRef + type: object + rfc2136: + description: |- + Use RFC2136 ("Dynamic Updates in the Domain Name System") (https://datatracker.ietf.org/doc/rfc2136/) + to manage DNS01 challenge records. + properties: + nameserver: + description: |- + The IP address or hostname of an authoritative DNS server supporting + RFC2136 in the form host:port. If the host is an IPv6 address it must be + enclosed in square brackets (e.g [2001:db8::1]); port is optional. + This field is required. + type: string + protocol: + description: Protocol to use for dynamic DNS update queries. Valid values are (case-sensitive) ``TCP`` and ``UDP``; ``UDP`` (default). + enum: + - TCP + - UDP + type: string + tsigAlgorithm: + description: |- + The TSIG Algorithm configured in the DNS supporting RFC2136. Used only + when ``tsigSecretSecretRef`` and ``tsigKeyName`` are defined. + Supported values are (case-insensitive): ``HMACMD5`` (default), + ``HMACSHA1``, ``HMACSHA256`` or ``HMACSHA512``. + type: string + tsigKeyName: + description: |- + The TSIG Key name configured in the DNS. + If ``tsigSecretSecretRef`` is defined, this field is required. + type: string + tsigSecretSecretRef: + description: |- + The name of the secret containing the TSIG value. + If ``tsigKeyName`` is defined, this field is required. + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + required: + - name + type: object + required: + - nameserver + type: object + route53: + description: Use the AWS Route53 API to manage DNS01 challenge records. + properties: + accessKeyID: + description: |- + The AccessKeyID is used for authentication. + Cannot be set when SecretAccessKeyID is set. + If neither the Access Key nor Key ID are set, we fall back to using env + vars, shared credentials file, or AWS Instance metadata, + see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials + type: string + accessKeyIDSecretRef: + description: |- + The SecretAccessKey is used for authentication. If set, pull the AWS + access key ID from a key within a Kubernetes Secret. + Cannot be set when AccessKeyID is set. + If neither the Access Key nor Key ID are set, we fall back to using env + vars, shared credentials file, or AWS Instance metadata, + see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + required: + - name + type: object + auth: + description: Auth configures how cert-manager authenticates. + properties: + kubernetes: + description: |- + Kubernetes authenticates with Route53 using AssumeRoleWithWebIdentity + by passing a bound ServiceAccount token. + properties: + serviceAccountRef: + description: |- + A reference to a service account that will be used to request a bound + token (also known as "projected token"). To use this field, you must + configure an RBAC rule to let cert-manager request a token. + properties: + audiences: + description: |- + TokenAudiences is an optional list of audiences to include in the + token passed to AWS. The default token consisting of the issuer's namespace + and name is always included. + If unset the audience defaults to `sts.amazonaws.com`. + items: + type: string + type: array + x-kubernetes-list-type: atomic + name: + description: Name of the ServiceAccount used to request a token. + type: string + required: + - name + type: object + required: + - serviceAccountRef + type: object + required: + - kubernetes + type: object + hostedZoneID: + description: If set, the provider will manage only this zone in Route53 and will not do a lookup using the route53:ListHostedZonesByName api call. + type: string + region: + description: |- + Override the AWS region. - The common name attribute is specified separately in the `commonName` field. - Cannot be set if the `literalSubject` field is set. - type: object - properties: - countries: - description: Countries to be used on the Certificate. - type: array - items: - type: string - localities: - description: Cities to be used on the Certificate. - type: array - items: - type: string - organizationalUnits: - description: Organizational Units to be used on the Certificate. - type: array - items: - type: string - organizations: - description: Organizations to be used on the Certificate. - type: array - items: - type: string - postalCodes: - description: Postal codes to be used on the Certificate. - type: array - items: - type: string - provinces: - description: State/Provinces to be used on the Certificate. - type: array - items: - type: string - serialNumber: - description: Serial number to be used on the Certificate. - type: string - streetAddresses: - description: Street addresses to be used on the Certificate. - type: array - items: - type: string - uris: - description: Requested URI subject alternative names. - type: array - items: - type: string - usages: - description: |- - Requested key usages and extended key usages. - These usages are used to set the `usages` field on the created CertificateRequest - resources. If `encodeUsagesInRequest` is unset or set to `true`, the usages - will additionally be encoded in the `request` field which contains the CSR blob. + Route53 is a global service and does not have regional endpoints but the + region specified here (or via environment variables) is used as a hint to + help compute the correct AWS credential scope and partition when it + connects to Route53. See: + - [Amazon Route 53 endpoints and quotas](https://docs.aws.amazon.com/general/latest/gr/r53.html) + - [Global services](https://docs.aws.amazon.com/whitepapers/latest/aws-fault-isolation-boundaries/global-services.html) - If unset, defaults to `digital signature` and `key encipherment`. - type: array - items: - description: |- - KeyUsage specifies valid usage contexts for keys. - See: - https://tools.ietf.org/html/rfc5280#section-4.2.1.3 - https://tools.ietf.org/html/rfc5280#section-4.2.1.12 + If you omit this region field, cert-manager will use the region from + AWS_REGION and AWS_DEFAULT_REGION environment variables, if they are set + in the cert-manager controller Pod. - Valid KeyUsage values are as follows: - "signing", - "digital signature", - "content commitment", - "key encipherment", - "key agreement", - "data encipherment", - "cert sign", - "crl sign", - "encipher only", - "decipher only", - "any", - "server auth", - "client auth", - "code signing", - "email protection", - "s/mime", - "ipsec end system", - "ipsec tunnel", - "ipsec user", - "timestamping", - "ocsp signing", - "microsoft sgc", - "netscape sgc" - type: string - enum: - - signing - - digital signature - - content commitment - - key encipherment - - key agreement - - data encipherment - - cert sign - - crl sign - - encipher only - - decipher only - - any - - server auth - - client auth - - code signing - - email protection - - s/mime - - ipsec end system - - ipsec tunnel - - ipsec user - - timestamping - - ocsp signing - - microsoft sgc - - netscape sgc - status: - description: |- - Status of the Certificate. - This is set and managed automatically. - Read-only. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status - type: object - properties: - conditions: - description: |- - List of status conditions to indicate the status of certificates. - Known condition types are `Ready` and `Issuing`. - type: array - items: - description: CertificateCondition contains condition information for a Certificate. - type: object - required: - - status - - type - properties: - lastTransitionTime: - description: |- - LastTransitionTime is the timestamp corresponding to the last status - change of this condition. - type: string - format: date-time - message: - description: |- - Message is a human readable description of the details of the last - transition, complementing reason. - type: string - observedGeneration: - description: |- - If set, this represents the .metadata.generation that the condition was - set based upon. - For instance, if .metadata.generation is currently 12, but the - .status.condition[x].observedGeneration is 9, the condition is out of date - with respect to the current state of the Certificate. - type: integer - format: int64 - reason: - description: |- - Reason is a brief machine readable explanation for the condition's last - transition. - type: string - status: - description: Status of the condition, one of (`True`, `False`, `Unknown`). - type: string - enum: - - "True" - - "False" - - Unknown - type: - description: Type of the condition, known values are (`Ready`, `Issuing`). - type: string - x-kubernetes-list-map-keys: - - type - x-kubernetes-list-type: map - failedIssuanceAttempts: - description: |- - The number of continuous failed issuance attempts up till now. This - field gets removed (if set) on a successful issuance and gets set to - 1 if unset and an issuance has failed. If an issuance has failed, the - delay till the next issuance will be calculated using formula - time.Hour * 2 ^ (failedIssuanceAttempts - 1). - type: integer - lastFailureTime: - description: |- - LastFailureTime is set only if the latest issuance for this - Certificate failed and contains the time of the failure. If an - issuance has failed, the delay till the next issuance will be - calculated using formula time.Hour * 2 ^ (failedIssuanceAttempts - - 1). If the latest issuance has succeeded this field will be unset. - type: string - format: date-time - nextPrivateKeySecretName: - description: |- - The name of the Secret resource containing the private key to be used - for the next certificate iteration. - The keymanager controller will automatically set this field if the - `Issuing` condition is set to `True`. - It will automatically unset this field when the Issuing condition is - not set or False. - type: string - notAfter: - description: |- - The expiration time of the certificate stored in the secret named - by this resource in `spec.secretName`. - type: string - format: date-time - notBefore: - description: |- - The time after which the certificate stored in the secret named - by this resource in `spec.secretName` is valid. - type: string - format: date-time - renewalTime: - description: |- - RenewalTime is the time at which the certificate will be next - renewed. - If not set, no upcoming renewal is scheduled. - type: string - format: date-time - revision: - description: |- - The current 'revision' of the certificate as issued. + The `region` field is not needed if you use [IAM Roles for Service Accounts (IRSA)](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html). + Instead an AWS_REGION environment variable is added to the cert-manager controller Pod by: + [Amazon EKS Pod Identity Webhook](https://github.com/aws/amazon-eks-pod-identity-webhook). + In this case this `region` field value is ignored. - When a CertificateRequest resource is created, it will have the - `cert-manager.io/certificate-revision` set to one greater than the - current value of this field. + The `region` field is not needed if you use [EKS Pod Identities](https://docs.aws.amazon.com/eks/latest/userguide/pod-identities.html). + Instead an AWS_REGION environment variable is added to the cert-manager controller Pod by: + [Amazon EKS Pod Identity Agent](https://github.com/aws/eks-pod-identity-agent), + In this case this `region` field value is ignored. + type: string + role: + description: |- + Role is a Role ARN which the Route53 provider will assume using either the explicit credentials AccessKeyID/SecretAccessKey + or the inferred credentials from environment variables, shared credentials file or AWS Instance metadata + type: string + secretAccessKeySecretRef: + description: |- + The SecretAccessKey is used for authentication. + If neither the Access Key nor Key ID are set, we fall back to using env + vars, shared credentials file, or AWS Instance metadata, + see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + required: + - name + type: object + type: object + webhook: + description: |- + Configure an external webhook based DNS01 challenge solver to manage + DNS01 challenge records. + properties: + config: + description: |- + Additional configuration that should be passed to the webhook apiserver + when challenges are processed. + This can contain arbitrary JSON data. + Secret values should not be specified in this stanza. + If secret values are needed (e.g., credentials for a DNS service), you + should use a SecretKeySelector to reference a Secret resource. + For details on the schema of this field, consult the webhook provider + implementation's documentation. + x-kubernetes-preserve-unknown-fields: true + groupName: + description: |- + The API group name that should be used when POSTing ChallengePayload + resources to the webhook apiserver. + This should be the same as the GroupName specified in the webhook + provider implementation. + type: string + solverName: + description: |- + The name of the solver to use, as defined in the webhook provider + implementation. + This will typically be the name of the provider, e.g., 'cloudflare'. + type: string + required: + - groupName + - solverName + type: object + type: object + http01: + description: |- + Configures cert-manager to attempt to complete authorizations by + performing the HTTP01 challenge flow. + It is not possible to obtain certificates for wildcard domain names + (e.g., `*.example.com`) using the HTTP01 challenge mechanism. + properties: + gatewayHTTPRoute: + description: |- + The Gateway API is a sig-network community API that models service networking + in Kubernetes (https://gateway-api.sigs.k8s.io/). The Gateway solver will + create HTTPRoutes with the specified labels in the same namespace as the challenge. + This solver is experimental, and fields / behaviour may change in the future. + properties: + labels: + additionalProperties: + type: string + description: |- + Custom labels that will be applied to HTTPRoutes created by cert-manager + while solving HTTP-01 challenges. + type: object + parentRefs: + description: |- + When solving an HTTP-01 challenge, cert-manager creates an HTTPRoute. + cert-manager needs to know which parentRefs should be used when creating + the HTTPRoute. Usually, the parentRef references a Gateway. See: + https://gateway-api.sigs.k8s.io/api-types/httproute/#attaching-to-gateways + items: + description: |- + ParentReference identifies an API object (usually a Gateway) that can be considered + a parent of this resource (usually a route). There are two kinds of parent resources + with "Core" support: - Upon issuance, this field will be set to the value of the annotation - on the CertificateRequest resource used to issue the certificate. + * Gateway (Gateway conformance profile) + * Service (Mesh conformance profile, ClusterIP Services only) - Persisting the value on the CertificateRequest resource allows the - certificates controller to know whether a request is part of an old - issuance or if it is part of the ongoing revision's issuance by - checking if the revision value in the annotation is greater than this - field. - type: integer - served: true - storage: true - -# END crd ---- -# Source: cert-manager/templates/crds.yaml -# START crd -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - name: challenges.acme.cert-manager.io - # START annotations - annotations: - helm.sh/resource-policy: keep - # END annotations - labels: - app: 'cert-manager' - app.kubernetes.io/name: 'cert-manager' - app.kubernetes.io/instance: 'cert-manager' - # Generated labels - app.kubernetes.io/version: "v1.17.0" - app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.17.0 -spec: - group: acme.cert-manager.io - names: - kind: Challenge - listKind: ChallengeList - plural: challenges - singular: challenge - categories: - - cert-manager - - cert-manager-acme - scope: Namespaced - versions: - - additionalPrinterColumns: - - jsonPath: .status.state - name: State - type: string - - jsonPath: .spec.dnsName - name: Domain - type: string - - jsonPath: .status.reason - name: Reason - priority: 1 - type: string - - description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1 - schema: - openAPIV3Schema: - description: Challenge is a type to represent a Challenge request with an ACME server - type: object - required: - - metadata - - spec - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - type: object - required: - - authorizationURL - - dnsName - - issuerRef - - key - - solver - - token - - type - - url - properties: - authorizationURL: - description: |- - The URL to the ACME Authorization resource that this - challenge is a part of. - type: string - dnsName: - description: |- - dnsName is the identifier that this challenge is for, e.g. example.com. - If the requested DNSName is a 'wildcard', this field MUST be set to the - non-wildcard domain, e.g. for `*.example.com`, it must be `example.com`. - type: string - issuerRef: - description: |- - References a properly configured ACME-type Issuer which should - be used to create this Challenge. - If the Issuer does not exist, processing will be retried. - If the Issuer is not an 'ACME' Issuer, an error will be returned and the - Challenge will be marked as failed. - type: object - required: - - name - properties: - group: - description: Group of the resource being referred to. - type: string - kind: - description: Kind of the resource being referred to. - type: string - name: - description: Name of the resource being referred to. - type: string - key: - description: |- - The ACME challenge key for this challenge - For HTTP01 challenges, this is the value that must be responded with to - complete the HTTP01 challenge in the format: - `.`. - For DNS01 challenges, this is the base64 encoded SHA256 sum of the - `.` - text that must be set as the TXT record content. - type: string - solver: - description: |- - Contains the domain solving configuration that should be used to - solve this challenge resource. - type: object - properties: - dns01: - description: |- - Configures cert-manager to attempt to complete authorizations by - performing the DNS01 challenge flow. - type: object - properties: - acmeDNS: - description: |- - Use the 'ACME DNS' (https://github.com/joohoi/acme-dns) API to manage - DNS01 challenge records. - type: object - required: - - accountSecretRef - - host - properties: - accountSecretRef: - description: |- - A reference to a specific 'key' within a Secret resource. - In some instances, `key` is a required field. - type: object - required: - - name - properties: - key: - description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. - type: string - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - host: - type: string - akamai: - description: Use the Akamai DNS zone management API to manage DNS01 challenge records. - type: object - required: - - accessTokenSecretRef - - clientSecretSecretRef - - clientTokenSecretRef - - serviceConsumerDomain - properties: - accessTokenSecretRef: - description: |- - A reference to a specific 'key' within a Secret resource. - In some instances, `key` is a required field. - type: object - required: - - name - properties: - key: - description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. - type: string - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - clientSecretSecretRef: - description: |- - A reference to a specific 'key' within a Secret resource. - In some instances, `key` is a required field. - type: object - required: - - name - properties: - key: - description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. - type: string - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - clientTokenSecretRef: - description: |- - A reference to a specific 'key' within a Secret resource. - In some instances, `key` is a required field. - type: object - required: - - name - properties: - key: - description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. - type: string - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - serviceConsumerDomain: - type: string - azureDNS: - description: Use the Microsoft Azure DNS API to manage DNS01 challenge records. - type: object - required: - - resourceGroupName - - subscriptionID - properties: - clientID: - description: |- - Auth: Azure Service Principal: - The ClientID of the Azure Service Principal used to authenticate with Azure DNS. - If set, ClientSecret and TenantID must also be set. - type: string - clientSecretSecretRef: - description: |- - Auth: Azure Service Principal: - A reference to a Secret containing the password associated with the Service Principal. - If set, ClientID and TenantID must also be set. - type: object - required: - - name - properties: - key: - description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. - type: string - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - environment: - description: name of the Azure environment (default AzurePublicCloud) - type: string - enum: - - AzurePublicCloud - - AzureChinaCloud - - AzureGermanCloud - - AzureUSGovernmentCloud - hostedZoneName: - description: name of the DNS zone that should be used - type: string - managedIdentity: - description: |- - Auth: Azure Workload Identity or Azure Managed Service Identity: - Settings to enable Azure Workload Identity or Azure Managed Service Identity - If set, ClientID, ClientSecret and TenantID must not be set. - type: object - properties: - clientID: - description: client ID of the managed identity, can not be used at the same time as resourceID - type: string - resourceID: - description: |- - resource ID of the managed identity, can not be used at the same time as clientID - Cannot be used for Azure Managed Service Identity - type: string - tenantID: - description: tenant ID of the managed identity, can not be used at the same time as resourceID - type: string - resourceGroupName: - description: resource group the DNS zone is located in - type: string - subscriptionID: - description: ID of the Azure subscription - type: string - tenantID: - description: |- - Auth: Azure Service Principal: - The TenantID of the Azure Service Principal used to authenticate with Azure DNS. - If set, ClientID and ClientSecret must also be set. - type: string - cloudDNS: - description: Use the Google Cloud DNS API to manage DNS01 challenge records. - type: object - required: - - project - properties: - hostedZoneName: - description: |- - HostedZoneName is an optional field that tells cert-manager in which - Cloud DNS zone the challenge record has to be created. - If left empty cert-manager will automatically choose a zone. - type: string - project: - type: string - serviceAccountSecretRef: - description: |- - A reference to a specific 'key' within a Secret resource. - In some instances, `key` is a required field. - type: object - required: - - name - properties: - key: - description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. - type: string - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - cloudflare: - description: Use the Cloudflare API to manage DNS01 challenge records. - type: object - properties: - apiKeySecretRef: - description: |- - API key to use to authenticate with Cloudflare. - Note: using an API token to authenticate is now the recommended method - as it allows greater control of permissions. - type: object - required: - - name - properties: - key: - description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. - type: string - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - apiTokenSecretRef: - description: API token used to authenticate with Cloudflare. - type: object - required: - - name - properties: - key: - description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. - type: string - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - email: - description: Email of the account, only required when using API key based authentication. - type: string - cnameStrategy: - description: |- - CNAMEStrategy configures how the DNS01 provider should handle CNAME - records when found in DNS zones. - type: string - enum: - - None - - Follow - digitalocean: - description: Use the DigitalOcean DNS API to manage DNS01 challenge records. - type: object - required: - - tokenSecretRef - properties: - tokenSecretRef: - description: |- - A reference to a specific 'key' within a Secret resource. - In some instances, `key` is a required field. - type: object - required: - - name - properties: - key: - description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. - type: string - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - rfc2136: - description: |- - Use RFC2136 ("Dynamic Updates in the Domain Name System") (https://datatracker.ietf.org/doc/rfc2136/) - to manage DNS01 challenge records. - type: object - required: - - nameserver - properties: - nameserver: - description: |- - The IP address or hostname of an authoritative DNS server supporting - RFC2136 in the form host:port. If the host is an IPv6 address it must be - enclosed in square brackets (e.g [2001:db8::1]) ; port is optional. - This field is required. - type: string - tsigAlgorithm: - description: |- - The TSIG Algorithm configured in the DNS supporting RFC2136. Used only - when ``tsigSecretSecretRef`` and ``tsigKeyName`` are defined. - Supported values are (case-insensitive): ``HMACMD5`` (default), - ``HMACSHA1``, ``HMACSHA256`` or ``HMACSHA512``. - type: string - tsigKeyName: - description: |- - The TSIG Key name configured in the DNS. - If ``tsigSecretSecretRef`` is defined, this field is required. - type: string - tsigSecretSecretRef: - description: |- - The name of the secret containing the TSIG value. - If ``tsigKeyName`` is defined, this field is required. - type: object - required: - - name - properties: - key: - description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. - type: string - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - route53: - description: Use the AWS Route53 API to manage DNS01 challenge records. - type: object - properties: - accessKeyID: - description: |- - The AccessKeyID is used for authentication. - Cannot be set when SecretAccessKeyID is set. - If neither the Access Key nor Key ID are set, we fall-back to using env - vars, shared credentials file or AWS Instance metadata, - see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials - type: string - accessKeyIDSecretRef: - description: |- - The SecretAccessKey is used for authentication. If set, pull the AWS - access key ID from a key within a Kubernetes Secret. - Cannot be set when AccessKeyID is set. - If neither the Access Key nor Key ID are set, we fall-back to using env - vars, shared credentials file or AWS Instance metadata, - see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials - type: object - required: - - name - properties: - key: - description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. - type: string - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - auth: - description: Auth configures how cert-manager authenticates. - type: object - required: - - kubernetes - properties: - kubernetes: - description: |- - Kubernetes authenticates with Route53 using AssumeRoleWithWebIdentity - by passing a bound ServiceAccount token. - type: object - required: - - serviceAccountRef - properties: - serviceAccountRef: - description: |- - A reference to a service account that will be used to request a bound - token (also known as "projected token"). To use this field, you must - configure an RBAC rule to let cert-manager request a token. - type: object - required: - - name - properties: - audiences: - description: |- - TokenAudiences is an optional list of audiences to include in the - token passed to AWS. The default token consisting of the issuer's namespace - and name is always included. - If unset the audience defaults to `sts.amazonaws.com`. - type: array - items: - type: string - name: - description: Name of the ServiceAccount used to request a token. - type: string - hostedZoneID: - description: If set, the provider will manage only this zone in Route53 and will not do a lookup using the route53:ListHostedZonesByName api call. - type: string - region: - description: |- - Override the AWS region. - - Route53 is a global service and does not have regional endpoints but the - region specified here (or via environment variables) is used as a hint to - help compute the correct AWS credential scope and partition when it - connects to Route53. See: - - [Amazon Route 53 endpoints and quotas](https://docs.aws.amazon.com/general/latest/gr/r53.html) - - [Global services](https://docs.aws.amazon.com/whitepapers/latest/aws-fault-isolation-boundaries/global-services.html) - - If you omit this region field, cert-manager will use the region from - AWS_REGION and AWS_DEFAULT_REGION environment variables, if they are set - in the cert-manager controller Pod. - - The `region` field is not needed if you use [IAM Roles for Service Accounts (IRSA)](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html). - Instead an AWS_REGION environment variable is added to the cert-manager controller Pod by: - [Amazon EKS Pod Identity Webhook](https://github.com/aws/amazon-eks-pod-identity-webhook). - In this case this `region` field value is ignored. - - The `region` field is not needed if you use [EKS Pod Identities](https://docs.aws.amazon.com/eks/latest/userguide/pod-identities.html). - Instead an AWS_REGION environment variable is added to the cert-manager controller Pod by: - [Amazon EKS Pod Identity Agent](https://github.com/aws/eks-pod-identity-agent), - In this case this `region` field value is ignored. - type: string - role: - description: |- - Role is a Role ARN which the Route53 provider will assume using either the explicit credentials AccessKeyID/SecretAccessKey - or the inferred credentials from environment variables, shared credentials file or AWS Instance metadata - type: string - secretAccessKeySecretRef: - description: |- - The SecretAccessKey is used for authentication. - If neither the Access Key nor Key ID are set, we fall-back to using env - vars, shared credentials file or AWS Instance metadata, - see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials - type: object - required: - - name - properties: - key: - description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. - type: string - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - webhook: - description: |- - Configure an external webhook based DNS01 challenge solver to manage - DNS01 challenge records. - type: object - required: - - groupName - - solverName - properties: - config: - description: |- - Additional configuration that should be passed to the webhook apiserver - when challenges are processed. - This can contain arbitrary JSON data. - Secret values should not be specified in this stanza. - If secret values are needed (e.g. credentials for a DNS service), you - should use a SecretKeySelector to reference a Secret resource. - For details on the schema of this field, consult the webhook provider - implementation's documentation. - x-kubernetes-preserve-unknown-fields: true - groupName: - description: |- - The API group name that should be used when POSTing ChallengePayload - resources to the webhook apiserver. - This should be the same as the GroupName specified in the webhook - provider implementation. - type: string - solverName: - description: |- - The name of the solver to use, as defined in the webhook provider - implementation. - This will typically be the name of the provider, e.g. 'cloudflare'. - type: string - http01: - description: |- - Configures cert-manager to attempt to complete authorizations by - performing the HTTP01 challenge flow. - It is not possible to obtain certificates for wildcard domain names - (e.g. `*.example.com`) using the HTTP01 challenge mechanism. - type: object - properties: - gatewayHTTPRoute: - description: |- - The Gateway API is a sig-network community API that models service networking - in Kubernetes (https://gateway-api.sigs.k8s.io/). The Gateway solver will - create HTTPRoutes with the specified labels in the same namespace as the challenge. - This solver is experimental, and fields / behaviour may change in the future. - type: object - properties: - labels: - description: |- - Custom labels that will be applied to HTTPRoutes created by cert-manager - while solving HTTP-01 challenges. - type: object - additionalProperties: - type: string - parentRefs: - description: |- - When solving an HTTP-01 challenge, cert-manager creates an HTTPRoute. - cert-manager needs to know which parentRefs should be used when creating - the HTTPRoute. Usually, the parentRef references a Gateway. See: - https://gateway-api.sigs.k8s.io/api-types/httproute/#attaching-to-gateways - type: array - items: - description: |- - ParentReference identifies an API object (usually a Gateway) that can be considered - a parent of this resource (usually a route). There are two kinds of parent resources - with "Core" support: - - * Gateway (Gateway conformance profile) - * Service (Mesh conformance profile, ClusterIP Services only) - - This API may be extended in the future to support additional kinds of parent - resources. + This API may be extended in the future to support additional kinds of parent + resources. The API object must be valid in the cluster; the Group and Kind must be registered in the cluster for this reference to be valid. - type: object - required: - - name properties: group: + default: gateway.networking.k8s.io description: |- Group is the group of the referent. When unspecified, "gateway.networking.k8s.io" is inferred. @@ -1844,11 +742,11 @@ spec: Group must be explicitly set to "" (empty string). Support: Core - type: string - default: gateway.networking.k8s.io maxLength: 253 pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string kind: + default: Gateway description: |- Kind is kind of the referent. @@ -1858,19 +756,18 @@ spec: * Service (Mesh conformance profile, ClusterIP Services only) Support for other resources is Implementation-Specific. - type: string - default: Gateway maxLength: 63 minLength: 1 pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string name: description: |- Name is the name of the referent. Support: Core - type: string maxLength: 253 minLength: 1 + type: string namespace: description: |- Namespace is the namespace of the referent. When unspecified, this refers @@ -1895,10 +792,10 @@ spec: Support: Core - type: string maxLength: 63 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string port: description: |- Port is the network port this Route targets. It can be interpreted @@ -1931,10 +828,10 @@ spec: the Route MUST be considered detached from the Gateway. Support: Extended - type: integer format: int32 maximum: 65535 minimum: 1 + type: integer sectionName: description: |- SectionName is the name of a section within the target resource. In the @@ -1961,15 +858,19 @@ spec: Route MUST be considered detached from the Gateway. Support: Core - type: string maxLength: 253 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + required: + - name + type: object + type: array + x-kubernetes-list-type: atomic podTemplate: description: |- Optional pod template used to configure the ACME challenge solver pods used for HTTP01 challenges. - type: object properties: metadata: description: |- @@ -1977,32 +878,29 @@ spec: Only the 'labels' and 'annotations' fields may be set. If labels or annotations overlap with in-built values, the values here will override the in-built values. - type: object properties: annotations: + additionalProperties: + type: string description: Annotations that should be added to the created ACME HTTP01 solver pods. type: object + labels: additionalProperties: type: string - labels: description: Labels that should be added to the created ACME HTTP01 solver pods. type: object - additionalProperties: - type: string + type: object spec: description: |- PodSpec defines overrides for the HTTP01 challenge solver pod. Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields. All other fields will be ignored. - type: object properties: affinity: description: If specified, the pod's scheduling constraints - type: object properties: nodeAffinity: description: Describes node affinity scheduling rules for the pod. - type: object properties: preferredDuringSchedulingIgnoredDuringExecution: description: |- @@ -2015,31 +913,20 @@ spec: compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node matches the corresponding matchExpressions; the node(s) with the highest sum are the most preferred. - type: array items: description: |- An empty preferred scheduling term matches all objects with implicit weight 0 (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). - type: object - required: - - preference - - weight properties: preference: description: A node selector term, associated with the corresponding weight. - type: object properties: matchExpressions: description: A list of node selector requirements by node's labels. - type: array items: description: |- A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator properties: key: description: The label key that the selector applies to. @@ -2056,22 +943,22 @@ spec: the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. - type: array items: type: string + type: array x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array x-kubernetes-list-type: atomic matchFields: description: A list of node selector requirements by node's fields. - type: array items: description: |- A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator properties: key: description: The label key that the selector applies to. @@ -2088,16 +975,27 @@ spec: the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. - type: array items: type: string + type: array x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array x-kubernetes-list-type: atomic + type: object x-kubernetes-map-type: atomic weight: description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100. - type: integer format: int32 + type: integer + required: + - preference + - weight + type: object + type: array x-kubernetes-list-type: atomic requiredDuringSchedulingIgnoredDuringExecution: description: |- @@ -2106,31 +1004,21 @@ spec: If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to an update), the system may or may not try to eventually evict the pod from its node. - type: object - required: - - nodeSelectorTerms properties: nodeSelectorTerms: description: Required. A list of node selector terms. The terms are ORed. - type: array items: description: |- A null or empty node selector term matches no objects. The requirements of them are ANDed. The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. - type: object properties: matchExpressions: description: A list of node selector requirements by node's labels. - type: array items: description: |- A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator properties: key: description: The label key that the selector applies to. @@ -2147,22 +1035,22 @@ spec: the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. - type: array items: type: string + type: array x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array x-kubernetes-list-type: atomic matchFields: description: A list of node selector requirements by node's fields. - type: array items: description: |- A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator properties: key: description: The label key that the selector applies to. @@ -2179,17 +1067,27 @@ spec: the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. - type: array items: type: string + type: array x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array x-kubernetes-list-type: atomic + type: object x-kubernetes-map-type: atomic + type: array x-kubernetes-list-type: atomic + required: + - nodeSelectorTerms + type: object x-kubernetes-map-type: atomic + type: object podAffinity: description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)). - type: object properties: preferredDuringSchedulingIgnoredDuringExecution: description: |- @@ -2202,37 +1100,23 @@ spec: compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. - type: array items: description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) - type: object - required: - - podAffinityTerm - - weight properties: podAffinityTerm: description: Required. A pod affinity term, associated with the corresponding weight. - type: object - required: - - topologyKey properties: labelSelector: description: |- A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods. - type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator properties: key: description: key is the label key that the selector applies to. @@ -2248,19 +1132,25 @@ spec: the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array items: type: string + type: array x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array x-kubernetes-list-type: atomic matchLabels: + additionalProperties: + type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - additionalProperties: - type: string + type: object x-kubernetes-map-type: atomic matchLabelKeys: description: |- @@ -2272,10 +1162,9 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). - type: array items: type: string + type: array x-kubernetes-list-type: atomic mismatchLabelKeys: description: |- @@ -2287,10 +1176,9 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). - type: array items: type: string + type: array x-kubernetes-list-type: atomic namespaceSelector: description: |- @@ -2299,19 +1187,13 @@ spec: and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. - type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator properties: key: description: key is the label key that the selector applies to. @@ -2327,19 +1209,25 @@ spec: the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array items: type: string + type: array x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array x-kubernetes-list-type: atomic matchLabels: + additionalProperties: + type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - additionalProperties: - type: string + type: object x-kubernetes-map-type: atomic namespaces: description: |- @@ -2347,9 +1235,9 @@ spec: The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". - type: array items: type: string + type: array x-kubernetes-list-type: atomic topologyKey: description: |- @@ -2359,12 +1247,20 @@ spec: selected pods is running. Empty topologyKey is not allowed. type: string + required: + - topologyKey + type: object weight: description: |- weight associated with matching the corresponding podAffinityTerm, in the range 1-100. - type: integer format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array x-kubernetes-list-type: atomic requiredDuringSchedulingIgnoredDuringExecution: description: |- @@ -2375,7 +1271,6 @@ spec: system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied. - type: array items: description: |- Defines a set of pods (namely those matching the labelSelector @@ -2384,27 +1279,18 @@ spec: where co-located is defined as running on a node whose value of the label with key matches that of any node on which a pod of the set of pods is running - type: object - required: - - topologyKey properties: labelSelector: description: |- A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods. - type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator properties: key: description: key is the label key that the selector applies to. @@ -2420,19 +1306,25 @@ spec: the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array items: type: string + type: array x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array x-kubernetes-list-type: atomic matchLabels: + additionalProperties: + type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - additionalProperties: - type: string + type: object x-kubernetes-map-type: atomic matchLabelKeys: description: |- @@ -2444,10 +1336,9 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). - type: array items: type: string + type: array x-kubernetes-list-type: atomic mismatchLabelKeys: description: |- @@ -2459,10 +1350,9 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). - type: array items: type: string + type: array x-kubernetes-list-type: atomic namespaceSelector: description: |- @@ -2471,19 +1361,13 @@ spec: and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. - type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator properties: key: description: key is the label key that the selector applies to. @@ -2499,19 +1383,25 @@ spec: the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array items: type: string + type: array x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array x-kubernetes-list-type: atomic matchLabels: + additionalProperties: + type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - additionalProperties: - type: string + type: object x-kubernetes-map-type: atomic namespaces: description: |- @@ -2519,9 +1409,9 @@ spec: The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". - type: array items: type: string + type: array x-kubernetes-list-type: atomic topologyKey: description: |- @@ -2531,10 +1421,14 @@ spec: selected pods is running. Empty topologyKey is not allowed. type: string + required: + - topologyKey + type: object + type: array x-kubernetes-list-type: atomic + type: object podAntiAffinity: description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)). - type: object properties: preferredDuringSchedulingIgnoredDuringExecution: description: |- @@ -2544,40 +1438,26 @@ spec: most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling anti-affinity expressions, etc.), - compute a sum by iterating through the elements of this field and adding - "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + compute a sum by iterating through the elements of this field and subtracting + "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. - type: array items: description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) - type: object - required: - - podAffinityTerm - - weight properties: podAffinityTerm: description: Required. A pod affinity term, associated with the corresponding weight. - type: object - required: - - topologyKey properties: labelSelector: description: |- A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods. - type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator properties: key: description: key is the label key that the selector applies to. @@ -2593,19 +1473,25 @@ spec: the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array items: type: string + type: array x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array x-kubernetes-list-type: atomic matchLabels: + additionalProperties: + type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - additionalProperties: - type: string + type: object x-kubernetes-map-type: atomic matchLabelKeys: description: |- @@ -2617,10 +1503,9 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). - type: array items: type: string + type: array x-kubernetes-list-type: atomic mismatchLabelKeys: description: |- @@ -2632,10 +1517,9 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). - type: array items: type: string + type: array x-kubernetes-list-type: atomic namespaceSelector: description: |- @@ -2644,19 +1528,13 @@ spec: and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. - type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator properties: key: description: key is the label key that the selector applies to. @@ -2672,19 +1550,25 @@ spec: the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array items: type: string + type: array x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array x-kubernetes-list-type: atomic matchLabels: + additionalProperties: + type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - additionalProperties: - type: string + type: object x-kubernetes-map-type: atomic namespaces: description: |- @@ -2692,9 +1576,9 @@ spec: The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". - type: array items: type: string + type: array x-kubernetes-list-type: atomic topologyKey: description: |- @@ -2704,12 +1588,20 @@ spec: selected pods is running. Empty topologyKey is not allowed. type: string + required: + - topologyKey + type: object weight: description: |- weight associated with matching the corresponding podAffinityTerm, in the range 1-100. - type: integer format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array x-kubernetes-list-type: atomic requiredDuringSchedulingIgnoredDuringExecution: description: |- @@ -2720,7 +1612,6 @@ spec: system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied. - type: array items: description: |- Defines a set of pods (namely those matching the labelSelector @@ -2729,27 +1620,18 @@ spec: where co-located is defined as running on a node whose value of the label with key matches that of any node on which a pod of the set of pods is running - type: object - required: - - topologyKey properties: labelSelector: description: |- A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods. - type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator properties: key: description: key is the label key that the selector applies to. @@ -2765,19 +1647,25 @@ spec: the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array items: type: string + type: array x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array x-kubernetes-list-type: atomic matchLabels: + additionalProperties: + type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - additionalProperties: - type: string + type: object x-kubernetes-map-type: atomic matchLabelKeys: description: |- @@ -2789,10 +1677,9 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). - type: array items: type: string + type: array x-kubernetes-list-type: atomic mismatchLabelKeys: description: |- @@ -2804,10 +1691,9 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). - type: array items: type: string + type: array x-kubernetes-list-type: atomic namespaceSelector: description: |- @@ -2816,19 +1702,13 @@ spec: and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. - type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator properties: key: description: key is the label key that the selector applies to. @@ -2844,19 +1724,25 @@ spec: the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array items: type: string + type: array x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array x-kubernetes-list-type: atomic matchLabels: + additionalProperties: + type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - additionalProperties: - type: string + type: object x-kubernetes-map-type: atomic namespaces: description: |- @@ -2864,9 +1750,9 @@ spec: The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". - type: array items: type: string + type: array x-kubernetes-list-type: atomic topologyKey: description: |- @@ -2876,17 +1762,22 @@ spec: selected pods is running. Empty topologyKey is not allowed. type: string + required: + - topologyKey + type: object + type: array x-kubernetes-list-type: atomic + type: object + type: object imagePullSecrets: description: If specified, the pod's imagePullSecrets - type: array items: description: |- LocalObjectReference contains enough information to let you locate the referenced object inside the same namespace. - type: object properties: name: + default: "" description: |- Name of the referent. This field is effectively required, but due to backwards compatibility is @@ -2894,22 +1785,59 @@ spec: almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string - default: "" + type: object x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map nodeSelector: + additionalProperties: + type: string description: |- NodeSelector is a selector which must be true for the pod to fit on a node. Selector which must match a node's labels for the pod to be scheduled on that node. More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ type: object - additionalProperties: - type: string priorityClassName: description: If specified, the pod's priorityClassName. type: string + resources: + description: |- + If specified, the pod's resource requirements. + These values override the global resource configuration flags. + Note that when only specifying resource limits, ensure they are greater than or equal + to the corresponding global resource requests configured via controller flags + (--acme-http01-solver-resource-request-cpu, --acme-http01-solver-resource-request-memory). + Kubernetes will reject pod creation if limits are lower than requests, causing challenge failures. + properties: + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to the global values configured via controller flags. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object securityContext: description: If specified, the pod's security context - type: object properties: fsGroup: description: |- @@ -2923,8 +1851,8 @@ spec: If unset, the Kubelet will not modify the ownership and permissions of any volume. Note that this field cannot be set when spec.os.name is windows. - type: integer format: int64 + type: integer fsGroupChangePolicy: description: |- fsGroupChangePolicy defines behavior of changing ownership and permission of the volume @@ -2943,8 +1871,8 @@ spec: PodSecurityContext, the value specified in SecurityContext takes precedence for that container. Note that this field cannot be set when spec.os.name is windows. - type: integer format: int64 + type: integer runAsNonRoot: description: |- Indicates that the container must run as a non-root user. @@ -2962,8 +1890,8 @@ spec: PodSecurityContext, the value specified in SecurityContext takes precedence for that container. Note that this field cannot be set when spec.os.name is windows. - type: integer format: int64 + type: integer seLinuxOptions: description: |- The SELinux context to be applied to all containers. @@ -2972,7 +1900,6 @@ spec: both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence for that container. Note that this field cannot be set when spec.os.name is windows. - type: object properties: level: description: Level is SELinux level label that applies to the container. @@ -2986,13 +1913,11 @@ spec: user: description: User is a SELinux user label that applies to the container. type: string + type: object seccompProfile: description: |- The seccomp options to use by the containers in this pod. Note that this field cannot be set when spec.os.name is windows. - type: object - required: - - type properties: localhostProfile: description: |- @@ -3010,6 +1935,9 @@ spec: RuntimeDefault - the container runtime default profile should be used. Unconfined - no profile should be applied. type: string + required: + - type + type: object supplementalGroups: description: |- A list of groups applied to the first process run in each container, in addition @@ -3019,22 +1947,18 @@ spec: defined in the container image for the uid of the container process are still effective, even if they are not included in this list. Note that this field cannot be set when spec.os.name is windows. - type: array items: - type: integer format: int64 + type: integer + type: array + x-kubernetes-list-type: atomic sysctls: description: |- Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported sysctls (by the container runtime) might fail to launch. Note that this field cannot be set when spec.os.name is windows. - type: array items: description: Sysctl defines a kernel parameter to be set - type: object - required: - - name - - value properties: name: description: Name of a property to set @@ -3042,17 +1966,22 @@ spec: value: description: Value of a property to set type: string + required: + - name + - value + type: object + type: array + x-kubernetes-list-type: atomic + type: object serviceAccountName: description: If specified, the pod's service account type: string tolerations: description: If specified, the pod's tolerations. - type: array items: description: |- The pod this Toleration is attached to tolerates any taint that matches the triple using the matching operator . - type: object properties: effect: description: |- @@ -3067,9 +1996,10 @@ spec: operator: description: |- Operator represents a key's relationship to the value. - Valid operators are Exists and Equal. Defaults to Equal. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). type: string tolerationSeconds: description: |- @@ -3077,25 +2007,30 @@ spec: of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, it is not set, which means tolerate the taint forever (do not evict). Zero and negative values will be treated as 0 (evict immediately) by the system. - type: integer format: int64 + type: integer value: description: |- Value is the taint value the toleration matches to. If the operator is Exists, the value should be empty, otherwise just a regular string. type: string + type: object + type: array + x-kubernetes-list-type: atomic + type: object + type: object serviceType: description: |- Optional service type for Kubernetes solver service. Supported values are NodePort or ClusterIP. If unset, defaults to NodePort. type: string + type: object ingress: description: |- The ingress based HTTP01 challenge solver will solve challenges by creating or modifying Ingress resources in order to route requests for '/.well-known/acme-challenge/XYZ' to 'challenge solver' pods that are provisioned by cert-manager for each Challenge to be completed. - type: object properties: class: description: |- @@ -3115,7 +2050,6 @@ spec: description: |- Optional ingress template used to configure the ACME challenge solver ingress used for HTTP01 challenges. - type: object properties: metadata: description: |- @@ -3123,18 +2057,19 @@ spec: Only the 'labels' and 'annotations' fields may be set. If labels or annotations overlap with in-built values, the values here will override the in-built values. - type: object properties: annotations: + additionalProperties: + type: string description: Annotations that should be added to the created ACME HTTP01 solver ingress. type: object + labels: additionalProperties: type: string - labels: description: Labels that should be added to the created ACME HTTP01 solver ingress. type: object - additionalProperties: - type: string + type: object + type: object name: description: |- The name of the ingress resource that should have ACME challenge solving @@ -3148,7 +2083,6 @@ spec: description: |- Optional pod template used to configure the ACME challenge solver pods used for HTTP01 challenges. - type: object properties: metadata: description: |- @@ -3156,32 +2090,29 @@ spec: Only the 'labels' and 'annotations' fields may be set. If labels or annotations overlap with in-built values, the values here will override the in-built values. - type: object properties: annotations: + additionalProperties: + type: string description: Annotations that should be added to the created ACME HTTP01 solver pods. type: object + labels: additionalProperties: type: string - labels: description: Labels that should be added to the created ACME HTTP01 solver pods. type: object - additionalProperties: - type: string + type: object spec: description: |- PodSpec defines overrides for the HTTP01 challenge solver pod. Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields. All other fields will be ignored. - type: object properties: affinity: description: If specified, the pod's scheduling constraints - type: object properties: nodeAffinity: description: Describes node affinity scheduling rules for the pod. - type: object properties: preferredDuringSchedulingIgnoredDuringExecution: description: |- @@ -3194,31 +2125,20 @@ spec: compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node matches the corresponding matchExpressions; the node(s) with the highest sum are the most preferred. - type: array items: description: |- An empty preferred scheduling term matches all objects with implicit weight 0 (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). - type: object - required: - - preference - - weight properties: preference: description: A node selector term, associated with the corresponding weight. - type: object properties: matchExpressions: description: A list of node selector requirements by node's labels. - type: array items: description: |- A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator properties: key: description: The label key that the selector applies to. @@ -3235,22 +2155,22 @@ spec: the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. - type: array items: type: string + type: array x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array x-kubernetes-list-type: atomic matchFields: description: A list of node selector requirements by node's fields. - type: array items: description: |- A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator properties: key: description: The label key that the selector applies to. @@ -3267,16 +2187,27 @@ spec: the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. - type: array items: type: string + type: array x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array x-kubernetes-list-type: atomic + type: object x-kubernetes-map-type: atomic weight: description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100. - type: integer format: int32 + type: integer + required: + - preference + - weight + type: object + type: array x-kubernetes-list-type: atomic requiredDuringSchedulingIgnoredDuringExecution: description: |- @@ -3285,31 +2216,21 @@ spec: If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to an update), the system may or may not try to eventually evict the pod from its node. - type: object - required: - - nodeSelectorTerms properties: nodeSelectorTerms: description: Required. A list of node selector terms. The terms are ORed. - type: array items: description: |- A null or empty node selector term matches no objects. The requirements of them are ANDed. The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. - type: object properties: matchExpressions: description: A list of node selector requirements by node's labels. - type: array items: description: |- A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator properties: key: description: The label key that the selector applies to. @@ -3326,22 +2247,22 @@ spec: the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. - type: array items: type: string + type: array x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array x-kubernetes-list-type: atomic matchFields: description: A list of node selector requirements by node's fields. - type: array items: description: |- A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator properties: key: description: The label key that the selector applies to. @@ -3358,17 +2279,27 @@ spec: the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. - type: array items: type: string + type: array x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array x-kubernetes-list-type: atomic + type: object x-kubernetes-map-type: atomic + type: array x-kubernetes-list-type: atomic + required: + - nodeSelectorTerms + type: object x-kubernetes-map-type: atomic + type: object podAffinity: description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)). - type: object properties: preferredDuringSchedulingIgnoredDuringExecution: description: |- @@ -3381,37 +2312,23 @@ spec: compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. - type: array items: description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) - type: object - required: - - podAffinityTerm - - weight properties: podAffinityTerm: description: Required. A pod affinity term, associated with the corresponding weight. - type: object - required: - - topologyKey properties: labelSelector: description: |- A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods. - type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator properties: key: description: key is the label key that the selector applies to. @@ -3427,19 +2344,25 @@ spec: the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array items: type: string + type: array x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array x-kubernetes-list-type: atomic matchLabels: + additionalProperties: + type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - additionalProperties: - type: string + type: object x-kubernetes-map-type: atomic matchLabelKeys: description: |- @@ -3451,10 +2374,9 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). - type: array items: type: string + type: array x-kubernetes-list-type: atomic mismatchLabelKeys: description: |- @@ -3466,10 +2388,9 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). - type: array items: type: string + type: array x-kubernetes-list-type: atomic namespaceSelector: description: |- @@ -3478,19 +2399,13 @@ spec: and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. - type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator properties: key: description: key is the label key that the selector applies to. @@ -3506,19 +2421,25 @@ spec: the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array items: type: string + type: array x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array x-kubernetes-list-type: atomic matchLabels: + additionalProperties: + type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - additionalProperties: - type: string + type: object x-kubernetes-map-type: atomic namespaces: description: |- @@ -3526,9 +2447,9 @@ spec: The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". - type: array items: type: string + type: array x-kubernetes-list-type: atomic topologyKey: description: |- @@ -3538,12 +2459,20 @@ spec: selected pods is running. Empty topologyKey is not allowed. type: string + required: + - topologyKey + type: object weight: description: |- weight associated with matching the corresponding podAffinityTerm, in the range 1-100. - type: integer format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array x-kubernetes-list-type: atomic requiredDuringSchedulingIgnoredDuringExecution: description: |- @@ -3554,7 +2483,6 @@ spec: system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied. - type: array items: description: |- Defines a set of pods (namely those matching the labelSelector @@ -3563,27 +2491,18 @@ spec: where co-located is defined as running on a node whose value of the label with key matches that of any node on which a pod of the set of pods is running - type: object - required: - - topologyKey properties: labelSelector: description: |- A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods. - type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator properties: key: description: key is the label key that the selector applies to. @@ -3599,19 +2518,25 @@ spec: the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array items: type: string + type: array x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array x-kubernetes-list-type: atomic matchLabels: + additionalProperties: + type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - additionalProperties: - type: string + type: object x-kubernetes-map-type: atomic matchLabelKeys: description: |- @@ -3623,10 +2548,9 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). - type: array items: type: string + type: array x-kubernetes-list-type: atomic mismatchLabelKeys: description: |- @@ -3638,10 +2562,9 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). - type: array items: type: string + type: array x-kubernetes-list-type: atomic namespaceSelector: description: |- @@ -3650,19 +2573,13 @@ spec: and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. - type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator properties: key: description: key is the label key that the selector applies to. @@ -3678,19 +2595,25 @@ spec: the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array items: type: string + type: array x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array x-kubernetes-list-type: atomic matchLabels: + additionalProperties: + type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - additionalProperties: - type: string + type: object x-kubernetes-map-type: atomic namespaces: description: |- @@ -3698,9 +2621,9 @@ spec: The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". - type: array items: type: string + type: array x-kubernetes-list-type: atomic topologyKey: description: |- @@ -3710,10 +2633,14 @@ spec: selected pods is running. Empty topologyKey is not allowed. type: string + required: + - topologyKey + type: object + type: array x-kubernetes-list-type: atomic + type: object podAntiAffinity: description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)). - type: object properties: preferredDuringSchedulingIgnoredDuringExecution: description: |- @@ -3723,40 +2650,26 @@ spec: most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling anti-affinity expressions, etc.), - compute a sum by iterating through the elements of this field and adding - "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + compute a sum by iterating through the elements of this field and subtracting + "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. - type: array items: description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) - type: object - required: - - podAffinityTerm - - weight properties: podAffinityTerm: description: Required. A pod affinity term, associated with the corresponding weight. - type: object - required: - - topologyKey properties: labelSelector: description: |- A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods. - type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator properties: key: description: key is the label key that the selector applies to. @@ -3772,19 +2685,25 @@ spec: the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array items: type: string + type: array x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array x-kubernetes-list-type: atomic matchLabels: + additionalProperties: + type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - additionalProperties: - type: string + type: object x-kubernetes-map-type: atomic matchLabelKeys: description: |- @@ -3796,10 +2715,9 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). - type: array items: type: string + type: array x-kubernetes-list-type: atomic mismatchLabelKeys: description: |- @@ -3811,10 +2729,9 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). - type: array items: type: string + type: array x-kubernetes-list-type: atomic namespaceSelector: description: |- @@ -3823,19 +2740,13 @@ spec: and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. - type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator properties: key: description: key is the label key that the selector applies to. @@ -3851,19 +2762,25 @@ spec: the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array items: type: string + type: array x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array x-kubernetes-list-type: atomic matchLabels: + additionalProperties: + type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - additionalProperties: - type: string + type: object x-kubernetes-map-type: atomic namespaces: description: |- @@ -3871,9 +2788,9 @@ spec: The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". - type: array items: type: string + type: array x-kubernetes-list-type: atomic topologyKey: description: |- @@ -3883,12 +2800,20 @@ spec: selected pods is running. Empty topologyKey is not allowed. type: string + required: + - topologyKey + type: object weight: description: |- weight associated with matching the corresponding podAffinityTerm, in the range 1-100. - type: integer format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array x-kubernetes-list-type: atomic requiredDuringSchedulingIgnoredDuringExecution: description: |- @@ -3899,7 +2824,6 @@ spec: system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied. - type: array items: description: |- Defines a set of pods (namely those matching the labelSelector @@ -3908,27 +2832,18 @@ spec: where co-located is defined as running on a node whose value of the label with key matches that of any node on which a pod of the set of pods is running - type: object - required: - - topologyKey properties: labelSelector: description: |- A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods. - type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator properties: key: description: key is the label key that the selector applies to. @@ -3944,19 +2859,25 @@ spec: the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array items: type: string + type: array x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array x-kubernetes-list-type: atomic matchLabels: + additionalProperties: + type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - additionalProperties: - type: string + type: object x-kubernetes-map-type: atomic matchLabelKeys: description: |- @@ -3968,10 +2889,9 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). - type: array items: type: string + type: array x-kubernetes-list-type: atomic mismatchLabelKeys: description: |- @@ -3983,10 +2903,9 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). - type: array items: type: string + type: array x-kubernetes-list-type: atomic namespaceSelector: description: |- @@ -3995,19 +2914,13 @@ spec: and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. - type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator properties: key: description: key is the label key that the selector applies to. @@ -4023,19 +2936,25 @@ spec: the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array items: type: string + type: array x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array x-kubernetes-list-type: atomic matchLabels: + additionalProperties: + type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - additionalProperties: - type: string + type: object x-kubernetes-map-type: atomic namespaces: description: |- @@ -4043,9 +2962,9 @@ spec: The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". - type: array items: type: string + type: array x-kubernetes-list-type: atomic topologyKey: description: |- @@ -4055,17 +2974,22 @@ spec: selected pods is running. Empty topologyKey is not allowed. type: string + required: + - topologyKey + type: object + type: array x-kubernetes-list-type: atomic + type: object + type: object imagePullSecrets: description: If specified, the pod's imagePullSecrets - type: array items: description: |- LocalObjectReference contains enough information to let you locate the referenced object inside the same namespace. - type: object properties: name: + default: "" description: |- Name of the referent. This field is effectively required, but due to backwards compatibility is @@ -4073,22 +2997,59 @@ spec: almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string - default: "" + type: object x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map nodeSelector: + additionalProperties: + type: string description: |- NodeSelector is a selector which must be true for the pod to fit on a node. Selector which must match a node's labels for the pod to be scheduled on that node. More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ type: object - additionalProperties: - type: string priorityClassName: description: If specified, the pod's priorityClassName. type: string + resources: + description: |- + If specified, the pod's resource requirements. + These values override the global resource configuration flags. + Note that when only specifying resource limits, ensure they are greater than or equal + to the corresponding global resource requests configured via controller flags + (--acme-http01-solver-resource-request-cpu, --acme-http01-solver-resource-request-memory). + Kubernetes will reject pod creation if limits are lower than requests, causing challenge failures. + properties: + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to the global values configured via controller flags. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object securityContext: description: If specified, the pod's security context - type: object properties: fsGroup: description: |- @@ -4096,333 +3057,1921 @@ spec: Some volume types allow the Kubelet to change the ownership of that volume to be owned by the pod: - 1. The owning GID will be the FSGroup - 2. The setgid bit is set (new files created in the volume will be owned by FSGroup) - 3. The permission bits are OR'd with rw-rw---- + 1. The owning GID will be the FSGroup + 2. The setgid bit is set (new files created in the volume will be owned by FSGroup) + 3. The permission bits are OR'd with rw-rw---- + + If unset, the Kubelet will not modify the ownership and permissions of any volume. + Note that this field cannot be set when spec.os.name is windows. + format: int64 + type: integer + fsGroupChangePolicy: + description: |- + fsGroupChangePolicy defines behavior of changing ownership and permission of the volume + before being exposed inside Pod. This field will only apply to + volume types which support fsGroup based ownership(and permissions). + It will have no effect on ephemeral volume types such as: secret, configmaps + and emptydir. + Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used. + Note that this field cannot be set when spec.os.name is windows. + type: string + runAsGroup: + description: |- + The GID to run the entrypoint of the container process. + Uses runtime default if unset. + May also be set in SecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence + for that container. + Note that this field cannot be set when spec.os.name is windows. + format: int64 + type: integer + runAsNonRoot: + description: |- + Indicates that the container must run as a non-root user. + If true, the Kubelet will validate the image at runtime to ensure that it + does not run as UID 0 (root) and fail to start the container if it does. + If unset or false, no such validation will be performed. + May also be set in SecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: boolean + runAsUser: + description: |- + The UID to run the entrypoint of the container process. + Defaults to user specified in image metadata if unspecified. + May also be set in SecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence + for that container. + Note that this field cannot be set when spec.os.name is windows. + format: int64 + type: integer + seLinuxOptions: + description: |- + The SELinux context to be applied to all containers. + If unspecified, the container runtime will allocate a random SELinux context for each + container. May also be set in SecurityContext. If set in + both SecurityContext and PodSecurityContext, the value specified in SecurityContext + takes precedence for that container. + Note that this field cannot be set when spec.os.name is windows. + properties: + level: + description: Level is SELinux level label that applies to the container. + type: string + role: + description: Role is a SELinux role label that applies to the container. + type: string + type: + description: Type is a SELinux type label that applies to the container. + type: string + user: + description: User is a SELinux user label that applies to the container. + type: string + type: object + seccompProfile: + description: |- + The seccomp options to use by the containers in this pod. + Note that this field cannot be set when spec.os.name is windows. + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile defined in a file on the node should be used. + The profile must be preconfigured on the node to work. + Must be a descending path, relative to the kubelet's configured seccomp profile location. + Must be set if type is "Localhost". Must NOT be set for any other type. + type: string + type: + description: |- + type indicates which kind of seccomp profile will be applied. + Valid options are: + + Localhost - a profile defined in a file on the node should be used. + RuntimeDefault - the container runtime default profile should be used. + Unconfined - no profile should be applied. + type: string + required: + - type + type: object + supplementalGroups: + description: |- + A list of groups applied to the first process run in each container, in addition + to the container's primary GID, the fsGroup (if specified), and group memberships + defined in the container image for the uid of the container process. If unspecified, + no additional groups are added to any container. Note that group memberships + defined in the container image for the uid of the container process are still effective, + even if they are not included in this list. + Note that this field cannot be set when spec.os.name is windows. + items: + format: int64 + type: integer + type: array + x-kubernetes-list-type: atomic + sysctls: + description: |- + Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported + sysctls (by the container runtime) might fail to launch. + Note that this field cannot be set when spec.os.name is windows. + items: + description: Sysctl defines a kernel parameter to be set + properties: + name: + description: Name of a property to set + type: string + value: + description: Value of a property to set + type: string + required: + - name + - value + type: object + type: array + x-kubernetes-list-type: atomic + type: object + serviceAccountName: + description: If specified, the pod's service account + type: string + tolerations: + description: If specified, the pod's tolerations. + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + format: int64 + type: integer + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + type: object + type: array + x-kubernetes-list-type: atomic + type: object + type: object + serviceType: + description: |- + Optional service type for Kubernetes solver service. Supported values + are NodePort or ClusterIP. If unset, defaults to NodePort. + type: string + type: object + type: object + selector: + description: |- + Selector selects a set of DNSNames on the Certificate resource that + should be solved using this challenge solver. + If not specified, the solver will be treated as the 'default' solver + with the lowest priority, i.e. if any other solver has a more specific + match, it will be used instead. + properties: + dnsNames: + description: |- + List of DNSNames that this solver will be used to solve. + If specified and a match is found, a dnsNames selector will take + precedence over a dnsZones selector. + If multiple solvers match with the same dnsNames value, the solver + with the most matching labels in matchLabels will be selected. + If neither has more matches, the solver defined earlier in the list + will be selected. + items: + type: string + type: array + x-kubernetes-list-type: atomic + dnsZones: + description: |- + List of DNSZones that this solver will be used to solve. + The most specific DNS zone match specified here will take precedence + over other DNS zone matches, so a solver specifying sys.example.com + will be selected over one specifying example.com for the domain + www.sys.example.com. + If multiple solvers match with the same dnsZones value, the solver + with the most matching labels in matchLabels will be selected. + If neither has more matches, the solver defined earlier in the list + will be selected. + items: + type: string + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + A label selector that is used to refine the set of certificate's that + this challenge solver will apply to. + type: object + type: object + waitInsteadOfSelfCheck: + description: |- + WaitInsteadOfSelfCheck, if set, skips cert-manager's self-check and + instead waits this long after presentation before asking the ACME server + to validate the challenge. + + This is an advanced escape hatch for environments where cert-manager's + self-check cannot succeed from its own network or DNS viewpoint even + though the ACME server can still validate successfully, for example due + to split-horizon DNS or NAT hairpinning. + + A value of 0 skips the self-check and asks the ACME server to validate + immediately after presentation, relying on the ACME server's own + validation retries (RFC 8555 section 8.2) to succeed once the challenge + has propagated. A negative duration is rejected. + Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration, + for example `30s` or `2m`. + type: string + type: object + token: + description: |- + The ACME challenge token for this challenge. + This is the raw value returned from the ACME server. + type: string + type: + description: |- + The type of ACME challenge this resource represents. + One of "HTTP-01" or "DNS-01". + enum: + - HTTP-01 + - DNS-01 + type: string + url: + description: |- + The URL of the ACME Challenge resource for this challenge. + This can be used to lookup details about the status of this challenge. + type: string + wildcard: + description: |- + wildcard will be true if this challenge is for a wildcard identifier, + for example '*.example.com'. + type: boolean + required: + - authorizationURL + - dnsName + - issuerRef + - key + - solver + - token + - type + - url + type: object + status: + properties: + presented: + description: |- + Presented is true once cert-manager has configured the solver resources + needed to expose this challenge's validation material. + For example, the DNS01 TXT record has been created, or the HTTP01 solver + has been configured to serve the challenge token. + This does not imply the self check is passing, that the ACME server has + validated the challenge, or that cert-manager has already accepted the + challenge with the ACME server. + type: boolean + presentedAt: + description: |- + PresentedAt records when cert-manager first configured the solver + resources for this challenge. This is used by the optional delay-based + readiness logic. + format: date-time + type: string + processing: + description: |- + Used to denote whether this challenge should be processed or not. + This field will only be set to true by the 'scheduling' component. + It will only be set to false by the 'challenges' controller, after the + challenge has reached a final state or timed out. + If this field is set to false, the challenge controller will not take + any more action. + type: boolean + reason: + description: |- + Contains human readable information on why the Challenge is in the + current state. + type: string + state: + description: |- + Contains the current 'state' of the challenge. + If not set, the state of the challenge is unknown. + enum: + - valid + - ready + - pending + - processing + - invalid + - expired + - errored + type: string + type: object + required: + - metadata + - spec + type: object + selectableFields: + - jsonPath: .spec.issuerRef.group + - jsonPath: .spec.issuerRef.kind + - jsonPath: .spec.issuerRef.name + served: true + storage: true + subresources: + status: {} + +--- +# Source: cert-manager/templates/crd-acme.cert-manager.io_orders.yaml +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: "orders.acme.cert-manager.io" + annotations: + helm.sh/resource-policy: keep + labels: + app: "cert-manager" + app.kubernetes.io/name: "cert-manager" + app.kubernetes.io/instance: "cert-manager" + app.kubernetes.io/component: "crds" + app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/managed-by: Helm + helm.sh/chart: cert-manager-v1.21.1 +spec: + group: acme.cert-manager.io + names: + categories: + - cert-manager + - cert-manager-acme + kind: Order + listKind: OrderList + plural: orders + singular: order + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .status.state + name: State + type: string + - jsonPath: .spec.issuerRef.name + name: Issuer + priority: 1 + type: string + - jsonPath: .status.reason + name: Reason + priority: 1 + type: string + - description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. + jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1 + schema: + openAPIV3Schema: + description: Order is a type to represent an Order with an ACME server + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + properties: + commonName: + description: |- + CommonName is the common name as specified on the DER encoded CSR. + If specified, this value must also be present in `dnsNames` or `ipAddresses`. + This field must match the corresponding field on the DER encoded CSR. + type: string + dnsNames: + description: |- + DNSNames is a list of DNS names that should be included as part of the Order + validation process. + This field must match the corresponding field on the DER encoded CSR. + items: + type: string + type: array + x-kubernetes-list-type: atomic + duration: + description: |- + Duration is the duration for the not after date for the requested certificate. + This is set on order creation as per the ACME spec. + type: string + ipAddresses: + description: |- + IPAddresses is a list of IP addresses that should be included as part of the Order + validation process. + This field must match the corresponding field on the DER encoded CSR. + items: + type: string + type: array + x-kubernetes-list-type: atomic + issuerRef: + description: |- + IssuerRef references a properly configured ACME-type Issuer which should + be used to create this Order. + If the Issuer does not exist, processing will be retried. + If the Issuer is not an 'ACME' Issuer, an error will be returned and the + Order will be marked as failed. + properties: + group: + description: |- + Group of the issuer being referred to. + Defaults to 'cert-manager.io'. + type: string + kind: + description: |- + Kind of the issuer being referred to. + Defaults to 'Issuer'. + type: string + name: + description: Name of the issuer being referred to. + type: string + required: + - name + type: object + profile: + description: |- + Profile allows requesting a certificate profile from the ACME server. + Supported profiles are listed by the server's ACME directory URL. + type: string + replaces: + description: |- + Replaces is the ARI CertID (RFC 9773 §4.1) of the certificate that this + Order is intended to replace. When set, cert-manager will include the + "replaces" field on the newOrder request to the ACME server if and only + if the server advertises ARI support in its directory. The CertID has + the form "base64url(AKI).base64url(serial)" and is derived locally from + the currently issued leaf certificate. + type: string + request: + description: |- + Certificate signing request bytes in DER encoding. + This will be used when finalizing the order. + This field must be set on the order. + format: byte + type: string + required: + - issuerRef + - request + type: object + status: + properties: + authorizations: + description: |- + Authorizations contains data returned from the ACME server on what + authorizations must be completed in order to validate the DNS names + specified on the Order. + items: + description: |- + ACMEAuthorization contains data returned from the ACME server on an + authorization that must be completed in order validate a DNS name on an ACME + Order resource. + properties: + challenges: + description: |- + Challenges specifies the challenge types offered by the ACME server. + One of these challenge types will be selected when validating the DNS + name and an appropriate Challenge resource will be created to perform + the ACME challenge process. + items: + description: |- + Challenge specifies a challenge offered by the ACME server for an Order. + An appropriate Challenge resource can be created to perform the ACME + challenge process. + properties: + token: + description: |- + Token is the token that must be presented for this challenge. + This is used to compute the 'key' that must also be presented. + type: string + type: + description: |- + Type is the type of challenge being offered, e.g., 'http-01', 'dns-01', + 'tls-sni-01', etc. + This is the raw value retrieved from the ACME server. + Only 'http-01' and 'dns-01' are supported by cert-manager, other values + will be ignored. + type: string + url: + description: |- + URL is the URL of this challenge. It can be used to retrieve additional + metadata about the Challenge from the ACME server. + type: string + required: + - token + - type + - url + type: object + type: array + x-kubernetes-list-type: atomic + identifier: + description: Identifier is the DNS name to be validated as part of this authorization + type: string + initialState: + description: |- + InitialState is the initial state of the ACME authorization when first + fetched from the ACME server. + If an Authorization is already 'valid', the Order controller will not + create a Challenge resource for the authorization. This will occur when + working with an ACME server that enables 'authz reuse' (such as Let's + Encrypt's production endpoint). + If not set and 'identifier' is set, the state is assumed to be pending + and a Challenge will be created. + enum: + - valid + - ready + - pending + - processing + - invalid + - expired + - errored + type: string + url: + description: URL is the URL of the Authorization that must be completed + type: string + wildcard: + description: |- + Wildcard will be true if this authorization is for a wildcard DNS name. + If this is true, the identifier will be the *non-wildcard* version of + the DNS name. + For example, if '*.example.com' is the DNS name being validated, this + field will be 'true' and the 'identifier' field will be 'example.com'. + type: boolean + required: + - url + type: object + type: array + x-kubernetes-list-type: atomic + certificate: + description: |- + Certificate is a copy of the PEM encoded certificate for this Order. + This field will be populated after the order has been successfully + finalized with the ACME server, and the order has transitioned to the + 'valid' state. + format: byte + type: string + failureTime: + description: |- + FailureTime stores the time that this order failed. + This is used to influence garbage collection and back-off. + format: date-time + type: string + finalizeURL: + description: |- + FinalizeURL of the Order. + This is used to obtain certificates for this order once it has been completed. + type: string + reason: + description: |- + Reason optionally provides more information about a why the order is in + the current state. + type: string + state: + description: |- + State contains the current state of this Order resource. + States 'success' and 'expired' are 'final' + enum: + - valid + - ready + - pending + - processing + - invalid + - expired + - errored + type: string + url: + description: |- + URL of the Order. + This will initially be empty when the resource is first created. + The Order controller will populate this field when the Order is first processed. + This field will be immutable after it is initially set. + type: string + type: object + required: + - metadata + - spec + type: object + selectableFields: + - jsonPath: .spec.issuerRef.group + - jsonPath: .spec.issuerRef.kind + - jsonPath: .spec.issuerRef.name + served: true + storage: true + subresources: + status: {} + +--- +# Source: cert-manager/templates/crd-cert-manager.io_certificaterequests.yaml +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: "certificaterequests.cert-manager.io" + annotations: + helm.sh/resource-policy: keep + labels: + app: "cert-manager" + app.kubernetes.io/name: "cert-manager" + app.kubernetes.io/instance: "cert-manager" + app.kubernetes.io/component: "crds" + app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/managed-by: Helm + helm.sh/chart: cert-manager-v1.21.1 +spec: + group: cert-manager.io + names: + categories: + - cert-manager + kind: CertificateRequest + listKind: CertificateRequestList + plural: certificaterequests + shortNames: + - cr + - crs + singular: certificaterequest + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .status.conditions[?(@.type == "Approved")].status + name: Approved + type: string + - jsonPath: .status.conditions[?(@.type == "Denied")].status + name: Denied + type: string + - jsonPath: .status.conditions[?(@.type == "Ready")].status + name: Ready + type: string + - jsonPath: .spec.issuerRef.name + name: Issuer + type: string + - jsonPath: .spec.username + name: Requester + type: string + - jsonPath: .status.conditions[?(@.type == "Ready")].message + name: Status + priority: 1 + type: string + - description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. + jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1 + schema: + openAPIV3Schema: + description: |- + A CertificateRequest is used to request a signed certificate from one of the + configured issuers. + + All fields within the CertificateRequest's `spec` are immutable after creation. + A CertificateRequest will either succeed or fail, as denoted by its `Ready` status + condition and its `status.failureTime` field. + + A CertificateRequest is a one-shot resource, meaning it represents a single + point in time request for a certificate and cannot be re-used. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: |- + Specification of the desired state of the CertificateRequest resource. + https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status + properties: + duration: + description: |- + Requested 'duration' (i.e. lifetime) of the Certificate. Note that the + issuer may choose to ignore the requested duration, just like any other + requested attribute. + type: string + extra: + additionalProperties: + items: + type: string + type: array + description: |- + Extra contains extra attributes of the user that created the CertificateRequest. + Populated by the cert-manager webhook on creation and immutable. + type: object + groups: + description: |- + Groups contains group membership of the user that created the CertificateRequest. + Populated by the cert-manager webhook on creation and immutable. + items: + type: string + type: array + x-kubernetes-list-type: atomic + isCA: + description: |- + Requested basic constraints isCA value. Note that the issuer may choose + to ignore the requested isCA value, just like any other requested attribute. + + NOTE: If the CSR in the `Request` field has a BasicConstraints extension, + it must have the same isCA value as specified here. + + If true, this will automatically add the `cert sign` usage to the list + of requested `usages`. + type: boolean + issuerRef: + description: |- + Reference to the issuer responsible for issuing the certificate. + If the issuer is namespace-scoped, it must be in the same namespace + as the Certificate. If the issuer is cluster-scoped, it can be used + from any namespace. + + The `name` field of the reference must always be specified. + properties: + group: + description: |- + Group of the issuer being referred to. + Defaults to 'cert-manager.io'. + type: string + kind: + description: |- + Kind of the issuer being referred to. + Defaults to 'Issuer'. + type: string + name: + description: Name of the issuer being referred to. + type: string + required: + - name + type: object + request: + description: |- + The PEM-encoded X.509 certificate signing request to be submitted to the + issuer for signing. + + If the CSR has a BasicConstraints extension, its isCA attribute must + match the `isCA` value of this CertificateRequest. + If the CSR has a KeyUsage extension, its key usages must match the + key usages in the `usages` field of this CertificateRequest. + If the CSR has a ExtKeyUsage extension, its extended key usages + must match the extended key usages in the `usages` field of this + CertificateRequest. + format: byte + type: string + uid: + description: |- + UID contains the uid of the user that created the CertificateRequest. + Populated by the cert-manager webhook on creation and immutable. + type: string + usages: + description: |- + Requested key usages and extended key usages. + + NOTE: If the CSR in the `Request` field has uses the KeyUsage or + ExtKeyUsage extension, these extensions must have the same values + as specified here without any additional values. + + If unset, defaults to `digital signature` and `key encipherment`. + items: + description: |- + KeyUsage specifies valid usage contexts for keys. + See: + https://tools.ietf.org/html/rfc5280#section-4.2.1.3 + https://tools.ietf.org/html/rfc5280#section-4.2.1.12 + + Valid KeyUsage values are as follows: + "signing", + "digital signature", + "content commitment", + "key encipherment", + "key agreement", + "data encipherment", + "cert sign", + "crl sign", + "encipher only", + "decipher only", + "any", + "server auth", + "client auth", + "code signing", + "email protection", + "s/mime", + "ipsec end system", + "ipsec tunnel", + "ipsec user", + "timestamping", + "ocsp signing", + "microsoft sgc", + "netscape sgc" + enum: + - signing + - digital signature + - content commitment + - key encipherment + - key agreement + - data encipherment + - cert sign + - crl sign + - encipher only + - decipher only + - any + - server auth + - client auth + - code signing + - email protection + - s/mime + - ipsec end system + - ipsec tunnel + - ipsec user + - timestamping + - ocsp signing + - microsoft sgc + - netscape sgc + type: string + type: array + x-kubernetes-list-type: atomic + username: + description: |- + Username contains the name of the user that created the CertificateRequest. + Populated by the cert-manager webhook on creation and immutable. + type: string + required: + - issuerRef + - request + type: object + status: + description: |- + Status of the CertificateRequest. + This is set and managed automatically. + Read-only. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status + properties: + ca: + description: |- + The PEM encoded X.509 certificate of the signer, also known as the CA + (Certificate Authority). + This is set on a best-effort basis by different issuers. + If not set, the CA is assumed to be unknown/not available. + format: byte + type: string + certificate: + description: |- + The PEM encoded X.509 certificate resulting from the certificate + signing request. + If not set, the CertificateRequest has either not been completed or has + failed. More information on failure can be found by checking the + `conditions` field. + format: byte + type: string + conditions: + description: |- + List of status conditions to indicate the status of a CertificateRequest. + Known condition types are `Ready`, `InvalidRequest`, `Approved` and `Denied`. + items: + description: CertificateRequestCondition contains condition information for a CertificateRequest. + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the timestamp corresponding to the last status + change of this condition. + format: date-time + type: string + message: + description: |- + Message is a human readable description of the details of the last + transition, complementing reason. + type: string + reason: + description: |- + Reason is a brief machine readable explanation for the condition's last + transition. + type: string + status: + description: Status of the condition, one of (`True`, `False`, `Unknown`). + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: |- + Type of the condition, known values are (`Ready`, `InvalidRequest`, + `Approved`, `Denied`). + type: string + required: + - status + - type + type: object + type: array + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + failureTime: + description: |- + FailureTime stores the time that this CertificateRequest failed. This is + used to influence garbage collection and back-off. + format: date-time + type: string + type: object + type: object + selectableFields: + - jsonPath: .spec.issuerRef.group + - jsonPath: .spec.issuerRef.kind + - jsonPath: .spec.issuerRef.name + served: true + storage: true + subresources: + status: {} + +--- +# Source: cert-manager/templates/crd-cert-manager.io_certificates.yaml +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: "certificates.cert-manager.io" + annotations: + helm.sh/resource-policy: keep + labels: + app: "cert-manager" + app.kubernetes.io/name: "cert-manager" + app.kubernetes.io/instance: "cert-manager" + app.kubernetes.io/component: "crds" + app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/managed-by: Helm + helm.sh/chart: cert-manager-v1.21.1 +spec: + group: cert-manager.io + names: + categories: + - cert-manager + kind: Certificate + listKind: CertificateList + plural: certificates + shortNames: + - cert + - certs + singular: certificate + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .status.conditions[?(@.type == "Ready")].status + name: Ready + type: string + - jsonPath: .spec.secretName + name: Secret + type: string + - jsonPath: .spec.issuerRef.name + name: Issuer + priority: 1 + type: string + - jsonPath: .status.conditions[?(@.type == "Ready")].message + name: Status + priority: 1 + type: string + - description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. + jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1 + schema: + openAPIV3Schema: + description: |- + A Certificate resource should be created to ensure an up to date and signed + X.509 certificate is stored in the Kubernetes Secret resource named in `spec.secretName`. + + The stored certificate will be renewed before it expires (as configured by `spec.renewBefore`). + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: |- + Specification of the desired state of the Certificate resource. + https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status + properties: + additionalOutputFormats: + description: |- + Defines extra output formats of the private key and signed certificate chain + to be written to this Certificate's target Secret. + items: + description: |- + CertificateAdditionalOutputFormat defines an additional output format of a + Certificate resource. These contain supplementary data formats of the signed + certificate chain and paired private key. + properties: + type: + description: |- + Type is the name of the format type that should be written to the + Certificate's target Secret. + enum: + - DER + - CombinedPEM + type: string + required: + - type + type: object + type: array + x-kubernetes-list-type: atomic + commonName: + description: |- + Requested common name X509 certificate subject attribute. + More info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.6 + NOTE: TLS clients will ignore this value when any subject alternative name is + set (see https://tools.ietf.org/html/rfc6125#section-6.4.4). + + Should have a length of 64 characters or fewer to avoid generating invalid CSRs. + Cannot be set if the `literalSubject` field is set. + type: string + dnsNames: + description: Requested DNS subject alternative names. + items: + type: string + type: array + x-kubernetes-list-type: atomic + duration: + description: |- + Requested 'duration' (i.e. lifetime) of the Certificate. Note that the + issuer may choose to ignore the requested duration, just like any other + requested attribute. + + If unset, this defaults to 90 days. + Minimum accepted duration is 1 hour. + Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration. + type: string + emailAddresses: + description: Requested email subject alternative names. + items: + type: string + type: array + x-kubernetes-list-type: atomic + encodeUsagesInRequest: + description: |- + Whether the KeyUsage and ExtKeyUsage extensions should be set in the encoded CSR. + + This option defaults to true, and should only be disabled if the target + issuer does not support CSRs with these X509 KeyUsage/ ExtKeyUsage extensions. + type: boolean + ipAddresses: + description: Requested IP address subject alternative names. + items: + type: string + type: array + x-kubernetes-list-type: atomic + isCA: + description: |- + Requested basic constraints isCA value. + The isCA value is used to set the `isCA` field on the created CertificateRequest + resources. Note that the issuer may choose to ignore the requested isCA value, just + like any other requested attribute. + + If true, this will automatically add the `cert sign` usage to the list + of requested `usages`. + type: boolean + issuerRef: + description: |- + Reference to the issuer responsible for issuing the certificate. + If the issuer is namespace-scoped, it must be in the same namespace + as the Certificate. If the issuer is cluster-scoped, it can be used + from any namespace. + + The `name` field of the reference must always be specified. + properties: + group: + description: |- + Group of the issuer being referred to. + Defaults to 'cert-manager.io'. + type: string + kind: + description: |- + Kind of the issuer being referred to. + Defaults to 'Issuer'. + type: string + name: + description: Name of the issuer being referred to. + type: string + required: + - name + type: object + keystores: + description: Additional keystore output formats to be stored in the Certificate's Secret. + properties: + jks: + description: |- + JKS configures options for storing a JKS keystore in the + `spec.secretName` Secret resource. + properties: + alias: + description: |- + Alias specifies the alias of the key in the keystore, required by the JKS format. + If not provided, the default alias `certificate` will be used. + type: string + create: + description: |- + Create enables JKS keystore creation for the Certificate. + If true, a file named `keystore.jks` will be created in the target + Secret resource, encrypted using the password stored in + `passwordSecretRef` or `password`. + The keystore file will be updated immediately. + If the issuer provided a CA certificate, a file named `truststore.jks` + will also be created in the target Secret resource, encrypted using the + password stored in `passwordSecretRef` + containing the issuing Certificate Authority + type: boolean + password: + description: |- + Password provides a literal password used to encrypt the JKS keystore. + Mutually exclusive with passwordSecretRef. + One of password or passwordSecretRef must provide a password with a non-zero length. + type: string + passwordSecretRef: + description: |- + PasswordSecretRef is a reference to a non-empty key in a Secret resource + containing the password used to encrypt the JKS keystore. + Mutually exclusive with password. + One of password or passwordSecretRef must provide a password with a non-zero length. + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + required: + - name + type: object + required: + - create + type: object + pkcs12: + description: |- + PKCS12 configures options for storing a PKCS12 keystore in the + `spec.secretName` Secret resource. + properties: + create: + description: |- + Create enables PKCS12 keystore creation for the Certificate. + If true, a file named `keystore.p12` will be created in the target + Secret resource, encrypted using the password stored in + `passwordSecretRef` or in `password`. + The keystore file will be updated immediately. + If the issuer provided a CA certificate, a file named `truststore.p12` will + also be created in the target Secret resource, encrypted using the + password stored in `passwordSecretRef` containing the issuing Certificate + Authority + type: boolean + password: + description: |- + Password provides a literal password used to encrypt the PKCS#12 keystore. + Mutually exclusive with passwordSecretRef. + One of password or passwordSecretRef must provide a password with a non-zero length. + type: string + passwordSecretRef: + description: |- + PasswordSecretRef is a reference to a non-empty key in a Secret resource + containing the password used to encrypt the PKCS#12 keystore. + Mutually exclusive with password. + One of password or passwordSecretRef must provide a password with a non-zero length. + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + required: + - name + type: object + profile: + description: |- + Profile specifies the key and certificate encryption algorithms and the HMAC algorithm + used to create the PKCS12 keystore. Default value is `LegacyRC2` for backward compatibility. + + If provided, allowed values are: + `LegacyRC2`: Deprecated. Not supported by default in OpenSSL 3 or Java 20. + `LegacyDES`: Less secure algorithm. Use this option for maximal compatibility. + `Modern2023`: Secure algorithm. Use this option in case you have to always use secure algorithms + (e.g., because of company policy). Please note that the security of the algorithm is not that important + in reality, because the unencrypted certificate and private key are also stored in the Secret. + `Modern2026`: Encodes PKCS#12 files using algorithms that are considered modern as of 2026. + Private keys and certificates are encrypted using PBES2 with PBKDF2-HMAC-SHA-256 and AES-256-CBC. + The MAC algorithm is PBMAC1 with PBKDF2-HMAC-SHA-256 and HMAC-SHA256. + Files produced with this profile can be read by OpenSSL 3.4.0 and higher, Java 26 and higher, + or with Java using compatible versions of Bouncy Castle. Meets FIPS 140-3 requirements. + enum: + - LegacyRC2 + - LegacyDES + - Modern2023 + - Modern2026 + type: string + required: + - create + type: object + type: object + literalSubject: + description: |- + Requested X.509 certificate subject, represented using the LDAP "String + Representation of a Distinguished Name" [1]. + Important: the LDAP string format also specifies the order of the attributes + in the subject, this is important when issuing certs for LDAP authentication. + Example: `CN=foo,DC=corp,DC=example,DC=com` + More info [1]: https://datatracker.ietf.org/doc/html/rfc4514 + More info: https://github.com/cert-manager/cert-manager/issues/3203 + More info: https://github.com/cert-manager/cert-manager/issues/4424 + + Cannot be set if the `subject` or `commonName` field is set. + type: string + nameConstraints: + description: |- + x.509 certificate NameConstraint extension which MUST NOT be used in a non-CA certificate. + More Info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.10 + + This is an Alpha Feature and is only enabled with the + `--feature-gates=NameConstraints=true` option set on both + the controller and webhook components. + properties: + critical: + description: if true then the name constraints are marked critical. + type: boolean + excluded: + description: |- + Excluded contains the constraints which must be disallowed. Any name matching a + restriction in the excluded field is invalid regardless + of information appearing in the permitted + properties: + dnsDomains: + description: DNSDomains is a list of DNS domains that are permitted or excluded. + items: + type: string + type: array + x-kubernetes-list-type: atomic + emailAddresses: + description: EmailAddresses is a list of Email Addresses that are permitted or excluded. + items: + type: string + type: array + x-kubernetes-list-type: atomic + ipRanges: + description: |- + IPRanges is a list of IP Ranges that are permitted or excluded. + This should be a valid CIDR notation. + items: + type: string + type: array + x-kubernetes-list-type: atomic + uriDomains: + description: URIDomains is a list of URI domains that are permitted or excluded. + items: + type: string + type: array + x-kubernetes-list-type: atomic + type: object + permitted: + description: Permitted contains the constraints in which the names must be located. + properties: + dnsDomains: + description: DNSDomains is a list of DNS domains that are permitted or excluded. + items: + type: string + type: array + x-kubernetes-list-type: atomic + emailAddresses: + description: EmailAddresses is a list of Email Addresses that are permitted or excluded. + items: + type: string + type: array + x-kubernetes-list-type: atomic + ipRanges: + description: |- + IPRanges is a list of IP Ranges that are permitted or excluded. + This should be a valid CIDR notation. + items: + type: string + type: array + x-kubernetes-list-type: atomic + uriDomains: + description: URIDomains is a list of URI domains that are permitted or excluded. + items: + type: string + type: array + x-kubernetes-list-type: atomic + type: object + type: object + otherNames: + description: |- + `otherNames` is an escape hatch for SAN that allows any type. We currently restrict the support to string like otherNames, cf RFC 5280 p 37 + Any UTF8 String valued otherName can be passed with by setting the keys oid: x.x.x.x and UTF8Value: somevalue for `otherName`. + Most commonly this would be UPN set with oid: 1.3.6.1.4.1.311.20.2.3 + You should ensure that any OID passed is valid for the UTF8String type as we do not explicitly validate this. + items: + properties: + oid: + description: |- + OID is the object identifier for the otherName SAN. + The object identifier must be expressed as a dotted string, for + example, "1.2.840.113556.1.4.221". + type: string + utf8Value: + description: |- + utf8Value is the string value of the otherName SAN. + The utf8Value accepts any valid UTF8 string to set as value for the otherName SAN. + type: string + type: object + type: array + x-kubernetes-list-type: atomic + privateKey: + description: |- + Private key options. These include the key algorithm and size, the used + encoding and the rotation policy. + properties: + algorithm: + description: |- + Algorithm is the private key algorithm of the corresponding private key + for this certificate. + + If provided, allowed values are either `RSA`, `ECDSA` or `Ed25519`. + If `algorithm` is specified and `size` is not provided, + key size of 2048 will be used for `RSA` key algorithm and + key size of 256 will be used for `ECDSA` key algorithm. + key size is ignored when using the `Ed25519` key algorithm. + enum: + - RSA + - ECDSA + - Ed25519 + type: string + encoding: + description: |- + The private key cryptography standards (PKCS) encoding for this + certificate's private key to be encoded in. + + If provided, allowed values are `PKCS1` and `PKCS8` standing for PKCS#1 + and PKCS#8, respectively. + Defaults to `PKCS1` if not specified. + enum: + - PKCS1 + - PKCS8 + type: string + rotationPolicy: + description: |- + RotationPolicy controls how private keys should be regenerated when a + re-issuance is being processed. + + If set to `Never`, a private key will only be generated if one does not + already exist in the target `spec.secretName`. If one does exist but it + does not have the correct algorithm or size, a warning will be raised + to await user intervention. + If set to `Always`, a private key matching the specified requirements + will be generated whenever a re-issuance occurs. + Default is `Always`. + The default was changed from `Never` to `Always` in cert-manager >=v1.18.0. + enum: + - Never + - Always + type: string + size: + description: |- + Size is the key bit size of the corresponding private key for this certificate. + + If `algorithm` is set to `RSA`, valid values are `2048`, `4096` or `8192`, + and will default to `2048` if not specified. + If `algorithm` is set to `ECDSA`, valid values are `256`, `384` or `521`, + and will default to `256` if not specified. + If `algorithm` is set to `Ed25519`, Size is ignored. + No other values are allowed. + type: integer + type: object + renewBefore: + description: |- + How long before the currently issued certificate's expiry cert-manager should + renew the certificate. For example, if a certificate is valid for 60 minutes, + and `renewBefore=10m`, cert-manager will begin to attempt to renew the certificate + 50 minutes after it was issued (i.e. when there are 10 minutes remaining until + the certificate is no longer valid). + + NOTE: The actual lifetime of the issued certificate is used to determine the + renewal time. If an issuer returns a certificate with a different lifetime than + the one requested, cert-manager will use the lifetime of the issued certificate. + + If unset, this defaults to 1/3 of the issued certificate's lifetime. + Minimum accepted value is 5 minutes. + Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration. + Cannot be set if the `renewBeforePercentage` field is set. + type: string + renewBeforePercentage: + description: |- + `renewBeforePercentage` is like `renewBefore`, except it is a relative percentage + rather than an absolute duration. For example, if a certificate is valid for 60 + minutes, and `renewBeforePercentage=25`, cert-manager will begin to attempt to + renew the certificate 45 minutes after it was issued (i.e. when there are 15 + minutes (25%) remaining until the certificate is no longer valid). + + NOTE: The actual lifetime of the issued certificate is used to determine the + renewal time. If an issuer returns a certificate with a different lifetime than + the one requested, cert-manager will use the lifetime of the issued certificate. + + Value must be an integer in the range (0,100). The minimum effective + `renewBefore` derived from the `renewBeforePercentage` and `duration` fields is 5 + minutes. + Cannot be set if the `renewBefore` field is set. + format: int32 + type: integer + renewal: + description: |- + `renewal` allows configuration of how your certificate is renewed. If the policy mentioned is + `RenewBefore` then the controller respects `renewBefore` and `renewBeforePercentage`. + properties: + policy: + description: '`policy` must be one of `Disabled`, `RenewBefore`.' + enum: + - RenewBefore + - Disabled + type: string + windows: + description: '`windows` mentions the behavior of when the renewal must happen.' + items: + description: CertificateRenewalWindows is the definition for renewal windows + properties: + cron: + description: |- + `cron` is a cron compliant string to allow when the renewal should be allowed. Format is as shown below: + * * * * * + | | | | | + | | | | day of the week (0–6) (Sunday to Saturday; + | | | month (1–12) 7 is also Sunday on some systems) + | | day of the month (1–31) + | hour (0–23) + minute (0–59) + minLength: 1 + type: string + timezone: + description: |- + `timezone` is IANA compliant timezone. For example America/Denver. + If this field is not set, timezone is treated as UTC. + minLength: 1 + type: string + windowDuration: + description: |- + `windowDuration` is how long the cron definition is active for. + Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration. + pattern: ^([0-9]+(\.[0-9]+)?(s|m|h))+$ + type: string + required: + - cron + - windowDuration + type: object + type: array + x-kubernetes-list-type: atomic + type: object + revisionHistoryLimit: + description: |- + The maximum number of CertificateRequest revisions that are maintained in + the Certificate's history. Each revision represents a single `CertificateRequest` + created by this Certificate, either when it was created, renewed, or Spec + was changed. Revisions will be removed by oldest first if the number of + revisions exceeds this number. + + If set, revisionHistoryLimit must be a value of `1` or greater. + Default value is `1`. + format: int32 + type: integer + secretName: + description: |- + Name of the Secret resource that will be automatically created and + managed by this Certificate resource. It will be populated with a + private key and certificate, signed by the denoted issuer. The Secret + resource lives in the same namespace as the Certificate resource. + type: string + secretTemplate: + description: |- + Defines annotations and labels to be copied to the Certificate's Secret. + Labels and annotations on the Secret will be changed as they appear on the + SecretTemplate when added or removed. SecretTemplate annotations are added + in conjunction with, and cannot overwrite, the base set of annotations + cert-manager sets on the Certificate's Secret. + properties: + annotations: + additionalProperties: + type: string + description: Annotations is a key value map to be copied to the target Kubernetes Secret. + type: object + labels: + additionalProperties: + type: string + description: Labels is a key value map to be copied to the target Kubernetes Secret. + type: object + type: object + signatureAlgorithm: + description: |- + Signature algorithm to use. + Allowed values for RSA keys: SHA256WithRSA, SHA384WithRSA, SHA512WithRSA. + Allowed values for ECDSA keys: ECDSAWithSHA256, ECDSAWithSHA384, ECDSAWithSHA512. + Allowed values for Ed25519 keys: PureEd25519. + enum: + - SHA256WithRSA + - SHA384WithRSA + - SHA512WithRSA + - ECDSAWithSHA256 + - ECDSAWithSHA384 + - ECDSAWithSHA512 + - PureEd25519 + type: string + subject: + description: |- + Requested set of X509 certificate subject attributes. + More info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.6 + + The common name attribute is specified separately in the `commonName` field. + Cannot be set if the `literalSubject` field is set. + properties: + countries: + description: Countries to be used on the Certificate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + localities: + description: Cities to be used on the Certificate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + organizationalUnits: + description: Organizational Units to be used on the Certificate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + organizations: + description: Organizations to be used on the Certificate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + postalCodes: + description: Postal codes to be used on the Certificate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + provinces: + description: State/Provinces to be used on the Certificate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + serialNumber: + description: Serial number to be used on the Certificate. + type: string + streetAddresses: + description: Street addresses to be used on the Certificate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + type: object + uris: + description: Requested URI subject alternative names. + items: + type: string + type: array + x-kubernetes-list-type: atomic + usages: + description: |- + Requested key usages and extended key usages. + These usages are used to set the `usages` field on the created CertificateRequest + resources. If `encodeUsagesInRequest` is unset or set to `true`, the usages + will additionally be encoded in the `request` field which contains the CSR blob. - If unset, the Kubelet will not modify the ownership and permissions of any volume. - Note that this field cannot be set when spec.os.name is windows. - type: integer - format: int64 - fsGroupChangePolicy: - description: |- - fsGroupChangePolicy defines behavior of changing ownership and permission of the volume - before being exposed inside Pod. This field will only apply to - volume types which support fsGroup based ownership(and permissions). - It will have no effect on ephemeral volume types such as: secret, configmaps - and emptydir. - Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used. - Note that this field cannot be set when spec.os.name is windows. - type: string - runAsGroup: - description: |- - The GID to run the entrypoint of the container process. - Uses runtime default if unset. - May also be set in SecurityContext. If set in both SecurityContext and - PodSecurityContext, the value specified in SecurityContext takes precedence - for that container. - Note that this field cannot be set when spec.os.name is windows. - type: integer - format: int64 - runAsNonRoot: - description: |- - Indicates that the container must run as a non-root user. - If true, the Kubelet will validate the image at runtime to ensure that it - does not run as UID 0 (root) and fail to start the container if it does. - If unset or false, no such validation will be performed. - May also be set in SecurityContext. If set in both SecurityContext and - PodSecurityContext, the value specified in SecurityContext takes precedence. - type: boolean - runAsUser: - description: |- - The UID to run the entrypoint of the container process. - Defaults to user specified in image metadata if unspecified. - May also be set in SecurityContext. If set in both SecurityContext and - PodSecurityContext, the value specified in SecurityContext takes precedence - for that container. - Note that this field cannot be set when spec.os.name is windows. - type: integer - format: int64 - seLinuxOptions: - description: |- - The SELinux context to be applied to all containers. - If unspecified, the container runtime will allocate a random SELinux context for each - container. May also be set in SecurityContext. If set in - both SecurityContext and PodSecurityContext, the value specified in SecurityContext - takes precedence for that container. - Note that this field cannot be set when spec.os.name is windows. - type: object - properties: - level: - description: Level is SELinux level label that applies to the container. - type: string - role: - description: Role is a SELinux role label that applies to the container. - type: string - type: - description: Type is a SELinux type label that applies to the container. - type: string - user: - description: User is a SELinux user label that applies to the container. - type: string - seccompProfile: - description: |- - The seccomp options to use by the containers in this pod. - Note that this field cannot be set when spec.os.name is windows. - type: object - required: - - type - properties: - localhostProfile: - description: |- - localhostProfile indicates a profile defined in a file on the node should be used. - The profile must be preconfigured on the node to work. - Must be a descending path, relative to the kubelet's configured seccomp profile location. - Must be set if type is "Localhost". Must NOT be set for any other type. - type: string - type: - description: |- - type indicates which kind of seccomp profile will be applied. - Valid options are: + If unset, defaults to `digital signature` and `key encipherment`. + items: + description: |- + KeyUsage specifies valid usage contexts for keys. + See: + https://tools.ietf.org/html/rfc5280#section-4.2.1.3 + https://tools.ietf.org/html/rfc5280#section-4.2.1.12 - Localhost - a profile defined in a file on the node should be used. - RuntimeDefault - the container runtime default profile should be used. - Unconfined - no profile should be applied. - type: string - supplementalGroups: - description: |- - A list of groups applied to the first process run in each container, in addition - to the container's primary GID, the fsGroup (if specified), and group memberships - defined in the container image for the uid of the container process. If unspecified, - no additional groups are added to any container. Note that group memberships - defined in the container image for the uid of the container process are still effective, - even if they are not included in this list. - Note that this field cannot be set when spec.os.name is windows. - type: array - items: - type: integer - format: int64 - sysctls: - description: |- - Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported - sysctls (by the container runtime) might fail to launch. - Note that this field cannot be set when spec.os.name is windows. - type: array - items: - description: Sysctl defines a kernel parameter to be set - type: object - required: - - name - - value - properties: - name: - description: Name of a property to set - type: string - value: - description: Value of a property to set - type: string - serviceAccountName: - description: If specified, the pod's service account - type: string - tolerations: - description: If specified, the pod's tolerations. - type: array - items: - description: |- - The pod this Toleration is attached to tolerates any taint that matches - the triple using the matching operator . - type: object - properties: - effect: - description: |- - Effect indicates the taint effect to match. Empty means match all taint effects. - When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. - type: string - key: - description: |- - Key is the taint key that the toleration applies to. Empty means match all taint keys. - If the key is empty, operator must be Exists; this combination means to match all values and all keys. - type: string - operator: - description: |- - Operator represents a key's relationship to the value. - Valid operators are Exists and Equal. Defaults to Equal. - Exists is equivalent to wildcard for value, so that a pod can - tolerate all taints of a particular category. - type: string - tolerationSeconds: - description: |- - TolerationSeconds represents the period of time the toleration (which must be - of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, - it is not set, which means tolerate the taint forever (do not evict). Zero and - negative values will be treated as 0 (evict immediately) by the system. - type: integer - format: int64 - value: - description: |- - Value is the taint value the toleration matches to. - If the operator is Exists, the value should be empty, otherwise just a regular string. - type: string - serviceType: - description: |- - Optional service type for Kubernetes solver service. Supported values - are NodePort or ClusterIP. If unset, defaults to NodePort. - type: string - selector: + Valid KeyUsage values are as follows: + "signing", + "digital signature", + "content commitment", + "key encipherment", + "key agreement", + "data encipherment", + "cert sign", + "crl sign", + "encipher only", + "decipher only", + "any", + "server auth", + "client auth", + "code signing", + "email protection", + "s/mime", + "ipsec end system", + "ipsec tunnel", + "ipsec user", + "timestamping", + "ocsp signing", + "microsoft sgc", + "netscape sgc" + enum: + - signing + - digital signature + - content commitment + - key encipherment + - key agreement + - data encipherment + - cert sign + - crl sign + - encipher only + - decipher only + - any + - server auth + - client auth + - code signing + - email protection + - s/mime + - ipsec end system + - ipsec tunnel + - ipsec user + - timestamping + - ocsp signing + - microsoft sgc + - netscape sgc + type: string + type: array + x-kubernetes-list-type: atomic + required: + - issuerRef + - secretName + type: object + status: + description: |- + Status of the Certificate. + This is set and managed automatically. + Read-only. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status + properties: + acme: + description: ACME stores information that is fetched from the ACME CA server. + properties: + ari: description: |- - Selector selects a set of DNSNames on the Certificate resource that - should be solved using this challenge solver. - If not specified, the solver will be treated as the 'default' solver - with the lowest priority, i.e. if any other solver has a more specific - match, it will be used instead. - type: object + ARI stores the ACME Renewal Information that is fetched from the ACME server + in accordance with RFC 9773. This is only populated if the ARI feature gate is enabled. properties: - dnsNames: - description: |- - List of DNSNames that this solver will be used to solve. - If specified and a match is found, a dnsNames selector will take - precedence over a dnsZones selector. - If multiple solvers match with the same dnsNames value, the solver - with the most matching labels in matchLabels will be selected. - If neither has more matches, the solver defined earlier in the list - will be selected. - type: array - items: - type: string - dnsZones: - description: |- - List of DNSZones that this solver will be used to solve. - The most specific DNS zone match specified here will take precedence - over other DNS zone matches, so a solver specifying sys.example.com - will be selected over one specifying example.com for the domain - www.sys.example.com. - If multiple solvers match with the same dnsZones value, the solver - with the most matching labels in matchLabels will be selected. - If neither has more matches, the solver defined earlier in the list - will be selected. - type: array - items: - type: string - matchLabels: + explanationURL: description: |- - A label selector that is used to refine the set of certificate's that - this challenge solver will apply to. + ExplanationURL is a human-readable URL that may explain why the suggested window + has its current value. + type: string + lastChecked: + description: LastChecked is the time at which the ACME server was last checked for renewal information. + format: date-time + type: string + lastError: + description: LastError is the last error encountered when checking the ACME server for renewal information, if any. + type: string + nextCheck: + description: NextCheck is the time at which the ACME server will next be checked for renewal information. + format: date-time + type: string + suggestedWindow: + description: SuggestedWindow is the suggested renewal window as returned by the ACME server in accordance with RFC 9773. + properties: + end: + description: End is the end of the suggested renewal window. + format: date-time + type: string + start: + description: Start is the start of the suggested renewal window. + format: date-time + type: string + required: + - end + - start type: object - additionalProperties: - type: string - token: + type: object + type: object + conditions: description: |- - The ACME challenge token for this challenge. - This is the raw value returned from the ACME server. - type: string - type: + List of status conditions to indicate the status of certificates. + Known condition types are `Ready` and `Issuing`. + items: + description: CertificateCondition contains condition information for a Certificate. + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the timestamp corresponding to the last status + change of this condition. + format: date-time + type: string + message: + description: |- + Message is a human readable description of the details of the last + transition, complementing reason. + type: string + observedGeneration: + description: |- + If set, this represents the .metadata.generation that the condition was + set based upon. + For instance, if .metadata.generation is currently 12, but the + .status.condition[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the Certificate. + format: int64 + type: integer + reason: + description: |- + Reason is a brief machine readable explanation for the condition's last + transition. + type: string + status: + description: Status of the condition, one of (`True`, `False`, `Unknown`). + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: Type of the condition, known values are (`Ready`, `Issuing`). + type: string + required: + - status + - type + type: object + type: array + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + failedIssuanceAttempts: description: |- - The type of ACME challenge this resource represents. - One of "HTTP-01" or "DNS-01". - type: string - enum: - - HTTP-01 - - DNS-01 - url: + The number of continuous failed issuance attempts up till now. This + field gets removed (if set) on a successful issuance and gets set to + 1 if unset and an issuance has failed. If an issuance has failed, the + delay till the next issuance will be calculated using formula + time.Hour * 2 ^ (failedIssuanceAttempts - 1). + type: integer + lastFailureTime: description: |- - The URL of the ACME Challenge resource for this challenge. - This can be used to lookup details about the status of this challenge. + LastFailureTime is set only if the latest issuance for this + Certificate failed and contains the time of the failure. If an + issuance has failed, the delay till the next issuance will be + calculated using formula time.Hour * 2 ^ (failedIssuanceAttempts - + 1). If the latest issuance has succeeded this field will be unset. + format: date-time type: string - wildcard: - description: |- - wildcard will be true if this challenge is for a wildcard identifier, - for example '*.example.com'. - type: boolean - status: - type: object - properties: - presented: + nextPrivateKeySecretName: description: |- - presented will be set to true if the challenge values for this challenge - are currently 'presented'. - This *does not* imply the self check is passing. Only that the values - have been 'submitted' for the appropriate challenge mechanism (i.e. the - DNS01 TXT record has been presented, or the HTTP01 configuration has been - configured). - type: boolean - processing: + The name of the Secret resource containing the private key to be used + for the next certificate iteration. + The keymanager controller will automatically set this field if the + `Issuing` condition is set to `True`. + It will automatically unset this field when the Issuing condition is + not set or False. + type: string + notAfter: description: |- - Used to denote whether this challenge should be processed or not. - This field will only be set to true by the 'scheduling' component. - It will only be set to false by the 'challenges' controller, after the - challenge has reached a final state or timed out. - If this field is set to false, the challenge controller will not take - any more action. - type: boolean - reason: + The expiration time of the certificate stored in the secret named + by this resource in `spec.secretName`. + format: date-time + type: string + notBefore: description: |- - Contains human readable information on why the Challenge is in the - current state. + The time after which the certificate stored in the secret named + by this resource in `spec.secretName` is valid. + format: date-time type: string - state: + renewalTime: description: |- - Contains the current 'state' of the challenge. - If not set, the state of the challenge is unknown. + RenewalTime is the time at which the certificate will be next + renewed. + If not set, no upcoming renewal is scheduled. + format: date-time type: string - enum: - - valid - - ready - - pending - - processing - - invalid - - expired - - errored + revision: + description: |- + The current 'revision' of the certificate as issued. + + When a CertificateRequest resource is created, it will have the + `cert-manager.io/certificate-revision` set to one greater than the + current value of this field. + + Upon issuance, this field will be set to the value of the annotation + on the CertificateRequest resource used to issue the certificate. + + Persisting the value on the CertificateRequest resource allows the + certificates controller to know whether a request is part of an old + issuance or if it is part of the ongoing revision's issuance by + checking if the revision value in the annotation is greater than this + field. + type: integer + type: object + type: object + selectableFields: + - jsonPath: .spec.issuerRef.group + - jsonPath: .spec.issuerRef.kind + - jsonPath: .spec.issuerRef.name served: true storage: true subresources: status: {} -# END crd --- -# Source: cert-manager/templates/crds.yaml -# START crd +# Source: cert-manager/templates/crd-cert-manager.io_clusterissuers.yaml apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: - name: clusterissuers.cert-manager.io - # START annotations + name: "clusterissuers.cert-manager.io" annotations: helm.sh/resource-policy: keep - # END annotations labels: - app: 'cert-manager' - app.kubernetes.io/name: 'cert-manager' - app.kubernetes.io/instance: 'cert-manager' - # Generated labels - app.kubernetes.io/version: "v1.17.0" + app: "cert-manager" + app.kubernetes.io/name: "cert-manager" + app.kubernetes.io/instance: "cert-manager" + app.kubernetes.io/component: "crds" + app.kubernetes.io/version: "v1.21.1" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.17.0 + helm.sh/chart: cert-manager-v1.21.1 spec: group: cert-manager.io names: + categories: + - cert-manager kind: ClusterIssuer listKind: ClusterIssuerList plural: clusterissuers + shortNames: + - ciss singular: clusterissuer - categories: - - cert-manager scope: Cluster versions: - - name: v1 - subresources: - status: {} - additionalPrinterColumns: - - jsonPath: .status.conditions[?(@.type=="Ready")].status + - additionalPrinterColumns: + - jsonPath: .status.conditions[?(@.type == "Ready")].status name: Ready type: string - - jsonPath: .status.conditions[?(@.type=="Ready")].message + - jsonPath: .status.conditions[?(@.type == "Ready")].message name: Status priority: 1 type: string - - jsonPath: .metadata.creationTimestamp - description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. + - description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. + jsonPath: .metadata.creationTimestamp name: Age type: date + name: v1 schema: openAPIV3Schema: description: |- @@ -4431,9 +4980,6 @@ spec: It is similar to an Issuer, however it is cluster-scoped and therefore can be referenced by resources that exist in *any* namespace, not just the same namespace as the referent. - type: object - required: - - spec properties: apiVersion: description: |- @@ -4454,16 +5000,11 @@ spec: type: object spec: description: Desired state of the ClusterIssuer resource. - type: object properties: acme: description: |- ACME configures this issuer to communicate with a RFC8555 (ACME) server to obtain signed x509 certificates. - type: object - required: - - privateKeySecretRef - - server properties: caBundle: description: |- @@ -4473,8 +5014,8 @@ spec: kinds of security vulnerabilities. If CABundle and SkipTLSVerify are unset, the system certificate bundle inside the container is used to validate the TLS connection. - type: string format: byte + type: string disableAccountKeyGeneration: description: |- Enables or disables generating a new ACME account key. @@ -4506,21 +5047,17 @@ spec: server. If set, upon registration cert-manager will attempt to associate the given external account credentials with the registered ACME account. - type: object - required: - - keyID - - keySecretRef properties: keyAlgorithm: description: |- Deprecated: keyAlgorithm field exists for historical compatibility reasons and should not be used. The algorithm is now hardcoded to HS256 in golang/x/crypto/acme. - type: string enum: - HS256 - HS384 - HS512 + type: string keyID: description: keyID is the ID of the CA key that the External Account is bound to. type: string @@ -4533,9 +5070,6 @@ spec: the External Account Binding keyID above. The secret key stored in the Secret **must** be un-padded, base64 URL encoded data. - type: object - required: - - name properties: key: description: |- @@ -4548,18 +5082,25 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string + required: + - name + type: object + required: + - keyID + - keySecretRef + type: object preferredChain: description: |- PreferredChain is the chain to use if the ACME server outputs multiple. PreferredChain is no guarantee that this one gets delivered by the ACME endpoint. - For example, for Let's Encrypt's DST crosssign you would use: + For example, for Let's Encrypt's DST cross-sign you would use: "DST Root CA X3" or "ISRG Root X1" for the newer Let's Encrypt root CA. This value picks the first certificate bundle in the combined set of ACME default and alternative chains that has a root-most certificate with this value as its issuer's commonname. - type: string maxLength: 64 + type: string privateKeySecretRef: description: |- PrivateKey is the name of a Kubernetes Secret resource that will be used to @@ -4567,9 +5108,6 @@ spec: Optionally, a `key` may be specified to select a specific entry within the named Secret resource. If `key` is not specified, a default of `tls.key` will be used. - type: object - required: - - name properties: key: description: |- @@ -4582,6 +5120,14 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string + required: + - name + type: object + profile: + description: |- + Profile allows requesting a certificate profile from the ACME server. + Supported profiles are listed by the server's ACME directory URL. + type: string server: description: |- Server is the URL used to access the ACME server's 'directory' endpoint. @@ -4608,36 +5154,26 @@ spec: Solver configurations must be provided in order to obtain certificates from an ACME server. For more information, see: https://cert-manager.io/docs/configuration/acme/ - type: array items: description: |- An ACMEChallengeSolver describes how to solve ACME challenges for the issuer it is part of. A selector may be provided to use different solving strategies for different DNS names. Only one of HTTP01 or DNS01 must be provided. - type: object properties: dns01: description: |- Configures cert-manager to attempt to complete authorizations by performing the DNS01 challenge flow. - type: object properties: acmeDNS: description: |- - Use the 'ACME DNS' (https://github.com/joohoi/acme-dns) API to manage - DNS01 challenge records. - type: object - required: - - accountSecretRef - - host + Use the 'ACME DNS' (https://github.com/joohoi/acme-dns) API to manage + DNS01 challenge records. properties: accountSecretRef: description: |- A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. - type: object - required: - - name properties: key: description: |- @@ -4650,24 +5186,22 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string + required: + - name + type: object host: type: string + required: + - accountSecretRef + - host + type: object akamai: description: Use the Akamai DNS zone management API to manage DNS01 challenge records. - type: object - required: - - accessTokenSecretRef - - clientSecretSecretRef - - clientTokenSecretRef - - serviceConsumerDomain properties: accessTokenSecretRef: description: |- A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. - type: object - required: - - name properties: key: description: |- @@ -4680,13 +5214,13 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string + required: + - name + type: object clientSecretSecretRef: description: |- A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. - type: object - required: - - name properties: key: description: |- @@ -4699,13 +5233,13 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string + required: + - name + type: object clientTokenSecretRef: description: |- A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. - type: object - required: - - name properties: key: description: |- @@ -4718,14 +5252,19 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string + required: + - name + type: object serviceConsumerDomain: type: string + required: + - accessTokenSecretRef + - clientSecretSecretRef + - clientTokenSecretRef + - serviceConsumerDomain + type: object azureDNS: description: Use the Microsoft Azure DNS API to manage DNS01 challenge records. - type: object - required: - - resourceGroupName - - subscriptionID properties: clientID: description: |- @@ -4738,9 +5277,6 @@ spec: Auth: Azure Service Principal: A reference to a Secret containing the password associated with the Service Principal. If set, ClientID and TenantID must also be set. - type: object - required: - - name properties: key: description: |- @@ -4753,14 +5289,17 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string + required: + - name + type: object environment: description: name of the Azure environment (default AzurePublicCloud) - type: string enum: - AzurePublicCloud - AzureChinaCloud - AzureGermanCloud - AzureUSGovernmentCloud + type: string hostedZoneName: description: name of the DNS zone that should be used type: string @@ -4769,19 +5308,19 @@ spec: Auth: Azure Workload Identity or Azure Managed Service Identity: Settings to enable Azure Workload Identity or Azure Managed Service Identity If set, ClientID, ClientSecret and TenantID must not be set. - type: object properties: clientID: - description: client ID of the managed identity, can not be used at the same time as resourceID + description: client ID of the managed identity, cannot be used at the same time as resourceID type: string resourceID: description: |- - resource ID of the managed identity, can not be used at the same time as clientID + resource ID of the managed identity, cannot be used at the same time as clientID Cannot be used for Azure Managed Service Identity type: string tenantID: - description: tenant ID of the managed identity, can not be used at the same time as resourceID + description: tenant ID of the managed identity, cannot be used at the same time as resourceID type: string + type: object resourceGroupName: description: resource group the DNS zone is located in type: string @@ -4794,11 +5333,28 @@ spec: The TenantID of the Azure Service Principal used to authenticate with Azure DNS. If set, ClientID and ClientSecret must also be set. type: string + zoneType: + description: |- + ZoneType determines which type of Azure DNS zone to use. + + Valid values are: + - AzurePublicZone (default): Use a public Azure DNS zone. + - AzurePrivateZone: Use an Azure Private DNS zone. + + If not specified, AzurePublicZone is used. + + Support for Azure Private DNS zones is currently + experimental and may change in future releases. + enum: + - AzurePublicZone + - AzurePrivateZone + type: string + required: + - resourceGroupName + - subscriptionID + type: object cloudDNS: description: Use the Google Cloud DNS API to manage DNS01 challenge records. - type: object - required: - - project properties: hostedZoneName: description: |- @@ -4812,9 +5368,6 @@ spec: description: |- A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. - type: object - required: - - name properties: key: description: |- @@ -4827,18 +5380,20 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string + required: + - name + type: object + required: + - project + type: object cloudflare: description: Use the Cloudflare API to manage DNS01 challenge records. - type: object properties: apiKeySecretRef: description: |- API key to use to authenticate with Cloudflare. Note: using an API token to authenticate is now the recommended method as it allows greater control of permissions. - type: object - required: - - name properties: key: description: |- @@ -4851,11 +5406,11 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string - apiTokenSecretRef: - description: API token used to authenticate with Cloudflare. - type: object required: - name + type: object + apiTokenSecretRef: + description: API token used to authenticate with Cloudflare. properties: key: description: |- @@ -4868,30 +5423,28 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string + required: + - name + type: object email: description: Email of the account, only required when using API key based authentication. type: string + type: object cnameStrategy: description: |- CNAMEStrategy configures how the DNS01 provider should handle CNAME records when found in DNS zones. - type: string enum: - None - Follow + type: string digitalocean: description: Use the DigitalOcean DNS API to manage DNS01 challenge records. - type: object - required: - - tokenSecretRef properties: tokenSecretRef: description: |- A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. - type: object - required: - - name properties: key: description: |- @@ -4904,21 +5457,30 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string + required: + - name + type: object + required: + - tokenSecretRef + type: object rfc2136: description: |- Use RFC2136 ("Dynamic Updates in the Domain Name System") (https://datatracker.ietf.org/doc/rfc2136/) to manage DNS01 challenge records. - type: object - required: - - nameserver properties: nameserver: description: |- The IP address or hostname of an authoritative DNS server supporting RFC2136 in the form host:port. If the host is an IPv6 address it must be - enclosed in square brackets (e.g [2001:db8::1]) ; port is optional. + enclosed in square brackets (e.g [2001:db8::1]); port is optional. This field is required. type: string + protocol: + description: Protocol to use for dynamic DNS update queries. Valid values are (case-sensitive) ``TCP`` and ``UDP``; ``UDP`` (default). + enum: + - TCP + - UDP + type: string tsigAlgorithm: description: |- The TSIG Algorithm configured in the DNS supporting RFC2136. Used only @@ -4935,9 +5497,6 @@ spec: description: |- The name of the secret containing the TSIG value. If ``tsigKeyName`` is defined, this field is required. - type: object - required: - - name properties: key: description: |- @@ -4950,16 +5509,21 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string + required: + - name + type: object + required: + - nameserver + type: object route53: description: Use the AWS Route53 API to manage DNS01 challenge records. - type: object properties: accessKeyID: description: |- The AccessKeyID is used for authentication. Cannot be set when SecretAccessKeyID is set. - If neither the Access Key nor Key ID are set, we fall-back to using env - vars, shared credentials file or AWS Instance metadata, + If neither the Access Key nor Key ID are set, we fall back to using env + vars, shared credentials file, or AWS Instance metadata, see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials type: string accessKeyIDSecretRef: @@ -4967,12 +5531,9 @@ spec: The SecretAccessKey is used for authentication. If set, pull the AWS access key ID from a key within a Kubernetes Secret. Cannot be set when AccessKeyID is set. - If neither the Access Key nor Key ID are set, we fall-back to using env - vars, shared credentials file or AWS Instance metadata, + If neither the Access Key nor Key ID are set, we fall back to using env + vars, shared credentials file, or AWS Instance metadata, see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials - type: object - required: - - name properties: key: description: |- @@ -4985,28 +5546,22 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string + required: + - name + type: object auth: description: Auth configures how cert-manager authenticates. - type: object - required: - - kubernetes properties: kubernetes: description: |- Kubernetes authenticates with Route53 using AssumeRoleWithWebIdentity by passing a bound ServiceAccount token. - type: object - required: - - serviceAccountRef properties: serviceAccountRef: description: |- A reference to a service account that will be used to request a bound token (also known as "projected token"). To use this field, you must configure an RBAC rule to let cert-manager request a token. - type: object - required: - - name properties: audiences: description: |- @@ -5014,12 +5569,22 @@ spec: token passed to AWS. The default token consisting of the issuer's namespace and name is always included. If unset the audience defaults to `sts.amazonaws.com`. - type: array items: type: string + type: array + x-kubernetes-list-type: atomic name: description: Name of the ServiceAccount used to request a token. type: string + required: + - name + type: object + required: + - serviceAccountRef + type: object + required: + - kubernetes + type: object hostedZoneID: description: If set, the provider will manage only this zone in Route53 and will not do a lookup using the route53:ListHostedZonesByName api call. type: string @@ -5056,12 +5621,9 @@ spec: secretAccessKeySecretRef: description: |- The SecretAccessKey is used for authentication. - If neither the Access Key nor Key ID are set, we fall-back to using env - vars, shared credentials file or AWS Instance metadata, + If neither the Access Key nor Key ID are set, we fall back to using env + vars, shared credentials file, or AWS Instance metadata, see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials - type: object - required: - - name properties: key: description: |- @@ -5074,14 +5636,14 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string + required: + - name + type: object + type: object webhook: description: |- Configure an external webhook based DNS01 challenge solver to manage DNS01 challenge records. - type: object - required: - - groupName - - solverName properties: config: description: |- @@ -5089,7 +5651,7 @@ spec: when challenges are processed. This can contain arbitrary JSON data. Secret values should not be specified in this stanza. - If secret values are needed (e.g. credentials for a DNS service), you + If secret values are needed (e.g., credentials for a DNS service), you should use a SecretKeySelector to reference a Secret resource. For details on the schema of this field, consult the webhook provider implementation's documentation. @@ -5105,15 +5667,19 @@ spec: description: |- The name of the solver to use, as defined in the webhook provider implementation. - This will typically be the name of the provider, e.g. 'cloudflare'. + This will typically be the name of the provider, e.g., 'cloudflare'. type: string + required: + - groupName + - solverName + type: object + type: object http01: description: |- Configures cert-manager to attempt to complete authorizations by performing the HTTP01 challenge flow. It is not possible to obtain certificates for wildcard domain names - (e.g. `*.example.com`) using the HTTP01 challenge mechanism. - type: object + (e.g., `*.example.com`) using the HTTP01 challenge mechanism. properties: gatewayHTTPRoute: description: |- @@ -5121,22 +5687,20 @@ spec: in Kubernetes (https://gateway-api.sigs.k8s.io/). The Gateway solver will create HTTPRoutes with the specified labels in the same namespace as the challenge. This solver is experimental, and fields / behaviour may change in the future. - type: object properties: labels: + additionalProperties: + type: string description: |- Custom labels that will be applied to HTTPRoutes created by cert-manager while solving HTTP-01 challenges. type: object - additionalProperties: - type: string parentRefs: description: |- When solving an HTTP-01 challenge, cert-manager creates an HTTPRoute. cert-manager needs to know which parentRefs should be used when creating the HTTPRoute. Usually, the parentRef references a Gateway. See: https://gateway-api.sigs.k8s.io/api-types/httproute/#attaching-to-gateways - type: array items: description: |- ParentReference identifies an API object (usually a Gateway) that can be considered @@ -5151,11 +5715,9 @@ spec: The API object must be valid in the cluster; the Group and Kind must be registered in the cluster for this reference to be valid. - type: object - required: - - name properties: group: + default: gateway.networking.k8s.io description: |- Group is the group of the referent. When unspecified, "gateway.networking.k8s.io" is inferred. @@ -5163,11 +5725,11 @@ spec: Group must be explicitly set to "" (empty string). Support: Core - type: string - default: gateway.networking.k8s.io maxLength: 253 pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string kind: + default: Gateway description: |- Kind is kind of the referent. @@ -5177,19 +5739,18 @@ spec: * Service (Mesh conformance profile, ClusterIP Services only) Support for other resources is Implementation-Specific. - type: string - default: Gateway maxLength: 63 minLength: 1 pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string name: description: |- Name is the name of the referent. Support: Core - type: string maxLength: 253 minLength: 1 + type: string namespace: description: |- Namespace is the namespace of the referent. When unspecified, this refers @@ -5214,10 +5775,10 @@ spec: Support: Core - type: string maxLength: 63 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string port: description: |- Port is the network port this Route targets. It can be interpreted @@ -5250,10 +5811,10 @@ spec: the Route MUST be considered detached from the Gateway. Support: Extended - type: integer format: int32 maximum: 65535 minimum: 1 + type: integer sectionName: description: |- SectionName is the name of a section within the target resource. In the @@ -5280,15 +5841,19 @@ spec: Route MUST be considered detached from the Gateway. Support: Core - type: string maxLength: 253 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + required: + - name + type: object + type: array + x-kubernetes-list-type: atomic podTemplate: description: |- Optional pod template used to configure the ACME challenge solver pods used for HTTP01 challenges. - type: object properties: metadata: description: |- @@ -5296,32 +5861,29 @@ spec: Only the 'labels' and 'annotations' fields may be set. If labels or annotations overlap with in-built values, the values here will override the in-built values. - type: object properties: annotations: + additionalProperties: + type: string description: Annotations that should be added to the created ACME HTTP01 solver pods. type: object + labels: additionalProperties: type: string - labels: description: Labels that should be added to the created ACME HTTP01 solver pods. type: object - additionalProperties: - type: string + type: object spec: description: |- PodSpec defines overrides for the HTTP01 challenge solver pod. Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields. All other fields will be ignored. - type: object properties: affinity: description: If specified, the pod's scheduling constraints - type: object properties: nodeAffinity: description: Describes node affinity scheduling rules for the pod. - type: object properties: preferredDuringSchedulingIgnoredDuringExecution: description: |- @@ -5334,31 +5896,20 @@ spec: compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node matches the corresponding matchExpressions; the node(s) with the highest sum are the most preferred. - type: array items: description: |- An empty preferred scheduling term matches all objects with implicit weight 0 (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). - type: object - required: - - preference - - weight properties: preference: description: A node selector term, associated with the corresponding weight. - type: object properties: matchExpressions: description: A list of node selector requirements by node's labels. - type: array items: description: |- A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator properties: key: description: The label key that the selector applies to. @@ -5375,22 +5926,22 @@ spec: the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. - type: array items: type: string + type: array x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array x-kubernetes-list-type: atomic matchFields: description: A list of node selector requirements by node's fields. - type: array items: description: |- A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator properties: key: description: The label key that the selector applies to. @@ -5407,16 +5958,27 @@ spec: the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. - type: array items: type: string + type: array x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array x-kubernetes-list-type: atomic + type: object x-kubernetes-map-type: atomic weight: description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100. - type: integer format: int32 + type: integer + required: + - preference + - weight + type: object + type: array x-kubernetes-list-type: atomic requiredDuringSchedulingIgnoredDuringExecution: description: |- @@ -5425,31 +5987,21 @@ spec: If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to an update), the system may or may not try to eventually evict the pod from its node. - type: object - required: - - nodeSelectorTerms properties: nodeSelectorTerms: description: Required. A list of node selector terms. The terms are ORed. - type: array items: description: |- A null or empty node selector term matches no objects. The requirements of them are ANDed. The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. - type: object properties: matchExpressions: description: A list of node selector requirements by node's labels. - type: array items: description: |- A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator properties: key: description: The label key that the selector applies to. @@ -5466,22 +6018,22 @@ spec: the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. - type: array items: type: string + type: array x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array x-kubernetes-list-type: atomic matchFields: description: A list of node selector requirements by node's fields. - type: array items: description: |- A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator properties: key: description: The label key that the selector applies to. @@ -5498,17 +6050,27 @@ spec: the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. - type: array items: type: string + type: array x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array x-kubernetes-list-type: atomic + type: object x-kubernetes-map-type: atomic + type: array x-kubernetes-list-type: atomic + required: + - nodeSelectorTerms + type: object x-kubernetes-map-type: atomic + type: object podAffinity: description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)). - type: object properties: preferredDuringSchedulingIgnoredDuringExecution: description: |- @@ -5521,37 +6083,23 @@ spec: compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. - type: array items: description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) - type: object - required: - - podAffinityTerm - - weight properties: podAffinityTerm: description: Required. A pod affinity term, associated with the corresponding weight. - type: object - required: - - topologyKey properties: labelSelector: description: |- A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods. - type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator properties: key: description: key is the label key that the selector applies to. @@ -5567,19 +6115,25 @@ spec: the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array items: type: string + type: array x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array x-kubernetes-list-type: atomic matchLabels: + additionalProperties: + type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - additionalProperties: - type: string + type: object x-kubernetes-map-type: atomic matchLabelKeys: description: |- @@ -5591,10 +6145,9 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). - type: array items: type: string + type: array x-kubernetes-list-type: atomic mismatchLabelKeys: description: |- @@ -5606,10 +6159,9 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). - type: array items: type: string + type: array x-kubernetes-list-type: atomic namespaceSelector: description: |- @@ -5618,19 +6170,13 @@ spec: and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. - type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator properties: key: description: key is the label key that the selector applies to. @@ -5646,19 +6192,25 @@ spec: the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array items: type: string + type: array x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array x-kubernetes-list-type: atomic matchLabels: + additionalProperties: + type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - additionalProperties: - type: string + type: object x-kubernetes-map-type: atomic namespaces: description: |- @@ -5666,9 +6218,9 @@ spec: The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". - type: array items: type: string + type: array x-kubernetes-list-type: atomic topologyKey: description: |- @@ -5678,12 +6230,20 @@ spec: selected pods is running. Empty topologyKey is not allowed. type: string + required: + - topologyKey + type: object weight: description: |- weight associated with matching the corresponding podAffinityTerm, in the range 1-100. - type: integer format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array x-kubernetes-list-type: atomic requiredDuringSchedulingIgnoredDuringExecution: description: |- @@ -5694,7 +6254,6 @@ spec: system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied. - type: array items: description: |- Defines a set of pods (namely those matching the labelSelector @@ -5703,27 +6262,18 @@ spec: where co-located is defined as running on a node whose value of the label with key matches that of any node on which a pod of the set of pods is running - type: object - required: - - topologyKey properties: labelSelector: description: |- A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods. - type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator properties: key: description: key is the label key that the selector applies to. @@ -5739,19 +6289,25 @@ spec: the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array items: type: string + type: array x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array x-kubernetes-list-type: atomic matchLabels: + additionalProperties: + type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - additionalProperties: - type: string + type: object x-kubernetes-map-type: atomic matchLabelKeys: description: |- @@ -5763,10 +6319,9 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). - type: array items: type: string + type: array x-kubernetes-list-type: atomic mismatchLabelKeys: description: |- @@ -5778,10 +6333,9 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). - type: array items: type: string + type: array x-kubernetes-list-type: atomic namespaceSelector: description: |- @@ -5790,19 +6344,13 @@ spec: and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. - type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator properties: key: description: key is the label key that the selector applies to. @@ -5818,19 +6366,25 @@ spec: the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array items: type: string + type: array x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array x-kubernetes-list-type: atomic matchLabels: + additionalProperties: + type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - additionalProperties: - type: string + type: object x-kubernetes-map-type: atomic namespaces: description: |- @@ -5838,9 +6392,9 @@ spec: The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". - type: array items: type: string + type: array x-kubernetes-list-type: atomic topologyKey: description: |- @@ -5850,10 +6404,14 @@ spec: selected pods is running. Empty topologyKey is not allowed. type: string + required: + - topologyKey + type: object + type: array x-kubernetes-list-type: atomic + type: object podAntiAffinity: description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)). - type: object properties: preferredDuringSchedulingIgnoredDuringExecution: description: |- @@ -5863,40 +6421,26 @@ spec: most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling anti-affinity expressions, etc.), - compute a sum by iterating through the elements of this field and adding - "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + compute a sum by iterating through the elements of this field and subtracting + "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. - type: array items: description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) - type: object - required: - - podAffinityTerm - - weight properties: podAffinityTerm: description: Required. A pod affinity term, associated with the corresponding weight. - type: object - required: - - topologyKey properties: labelSelector: description: |- A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods. - type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator properties: key: description: key is the label key that the selector applies to. @@ -5912,19 +6456,25 @@ spec: the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array items: type: string + type: array x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array x-kubernetes-list-type: atomic matchLabels: + additionalProperties: + type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - additionalProperties: - type: string + type: object x-kubernetes-map-type: atomic matchLabelKeys: description: |- @@ -5936,10 +6486,9 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). - type: array items: type: string + type: array x-kubernetes-list-type: atomic mismatchLabelKeys: description: |- @@ -5951,10 +6500,9 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). - type: array items: type: string + type: array x-kubernetes-list-type: atomic namespaceSelector: description: |- @@ -5963,19 +6511,13 @@ spec: and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. - type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator properties: key: description: key is the label key that the selector applies to. @@ -5991,19 +6533,25 @@ spec: the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array items: type: string + type: array x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array x-kubernetes-list-type: atomic matchLabels: + additionalProperties: + type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - additionalProperties: - type: string + type: object x-kubernetes-map-type: atomic namespaces: description: |- @@ -6011,9 +6559,9 @@ spec: The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". - type: array items: type: string + type: array x-kubernetes-list-type: atomic topologyKey: description: |- @@ -6023,12 +6571,20 @@ spec: selected pods is running. Empty topologyKey is not allowed. type: string + required: + - topologyKey + type: object weight: description: |- weight associated with matching the corresponding podAffinityTerm, in the range 1-100. - type: integer format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array x-kubernetes-list-type: atomic requiredDuringSchedulingIgnoredDuringExecution: description: |- @@ -6039,7 +6595,6 @@ spec: system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied. - type: array items: description: |- Defines a set of pods (namely those matching the labelSelector @@ -6048,27 +6603,18 @@ spec: where co-located is defined as running on a node whose value of the label with key matches that of any node on which a pod of the set of pods is running - type: object - required: - - topologyKey properties: labelSelector: description: |- A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods. - type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator properties: key: description: key is the label key that the selector applies to. @@ -6084,19 +6630,25 @@ spec: the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array items: type: string + type: array x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array x-kubernetes-list-type: atomic matchLabels: + additionalProperties: + type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - additionalProperties: - type: string + type: object x-kubernetes-map-type: atomic matchLabelKeys: description: |- @@ -6108,10 +6660,9 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). - type: array items: type: string + type: array x-kubernetes-list-type: atomic mismatchLabelKeys: description: |- @@ -6123,10 +6674,9 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). - type: array items: type: string + type: array x-kubernetes-list-type: atomic namespaceSelector: description: |- @@ -6135,19 +6685,13 @@ spec: and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. - type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator properties: key: description: key is the label key that the selector applies to. @@ -6163,19 +6707,25 @@ spec: the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array items: type: string + type: array x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array x-kubernetes-list-type: atomic matchLabels: + additionalProperties: + type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - additionalProperties: - type: string + type: object x-kubernetes-map-type: atomic namespaces: description: |- @@ -6183,9 +6733,9 @@ spec: The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". - type: array items: type: string + type: array x-kubernetes-list-type: atomic topologyKey: description: |- @@ -6195,17 +6745,22 @@ spec: selected pods is running. Empty topologyKey is not allowed. type: string + required: + - topologyKey + type: object + type: array x-kubernetes-list-type: atomic + type: object + type: object imagePullSecrets: description: If specified, the pod's imagePullSecrets - type: array items: description: |- LocalObjectReference contains enough information to let you locate the referenced object inside the same namespace. - type: object properties: name: + default: "" description: |- Name of the referent. This field is effectively required, but due to backwards compatibility is @@ -6213,22 +6768,59 @@ spec: almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string - default: "" + type: object x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map nodeSelector: + additionalProperties: + type: string description: |- NodeSelector is a selector which must be true for the pod to fit on a node. Selector which must match a node's labels for the pod to be scheduled on that node. More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ type: object - additionalProperties: - type: string priorityClassName: description: If specified, the pod's priorityClassName. type: string + resources: + description: |- + If specified, the pod's resource requirements. + These values override the global resource configuration flags. + Note that when only specifying resource limits, ensure they are greater than or equal + to the corresponding global resource requests configured via controller flags + (--acme-http01-solver-resource-request-cpu, --acme-http01-solver-resource-request-memory). + Kubernetes will reject pod creation if limits are lower than requests, causing challenge failures. + properties: + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to the global values configured via controller flags. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object securityContext: description: If specified, the pod's security context - type: object properties: fsGroup: description: |- @@ -6242,8 +6834,8 @@ spec: If unset, the Kubelet will not modify the ownership and permissions of any volume. Note that this field cannot be set when spec.os.name is windows. - type: integer format: int64 + type: integer fsGroupChangePolicy: description: |- fsGroupChangePolicy defines behavior of changing ownership and permission of the volume @@ -6262,8 +6854,8 @@ spec: PodSecurityContext, the value specified in SecurityContext takes precedence for that container. Note that this field cannot be set when spec.os.name is windows. - type: integer format: int64 + type: integer runAsNonRoot: description: |- Indicates that the container must run as a non-root user. @@ -6281,8 +6873,8 @@ spec: PodSecurityContext, the value specified in SecurityContext takes precedence for that container. Note that this field cannot be set when spec.os.name is windows. - type: integer format: int64 + type: integer seLinuxOptions: description: |- The SELinux context to be applied to all containers. @@ -6291,7 +6883,6 @@ spec: both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence for that container. Note that this field cannot be set when spec.os.name is windows. - type: object properties: level: description: Level is SELinux level label that applies to the container. @@ -6305,13 +6896,11 @@ spec: user: description: User is a SELinux user label that applies to the container. type: string + type: object seccompProfile: description: |- The seccomp options to use by the containers in this pod. Note that this field cannot be set when spec.os.name is windows. - type: object - required: - - type properties: localhostProfile: description: |- @@ -6329,6 +6918,9 @@ spec: RuntimeDefault - the container runtime default profile should be used. Unconfined - no profile should be applied. type: string + required: + - type + type: object supplementalGroups: description: |- A list of groups applied to the first process run in each container, in addition @@ -6338,22 +6930,18 @@ spec: defined in the container image for the uid of the container process are still effective, even if they are not included in this list. Note that this field cannot be set when spec.os.name is windows. - type: array items: - type: integer format: int64 + type: integer + type: array + x-kubernetes-list-type: atomic sysctls: description: |- Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported sysctls (by the container runtime) might fail to launch. Note that this field cannot be set when spec.os.name is windows. - type: array items: description: Sysctl defines a kernel parameter to be set - type: object - required: - - name - - value properties: name: description: Name of a property to set @@ -6361,17 +6949,22 @@ spec: value: description: Value of a property to set type: string + required: + - name + - value + type: object + type: array + x-kubernetes-list-type: atomic + type: object serviceAccountName: description: If specified, the pod's service account type: string tolerations: description: If specified, the pod's tolerations. - type: array items: description: |- The pod this Toleration is attached to tolerates any taint that matches the triple using the matching operator . - type: object properties: effect: description: |- @@ -6386,9 +6979,10 @@ spec: operator: description: |- Operator represents a key's relationship to the value. - Valid operators are Exists and Equal. Defaults to Equal. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). type: string tolerationSeconds: description: |- @@ -6396,25 +6990,30 @@ spec: of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, it is not set, which means tolerate the taint forever (do not evict). Zero and negative values will be treated as 0 (evict immediately) by the system. - type: integer format: int64 + type: integer value: description: |- Value is the taint value the toleration matches to. If the operator is Exists, the value should be empty, otherwise just a regular string. type: string + type: object + type: array + x-kubernetes-list-type: atomic + type: object + type: object serviceType: description: |- Optional service type for Kubernetes solver service. Supported values are NodePort or ClusterIP. If unset, defaults to NodePort. type: string + type: object ingress: description: |- The ingress based HTTP01 challenge solver will solve challenges by creating or modifying Ingress resources in order to route requests for '/.well-known/acme-challenge/XYZ' to 'challenge solver' pods that are provisioned by cert-manager for each Challenge to be completed. - type: object properties: class: description: |- @@ -6434,7 +7033,6 @@ spec: description: |- Optional ingress template used to configure the ACME challenge solver ingress used for HTTP01 challenges. - type: object properties: metadata: description: |- @@ -6442,18 +7040,19 @@ spec: Only the 'labels' and 'annotations' fields may be set. If labels or annotations overlap with in-built values, the values here will override the in-built values. - type: object properties: annotations: + additionalProperties: + type: string description: Annotations that should be added to the created ACME HTTP01 solver ingress. type: object + labels: additionalProperties: type: string - labels: description: Labels that should be added to the created ACME HTTP01 solver ingress. type: object - additionalProperties: - type: string + type: object + type: object name: description: |- The name of the ingress resource that should have ACME challenge solving @@ -6467,7 +7066,6 @@ spec: description: |- Optional pod template used to configure the ACME challenge solver pods used for HTTP01 challenges. - type: object properties: metadata: description: |- @@ -6475,32 +7073,29 @@ spec: Only the 'labels' and 'annotations' fields may be set. If labels or annotations overlap with in-built values, the values here will override the in-built values. - type: object properties: annotations: + additionalProperties: + type: string description: Annotations that should be added to the created ACME HTTP01 solver pods. type: object + labels: additionalProperties: type: string - labels: description: Labels that should be added to the created ACME HTTP01 solver pods. type: object - additionalProperties: - type: string + type: object spec: description: |- PodSpec defines overrides for the HTTP01 challenge solver pod. Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields. All other fields will be ignored. - type: object properties: affinity: description: If specified, the pod's scheduling constraints - type: object properties: nodeAffinity: description: Describes node affinity scheduling rules for the pod. - type: object properties: preferredDuringSchedulingIgnoredDuringExecution: description: |- @@ -6513,31 +7108,20 @@ spec: compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node matches the corresponding matchExpressions; the node(s) with the highest sum are the most preferred. - type: array items: description: |- An empty preferred scheduling term matches all objects with implicit weight 0 (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). - type: object - required: - - preference - - weight properties: preference: description: A node selector term, associated with the corresponding weight. - type: object properties: matchExpressions: description: A list of node selector requirements by node's labels. - type: array items: description: |- A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator properties: key: description: The label key that the selector applies to. @@ -6554,22 +7138,22 @@ spec: the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. - type: array items: type: string + type: array x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array x-kubernetes-list-type: atomic matchFields: description: A list of node selector requirements by node's fields. - type: array items: description: |- A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator properties: key: description: The label key that the selector applies to. @@ -6586,16 +7170,27 @@ spec: the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. - type: array items: type: string + type: array x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array x-kubernetes-list-type: atomic + type: object x-kubernetes-map-type: atomic weight: description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100. - type: integer format: int32 + type: integer + required: + - preference + - weight + type: object + type: array x-kubernetes-list-type: atomic requiredDuringSchedulingIgnoredDuringExecution: description: |- @@ -6604,31 +7199,21 @@ spec: If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to an update), the system may or may not try to eventually evict the pod from its node. - type: object - required: - - nodeSelectorTerms properties: nodeSelectorTerms: description: Required. A list of node selector terms. The terms are ORed. - type: array items: description: |- A null or empty node selector term matches no objects. The requirements of them are ANDed. The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. - type: object properties: matchExpressions: description: A list of node selector requirements by node's labels. - type: array items: description: |- A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator properties: key: description: The label key that the selector applies to. @@ -6645,22 +7230,22 @@ spec: the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. - type: array items: type: string + type: array x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array x-kubernetes-list-type: atomic matchFields: description: A list of node selector requirements by node's fields. - type: array items: description: |- A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator properties: key: description: The label key that the selector applies to. @@ -6677,17 +7262,27 @@ spec: the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. - type: array items: type: string + type: array x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array x-kubernetes-list-type: atomic + type: object x-kubernetes-map-type: atomic + type: array x-kubernetes-list-type: atomic + required: + - nodeSelectorTerms + type: object x-kubernetes-map-type: atomic + type: object podAffinity: description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)). - type: object properties: preferredDuringSchedulingIgnoredDuringExecution: description: |- @@ -6700,37 +7295,23 @@ spec: compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. - type: array items: description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) - type: object - required: - - podAffinityTerm - - weight properties: podAffinityTerm: description: Required. A pod affinity term, associated with the corresponding weight. - type: object - required: - - topologyKey properties: labelSelector: description: |- A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods. - type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator properties: key: description: key is the label key that the selector applies to. @@ -6746,19 +7327,25 @@ spec: the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array items: type: string + type: array x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array x-kubernetes-list-type: atomic matchLabels: + additionalProperties: + type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - additionalProperties: - type: string + type: object x-kubernetes-map-type: atomic matchLabelKeys: description: |- @@ -6770,10 +7357,9 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). - type: array items: type: string + type: array x-kubernetes-list-type: atomic mismatchLabelKeys: description: |- @@ -6785,10 +7371,9 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). - type: array items: type: string + type: array x-kubernetes-list-type: atomic namespaceSelector: description: |- @@ -6797,19 +7382,13 @@ spec: and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. - type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator properties: key: description: key is the label key that the selector applies to. @@ -6825,19 +7404,25 @@ spec: the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array items: type: string + type: array x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array x-kubernetes-list-type: atomic matchLabels: + additionalProperties: + type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - additionalProperties: - type: string + type: object x-kubernetes-map-type: atomic namespaces: description: |- @@ -6845,9 +7430,9 @@ spec: The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". - type: array items: type: string + type: array x-kubernetes-list-type: atomic topologyKey: description: |- @@ -6857,12 +7442,20 @@ spec: selected pods is running. Empty topologyKey is not allowed. type: string + required: + - topologyKey + type: object weight: description: |- weight associated with matching the corresponding podAffinityTerm, in the range 1-100. - type: integer format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array x-kubernetes-list-type: atomic requiredDuringSchedulingIgnoredDuringExecution: description: |- @@ -6873,7 +7466,6 @@ spec: system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied. - type: array items: description: |- Defines a set of pods (namely those matching the labelSelector @@ -6882,27 +7474,18 @@ spec: where co-located is defined as running on a node whose value of the label with key matches that of any node on which a pod of the set of pods is running - type: object - required: - - topologyKey properties: labelSelector: description: |- A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods. - type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator properties: key: description: key is the label key that the selector applies to. @@ -6918,19 +7501,25 @@ spec: the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array items: type: string + type: array x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array x-kubernetes-list-type: atomic matchLabels: + additionalProperties: + type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - additionalProperties: - type: string + type: object x-kubernetes-map-type: atomic matchLabelKeys: description: |- @@ -6942,10 +7531,9 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). - type: array items: type: string + type: array x-kubernetes-list-type: atomic mismatchLabelKeys: description: |- @@ -6957,10 +7545,9 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). - type: array items: type: string + type: array x-kubernetes-list-type: atomic namespaceSelector: description: |- @@ -6969,19 +7556,13 @@ spec: and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. - type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator properties: key: description: key is the label key that the selector applies to. @@ -6997,19 +7578,25 @@ spec: the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array items: type: string + type: array x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array x-kubernetes-list-type: atomic matchLabels: + additionalProperties: + type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - additionalProperties: - type: string + type: object x-kubernetes-map-type: atomic namespaces: description: |- @@ -7017,9 +7604,9 @@ spec: The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". - type: array items: type: string + type: array x-kubernetes-list-type: atomic topologyKey: description: |- @@ -7029,10 +7616,14 @@ spec: selected pods is running. Empty topologyKey is not allowed. type: string + required: + - topologyKey + type: object + type: array x-kubernetes-list-type: atomic + type: object podAntiAffinity: description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)). - type: object properties: preferredDuringSchedulingIgnoredDuringExecution: description: |- @@ -7042,40 +7633,26 @@ spec: most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling anti-affinity expressions, etc.), - compute a sum by iterating through the elements of this field and adding - "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + compute a sum by iterating through the elements of this field and subtracting + "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. - type: array items: description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) - type: object - required: - - podAffinityTerm - - weight properties: podAffinityTerm: description: Required. A pod affinity term, associated with the corresponding weight. - type: object - required: - - topologyKey properties: labelSelector: description: |- A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods. - type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator properties: key: description: key is the label key that the selector applies to. @@ -7091,19 +7668,25 @@ spec: the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array items: type: string + type: array x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array x-kubernetes-list-type: atomic matchLabels: + additionalProperties: + type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - additionalProperties: - type: string + type: object x-kubernetes-map-type: atomic matchLabelKeys: description: |- @@ -7115,10 +7698,9 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). - type: array items: type: string + type: array x-kubernetes-list-type: atomic mismatchLabelKeys: description: |- @@ -7130,10 +7712,9 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). - type: array items: type: string + type: array x-kubernetes-list-type: atomic namespaceSelector: description: |- @@ -7142,19 +7723,13 @@ spec: and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. - type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator properties: key: description: key is the label key that the selector applies to. @@ -7170,19 +7745,25 @@ spec: the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array items: type: string + type: array x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array x-kubernetes-list-type: atomic matchLabels: + additionalProperties: + type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - additionalProperties: - type: string + type: object x-kubernetes-map-type: atomic namespaces: description: |- @@ -7190,9 +7771,9 @@ spec: The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". - type: array items: type: string + type: array x-kubernetes-list-type: atomic topologyKey: description: |- @@ -7202,12 +7783,20 @@ spec: selected pods is running. Empty topologyKey is not allowed. type: string + required: + - topologyKey + type: object weight: description: |- weight associated with matching the corresponding podAffinityTerm, in the range 1-100. - type: integer format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array x-kubernetes-list-type: atomic requiredDuringSchedulingIgnoredDuringExecution: description: |- @@ -7218,7 +7807,6 @@ spec: system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied. - type: array items: description: |- Defines a set of pods (namely those matching the labelSelector @@ -7227,27 +7815,18 @@ spec: where co-located is defined as running on a node whose value of the label with key matches that of any node on which a pod of the set of pods is running - type: object - required: - - topologyKey properties: labelSelector: description: |- A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods. - type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator properties: key: description: key is the label key that the selector applies to. @@ -7263,19 +7842,25 @@ spec: the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array items: type: string + type: array x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array x-kubernetes-list-type: atomic matchLabels: + additionalProperties: + type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - additionalProperties: - type: string + type: object x-kubernetes-map-type: atomic matchLabelKeys: description: |- @@ -7287,10 +7872,9 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). - type: array items: type: string + type: array x-kubernetes-list-type: atomic mismatchLabelKeys: description: |- @@ -7302,10 +7886,9 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). - type: array items: type: string + type: array x-kubernetes-list-type: atomic namespaceSelector: description: |- @@ -7314,19 +7897,13 @@ spec: and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. - type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator properties: key: description: key is the label key that the selector applies to. @@ -7342,19 +7919,25 @@ spec: the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array items: type: string + type: array x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array x-kubernetes-list-type: atomic matchLabels: + additionalProperties: + type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - additionalProperties: - type: string + type: object x-kubernetes-map-type: atomic namespaces: description: |- @@ -7362,9 +7945,9 @@ spec: The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". - type: array items: type: string + type: array x-kubernetes-list-type: atomic topologyKey: description: |- @@ -7374,17 +7957,22 @@ spec: selected pods is running. Empty topologyKey is not allowed. type: string + required: + - topologyKey + type: object + type: array x-kubernetes-list-type: atomic + type: object + type: object imagePullSecrets: description: If specified, the pod's imagePullSecrets - type: array items: description: |- LocalObjectReference contains enough information to let you locate the referenced object inside the same namespace. - type: object properties: name: + default: "" description: |- Name of the referent. This field is effectively required, but due to backwards compatibility is @@ -7392,22 +7980,59 @@ spec: almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string - default: "" + type: object x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map nodeSelector: + additionalProperties: + type: string description: |- NodeSelector is a selector which must be true for the pod to fit on a node. Selector which must match a node's labels for the pod to be scheduled on that node. More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ type: object - additionalProperties: - type: string priorityClassName: description: If specified, the pod's priorityClassName. type: string + resources: + description: |- + If specified, the pod's resource requirements. + These values override the global resource configuration flags. + Note that when only specifying resource limits, ensure they are greater than or equal + to the corresponding global resource requests configured via controller flags + (--acme-http01-solver-resource-request-cpu, --acme-http01-solver-resource-request-memory). + Kubernetes will reject pod creation if limits are lower than requests, causing challenge failures. + properties: + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to the global values configured via controller flags. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object securityContext: description: If specified, the pod's security context - type: object properties: fsGroup: description: |- @@ -7421,8 +8046,8 @@ spec: If unset, the Kubelet will not modify the ownership and permissions of any volume. Note that this field cannot be set when spec.os.name is windows. - type: integer format: int64 + type: integer fsGroupChangePolicy: description: |- fsGroupChangePolicy defines behavior of changing ownership and permission of the volume @@ -7441,8 +8066,8 @@ spec: PodSecurityContext, the value specified in SecurityContext takes precedence for that container. Note that this field cannot be set when spec.os.name is windows. - type: integer format: int64 + type: integer runAsNonRoot: description: |- Indicates that the container must run as a non-root user. @@ -7460,8 +8085,8 @@ spec: PodSecurityContext, the value specified in SecurityContext takes precedence for that container. Note that this field cannot be set when spec.os.name is windows. - type: integer format: int64 + type: integer seLinuxOptions: description: |- The SELinux context to be applied to all containers. @@ -7470,7 +8095,6 @@ spec: both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence for that container. Note that this field cannot be set when spec.os.name is windows. - type: object properties: level: description: Level is SELinux level label that applies to the container. @@ -7484,13 +8108,11 @@ spec: user: description: User is a SELinux user label that applies to the container. type: string + type: object seccompProfile: description: |- The seccomp options to use by the containers in this pod. Note that this field cannot be set when spec.os.name is windows. - type: object - required: - - type properties: localhostProfile: description: |- @@ -7508,6 +8130,9 @@ spec: RuntimeDefault - the container runtime default profile should be used. Unconfined - no profile should be applied. type: string + required: + - type + type: object supplementalGroups: description: |- A list of groups applied to the first process run in each container, in addition @@ -7517,22 +8142,18 @@ spec: defined in the container image for the uid of the container process are still effective, even if they are not included in this list. Note that this field cannot be set when spec.os.name is windows. - type: array items: - type: integer format: int64 + type: integer + type: array + x-kubernetes-list-type: atomic sysctls: description: |- Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported sysctls (by the container runtime) might fail to launch. Note that this field cannot be set when spec.os.name is windows. - type: array items: description: Sysctl defines a kernel parameter to be set - type: object - required: - - name - - value properties: name: description: Name of a property to set @@ -7540,17 +8161,22 @@ spec: value: description: Value of a property to set type: string + required: + - name + - value + type: object + type: array + x-kubernetes-list-type: atomic + type: object serviceAccountName: description: If specified, the pod's service account type: string tolerations: description: If specified, the pod's tolerations. - type: array items: description: |- The pod this Toleration is attached to tolerates any taint that matches the triple using the matching operator . - type: object properties: effect: description: |- @@ -7565,9 +8191,10 @@ spec: operator: description: |- Operator represents a key's relationship to the value. - Valid operators are Exists and Equal. Defaults to Equal. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). type: string tolerationSeconds: description: |- @@ -7575,18 +8202,25 @@ spec: of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, it is not set, which means tolerate the taint forever (do not evict). Zero and negative values will be treated as 0 (evict immediately) by the system. - type: integer format: int64 + type: integer value: description: |- Value is the taint value the toleration matches to. If the operator is Exists, the value should be empty, otherwise just a regular string. type: string + type: object + type: array + x-kubernetes-list-type: atomic + type: object + type: object serviceType: description: |- Optional service type for Kubernetes solver service. Supported values are NodePort or ClusterIP. If unset, defaults to NodePort. type: string + type: object + type: object selector: description: |- Selector selects a set of DNSNames on the Certificate resource that @@ -7594,7 +8228,6 @@ spec: If not specified, the solver will be treated as the 'default' solver with the lowest priority, i.e. if any other solver has a more specific match, it will be used instead. - type: object properties: dnsNames: description: |- @@ -7605,9 +8238,10 @@ spec: with the most matching labels in matchLabels will be selected. If neither has more matches, the solver defined earlier in the list will be selected. - type: array items: type: string + type: array + x-kubernetes-list-type: atomic dnsZones: description: |- List of DNSZones that this solver will be used to solve. @@ -7619,41 +8253,67 @@ spec: with the most matching labels in matchLabels will be selected. If neither has more matches, the solver defined earlier in the list will be selected. - type: array items: type: string + type: array + x-kubernetes-list-type: atomic matchLabels: + additionalProperties: + type: string description: |- A label selector that is used to refine the set of certificate's that this challenge solver will apply to. type: object - additionalProperties: - type: string + type: object + waitInsteadOfSelfCheck: + description: |- + WaitInsteadOfSelfCheck, if set, skips cert-manager's self-check and + instead waits this long after presentation before asking the ACME server + to validate the challenge. + + This is an advanced escape hatch for environments where cert-manager's + self-check cannot succeed from its own network or DNS viewpoint even + though the ACME server can still validate successfully, for example due + to split-horizon DNS or NAT hairpinning. + + A value of 0 skips the self-check and asks the ACME server to validate + immediately after presentation, relying on the ACME server's own + validation retries (RFC 8555 section 8.2) to succeed once the challenge + has propagated. A negative duration is rejected. + Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration, + for example `30s` or `2m`. + type: string + type: object + type: array + x-kubernetes-list-type: atomic + required: + - privateKeySecretRef + - server + type: object ca: description: |- CA configures this issuer to sign certificates using a signing CA keypair stored in a Secret resource. This is used to build internal PKIs that are managed by cert-manager. - type: object - required: - - secretName properties: crlDistributionPoints: description: |- The CRL distribution points is an X.509 v3 certificate extension which identifies the location of the CRL from which the revocation of this certificate can be checked. If not set, certificates will be issued without distribution points set. - type: array items: type: string + type: array + x-kubernetes-list-type: atomic issuingCertificateURLs: description: |- IssuingCertificateURLs is a list of URLs which this issuer should embed into certificates it creates. See https://www.rfc-editor.org/rfc/rfc5280#section-4.2.2.1 for more details. As an example, such a URL might be "http://ca.domain.com/ca.crt". - type: array items: type: string + type: array + x-kubernetes-list-type: atomic ocspServers: description: |- The OCSP server list is an X.509 v3 extension that defines a list of @@ -7661,51 +8321,45 @@ spec: revocation status of an issued certificate. If not set, the certificate will be issued with no OCSP servers set. For example, an OCSP server URL could be "http://ocsp.int-x3.letsencrypt.org". - type: array items: type: string + type: array + x-kubernetes-list-type: atomic secretName: description: |- SecretName is the name of the secret used to sign Certificates issued by this Issuer. type: string + required: + - secretName + type: object selfSigned: description: |- SelfSigned configures this issuer to 'self sign' certificates using the private key used to create the CertificateRequest object. - type: object properties: crlDistributionPoints: description: |- The CRL distribution points is an X.509 v3 certificate extension which identifies the location of the CRL from which the revocation of this certificate can be checked. If not set certificate will be issued without CDP. Values are strings. - type: array items: type: string + type: array + x-kubernetes-list-type: atomic + type: object vault: description: |- Vault configures this issuer to sign certificates using a HashiCorp Vault PKI backend. - type: object - required: - - auth - - path - - server properties: auth: description: Auth configures how cert-manager authenticates with the Vault server. - type: object properties: appRole: description: |- AppRole authenticates with Vault using the App Role auth mechanism, with the role and secret stored in a Kubernetes Secret resource. - type: object - required: - - path - - roleId - - secretRef properties: path: description: |- @@ -7723,9 +8377,6 @@ spec: to authenticate with Vault. The `key` field must be specified and denotes which entry within the Secret resource is used as the app role secret. - type: object - required: - - name properties: key: description: |- @@ -7738,12 +8389,75 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string + required: + - name + type: object + required: + - path + - roleId + - secretRef + type: object + aws: + description: |- + AWS authenticates with Vault using AWS IAM authentication. + This allows authentication using IAM roles for service accounts (IRSA), + EKS Pod Identity (PIA), or ambient credentials (EC2 instance profiles, ECS task role). + properties: + iamRoleArn: + description: |- + The ARN of the AWS IAM role to assume using the Kubernetes service account + token. Required when using IRSA (serviceAccountRef is set). + This role must have a trust policy that allows the OIDC provider to assume it. + type: string + mountPath: + description: |- + The Vault mountPath here is the mount path to use when authenticating with + Vault. For example, setting a value to `/v1/auth/foo`, will use the path + `/v1/auth/foo/login` to authenticate with Vault. If unspecified, the + default value "/v1/auth/aws" will be used. + type: string + region: + description: |- + The AWS region to use for authentication. If not specified, the region + will be determined from AWS_REGION or AWS_DEFAULT_REGION environment + variables, falling back to "us-east-1" if not set. + type: string + role: + description: A required field containing the Vault Role to assume when authenticating. + minLength: 1 + type: string + serviceAccountRef: + description: |- + A reference to a service account that will be used to request a web identity + token for IRSA (IAM Roles for Service Accounts) authentication. + properties: + audiences: + description: |- + TokenAudiences is an optional list of extra audiences to include in the token passed to Vault. + The default audiences are always included in the token. + items: + type: string + type: array + x-kubernetes-list-type: atomic + name: + description: Name of the ServiceAccount used to request a token. + type: string + required: + - name + type: object + vaultHeaderValue: + description: |- + The Vault header value to include in the STS signing request. + This is used to prevent replay attacks. + type: string + required: + - role + type: object clientCertificate: description: |- ClientCertificate authenticates with Vault by presenting a client certificate during the request's TLS handshake. Works only when using HTTPS protocol. - type: object properties: mountPath: description: |- @@ -7763,13 +8477,11 @@ spec: tls.crt and tls.key) used to authenticate to Vault using TLS client authentication. type: string + type: object kubernetes: description: |- Kubernetes authenticates with Vault by passing the ServiceAccount token stored in the named Secret resource to the Vault server. - type: object - required: - - role properties: mountPath: description: |- @@ -7788,9 +8500,6 @@ spec: The required Secret field containing a Kubernetes ServiceAccount JWT used for authenticating with Vault. Use of 'ambient credentials' is not supported. - type: object - required: - - name properties: key: description: |- @@ -7803,6 +8512,9 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string + required: + - name + type: object serviceAccountRef: description: |- A reference to a service account that will be used to request a bound @@ -7810,25 +8522,26 @@ spec: using this field means that you don't rely on statically bound tokens. To use this field, you must configure an RBAC rule to let cert-manager request a token. - type: object - required: - - name properties: audiences: description: |- - TokenAudiences is an optional list of extra audiences to include in the token passed to Vault. The default token - consisting of the issuer's namespace and name is always included. - type: array + TokenAudiences is an optional list of extra audiences to include in the token passed to Vault. + The default audiences are always included in the token. items: type: string + type: array + x-kubernetes-list-type: atomic name: description: Name of the ServiceAccount used to request a token. type: string + required: + - name + type: object + required: + - role + type: object tokenSecretRef: description: TokenSecretRef authenticates with Vault by presenting a token. - type: object - required: - - name properties: key: description: |- @@ -7841,6 +8554,10 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string + required: + - name + type: object + type: object caBundle: description: |- Base64-encoded bundle of PEM CAs which will be used to validate the certificate @@ -7849,8 +8566,8 @@ spec: Mutually exclusive with CABundleSecretRef. If neither CABundle nor CABundleSecretRef are defined, the certificate bundle in the cert-manager controller container is used to validate the TLS connection. - type: string format: byte + type: string caBundleSecretRef: description: |- Reference to a Secret containing a bundle of PEM-encoded CAs to use when @@ -7859,9 +8576,6 @@ spec: If neither CABundle nor CABundleSecretRef are defined, the certificate bundle in the cert-manager controller container is used to validate the TLS connection. If no key for the Secret is specified, cert-manager will default to 'ca.crt'. - type: object - required: - - name properties: key: description: |- @@ -7874,13 +8588,13 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string + required: + - name + type: object clientCertSecretRef: description: |- Reference to a Secret containing a PEM-encoded Client Certificate to use when the Vault server requires mTLS. - type: object - required: - - name properties: key: description: |- @@ -7893,13 +8607,13 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string + required: + - name + type: object clientKeySecretRef: description: |- Reference to a Secret containing a PEM-encoded Client Private Key to use when the Vault server requires mTLS. - type: object - required: - - name properties: key: description: |- @@ -7912,6 +8626,9 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string + required: + - name + type: object namespace: description: |- Name of the vault namespace. Namespaces is a set of features within Vault Enterprise that allows Vault environments to support Secure Multi-tenancy. e.g: "ns1" @@ -7925,27 +8642,28 @@ spec: server: description: 'Server is the connection address for the Vault server, e.g: "https://vault.example.com:8200".' type: string + serverName: + description: |- + ServerName is used to verify the hostname on the returned certificates + by the Vault server. + type: string + required: + - auth + - path + - server + type: object venafi: description: |- - Venafi configures this issuer to sign certificates using a Venafi TPP - or Venafi Cloud policy zone. - type: object - required: - - zone + Venafi configures this issuer to sign certificates using a CyberArk Certificate Manager Self-Hosted + or SaaS policy zone. properties: cloud: description: |- - Cloud specifies the Venafi cloud configuration settings. - Only one of TPP or Cloud may be specified. - type: object - required: - - apiTokenSecretRef + Cloud specifies the CyberArk Certificate Manager SaaS configuration settings. + Only one of CyberArk Certificate Manager may be specified. properties: apiTokenSecretRef: - description: APITokenSecretRef is a secret key selector for the Venafi Cloud API token. - type: object - required: - - name + description: APITokenSecretRef is a secret key selector for the CyberArk Certificate Manager SaaS API token. properties: key: description: |- @@ -7958,38 +8676,77 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string + required: + - name + type: object url: description: |- - URL is the base URL for Venafi Cloud. - Defaults to "https://api.venafi.cloud/v1". + URL is the base URL for CyberArk Certificate Manager SaaS. + Defaults to "https://api.venafi.cloud/". type: string - tpp: - description: |- - TPP specifies Trust Protection Platform configuration settings. - Only one of TPP or Cloud may be specified. + required: + - apiTokenSecretRef type: object + ngts: + description: |- + NGTS specifies Palo Alto Networks Next Generation Trust Services (NGTS) configuration + using OAuth 2.0 Client Credentials. Only one of tpp, cloud, or ngts may be specified. + properties: + credentialsRef: + description: |- + CredentialsRef is a reference to a Kubernetes Secret containing the OAuth 2.0 + Client ID and Client Secret. The secret must contain the keys 'client-id' and + 'client-secret'. + properties: + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + required: + - name + type: object + tokenEndpoint: + description: |- + TokenEndpoint is the OAuth 2.0 token endpoint URL used to obtain access tokens, + for example "https://auth.apps.paloaltonetworks.com/oauth2/access_token". + Defaults to "https://auth.apps.paloaltonetworks.com/oauth2/access_token" if not set. + type: string + tsgID: + description: |- + TSGID is the Tenant Service Group ID used to scope the OAuth 2.0 access token, + for example "1234567890". The tsg_id: prefix is added automatically. + This field is required. + type: string + url: + description: |- + URL is the base URL for the NGTS API endpoint. + Defaults to "https://api.strata.paloaltonetworks.com/ngts" if not set. + type: string required: - credentialsRef - - url + - tsgID + type: object + tpp: + description: |- + TPP specifies CyberArk Certificate Manager Self-Hosted configuration settings. + Only one of CyberArk Certificate Manager may be specified. properties: caBundle: description: |- Base64-encoded bundle of PEM CAs which will be used to validate the certificate - chain presented by the TPP server. Only used if using HTTPS; ignored for HTTP. + chain presented by the CyberArk Certificate Manager Self-Hosted server. Only used if using HTTPS; ignored for HTTP. If undefined, the certificate bundle in the cert-manager controller container is used to validate the chain. - type: string format: byte + type: string caBundleSecretRef: description: |- Reference to a Secret containing a base64-encoded bundle of PEM CAs - which will be used to validate the certificate chain presented by the TPP server. + which will be used to validate the certificate chain presented by the CyberArk Certificate Manager Self-Hosted server. Only used if using HTTPS; ignored for HTTP. Mutually exclusive with CABundle. If neither CABundle nor CABundleSecretRef is defined, the certificate bundle in the cert-manager controller container is used to validate the TLS connection. - type: object - required: - - name properties: key: description: |- @@ -8002,42 +8759,54 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string + required: + - name + type: object credentialsRef: description: |- - CredentialsRef is a reference to a Secret containing the Venafi TPP API credentials. + CredentialsRef is a reference to a Secret containing the CyberArk Certificate Manager Self-Hosted API credentials. The secret must contain the key 'access-token' for the Access Token Authentication, or two keys, 'username' and 'password' for the API Keys Authentication. - type: object - required: - - name properties: name: description: |- Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string + required: + - name + type: object url: description: |- - URL is the base URL for the vedsdk endpoint of the Venafi TPP instance, + URL is the base URL for the vedsdk endpoint of the CyberArk Certificate Manager Self-Hosted instance, for example: "https://tpp.example.com/vedsdk". type: string + required: + - credentialsRef + - url + type: object zone: description: |- - Zone is the Venafi Policy Zone to use for this issuer. - All requests made to the Venafi platform will be restricted by the named + Zone is the Certificate Manager Policy Zone to use for this issuer. + All requests made to the Certificate Manager platform will be restricted by the named zone policy. This field is required. type: string + required: + - zone + type: object + x-kubernetes-validations: + - message: exactly one of tpp, cloud, or ngts must be configured + rule: '(has(self.tpp) ? 1 : 0) + (has(self.cloud) ? 1 : 0) + (has(self.ngts) ? 1 : 0) == 1' + type: object status: description: Status of the ClusterIssuer. This is set and managed automatically. - type: object properties: acme: description: |- ACME specific status options. This field should only be set if the Issuer is configured to use an ACME server to issue certificates. - type: object properties: lastPrivateKeyHash: description: |- @@ -8056,24 +8825,20 @@ spec: URI is the unique account identifier, which can also be used to retrieve account details from the CA type: string + type: object conditions: description: |- List of status conditions to indicate the status of a CertificateRequest. Known condition types are `Ready`. - type: array items: description: IssuerCondition contains condition information for an Issuer. - type: object - required: - - status - - type properties: lastTransitionTime: description: |- LastTransitionTime is the timestamp corresponding to the last status change of this condition. - type: string format: date-time + type: string message: description: |- Message is a human readable description of the details of the last @@ -8086,8 +8851,8 @@ spec: For instance, if .metadata.generation is currently 12, but the .status.condition[x].observedGeneration is 9, the condition is out of date with respect to the current state of the Issuer. - type: integer format: int64 + type: integer reason: description: |- Reason is a brief machine readable explanation for the condition's last @@ -8095,67 +8860,73 @@ spec: type: string status: description: Status of the condition, one of (`True`, `False`, `Unknown`). - type: string enum: - "True" - "False" - Unknown + type: string type: description: Type of the condition, known values are (`Ready`). type: string + required: + - status + - type + type: object + type: array x-kubernetes-list-map-keys: - type x-kubernetes-list-type: map + type: object + required: + - spec + type: object served: true storage: true + subresources: + status: {} -# END crd --- -# Source: cert-manager/templates/crds.yaml -# START crd +# Source: cert-manager/templates/crd-cert-manager.io_issuers.yaml apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: - name: issuers.cert-manager.io - # START annotations + name: "issuers.cert-manager.io" annotations: helm.sh/resource-policy: keep - # END annotations labels: - app: 'cert-manager' - app.kubernetes.io/name: 'cert-manager' - app.kubernetes.io/instance: 'cert-manager' + app: "cert-manager" + app.kubernetes.io/name: "cert-manager" + app.kubernetes.io/instance: "cert-manager" app.kubernetes.io/component: "crds" - # Generated labels - app.kubernetes.io/version: "v1.17.0" + app.kubernetes.io/version: "v1.21.1" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.17.0 + helm.sh/chart: cert-manager-v1.21.1 spec: group: cert-manager.io names: + categories: + - cert-manager kind: Issuer listKind: IssuerList plural: issuers + shortNames: + - iss singular: issuer - categories: - - cert-manager scope: Namespaced versions: - - name: v1 - subresources: - status: {} - additionalPrinterColumns: - - jsonPath: .status.conditions[?(@.type=="Ready")].status + - additionalPrinterColumns: + - jsonPath: .status.conditions[?(@.type == "Ready")].status name: Ready type: string - - jsonPath: .status.conditions[?(@.type=="Ready")].message + - jsonPath: .status.conditions[?(@.type == "Ready")].message name: Status priority: 1 type: string - - jsonPath: .metadata.creationTimestamp - description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. + - description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. + jsonPath: .metadata.creationTimestamp name: Age type: date + name: v1 schema: openAPIV3Schema: description: |- @@ -8163,9 +8934,6 @@ spec: referenced as part of `issuerRef` fields. It is scoped to a single namespace and can therefore only be referenced by resources within the same namespace. - type: object - required: - - spec properties: apiVersion: description: |- @@ -8186,16 +8954,11 @@ spec: type: object spec: description: Desired state of the Issuer resource. - type: object properties: acme: description: |- ACME configures this issuer to communicate with a RFC8555 (ACME) server to obtain signed x509 certificates. - type: object - required: - - privateKeySecretRef - - server properties: caBundle: description: |- @@ -8205,8 +8968,8 @@ spec: kinds of security vulnerabilities. If CABundle and SkipTLSVerify are unset, the system certificate bundle inside the container is used to validate the TLS connection. - type: string format: byte + type: string disableAccountKeyGeneration: description: |- Enables or disables generating a new ACME account key. @@ -8238,21 +9001,17 @@ spec: server. If set, upon registration cert-manager will attempt to associate the given external account credentials with the registered ACME account. - type: object - required: - - keyID - - keySecretRef properties: keyAlgorithm: description: |- Deprecated: keyAlgorithm field exists for historical compatibility reasons and should not be used. The algorithm is now hardcoded to HS256 in golang/x/crypto/acme. - type: string enum: - HS256 - HS384 - HS512 + type: string keyID: description: keyID is the ID of the CA key that the External Account is bound to. type: string @@ -8265,9 +9024,6 @@ spec: the External Account Binding keyID above. The secret key stored in the Secret **must** be un-padded, base64 URL encoded data. - type: object - required: - - name properties: key: description: |- @@ -8280,18 +9036,25 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string + required: + - name + type: object + required: + - keyID + - keySecretRef + type: object preferredChain: description: |- PreferredChain is the chain to use if the ACME server outputs multiple. PreferredChain is no guarantee that this one gets delivered by the ACME endpoint. - For example, for Let's Encrypt's DST crosssign you would use: + For example, for Let's Encrypt's DST cross-sign you would use: "DST Root CA X3" or "ISRG Root X1" for the newer Let's Encrypt root CA. This value picks the first certificate bundle in the combined set of ACME default and alternative chains that has a root-most certificate with this value as its issuer's commonname. - type: string maxLength: 64 + type: string privateKeySecretRef: description: |- PrivateKey is the name of a Kubernetes Secret resource that will be used to @@ -8299,9 +9062,6 @@ spec: Optionally, a `key` may be specified to select a specific entry within the named Secret resource. If `key` is not specified, a default of `tls.key` will be used. - type: object - required: - - name properties: key: description: |- @@ -8314,6 +9074,14 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string + required: + - name + type: object + profile: + description: |- + Profile allows requesting a certificate profile from the ACME server. + Supported profiles are listed by the server's ACME directory URL. + type: string server: description: |- Server is the URL used to access the ACME server's 'directory' endpoint. @@ -8340,36 +9108,26 @@ spec: Solver configurations must be provided in order to obtain certificates from an ACME server. For more information, see: https://cert-manager.io/docs/configuration/acme/ - type: array items: description: |- An ACMEChallengeSolver describes how to solve ACME challenges for the issuer it is part of. A selector may be provided to use different solving strategies for different DNS names. Only one of HTTP01 or DNS01 must be provided. - type: object properties: dns01: description: |- Configures cert-manager to attempt to complete authorizations by performing the DNS01 challenge flow. - type: object properties: acmeDNS: description: |- Use the 'ACME DNS' (https://github.com/joohoi/acme-dns) API to manage DNS01 challenge records. - type: object - required: - - accountSecretRef - - host properties: accountSecretRef: description: |- A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. - type: object - required: - - name properties: key: description: |- @@ -8382,24 +9140,22 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string + required: + - name + type: object host: type: string + required: + - accountSecretRef + - host + type: object akamai: description: Use the Akamai DNS zone management API to manage DNS01 challenge records. - type: object - required: - - accessTokenSecretRef - - clientSecretSecretRef - - clientTokenSecretRef - - serviceConsumerDomain properties: accessTokenSecretRef: description: |- A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. - type: object - required: - - name properties: key: description: |- @@ -8412,13 +9168,13 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string + required: + - name + type: object clientSecretSecretRef: description: |- A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. - type: object - required: - - name properties: key: description: |- @@ -8431,13 +9187,13 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string + required: + - name + type: object clientTokenSecretRef: description: |- A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. - type: object - required: - - name properties: key: description: |- @@ -8450,14 +9206,19 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string + required: + - name + type: object serviceConsumerDomain: type: string + required: + - accessTokenSecretRef + - clientSecretSecretRef + - clientTokenSecretRef + - serviceConsumerDomain + type: object azureDNS: description: Use the Microsoft Azure DNS API to manage DNS01 challenge records. - type: object - required: - - resourceGroupName - - subscriptionID properties: clientID: description: |- @@ -8470,9 +9231,6 @@ spec: Auth: Azure Service Principal: A reference to a Secret containing the password associated with the Service Principal. If set, ClientID and TenantID must also be set. - type: object - required: - - name properties: key: description: |- @@ -8485,14 +9243,17 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string + required: + - name + type: object environment: description: name of the Azure environment (default AzurePublicCloud) - type: string enum: - AzurePublicCloud - AzureChinaCloud - AzureGermanCloud - AzureUSGovernmentCloud + type: string hostedZoneName: description: name of the DNS zone that should be used type: string @@ -8501,19 +9262,19 @@ spec: Auth: Azure Workload Identity or Azure Managed Service Identity: Settings to enable Azure Workload Identity or Azure Managed Service Identity If set, ClientID, ClientSecret and TenantID must not be set. - type: object properties: clientID: - description: client ID of the managed identity, can not be used at the same time as resourceID + description: client ID of the managed identity, cannot be used at the same time as resourceID type: string resourceID: description: |- - resource ID of the managed identity, can not be used at the same time as clientID + resource ID of the managed identity, cannot be used at the same time as clientID Cannot be used for Azure Managed Service Identity type: string tenantID: - description: tenant ID of the managed identity, can not be used at the same time as resourceID + description: tenant ID of the managed identity, cannot be used at the same time as resourceID type: string + type: object resourceGroupName: description: resource group the DNS zone is located in type: string @@ -8526,11 +9287,28 @@ spec: The TenantID of the Azure Service Principal used to authenticate with Azure DNS. If set, ClientID and ClientSecret must also be set. type: string + zoneType: + description: |- + ZoneType determines which type of Azure DNS zone to use. + + Valid values are: + - AzurePublicZone (default): Use a public Azure DNS zone. + - AzurePrivateZone: Use an Azure Private DNS zone. + + If not specified, AzurePublicZone is used. + + Support for Azure Private DNS zones is currently + experimental and may change in future releases. + enum: + - AzurePublicZone + - AzurePrivateZone + type: string + required: + - resourceGroupName + - subscriptionID + type: object cloudDNS: description: Use the Google Cloud DNS API to manage DNS01 challenge records. - type: object - required: - - project properties: hostedZoneName: description: |- @@ -8544,9 +9322,6 @@ spec: description: |- A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. - type: object - required: - - name properties: key: description: |- @@ -8559,18 +9334,20 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string + required: + - name + type: object + required: + - project + type: object cloudflare: description: Use the Cloudflare API to manage DNS01 challenge records. - type: object properties: apiKeySecretRef: description: |- API key to use to authenticate with Cloudflare. Note: using an API token to authenticate is now the recommended method as it allows greater control of permissions. - type: object - required: - - name properties: key: description: |- @@ -8583,11 +9360,11 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string - apiTokenSecretRef: - description: API token used to authenticate with Cloudflare. - type: object required: - name + type: object + apiTokenSecretRef: + description: API token used to authenticate with Cloudflare. properties: key: description: |- @@ -8600,30 +9377,28 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string + required: + - name + type: object email: description: Email of the account, only required when using API key based authentication. type: string + type: object cnameStrategy: description: |- CNAMEStrategy configures how the DNS01 provider should handle CNAME records when found in DNS zones. - type: string enum: - None - Follow + type: string digitalocean: description: Use the DigitalOcean DNS API to manage DNS01 challenge records. - type: object - required: - - tokenSecretRef properties: tokenSecretRef: description: |- A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. - type: object - required: - - name properties: key: description: |- @@ -8636,21 +9411,30 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string + required: + - name + type: object + required: + - tokenSecretRef + type: object rfc2136: description: |- Use RFC2136 ("Dynamic Updates in the Domain Name System") (https://datatracker.ietf.org/doc/rfc2136/) to manage DNS01 challenge records. - type: object - required: - - nameserver properties: nameserver: description: |- The IP address or hostname of an authoritative DNS server supporting RFC2136 in the form host:port. If the host is an IPv6 address it must be - enclosed in square brackets (e.g [2001:db8::1]) ; port is optional. + enclosed in square brackets (e.g [2001:db8::1]); port is optional. This field is required. type: string + protocol: + description: Protocol to use for dynamic DNS update queries. Valid values are (case-sensitive) ``TCP`` and ``UDP``; ``UDP`` (default). + enum: + - TCP + - UDP + type: string tsigAlgorithm: description: |- The TSIG Algorithm configured in the DNS supporting RFC2136. Used only @@ -8667,9 +9451,6 @@ spec: description: |- The name of the secret containing the TSIG value. If ``tsigKeyName`` is defined, this field is required. - type: object - required: - - name properties: key: description: |- @@ -8682,16 +9463,21 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string + required: + - name + type: object + required: + - nameserver + type: object route53: description: Use the AWS Route53 API to manage DNS01 challenge records. - type: object properties: accessKeyID: description: |- The AccessKeyID is used for authentication. Cannot be set when SecretAccessKeyID is set. - If neither the Access Key nor Key ID are set, we fall-back to using env - vars, shared credentials file or AWS Instance metadata, + If neither the Access Key nor Key ID are set, we fall back to using env + vars, shared credentials file, or AWS Instance metadata, see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials type: string accessKeyIDSecretRef: @@ -8699,12 +9485,9 @@ spec: The SecretAccessKey is used for authentication. If set, pull the AWS access key ID from a key within a Kubernetes Secret. Cannot be set when AccessKeyID is set. - If neither the Access Key nor Key ID are set, we fall-back to using env - vars, shared credentials file or AWS Instance metadata, + If neither the Access Key nor Key ID are set, we fall back to using env + vars, shared credentials file, or AWS Instance metadata, see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials - type: object - required: - - name properties: key: description: |- @@ -8717,28 +9500,22 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string + required: + - name + type: object auth: description: Auth configures how cert-manager authenticates. - type: object - required: - - kubernetes properties: kubernetes: description: |- Kubernetes authenticates with Route53 using AssumeRoleWithWebIdentity by passing a bound ServiceAccount token. - type: object - required: - - serviceAccountRef properties: serviceAccountRef: description: |- A reference to a service account that will be used to request a bound token (also known as "projected token"). To use this field, you must configure an RBAC rule to let cert-manager request a token. - type: object - required: - - name properties: audiences: description: |- @@ -8746,12 +9523,22 @@ spec: token passed to AWS. The default token consisting of the issuer's namespace and name is always included. If unset the audience defaults to `sts.amazonaws.com`. - type: array items: type: string + type: array + x-kubernetes-list-type: atomic name: description: Name of the ServiceAccount used to request a token. type: string + required: + - name + type: object + required: + - serviceAccountRef + type: object + required: + - kubernetes + type: object hostedZoneID: description: If set, the provider will manage only this zone in Route53 and will not do a lookup using the route53:ListHostedZonesByName api call. type: string @@ -8788,12 +9575,9 @@ spec: secretAccessKeySecretRef: description: |- The SecretAccessKey is used for authentication. - If neither the Access Key nor Key ID are set, we fall-back to using env - vars, shared credentials file or AWS Instance metadata, + If neither the Access Key nor Key ID are set, we fall back to using env + vars, shared credentials file, or AWS Instance metadata, see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials - type: object - required: - - name properties: key: description: |- @@ -8806,14 +9590,14 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string + required: + - name + type: object + type: object webhook: description: |- Configure an external webhook based DNS01 challenge solver to manage DNS01 challenge records. - type: object - required: - - groupName - - solverName properties: config: description: |- @@ -8821,7 +9605,7 @@ spec: when challenges are processed. This can contain arbitrary JSON data. Secret values should not be specified in this stanza. - If secret values are needed (e.g. credentials for a DNS service), you + If secret values are needed (e.g., credentials for a DNS service), you should use a SecretKeySelector to reference a Secret resource. For details on the schema of this field, consult the webhook provider implementation's documentation. @@ -8837,15 +9621,19 @@ spec: description: |- The name of the solver to use, as defined in the webhook provider implementation. - This will typically be the name of the provider, e.g. 'cloudflare'. + This will typically be the name of the provider, e.g., 'cloudflare'. type: string + required: + - groupName + - solverName + type: object + type: object http01: description: |- Configures cert-manager to attempt to complete authorizations by performing the HTTP01 challenge flow. It is not possible to obtain certificates for wildcard domain names - (e.g. `*.example.com`) using the HTTP01 challenge mechanism. - type: object + (e.g., `*.example.com`) using the HTTP01 challenge mechanism. properties: gatewayHTTPRoute: description: |- @@ -8853,22 +9641,20 @@ spec: in Kubernetes (https://gateway-api.sigs.k8s.io/). The Gateway solver will create HTTPRoutes with the specified labels in the same namespace as the challenge. This solver is experimental, and fields / behaviour may change in the future. - type: object properties: labels: + additionalProperties: + type: string description: |- Custom labels that will be applied to HTTPRoutes created by cert-manager while solving HTTP-01 challenges. type: object - additionalProperties: - type: string parentRefs: description: |- When solving an HTTP-01 challenge, cert-manager creates an HTTPRoute. cert-manager needs to know which parentRefs should be used when creating the HTTPRoute. Usually, the parentRef references a Gateway. See: https://gateway-api.sigs.k8s.io/api-types/httproute/#attaching-to-gateways - type: array items: description: |- ParentReference identifies an API object (usually a Gateway) that can be considered @@ -8883,11 +9669,9 @@ spec: The API object must be valid in the cluster; the Group and Kind must be registered in the cluster for this reference to be valid. - type: object - required: - - name properties: group: + default: gateway.networking.k8s.io description: |- Group is the group of the referent. When unspecified, "gateway.networking.k8s.io" is inferred. @@ -8895,11 +9679,11 @@ spec: Group must be explicitly set to "" (empty string). Support: Core - type: string - default: gateway.networking.k8s.io maxLength: 253 pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string kind: + default: Gateway description: |- Kind is kind of the referent. @@ -8909,19 +9693,18 @@ spec: * Service (Mesh conformance profile, ClusterIP Services only) Support for other resources is Implementation-Specific. - type: string - default: Gateway maxLength: 63 minLength: 1 pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string name: description: |- Name is the name of the referent. Support: Core - type: string maxLength: 253 minLength: 1 + type: string namespace: description: |- Namespace is the namespace of the referent. When unspecified, this refers @@ -8946,10 +9729,10 @@ spec: Support: Core - type: string maxLength: 63 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string port: description: |- Port is the network port this Route targets. It can be interpreted @@ -8982,10 +9765,10 @@ spec: the Route MUST be considered detached from the Gateway. Support: Extended - type: integer format: int32 maximum: 65535 minimum: 1 + type: integer sectionName: description: |- SectionName is the name of a section within the target resource. In the @@ -9012,15 +9795,19 @@ spec: Route MUST be considered detached from the Gateway. Support: Core - type: string maxLength: 253 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + required: + - name + type: object + type: array + x-kubernetes-list-type: atomic podTemplate: description: |- Optional pod template used to configure the ACME challenge solver pods used for HTTP01 challenges. - type: object properties: metadata: description: |- @@ -9028,32 +9815,29 @@ spec: Only the 'labels' and 'annotations' fields may be set. If labels or annotations overlap with in-built values, the values here will override the in-built values. - type: object properties: annotations: + additionalProperties: + type: string description: Annotations that should be added to the created ACME HTTP01 solver pods. type: object + labels: additionalProperties: type: string - labels: description: Labels that should be added to the created ACME HTTP01 solver pods. type: object - additionalProperties: - type: string + type: object spec: description: |- PodSpec defines overrides for the HTTP01 challenge solver pod. Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields. All other fields will be ignored. - type: object properties: affinity: description: If specified, the pod's scheduling constraints - type: object properties: nodeAffinity: description: Describes node affinity scheduling rules for the pod. - type: object properties: preferredDuringSchedulingIgnoredDuringExecution: description: |- @@ -9066,31 +9850,20 @@ spec: compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node matches the corresponding matchExpressions; the node(s) with the highest sum are the most preferred. - type: array items: description: |- An empty preferred scheduling term matches all objects with implicit weight 0 (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). - type: object - required: - - preference - - weight properties: preference: description: A node selector term, associated with the corresponding weight. - type: object properties: matchExpressions: description: A list of node selector requirements by node's labels. - type: array items: description: |- A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator properties: key: description: The label key that the selector applies to. @@ -9107,22 +9880,22 @@ spec: the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. - type: array items: type: string + type: array x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array x-kubernetes-list-type: atomic matchFields: description: A list of node selector requirements by node's fields. - type: array items: description: |- A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator properties: key: description: The label key that the selector applies to. @@ -9139,16 +9912,27 @@ spec: the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. - type: array items: type: string + type: array x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array x-kubernetes-list-type: atomic + type: object x-kubernetes-map-type: atomic weight: description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100. - type: integer format: int32 + type: integer + required: + - preference + - weight + type: object + type: array x-kubernetes-list-type: atomic requiredDuringSchedulingIgnoredDuringExecution: description: |- @@ -9157,31 +9941,21 @@ spec: If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to an update), the system may or may not try to eventually evict the pod from its node. - type: object - required: - - nodeSelectorTerms properties: nodeSelectorTerms: description: Required. A list of node selector terms. The terms are ORed. - type: array items: description: |- A null or empty node selector term matches no objects. The requirements of them are ANDed. The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. - type: object properties: matchExpressions: description: A list of node selector requirements by node's labels. - type: array items: description: |- A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator properties: key: description: The label key that the selector applies to. @@ -9198,22 +9972,22 @@ spec: the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. - type: array items: type: string + type: array x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array x-kubernetes-list-type: atomic matchFields: description: A list of node selector requirements by node's fields. - type: array items: description: |- A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator properties: key: description: The label key that the selector applies to. @@ -9230,17 +10004,27 @@ spec: the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. - type: array items: type: string + type: array x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array x-kubernetes-list-type: atomic + type: object x-kubernetes-map-type: atomic + type: array x-kubernetes-list-type: atomic + required: + - nodeSelectorTerms + type: object x-kubernetes-map-type: atomic + type: object podAffinity: description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)). - type: object properties: preferredDuringSchedulingIgnoredDuringExecution: description: |- @@ -9253,37 +10037,23 @@ spec: compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. - type: array items: description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) - type: object - required: - - podAffinityTerm - - weight properties: podAffinityTerm: description: Required. A pod affinity term, associated with the corresponding weight. - type: object - required: - - topologyKey properties: labelSelector: description: |- A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods. - type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator properties: key: description: key is the label key that the selector applies to. @@ -9299,19 +10069,25 @@ spec: the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array items: type: string + type: array x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array x-kubernetes-list-type: atomic matchLabels: + additionalProperties: + type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - additionalProperties: - type: string + type: object x-kubernetes-map-type: atomic matchLabelKeys: description: |- @@ -9323,10 +10099,9 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). - type: array items: type: string + type: array x-kubernetes-list-type: atomic mismatchLabelKeys: description: |- @@ -9338,10 +10113,9 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). - type: array items: type: string + type: array x-kubernetes-list-type: atomic namespaceSelector: description: |- @@ -9350,19 +10124,13 @@ spec: and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. - type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator properties: key: description: key is the label key that the selector applies to. @@ -9378,19 +10146,25 @@ spec: the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array items: type: string + type: array x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array x-kubernetes-list-type: atomic matchLabels: + additionalProperties: + type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - additionalProperties: - type: string + type: object x-kubernetes-map-type: atomic namespaces: description: |- @@ -9398,9 +10172,9 @@ spec: The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". - type: array items: type: string + type: array x-kubernetes-list-type: atomic topologyKey: description: |- @@ -9410,12 +10184,20 @@ spec: selected pods is running. Empty topologyKey is not allowed. type: string + required: + - topologyKey + type: object weight: description: |- weight associated with matching the corresponding podAffinityTerm, in the range 1-100. - type: integer format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array x-kubernetes-list-type: atomic requiredDuringSchedulingIgnoredDuringExecution: description: |- @@ -9426,7 +10208,6 @@ spec: system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied. - type: array items: description: |- Defines a set of pods (namely those matching the labelSelector @@ -9435,27 +10216,18 @@ spec: where co-located is defined as running on a node whose value of the label with key matches that of any node on which a pod of the set of pods is running - type: object - required: - - topologyKey properties: labelSelector: description: |- A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods. - type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator properties: key: description: key is the label key that the selector applies to. @@ -9471,19 +10243,25 @@ spec: the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array items: type: string + type: array x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array x-kubernetes-list-type: atomic matchLabels: + additionalProperties: + type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - additionalProperties: - type: string + type: object x-kubernetes-map-type: atomic matchLabelKeys: description: |- @@ -9495,10 +10273,9 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). - type: array items: type: string + type: array x-kubernetes-list-type: atomic mismatchLabelKeys: description: |- @@ -9510,10 +10287,9 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). - type: array items: type: string + type: array x-kubernetes-list-type: atomic namespaceSelector: description: |- @@ -9522,19 +10298,13 @@ spec: and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. - type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator properties: key: description: key is the label key that the selector applies to. @@ -9550,19 +10320,25 @@ spec: the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array items: type: string + type: array x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array x-kubernetes-list-type: atomic matchLabels: + additionalProperties: + type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - additionalProperties: - type: string + type: object x-kubernetes-map-type: atomic namespaces: description: |- @@ -9570,9 +10346,9 @@ spec: The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". - type: array items: type: string + type: array x-kubernetes-list-type: atomic topologyKey: description: |- @@ -9582,10 +10358,14 @@ spec: selected pods is running. Empty topologyKey is not allowed. type: string + required: + - topologyKey + type: object + type: array x-kubernetes-list-type: atomic + type: object podAntiAffinity: description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)). - type: object properties: preferredDuringSchedulingIgnoredDuringExecution: description: |- @@ -9595,40 +10375,26 @@ spec: most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling anti-affinity expressions, etc.), - compute a sum by iterating through the elements of this field and adding - "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + compute a sum by iterating through the elements of this field and subtracting + "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. - type: array items: description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) - type: object - required: - - podAffinityTerm - - weight properties: podAffinityTerm: description: Required. A pod affinity term, associated with the corresponding weight. - type: object - required: - - topologyKey properties: labelSelector: description: |- A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods. - type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator properties: key: description: key is the label key that the selector applies to. @@ -9644,19 +10410,25 @@ spec: the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array items: type: string + type: array x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array x-kubernetes-list-type: atomic matchLabels: + additionalProperties: + type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - additionalProperties: - type: string + type: object x-kubernetes-map-type: atomic matchLabelKeys: description: |- @@ -9668,10 +10440,9 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). - type: array items: type: string + type: array x-kubernetes-list-type: atomic mismatchLabelKeys: description: |- @@ -9683,10 +10454,9 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). - type: array items: type: string + type: array x-kubernetes-list-type: atomic namespaceSelector: description: |- @@ -9695,19 +10465,13 @@ spec: and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. - type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator properties: key: description: key is the label key that the selector applies to. @@ -9723,19 +10487,25 @@ spec: the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array items: type: string + type: array x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array x-kubernetes-list-type: atomic matchLabels: + additionalProperties: + type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - additionalProperties: - type: string + type: object x-kubernetes-map-type: atomic namespaces: description: |- @@ -9743,9 +10513,9 @@ spec: The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". - type: array items: type: string + type: array x-kubernetes-list-type: atomic topologyKey: description: |- @@ -9755,12 +10525,20 @@ spec: selected pods is running. Empty topologyKey is not allowed. type: string + required: + - topologyKey + type: object weight: description: |- weight associated with matching the corresponding podAffinityTerm, in the range 1-100. - type: integer format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array x-kubernetes-list-type: atomic requiredDuringSchedulingIgnoredDuringExecution: description: |- @@ -9771,7 +10549,6 @@ spec: system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied. - type: array items: description: |- Defines a set of pods (namely those matching the labelSelector @@ -9780,27 +10557,18 @@ spec: where co-located is defined as running on a node whose value of the label with key matches that of any node on which a pod of the set of pods is running - type: object - required: - - topologyKey properties: labelSelector: description: |- A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods. - type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator properties: key: description: key is the label key that the selector applies to. @@ -9816,19 +10584,25 @@ spec: the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array items: type: string + type: array x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array x-kubernetes-list-type: atomic matchLabels: + additionalProperties: + type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - additionalProperties: - type: string + type: object x-kubernetes-map-type: atomic matchLabelKeys: description: |- @@ -9840,10 +10614,9 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). - type: array items: type: string + type: array x-kubernetes-list-type: atomic mismatchLabelKeys: description: |- @@ -9855,10 +10628,9 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). - type: array items: type: string + type: array x-kubernetes-list-type: atomic namespaceSelector: description: |- @@ -9867,19 +10639,13 @@ spec: and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. - type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator properties: key: description: key is the label key that the selector applies to. @@ -9895,19 +10661,25 @@ spec: the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array items: type: string + type: array x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array x-kubernetes-list-type: atomic matchLabels: + additionalProperties: + type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - additionalProperties: - type: string + type: object x-kubernetes-map-type: atomic namespaces: description: |- @@ -9915,9 +10687,9 @@ spec: The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". - type: array items: type: string + type: array x-kubernetes-list-type: atomic topologyKey: description: |- @@ -9927,17 +10699,22 @@ spec: selected pods is running. Empty topologyKey is not allowed. type: string + required: + - topologyKey + type: object + type: array x-kubernetes-list-type: atomic + type: object + type: object imagePullSecrets: description: If specified, the pod's imagePullSecrets - type: array items: description: |- LocalObjectReference contains enough information to let you locate the referenced object inside the same namespace. - type: object properties: name: + default: "" description: |- Name of the referent. This field is effectively required, but due to backwards compatibility is @@ -9945,22 +10722,59 @@ spec: almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string - default: "" + type: object x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map nodeSelector: + additionalProperties: + type: string description: |- NodeSelector is a selector which must be true for the pod to fit on a node. Selector which must match a node's labels for the pod to be scheduled on that node. More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ type: object - additionalProperties: - type: string priorityClassName: description: If specified, the pod's priorityClassName. type: string + resources: + description: |- + If specified, the pod's resource requirements. + These values override the global resource configuration flags. + Note that when only specifying resource limits, ensure they are greater than or equal + to the corresponding global resource requests configured via controller flags + (--acme-http01-solver-resource-request-cpu, --acme-http01-solver-resource-request-memory). + Kubernetes will reject pod creation if limits are lower than requests, causing challenge failures. + properties: + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to the global values configured via controller flags. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object securityContext: description: If specified, the pod's security context - type: object properties: fsGroup: description: |- @@ -9974,8 +10788,8 @@ spec: If unset, the Kubelet will not modify the ownership and permissions of any volume. Note that this field cannot be set when spec.os.name is windows. - type: integer format: int64 + type: integer fsGroupChangePolicy: description: |- fsGroupChangePolicy defines behavior of changing ownership and permission of the volume @@ -9994,8 +10808,8 @@ spec: PodSecurityContext, the value specified in SecurityContext takes precedence for that container. Note that this field cannot be set when spec.os.name is windows. - type: integer format: int64 + type: integer runAsNonRoot: description: |- Indicates that the container must run as a non-root user. @@ -10013,8 +10827,8 @@ spec: PodSecurityContext, the value specified in SecurityContext takes precedence for that container. Note that this field cannot be set when spec.os.name is windows. - type: integer format: int64 + type: integer seLinuxOptions: description: |- The SELinux context to be applied to all containers. @@ -10023,7 +10837,6 @@ spec: both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence for that container. Note that this field cannot be set when spec.os.name is windows. - type: object properties: level: description: Level is SELinux level label that applies to the container. @@ -10037,13 +10850,11 @@ spec: user: description: User is a SELinux user label that applies to the container. type: string + type: object seccompProfile: description: |- The seccomp options to use by the containers in this pod. Note that this field cannot be set when spec.os.name is windows. - type: object - required: - - type properties: localhostProfile: description: |- @@ -10061,6 +10872,9 @@ spec: RuntimeDefault - the container runtime default profile should be used. Unconfined - no profile should be applied. type: string + required: + - type + type: object supplementalGroups: description: |- A list of groups applied to the first process run in each container, in addition @@ -10070,22 +10884,18 @@ spec: defined in the container image for the uid of the container process are still effective, even if they are not included in this list. Note that this field cannot be set when spec.os.name is windows. - type: array items: - type: integer format: int64 + type: integer + type: array + x-kubernetes-list-type: atomic sysctls: description: |- Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported sysctls (by the container runtime) might fail to launch. Note that this field cannot be set when spec.os.name is windows. - type: array items: description: Sysctl defines a kernel parameter to be set - type: object - required: - - name - - value properties: name: description: Name of a property to set @@ -10093,17 +10903,22 @@ spec: value: description: Value of a property to set type: string + required: + - name + - value + type: object + type: array + x-kubernetes-list-type: atomic + type: object serviceAccountName: description: If specified, the pod's service account type: string tolerations: description: If specified, the pod's tolerations. - type: array items: description: |- The pod this Toleration is attached to tolerates any taint that matches the triple using the matching operator . - type: object properties: effect: description: |- @@ -10118,9 +10933,10 @@ spec: operator: description: |- Operator represents a key's relationship to the value. - Valid operators are Exists and Equal. Defaults to Equal. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). type: string tolerationSeconds: description: |- @@ -10128,25 +10944,30 @@ spec: of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, it is not set, which means tolerate the taint forever (do not evict). Zero and negative values will be treated as 0 (evict immediately) by the system. - type: integer format: int64 + type: integer value: description: |- Value is the taint value the toleration matches to. If the operator is Exists, the value should be empty, otherwise just a regular string. type: string + type: object + type: array + x-kubernetes-list-type: atomic + type: object + type: object serviceType: description: |- Optional service type for Kubernetes solver service. Supported values are NodePort or ClusterIP. If unset, defaults to NodePort. type: string + type: object ingress: description: |- The ingress based HTTP01 challenge solver will solve challenges by creating or modifying Ingress resources in order to route requests for '/.well-known/acme-challenge/XYZ' to 'challenge solver' pods that are provisioned by cert-manager for each Challenge to be completed. - type: object properties: class: description: |- @@ -10166,7 +10987,6 @@ spec: description: |- Optional ingress template used to configure the ACME challenge solver ingress used for HTTP01 challenges. - type: object properties: metadata: description: |- @@ -10174,18 +10994,19 @@ spec: Only the 'labels' and 'annotations' fields may be set. If labels or annotations overlap with in-built values, the values here will override the in-built values. - type: object properties: annotations: + additionalProperties: + type: string description: Annotations that should be added to the created ACME HTTP01 solver ingress. type: object + labels: additionalProperties: type: string - labels: description: Labels that should be added to the created ACME HTTP01 solver ingress. type: object - additionalProperties: - type: string + type: object + type: object name: description: |- The name of the ingress resource that should have ACME challenge solving @@ -10199,7 +11020,6 @@ spec: description: |- Optional pod template used to configure the ACME challenge solver pods used for HTTP01 challenges. - type: object properties: metadata: description: |- @@ -10207,32 +11027,29 @@ spec: Only the 'labels' and 'annotations' fields may be set. If labels or annotations overlap with in-built values, the values here will override the in-built values. - type: object properties: annotations: + additionalProperties: + type: string description: Annotations that should be added to the created ACME HTTP01 solver pods. type: object + labels: additionalProperties: type: string - labels: description: Labels that should be added to the created ACME HTTP01 solver pods. type: object - additionalProperties: - type: string + type: object spec: description: |- PodSpec defines overrides for the HTTP01 challenge solver pod. Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields. All other fields will be ignored. - type: object properties: affinity: description: If specified, the pod's scheduling constraints - type: object properties: nodeAffinity: description: Describes node affinity scheduling rules for the pod. - type: object properties: preferredDuringSchedulingIgnoredDuringExecution: description: |- @@ -10245,31 +11062,20 @@ spec: compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node matches the corresponding matchExpressions; the node(s) with the highest sum are the most preferred. - type: array items: description: |- An empty preferred scheduling term matches all objects with implicit weight 0 (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). - type: object - required: - - preference - - weight properties: preference: description: A node selector term, associated with the corresponding weight. - type: object properties: matchExpressions: description: A list of node selector requirements by node's labels. - type: array items: description: |- A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator properties: key: description: The label key that the selector applies to. @@ -10286,22 +11092,22 @@ spec: the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. - type: array items: type: string + type: array x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array x-kubernetes-list-type: atomic matchFields: description: A list of node selector requirements by node's fields. - type: array items: description: |- A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator properties: key: description: The label key that the selector applies to. @@ -10318,16 +11124,27 @@ spec: the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. - type: array items: type: string + type: array x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array x-kubernetes-list-type: atomic + type: object x-kubernetes-map-type: atomic weight: description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100. - type: integer format: int32 + type: integer + required: + - preference + - weight + type: object + type: array x-kubernetes-list-type: atomic requiredDuringSchedulingIgnoredDuringExecution: description: |- @@ -10336,31 +11153,21 @@ spec: If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to an update), the system may or may not try to eventually evict the pod from its node. - type: object - required: - - nodeSelectorTerms properties: nodeSelectorTerms: description: Required. A list of node selector terms. The terms are ORed. - type: array items: description: |- A null or empty node selector term matches no objects. The requirements of them are ANDed. The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. - type: object properties: matchExpressions: description: A list of node selector requirements by node's labels. - type: array items: description: |- A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator properties: key: description: The label key that the selector applies to. @@ -10377,22 +11184,22 @@ spec: the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. - type: array items: type: string + type: array x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array x-kubernetes-list-type: atomic matchFields: description: A list of node selector requirements by node's fields. - type: array items: description: |- A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator properties: key: description: The label key that the selector applies to. @@ -10409,17 +11216,27 @@ spec: the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. - type: array items: type: string + type: array x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array x-kubernetes-list-type: atomic + type: object x-kubernetes-map-type: atomic + type: array x-kubernetes-list-type: atomic + required: + - nodeSelectorTerms + type: object x-kubernetes-map-type: atomic + type: object podAffinity: description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)). - type: object properties: preferredDuringSchedulingIgnoredDuringExecution: description: |- @@ -10432,37 +11249,23 @@ spec: compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. - type: array items: description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) - type: object - required: - - podAffinityTerm - - weight properties: podAffinityTerm: description: Required. A pod affinity term, associated with the corresponding weight. - type: object - required: - - topologyKey properties: labelSelector: description: |- A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods. - type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator properties: key: description: key is the label key that the selector applies to. @@ -10478,19 +11281,25 @@ spec: the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array items: type: string + type: array x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array x-kubernetes-list-type: atomic matchLabels: + additionalProperties: + type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - additionalProperties: - type: string + type: object x-kubernetes-map-type: atomic matchLabelKeys: description: |- @@ -10502,10 +11311,9 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). - type: array items: type: string + type: array x-kubernetes-list-type: atomic mismatchLabelKeys: description: |- @@ -10517,10 +11325,9 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). - type: array items: type: string + type: array x-kubernetes-list-type: atomic namespaceSelector: description: |- @@ -10529,19 +11336,13 @@ spec: and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. - type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator properties: key: description: key is the label key that the selector applies to. @@ -10557,19 +11358,25 @@ spec: the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array items: type: string + type: array x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array x-kubernetes-list-type: atomic matchLabels: + additionalProperties: + type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - additionalProperties: - type: string + type: object x-kubernetes-map-type: atomic namespaces: description: |- @@ -10577,9 +11384,9 @@ spec: The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". - type: array items: type: string + type: array x-kubernetes-list-type: atomic topologyKey: description: |- @@ -10589,12 +11396,20 @@ spec: selected pods is running. Empty topologyKey is not allowed. type: string + required: + - topologyKey + type: object weight: description: |- weight associated with matching the corresponding podAffinityTerm, in the range 1-100. - type: integer format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array x-kubernetes-list-type: atomic requiredDuringSchedulingIgnoredDuringExecution: description: |- @@ -10605,7 +11420,6 @@ spec: system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied. - type: array items: description: |- Defines a set of pods (namely those matching the labelSelector @@ -10614,27 +11428,18 @@ spec: where co-located is defined as running on a node whose value of the label with key matches that of any node on which a pod of the set of pods is running - type: object - required: - - topologyKey properties: labelSelector: description: |- A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods. - type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator properties: key: description: key is the label key that the selector applies to. @@ -10650,19 +11455,25 @@ spec: the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array items: type: string + type: array x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array x-kubernetes-list-type: atomic matchLabels: + additionalProperties: + type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - additionalProperties: - type: string + type: object x-kubernetes-map-type: atomic matchLabelKeys: description: |- @@ -10674,10 +11485,9 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). - type: array items: type: string + type: array x-kubernetes-list-type: atomic mismatchLabelKeys: description: |- @@ -10689,10 +11499,9 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). - type: array items: type: string + type: array x-kubernetes-list-type: atomic namespaceSelector: description: |- @@ -10701,19 +11510,13 @@ spec: and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. - type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator properties: key: description: key is the label key that the selector applies to. @@ -10729,19 +11532,25 @@ spec: the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array items: type: string + type: array x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array x-kubernetes-list-type: atomic matchLabels: + additionalProperties: + type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - additionalProperties: - type: string + type: object x-kubernetes-map-type: atomic namespaces: description: |- @@ -10749,9 +11558,9 @@ spec: The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". - type: array items: type: string + type: array x-kubernetes-list-type: atomic topologyKey: description: |- @@ -10761,10 +11570,14 @@ spec: selected pods is running. Empty topologyKey is not allowed. type: string + required: + - topologyKey + type: object + type: array x-kubernetes-list-type: atomic + type: object podAntiAffinity: description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)). - type: object properties: preferredDuringSchedulingIgnoredDuringExecution: description: |- @@ -10774,40 +11587,26 @@ spec: most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling anti-affinity expressions, etc.), - compute a sum by iterating through the elements of this field and adding - "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + compute a sum by iterating through the elements of this field and subtracting + "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. - type: array items: description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) - type: object - required: - - podAffinityTerm - - weight properties: podAffinityTerm: description: Required. A pod affinity term, associated with the corresponding weight. - type: object - required: - - topologyKey properties: labelSelector: description: |- A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods. - type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator properties: key: description: key is the label key that the selector applies to. @@ -10823,19 +11622,25 @@ spec: the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array items: type: string + type: array x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array x-kubernetes-list-type: atomic matchLabels: + additionalProperties: + type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - additionalProperties: - type: string + type: object x-kubernetes-map-type: atomic matchLabelKeys: description: |- @@ -10847,10 +11652,9 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). - type: array items: type: string + type: array x-kubernetes-list-type: atomic mismatchLabelKeys: description: |- @@ -10862,10 +11666,9 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). - type: array items: type: string + type: array x-kubernetes-list-type: atomic namespaceSelector: description: |- @@ -10874,19 +11677,13 @@ spec: and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. - type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator properties: key: description: key is the label key that the selector applies to. @@ -10902,19 +11699,25 @@ spec: the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array items: type: string + type: array x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array x-kubernetes-list-type: atomic matchLabels: + additionalProperties: + type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - additionalProperties: - type: string + type: object x-kubernetes-map-type: atomic namespaces: description: |- @@ -10922,9 +11725,9 @@ spec: The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". - type: array items: type: string + type: array x-kubernetes-list-type: atomic topologyKey: description: |- @@ -10934,12 +11737,20 @@ spec: selected pods is running. Empty topologyKey is not allowed. type: string + required: + - topologyKey + type: object weight: description: |- weight associated with matching the corresponding podAffinityTerm, in the range 1-100. - type: integer format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array x-kubernetes-list-type: atomic requiredDuringSchedulingIgnoredDuringExecution: description: |- @@ -10950,7 +11761,6 @@ spec: system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied. - type: array items: description: |- Defines a set of pods (namely those matching the labelSelector @@ -10959,27 +11769,18 @@ spec: where co-located is defined as running on a node whose value of the label with key matches that of any node on which a pod of the set of pods is running - type: object - required: - - topologyKey properties: labelSelector: description: |- A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods. - type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator properties: key: description: key is the label key that the selector applies to. @@ -10995,19 +11796,25 @@ spec: the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array items: type: string + type: array x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array x-kubernetes-list-type: atomic matchLabels: + additionalProperties: + type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - additionalProperties: - type: string + type: object x-kubernetes-map-type: atomic matchLabelKeys: description: |- @@ -11019,10 +11826,9 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). - type: array items: type: string + type: array x-kubernetes-list-type: atomic mismatchLabelKeys: description: |- @@ -11034,10 +11840,9 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). - type: array items: type: string + type: array x-kubernetes-list-type: atomic namespaceSelector: description: |- @@ -11046,19 +11851,13 @@ spec: and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. - type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - type: array items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. - type: object - required: - - key - - operator properties: key: description: key is the label key that the selector applies to. @@ -11074,19 +11873,25 @@ spec: the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - type: array items: type: string + type: array x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array x-kubernetes-list-type: atomic matchLabels: + additionalProperties: + type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - additionalProperties: - type: string + type: object x-kubernetes-map-type: atomic namespaces: description: |- @@ -11094,9 +11899,9 @@ spec: The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". - type: array items: type: string + type: array x-kubernetes-list-type: atomic topologyKey: description: |- @@ -11106,17 +11911,22 @@ spec: selected pods is running. Empty topologyKey is not allowed. type: string + required: + - topologyKey + type: object + type: array x-kubernetes-list-type: atomic + type: object + type: object imagePullSecrets: description: If specified, the pod's imagePullSecrets - type: array items: description: |- LocalObjectReference contains enough information to let you locate the referenced object inside the same namespace. - type: object properties: name: + default: "" description: |- Name of the referent. This field is effectively required, but due to backwards compatibility is @@ -11124,22 +11934,59 @@ spec: almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string - default: "" + type: object x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map nodeSelector: + additionalProperties: + type: string description: |- NodeSelector is a selector which must be true for the pod to fit on a node. Selector which must match a node's labels for the pod to be scheduled on that node. More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ type: object - additionalProperties: - type: string priorityClassName: description: If specified, the pod's priorityClassName. type: string + resources: + description: |- + If specified, the pod's resource requirements. + These values override the global resource configuration flags. + Note that when only specifying resource limits, ensure they are greater than or equal + to the corresponding global resource requests configured via controller flags + (--acme-http01-solver-resource-request-cpu, --acme-http01-solver-resource-request-memory). + Kubernetes will reject pod creation if limits are lower than requests, causing challenge failures. + properties: + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to the global values configured via controller flags. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object securityContext: description: If specified, the pod's security context - type: object properties: fsGroup: description: |- @@ -11153,8 +12000,8 @@ spec: If unset, the Kubelet will not modify the ownership and permissions of any volume. Note that this field cannot be set when spec.os.name is windows. - type: integer format: int64 + type: integer fsGroupChangePolicy: description: |- fsGroupChangePolicy defines behavior of changing ownership and permission of the volume @@ -11173,8 +12020,8 @@ spec: PodSecurityContext, the value specified in SecurityContext takes precedence for that container. Note that this field cannot be set when spec.os.name is windows. - type: integer format: int64 + type: integer runAsNonRoot: description: |- Indicates that the container must run as a non-root user. @@ -11192,8 +12039,8 @@ spec: PodSecurityContext, the value specified in SecurityContext takes precedence for that container. Note that this field cannot be set when spec.os.name is windows. - type: integer format: int64 + type: integer seLinuxOptions: description: |- The SELinux context to be applied to all containers. @@ -11202,7 +12049,6 @@ spec: both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence for that container. Note that this field cannot be set when spec.os.name is windows. - type: object properties: level: description: Level is SELinux level label that applies to the container. @@ -11216,13 +12062,11 @@ spec: user: description: User is a SELinux user label that applies to the container. type: string + type: object seccompProfile: description: |- The seccomp options to use by the containers in this pod. Note that this field cannot be set when spec.os.name is windows. - type: object - required: - - type properties: localhostProfile: description: |- @@ -11240,6 +12084,9 @@ spec: RuntimeDefault - the container runtime default profile should be used. Unconfined - no profile should be applied. type: string + required: + - type + type: object supplementalGroups: description: |- A list of groups applied to the first process run in each container, in addition @@ -11249,22 +12096,18 @@ spec: defined in the container image for the uid of the container process are still effective, even if they are not included in this list. Note that this field cannot be set when spec.os.name is windows. - type: array items: - type: integer format: int64 + type: integer + type: array + x-kubernetes-list-type: atomic sysctls: description: |- Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported sysctls (by the container runtime) might fail to launch. Note that this field cannot be set when spec.os.name is windows. - type: array items: description: Sysctl defines a kernel parameter to be set - type: object - required: - - name - - value properties: name: description: Name of a property to set @@ -11272,17 +12115,22 @@ spec: value: description: Value of a property to set type: string + required: + - name + - value + type: object + type: array + x-kubernetes-list-type: atomic + type: object serviceAccountName: description: If specified, the pod's service account type: string tolerations: description: If specified, the pod's tolerations. - type: array items: description: |- The pod this Toleration is attached to tolerates any taint that matches the triple using the matching operator . - type: object properties: effect: description: |- @@ -11297,9 +12145,10 @@ spec: operator: description: |- Operator represents a key's relationship to the value. - Valid operators are Exists and Equal. Defaults to Equal. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). type: string tolerationSeconds: description: |- @@ -11307,18 +12156,25 @@ spec: of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, it is not set, which means tolerate the taint forever (do not evict). Zero and negative values will be treated as 0 (evict immediately) by the system. - type: integer format: int64 + type: integer value: description: |- Value is the taint value the toleration matches to. If the operator is Exists, the value should be empty, otherwise just a regular string. type: string + type: object + type: array + x-kubernetes-list-type: atomic + type: object + type: object serviceType: description: |- Optional service type for Kubernetes solver service. Supported values are NodePort or ClusterIP. If unset, defaults to NodePort. type: string + type: object + type: object selector: description: |- Selector selects a set of DNSNames on the Certificate resource that @@ -11326,7 +12182,6 @@ spec: If not specified, the solver will be treated as the 'default' solver with the lowest priority, i.e. if any other solver has a more specific match, it will be used instead. - type: object properties: dnsNames: description: |- @@ -11337,9 +12192,10 @@ spec: with the most matching labels in matchLabels will be selected. If neither has more matches, the solver defined earlier in the list will be selected. - type: array items: type: string + type: array + x-kubernetes-list-type: atomic dnsZones: description: |- List of DNSZones that this solver will be used to solve. @@ -11351,41 +12207,67 @@ spec: with the most matching labels in matchLabels will be selected. If neither has more matches, the solver defined earlier in the list will be selected. - type: array items: type: string + type: array + x-kubernetes-list-type: atomic matchLabels: + additionalProperties: + type: string description: |- A label selector that is used to refine the set of certificate's that this challenge solver will apply to. type: object - additionalProperties: - type: string + type: object + waitInsteadOfSelfCheck: + description: |- + WaitInsteadOfSelfCheck, if set, skips cert-manager's self-check and + instead waits this long after presentation before asking the ACME server + to validate the challenge. + + This is an advanced escape hatch for environments where cert-manager's + self-check cannot succeed from its own network or DNS viewpoint even + though the ACME server can still validate successfully, for example due + to split-horizon DNS or NAT hairpinning. + + A value of 0 skips the self-check and asks the ACME server to validate + immediately after presentation, relying on the ACME server's own + validation retries (RFC 8555 section 8.2) to succeed once the challenge + has propagated. A negative duration is rejected. + Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration, + for example `30s` or `2m`. + type: string + type: object + type: array + x-kubernetes-list-type: atomic + required: + - privateKeySecretRef + - server + type: object ca: description: |- CA configures this issuer to sign certificates using a signing CA keypair stored in a Secret resource. This is used to build internal PKIs that are managed by cert-manager. - type: object - required: - - secretName properties: crlDistributionPoints: description: |- The CRL distribution points is an X.509 v3 certificate extension which identifies the location of the CRL from which the revocation of this certificate can be checked. If not set, certificates will be issued without distribution points set. - type: array items: type: string + type: array + x-kubernetes-list-type: atomic issuingCertificateURLs: description: |- IssuingCertificateURLs is a list of URLs which this issuer should embed into certificates it creates. See https://www.rfc-editor.org/rfc/rfc5280#section-4.2.2.1 for more details. As an example, such a URL might be "http://ca.domain.com/ca.crt". - type: array items: type: string + type: array + x-kubernetes-list-type: atomic ocspServers: description: |- The OCSP server list is an X.509 v3 extension that defines a list of @@ -11393,51 +12275,45 @@ spec: revocation status of an issued certificate. If not set, the certificate will be issued with no OCSP servers set. For example, an OCSP server URL could be "http://ocsp.int-x3.letsencrypt.org". - type: array items: type: string + type: array + x-kubernetes-list-type: atomic secretName: description: |- SecretName is the name of the secret used to sign Certificates issued by this Issuer. type: string + required: + - secretName + type: object selfSigned: description: |- SelfSigned configures this issuer to 'self sign' certificates using the private key used to create the CertificateRequest object. - type: object properties: crlDistributionPoints: description: |- The CRL distribution points is an X.509 v3 certificate extension which identifies the location of the CRL from which the revocation of this certificate can be checked. If not set certificate will be issued without CDP. Values are strings. - type: array items: type: string + type: array + x-kubernetes-list-type: atomic + type: object vault: description: |- Vault configures this issuer to sign certificates using a HashiCorp Vault PKI backend. - type: object - required: - - auth - - path - - server properties: auth: description: Auth configures how cert-manager authenticates with the Vault server. - type: object properties: appRole: description: |- AppRole authenticates with Vault using the App Role auth mechanism, with the role and secret stored in a Kubernetes Secret resource. - type: object - required: - - path - - roleId - - secretRef properties: path: description: |- @@ -11455,9 +12331,6 @@ spec: to authenticate with Vault. The `key` field must be specified and denotes which entry within the Secret resource is used as the app role secret. - type: object - required: - - name properties: key: description: |- @@ -11470,12 +12343,75 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string + required: + - name + type: object + required: + - path + - roleId + - secretRef + type: object + aws: + description: |- + AWS authenticates with Vault using AWS IAM authentication. + This allows authentication using IAM roles for service accounts (IRSA), + EKS Pod Identity (PIA), or ambient credentials (EC2 instance profiles, ECS task role). + properties: + iamRoleArn: + description: |- + The ARN of the AWS IAM role to assume using the Kubernetes service account + token. Required when using IRSA (serviceAccountRef is set). + This role must have a trust policy that allows the OIDC provider to assume it. + type: string + mountPath: + description: |- + The Vault mountPath here is the mount path to use when authenticating with + Vault. For example, setting a value to `/v1/auth/foo`, will use the path + `/v1/auth/foo/login` to authenticate with Vault. If unspecified, the + default value "/v1/auth/aws" will be used. + type: string + region: + description: |- + The AWS region to use for authentication. If not specified, the region + will be determined from AWS_REGION or AWS_DEFAULT_REGION environment + variables, falling back to "us-east-1" if not set. + type: string + role: + description: A required field containing the Vault Role to assume when authenticating. + minLength: 1 + type: string + serviceAccountRef: + description: |- + A reference to a service account that will be used to request a web identity + token for IRSA (IAM Roles for Service Accounts) authentication. + properties: + audiences: + description: |- + TokenAudiences is an optional list of extra audiences to include in the token passed to Vault. + The default audiences are always included in the token. + items: + type: string + type: array + x-kubernetes-list-type: atomic + name: + description: Name of the ServiceAccount used to request a token. + type: string + required: + - name + type: object + vaultHeaderValue: + description: |- + The Vault header value to include in the STS signing request. + This is used to prevent replay attacks. + type: string + required: + - role + type: object clientCertificate: description: |- ClientCertificate authenticates with Vault by presenting a client certificate during the request's TLS handshake. Works only when using HTTPS protocol. - type: object properties: mountPath: description: |- @@ -11495,13 +12431,11 @@ spec: tls.crt and tls.key) used to authenticate to Vault using TLS client authentication. type: string + type: object kubernetes: description: |- Kubernetes authenticates with Vault by passing the ServiceAccount token stored in the named Secret resource to the Vault server. - type: object - required: - - role properties: mountPath: description: |- @@ -11520,9 +12454,6 @@ spec: The required Secret field containing a Kubernetes ServiceAccount JWT used for authenticating with Vault. Use of 'ambient credentials' is not supported. - type: object - required: - - name properties: key: description: |- @@ -11535,6 +12466,9 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string + required: + - name + type: object serviceAccountRef: description: |- A reference to a service account that will be used to request a bound @@ -11542,25 +12476,26 @@ spec: using this field means that you don't rely on statically bound tokens. To use this field, you must configure an RBAC rule to let cert-manager request a token. - type: object - required: - - name properties: audiences: description: |- - TokenAudiences is an optional list of extra audiences to include in the token passed to Vault. The default token - consisting of the issuer's namespace and name is always included. - type: array + TokenAudiences is an optional list of extra audiences to include in the token passed to Vault. + The default audiences are always included in the token. items: type: string + type: array + x-kubernetes-list-type: atomic name: description: Name of the ServiceAccount used to request a token. type: string + required: + - name + type: object + required: + - role + type: object tokenSecretRef: description: TokenSecretRef authenticates with Vault by presenting a token. - type: object - required: - - name properties: key: description: |- @@ -11573,6 +12508,10 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string + required: + - name + type: object + type: object caBundle: description: |- Base64-encoded bundle of PEM CAs which will be used to validate the certificate @@ -11581,8 +12520,8 @@ spec: Mutually exclusive with CABundleSecretRef. If neither CABundle nor CABundleSecretRef are defined, the certificate bundle in the cert-manager controller container is used to validate the TLS connection. - type: string format: byte + type: string caBundleSecretRef: description: |- Reference to a Secret containing a bundle of PEM-encoded CAs to use when @@ -11591,9 +12530,6 @@ spec: If neither CABundle nor CABundleSecretRef are defined, the certificate bundle in the cert-manager controller container is used to validate the TLS connection. If no key for the Secret is specified, cert-manager will default to 'ca.crt'. - type: object - required: - - name properties: key: description: |- @@ -11606,13 +12542,13 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string + required: + - name + type: object clientCertSecretRef: description: |- Reference to a Secret containing a PEM-encoded Client Certificate to use when the Vault server requires mTLS. - type: object - required: - - name properties: key: description: |- @@ -11625,13 +12561,13 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string + required: + - name + type: object clientKeySecretRef: description: |- Reference to a Secret containing a PEM-encoded Client Private Key to use when the Vault server requires mTLS. - type: object - required: - - name properties: key: description: |- @@ -11644,6 +12580,9 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string + required: + - name + type: object namespace: description: |- Name of the vault namespace. Namespaces is a set of features within Vault Enterprise that allows Vault environments to support Secure Multi-tenancy. e.g: "ns1" @@ -11657,27 +12596,28 @@ spec: server: description: 'Server is the connection address for the Vault server, e.g: "https://vault.example.com:8200".' type: string + serverName: + description: |- + ServerName is used to verify the hostname on the returned certificates + by the Vault server. + type: string + required: + - auth + - path + - server + type: object venafi: description: |- - Venafi configures this issuer to sign certificates using a Venafi TPP - or Venafi Cloud policy zone. - type: object - required: - - zone + Venafi configures this issuer to sign certificates using a CyberArk Certificate Manager Self-Hosted + or SaaS policy zone. properties: cloud: description: |- - Cloud specifies the Venafi cloud configuration settings. - Only one of TPP or Cloud may be specified. - type: object - required: - - apiTokenSecretRef + Cloud specifies the CyberArk Certificate Manager SaaS configuration settings. + Only one of CyberArk Certificate Manager may be specified. properties: apiTokenSecretRef: - description: APITokenSecretRef is a secret key selector for the Venafi Cloud API token. - type: object - required: - - name + description: APITokenSecretRef is a secret key selector for the CyberArk Certificate Manager SaaS API token. properties: key: description: |- @@ -11690,38 +12630,77 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string + required: + - name + type: object url: description: |- - URL is the base URL for Venafi Cloud. - Defaults to "https://api.venafi.cloud/v1". + URL is the base URL for CyberArk Certificate Manager SaaS. + Defaults to "https://api.venafi.cloud/". type: string - tpp: - description: |- - TPP specifies Trust Protection Platform configuration settings. - Only one of TPP or Cloud may be specified. + required: + - apiTokenSecretRef type: object + ngts: + description: |- + NGTS specifies Palo Alto Networks Next Generation Trust Services (NGTS) configuration + using OAuth 2.0 Client Credentials. Only one of tpp, cloud, or ngts may be specified. + properties: + credentialsRef: + description: |- + CredentialsRef is a reference to a Kubernetes Secret containing the OAuth 2.0 + Client ID and Client Secret. The secret must contain the keys 'client-id' and + 'client-secret'. + properties: + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + required: + - name + type: object + tokenEndpoint: + description: |- + TokenEndpoint is the OAuth 2.0 token endpoint URL used to obtain access tokens, + for example "https://auth.apps.paloaltonetworks.com/oauth2/access_token". + Defaults to "https://auth.apps.paloaltonetworks.com/oauth2/access_token" if not set. + type: string + tsgID: + description: |- + TSGID is the Tenant Service Group ID used to scope the OAuth 2.0 access token, + for example "1234567890". The tsg_id: prefix is added automatically. + This field is required. + type: string + url: + description: |- + URL is the base URL for the NGTS API endpoint. + Defaults to "https://api.strata.paloaltonetworks.com/ngts" if not set. + type: string required: - credentialsRef - - url + - tsgID + type: object + tpp: + description: |- + TPP specifies CyberArk Certificate Manager Self-Hosted configuration settings. + Only one of CyberArk Certificate Manager may be specified. properties: caBundle: description: |- Base64-encoded bundle of PEM CAs which will be used to validate the certificate - chain presented by the TPP server. Only used if using HTTPS; ignored for HTTP. + chain presented by the CyberArk Certificate Manager Self-Hosted server. Only used if using HTTPS; ignored for HTTP. If undefined, the certificate bundle in the cert-manager controller container is used to validate the chain. - type: string format: byte + type: string caBundleSecretRef: description: |- Reference to a Secret containing a base64-encoded bundle of PEM CAs - which will be used to validate the certificate chain presented by the TPP server. + which will be used to validate the certificate chain presented by the CyberArk Certificate Manager Self-Hosted server. Only used if using HTTPS; ignored for HTTP. Mutually exclusive with CABundle. If neither CABundle nor CABundleSecretRef is defined, the certificate bundle in the cert-manager controller container is used to validate the TLS connection. - type: object - required: - - name properties: key: description: |- @@ -11734,385 +12713,132 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string + required: + - name + type: object credentialsRef: description: |- - CredentialsRef is a reference to a Secret containing the Venafi TPP API credentials. + CredentialsRef is a reference to a Secret containing the CyberArk Certificate Manager Self-Hosted API credentials. The secret must contain the key 'access-token' for the Access Token Authentication, or two keys, 'username' and 'password' for the API Keys Authentication. - type: object - required: - - name properties: name: description: |- Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string + required: + - name + type: object url: description: |- - URL is the base URL for the vedsdk endpoint of the Venafi TPP instance, + URL is the base URL for the vedsdk endpoint of the CyberArk Certificate Manager Self-Hosted instance, for example: "https://tpp.example.com/vedsdk". type: string + required: + - credentialsRef + - url + type: object zone: description: |- - Zone is the Venafi Policy Zone to use for this issuer. - All requests made to the Venafi platform will be restricted by the named + Zone is the Certificate Manager Policy Zone to use for this issuer. + All requests made to the Certificate Manager platform will be restricted by the named zone policy. This field is required. type: string - status: - description: Status of the Issuer. This is set and managed automatically. - type: object - properties: - acme: - description: |- - ACME specific status options. - This field should only be set if the Issuer is configured to use an ACME - server to issue certificates. - type: object - properties: - lastPrivateKeyHash: - description: |- - LastPrivateKeyHash is a hash of the private key associated with the latest - registered ACME account, in order to track changes made to registered account - associated with the Issuer - type: string - lastRegisteredEmail: - description: |- - LastRegisteredEmail is the email associated with the latest registered - ACME account, in order to track changes made to registered account - associated with the Issuer - type: string - uri: - description: |- - URI is the unique account identifier, which can also be used to retrieve - account details from the CA - type: string - conditions: - description: |- - List of status conditions to indicate the status of a CertificateRequest. - Known condition types are `Ready`. - type: array - items: - description: IssuerCondition contains condition information for an Issuer. - type: object - required: - - status - - type - properties: - lastTransitionTime: - description: |- - LastTransitionTime is the timestamp corresponding to the last status - change of this condition. - type: string - format: date-time - message: - description: |- - Message is a human readable description of the details of the last - transition, complementing reason. - type: string - observedGeneration: - description: |- - If set, this represents the .metadata.generation that the condition was - set based upon. - For instance, if .metadata.generation is currently 12, but the - .status.condition[x].observedGeneration is 9, the condition is out of date - with respect to the current state of the Issuer. - type: integer - format: int64 - reason: - description: |- - Reason is a brief machine readable explanation for the condition's last - transition. - type: string - status: - description: Status of the condition, one of (`True`, `False`, `Unknown`). - type: string - enum: - - "True" - - "False" - - Unknown - type: - description: Type of the condition, known values are (`Ready`). - type: string - x-kubernetes-list-map-keys: - - type - x-kubernetes-list-type: map - served: true - storage: true - -# END crd ---- -# Source: cert-manager/templates/crds.yaml -# START crd -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - name: orders.acme.cert-manager.io - # START annotations - annotations: - helm.sh/resource-policy: keep - # END annotations - labels: - app: 'cert-manager' - app.kubernetes.io/name: 'cert-manager' - app.kubernetes.io/instance: 'cert-manager' - app.kubernetes.io/component: "crds" - # Generated labels - app.kubernetes.io/version: "v1.17.0" - app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.17.0 -spec: - group: acme.cert-manager.io - names: - kind: Order - listKind: OrderList - plural: orders - singular: order - categories: - - cert-manager - - cert-manager-acme - scope: Namespaced - versions: - - name: v1 - subresources: - status: {} - additionalPrinterColumns: - - jsonPath: .status.state - name: State - type: string - - jsonPath: .spec.issuerRef.name - name: Issuer - priority: 1 - type: string - - jsonPath: .status.reason - name: Reason - priority: 1 - type: string - - jsonPath: .metadata.creationTimestamp - description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. - name: Age - type: date - schema: - openAPIV3Schema: - description: Order is a type to represent an Order with an ACME server - type: object - required: - - metadata - - spec - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - type: object - required: - - issuerRef - - request - properties: - commonName: - description: |- - CommonName is the common name as specified on the DER encoded CSR. - If specified, this value must also be present in `dnsNames` or `ipAddresses`. - This field must match the corresponding field on the DER encoded CSR. - type: string - dnsNames: - description: |- - DNSNames is a list of DNS names that should be included as part of the Order - validation process. - This field must match the corresponding field on the DER encoded CSR. - type: array - items: - type: string - duration: - description: |- - Duration is the duration for the not after date for the requested certificate. - this is set on order creation as pe the ACME spec. - type: string - ipAddresses: - description: |- - IPAddresses is a list of IP addresses that should be included as part of the Order - validation process. - This field must match the corresponding field on the DER encoded CSR. - type: array - items: - type: string - issuerRef: - description: |- - IssuerRef references a properly configured ACME-type Issuer which should - be used to create this Order. - If the Issuer does not exist, processing will be retried. - If the Issuer is not an 'ACME' Issuer, an error will be returned and the - Order will be marked as failed. - type: object required: - - name + - zone + type: object + x-kubernetes-validations: + - message: exactly one of tpp, cloud, or ngts must be configured + rule: '(has(self.tpp) ? 1 : 0) + (has(self.cloud) ? 1 : 0) + (has(self.ngts) ? 1 : 0) == 1' + type: object + status: + description: Status of the Issuer. This is set and managed automatically. + properties: + acme: + description: |- + ACME specific status options. + This field should only be set if the Issuer is configured to use an ACME + server to issue certificates. properties: - group: - description: Group of the resource being referred to. + lastPrivateKeyHash: + description: |- + LastPrivateKeyHash is a hash of the private key associated with the latest + registered ACME account, in order to track changes made to registered account + associated with the Issuer type: string - kind: - description: Kind of the resource being referred to. + lastRegisteredEmail: + description: |- + LastRegisteredEmail is the email associated with the latest registered + ACME account, in order to track changes made to registered account + associated with the Issuer type: string - name: - description: Name of the resource being referred to. + uri: + description: |- + URI is the unique account identifier, which can also be used to retrieve + account details from the CA type: string - request: - description: |- - Certificate signing request bytes in DER encoding. - This will be used when finalizing the order. - This field must be set on the order. - type: string - format: byte - status: - type: object - properties: - authorizations: + type: object + conditions: description: |- - Authorizations contains data returned from the ACME server on what - authorizations must be completed in order to validate the DNS names - specified on the Order. - type: array + List of status conditions to indicate the status of a CertificateRequest. + Known condition types are `Ready`. items: - description: |- - ACMEAuthorization contains data returned from the ACME server on an - authorization that must be completed in order validate a DNS name on an ACME - Order resource. - type: object - required: - - url + description: IssuerCondition contains condition information for an Issuer. properties: - challenges: + lastTransitionTime: description: |- - Challenges specifies the challenge types offered by the ACME server. - One of these challenge types will be selected when validating the DNS - name and an appropriate Challenge resource will be created to perform - the ACME challenge process. - type: array - items: - description: |- - Challenge specifies a challenge offered by the ACME server for an Order. - An appropriate Challenge resource can be created to perform the ACME - challenge process. - type: object - required: - - token - - type - - url - properties: - token: - description: |- - Token is the token that must be presented for this challenge. - This is used to compute the 'key' that must also be presented. - type: string - type: - description: |- - Type is the type of challenge being offered, e.g. 'http-01', 'dns-01', - 'tls-sni-01', etc. - This is the raw value retrieved from the ACME server. - Only 'http-01' and 'dns-01' are supported by cert-manager, other values - will be ignored. - type: string - url: - description: |- - URL is the URL of this challenge. It can be used to retrieve additional - metadata about the Challenge from the ACME server. - type: string - identifier: - description: Identifier is the DNS name to be validated as part of this authorization + LastTransitionTime is the timestamp corresponding to the last status + change of this condition. + format: date-time type: string - initialState: + message: description: |- - InitialState is the initial state of the ACME authorization when first - fetched from the ACME server. - If an Authorization is already 'valid', the Order controller will not - create a Challenge resource for the authorization. This will occur when - working with an ACME server that enables 'authz reuse' (such as Let's - Encrypt's production endpoint). - If not set and 'identifier' is set, the state is assumed to be pending - and a Challenge will be created. + Message is a human readable description of the details of the last + transition, complementing reason. + type: string + observedGeneration: + description: |- + If set, this represents the .metadata.generation that the condition was + set based upon. + For instance, if .metadata.generation is currently 12, but the + .status.condition[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the Issuer. + format: int64 + type: integer + reason: + description: |- + Reason is a brief machine readable explanation for the condition's last + transition. type: string + status: + description: Status of the condition, one of (`True`, `False`, `Unknown`). enum: - - valid - - ready - - pending - - processing - - invalid - - expired - - errored - url: - description: URL is the URL of the Authorization that must be completed + - "True" + - "False" + - Unknown type: string - wildcard: - description: |- - Wildcard will be true if this authorization is for a wildcard DNS name. - If this is true, the identifier will be the *non-wildcard* version of - the DNS name. - For example, if '*.example.com' is the DNS name being validated, this - field will be 'true' and the 'identifier' field will be 'example.com'. - type: boolean - certificate: - description: |- - Certificate is a copy of the PEM encoded certificate for this Order. - This field will be populated after the order has been successfully - finalized with the ACME server, and the order has transitioned to the - 'valid' state. - type: string - format: byte - failureTime: - description: |- - FailureTime stores the time that this order failed. - This is used to influence garbage collection and back-off. - type: string - format: date-time - finalizeURL: - description: |- - FinalizeURL of the Order. - This is used to obtain certificates for this order once it has been completed. - type: string - reason: - description: |- - Reason optionally provides more information about a why the order is in - the current state. - type: string - state: - description: |- - State contains the current state of this Order resource. - States 'success' and 'expired' are 'final' - type: string - enum: - - valid - - ready - - pending - - processing - - invalid - - expired - - errored - url: - description: |- - URL of the Order. - This will initially be empty when the resource is first created. - The Order controller will populate this field when the Order is first processed. - This field will be immutable after it is initially set. - type: string + type: + description: Type of the condition, known values are (`Ready`). + type: string + required: + - status + - type + type: object + type: array + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + type: object + required: + - spec + type: object served: true storage: true + subresources: + status: {} -# END crd --- # Source: cert-manager/templates/cainjector-rbac.yaml apiVersion: rbac.authorization.k8s.io/v1 @@ -12124,9 +12850,9 @@ metadata: app.kubernetes.io/name: cainjector app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "cainjector" - app.kubernetes.io/version: "v1.17.0" + app.kubernetes.io/version: "v1.21.1" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.17.0 + helm.sh/chart: cert-manager-v1.21.1 rules: - apiGroups: ["cert-manager.io"] resources: ["certificates"] @@ -12158,9 +12884,9 @@ metadata: app.kubernetes.io/name: cert-manager app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "controller" - app.kubernetes.io/version: "v1.17.0" + app.kubernetes.io/version: "v1.21.1" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.17.0 + helm.sh/chart: cert-manager-v1.21.1 rules: - apiGroups: ["cert-manager.io"] resources: ["issuers", "issuers/status"] @@ -12186,9 +12912,9 @@ metadata: app.kubernetes.io/name: cert-manager app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "controller" - app.kubernetes.io/version: "v1.17.0" + app.kubernetes.io/version: "v1.21.1" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.17.0 + helm.sh/chart: cert-manager-v1.21.1 rules: - apiGroups: ["cert-manager.io"] resources: ["clusterissuers", "clusterissuers/status"] @@ -12214,9 +12940,9 @@ metadata: app.kubernetes.io/name: cert-manager app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "controller" - app.kubernetes.io/version: "v1.17.0" + app.kubernetes.io/version: "v1.21.1" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.17.0 + helm.sh/chart: cert-manager-v1.21.1 rules: - apiGroups: ["cert-manager.io"] resources: ["certificates", "certificates/status", "certificaterequests", "certificaterequests/status"] @@ -12251,9 +12977,9 @@ metadata: app.kubernetes.io/name: cert-manager app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "controller" - app.kubernetes.io/version: "v1.17.0" + app.kubernetes.io/version: "v1.21.1" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.17.0 + helm.sh/chart: cert-manager-v1.21.1 rules: - apiGroups: ["acme.cert-manager.io"] resources: ["orders", "orders/status"] @@ -12273,6 +12999,9 @@ rules: - apiGroups: ["acme.cert-manager.io"] resources: ["orders/finalizers"] verbs: ["update"] + - apiGroups: ["cert-manager.io"] + resources: ["clusterissuers/finalizers", "issuers/finalizers"] + verbs: ["update"] - apiGroups: [""] resources: ["secrets"] verbs: ["get", "list", "watch"] @@ -12291,9 +13020,9 @@ metadata: app.kubernetes.io/name: cert-manager app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "controller" - app.kubernetes.io/version: "v1.17.0" + app.kubernetes.io/version: "v1.21.1" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.17.0 + helm.sh/chart: cert-manager-v1.21.1 rules: # Use to update challenge resource status - apiGroups: ["acme.cert-manager.io"] @@ -12322,8 +13051,8 @@ rules: - apiGroups: ["networking.k8s.io"] resources: ["ingresses"] verbs: ["get", "list", "watch", "create", "delete", "update"] - - apiGroups: [ "gateway.networking.k8s.io" ] - resources: [ "httproutes" ] + - apiGroups: ["gateway.networking.k8s.io"] + resources: ["httproutes"] verbs: ["get", "list", "watch", "create", "delete", "update"] # We require the ability to specify a custom hostname when we are creating # new ingress resources. @@ -12353,9 +13082,9 @@ metadata: app.kubernetes.io/name: cert-manager app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "controller" - app.kubernetes.io/version: "v1.17.0" + app.kubernetes.io/version: "v1.21.1" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.17.0 + helm.sh/chart: cert-manager-v1.21.1 rules: - apiGroups: ["cert-manager.io"] resources: ["certificates", "certificaterequests"] @@ -12373,10 +13102,10 @@ rules: resources: ["ingresses/finalizers"] verbs: ["update"] - apiGroups: ["gateway.networking.k8s.io"] - resources: ["gateways", "httproutes"] + resources: ["gateways", "httproutes", "listenersets"] verbs: ["get", "list", "watch"] - apiGroups: ["gateway.networking.k8s.io"] - resources: ["gateways/finalizers", "httproutes/finalizers"] + resources: ["gateways/finalizers", "httproutes/finalizers", "listenersets/finalizers"] verbs: ["update"] - apiGroups: [""] resources: ["events"] @@ -12392,9 +13121,9 @@ metadata: app.kubernetes.io/name: cert-manager app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "controller" - app.kubernetes.io/version: "v1.17.0" + app.kubernetes.io/version: "v1.21.1" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.17.0 + helm.sh/chart: cert-manager-v1.21.1 rbac.authorization.k8s.io/aggregate-to-cluster-reader: "true" rules: - apiGroups: ["cert-manager.io"] @@ -12411,9 +13140,9 @@ metadata: app.kubernetes.io/name: cert-manager app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "controller" - app.kubernetes.io/version: "v1.17.0" + app.kubernetes.io/version: "v1.21.1" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.17.0 + helm.sh/chart: cert-manager-v1.21.1 rbac.authorization.k8s.io/aggregate-to-view: "true" rbac.authorization.k8s.io/aggregate-to-edit: "true" rbac.authorization.k8s.io/aggregate-to-admin: "true" @@ -12436,9 +13165,9 @@ metadata: app.kubernetes.io/name: cert-manager app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "controller" - app.kubernetes.io/version: "v1.17.0" + app.kubernetes.io/version: "v1.21.1" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.17.0 + helm.sh/chart: cert-manager-v1.21.1 rbac.authorization.k8s.io/aggregate-to-edit: "true" rbac.authorization.k8s.io/aggregate-to-admin: "true" rules: @@ -12449,8 +13178,11 @@ rules: resources: ["certificates/status"] verbs: ["update"] - apiGroups: ["acme.cert-manager.io"] - resources: ["challenges", "orders"] - verbs: ["create", "delete", "deletecollection", "patch", "update"] + resources: ["challenges"] + verbs: ["delete", "deletecollection", "patch", "update"] + - apiGroups: ["acme.cert-manager.io"] + resources: ["orders"] + verbs: ["delete", "deletecollection"] --- # Source: cert-manager/templates/rbac.yaml # Permission to approve CertificateRequests referencing cert-manager.io Issuers and ClusterIssuers @@ -12463,9 +13195,9 @@ metadata: app.kubernetes.io/name: cert-manager app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "cert-manager" - app.kubernetes.io/version: "v1.17.0" + app.kubernetes.io/version: "v1.21.1" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.17.0 + helm.sh/chart: cert-manager-v1.21.1 rules: - apiGroups: ["cert-manager.io"] resources: ["signers"] @@ -12487,9 +13219,9 @@ metadata: app.kubernetes.io/name: cert-manager app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "cert-manager" - app.kubernetes.io/version: "v1.17.0" + app.kubernetes.io/version: "v1.21.1" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.17.0 + helm.sh/chart: cert-manager-v1.21.1 rules: - apiGroups: ["certificates.k8s.io"] resources: ["certificatesigningrequests"] @@ -12515,9 +13247,9 @@ metadata: app.kubernetes.io/name: webhook app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "webhook" - app.kubernetes.io/version: "v1.17.0" + app.kubernetes.io/version: "v1.21.1" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.17.0 + helm.sh/chart: cert-manager-v1.21.1 rules: - apiGroups: ["authorization.k8s.io"] resources: ["subjectaccessreviews"] @@ -12533,9 +13265,9 @@ metadata: app.kubernetes.io/name: cainjector app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "cainjector" - app.kubernetes.io/version: "v1.17.0" + app.kubernetes.io/version: "v1.21.1" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.17.0 + helm.sh/chart: cert-manager-v1.21.1 roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole @@ -12555,9 +13287,9 @@ metadata: app.kubernetes.io/name: cert-manager app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "controller" - app.kubernetes.io/version: "v1.17.0" + app.kubernetes.io/version: "v1.21.1" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.17.0 + helm.sh/chart: cert-manager-v1.21.1 roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole @@ -12577,9 +13309,9 @@ metadata: app.kubernetes.io/name: cert-manager app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "controller" - app.kubernetes.io/version: "v1.17.0" + app.kubernetes.io/version: "v1.21.1" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.17.0 + helm.sh/chart: cert-manager-v1.21.1 roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole @@ -12599,9 +13331,9 @@ metadata: app.kubernetes.io/name: cert-manager app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "controller" - app.kubernetes.io/version: "v1.17.0" + app.kubernetes.io/version: "v1.21.1" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.17.0 + helm.sh/chart: cert-manager-v1.21.1 roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole @@ -12621,9 +13353,9 @@ metadata: app.kubernetes.io/name: cert-manager app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "controller" - app.kubernetes.io/version: "v1.17.0" + app.kubernetes.io/version: "v1.21.1" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.17.0 + helm.sh/chart: cert-manager-v1.21.1 roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole @@ -12643,9 +13375,9 @@ metadata: app.kubernetes.io/name: cert-manager app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "controller" - app.kubernetes.io/version: "v1.17.0" + app.kubernetes.io/version: "v1.21.1" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.17.0 + helm.sh/chart: cert-manager-v1.21.1 roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole @@ -12665,9 +13397,9 @@ metadata: app.kubernetes.io/name: cert-manager app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "controller" - app.kubernetes.io/version: "v1.17.0" + app.kubernetes.io/version: "v1.21.1" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.17.0 + helm.sh/chart: cert-manager-v1.21.1 roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole @@ -12687,9 +13419,9 @@ metadata: app.kubernetes.io/name: cert-manager app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "cert-manager" - app.kubernetes.io/version: "v1.17.0" + app.kubernetes.io/version: "v1.21.1" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.17.0 + helm.sh/chart: cert-manager-v1.21.1 roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole @@ -12709,9 +13441,9 @@ metadata: app.kubernetes.io/name: cert-manager app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "cert-manager" - app.kubernetes.io/version: "v1.17.0" + app.kubernetes.io/version: "v1.21.1" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.17.0 + helm.sh/chart: cert-manager-v1.21.1 roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole @@ -12720,6 +13452,7 @@ subjects: - name: cert-manager namespace: cert-manager kind: ServiceAccount + --- # Source: cert-manager/templates/webhook-rbac.yaml apiVersion: rbac.authorization.k8s.io/v1 @@ -12731,9 +13464,9 @@ metadata: app.kubernetes.io/name: webhook app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "webhook" - app.kubernetes.io/version: "v1.17.0" + app.kubernetes.io/version: "v1.21.1" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.17.0 + helm.sh/chart: cert-manager-v1.21.1 roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole @@ -12742,6 +13475,7 @@ subjects: - kind: ServiceAccount name: cert-manager-webhook namespace: cert-manager + --- # Source: cert-manager/templates/cainjector-rbac.yaml # leader election rules @@ -12755,9 +13489,9 @@ metadata: app.kubernetes.io/name: cainjector app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "cainjector" - app.kubernetes.io/version: "v1.17.0" + app.kubernetes.io/version: "v1.21.1" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.17.0 + helm.sh/chart: cert-manager-v1.21.1 rules: # Used for leader election by the controller # cert-manager-cainjector-leader-election is used by the CertificateBased injector controller @@ -12783,9 +13517,9 @@ metadata: app.kubernetes.io/name: cert-manager app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "controller" - app.kubernetes.io/version: "v1.17.0" + app.kubernetes.io/version: "v1.21.1" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.17.0 + helm.sh/chart: cert-manager-v1.21.1 rules: - apiGroups: ["coordination.k8s.io"] resources: ["leases"] @@ -12795,26 +13529,6 @@ rules: resources: ["leases"] verbs: ["create"] --- -# Source: cert-manager/templates/rbac.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: cert-manager-tokenrequest - namespace: cert-manager - labels: - app: cert-manager - app.kubernetes.io/name: cert-manager - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/component: "controller" - app.kubernetes.io/version: "v1.17.0" - app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.17.0 -rules: - - apiGroups: [""] - resources: ["serviceaccounts/token"] - resourceNames: ["cert-manager"] - verbs: ["create"] ---- # Source: cert-manager/templates/webhook-rbac.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: Role @@ -12826,9 +13540,9 @@ metadata: app.kubernetes.io/name: webhook app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "webhook" - app.kubernetes.io/version: "v1.17.0" + app.kubernetes.io/version: "v1.21.1" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.17.0 + helm.sh/chart: cert-manager-v1.21.1 rules: - apiGroups: [""] resources: ["secrets"] @@ -12853,9 +13567,9 @@ metadata: app.kubernetes.io/name: cainjector app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "cainjector" - app.kubernetes.io/version: "v1.17.0" + app.kubernetes.io/version: "v1.21.1" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.17.0 + helm.sh/chart: cert-manager-v1.21.1 roleRef: apiGroup: rbac.authorization.k8s.io kind: Role @@ -12864,6 +13578,7 @@ subjects: - kind: ServiceAccount name: cert-manager-cainjector namespace: cert-manager + --- # Source: cert-manager/templates/rbac.yaml # grant cert-manager permission to manage the leaderelection configmap in the @@ -12878,9 +13593,9 @@ metadata: app.kubernetes.io/name: cert-manager app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "controller" - app.kubernetes.io/version: "v1.17.0" + app.kubernetes.io/version: "v1.21.1" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.17.0 + helm.sh/chart: cert-manager-v1.21.1 roleRef: apiGroup: rbac.authorization.k8s.io kind: Role @@ -12890,30 +13605,6 @@ subjects: name: cert-manager namespace: cert-manager --- -# Source: cert-manager/templates/rbac.yaml -# grant cert-manager permission to create tokens for the serviceaccount -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: cert-manager-cert-manager-tokenrequest - namespace: cert-manager - labels: - app: cert-manager - app.kubernetes.io/name: cert-manager - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/component: "controller" - app.kubernetes.io/version: "v1.17.0" - app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.17.0 -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: cert-manager-tokenrequest -subjects: - - kind: ServiceAccount - name: cert-manager - namespace: cert-manager ---- # Source: cert-manager/templates/webhook-rbac.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding @@ -12925,9 +13616,9 @@ metadata: app.kubernetes.io/name: webhook app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "webhook" - app.kubernetes.io/version: "v1.17.0" + app.kubernetes.io/version: "v1.21.1" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.17.0 + helm.sh/chart: cert-manager-v1.21.1 roleRef: apiGroup: rbac.authorization.k8s.io kind: Role @@ -12948,9 +13639,9 @@ metadata: app.kubernetes.io/name: cainjector app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "cainjector" - app.kubernetes.io/version: "v1.17.0" + app.kubernetes.io/version: "v1.21.1" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.17.0 + helm.sh/chart: cert-manager-v1.21.1 spec: type: ClusterIP ports: @@ -12961,6 +13652,7 @@ spec: app.kubernetes.io/name: cainjector app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "cainjector" + --- # Source: cert-manager/templates/service.yaml apiVersion: v1 @@ -12973,20 +13665,20 @@ metadata: app.kubernetes.io/name: cert-manager app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "controller" - app.kubernetes.io/version: "v1.17.0" + app.kubernetes.io/version: "v1.21.1" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.17.0 + helm.sh/chart: cert-manager-v1.21.1 spec: type: ClusterIP ports: - protocol: TCP port: 9402 - name: tcp-prometheus-servicemonitor - targetPort: 9402 + name: http-metrics selector: app.kubernetes.io/name: cert-manager app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "controller" + --- # Source: cert-manager/templates/webhook-service.yaml apiVersion: v1 @@ -12999,9 +13691,9 @@ metadata: app.kubernetes.io/name: webhook app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "webhook" - app.kubernetes.io/version: "v1.17.0" + app.kubernetes.io/version: "v1.21.1" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.17.0 + helm.sh/chart: cert-manager-v1.21.1 spec: type: ClusterIP ports: @@ -13017,6 +13709,7 @@ spec: app.kubernetes.io/name: webhook app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "webhook" + --- # Source: cert-manager/templates/cainjector-deployment.yaml apiVersion: apps/v1 @@ -13029,9 +13722,9 @@ metadata: app.kubernetes.io/name: cainjector app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "cainjector" - app.kubernetes.io/version: "v1.17.0" + app.kubernetes.io/version: "v1.21.1" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.17.0 + helm.sh/chart: cert-manager-v1.21.1 spec: replicas: 1 selector: @@ -13046,9 +13739,9 @@ spec: app.kubernetes.io/name: cainjector app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "cainjector" - app.kubernetes.io/version: "v1.17.0" + app.kubernetes.io/version: "v1.21.1" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.17.0 + helm.sh/chart: cert-manager-v1.21.1 annotations: prometheus.io/path: "/metrics" prometheus.io/scrape: 'true' @@ -13062,7 +13755,7 @@ spec: type: RuntimeDefault containers: - name: cert-manager-cainjector - image: "quay.io/jetstack/cert-manager-cainjector:v1.17.0" + image: "quay.io/jetstack/cert-manager-cainjector:v1.21.1" imagePullPolicy: IfNotPresent args: - --v=2 @@ -13083,7 +13776,8 @@ spec: - ALL readOnlyRootFilesystem: true nodeSelector: - kubernetes.io/os: linux + kubernetes.io/os: "linux" + --- # Source: cert-manager/templates/deployment.yaml apiVersion: apps/v1 @@ -13096,9 +13790,9 @@ metadata: app.kubernetes.io/name: cert-manager app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "controller" - app.kubernetes.io/version: "v1.17.0" + app.kubernetes.io/version: "v1.21.1" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.17.0 + helm.sh/chart: cert-manager-v1.21.1 spec: replicas: 1 selector: @@ -13113,9 +13807,9 @@ spec: app.kubernetes.io/name: cert-manager app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "controller" - app.kubernetes.io/version: "v1.17.0" + app.kubernetes.io/version: "v1.21.1" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.17.0 + helm.sh/chart: cert-manager-v1.21.1 annotations: prometheus.io/path: "/metrics" prometheus.io/scrape: 'true' @@ -13129,13 +13823,13 @@ spec: type: RuntimeDefault containers: - name: cert-manager-controller - image: "quay.io/jetstack/cert-manager-controller:v1.17.0" + image: "quay.io/jetstack/cert-manager-controller:v1.21.1" imagePullPolicy: IfNotPresent args: - --v=2 - --cluster-resource-namespace=$(POD_NAMESPACE) - --leader-election-namespace=cert-manager - - --acme-http01-solver-image=quay.io/jetstack/cert-manager-acmesolver:v1.17.0 + - --acme-http01-solver-image=quay.io/jetstack/cert-manager-acmesolver:v1.21.1 - --max-concurrent-challenges=60 ports: - containerPort: 9402 @@ -13169,7 +13863,8 @@ spec: successThreshold: 1 failureThreshold: 8 nodeSelector: - kubernetes.io/os: linux + kubernetes.io/os: "linux" + --- # Source: cert-manager/templates/webhook-deployment.yaml apiVersion: apps/v1 @@ -13182,9 +13877,9 @@ metadata: app.kubernetes.io/name: webhook app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "webhook" - app.kubernetes.io/version: "v1.17.0" + app.kubernetes.io/version: "v1.21.1" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.17.0 + helm.sh/chart: cert-manager-v1.21.1 spec: replicas: 1 selector: @@ -13199,9 +13894,9 @@ spec: app.kubernetes.io/name: webhook app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "webhook" - app.kubernetes.io/version: "v1.17.0" + app.kubernetes.io/version: "v1.21.1" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.17.0 + helm.sh/chart: cert-manager-v1.21.1 annotations: prometheus.io/path: "/metrics" prometheus.io/scrape: 'true' @@ -13215,7 +13910,7 @@ spec: type: RuntimeDefault containers: - name: cert-manager-webhook - image: "quay.io/jetstack/cert-manager-webhook:v1.17.0" + image: "quay.io/jetstack/cert-manager-webhook:v1.21.1" imagePullPolicy: IfNotPresent args: - --v=2 @@ -13225,7 +13920,6 @@ spec: - --dynamic-serving-dns-names=cert-manager-webhook - --dynamic-serving-dns-names=cert-manager-webhook.$(POD_NAMESPACE) - --dynamic-serving-dns-names=cert-manager-webhook.$(POD_NAMESPACE).svc - ports: - name: https protocol: TCP @@ -13239,7 +13933,7 @@ spec: livenessProbe: httpGet: path: /livez - port: 6080 + port: healthcheck scheme: HTTP initialDelaySeconds: 60 periodSeconds: 10 @@ -13249,7 +13943,7 @@ spec: readinessProbe: httpGet: path: /healthz - port: 6080 + port: healthcheck scheme: HTTP initialDelaySeconds: 5 periodSeconds: 5 @@ -13268,7 +13962,8 @@ spec: fieldRef: fieldPath: metadata.namespace nodeSelector: - kubernetes.io/os: linux + kubernetes.io/os: "linux" + --- # Source: cert-manager/templates/webhook-mutating-webhook.yaml apiVersion: admissionregistration.k8s.io/v1 @@ -13280,9 +13975,9 @@ metadata: app.kubernetes.io/name: webhook app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "webhook" - app.kubernetes.io/version: "v1.17.0" + app.kubernetes.io/version: "v1.21.1" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.17.0 + helm.sh/chart: cert-manager-v1.21.1 annotations: cert-manager.io/inject-ca-from-secret: "cert-manager/cert-manager-webhook-ca" webhooks: @@ -13321,9 +14016,9 @@ metadata: app.kubernetes.io/name: webhook app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "webhook" - app.kubernetes.io/version: "v1.17.0" + app.kubernetes.io/version: "v1.21.1" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.17.0 + helm.sh/chart: cert-manager-v1.21.1 annotations: cert-manager.io/inject-ca-from-secret: "cert-manager/cert-manager-webhook-ca" webhooks: @@ -13375,9 +14070,10 @@ metadata: app.kubernetes.io/name: startupapicheck app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "startupapicheck" - app.kubernetes.io/version: "v1.17.0" + app.kubernetes.io/version: "v1.21.1" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.17.0 + helm.sh/chart: cert-manager-v1.21.1 + --- # Source: cert-manager/templates/startupapicheck-rbac.yaml # create certificate role @@ -13391,9 +14087,9 @@ metadata: app.kubernetes.io/name: startupapicheck app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "startupapicheck" - app.kubernetes.io/version: "v1.17.0" + app.kubernetes.io/version: "v1.21.1" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.17.0 + helm.sh/chart: cert-manager-v1.21.1 annotations: helm.sh/hook: post-install helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded @@ -13414,9 +14110,9 @@ metadata: app.kubernetes.io/name: startupapicheck app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "startupapicheck" - app.kubernetes.io/version: "v1.17.0" + app.kubernetes.io/version: "v1.21.1" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.17.0 + helm.sh/chart: cert-manager-v1.21.1 annotations: helm.sh/hook: post-install helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded @@ -13429,6 +14125,7 @@ subjects: - kind: ServiceAccount name: cert-manager-startupapicheck namespace: cert-manager + --- # Source: cert-manager/templates/startupapicheck-job.yaml apiVersion: batch/v1 @@ -13441,9 +14138,9 @@ metadata: app.kubernetes.io/name: startupapicheck app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "startupapicheck" - app.kubernetes.io/version: "v1.17.0" + app.kubernetes.io/version: "v1.21.1" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.17.0 + helm.sh/chart: cert-manager-v1.21.1 annotations: helm.sh/hook: post-install helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded @@ -13457,9 +14154,9 @@ spec: app.kubernetes.io/name: startupapicheck app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "startupapicheck" - app.kubernetes.io/version: "v1.17.0" + app.kubernetes.io/version: "v1.21.1" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.17.0 + helm.sh/chart: cert-manager-v1.21.1 spec: restartPolicy: OnFailure serviceAccountName: cert-manager-startupapicheck @@ -13470,7 +14167,7 @@ spec: type: RuntimeDefault containers: - name: cert-manager-startupapicheck - image: "quay.io/jetstack/cert-manager-startupapicheck:v1.17.0" + image: "quay.io/jetstack/cert-manager-startupapicheck:v1.21.1" imagePullPolicy: IfNotPresent args: - check @@ -13489,5 +14186,5 @@ spec: fieldRef: fieldPath: metadata.namespace nodeSelector: - kubernetes.io/os: linux + kubernetes.io/os: "linux" diff --git a/packages/manifests/operators/cert-manager/v1.21.1.yaml b/packages/manifests/operators/cert-manager/v1.21.1.yaml new file mode 100644 index 0000000..6a83c36 --- /dev/null +++ b/packages/manifests/operators/cert-manager/v1.21.1.yaml @@ -0,0 +1,14190 @@ +# Source: jetstack/cert-manager@v1.21.1 +--- +# Added by pull-manifests.ts to ensure namespace exists +apiVersion: v1 +kind: Namespace +metadata: + name: cert-manager + labels: + app.kubernetes.io/name: cert-manager + +--- +--- +# Source: cert-manager/templates/cainjector-serviceaccount.yaml +apiVersion: v1 +kind: ServiceAccount +automountServiceAccountToken: true +metadata: + name: cert-manager-cainjector + namespace: cert-manager + labels: + app: cainjector + app.kubernetes.io/name: cainjector + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "cainjector" + app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/managed-by: Helm + helm.sh/chart: cert-manager-v1.21.1 + +--- +# Source: cert-manager/templates/serviceaccount.yaml +apiVersion: v1 +kind: ServiceAccount +automountServiceAccountToken: true +metadata: + name: cert-manager + namespace: cert-manager + labels: + app: cert-manager + app.kubernetes.io/name: cert-manager + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "controller" + app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/managed-by: Helm + helm.sh/chart: cert-manager-v1.21.1 + +--- +# Source: cert-manager/templates/webhook-serviceaccount.yaml +apiVersion: v1 +kind: ServiceAccount +automountServiceAccountToken: true +metadata: + name: cert-manager-webhook + namespace: cert-manager + labels: + app: webhook + app.kubernetes.io/name: webhook + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "webhook" + app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/managed-by: Helm + helm.sh/chart: cert-manager-v1.21.1 + +--- +# Source: cert-manager/templates/crd-acme.cert-manager.io_challenges.yaml +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: "challenges.acme.cert-manager.io" + annotations: + helm.sh/resource-policy: keep + labels: + app: "cert-manager" + app.kubernetes.io/name: "cert-manager" + app.kubernetes.io/instance: "cert-manager" + app.kubernetes.io/component: "crds" + app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/managed-by: Helm + helm.sh/chart: cert-manager-v1.21.1 +spec: + group: acme.cert-manager.io + names: + categories: + - cert-manager + - cert-manager-acme + kind: Challenge + listKind: ChallengeList + plural: challenges + singular: challenge + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .status.state + name: State + type: string + - jsonPath: .spec.dnsName + name: Domain + type: string + - jsonPath: .status.reason + name: Reason + priority: 1 + type: string + - description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. + jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1 + schema: + openAPIV3Schema: + description: Challenge is a type to represent a Challenge request with an ACME server + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + properties: + authorizationURL: + description: |- + The URL to the ACME Authorization resource that this + challenge is a part of. + type: string + dnsName: + description: |- + dnsName is the identifier that this challenge is for, e.g., example.com. + If the requested DNSName is a 'wildcard', this field MUST be set to the + non-wildcard domain, e.g., for `*.example.com`, it must be `example.com`. + type: string + issuerRef: + description: |- + References a properly configured ACME-type Issuer which should + be used to create this Challenge. + If the Issuer does not exist, processing will be retried. + If the Issuer is not an 'ACME' Issuer, an error will be returned and the + Challenge will be marked as failed. + properties: + group: + description: |- + Group of the issuer being referred to. + Defaults to 'cert-manager.io'. + type: string + kind: + description: |- + Kind of the issuer being referred to. + Defaults to 'Issuer'. + type: string + name: + description: Name of the issuer being referred to. + type: string + required: + - name + type: object + key: + description: |- + The ACME challenge key for this challenge + For HTTP01 challenges, this is the value that must be responded with to + complete the HTTP01 challenge in the format: + `.`. + For DNS01 challenges, this is the base64 encoded SHA256 sum of the + `.` + text that must be set as the TXT record content. + type: string + solver: + description: |- + Contains the domain solving configuration that should be used to + solve this challenge resource. + properties: + dns01: + description: |- + Configures cert-manager to attempt to complete authorizations by + performing the DNS01 challenge flow. + properties: + acmeDNS: + description: |- + Use the 'ACME DNS' (https://github.com/joohoi/acme-dns) API to manage + DNS01 challenge records. + properties: + accountSecretRef: + description: |- + A reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + required: + - name + type: object + host: + type: string + required: + - accountSecretRef + - host + type: object + akamai: + description: Use the Akamai DNS zone management API to manage DNS01 challenge records. + properties: + accessTokenSecretRef: + description: |- + A reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + required: + - name + type: object + clientSecretSecretRef: + description: |- + A reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + required: + - name + type: object + clientTokenSecretRef: + description: |- + A reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + required: + - name + type: object + serviceConsumerDomain: + type: string + required: + - accessTokenSecretRef + - clientSecretSecretRef + - clientTokenSecretRef + - serviceConsumerDomain + type: object + azureDNS: + description: Use the Microsoft Azure DNS API to manage DNS01 challenge records. + properties: + clientID: + description: |- + Auth: Azure Service Principal: + The ClientID of the Azure Service Principal used to authenticate with Azure DNS. + If set, ClientSecret and TenantID must also be set. + type: string + clientSecretSecretRef: + description: |- + Auth: Azure Service Principal: + A reference to a Secret containing the password associated with the Service Principal. + If set, ClientID and TenantID must also be set. + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + required: + - name + type: object + environment: + description: name of the Azure environment (default AzurePublicCloud) + enum: + - AzurePublicCloud + - AzureChinaCloud + - AzureGermanCloud + - AzureUSGovernmentCloud + type: string + hostedZoneName: + description: name of the DNS zone that should be used + type: string + managedIdentity: + description: |- + Auth: Azure Workload Identity or Azure Managed Service Identity: + Settings to enable Azure Workload Identity or Azure Managed Service Identity + If set, ClientID, ClientSecret and TenantID must not be set. + properties: + clientID: + description: client ID of the managed identity, cannot be used at the same time as resourceID + type: string + resourceID: + description: |- + resource ID of the managed identity, cannot be used at the same time as clientID + Cannot be used for Azure Managed Service Identity + type: string + tenantID: + description: tenant ID of the managed identity, cannot be used at the same time as resourceID + type: string + type: object + resourceGroupName: + description: resource group the DNS zone is located in + type: string + subscriptionID: + description: ID of the Azure subscription + type: string + tenantID: + description: |- + Auth: Azure Service Principal: + The TenantID of the Azure Service Principal used to authenticate with Azure DNS. + If set, ClientID and ClientSecret must also be set. + type: string + zoneType: + description: |- + ZoneType determines which type of Azure DNS zone to use. + + Valid values are: + - AzurePublicZone (default): Use a public Azure DNS zone. + - AzurePrivateZone: Use an Azure Private DNS zone. + + If not specified, AzurePublicZone is used. + + Support for Azure Private DNS zones is currently + experimental and may change in future releases. + enum: + - AzurePublicZone + - AzurePrivateZone + type: string + required: + - resourceGroupName + - subscriptionID + type: object + cloudDNS: + description: Use the Google Cloud DNS API to manage DNS01 challenge records. + properties: + hostedZoneName: + description: |- + HostedZoneName is an optional field that tells cert-manager in which + Cloud DNS zone the challenge record has to be created. + If left empty cert-manager will automatically choose a zone. + type: string + project: + type: string + serviceAccountSecretRef: + description: |- + A reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + required: + - name + type: object + required: + - project + type: object + cloudflare: + description: Use the Cloudflare API to manage DNS01 challenge records. + properties: + apiKeySecretRef: + description: |- + API key to use to authenticate with Cloudflare. + Note: using an API token to authenticate is now the recommended method + as it allows greater control of permissions. + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + required: + - name + type: object + apiTokenSecretRef: + description: API token used to authenticate with Cloudflare. + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + required: + - name + type: object + email: + description: Email of the account, only required when using API key based authentication. + type: string + type: object + cnameStrategy: + description: |- + CNAMEStrategy configures how the DNS01 provider should handle CNAME + records when found in DNS zones. + enum: + - None + - Follow + type: string + digitalocean: + description: Use the DigitalOcean DNS API to manage DNS01 challenge records. + properties: + tokenSecretRef: + description: |- + A reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + required: + - name + type: object + required: + - tokenSecretRef + type: object + rfc2136: + description: |- + Use RFC2136 ("Dynamic Updates in the Domain Name System") (https://datatracker.ietf.org/doc/rfc2136/) + to manage DNS01 challenge records. + properties: + nameserver: + description: |- + The IP address or hostname of an authoritative DNS server supporting + RFC2136 in the form host:port. If the host is an IPv6 address it must be + enclosed in square brackets (e.g [2001:db8::1]); port is optional. + This field is required. + type: string + protocol: + description: Protocol to use for dynamic DNS update queries. Valid values are (case-sensitive) ``TCP`` and ``UDP``; ``UDP`` (default). + enum: + - TCP + - UDP + type: string + tsigAlgorithm: + description: |- + The TSIG Algorithm configured in the DNS supporting RFC2136. Used only + when ``tsigSecretSecretRef`` and ``tsigKeyName`` are defined. + Supported values are (case-insensitive): ``HMACMD5`` (default), + ``HMACSHA1``, ``HMACSHA256`` or ``HMACSHA512``. + type: string + tsigKeyName: + description: |- + The TSIG Key name configured in the DNS. + If ``tsigSecretSecretRef`` is defined, this field is required. + type: string + tsigSecretSecretRef: + description: |- + The name of the secret containing the TSIG value. + If ``tsigKeyName`` is defined, this field is required. + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + required: + - name + type: object + required: + - nameserver + type: object + route53: + description: Use the AWS Route53 API to manage DNS01 challenge records. + properties: + accessKeyID: + description: |- + The AccessKeyID is used for authentication. + Cannot be set when SecretAccessKeyID is set. + If neither the Access Key nor Key ID are set, we fall back to using env + vars, shared credentials file, or AWS Instance metadata, + see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials + type: string + accessKeyIDSecretRef: + description: |- + The SecretAccessKey is used for authentication. If set, pull the AWS + access key ID from a key within a Kubernetes Secret. + Cannot be set when AccessKeyID is set. + If neither the Access Key nor Key ID are set, we fall back to using env + vars, shared credentials file, or AWS Instance metadata, + see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + required: + - name + type: object + auth: + description: Auth configures how cert-manager authenticates. + properties: + kubernetes: + description: |- + Kubernetes authenticates with Route53 using AssumeRoleWithWebIdentity + by passing a bound ServiceAccount token. + properties: + serviceAccountRef: + description: |- + A reference to a service account that will be used to request a bound + token (also known as "projected token"). To use this field, you must + configure an RBAC rule to let cert-manager request a token. + properties: + audiences: + description: |- + TokenAudiences is an optional list of audiences to include in the + token passed to AWS. The default token consisting of the issuer's namespace + and name is always included. + If unset the audience defaults to `sts.amazonaws.com`. + items: + type: string + type: array + x-kubernetes-list-type: atomic + name: + description: Name of the ServiceAccount used to request a token. + type: string + required: + - name + type: object + required: + - serviceAccountRef + type: object + required: + - kubernetes + type: object + hostedZoneID: + description: If set, the provider will manage only this zone in Route53 and will not do a lookup using the route53:ListHostedZonesByName api call. + type: string + region: + description: |- + Override the AWS region. + + Route53 is a global service and does not have regional endpoints but the + region specified here (or via environment variables) is used as a hint to + help compute the correct AWS credential scope and partition when it + connects to Route53. See: + - [Amazon Route 53 endpoints and quotas](https://docs.aws.amazon.com/general/latest/gr/r53.html) + - [Global services](https://docs.aws.amazon.com/whitepapers/latest/aws-fault-isolation-boundaries/global-services.html) + + If you omit this region field, cert-manager will use the region from + AWS_REGION and AWS_DEFAULT_REGION environment variables, if they are set + in the cert-manager controller Pod. + + The `region` field is not needed if you use [IAM Roles for Service Accounts (IRSA)](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html). + Instead an AWS_REGION environment variable is added to the cert-manager controller Pod by: + [Amazon EKS Pod Identity Webhook](https://github.com/aws/amazon-eks-pod-identity-webhook). + In this case this `region` field value is ignored. + + The `region` field is not needed if you use [EKS Pod Identities](https://docs.aws.amazon.com/eks/latest/userguide/pod-identities.html). + Instead an AWS_REGION environment variable is added to the cert-manager controller Pod by: + [Amazon EKS Pod Identity Agent](https://github.com/aws/eks-pod-identity-agent), + In this case this `region` field value is ignored. + type: string + role: + description: |- + Role is a Role ARN which the Route53 provider will assume using either the explicit credentials AccessKeyID/SecretAccessKey + or the inferred credentials from environment variables, shared credentials file or AWS Instance metadata + type: string + secretAccessKeySecretRef: + description: |- + The SecretAccessKey is used for authentication. + If neither the Access Key nor Key ID are set, we fall back to using env + vars, shared credentials file, or AWS Instance metadata, + see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + required: + - name + type: object + type: object + webhook: + description: |- + Configure an external webhook based DNS01 challenge solver to manage + DNS01 challenge records. + properties: + config: + description: |- + Additional configuration that should be passed to the webhook apiserver + when challenges are processed. + This can contain arbitrary JSON data. + Secret values should not be specified in this stanza. + If secret values are needed (e.g., credentials for a DNS service), you + should use a SecretKeySelector to reference a Secret resource. + For details on the schema of this field, consult the webhook provider + implementation's documentation. + x-kubernetes-preserve-unknown-fields: true + groupName: + description: |- + The API group name that should be used when POSTing ChallengePayload + resources to the webhook apiserver. + This should be the same as the GroupName specified in the webhook + provider implementation. + type: string + solverName: + description: |- + The name of the solver to use, as defined in the webhook provider + implementation. + This will typically be the name of the provider, e.g., 'cloudflare'. + type: string + required: + - groupName + - solverName + type: object + type: object + http01: + description: |- + Configures cert-manager to attempt to complete authorizations by + performing the HTTP01 challenge flow. + It is not possible to obtain certificates for wildcard domain names + (e.g., `*.example.com`) using the HTTP01 challenge mechanism. + properties: + gatewayHTTPRoute: + description: |- + The Gateway API is a sig-network community API that models service networking + in Kubernetes (https://gateway-api.sigs.k8s.io/). The Gateway solver will + create HTTPRoutes with the specified labels in the same namespace as the challenge. + This solver is experimental, and fields / behaviour may change in the future. + properties: + labels: + additionalProperties: + type: string + description: |- + Custom labels that will be applied to HTTPRoutes created by cert-manager + while solving HTTP-01 challenges. + type: object + parentRefs: + description: |- + When solving an HTTP-01 challenge, cert-manager creates an HTTPRoute. + cert-manager needs to know which parentRefs should be used when creating + the HTTPRoute. Usually, the parentRef references a Gateway. See: + https://gateway-api.sigs.k8s.io/api-types/httproute/#attaching-to-gateways + items: + description: |- + ParentReference identifies an API object (usually a Gateway) that can be considered + a parent of this resource (usually a route). There are two kinds of parent resources + with "Core" support: + + * Gateway (Gateway conformance profile) + * Service (Mesh conformance profile, ClusterIP Services only) + + This API may be extended in the future to support additional kinds of parent + resources. + + The API object must be valid in the cluster; the Group and Kind must + be registered in the cluster for this reference to be valid. + properties: + group: + default: gateway.networking.k8s.io + description: |- + Group is the group of the referent. + When unspecified, "gateway.networking.k8s.io" is inferred. + To set the core API group (such as for a "Service" kind referent), + Group must be explicitly set to "" (empty string). + + Support: Core + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + default: Gateway + description: |- + Kind is kind of the referent. + + There are two kinds of parent resources with "Core" support: + + * Gateway (Gateway conformance profile) + * Service (Mesh conformance profile, ClusterIP Services only) + + Support for other resources is Implementation-Specific. + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: |- + Name is the name of the referent. + + Support: Core + maxLength: 253 + minLength: 1 + type: string + namespace: + description: |- + Namespace is the namespace of the referent. When unspecified, this refers + to the local namespace of the Route. + + Note that there are specific rules for ParentRefs which cross namespace + boundaries. Cross-namespace references are only valid if they are explicitly + allowed by something in the namespace they are referring to. For example: + Gateway has the AllowedRoutes field, and ReferenceGrant provides a + generic way to enable any other kind of cross-namespace reference. + + + ParentRefs from a Route to a Service in the same namespace are "producer" + routes, which apply default routing rules to inbound connections from + any namespace to the Service. + + ParentRefs from a Route to a Service in a different namespace are + "consumer" routes, and these routing rules are only applied to outbound + connections originating from the same namespace as the Route, for which + the intended destination of the connections are a Service targeted as a + ParentRef of the Route. + + + Support: Core + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + port: + description: |- + Port is the network port this Route targets. It can be interpreted + differently based on the type of parent resource. + + When the parent resource is a Gateway, this targets all listeners + listening on the specified port that also support this kind of Route(and + select this Route). It's not recommended to set `Port` unless the + networking behaviors specified in a Route must apply to a specific port + as opposed to a listener(s) whose port(s) may be changed. When both Port + and SectionName are specified, the name and port of the selected listener + must match both specified values. + + + When the parent resource is a Service, this targets a specific port in the + Service spec. When both Port (experimental) and SectionName are specified, + the name and port of the selected port must match both specified values. + + + Implementations MAY choose to support other parent resources. + Implementations supporting other types of parent resources MUST clearly + document how/if Port is interpreted. + + For the purpose of status, an attachment is considered successful as + long as the parent resource accepts it partially. For example, Gateway + listeners can restrict which Routes can attach to them by Route kind, + namespace, or hostname. If 1 of 2 Gateway listeners accept attachment + from the referencing Route, the Route MUST be considered successfully + attached. If no Gateway listeners accept attachment from this Route, + the Route MUST be considered detached from the Gateway. + + Support: Extended + format: int32 + maximum: 65535 + minimum: 1 + type: integer + sectionName: + description: |- + SectionName is the name of a section within the target resource. In the + following resources, SectionName is interpreted as the following: + + * Gateway: Listener name. When both Port (experimental) and SectionName + are specified, the name and port of the selected listener must match + both specified values. + * Service: Port name. When both Port (experimental) and SectionName + are specified, the name and port of the selected listener must match + both specified values. + + Implementations MAY choose to support attaching Routes to other resources. + If that is the case, they MUST clearly document how SectionName is + interpreted. + + When unspecified (empty string), this will reference the entire resource. + For the purpose of status, an attachment is considered successful if at + least one section in the parent resource accepts it. For example, Gateway + listeners can restrict which Routes can attach to them by Route kind, + namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from + the referencing Route, the Route MUST be considered successfully + attached. If no Gateway listeners accept attachment from this Route, the + Route MUST be considered detached from the Gateway. + + Support: Core + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + required: + - name + type: object + type: array + x-kubernetes-list-type: atomic + podTemplate: + description: |- + Optional pod template used to configure the ACME challenge solver pods + used for HTTP01 challenges. + properties: + metadata: + description: |- + ObjectMeta overrides for the pod used to solve HTTP01 challenges. + Only the 'labels' and 'annotations' fields may be set. + If labels or annotations overlap with in-built values, the values here + will override the in-built values. + properties: + annotations: + additionalProperties: + type: string + description: Annotations that should be added to the created ACME HTTP01 solver pods. + type: object + labels: + additionalProperties: + type: string + description: Labels that should be added to the created ACME HTTP01 solver pods. + type: object + type: object + spec: + description: |- + PodSpec defines overrides for the HTTP01 challenge solver pod. + Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields. + All other fields will be ignored. + properties: + affinity: + description: If specified, the pod's scheduling constraints + properties: + nodeAffinity: + description: Describes node affinity scheduling rules for the pod. + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node matches the corresponding matchExpressions; the + node(s) with the highest sum are the most preferred. + items: + description: |- + An empty preferred scheduling term matches all objects with implicit weight 0 + (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). + properties: + preference: + description: A node selector term, associated with the corresponding weight. + properties: + matchExpressions: + description: A list of node selector requirements by node's labels. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchFields: + description: A list of node selector requirements by node's fields. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + type: object + x-kubernetes-map-type: atomic + weight: + description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100. + format: int32 + type: integer + required: + - preference + - weight + type: object + type: array + x-kubernetes-list-type: atomic + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to an update), the system + may or may not try to eventually evict the pod from its node. + properties: + nodeSelectorTerms: + description: Required. A list of node selector terms. The terms are ORed. + items: + description: |- + A null or empty node selector term matches no objects. The requirements of + them are ANDed. + The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. + properties: + matchExpressions: + description: A list of node selector requirements by node's labels. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchFields: + description: A list of node selector requirements by node's fields. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + required: + - nodeSelectorTerms + type: object + x-kubernetes-map-type: atomic + type: object + podAffinity: + description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)). + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + items: + description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated with the corresponding weight. + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both matchLabelKeys and labelSelector. + Also, matchLabelKeys cannot be set when labelSelector isn't set. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. + Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + x-kubernetes-list-type: atomic + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + x-kubernetes-list-type: atomic + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both matchLabelKeys and labelSelector. + Also, matchLabelKeys cannot be set when labelSelector isn't set. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. + Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + x-kubernetes-list-type: atomic + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + type: array + x-kubernetes-list-type: atomic + type: object + podAntiAffinity: + description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)). + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the anti-affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling anti-affinity expressions, etc.), + compute a sum by iterating through the elements of this field and subtracting + "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + items: + description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated with the corresponding weight. + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both matchLabelKeys and labelSelector. + Also, matchLabelKeys cannot be set when labelSelector isn't set. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. + Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + x-kubernetes-list-type: atomic + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + x-kubernetes-list-type: atomic + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the anti-affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the anti-affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both matchLabelKeys and labelSelector. + Also, matchLabelKeys cannot be set when labelSelector isn't set. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. + Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + x-kubernetes-list-type: atomic + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + type: array + x-kubernetes-list-type: atomic + type: object + type: object + imagePullSecrets: + description: If specified, the pod's imagePullSecrets + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + nodeSelector: + additionalProperties: + type: string + description: |- + NodeSelector is a selector which must be true for the pod to fit on a node. + Selector which must match a node's labels for the pod to be scheduled on that node. + More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ + type: object + priorityClassName: + description: If specified, the pod's priorityClassName. + type: string + resources: + description: |- + If specified, the pod's resource requirements. + These values override the global resource configuration flags. + Note that when only specifying resource limits, ensure they are greater than or equal + to the corresponding global resource requests configured via controller flags + (--acme-http01-solver-resource-request-cpu, --acme-http01-solver-resource-request-memory). + Kubernetes will reject pod creation if limits are lower than requests, causing challenge failures. + properties: + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to the global values configured via controller flags. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + securityContext: + description: If specified, the pod's security context + properties: + fsGroup: + description: |- + A special supplemental group that applies to all containers in a pod. + Some volume types allow the Kubelet to change the ownership of that volume + to be owned by the pod: + + 1. The owning GID will be the FSGroup + 2. The setgid bit is set (new files created in the volume will be owned by FSGroup) + 3. The permission bits are OR'd with rw-rw---- + + If unset, the Kubelet will not modify the ownership and permissions of any volume. + Note that this field cannot be set when spec.os.name is windows. + format: int64 + type: integer + fsGroupChangePolicy: + description: |- + fsGroupChangePolicy defines behavior of changing ownership and permission of the volume + before being exposed inside Pod. This field will only apply to + volume types which support fsGroup based ownership(and permissions). + It will have no effect on ephemeral volume types such as: secret, configmaps + and emptydir. + Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used. + Note that this field cannot be set when spec.os.name is windows. + type: string + runAsGroup: + description: |- + The GID to run the entrypoint of the container process. + Uses runtime default if unset. + May also be set in SecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence + for that container. + Note that this field cannot be set when spec.os.name is windows. + format: int64 + type: integer + runAsNonRoot: + description: |- + Indicates that the container must run as a non-root user. + If true, the Kubelet will validate the image at runtime to ensure that it + does not run as UID 0 (root) and fail to start the container if it does. + If unset or false, no such validation will be performed. + May also be set in SecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: boolean + runAsUser: + description: |- + The UID to run the entrypoint of the container process. + Defaults to user specified in image metadata if unspecified. + May also be set in SecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence + for that container. + Note that this field cannot be set when spec.os.name is windows. + format: int64 + type: integer + seLinuxOptions: + description: |- + The SELinux context to be applied to all containers. + If unspecified, the container runtime will allocate a random SELinux context for each + container. May also be set in SecurityContext. If set in + both SecurityContext and PodSecurityContext, the value specified in SecurityContext + takes precedence for that container. + Note that this field cannot be set when spec.os.name is windows. + properties: + level: + description: Level is SELinux level label that applies to the container. + type: string + role: + description: Role is a SELinux role label that applies to the container. + type: string + type: + description: Type is a SELinux type label that applies to the container. + type: string + user: + description: User is a SELinux user label that applies to the container. + type: string + type: object + seccompProfile: + description: |- + The seccomp options to use by the containers in this pod. + Note that this field cannot be set when spec.os.name is windows. + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile defined in a file on the node should be used. + The profile must be preconfigured on the node to work. + Must be a descending path, relative to the kubelet's configured seccomp profile location. + Must be set if type is "Localhost". Must NOT be set for any other type. + type: string + type: + description: |- + type indicates which kind of seccomp profile will be applied. + Valid options are: + + Localhost - a profile defined in a file on the node should be used. + RuntimeDefault - the container runtime default profile should be used. + Unconfined - no profile should be applied. + type: string + required: + - type + type: object + supplementalGroups: + description: |- + A list of groups applied to the first process run in each container, in addition + to the container's primary GID, the fsGroup (if specified), and group memberships + defined in the container image for the uid of the container process. If unspecified, + no additional groups are added to any container. Note that group memberships + defined in the container image for the uid of the container process are still effective, + even if they are not included in this list. + Note that this field cannot be set when spec.os.name is windows. + items: + format: int64 + type: integer + type: array + x-kubernetes-list-type: atomic + sysctls: + description: |- + Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported + sysctls (by the container runtime) might fail to launch. + Note that this field cannot be set when spec.os.name is windows. + items: + description: Sysctl defines a kernel parameter to be set + properties: + name: + description: Name of a property to set + type: string + value: + description: Value of a property to set + type: string + required: + - name + - value + type: object + type: array + x-kubernetes-list-type: atomic + type: object + serviceAccountName: + description: If specified, the pod's service account + type: string + tolerations: + description: If specified, the pod's tolerations. + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + format: int64 + type: integer + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + type: object + type: array + x-kubernetes-list-type: atomic + type: object + type: object + serviceType: + description: |- + Optional service type for Kubernetes solver service. Supported values + are NodePort or ClusterIP. If unset, defaults to NodePort. + type: string + type: object + ingress: + description: |- + The ingress based HTTP01 challenge solver will solve challenges by + creating or modifying Ingress resources in order to route requests for + '/.well-known/acme-challenge/XYZ' to 'challenge solver' pods that are + provisioned by cert-manager for each Challenge to be completed. + properties: + class: + description: |- + This field configures the annotation `kubernetes.io/ingress.class` when + creating Ingress resources to solve ACME challenges that use this + challenge solver. Only one of `class`, `name` or `ingressClassName` may + be specified. + type: string + ingressClassName: + description: |- + This field configures the field `ingressClassName` on the created Ingress + resources used to solve ACME challenges that use this challenge solver. + This is the recommended way of configuring the ingress class. Only one of + `class`, `name` or `ingressClassName` may be specified. + type: string + ingressTemplate: + description: |- + Optional ingress template used to configure the ACME challenge solver + ingress used for HTTP01 challenges. + properties: + metadata: + description: |- + ObjectMeta overrides for the ingress used to solve HTTP01 challenges. + Only the 'labels' and 'annotations' fields may be set. + If labels or annotations overlap with in-built values, the values here + will override the in-built values. + properties: + annotations: + additionalProperties: + type: string + description: Annotations that should be added to the created ACME HTTP01 solver ingress. + type: object + labels: + additionalProperties: + type: string + description: Labels that should be added to the created ACME HTTP01 solver ingress. + type: object + type: object + type: object + name: + description: |- + The name of the ingress resource that should have ACME challenge solving + routes inserted into it in order to solve HTTP01 challenges. + This is typically used in conjunction with ingress controllers like + ingress-gce, which maintains a 1:1 mapping between external IPs and + ingress resources. Only one of `class`, `name` or `ingressClassName` may + be specified. + type: string + podTemplate: + description: |- + Optional pod template used to configure the ACME challenge solver pods + used for HTTP01 challenges. + properties: + metadata: + description: |- + ObjectMeta overrides for the pod used to solve HTTP01 challenges. + Only the 'labels' and 'annotations' fields may be set. + If labels or annotations overlap with in-built values, the values here + will override the in-built values. + properties: + annotations: + additionalProperties: + type: string + description: Annotations that should be added to the created ACME HTTP01 solver pods. + type: object + labels: + additionalProperties: + type: string + description: Labels that should be added to the created ACME HTTP01 solver pods. + type: object + type: object + spec: + description: |- + PodSpec defines overrides for the HTTP01 challenge solver pod. + Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields. + All other fields will be ignored. + properties: + affinity: + description: If specified, the pod's scheduling constraints + properties: + nodeAffinity: + description: Describes node affinity scheduling rules for the pod. + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node matches the corresponding matchExpressions; the + node(s) with the highest sum are the most preferred. + items: + description: |- + An empty preferred scheduling term matches all objects with implicit weight 0 + (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). + properties: + preference: + description: A node selector term, associated with the corresponding weight. + properties: + matchExpressions: + description: A list of node selector requirements by node's labels. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchFields: + description: A list of node selector requirements by node's fields. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + type: object + x-kubernetes-map-type: atomic + weight: + description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100. + format: int32 + type: integer + required: + - preference + - weight + type: object + type: array + x-kubernetes-list-type: atomic + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to an update), the system + may or may not try to eventually evict the pod from its node. + properties: + nodeSelectorTerms: + description: Required. A list of node selector terms. The terms are ORed. + items: + description: |- + A null or empty node selector term matches no objects. The requirements of + them are ANDed. + The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. + properties: + matchExpressions: + description: A list of node selector requirements by node's labels. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchFields: + description: A list of node selector requirements by node's fields. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + required: + - nodeSelectorTerms + type: object + x-kubernetes-map-type: atomic + type: object + podAffinity: + description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)). + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + items: + description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated with the corresponding weight. + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both matchLabelKeys and labelSelector. + Also, matchLabelKeys cannot be set when labelSelector isn't set. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. + Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + x-kubernetes-list-type: atomic + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + x-kubernetes-list-type: atomic + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both matchLabelKeys and labelSelector. + Also, matchLabelKeys cannot be set when labelSelector isn't set. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. + Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + x-kubernetes-list-type: atomic + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + type: array + x-kubernetes-list-type: atomic + type: object + podAntiAffinity: + description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)). + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the anti-affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling anti-affinity expressions, etc.), + compute a sum by iterating through the elements of this field and subtracting + "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + items: + description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated with the corresponding weight. + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both matchLabelKeys and labelSelector. + Also, matchLabelKeys cannot be set when labelSelector isn't set. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. + Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + x-kubernetes-list-type: atomic + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + x-kubernetes-list-type: atomic + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the anti-affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the anti-affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both matchLabelKeys and labelSelector. + Also, matchLabelKeys cannot be set when labelSelector isn't set. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. + Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + x-kubernetes-list-type: atomic + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + type: array + x-kubernetes-list-type: atomic + type: object + type: object + imagePullSecrets: + description: If specified, the pod's imagePullSecrets + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + nodeSelector: + additionalProperties: + type: string + description: |- + NodeSelector is a selector which must be true for the pod to fit on a node. + Selector which must match a node's labels for the pod to be scheduled on that node. + More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ + type: object + priorityClassName: + description: If specified, the pod's priorityClassName. + type: string + resources: + description: |- + If specified, the pod's resource requirements. + These values override the global resource configuration flags. + Note that when only specifying resource limits, ensure they are greater than or equal + to the corresponding global resource requests configured via controller flags + (--acme-http01-solver-resource-request-cpu, --acme-http01-solver-resource-request-memory). + Kubernetes will reject pod creation if limits are lower than requests, causing challenge failures. + properties: + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to the global values configured via controller flags. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + securityContext: + description: If specified, the pod's security context + properties: + fsGroup: + description: |- + A special supplemental group that applies to all containers in a pod. + Some volume types allow the Kubelet to change the ownership of that volume + to be owned by the pod: + + 1. The owning GID will be the FSGroup + 2. The setgid bit is set (new files created in the volume will be owned by FSGroup) + 3. The permission bits are OR'd with rw-rw---- + + If unset, the Kubelet will not modify the ownership and permissions of any volume. + Note that this field cannot be set when spec.os.name is windows. + format: int64 + type: integer + fsGroupChangePolicy: + description: |- + fsGroupChangePolicy defines behavior of changing ownership and permission of the volume + before being exposed inside Pod. This field will only apply to + volume types which support fsGroup based ownership(and permissions). + It will have no effect on ephemeral volume types such as: secret, configmaps + and emptydir. + Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used. + Note that this field cannot be set when spec.os.name is windows. + type: string + runAsGroup: + description: |- + The GID to run the entrypoint of the container process. + Uses runtime default if unset. + May also be set in SecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence + for that container. + Note that this field cannot be set when spec.os.name is windows. + format: int64 + type: integer + runAsNonRoot: + description: |- + Indicates that the container must run as a non-root user. + If true, the Kubelet will validate the image at runtime to ensure that it + does not run as UID 0 (root) and fail to start the container if it does. + If unset or false, no such validation will be performed. + May also be set in SecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: boolean + runAsUser: + description: |- + The UID to run the entrypoint of the container process. + Defaults to user specified in image metadata if unspecified. + May also be set in SecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence + for that container. + Note that this field cannot be set when spec.os.name is windows. + format: int64 + type: integer + seLinuxOptions: + description: |- + The SELinux context to be applied to all containers. + If unspecified, the container runtime will allocate a random SELinux context for each + container. May also be set in SecurityContext. If set in + both SecurityContext and PodSecurityContext, the value specified in SecurityContext + takes precedence for that container. + Note that this field cannot be set when spec.os.name is windows. + properties: + level: + description: Level is SELinux level label that applies to the container. + type: string + role: + description: Role is a SELinux role label that applies to the container. + type: string + type: + description: Type is a SELinux type label that applies to the container. + type: string + user: + description: User is a SELinux user label that applies to the container. + type: string + type: object + seccompProfile: + description: |- + The seccomp options to use by the containers in this pod. + Note that this field cannot be set when spec.os.name is windows. + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile defined in a file on the node should be used. + The profile must be preconfigured on the node to work. + Must be a descending path, relative to the kubelet's configured seccomp profile location. + Must be set if type is "Localhost". Must NOT be set for any other type. + type: string + type: + description: |- + type indicates which kind of seccomp profile will be applied. + Valid options are: + + Localhost - a profile defined in a file on the node should be used. + RuntimeDefault - the container runtime default profile should be used. + Unconfined - no profile should be applied. + type: string + required: + - type + type: object + supplementalGroups: + description: |- + A list of groups applied to the first process run in each container, in addition + to the container's primary GID, the fsGroup (if specified), and group memberships + defined in the container image for the uid of the container process. If unspecified, + no additional groups are added to any container. Note that group memberships + defined in the container image for the uid of the container process are still effective, + even if they are not included in this list. + Note that this field cannot be set when spec.os.name is windows. + items: + format: int64 + type: integer + type: array + x-kubernetes-list-type: atomic + sysctls: + description: |- + Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported + sysctls (by the container runtime) might fail to launch. + Note that this field cannot be set when spec.os.name is windows. + items: + description: Sysctl defines a kernel parameter to be set + properties: + name: + description: Name of a property to set + type: string + value: + description: Value of a property to set + type: string + required: + - name + - value + type: object + type: array + x-kubernetes-list-type: atomic + type: object + serviceAccountName: + description: If specified, the pod's service account + type: string + tolerations: + description: If specified, the pod's tolerations. + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + format: int64 + type: integer + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + type: object + type: array + x-kubernetes-list-type: atomic + type: object + type: object + serviceType: + description: |- + Optional service type for Kubernetes solver service. Supported values + are NodePort or ClusterIP. If unset, defaults to NodePort. + type: string + type: object + type: object + selector: + description: |- + Selector selects a set of DNSNames on the Certificate resource that + should be solved using this challenge solver. + If not specified, the solver will be treated as the 'default' solver + with the lowest priority, i.e. if any other solver has a more specific + match, it will be used instead. + properties: + dnsNames: + description: |- + List of DNSNames that this solver will be used to solve. + If specified and a match is found, a dnsNames selector will take + precedence over a dnsZones selector. + If multiple solvers match with the same dnsNames value, the solver + with the most matching labels in matchLabels will be selected. + If neither has more matches, the solver defined earlier in the list + will be selected. + items: + type: string + type: array + x-kubernetes-list-type: atomic + dnsZones: + description: |- + List of DNSZones that this solver will be used to solve. + The most specific DNS zone match specified here will take precedence + over other DNS zone matches, so a solver specifying sys.example.com + will be selected over one specifying example.com for the domain + www.sys.example.com. + If multiple solvers match with the same dnsZones value, the solver + with the most matching labels in matchLabels will be selected. + If neither has more matches, the solver defined earlier in the list + will be selected. + items: + type: string + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + A label selector that is used to refine the set of certificate's that + this challenge solver will apply to. + type: object + type: object + waitInsteadOfSelfCheck: + description: |- + WaitInsteadOfSelfCheck, if set, skips cert-manager's self-check and + instead waits this long after presentation before asking the ACME server + to validate the challenge. + + This is an advanced escape hatch for environments where cert-manager's + self-check cannot succeed from its own network or DNS viewpoint even + though the ACME server can still validate successfully, for example due + to split-horizon DNS or NAT hairpinning. + + A value of 0 skips the self-check and asks the ACME server to validate + immediately after presentation, relying on the ACME server's own + validation retries (RFC 8555 section 8.2) to succeed once the challenge + has propagated. A negative duration is rejected. + Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration, + for example `30s` or `2m`. + type: string + type: object + token: + description: |- + The ACME challenge token for this challenge. + This is the raw value returned from the ACME server. + type: string + type: + description: |- + The type of ACME challenge this resource represents. + One of "HTTP-01" or "DNS-01". + enum: + - HTTP-01 + - DNS-01 + type: string + url: + description: |- + The URL of the ACME Challenge resource for this challenge. + This can be used to lookup details about the status of this challenge. + type: string + wildcard: + description: |- + wildcard will be true if this challenge is for a wildcard identifier, + for example '*.example.com'. + type: boolean + required: + - authorizationURL + - dnsName + - issuerRef + - key + - solver + - token + - type + - url + type: object + status: + properties: + presented: + description: |- + Presented is true once cert-manager has configured the solver resources + needed to expose this challenge's validation material. + For example, the DNS01 TXT record has been created, or the HTTP01 solver + has been configured to serve the challenge token. + This does not imply the self check is passing, that the ACME server has + validated the challenge, or that cert-manager has already accepted the + challenge with the ACME server. + type: boolean + presentedAt: + description: |- + PresentedAt records when cert-manager first configured the solver + resources for this challenge. This is used by the optional delay-based + readiness logic. + format: date-time + type: string + processing: + description: |- + Used to denote whether this challenge should be processed or not. + This field will only be set to true by the 'scheduling' component. + It will only be set to false by the 'challenges' controller, after the + challenge has reached a final state or timed out. + If this field is set to false, the challenge controller will not take + any more action. + type: boolean + reason: + description: |- + Contains human readable information on why the Challenge is in the + current state. + type: string + state: + description: |- + Contains the current 'state' of the challenge. + If not set, the state of the challenge is unknown. + enum: + - valid + - ready + - pending + - processing + - invalid + - expired + - errored + type: string + type: object + required: + - metadata + - spec + type: object + selectableFields: + - jsonPath: .spec.issuerRef.group + - jsonPath: .spec.issuerRef.kind + - jsonPath: .spec.issuerRef.name + served: true + storage: true + subresources: + status: {} + +--- +# Source: cert-manager/templates/crd-acme.cert-manager.io_orders.yaml +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: "orders.acme.cert-manager.io" + annotations: + helm.sh/resource-policy: keep + labels: + app: "cert-manager" + app.kubernetes.io/name: "cert-manager" + app.kubernetes.io/instance: "cert-manager" + app.kubernetes.io/component: "crds" + app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/managed-by: Helm + helm.sh/chart: cert-manager-v1.21.1 +spec: + group: acme.cert-manager.io + names: + categories: + - cert-manager + - cert-manager-acme + kind: Order + listKind: OrderList + plural: orders + singular: order + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .status.state + name: State + type: string + - jsonPath: .spec.issuerRef.name + name: Issuer + priority: 1 + type: string + - jsonPath: .status.reason + name: Reason + priority: 1 + type: string + - description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. + jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1 + schema: + openAPIV3Schema: + description: Order is a type to represent an Order with an ACME server + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + properties: + commonName: + description: |- + CommonName is the common name as specified on the DER encoded CSR. + If specified, this value must also be present in `dnsNames` or `ipAddresses`. + This field must match the corresponding field on the DER encoded CSR. + type: string + dnsNames: + description: |- + DNSNames is a list of DNS names that should be included as part of the Order + validation process. + This field must match the corresponding field on the DER encoded CSR. + items: + type: string + type: array + x-kubernetes-list-type: atomic + duration: + description: |- + Duration is the duration for the not after date for the requested certificate. + This is set on order creation as per the ACME spec. + type: string + ipAddresses: + description: |- + IPAddresses is a list of IP addresses that should be included as part of the Order + validation process. + This field must match the corresponding field on the DER encoded CSR. + items: + type: string + type: array + x-kubernetes-list-type: atomic + issuerRef: + description: |- + IssuerRef references a properly configured ACME-type Issuer which should + be used to create this Order. + If the Issuer does not exist, processing will be retried. + If the Issuer is not an 'ACME' Issuer, an error will be returned and the + Order will be marked as failed. + properties: + group: + description: |- + Group of the issuer being referred to. + Defaults to 'cert-manager.io'. + type: string + kind: + description: |- + Kind of the issuer being referred to. + Defaults to 'Issuer'. + type: string + name: + description: Name of the issuer being referred to. + type: string + required: + - name + type: object + profile: + description: |- + Profile allows requesting a certificate profile from the ACME server. + Supported profiles are listed by the server's ACME directory URL. + type: string + replaces: + description: |- + Replaces is the ARI CertID (RFC 9773 §4.1) of the certificate that this + Order is intended to replace. When set, cert-manager will include the + "replaces" field on the newOrder request to the ACME server if and only + if the server advertises ARI support in its directory. The CertID has + the form "base64url(AKI).base64url(serial)" and is derived locally from + the currently issued leaf certificate. + type: string + request: + description: |- + Certificate signing request bytes in DER encoding. + This will be used when finalizing the order. + This field must be set on the order. + format: byte + type: string + required: + - issuerRef + - request + type: object + status: + properties: + authorizations: + description: |- + Authorizations contains data returned from the ACME server on what + authorizations must be completed in order to validate the DNS names + specified on the Order. + items: + description: |- + ACMEAuthorization contains data returned from the ACME server on an + authorization that must be completed in order validate a DNS name on an ACME + Order resource. + properties: + challenges: + description: |- + Challenges specifies the challenge types offered by the ACME server. + One of these challenge types will be selected when validating the DNS + name and an appropriate Challenge resource will be created to perform + the ACME challenge process. + items: + description: |- + Challenge specifies a challenge offered by the ACME server for an Order. + An appropriate Challenge resource can be created to perform the ACME + challenge process. + properties: + token: + description: |- + Token is the token that must be presented for this challenge. + This is used to compute the 'key' that must also be presented. + type: string + type: + description: |- + Type is the type of challenge being offered, e.g., 'http-01', 'dns-01', + 'tls-sni-01', etc. + This is the raw value retrieved from the ACME server. + Only 'http-01' and 'dns-01' are supported by cert-manager, other values + will be ignored. + type: string + url: + description: |- + URL is the URL of this challenge. It can be used to retrieve additional + metadata about the Challenge from the ACME server. + type: string + required: + - token + - type + - url + type: object + type: array + x-kubernetes-list-type: atomic + identifier: + description: Identifier is the DNS name to be validated as part of this authorization + type: string + initialState: + description: |- + InitialState is the initial state of the ACME authorization when first + fetched from the ACME server. + If an Authorization is already 'valid', the Order controller will not + create a Challenge resource for the authorization. This will occur when + working with an ACME server that enables 'authz reuse' (such as Let's + Encrypt's production endpoint). + If not set and 'identifier' is set, the state is assumed to be pending + and a Challenge will be created. + enum: + - valid + - ready + - pending + - processing + - invalid + - expired + - errored + type: string + url: + description: URL is the URL of the Authorization that must be completed + type: string + wildcard: + description: |- + Wildcard will be true if this authorization is for a wildcard DNS name. + If this is true, the identifier will be the *non-wildcard* version of + the DNS name. + For example, if '*.example.com' is the DNS name being validated, this + field will be 'true' and the 'identifier' field will be 'example.com'. + type: boolean + required: + - url + type: object + type: array + x-kubernetes-list-type: atomic + certificate: + description: |- + Certificate is a copy of the PEM encoded certificate for this Order. + This field will be populated after the order has been successfully + finalized with the ACME server, and the order has transitioned to the + 'valid' state. + format: byte + type: string + failureTime: + description: |- + FailureTime stores the time that this order failed. + This is used to influence garbage collection and back-off. + format: date-time + type: string + finalizeURL: + description: |- + FinalizeURL of the Order. + This is used to obtain certificates for this order once it has been completed. + type: string + reason: + description: |- + Reason optionally provides more information about a why the order is in + the current state. + type: string + state: + description: |- + State contains the current state of this Order resource. + States 'success' and 'expired' are 'final' + enum: + - valid + - ready + - pending + - processing + - invalid + - expired + - errored + type: string + url: + description: |- + URL of the Order. + This will initially be empty when the resource is first created. + The Order controller will populate this field when the Order is first processed. + This field will be immutable after it is initially set. + type: string + type: object + required: + - metadata + - spec + type: object + selectableFields: + - jsonPath: .spec.issuerRef.group + - jsonPath: .spec.issuerRef.kind + - jsonPath: .spec.issuerRef.name + served: true + storage: true + subresources: + status: {} + +--- +# Source: cert-manager/templates/crd-cert-manager.io_certificaterequests.yaml +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: "certificaterequests.cert-manager.io" + annotations: + helm.sh/resource-policy: keep + labels: + app: "cert-manager" + app.kubernetes.io/name: "cert-manager" + app.kubernetes.io/instance: "cert-manager" + app.kubernetes.io/component: "crds" + app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/managed-by: Helm + helm.sh/chart: cert-manager-v1.21.1 +spec: + group: cert-manager.io + names: + categories: + - cert-manager + kind: CertificateRequest + listKind: CertificateRequestList + plural: certificaterequests + shortNames: + - cr + - crs + singular: certificaterequest + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .status.conditions[?(@.type == "Approved")].status + name: Approved + type: string + - jsonPath: .status.conditions[?(@.type == "Denied")].status + name: Denied + type: string + - jsonPath: .status.conditions[?(@.type == "Ready")].status + name: Ready + type: string + - jsonPath: .spec.issuerRef.name + name: Issuer + type: string + - jsonPath: .spec.username + name: Requester + type: string + - jsonPath: .status.conditions[?(@.type == "Ready")].message + name: Status + priority: 1 + type: string + - description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. + jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1 + schema: + openAPIV3Schema: + description: |- + A CertificateRequest is used to request a signed certificate from one of the + configured issuers. + + All fields within the CertificateRequest's `spec` are immutable after creation. + A CertificateRequest will either succeed or fail, as denoted by its `Ready` status + condition and its `status.failureTime` field. + + A CertificateRequest is a one-shot resource, meaning it represents a single + point in time request for a certificate and cannot be re-used. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: |- + Specification of the desired state of the CertificateRequest resource. + https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status + properties: + duration: + description: |- + Requested 'duration' (i.e. lifetime) of the Certificate. Note that the + issuer may choose to ignore the requested duration, just like any other + requested attribute. + type: string + extra: + additionalProperties: + items: + type: string + type: array + description: |- + Extra contains extra attributes of the user that created the CertificateRequest. + Populated by the cert-manager webhook on creation and immutable. + type: object + groups: + description: |- + Groups contains group membership of the user that created the CertificateRequest. + Populated by the cert-manager webhook on creation and immutable. + items: + type: string + type: array + x-kubernetes-list-type: atomic + isCA: + description: |- + Requested basic constraints isCA value. Note that the issuer may choose + to ignore the requested isCA value, just like any other requested attribute. + + NOTE: If the CSR in the `Request` field has a BasicConstraints extension, + it must have the same isCA value as specified here. + + If true, this will automatically add the `cert sign` usage to the list + of requested `usages`. + type: boolean + issuerRef: + description: |- + Reference to the issuer responsible for issuing the certificate. + If the issuer is namespace-scoped, it must be in the same namespace + as the Certificate. If the issuer is cluster-scoped, it can be used + from any namespace. + + The `name` field of the reference must always be specified. + properties: + group: + description: |- + Group of the issuer being referred to. + Defaults to 'cert-manager.io'. + type: string + kind: + description: |- + Kind of the issuer being referred to. + Defaults to 'Issuer'. + type: string + name: + description: Name of the issuer being referred to. + type: string + required: + - name + type: object + request: + description: |- + The PEM-encoded X.509 certificate signing request to be submitted to the + issuer for signing. + + If the CSR has a BasicConstraints extension, its isCA attribute must + match the `isCA` value of this CertificateRequest. + If the CSR has a KeyUsage extension, its key usages must match the + key usages in the `usages` field of this CertificateRequest. + If the CSR has a ExtKeyUsage extension, its extended key usages + must match the extended key usages in the `usages` field of this + CertificateRequest. + format: byte + type: string + uid: + description: |- + UID contains the uid of the user that created the CertificateRequest. + Populated by the cert-manager webhook on creation and immutable. + type: string + usages: + description: |- + Requested key usages and extended key usages. + + NOTE: If the CSR in the `Request` field has uses the KeyUsage or + ExtKeyUsage extension, these extensions must have the same values + as specified here without any additional values. + + If unset, defaults to `digital signature` and `key encipherment`. + items: + description: |- + KeyUsage specifies valid usage contexts for keys. + See: + https://tools.ietf.org/html/rfc5280#section-4.2.1.3 + https://tools.ietf.org/html/rfc5280#section-4.2.1.12 + + Valid KeyUsage values are as follows: + "signing", + "digital signature", + "content commitment", + "key encipherment", + "key agreement", + "data encipherment", + "cert sign", + "crl sign", + "encipher only", + "decipher only", + "any", + "server auth", + "client auth", + "code signing", + "email protection", + "s/mime", + "ipsec end system", + "ipsec tunnel", + "ipsec user", + "timestamping", + "ocsp signing", + "microsoft sgc", + "netscape sgc" + enum: + - signing + - digital signature + - content commitment + - key encipherment + - key agreement + - data encipherment + - cert sign + - crl sign + - encipher only + - decipher only + - any + - server auth + - client auth + - code signing + - email protection + - s/mime + - ipsec end system + - ipsec tunnel + - ipsec user + - timestamping + - ocsp signing + - microsoft sgc + - netscape sgc + type: string + type: array + x-kubernetes-list-type: atomic + username: + description: |- + Username contains the name of the user that created the CertificateRequest. + Populated by the cert-manager webhook on creation and immutable. + type: string + required: + - issuerRef + - request + type: object + status: + description: |- + Status of the CertificateRequest. + This is set and managed automatically. + Read-only. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status + properties: + ca: + description: |- + The PEM encoded X.509 certificate of the signer, also known as the CA + (Certificate Authority). + This is set on a best-effort basis by different issuers. + If not set, the CA is assumed to be unknown/not available. + format: byte + type: string + certificate: + description: |- + The PEM encoded X.509 certificate resulting from the certificate + signing request. + If not set, the CertificateRequest has either not been completed or has + failed. More information on failure can be found by checking the + `conditions` field. + format: byte + type: string + conditions: + description: |- + List of status conditions to indicate the status of a CertificateRequest. + Known condition types are `Ready`, `InvalidRequest`, `Approved` and `Denied`. + items: + description: CertificateRequestCondition contains condition information for a CertificateRequest. + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the timestamp corresponding to the last status + change of this condition. + format: date-time + type: string + message: + description: |- + Message is a human readable description of the details of the last + transition, complementing reason. + type: string + reason: + description: |- + Reason is a brief machine readable explanation for the condition's last + transition. + type: string + status: + description: Status of the condition, one of (`True`, `False`, `Unknown`). + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: |- + Type of the condition, known values are (`Ready`, `InvalidRequest`, + `Approved`, `Denied`). + type: string + required: + - status + - type + type: object + type: array + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + failureTime: + description: |- + FailureTime stores the time that this CertificateRequest failed. This is + used to influence garbage collection and back-off. + format: date-time + type: string + type: object + type: object + selectableFields: + - jsonPath: .spec.issuerRef.group + - jsonPath: .spec.issuerRef.kind + - jsonPath: .spec.issuerRef.name + served: true + storage: true + subresources: + status: {} + +--- +# Source: cert-manager/templates/crd-cert-manager.io_certificates.yaml +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: "certificates.cert-manager.io" + annotations: + helm.sh/resource-policy: keep + labels: + app: "cert-manager" + app.kubernetes.io/name: "cert-manager" + app.kubernetes.io/instance: "cert-manager" + app.kubernetes.io/component: "crds" + app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/managed-by: Helm + helm.sh/chart: cert-manager-v1.21.1 +spec: + group: cert-manager.io + names: + categories: + - cert-manager + kind: Certificate + listKind: CertificateList + plural: certificates + shortNames: + - cert + - certs + singular: certificate + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .status.conditions[?(@.type == "Ready")].status + name: Ready + type: string + - jsonPath: .spec.secretName + name: Secret + type: string + - jsonPath: .spec.issuerRef.name + name: Issuer + priority: 1 + type: string + - jsonPath: .status.conditions[?(@.type == "Ready")].message + name: Status + priority: 1 + type: string + - description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. + jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1 + schema: + openAPIV3Schema: + description: |- + A Certificate resource should be created to ensure an up to date and signed + X.509 certificate is stored in the Kubernetes Secret resource named in `spec.secretName`. + + The stored certificate will be renewed before it expires (as configured by `spec.renewBefore`). + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: |- + Specification of the desired state of the Certificate resource. + https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status + properties: + additionalOutputFormats: + description: |- + Defines extra output formats of the private key and signed certificate chain + to be written to this Certificate's target Secret. + items: + description: |- + CertificateAdditionalOutputFormat defines an additional output format of a + Certificate resource. These contain supplementary data formats of the signed + certificate chain and paired private key. + properties: + type: + description: |- + Type is the name of the format type that should be written to the + Certificate's target Secret. + enum: + - DER + - CombinedPEM + type: string + required: + - type + type: object + type: array + x-kubernetes-list-type: atomic + commonName: + description: |- + Requested common name X509 certificate subject attribute. + More info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.6 + NOTE: TLS clients will ignore this value when any subject alternative name is + set (see https://tools.ietf.org/html/rfc6125#section-6.4.4). + + Should have a length of 64 characters or fewer to avoid generating invalid CSRs. + Cannot be set if the `literalSubject` field is set. + type: string + dnsNames: + description: Requested DNS subject alternative names. + items: + type: string + type: array + x-kubernetes-list-type: atomic + duration: + description: |- + Requested 'duration' (i.e. lifetime) of the Certificate. Note that the + issuer may choose to ignore the requested duration, just like any other + requested attribute. + + If unset, this defaults to 90 days. + Minimum accepted duration is 1 hour. + Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration. + type: string + emailAddresses: + description: Requested email subject alternative names. + items: + type: string + type: array + x-kubernetes-list-type: atomic + encodeUsagesInRequest: + description: |- + Whether the KeyUsage and ExtKeyUsage extensions should be set in the encoded CSR. + + This option defaults to true, and should only be disabled if the target + issuer does not support CSRs with these X509 KeyUsage/ ExtKeyUsage extensions. + type: boolean + ipAddresses: + description: Requested IP address subject alternative names. + items: + type: string + type: array + x-kubernetes-list-type: atomic + isCA: + description: |- + Requested basic constraints isCA value. + The isCA value is used to set the `isCA` field on the created CertificateRequest + resources. Note that the issuer may choose to ignore the requested isCA value, just + like any other requested attribute. + + If true, this will automatically add the `cert sign` usage to the list + of requested `usages`. + type: boolean + issuerRef: + description: |- + Reference to the issuer responsible for issuing the certificate. + If the issuer is namespace-scoped, it must be in the same namespace + as the Certificate. If the issuer is cluster-scoped, it can be used + from any namespace. + + The `name` field of the reference must always be specified. + properties: + group: + description: |- + Group of the issuer being referred to. + Defaults to 'cert-manager.io'. + type: string + kind: + description: |- + Kind of the issuer being referred to. + Defaults to 'Issuer'. + type: string + name: + description: Name of the issuer being referred to. + type: string + required: + - name + type: object + keystores: + description: Additional keystore output formats to be stored in the Certificate's Secret. + properties: + jks: + description: |- + JKS configures options for storing a JKS keystore in the + `spec.secretName` Secret resource. + properties: + alias: + description: |- + Alias specifies the alias of the key in the keystore, required by the JKS format. + If not provided, the default alias `certificate` will be used. + type: string + create: + description: |- + Create enables JKS keystore creation for the Certificate. + If true, a file named `keystore.jks` will be created in the target + Secret resource, encrypted using the password stored in + `passwordSecretRef` or `password`. + The keystore file will be updated immediately. + If the issuer provided a CA certificate, a file named `truststore.jks` + will also be created in the target Secret resource, encrypted using the + password stored in `passwordSecretRef` + containing the issuing Certificate Authority + type: boolean + password: + description: |- + Password provides a literal password used to encrypt the JKS keystore. + Mutually exclusive with passwordSecretRef. + One of password or passwordSecretRef must provide a password with a non-zero length. + type: string + passwordSecretRef: + description: |- + PasswordSecretRef is a reference to a non-empty key in a Secret resource + containing the password used to encrypt the JKS keystore. + Mutually exclusive with password. + One of password or passwordSecretRef must provide a password with a non-zero length. + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + required: + - name + type: object + required: + - create + type: object + pkcs12: + description: |- + PKCS12 configures options for storing a PKCS12 keystore in the + `spec.secretName` Secret resource. + properties: + create: + description: |- + Create enables PKCS12 keystore creation for the Certificate. + If true, a file named `keystore.p12` will be created in the target + Secret resource, encrypted using the password stored in + `passwordSecretRef` or in `password`. + The keystore file will be updated immediately. + If the issuer provided a CA certificate, a file named `truststore.p12` will + also be created in the target Secret resource, encrypted using the + password stored in `passwordSecretRef` containing the issuing Certificate + Authority + type: boolean + password: + description: |- + Password provides a literal password used to encrypt the PKCS#12 keystore. + Mutually exclusive with passwordSecretRef. + One of password or passwordSecretRef must provide a password with a non-zero length. + type: string + passwordSecretRef: + description: |- + PasswordSecretRef is a reference to a non-empty key in a Secret resource + containing the password used to encrypt the PKCS#12 keystore. + Mutually exclusive with password. + One of password or passwordSecretRef must provide a password with a non-zero length. + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + required: + - name + type: object + profile: + description: |- + Profile specifies the key and certificate encryption algorithms and the HMAC algorithm + used to create the PKCS12 keystore. Default value is `LegacyRC2` for backward compatibility. + + If provided, allowed values are: + `LegacyRC2`: Deprecated. Not supported by default in OpenSSL 3 or Java 20. + `LegacyDES`: Less secure algorithm. Use this option for maximal compatibility. + `Modern2023`: Secure algorithm. Use this option in case you have to always use secure algorithms + (e.g., because of company policy). Please note that the security of the algorithm is not that important + in reality, because the unencrypted certificate and private key are also stored in the Secret. + `Modern2026`: Encodes PKCS#12 files using algorithms that are considered modern as of 2026. + Private keys and certificates are encrypted using PBES2 with PBKDF2-HMAC-SHA-256 and AES-256-CBC. + The MAC algorithm is PBMAC1 with PBKDF2-HMAC-SHA-256 and HMAC-SHA256. + Files produced with this profile can be read by OpenSSL 3.4.0 and higher, Java 26 and higher, + or with Java using compatible versions of Bouncy Castle. Meets FIPS 140-3 requirements. + enum: + - LegacyRC2 + - LegacyDES + - Modern2023 + - Modern2026 + type: string + required: + - create + type: object + type: object + literalSubject: + description: |- + Requested X.509 certificate subject, represented using the LDAP "String + Representation of a Distinguished Name" [1]. + Important: the LDAP string format also specifies the order of the attributes + in the subject, this is important when issuing certs for LDAP authentication. + Example: `CN=foo,DC=corp,DC=example,DC=com` + More info [1]: https://datatracker.ietf.org/doc/html/rfc4514 + More info: https://github.com/cert-manager/cert-manager/issues/3203 + More info: https://github.com/cert-manager/cert-manager/issues/4424 + + Cannot be set if the `subject` or `commonName` field is set. + type: string + nameConstraints: + description: |- + x.509 certificate NameConstraint extension which MUST NOT be used in a non-CA certificate. + More Info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.10 + + This is an Alpha Feature and is only enabled with the + `--feature-gates=NameConstraints=true` option set on both + the controller and webhook components. + properties: + critical: + description: if true then the name constraints are marked critical. + type: boolean + excluded: + description: |- + Excluded contains the constraints which must be disallowed. Any name matching a + restriction in the excluded field is invalid regardless + of information appearing in the permitted + properties: + dnsDomains: + description: DNSDomains is a list of DNS domains that are permitted or excluded. + items: + type: string + type: array + x-kubernetes-list-type: atomic + emailAddresses: + description: EmailAddresses is a list of Email Addresses that are permitted or excluded. + items: + type: string + type: array + x-kubernetes-list-type: atomic + ipRanges: + description: |- + IPRanges is a list of IP Ranges that are permitted or excluded. + This should be a valid CIDR notation. + items: + type: string + type: array + x-kubernetes-list-type: atomic + uriDomains: + description: URIDomains is a list of URI domains that are permitted or excluded. + items: + type: string + type: array + x-kubernetes-list-type: atomic + type: object + permitted: + description: Permitted contains the constraints in which the names must be located. + properties: + dnsDomains: + description: DNSDomains is a list of DNS domains that are permitted or excluded. + items: + type: string + type: array + x-kubernetes-list-type: atomic + emailAddresses: + description: EmailAddresses is a list of Email Addresses that are permitted or excluded. + items: + type: string + type: array + x-kubernetes-list-type: atomic + ipRanges: + description: |- + IPRanges is a list of IP Ranges that are permitted or excluded. + This should be a valid CIDR notation. + items: + type: string + type: array + x-kubernetes-list-type: atomic + uriDomains: + description: URIDomains is a list of URI domains that are permitted or excluded. + items: + type: string + type: array + x-kubernetes-list-type: atomic + type: object + type: object + otherNames: + description: |- + `otherNames` is an escape hatch for SAN that allows any type. We currently restrict the support to string like otherNames, cf RFC 5280 p 37 + Any UTF8 String valued otherName can be passed with by setting the keys oid: x.x.x.x and UTF8Value: somevalue for `otherName`. + Most commonly this would be UPN set with oid: 1.3.6.1.4.1.311.20.2.3 + You should ensure that any OID passed is valid for the UTF8String type as we do not explicitly validate this. + items: + properties: + oid: + description: |- + OID is the object identifier for the otherName SAN. + The object identifier must be expressed as a dotted string, for + example, "1.2.840.113556.1.4.221". + type: string + utf8Value: + description: |- + utf8Value is the string value of the otherName SAN. + The utf8Value accepts any valid UTF8 string to set as value for the otherName SAN. + type: string + type: object + type: array + x-kubernetes-list-type: atomic + privateKey: + description: |- + Private key options. These include the key algorithm and size, the used + encoding and the rotation policy. + properties: + algorithm: + description: |- + Algorithm is the private key algorithm of the corresponding private key + for this certificate. + + If provided, allowed values are either `RSA`, `ECDSA` or `Ed25519`. + If `algorithm` is specified and `size` is not provided, + key size of 2048 will be used for `RSA` key algorithm and + key size of 256 will be used for `ECDSA` key algorithm. + key size is ignored when using the `Ed25519` key algorithm. + enum: + - RSA + - ECDSA + - Ed25519 + type: string + encoding: + description: |- + The private key cryptography standards (PKCS) encoding for this + certificate's private key to be encoded in. + + If provided, allowed values are `PKCS1` and `PKCS8` standing for PKCS#1 + and PKCS#8, respectively. + Defaults to `PKCS1` if not specified. + enum: + - PKCS1 + - PKCS8 + type: string + rotationPolicy: + description: |- + RotationPolicy controls how private keys should be regenerated when a + re-issuance is being processed. + + If set to `Never`, a private key will only be generated if one does not + already exist in the target `spec.secretName`. If one does exist but it + does not have the correct algorithm or size, a warning will be raised + to await user intervention. + If set to `Always`, a private key matching the specified requirements + will be generated whenever a re-issuance occurs. + Default is `Always`. + The default was changed from `Never` to `Always` in cert-manager >=v1.18.0. + enum: + - Never + - Always + type: string + size: + description: |- + Size is the key bit size of the corresponding private key for this certificate. + + If `algorithm` is set to `RSA`, valid values are `2048`, `4096` or `8192`, + and will default to `2048` if not specified. + If `algorithm` is set to `ECDSA`, valid values are `256`, `384` or `521`, + and will default to `256` if not specified. + If `algorithm` is set to `Ed25519`, Size is ignored. + No other values are allowed. + type: integer + type: object + renewBefore: + description: |- + How long before the currently issued certificate's expiry cert-manager should + renew the certificate. For example, if a certificate is valid for 60 minutes, + and `renewBefore=10m`, cert-manager will begin to attempt to renew the certificate + 50 minutes after it was issued (i.e. when there are 10 minutes remaining until + the certificate is no longer valid). + + NOTE: The actual lifetime of the issued certificate is used to determine the + renewal time. If an issuer returns a certificate with a different lifetime than + the one requested, cert-manager will use the lifetime of the issued certificate. + + If unset, this defaults to 1/3 of the issued certificate's lifetime. + Minimum accepted value is 5 minutes. + Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration. + Cannot be set if the `renewBeforePercentage` field is set. + type: string + renewBeforePercentage: + description: |- + `renewBeforePercentage` is like `renewBefore`, except it is a relative percentage + rather than an absolute duration. For example, if a certificate is valid for 60 + minutes, and `renewBeforePercentage=25`, cert-manager will begin to attempt to + renew the certificate 45 minutes after it was issued (i.e. when there are 15 + minutes (25%) remaining until the certificate is no longer valid). + + NOTE: The actual lifetime of the issued certificate is used to determine the + renewal time. If an issuer returns a certificate with a different lifetime than + the one requested, cert-manager will use the lifetime of the issued certificate. + + Value must be an integer in the range (0,100). The minimum effective + `renewBefore` derived from the `renewBeforePercentage` and `duration` fields is 5 + minutes. + Cannot be set if the `renewBefore` field is set. + format: int32 + type: integer + renewal: + description: |- + `renewal` allows configuration of how your certificate is renewed. If the policy mentioned is + `RenewBefore` then the controller respects `renewBefore` and `renewBeforePercentage`. + properties: + policy: + description: '`policy` must be one of `Disabled`, `RenewBefore`.' + enum: + - RenewBefore + - Disabled + type: string + windows: + description: '`windows` mentions the behavior of when the renewal must happen.' + items: + description: CertificateRenewalWindows is the definition for renewal windows + properties: + cron: + description: |- + `cron` is a cron compliant string to allow when the renewal should be allowed. Format is as shown below: + * * * * * + | | | | | + | | | | day of the week (0–6) (Sunday to Saturday; + | | | month (1–12) 7 is also Sunday on some systems) + | | day of the month (1–31) + | hour (0–23) + minute (0–59) + minLength: 1 + type: string + timezone: + description: |- + `timezone` is IANA compliant timezone. For example America/Denver. + If this field is not set, timezone is treated as UTC. + minLength: 1 + type: string + windowDuration: + description: |- + `windowDuration` is how long the cron definition is active for. + Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration. + pattern: ^([0-9]+(\.[0-9]+)?(s|m|h))+$ + type: string + required: + - cron + - windowDuration + type: object + type: array + x-kubernetes-list-type: atomic + type: object + revisionHistoryLimit: + description: |- + The maximum number of CertificateRequest revisions that are maintained in + the Certificate's history. Each revision represents a single `CertificateRequest` + created by this Certificate, either when it was created, renewed, or Spec + was changed. Revisions will be removed by oldest first if the number of + revisions exceeds this number. + + If set, revisionHistoryLimit must be a value of `1` or greater. + Default value is `1`. + format: int32 + type: integer + secretName: + description: |- + Name of the Secret resource that will be automatically created and + managed by this Certificate resource. It will be populated with a + private key and certificate, signed by the denoted issuer. The Secret + resource lives in the same namespace as the Certificate resource. + type: string + secretTemplate: + description: |- + Defines annotations and labels to be copied to the Certificate's Secret. + Labels and annotations on the Secret will be changed as they appear on the + SecretTemplate when added or removed. SecretTemplate annotations are added + in conjunction with, and cannot overwrite, the base set of annotations + cert-manager sets on the Certificate's Secret. + properties: + annotations: + additionalProperties: + type: string + description: Annotations is a key value map to be copied to the target Kubernetes Secret. + type: object + labels: + additionalProperties: + type: string + description: Labels is a key value map to be copied to the target Kubernetes Secret. + type: object + type: object + signatureAlgorithm: + description: |- + Signature algorithm to use. + Allowed values for RSA keys: SHA256WithRSA, SHA384WithRSA, SHA512WithRSA. + Allowed values for ECDSA keys: ECDSAWithSHA256, ECDSAWithSHA384, ECDSAWithSHA512. + Allowed values for Ed25519 keys: PureEd25519. + enum: + - SHA256WithRSA + - SHA384WithRSA + - SHA512WithRSA + - ECDSAWithSHA256 + - ECDSAWithSHA384 + - ECDSAWithSHA512 + - PureEd25519 + type: string + subject: + description: |- + Requested set of X509 certificate subject attributes. + More info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.6 + + The common name attribute is specified separately in the `commonName` field. + Cannot be set if the `literalSubject` field is set. + properties: + countries: + description: Countries to be used on the Certificate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + localities: + description: Cities to be used on the Certificate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + organizationalUnits: + description: Organizational Units to be used on the Certificate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + organizations: + description: Organizations to be used on the Certificate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + postalCodes: + description: Postal codes to be used on the Certificate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + provinces: + description: State/Provinces to be used on the Certificate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + serialNumber: + description: Serial number to be used on the Certificate. + type: string + streetAddresses: + description: Street addresses to be used on the Certificate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + type: object + uris: + description: Requested URI subject alternative names. + items: + type: string + type: array + x-kubernetes-list-type: atomic + usages: + description: |- + Requested key usages and extended key usages. + These usages are used to set the `usages` field on the created CertificateRequest + resources. If `encodeUsagesInRequest` is unset or set to `true`, the usages + will additionally be encoded in the `request` field which contains the CSR blob. + + If unset, defaults to `digital signature` and `key encipherment`. + items: + description: |- + KeyUsage specifies valid usage contexts for keys. + See: + https://tools.ietf.org/html/rfc5280#section-4.2.1.3 + https://tools.ietf.org/html/rfc5280#section-4.2.1.12 + + Valid KeyUsage values are as follows: + "signing", + "digital signature", + "content commitment", + "key encipherment", + "key agreement", + "data encipherment", + "cert sign", + "crl sign", + "encipher only", + "decipher only", + "any", + "server auth", + "client auth", + "code signing", + "email protection", + "s/mime", + "ipsec end system", + "ipsec tunnel", + "ipsec user", + "timestamping", + "ocsp signing", + "microsoft sgc", + "netscape sgc" + enum: + - signing + - digital signature + - content commitment + - key encipherment + - key agreement + - data encipherment + - cert sign + - crl sign + - encipher only + - decipher only + - any + - server auth + - client auth + - code signing + - email protection + - s/mime + - ipsec end system + - ipsec tunnel + - ipsec user + - timestamping + - ocsp signing + - microsoft sgc + - netscape sgc + type: string + type: array + x-kubernetes-list-type: atomic + required: + - issuerRef + - secretName + type: object + status: + description: |- + Status of the Certificate. + This is set and managed automatically. + Read-only. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status + properties: + acme: + description: ACME stores information that is fetched from the ACME CA server. + properties: + ari: + description: |- + ARI stores the ACME Renewal Information that is fetched from the ACME server + in accordance with RFC 9773. This is only populated if the ARI feature gate is enabled. + properties: + explanationURL: + description: |- + ExplanationURL is a human-readable URL that may explain why the suggested window + has its current value. + type: string + lastChecked: + description: LastChecked is the time at which the ACME server was last checked for renewal information. + format: date-time + type: string + lastError: + description: LastError is the last error encountered when checking the ACME server for renewal information, if any. + type: string + nextCheck: + description: NextCheck is the time at which the ACME server will next be checked for renewal information. + format: date-time + type: string + suggestedWindow: + description: SuggestedWindow is the suggested renewal window as returned by the ACME server in accordance with RFC 9773. + properties: + end: + description: End is the end of the suggested renewal window. + format: date-time + type: string + start: + description: Start is the start of the suggested renewal window. + format: date-time + type: string + required: + - end + - start + type: object + type: object + type: object + conditions: + description: |- + List of status conditions to indicate the status of certificates. + Known condition types are `Ready` and `Issuing`. + items: + description: CertificateCondition contains condition information for a Certificate. + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the timestamp corresponding to the last status + change of this condition. + format: date-time + type: string + message: + description: |- + Message is a human readable description of the details of the last + transition, complementing reason. + type: string + observedGeneration: + description: |- + If set, this represents the .metadata.generation that the condition was + set based upon. + For instance, if .metadata.generation is currently 12, but the + .status.condition[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the Certificate. + format: int64 + type: integer + reason: + description: |- + Reason is a brief machine readable explanation for the condition's last + transition. + type: string + status: + description: Status of the condition, one of (`True`, `False`, `Unknown`). + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: Type of the condition, known values are (`Ready`, `Issuing`). + type: string + required: + - status + - type + type: object + type: array + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + failedIssuanceAttempts: + description: |- + The number of continuous failed issuance attempts up till now. This + field gets removed (if set) on a successful issuance and gets set to + 1 if unset and an issuance has failed. If an issuance has failed, the + delay till the next issuance will be calculated using formula + time.Hour * 2 ^ (failedIssuanceAttempts - 1). + type: integer + lastFailureTime: + description: |- + LastFailureTime is set only if the latest issuance for this + Certificate failed and contains the time of the failure. If an + issuance has failed, the delay till the next issuance will be + calculated using formula time.Hour * 2 ^ (failedIssuanceAttempts - + 1). If the latest issuance has succeeded this field will be unset. + format: date-time + type: string + nextPrivateKeySecretName: + description: |- + The name of the Secret resource containing the private key to be used + for the next certificate iteration. + The keymanager controller will automatically set this field if the + `Issuing` condition is set to `True`. + It will automatically unset this field when the Issuing condition is + not set or False. + type: string + notAfter: + description: |- + The expiration time of the certificate stored in the secret named + by this resource in `spec.secretName`. + format: date-time + type: string + notBefore: + description: |- + The time after which the certificate stored in the secret named + by this resource in `spec.secretName` is valid. + format: date-time + type: string + renewalTime: + description: |- + RenewalTime is the time at which the certificate will be next + renewed. + If not set, no upcoming renewal is scheduled. + format: date-time + type: string + revision: + description: |- + The current 'revision' of the certificate as issued. + + When a CertificateRequest resource is created, it will have the + `cert-manager.io/certificate-revision` set to one greater than the + current value of this field. + + Upon issuance, this field will be set to the value of the annotation + on the CertificateRequest resource used to issue the certificate. + + Persisting the value on the CertificateRequest resource allows the + certificates controller to know whether a request is part of an old + issuance or if it is part of the ongoing revision's issuance by + checking if the revision value in the annotation is greater than this + field. + type: integer + type: object + type: object + selectableFields: + - jsonPath: .spec.issuerRef.group + - jsonPath: .spec.issuerRef.kind + - jsonPath: .spec.issuerRef.name + served: true + storage: true + subresources: + status: {} + +--- +# Source: cert-manager/templates/crd-cert-manager.io_clusterissuers.yaml +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: "clusterissuers.cert-manager.io" + annotations: + helm.sh/resource-policy: keep + labels: + app: "cert-manager" + app.kubernetes.io/name: "cert-manager" + app.kubernetes.io/instance: "cert-manager" + app.kubernetes.io/component: "crds" + app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/managed-by: Helm + helm.sh/chart: cert-manager-v1.21.1 +spec: + group: cert-manager.io + names: + categories: + - cert-manager + kind: ClusterIssuer + listKind: ClusterIssuerList + plural: clusterissuers + shortNames: + - ciss + singular: clusterissuer + scope: Cluster + versions: + - additionalPrinterColumns: + - jsonPath: .status.conditions[?(@.type == "Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type == "Ready")].message + name: Status + priority: 1 + type: string + - description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. + jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1 + schema: + openAPIV3Schema: + description: |- + A ClusterIssuer represents a certificate issuing authority which can be + referenced as part of `issuerRef` fields. + It is similar to an Issuer, however it is cluster-scoped and therefore can + be referenced by resources that exist in *any* namespace, not just the same + namespace as the referent. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: Desired state of the ClusterIssuer resource. + properties: + acme: + description: |- + ACME configures this issuer to communicate with a RFC8555 (ACME) server + to obtain signed x509 certificates. + properties: + caBundle: + description: |- + Base64-encoded bundle of PEM CAs which can be used to validate the certificate + chain presented by the ACME server. + Mutually exclusive with SkipTLSVerify; prefer using CABundle to prevent various + kinds of security vulnerabilities. + If CABundle and SkipTLSVerify are unset, the system certificate bundle inside + the container is used to validate the TLS connection. + format: byte + type: string + disableAccountKeyGeneration: + description: |- + Enables or disables generating a new ACME account key. + If true, the Issuer resource will *not* request a new account but will expect + the account key to be supplied via an existing secret. + If false, the cert-manager system will generate a new ACME account key + for the Issuer. + Defaults to false. + type: boolean + email: + description: |- + Email is the email address to be associated with the ACME account. + This field is optional, but it is strongly recommended to be set. + It will be used to contact you in case of issues with your account or + certificates, including expiry notification emails. + This field may be updated after the account is initially registered. + type: string + enableDurationFeature: + description: |- + Enables requesting a Not After date on certificates that matches the + duration of the certificate. This is not supported by all ACME servers + like Let's Encrypt. If set to true when the ACME server does not support + it, it will create an error on the Order. + Defaults to false. + type: boolean + externalAccountBinding: + description: |- + ExternalAccountBinding is a reference to a CA external account of the ACME + server. + If set, upon registration cert-manager will attempt to associate the given + external account credentials with the registered ACME account. + properties: + keyAlgorithm: + description: |- + Deprecated: keyAlgorithm field exists for historical compatibility + reasons and should not be used. The algorithm is now hardcoded to HS256 + in golang/x/crypto/acme. + enum: + - HS256 + - HS384 + - HS512 + type: string + keyID: + description: keyID is the ID of the CA key that the External Account is bound to. + type: string + keySecretRef: + description: |- + keySecretRef is a Secret Key Selector referencing a data item in a Kubernetes + Secret which holds the symmetric MAC key of the External Account Binding. + The `key` is the index string that is paired with the key data in the + Secret and should not be confused with the key data itself, or indeed with + the External Account Binding keyID above. + The secret key stored in the Secret **must** be un-padded, base64 URL + encoded data. + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + required: + - name + type: object + required: + - keyID + - keySecretRef + type: object + preferredChain: + description: |- + PreferredChain is the chain to use if the ACME server outputs multiple. + PreferredChain is no guarantee that this one gets delivered by the ACME + endpoint. + For example, for Let's Encrypt's DST cross-sign you would use: + "DST Root CA X3" or "ISRG Root X1" for the newer Let's Encrypt root CA. + This value picks the first certificate bundle in the combined set of + ACME default and alternative chains that has a root-most certificate with + this value as its issuer's commonname. + maxLength: 64 + type: string + privateKeySecretRef: + description: |- + PrivateKey is the name of a Kubernetes Secret resource that will be used to + store the automatically generated ACME account private key. + Optionally, a `key` may be specified to select a specific entry within + the named Secret resource. + If `key` is not specified, a default of `tls.key` will be used. + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + required: + - name + type: object + profile: + description: |- + Profile allows requesting a certificate profile from the ACME server. + Supported profiles are listed by the server's ACME directory URL. + type: string + server: + description: |- + Server is the URL used to access the ACME server's 'directory' endpoint. + For example, for Let's Encrypt's staging endpoint, you would use: + "https://acme-staging-v02.api.letsencrypt.org/directory". + Only ACME v2 endpoints (i.e. RFC 8555) are supported. + type: string + skipTLSVerify: + description: |- + INSECURE: Enables or disables validation of the ACME server TLS certificate. + If true, requests to the ACME server will not have the TLS certificate chain + validated. + Mutually exclusive with CABundle; prefer using CABundle to prevent various + kinds of security vulnerabilities. + Only enable this option in development environments. + If CABundle and SkipTLSVerify are unset, the system certificate bundle inside + the container is used to validate the TLS connection. + Defaults to false. + type: boolean + solvers: + description: |- + Solvers is a list of challenge solvers that will be used to solve + ACME challenges for the matching domains. + Solver configurations must be provided in order to obtain certificates + from an ACME server. + For more information, see: https://cert-manager.io/docs/configuration/acme/ + items: + description: |- + An ACMEChallengeSolver describes how to solve ACME challenges for the issuer it is part of. + A selector may be provided to use different solving strategies for different DNS names. + Only one of HTTP01 or DNS01 must be provided. + properties: + dns01: + description: |- + Configures cert-manager to attempt to complete authorizations by + performing the DNS01 challenge flow. + properties: + acmeDNS: + description: |- + Use the 'ACME DNS' (https://github.com/joohoi/acme-dns) API to manage + DNS01 challenge records. + properties: + accountSecretRef: + description: |- + A reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + required: + - name + type: object + host: + type: string + required: + - accountSecretRef + - host + type: object + akamai: + description: Use the Akamai DNS zone management API to manage DNS01 challenge records. + properties: + accessTokenSecretRef: + description: |- + A reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + required: + - name + type: object + clientSecretSecretRef: + description: |- + A reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + required: + - name + type: object + clientTokenSecretRef: + description: |- + A reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + required: + - name + type: object + serviceConsumerDomain: + type: string + required: + - accessTokenSecretRef + - clientSecretSecretRef + - clientTokenSecretRef + - serviceConsumerDomain + type: object + azureDNS: + description: Use the Microsoft Azure DNS API to manage DNS01 challenge records. + properties: + clientID: + description: |- + Auth: Azure Service Principal: + The ClientID of the Azure Service Principal used to authenticate with Azure DNS. + If set, ClientSecret and TenantID must also be set. + type: string + clientSecretSecretRef: + description: |- + Auth: Azure Service Principal: + A reference to a Secret containing the password associated with the Service Principal. + If set, ClientID and TenantID must also be set. + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + required: + - name + type: object + environment: + description: name of the Azure environment (default AzurePublicCloud) + enum: + - AzurePublicCloud + - AzureChinaCloud + - AzureGermanCloud + - AzureUSGovernmentCloud + type: string + hostedZoneName: + description: name of the DNS zone that should be used + type: string + managedIdentity: + description: |- + Auth: Azure Workload Identity or Azure Managed Service Identity: + Settings to enable Azure Workload Identity or Azure Managed Service Identity + If set, ClientID, ClientSecret and TenantID must not be set. + properties: + clientID: + description: client ID of the managed identity, cannot be used at the same time as resourceID + type: string + resourceID: + description: |- + resource ID of the managed identity, cannot be used at the same time as clientID + Cannot be used for Azure Managed Service Identity + type: string + tenantID: + description: tenant ID of the managed identity, cannot be used at the same time as resourceID + type: string + type: object + resourceGroupName: + description: resource group the DNS zone is located in + type: string + subscriptionID: + description: ID of the Azure subscription + type: string + tenantID: + description: |- + Auth: Azure Service Principal: + The TenantID of the Azure Service Principal used to authenticate with Azure DNS. + If set, ClientID and ClientSecret must also be set. + type: string + zoneType: + description: |- + ZoneType determines which type of Azure DNS zone to use. + + Valid values are: + - AzurePublicZone (default): Use a public Azure DNS zone. + - AzurePrivateZone: Use an Azure Private DNS zone. + + If not specified, AzurePublicZone is used. + + Support for Azure Private DNS zones is currently + experimental and may change in future releases. + enum: + - AzurePublicZone + - AzurePrivateZone + type: string + required: + - resourceGroupName + - subscriptionID + type: object + cloudDNS: + description: Use the Google Cloud DNS API to manage DNS01 challenge records. + properties: + hostedZoneName: + description: |- + HostedZoneName is an optional field that tells cert-manager in which + Cloud DNS zone the challenge record has to be created. + If left empty cert-manager will automatically choose a zone. + type: string + project: + type: string + serviceAccountSecretRef: + description: |- + A reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + required: + - name + type: object + required: + - project + type: object + cloudflare: + description: Use the Cloudflare API to manage DNS01 challenge records. + properties: + apiKeySecretRef: + description: |- + API key to use to authenticate with Cloudflare. + Note: using an API token to authenticate is now the recommended method + as it allows greater control of permissions. + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + required: + - name + type: object + apiTokenSecretRef: + description: API token used to authenticate with Cloudflare. + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + required: + - name + type: object + email: + description: Email of the account, only required when using API key based authentication. + type: string + type: object + cnameStrategy: + description: |- + CNAMEStrategy configures how the DNS01 provider should handle CNAME + records when found in DNS zones. + enum: + - None + - Follow + type: string + digitalocean: + description: Use the DigitalOcean DNS API to manage DNS01 challenge records. + properties: + tokenSecretRef: + description: |- + A reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + required: + - name + type: object + required: + - tokenSecretRef + type: object + rfc2136: + description: |- + Use RFC2136 ("Dynamic Updates in the Domain Name System") (https://datatracker.ietf.org/doc/rfc2136/) + to manage DNS01 challenge records. + properties: + nameserver: + description: |- + The IP address or hostname of an authoritative DNS server supporting + RFC2136 in the form host:port. If the host is an IPv6 address it must be + enclosed in square brackets (e.g [2001:db8::1]); port is optional. + This field is required. + type: string + protocol: + description: Protocol to use for dynamic DNS update queries. Valid values are (case-sensitive) ``TCP`` and ``UDP``; ``UDP`` (default). + enum: + - TCP + - UDP + type: string + tsigAlgorithm: + description: |- + The TSIG Algorithm configured in the DNS supporting RFC2136. Used only + when ``tsigSecretSecretRef`` and ``tsigKeyName`` are defined. + Supported values are (case-insensitive): ``HMACMD5`` (default), + ``HMACSHA1``, ``HMACSHA256`` or ``HMACSHA512``. + type: string + tsigKeyName: + description: |- + The TSIG Key name configured in the DNS. + If ``tsigSecretSecretRef`` is defined, this field is required. + type: string + tsigSecretSecretRef: + description: |- + The name of the secret containing the TSIG value. + If ``tsigKeyName`` is defined, this field is required. + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + required: + - name + type: object + required: + - nameserver + type: object + route53: + description: Use the AWS Route53 API to manage DNS01 challenge records. + properties: + accessKeyID: + description: |- + The AccessKeyID is used for authentication. + Cannot be set when SecretAccessKeyID is set. + If neither the Access Key nor Key ID are set, we fall back to using env + vars, shared credentials file, or AWS Instance metadata, + see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials + type: string + accessKeyIDSecretRef: + description: |- + The SecretAccessKey is used for authentication. If set, pull the AWS + access key ID from a key within a Kubernetes Secret. + Cannot be set when AccessKeyID is set. + If neither the Access Key nor Key ID are set, we fall back to using env + vars, shared credentials file, or AWS Instance metadata, + see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + required: + - name + type: object + auth: + description: Auth configures how cert-manager authenticates. + properties: + kubernetes: + description: |- + Kubernetes authenticates with Route53 using AssumeRoleWithWebIdentity + by passing a bound ServiceAccount token. + properties: + serviceAccountRef: + description: |- + A reference to a service account that will be used to request a bound + token (also known as "projected token"). To use this field, you must + configure an RBAC rule to let cert-manager request a token. + properties: + audiences: + description: |- + TokenAudiences is an optional list of audiences to include in the + token passed to AWS. The default token consisting of the issuer's namespace + and name is always included. + If unset the audience defaults to `sts.amazonaws.com`. + items: + type: string + type: array + x-kubernetes-list-type: atomic + name: + description: Name of the ServiceAccount used to request a token. + type: string + required: + - name + type: object + required: + - serviceAccountRef + type: object + required: + - kubernetes + type: object + hostedZoneID: + description: If set, the provider will manage only this zone in Route53 and will not do a lookup using the route53:ListHostedZonesByName api call. + type: string + region: + description: |- + Override the AWS region. + + Route53 is a global service and does not have regional endpoints but the + region specified here (or via environment variables) is used as a hint to + help compute the correct AWS credential scope and partition when it + connects to Route53. See: + - [Amazon Route 53 endpoints and quotas](https://docs.aws.amazon.com/general/latest/gr/r53.html) + - [Global services](https://docs.aws.amazon.com/whitepapers/latest/aws-fault-isolation-boundaries/global-services.html) + + If you omit this region field, cert-manager will use the region from + AWS_REGION and AWS_DEFAULT_REGION environment variables, if they are set + in the cert-manager controller Pod. + + The `region` field is not needed if you use [IAM Roles for Service Accounts (IRSA)](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html). + Instead an AWS_REGION environment variable is added to the cert-manager controller Pod by: + [Amazon EKS Pod Identity Webhook](https://github.com/aws/amazon-eks-pod-identity-webhook). + In this case this `region` field value is ignored. + + The `region` field is not needed if you use [EKS Pod Identities](https://docs.aws.amazon.com/eks/latest/userguide/pod-identities.html). + Instead an AWS_REGION environment variable is added to the cert-manager controller Pod by: + [Amazon EKS Pod Identity Agent](https://github.com/aws/eks-pod-identity-agent), + In this case this `region` field value is ignored. + type: string + role: + description: |- + Role is a Role ARN which the Route53 provider will assume using either the explicit credentials AccessKeyID/SecretAccessKey + or the inferred credentials from environment variables, shared credentials file or AWS Instance metadata + type: string + secretAccessKeySecretRef: + description: |- + The SecretAccessKey is used for authentication. + If neither the Access Key nor Key ID are set, we fall back to using env + vars, shared credentials file, or AWS Instance metadata, + see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + required: + - name + type: object + type: object + webhook: + description: |- + Configure an external webhook based DNS01 challenge solver to manage + DNS01 challenge records. + properties: + config: + description: |- + Additional configuration that should be passed to the webhook apiserver + when challenges are processed. + This can contain arbitrary JSON data. + Secret values should not be specified in this stanza. + If secret values are needed (e.g., credentials for a DNS service), you + should use a SecretKeySelector to reference a Secret resource. + For details on the schema of this field, consult the webhook provider + implementation's documentation. + x-kubernetes-preserve-unknown-fields: true + groupName: + description: |- + The API group name that should be used when POSTing ChallengePayload + resources to the webhook apiserver. + This should be the same as the GroupName specified in the webhook + provider implementation. + type: string + solverName: + description: |- + The name of the solver to use, as defined in the webhook provider + implementation. + This will typically be the name of the provider, e.g., 'cloudflare'. + type: string + required: + - groupName + - solverName + type: object + type: object + http01: + description: |- + Configures cert-manager to attempt to complete authorizations by + performing the HTTP01 challenge flow. + It is not possible to obtain certificates for wildcard domain names + (e.g., `*.example.com`) using the HTTP01 challenge mechanism. + properties: + gatewayHTTPRoute: + description: |- + The Gateway API is a sig-network community API that models service networking + in Kubernetes (https://gateway-api.sigs.k8s.io/). The Gateway solver will + create HTTPRoutes with the specified labels in the same namespace as the challenge. + This solver is experimental, and fields / behaviour may change in the future. + properties: + labels: + additionalProperties: + type: string + description: |- + Custom labels that will be applied to HTTPRoutes created by cert-manager + while solving HTTP-01 challenges. + type: object + parentRefs: + description: |- + When solving an HTTP-01 challenge, cert-manager creates an HTTPRoute. + cert-manager needs to know which parentRefs should be used when creating + the HTTPRoute. Usually, the parentRef references a Gateway. See: + https://gateway-api.sigs.k8s.io/api-types/httproute/#attaching-to-gateways + items: + description: |- + ParentReference identifies an API object (usually a Gateway) that can be considered + a parent of this resource (usually a route). There are two kinds of parent resources + with "Core" support: + + * Gateway (Gateway conformance profile) + * Service (Mesh conformance profile, ClusterIP Services only) + + This API may be extended in the future to support additional kinds of parent + resources. + + The API object must be valid in the cluster; the Group and Kind must + be registered in the cluster for this reference to be valid. + properties: + group: + default: gateway.networking.k8s.io + description: |- + Group is the group of the referent. + When unspecified, "gateway.networking.k8s.io" is inferred. + To set the core API group (such as for a "Service" kind referent), + Group must be explicitly set to "" (empty string). + + Support: Core + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + default: Gateway + description: |- + Kind is kind of the referent. + + There are two kinds of parent resources with "Core" support: + + * Gateway (Gateway conformance profile) + * Service (Mesh conformance profile, ClusterIP Services only) + + Support for other resources is Implementation-Specific. + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: |- + Name is the name of the referent. + + Support: Core + maxLength: 253 + minLength: 1 + type: string + namespace: + description: |- + Namespace is the namespace of the referent. When unspecified, this refers + to the local namespace of the Route. + + Note that there are specific rules for ParentRefs which cross namespace + boundaries. Cross-namespace references are only valid if they are explicitly + allowed by something in the namespace they are referring to. For example: + Gateway has the AllowedRoutes field, and ReferenceGrant provides a + generic way to enable any other kind of cross-namespace reference. + + + ParentRefs from a Route to a Service in the same namespace are "producer" + routes, which apply default routing rules to inbound connections from + any namespace to the Service. + + ParentRefs from a Route to a Service in a different namespace are + "consumer" routes, and these routing rules are only applied to outbound + connections originating from the same namespace as the Route, for which + the intended destination of the connections are a Service targeted as a + ParentRef of the Route. + + + Support: Core + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + port: + description: |- + Port is the network port this Route targets. It can be interpreted + differently based on the type of parent resource. + + When the parent resource is a Gateway, this targets all listeners + listening on the specified port that also support this kind of Route(and + select this Route). It's not recommended to set `Port` unless the + networking behaviors specified in a Route must apply to a specific port + as opposed to a listener(s) whose port(s) may be changed. When both Port + and SectionName are specified, the name and port of the selected listener + must match both specified values. + + + When the parent resource is a Service, this targets a specific port in the + Service spec. When both Port (experimental) and SectionName are specified, + the name and port of the selected port must match both specified values. + + + Implementations MAY choose to support other parent resources. + Implementations supporting other types of parent resources MUST clearly + document how/if Port is interpreted. + + For the purpose of status, an attachment is considered successful as + long as the parent resource accepts it partially. For example, Gateway + listeners can restrict which Routes can attach to them by Route kind, + namespace, or hostname. If 1 of 2 Gateway listeners accept attachment + from the referencing Route, the Route MUST be considered successfully + attached. If no Gateway listeners accept attachment from this Route, + the Route MUST be considered detached from the Gateway. + + Support: Extended + format: int32 + maximum: 65535 + minimum: 1 + type: integer + sectionName: + description: |- + SectionName is the name of a section within the target resource. In the + following resources, SectionName is interpreted as the following: + + * Gateway: Listener name. When both Port (experimental) and SectionName + are specified, the name and port of the selected listener must match + both specified values. + * Service: Port name. When both Port (experimental) and SectionName + are specified, the name and port of the selected listener must match + both specified values. + + Implementations MAY choose to support attaching Routes to other resources. + If that is the case, they MUST clearly document how SectionName is + interpreted. + + When unspecified (empty string), this will reference the entire resource. + For the purpose of status, an attachment is considered successful if at + least one section in the parent resource accepts it. For example, Gateway + listeners can restrict which Routes can attach to them by Route kind, + namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from + the referencing Route, the Route MUST be considered successfully + attached. If no Gateway listeners accept attachment from this Route, the + Route MUST be considered detached from the Gateway. + + Support: Core + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + required: + - name + type: object + type: array + x-kubernetes-list-type: atomic + podTemplate: + description: |- + Optional pod template used to configure the ACME challenge solver pods + used for HTTP01 challenges. + properties: + metadata: + description: |- + ObjectMeta overrides for the pod used to solve HTTP01 challenges. + Only the 'labels' and 'annotations' fields may be set. + If labels or annotations overlap with in-built values, the values here + will override the in-built values. + properties: + annotations: + additionalProperties: + type: string + description: Annotations that should be added to the created ACME HTTP01 solver pods. + type: object + labels: + additionalProperties: + type: string + description: Labels that should be added to the created ACME HTTP01 solver pods. + type: object + type: object + spec: + description: |- + PodSpec defines overrides for the HTTP01 challenge solver pod. + Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields. + All other fields will be ignored. + properties: + affinity: + description: If specified, the pod's scheduling constraints + properties: + nodeAffinity: + description: Describes node affinity scheduling rules for the pod. + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node matches the corresponding matchExpressions; the + node(s) with the highest sum are the most preferred. + items: + description: |- + An empty preferred scheduling term matches all objects with implicit weight 0 + (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). + properties: + preference: + description: A node selector term, associated with the corresponding weight. + properties: + matchExpressions: + description: A list of node selector requirements by node's labels. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchFields: + description: A list of node selector requirements by node's fields. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + type: object + x-kubernetes-map-type: atomic + weight: + description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100. + format: int32 + type: integer + required: + - preference + - weight + type: object + type: array + x-kubernetes-list-type: atomic + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to an update), the system + may or may not try to eventually evict the pod from its node. + properties: + nodeSelectorTerms: + description: Required. A list of node selector terms. The terms are ORed. + items: + description: |- + A null or empty node selector term matches no objects. The requirements of + them are ANDed. + The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. + properties: + matchExpressions: + description: A list of node selector requirements by node's labels. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchFields: + description: A list of node selector requirements by node's fields. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + required: + - nodeSelectorTerms + type: object + x-kubernetes-map-type: atomic + type: object + podAffinity: + description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)). + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + items: + description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated with the corresponding weight. + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both matchLabelKeys and labelSelector. + Also, matchLabelKeys cannot be set when labelSelector isn't set. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. + Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + x-kubernetes-list-type: atomic + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + x-kubernetes-list-type: atomic + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both matchLabelKeys and labelSelector. + Also, matchLabelKeys cannot be set when labelSelector isn't set. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. + Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + x-kubernetes-list-type: atomic + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + type: array + x-kubernetes-list-type: atomic + type: object + podAntiAffinity: + description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)). + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the anti-affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling anti-affinity expressions, etc.), + compute a sum by iterating through the elements of this field and subtracting + "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + items: + description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated with the corresponding weight. + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both matchLabelKeys and labelSelector. + Also, matchLabelKeys cannot be set when labelSelector isn't set. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. + Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + x-kubernetes-list-type: atomic + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + x-kubernetes-list-type: atomic + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the anti-affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the anti-affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both matchLabelKeys and labelSelector. + Also, matchLabelKeys cannot be set when labelSelector isn't set. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. + Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + x-kubernetes-list-type: atomic + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + type: array + x-kubernetes-list-type: atomic + type: object + type: object + imagePullSecrets: + description: If specified, the pod's imagePullSecrets + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + nodeSelector: + additionalProperties: + type: string + description: |- + NodeSelector is a selector which must be true for the pod to fit on a node. + Selector which must match a node's labels for the pod to be scheduled on that node. + More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ + type: object + priorityClassName: + description: If specified, the pod's priorityClassName. + type: string + resources: + description: |- + If specified, the pod's resource requirements. + These values override the global resource configuration flags. + Note that when only specifying resource limits, ensure they are greater than or equal + to the corresponding global resource requests configured via controller flags + (--acme-http01-solver-resource-request-cpu, --acme-http01-solver-resource-request-memory). + Kubernetes will reject pod creation if limits are lower than requests, causing challenge failures. + properties: + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to the global values configured via controller flags. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + securityContext: + description: If specified, the pod's security context + properties: + fsGroup: + description: |- + A special supplemental group that applies to all containers in a pod. + Some volume types allow the Kubelet to change the ownership of that volume + to be owned by the pod: + + 1. The owning GID will be the FSGroup + 2. The setgid bit is set (new files created in the volume will be owned by FSGroup) + 3. The permission bits are OR'd with rw-rw---- + + If unset, the Kubelet will not modify the ownership and permissions of any volume. + Note that this field cannot be set when spec.os.name is windows. + format: int64 + type: integer + fsGroupChangePolicy: + description: |- + fsGroupChangePolicy defines behavior of changing ownership and permission of the volume + before being exposed inside Pod. This field will only apply to + volume types which support fsGroup based ownership(and permissions). + It will have no effect on ephemeral volume types such as: secret, configmaps + and emptydir. + Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used. + Note that this field cannot be set when spec.os.name is windows. + type: string + runAsGroup: + description: |- + The GID to run the entrypoint of the container process. + Uses runtime default if unset. + May also be set in SecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence + for that container. + Note that this field cannot be set when spec.os.name is windows. + format: int64 + type: integer + runAsNonRoot: + description: |- + Indicates that the container must run as a non-root user. + If true, the Kubelet will validate the image at runtime to ensure that it + does not run as UID 0 (root) and fail to start the container if it does. + If unset or false, no such validation will be performed. + May also be set in SecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: boolean + runAsUser: + description: |- + The UID to run the entrypoint of the container process. + Defaults to user specified in image metadata if unspecified. + May also be set in SecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence + for that container. + Note that this field cannot be set when spec.os.name is windows. + format: int64 + type: integer + seLinuxOptions: + description: |- + The SELinux context to be applied to all containers. + If unspecified, the container runtime will allocate a random SELinux context for each + container. May also be set in SecurityContext. If set in + both SecurityContext and PodSecurityContext, the value specified in SecurityContext + takes precedence for that container. + Note that this field cannot be set when spec.os.name is windows. + properties: + level: + description: Level is SELinux level label that applies to the container. + type: string + role: + description: Role is a SELinux role label that applies to the container. + type: string + type: + description: Type is a SELinux type label that applies to the container. + type: string + user: + description: User is a SELinux user label that applies to the container. + type: string + type: object + seccompProfile: + description: |- + The seccomp options to use by the containers in this pod. + Note that this field cannot be set when spec.os.name is windows. + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile defined in a file on the node should be used. + The profile must be preconfigured on the node to work. + Must be a descending path, relative to the kubelet's configured seccomp profile location. + Must be set if type is "Localhost". Must NOT be set for any other type. + type: string + type: + description: |- + type indicates which kind of seccomp profile will be applied. + Valid options are: + + Localhost - a profile defined in a file on the node should be used. + RuntimeDefault - the container runtime default profile should be used. + Unconfined - no profile should be applied. + type: string + required: + - type + type: object + supplementalGroups: + description: |- + A list of groups applied to the first process run in each container, in addition + to the container's primary GID, the fsGroup (if specified), and group memberships + defined in the container image for the uid of the container process. If unspecified, + no additional groups are added to any container. Note that group memberships + defined in the container image for the uid of the container process are still effective, + even if they are not included in this list. + Note that this field cannot be set when spec.os.name is windows. + items: + format: int64 + type: integer + type: array + x-kubernetes-list-type: atomic + sysctls: + description: |- + Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported + sysctls (by the container runtime) might fail to launch. + Note that this field cannot be set when spec.os.name is windows. + items: + description: Sysctl defines a kernel parameter to be set + properties: + name: + description: Name of a property to set + type: string + value: + description: Value of a property to set + type: string + required: + - name + - value + type: object + type: array + x-kubernetes-list-type: atomic + type: object + serviceAccountName: + description: If specified, the pod's service account + type: string + tolerations: + description: If specified, the pod's tolerations. + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + format: int64 + type: integer + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + type: object + type: array + x-kubernetes-list-type: atomic + type: object + type: object + serviceType: + description: |- + Optional service type for Kubernetes solver service. Supported values + are NodePort or ClusterIP. If unset, defaults to NodePort. + type: string + type: object + ingress: + description: |- + The ingress based HTTP01 challenge solver will solve challenges by + creating or modifying Ingress resources in order to route requests for + '/.well-known/acme-challenge/XYZ' to 'challenge solver' pods that are + provisioned by cert-manager for each Challenge to be completed. + properties: + class: + description: |- + This field configures the annotation `kubernetes.io/ingress.class` when + creating Ingress resources to solve ACME challenges that use this + challenge solver. Only one of `class`, `name` or `ingressClassName` may + be specified. + type: string + ingressClassName: + description: |- + This field configures the field `ingressClassName` on the created Ingress + resources used to solve ACME challenges that use this challenge solver. + This is the recommended way of configuring the ingress class. Only one of + `class`, `name` or `ingressClassName` may be specified. + type: string + ingressTemplate: + description: |- + Optional ingress template used to configure the ACME challenge solver + ingress used for HTTP01 challenges. + properties: + metadata: + description: |- + ObjectMeta overrides for the ingress used to solve HTTP01 challenges. + Only the 'labels' and 'annotations' fields may be set. + If labels or annotations overlap with in-built values, the values here + will override the in-built values. + properties: + annotations: + additionalProperties: + type: string + description: Annotations that should be added to the created ACME HTTP01 solver ingress. + type: object + labels: + additionalProperties: + type: string + description: Labels that should be added to the created ACME HTTP01 solver ingress. + type: object + type: object + type: object + name: + description: |- + The name of the ingress resource that should have ACME challenge solving + routes inserted into it in order to solve HTTP01 challenges. + This is typically used in conjunction with ingress controllers like + ingress-gce, which maintains a 1:1 mapping between external IPs and + ingress resources. Only one of `class`, `name` or `ingressClassName` may + be specified. + type: string + podTemplate: + description: |- + Optional pod template used to configure the ACME challenge solver pods + used for HTTP01 challenges. + properties: + metadata: + description: |- + ObjectMeta overrides for the pod used to solve HTTP01 challenges. + Only the 'labels' and 'annotations' fields may be set. + If labels or annotations overlap with in-built values, the values here + will override the in-built values. + properties: + annotations: + additionalProperties: + type: string + description: Annotations that should be added to the created ACME HTTP01 solver pods. + type: object + labels: + additionalProperties: + type: string + description: Labels that should be added to the created ACME HTTP01 solver pods. + type: object + type: object + spec: + description: |- + PodSpec defines overrides for the HTTP01 challenge solver pod. + Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields. + All other fields will be ignored. + properties: + affinity: + description: If specified, the pod's scheduling constraints + properties: + nodeAffinity: + description: Describes node affinity scheduling rules for the pod. + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node matches the corresponding matchExpressions; the + node(s) with the highest sum are the most preferred. + items: + description: |- + An empty preferred scheduling term matches all objects with implicit weight 0 + (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). + properties: + preference: + description: A node selector term, associated with the corresponding weight. + properties: + matchExpressions: + description: A list of node selector requirements by node's labels. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchFields: + description: A list of node selector requirements by node's fields. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + type: object + x-kubernetes-map-type: atomic + weight: + description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100. + format: int32 + type: integer + required: + - preference + - weight + type: object + type: array + x-kubernetes-list-type: atomic + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to an update), the system + may or may not try to eventually evict the pod from its node. + properties: + nodeSelectorTerms: + description: Required. A list of node selector terms. The terms are ORed. + items: + description: |- + A null or empty node selector term matches no objects. The requirements of + them are ANDed. + The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. + properties: + matchExpressions: + description: A list of node selector requirements by node's labels. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchFields: + description: A list of node selector requirements by node's fields. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + required: + - nodeSelectorTerms + type: object + x-kubernetes-map-type: atomic + type: object + podAffinity: + description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)). + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + items: + description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated with the corresponding weight. + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both matchLabelKeys and labelSelector. + Also, matchLabelKeys cannot be set when labelSelector isn't set. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. + Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + x-kubernetes-list-type: atomic + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + x-kubernetes-list-type: atomic + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both matchLabelKeys and labelSelector. + Also, matchLabelKeys cannot be set when labelSelector isn't set. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. + Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + x-kubernetes-list-type: atomic + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + type: array + x-kubernetes-list-type: atomic + type: object + podAntiAffinity: + description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)). + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the anti-affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling anti-affinity expressions, etc.), + compute a sum by iterating through the elements of this field and subtracting + "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + items: + description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated with the corresponding weight. + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both matchLabelKeys and labelSelector. + Also, matchLabelKeys cannot be set when labelSelector isn't set. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. + Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + x-kubernetes-list-type: atomic + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + x-kubernetes-list-type: atomic + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the anti-affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the anti-affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both matchLabelKeys and labelSelector. + Also, matchLabelKeys cannot be set when labelSelector isn't set. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. + Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + x-kubernetes-list-type: atomic + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + type: array + x-kubernetes-list-type: atomic + type: object + type: object + imagePullSecrets: + description: If specified, the pod's imagePullSecrets + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + nodeSelector: + additionalProperties: + type: string + description: |- + NodeSelector is a selector which must be true for the pod to fit on a node. + Selector which must match a node's labels for the pod to be scheduled on that node. + More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ + type: object + priorityClassName: + description: If specified, the pod's priorityClassName. + type: string + resources: + description: |- + If specified, the pod's resource requirements. + These values override the global resource configuration flags. + Note that when only specifying resource limits, ensure they are greater than or equal + to the corresponding global resource requests configured via controller flags + (--acme-http01-solver-resource-request-cpu, --acme-http01-solver-resource-request-memory). + Kubernetes will reject pod creation if limits are lower than requests, causing challenge failures. + properties: + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to the global values configured via controller flags. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + securityContext: + description: If specified, the pod's security context + properties: + fsGroup: + description: |- + A special supplemental group that applies to all containers in a pod. + Some volume types allow the Kubelet to change the ownership of that volume + to be owned by the pod: + + 1. The owning GID will be the FSGroup + 2. The setgid bit is set (new files created in the volume will be owned by FSGroup) + 3. The permission bits are OR'd with rw-rw---- + + If unset, the Kubelet will not modify the ownership and permissions of any volume. + Note that this field cannot be set when spec.os.name is windows. + format: int64 + type: integer + fsGroupChangePolicy: + description: |- + fsGroupChangePolicy defines behavior of changing ownership and permission of the volume + before being exposed inside Pod. This field will only apply to + volume types which support fsGroup based ownership(and permissions). + It will have no effect on ephemeral volume types such as: secret, configmaps + and emptydir. + Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used. + Note that this field cannot be set when spec.os.name is windows. + type: string + runAsGroup: + description: |- + The GID to run the entrypoint of the container process. + Uses runtime default if unset. + May also be set in SecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence + for that container. + Note that this field cannot be set when spec.os.name is windows. + format: int64 + type: integer + runAsNonRoot: + description: |- + Indicates that the container must run as a non-root user. + If true, the Kubelet will validate the image at runtime to ensure that it + does not run as UID 0 (root) and fail to start the container if it does. + If unset or false, no such validation will be performed. + May also be set in SecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: boolean + runAsUser: + description: |- + The UID to run the entrypoint of the container process. + Defaults to user specified in image metadata if unspecified. + May also be set in SecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence + for that container. + Note that this field cannot be set when spec.os.name is windows. + format: int64 + type: integer + seLinuxOptions: + description: |- + The SELinux context to be applied to all containers. + If unspecified, the container runtime will allocate a random SELinux context for each + container. May also be set in SecurityContext. If set in + both SecurityContext and PodSecurityContext, the value specified in SecurityContext + takes precedence for that container. + Note that this field cannot be set when spec.os.name is windows. + properties: + level: + description: Level is SELinux level label that applies to the container. + type: string + role: + description: Role is a SELinux role label that applies to the container. + type: string + type: + description: Type is a SELinux type label that applies to the container. + type: string + user: + description: User is a SELinux user label that applies to the container. + type: string + type: object + seccompProfile: + description: |- + The seccomp options to use by the containers in this pod. + Note that this field cannot be set when spec.os.name is windows. + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile defined in a file on the node should be used. + The profile must be preconfigured on the node to work. + Must be a descending path, relative to the kubelet's configured seccomp profile location. + Must be set if type is "Localhost". Must NOT be set for any other type. + type: string + type: + description: |- + type indicates which kind of seccomp profile will be applied. + Valid options are: + + Localhost - a profile defined in a file on the node should be used. + RuntimeDefault - the container runtime default profile should be used. + Unconfined - no profile should be applied. + type: string + required: + - type + type: object + supplementalGroups: + description: |- + A list of groups applied to the first process run in each container, in addition + to the container's primary GID, the fsGroup (if specified), and group memberships + defined in the container image for the uid of the container process. If unspecified, + no additional groups are added to any container. Note that group memberships + defined in the container image for the uid of the container process are still effective, + even if they are not included in this list. + Note that this field cannot be set when spec.os.name is windows. + items: + format: int64 + type: integer + type: array + x-kubernetes-list-type: atomic + sysctls: + description: |- + Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported + sysctls (by the container runtime) might fail to launch. + Note that this field cannot be set when spec.os.name is windows. + items: + description: Sysctl defines a kernel parameter to be set + properties: + name: + description: Name of a property to set + type: string + value: + description: Value of a property to set + type: string + required: + - name + - value + type: object + type: array + x-kubernetes-list-type: atomic + type: object + serviceAccountName: + description: If specified, the pod's service account + type: string + tolerations: + description: If specified, the pod's tolerations. + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + format: int64 + type: integer + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + type: object + type: array + x-kubernetes-list-type: atomic + type: object + type: object + serviceType: + description: |- + Optional service type for Kubernetes solver service. Supported values + are NodePort or ClusterIP. If unset, defaults to NodePort. + type: string + type: object + type: object + selector: + description: |- + Selector selects a set of DNSNames on the Certificate resource that + should be solved using this challenge solver. + If not specified, the solver will be treated as the 'default' solver + with the lowest priority, i.e. if any other solver has a more specific + match, it will be used instead. + properties: + dnsNames: + description: |- + List of DNSNames that this solver will be used to solve. + If specified and a match is found, a dnsNames selector will take + precedence over a dnsZones selector. + If multiple solvers match with the same dnsNames value, the solver + with the most matching labels in matchLabels will be selected. + If neither has more matches, the solver defined earlier in the list + will be selected. + items: + type: string + type: array + x-kubernetes-list-type: atomic + dnsZones: + description: |- + List of DNSZones that this solver will be used to solve. + The most specific DNS zone match specified here will take precedence + over other DNS zone matches, so a solver specifying sys.example.com + will be selected over one specifying example.com for the domain + www.sys.example.com. + If multiple solvers match with the same dnsZones value, the solver + with the most matching labels in matchLabels will be selected. + If neither has more matches, the solver defined earlier in the list + will be selected. + items: + type: string + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + A label selector that is used to refine the set of certificate's that + this challenge solver will apply to. + type: object + type: object + waitInsteadOfSelfCheck: + description: |- + WaitInsteadOfSelfCheck, if set, skips cert-manager's self-check and + instead waits this long after presentation before asking the ACME server + to validate the challenge. + + This is an advanced escape hatch for environments where cert-manager's + self-check cannot succeed from its own network or DNS viewpoint even + though the ACME server can still validate successfully, for example due + to split-horizon DNS or NAT hairpinning. + + A value of 0 skips the self-check and asks the ACME server to validate + immediately after presentation, relying on the ACME server's own + validation retries (RFC 8555 section 8.2) to succeed once the challenge + has propagated. A negative duration is rejected. + Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration, + for example `30s` or `2m`. + type: string + type: object + type: array + x-kubernetes-list-type: atomic + required: + - privateKeySecretRef + - server + type: object + ca: + description: |- + CA configures this issuer to sign certificates using a signing CA keypair + stored in a Secret resource. + This is used to build internal PKIs that are managed by cert-manager. + properties: + crlDistributionPoints: + description: |- + The CRL distribution points is an X.509 v3 certificate extension which identifies + the location of the CRL from which the revocation of this certificate can be checked. + If not set, certificates will be issued without distribution points set. + items: + type: string + type: array + x-kubernetes-list-type: atomic + issuingCertificateURLs: + description: |- + IssuingCertificateURLs is a list of URLs which this issuer should embed into certificates + it creates. See https://www.rfc-editor.org/rfc/rfc5280#section-4.2.2.1 for more details. + As an example, such a URL might be "http://ca.domain.com/ca.crt". + items: + type: string + type: array + x-kubernetes-list-type: atomic + ocspServers: + description: |- + The OCSP server list is an X.509 v3 extension that defines a list of + URLs of OCSP responders. The OCSP responders can be queried for the + revocation status of an issued certificate. If not set, the + certificate will be issued with no OCSP servers set. For example, an + OCSP server URL could be "http://ocsp.int-x3.letsencrypt.org". + items: + type: string + type: array + x-kubernetes-list-type: atomic + secretName: + description: |- + SecretName is the name of the secret used to sign Certificates issued + by this Issuer. + type: string + required: + - secretName + type: object + selfSigned: + description: |- + SelfSigned configures this issuer to 'self sign' certificates using the + private key used to create the CertificateRequest object. + properties: + crlDistributionPoints: + description: |- + The CRL distribution points is an X.509 v3 certificate extension which identifies + the location of the CRL from which the revocation of this certificate can be checked. + If not set certificate will be issued without CDP. Values are strings. + items: + type: string + type: array + x-kubernetes-list-type: atomic + type: object + vault: + description: |- + Vault configures this issuer to sign certificates using a HashiCorp Vault + PKI backend. + properties: + auth: + description: Auth configures how cert-manager authenticates with the Vault server. + properties: + appRole: + description: |- + AppRole authenticates with Vault using the App Role auth mechanism, + with the role and secret stored in a Kubernetes Secret resource. + properties: + path: + description: |- + Path where the App Role authentication backend is mounted in Vault, e.g: + "approle" + type: string + roleId: + description: |- + RoleID configured in the App Role authentication backend when setting + up the authentication backend in Vault. + type: string + secretRef: + description: |- + Reference to a key in a Secret that contains the App Role secret used + to authenticate with Vault. + The `key` field must be specified and denotes which entry within the Secret + resource is used as the app role secret. + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + required: + - name + type: object + required: + - path + - roleId + - secretRef + type: object + aws: + description: |- + AWS authenticates with Vault using AWS IAM authentication. + This allows authentication using IAM roles for service accounts (IRSA), + EKS Pod Identity (PIA), or ambient credentials (EC2 instance profiles, ECS task role). + properties: + iamRoleArn: + description: |- + The ARN of the AWS IAM role to assume using the Kubernetes service account + token. Required when using IRSA (serviceAccountRef is set). + This role must have a trust policy that allows the OIDC provider to assume it. + type: string + mountPath: + description: |- + The Vault mountPath here is the mount path to use when authenticating with + Vault. For example, setting a value to `/v1/auth/foo`, will use the path + `/v1/auth/foo/login` to authenticate with Vault. If unspecified, the + default value "/v1/auth/aws" will be used. + type: string + region: + description: |- + The AWS region to use for authentication. If not specified, the region + will be determined from AWS_REGION or AWS_DEFAULT_REGION environment + variables, falling back to "us-east-1" if not set. + type: string + role: + description: A required field containing the Vault Role to assume when authenticating. + minLength: 1 + type: string + serviceAccountRef: + description: |- + A reference to a service account that will be used to request a web identity + token for IRSA (IAM Roles for Service Accounts) authentication. + properties: + audiences: + description: |- + TokenAudiences is an optional list of extra audiences to include in the token passed to Vault. + The default audiences are always included in the token. + items: + type: string + type: array + x-kubernetes-list-type: atomic + name: + description: Name of the ServiceAccount used to request a token. + type: string + required: + - name + type: object + vaultHeaderValue: + description: |- + The Vault header value to include in the STS signing request. + This is used to prevent replay attacks. + type: string + required: + - role + type: object + clientCertificate: + description: |- + ClientCertificate authenticates with Vault by presenting a client + certificate during the request's TLS handshake. + Works only when using HTTPS protocol. + properties: + mountPath: + description: |- + The Vault mountPath here is the mount path to use when authenticating with + Vault. For example, setting a value to `/v1/auth/foo`, will use the path + `/v1/auth/foo/login` to authenticate with Vault. If unspecified, the + default value "/v1/auth/cert" will be used. + type: string + name: + description: |- + Name of the certificate role to authenticate against. + If not set, matching any certificate role, if available. + type: string + secretName: + description: |- + Reference to Kubernetes Secret of type "kubernetes.io/tls" (hence containing + tls.crt and tls.key) used to authenticate to Vault using TLS client + authentication. + type: string + type: object + kubernetes: + description: |- + Kubernetes authenticates with Vault by passing the ServiceAccount + token stored in the named Secret resource to the Vault server. + properties: + mountPath: + description: |- + The Vault mountPath here is the mount path to use when authenticating with + Vault. For example, setting a value to `/v1/auth/foo`, will use the path + `/v1/auth/foo/login` to authenticate with Vault. If unspecified, the + default value "/v1/auth/kubernetes" will be used. + type: string + role: + description: |- + A required field containing the Vault Role to assume. A Role binds a + Kubernetes ServiceAccount with a set of Vault policies. + type: string + secretRef: + description: |- + The required Secret field containing a Kubernetes ServiceAccount JWT used + for authenticating with Vault. Use of 'ambient credentials' is not + supported. + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + required: + - name + type: object + serviceAccountRef: + description: |- + A reference to a service account that will be used to request a bound + token (also known as "projected token"). Compared to using "secretRef", + using this field means that you don't rely on statically bound tokens. To + use this field, you must configure an RBAC rule to let cert-manager + request a token. + properties: + audiences: + description: |- + TokenAudiences is an optional list of extra audiences to include in the token passed to Vault. + The default audiences are always included in the token. + items: + type: string + type: array + x-kubernetes-list-type: atomic + name: + description: Name of the ServiceAccount used to request a token. + type: string + required: + - name + type: object + required: + - role + type: object + tokenSecretRef: + description: TokenSecretRef authenticates with Vault by presenting a token. + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + required: + - name + type: object + type: object + caBundle: + description: |- + Base64-encoded bundle of PEM CAs which will be used to validate the certificate + chain presented by Vault. Only used if using HTTPS to connect to Vault and + ignored for HTTP connections. + Mutually exclusive with CABundleSecretRef. + If neither CABundle nor CABundleSecretRef are defined, the certificate bundle in + the cert-manager controller container is used to validate the TLS connection. + format: byte + type: string + caBundleSecretRef: + description: |- + Reference to a Secret containing a bundle of PEM-encoded CAs to use when + verifying the certificate chain presented by Vault when using HTTPS. + Mutually exclusive with CABundle. + If neither CABundle nor CABundleSecretRef are defined, the certificate bundle in + the cert-manager controller container is used to validate the TLS connection. + If no key for the Secret is specified, cert-manager will default to 'ca.crt'. + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + required: + - name + type: object + clientCertSecretRef: + description: |- + Reference to a Secret containing a PEM-encoded Client Certificate to use when the + Vault server requires mTLS. + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + required: + - name + type: object + clientKeySecretRef: + description: |- + Reference to a Secret containing a PEM-encoded Client Private Key to use when the + Vault server requires mTLS. + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + required: + - name + type: object + namespace: + description: |- + Name of the vault namespace. Namespaces is a set of features within Vault Enterprise that allows Vault environments to support Secure Multi-tenancy. e.g: "ns1" + More about namespaces can be found here https://www.vaultproject.io/docs/enterprise/namespaces + type: string + path: + description: |- + Path is the mount path of the Vault PKI backend's `sign` endpoint, e.g: + "my_pki_mount/sign/my-role-name". + type: string + server: + description: 'Server is the connection address for the Vault server, e.g: "https://vault.example.com:8200".' + type: string + serverName: + description: |- + ServerName is used to verify the hostname on the returned certificates + by the Vault server. + type: string + required: + - auth + - path + - server + type: object + venafi: + description: |- + Venafi configures this issuer to sign certificates using a CyberArk Certificate Manager Self-Hosted + or SaaS policy zone. + properties: + cloud: + description: |- + Cloud specifies the CyberArk Certificate Manager SaaS configuration settings. + Only one of CyberArk Certificate Manager may be specified. + properties: + apiTokenSecretRef: + description: APITokenSecretRef is a secret key selector for the CyberArk Certificate Manager SaaS API token. + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + required: + - name + type: object + url: + description: |- + URL is the base URL for CyberArk Certificate Manager SaaS. + Defaults to "https://api.venafi.cloud/". + type: string + required: + - apiTokenSecretRef + type: object + ngts: + description: |- + NGTS specifies Palo Alto Networks Next Generation Trust Services (NGTS) configuration + using OAuth 2.0 Client Credentials. Only one of tpp, cloud, or ngts may be specified. + properties: + credentialsRef: + description: |- + CredentialsRef is a reference to a Kubernetes Secret containing the OAuth 2.0 + Client ID and Client Secret. The secret must contain the keys 'client-id' and + 'client-secret'. + properties: + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + required: + - name + type: object + tokenEndpoint: + description: |- + TokenEndpoint is the OAuth 2.0 token endpoint URL used to obtain access tokens, + for example "https://auth.apps.paloaltonetworks.com/oauth2/access_token". + Defaults to "https://auth.apps.paloaltonetworks.com/oauth2/access_token" if not set. + type: string + tsgID: + description: |- + TSGID is the Tenant Service Group ID used to scope the OAuth 2.0 access token, + for example "1234567890". The tsg_id: prefix is added automatically. + This field is required. + type: string + url: + description: |- + URL is the base URL for the NGTS API endpoint. + Defaults to "https://api.strata.paloaltonetworks.com/ngts" if not set. + type: string + required: + - credentialsRef + - tsgID + type: object + tpp: + description: |- + TPP specifies CyberArk Certificate Manager Self-Hosted configuration settings. + Only one of CyberArk Certificate Manager may be specified. + properties: + caBundle: + description: |- + Base64-encoded bundle of PEM CAs which will be used to validate the certificate + chain presented by the CyberArk Certificate Manager Self-Hosted server. Only used if using HTTPS; ignored for HTTP. + If undefined, the certificate bundle in the cert-manager controller container + is used to validate the chain. + format: byte + type: string + caBundleSecretRef: + description: |- + Reference to a Secret containing a base64-encoded bundle of PEM CAs + which will be used to validate the certificate chain presented by the CyberArk Certificate Manager Self-Hosted server. + Only used if using HTTPS; ignored for HTTP. Mutually exclusive with CABundle. + If neither CABundle nor CABundleSecretRef is defined, the certificate bundle in + the cert-manager controller container is used to validate the TLS connection. + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + required: + - name + type: object + credentialsRef: + description: |- + CredentialsRef is a reference to a Secret containing the CyberArk Certificate Manager Self-Hosted API credentials. + The secret must contain the key 'access-token' for the Access Token Authentication, + or two keys, 'username' and 'password' for the API Keys Authentication. + properties: + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + required: + - name + type: object + url: + description: |- + URL is the base URL for the vedsdk endpoint of the CyberArk Certificate Manager Self-Hosted instance, + for example: "https://tpp.example.com/vedsdk". + type: string + required: + - credentialsRef + - url + type: object + zone: + description: |- + Zone is the Certificate Manager Policy Zone to use for this issuer. + All requests made to the Certificate Manager platform will be restricted by the named + zone policy. + This field is required. + type: string + required: + - zone + type: object + x-kubernetes-validations: + - message: exactly one of tpp, cloud, or ngts must be configured + rule: '(has(self.tpp) ? 1 : 0) + (has(self.cloud) ? 1 : 0) + (has(self.ngts) ? 1 : 0) == 1' + type: object + status: + description: Status of the ClusterIssuer. This is set and managed automatically. + properties: + acme: + description: |- + ACME specific status options. + This field should only be set if the Issuer is configured to use an ACME + server to issue certificates. + properties: + lastPrivateKeyHash: + description: |- + LastPrivateKeyHash is a hash of the private key associated with the latest + registered ACME account, in order to track changes made to registered account + associated with the Issuer + type: string + lastRegisteredEmail: + description: |- + LastRegisteredEmail is the email associated with the latest registered + ACME account, in order to track changes made to registered account + associated with the Issuer + type: string + uri: + description: |- + URI is the unique account identifier, which can also be used to retrieve + account details from the CA + type: string + type: object + conditions: + description: |- + List of status conditions to indicate the status of a CertificateRequest. + Known condition types are `Ready`. + items: + description: IssuerCondition contains condition information for an Issuer. + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the timestamp corresponding to the last status + change of this condition. + format: date-time + type: string + message: + description: |- + Message is a human readable description of the details of the last + transition, complementing reason. + type: string + observedGeneration: + description: |- + If set, this represents the .metadata.generation that the condition was + set based upon. + For instance, if .metadata.generation is currently 12, but the + .status.condition[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the Issuer. + format: int64 + type: integer + reason: + description: |- + Reason is a brief machine readable explanation for the condition's last + transition. + type: string + status: + description: Status of the condition, one of (`True`, `False`, `Unknown`). + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: Type of the condition, known values are (`Ready`). + type: string + required: + - status + - type + type: object + type: array + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + type: object + required: + - spec + type: object + served: true + storage: true + subresources: + status: {} + +--- +# Source: cert-manager/templates/crd-cert-manager.io_issuers.yaml +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: "issuers.cert-manager.io" + annotations: + helm.sh/resource-policy: keep + labels: + app: "cert-manager" + app.kubernetes.io/name: "cert-manager" + app.kubernetes.io/instance: "cert-manager" + app.kubernetes.io/component: "crds" + app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/managed-by: Helm + helm.sh/chart: cert-manager-v1.21.1 +spec: + group: cert-manager.io + names: + categories: + - cert-manager + kind: Issuer + listKind: IssuerList + plural: issuers + shortNames: + - iss + singular: issuer + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .status.conditions[?(@.type == "Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type == "Ready")].message + name: Status + priority: 1 + type: string + - description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. + jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1 + schema: + openAPIV3Schema: + description: |- + An Issuer represents a certificate issuing authority which can be + referenced as part of `issuerRef` fields. + It is scoped to a single namespace and can therefore only be referenced by + resources within the same namespace. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: Desired state of the Issuer resource. + properties: + acme: + description: |- + ACME configures this issuer to communicate with a RFC8555 (ACME) server + to obtain signed x509 certificates. + properties: + caBundle: + description: |- + Base64-encoded bundle of PEM CAs which can be used to validate the certificate + chain presented by the ACME server. + Mutually exclusive with SkipTLSVerify; prefer using CABundle to prevent various + kinds of security vulnerabilities. + If CABundle and SkipTLSVerify are unset, the system certificate bundle inside + the container is used to validate the TLS connection. + format: byte + type: string + disableAccountKeyGeneration: + description: |- + Enables or disables generating a new ACME account key. + If true, the Issuer resource will *not* request a new account but will expect + the account key to be supplied via an existing secret. + If false, the cert-manager system will generate a new ACME account key + for the Issuer. + Defaults to false. + type: boolean + email: + description: |- + Email is the email address to be associated with the ACME account. + This field is optional, but it is strongly recommended to be set. + It will be used to contact you in case of issues with your account or + certificates, including expiry notification emails. + This field may be updated after the account is initially registered. + type: string + enableDurationFeature: + description: |- + Enables requesting a Not After date on certificates that matches the + duration of the certificate. This is not supported by all ACME servers + like Let's Encrypt. If set to true when the ACME server does not support + it, it will create an error on the Order. + Defaults to false. + type: boolean + externalAccountBinding: + description: |- + ExternalAccountBinding is a reference to a CA external account of the ACME + server. + If set, upon registration cert-manager will attempt to associate the given + external account credentials with the registered ACME account. + properties: + keyAlgorithm: + description: |- + Deprecated: keyAlgorithm field exists for historical compatibility + reasons and should not be used. The algorithm is now hardcoded to HS256 + in golang/x/crypto/acme. + enum: + - HS256 + - HS384 + - HS512 + type: string + keyID: + description: keyID is the ID of the CA key that the External Account is bound to. + type: string + keySecretRef: + description: |- + keySecretRef is a Secret Key Selector referencing a data item in a Kubernetes + Secret which holds the symmetric MAC key of the External Account Binding. + The `key` is the index string that is paired with the key data in the + Secret and should not be confused with the key data itself, or indeed with + the External Account Binding keyID above. + The secret key stored in the Secret **must** be un-padded, base64 URL + encoded data. + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + required: + - name + type: object + required: + - keyID + - keySecretRef + type: object + preferredChain: + description: |- + PreferredChain is the chain to use if the ACME server outputs multiple. + PreferredChain is no guarantee that this one gets delivered by the ACME + endpoint. + For example, for Let's Encrypt's DST cross-sign you would use: + "DST Root CA X3" or "ISRG Root X1" for the newer Let's Encrypt root CA. + This value picks the first certificate bundle in the combined set of + ACME default and alternative chains that has a root-most certificate with + this value as its issuer's commonname. + maxLength: 64 + type: string + privateKeySecretRef: + description: |- + PrivateKey is the name of a Kubernetes Secret resource that will be used to + store the automatically generated ACME account private key. + Optionally, a `key` may be specified to select a specific entry within + the named Secret resource. + If `key` is not specified, a default of `tls.key` will be used. + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + required: + - name + type: object + profile: + description: |- + Profile allows requesting a certificate profile from the ACME server. + Supported profiles are listed by the server's ACME directory URL. + type: string + server: + description: |- + Server is the URL used to access the ACME server's 'directory' endpoint. + For example, for Let's Encrypt's staging endpoint, you would use: + "https://acme-staging-v02.api.letsencrypt.org/directory". + Only ACME v2 endpoints (i.e. RFC 8555) are supported. + type: string + skipTLSVerify: + description: |- + INSECURE: Enables or disables validation of the ACME server TLS certificate. + If true, requests to the ACME server will not have the TLS certificate chain + validated. + Mutually exclusive with CABundle; prefer using CABundle to prevent various + kinds of security vulnerabilities. + Only enable this option in development environments. + If CABundle and SkipTLSVerify are unset, the system certificate bundle inside + the container is used to validate the TLS connection. + Defaults to false. + type: boolean + solvers: + description: |- + Solvers is a list of challenge solvers that will be used to solve + ACME challenges for the matching domains. + Solver configurations must be provided in order to obtain certificates + from an ACME server. + For more information, see: https://cert-manager.io/docs/configuration/acme/ + items: + description: |- + An ACMEChallengeSolver describes how to solve ACME challenges for the issuer it is part of. + A selector may be provided to use different solving strategies for different DNS names. + Only one of HTTP01 or DNS01 must be provided. + properties: + dns01: + description: |- + Configures cert-manager to attempt to complete authorizations by + performing the DNS01 challenge flow. + properties: + acmeDNS: + description: |- + Use the 'ACME DNS' (https://github.com/joohoi/acme-dns) API to manage + DNS01 challenge records. + properties: + accountSecretRef: + description: |- + A reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + required: + - name + type: object + host: + type: string + required: + - accountSecretRef + - host + type: object + akamai: + description: Use the Akamai DNS zone management API to manage DNS01 challenge records. + properties: + accessTokenSecretRef: + description: |- + A reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + required: + - name + type: object + clientSecretSecretRef: + description: |- + A reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + required: + - name + type: object + clientTokenSecretRef: + description: |- + A reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + required: + - name + type: object + serviceConsumerDomain: + type: string + required: + - accessTokenSecretRef + - clientSecretSecretRef + - clientTokenSecretRef + - serviceConsumerDomain + type: object + azureDNS: + description: Use the Microsoft Azure DNS API to manage DNS01 challenge records. + properties: + clientID: + description: |- + Auth: Azure Service Principal: + The ClientID of the Azure Service Principal used to authenticate with Azure DNS. + If set, ClientSecret and TenantID must also be set. + type: string + clientSecretSecretRef: + description: |- + Auth: Azure Service Principal: + A reference to a Secret containing the password associated with the Service Principal. + If set, ClientID and TenantID must also be set. + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + required: + - name + type: object + environment: + description: name of the Azure environment (default AzurePublicCloud) + enum: + - AzurePublicCloud + - AzureChinaCloud + - AzureGermanCloud + - AzureUSGovernmentCloud + type: string + hostedZoneName: + description: name of the DNS zone that should be used + type: string + managedIdentity: + description: |- + Auth: Azure Workload Identity or Azure Managed Service Identity: + Settings to enable Azure Workload Identity or Azure Managed Service Identity + If set, ClientID, ClientSecret and TenantID must not be set. + properties: + clientID: + description: client ID of the managed identity, cannot be used at the same time as resourceID + type: string + resourceID: + description: |- + resource ID of the managed identity, cannot be used at the same time as clientID + Cannot be used for Azure Managed Service Identity + type: string + tenantID: + description: tenant ID of the managed identity, cannot be used at the same time as resourceID + type: string + type: object + resourceGroupName: + description: resource group the DNS zone is located in + type: string + subscriptionID: + description: ID of the Azure subscription + type: string + tenantID: + description: |- + Auth: Azure Service Principal: + The TenantID of the Azure Service Principal used to authenticate with Azure DNS. + If set, ClientID and ClientSecret must also be set. + type: string + zoneType: + description: |- + ZoneType determines which type of Azure DNS zone to use. + + Valid values are: + - AzurePublicZone (default): Use a public Azure DNS zone. + - AzurePrivateZone: Use an Azure Private DNS zone. + + If not specified, AzurePublicZone is used. + + Support for Azure Private DNS zones is currently + experimental and may change in future releases. + enum: + - AzurePublicZone + - AzurePrivateZone + type: string + required: + - resourceGroupName + - subscriptionID + type: object + cloudDNS: + description: Use the Google Cloud DNS API to manage DNS01 challenge records. + properties: + hostedZoneName: + description: |- + HostedZoneName is an optional field that tells cert-manager in which + Cloud DNS zone the challenge record has to be created. + If left empty cert-manager will automatically choose a zone. + type: string + project: + type: string + serviceAccountSecretRef: + description: |- + A reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + required: + - name + type: object + required: + - project + type: object + cloudflare: + description: Use the Cloudflare API to manage DNS01 challenge records. + properties: + apiKeySecretRef: + description: |- + API key to use to authenticate with Cloudflare. + Note: using an API token to authenticate is now the recommended method + as it allows greater control of permissions. + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + required: + - name + type: object + apiTokenSecretRef: + description: API token used to authenticate with Cloudflare. + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + required: + - name + type: object + email: + description: Email of the account, only required when using API key based authentication. + type: string + type: object + cnameStrategy: + description: |- + CNAMEStrategy configures how the DNS01 provider should handle CNAME + records when found in DNS zones. + enum: + - None + - Follow + type: string + digitalocean: + description: Use the DigitalOcean DNS API to manage DNS01 challenge records. + properties: + tokenSecretRef: + description: |- + A reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + required: + - name + type: object + required: + - tokenSecretRef + type: object + rfc2136: + description: |- + Use RFC2136 ("Dynamic Updates in the Domain Name System") (https://datatracker.ietf.org/doc/rfc2136/) + to manage DNS01 challenge records. + properties: + nameserver: + description: |- + The IP address or hostname of an authoritative DNS server supporting + RFC2136 in the form host:port. If the host is an IPv6 address it must be + enclosed in square brackets (e.g [2001:db8::1]); port is optional. + This field is required. + type: string + protocol: + description: Protocol to use for dynamic DNS update queries. Valid values are (case-sensitive) ``TCP`` and ``UDP``; ``UDP`` (default). + enum: + - TCP + - UDP + type: string + tsigAlgorithm: + description: |- + The TSIG Algorithm configured in the DNS supporting RFC2136. Used only + when ``tsigSecretSecretRef`` and ``tsigKeyName`` are defined. + Supported values are (case-insensitive): ``HMACMD5`` (default), + ``HMACSHA1``, ``HMACSHA256`` or ``HMACSHA512``. + type: string + tsigKeyName: + description: |- + The TSIG Key name configured in the DNS. + If ``tsigSecretSecretRef`` is defined, this field is required. + type: string + tsigSecretSecretRef: + description: |- + The name of the secret containing the TSIG value. + If ``tsigKeyName`` is defined, this field is required. + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + required: + - name + type: object + required: + - nameserver + type: object + route53: + description: Use the AWS Route53 API to manage DNS01 challenge records. + properties: + accessKeyID: + description: |- + The AccessKeyID is used for authentication. + Cannot be set when SecretAccessKeyID is set. + If neither the Access Key nor Key ID are set, we fall back to using env + vars, shared credentials file, or AWS Instance metadata, + see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials + type: string + accessKeyIDSecretRef: + description: |- + The SecretAccessKey is used for authentication. If set, pull the AWS + access key ID from a key within a Kubernetes Secret. + Cannot be set when AccessKeyID is set. + If neither the Access Key nor Key ID are set, we fall back to using env + vars, shared credentials file, or AWS Instance metadata, + see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + required: + - name + type: object + auth: + description: Auth configures how cert-manager authenticates. + properties: + kubernetes: + description: |- + Kubernetes authenticates with Route53 using AssumeRoleWithWebIdentity + by passing a bound ServiceAccount token. + properties: + serviceAccountRef: + description: |- + A reference to a service account that will be used to request a bound + token (also known as "projected token"). To use this field, you must + configure an RBAC rule to let cert-manager request a token. + properties: + audiences: + description: |- + TokenAudiences is an optional list of audiences to include in the + token passed to AWS. The default token consisting of the issuer's namespace + and name is always included. + If unset the audience defaults to `sts.amazonaws.com`. + items: + type: string + type: array + x-kubernetes-list-type: atomic + name: + description: Name of the ServiceAccount used to request a token. + type: string + required: + - name + type: object + required: + - serviceAccountRef + type: object + required: + - kubernetes + type: object + hostedZoneID: + description: If set, the provider will manage only this zone in Route53 and will not do a lookup using the route53:ListHostedZonesByName api call. + type: string + region: + description: |- + Override the AWS region. + + Route53 is a global service and does not have regional endpoints but the + region specified here (or via environment variables) is used as a hint to + help compute the correct AWS credential scope and partition when it + connects to Route53. See: + - [Amazon Route 53 endpoints and quotas](https://docs.aws.amazon.com/general/latest/gr/r53.html) + - [Global services](https://docs.aws.amazon.com/whitepapers/latest/aws-fault-isolation-boundaries/global-services.html) + + If you omit this region field, cert-manager will use the region from + AWS_REGION and AWS_DEFAULT_REGION environment variables, if they are set + in the cert-manager controller Pod. + + The `region` field is not needed if you use [IAM Roles for Service Accounts (IRSA)](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html). + Instead an AWS_REGION environment variable is added to the cert-manager controller Pod by: + [Amazon EKS Pod Identity Webhook](https://github.com/aws/amazon-eks-pod-identity-webhook). + In this case this `region` field value is ignored. + + The `region` field is not needed if you use [EKS Pod Identities](https://docs.aws.amazon.com/eks/latest/userguide/pod-identities.html). + Instead an AWS_REGION environment variable is added to the cert-manager controller Pod by: + [Amazon EKS Pod Identity Agent](https://github.com/aws/eks-pod-identity-agent), + In this case this `region` field value is ignored. + type: string + role: + description: |- + Role is a Role ARN which the Route53 provider will assume using either the explicit credentials AccessKeyID/SecretAccessKey + or the inferred credentials from environment variables, shared credentials file or AWS Instance metadata + type: string + secretAccessKeySecretRef: + description: |- + The SecretAccessKey is used for authentication. + If neither the Access Key nor Key ID are set, we fall back to using env + vars, shared credentials file, or AWS Instance metadata, + see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + required: + - name + type: object + type: object + webhook: + description: |- + Configure an external webhook based DNS01 challenge solver to manage + DNS01 challenge records. + properties: + config: + description: |- + Additional configuration that should be passed to the webhook apiserver + when challenges are processed. + This can contain arbitrary JSON data. + Secret values should not be specified in this stanza. + If secret values are needed (e.g., credentials for a DNS service), you + should use a SecretKeySelector to reference a Secret resource. + For details on the schema of this field, consult the webhook provider + implementation's documentation. + x-kubernetes-preserve-unknown-fields: true + groupName: + description: |- + The API group name that should be used when POSTing ChallengePayload + resources to the webhook apiserver. + This should be the same as the GroupName specified in the webhook + provider implementation. + type: string + solverName: + description: |- + The name of the solver to use, as defined in the webhook provider + implementation. + This will typically be the name of the provider, e.g., 'cloudflare'. + type: string + required: + - groupName + - solverName + type: object + type: object + http01: + description: |- + Configures cert-manager to attempt to complete authorizations by + performing the HTTP01 challenge flow. + It is not possible to obtain certificates for wildcard domain names + (e.g., `*.example.com`) using the HTTP01 challenge mechanism. + properties: + gatewayHTTPRoute: + description: |- + The Gateway API is a sig-network community API that models service networking + in Kubernetes (https://gateway-api.sigs.k8s.io/). The Gateway solver will + create HTTPRoutes with the specified labels in the same namespace as the challenge. + This solver is experimental, and fields / behaviour may change in the future. + properties: + labels: + additionalProperties: + type: string + description: |- + Custom labels that will be applied to HTTPRoutes created by cert-manager + while solving HTTP-01 challenges. + type: object + parentRefs: + description: |- + When solving an HTTP-01 challenge, cert-manager creates an HTTPRoute. + cert-manager needs to know which parentRefs should be used when creating + the HTTPRoute. Usually, the parentRef references a Gateway. See: + https://gateway-api.sigs.k8s.io/api-types/httproute/#attaching-to-gateways + items: + description: |- + ParentReference identifies an API object (usually a Gateway) that can be considered + a parent of this resource (usually a route). There are two kinds of parent resources + with "Core" support: + + * Gateway (Gateway conformance profile) + * Service (Mesh conformance profile, ClusterIP Services only) + + This API may be extended in the future to support additional kinds of parent + resources. + + The API object must be valid in the cluster; the Group and Kind must + be registered in the cluster for this reference to be valid. + properties: + group: + default: gateway.networking.k8s.io + description: |- + Group is the group of the referent. + When unspecified, "gateway.networking.k8s.io" is inferred. + To set the core API group (such as for a "Service" kind referent), + Group must be explicitly set to "" (empty string). + + Support: Core + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + default: Gateway + description: |- + Kind is kind of the referent. + + There are two kinds of parent resources with "Core" support: + + * Gateway (Gateway conformance profile) + * Service (Mesh conformance profile, ClusterIP Services only) + + Support for other resources is Implementation-Specific. + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: |- + Name is the name of the referent. + + Support: Core + maxLength: 253 + minLength: 1 + type: string + namespace: + description: |- + Namespace is the namespace of the referent. When unspecified, this refers + to the local namespace of the Route. + + Note that there are specific rules for ParentRefs which cross namespace + boundaries. Cross-namespace references are only valid if they are explicitly + allowed by something in the namespace they are referring to. For example: + Gateway has the AllowedRoutes field, and ReferenceGrant provides a + generic way to enable any other kind of cross-namespace reference. + + + ParentRefs from a Route to a Service in the same namespace are "producer" + routes, which apply default routing rules to inbound connections from + any namespace to the Service. + + ParentRefs from a Route to a Service in a different namespace are + "consumer" routes, and these routing rules are only applied to outbound + connections originating from the same namespace as the Route, for which + the intended destination of the connections are a Service targeted as a + ParentRef of the Route. + + + Support: Core + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + port: + description: |- + Port is the network port this Route targets. It can be interpreted + differently based on the type of parent resource. + + When the parent resource is a Gateway, this targets all listeners + listening on the specified port that also support this kind of Route(and + select this Route). It's not recommended to set `Port` unless the + networking behaviors specified in a Route must apply to a specific port + as opposed to a listener(s) whose port(s) may be changed. When both Port + and SectionName are specified, the name and port of the selected listener + must match both specified values. + + + When the parent resource is a Service, this targets a specific port in the + Service spec. When both Port (experimental) and SectionName are specified, + the name and port of the selected port must match both specified values. + + + Implementations MAY choose to support other parent resources. + Implementations supporting other types of parent resources MUST clearly + document how/if Port is interpreted. + + For the purpose of status, an attachment is considered successful as + long as the parent resource accepts it partially. For example, Gateway + listeners can restrict which Routes can attach to them by Route kind, + namespace, or hostname. If 1 of 2 Gateway listeners accept attachment + from the referencing Route, the Route MUST be considered successfully + attached. If no Gateway listeners accept attachment from this Route, + the Route MUST be considered detached from the Gateway. + + Support: Extended + format: int32 + maximum: 65535 + minimum: 1 + type: integer + sectionName: + description: |- + SectionName is the name of a section within the target resource. In the + following resources, SectionName is interpreted as the following: + + * Gateway: Listener name. When both Port (experimental) and SectionName + are specified, the name and port of the selected listener must match + both specified values. + * Service: Port name. When both Port (experimental) and SectionName + are specified, the name and port of the selected listener must match + both specified values. + + Implementations MAY choose to support attaching Routes to other resources. + If that is the case, they MUST clearly document how SectionName is + interpreted. + + When unspecified (empty string), this will reference the entire resource. + For the purpose of status, an attachment is considered successful if at + least one section in the parent resource accepts it. For example, Gateway + listeners can restrict which Routes can attach to them by Route kind, + namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from + the referencing Route, the Route MUST be considered successfully + attached. If no Gateway listeners accept attachment from this Route, the + Route MUST be considered detached from the Gateway. + + Support: Core + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + required: + - name + type: object + type: array + x-kubernetes-list-type: atomic + podTemplate: + description: |- + Optional pod template used to configure the ACME challenge solver pods + used for HTTP01 challenges. + properties: + metadata: + description: |- + ObjectMeta overrides for the pod used to solve HTTP01 challenges. + Only the 'labels' and 'annotations' fields may be set. + If labels or annotations overlap with in-built values, the values here + will override the in-built values. + properties: + annotations: + additionalProperties: + type: string + description: Annotations that should be added to the created ACME HTTP01 solver pods. + type: object + labels: + additionalProperties: + type: string + description: Labels that should be added to the created ACME HTTP01 solver pods. + type: object + type: object + spec: + description: |- + PodSpec defines overrides for the HTTP01 challenge solver pod. + Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields. + All other fields will be ignored. + properties: + affinity: + description: If specified, the pod's scheduling constraints + properties: + nodeAffinity: + description: Describes node affinity scheduling rules for the pod. + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node matches the corresponding matchExpressions; the + node(s) with the highest sum are the most preferred. + items: + description: |- + An empty preferred scheduling term matches all objects with implicit weight 0 + (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). + properties: + preference: + description: A node selector term, associated with the corresponding weight. + properties: + matchExpressions: + description: A list of node selector requirements by node's labels. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchFields: + description: A list of node selector requirements by node's fields. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + type: object + x-kubernetes-map-type: atomic + weight: + description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100. + format: int32 + type: integer + required: + - preference + - weight + type: object + type: array + x-kubernetes-list-type: atomic + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to an update), the system + may or may not try to eventually evict the pod from its node. + properties: + nodeSelectorTerms: + description: Required. A list of node selector terms. The terms are ORed. + items: + description: |- + A null or empty node selector term matches no objects. The requirements of + them are ANDed. + The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. + properties: + matchExpressions: + description: A list of node selector requirements by node's labels. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchFields: + description: A list of node selector requirements by node's fields. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + required: + - nodeSelectorTerms + type: object + x-kubernetes-map-type: atomic + type: object + podAffinity: + description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)). + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + items: + description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated with the corresponding weight. + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both matchLabelKeys and labelSelector. + Also, matchLabelKeys cannot be set when labelSelector isn't set. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. + Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + x-kubernetes-list-type: atomic + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + x-kubernetes-list-type: atomic + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both matchLabelKeys and labelSelector. + Also, matchLabelKeys cannot be set when labelSelector isn't set. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. + Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + x-kubernetes-list-type: atomic + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + type: array + x-kubernetes-list-type: atomic + type: object + podAntiAffinity: + description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)). + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the anti-affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling anti-affinity expressions, etc.), + compute a sum by iterating through the elements of this field and subtracting + "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + items: + description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated with the corresponding weight. + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both matchLabelKeys and labelSelector. + Also, matchLabelKeys cannot be set when labelSelector isn't set. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. + Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + x-kubernetes-list-type: atomic + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + x-kubernetes-list-type: atomic + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the anti-affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the anti-affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both matchLabelKeys and labelSelector. + Also, matchLabelKeys cannot be set when labelSelector isn't set. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. + Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + x-kubernetes-list-type: atomic + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + type: array + x-kubernetes-list-type: atomic + type: object + type: object + imagePullSecrets: + description: If specified, the pod's imagePullSecrets + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + nodeSelector: + additionalProperties: + type: string + description: |- + NodeSelector is a selector which must be true for the pod to fit on a node. + Selector which must match a node's labels for the pod to be scheduled on that node. + More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ + type: object + priorityClassName: + description: If specified, the pod's priorityClassName. + type: string + resources: + description: |- + If specified, the pod's resource requirements. + These values override the global resource configuration flags. + Note that when only specifying resource limits, ensure they are greater than or equal + to the corresponding global resource requests configured via controller flags + (--acme-http01-solver-resource-request-cpu, --acme-http01-solver-resource-request-memory). + Kubernetes will reject pod creation if limits are lower than requests, causing challenge failures. + properties: + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to the global values configured via controller flags. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + securityContext: + description: If specified, the pod's security context + properties: + fsGroup: + description: |- + A special supplemental group that applies to all containers in a pod. + Some volume types allow the Kubelet to change the ownership of that volume + to be owned by the pod: + + 1. The owning GID will be the FSGroup + 2. The setgid bit is set (new files created in the volume will be owned by FSGroup) + 3. The permission bits are OR'd with rw-rw---- + + If unset, the Kubelet will not modify the ownership and permissions of any volume. + Note that this field cannot be set when spec.os.name is windows. + format: int64 + type: integer + fsGroupChangePolicy: + description: |- + fsGroupChangePolicy defines behavior of changing ownership and permission of the volume + before being exposed inside Pod. This field will only apply to + volume types which support fsGroup based ownership(and permissions). + It will have no effect on ephemeral volume types such as: secret, configmaps + and emptydir. + Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used. + Note that this field cannot be set when spec.os.name is windows. + type: string + runAsGroup: + description: |- + The GID to run the entrypoint of the container process. + Uses runtime default if unset. + May also be set in SecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence + for that container. + Note that this field cannot be set when spec.os.name is windows. + format: int64 + type: integer + runAsNonRoot: + description: |- + Indicates that the container must run as a non-root user. + If true, the Kubelet will validate the image at runtime to ensure that it + does not run as UID 0 (root) and fail to start the container if it does. + If unset or false, no such validation will be performed. + May also be set in SecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: boolean + runAsUser: + description: |- + The UID to run the entrypoint of the container process. + Defaults to user specified in image metadata if unspecified. + May also be set in SecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence + for that container. + Note that this field cannot be set when spec.os.name is windows. + format: int64 + type: integer + seLinuxOptions: + description: |- + The SELinux context to be applied to all containers. + If unspecified, the container runtime will allocate a random SELinux context for each + container. May also be set in SecurityContext. If set in + both SecurityContext and PodSecurityContext, the value specified in SecurityContext + takes precedence for that container. + Note that this field cannot be set when spec.os.name is windows. + properties: + level: + description: Level is SELinux level label that applies to the container. + type: string + role: + description: Role is a SELinux role label that applies to the container. + type: string + type: + description: Type is a SELinux type label that applies to the container. + type: string + user: + description: User is a SELinux user label that applies to the container. + type: string + type: object + seccompProfile: + description: |- + The seccomp options to use by the containers in this pod. + Note that this field cannot be set when spec.os.name is windows. + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile defined in a file on the node should be used. + The profile must be preconfigured on the node to work. + Must be a descending path, relative to the kubelet's configured seccomp profile location. + Must be set if type is "Localhost". Must NOT be set for any other type. + type: string + type: + description: |- + type indicates which kind of seccomp profile will be applied. + Valid options are: + + Localhost - a profile defined in a file on the node should be used. + RuntimeDefault - the container runtime default profile should be used. + Unconfined - no profile should be applied. + type: string + required: + - type + type: object + supplementalGroups: + description: |- + A list of groups applied to the first process run in each container, in addition + to the container's primary GID, the fsGroup (if specified), and group memberships + defined in the container image for the uid of the container process. If unspecified, + no additional groups are added to any container. Note that group memberships + defined in the container image for the uid of the container process are still effective, + even if they are not included in this list. + Note that this field cannot be set when spec.os.name is windows. + items: + format: int64 + type: integer + type: array + x-kubernetes-list-type: atomic + sysctls: + description: |- + Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported + sysctls (by the container runtime) might fail to launch. + Note that this field cannot be set when spec.os.name is windows. + items: + description: Sysctl defines a kernel parameter to be set + properties: + name: + description: Name of a property to set + type: string + value: + description: Value of a property to set + type: string + required: + - name + - value + type: object + type: array + x-kubernetes-list-type: atomic + type: object + serviceAccountName: + description: If specified, the pod's service account + type: string + tolerations: + description: If specified, the pod's tolerations. + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + format: int64 + type: integer + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + type: object + type: array + x-kubernetes-list-type: atomic + type: object + type: object + serviceType: + description: |- + Optional service type for Kubernetes solver service. Supported values + are NodePort or ClusterIP. If unset, defaults to NodePort. + type: string + type: object + ingress: + description: |- + The ingress based HTTP01 challenge solver will solve challenges by + creating or modifying Ingress resources in order to route requests for + '/.well-known/acme-challenge/XYZ' to 'challenge solver' pods that are + provisioned by cert-manager for each Challenge to be completed. + properties: + class: + description: |- + This field configures the annotation `kubernetes.io/ingress.class` when + creating Ingress resources to solve ACME challenges that use this + challenge solver. Only one of `class`, `name` or `ingressClassName` may + be specified. + type: string + ingressClassName: + description: |- + This field configures the field `ingressClassName` on the created Ingress + resources used to solve ACME challenges that use this challenge solver. + This is the recommended way of configuring the ingress class. Only one of + `class`, `name` or `ingressClassName` may be specified. + type: string + ingressTemplate: + description: |- + Optional ingress template used to configure the ACME challenge solver + ingress used for HTTP01 challenges. + properties: + metadata: + description: |- + ObjectMeta overrides for the ingress used to solve HTTP01 challenges. + Only the 'labels' and 'annotations' fields may be set. + If labels or annotations overlap with in-built values, the values here + will override the in-built values. + properties: + annotations: + additionalProperties: + type: string + description: Annotations that should be added to the created ACME HTTP01 solver ingress. + type: object + labels: + additionalProperties: + type: string + description: Labels that should be added to the created ACME HTTP01 solver ingress. + type: object + type: object + type: object + name: + description: |- + The name of the ingress resource that should have ACME challenge solving + routes inserted into it in order to solve HTTP01 challenges. + This is typically used in conjunction with ingress controllers like + ingress-gce, which maintains a 1:1 mapping between external IPs and + ingress resources. Only one of `class`, `name` or `ingressClassName` may + be specified. + type: string + podTemplate: + description: |- + Optional pod template used to configure the ACME challenge solver pods + used for HTTP01 challenges. + properties: + metadata: + description: |- + ObjectMeta overrides for the pod used to solve HTTP01 challenges. + Only the 'labels' and 'annotations' fields may be set. + If labels or annotations overlap with in-built values, the values here + will override the in-built values. + properties: + annotations: + additionalProperties: + type: string + description: Annotations that should be added to the created ACME HTTP01 solver pods. + type: object + labels: + additionalProperties: + type: string + description: Labels that should be added to the created ACME HTTP01 solver pods. + type: object + type: object + spec: + description: |- + PodSpec defines overrides for the HTTP01 challenge solver pod. + Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields. + All other fields will be ignored. + properties: + affinity: + description: If specified, the pod's scheduling constraints + properties: + nodeAffinity: + description: Describes node affinity scheduling rules for the pod. + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node matches the corresponding matchExpressions; the + node(s) with the highest sum are the most preferred. + items: + description: |- + An empty preferred scheduling term matches all objects with implicit weight 0 + (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). + properties: + preference: + description: A node selector term, associated with the corresponding weight. + properties: + matchExpressions: + description: A list of node selector requirements by node's labels. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchFields: + description: A list of node selector requirements by node's fields. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + type: object + x-kubernetes-map-type: atomic + weight: + description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100. + format: int32 + type: integer + required: + - preference + - weight + type: object + type: array + x-kubernetes-list-type: atomic + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to an update), the system + may or may not try to eventually evict the pod from its node. + properties: + nodeSelectorTerms: + description: Required. A list of node selector terms. The terms are ORed. + items: + description: |- + A null or empty node selector term matches no objects. The requirements of + them are ANDed. + The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. + properties: + matchExpressions: + description: A list of node selector requirements by node's labels. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchFields: + description: A list of node selector requirements by node's fields. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + required: + - nodeSelectorTerms + type: object + x-kubernetes-map-type: atomic + type: object + podAffinity: + description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)). + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + items: + description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated with the corresponding weight. + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both matchLabelKeys and labelSelector. + Also, matchLabelKeys cannot be set when labelSelector isn't set. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. + Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + x-kubernetes-list-type: atomic + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + x-kubernetes-list-type: atomic + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both matchLabelKeys and labelSelector. + Also, matchLabelKeys cannot be set when labelSelector isn't set. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. + Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + x-kubernetes-list-type: atomic + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + type: array + x-kubernetes-list-type: atomic + type: object + podAntiAffinity: + description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)). + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the anti-affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling anti-affinity expressions, etc.), + compute a sum by iterating through the elements of this field and subtracting + "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + items: + description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated with the corresponding weight. + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both matchLabelKeys and labelSelector. + Also, matchLabelKeys cannot be set when labelSelector isn't set. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. + Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + x-kubernetes-list-type: atomic + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + x-kubernetes-list-type: atomic + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the anti-affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the anti-affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both matchLabelKeys and labelSelector. + Also, matchLabelKeys cannot be set when labelSelector isn't set. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. + Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + x-kubernetes-list-type: atomic + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + type: array + x-kubernetes-list-type: atomic + type: object + type: object + imagePullSecrets: + description: If specified, the pod's imagePullSecrets + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + nodeSelector: + additionalProperties: + type: string + description: |- + NodeSelector is a selector which must be true for the pod to fit on a node. + Selector which must match a node's labels for the pod to be scheduled on that node. + More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ + type: object + priorityClassName: + description: If specified, the pod's priorityClassName. + type: string + resources: + description: |- + If specified, the pod's resource requirements. + These values override the global resource configuration flags. + Note that when only specifying resource limits, ensure they are greater than or equal + to the corresponding global resource requests configured via controller flags + (--acme-http01-solver-resource-request-cpu, --acme-http01-solver-resource-request-memory). + Kubernetes will reject pod creation if limits are lower than requests, causing challenge failures. + properties: + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to the global values configured via controller flags. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + securityContext: + description: If specified, the pod's security context + properties: + fsGroup: + description: |- + A special supplemental group that applies to all containers in a pod. + Some volume types allow the Kubelet to change the ownership of that volume + to be owned by the pod: + + 1. The owning GID will be the FSGroup + 2. The setgid bit is set (new files created in the volume will be owned by FSGroup) + 3. The permission bits are OR'd with rw-rw---- + + If unset, the Kubelet will not modify the ownership and permissions of any volume. + Note that this field cannot be set when spec.os.name is windows. + format: int64 + type: integer + fsGroupChangePolicy: + description: |- + fsGroupChangePolicy defines behavior of changing ownership and permission of the volume + before being exposed inside Pod. This field will only apply to + volume types which support fsGroup based ownership(and permissions). + It will have no effect on ephemeral volume types such as: secret, configmaps + and emptydir. + Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used. + Note that this field cannot be set when spec.os.name is windows. + type: string + runAsGroup: + description: |- + The GID to run the entrypoint of the container process. + Uses runtime default if unset. + May also be set in SecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence + for that container. + Note that this field cannot be set when spec.os.name is windows. + format: int64 + type: integer + runAsNonRoot: + description: |- + Indicates that the container must run as a non-root user. + If true, the Kubelet will validate the image at runtime to ensure that it + does not run as UID 0 (root) and fail to start the container if it does. + If unset or false, no such validation will be performed. + May also be set in SecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: boolean + runAsUser: + description: |- + The UID to run the entrypoint of the container process. + Defaults to user specified in image metadata if unspecified. + May also be set in SecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence + for that container. + Note that this field cannot be set when spec.os.name is windows. + format: int64 + type: integer + seLinuxOptions: + description: |- + The SELinux context to be applied to all containers. + If unspecified, the container runtime will allocate a random SELinux context for each + container. May also be set in SecurityContext. If set in + both SecurityContext and PodSecurityContext, the value specified in SecurityContext + takes precedence for that container. + Note that this field cannot be set when spec.os.name is windows. + properties: + level: + description: Level is SELinux level label that applies to the container. + type: string + role: + description: Role is a SELinux role label that applies to the container. + type: string + type: + description: Type is a SELinux type label that applies to the container. + type: string + user: + description: User is a SELinux user label that applies to the container. + type: string + type: object + seccompProfile: + description: |- + The seccomp options to use by the containers in this pod. + Note that this field cannot be set when spec.os.name is windows. + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile defined in a file on the node should be used. + The profile must be preconfigured on the node to work. + Must be a descending path, relative to the kubelet's configured seccomp profile location. + Must be set if type is "Localhost". Must NOT be set for any other type. + type: string + type: + description: |- + type indicates which kind of seccomp profile will be applied. + Valid options are: + + Localhost - a profile defined in a file on the node should be used. + RuntimeDefault - the container runtime default profile should be used. + Unconfined - no profile should be applied. + type: string + required: + - type + type: object + supplementalGroups: + description: |- + A list of groups applied to the first process run in each container, in addition + to the container's primary GID, the fsGroup (if specified), and group memberships + defined in the container image for the uid of the container process. If unspecified, + no additional groups are added to any container. Note that group memberships + defined in the container image for the uid of the container process are still effective, + even if they are not included in this list. + Note that this field cannot be set when spec.os.name is windows. + items: + format: int64 + type: integer + type: array + x-kubernetes-list-type: atomic + sysctls: + description: |- + Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported + sysctls (by the container runtime) might fail to launch. + Note that this field cannot be set when spec.os.name is windows. + items: + description: Sysctl defines a kernel parameter to be set + properties: + name: + description: Name of a property to set + type: string + value: + description: Value of a property to set + type: string + required: + - name + - value + type: object + type: array + x-kubernetes-list-type: atomic + type: object + serviceAccountName: + description: If specified, the pod's service account + type: string + tolerations: + description: If specified, the pod's tolerations. + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + format: int64 + type: integer + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + type: object + type: array + x-kubernetes-list-type: atomic + type: object + type: object + serviceType: + description: |- + Optional service type for Kubernetes solver service. Supported values + are NodePort or ClusterIP. If unset, defaults to NodePort. + type: string + type: object + type: object + selector: + description: |- + Selector selects a set of DNSNames on the Certificate resource that + should be solved using this challenge solver. + If not specified, the solver will be treated as the 'default' solver + with the lowest priority, i.e. if any other solver has a more specific + match, it will be used instead. + properties: + dnsNames: + description: |- + List of DNSNames that this solver will be used to solve. + If specified and a match is found, a dnsNames selector will take + precedence over a dnsZones selector. + If multiple solvers match with the same dnsNames value, the solver + with the most matching labels in matchLabels will be selected. + If neither has more matches, the solver defined earlier in the list + will be selected. + items: + type: string + type: array + x-kubernetes-list-type: atomic + dnsZones: + description: |- + List of DNSZones that this solver will be used to solve. + The most specific DNS zone match specified here will take precedence + over other DNS zone matches, so a solver specifying sys.example.com + will be selected over one specifying example.com for the domain + www.sys.example.com. + If multiple solvers match with the same dnsZones value, the solver + with the most matching labels in matchLabels will be selected. + If neither has more matches, the solver defined earlier in the list + will be selected. + items: + type: string + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + A label selector that is used to refine the set of certificate's that + this challenge solver will apply to. + type: object + type: object + waitInsteadOfSelfCheck: + description: |- + WaitInsteadOfSelfCheck, if set, skips cert-manager's self-check and + instead waits this long after presentation before asking the ACME server + to validate the challenge. + + This is an advanced escape hatch for environments where cert-manager's + self-check cannot succeed from its own network or DNS viewpoint even + though the ACME server can still validate successfully, for example due + to split-horizon DNS or NAT hairpinning. + + A value of 0 skips the self-check and asks the ACME server to validate + immediately after presentation, relying on the ACME server's own + validation retries (RFC 8555 section 8.2) to succeed once the challenge + has propagated. A negative duration is rejected. + Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration, + for example `30s` or `2m`. + type: string + type: object + type: array + x-kubernetes-list-type: atomic + required: + - privateKeySecretRef + - server + type: object + ca: + description: |- + CA configures this issuer to sign certificates using a signing CA keypair + stored in a Secret resource. + This is used to build internal PKIs that are managed by cert-manager. + properties: + crlDistributionPoints: + description: |- + The CRL distribution points is an X.509 v3 certificate extension which identifies + the location of the CRL from which the revocation of this certificate can be checked. + If not set, certificates will be issued without distribution points set. + items: + type: string + type: array + x-kubernetes-list-type: atomic + issuingCertificateURLs: + description: |- + IssuingCertificateURLs is a list of URLs which this issuer should embed into certificates + it creates. See https://www.rfc-editor.org/rfc/rfc5280#section-4.2.2.1 for more details. + As an example, such a URL might be "http://ca.domain.com/ca.crt". + items: + type: string + type: array + x-kubernetes-list-type: atomic + ocspServers: + description: |- + The OCSP server list is an X.509 v3 extension that defines a list of + URLs of OCSP responders. The OCSP responders can be queried for the + revocation status of an issued certificate. If not set, the + certificate will be issued with no OCSP servers set. For example, an + OCSP server URL could be "http://ocsp.int-x3.letsencrypt.org". + items: + type: string + type: array + x-kubernetes-list-type: atomic + secretName: + description: |- + SecretName is the name of the secret used to sign Certificates issued + by this Issuer. + type: string + required: + - secretName + type: object + selfSigned: + description: |- + SelfSigned configures this issuer to 'self sign' certificates using the + private key used to create the CertificateRequest object. + properties: + crlDistributionPoints: + description: |- + The CRL distribution points is an X.509 v3 certificate extension which identifies + the location of the CRL from which the revocation of this certificate can be checked. + If not set certificate will be issued without CDP. Values are strings. + items: + type: string + type: array + x-kubernetes-list-type: atomic + type: object + vault: + description: |- + Vault configures this issuer to sign certificates using a HashiCorp Vault + PKI backend. + properties: + auth: + description: Auth configures how cert-manager authenticates with the Vault server. + properties: + appRole: + description: |- + AppRole authenticates with Vault using the App Role auth mechanism, + with the role and secret stored in a Kubernetes Secret resource. + properties: + path: + description: |- + Path where the App Role authentication backend is mounted in Vault, e.g: + "approle" + type: string + roleId: + description: |- + RoleID configured in the App Role authentication backend when setting + up the authentication backend in Vault. + type: string + secretRef: + description: |- + Reference to a key in a Secret that contains the App Role secret used + to authenticate with Vault. + The `key` field must be specified and denotes which entry within the Secret + resource is used as the app role secret. + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + required: + - name + type: object + required: + - path + - roleId + - secretRef + type: object + aws: + description: |- + AWS authenticates with Vault using AWS IAM authentication. + This allows authentication using IAM roles for service accounts (IRSA), + EKS Pod Identity (PIA), or ambient credentials (EC2 instance profiles, ECS task role). + properties: + iamRoleArn: + description: |- + The ARN of the AWS IAM role to assume using the Kubernetes service account + token. Required when using IRSA (serviceAccountRef is set). + This role must have a trust policy that allows the OIDC provider to assume it. + type: string + mountPath: + description: |- + The Vault mountPath here is the mount path to use when authenticating with + Vault. For example, setting a value to `/v1/auth/foo`, will use the path + `/v1/auth/foo/login` to authenticate with Vault. If unspecified, the + default value "/v1/auth/aws" will be used. + type: string + region: + description: |- + The AWS region to use for authentication. If not specified, the region + will be determined from AWS_REGION or AWS_DEFAULT_REGION environment + variables, falling back to "us-east-1" if not set. + type: string + role: + description: A required field containing the Vault Role to assume when authenticating. + minLength: 1 + type: string + serviceAccountRef: + description: |- + A reference to a service account that will be used to request a web identity + token for IRSA (IAM Roles for Service Accounts) authentication. + properties: + audiences: + description: |- + TokenAudiences is an optional list of extra audiences to include in the token passed to Vault. + The default audiences are always included in the token. + items: + type: string + type: array + x-kubernetes-list-type: atomic + name: + description: Name of the ServiceAccount used to request a token. + type: string + required: + - name + type: object + vaultHeaderValue: + description: |- + The Vault header value to include in the STS signing request. + This is used to prevent replay attacks. + type: string + required: + - role + type: object + clientCertificate: + description: |- + ClientCertificate authenticates with Vault by presenting a client + certificate during the request's TLS handshake. + Works only when using HTTPS protocol. + properties: + mountPath: + description: |- + The Vault mountPath here is the mount path to use when authenticating with + Vault. For example, setting a value to `/v1/auth/foo`, will use the path + `/v1/auth/foo/login` to authenticate with Vault. If unspecified, the + default value "/v1/auth/cert" will be used. + type: string + name: + description: |- + Name of the certificate role to authenticate against. + If not set, matching any certificate role, if available. + type: string + secretName: + description: |- + Reference to Kubernetes Secret of type "kubernetes.io/tls" (hence containing + tls.crt and tls.key) used to authenticate to Vault using TLS client + authentication. + type: string + type: object + kubernetes: + description: |- + Kubernetes authenticates with Vault by passing the ServiceAccount + token stored in the named Secret resource to the Vault server. + properties: + mountPath: + description: |- + The Vault mountPath here is the mount path to use when authenticating with + Vault. For example, setting a value to `/v1/auth/foo`, will use the path + `/v1/auth/foo/login` to authenticate with Vault. If unspecified, the + default value "/v1/auth/kubernetes" will be used. + type: string + role: + description: |- + A required field containing the Vault Role to assume. A Role binds a + Kubernetes ServiceAccount with a set of Vault policies. + type: string + secretRef: + description: |- + The required Secret field containing a Kubernetes ServiceAccount JWT used + for authenticating with Vault. Use of 'ambient credentials' is not + supported. + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + required: + - name + type: object + serviceAccountRef: + description: |- + A reference to a service account that will be used to request a bound + token (also known as "projected token"). Compared to using "secretRef", + using this field means that you don't rely on statically bound tokens. To + use this field, you must configure an RBAC rule to let cert-manager + request a token. + properties: + audiences: + description: |- + TokenAudiences is an optional list of extra audiences to include in the token passed to Vault. + The default audiences are always included in the token. + items: + type: string + type: array + x-kubernetes-list-type: atomic + name: + description: Name of the ServiceAccount used to request a token. + type: string + required: + - name + type: object + required: + - role + type: object + tokenSecretRef: + description: TokenSecretRef authenticates with Vault by presenting a token. + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + required: + - name + type: object + type: object + caBundle: + description: |- + Base64-encoded bundle of PEM CAs which will be used to validate the certificate + chain presented by Vault. Only used if using HTTPS to connect to Vault and + ignored for HTTP connections. + Mutually exclusive with CABundleSecretRef. + If neither CABundle nor CABundleSecretRef are defined, the certificate bundle in + the cert-manager controller container is used to validate the TLS connection. + format: byte + type: string + caBundleSecretRef: + description: |- + Reference to a Secret containing a bundle of PEM-encoded CAs to use when + verifying the certificate chain presented by Vault when using HTTPS. + Mutually exclusive with CABundle. + If neither CABundle nor CABundleSecretRef are defined, the certificate bundle in + the cert-manager controller container is used to validate the TLS connection. + If no key for the Secret is specified, cert-manager will default to 'ca.crt'. + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + required: + - name + type: object + clientCertSecretRef: + description: |- + Reference to a Secret containing a PEM-encoded Client Certificate to use when the + Vault server requires mTLS. + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + required: + - name + type: object + clientKeySecretRef: + description: |- + Reference to a Secret containing a PEM-encoded Client Private Key to use when the + Vault server requires mTLS. + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + required: + - name + type: object + namespace: + description: |- + Name of the vault namespace. Namespaces is a set of features within Vault Enterprise that allows Vault environments to support Secure Multi-tenancy. e.g: "ns1" + More about namespaces can be found here https://www.vaultproject.io/docs/enterprise/namespaces + type: string + path: + description: |- + Path is the mount path of the Vault PKI backend's `sign` endpoint, e.g: + "my_pki_mount/sign/my-role-name". + type: string + server: + description: 'Server is the connection address for the Vault server, e.g: "https://vault.example.com:8200".' + type: string + serverName: + description: |- + ServerName is used to verify the hostname on the returned certificates + by the Vault server. + type: string + required: + - auth + - path + - server + type: object + venafi: + description: |- + Venafi configures this issuer to sign certificates using a CyberArk Certificate Manager Self-Hosted + or SaaS policy zone. + properties: + cloud: + description: |- + Cloud specifies the CyberArk Certificate Manager SaaS configuration settings. + Only one of CyberArk Certificate Manager may be specified. + properties: + apiTokenSecretRef: + description: APITokenSecretRef is a secret key selector for the CyberArk Certificate Manager SaaS API token. + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + required: + - name + type: object + url: + description: |- + URL is the base URL for CyberArk Certificate Manager SaaS. + Defaults to "https://api.venafi.cloud/". + type: string + required: + - apiTokenSecretRef + type: object + ngts: + description: |- + NGTS specifies Palo Alto Networks Next Generation Trust Services (NGTS) configuration + using OAuth 2.0 Client Credentials. Only one of tpp, cloud, or ngts may be specified. + properties: + credentialsRef: + description: |- + CredentialsRef is a reference to a Kubernetes Secret containing the OAuth 2.0 + Client ID and Client Secret. The secret must contain the keys 'client-id' and + 'client-secret'. + properties: + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + required: + - name + type: object + tokenEndpoint: + description: |- + TokenEndpoint is the OAuth 2.0 token endpoint URL used to obtain access tokens, + for example "https://auth.apps.paloaltonetworks.com/oauth2/access_token". + Defaults to "https://auth.apps.paloaltonetworks.com/oauth2/access_token" if not set. + type: string + tsgID: + description: |- + TSGID is the Tenant Service Group ID used to scope the OAuth 2.0 access token, + for example "1234567890". The tsg_id: prefix is added automatically. + This field is required. + type: string + url: + description: |- + URL is the base URL for the NGTS API endpoint. + Defaults to "https://api.strata.paloaltonetworks.com/ngts" if not set. + type: string + required: + - credentialsRef + - tsgID + type: object + tpp: + description: |- + TPP specifies CyberArk Certificate Manager Self-Hosted configuration settings. + Only one of CyberArk Certificate Manager may be specified. + properties: + caBundle: + description: |- + Base64-encoded bundle of PEM CAs which will be used to validate the certificate + chain presented by the CyberArk Certificate Manager Self-Hosted server. Only used if using HTTPS; ignored for HTTP. + If undefined, the certificate bundle in the cert-manager controller container + is used to validate the chain. + format: byte + type: string + caBundleSecretRef: + description: |- + Reference to a Secret containing a base64-encoded bundle of PEM CAs + which will be used to validate the certificate chain presented by the CyberArk Certificate Manager Self-Hosted server. + Only used if using HTTPS; ignored for HTTP. Mutually exclusive with CABundle. + If neither CABundle nor CABundleSecretRef is defined, the certificate bundle in + the cert-manager controller container is used to validate the TLS connection. + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + required: + - name + type: object + credentialsRef: + description: |- + CredentialsRef is a reference to a Secret containing the CyberArk Certificate Manager Self-Hosted API credentials. + The secret must contain the key 'access-token' for the Access Token Authentication, + or two keys, 'username' and 'password' for the API Keys Authentication. + properties: + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + required: + - name + type: object + url: + description: |- + URL is the base URL for the vedsdk endpoint of the CyberArk Certificate Manager Self-Hosted instance, + for example: "https://tpp.example.com/vedsdk". + type: string + required: + - credentialsRef + - url + type: object + zone: + description: |- + Zone is the Certificate Manager Policy Zone to use for this issuer. + All requests made to the Certificate Manager platform will be restricted by the named + zone policy. + This field is required. + type: string + required: + - zone + type: object + x-kubernetes-validations: + - message: exactly one of tpp, cloud, or ngts must be configured + rule: '(has(self.tpp) ? 1 : 0) + (has(self.cloud) ? 1 : 0) + (has(self.ngts) ? 1 : 0) == 1' + type: object + status: + description: Status of the Issuer. This is set and managed automatically. + properties: + acme: + description: |- + ACME specific status options. + This field should only be set if the Issuer is configured to use an ACME + server to issue certificates. + properties: + lastPrivateKeyHash: + description: |- + LastPrivateKeyHash is a hash of the private key associated with the latest + registered ACME account, in order to track changes made to registered account + associated with the Issuer + type: string + lastRegisteredEmail: + description: |- + LastRegisteredEmail is the email associated with the latest registered + ACME account, in order to track changes made to registered account + associated with the Issuer + type: string + uri: + description: |- + URI is the unique account identifier, which can also be used to retrieve + account details from the CA + type: string + type: object + conditions: + description: |- + List of status conditions to indicate the status of a CertificateRequest. + Known condition types are `Ready`. + items: + description: IssuerCondition contains condition information for an Issuer. + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the timestamp corresponding to the last status + change of this condition. + format: date-time + type: string + message: + description: |- + Message is a human readable description of the details of the last + transition, complementing reason. + type: string + observedGeneration: + description: |- + If set, this represents the .metadata.generation that the condition was + set based upon. + For instance, if .metadata.generation is currently 12, but the + .status.condition[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the Issuer. + format: int64 + type: integer + reason: + description: |- + Reason is a brief machine readable explanation for the condition's last + transition. + type: string + status: + description: Status of the condition, one of (`True`, `False`, `Unknown`). + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: Type of the condition, known values are (`Ready`). + type: string + required: + - status + - type + type: object + type: array + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + type: object + required: + - spec + type: object + served: true + storage: true + subresources: + status: {} + +--- +# Source: cert-manager/templates/cainjector-rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: cert-manager-cainjector + labels: + app: cainjector + app.kubernetes.io/name: cainjector + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "cainjector" + app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/managed-by: Helm + helm.sh/chart: cert-manager-v1.21.1 +rules: + - apiGroups: ["cert-manager.io"] + resources: ["certificates"] + verbs: ["get", "list", "watch"] + - apiGroups: [""] + resources: ["secrets"] + verbs: ["get", "list", "watch"] + - apiGroups: [""] + resources: ["events"] + verbs: ["get", "create", "update", "patch"] + - apiGroups: ["admissionregistration.k8s.io"] + resources: ["validatingwebhookconfigurations", "mutatingwebhookconfigurations"] + verbs: ["get", "list", "watch", "update", "patch"] + - apiGroups: ["apiregistration.k8s.io"] + resources: ["apiservices"] + verbs: ["get", "list", "watch", "update", "patch"] + - apiGroups: ["apiextensions.k8s.io"] + resources: ["customresourcedefinitions"] + verbs: ["get", "list", "watch", "update", "patch"] +--- +# Source: cert-manager/templates/rbac.yaml +# Issuer controller role +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: cert-manager-controller-issuers + labels: + app: cert-manager + app.kubernetes.io/name: cert-manager + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "controller" + app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/managed-by: Helm + helm.sh/chart: cert-manager-v1.21.1 +rules: + - apiGroups: ["cert-manager.io"] + resources: ["issuers", "issuers/status"] + verbs: ["update", "patch"] + - apiGroups: ["cert-manager.io"] + resources: ["issuers"] + verbs: ["get", "list", "watch"] + - apiGroups: [""] + resources: ["secrets"] + verbs: ["get", "list", "watch", "create", "update", "delete"] + - apiGroups: [""] + resources: ["events"] + verbs: ["create", "patch"] +--- +# Source: cert-manager/templates/rbac.yaml +# ClusterIssuer controller role +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: cert-manager-controller-clusterissuers + labels: + app: cert-manager + app.kubernetes.io/name: cert-manager + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "controller" + app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/managed-by: Helm + helm.sh/chart: cert-manager-v1.21.1 +rules: + - apiGroups: ["cert-manager.io"] + resources: ["clusterissuers", "clusterissuers/status"] + verbs: ["update", "patch"] + - apiGroups: ["cert-manager.io"] + resources: ["clusterissuers"] + verbs: ["get", "list", "watch"] + - apiGroups: [""] + resources: ["secrets"] + verbs: ["get", "list", "watch", "create", "update", "delete"] + - apiGroups: [""] + resources: ["events"] + verbs: ["create", "patch"] +--- +# Source: cert-manager/templates/rbac.yaml +# Certificates controller role +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: cert-manager-controller-certificates + labels: + app: cert-manager + app.kubernetes.io/name: cert-manager + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "controller" + app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/managed-by: Helm + helm.sh/chart: cert-manager-v1.21.1 +rules: + - apiGroups: ["cert-manager.io"] + resources: ["certificates", "certificates/status", "certificaterequests", "certificaterequests/status"] + verbs: ["update", "patch"] + - apiGroups: ["cert-manager.io"] + resources: ["certificates", "certificaterequests", "clusterissuers", "issuers"] + verbs: ["get", "list", "watch"] + # We require these rules to support users with the OwnerReferencesPermissionEnforcement + # admission controller enabled: + # https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#ownerreferencespermissionenforcement + - apiGroups: ["cert-manager.io"] + resources: ["certificates/finalizers", "certificaterequests/finalizers"] + verbs: ["update"] + - apiGroups: ["acme.cert-manager.io"] + resources: ["orders"] + verbs: ["create", "delete", "get", "list", "watch"] + - apiGroups: [""] + resources: ["secrets"] + verbs: ["get", "list", "watch", "create", "update", "delete", "patch"] + - apiGroups: [""] + resources: ["events"] + verbs: ["create", "patch"] +--- +# Source: cert-manager/templates/rbac.yaml +# Orders controller role +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: cert-manager-controller-orders + labels: + app: cert-manager + app.kubernetes.io/name: cert-manager + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "controller" + app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/managed-by: Helm + helm.sh/chart: cert-manager-v1.21.1 +rules: + - apiGroups: ["acme.cert-manager.io"] + resources: ["orders", "orders/status"] + verbs: ["update", "patch"] + - apiGroups: ["acme.cert-manager.io"] + resources: ["orders", "challenges"] + verbs: ["get", "list", "watch"] + - apiGroups: ["cert-manager.io"] + resources: ["clusterissuers", "issuers"] + verbs: ["get", "list", "watch"] + - apiGroups: ["acme.cert-manager.io"] + resources: ["challenges"] + verbs: ["create", "delete"] + # We require these rules to support users with the OwnerReferencesPermissionEnforcement + # admission controller enabled: + # https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#ownerreferencespermissionenforcement + - apiGroups: ["acme.cert-manager.io"] + resources: ["orders/finalizers"] + verbs: ["update"] + - apiGroups: ["cert-manager.io"] + resources: ["clusterissuers/finalizers", "issuers/finalizers"] + verbs: ["update"] + - apiGroups: [""] + resources: ["secrets"] + verbs: ["get", "list", "watch"] + - apiGroups: [""] + resources: ["events"] + verbs: ["create", "patch"] +--- +# Source: cert-manager/templates/rbac.yaml +# Challenges controller role +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: cert-manager-controller-challenges + labels: + app: cert-manager + app.kubernetes.io/name: cert-manager + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "controller" + app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/managed-by: Helm + helm.sh/chart: cert-manager-v1.21.1 +rules: + # Use to update challenge resource status + - apiGroups: ["acme.cert-manager.io"] + resources: ["challenges", "challenges/status"] + verbs: ["update", "patch"] + # Used to watch challenge resources + - apiGroups: ["acme.cert-manager.io"] + resources: ["challenges"] + verbs: ["get", "list", "watch"] + # Used to watch challenges, issuer and clusterissuer resources + - apiGroups: ["cert-manager.io"] + resources: ["issuers", "clusterissuers"] + verbs: ["get", "list", "watch"] + # Need to be able to retrieve ACME account private key to complete challenges + - apiGroups: [""] + resources: ["secrets"] + verbs: ["get", "list", "watch"] + # Used to create events + - apiGroups: [""] + resources: ["events"] + verbs: ["create", "patch"] + # HTTP01 rules + - apiGroups: [""] + resources: ["pods", "services"] + verbs: ["get", "list", "watch", "create", "delete"] + - apiGroups: ["networking.k8s.io"] + resources: ["ingresses"] + verbs: ["get", "list", "watch", "create", "delete", "update"] + - apiGroups: ["gateway.networking.k8s.io"] + resources: ["httproutes"] + verbs: ["get", "list", "watch", "create", "delete", "update"] + # We require the ability to specify a custom hostname when we are creating + # new ingress resources. + # See: https://github.com/openshift/origin/blob/21f191775636f9acadb44fa42beeb4f75b255532/pkg/route/apiserver/admission/ingress_admission.go#L84-L148 + - apiGroups: ["route.openshift.io"] + resources: ["routes/custom-host"] + verbs: ["create"] + # We require these rules to support users with the OwnerReferencesPermissionEnforcement + # admission controller enabled: + # https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#ownerreferencespermissionenforcement + - apiGroups: ["acme.cert-manager.io"] + resources: ["challenges/finalizers"] + verbs: ["update"] + # DNS01 rules (duplicated above) + - apiGroups: [""] + resources: ["secrets"] + verbs: ["get", "list", "watch"] +--- +# Source: cert-manager/templates/rbac.yaml +# ingress-shim controller role +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: cert-manager-controller-ingress-shim + labels: + app: cert-manager + app.kubernetes.io/name: cert-manager + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "controller" + app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/managed-by: Helm + helm.sh/chart: cert-manager-v1.21.1 +rules: + - apiGroups: ["cert-manager.io"] + resources: ["certificates", "certificaterequests"] + verbs: ["create", "update", "delete"] + - apiGroups: ["cert-manager.io"] + resources: ["certificates", "certificaterequests", "issuers", "clusterissuers"] + verbs: ["get", "list", "watch"] + - apiGroups: ["networking.k8s.io"] + resources: ["ingresses"] + verbs: ["get", "list", "watch"] + # We require these rules to support users with the OwnerReferencesPermissionEnforcement + # admission controller enabled: + # https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#ownerreferencespermissionenforcement + - apiGroups: ["networking.k8s.io"] + resources: ["ingresses/finalizers"] + verbs: ["update"] + - apiGroups: ["gateway.networking.k8s.io"] + resources: ["gateways", "httproutes", "listenersets"] + verbs: ["get", "list", "watch"] + - apiGroups: ["gateway.networking.k8s.io"] + resources: ["gateways/finalizers", "httproutes/finalizers", "listenersets/finalizers"] + verbs: ["update"] + - apiGroups: [""] + resources: ["events"] + verbs: ["create", "patch"] +--- +# Source: cert-manager/templates/rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: cert-manager-cluster-view + labels: + app: cert-manager + app.kubernetes.io/name: cert-manager + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "controller" + app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/managed-by: Helm + helm.sh/chart: cert-manager-v1.21.1 + rbac.authorization.k8s.io/aggregate-to-cluster-reader: "true" +rules: + - apiGroups: ["cert-manager.io"] + resources: ["clusterissuers"] + verbs: ["get", "list", "watch"] +--- +# Source: cert-manager/templates/rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: cert-manager-view + labels: + app: cert-manager + app.kubernetes.io/name: cert-manager + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "controller" + app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/managed-by: Helm + helm.sh/chart: cert-manager-v1.21.1 + rbac.authorization.k8s.io/aggregate-to-view: "true" + rbac.authorization.k8s.io/aggregate-to-edit: "true" + rbac.authorization.k8s.io/aggregate-to-admin: "true" + rbac.authorization.k8s.io/aggregate-to-cluster-reader: "true" +rules: + - apiGroups: ["cert-manager.io"] + resources: ["certificates", "certificaterequests", "issuers"] + verbs: ["get", "list", "watch"] + - apiGroups: ["acme.cert-manager.io"] + resources: ["challenges", "orders"] + verbs: ["get", "list", "watch"] +--- +# Source: cert-manager/templates/rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: cert-manager-edit + labels: + app: cert-manager + app.kubernetes.io/name: cert-manager + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "controller" + app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/managed-by: Helm + helm.sh/chart: cert-manager-v1.21.1 + rbac.authorization.k8s.io/aggregate-to-edit: "true" + rbac.authorization.k8s.io/aggregate-to-admin: "true" +rules: + - apiGroups: ["cert-manager.io"] + resources: ["certificates", "certificaterequests", "issuers"] + verbs: ["create", "delete", "deletecollection", "patch", "update"] + - apiGroups: ["cert-manager.io"] + resources: ["certificates/status"] + verbs: ["update"] + - apiGroups: ["acme.cert-manager.io"] + resources: ["challenges"] + verbs: ["delete", "deletecollection", "patch", "update"] + - apiGroups: ["acme.cert-manager.io"] + resources: ["orders"] + verbs: ["delete", "deletecollection"] +--- +# Source: cert-manager/templates/rbac.yaml +# Permission to approve CertificateRequests referencing cert-manager.io Issuers and ClusterIssuers +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: cert-manager-controller-approve:cert-manager-io + labels: + app: cert-manager + app.kubernetes.io/name: cert-manager + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "cert-manager" + app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/managed-by: Helm + helm.sh/chart: cert-manager-v1.21.1 +rules: + - apiGroups: ["cert-manager.io"] + resources: ["signers"] + verbs: ["approve"] + resourceNames: + - "issuers.cert-manager.io/*" + - "clusterissuers.cert-manager.io/*" +--- +# Source: cert-manager/templates/rbac.yaml +# Permission to: +# - Update and sign CertificateSigningRequests referencing cert-manager.io Issuers and ClusterIssuers +# - Perform SubjectAccessReviews to test whether users are able to reference Namespaced Issuers +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: cert-manager-controller-certificatesigningrequests + labels: + app: cert-manager + app.kubernetes.io/name: cert-manager + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "cert-manager" + app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/managed-by: Helm + helm.sh/chart: cert-manager-v1.21.1 +rules: + - apiGroups: ["certificates.k8s.io"] + resources: ["certificatesigningrequests"] + verbs: ["get", "list", "watch", "update"] + - apiGroups: ["certificates.k8s.io"] + resources: ["certificatesigningrequests/status"] + verbs: ["update", "patch"] + - apiGroups: ["certificates.k8s.io"] + resources: ["signers"] + resourceNames: ["issuers.cert-manager.io/*", "clusterissuers.cert-manager.io/*"] + verbs: ["sign"] + - apiGroups: ["authorization.k8s.io"] + resources: ["subjectaccessreviews"] + verbs: ["create"] +--- +# Source: cert-manager/templates/webhook-rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: cert-manager-webhook:subjectaccessreviews + labels: + app: webhook + app.kubernetes.io/name: webhook + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "webhook" + app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/managed-by: Helm + helm.sh/chart: cert-manager-v1.21.1 +rules: +- apiGroups: ["authorization.k8s.io"] + resources: ["subjectaccessreviews"] + verbs: ["create"] +--- +# Source: cert-manager/templates/cainjector-rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: cert-manager-cainjector + labels: + app: cainjector + app.kubernetes.io/name: cainjector + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "cainjector" + app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/managed-by: Helm + helm.sh/chart: cert-manager-v1.21.1 +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: cert-manager-cainjector +subjects: + - name: cert-manager-cainjector + namespace: cert-manager + kind: ServiceAccount +--- +# Source: cert-manager/templates/rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: cert-manager-controller-issuers + labels: + app: cert-manager + app.kubernetes.io/name: cert-manager + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "controller" + app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/managed-by: Helm + helm.sh/chart: cert-manager-v1.21.1 +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: cert-manager-controller-issuers +subjects: + - name: cert-manager + namespace: cert-manager + kind: ServiceAccount +--- +# Source: cert-manager/templates/rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: cert-manager-controller-clusterissuers + labels: + app: cert-manager + app.kubernetes.io/name: cert-manager + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "controller" + app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/managed-by: Helm + helm.sh/chart: cert-manager-v1.21.1 +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: cert-manager-controller-clusterissuers +subjects: + - name: cert-manager + namespace: cert-manager + kind: ServiceAccount +--- +# Source: cert-manager/templates/rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: cert-manager-controller-certificates + labels: + app: cert-manager + app.kubernetes.io/name: cert-manager + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "controller" + app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/managed-by: Helm + helm.sh/chart: cert-manager-v1.21.1 +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: cert-manager-controller-certificates +subjects: + - name: cert-manager + namespace: cert-manager + kind: ServiceAccount +--- +# Source: cert-manager/templates/rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: cert-manager-controller-orders + labels: + app: cert-manager + app.kubernetes.io/name: cert-manager + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "controller" + app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/managed-by: Helm + helm.sh/chart: cert-manager-v1.21.1 +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: cert-manager-controller-orders +subjects: + - name: cert-manager + namespace: cert-manager + kind: ServiceAccount +--- +# Source: cert-manager/templates/rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: cert-manager-controller-challenges + labels: + app: cert-manager + app.kubernetes.io/name: cert-manager + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "controller" + app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/managed-by: Helm + helm.sh/chart: cert-manager-v1.21.1 +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: cert-manager-controller-challenges +subjects: + - name: cert-manager + namespace: cert-manager + kind: ServiceAccount +--- +# Source: cert-manager/templates/rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: cert-manager-controller-ingress-shim + labels: + app: cert-manager + app.kubernetes.io/name: cert-manager + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "controller" + app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/managed-by: Helm + helm.sh/chart: cert-manager-v1.21.1 +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: cert-manager-controller-ingress-shim +subjects: + - name: cert-manager + namespace: cert-manager + kind: ServiceAccount +--- +# Source: cert-manager/templates/rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: cert-manager-controller-approve:cert-manager-io + labels: + app: cert-manager + app.kubernetes.io/name: cert-manager + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "cert-manager" + app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/managed-by: Helm + helm.sh/chart: cert-manager-v1.21.1 +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: cert-manager-controller-approve:cert-manager-io +subjects: + - name: cert-manager + namespace: cert-manager + kind: ServiceAccount +--- +# Source: cert-manager/templates/rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: cert-manager-controller-certificatesigningrequests + labels: + app: cert-manager + app.kubernetes.io/name: cert-manager + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "cert-manager" + app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/managed-by: Helm + helm.sh/chart: cert-manager-v1.21.1 +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: cert-manager-controller-certificatesigningrequests +subjects: + - name: cert-manager + namespace: cert-manager + kind: ServiceAccount + +--- +# Source: cert-manager/templates/webhook-rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: cert-manager-webhook:subjectaccessreviews + labels: + app: webhook + app.kubernetes.io/name: webhook + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "webhook" + app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/managed-by: Helm + helm.sh/chart: cert-manager-v1.21.1 +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: cert-manager-webhook:subjectaccessreviews +subjects: +- kind: ServiceAccount + name: cert-manager-webhook + namespace: cert-manager + +--- +# Source: cert-manager/templates/cainjector-rbac.yaml +# leader election rules +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: cert-manager-cainjector:leaderelection + namespace: cert-manager + labels: + app: cainjector + app.kubernetes.io/name: cainjector + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "cainjector" + app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/managed-by: Helm + helm.sh/chart: cert-manager-v1.21.1 +rules: + # Used for leader election by the controller + # cert-manager-cainjector-leader-election is used by the CertificateBased injector controller + # see cmd/cainjector/start.go#L113 + # cert-manager-cainjector-leader-election-core is used by the SecretBased injector controller + # see cmd/cainjector/start.go#L137 + - apiGroups: ["coordination.k8s.io"] + resources: ["leases"] + resourceNames: ["cert-manager-cainjector-leader-election", "cert-manager-cainjector-leader-election-core"] + verbs: ["get", "update", "patch"] + - apiGroups: ["coordination.k8s.io"] + resources: ["leases"] + verbs: ["create"] +--- +# Source: cert-manager/templates/rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: cert-manager:leaderelection + namespace: cert-manager + labels: + app: cert-manager + app.kubernetes.io/name: cert-manager + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "controller" + app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/managed-by: Helm + helm.sh/chart: cert-manager-v1.21.1 +rules: + - apiGroups: ["coordination.k8s.io"] + resources: ["leases"] + resourceNames: ["cert-manager-controller"] + verbs: ["get", "update", "patch"] + - apiGroups: ["coordination.k8s.io"] + resources: ["leases"] + verbs: ["create"] +--- +# Source: cert-manager/templates/webhook-rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: cert-manager-webhook:dynamic-serving + namespace: cert-manager + labels: + app: webhook + app.kubernetes.io/name: webhook + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "webhook" + app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/managed-by: Helm + helm.sh/chart: cert-manager-v1.21.1 +rules: +- apiGroups: [""] + resources: ["secrets"] + resourceNames: + - 'cert-manager-webhook-ca' + verbs: ["get", "list", "watch", "update"] +# It's not possible to grant CREATE permission on a single resourceName. +- apiGroups: [""] + resources: ["secrets"] + verbs: ["create"] +--- +# Source: cert-manager/templates/cainjector-rbac.yaml +# grant cert-manager permission to manage the leaderelection configmap in the +# leader election namespace +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: cert-manager-cainjector:leaderelection + namespace: cert-manager + labels: + app: cainjector + app.kubernetes.io/name: cainjector + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "cainjector" + app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/managed-by: Helm + helm.sh/chart: cert-manager-v1.21.1 +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: cert-manager-cainjector:leaderelection +subjects: + - kind: ServiceAccount + name: cert-manager-cainjector + namespace: cert-manager + +--- +# Source: cert-manager/templates/rbac.yaml +# grant cert-manager permission to manage the leaderelection configmap in the +# leader election namespace +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: cert-manager:leaderelection + namespace: cert-manager + labels: + app: cert-manager + app.kubernetes.io/name: cert-manager + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "controller" + app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/managed-by: Helm + helm.sh/chart: cert-manager-v1.21.1 +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: cert-manager:leaderelection +subjects: + - kind: ServiceAccount + name: cert-manager + namespace: cert-manager +--- +# Source: cert-manager/templates/webhook-rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: cert-manager-webhook:dynamic-serving + namespace: cert-manager + labels: + app: webhook + app.kubernetes.io/name: webhook + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "webhook" + app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/managed-by: Helm + helm.sh/chart: cert-manager-v1.21.1 +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: cert-manager-webhook:dynamic-serving +subjects: +- kind: ServiceAccount + name: cert-manager-webhook + namespace: cert-manager +--- +# Source: cert-manager/templates/cainjector-service.yaml +apiVersion: v1 +kind: Service +metadata: + name: cert-manager-cainjector + namespace: cert-manager + labels: + app: cainjector + app.kubernetes.io/name: cainjector + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "cainjector" + app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/managed-by: Helm + helm.sh/chart: cert-manager-v1.21.1 +spec: + type: ClusterIP + ports: + - protocol: TCP + port: 9402 + name: http-metrics + selector: + app.kubernetes.io/name: cainjector + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "cainjector" + +--- +# Source: cert-manager/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + name: cert-manager + namespace: cert-manager + labels: + app: cert-manager + app.kubernetes.io/name: cert-manager + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "controller" + app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/managed-by: Helm + helm.sh/chart: cert-manager-v1.21.1 +spec: + type: ClusterIP + ports: + - protocol: TCP + port: 9402 + name: http-metrics + selector: + app.kubernetes.io/name: cert-manager + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "controller" + +--- +# Source: cert-manager/templates/webhook-service.yaml +apiVersion: v1 +kind: Service +metadata: + name: cert-manager-webhook + namespace: cert-manager + labels: + app: webhook + app.kubernetes.io/name: webhook + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "webhook" + app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/managed-by: Helm + helm.sh/chart: cert-manager-v1.21.1 +spec: + type: ClusterIP + ports: + - name: https + port: 443 + protocol: TCP + targetPort: "https" + - name: metrics + port: 9402 + protocol: TCP + targetPort: "http-metrics" + selector: + app.kubernetes.io/name: webhook + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "webhook" + +--- +# Source: cert-manager/templates/cainjector-deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + name: cert-manager-cainjector + namespace: cert-manager + labels: + app: cainjector + app.kubernetes.io/name: cainjector + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "cainjector" + app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/managed-by: Helm + helm.sh/chart: cert-manager-v1.21.1 +spec: + replicas: 1 + selector: + matchLabels: + app.kubernetes.io/name: cainjector + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "cainjector" + template: + metadata: + labels: + app: cainjector + app.kubernetes.io/name: cainjector + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "cainjector" + app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/managed-by: Helm + helm.sh/chart: cert-manager-v1.21.1 + annotations: + prometheus.io/path: "/metrics" + prometheus.io/scrape: 'true' + prometheus.io/port: '9402' + spec: + serviceAccountName: cert-manager-cainjector + enableServiceLinks: false + securityContext: + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault + containers: + - name: cert-manager-cainjector + image: "quay.io/jetstack/cert-manager-cainjector:v1.21.1" + imagePullPolicy: IfNotPresent + args: + - --v=2 + - --leader-election-namespace=cert-manager + ports: + - containerPort: 9402 + name: http-metrics + protocol: TCP + env: + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + nodeSelector: + kubernetes.io/os: "linux" + +--- +# Source: cert-manager/templates/deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + name: cert-manager + namespace: cert-manager + labels: + app: cert-manager + app.kubernetes.io/name: cert-manager + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "controller" + app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/managed-by: Helm + helm.sh/chart: cert-manager-v1.21.1 +spec: + replicas: 1 + selector: + matchLabels: + app.kubernetes.io/name: cert-manager + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "controller" + template: + metadata: + labels: + app: cert-manager + app.kubernetes.io/name: cert-manager + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "controller" + app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/managed-by: Helm + helm.sh/chart: cert-manager-v1.21.1 + annotations: + prometheus.io/path: "/metrics" + prometheus.io/scrape: 'true' + prometheus.io/port: '9402' + spec: + serviceAccountName: cert-manager + enableServiceLinks: false + securityContext: + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault + containers: + - name: cert-manager-controller + image: "quay.io/jetstack/cert-manager-controller:v1.21.1" + imagePullPolicy: IfNotPresent + args: + - --v=2 + - --cluster-resource-namespace=$(POD_NAMESPACE) + - --leader-election-namespace=cert-manager + - --acme-http01-solver-image=quay.io/jetstack/cert-manager-acmesolver:v1.21.1 + - --max-concurrent-challenges=60 + ports: + - containerPort: 9402 + name: http-metrics + protocol: TCP + - containerPort: 9403 + name: http-healthz + protocol: TCP + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + env: + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + # LivenessProbe settings are based on those used for the Kubernetes + # controller-manager. See: + # https://github.com/kubernetes/kubernetes/blob/806b30170c61a38fedd54cc9ede4cd6275a1ad3b/cmd/kubeadm/app/util/staticpod/utils.go#L241-L245 + livenessProbe: + httpGet: + port: http-healthz + path: /livez + scheme: HTTP + initialDelaySeconds: 10 + periodSeconds: 10 + timeoutSeconds: 15 + successThreshold: 1 + failureThreshold: 8 + nodeSelector: + kubernetes.io/os: "linux" + +--- +# Source: cert-manager/templates/webhook-deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + name: cert-manager-webhook + namespace: cert-manager + labels: + app: webhook + app.kubernetes.io/name: webhook + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "webhook" + app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/managed-by: Helm + helm.sh/chart: cert-manager-v1.21.1 +spec: + replicas: 1 + selector: + matchLabels: + app.kubernetes.io/name: webhook + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "webhook" + template: + metadata: + labels: + app: webhook + app.kubernetes.io/name: webhook + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "webhook" + app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/managed-by: Helm + helm.sh/chart: cert-manager-v1.21.1 + annotations: + prometheus.io/path: "/metrics" + prometheus.io/scrape: 'true' + prometheus.io/port: '9402' + spec: + serviceAccountName: cert-manager-webhook + enableServiceLinks: false + securityContext: + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault + containers: + - name: cert-manager-webhook + image: "quay.io/jetstack/cert-manager-webhook:v1.21.1" + imagePullPolicy: IfNotPresent + args: + - --v=2 + - --secure-port=10250 + - --dynamic-serving-ca-secret-namespace=$(POD_NAMESPACE) + - --dynamic-serving-ca-secret-name=cert-manager-webhook-ca + - --dynamic-serving-dns-names=cert-manager-webhook + - --dynamic-serving-dns-names=cert-manager-webhook.$(POD_NAMESPACE) + - --dynamic-serving-dns-names=cert-manager-webhook.$(POD_NAMESPACE).svc + ports: + - name: https + protocol: TCP + containerPort: 10250 + - name: healthcheck + protocol: TCP + containerPort: 6080 + - containerPort: 9402 + name: http-metrics + protocol: TCP + livenessProbe: + httpGet: + path: /livez + port: healthcheck + scheme: HTTP + initialDelaySeconds: 60 + periodSeconds: 10 + timeoutSeconds: 1 + successThreshold: 1 + failureThreshold: 3 + readinessProbe: + httpGet: + path: /healthz + port: healthcheck + scheme: HTTP + initialDelaySeconds: 5 + periodSeconds: 5 + timeoutSeconds: 1 + successThreshold: 1 + failureThreshold: 3 + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + env: + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + nodeSelector: + kubernetes.io/os: "linux" + +--- +# Source: cert-manager/templates/webhook-mutating-webhook.yaml +apiVersion: admissionregistration.k8s.io/v1 +kind: MutatingWebhookConfiguration +metadata: + name: cert-manager-webhook + labels: + app: webhook + app.kubernetes.io/name: webhook + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "webhook" + app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/managed-by: Helm + helm.sh/chart: cert-manager-v1.21.1 + annotations: + cert-manager.io/inject-ca-from-secret: "cert-manager/cert-manager-webhook-ca" +webhooks: + - name: webhook.cert-manager.io + rules: + - apiGroups: + - "cert-manager.io" + apiVersions: + - "v1" + operations: + - CREATE + resources: + - "certificaterequests" + admissionReviewVersions: ["v1"] + # This webhook only accepts v1 cert-manager resources. + # Equivalent matchPolicy ensures that non-v1 resource requests are sent to + # this webhook (after the resources have been converted to v1). + matchPolicy: Equivalent + timeoutSeconds: 30 + failurePolicy: Fail + # Only include 'sideEffects' field in Kubernetes 1.12+ + sideEffects: None + clientConfig: + service: + name: cert-manager-webhook + namespace: cert-manager + path: /mutate +--- +# Source: cert-manager/templates/webhook-validating-webhook.yaml +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingWebhookConfiguration +metadata: + name: cert-manager-webhook + labels: + app: webhook + app.kubernetes.io/name: webhook + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "webhook" + app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/managed-by: Helm + helm.sh/chart: cert-manager-v1.21.1 + annotations: + cert-manager.io/inject-ca-from-secret: "cert-manager/cert-manager-webhook-ca" +webhooks: + - name: webhook.cert-manager.io + namespaceSelector: + matchExpressions: + - key: cert-manager.io/disable-validation + operator: NotIn + values: + - "true" + rules: + - apiGroups: + - "cert-manager.io" + - "acme.cert-manager.io" + apiVersions: + - "v1" + operations: + - CREATE + - UPDATE + resources: + - "*/*" + admissionReviewVersions: ["v1"] + # This webhook only accepts v1 cert-manager resources. + # Equivalent matchPolicy ensures that non-v1 resource requests are sent to + # this webhook (after the resources have been converted to v1). + matchPolicy: Equivalent + timeoutSeconds: 30 + failurePolicy: Fail + sideEffects: None + clientConfig: + service: + name: cert-manager-webhook + namespace: cert-manager + path: /validate +--- +# Source: cert-manager/templates/startupapicheck-serviceaccount.yaml +apiVersion: v1 +kind: ServiceAccount +automountServiceAccountToken: true +metadata: + name: cert-manager-startupapicheck + namespace: cert-manager + annotations: + helm.sh/hook: post-install + helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded + helm.sh/hook-weight: "-5" + labels: + app: startupapicheck + app.kubernetes.io/name: startupapicheck + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "startupapicheck" + app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/managed-by: Helm + helm.sh/chart: cert-manager-v1.21.1 + +--- +# Source: cert-manager/templates/startupapicheck-rbac.yaml +# create certificate role +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: cert-manager-startupapicheck:create-cert + namespace: cert-manager + labels: + app: startupapicheck + app.kubernetes.io/name: startupapicheck + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "startupapicheck" + app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/managed-by: Helm + helm.sh/chart: cert-manager-v1.21.1 + annotations: + helm.sh/hook: post-install + helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded + helm.sh/hook-weight: "-5" +rules: + - apiGroups: ["cert-manager.io"] + resources: ["certificaterequests"] + verbs: ["create"] +--- +# Source: cert-manager/templates/startupapicheck-rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: cert-manager-startupapicheck:create-cert + namespace: cert-manager + labels: + app: startupapicheck + app.kubernetes.io/name: startupapicheck + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "startupapicheck" + app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/managed-by: Helm + helm.sh/chart: cert-manager-v1.21.1 + annotations: + helm.sh/hook: post-install + helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded + helm.sh/hook-weight: "-5" +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: cert-manager-startupapicheck:create-cert +subjects: + - kind: ServiceAccount + name: cert-manager-startupapicheck + namespace: cert-manager + +--- +# Source: cert-manager/templates/startupapicheck-job.yaml +apiVersion: batch/v1 +kind: Job +metadata: + name: cert-manager-startupapicheck + namespace: cert-manager + labels: + app: startupapicheck + app.kubernetes.io/name: startupapicheck + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "startupapicheck" + app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/managed-by: Helm + helm.sh/chart: cert-manager-v1.21.1 + annotations: + helm.sh/hook: post-install + helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded + helm.sh/hook-weight: "1" +spec: + backoffLimit: 4 + template: + metadata: + labels: + app: startupapicheck + app.kubernetes.io/name: startupapicheck + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "startupapicheck" + app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/managed-by: Helm + helm.sh/chart: cert-manager-v1.21.1 + spec: + restartPolicy: OnFailure + serviceAccountName: cert-manager-startupapicheck + enableServiceLinks: false + securityContext: + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault + containers: + - name: cert-manager-startupapicheck + image: "quay.io/jetstack/cert-manager-startupapicheck:v1.21.1" + imagePullPolicy: IfNotPresent + args: + - check + - api + - --wait=1m + - -v + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + env: + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + nodeSelector: + kubernetes.io/os: "linux" + diff --git a/packages/manifests/operators/cilium.yaml b/packages/manifests/operators/cilium.yaml new file mode 100644 index 0000000..ec5c220 --- /dev/null +++ b/packages/manifests/operators/cilium.yaml @@ -0,0 +1,1789 @@ +# Source: cilium/cilium@1.19.5 +--- +# Added by pull-manifests.ts to ensure namespace exists +apiVersion: v1 +kind: Namespace +metadata: + name: kube-system + labels: + app.kubernetes.io/name: kube-system + +--- +--- +# Source: cilium/templates/cilium-secrets-namespace.yaml +apiVersion: v1 +kind: Namespace +metadata: + name: "cilium-secrets" + labels: + app.kubernetes.io/part-of: cilium + annotations: + +--- +# Source: cilium/templates/cilium-agent/serviceaccount.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: "cilium" + namespace: kube-system + +--- +# Source: cilium/templates/cilium-envoy/serviceaccount.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: "cilium-envoy" + namespace: kube-system + +--- +# Source: cilium/templates/cilium-operator/serviceaccount.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: "cilium-operator" + namespace: kube-system + +--- +# Source: cilium/templates/cilium-ca-secret.yaml +apiVersion: v1 +kind: Secret +metadata: + name: cilium-ca + namespace: kube-system + labels: + cilium.io/helm-template-non-idempotent: "true" +data: + ca.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURFekNDQWZ1Z0F3SUJBZ0lRVlpkb3h2NDVNSDh4WFVZQk9RME9MakFOQmdrcWhraUc5dzBCQVFzRkFEQVUKTVJJd0VBWURWUVFERXdsRGFXeHBkVzBnUTBFd0hoY05Nall3T0RFeU1qRXpOVFF5V2hjTk1qa3dPREV4TWpFegpOVFF5V2pBVU1SSXdFQVlEVlFRREV3bERhV3hwZFcwZ1EwRXdnZ0VpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElCCkR3QXdnZ0VLQW9JQkFRRE56RnYxUFZEaENUSlRFT01oaFZhR243YlB4M3hISnQ5bFIrRDhxck1qb1pleWZ5MmkKZkhOYXl4YUlSeVBkMzRselpCejJuRCtpMnhCM3VrcC9EYTU1aUNUSFdRdkJXVWhtRWgyaG5TM0ErUFVRdDVZRgpvZWV2a3Z0eEFLczB4YnBoR0hJNjlqTkRLZHFJYkxIOXl3UWdOdUZ1bGVZdWFMazIwd0F4dTJWVDFYZisvVklPClgrVlZTZkg0aEkveFUyT2F4OUtyYTlkQ1RkVDdWQ2M0SFVxRFF2SlMwQlJGeDNPaTFFVElUT2Vzd3kreklQNzYKL0dLamJsMWFobzB0VGJTWXJ5SWJqSzQweVF5cGcxNnAyb25Eeks4SkZFSHBnVG1VSy9FNE8zd1BIL05yVEdhTQpkV2lTVmZQbzduaE1OdFFsNXVHWFh3alJlVWhuQmdXU2l4a0xBZ01CQUFHallUQmZNQTRHQTFVZER3RUIvd1FFCkF3SUNwREFkQmdOVkhTVUVGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXcKQXdFQi96QWRCZ05WSFE0RUZnUVV3L0s4V1p4WU1YUGJLY2xRd1haZ3Y1LzZONTB3RFFZSktvWklodmNOQVFFTApCUUFEZ2dFQkFIRDNQNWt3SE1ycnQxSHM0TGlkS2UxbTJmQ2FmcVV3b1JiSC9BaWJZd1pTNVdXUzkwNXduNEplCkovejdmampOWnI5enRHZklCM0RZVDZqTWh0ejQ3ZkhQM0pzYVU3enNxL1RsME5HbDBSTXBLbnk4VFBYcHFvNUcKMWNNUTBxdFUvSGcrYWJuVUxJRDVUa25JWktDOWRZT1dVcGtGNHBBcEtXWTViUVMxZldPTGJ6ay8zbmVTVlNkRgp2MUIxZXpvNG9TZ0o4Q3RqOXdjOWtEVUMvTWdjNUNmdGgyNWVTZ1o3SytqaC9LUE1DK0VVRmJ5TEJTTGVsZi9rCmhjYzYwVUdNQ1FxNllPbWNiZjF6QitucTBHUDdXZUYrZHI5MnowS1BnWEZKQmVOU3U4WlN6dlgwbkRKdUM4QjEKSEdRS2hUWjlGWUJkN3V6bXFZZVBrT3huNytIbnB3QT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo= + ca.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFcEFJQkFBS0NBUUVBemN4YjlUMVE0UWt5VXhEaklZVldocCsyejhkOFJ5YmZaVWZnL0txekk2R1hzbjh0Cm9ueHpXc3NXaUVjajNkK0pjMlFjOXB3L290c1FkN3BLZncydWVZZ2t4MWtMd1ZsSVpoSWRvWjB0d1BqMUVMZVcKQmFIbnI1TDdjUUNyTk1XNllSaHlPdll6UXluYWlHeXgvY3NFSURiaGJwWG1MbWk1TnRNQU1idGxVOVYzL3YxUwpEbC9sVlVueCtJU1A4Vk5qbXNmU3EydlhRazNVKzFRbk9CMUtnMEx5VXRBVVJjZHpvdFJFeUV6bnJNTXZzeUQrCit2eGlvMjVkV29hTkxVMjBtSzhpRzR5dU5Na01xWU5lcWRxSnc4eXZDUlJCNllFNWxDdnhPRHQ4RHgvemEweG0KakhWb2tsWHo2TzU0VERiVUplYmhsMThJMFhsSVp3WUZrb3NaQ3dJREFRQUJBb0lCQUNJRTZhQ1pBYkVwZFlXdwpzWE1kbVFlSkNFM0JrcVFxWTF4WkxQSm5mMVJoQm5RTnZPdnl1WmpsSUhUbm1hQzRMbjhDS2gyRUI2cnlubjdFCkwwTmdiaHFON0ZKOXdFazJhcGJnNE1BUi9QbTh6Ym4xTnhuNFFSWFBiTHdwMmFOUUdqYXB0VnhVelhXSlNpUXEKSDZRdDlxRWlvVkpIK2pScXdFODFRdjkxbEZMdWx6OUlJSGNEOE10STQ0QnFBQ0hHVEVhUzZ2ZFR2QWl6M1pMUApzVVAwZTQweXlYKzhDcmpjdytnSkcwYUVMNytqL3YrMmhLNmVJMzJUcGc4YStqNjlQMmxPNE10eUp1UWNmKzJUCjJCQXk3Z1R1KzVmazM3Q0hvVEIrN1NWekFDQTdObW92cFkyeDJXYTJVVXBLOEZkTEdQS255cE1SbTNSRklCVFcKaWo2SzFWRUNnWUVBOEcvYm1qWTFFQVVEejRSbHJYSzlpeCtiQTM1RXFBV21KM2lkVkJGMGxoazl6d0o1OGFyRgpoZTduTFJtOUxOMmwxSW9UV1lmVlFuWWRjZ3dicHhzR3RwZ2tZUDFtMGFXbWZvR0NSN0h3TW56ZThRUFNZVCtkCjJZUkhPc3VJUERZdmdRL1dtRjZ6enVhQXpKdHJ2SFlUUUpuQW4weGx0MmVGQlJROU9BNEpCUHNDZ1lFQTJ4NkcKSkR2VXJtbWdCSlBlT0JQS0ZGY0tJWGFtbEU1QURVclNiRjM0ejhraTRrdFRhekJFOENFeFhYNjQrMjR6V2tyOApkU2hxQWsyWGlSR1hrRS9BZ2d3cFROWXh6NEpJV2VoWmJieitQcEFacFp6OUs1TUVxbEZTd1l1d0lOL1J5Mnd6CmJBS000L0NzdGNTVU1ZV3cwa2U3MkliSE5ZNTVHdFZqQTB4b1h6RUNnWUVBbWJHWE9pT3VsYmZ1OEtjY2E5eHQKeDFJRHdCN2wrbFhxR1U4am1zcXhzUVVmbW9WbHVCTEd3cyt0WFFvWUFHY0xDeXJjSlo0THQ3bFRKMFVRSkNqRgppTkVHYUMxem5VMzdlT0NHakJmMWlBQ0VicUpYeUN4blZkVVZ4MEsxcW0ra3ZDYUlzY3ZQdXRGandlY1QzbHZJCkFNS0gvQXhVOVFFcWFjMi9PR2JZWXlNQ2dZQlJaSTAvZUZvUVQzdjVOMVFjVUgySUFLenFzVUEvWnJHMFBrN2IKb2l5Q1FweUtvcUJoK0pRaS9yRnZvVnJsU3BJWXdESDI4d1F0eHRTN1BhV25IWGpNMWVlaGV3OFZuYmR5YmpTSgo1dUlxS3l6YnIrejYrcW1JK3B4YStLQjhGYWZBZ0hpNWJsa1hjcGMxRGNoZWZPS3B1YXUxU3B0RThaOWFzRmtQCktKcThnUUtCZ1FDZ2xRZzFnQ09YMzhOa2dFNEc5ak9FdHFQMGxFMFNMbmtHckYwQVJiYkJ4aGlwOTdyVFhCeWMKMkpPRHJaWTA1Z0lPVWxWdVpieU8rdXpQaDNiZERxTUpYQ3pjWm9rVjRoU1piOFlwSVVVU0hQdGhOandmazcrdwovUXlickpLUndQNS91bnVPVzFMVEtYbUg3ZjVlVGpqeDBXc0FMZWtVc3J3VnppWWNVWEJmVVE9PQotLS0tLUVORCBSU0EgUFJJVkFURSBLRVktLS0tLQo= + +--- +# Source: cilium/templates/hubble/tls-helm/server-secret.yaml +apiVersion: v1 +kind: Secret +metadata: + name: hubble-server-certs + namespace: kube-system + labels: + cilium.io/helm-template-non-idempotent: "true" + + annotations: +type: kubernetes.io/tls +data: + ca.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURFekNDQWZ1Z0F3SUJBZ0lRVlpkb3h2NDVNSDh4WFVZQk9RME9MakFOQmdrcWhraUc5dzBCQVFzRkFEQVUKTVJJd0VBWURWUVFERXdsRGFXeHBkVzBnUTBFd0hoY05Nall3T0RFeU1qRXpOVFF5V2hjTk1qa3dPREV4TWpFegpOVFF5V2pBVU1SSXdFQVlEVlFRREV3bERhV3hwZFcwZ1EwRXdnZ0VpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElCCkR3QXdnZ0VLQW9JQkFRRE56RnYxUFZEaENUSlRFT01oaFZhR243YlB4M3hISnQ5bFIrRDhxck1qb1pleWZ5MmkKZkhOYXl4YUlSeVBkMzRselpCejJuRCtpMnhCM3VrcC9EYTU1aUNUSFdRdkJXVWhtRWgyaG5TM0ErUFVRdDVZRgpvZWV2a3Z0eEFLczB4YnBoR0hJNjlqTkRLZHFJYkxIOXl3UWdOdUZ1bGVZdWFMazIwd0F4dTJWVDFYZisvVklPClgrVlZTZkg0aEkveFUyT2F4OUtyYTlkQ1RkVDdWQ2M0SFVxRFF2SlMwQlJGeDNPaTFFVElUT2Vzd3kreklQNzYKL0dLamJsMWFobzB0VGJTWXJ5SWJqSzQweVF5cGcxNnAyb25Eeks4SkZFSHBnVG1VSy9FNE8zd1BIL05yVEdhTQpkV2lTVmZQbzduaE1OdFFsNXVHWFh3alJlVWhuQmdXU2l4a0xBZ01CQUFHallUQmZNQTRHQTFVZER3RUIvd1FFCkF3SUNwREFkQmdOVkhTVUVGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXcKQXdFQi96QWRCZ05WSFE0RUZnUVV3L0s4V1p4WU1YUGJLY2xRd1haZ3Y1LzZONTB3RFFZSktvWklodmNOQVFFTApCUUFEZ2dFQkFIRDNQNWt3SE1ycnQxSHM0TGlkS2UxbTJmQ2FmcVV3b1JiSC9BaWJZd1pTNVdXUzkwNXduNEplCkovejdmampOWnI5enRHZklCM0RZVDZqTWh0ejQ3ZkhQM0pzYVU3enNxL1RsME5HbDBSTXBLbnk4VFBYcHFvNUcKMWNNUTBxdFUvSGcrYWJuVUxJRDVUa25JWktDOWRZT1dVcGtGNHBBcEtXWTViUVMxZldPTGJ6ay8zbmVTVlNkRgp2MUIxZXpvNG9TZ0o4Q3RqOXdjOWtEVUMvTWdjNUNmdGgyNWVTZ1o3SytqaC9LUE1DK0VVRmJ5TEJTTGVsZi9rCmhjYzYwVUdNQ1FxNllPbWNiZjF6QitucTBHUDdXZUYrZHI5MnowS1BnWEZKQmVOU3U4WlN6dlgwbkRKdUM4QjEKSEdRS2hUWjlGWUJkN3V6bXFZZVBrT3huNytIbnB3QT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo= + tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURWekNDQWorZ0F3SUJBZ0lSQU9FVnZPc0tSQTRpM0R1akJxNlFkdHN3RFFZSktvWklodmNOQVFFTEJRQXcKRkRFU01CQUdBMVVFQXhNSlEybHNhWFZ0SUVOQk1CNFhEVEkyTURneE1qSXhNelUwTWxvWERUSTNNRGd4TWpJeApNelUwTWxvd0tqRW9NQ1lHQTFVRUF3d2ZLaTVrWldaaGRXeDBMbWgxWW1Kc1pTMW5jbkJqTG1OcGJHbDFiUzVwCmJ6Q0NBU0l3RFFZSktvWklodmNOQVFFQkJRQURnZ0VQQURDQ0FRb0NnZ0VCQU5TVVlFS1VhajZQZEZlaHF1QWIKRWpQWmJ4UmIxbDVuUTNXYkZxdDFZdThHSGJSRU1TT1k5WGFJa3Q3TGF4NHVXQXdUMGV6bVY2Vk04cTExMnM0LwovRGI5UkY3R2xVYlgxK1BaQmFCcTlDUXQrUGFNZXlKelRpbFJaUzY5VkxOL0EyRU5sQWZmaDBJdkZkeFV6cVdqCjNnNWZrTlF5ZjVZV08rQUZUWkFBaXVTRjFUN09KaEJBZEtwSlAvZVc4dVYvMzRrTlovTDFDb0xpaFhFajgxTnAKMi91SG43aU4xWjdYSHk0RzBpb1JmY214d0Z5MTBCdU5CakFxejNwR3NsTFFaU1JFbW50QTl5THc0M3RsWHZ3UApTOEEyUmJoQUZVNEs0ZlljaDBtK0Y2bEdMUVcrNDYwa2toTFk3MkVWQjdGMEFLZHNWK3BYcTJaWnFVOWdBWC9xCkdWMENBd0VBQWFPQmpUQ0JpakFPQmdOVkhROEJBZjhFQkFNQ0JhQXdIUVlEVlIwbEJCWXdGQVlJS3dZQkJRVUgKQXdFR0NDc0dBUVVGQndNQ01Bd0dBMVVkRXdFQi93UUNNQUF3SHdZRFZSMGpCQmd3Rm9BVXcvSzhXWnhZTVhQYgpLY2xRd1haZ3Y1LzZONTB3S2dZRFZSMFJCQ013SVlJZktpNWtaV1poZFd4MExtaDFZbUpzWlMxbmNuQmpMbU5wCmJHbDFiUzVwYnpBTkJna3Foa2lHOXcwQkFRc0ZBQU9DQVFFQWZEQmw5OWxWNzg1UFVqQ2VkMS9ES0k5dVljSSsKdXZlenRQRVJhNGdWelc2cEg4SkNSSEcwS1A2QW1oaEgxV2N4US84N3NWWHRyRi9YZ3VDNm1FMmxXdzY4UjBieApaRHBiZE1jRTVoM013cDkwcEJucEdMWk9SWXcrVmlkQytTY1UxZlQyZHIyMHhxS1pROW5IaGxnVTY1akRKQUowCkNEemNMVHE2ZHJZUkNPNlJDeXJQcmJrcjZRNEh3aGVjb3U3a3kxenNyRFZyMmwwNlBTbkVQM2dLUUMzdHR4RlcKOEh3cG1VdjV6MmxFVmUvajZpRmY2RlBtcWZyYTMxcWYyWG9pVkZmVXM3R05jeWZVSFk4MkR6dEMxU015Vk5aaAp6eGxseUpuQU4wQVZGSmdnYUNCcjd4a1l0MWlHS1pSbEpNUjdycTVVK3hQQjFNcGduMXkzU290aTF3PT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo= + tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb2dJQkFBS0NBUUVBMUpSZ1FwUnFQbzkwVjZHcTRCc1NNOWx2RkZ2V1htZERkWnNXcTNWaTd3WWR0RVF4Ckk1ajFkb2lTM3N0ckhpNVlEQlBSN09aWHBVenlyWFhhemovOE52MUVYc2FWUnRmWDQ5a0ZvR3IwSkMzNDlveDcKSW5OT0tWRmxMcjFVczM4RFlRMlVCOStIUWk4VjNGVE9wYVBlRGwrUTFESi9saFk3NEFWTmtBQ0s1SVhWUHM0bQpFRUIwcWtrLzk1Ynk1WC9maVExbjh2VUtndUtGY1NQelUybmIrNGVmdUkzVm50Y2ZMZ2JTS2hGOXliSEFYTFhRCkc0MEdNQ3JQZWtheVV0QmxKRVNhZTBEM0l2RGplMlZlL0E5THdEWkZ1RUFWVGdyaDloeUhTYjRYcVVZdEJiN2oKclNTU0V0anZZUlVIc1hRQXAyeFg2bGVyWmxtcFQyQUJmK29aWFFJREFRQUJBb0lCQUQwNEc3NmcwallCQng3RAplcHUrZ0EvNWdzRklyMlFSZGY1MDh1TGUwK2FGQ3VIaXI0b1NYMEpMRTR6ZzVSRFVoTnU1aTMrZldFZE04U2hlCkkreTR4WkFxZ05tUWMrWHFmQXhzYisvaVRUdnNGMklkVThxNGpSNWVCL2NkWkRxckRkU1IzZnNrZHVYcS9HOHUKNXpJUmpuM3lMSm5IanpHd1puN2QyQmZyNkJQbUpvTkxKbzZsVks1Tmx4VXhpRzdVak1nZlBwVmdUc3BQa1lEUQoxZEpaSmJQam55UGtqdXRPZVZLSnh0MUZyL21sdGVLYTk0d3dNdS9FQjlHSFVxVzlpZ2t1N2Z5MUhRLzJLSmRUCkVKYytZRlAvclhGeFBxcWlGN3FDWVNoQlRRZFVHemxYNENIVTVMeHAxR09xZmo0VFkvbGQyVFRZL24zUnBoay8KYU4vaGM5c0NnWUVBNi9xWmFKd0RTTzFaV3NNcEtnWTZrWUxrYmFZbTZnUnlIYmpVUWQzRUg0V3VHSHRJZnZLRgpnRkRCUm53anExR1NqRnloYnoybWZZYXBVbkZnT20waGRmSGs0aGFtNzJBL2EyVEZxMmhpYmlYTEljMVFwaVA3Ckptby9aVStNTi9Qeno0cy9EdmJCZDdLL3U2Z0lob3pvWUl3UDlGY1d3TkNFajI5Z1E0MXBqRThDZ1lFQTVwMk0Kd0lXMFFHRndBSU1WdWJyVXoyK1BCOG1yaENJbEVzRzJuV3FRNkhEcjdXeG82YVhJVGNJZk9vbjRXNmFoV3lETwpBMXJDc0hXWXpBZlkzamtjNkU5ZURtOHVJMzkwR3RtSGpVdUsybHMzanFheE9uRldNd3p1TlNDN0RtVFBrdHAvClJMR25KeFNubGdBMUJ6T1h4WE9yOHBQbEtIcjEwMGhZdjByKytKTUNnWUE3bVVjMWpIR244WW9ueWpLVFVvOW8KUU03QWdyNUJURzRsNDVCNE1qSmVZN3pjb2dabFNZcytKU2NyVGg4VUhiNE5oVGVnaU1tTDJuN1pPNWs2S0dYVApEQXpxclIzc1J6cTlQTzVQcEVWMzNFTzVmY2xvckoyNXpndkU0cHBmWjFXa2pWNlh3T3FMK0xGRUMrUmJWeXM1CmR5WndaNjV2ZERxR24zS0luU2FUTVFLQmdHVldDY2wzZHpOckhZbzhEOG5qWFN3aHUxb1N0am1EdjRLMGVJaEgKa1pGeVBWbkE3NERzQms2VTVLQVdqSG5KaU5IQVlvWjYxVjR3N29tSlVUU2xLQnkwODRHb1BULy8rNGJvMjNXdApJa0M5SUhhZ3JQUWZaVjlkYVRjVFFOOGNVVklZalNBa2FHejEySVpEWlFuYkUvQUIyaWJuOGlTTms0UGFJSlUrCllUZmRBb0dBU01EejBGb0dGNDBZbU1VRU9MVHRpVmMxQ1BQT21Zdks0c3ByRjQvWDh5eGYyL2luSy9UQk1sTC8KdzVhaWQ4Ym02dDhOUUErcVM5SWdNdnpTU3lFaUdmbjZsMmtDN1haWGI4UWI2SUF2SmF4ZzRLTElxN3ZIek5tegp1ZXd5YllTRWJVVjNYQVBPdlF2N0NkbGxqUWRDWHQwb3pmK2hnU0F2RjZCNTA4YkY4eUk9Ci0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg== + +--- +# Source: cilium/templates/cilium-configmap.yaml +apiVersion: v1 +kind: ConfigMap +metadata: + name: cilium-config + namespace: kube-system +data: + + # Identity allocation mode selects how identities are shared between cilium + # nodes by setting how they are stored. The options are "crd", "kvstore" or + # "doublewrite-readkvstore" / "doublewrite-readcrd". + # - "crd" stores identities in kubernetes as CRDs (custom resource definition). + # These can be queried with: + # kubectl get ciliumid + # - "kvstore" stores identities in an etcd kvstore, that is + # configured below. Cilium versions before 1.6 supported only the kvstore + # backend. Upgrades from these older cilium versions should continue using + # the kvstore by commenting out the identity-allocation-mode below, or + # setting it to "kvstore". + # - "doublewrite" modes store identities in both the kvstore and CRDs. This is useful + # for seamless migrations from the kvstore mode to the crd mode. Consult the + # documentation for more information on how to perform the migration. + identity-allocation-mode: crd + + identity-heartbeat-timeout: "30m0s" + identity-gc-interval: "15m0s" + cilium-endpoint-gc-interval: "5m0s" + nodes-gc-interval: "5m0s" + + # If you want to run cilium in debug mode change this value to true + debug: "false" + metrics-sampling-interval: "5m" + # The agent can be put into the following three policy enforcement modes + # default, always and never. + # https://docs.cilium.io/en/latest/security/policy/intro/#policy-enforcement-modes + enable-policy: "default" + # If you want metrics enabled in cilium-operator, set the port for + # which the Cilium Operator will have their metrics exposed. + # NOTE that this will open the port on the nodes where Cilium operator pod + # is scheduled. + operator-prometheus-serve-addr: ":9963" + enable-metrics: "true" + enable-policy-secrets-sync: "true" + policy-secrets-only-from-secrets-namespace: "true" + policy-secrets-namespace: "cilium-secrets" + + # Enable IPv4 addressing. If enabled, all endpoints are allocated an IPv4 + # address. + enable-ipv4: "true" + + # Enable IPv6 addressing. If enabled, all endpoints are allocated an IPv6 + # address. + enable-ipv6: "false" + # Users who wish to specify their own custom CNI configuration file must set + # custom-cni-conf to "true", otherwise Cilium may overwrite the configuration. + custom-cni-conf: "false" + enable-bpf-clock-probe: "false" + # If you want cilium monitor to aggregate tracing for packets, set this level + # to "low", "medium", or "maximum". The higher the level, the less packets + # that will be seen in monitor output. + monitor-aggregation: medium + + # The monitor aggregation interval governs the typical time between monitor + # notification events for each allowed connection. + # + # Only effective when monitor aggregation is set to "medium" or higher. + monitor-aggregation-interval: "5s" + + # The monitor aggregation flags determine which TCP flags which, upon the + # first observation, cause monitor notifications to be generated. + # + # Only effective when monitor aggregation is set to "medium" or higher. + monitor-aggregation-flags: all + # Specifies the ratio (0.0-1.0] of total system memory to use for dynamic + # sizing of the TCP CT, non-TCP CT, NAT and policy BPF maps. + bpf-map-dynamic-size-ratio: "0.0025" + # bpf-policy-map-max specifies the maximum number of entries in endpoint + # policy map (per endpoint) + bpf-policy-map-max: "16384" + # bpf-policy-stats-map-max specifies the maximum number of entries in global + # policy stats map + bpf-policy-stats-map-max: "65536" + # bpf-lb-map-max specifies the maximum number of entries in bpf lb service, + # backend and affinity maps. + bpf-lb-map-max: "65536" + bpf-lb-external-clusterip: "false" + bpf-lb-source-range-all-types: "false" + bpf-lb-algorithm-annotation: "false" + bpf-lb-mode-annotation: "false" + + bpf-distributed-lru: "false" + bpf-events-drop-enabled: "true" + bpf-events-policy-verdict-enabled: "true" + bpf-events-trace-enabled: "true" + + # Pre-allocation of map entries allows per-packet latency to be reduced, at + # the expense of up-front memory allocation for the entries in the maps. The + # default value below will minimize memory usage in the default installation; + # users who are sensitive to latency may consider setting this to "true". + # + # This option was introduced in Cilium 1.4. Cilium 1.3 and earlier ignore + # this option and behave as though it is set to "true". + # + # If this value is modified, then during the next Cilium startup the restore + # of existing endpoints and tracking of ongoing connections may be disrupted. + # As a result, reply packets may be dropped and the load-balancing decisions + # for established connections may change. + # + # If this option is set to "false" during an upgrade from 1.3 or earlier to + # 1.4 or later, then it may cause one-time disruptions during the upgrade. + preallocate-bpf-maps: "false" + + # Name of the cluster. Only relevant when building a mesh of clusters. + cluster-name: "default" + # Unique ID of the cluster. Must be unique across all connected clusters and + # in the range of 1 and 255. Only relevant when building a mesh of clusters. + cluster-id: "0" + + # Encapsulation mode for communication between nodes + # Possible values: + # - disabled + # - vxlan (default) + # - geneve + + routing-mode: "tunnel" + tunnel-protocol: "vxlan" + tunnel-source-port-range: "0-0" + service-no-backend-response: "reject" + policy-deny-response: "none" + + + # Enables L7 proxy for L7 policy enforcement and visibility + enable-l7-proxy: "true" + enable-ipv4-masquerade: "true" + enable-ipv4-big-tcp: "false" + enable-ipv6-big-tcp: "false" + enable-ipv6-masquerade: "true" + enable-tcx: "true" + datapath-mode: "veth" + enable-masquerade-to-route-source: "false" + + enable-xt-socket-fallback: "true" + install-no-conntrack-iptables-rules: "false" + iptables-random-fully: "false" + + auto-direct-node-routes: "false" + direct-routing-skip-unreachable: "false" + + + + kube-proxy-replacement: "false" + enable-no-service-endpoints-routable: "true" + bpf-lb-sock: "false" + enable-health-check-nodeport: "true" + enable-health-check-loadbalancer-ip: "false" + node-port-bind-protection: "true" + enable-auto-protect-node-port-range: "true" + bpf-lb-acceleration: "disabled" + enable-service-topology: "false" + enable-l2-neigh-discovery: "false" + k8s-require-ipv4-pod-cidr: "false" + k8s-require-ipv6-pod-cidr: "false" + enable-k8s-networkpolicy: "true" + enable-endpoint-lockdown-on-policy-overflow: "false" + # Tell the agent to generate and write a CNI configuration file + write-cni-conf-when-ready: /host/etc/cni/net.d/05-cilium.conflist + cni-exclusive: "true" + cni-log-file: "/var/run/cilium/cilium-cni.log" + enable-endpoint-health-checking: "true" + enable-health-checking: "true" + health-check-icmp-failure-threshold: "3" + enable-well-known-identities: "false" + enable-node-selector-labels: "false" + synchronize-k8s-nodes: "true" + operator-api-serve-addr: "127.0.0.1:9234" + + enable-hubble: "true" + # UNIX domain socket for Hubble server to listen to. + hubble-socket-path: "/var/run/cilium/hubble.sock" + hubble-network-policy-correlation-enabled: "true" + # An additional address for Hubble server to listen to (e.g. ":4244"). + hubble-listen-address: ":4244" + hubble-disable-tls: "false" + hubble-tls-cert-file: /var/lib/cilium/tls/hubble/server.crt + hubble-tls-key-file: /var/lib/cilium/tls/hubble/server.key + hubble-tls-client-ca-files: /var/lib/cilium/tls/hubble/client-ca.crt + ipam: "cluster-pool" + ipam-cilium-node-update-rate: "15s" + cluster-pool-ipv4-cidr: "10.0.0.0/8" + cluster-pool-ipv4-mask-size: "24" + + default-lb-service-ipam: "lbipam" + egress-gateway-reconciliation-trigger-interval: "1s" + enable-vtep: "false" + vtep-endpoint: "" + vtep-cidr: "" + vtep-mask: "" + vtep-mac: "" + + packetization-layer-pmtud-mode: "blackhole" + procfs: "/host/proc" + bpf-root: "/sys/fs/bpf" + cgroup-root: "/run/cilium/cgroupv2" + + identity-management-mode: "agent" + enable-sctp: "false" + remove-cilium-node-taints: "true" + set-cilium-node-taints: "true" + set-cilium-is-up-condition: "true" + unmanaged-pod-watcher-interval: "15s" + # default DNS proxy to transparent mode in non-chaining modes + dnsproxy-enable-transparent-mode: "true" + dnsproxy-socket-linger-timeout: "10" + tofqdns-dns-reject-response-code: "refused" + tofqdns-enable-dns-compression: "true" + tofqdns-endpoint-max-ip-per-hostname: "1000" + tofqdns-idle-connection-grace-period: "0s" + tofqdns-max-deferred-connection-deletes: "10000" + tofqdns-proxy-response-max-delay: "100ms" + tofqdns-preallocate-identities: "true" + agent-not-ready-taint-key: "node.cilium.io/agent-not-ready" + + mesh-auth-enabled: "false" + mesh-auth-queue-size: "1024" + mesh-auth-rotated-identities-queue-size: "1024" + mesh-auth-gc-interval: "5m0s" + + proxy-xff-num-trusted-hops-ingress: "0" + proxy-xff-num-trusted-hops-egress: "0" + proxy-connect-timeout: "2" + proxy-initial-fetch-timeout: "30" + proxy-max-active-downstream-connections: "50000" + proxy-max-requests-per-connection: "0" + proxy-max-connection-duration-seconds: "0" + proxy-idle-timeout-seconds: "60" + proxy-max-concurrent-retries: "128" + proxy-use-original-source-address: "true" + proxy-cluster-max-connections: "1024" + proxy-cluster-max-requests: "1024" + http-retry-count: "3" + http-stream-idle-timeout: "300" + + external-envoy-proxy: "true" + envoy-base-id: "0" + envoy-access-log-buffer-size: "4096" + envoy-keep-cap-netbindservice: "false" + max-connected-clusters: "255" + clustermesh-cache-ttl: "0s" + clustermesh-enable-endpoint-sync: "false" + clustermesh-enable-mcs-api: "false" + clustermesh-mcs-api-install-crds: "true" + policy-default-local-cluster: "true" + + nat-map-stats-entries: "32" + nat-map-stats-interval: "30s" + enable-lb-ipam: "true" + enable-non-default-deny-policies: "true" + enable-source-ip-verification: "true" + enable-dynamic-config: "true" + enable-drift-checker: "true" + +# Extra config allows adding arbitrary properties to the cilium config. +# By putting it at the end of the ConfigMap, it's also possible to override existing properties. +--- +# Source: cilium/templates/cilium-envoy/configmap.yaml +apiVersion: v1 +kind: ConfigMap +metadata: + name: cilium-envoy-config + namespace: kube-system +data: + # Keep the key name as bootstrap-config.json to avoid breaking changes + bootstrap-config.json: | + {"admin":{"address":{"pipe":{"mode":432,"path":"/var/run/cilium/envoy/sockets/admin.sock"}}},"applicationLogConfig":{"logFormat":{"textFormat":"[%Y-%m-%d %T.%e][%t][%l][%n] [%g:%#] %v"}},"bootstrapExtensions":[{"name":"envoy.bootstrap.internal_listener","typedConfig":{"@type":"type.googleapis.com/envoy.extensions.bootstrap.internal_listener.v3.InternalListener"}}],"dynamicResources":{"cdsConfig":{"apiConfigSource":{"apiType":"GRPC","grpcServices":[{"envoyGrpc":{"clusterName":"xds-grpc-cilium"}}],"setNodeOnFirstMessageOnly":true,"transportApiVersion":"V3"},"initialFetchTimeout":"30s","resourceApiVersion":"V3"},"ldsConfig":{"apiConfigSource":{"apiType":"GRPC","grpcServices":[{"envoyGrpc":{"clusterName":"xds-grpc-cilium"}}],"setNodeOnFirstMessageOnly":true,"transportApiVersion":"V3"},"initialFetchTimeout":"30s","resourceApiVersion":"V3"}},"node":{"cluster":"ingress-cluster","id":"host~127.0.0.1~no-id~localdomain"},"overloadManager":{"resourceMonitors":[{"name":"envoy.resource_monitors.global_downstream_max_connections","typedConfig":{"@type":"type.googleapis.com/envoy.extensions.resource_monitors.downstream_connections.v3.DownstreamConnectionsConfig","max_active_downstream_connections":"50000"}}]},"staticResources":{"clusters":[{"circuitBreakers":{"thresholds":[{"maxConnections":1024,"maxRequests":1024,"maxRetries":128}]},"cleanupInterval":"2.500s","connectTimeout":"2s","lbPolicy":"CLUSTER_PROVIDED","name":"ingress-cluster","type":"ORIGINAL_DST","typedExtensionProtocolOptions":{"envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{"@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions","commonHttpProtocolOptions":{"idleTimeout":"60s","maxConnectionDuration":"0s","maxRequestsPerConnection":0},"useDownstreamProtocolConfig":{}}}},{"circuitBreakers":{"thresholds":[{"maxConnections":1024,"maxRequests":1024,"maxRetries":128}]},"cleanupInterval":"2.500s","connectTimeout":"2s","lbPolicy":"CLUSTER_PROVIDED","name":"egress-cluster-tls","transportSocket":{"name":"cilium.tls_wrapper","typedConfig":{"@type":"type.googleapis.com/cilium.UpstreamTlsWrapperContext"}},"type":"ORIGINAL_DST","typedExtensionProtocolOptions":{"envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{"@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions","commonHttpProtocolOptions":{"idleTimeout":"60s","maxConnectionDuration":"0s","maxRequestsPerConnection":0},"upstreamHttpProtocolOptions":{},"useDownstreamProtocolConfig":{}}}},{"circuitBreakers":{"thresholds":[{"maxConnections":1024,"maxRequests":1024,"maxRetries":128}]},"cleanupInterval":"2.500s","connectTimeout":"2s","lbPolicy":"CLUSTER_PROVIDED","name":"egress-cluster","type":"ORIGINAL_DST","typedExtensionProtocolOptions":{"envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{"@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions","commonHttpProtocolOptions":{"idleTimeout":"60s","maxConnectionDuration":"0s","maxRequestsPerConnection":0},"useDownstreamProtocolConfig":{}}}},{"circuitBreakers":{"thresholds":[{"maxConnections":1024,"maxRequests":1024,"maxRetries":128}]},"cleanupInterval":"2.500s","connectTimeout":"2s","lbPolicy":"CLUSTER_PROVIDED","name":"ingress-cluster-tls","transportSocket":{"name":"cilium.tls_wrapper","typedConfig":{"@type":"type.googleapis.com/cilium.UpstreamTlsWrapperContext"}},"type":"ORIGINAL_DST","typedExtensionProtocolOptions":{"envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{"@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions","commonHttpProtocolOptions":{"idleTimeout":"60s","maxConnectionDuration":"0s","maxRequestsPerConnection":0},"upstreamHttpProtocolOptions":{},"useDownstreamProtocolConfig":{}}}},{"connectTimeout":"2s","loadAssignment":{"clusterName":"xds-grpc-cilium","endpoints":[{"lbEndpoints":[{"endpoint":{"address":{"pipe":{"path":"/var/run/cilium/envoy/sockets/xds.sock"}}}}]}]},"name":"xds-grpc-cilium","type":"STATIC","typedExtensionProtocolOptions":{"envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{"@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions","explicitHttpConfig":{"http2ProtocolOptions":{}}}}},{"connectTimeout":"2s","loadAssignment":{"clusterName":"/envoy-admin","endpoints":[{"lbEndpoints":[{"endpoint":{"address":{"pipe":{"path":"/var/run/cilium/envoy/sockets/admin.sock"}}}}]}]},"name":"/envoy-admin","type":"STATIC"}],"listeners":[{"address":{"socketAddress":{"address":"0.0.0.0","portValue":9964}},"filterChains":[{"filters":[{"name":"envoy.filters.network.http_connection_manager","typedConfig":{"@type":"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager","httpFilters":[{"name":"envoy.filters.http.router","typedConfig":{"@type":"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"}}],"internalAddressConfig":{"cidrRanges":[{"addressPrefix":"10.0.0.0","prefixLen":8},{"addressPrefix":"172.16.0.0","prefixLen":12},{"addressPrefix":"192.168.0.0","prefixLen":16},{"addressPrefix":"127.0.0.1","prefixLen":32}]},"routeConfig":{"virtualHosts":[{"domains":["*"],"name":"prometheus_metrics_route","routes":[{"match":{"prefix":"/metrics"},"name":"prometheus_metrics_route","route":{"cluster":"/envoy-admin","prefixRewrite":"/stats/prometheus"}}]}]},"statPrefix":"envoy-prometheus-metrics-listener","streamIdleTimeout":"300s"}}]}],"name":"envoy-prometheus-metrics-listener"},{"address":{"socketAddress":{"address":"127.0.0.1","portValue":9878}},"filterChains":[{"filters":[{"name":"envoy.filters.network.http_connection_manager","typedConfig":{"@type":"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager","httpFilters":[{"name":"envoy.filters.http.router","typedConfig":{"@type":"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"}}],"internalAddressConfig":{"cidrRanges":[{"addressPrefix":"10.0.0.0","prefixLen":8},{"addressPrefix":"172.16.0.0","prefixLen":12},{"addressPrefix":"192.168.0.0","prefixLen":16},{"addressPrefix":"127.0.0.1","prefixLen":32}]},"routeConfig":{"virtual_hosts":[{"domains":["*"],"name":"health","routes":[{"match":{"prefix":"/healthz"},"name":"health","route":{"cluster":"/envoy-admin","prefixRewrite":"/ready"}}]}]},"statPrefix":"envoy-health-listener","streamIdleTimeout":"300s"}}]}],"name":"envoy-health-listener"}]}} + +--- +# Source: cilium/templates/cilium-agent/clusterrole.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: cilium + labels: + app.kubernetes.io/part-of: cilium +rules: +- apiGroups: + - networking.k8s.io + resources: + - networkpolicies + verbs: + - get + - list + - watch +- apiGroups: + - discovery.k8s.io + resources: + - endpointslices + verbs: + - get + - list + - watch +- apiGroups: + - "" + resources: + - namespaces + - services + - pods + - endpoints + - nodes + verbs: + - get + - list + - watch +- apiGroups: + - apiextensions.k8s.io + resources: + - customresourcedefinitions + verbs: + - list + - watch + # This is used when validating policies in preflight. This will need to stay + # until we figure out how to avoid "get" inside the preflight, and then + # should be removed ideally. + - get +- apiGroups: + - cilium.io + resources: + - ciliumloadbalancerippools + - ciliumbgppeeringpolicies + - ciliumbgpnodeconfigs + - ciliumbgpadvertisements + - ciliumbgppeerconfigs + - ciliumclusterwideenvoyconfigs + - ciliumclusterwidenetworkpolicies + - ciliumegressgatewaypolicies + - ciliumendpoints + - ciliumendpointslices + - ciliumenvoyconfigs + - ciliumidentities + - ciliumlocalredirectpolicies + - ciliumnetworkpolicies + - ciliumnodes + - ciliumnodeconfigs + - ciliumcidrgroups + - ciliuml2announcementpolicies + - ciliumpodippools + verbs: + - list + - watch +- apiGroups: + - cilium.io + resources: + - ciliumidentities + - ciliumendpoints + - ciliumnodes + verbs: + - create +- apiGroups: + - cilium.io + # To synchronize garbage collection of such resources + resources: + - ciliumidentities + verbs: + - update +- apiGroups: + - cilium.io + resources: + - ciliumendpoints + verbs: + - delete + - get +- apiGroups: + - cilium.io + resources: + - ciliumnodes + - ciliumnodes/status + verbs: + - get + - update +- apiGroups: + - cilium.io + resources: + - ciliumendpoints/status + - ciliumendpoints + - ciliuml2announcementpolicies/status + - ciliumbgpnodeconfigs/status + verbs: + - patch + +--- +# Source: cilium/templates/cilium-operator/clusterrole.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: cilium-operator + labels: + app.kubernetes.io/part-of: cilium +rules: +- apiGroups: + - "" + resources: + - pods + verbs: + - get + - list + - watch + # to automatically delete [core|kube]dns pods so that are starting to being + # managed by Cilium + - delete +- apiGroups: + - "" + resources: + - configmaps + resourceNames: + - cilium-config + verbs: + # allow patching of the configmap to set annotations + - patch +- apiGroups: + - "" + resources: + - nodes + verbs: + - list + - watch +- apiGroups: + - "" + resources: + # To remove node taints + - nodes + # To set NetworkUnavailable false on startup + - nodes/status + verbs: + - patch +- apiGroups: + - discovery.k8s.io + resources: + - endpointslices + verbs: + - get + - list + - watch +- apiGroups: + - "" + resources: + # to perform LB IP allocation for BGP + - services/status + verbs: + - update + - patch +- apiGroups: + - "" + resources: + # to check apiserver connectivity + - namespaces + - secrets + verbs: + - get + - list + - watch +- apiGroups: + - "" + resources: + # to perform the translation of a CNP that contains `ToGroup` to its endpoints + - services + - endpoints + verbs: + - get + - list + - watch +- apiGroups: + - cilium.io + resources: + - ciliumnetworkpolicies + - ciliumclusterwidenetworkpolicies + verbs: + # Create auto-generated CNPs and CCNPs from Policies that have 'toGroups' + - create + - update + - deletecollection + # To update the status of the CNPs and CCNPs + - patch + - get + - list + - watch +- apiGroups: + - cilium.io + resources: + - ciliumnetworkpolicies/status + - ciliumclusterwidenetworkpolicies/status + verbs: + # Update the auto-generated CNPs and CCNPs status. + - patch + - update +- apiGroups: + - cilium.io + resources: + - ciliumendpoints + - ciliumidentities + verbs: + # To perform garbage collection of such resources + - delete + - list + - watch +- apiGroups: + - cilium.io + resources: + - ciliumidentities + verbs: + # To synchronize garbage collection of such resources + - update +- apiGroups: + - cilium.io + resources: + - ciliumnodes + verbs: + - create + - update + - get + - list + - watch + # To perform CiliumNode garbage collector + - delete +- apiGroups: + - cilium.io + resources: + - ciliumnodes/status + verbs: + - update +- apiGroups: + - cilium.io + resources: + - ciliumendpointslices + - ciliumenvoyconfigs + - ciliumbgppeerconfigs + - ciliumbgpadvertisements + - ciliumbgpnodeconfigs + verbs: + - create + - update + - get + - list + - watch + - delete + - patch +- apiGroups: + - cilium.io + resources: + - ciliumbgpclusterconfigs/status + - ciliumbgppeerconfigs/status + verbs: + - update +- apiGroups: + - apiextensions.k8s.io + resources: + - customresourcedefinitions + verbs: + - create + - get + - list + - watch +- apiGroups: + - apiextensions.k8s.io + resources: + - customresourcedefinitions + verbs: + - update + resourceNames: + - ciliumloadbalancerippools.cilium.io + - ciliumbgpclusterconfigs.cilium.io + - ciliumbgppeerconfigs.cilium.io + - ciliumbgpadvertisements.cilium.io + - ciliumbgpnodeconfigs.cilium.io + - ciliumbgpnodeconfigoverrides.cilium.io + - ciliumclusterwideenvoyconfigs.cilium.io + - ciliumclusterwidenetworkpolicies.cilium.io + - ciliumegressgatewaypolicies.cilium.io + - ciliumendpoints.cilium.io + - ciliumendpointslices.cilium.io + - ciliumenvoyconfigs.cilium.io + - ciliumidentities.cilium.io + - ciliumlocalredirectpolicies.cilium.io + - ciliumnetworkpolicies.cilium.io + - ciliumnodes.cilium.io + - ciliumnodeconfigs.cilium.io + - ciliumcidrgroups.cilium.io + - ciliuml2announcementpolicies.cilium.io + - ciliumpodippools.cilium.io + - ciliumgatewayclassconfigs.cilium.io +- apiGroups: + - cilium.io + resources: + - ciliumloadbalancerippools + - ciliumpodippools + - ciliumbgppeeringpolicies + - ciliumbgpclusterconfigs + - ciliumbgpnodeconfigoverrides + - ciliumbgppeerconfigs + verbs: + - get + - list + - watch +- apiGroups: + - cilium.io + resources: + - ciliumpodippools + verbs: + - create +- apiGroups: + - cilium.io + resources: + - ciliumloadbalancerippools/status + verbs: + - patch +# For cilium-operator running in HA mode. +# +# Cilium operator running in HA mode requires the use of ResourceLock for Leader Election +# between multiple running instances. +# The preferred way of doing this is to use LeasesResourceLock as edits to Leases are less +# common and fewer objects in the cluster watch "all Leases". +- apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - create + - get + - update +- apiGroups: + - cilium.io + resources: + - ciliumendpointslices + verbs: + - deletecollection + +--- +# Source: cilium/templates/cilium-agent/clusterrolebinding.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: cilium + labels: + app.kubernetes.io/part-of: cilium +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: cilium +subjects: +- kind: ServiceAccount + name: "cilium" + namespace: kube-system + +--- +# Source: cilium/templates/cilium-operator/clusterrolebinding.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: cilium-operator + labels: + app.kubernetes.io/part-of: cilium +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: cilium-operator +subjects: +- kind: ServiceAccount + name: "cilium-operator" + namespace: kube-system + +--- +# Source: cilium/templates/cilium-agent/role.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: cilium-config-agent + namespace: kube-system + labels: + app.kubernetes.io/part-of: cilium +rules: +- apiGroups: + - "" + resources: + - configmaps + verbs: + - get + - list + - watch +--- +# Source: cilium/templates/cilium-agent/role.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: cilium-tlsinterception-secrets + namespace: "cilium-secrets" + labels: + app.kubernetes.io/part-of: cilium +rules: +- apiGroups: + - "" + resources: + - secrets + verbs: + - get + - list + - watch + +--- +# Source: cilium/templates/cilium-operator/role.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: cilium-operator-tlsinterception-secrets + namespace: "cilium-secrets" + labels: + app.kubernetes.io/part-of: cilium +rules: +- apiGroups: + - "" + resources: + - secrets + verbs: + - create + - delete + - update + - patch +--- +# Source: cilium/templates/cilium-operator/role.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: cilium-operator-ztunnel + namespace: kube-system + labels: + app.kubernetes.io/part-of: cilium +rules: +# ZTunnel DaemonSet management permissions +# Note: These permissions must always be granted (not conditional on encryption.type) +# because the controller needs to clean up stale DaemonSets when ztunnel is disabled. +- apiGroups: + - apps + resources: + - daemonsets + verbs: + - create + - delete + - get + - list + - watch + +--- +# Source: cilium/templates/cilium-agent/rolebinding.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: cilium-config-agent + namespace: kube-system + labels: + app.kubernetes.io/part-of: cilium +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: cilium-config-agent +subjects: + - kind: ServiceAccount + name: "cilium" + namespace: kube-system +--- +# Source: cilium/templates/cilium-agent/rolebinding.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: cilium-tlsinterception-secrets + namespace: "cilium-secrets" + labels: + app.kubernetes.io/part-of: cilium +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: cilium-tlsinterception-secrets +subjects: +- kind: ServiceAccount + name: "cilium" + namespace: kube-system + +--- +# Source: cilium/templates/cilium-operator/rolebinding.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: cilium-operator-tlsinterception-secrets + namespace: "cilium-secrets" + labels: + app.kubernetes.io/part-of: cilium +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: cilium-operator-tlsinterception-secrets +subjects: +- kind: ServiceAccount + name: "cilium-operator" + namespace: kube-system +--- +# Source: cilium/templates/cilium-operator/rolebinding.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: cilium-operator-ztunnel + namespace: kube-system + labels: + app.kubernetes.io/part-of: cilium +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: cilium-operator-ztunnel +subjects: +- kind: ServiceAccount + name: "cilium-operator" + namespace: kube-system + +--- +# Source: cilium/templates/cilium-envoy/service.yaml +apiVersion: v1 +kind: Service +metadata: + name: cilium-envoy + namespace: kube-system + annotations: + prometheus.io/scrape: "true" + prometheus.io/port: "9964" + labels: + k8s-app: cilium-envoy + app.kubernetes.io/name: cilium-envoy + app.kubernetes.io/part-of: cilium + io.cilium/app: proxy +spec: + clusterIP: None + type: ClusterIP + selector: + k8s-app: cilium-envoy + ports: + - name: envoy-metrics + port: 9964 + protocol: TCP + targetPort: 9964 + +--- +# Source: cilium/templates/hubble/peer-service.yaml +apiVersion: v1 +kind: Service +metadata: + name: hubble-peer + namespace: kube-system + labels: + k8s-app: cilium + app.kubernetes.io/part-of: cilium + app.kubernetes.io/name: hubble-peer + +spec: + selector: + k8s-app: cilium + ports: + - name: peer-service + port: 443 + protocol: TCP + targetPort: 4244 + internalTrafficPolicy: Local + +--- +# Source: cilium/templates/cilium-agent/daemonset.yaml +apiVersion: apps/v1 +kind: DaemonSet +metadata: + name: cilium + namespace: kube-system + labels: + k8s-app: cilium + app.kubernetes.io/part-of: cilium + app.kubernetes.io/name: cilium-agent +spec: + selector: + matchLabels: + k8s-app: cilium + updateStrategy: + rollingUpdate: + maxUnavailable: 2 + type: RollingUpdate + template: + metadata: + annotations: + kubectl.kubernetes.io/default-container: cilium-agent + labels: + k8s-app: cilium + app.kubernetes.io/name: cilium-agent + app.kubernetes.io/part-of: cilium + spec: + securityContext: + appArmorProfile: + type: Unconfined + seccompProfile: + type: Unconfined + containers: + - name: cilium-agent + image: "quay.io/cilium/cilium:v1.19.5@sha256:20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732" + imagePullPolicy: IfNotPresent + command: + - cilium-agent + args: + - --config-dir=/tmp/cilium/config-map + startupProbe: + httpGet: + host: "127.0.0.1" + path: /healthz + port: health + scheme: HTTP + httpHeaders: + - name: "brief" + value: "true" + failureThreshold: 300 + periodSeconds: 2 + successThreshold: 1 + initialDelaySeconds: 5 + livenessProbe: + httpGet: + host: "127.0.0.1" + path: /healthz + port: health + scheme: HTTP + httpHeaders: + - name: "brief" + value: "true" + - name: "require-k8s-connectivity" + value: "false" + periodSeconds: 30 + successThreshold: 1 + failureThreshold: 10 + timeoutSeconds: 5 + readinessProbe: + httpGet: + host: "127.0.0.1" + path: /healthz + port: health + scheme: HTTP + httpHeaders: + - name: "brief" + value: "true" + periodSeconds: 30 + successThreshold: 1 + failureThreshold: 3 + timeoutSeconds: 5 + env: + - name: K8S_NODE_NAME + valueFrom: + fieldRef: + apiVersion: v1 + fieldPath: spec.nodeName + - name: CILIUM_K8S_NAMESPACE + valueFrom: + fieldRef: + apiVersion: v1 + fieldPath: metadata.namespace + - name: CILIUM_CLUSTERMESH_CONFIG + value: /var/lib/cilium/clustermesh/ + - name: GOMEMLIMIT + valueFrom: + resourceFieldRef: + resource: limits.memory + divisor: '1' + - name: KUBE_CLIENT_BACKOFF_BASE + value: "1" + - name: KUBE_CLIENT_BACKOFF_DURATION + value: "120" + lifecycle: + postStart: + exec: + command: + - "bash" + - "-c" + - | + set -o errexit + set -o pipefail + set -o nounset + + # When running in AWS ENI mode, it's likely that 'aws-node' has + # had a chance to install SNAT iptables rules. These can result + # in dropped traffic, so we should attempt to remove them. + # We do it using a 'postStart' hook since this may need to run + # for nodes which might have already been init'ed but may still + # have dangling rules. This is safe because there are no + # dependencies on anything that is part of the startup script + # itself, and can be safely run multiple times per node (e.g. in + # case of a restart). + if [[ "$(iptables-save | grep -E -c 'AWS-SNAT-CHAIN|AWS-CONNMARK-CHAIN')" != "0" ]]; + then + echo 'Deleting iptables rules created by the AWS CNI VPC plugin' + iptables-save | grep -E -v 'AWS-SNAT-CHAIN|AWS-CONNMARK-CHAIN' | iptables-restore + fi + echo 'Done!' + + preStop: + exec: + command: + - /cni-uninstall.sh + ports: + - name: health + containerPort: 9879 + hostPort: 9879 + protocol: TCP + - name: peer-service + containerPort: 4244 + hostPort: 4244 + protocol: TCP + securityContext: + seLinuxOptions: + level: s0 + type: spc_t + capabilities: + add: + - CHOWN + - KILL + - NET_ADMIN + - NET_RAW + - IPC_LOCK + - SYS_MODULE + - SYS_ADMIN + - SYS_RESOURCE + - DAC_OVERRIDE + - FOWNER + - SETGID + - SETUID + - SYSLOG + drop: + - ALL + terminationMessagePolicy: FallbackToLogsOnError + volumeMounts: + - name: envoy-sockets + mountPath: /var/run/cilium/envoy/sockets + readOnly: false + # Unprivileged containers need to mount /proc/sys/net from the host + # to have write access + - mountPath: /host/proc/sys/net + name: host-proc-sys-net + # Unprivileged containers need to mount /proc/sys/kernel from the host + # to have write access + - mountPath: /host/proc/sys/kernel + name: host-proc-sys-kernel + - name: bpf-maps + mountPath: /sys/fs/bpf + # Unprivileged containers can't set mount propagation to bidirectional + # in this case we will mount the bpf fs from an init container that + # is privileged and set the mount propagation from host to container + # in Cilium. + mountPropagation: HostToContainer + - name: cilium-run + mountPath: /var/run/cilium + - name: cilium-netns + mountPath: /var/run/cilium/netns + mountPropagation: HostToContainer + - name: etc-cni-netd + mountPath: /host/etc/cni/net.d + - name: clustermesh-secrets + mountPath: /var/lib/cilium/clustermesh + readOnly: true + # Needed to be able to load kernel modules + - name: lib-modules + mountPath: /lib/modules + readOnly: true + - name: xtables-lock + mountPath: /run/xtables.lock + - name: hubble-tls + mountPath: /var/lib/cilium/tls/hubble + readOnly: true + - name: tmp + mountPath: /tmp + + initContainers: + - name: config + image: "quay.io/cilium/cilium:v1.19.5@sha256:20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732" + imagePullPolicy: IfNotPresent + command: + - cilium-dbg + - build-config + env: + - name: K8S_NODE_NAME + valueFrom: + fieldRef: + apiVersion: v1 + fieldPath: spec.nodeName + - name: CILIUM_K8S_NAMESPACE + valueFrom: + fieldRef: + apiVersion: v1 + fieldPath: metadata.namespace + volumeMounts: + - name: tmp + mountPath: /tmp + terminationMessagePolicy: FallbackToLogsOnError + securityContext: + capabilities: + add: + - NET_ADMIN + drop: + - ALL + # Required to mount cgroup2 filesystem on the underlying Kubernetes node. + # We use nsenter command with host's cgroup and mount namespaces enabled. + - name: mount-cgroup + image: "quay.io/cilium/cilium:v1.19.5@sha256:20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732" + imagePullPolicy: IfNotPresent + env: + - name: CGROUP_ROOT + value: /run/cilium/cgroupv2 + - name: BIN_PATH + value: /opt/cni/bin + command: + - bash + - -ec + # The statically linked Go program binary is invoked to avoid any + # dependency on utilities like sh and mount that can be missing on certain + # distros installed on the underlying host. Copy the binary to the + # same directory where we install cilium cni plugin so that exec permissions + # are available. + - | + cp /usr/bin/cilium-mount /hostbin/cilium-mount; + nsenter --cgroup=/hostproc/1/ns/cgroup --mount=/hostproc/1/ns/mnt "${BIN_PATH}/cilium-mount" $CGROUP_ROOT; + rm /hostbin/cilium-mount + volumeMounts: + - name: hostproc + mountPath: /hostproc + - name: cni-path + mountPath: /hostbin + terminationMessagePolicy: FallbackToLogsOnError + securityContext: + seLinuxOptions: + level: s0 + type: spc_t + capabilities: + add: + - SYS_ADMIN + - SYS_CHROOT + - SYS_PTRACE + drop: + - ALL + - name: apply-sysctl-overwrites + image: "quay.io/cilium/cilium:v1.19.5@sha256:20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732" + imagePullPolicy: IfNotPresent + env: + - name: BIN_PATH + value: /opt/cni/bin + command: + - bash + - -ec + # The statically linked Go program binary is invoked to avoid any + # dependency on utilities like sh that can be missing on certain + # distros installed on the underlying host. Copy the binary to the + # same directory where we install cilium cni plugin so that exec permissions + # are available. + - | + cp /usr/bin/cilium-sysctlfix /hostbin/cilium-sysctlfix; + nsenter --mount=/hostproc/1/ns/mnt "${BIN_PATH}/cilium-sysctlfix"; + rm /hostbin/cilium-sysctlfix + volumeMounts: + - name: hostproc + mountPath: /hostproc + - name: cni-path + mountPath: /hostbin + terminationMessagePolicy: FallbackToLogsOnError + securityContext: + seLinuxOptions: + level: s0 + type: spc_t + capabilities: + add: + - SYS_ADMIN + - SYS_CHROOT + - SYS_PTRACE + drop: + - ALL + # Mount the bpf fs if it is not mounted. We will perform this task + # from a privileged container because the mount propagation bidirectional + # only works from privileged containers. + - name: mount-bpf-fs + image: "quay.io/cilium/cilium:v1.19.5@sha256:20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732" + imagePullPolicy: IfNotPresent + args: + - 'mount | grep "/sys/fs/bpf type bpf" || mount -t bpf bpf /sys/fs/bpf' + command: + - /bin/bash + - -c + - -- + terminationMessagePolicy: FallbackToLogsOnError + securityContext: + privileged: true + volumeMounts: + - name: bpf-maps + mountPath: /sys/fs/bpf + mountPropagation: Bidirectional + - name: clean-cilium-state + image: "quay.io/cilium/cilium:v1.19.5@sha256:20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732" + imagePullPolicy: IfNotPresent + command: + - /init-container.sh + env: + - name: CILIUM_ALL_STATE + valueFrom: + configMapKeyRef: + name: cilium-config + key: clean-cilium-state + optional: true + - name: CILIUM_BPF_STATE + valueFrom: + configMapKeyRef: + name: cilium-config + key: clean-cilium-bpf-state + optional: true + - name: WRITE_CNI_CONF_WHEN_READY + valueFrom: + configMapKeyRef: + name: cilium-config + key: write-cni-conf-when-ready + optional: true + terminationMessagePolicy: FallbackToLogsOnError + securityContext: + seLinuxOptions: + level: s0 + type: spc_t + capabilities: + add: + - NET_ADMIN + - SYS_MODULE + - SYS_ADMIN + - SYS_RESOURCE + drop: + - ALL + volumeMounts: + - name: bpf-maps + mountPath: /sys/fs/bpf + # Required to mount cgroup filesystem from the host to cilium agent pod + - name: cilium-cgroup + mountPath: /run/cilium/cgroupv2 + mountPropagation: HostToContainer + - name: cilium-run + mountPath: /var/run/cilium # wait-for-kube-proxy + # Install the CNI binaries in an InitContainer so we don't have a writable host mount in the agent + - name: install-cni-binaries + image: "quay.io/cilium/cilium:v1.19.5@sha256:20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732" + imagePullPolicy: IfNotPresent + command: + - "/install-plugin.sh" + resources: + limits: + cpu: 1 + memory: 1Gi + requests: + cpu: 100m + memory: 10Mi + securityContext: + seLinuxOptions: + level: s0 + type: spc_t + capabilities: + drop: + - ALL + terminationMessagePolicy: FallbackToLogsOnError + volumeMounts: + - name: cni-path + mountPath: /host/opt/cni/bin # .Values.cni.install + restartPolicy: Always + priorityClassName: system-node-critical + serviceAccountName: "cilium" + automountServiceAccountToken: true + terminationGracePeriodSeconds: 1 + hostNetwork: true + + affinity: + podAntiAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchLabels: + k8s-app: cilium + topologyKey: kubernetes.io/hostname + nodeSelector: + kubernetes.io/os: linux + tolerations: + - operator: Exists + volumes: + # For sharing configuration between the "config" initContainer and the agent + - name: tmp + emptyDir: {} + # To keep state between restarts / upgrades + - name: cilium-run + hostPath: + path: /var/run/cilium + type: DirectoryOrCreate + # To exec into pod network namespaces + - name: cilium-netns + hostPath: + path: /var/run/netns + type: DirectoryOrCreate + # To keep state between restarts / upgrades for bpf maps + - name: bpf-maps + hostPath: + path: /sys/fs/bpf + type: DirectoryOrCreate + # To mount cgroup2 filesystem on the host or apply sysctlfix + - name: hostproc + hostPath: + path: /proc + type: Directory + # To keep state between restarts / upgrades for cgroup2 filesystem + - name: cilium-cgroup + hostPath: + path: /run/cilium/cgroupv2 + type: DirectoryOrCreate + # To install cilium cni plugin in the host + - name: cni-path + hostPath: + path: /opt/cni/bin + type: DirectoryOrCreate + # To install cilium cni configuration in the host + - name: etc-cni-netd + hostPath: + path: /etc/cni/net.d + type: DirectoryOrCreate + # To be able to load kernel modules + - name: lib-modules + hostPath: + path: /lib/modules + # To access iptables concurrently with other processes (e.g. kube-proxy) + - name: xtables-lock + hostPath: + path: /run/xtables.lock + type: FileOrCreate + # Sharing socket with Cilium Envoy on the same node by using a host path + - name: envoy-sockets + hostPath: + path: "/var/run/cilium/envoy/sockets" + type: DirectoryOrCreate + # To read the clustermesh configuration + - name: clustermesh-secrets + projected: + # note: the leading zero means this number is in octal representation: do not remove it + defaultMode: 0400 + sources: + - secret: + name: cilium-clustermesh + optional: true + # note: items are not explicitly listed here, since the entries of this secret + # depend on the peers configured, and that would cause a restart of all agents + # at every addition/removal. Leaving the field empty makes each secret entry + # to be automatically projected into the volume as a file whose name is the key. + - secret: + name: clustermesh-apiserver-remote-cert + optional: true + items: + - key: tls.key + path: common-etcd-client.key + - key: tls.crt + path: common-etcd-client.crt + - key: ca.crt + path: common-etcd-client-ca.crt + # note: we configure the volume for the kvstoremesh-specific certificate + # regardless of whether KVStoreMesh is enabled or not, so that it can be + # automatically mounted in case KVStoreMesh gets subsequently enabled, + # without requiring an agent restart. + - secret: + name: clustermesh-apiserver-local-cert + optional: true + items: + - key: tls.key + path: local-etcd-client.key + - key: tls.crt + path: local-etcd-client.crt + - key: ca.crt + path: local-etcd-client-ca.crt + - name: host-proc-sys-net + hostPath: + path: /proc/sys/net + type: Directory + - name: host-proc-sys-kernel + hostPath: + path: /proc/sys/kernel + type: Directory + - name: hubble-tls + projected: + # note: the leading zero means this number is in octal representation: do not remove it + defaultMode: 0400 + sources: + - secret: + name: hubble-server-certs + optional: true + items: + - key: tls.crt + path: server.crt + - key: tls.key + path: server.key + - key: ca.crt + path: client-ca.crt + + +--- +# Source: cilium/templates/cilium-envoy/daemonset.yaml +apiVersion: apps/v1 +kind: DaemonSet +metadata: + name: cilium-envoy + namespace: kube-system + labels: + k8s-app: cilium-envoy + app.kubernetes.io/part-of: cilium + app.kubernetes.io/name: cilium-envoy + name: cilium-envoy +spec: + selector: + matchLabels: + k8s-app: cilium-envoy + + updateStrategy: + rollingUpdate: + maxUnavailable: 2 + type: RollingUpdate + template: + metadata: + annotations: + labels: + k8s-app: cilium-envoy + name: cilium-envoy + app.kubernetes.io/name: cilium-envoy + app.kubernetes.io/part-of: cilium + spec: + securityContext: + appArmorProfile: + type: Unconfined + + containers: + - name: cilium-envoy + image: "quay.io/cilium/cilium-envoy:v1.36.8-1781157951-a7f42a3390781539911b5b9107881b35ecc4e752@sha256:326f872e19ce8aa45170efbf583b3f301586ba3feead14b864676d4baf3b45ed" + imagePullPolicy: IfNotPresent + command: + - /usr/bin/cilium-envoy-starter + args: + - '--' + - '-c /var/run/cilium/envoy/bootstrap-config.json' + - '--base-id 0' + - '--log-level info' + + startupProbe: + httpGet: + host: "127.0.0.1" + path: /healthz + port: 9878 + scheme: HTTP + failureThreshold: 105 + periodSeconds: 2 + successThreshold: 1 + initialDelaySeconds: 5 + livenessProbe: + httpGet: + host: "127.0.0.1" + path: /healthz + port: 9878 + scheme: HTTP + periodSeconds: 30 + successThreshold: 1 + failureThreshold: 10 + timeoutSeconds: 5 + readinessProbe: + httpGet: + host: "127.0.0.1" + path: /healthz + port: 9878 + scheme: HTTP + periodSeconds: 30 + successThreshold: 1 + failureThreshold: 3 + timeoutSeconds: 5 + env: + - name: K8S_NODE_NAME + valueFrom: + fieldRef: + apiVersion: v1 + fieldPath: spec.nodeName + - name: CILIUM_K8S_NAMESPACE + valueFrom: + fieldRef: + apiVersion: v1 + fieldPath: metadata.namespace + + ports: + - name: envoy-metrics + containerPort: 9964 + hostPort: 9964 + protocol: TCP + securityContext: + seLinuxOptions: + level: s0 + type: spc_t + capabilities: + add: + - NET_ADMIN + - SYS_ADMIN + drop: + - ALL + terminationMessagePolicy: FallbackToLogsOnError + volumeMounts: + - name: envoy-sockets + mountPath: /var/run/cilium/envoy/sockets + readOnly: false + - name: envoy-artifacts + mountPath: /var/run/cilium/envoy/artifacts + readOnly: true + - name: envoy-config + mountPath: /var/run/cilium/envoy/ + readOnly: true + - name: bpf-maps + mountPath: /sys/fs/bpf + mountPropagation: HostToContainer + + restartPolicy: Always + priorityClassName: system-node-critical + serviceAccountName: "cilium-envoy" + automountServiceAccountToken: true + terminationGracePeriodSeconds: 1 + hostNetwork: true + + affinity: + nodeAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: cilium.io/no-schedule + operator: NotIn + values: + - "true" + podAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchLabels: + k8s-app: cilium + topologyKey: kubernetes.io/hostname + podAntiAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchLabels: + k8s-app: cilium-envoy + topologyKey: kubernetes.io/hostname + nodeSelector: + kubernetes.io/os: linux + tolerations: + - operator: Exists + volumes: + - name: envoy-sockets + hostPath: + path: "/var/run/cilium/envoy/sockets" + type: DirectoryOrCreate + - name: envoy-artifacts + hostPath: + path: "/var/run/cilium/envoy/artifacts" + type: DirectoryOrCreate + - name: envoy-config + configMap: + name: "cilium-envoy-config" + # note: the leading zero means this number is in octal representation: do not remove it + defaultMode: 0400 + items: + - key: bootstrap-config.json + path: bootstrap-config.json + # To keep state between restarts / upgrades + # To keep state between restarts / upgrades for bpf maps + - name: bpf-maps + hostPath: + path: /sys/fs/bpf + type: DirectoryOrCreate + + +--- +# Source: cilium/templates/cilium-operator/deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + name: cilium-operator + namespace: kube-system + labels: + io.cilium/app: operator + name: cilium-operator + app.kubernetes.io/part-of: cilium + app.kubernetes.io/name: cilium-operator +spec: + # See docs on ServerCapabilities.LeasesResourceLock in file pkg/k8s/version/version.go + # for more details. + replicas: 2 + selector: + matchLabels: + io.cilium/app: operator + name: cilium-operator + # ensure operator update on single node k8s clusters, by using rolling update with maxUnavailable=100% in case + # of one replica and no user configured Recreate strategy. + # otherwise an update might get stuck due to the default maxUnavailable=50% in combination with the + # podAntiAffinity which prevents deployments of multiple operator replicas on the same node. + strategy: + rollingUpdate: + maxSurge: 25% + maxUnavailable: 50% + type: RollingUpdate + template: + metadata: + annotations: + prometheus.io/port: "9963" + prometheus.io/scrape: "true" + labels: + io.cilium/app: operator + name: cilium-operator + app.kubernetes.io/part-of: cilium + app.kubernetes.io/name: cilium-operator + spec: + securityContext: + seccompProfile: + type: RuntimeDefault + containers: + - name: cilium-operator + image: "quay.io/cilium/operator-generic:v1.19.5@sha256:be848a365776e07d0c5a895eda7aec928ddc52a5a1fa2f432fd7a286609e1db4" + imagePullPolicy: IfNotPresent + command: + - cilium-operator-generic + args: + - --config-dir=/tmp/cilium/config-map + - --debug=$(CILIUM_DEBUG) + env: + - name: K8S_NODE_NAME + valueFrom: + fieldRef: + apiVersion: v1 + fieldPath: spec.nodeName + - name: CILIUM_K8S_NAMESPACE + valueFrom: + fieldRef: + apiVersion: v1 + fieldPath: metadata.namespace + - name: CILIUM_DEBUG + valueFrom: + configMapKeyRef: + key: debug + name: cilium-config + optional: true + ports: + - name: health + containerPort: 9234 + hostPort: 9234 + - name: prometheus + containerPort: 9963 + hostPort: 9963 + protocol: TCP + livenessProbe: + httpGet: + host: "127.0.0.1" + path: /healthz + port: health + scheme: HTTP + initialDelaySeconds: 60 + periodSeconds: 10 + timeoutSeconds: 3 + readinessProbe: + httpGet: + host: "127.0.0.1" + path: /healthz + port: health + scheme: HTTP + initialDelaySeconds: 0 + periodSeconds: 5 + timeoutSeconds: 3 + failureThreshold: 5 + volumeMounts: + - name: cilium-config-path + mountPath: /tmp/cilium/config-map + readOnly: true + + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + terminationMessagePolicy: FallbackToLogsOnError + hostNetwork: true + restartPolicy: Always + priorityClassName: system-cluster-critical + serviceAccountName: "cilium-operator" + automountServiceAccountToken: true + # In HA mode, cilium-operator pods must not be scheduled on the same + # node as they will clash with each other. + affinity: + podAntiAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchLabels: + io.cilium/app: operator + topologyKey: kubernetes.io/hostname + nodeSelector: + kubernetes.io/os: linux + tolerations: + - key: node-role.kubernetes.io/control-plane + operator: Exists + - key: node-role.kubernetes.io/master + operator: Exists + - key: node.kubernetes.io/not-ready + operator: Exists + - key: node.cloudprovider.kubernetes.io/uninitialized + operator: Exists + - key: node.cilium.io/agent-not-ready + operator: Exists + + volumes: + # To read the configuration from the config map + - name: cilium-config-path + configMap: + name: cilium-config + diff --git a/packages/manifests/operators/cilium/1.19.5.yaml b/packages/manifests/operators/cilium/1.19.5.yaml new file mode 100644 index 0000000..ec5c220 --- /dev/null +++ b/packages/manifests/operators/cilium/1.19.5.yaml @@ -0,0 +1,1789 @@ +# Source: cilium/cilium@1.19.5 +--- +# Added by pull-manifests.ts to ensure namespace exists +apiVersion: v1 +kind: Namespace +metadata: + name: kube-system + labels: + app.kubernetes.io/name: kube-system + +--- +--- +# Source: cilium/templates/cilium-secrets-namespace.yaml +apiVersion: v1 +kind: Namespace +metadata: + name: "cilium-secrets" + labels: + app.kubernetes.io/part-of: cilium + annotations: + +--- +# Source: cilium/templates/cilium-agent/serviceaccount.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: "cilium" + namespace: kube-system + +--- +# Source: cilium/templates/cilium-envoy/serviceaccount.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: "cilium-envoy" + namespace: kube-system + +--- +# Source: cilium/templates/cilium-operator/serviceaccount.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: "cilium-operator" + namespace: kube-system + +--- +# Source: cilium/templates/cilium-ca-secret.yaml +apiVersion: v1 +kind: Secret +metadata: + name: cilium-ca + namespace: kube-system + labels: + cilium.io/helm-template-non-idempotent: "true" +data: + ca.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURFekNDQWZ1Z0F3SUJBZ0lRVlpkb3h2NDVNSDh4WFVZQk9RME9MakFOQmdrcWhraUc5dzBCQVFzRkFEQVUKTVJJd0VBWURWUVFERXdsRGFXeHBkVzBnUTBFd0hoY05Nall3T0RFeU1qRXpOVFF5V2hjTk1qa3dPREV4TWpFegpOVFF5V2pBVU1SSXdFQVlEVlFRREV3bERhV3hwZFcwZ1EwRXdnZ0VpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElCCkR3QXdnZ0VLQW9JQkFRRE56RnYxUFZEaENUSlRFT01oaFZhR243YlB4M3hISnQ5bFIrRDhxck1qb1pleWZ5MmkKZkhOYXl4YUlSeVBkMzRselpCejJuRCtpMnhCM3VrcC9EYTU1aUNUSFdRdkJXVWhtRWgyaG5TM0ErUFVRdDVZRgpvZWV2a3Z0eEFLczB4YnBoR0hJNjlqTkRLZHFJYkxIOXl3UWdOdUZ1bGVZdWFMazIwd0F4dTJWVDFYZisvVklPClgrVlZTZkg0aEkveFUyT2F4OUtyYTlkQ1RkVDdWQ2M0SFVxRFF2SlMwQlJGeDNPaTFFVElUT2Vzd3kreklQNzYKL0dLamJsMWFobzB0VGJTWXJ5SWJqSzQweVF5cGcxNnAyb25Eeks4SkZFSHBnVG1VSy9FNE8zd1BIL05yVEdhTQpkV2lTVmZQbzduaE1OdFFsNXVHWFh3alJlVWhuQmdXU2l4a0xBZ01CQUFHallUQmZNQTRHQTFVZER3RUIvd1FFCkF3SUNwREFkQmdOVkhTVUVGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXcKQXdFQi96QWRCZ05WSFE0RUZnUVV3L0s4V1p4WU1YUGJLY2xRd1haZ3Y1LzZONTB3RFFZSktvWklodmNOQVFFTApCUUFEZ2dFQkFIRDNQNWt3SE1ycnQxSHM0TGlkS2UxbTJmQ2FmcVV3b1JiSC9BaWJZd1pTNVdXUzkwNXduNEplCkovejdmampOWnI5enRHZklCM0RZVDZqTWh0ejQ3ZkhQM0pzYVU3enNxL1RsME5HbDBSTXBLbnk4VFBYcHFvNUcKMWNNUTBxdFUvSGcrYWJuVUxJRDVUa25JWktDOWRZT1dVcGtGNHBBcEtXWTViUVMxZldPTGJ6ay8zbmVTVlNkRgp2MUIxZXpvNG9TZ0o4Q3RqOXdjOWtEVUMvTWdjNUNmdGgyNWVTZ1o3SytqaC9LUE1DK0VVRmJ5TEJTTGVsZi9rCmhjYzYwVUdNQ1FxNllPbWNiZjF6QitucTBHUDdXZUYrZHI5MnowS1BnWEZKQmVOU3U4WlN6dlgwbkRKdUM4QjEKSEdRS2hUWjlGWUJkN3V6bXFZZVBrT3huNytIbnB3QT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo= + ca.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFcEFJQkFBS0NBUUVBemN4YjlUMVE0UWt5VXhEaklZVldocCsyejhkOFJ5YmZaVWZnL0txekk2R1hzbjh0Cm9ueHpXc3NXaUVjajNkK0pjMlFjOXB3L290c1FkN3BLZncydWVZZ2t4MWtMd1ZsSVpoSWRvWjB0d1BqMUVMZVcKQmFIbnI1TDdjUUNyTk1XNllSaHlPdll6UXluYWlHeXgvY3NFSURiaGJwWG1MbWk1TnRNQU1idGxVOVYzL3YxUwpEbC9sVlVueCtJU1A4Vk5qbXNmU3EydlhRazNVKzFRbk9CMUtnMEx5VXRBVVJjZHpvdFJFeUV6bnJNTXZzeUQrCit2eGlvMjVkV29hTkxVMjBtSzhpRzR5dU5Na01xWU5lcWRxSnc4eXZDUlJCNllFNWxDdnhPRHQ4RHgvemEweG0KakhWb2tsWHo2TzU0VERiVUplYmhsMThJMFhsSVp3WUZrb3NaQ3dJREFRQUJBb0lCQUNJRTZhQ1pBYkVwZFlXdwpzWE1kbVFlSkNFM0JrcVFxWTF4WkxQSm5mMVJoQm5RTnZPdnl1WmpsSUhUbm1hQzRMbjhDS2gyRUI2cnlubjdFCkwwTmdiaHFON0ZKOXdFazJhcGJnNE1BUi9QbTh6Ym4xTnhuNFFSWFBiTHdwMmFOUUdqYXB0VnhVelhXSlNpUXEKSDZRdDlxRWlvVkpIK2pScXdFODFRdjkxbEZMdWx6OUlJSGNEOE10STQ0QnFBQ0hHVEVhUzZ2ZFR2QWl6M1pMUApzVVAwZTQweXlYKzhDcmpjdytnSkcwYUVMNytqL3YrMmhLNmVJMzJUcGc4YStqNjlQMmxPNE10eUp1UWNmKzJUCjJCQXk3Z1R1KzVmazM3Q0hvVEIrN1NWekFDQTdObW92cFkyeDJXYTJVVXBLOEZkTEdQS255cE1SbTNSRklCVFcKaWo2SzFWRUNnWUVBOEcvYm1qWTFFQVVEejRSbHJYSzlpeCtiQTM1RXFBV21KM2lkVkJGMGxoazl6d0o1OGFyRgpoZTduTFJtOUxOMmwxSW9UV1lmVlFuWWRjZ3dicHhzR3RwZ2tZUDFtMGFXbWZvR0NSN0h3TW56ZThRUFNZVCtkCjJZUkhPc3VJUERZdmdRL1dtRjZ6enVhQXpKdHJ2SFlUUUpuQW4weGx0MmVGQlJROU9BNEpCUHNDZ1lFQTJ4NkcKSkR2VXJtbWdCSlBlT0JQS0ZGY0tJWGFtbEU1QURVclNiRjM0ejhraTRrdFRhekJFOENFeFhYNjQrMjR6V2tyOApkU2hxQWsyWGlSR1hrRS9BZ2d3cFROWXh6NEpJV2VoWmJieitQcEFacFp6OUs1TUVxbEZTd1l1d0lOL1J5Mnd6CmJBS000L0NzdGNTVU1ZV3cwa2U3MkliSE5ZNTVHdFZqQTB4b1h6RUNnWUVBbWJHWE9pT3VsYmZ1OEtjY2E5eHQKeDFJRHdCN2wrbFhxR1U4am1zcXhzUVVmbW9WbHVCTEd3cyt0WFFvWUFHY0xDeXJjSlo0THQ3bFRKMFVRSkNqRgppTkVHYUMxem5VMzdlT0NHakJmMWlBQ0VicUpYeUN4blZkVVZ4MEsxcW0ra3ZDYUlzY3ZQdXRGandlY1QzbHZJCkFNS0gvQXhVOVFFcWFjMi9PR2JZWXlNQ2dZQlJaSTAvZUZvUVQzdjVOMVFjVUgySUFLenFzVUEvWnJHMFBrN2IKb2l5Q1FweUtvcUJoK0pRaS9yRnZvVnJsU3BJWXdESDI4d1F0eHRTN1BhV25IWGpNMWVlaGV3OFZuYmR5YmpTSgo1dUlxS3l6YnIrejYrcW1JK3B4YStLQjhGYWZBZ0hpNWJsa1hjcGMxRGNoZWZPS3B1YXUxU3B0RThaOWFzRmtQCktKcThnUUtCZ1FDZ2xRZzFnQ09YMzhOa2dFNEc5ak9FdHFQMGxFMFNMbmtHckYwQVJiYkJ4aGlwOTdyVFhCeWMKMkpPRHJaWTA1Z0lPVWxWdVpieU8rdXpQaDNiZERxTUpYQ3pjWm9rVjRoU1piOFlwSVVVU0hQdGhOandmazcrdwovUXlickpLUndQNS91bnVPVzFMVEtYbUg3ZjVlVGpqeDBXc0FMZWtVc3J3VnppWWNVWEJmVVE9PQotLS0tLUVORCBSU0EgUFJJVkFURSBLRVktLS0tLQo= + +--- +# Source: cilium/templates/hubble/tls-helm/server-secret.yaml +apiVersion: v1 +kind: Secret +metadata: + name: hubble-server-certs + namespace: kube-system + labels: + cilium.io/helm-template-non-idempotent: "true" + + annotations: +type: kubernetes.io/tls +data: + ca.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURFekNDQWZ1Z0F3SUJBZ0lRVlpkb3h2NDVNSDh4WFVZQk9RME9MakFOQmdrcWhraUc5dzBCQVFzRkFEQVUKTVJJd0VBWURWUVFERXdsRGFXeHBkVzBnUTBFd0hoY05Nall3T0RFeU1qRXpOVFF5V2hjTk1qa3dPREV4TWpFegpOVFF5V2pBVU1SSXdFQVlEVlFRREV3bERhV3hwZFcwZ1EwRXdnZ0VpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElCCkR3QXdnZ0VLQW9JQkFRRE56RnYxUFZEaENUSlRFT01oaFZhR243YlB4M3hISnQ5bFIrRDhxck1qb1pleWZ5MmkKZkhOYXl4YUlSeVBkMzRselpCejJuRCtpMnhCM3VrcC9EYTU1aUNUSFdRdkJXVWhtRWgyaG5TM0ErUFVRdDVZRgpvZWV2a3Z0eEFLczB4YnBoR0hJNjlqTkRLZHFJYkxIOXl3UWdOdUZ1bGVZdWFMazIwd0F4dTJWVDFYZisvVklPClgrVlZTZkg0aEkveFUyT2F4OUtyYTlkQ1RkVDdWQ2M0SFVxRFF2SlMwQlJGeDNPaTFFVElUT2Vzd3kreklQNzYKL0dLamJsMWFobzB0VGJTWXJ5SWJqSzQweVF5cGcxNnAyb25Eeks4SkZFSHBnVG1VSy9FNE8zd1BIL05yVEdhTQpkV2lTVmZQbzduaE1OdFFsNXVHWFh3alJlVWhuQmdXU2l4a0xBZ01CQUFHallUQmZNQTRHQTFVZER3RUIvd1FFCkF3SUNwREFkQmdOVkhTVUVGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXcKQXdFQi96QWRCZ05WSFE0RUZnUVV3L0s4V1p4WU1YUGJLY2xRd1haZ3Y1LzZONTB3RFFZSktvWklodmNOQVFFTApCUUFEZ2dFQkFIRDNQNWt3SE1ycnQxSHM0TGlkS2UxbTJmQ2FmcVV3b1JiSC9BaWJZd1pTNVdXUzkwNXduNEplCkovejdmampOWnI5enRHZklCM0RZVDZqTWh0ejQ3ZkhQM0pzYVU3enNxL1RsME5HbDBSTXBLbnk4VFBYcHFvNUcKMWNNUTBxdFUvSGcrYWJuVUxJRDVUa25JWktDOWRZT1dVcGtGNHBBcEtXWTViUVMxZldPTGJ6ay8zbmVTVlNkRgp2MUIxZXpvNG9TZ0o4Q3RqOXdjOWtEVUMvTWdjNUNmdGgyNWVTZ1o3SytqaC9LUE1DK0VVRmJ5TEJTTGVsZi9rCmhjYzYwVUdNQ1FxNllPbWNiZjF6QitucTBHUDdXZUYrZHI5MnowS1BnWEZKQmVOU3U4WlN6dlgwbkRKdUM4QjEKSEdRS2hUWjlGWUJkN3V6bXFZZVBrT3huNytIbnB3QT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo= + tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURWekNDQWorZ0F3SUJBZ0lSQU9FVnZPc0tSQTRpM0R1akJxNlFkdHN3RFFZSktvWklodmNOQVFFTEJRQXcKRkRFU01CQUdBMVVFQXhNSlEybHNhWFZ0SUVOQk1CNFhEVEkyTURneE1qSXhNelUwTWxvWERUSTNNRGd4TWpJeApNelUwTWxvd0tqRW9NQ1lHQTFVRUF3d2ZLaTVrWldaaGRXeDBMbWgxWW1Kc1pTMW5jbkJqTG1OcGJHbDFiUzVwCmJ6Q0NBU0l3RFFZSktvWklodmNOQVFFQkJRQURnZ0VQQURDQ0FRb0NnZ0VCQU5TVVlFS1VhajZQZEZlaHF1QWIKRWpQWmJ4UmIxbDVuUTNXYkZxdDFZdThHSGJSRU1TT1k5WGFJa3Q3TGF4NHVXQXdUMGV6bVY2Vk04cTExMnM0LwovRGI5UkY3R2xVYlgxK1BaQmFCcTlDUXQrUGFNZXlKelRpbFJaUzY5VkxOL0EyRU5sQWZmaDBJdkZkeFV6cVdqCjNnNWZrTlF5ZjVZV08rQUZUWkFBaXVTRjFUN09KaEJBZEtwSlAvZVc4dVYvMzRrTlovTDFDb0xpaFhFajgxTnAKMi91SG43aU4xWjdYSHk0RzBpb1JmY214d0Z5MTBCdU5CakFxejNwR3NsTFFaU1JFbW50QTl5THc0M3RsWHZ3UApTOEEyUmJoQUZVNEs0ZlljaDBtK0Y2bEdMUVcrNDYwa2toTFk3MkVWQjdGMEFLZHNWK3BYcTJaWnFVOWdBWC9xCkdWMENBd0VBQWFPQmpUQ0JpakFPQmdOVkhROEJBZjhFQkFNQ0JhQXdIUVlEVlIwbEJCWXdGQVlJS3dZQkJRVUgKQXdFR0NDc0dBUVVGQndNQ01Bd0dBMVVkRXdFQi93UUNNQUF3SHdZRFZSMGpCQmd3Rm9BVXcvSzhXWnhZTVhQYgpLY2xRd1haZ3Y1LzZONTB3S2dZRFZSMFJCQ013SVlJZktpNWtaV1poZFd4MExtaDFZbUpzWlMxbmNuQmpMbU5wCmJHbDFiUzVwYnpBTkJna3Foa2lHOXcwQkFRc0ZBQU9DQVFFQWZEQmw5OWxWNzg1UFVqQ2VkMS9ES0k5dVljSSsKdXZlenRQRVJhNGdWelc2cEg4SkNSSEcwS1A2QW1oaEgxV2N4US84N3NWWHRyRi9YZ3VDNm1FMmxXdzY4UjBieApaRHBiZE1jRTVoM013cDkwcEJucEdMWk9SWXcrVmlkQytTY1UxZlQyZHIyMHhxS1pROW5IaGxnVTY1akRKQUowCkNEemNMVHE2ZHJZUkNPNlJDeXJQcmJrcjZRNEh3aGVjb3U3a3kxenNyRFZyMmwwNlBTbkVQM2dLUUMzdHR4RlcKOEh3cG1VdjV6MmxFVmUvajZpRmY2RlBtcWZyYTMxcWYyWG9pVkZmVXM3R05jeWZVSFk4MkR6dEMxU015Vk5aaAp6eGxseUpuQU4wQVZGSmdnYUNCcjd4a1l0MWlHS1pSbEpNUjdycTVVK3hQQjFNcGduMXkzU290aTF3PT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo= + tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb2dJQkFBS0NBUUVBMUpSZ1FwUnFQbzkwVjZHcTRCc1NNOWx2RkZ2V1htZERkWnNXcTNWaTd3WWR0RVF4Ckk1ajFkb2lTM3N0ckhpNVlEQlBSN09aWHBVenlyWFhhemovOE52MUVYc2FWUnRmWDQ5a0ZvR3IwSkMzNDlveDcKSW5OT0tWRmxMcjFVczM4RFlRMlVCOStIUWk4VjNGVE9wYVBlRGwrUTFESi9saFk3NEFWTmtBQ0s1SVhWUHM0bQpFRUIwcWtrLzk1Ynk1WC9maVExbjh2VUtndUtGY1NQelUybmIrNGVmdUkzVm50Y2ZMZ2JTS2hGOXliSEFYTFhRCkc0MEdNQ3JQZWtheVV0QmxKRVNhZTBEM0l2RGplMlZlL0E5THdEWkZ1RUFWVGdyaDloeUhTYjRYcVVZdEJiN2oKclNTU0V0anZZUlVIc1hRQXAyeFg2bGVyWmxtcFQyQUJmK29aWFFJREFRQUJBb0lCQUQwNEc3NmcwallCQng3RAplcHUrZ0EvNWdzRklyMlFSZGY1MDh1TGUwK2FGQ3VIaXI0b1NYMEpMRTR6ZzVSRFVoTnU1aTMrZldFZE04U2hlCkkreTR4WkFxZ05tUWMrWHFmQXhzYisvaVRUdnNGMklkVThxNGpSNWVCL2NkWkRxckRkU1IzZnNrZHVYcS9HOHUKNXpJUmpuM3lMSm5IanpHd1puN2QyQmZyNkJQbUpvTkxKbzZsVks1Tmx4VXhpRzdVak1nZlBwVmdUc3BQa1lEUQoxZEpaSmJQam55UGtqdXRPZVZLSnh0MUZyL21sdGVLYTk0d3dNdS9FQjlHSFVxVzlpZ2t1N2Z5MUhRLzJLSmRUCkVKYytZRlAvclhGeFBxcWlGN3FDWVNoQlRRZFVHemxYNENIVTVMeHAxR09xZmo0VFkvbGQyVFRZL24zUnBoay8KYU4vaGM5c0NnWUVBNi9xWmFKd0RTTzFaV3NNcEtnWTZrWUxrYmFZbTZnUnlIYmpVUWQzRUg0V3VHSHRJZnZLRgpnRkRCUm53anExR1NqRnloYnoybWZZYXBVbkZnT20waGRmSGs0aGFtNzJBL2EyVEZxMmhpYmlYTEljMVFwaVA3Ckptby9aVStNTi9Qeno0cy9EdmJCZDdLL3U2Z0lob3pvWUl3UDlGY1d3TkNFajI5Z1E0MXBqRThDZ1lFQTVwMk0Kd0lXMFFHRndBSU1WdWJyVXoyK1BCOG1yaENJbEVzRzJuV3FRNkhEcjdXeG82YVhJVGNJZk9vbjRXNmFoV3lETwpBMXJDc0hXWXpBZlkzamtjNkU5ZURtOHVJMzkwR3RtSGpVdUsybHMzanFheE9uRldNd3p1TlNDN0RtVFBrdHAvClJMR25KeFNubGdBMUJ6T1h4WE9yOHBQbEtIcjEwMGhZdjByKytKTUNnWUE3bVVjMWpIR244WW9ueWpLVFVvOW8KUU03QWdyNUJURzRsNDVCNE1qSmVZN3pjb2dabFNZcytKU2NyVGg4VUhiNE5oVGVnaU1tTDJuN1pPNWs2S0dYVApEQXpxclIzc1J6cTlQTzVQcEVWMzNFTzVmY2xvckoyNXpndkU0cHBmWjFXa2pWNlh3T3FMK0xGRUMrUmJWeXM1CmR5WndaNjV2ZERxR24zS0luU2FUTVFLQmdHVldDY2wzZHpOckhZbzhEOG5qWFN3aHUxb1N0am1EdjRLMGVJaEgKa1pGeVBWbkE3NERzQms2VTVLQVdqSG5KaU5IQVlvWjYxVjR3N29tSlVUU2xLQnkwODRHb1BULy8rNGJvMjNXdApJa0M5SUhhZ3JQUWZaVjlkYVRjVFFOOGNVVklZalNBa2FHejEySVpEWlFuYkUvQUIyaWJuOGlTTms0UGFJSlUrCllUZmRBb0dBU01EejBGb0dGNDBZbU1VRU9MVHRpVmMxQ1BQT21Zdks0c3ByRjQvWDh5eGYyL2luSy9UQk1sTC8KdzVhaWQ4Ym02dDhOUUErcVM5SWdNdnpTU3lFaUdmbjZsMmtDN1haWGI4UWI2SUF2SmF4ZzRLTElxN3ZIek5tegp1ZXd5YllTRWJVVjNYQVBPdlF2N0NkbGxqUWRDWHQwb3pmK2hnU0F2RjZCNTA4YkY4eUk9Ci0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg== + +--- +# Source: cilium/templates/cilium-configmap.yaml +apiVersion: v1 +kind: ConfigMap +metadata: + name: cilium-config + namespace: kube-system +data: + + # Identity allocation mode selects how identities are shared between cilium + # nodes by setting how they are stored. The options are "crd", "kvstore" or + # "doublewrite-readkvstore" / "doublewrite-readcrd". + # - "crd" stores identities in kubernetes as CRDs (custom resource definition). + # These can be queried with: + # kubectl get ciliumid + # - "kvstore" stores identities in an etcd kvstore, that is + # configured below. Cilium versions before 1.6 supported only the kvstore + # backend. Upgrades from these older cilium versions should continue using + # the kvstore by commenting out the identity-allocation-mode below, or + # setting it to "kvstore". + # - "doublewrite" modes store identities in both the kvstore and CRDs. This is useful + # for seamless migrations from the kvstore mode to the crd mode. Consult the + # documentation for more information on how to perform the migration. + identity-allocation-mode: crd + + identity-heartbeat-timeout: "30m0s" + identity-gc-interval: "15m0s" + cilium-endpoint-gc-interval: "5m0s" + nodes-gc-interval: "5m0s" + + # If you want to run cilium in debug mode change this value to true + debug: "false" + metrics-sampling-interval: "5m" + # The agent can be put into the following three policy enforcement modes + # default, always and never. + # https://docs.cilium.io/en/latest/security/policy/intro/#policy-enforcement-modes + enable-policy: "default" + # If you want metrics enabled in cilium-operator, set the port for + # which the Cilium Operator will have their metrics exposed. + # NOTE that this will open the port on the nodes where Cilium operator pod + # is scheduled. + operator-prometheus-serve-addr: ":9963" + enable-metrics: "true" + enable-policy-secrets-sync: "true" + policy-secrets-only-from-secrets-namespace: "true" + policy-secrets-namespace: "cilium-secrets" + + # Enable IPv4 addressing. If enabled, all endpoints are allocated an IPv4 + # address. + enable-ipv4: "true" + + # Enable IPv6 addressing. If enabled, all endpoints are allocated an IPv6 + # address. + enable-ipv6: "false" + # Users who wish to specify their own custom CNI configuration file must set + # custom-cni-conf to "true", otherwise Cilium may overwrite the configuration. + custom-cni-conf: "false" + enable-bpf-clock-probe: "false" + # If you want cilium monitor to aggregate tracing for packets, set this level + # to "low", "medium", or "maximum". The higher the level, the less packets + # that will be seen in monitor output. + monitor-aggregation: medium + + # The monitor aggregation interval governs the typical time between monitor + # notification events for each allowed connection. + # + # Only effective when monitor aggregation is set to "medium" or higher. + monitor-aggregation-interval: "5s" + + # The monitor aggregation flags determine which TCP flags which, upon the + # first observation, cause monitor notifications to be generated. + # + # Only effective when monitor aggregation is set to "medium" or higher. + monitor-aggregation-flags: all + # Specifies the ratio (0.0-1.0] of total system memory to use for dynamic + # sizing of the TCP CT, non-TCP CT, NAT and policy BPF maps. + bpf-map-dynamic-size-ratio: "0.0025" + # bpf-policy-map-max specifies the maximum number of entries in endpoint + # policy map (per endpoint) + bpf-policy-map-max: "16384" + # bpf-policy-stats-map-max specifies the maximum number of entries in global + # policy stats map + bpf-policy-stats-map-max: "65536" + # bpf-lb-map-max specifies the maximum number of entries in bpf lb service, + # backend and affinity maps. + bpf-lb-map-max: "65536" + bpf-lb-external-clusterip: "false" + bpf-lb-source-range-all-types: "false" + bpf-lb-algorithm-annotation: "false" + bpf-lb-mode-annotation: "false" + + bpf-distributed-lru: "false" + bpf-events-drop-enabled: "true" + bpf-events-policy-verdict-enabled: "true" + bpf-events-trace-enabled: "true" + + # Pre-allocation of map entries allows per-packet latency to be reduced, at + # the expense of up-front memory allocation for the entries in the maps. The + # default value below will minimize memory usage in the default installation; + # users who are sensitive to latency may consider setting this to "true". + # + # This option was introduced in Cilium 1.4. Cilium 1.3 and earlier ignore + # this option and behave as though it is set to "true". + # + # If this value is modified, then during the next Cilium startup the restore + # of existing endpoints and tracking of ongoing connections may be disrupted. + # As a result, reply packets may be dropped and the load-balancing decisions + # for established connections may change. + # + # If this option is set to "false" during an upgrade from 1.3 or earlier to + # 1.4 or later, then it may cause one-time disruptions during the upgrade. + preallocate-bpf-maps: "false" + + # Name of the cluster. Only relevant when building a mesh of clusters. + cluster-name: "default" + # Unique ID of the cluster. Must be unique across all connected clusters and + # in the range of 1 and 255. Only relevant when building a mesh of clusters. + cluster-id: "0" + + # Encapsulation mode for communication between nodes + # Possible values: + # - disabled + # - vxlan (default) + # - geneve + + routing-mode: "tunnel" + tunnel-protocol: "vxlan" + tunnel-source-port-range: "0-0" + service-no-backend-response: "reject" + policy-deny-response: "none" + + + # Enables L7 proxy for L7 policy enforcement and visibility + enable-l7-proxy: "true" + enable-ipv4-masquerade: "true" + enable-ipv4-big-tcp: "false" + enable-ipv6-big-tcp: "false" + enable-ipv6-masquerade: "true" + enable-tcx: "true" + datapath-mode: "veth" + enable-masquerade-to-route-source: "false" + + enable-xt-socket-fallback: "true" + install-no-conntrack-iptables-rules: "false" + iptables-random-fully: "false" + + auto-direct-node-routes: "false" + direct-routing-skip-unreachable: "false" + + + + kube-proxy-replacement: "false" + enable-no-service-endpoints-routable: "true" + bpf-lb-sock: "false" + enable-health-check-nodeport: "true" + enable-health-check-loadbalancer-ip: "false" + node-port-bind-protection: "true" + enable-auto-protect-node-port-range: "true" + bpf-lb-acceleration: "disabled" + enable-service-topology: "false" + enable-l2-neigh-discovery: "false" + k8s-require-ipv4-pod-cidr: "false" + k8s-require-ipv6-pod-cidr: "false" + enable-k8s-networkpolicy: "true" + enable-endpoint-lockdown-on-policy-overflow: "false" + # Tell the agent to generate and write a CNI configuration file + write-cni-conf-when-ready: /host/etc/cni/net.d/05-cilium.conflist + cni-exclusive: "true" + cni-log-file: "/var/run/cilium/cilium-cni.log" + enable-endpoint-health-checking: "true" + enable-health-checking: "true" + health-check-icmp-failure-threshold: "3" + enable-well-known-identities: "false" + enable-node-selector-labels: "false" + synchronize-k8s-nodes: "true" + operator-api-serve-addr: "127.0.0.1:9234" + + enable-hubble: "true" + # UNIX domain socket for Hubble server to listen to. + hubble-socket-path: "/var/run/cilium/hubble.sock" + hubble-network-policy-correlation-enabled: "true" + # An additional address for Hubble server to listen to (e.g. ":4244"). + hubble-listen-address: ":4244" + hubble-disable-tls: "false" + hubble-tls-cert-file: /var/lib/cilium/tls/hubble/server.crt + hubble-tls-key-file: /var/lib/cilium/tls/hubble/server.key + hubble-tls-client-ca-files: /var/lib/cilium/tls/hubble/client-ca.crt + ipam: "cluster-pool" + ipam-cilium-node-update-rate: "15s" + cluster-pool-ipv4-cidr: "10.0.0.0/8" + cluster-pool-ipv4-mask-size: "24" + + default-lb-service-ipam: "lbipam" + egress-gateway-reconciliation-trigger-interval: "1s" + enable-vtep: "false" + vtep-endpoint: "" + vtep-cidr: "" + vtep-mask: "" + vtep-mac: "" + + packetization-layer-pmtud-mode: "blackhole" + procfs: "/host/proc" + bpf-root: "/sys/fs/bpf" + cgroup-root: "/run/cilium/cgroupv2" + + identity-management-mode: "agent" + enable-sctp: "false" + remove-cilium-node-taints: "true" + set-cilium-node-taints: "true" + set-cilium-is-up-condition: "true" + unmanaged-pod-watcher-interval: "15s" + # default DNS proxy to transparent mode in non-chaining modes + dnsproxy-enable-transparent-mode: "true" + dnsproxy-socket-linger-timeout: "10" + tofqdns-dns-reject-response-code: "refused" + tofqdns-enable-dns-compression: "true" + tofqdns-endpoint-max-ip-per-hostname: "1000" + tofqdns-idle-connection-grace-period: "0s" + tofqdns-max-deferred-connection-deletes: "10000" + tofqdns-proxy-response-max-delay: "100ms" + tofqdns-preallocate-identities: "true" + agent-not-ready-taint-key: "node.cilium.io/agent-not-ready" + + mesh-auth-enabled: "false" + mesh-auth-queue-size: "1024" + mesh-auth-rotated-identities-queue-size: "1024" + mesh-auth-gc-interval: "5m0s" + + proxy-xff-num-trusted-hops-ingress: "0" + proxy-xff-num-trusted-hops-egress: "0" + proxy-connect-timeout: "2" + proxy-initial-fetch-timeout: "30" + proxy-max-active-downstream-connections: "50000" + proxy-max-requests-per-connection: "0" + proxy-max-connection-duration-seconds: "0" + proxy-idle-timeout-seconds: "60" + proxy-max-concurrent-retries: "128" + proxy-use-original-source-address: "true" + proxy-cluster-max-connections: "1024" + proxy-cluster-max-requests: "1024" + http-retry-count: "3" + http-stream-idle-timeout: "300" + + external-envoy-proxy: "true" + envoy-base-id: "0" + envoy-access-log-buffer-size: "4096" + envoy-keep-cap-netbindservice: "false" + max-connected-clusters: "255" + clustermesh-cache-ttl: "0s" + clustermesh-enable-endpoint-sync: "false" + clustermesh-enable-mcs-api: "false" + clustermesh-mcs-api-install-crds: "true" + policy-default-local-cluster: "true" + + nat-map-stats-entries: "32" + nat-map-stats-interval: "30s" + enable-lb-ipam: "true" + enable-non-default-deny-policies: "true" + enable-source-ip-verification: "true" + enable-dynamic-config: "true" + enable-drift-checker: "true" + +# Extra config allows adding arbitrary properties to the cilium config. +# By putting it at the end of the ConfigMap, it's also possible to override existing properties. +--- +# Source: cilium/templates/cilium-envoy/configmap.yaml +apiVersion: v1 +kind: ConfigMap +metadata: + name: cilium-envoy-config + namespace: kube-system +data: + # Keep the key name as bootstrap-config.json to avoid breaking changes + bootstrap-config.json: | + {"admin":{"address":{"pipe":{"mode":432,"path":"/var/run/cilium/envoy/sockets/admin.sock"}}},"applicationLogConfig":{"logFormat":{"textFormat":"[%Y-%m-%d %T.%e][%t][%l][%n] [%g:%#] %v"}},"bootstrapExtensions":[{"name":"envoy.bootstrap.internal_listener","typedConfig":{"@type":"type.googleapis.com/envoy.extensions.bootstrap.internal_listener.v3.InternalListener"}}],"dynamicResources":{"cdsConfig":{"apiConfigSource":{"apiType":"GRPC","grpcServices":[{"envoyGrpc":{"clusterName":"xds-grpc-cilium"}}],"setNodeOnFirstMessageOnly":true,"transportApiVersion":"V3"},"initialFetchTimeout":"30s","resourceApiVersion":"V3"},"ldsConfig":{"apiConfigSource":{"apiType":"GRPC","grpcServices":[{"envoyGrpc":{"clusterName":"xds-grpc-cilium"}}],"setNodeOnFirstMessageOnly":true,"transportApiVersion":"V3"},"initialFetchTimeout":"30s","resourceApiVersion":"V3"}},"node":{"cluster":"ingress-cluster","id":"host~127.0.0.1~no-id~localdomain"},"overloadManager":{"resourceMonitors":[{"name":"envoy.resource_monitors.global_downstream_max_connections","typedConfig":{"@type":"type.googleapis.com/envoy.extensions.resource_monitors.downstream_connections.v3.DownstreamConnectionsConfig","max_active_downstream_connections":"50000"}}]},"staticResources":{"clusters":[{"circuitBreakers":{"thresholds":[{"maxConnections":1024,"maxRequests":1024,"maxRetries":128}]},"cleanupInterval":"2.500s","connectTimeout":"2s","lbPolicy":"CLUSTER_PROVIDED","name":"ingress-cluster","type":"ORIGINAL_DST","typedExtensionProtocolOptions":{"envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{"@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions","commonHttpProtocolOptions":{"idleTimeout":"60s","maxConnectionDuration":"0s","maxRequestsPerConnection":0},"useDownstreamProtocolConfig":{}}}},{"circuitBreakers":{"thresholds":[{"maxConnections":1024,"maxRequests":1024,"maxRetries":128}]},"cleanupInterval":"2.500s","connectTimeout":"2s","lbPolicy":"CLUSTER_PROVIDED","name":"egress-cluster-tls","transportSocket":{"name":"cilium.tls_wrapper","typedConfig":{"@type":"type.googleapis.com/cilium.UpstreamTlsWrapperContext"}},"type":"ORIGINAL_DST","typedExtensionProtocolOptions":{"envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{"@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions","commonHttpProtocolOptions":{"idleTimeout":"60s","maxConnectionDuration":"0s","maxRequestsPerConnection":0},"upstreamHttpProtocolOptions":{},"useDownstreamProtocolConfig":{}}}},{"circuitBreakers":{"thresholds":[{"maxConnections":1024,"maxRequests":1024,"maxRetries":128}]},"cleanupInterval":"2.500s","connectTimeout":"2s","lbPolicy":"CLUSTER_PROVIDED","name":"egress-cluster","type":"ORIGINAL_DST","typedExtensionProtocolOptions":{"envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{"@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions","commonHttpProtocolOptions":{"idleTimeout":"60s","maxConnectionDuration":"0s","maxRequestsPerConnection":0},"useDownstreamProtocolConfig":{}}}},{"circuitBreakers":{"thresholds":[{"maxConnections":1024,"maxRequests":1024,"maxRetries":128}]},"cleanupInterval":"2.500s","connectTimeout":"2s","lbPolicy":"CLUSTER_PROVIDED","name":"ingress-cluster-tls","transportSocket":{"name":"cilium.tls_wrapper","typedConfig":{"@type":"type.googleapis.com/cilium.UpstreamTlsWrapperContext"}},"type":"ORIGINAL_DST","typedExtensionProtocolOptions":{"envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{"@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions","commonHttpProtocolOptions":{"idleTimeout":"60s","maxConnectionDuration":"0s","maxRequestsPerConnection":0},"upstreamHttpProtocolOptions":{},"useDownstreamProtocolConfig":{}}}},{"connectTimeout":"2s","loadAssignment":{"clusterName":"xds-grpc-cilium","endpoints":[{"lbEndpoints":[{"endpoint":{"address":{"pipe":{"path":"/var/run/cilium/envoy/sockets/xds.sock"}}}}]}]},"name":"xds-grpc-cilium","type":"STATIC","typedExtensionProtocolOptions":{"envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{"@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions","explicitHttpConfig":{"http2ProtocolOptions":{}}}}},{"connectTimeout":"2s","loadAssignment":{"clusterName":"/envoy-admin","endpoints":[{"lbEndpoints":[{"endpoint":{"address":{"pipe":{"path":"/var/run/cilium/envoy/sockets/admin.sock"}}}}]}]},"name":"/envoy-admin","type":"STATIC"}],"listeners":[{"address":{"socketAddress":{"address":"0.0.0.0","portValue":9964}},"filterChains":[{"filters":[{"name":"envoy.filters.network.http_connection_manager","typedConfig":{"@type":"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager","httpFilters":[{"name":"envoy.filters.http.router","typedConfig":{"@type":"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"}}],"internalAddressConfig":{"cidrRanges":[{"addressPrefix":"10.0.0.0","prefixLen":8},{"addressPrefix":"172.16.0.0","prefixLen":12},{"addressPrefix":"192.168.0.0","prefixLen":16},{"addressPrefix":"127.0.0.1","prefixLen":32}]},"routeConfig":{"virtualHosts":[{"domains":["*"],"name":"prometheus_metrics_route","routes":[{"match":{"prefix":"/metrics"},"name":"prometheus_metrics_route","route":{"cluster":"/envoy-admin","prefixRewrite":"/stats/prometheus"}}]}]},"statPrefix":"envoy-prometheus-metrics-listener","streamIdleTimeout":"300s"}}]}],"name":"envoy-prometheus-metrics-listener"},{"address":{"socketAddress":{"address":"127.0.0.1","portValue":9878}},"filterChains":[{"filters":[{"name":"envoy.filters.network.http_connection_manager","typedConfig":{"@type":"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager","httpFilters":[{"name":"envoy.filters.http.router","typedConfig":{"@type":"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"}}],"internalAddressConfig":{"cidrRanges":[{"addressPrefix":"10.0.0.0","prefixLen":8},{"addressPrefix":"172.16.0.0","prefixLen":12},{"addressPrefix":"192.168.0.0","prefixLen":16},{"addressPrefix":"127.0.0.1","prefixLen":32}]},"routeConfig":{"virtual_hosts":[{"domains":["*"],"name":"health","routes":[{"match":{"prefix":"/healthz"},"name":"health","route":{"cluster":"/envoy-admin","prefixRewrite":"/ready"}}]}]},"statPrefix":"envoy-health-listener","streamIdleTimeout":"300s"}}]}],"name":"envoy-health-listener"}]}} + +--- +# Source: cilium/templates/cilium-agent/clusterrole.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: cilium + labels: + app.kubernetes.io/part-of: cilium +rules: +- apiGroups: + - networking.k8s.io + resources: + - networkpolicies + verbs: + - get + - list + - watch +- apiGroups: + - discovery.k8s.io + resources: + - endpointslices + verbs: + - get + - list + - watch +- apiGroups: + - "" + resources: + - namespaces + - services + - pods + - endpoints + - nodes + verbs: + - get + - list + - watch +- apiGroups: + - apiextensions.k8s.io + resources: + - customresourcedefinitions + verbs: + - list + - watch + # This is used when validating policies in preflight. This will need to stay + # until we figure out how to avoid "get" inside the preflight, and then + # should be removed ideally. + - get +- apiGroups: + - cilium.io + resources: + - ciliumloadbalancerippools + - ciliumbgppeeringpolicies + - ciliumbgpnodeconfigs + - ciliumbgpadvertisements + - ciliumbgppeerconfigs + - ciliumclusterwideenvoyconfigs + - ciliumclusterwidenetworkpolicies + - ciliumegressgatewaypolicies + - ciliumendpoints + - ciliumendpointslices + - ciliumenvoyconfigs + - ciliumidentities + - ciliumlocalredirectpolicies + - ciliumnetworkpolicies + - ciliumnodes + - ciliumnodeconfigs + - ciliumcidrgroups + - ciliuml2announcementpolicies + - ciliumpodippools + verbs: + - list + - watch +- apiGroups: + - cilium.io + resources: + - ciliumidentities + - ciliumendpoints + - ciliumnodes + verbs: + - create +- apiGroups: + - cilium.io + # To synchronize garbage collection of such resources + resources: + - ciliumidentities + verbs: + - update +- apiGroups: + - cilium.io + resources: + - ciliumendpoints + verbs: + - delete + - get +- apiGroups: + - cilium.io + resources: + - ciliumnodes + - ciliumnodes/status + verbs: + - get + - update +- apiGroups: + - cilium.io + resources: + - ciliumendpoints/status + - ciliumendpoints + - ciliuml2announcementpolicies/status + - ciliumbgpnodeconfigs/status + verbs: + - patch + +--- +# Source: cilium/templates/cilium-operator/clusterrole.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: cilium-operator + labels: + app.kubernetes.io/part-of: cilium +rules: +- apiGroups: + - "" + resources: + - pods + verbs: + - get + - list + - watch + # to automatically delete [core|kube]dns pods so that are starting to being + # managed by Cilium + - delete +- apiGroups: + - "" + resources: + - configmaps + resourceNames: + - cilium-config + verbs: + # allow patching of the configmap to set annotations + - patch +- apiGroups: + - "" + resources: + - nodes + verbs: + - list + - watch +- apiGroups: + - "" + resources: + # To remove node taints + - nodes + # To set NetworkUnavailable false on startup + - nodes/status + verbs: + - patch +- apiGroups: + - discovery.k8s.io + resources: + - endpointslices + verbs: + - get + - list + - watch +- apiGroups: + - "" + resources: + # to perform LB IP allocation for BGP + - services/status + verbs: + - update + - patch +- apiGroups: + - "" + resources: + # to check apiserver connectivity + - namespaces + - secrets + verbs: + - get + - list + - watch +- apiGroups: + - "" + resources: + # to perform the translation of a CNP that contains `ToGroup` to its endpoints + - services + - endpoints + verbs: + - get + - list + - watch +- apiGroups: + - cilium.io + resources: + - ciliumnetworkpolicies + - ciliumclusterwidenetworkpolicies + verbs: + # Create auto-generated CNPs and CCNPs from Policies that have 'toGroups' + - create + - update + - deletecollection + # To update the status of the CNPs and CCNPs + - patch + - get + - list + - watch +- apiGroups: + - cilium.io + resources: + - ciliumnetworkpolicies/status + - ciliumclusterwidenetworkpolicies/status + verbs: + # Update the auto-generated CNPs and CCNPs status. + - patch + - update +- apiGroups: + - cilium.io + resources: + - ciliumendpoints + - ciliumidentities + verbs: + # To perform garbage collection of such resources + - delete + - list + - watch +- apiGroups: + - cilium.io + resources: + - ciliumidentities + verbs: + # To synchronize garbage collection of such resources + - update +- apiGroups: + - cilium.io + resources: + - ciliumnodes + verbs: + - create + - update + - get + - list + - watch + # To perform CiliumNode garbage collector + - delete +- apiGroups: + - cilium.io + resources: + - ciliumnodes/status + verbs: + - update +- apiGroups: + - cilium.io + resources: + - ciliumendpointslices + - ciliumenvoyconfigs + - ciliumbgppeerconfigs + - ciliumbgpadvertisements + - ciliumbgpnodeconfigs + verbs: + - create + - update + - get + - list + - watch + - delete + - patch +- apiGroups: + - cilium.io + resources: + - ciliumbgpclusterconfigs/status + - ciliumbgppeerconfigs/status + verbs: + - update +- apiGroups: + - apiextensions.k8s.io + resources: + - customresourcedefinitions + verbs: + - create + - get + - list + - watch +- apiGroups: + - apiextensions.k8s.io + resources: + - customresourcedefinitions + verbs: + - update + resourceNames: + - ciliumloadbalancerippools.cilium.io + - ciliumbgpclusterconfigs.cilium.io + - ciliumbgppeerconfigs.cilium.io + - ciliumbgpadvertisements.cilium.io + - ciliumbgpnodeconfigs.cilium.io + - ciliumbgpnodeconfigoverrides.cilium.io + - ciliumclusterwideenvoyconfigs.cilium.io + - ciliumclusterwidenetworkpolicies.cilium.io + - ciliumegressgatewaypolicies.cilium.io + - ciliumendpoints.cilium.io + - ciliumendpointslices.cilium.io + - ciliumenvoyconfigs.cilium.io + - ciliumidentities.cilium.io + - ciliumlocalredirectpolicies.cilium.io + - ciliumnetworkpolicies.cilium.io + - ciliumnodes.cilium.io + - ciliumnodeconfigs.cilium.io + - ciliumcidrgroups.cilium.io + - ciliuml2announcementpolicies.cilium.io + - ciliumpodippools.cilium.io + - ciliumgatewayclassconfigs.cilium.io +- apiGroups: + - cilium.io + resources: + - ciliumloadbalancerippools + - ciliumpodippools + - ciliumbgppeeringpolicies + - ciliumbgpclusterconfigs + - ciliumbgpnodeconfigoverrides + - ciliumbgppeerconfigs + verbs: + - get + - list + - watch +- apiGroups: + - cilium.io + resources: + - ciliumpodippools + verbs: + - create +- apiGroups: + - cilium.io + resources: + - ciliumloadbalancerippools/status + verbs: + - patch +# For cilium-operator running in HA mode. +# +# Cilium operator running in HA mode requires the use of ResourceLock for Leader Election +# between multiple running instances. +# The preferred way of doing this is to use LeasesResourceLock as edits to Leases are less +# common and fewer objects in the cluster watch "all Leases". +- apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - create + - get + - update +- apiGroups: + - cilium.io + resources: + - ciliumendpointslices + verbs: + - deletecollection + +--- +# Source: cilium/templates/cilium-agent/clusterrolebinding.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: cilium + labels: + app.kubernetes.io/part-of: cilium +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: cilium +subjects: +- kind: ServiceAccount + name: "cilium" + namespace: kube-system + +--- +# Source: cilium/templates/cilium-operator/clusterrolebinding.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: cilium-operator + labels: + app.kubernetes.io/part-of: cilium +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: cilium-operator +subjects: +- kind: ServiceAccount + name: "cilium-operator" + namespace: kube-system + +--- +# Source: cilium/templates/cilium-agent/role.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: cilium-config-agent + namespace: kube-system + labels: + app.kubernetes.io/part-of: cilium +rules: +- apiGroups: + - "" + resources: + - configmaps + verbs: + - get + - list + - watch +--- +# Source: cilium/templates/cilium-agent/role.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: cilium-tlsinterception-secrets + namespace: "cilium-secrets" + labels: + app.kubernetes.io/part-of: cilium +rules: +- apiGroups: + - "" + resources: + - secrets + verbs: + - get + - list + - watch + +--- +# Source: cilium/templates/cilium-operator/role.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: cilium-operator-tlsinterception-secrets + namespace: "cilium-secrets" + labels: + app.kubernetes.io/part-of: cilium +rules: +- apiGroups: + - "" + resources: + - secrets + verbs: + - create + - delete + - update + - patch +--- +# Source: cilium/templates/cilium-operator/role.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: cilium-operator-ztunnel + namespace: kube-system + labels: + app.kubernetes.io/part-of: cilium +rules: +# ZTunnel DaemonSet management permissions +# Note: These permissions must always be granted (not conditional on encryption.type) +# because the controller needs to clean up stale DaemonSets when ztunnel is disabled. +- apiGroups: + - apps + resources: + - daemonsets + verbs: + - create + - delete + - get + - list + - watch + +--- +# Source: cilium/templates/cilium-agent/rolebinding.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: cilium-config-agent + namespace: kube-system + labels: + app.kubernetes.io/part-of: cilium +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: cilium-config-agent +subjects: + - kind: ServiceAccount + name: "cilium" + namespace: kube-system +--- +# Source: cilium/templates/cilium-agent/rolebinding.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: cilium-tlsinterception-secrets + namespace: "cilium-secrets" + labels: + app.kubernetes.io/part-of: cilium +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: cilium-tlsinterception-secrets +subjects: +- kind: ServiceAccount + name: "cilium" + namespace: kube-system + +--- +# Source: cilium/templates/cilium-operator/rolebinding.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: cilium-operator-tlsinterception-secrets + namespace: "cilium-secrets" + labels: + app.kubernetes.io/part-of: cilium +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: cilium-operator-tlsinterception-secrets +subjects: +- kind: ServiceAccount + name: "cilium-operator" + namespace: kube-system +--- +# Source: cilium/templates/cilium-operator/rolebinding.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: cilium-operator-ztunnel + namespace: kube-system + labels: + app.kubernetes.io/part-of: cilium +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: cilium-operator-ztunnel +subjects: +- kind: ServiceAccount + name: "cilium-operator" + namespace: kube-system + +--- +# Source: cilium/templates/cilium-envoy/service.yaml +apiVersion: v1 +kind: Service +metadata: + name: cilium-envoy + namespace: kube-system + annotations: + prometheus.io/scrape: "true" + prometheus.io/port: "9964" + labels: + k8s-app: cilium-envoy + app.kubernetes.io/name: cilium-envoy + app.kubernetes.io/part-of: cilium + io.cilium/app: proxy +spec: + clusterIP: None + type: ClusterIP + selector: + k8s-app: cilium-envoy + ports: + - name: envoy-metrics + port: 9964 + protocol: TCP + targetPort: 9964 + +--- +# Source: cilium/templates/hubble/peer-service.yaml +apiVersion: v1 +kind: Service +metadata: + name: hubble-peer + namespace: kube-system + labels: + k8s-app: cilium + app.kubernetes.io/part-of: cilium + app.kubernetes.io/name: hubble-peer + +spec: + selector: + k8s-app: cilium + ports: + - name: peer-service + port: 443 + protocol: TCP + targetPort: 4244 + internalTrafficPolicy: Local + +--- +# Source: cilium/templates/cilium-agent/daemonset.yaml +apiVersion: apps/v1 +kind: DaemonSet +metadata: + name: cilium + namespace: kube-system + labels: + k8s-app: cilium + app.kubernetes.io/part-of: cilium + app.kubernetes.io/name: cilium-agent +spec: + selector: + matchLabels: + k8s-app: cilium + updateStrategy: + rollingUpdate: + maxUnavailable: 2 + type: RollingUpdate + template: + metadata: + annotations: + kubectl.kubernetes.io/default-container: cilium-agent + labels: + k8s-app: cilium + app.kubernetes.io/name: cilium-agent + app.kubernetes.io/part-of: cilium + spec: + securityContext: + appArmorProfile: + type: Unconfined + seccompProfile: + type: Unconfined + containers: + - name: cilium-agent + image: "quay.io/cilium/cilium:v1.19.5@sha256:20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732" + imagePullPolicy: IfNotPresent + command: + - cilium-agent + args: + - --config-dir=/tmp/cilium/config-map + startupProbe: + httpGet: + host: "127.0.0.1" + path: /healthz + port: health + scheme: HTTP + httpHeaders: + - name: "brief" + value: "true" + failureThreshold: 300 + periodSeconds: 2 + successThreshold: 1 + initialDelaySeconds: 5 + livenessProbe: + httpGet: + host: "127.0.0.1" + path: /healthz + port: health + scheme: HTTP + httpHeaders: + - name: "brief" + value: "true" + - name: "require-k8s-connectivity" + value: "false" + periodSeconds: 30 + successThreshold: 1 + failureThreshold: 10 + timeoutSeconds: 5 + readinessProbe: + httpGet: + host: "127.0.0.1" + path: /healthz + port: health + scheme: HTTP + httpHeaders: + - name: "brief" + value: "true" + periodSeconds: 30 + successThreshold: 1 + failureThreshold: 3 + timeoutSeconds: 5 + env: + - name: K8S_NODE_NAME + valueFrom: + fieldRef: + apiVersion: v1 + fieldPath: spec.nodeName + - name: CILIUM_K8S_NAMESPACE + valueFrom: + fieldRef: + apiVersion: v1 + fieldPath: metadata.namespace + - name: CILIUM_CLUSTERMESH_CONFIG + value: /var/lib/cilium/clustermesh/ + - name: GOMEMLIMIT + valueFrom: + resourceFieldRef: + resource: limits.memory + divisor: '1' + - name: KUBE_CLIENT_BACKOFF_BASE + value: "1" + - name: KUBE_CLIENT_BACKOFF_DURATION + value: "120" + lifecycle: + postStart: + exec: + command: + - "bash" + - "-c" + - | + set -o errexit + set -o pipefail + set -o nounset + + # When running in AWS ENI mode, it's likely that 'aws-node' has + # had a chance to install SNAT iptables rules. These can result + # in dropped traffic, so we should attempt to remove them. + # We do it using a 'postStart' hook since this may need to run + # for nodes which might have already been init'ed but may still + # have dangling rules. This is safe because there are no + # dependencies on anything that is part of the startup script + # itself, and can be safely run multiple times per node (e.g. in + # case of a restart). + if [[ "$(iptables-save | grep -E -c 'AWS-SNAT-CHAIN|AWS-CONNMARK-CHAIN')" != "0" ]]; + then + echo 'Deleting iptables rules created by the AWS CNI VPC plugin' + iptables-save | grep -E -v 'AWS-SNAT-CHAIN|AWS-CONNMARK-CHAIN' | iptables-restore + fi + echo 'Done!' + + preStop: + exec: + command: + - /cni-uninstall.sh + ports: + - name: health + containerPort: 9879 + hostPort: 9879 + protocol: TCP + - name: peer-service + containerPort: 4244 + hostPort: 4244 + protocol: TCP + securityContext: + seLinuxOptions: + level: s0 + type: spc_t + capabilities: + add: + - CHOWN + - KILL + - NET_ADMIN + - NET_RAW + - IPC_LOCK + - SYS_MODULE + - SYS_ADMIN + - SYS_RESOURCE + - DAC_OVERRIDE + - FOWNER + - SETGID + - SETUID + - SYSLOG + drop: + - ALL + terminationMessagePolicy: FallbackToLogsOnError + volumeMounts: + - name: envoy-sockets + mountPath: /var/run/cilium/envoy/sockets + readOnly: false + # Unprivileged containers need to mount /proc/sys/net from the host + # to have write access + - mountPath: /host/proc/sys/net + name: host-proc-sys-net + # Unprivileged containers need to mount /proc/sys/kernel from the host + # to have write access + - mountPath: /host/proc/sys/kernel + name: host-proc-sys-kernel + - name: bpf-maps + mountPath: /sys/fs/bpf + # Unprivileged containers can't set mount propagation to bidirectional + # in this case we will mount the bpf fs from an init container that + # is privileged and set the mount propagation from host to container + # in Cilium. + mountPropagation: HostToContainer + - name: cilium-run + mountPath: /var/run/cilium + - name: cilium-netns + mountPath: /var/run/cilium/netns + mountPropagation: HostToContainer + - name: etc-cni-netd + mountPath: /host/etc/cni/net.d + - name: clustermesh-secrets + mountPath: /var/lib/cilium/clustermesh + readOnly: true + # Needed to be able to load kernel modules + - name: lib-modules + mountPath: /lib/modules + readOnly: true + - name: xtables-lock + mountPath: /run/xtables.lock + - name: hubble-tls + mountPath: /var/lib/cilium/tls/hubble + readOnly: true + - name: tmp + mountPath: /tmp + + initContainers: + - name: config + image: "quay.io/cilium/cilium:v1.19.5@sha256:20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732" + imagePullPolicy: IfNotPresent + command: + - cilium-dbg + - build-config + env: + - name: K8S_NODE_NAME + valueFrom: + fieldRef: + apiVersion: v1 + fieldPath: spec.nodeName + - name: CILIUM_K8S_NAMESPACE + valueFrom: + fieldRef: + apiVersion: v1 + fieldPath: metadata.namespace + volumeMounts: + - name: tmp + mountPath: /tmp + terminationMessagePolicy: FallbackToLogsOnError + securityContext: + capabilities: + add: + - NET_ADMIN + drop: + - ALL + # Required to mount cgroup2 filesystem on the underlying Kubernetes node. + # We use nsenter command with host's cgroup and mount namespaces enabled. + - name: mount-cgroup + image: "quay.io/cilium/cilium:v1.19.5@sha256:20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732" + imagePullPolicy: IfNotPresent + env: + - name: CGROUP_ROOT + value: /run/cilium/cgroupv2 + - name: BIN_PATH + value: /opt/cni/bin + command: + - bash + - -ec + # The statically linked Go program binary is invoked to avoid any + # dependency on utilities like sh and mount that can be missing on certain + # distros installed on the underlying host. Copy the binary to the + # same directory where we install cilium cni plugin so that exec permissions + # are available. + - | + cp /usr/bin/cilium-mount /hostbin/cilium-mount; + nsenter --cgroup=/hostproc/1/ns/cgroup --mount=/hostproc/1/ns/mnt "${BIN_PATH}/cilium-mount" $CGROUP_ROOT; + rm /hostbin/cilium-mount + volumeMounts: + - name: hostproc + mountPath: /hostproc + - name: cni-path + mountPath: /hostbin + terminationMessagePolicy: FallbackToLogsOnError + securityContext: + seLinuxOptions: + level: s0 + type: spc_t + capabilities: + add: + - SYS_ADMIN + - SYS_CHROOT + - SYS_PTRACE + drop: + - ALL + - name: apply-sysctl-overwrites + image: "quay.io/cilium/cilium:v1.19.5@sha256:20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732" + imagePullPolicy: IfNotPresent + env: + - name: BIN_PATH + value: /opt/cni/bin + command: + - bash + - -ec + # The statically linked Go program binary is invoked to avoid any + # dependency on utilities like sh that can be missing on certain + # distros installed on the underlying host. Copy the binary to the + # same directory where we install cilium cni plugin so that exec permissions + # are available. + - | + cp /usr/bin/cilium-sysctlfix /hostbin/cilium-sysctlfix; + nsenter --mount=/hostproc/1/ns/mnt "${BIN_PATH}/cilium-sysctlfix"; + rm /hostbin/cilium-sysctlfix + volumeMounts: + - name: hostproc + mountPath: /hostproc + - name: cni-path + mountPath: /hostbin + terminationMessagePolicy: FallbackToLogsOnError + securityContext: + seLinuxOptions: + level: s0 + type: spc_t + capabilities: + add: + - SYS_ADMIN + - SYS_CHROOT + - SYS_PTRACE + drop: + - ALL + # Mount the bpf fs if it is not mounted. We will perform this task + # from a privileged container because the mount propagation bidirectional + # only works from privileged containers. + - name: mount-bpf-fs + image: "quay.io/cilium/cilium:v1.19.5@sha256:20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732" + imagePullPolicy: IfNotPresent + args: + - 'mount | grep "/sys/fs/bpf type bpf" || mount -t bpf bpf /sys/fs/bpf' + command: + - /bin/bash + - -c + - -- + terminationMessagePolicy: FallbackToLogsOnError + securityContext: + privileged: true + volumeMounts: + - name: bpf-maps + mountPath: /sys/fs/bpf + mountPropagation: Bidirectional + - name: clean-cilium-state + image: "quay.io/cilium/cilium:v1.19.5@sha256:20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732" + imagePullPolicy: IfNotPresent + command: + - /init-container.sh + env: + - name: CILIUM_ALL_STATE + valueFrom: + configMapKeyRef: + name: cilium-config + key: clean-cilium-state + optional: true + - name: CILIUM_BPF_STATE + valueFrom: + configMapKeyRef: + name: cilium-config + key: clean-cilium-bpf-state + optional: true + - name: WRITE_CNI_CONF_WHEN_READY + valueFrom: + configMapKeyRef: + name: cilium-config + key: write-cni-conf-when-ready + optional: true + terminationMessagePolicy: FallbackToLogsOnError + securityContext: + seLinuxOptions: + level: s0 + type: spc_t + capabilities: + add: + - NET_ADMIN + - SYS_MODULE + - SYS_ADMIN + - SYS_RESOURCE + drop: + - ALL + volumeMounts: + - name: bpf-maps + mountPath: /sys/fs/bpf + # Required to mount cgroup filesystem from the host to cilium agent pod + - name: cilium-cgroup + mountPath: /run/cilium/cgroupv2 + mountPropagation: HostToContainer + - name: cilium-run + mountPath: /var/run/cilium # wait-for-kube-proxy + # Install the CNI binaries in an InitContainer so we don't have a writable host mount in the agent + - name: install-cni-binaries + image: "quay.io/cilium/cilium:v1.19.5@sha256:20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732" + imagePullPolicy: IfNotPresent + command: + - "/install-plugin.sh" + resources: + limits: + cpu: 1 + memory: 1Gi + requests: + cpu: 100m + memory: 10Mi + securityContext: + seLinuxOptions: + level: s0 + type: spc_t + capabilities: + drop: + - ALL + terminationMessagePolicy: FallbackToLogsOnError + volumeMounts: + - name: cni-path + mountPath: /host/opt/cni/bin # .Values.cni.install + restartPolicy: Always + priorityClassName: system-node-critical + serviceAccountName: "cilium" + automountServiceAccountToken: true + terminationGracePeriodSeconds: 1 + hostNetwork: true + + affinity: + podAntiAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchLabels: + k8s-app: cilium + topologyKey: kubernetes.io/hostname + nodeSelector: + kubernetes.io/os: linux + tolerations: + - operator: Exists + volumes: + # For sharing configuration between the "config" initContainer and the agent + - name: tmp + emptyDir: {} + # To keep state between restarts / upgrades + - name: cilium-run + hostPath: + path: /var/run/cilium + type: DirectoryOrCreate + # To exec into pod network namespaces + - name: cilium-netns + hostPath: + path: /var/run/netns + type: DirectoryOrCreate + # To keep state between restarts / upgrades for bpf maps + - name: bpf-maps + hostPath: + path: /sys/fs/bpf + type: DirectoryOrCreate + # To mount cgroup2 filesystem on the host or apply sysctlfix + - name: hostproc + hostPath: + path: /proc + type: Directory + # To keep state between restarts / upgrades for cgroup2 filesystem + - name: cilium-cgroup + hostPath: + path: /run/cilium/cgroupv2 + type: DirectoryOrCreate + # To install cilium cni plugin in the host + - name: cni-path + hostPath: + path: /opt/cni/bin + type: DirectoryOrCreate + # To install cilium cni configuration in the host + - name: etc-cni-netd + hostPath: + path: /etc/cni/net.d + type: DirectoryOrCreate + # To be able to load kernel modules + - name: lib-modules + hostPath: + path: /lib/modules + # To access iptables concurrently with other processes (e.g. kube-proxy) + - name: xtables-lock + hostPath: + path: /run/xtables.lock + type: FileOrCreate + # Sharing socket with Cilium Envoy on the same node by using a host path + - name: envoy-sockets + hostPath: + path: "/var/run/cilium/envoy/sockets" + type: DirectoryOrCreate + # To read the clustermesh configuration + - name: clustermesh-secrets + projected: + # note: the leading zero means this number is in octal representation: do not remove it + defaultMode: 0400 + sources: + - secret: + name: cilium-clustermesh + optional: true + # note: items are not explicitly listed here, since the entries of this secret + # depend on the peers configured, and that would cause a restart of all agents + # at every addition/removal. Leaving the field empty makes each secret entry + # to be automatically projected into the volume as a file whose name is the key. + - secret: + name: clustermesh-apiserver-remote-cert + optional: true + items: + - key: tls.key + path: common-etcd-client.key + - key: tls.crt + path: common-etcd-client.crt + - key: ca.crt + path: common-etcd-client-ca.crt + # note: we configure the volume for the kvstoremesh-specific certificate + # regardless of whether KVStoreMesh is enabled or not, so that it can be + # automatically mounted in case KVStoreMesh gets subsequently enabled, + # without requiring an agent restart. + - secret: + name: clustermesh-apiserver-local-cert + optional: true + items: + - key: tls.key + path: local-etcd-client.key + - key: tls.crt + path: local-etcd-client.crt + - key: ca.crt + path: local-etcd-client-ca.crt + - name: host-proc-sys-net + hostPath: + path: /proc/sys/net + type: Directory + - name: host-proc-sys-kernel + hostPath: + path: /proc/sys/kernel + type: Directory + - name: hubble-tls + projected: + # note: the leading zero means this number is in octal representation: do not remove it + defaultMode: 0400 + sources: + - secret: + name: hubble-server-certs + optional: true + items: + - key: tls.crt + path: server.crt + - key: tls.key + path: server.key + - key: ca.crt + path: client-ca.crt + + +--- +# Source: cilium/templates/cilium-envoy/daemonset.yaml +apiVersion: apps/v1 +kind: DaemonSet +metadata: + name: cilium-envoy + namespace: kube-system + labels: + k8s-app: cilium-envoy + app.kubernetes.io/part-of: cilium + app.kubernetes.io/name: cilium-envoy + name: cilium-envoy +spec: + selector: + matchLabels: + k8s-app: cilium-envoy + + updateStrategy: + rollingUpdate: + maxUnavailable: 2 + type: RollingUpdate + template: + metadata: + annotations: + labels: + k8s-app: cilium-envoy + name: cilium-envoy + app.kubernetes.io/name: cilium-envoy + app.kubernetes.io/part-of: cilium + spec: + securityContext: + appArmorProfile: + type: Unconfined + + containers: + - name: cilium-envoy + image: "quay.io/cilium/cilium-envoy:v1.36.8-1781157951-a7f42a3390781539911b5b9107881b35ecc4e752@sha256:326f872e19ce8aa45170efbf583b3f301586ba3feead14b864676d4baf3b45ed" + imagePullPolicy: IfNotPresent + command: + - /usr/bin/cilium-envoy-starter + args: + - '--' + - '-c /var/run/cilium/envoy/bootstrap-config.json' + - '--base-id 0' + - '--log-level info' + + startupProbe: + httpGet: + host: "127.0.0.1" + path: /healthz + port: 9878 + scheme: HTTP + failureThreshold: 105 + periodSeconds: 2 + successThreshold: 1 + initialDelaySeconds: 5 + livenessProbe: + httpGet: + host: "127.0.0.1" + path: /healthz + port: 9878 + scheme: HTTP + periodSeconds: 30 + successThreshold: 1 + failureThreshold: 10 + timeoutSeconds: 5 + readinessProbe: + httpGet: + host: "127.0.0.1" + path: /healthz + port: 9878 + scheme: HTTP + periodSeconds: 30 + successThreshold: 1 + failureThreshold: 3 + timeoutSeconds: 5 + env: + - name: K8S_NODE_NAME + valueFrom: + fieldRef: + apiVersion: v1 + fieldPath: spec.nodeName + - name: CILIUM_K8S_NAMESPACE + valueFrom: + fieldRef: + apiVersion: v1 + fieldPath: metadata.namespace + + ports: + - name: envoy-metrics + containerPort: 9964 + hostPort: 9964 + protocol: TCP + securityContext: + seLinuxOptions: + level: s0 + type: spc_t + capabilities: + add: + - NET_ADMIN + - SYS_ADMIN + drop: + - ALL + terminationMessagePolicy: FallbackToLogsOnError + volumeMounts: + - name: envoy-sockets + mountPath: /var/run/cilium/envoy/sockets + readOnly: false + - name: envoy-artifacts + mountPath: /var/run/cilium/envoy/artifacts + readOnly: true + - name: envoy-config + mountPath: /var/run/cilium/envoy/ + readOnly: true + - name: bpf-maps + mountPath: /sys/fs/bpf + mountPropagation: HostToContainer + + restartPolicy: Always + priorityClassName: system-node-critical + serviceAccountName: "cilium-envoy" + automountServiceAccountToken: true + terminationGracePeriodSeconds: 1 + hostNetwork: true + + affinity: + nodeAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: cilium.io/no-schedule + operator: NotIn + values: + - "true" + podAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchLabels: + k8s-app: cilium + topologyKey: kubernetes.io/hostname + podAntiAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchLabels: + k8s-app: cilium-envoy + topologyKey: kubernetes.io/hostname + nodeSelector: + kubernetes.io/os: linux + tolerations: + - operator: Exists + volumes: + - name: envoy-sockets + hostPath: + path: "/var/run/cilium/envoy/sockets" + type: DirectoryOrCreate + - name: envoy-artifacts + hostPath: + path: "/var/run/cilium/envoy/artifacts" + type: DirectoryOrCreate + - name: envoy-config + configMap: + name: "cilium-envoy-config" + # note: the leading zero means this number is in octal representation: do not remove it + defaultMode: 0400 + items: + - key: bootstrap-config.json + path: bootstrap-config.json + # To keep state between restarts / upgrades + # To keep state between restarts / upgrades for bpf maps + - name: bpf-maps + hostPath: + path: /sys/fs/bpf + type: DirectoryOrCreate + + +--- +# Source: cilium/templates/cilium-operator/deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + name: cilium-operator + namespace: kube-system + labels: + io.cilium/app: operator + name: cilium-operator + app.kubernetes.io/part-of: cilium + app.kubernetes.io/name: cilium-operator +spec: + # See docs on ServerCapabilities.LeasesResourceLock in file pkg/k8s/version/version.go + # for more details. + replicas: 2 + selector: + matchLabels: + io.cilium/app: operator + name: cilium-operator + # ensure operator update on single node k8s clusters, by using rolling update with maxUnavailable=100% in case + # of one replica and no user configured Recreate strategy. + # otherwise an update might get stuck due to the default maxUnavailable=50% in combination with the + # podAntiAffinity which prevents deployments of multiple operator replicas on the same node. + strategy: + rollingUpdate: + maxSurge: 25% + maxUnavailable: 50% + type: RollingUpdate + template: + metadata: + annotations: + prometheus.io/port: "9963" + prometheus.io/scrape: "true" + labels: + io.cilium/app: operator + name: cilium-operator + app.kubernetes.io/part-of: cilium + app.kubernetes.io/name: cilium-operator + spec: + securityContext: + seccompProfile: + type: RuntimeDefault + containers: + - name: cilium-operator + image: "quay.io/cilium/operator-generic:v1.19.5@sha256:be848a365776e07d0c5a895eda7aec928ddc52a5a1fa2f432fd7a286609e1db4" + imagePullPolicy: IfNotPresent + command: + - cilium-operator-generic + args: + - --config-dir=/tmp/cilium/config-map + - --debug=$(CILIUM_DEBUG) + env: + - name: K8S_NODE_NAME + valueFrom: + fieldRef: + apiVersion: v1 + fieldPath: spec.nodeName + - name: CILIUM_K8S_NAMESPACE + valueFrom: + fieldRef: + apiVersion: v1 + fieldPath: metadata.namespace + - name: CILIUM_DEBUG + valueFrom: + configMapKeyRef: + key: debug + name: cilium-config + optional: true + ports: + - name: health + containerPort: 9234 + hostPort: 9234 + - name: prometheus + containerPort: 9963 + hostPort: 9963 + protocol: TCP + livenessProbe: + httpGet: + host: "127.0.0.1" + path: /healthz + port: health + scheme: HTTP + initialDelaySeconds: 60 + periodSeconds: 10 + timeoutSeconds: 3 + readinessProbe: + httpGet: + host: "127.0.0.1" + path: /healthz + port: health + scheme: HTTP + initialDelaySeconds: 0 + periodSeconds: 5 + timeoutSeconds: 3 + failureThreshold: 5 + volumeMounts: + - name: cilium-config-path + mountPath: /tmp/cilium/config-map + readOnly: true + + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + terminationMessagePolicy: FallbackToLogsOnError + hostNetwork: true + restartPolicy: Always + priorityClassName: system-cluster-critical + serviceAccountName: "cilium-operator" + automountServiceAccountToken: true + # In HA mode, cilium-operator pods must not be scheduled on the same + # node as they will clash with each other. + affinity: + podAntiAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchLabels: + io.cilium/app: operator + topologyKey: kubernetes.io/hostname + nodeSelector: + kubernetes.io/os: linux + tolerations: + - key: node-role.kubernetes.io/control-plane + operator: Exists + - key: node-role.kubernetes.io/master + operator: Exists + - key: node.kubernetes.io/not-ready + operator: Exists + - key: node.cloudprovider.kubernetes.io/uninitialized + operator: Exists + - key: node.cilium.io/agent-not-ready + operator: Exists + + volumes: + # To read the configuration from the config map + - name: cilium-config-path + configMap: + name: cilium-config + diff --git a/packages/manifests/operators/cloudnative-pg.yaml b/packages/manifests/operators/cloudnative-pg.yaml index de546db..c61db3e 100644 --- a/packages/manifests/operators/cloudnative-pg.yaml +++ b/packages/manifests/operators/cloudnative-pg.yaml @@ -1,4 +1,4 @@ -# Source: https://raw.githubusercontent.com/cloudnative-pg/cloudnative-pg/release-1.25/releases/cnpg-1.25.2.yaml +# Source: https://raw.githubusercontent.com/cloudnative-pg/cloudnative-pg/v1.25.2/releases/cnpg-1.25.2.yaml --- apiVersion: v1 kind: Namespace diff --git a/packages/manifests/operators/cloudnative-pg/1.25.2.yaml b/packages/manifests/operators/cloudnative-pg/1.25.2.yaml index de546db..c61db3e 100644 --- a/packages/manifests/operators/cloudnative-pg/1.25.2.yaml +++ b/packages/manifests/operators/cloudnative-pg/1.25.2.yaml @@ -1,4 +1,4 @@ -# Source: https://raw.githubusercontent.com/cloudnative-pg/cloudnative-pg/release-1.25/releases/cnpg-1.25.2.yaml +# Source: https://raw.githubusercontent.com/cloudnative-pg/cloudnative-pg/v1.25.2/releases/cnpg-1.25.2.yaml --- apiVersion: v1 kind: Namespace diff --git a/packages/manifests/operators/ingress-nginx.yaml b/packages/manifests/operators/ingress-nginx.yaml deleted file mode 100644 index 603f3bb..0000000 --- a/packages/manifests/operators/ingress-nginx.yaml +++ /dev/null @@ -1,784 +0,0 @@ -# Source: ingress-nginx/ingress-nginx@4.11.2 ---- -# Added by pull-manifests.ts to ensure namespace exists -apiVersion: v1 -kind: Namespace -metadata: - name: ingress-nginx - labels: - app.kubernetes.io/name: ingress-nginx - ---- ---- -# Source: ingress-nginx/templates/controller-serviceaccount.yaml -apiVersion: v1 -kind: ServiceAccount -metadata: - labels: - helm.sh/chart: ingress-nginx-4.11.2 - app.kubernetes.io/name: ingress-nginx - app.kubernetes.io/instance: ingress-nginx - app.kubernetes.io/version: "1.11.2" - app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: controller - name: ingress-nginx - namespace: ingress-nginx -automountServiceAccountToken: true ---- -# Source: ingress-nginx/templates/controller-configmap.yaml -apiVersion: v1 -kind: ConfigMap -metadata: - labels: - helm.sh/chart: ingress-nginx-4.11.2 - app.kubernetes.io/name: ingress-nginx - app.kubernetes.io/instance: ingress-nginx - app.kubernetes.io/version: "1.11.2" - app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: controller - name: ingress-nginx-controller - namespace: ingress-nginx -data: - allow-snippet-annotations: "false" ---- -# Source: ingress-nginx/templates/clusterrole.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - labels: - helm.sh/chart: ingress-nginx-4.11.2 - app.kubernetes.io/name: ingress-nginx - app.kubernetes.io/instance: ingress-nginx - app.kubernetes.io/version: "1.11.2" - app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/managed-by: Helm - name: ingress-nginx -rules: - - apiGroups: - - "" - resources: - - configmaps - - endpoints - - nodes - - pods - - secrets - - namespaces - verbs: - - list - - watch - - apiGroups: - - coordination.k8s.io - resources: - - leases - verbs: - - list - - watch - - apiGroups: - - "" - resources: - - nodes - verbs: - - get - - apiGroups: - - "" - resources: - - services - verbs: - - get - - list - - watch - - apiGroups: - - networking.k8s.io - resources: - - ingresses - verbs: - - get - - list - - watch - - apiGroups: - - "" - resources: - - events - verbs: - - create - - patch - - apiGroups: - - networking.k8s.io - resources: - - ingresses/status - verbs: - - update - - apiGroups: - - networking.k8s.io - resources: - - ingressclasses - verbs: - - get - - list - - watch - - apiGroups: - - discovery.k8s.io - resources: - - endpointslices - verbs: - - list - - watch - - get ---- -# Source: ingress-nginx/templates/clusterrolebinding.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - labels: - helm.sh/chart: ingress-nginx-4.11.2 - app.kubernetes.io/name: ingress-nginx - app.kubernetes.io/instance: ingress-nginx - app.kubernetes.io/version: "1.11.2" - app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/managed-by: Helm - name: ingress-nginx -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: ingress-nginx -subjects: - - kind: ServiceAccount - name: ingress-nginx - namespace: ingress-nginx ---- -# Source: ingress-nginx/templates/controller-role.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - labels: - helm.sh/chart: ingress-nginx-4.11.2 - app.kubernetes.io/name: ingress-nginx - app.kubernetes.io/instance: ingress-nginx - app.kubernetes.io/version: "1.11.2" - app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: controller - name: ingress-nginx - namespace: ingress-nginx -rules: - - apiGroups: - - "" - resources: - - namespaces - verbs: - - get - - apiGroups: - - "" - resources: - - configmaps - - pods - - secrets - - endpoints - verbs: - - get - - list - - watch - - apiGroups: - - "" - resources: - - services - verbs: - - get - - list - - watch - - apiGroups: - - networking.k8s.io - resources: - - ingresses - verbs: - - get - - list - - watch - # Omit Ingress status permissions if `--update-status` is disabled. - - apiGroups: - - networking.k8s.io - resources: - - ingresses/status - verbs: - - update - - apiGroups: - - networking.k8s.io - resources: - - ingressclasses - verbs: - - get - - list - - watch - - apiGroups: - - coordination.k8s.io - resources: - - leases - resourceNames: - - ingress-nginx-leader - verbs: - - get - - update - - apiGroups: - - coordination.k8s.io - resources: - - leases - verbs: - - create - - apiGroups: - - "" - resources: - - events - verbs: - - create - - patch - - apiGroups: - - discovery.k8s.io - resources: - - endpointslices - verbs: - - list - - watch - - get ---- -# Source: ingress-nginx/templates/controller-rolebinding.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - labels: - helm.sh/chart: ingress-nginx-4.11.2 - app.kubernetes.io/name: ingress-nginx - app.kubernetes.io/instance: ingress-nginx - app.kubernetes.io/version: "1.11.2" - app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: controller - name: ingress-nginx - namespace: ingress-nginx -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: ingress-nginx -subjects: - - kind: ServiceAccount - name: ingress-nginx - namespace: ingress-nginx ---- -# Source: ingress-nginx/templates/controller-service-metrics.yaml -apiVersion: v1 -kind: Service -metadata: - labels: - helm.sh/chart: ingress-nginx-4.11.2 - app.kubernetes.io/name: ingress-nginx - app.kubernetes.io/instance: ingress-nginx - app.kubernetes.io/version: "1.11.2" - app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: controller - name: ingress-nginx-controller-metrics - namespace: ingress-nginx -spec: - type: ClusterIP - ports: - - name: metrics - port: 10254 - protocol: TCP - targetPort: metrics - selector: - app.kubernetes.io/name: ingress-nginx - app.kubernetes.io/instance: ingress-nginx - app.kubernetes.io/component: controller ---- -# Source: ingress-nginx/templates/controller-service-webhook.yaml -apiVersion: v1 -kind: Service -metadata: - labels: - helm.sh/chart: ingress-nginx-4.11.2 - app.kubernetes.io/name: ingress-nginx - app.kubernetes.io/instance: ingress-nginx - app.kubernetes.io/version: "1.11.2" - app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: controller - name: ingress-nginx-controller-admission - namespace: ingress-nginx -spec: - type: ClusterIP - ports: - - name: https-webhook - port: 443 - targetPort: webhook - appProtocol: https - selector: - app.kubernetes.io/name: ingress-nginx - app.kubernetes.io/instance: ingress-nginx - app.kubernetes.io/component: controller ---- -# Source: ingress-nginx/templates/controller-service.yaml -apiVersion: v1 -kind: Service -metadata: - annotations: - labels: - helm.sh/chart: ingress-nginx-4.11.2 - app.kubernetes.io/name: ingress-nginx - app.kubernetes.io/instance: ingress-nginx - app.kubernetes.io/version: "1.11.2" - app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: controller - name: ingress-nginx-controller - namespace: ingress-nginx -spec: - type: LoadBalancer - ipFamilyPolicy: SingleStack - ipFamilies: - - IPv4 - ports: - - name: http - port: 80 - protocol: TCP - targetPort: http - appProtocol: http - - name: https - port: 443 - protocol: TCP - targetPort: https - appProtocol: https - selector: - app.kubernetes.io/name: ingress-nginx - app.kubernetes.io/instance: ingress-nginx - app.kubernetes.io/component: controller ---- -# Source: ingress-nginx/templates/controller-deployment.yaml -apiVersion: apps/v1 -kind: Deployment -metadata: - labels: - helm.sh/chart: ingress-nginx-4.11.2 - app.kubernetes.io/name: ingress-nginx - app.kubernetes.io/instance: ingress-nginx - app.kubernetes.io/version: "1.11.2" - app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: controller - name: ingress-nginx-controller - namespace: ingress-nginx -spec: - selector: - matchLabels: - app.kubernetes.io/name: ingress-nginx - app.kubernetes.io/instance: ingress-nginx - app.kubernetes.io/component: controller - replicas: 1 - revisionHistoryLimit: 10 - minReadySeconds: 0 - template: - metadata: - annotations: - prometheus: "map[io/port:10254 io/scrape:true]" - labels: - helm.sh/chart: ingress-nginx-4.11.2 - app.kubernetes.io/name: ingress-nginx - app.kubernetes.io/instance: ingress-nginx - app.kubernetes.io/version: "1.11.2" - app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: controller - spec: - dnsPolicy: ClusterFirst - containers: - - name: controller - image: registry.k8s.io/ingress-nginx/controller:v1.11.2@sha256:d5f8217feeac4887cb1ed21f27c2674e58be06bd8f5184cacea2a69abaf78dce - imagePullPolicy: IfNotPresent - lifecycle: - preStop: - exec: - command: - - /wait-shutdown - args: - - /nginx-ingress-controller - - --publish-service=$(POD_NAMESPACE)/ingress-nginx-controller - - --election-id=ingress-nginx-leader - - --controller-class=k8s.io/ingress-nginx - - --ingress-class=nginx - - --configmap=$(POD_NAMESPACE)/ingress-nginx-controller - - --validating-webhook=:8443 - - --validating-webhook-certificate=/usr/local/certificates/cert - - --validating-webhook-key=/usr/local/certificates/key - securityContext: - runAsNonRoot: true - runAsUser: 101 - allowPrivilegeEscalation: false - seccompProfile: - type: RuntimeDefault - capabilities: - drop: - - ALL - add: - - NET_BIND_SERVICE - readOnlyRootFilesystem: false - env: - - name: POD_NAME - valueFrom: - fieldRef: - fieldPath: metadata.name - - name: POD_NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace - - name: LD_PRELOAD - value: /usr/local/lib/libmimalloc.so - livenessProbe: - failureThreshold: 5 - httpGet: - path: /healthz - port: 10254 - scheme: HTTP - initialDelaySeconds: 10 - periodSeconds: 10 - successThreshold: 1 - timeoutSeconds: 1 - readinessProbe: - failureThreshold: 3 - httpGet: - path: /healthz - port: 10254 - scheme: HTTP - initialDelaySeconds: 10 - periodSeconds: 10 - successThreshold: 1 - timeoutSeconds: 1 - ports: - - name: http - containerPort: 80 - protocol: TCP - - name: https - containerPort: 443 - protocol: TCP - - name: metrics - containerPort: 10254 - protocol: TCP - - name: webhook - containerPort: 8443 - protocol: TCP - volumeMounts: - - name: webhook-cert - mountPath: /usr/local/certificates/ - readOnly: true - resources: - requests: - cpu: 100m - memory: 90Mi - nodeSelector: - kubernetes.io/os: linux - serviceAccountName: ingress-nginx - terminationGracePeriodSeconds: 300 - volumes: - - name: webhook-cert - secret: - secretName: ingress-nginx-admission ---- -# Source: ingress-nginx/templates/controller-ingressclass.yaml -apiVersion: networking.k8s.io/v1 -kind: IngressClass -metadata: - labels: - helm.sh/chart: ingress-nginx-4.11.2 - app.kubernetes.io/name: ingress-nginx - app.kubernetes.io/instance: ingress-nginx - app.kubernetes.io/version: "1.11.2" - app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: controller - name: nginx -spec: - controller: k8s.io/ingress-nginx ---- -# Source: ingress-nginx/templates/controller-poddisruptionbudget.yaml -# PDB is not supported for DaemonSets. -# https://github.com/kubernetes/kubernetes/issues/108124 ---- -# Source: ingress-nginx/templates/admission-webhooks/validating-webhook.yaml -# before changing this value, check the required kubernetes version -# https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#prerequisites -apiVersion: admissionregistration.k8s.io/v1 -kind: ValidatingWebhookConfiguration -metadata: - annotations: - labels: - helm.sh/chart: ingress-nginx-4.11.2 - app.kubernetes.io/name: ingress-nginx - app.kubernetes.io/instance: ingress-nginx - app.kubernetes.io/version: "1.11.2" - app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: admission-webhook - name: ingress-nginx-admission -webhooks: - - name: validate.nginx.ingress.kubernetes.io - matchPolicy: Equivalent - rules: - - apiGroups: - - networking.k8s.io - apiVersions: - - v1 - operations: - - CREATE - - UPDATE - resources: - - ingresses - failurePolicy: Fail - sideEffects: None - admissionReviewVersions: - - v1 - clientConfig: - service: - name: ingress-nginx-controller-admission - namespace: ingress-nginx - path: /networking/v1/ingresses ---- -# Source: ingress-nginx/templates/admission-webhooks/job-patch/serviceaccount.yaml -apiVersion: v1 -kind: ServiceAccount -metadata: - name: ingress-nginx-admission - namespace: ingress-nginx - annotations: - "helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade - "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded - labels: - helm.sh/chart: ingress-nginx-4.11.2 - app.kubernetes.io/name: ingress-nginx - app.kubernetes.io/instance: ingress-nginx - app.kubernetes.io/version: "1.11.2" - app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: admission-webhook -automountServiceAccountToken: true ---- -# Source: ingress-nginx/templates/admission-webhooks/job-patch/clusterrole.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: ingress-nginx-admission - annotations: - "helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade - "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded - labels: - helm.sh/chart: ingress-nginx-4.11.2 - app.kubernetes.io/name: ingress-nginx - app.kubernetes.io/instance: ingress-nginx - app.kubernetes.io/version: "1.11.2" - app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: admission-webhook -rules: - - apiGroups: - - admissionregistration.k8s.io - resources: - - validatingwebhookconfigurations - verbs: - - get - - update ---- -# Source: ingress-nginx/templates/admission-webhooks/job-patch/clusterrolebinding.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: ingress-nginx-admission - annotations: - "helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade - "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded - labels: - helm.sh/chart: ingress-nginx-4.11.2 - app.kubernetes.io/name: ingress-nginx - app.kubernetes.io/instance: ingress-nginx - app.kubernetes.io/version: "1.11.2" - app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: admission-webhook -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: ingress-nginx-admission -subjects: - - kind: ServiceAccount - name: ingress-nginx-admission - namespace: ingress-nginx ---- -# Source: ingress-nginx/templates/admission-webhooks/job-patch/role.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: ingress-nginx-admission - namespace: ingress-nginx - annotations: - "helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade - "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded - labels: - helm.sh/chart: ingress-nginx-4.11.2 - app.kubernetes.io/name: ingress-nginx - app.kubernetes.io/instance: ingress-nginx - app.kubernetes.io/version: "1.11.2" - app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: admission-webhook -rules: - - apiGroups: - - "" - resources: - - secrets - verbs: - - get - - create ---- -# Source: ingress-nginx/templates/admission-webhooks/job-patch/rolebinding.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: ingress-nginx-admission - namespace: ingress-nginx - annotations: - "helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade - "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded - labels: - helm.sh/chart: ingress-nginx-4.11.2 - app.kubernetes.io/name: ingress-nginx - app.kubernetes.io/instance: ingress-nginx - app.kubernetes.io/version: "1.11.2" - app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: admission-webhook -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: ingress-nginx-admission -subjects: - - kind: ServiceAccount - name: ingress-nginx-admission - namespace: ingress-nginx ---- -# Source: ingress-nginx/templates/admission-webhooks/job-patch/job-createSecret.yaml -apiVersion: batch/v1 -kind: Job -metadata: - name: ingress-nginx-admission-create - namespace: ingress-nginx - annotations: - "helm.sh/hook": pre-install,pre-upgrade - "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded - labels: - helm.sh/chart: ingress-nginx-4.11.2 - app.kubernetes.io/name: ingress-nginx - app.kubernetes.io/instance: ingress-nginx - app.kubernetes.io/version: "1.11.2" - app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: admission-webhook -spec: - template: - metadata: - name: ingress-nginx-admission-create - labels: - helm.sh/chart: ingress-nginx-4.11.2 - app.kubernetes.io/name: ingress-nginx - app.kubernetes.io/instance: ingress-nginx - app.kubernetes.io/version: "1.11.2" - app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: admission-webhook - spec: - containers: - - name: create - image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.4.3@sha256:a320a50cc91bd15fd2d6fa6de58bd98c1bd64b9a6f926ce23a600d87043455a3 - imagePullPolicy: IfNotPresent - args: - - create - - --host=ingress-nginx-controller-admission,ingress-nginx-controller-admission.$(POD_NAMESPACE).svc - - --namespace=$(POD_NAMESPACE) - - --secret-name=ingress-nginx-admission - env: - - name: POD_NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace - securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL - readOnlyRootFilesystem: true - runAsNonRoot: true - runAsUser: 65532 - seccompProfile: - type: RuntimeDefault - restartPolicy: OnFailure - serviceAccountName: ingress-nginx-admission - nodeSelector: - kubernetes.io/os: linux ---- -# Source: ingress-nginx/templates/admission-webhooks/job-patch/job-patchWebhook.yaml -apiVersion: batch/v1 -kind: Job -metadata: - name: ingress-nginx-admission-patch - namespace: ingress-nginx - annotations: - "helm.sh/hook": post-install,post-upgrade - "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded - labels: - helm.sh/chart: ingress-nginx-4.11.2 - app.kubernetes.io/name: ingress-nginx - app.kubernetes.io/instance: ingress-nginx - app.kubernetes.io/version: "1.11.2" - app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: admission-webhook -spec: - template: - metadata: - name: ingress-nginx-admission-patch - labels: - helm.sh/chart: ingress-nginx-4.11.2 - app.kubernetes.io/name: ingress-nginx - app.kubernetes.io/instance: ingress-nginx - app.kubernetes.io/version: "1.11.2" - app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: admission-webhook - spec: - containers: - - name: patch - image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.4.3@sha256:a320a50cc91bd15fd2d6fa6de58bd98c1bd64b9a6f926ce23a600d87043455a3 - imagePullPolicy: IfNotPresent - args: - - patch - - --webhook-name=ingress-nginx-admission - - --namespace=$(POD_NAMESPACE) - - --patch-mutating=false - - --secret-name=ingress-nginx-admission - - --patch-failure-policy=Fail - env: - - name: POD_NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace - securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL - readOnlyRootFilesystem: true - runAsNonRoot: true - runAsUser: 65532 - seccompProfile: - type: RuntimeDefault - restartPolicy: OnFailure - serviceAccountName: ingress-nginx-admission - nodeSelector: - kubernetes.io/os: linux - diff --git a/packages/manifests/operators/ingress-nginx/4.11.2.yaml b/packages/manifests/operators/ingress-nginx/4.11.2.yaml deleted file mode 100644 index 603f3bb..0000000 --- a/packages/manifests/operators/ingress-nginx/4.11.2.yaml +++ /dev/null @@ -1,784 +0,0 @@ -# Source: ingress-nginx/ingress-nginx@4.11.2 ---- -# Added by pull-manifests.ts to ensure namespace exists -apiVersion: v1 -kind: Namespace -metadata: - name: ingress-nginx - labels: - app.kubernetes.io/name: ingress-nginx - ---- ---- -# Source: ingress-nginx/templates/controller-serviceaccount.yaml -apiVersion: v1 -kind: ServiceAccount -metadata: - labels: - helm.sh/chart: ingress-nginx-4.11.2 - app.kubernetes.io/name: ingress-nginx - app.kubernetes.io/instance: ingress-nginx - app.kubernetes.io/version: "1.11.2" - app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: controller - name: ingress-nginx - namespace: ingress-nginx -automountServiceAccountToken: true ---- -# Source: ingress-nginx/templates/controller-configmap.yaml -apiVersion: v1 -kind: ConfigMap -metadata: - labels: - helm.sh/chart: ingress-nginx-4.11.2 - app.kubernetes.io/name: ingress-nginx - app.kubernetes.io/instance: ingress-nginx - app.kubernetes.io/version: "1.11.2" - app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: controller - name: ingress-nginx-controller - namespace: ingress-nginx -data: - allow-snippet-annotations: "false" ---- -# Source: ingress-nginx/templates/clusterrole.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - labels: - helm.sh/chart: ingress-nginx-4.11.2 - app.kubernetes.io/name: ingress-nginx - app.kubernetes.io/instance: ingress-nginx - app.kubernetes.io/version: "1.11.2" - app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/managed-by: Helm - name: ingress-nginx -rules: - - apiGroups: - - "" - resources: - - configmaps - - endpoints - - nodes - - pods - - secrets - - namespaces - verbs: - - list - - watch - - apiGroups: - - coordination.k8s.io - resources: - - leases - verbs: - - list - - watch - - apiGroups: - - "" - resources: - - nodes - verbs: - - get - - apiGroups: - - "" - resources: - - services - verbs: - - get - - list - - watch - - apiGroups: - - networking.k8s.io - resources: - - ingresses - verbs: - - get - - list - - watch - - apiGroups: - - "" - resources: - - events - verbs: - - create - - patch - - apiGroups: - - networking.k8s.io - resources: - - ingresses/status - verbs: - - update - - apiGroups: - - networking.k8s.io - resources: - - ingressclasses - verbs: - - get - - list - - watch - - apiGroups: - - discovery.k8s.io - resources: - - endpointslices - verbs: - - list - - watch - - get ---- -# Source: ingress-nginx/templates/clusterrolebinding.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - labels: - helm.sh/chart: ingress-nginx-4.11.2 - app.kubernetes.io/name: ingress-nginx - app.kubernetes.io/instance: ingress-nginx - app.kubernetes.io/version: "1.11.2" - app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/managed-by: Helm - name: ingress-nginx -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: ingress-nginx -subjects: - - kind: ServiceAccount - name: ingress-nginx - namespace: ingress-nginx ---- -# Source: ingress-nginx/templates/controller-role.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - labels: - helm.sh/chart: ingress-nginx-4.11.2 - app.kubernetes.io/name: ingress-nginx - app.kubernetes.io/instance: ingress-nginx - app.kubernetes.io/version: "1.11.2" - app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: controller - name: ingress-nginx - namespace: ingress-nginx -rules: - - apiGroups: - - "" - resources: - - namespaces - verbs: - - get - - apiGroups: - - "" - resources: - - configmaps - - pods - - secrets - - endpoints - verbs: - - get - - list - - watch - - apiGroups: - - "" - resources: - - services - verbs: - - get - - list - - watch - - apiGroups: - - networking.k8s.io - resources: - - ingresses - verbs: - - get - - list - - watch - # Omit Ingress status permissions if `--update-status` is disabled. - - apiGroups: - - networking.k8s.io - resources: - - ingresses/status - verbs: - - update - - apiGroups: - - networking.k8s.io - resources: - - ingressclasses - verbs: - - get - - list - - watch - - apiGroups: - - coordination.k8s.io - resources: - - leases - resourceNames: - - ingress-nginx-leader - verbs: - - get - - update - - apiGroups: - - coordination.k8s.io - resources: - - leases - verbs: - - create - - apiGroups: - - "" - resources: - - events - verbs: - - create - - patch - - apiGroups: - - discovery.k8s.io - resources: - - endpointslices - verbs: - - list - - watch - - get ---- -# Source: ingress-nginx/templates/controller-rolebinding.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - labels: - helm.sh/chart: ingress-nginx-4.11.2 - app.kubernetes.io/name: ingress-nginx - app.kubernetes.io/instance: ingress-nginx - app.kubernetes.io/version: "1.11.2" - app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: controller - name: ingress-nginx - namespace: ingress-nginx -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: ingress-nginx -subjects: - - kind: ServiceAccount - name: ingress-nginx - namespace: ingress-nginx ---- -# Source: ingress-nginx/templates/controller-service-metrics.yaml -apiVersion: v1 -kind: Service -metadata: - labels: - helm.sh/chart: ingress-nginx-4.11.2 - app.kubernetes.io/name: ingress-nginx - app.kubernetes.io/instance: ingress-nginx - app.kubernetes.io/version: "1.11.2" - app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: controller - name: ingress-nginx-controller-metrics - namespace: ingress-nginx -spec: - type: ClusterIP - ports: - - name: metrics - port: 10254 - protocol: TCP - targetPort: metrics - selector: - app.kubernetes.io/name: ingress-nginx - app.kubernetes.io/instance: ingress-nginx - app.kubernetes.io/component: controller ---- -# Source: ingress-nginx/templates/controller-service-webhook.yaml -apiVersion: v1 -kind: Service -metadata: - labels: - helm.sh/chart: ingress-nginx-4.11.2 - app.kubernetes.io/name: ingress-nginx - app.kubernetes.io/instance: ingress-nginx - app.kubernetes.io/version: "1.11.2" - app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: controller - name: ingress-nginx-controller-admission - namespace: ingress-nginx -spec: - type: ClusterIP - ports: - - name: https-webhook - port: 443 - targetPort: webhook - appProtocol: https - selector: - app.kubernetes.io/name: ingress-nginx - app.kubernetes.io/instance: ingress-nginx - app.kubernetes.io/component: controller ---- -# Source: ingress-nginx/templates/controller-service.yaml -apiVersion: v1 -kind: Service -metadata: - annotations: - labels: - helm.sh/chart: ingress-nginx-4.11.2 - app.kubernetes.io/name: ingress-nginx - app.kubernetes.io/instance: ingress-nginx - app.kubernetes.io/version: "1.11.2" - app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: controller - name: ingress-nginx-controller - namespace: ingress-nginx -spec: - type: LoadBalancer - ipFamilyPolicy: SingleStack - ipFamilies: - - IPv4 - ports: - - name: http - port: 80 - protocol: TCP - targetPort: http - appProtocol: http - - name: https - port: 443 - protocol: TCP - targetPort: https - appProtocol: https - selector: - app.kubernetes.io/name: ingress-nginx - app.kubernetes.io/instance: ingress-nginx - app.kubernetes.io/component: controller ---- -# Source: ingress-nginx/templates/controller-deployment.yaml -apiVersion: apps/v1 -kind: Deployment -metadata: - labels: - helm.sh/chart: ingress-nginx-4.11.2 - app.kubernetes.io/name: ingress-nginx - app.kubernetes.io/instance: ingress-nginx - app.kubernetes.io/version: "1.11.2" - app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: controller - name: ingress-nginx-controller - namespace: ingress-nginx -spec: - selector: - matchLabels: - app.kubernetes.io/name: ingress-nginx - app.kubernetes.io/instance: ingress-nginx - app.kubernetes.io/component: controller - replicas: 1 - revisionHistoryLimit: 10 - minReadySeconds: 0 - template: - metadata: - annotations: - prometheus: "map[io/port:10254 io/scrape:true]" - labels: - helm.sh/chart: ingress-nginx-4.11.2 - app.kubernetes.io/name: ingress-nginx - app.kubernetes.io/instance: ingress-nginx - app.kubernetes.io/version: "1.11.2" - app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: controller - spec: - dnsPolicy: ClusterFirst - containers: - - name: controller - image: registry.k8s.io/ingress-nginx/controller:v1.11.2@sha256:d5f8217feeac4887cb1ed21f27c2674e58be06bd8f5184cacea2a69abaf78dce - imagePullPolicy: IfNotPresent - lifecycle: - preStop: - exec: - command: - - /wait-shutdown - args: - - /nginx-ingress-controller - - --publish-service=$(POD_NAMESPACE)/ingress-nginx-controller - - --election-id=ingress-nginx-leader - - --controller-class=k8s.io/ingress-nginx - - --ingress-class=nginx - - --configmap=$(POD_NAMESPACE)/ingress-nginx-controller - - --validating-webhook=:8443 - - --validating-webhook-certificate=/usr/local/certificates/cert - - --validating-webhook-key=/usr/local/certificates/key - securityContext: - runAsNonRoot: true - runAsUser: 101 - allowPrivilegeEscalation: false - seccompProfile: - type: RuntimeDefault - capabilities: - drop: - - ALL - add: - - NET_BIND_SERVICE - readOnlyRootFilesystem: false - env: - - name: POD_NAME - valueFrom: - fieldRef: - fieldPath: metadata.name - - name: POD_NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace - - name: LD_PRELOAD - value: /usr/local/lib/libmimalloc.so - livenessProbe: - failureThreshold: 5 - httpGet: - path: /healthz - port: 10254 - scheme: HTTP - initialDelaySeconds: 10 - periodSeconds: 10 - successThreshold: 1 - timeoutSeconds: 1 - readinessProbe: - failureThreshold: 3 - httpGet: - path: /healthz - port: 10254 - scheme: HTTP - initialDelaySeconds: 10 - periodSeconds: 10 - successThreshold: 1 - timeoutSeconds: 1 - ports: - - name: http - containerPort: 80 - protocol: TCP - - name: https - containerPort: 443 - protocol: TCP - - name: metrics - containerPort: 10254 - protocol: TCP - - name: webhook - containerPort: 8443 - protocol: TCP - volumeMounts: - - name: webhook-cert - mountPath: /usr/local/certificates/ - readOnly: true - resources: - requests: - cpu: 100m - memory: 90Mi - nodeSelector: - kubernetes.io/os: linux - serviceAccountName: ingress-nginx - terminationGracePeriodSeconds: 300 - volumes: - - name: webhook-cert - secret: - secretName: ingress-nginx-admission ---- -# Source: ingress-nginx/templates/controller-ingressclass.yaml -apiVersion: networking.k8s.io/v1 -kind: IngressClass -metadata: - labels: - helm.sh/chart: ingress-nginx-4.11.2 - app.kubernetes.io/name: ingress-nginx - app.kubernetes.io/instance: ingress-nginx - app.kubernetes.io/version: "1.11.2" - app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: controller - name: nginx -spec: - controller: k8s.io/ingress-nginx ---- -# Source: ingress-nginx/templates/controller-poddisruptionbudget.yaml -# PDB is not supported for DaemonSets. -# https://github.com/kubernetes/kubernetes/issues/108124 ---- -# Source: ingress-nginx/templates/admission-webhooks/validating-webhook.yaml -# before changing this value, check the required kubernetes version -# https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#prerequisites -apiVersion: admissionregistration.k8s.io/v1 -kind: ValidatingWebhookConfiguration -metadata: - annotations: - labels: - helm.sh/chart: ingress-nginx-4.11.2 - app.kubernetes.io/name: ingress-nginx - app.kubernetes.io/instance: ingress-nginx - app.kubernetes.io/version: "1.11.2" - app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: admission-webhook - name: ingress-nginx-admission -webhooks: - - name: validate.nginx.ingress.kubernetes.io - matchPolicy: Equivalent - rules: - - apiGroups: - - networking.k8s.io - apiVersions: - - v1 - operations: - - CREATE - - UPDATE - resources: - - ingresses - failurePolicy: Fail - sideEffects: None - admissionReviewVersions: - - v1 - clientConfig: - service: - name: ingress-nginx-controller-admission - namespace: ingress-nginx - path: /networking/v1/ingresses ---- -# Source: ingress-nginx/templates/admission-webhooks/job-patch/serviceaccount.yaml -apiVersion: v1 -kind: ServiceAccount -metadata: - name: ingress-nginx-admission - namespace: ingress-nginx - annotations: - "helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade - "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded - labels: - helm.sh/chart: ingress-nginx-4.11.2 - app.kubernetes.io/name: ingress-nginx - app.kubernetes.io/instance: ingress-nginx - app.kubernetes.io/version: "1.11.2" - app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: admission-webhook -automountServiceAccountToken: true ---- -# Source: ingress-nginx/templates/admission-webhooks/job-patch/clusterrole.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: ingress-nginx-admission - annotations: - "helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade - "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded - labels: - helm.sh/chart: ingress-nginx-4.11.2 - app.kubernetes.io/name: ingress-nginx - app.kubernetes.io/instance: ingress-nginx - app.kubernetes.io/version: "1.11.2" - app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: admission-webhook -rules: - - apiGroups: - - admissionregistration.k8s.io - resources: - - validatingwebhookconfigurations - verbs: - - get - - update ---- -# Source: ingress-nginx/templates/admission-webhooks/job-patch/clusterrolebinding.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: ingress-nginx-admission - annotations: - "helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade - "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded - labels: - helm.sh/chart: ingress-nginx-4.11.2 - app.kubernetes.io/name: ingress-nginx - app.kubernetes.io/instance: ingress-nginx - app.kubernetes.io/version: "1.11.2" - app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: admission-webhook -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: ingress-nginx-admission -subjects: - - kind: ServiceAccount - name: ingress-nginx-admission - namespace: ingress-nginx ---- -# Source: ingress-nginx/templates/admission-webhooks/job-patch/role.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: ingress-nginx-admission - namespace: ingress-nginx - annotations: - "helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade - "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded - labels: - helm.sh/chart: ingress-nginx-4.11.2 - app.kubernetes.io/name: ingress-nginx - app.kubernetes.io/instance: ingress-nginx - app.kubernetes.io/version: "1.11.2" - app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: admission-webhook -rules: - - apiGroups: - - "" - resources: - - secrets - verbs: - - get - - create ---- -# Source: ingress-nginx/templates/admission-webhooks/job-patch/rolebinding.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: ingress-nginx-admission - namespace: ingress-nginx - annotations: - "helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade - "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded - labels: - helm.sh/chart: ingress-nginx-4.11.2 - app.kubernetes.io/name: ingress-nginx - app.kubernetes.io/instance: ingress-nginx - app.kubernetes.io/version: "1.11.2" - app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: admission-webhook -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: ingress-nginx-admission -subjects: - - kind: ServiceAccount - name: ingress-nginx-admission - namespace: ingress-nginx ---- -# Source: ingress-nginx/templates/admission-webhooks/job-patch/job-createSecret.yaml -apiVersion: batch/v1 -kind: Job -metadata: - name: ingress-nginx-admission-create - namespace: ingress-nginx - annotations: - "helm.sh/hook": pre-install,pre-upgrade - "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded - labels: - helm.sh/chart: ingress-nginx-4.11.2 - app.kubernetes.io/name: ingress-nginx - app.kubernetes.io/instance: ingress-nginx - app.kubernetes.io/version: "1.11.2" - app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: admission-webhook -spec: - template: - metadata: - name: ingress-nginx-admission-create - labels: - helm.sh/chart: ingress-nginx-4.11.2 - app.kubernetes.io/name: ingress-nginx - app.kubernetes.io/instance: ingress-nginx - app.kubernetes.io/version: "1.11.2" - app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: admission-webhook - spec: - containers: - - name: create - image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.4.3@sha256:a320a50cc91bd15fd2d6fa6de58bd98c1bd64b9a6f926ce23a600d87043455a3 - imagePullPolicy: IfNotPresent - args: - - create - - --host=ingress-nginx-controller-admission,ingress-nginx-controller-admission.$(POD_NAMESPACE).svc - - --namespace=$(POD_NAMESPACE) - - --secret-name=ingress-nginx-admission - env: - - name: POD_NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace - securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL - readOnlyRootFilesystem: true - runAsNonRoot: true - runAsUser: 65532 - seccompProfile: - type: RuntimeDefault - restartPolicy: OnFailure - serviceAccountName: ingress-nginx-admission - nodeSelector: - kubernetes.io/os: linux ---- -# Source: ingress-nginx/templates/admission-webhooks/job-patch/job-patchWebhook.yaml -apiVersion: batch/v1 -kind: Job -metadata: - name: ingress-nginx-admission-patch - namespace: ingress-nginx - annotations: - "helm.sh/hook": post-install,post-upgrade - "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded - labels: - helm.sh/chart: ingress-nginx-4.11.2 - app.kubernetes.io/name: ingress-nginx - app.kubernetes.io/instance: ingress-nginx - app.kubernetes.io/version: "1.11.2" - app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: admission-webhook -spec: - template: - metadata: - name: ingress-nginx-admission-patch - labels: - helm.sh/chart: ingress-nginx-4.11.2 - app.kubernetes.io/name: ingress-nginx - app.kubernetes.io/instance: ingress-nginx - app.kubernetes.io/version: "1.11.2" - app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/component: admission-webhook - spec: - containers: - - name: patch - image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.4.3@sha256:a320a50cc91bd15fd2d6fa6de58bd98c1bd64b9a6f926ce23a600d87043455a3 - imagePullPolicy: IfNotPresent - args: - - patch - - --webhook-name=ingress-nginx-admission - - --namespace=$(POD_NAMESPACE) - - --patch-mutating=false - - --secret-name=ingress-nginx-admission - - --patch-failure-policy=Fail - env: - - name: POD_NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace - securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL - readOnlyRootFilesystem: true - runAsNonRoot: true - runAsUser: 65532 - seccompProfile: - type: RuntimeDefault - restartPolicy: OnFailure - serviceAccountName: ingress-nginx-admission - nodeSelector: - kubernetes.io/os: linux - diff --git a/packages/manifests/operators/knative-serving.yaml b/packages/manifests/operators/knative-serving.yaml index 5f49d44..bbe9e23 100644 --- a/packages/manifests/operators/knative-serving.yaml +++ b/packages/manifests/operators/knative-serving.yaml @@ -1,4 +1,4 @@ -# Source: https://github.com/knative/serving/releases/download/knative-v1.15.0/serving-crds.yaml +# Source: https://github.com/knative/serving/releases/download/knative-v1.22.1/serving-crds.yaml --- # Copyright 2020 The Knative Authors # @@ -21,7 +21,7 @@ metadata: labels: app.kubernetes.io/name: knative-serving app.kubernetes.io/component: networking - app.kubernetes.io/version: "1.15.0" + app.kubernetes.io/version: "1.22.1" knative.dev/crd-install: "true" spec: group: networking.internal.knative.dev @@ -206,7 +206,7 @@ metadata: name: configurations.serving.knative.dev labels: app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.15.0" + app.kubernetes.io/version: "1.22.1" knative.dev/crd-install: "true" duck.knative.dev/podspecable: "true" spec: @@ -342,6 +342,7 @@ spec: type: array items: type: string + x-kubernetes-list-type: atomic command: description: |- Entrypoint array. Not executed within a shell. @@ -355,6 +356,7 @@ spec: type: array items: type: string + x-kubernetes-list-type: atomic env: description: |- List of environment variables to set in the container. @@ -367,7 +369,9 @@ spec: - name properties: name: - description: Name of the environment variable. Must be a C_IDENTIFIER. + description: |- + Name of the environment variable. + May consist of any printable ASCII characters except '='. type: string value: description: |- @@ -397,23 +401,28 @@ spec: name: description: |- Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid? type: string + default: "" optional: description: Specify whether the ConfigMap or its key must be defined type: boolean x-kubernetes-map-type: atomic fieldRef: - description: This is accessible behind a feature flag - kubernetes.podspec-fieldref + description: |- + This is accessible behind a feature flag - kubernetes.podspec-fieldref type: object - x-kubernetes-preserve-unknown-fields: true x-kubernetes-map-type: atomic + x-kubernetes-preserve-unknown-fields: true resourceFieldRef: - description: This is accessible behind a feature flag - kubernetes.podspec-fieldref + description: |- + This is accessible behind a feature flag - kubernetes.podspec-fieldref type: object - x-kubernetes-preserve-unknown-fields: true x-kubernetes-map-type: atomic + x-kubernetes-preserve-unknown-fields: true secretKeyRef: description: Selects a key of a secret in the pod's namespace type: object @@ -426,24 +435,30 @@ spec: name: description: |- Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid? type: string + default: "" optional: description: Specify whether the Secret or its key must be defined type: boolean x-kubernetes-map-type: atomic + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map envFrom: description: |- List of sources to populate environment variables in the container. - The keys defined within a source must be a C_IDENTIFIER. All invalid keys - will be reported as an event when the container is starting. When a key exists in multiple + The keys defined within a source may consist of any printable ASCII characters except '='. + When a key exists in multiple sources, the value associated with the last source will take precedence. Values defined by an Env with a duplicate key will take precedence. Cannot be updated. type: array items: - description: EnvFromSource represents the source of a set of ConfigMaps + description: EnvFromSource represents the source of a set of ConfigMaps or Secrets type: object properties: configMapRef: @@ -453,15 +468,20 @@ spec: name: description: |- Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid? type: string + default: "" optional: description: Specify whether the ConfigMap must be defined type: boolean x-kubernetes-map-type: atomic prefix: - description: An optional identifier to prepend to each key in the ConfigMap. Must be a C_IDENTIFIER. + description: |- + Optional text to prepend to the name of each environment variable. + May consist of any printable ASCII characters except '='. type: string secretRef: description: The Secret to select from @@ -470,13 +490,17 @@ spec: name: description: |- Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid? type: string + default: "" optional: description: Specify whether the Secret must be defined type: boolean x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic image: description: |- Container image name. @@ -501,7 +525,7 @@ spec: type: object properties: exec: - description: Exec specifies the action to take. + description: Exec specifies a command to execute in the container. type: object properties: command: @@ -514,6 +538,7 @@ spec: type: array items: type: string + x-kubernetes-list-type: atomic failureThreshold: description: |- Minimum consecutive failures for the probe to be considered failed after having succeeded. @@ -521,10 +546,8 @@ spec: type: integer format: int32 grpc: - description: GRPC specifies an action involving a GRPC port. + description: GRPC specifies a GRPC HealthCheckRequest. type: object - required: - - port properties: port: description: Port number of the gRPC service. Number must be in the range 1 to 65535. @@ -535,11 +558,11 @@ spec: Service is the name of the service to place in the gRPC HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). - If this is not specified, the default behavior is defined by gRPC. type: string + default: "" httpGet: - description: HTTPGet specifies the http request to perform. + description: HTTPGet specifies an HTTP GET request to perform. type: object properties: host: @@ -565,6 +588,7 @@ spec: value: description: The header field value type: string + x-kubernetes-list-type: atomic path: description: Path to access on the HTTP server. type: string @@ -589,7 +613,8 @@ spec: type: integer format: int32 periodSeconds: - description: How often (in seconds) to perform the probe. + description: |- + How often (in seconds) to perform the probe. type: integer format: int32 successThreshold: @@ -599,7 +624,7 @@ spec: type: integer format: int32 tcpSocket: - description: TCPSocket specifies an action involving a TCP port. + description: TCPSocket specifies a connection to a TCP port. type: object properties: host: @@ -640,8 +665,6 @@ spec: items: description: ContainerPort represents a network port in a single container. type: object - required: - - containerPort properties: containerPort: description: |- @@ -661,10 +684,6 @@ spec: Defaults to "TCP". type: string default: TCP - x-kubernetes-list-map-keys: - - containerPort - - protocol - x-kubernetes-list-type: map readinessProbe: description: |- Periodic probe of container service readiness. @@ -674,7 +693,7 @@ spec: type: object properties: exec: - description: Exec specifies the action to take. + description: Exec specifies a command to execute in the container. type: object properties: command: @@ -687,6 +706,7 @@ spec: type: array items: type: string + x-kubernetes-list-type: atomic failureThreshold: description: |- Minimum consecutive failures for the probe to be considered failed after having succeeded. @@ -694,10 +714,8 @@ spec: type: integer format: int32 grpc: - description: GRPC specifies an action involving a GRPC port. + description: GRPC specifies a GRPC HealthCheckRequest. type: object - required: - - port properties: port: description: Port number of the gRPC service. Number must be in the range 1 to 65535. @@ -708,11 +726,11 @@ spec: Service is the name of the service to place in the gRPC HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). - If this is not specified, the default behavior is defined by gRPC. type: string + default: "" httpGet: - description: HTTPGet specifies the http request to perform. + description: HTTPGet specifies an HTTP GET request to perform. type: object properties: host: @@ -738,6 +756,7 @@ spec: value: description: The header field value type: string + x-kubernetes-list-type: atomic path: description: Path to access on the HTTP server. type: string @@ -762,7 +781,8 @@ spec: type: integer format: int32 periodSeconds: - description: How often (in seconds) to perform the probe. + description: |- + How often (in seconds) to perform the probe. type: integer format: int32 successThreshold: @@ -772,7 +792,7 @@ spec: type: integer format: int32 tcpSocket: - description: TCPSocket specifies an action involving a TCP port. + description: TCPSocket specifies a connection to a TCP port. type: object properties: host: @@ -801,33 +821,6 @@ spec: More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ type: object properties: - claims: - description: |- - Claims lists the names of resources, defined in spec.resourceClaims, - that are used by this container. - - - This is an alpha field and requires enabling the - DynamicResourceAllocation feature gate. - - - This field is immutable. It can only be set for containers. - type: array - items: - description: ResourceClaim references one entry in PodSpec.ResourceClaims. - type: object - required: - - name - properties: - name: - description: |- - Name must match the name of one entry in pod.spec.resourceClaims of - the Pod where this field is used. It makes that resource available - inside a container. - type: string - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map limits: description: |- Limits describes the maximum amount of compute resources allowed. @@ -882,12 +875,18 @@ spec: items: description: Capability represent POSIX capabilities type type: string + x-kubernetes-list-type: atomic drop: description: Removed capabilities type: array items: description: Capability represent POSIX capabilities type type: string + x-kubernetes-list-type: atomic + privileged: + description: |- + Run container in privileged mode. This can only be set to explicitly to 'false' + type: boolean readOnlyRootFilesystem: description: |- Whether this container has a read-only root filesystem. @@ -943,7 +942,6 @@ spec: type indicates which kind of seccomp profile will be applied. Valid options are: - Localhost - a profile defined in a file on the node should be used. RuntimeDefault - the container runtime default profile should be used. Unconfined - no profile should be applied. @@ -960,7 +958,7 @@ spec: type: object properties: exec: - description: Exec specifies the action to take. + description: Exec specifies a command to execute in the container. type: object properties: command: @@ -973,6 +971,7 @@ spec: type: array items: type: string + x-kubernetes-list-type: atomic failureThreshold: description: |- Minimum consecutive failures for the probe to be considered failed after having succeeded. @@ -980,10 +979,8 @@ spec: type: integer format: int32 grpc: - description: GRPC specifies an action involving a GRPC port. + description: GRPC specifies a GRPC HealthCheckRequest. type: object - required: - - port properties: port: description: Port number of the gRPC service. Number must be in the range 1 to 65535. @@ -994,11 +991,11 @@ spec: Service is the name of the service to place in the gRPC HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). - If this is not specified, the default behavior is defined by gRPC. type: string + default: "" httpGet: - description: HTTPGet specifies the http request to perform. + description: HTTPGet specifies an HTTP GET request to perform. type: object properties: host: @@ -1024,6 +1021,7 @@ spec: value: description: The header field value type: string + x-kubernetes-list-type: atomic path: description: Path to access on the HTTP server. type: string @@ -1048,7 +1046,8 @@ spec: type: integer format: int32 periodSeconds: - description: How often (in seconds) to perform the probe. + description: |- + How often (in seconds) to perform the probe. type: integer format: int32 successThreshold: @@ -1058,7 +1057,7 @@ spec: type: integer format: int32 tcpSocket: - description: TCPSocket specifies an action involving a TCP port. + description: TCPSocket specifies a connection to a TCP port. type: object properties: host: @@ -1117,6 +1116,10 @@ spec: Path within the container at which the volume should be mounted. Must not contain ':'. type: string + mountPropagation: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-volumes-mount-propagation + type: string name: description: This must match the Name of a Volume. type: string @@ -1130,6 +1133,9 @@ spec: Path within the volume from which the container's volume should be mounted. Defaults to "" (volume's root). type: string + x-kubernetes-list-map-keys: + - mountPath + x-kubernetes-list-type: map workingDir: description: |- Container's working directory. @@ -1138,22 +1144,39 @@ spec: Cannot be updated. type: string dnsConfig: - description: This is accessible behind a feature flag - kubernetes.podspec-dnsconfig + description: |- + This is accessible behind a feature flag - kubernetes.podspec-dnsconfig type: object x-kubernetes-preserve-unknown-fields: true dnsPolicy: - description: This is accessible behind a feature flag - kubernetes.podspec-dnspolicy + description: |- + This is accessible behind a feature flag - kubernetes.podspec-dnspolicy type: string enableServiceLinks: - description: 'EnableServiceLinks indicates whether information about services should be injected into pod''s environment variables, matching the syntax of Docker links. Optional: Knative defaults this to false.' + description: |- + EnableServiceLinks indicates whether information aboutservices should be injected into pod's environment variables, matching the syntax of Docker links. Optional: Knative defaults this to false. type: boolean hostAliases: - description: This is accessible behind a feature flag - kubernetes.podspec-hostaliases + description: |- + This is accessible behind a feature flag - kubernetes.podspec-hostaliases type: array items: - description: This is accessible behind a feature flag - kubernetes.podspec-hostaliases + description: |- + This is accessible behind a feature flag - kubernetes.podspec-hostaliases type: object x-kubernetes-preserve-unknown-fields: true + hostIPC: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-hostipc + type: boolean + hostNetwork: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-hostnetwork + type: boolean + hostPID: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-hostpid + type: boolean idleTimeoutSeconds: description: |- IdleTimeoutSeconds is the maximum duration in seconds a request will be allowed @@ -1176,39 +1199,35 @@ spec: name: description: |- Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid? type: string + default: "" x-kubernetes-map-type: atomic + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map initContainers: description: |- - List of initialization containers belonging to the pod. - Init containers are executed in order prior to containers being started. If any - init container fails, the pod is considered to have failed and is handled according - to its restartPolicy. The name for an init container or normal container must be - unique among all containers. - Init containers may not have Lifecycle actions, Readiness probes, Liveness probes, or Startup probes. - The resourceRequirements of an init container are taken into account during scheduling - by finding the highest request/limit for each resource type, and then using the max of - of that value or the sum of the normal containers. Limits are applied to init containers - in a similar fashion. - Init containers cannot currently be added or removed. - Cannot be updated. - More info: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/ + This is accessible behind a feature flag - kubernetes.podspec-init-containers type: array items: description: This is accessible behind a feature flag - kubernetes.podspec-init-containers type: object x-kubernetes-preserve-unknown-fields: true nodeSelector: - description: This is accessible behind a feature flag - kubernetes.podspec-nodeselector + description: |- + This is accessible behind a feature flag - kubernetes.podspec-nodeselector type: object - x-kubernetes-preserve-unknown-fields: true + additionalProperties: + type: string x-kubernetes-map-type: atomic priorityClassName: - description: This is accessible behind a feature flag - kubernetes.podspec-priorityclassname + description: |- + This is accessible behind a feature flag - kubernetes.podspec-priorityclassname type: string - x-kubernetes-preserve-unknown-fields: true responseStartTimeoutSeconds: description: |- ResponseStartTimeoutSeconds is the maximum duration in seconds that the request @@ -1217,15 +1236,16 @@ spec: type: integer format: int64 runtimeClassName: - description: This is accessible behind a feature flag - kubernetes.podspec-runtimeclassname + description: |- + This is accessible behind a feature flag - kubernetes.podspec-runtimeclassname type: string - x-kubernetes-preserve-unknown-fields: true schedulerName: - description: This is accessible behind a feature flag - kubernetes.podspec-schedulername + description: |- + This is accessible behind a feature flag - kubernetes.podspec-schedulername type: string - x-kubernetes-preserve-unknown-fields: true securityContext: - description: This is accessible behind a feature flag - kubernetes.podspec-securitycontext + description: |- + This is accessible behind a feature flag - kubernetes.podspec-securitycontext type: object x-kubernetes-preserve-unknown-fields: true serviceAccountName: @@ -1234,9 +1254,9 @@ spec: More info: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/ type: string shareProcessNamespace: - description: This is accessible behind a feature flag - kubernetes.podspec-shareproccessnamespace + description: |- + This is accessible behind a feature flag - kubernetes.podspec-shareprocessnamespace type: boolean - x-kubernetes-preserve-unknown-fields: true timeoutSeconds: description: |- TimeoutSeconds is the maximum duration in seconds that the request instance @@ -1248,11 +1268,13 @@ spec: description: This is accessible behind a feature flag - kubernetes.podspec-tolerations type: array items: - description: This is accessible behind a feature flag - kubernetes.podspec-tolerations + description: |- + This is accessible behind a feature flag - kubernetes.podspec-tolerations type: object x-kubernetes-preserve-unknown-fields: true topologySpreadConstraints: - description: This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints + description: |- + This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints type: array items: description: This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints @@ -1321,18 +1343,37 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + x-kubernetes-list-type: atomic name: description: |- Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid? type: string + default: "" optional: description: optional specify whether the ConfigMap or its keys must be defined type: boolean x-kubernetes-map-type: atomic + csi: + description: This is accessible behind a feature flag - kubernetes.podspec-volumes-csi + type: object + x-kubernetes-preserve-unknown-fields: true emptyDir: - description: This is accessible behind a feature flag - kubernetes.podspec-emptydir + description: |- + This is accessible behind a feature flag - kubernetes.podspec-volumes-emptydir + type: object + x-kubernetes-preserve-unknown-fields: true + hostPath: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-volumes-hostpath + type: object + x-kubernetes-preserve-unknown-fields: true + image: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-volumes-image type: object x-kubernetes-preserve-unknown-fields: true name: @@ -1342,7 +1383,8 @@ spec: More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string persistentVolumeClaim: - description: This is accessible behind a feature flag - kubernetes.podspec-persistent-volume-claim + description: |- + This is accessible behind a feature flag - kubernetes.podspec-persistent-volume-claim type: object x-kubernetes-preserve-unknown-fields: true projected: @@ -1360,10 +1402,14 @@ spec: type: integer format: int32 sources: - description: sources is the list of volume projections + description: |- + sources is the list of volume projections. Each entry in this list + handles one source. type: array items: - description: Projection that may be projected along with other supported volume types + description: |- + Projection that may be projected along with other supported volume types. + Exactly one of these fields must be set. type: object properties: configMap: @@ -1407,12 +1453,16 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + x-kubernetes-list-type: atomic name: description: |- Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid? type: string + default: "" optional: description: optional specify whether the ConfigMap or its keys must be defined type: boolean @@ -1431,7 +1481,7 @@ spec: - path properties: fieldRef: - description: 'Required: Selects a field of the pod: only annotations, labels, name and namespace are supported.' + description: 'Required: Selects a field of the pod: only annotations, labels, name, namespace and uid are supported.' type: object required: - fieldPath @@ -1478,6 +1528,7 @@ spec: description: 'Required: resource to select' type: string x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic secret: description: secret information about the secret data to project type: object @@ -1519,12 +1570,16 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + x-kubernetes-list-type: atomic name: description: |- Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid? type: string + default: "" optional: description: optional field specify whether the Secret or its key must be defined type: boolean @@ -1557,6 +1612,7 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + x-kubernetes-list-type: atomic secret: description: |- secret represents a secret that should populate this volume. @@ -1611,6 +1667,7 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + x-kubernetes-list-type: atomic optional: description: optional field specify whether the Secret or its keys must be defined type: boolean @@ -1619,6 +1676,9 @@ spec: secretName is the name of the secret in the pod's namespace to use. More info: https://kubernetes.io/docs/concepts/storage/volumes#secret type: string + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map status: description: ConfigurationStatus communicates the observed state of the Configuration (from the controller). type: object @@ -1705,7 +1765,7 @@ metadata: labels: app.kubernetes.io/name: knative-serving app.kubernetes.io/component: networking - app.kubernetes.io/version: "1.15.0" + app.kubernetes.io/version: "1.22.1" knative.dev/crd-install: "true" spec: group: networking.internal.knative.dev @@ -1781,7 +1841,7 @@ metadata: name: domainmappings.serving.knative.dev labels: app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.15.0" + app.kubernetes.io/version: "1.22.1" knative.dev/crd-install: "true" spec: group: serving.knative.dev @@ -1835,13 +1895,11 @@ spec: description: |- Ref specifies the target of the Domain Mapping. - The object identified by the Ref must be an Addressable with a URL of the form `{name}.{namespace}.{domain}` where `{domain}` is the cluster domain, and `{name}` and `{namespace}` are the name and namespace of a Kubernetes Service. - This contract is satisfied by Knative types such as Knative Services and Knative Routes, and by Kubernetes Services. type: object @@ -1994,7 +2052,7 @@ metadata: labels: app.kubernetes.io/name: knative-serving app.kubernetes.io/component: networking - app.kubernetes.io/version: "1.15.0" + app.kubernetes.io/version: "1.22.1" knative.dev/crd-install: "true" spec: group: networking.internal.knative.dev @@ -2011,7 +2069,6 @@ spec: by a backend. An Ingress can be configured to give services externally-reachable URLs, load balance traffic, offer name based virtual hosting, etc. - This is heavily based on K8s Ingress https://godoc.org/k8s.io/api/networking/v1beta1#Ingress which some highlighted modifications. type: object @@ -2083,7 +2140,6 @@ spec: description: |- A collection of paths that map requests to backends. - If they are multiple matching paths, the first match takes precedence. type: array items: @@ -2099,7 +2155,6 @@ spec: AppendHeaders allow specifying additional HTTP headers to add before forwarding a request to the destination service. - NOTE: This differs from K8s Ingress which doesn't allow header appending. type: object additionalProperties: @@ -2134,7 +2189,6 @@ spec: description: |- RewriteHost rewrites the incoming request's host header. - This field is currently experimental and not supported by all Ingress implementations. type: string @@ -2156,7 +2210,6 @@ spec: AppendHeaders allow specifying additional HTTP headers to add before forwarding a request to the destination service. - NOTE: This differs from K8s Ingress which doesn't allow header appending. type: object additionalProperties: @@ -2166,7 +2219,6 @@ spec: Specifies the split percentage, a number between 0 and 100. If only one split is specified, we default to 100. - NOTE: This differs from K8s Ingress to allow percentage split. type: integer serviceName: @@ -2176,7 +2228,6 @@ spec: description: |- Specifies the namespace of the referenced service. - NOTE: This differs from K8s Ingress to allow routing to different namespaces. type: string servicePort: @@ -2301,7 +2352,6 @@ spec: description: |- DomainInternal is set if there is a cluster-local DNS name to access the Ingress. - NOTE: This differs from K8s Ingress, since we also desire to have a cluster-local DNS name to allow routing in case of not having a mesh. type: string @@ -2337,7 +2387,6 @@ spec: description: |- DomainInternal is set if there is a cluster-local DNS name to access the Ingress. - NOTE: This differs from K8s Ingress, since we also desire to have a cluster-local DNS name to allow routing in case of not having a mesh. type: string @@ -2390,7 +2439,7 @@ metadata: name: metrics.autoscaling.internal.knative.dev labels: app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.15.0" + app.kubernetes.io/version: "1.22.1" knative.dev/crd-install: "true" spec: group: autoscaling.internal.knative.dev @@ -2533,7 +2582,7 @@ metadata: name: podautoscalers.autoscaling.internal.knative.dev labels: app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.15.0" + app.kubernetes.io/version: "1.22.1" knative.dev/crd-install: "true" spec: group: autoscaling.internal.knative.dev @@ -2733,7 +2782,7 @@ metadata: name: revisions.serving.knative.dev labels: app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.15.0" + app.kubernetes.io/version: "1.22.1" knative.dev/crd-install: "true" spec: group: serving.knative.dev @@ -2780,7 +2829,6 @@ spec: references a container image. Revisions are created by updates to a Configuration. - See also: https://github.com/knative/serving/blob/main/docs/spec/overview.md#revision type: object properties: @@ -2846,6 +2894,7 @@ spec: type: array items: type: string + x-kubernetes-list-type: atomic command: description: |- Entrypoint array. Not executed within a shell. @@ -2859,6 +2908,7 @@ spec: type: array items: type: string + x-kubernetes-list-type: atomic env: description: |- List of environment variables to set in the container. @@ -2871,7 +2921,9 @@ spec: - name properties: name: - description: Name of the environment variable. Must be a C_IDENTIFIER. + description: |- + Name of the environment variable. + May consist of any printable ASCII characters except '='. type: string value: description: |- @@ -2901,23 +2953,28 @@ spec: name: description: |- Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid? type: string + default: "" optional: description: Specify whether the ConfigMap or its key must be defined type: boolean x-kubernetes-map-type: atomic fieldRef: - description: This is accessible behind a feature flag - kubernetes.podspec-fieldref + description: |- + This is accessible behind a feature flag - kubernetes.podspec-fieldref type: object - x-kubernetes-preserve-unknown-fields: true x-kubernetes-map-type: atomic + x-kubernetes-preserve-unknown-fields: true resourceFieldRef: - description: This is accessible behind a feature flag - kubernetes.podspec-fieldref + description: |- + This is accessible behind a feature flag - kubernetes.podspec-fieldref type: object - x-kubernetes-preserve-unknown-fields: true x-kubernetes-map-type: atomic + x-kubernetes-preserve-unknown-fields: true secretKeyRef: description: Selects a key of a secret in the pod's namespace type: object @@ -2930,24 +2987,30 @@ spec: name: description: |- Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid? type: string + default: "" optional: description: Specify whether the Secret or its key must be defined type: boolean x-kubernetes-map-type: atomic + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map envFrom: description: |- List of sources to populate environment variables in the container. - The keys defined within a source must be a C_IDENTIFIER. All invalid keys - will be reported as an event when the container is starting. When a key exists in multiple + The keys defined within a source may consist of any printable ASCII characters except '='. + When a key exists in multiple sources, the value associated with the last source will take precedence. Values defined by an Env with a duplicate key will take precedence. Cannot be updated. type: array items: - description: EnvFromSource represents the source of a set of ConfigMaps + description: EnvFromSource represents the source of a set of ConfigMaps or Secrets type: object properties: configMapRef: @@ -2957,15 +3020,20 @@ spec: name: description: |- Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid? type: string + default: "" optional: description: Specify whether the ConfigMap must be defined type: boolean x-kubernetes-map-type: atomic prefix: - description: An optional identifier to prepend to each key in the ConfigMap. Must be a C_IDENTIFIER. + description: |- + Optional text to prepend to the name of each environment variable. + May consist of any printable ASCII characters except '='. type: string secretRef: description: The Secret to select from @@ -2974,13 +3042,17 @@ spec: name: description: |- Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid? type: string + default: "" optional: description: Specify whether the Secret must be defined type: boolean x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic image: description: |- Container image name. @@ -3005,7 +3077,7 @@ spec: type: object properties: exec: - description: Exec specifies the action to take. + description: Exec specifies a command to execute in the container. type: object properties: command: @@ -3018,6 +3090,7 @@ spec: type: array items: type: string + x-kubernetes-list-type: atomic failureThreshold: description: |- Minimum consecutive failures for the probe to be considered failed after having succeeded. @@ -3025,10 +3098,8 @@ spec: type: integer format: int32 grpc: - description: GRPC specifies an action involving a GRPC port. + description: GRPC specifies a GRPC HealthCheckRequest. type: object - required: - - port properties: port: description: Port number of the gRPC service. Number must be in the range 1 to 65535. @@ -3039,11 +3110,11 @@ spec: Service is the name of the service to place in the gRPC HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). - If this is not specified, the default behavior is defined by gRPC. type: string + default: "" httpGet: - description: HTTPGet specifies the http request to perform. + description: HTTPGet specifies an HTTP GET request to perform. type: object properties: host: @@ -3069,6 +3140,7 @@ spec: value: description: The header field value type: string + x-kubernetes-list-type: atomic path: description: Path to access on the HTTP server. type: string @@ -3093,7 +3165,8 @@ spec: type: integer format: int32 periodSeconds: - description: How often (in seconds) to perform the probe. + description: |- + How often (in seconds) to perform the probe. type: integer format: int32 successThreshold: @@ -3103,7 +3176,7 @@ spec: type: integer format: int32 tcpSocket: - description: TCPSocket specifies an action involving a TCP port. + description: TCPSocket specifies a connection to a TCP port. type: object properties: host: @@ -3144,8 +3217,6 @@ spec: items: description: ContainerPort represents a network port in a single container. type: object - required: - - containerPort properties: containerPort: description: |- @@ -3165,10 +3236,6 @@ spec: Defaults to "TCP". type: string default: TCP - x-kubernetes-list-map-keys: - - containerPort - - protocol - x-kubernetes-list-type: map readinessProbe: description: |- Periodic probe of container service readiness. @@ -3178,7 +3245,7 @@ spec: type: object properties: exec: - description: Exec specifies the action to take. + description: Exec specifies a command to execute in the container. type: object properties: command: @@ -3191,6 +3258,7 @@ spec: type: array items: type: string + x-kubernetes-list-type: atomic failureThreshold: description: |- Minimum consecutive failures for the probe to be considered failed after having succeeded. @@ -3198,10 +3266,8 @@ spec: type: integer format: int32 grpc: - description: GRPC specifies an action involving a GRPC port. + description: GRPC specifies a GRPC HealthCheckRequest. type: object - required: - - port properties: port: description: Port number of the gRPC service. Number must be in the range 1 to 65535. @@ -3212,11 +3278,11 @@ spec: Service is the name of the service to place in the gRPC HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). - If this is not specified, the default behavior is defined by gRPC. type: string + default: "" httpGet: - description: HTTPGet specifies the http request to perform. + description: HTTPGet specifies an HTTP GET request to perform. type: object properties: host: @@ -3242,6 +3308,7 @@ spec: value: description: The header field value type: string + x-kubernetes-list-type: atomic path: description: Path to access on the HTTP server. type: string @@ -3266,7 +3333,8 @@ spec: type: integer format: int32 periodSeconds: - description: How often (in seconds) to perform the probe. + description: |- + How often (in seconds) to perform the probe. type: integer format: int32 successThreshold: @@ -3276,7 +3344,7 @@ spec: type: integer format: int32 tcpSocket: - description: TCPSocket specifies an action involving a TCP port. + description: TCPSocket specifies a connection to a TCP port. type: object properties: host: @@ -3305,33 +3373,6 @@ spec: More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ type: object properties: - claims: - description: |- - Claims lists the names of resources, defined in spec.resourceClaims, - that are used by this container. - - - This is an alpha field and requires enabling the - DynamicResourceAllocation feature gate. - - - This field is immutable. It can only be set for containers. - type: array - items: - description: ResourceClaim references one entry in PodSpec.ResourceClaims. - type: object - required: - - name - properties: - name: - description: |- - Name must match the name of one entry in pod.spec.resourceClaims of - the Pod where this field is used. It makes that resource available - inside a container. - type: string - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map limits: description: |- Limits describes the maximum amount of compute resources allowed. @@ -3386,12 +3427,18 @@ spec: items: description: Capability represent POSIX capabilities type type: string + x-kubernetes-list-type: atomic drop: description: Removed capabilities type: array items: description: Capability represent POSIX capabilities type type: string + x-kubernetes-list-type: atomic + privileged: + description: |- + Run container in privileged mode. This can only be set to explicitly to 'false' + type: boolean readOnlyRootFilesystem: description: |- Whether this container has a read-only root filesystem. @@ -3447,7 +3494,6 @@ spec: type indicates which kind of seccomp profile will be applied. Valid options are: - Localhost - a profile defined in a file on the node should be used. RuntimeDefault - the container runtime default profile should be used. Unconfined - no profile should be applied. @@ -3464,7 +3510,7 @@ spec: type: object properties: exec: - description: Exec specifies the action to take. + description: Exec specifies a command to execute in the container. type: object properties: command: @@ -3477,6 +3523,7 @@ spec: type: array items: type: string + x-kubernetes-list-type: atomic failureThreshold: description: |- Minimum consecutive failures for the probe to be considered failed after having succeeded. @@ -3484,10 +3531,8 @@ spec: type: integer format: int32 grpc: - description: GRPC specifies an action involving a GRPC port. + description: GRPC specifies a GRPC HealthCheckRequest. type: object - required: - - port properties: port: description: Port number of the gRPC service. Number must be in the range 1 to 65535. @@ -3498,11 +3543,11 @@ spec: Service is the name of the service to place in the gRPC HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). - If this is not specified, the default behavior is defined by gRPC. type: string + default: "" httpGet: - description: HTTPGet specifies the http request to perform. + description: HTTPGet specifies an HTTP GET request to perform. type: object properties: host: @@ -3528,6 +3573,7 @@ spec: value: description: The header field value type: string + x-kubernetes-list-type: atomic path: description: Path to access on the HTTP server. type: string @@ -3552,7 +3598,8 @@ spec: type: integer format: int32 periodSeconds: - description: How often (in seconds) to perform the probe. + description: |- + How often (in seconds) to perform the probe. type: integer format: int32 successThreshold: @@ -3562,7 +3609,7 @@ spec: type: integer format: int32 tcpSocket: - description: TCPSocket specifies an action involving a TCP port. + description: TCPSocket specifies a connection to a TCP port. type: object properties: host: @@ -3621,6 +3668,10 @@ spec: Path within the container at which the volume should be mounted. Must not contain ':'. type: string + mountPropagation: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-volumes-mount-propagation + type: string name: description: This must match the Name of a Volume. type: string @@ -3634,6 +3685,9 @@ spec: Path within the volume from which the container's volume should be mounted. Defaults to "" (volume's root). type: string + x-kubernetes-list-map-keys: + - mountPath + x-kubernetes-list-type: map workingDir: description: |- Container's working directory. @@ -3642,22 +3696,39 @@ spec: Cannot be updated. type: string dnsConfig: - description: This is accessible behind a feature flag - kubernetes.podspec-dnsconfig + description: |- + This is accessible behind a feature flag - kubernetes.podspec-dnsconfig type: object x-kubernetes-preserve-unknown-fields: true dnsPolicy: - description: This is accessible behind a feature flag - kubernetes.podspec-dnspolicy + description: |- + This is accessible behind a feature flag - kubernetes.podspec-dnspolicy type: string enableServiceLinks: - description: 'EnableServiceLinks indicates whether information about services should be injected into pod''s environment variables, matching the syntax of Docker links. Optional: Knative defaults this to false.' + description: |- + EnableServiceLinks indicates whether information aboutservices should be injected into pod's environment variables, matching the syntax of Docker links. Optional: Knative defaults this to false. type: boolean hostAliases: - description: This is accessible behind a feature flag - kubernetes.podspec-hostaliases + description: |- + This is accessible behind a feature flag - kubernetes.podspec-hostaliases type: array items: - description: This is accessible behind a feature flag - kubernetes.podspec-hostaliases + description: |- + This is accessible behind a feature flag - kubernetes.podspec-hostaliases type: object x-kubernetes-preserve-unknown-fields: true + hostIPC: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-hostipc + type: boolean + hostNetwork: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-hostnetwork + type: boolean + hostPID: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-hostpid + type: boolean idleTimeoutSeconds: description: |- IdleTimeoutSeconds is the maximum duration in seconds a request will be allowed @@ -3680,39 +3751,35 @@ spec: name: description: |- Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid? type: string + default: "" x-kubernetes-map-type: atomic + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map initContainers: description: |- - List of initialization containers belonging to the pod. - Init containers are executed in order prior to containers being started. If any - init container fails, the pod is considered to have failed and is handled according - to its restartPolicy. The name for an init container or normal container must be - unique among all containers. - Init containers may not have Lifecycle actions, Readiness probes, Liveness probes, or Startup probes. - The resourceRequirements of an init container are taken into account during scheduling - by finding the highest request/limit for each resource type, and then using the max of - of that value or the sum of the normal containers. Limits are applied to init containers - in a similar fashion. - Init containers cannot currently be added or removed. - Cannot be updated. - More info: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/ + This is accessible behind a feature flag - kubernetes.podspec-init-containers type: array items: description: This is accessible behind a feature flag - kubernetes.podspec-init-containers type: object x-kubernetes-preserve-unknown-fields: true nodeSelector: - description: This is accessible behind a feature flag - kubernetes.podspec-nodeselector + description: |- + This is accessible behind a feature flag - kubernetes.podspec-nodeselector type: object - x-kubernetes-preserve-unknown-fields: true + additionalProperties: + type: string x-kubernetes-map-type: atomic priorityClassName: - description: This is accessible behind a feature flag - kubernetes.podspec-priorityclassname + description: |- + This is accessible behind a feature flag - kubernetes.podspec-priorityclassname type: string - x-kubernetes-preserve-unknown-fields: true responseStartTimeoutSeconds: description: |- ResponseStartTimeoutSeconds is the maximum duration in seconds that the request @@ -3721,15 +3788,16 @@ spec: type: integer format: int64 runtimeClassName: - description: This is accessible behind a feature flag - kubernetes.podspec-runtimeclassname + description: |- + This is accessible behind a feature flag - kubernetes.podspec-runtimeclassname type: string - x-kubernetes-preserve-unknown-fields: true schedulerName: - description: This is accessible behind a feature flag - kubernetes.podspec-schedulername + description: |- + This is accessible behind a feature flag - kubernetes.podspec-schedulername type: string - x-kubernetes-preserve-unknown-fields: true securityContext: - description: This is accessible behind a feature flag - kubernetes.podspec-securitycontext + description: |- + This is accessible behind a feature flag - kubernetes.podspec-securitycontext type: object x-kubernetes-preserve-unknown-fields: true serviceAccountName: @@ -3738,9 +3806,9 @@ spec: More info: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/ type: string shareProcessNamespace: - description: This is accessible behind a feature flag - kubernetes.podspec-shareproccessnamespace + description: |- + This is accessible behind a feature flag - kubernetes.podspec-shareprocessnamespace type: boolean - x-kubernetes-preserve-unknown-fields: true timeoutSeconds: description: |- TimeoutSeconds is the maximum duration in seconds that the request instance @@ -3752,11 +3820,13 @@ spec: description: This is accessible behind a feature flag - kubernetes.podspec-tolerations type: array items: - description: This is accessible behind a feature flag - kubernetes.podspec-tolerations + description: |- + This is accessible behind a feature flag - kubernetes.podspec-tolerations type: object x-kubernetes-preserve-unknown-fields: true topologySpreadConstraints: - description: This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints + description: |- + This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints type: array items: description: This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints @@ -3825,18 +3895,37 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + x-kubernetes-list-type: atomic name: description: |- Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid? type: string + default: "" optional: description: optional specify whether the ConfigMap or its keys must be defined type: boolean x-kubernetes-map-type: atomic + csi: + description: This is accessible behind a feature flag - kubernetes.podspec-volumes-csi + type: object + x-kubernetes-preserve-unknown-fields: true emptyDir: - description: This is accessible behind a feature flag - kubernetes.podspec-emptydir + description: |- + This is accessible behind a feature flag - kubernetes.podspec-volumes-emptydir + type: object + x-kubernetes-preserve-unknown-fields: true + hostPath: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-volumes-hostpath + type: object + x-kubernetes-preserve-unknown-fields: true + image: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-volumes-image type: object x-kubernetes-preserve-unknown-fields: true name: @@ -3846,7 +3935,8 @@ spec: More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string persistentVolumeClaim: - description: This is accessible behind a feature flag - kubernetes.podspec-persistent-volume-claim + description: |- + This is accessible behind a feature flag - kubernetes.podspec-persistent-volume-claim type: object x-kubernetes-preserve-unknown-fields: true projected: @@ -3864,10 +3954,14 @@ spec: type: integer format: int32 sources: - description: sources is the list of volume projections + description: |- + sources is the list of volume projections. Each entry in this list + handles one source. type: array items: - description: Projection that may be projected along with other supported volume types + description: |- + Projection that may be projected along with other supported volume types. + Exactly one of these fields must be set. type: object properties: configMap: @@ -3911,12 +4005,16 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + x-kubernetes-list-type: atomic name: description: |- Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid? type: string + default: "" optional: description: optional specify whether the ConfigMap or its keys must be defined type: boolean @@ -3935,7 +4033,7 @@ spec: - path properties: fieldRef: - description: 'Required: Selects a field of the pod: only annotations, labels, name and namespace are supported.' + description: 'Required: Selects a field of the pod: only annotations, labels, name, namespace and uid are supported.' type: object required: - fieldPath @@ -3982,6 +4080,7 @@ spec: description: 'Required: resource to select' type: string x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic secret: description: secret information about the secret data to project type: object @@ -4023,12 +4122,16 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + x-kubernetes-list-type: atomic name: description: |- Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid? type: string + default: "" optional: description: optional field specify whether the Secret or its key must be defined type: boolean @@ -4061,6 +4164,7 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + x-kubernetes-list-type: atomic secret: description: |- secret represents a secret that should populate this volume. @@ -4115,6 +4219,7 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + x-kubernetes-list-type: atomic optional: description: optional field specify whether the Secret or its keys must be defined type: boolean @@ -4123,6 +4228,9 @@ spec: secretName is the name of the secret in the pod's namespace to use. More info: https://kubernetes.io/docs/concepts/storage/volumes#secret type: string + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map status: description: RevisionStatus communicates the observed state of the Revision (from the controller). type: object @@ -4182,7 +4290,7 @@ spec: The digests are resolved during the creation of Revision. ContainerStatuses holds the container name and image digests for both serving and non serving containers. - ref: http://bit.ly/image-digests + ref: https://bit.ly/image-digests type: array items: description: ContainerStatus holds the information of container name and image digest value @@ -4203,7 +4311,7 @@ spec: The digests are resolved during the creation of Revision. ContainerStatuses holds the container name and image digests for both serving and non serving containers. - ref: http://bit.ly/image-digests + ref: https://bit.ly/image-digests type: array items: description: ContainerStatus holds the information of container name and image digest value @@ -4247,7 +4355,7 @@ metadata: name: routes.serving.knative.dev labels: app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.15.0" + app.kubernetes.io/version: "1.22.1" knative.dev/crd-install: "true" duck.knative.dev/addressable: "true" spec: @@ -4517,7 +4625,7 @@ metadata: labels: app.kubernetes.io/name: knative-serving app.kubernetes.io/component: networking - app.kubernetes.io/version: "1.15.0" + app.kubernetes.io/version: "1.22.1" knative.dev/crd-install: "true" spec: group: networking.internal.knative.dev @@ -4590,7 +4698,6 @@ spec: the event) or if no container name is specified "spec.containers[2]" (container with index 2 in this pod). This syntax is chosen only to have some well-defined way of referencing a part of an object. - TODO: this design is not final and this field is subject to change in the future. type: string kind: description: |- @@ -4741,7 +4848,7 @@ metadata: name: services.serving.knative.dev labels: app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.15.0" + app.kubernetes.io/version: "1.22.1" knative.dev/crd-install: "true" duck.knative.dev/addressable: "true" duck.knative.dev/podspecable: "true" @@ -4792,11 +4899,9 @@ spec: underlying Routes and Configurations (much as a kubernetes Deployment orchestrates ReplicaSets), and its usage is optional but recommended. - The Service's controller will track the statuses of its owned Configuration and Route, reflecting their statuses and conditions as its own. - See also: https://github.com/knative/serving/blob/main/docs/spec/overview.md#service type: object properties: @@ -4897,6 +5002,7 @@ spec: type: array items: type: string + x-kubernetes-list-type: atomic command: description: |- Entrypoint array. Not executed within a shell. @@ -4910,6 +5016,7 @@ spec: type: array items: type: string + x-kubernetes-list-type: atomic env: description: |- List of environment variables to set in the container. @@ -4922,7 +5029,9 @@ spec: - name properties: name: - description: Name of the environment variable. Must be a C_IDENTIFIER. + description: |- + Name of the environment variable. + May consist of any printable ASCII characters except '='. type: string value: description: |- @@ -4952,23 +5061,28 @@ spec: name: description: |- Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid? type: string + default: "" optional: description: Specify whether the ConfigMap or its key must be defined type: boolean x-kubernetes-map-type: atomic fieldRef: - description: This is accessible behind a feature flag - kubernetes.podspec-fieldref + description: |- + This is accessible behind a feature flag - kubernetes.podspec-fieldref type: object - x-kubernetes-preserve-unknown-fields: true x-kubernetes-map-type: atomic + x-kubernetes-preserve-unknown-fields: true resourceFieldRef: - description: This is accessible behind a feature flag - kubernetes.podspec-fieldref + description: |- + This is accessible behind a feature flag - kubernetes.podspec-fieldref type: object - x-kubernetes-preserve-unknown-fields: true x-kubernetes-map-type: atomic + x-kubernetes-preserve-unknown-fields: true secretKeyRef: description: Selects a key of a secret in the pod's namespace type: object @@ -4981,24 +5095,30 @@ spec: name: description: |- Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid? type: string + default: "" optional: description: Specify whether the Secret or its key must be defined type: boolean x-kubernetes-map-type: atomic + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map envFrom: description: |- List of sources to populate environment variables in the container. - The keys defined within a source must be a C_IDENTIFIER. All invalid keys - will be reported as an event when the container is starting. When a key exists in multiple + The keys defined within a source may consist of any printable ASCII characters except '='. + When a key exists in multiple sources, the value associated with the last source will take precedence. Values defined by an Env with a duplicate key will take precedence. Cannot be updated. type: array items: - description: EnvFromSource represents the source of a set of ConfigMaps + description: EnvFromSource represents the source of a set of ConfigMaps or Secrets type: object properties: configMapRef: @@ -5008,15 +5128,20 @@ spec: name: description: |- Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid? type: string + default: "" optional: description: Specify whether the ConfigMap must be defined type: boolean x-kubernetes-map-type: atomic prefix: - description: An optional identifier to prepend to each key in the ConfigMap. Must be a C_IDENTIFIER. + description: |- + Optional text to prepend to the name of each environment variable. + May consist of any printable ASCII characters except '='. type: string secretRef: description: The Secret to select from @@ -5025,13 +5150,17 @@ spec: name: description: |- Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid? type: string + default: "" optional: description: Specify whether the Secret must be defined type: boolean x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic image: description: |- Container image name. @@ -5056,7 +5185,7 @@ spec: type: object properties: exec: - description: Exec specifies the action to take. + description: Exec specifies a command to execute in the container. type: object properties: command: @@ -5069,6 +5198,7 @@ spec: type: array items: type: string + x-kubernetes-list-type: atomic failureThreshold: description: |- Minimum consecutive failures for the probe to be considered failed after having succeeded. @@ -5076,10 +5206,8 @@ spec: type: integer format: int32 grpc: - description: GRPC specifies an action involving a GRPC port. + description: GRPC specifies a GRPC HealthCheckRequest. type: object - required: - - port properties: port: description: Port number of the gRPC service. Number must be in the range 1 to 65535. @@ -5090,11 +5218,11 @@ spec: Service is the name of the service to place in the gRPC HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). - If this is not specified, the default behavior is defined by gRPC. type: string + default: "" httpGet: - description: HTTPGet specifies the http request to perform. + description: HTTPGet specifies an HTTP GET request to perform. type: object properties: host: @@ -5120,6 +5248,7 @@ spec: value: description: The header field value type: string + x-kubernetes-list-type: atomic path: description: Path to access on the HTTP server. type: string @@ -5144,7 +5273,8 @@ spec: type: integer format: int32 periodSeconds: - description: How often (in seconds) to perform the probe. + description: |- + How often (in seconds) to perform the probe. type: integer format: int32 successThreshold: @@ -5154,7 +5284,7 @@ spec: type: integer format: int32 tcpSocket: - description: TCPSocket specifies an action involving a TCP port. + description: TCPSocket specifies a connection to a TCP port. type: object properties: host: @@ -5195,8 +5325,6 @@ spec: items: description: ContainerPort represents a network port in a single container. type: object - required: - - containerPort properties: containerPort: description: |- @@ -5216,10 +5344,6 @@ spec: Defaults to "TCP". type: string default: TCP - x-kubernetes-list-map-keys: - - containerPort - - protocol - x-kubernetes-list-type: map readinessProbe: description: |- Periodic probe of container service readiness. @@ -5229,7 +5353,7 @@ spec: type: object properties: exec: - description: Exec specifies the action to take. + description: Exec specifies a command to execute in the container. type: object properties: command: @@ -5242,6 +5366,7 @@ spec: type: array items: type: string + x-kubernetes-list-type: atomic failureThreshold: description: |- Minimum consecutive failures for the probe to be considered failed after having succeeded. @@ -5249,10 +5374,8 @@ spec: type: integer format: int32 grpc: - description: GRPC specifies an action involving a GRPC port. + description: GRPC specifies a GRPC HealthCheckRequest. type: object - required: - - port properties: port: description: Port number of the gRPC service. Number must be in the range 1 to 65535. @@ -5263,11 +5386,11 @@ spec: Service is the name of the service to place in the gRPC HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). - If this is not specified, the default behavior is defined by gRPC. type: string + default: "" httpGet: - description: HTTPGet specifies the http request to perform. + description: HTTPGet specifies an HTTP GET request to perform. type: object properties: host: @@ -5293,6 +5416,7 @@ spec: value: description: The header field value type: string + x-kubernetes-list-type: atomic path: description: Path to access on the HTTP server. type: string @@ -5317,7 +5441,8 @@ spec: type: integer format: int32 periodSeconds: - description: How often (in seconds) to perform the probe. + description: |- + How often (in seconds) to perform the probe. type: integer format: int32 successThreshold: @@ -5327,7 +5452,7 @@ spec: type: integer format: int32 tcpSocket: - description: TCPSocket specifies an action involving a TCP port. + description: TCPSocket specifies a connection to a TCP port. type: object properties: host: @@ -5356,33 +5481,6 @@ spec: More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ type: object properties: - claims: - description: |- - Claims lists the names of resources, defined in spec.resourceClaims, - that are used by this container. - - - This is an alpha field and requires enabling the - DynamicResourceAllocation feature gate. - - - This field is immutable. It can only be set for containers. - type: array - items: - description: ResourceClaim references one entry in PodSpec.ResourceClaims. - type: object - required: - - name - properties: - name: - description: |- - Name must match the name of one entry in pod.spec.resourceClaims of - the Pod where this field is used. It makes that resource available - inside a container. - type: string - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map limits: description: |- Limits describes the maximum amount of compute resources allowed. @@ -5437,12 +5535,18 @@ spec: items: description: Capability represent POSIX capabilities type type: string + x-kubernetes-list-type: atomic drop: description: Removed capabilities type: array items: description: Capability represent POSIX capabilities type type: string + x-kubernetes-list-type: atomic + privileged: + description: |- + Run container in privileged mode. This can only be set to explicitly to 'false' + type: boolean readOnlyRootFilesystem: description: |- Whether this container has a read-only root filesystem. @@ -5498,7 +5602,6 @@ spec: type indicates which kind of seccomp profile will be applied. Valid options are: - Localhost - a profile defined in a file on the node should be used. RuntimeDefault - the container runtime default profile should be used. Unconfined - no profile should be applied. @@ -5515,7 +5618,7 @@ spec: type: object properties: exec: - description: Exec specifies the action to take. + description: Exec specifies a command to execute in the container. type: object properties: command: @@ -5528,6 +5631,7 @@ spec: type: array items: type: string + x-kubernetes-list-type: atomic failureThreshold: description: |- Minimum consecutive failures for the probe to be considered failed after having succeeded. @@ -5535,10 +5639,8 @@ spec: type: integer format: int32 grpc: - description: GRPC specifies an action involving a GRPC port. + description: GRPC specifies a GRPC HealthCheckRequest. type: object - required: - - port properties: port: description: Port number of the gRPC service. Number must be in the range 1 to 65535. @@ -5549,11 +5651,11 @@ spec: Service is the name of the service to place in the gRPC HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). - If this is not specified, the default behavior is defined by gRPC. type: string + default: "" httpGet: - description: HTTPGet specifies the http request to perform. + description: HTTPGet specifies an HTTP GET request to perform. type: object properties: host: @@ -5579,6 +5681,7 @@ spec: value: description: The header field value type: string + x-kubernetes-list-type: atomic path: description: Path to access on the HTTP server. type: string @@ -5603,7 +5706,8 @@ spec: type: integer format: int32 periodSeconds: - description: How often (in seconds) to perform the probe. + description: |- + How often (in seconds) to perform the probe. type: integer format: int32 successThreshold: @@ -5613,7 +5717,7 @@ spec: type: integer format: int32 tcpSocket: - description: TCPSocket specifies an action involving a TCP port. + description: TCPSocket specifies a connection to a TCP port. type: object properties: host: @@ -5672,6 +5776,10 @@ spec: Path within the container at which the volume should be mounted. Must not contain ':'. type: string + mountPropagation: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-volumes-mount-propagation + type: string name: description: This must match the Name of a Volume. type: string @@ -5685,6 +5793,9 @@ spec: Path within the volume from which the container's volume should be mounted. Defaults to "" (volume's root). type: string + x-kubernetes-list-map-keys: + - mountPath + x-kubernetes-list-type: map workingDir: description: |- Container's working directory. @@ -5693,22 +5804,39 @@ spec: Cannot be updated. type: string dnsConfig: - description: This is accessible behind a feature flag - kubernetes.podspec-dnsconfig + description: |- + This is accessible behind a feature flag - kubernetes.podspec-dnsconfig type: object x-kubernetes-preserve-unknown-fields: true dnsPolicy: - description: This is accessible behind a feature flag - kubernetes.podspec-dnspolicy + description: |- + This is accessible behind a feature flag - kubernetes.podspec-dnspolicy type: string enableServiceLinks: - description: 'EnableServiceLinks indicates whether information about services should be injected into pod''s environment variables, matching the syntax of Docker links. Optional: Knative defaults this to false.' + description: |- + EnableServiceLinks indicates whether information aboutservices should be injected into pod's environment variables, matching the syntax of Docker links. Optional: Knative defaults this to false. type: boolean hostAliases: - description: This is accessible behind a feature flag - kubernetes.podspec-hostaliases + description: |- + This is accessible behind a feature flag - kubernetes.podspec-hostaliases type: array items: - description: This is accessible behind a feature flag - kubernetes.podspec-hostaliases + description: |- + This is accessible behind a feature flag - kubernetes.podspec-hostaliases type: object x-kubernetes-preserve-unknown-fields: true + hostIPC: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-hostipc + type: boolean + hostNetwork: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-hostnetwork + type: boolean + hostPID: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-hostpid + type: boolean idleTimeoutSeconds: description: |- IdleTimeoutSeconds is the maximum duration in seconds a request will be allowed @@ -5731,39 +5859,35 @@ spec: name: description: |- Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid? type: string + default: "" x-kubernetes-map-type: atomic + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map initContainers: description: |- - List of initialization containers belonging to the pod. - Init containers are executed in order prior to containers being started. If any - init container fails, the pod is considered to have failed and is handled according - to its restartPolicy. The name for an init container or normal container must be - unique among all containers. - Init containers may not have Lifecycle actions, Readiness probes, Liveness probes, or Startup probes. - The resourceRequirements of an init container are taken into account during scheduling - by finding the highest request/limit for each resource type, and then using the max of - of that value or the sum of the normal containers. Limits are applied to init containers - in a similar fashion. - Init containers cannot currently be added or removed. - Cannot be updated. - More info: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/ + This is accessible behind a feature flag - kubernetes.podspec-init-containers type: array items: description: This is accessible behind a feature flag - kubernetes.podspec-init-containers type: object x-kubernetes-preserve-unknown-fields: true nodeSelector: - description: This is accessible behind a feature flag - kubernetes.podspec-nodeselector + description: |- + This is accessible behind a feature flag - kubernetes.podspec-nodeselector type: object - x-kubernetes-preserve-unknown-fields: true + additionalProperties: + type: string x-kubernetes-map-type: atomic priorityClassName: - description: This is accessible behind a feature flag - kubernetes.podspec-priorityclassname + description: |- + This is accessible behind a feature flag - kubernetes.podspec-priorityclassname type: string - x-kubernetes-preserve-unknown-fields: true responseStartTimeoutSeconds: description: |- ResponseStartTimeoutSeconds is the maximum duration in seconds that the request @@ -5772,15 +5896,16 @@ spec: type: integer format: int64 runtimeClassName: - description: This is accessible behind a feature flag - kubernetes.podspec-runtimeclassname + description: |- + This is accessible behind a feature flag - kubernetes.podspec-runtimeclassname type: string - x-kubernetes-preserve-unknown-fields: true schedulerName: - description: This is accessible behind a feature flag - kubernetes.podspec-schedulername + description: |- + This is accessible behind a feature flag - kubernetes.podspec-schedulername type: string - x-kubernetes-preserve-unknown-fields: true securityContext: - description: This is accessible behind a feature flag - kubernetes.podspec-securitycontext + description: |- + This is accessible behind a feature flag - kubernetes.podspec-securitycontext type: object x-kubernetes-preserve-unknown-fields: true serviceAccountName: @@ -5789,9 +5914,9 @@ spec: More info: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/ type: string shareProcessNamespace: - description: This is accessible behind a feature flag - kubernetes.podspec-shareproccessnamespace + description: |- + This is accessible behind a feature flag - kubernetes.podspec-shareprocessnamespace type: boolean - x-kubernetes-preserve-unknown-fields: true timeoutSeconds: description: |- TimeoutSeconds is the maximum duration in seconds that the request instance @@ -5803,11 +5928,13 @@ spec: description: This is accessible behind a feature flag - kubernetes.podspec-tolerations type: array items: - description: This is accessible behind a feature flag - kubernetes.podspec-tolerations + description: |- + This is accessible behind a feature flag - kubernetes.podspec-tolerations type: object x-kubernetes-preserve-unknown-fields: true topologySpreadConstraints: - description: This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints + description: |- + This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints type: array items: description: This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints @@ -5876,18 +6003,37 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + x-kubernetes-list-type: atomic name: description: |- Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid? type: string + default: "" optional: description: optional specify whether the ConfigMap or its keys must be defined type: boolean x-kubernetes-map-type: atomic + csi: + description: This is accessible behind a feature flag - kubernetes.podspec-volumes-csi + type: object + x-kubernetes-preserve-unknown-fields: true emptyDir: - description: This is accessible behind a feature flag - kubernetes.podspec-emptydir + description: |- + This is accessible behind a feature flag - kubernetes.podspec-volumes-emptydir + type: object + x-kubernetes-preserve-unknown-fields: true + hostPath: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-volumes-hostpath + type: object + x-kubernetes-preserve-unknown-fields: true + image: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-volumes-image type: object x-kubernetes-preserve-unknown-fields: true name: @@ -5897,7 +6043,8 @@ spec: More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string persistentVolumeClaim: - description: This is accessible behind a feature flag - kubernetes.podspec-persistent-volume-claim + description: |- + This is accessible behind a feature flag - kubernetes.podspec-persistent-volume-claim type: object x-kubernetes-preserve-unknown-fields: true projected: @@ -5915,10 +6062,14 @@ spec: type: integer format: int32 sources: - description: sources is the list of volume projections + description: |- + sources is the list of volume projections. Each entry in this list + handles one source. type: array items: - description: Projection that may be projected along with other supported volume types + description: |- + Projection that may be projected along with other supported volume types. + Exactly one of these fields must be set. type: object properties: configMap: @@ -5962,12 +6113,16 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + x-kubernetes-list-type: atomic name: description: |- Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid? type: string + default: "" optional: description: optional specify whether the ConfigMap or its keys must be defined type: boolean @@ -5986,7 +6141,7 @@ spec: - path properties: fieldRef: - description: 'Required: Selects a field of the pod: only annotations, labels, name and namespace are supported.' + description: 'Required: Selects a field of the pod: only annotations, labels, name, namespace and uid are supported.' type: object required: - fieldPath @@ -6033,6 +6188,7 @@ spec: description: 'Required: resource to select' type: string x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic secret: description: secret information about the secret data to project type: object @@ -6074,12 +6230,16 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + x-kubernetes-list-type: atomic name: description: |- Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid? type: string + default: "" optional: description: optional field specify whether the Secret or its key must be defined type: boolean @@ -6112,6 +6272,7 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string + x-kubernetes-list-type: atomic secret: description: |- secret represents a secret that should populate this volume. @@ -6166,6 +6327,7 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string + x-kubernetes-list-type: atomic optional: description: optional field specify whether the Secret or its keys must be defined type: boolean @@ -6174,6 +6336,9 @@ spec: secretName is the name of the secret in the pod's namespace to use. More info: https://kubernetes.io/docs/concepts/storage/volumes#secret type: string + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map traffic: description: |- Traffic specifies how to distribute traffic over a collection of @@ -6389,7 +6554,7 @@ metadata: name: images.caching.internal.knative.dev labels: app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.15.0" + app.kubernetes.io/version: "1.22.1" knative.dev/crd-install: "true" spec: group: caching.internal.knative.dev @@ -6454,9 +6619,12 @@ spec: name: description: |- Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid? type: string + default: "" x-kubernetes-map-type: atomic serviceAccountName: description: |- @@ -6524,7 +6692,7 @@ spec: type: string jsonPath: .spec.image --- -# Source: https://github.com/knative/serving/releases/download/knative-v1.15.0/serving-core.yaml +# Source: https://github.com/knative/serving/releases/download/knative-v1.22.1/serving-core.yaml --- # Copyright 2018 The Knative Authors # @@ -6546,7 +6714,7 @@ metadata: name: knative-serving labels: app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.15.0" + app.kubernetes.io/version: "1.22.1" --- # Copyright 2023 The Knative Authors # @@ -6569,7 +6737,7 @@ metadata: namespace: knative-serving labels: serving.knative.dev/controller: "true" - app.kubernetes.io/version: "1.15.0" + app.kubernetes.io/version: "1.22.1" app.kubernetes.io/name: knative-serving rules: - apiGroups: [""] @@ -6586,7 +6754,7 @@ metadata: name: knative-serving-activator-cluster labels: serving.knative.dev/controller: "true" - app.kubernetes.io/version: "1.15.0" + app.kubernetes.io/version: "1.22.1" app.kubernetes.io/name: knative-serving rules: - apiGroups: [""] @@ -6618,7 +6786,7 @@ metadata: # (which should be identical, but isn't guaranteed to be installed alongside serving). name: knative-serving-aggregated-addressable-resolver labels: - app.kubernetes.io/version: "1.15.0" + app.kubernetes.io/version: "1.22.1" app.kubernetes.io/name: knative-serving aggregationRule: clusterRoleSelectors: @@ -6630,7 +6798,7 @@ apiVersion: rbac.authorization.k8s.io/v1 metadata: name: knative-serving-addressable-resolver labels: - app.kubernetes.io/version: "1.15.0" + app.kubernetes.io/version: "1.22.1" app.kubernetes.io/name: knative-serving # Labeled to facilitate aggregated cluster roles that act on Addressables. duck.knative.dev/addressable: "true" @@ -6668,7 +6836,7 @@ metadata: name: knative-serving-namespaced-admin labels: rbac.authorization.k8s.io/aggregate-to-admin: "true" - app.kubernetes.io/version: "1.15.0" + app.kubernetes.io/version: "1.22.1" app.kubernetes.io/name: knative-serving rules: - apiGroups: ["serving.knative.dev"] @@ -6684,7 +6852,7 @@ metadata: name: knative-serving-namespaced-edit labels: rbac.authorization.k8s.io/aggregate-to-edit: "true" - app.kubernetes.io/version: "1.15.0" + app.kubernetes.io/version: "1.22.1" app.kubernetes.io/name: knative-serving rules: - apiGroups: ["serving.knative.dev"] @@ -6700,7 +6868,7 @@ metadata: name: knative-serving-namespaced-view labels: rbac.authorization.k8s.io/aggregate-to-view: "true" - app.kubernetes.io/version: "1.15.0" + app.kubernetes.io/version: "1.22.1" app.kubernetes.io/name: knative-serving rules: - apiGroups: ["serving.knative.dev", "networking.internal.knative.dev", "autoscaling.internal.knative.dev", "caching.internal.knative.dev"] @@ -6727,7 +6895,7 @@ metadata: name: knative-serving-core labels: serving.knative.dev/controller: "true" - app.kubernetes.io/version: "1.15.0" + app.kubernetes.io/version: "1.22.1" app.kubernetes.io/name: knative-serving rules: - apiGroups: [""] @@ -6736,9 +6904,15 @@ rules: - apiGroups: [""] resources: ["endpoints/restricted"] # Permission for RestrictedEndpointsAdmission verbs: ["create"] + - apiGroups: ["discovery.k8s.io"] + resources: ["endpointslices/restricted"] # Permission for RestrictedEndpointsAdmission + verbs: ["create"] - apiGroups: [""] resources: ["namespaces/finalizers"] # finalizers are needed for the owner reference of the webhook verbs: ["update"] + - apiGroups: ["discovery.k8s.io"] + resources: ["endpointslices"] + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] - apiGroups: ["apps"] resources: ["deployments", "deployments/finalizers"] # finalizers are needed for the owner reference of the webhook verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] @@ -6770,6 +6944,9 @@ rules: resources: ["clusterroles"] verbs: ["delete"] resourceNames: ["knative-serving-certmanager"] + - apiGroups: ["*"] + resources: ["*/scale"] + verbs: ["patch"] --- # Copyright 2019 The Knative Authors # @@ -6790,7 +6967,7 @@ apiVersion: rbac.authorization.k8s.io/v1 metadata: name: knative-serving-podspecable-binding labels: - app.kubernetes.io/version: "1.15.0" + app.kubernetes.io/version: "1.22.1" app.kubernetes.io/name: knative-serving # Labeled to facilitate aggregated cluster roles that act on PodSpecables. duck.knative.dev/podspecable: "true" @@ -6828,7 +7005,7 @@ metadata: labels: app.kubernetes.io/component: controller app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.15.0" + app.kubernetes.io/version: "1.22.1" --- kind: ClusterRole apiVersion: rbac.authorization.k8s.io/v1 @@ -6836,7 +7013,7 @@ metadata: name: knative-serving-admin labels: app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.15.0" + app.kubernetes.io/version: "1.22.1" aggregationRule: clusterRoleSelectors: - matchLabels: @@ -6849,7 +7026,7 @@ metadata: labels: app.kubernetes.io/component: controller app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.15.0" + app.kubernetes.io/version: "1.22.1" subjects: - kind: ServiceAccount name: controller @@ -6866,7 +7043,7 @@ metadata: labels: app.kubernetes.io/component: controller app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.15.0" + app.kubernetes.io/version: "1.22.1" subjects: - kind: ServiceAccount name: controller @@ -6884,7 +7061,7 @@ metadata: labels: app.kubernetes.io/component: activator app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.15.0" + app.kubernetes.io/version: "1.22.1" --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding @@ -6894,7 +7071,7 @@ metadata: labels: app.kubernetes.io/component: activator app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.15.0" + app.kubernetes.io/version: "1.22.1" subjects: - kind: ServiceAccount name: activator @@ -6911,7 +7088,7 @@ metadata: labels: app.kubernetes.io/component: activator app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.15.0" + app.kubernetes.io/version: "1.22.1" subjects: - kind: ServiceAccount name: activator @@ -6958,11 +7135,11 @@ metadata: labels: app.kubernetes.io/component: queue-proxy app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.15.0" + app.kubernetes.io/version: "1.22.1" spec: # This is the Go import path for the binary that is containerized # and substituted here. - image: gcr.io/knative-releases/knative.dev/serving/cmd/queue@sha256:d313c823f25a09326a7c3c2ec9833c5e005791bc3acb4036ebf33735cbb62bee + image: gcr.io/knative-releases/knative.dev/serving/cmd/queue@sha256:b1af8bda6c1d32b1cf5fbf8f1f6068c5007a5cebf091039fdea83b88b1fd87f4 --- # Copyright 2018 The Knative Authors # @@ -6986,9 +7163,9 @@ metadata: labels: app.kubernetes.io/component: autoscaler app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.15.0" + app.kubernetes.io/version: "1.22.1" annotations: - knative.dev/example-checksum: "47c2487f" + knative.dev/example-checksum: "c727b3e8" data: _example: | ################################ @@ -7138,7 +7315,7 @@ data: # The `unit` is one concurrent request proxied by the activator. # activator-capacity must be at least 1. # This value is used for computation of the Activator subset size. - # See the algorithm here: http://bit.ly/38XiCZ3. + # See the algorithm here: https://bit.ly/38XiCZ3. # TODO(vagababov): tune after actual benchmarking. activator-capacity: "100.0" @@ -7196,7 +7373,7 @@ metadata: labels: app.kubernetes.io/name: knative-serving app.kubernetes.io/component: controller - app.kubernetes.io/version: "1.15.0" + app.kubernetes.io/version: "1.22.1" networking.knative.dev/certificate-provider: cert-manager annotations: knative.dev/example-checksum: "b7a9a602" @@ -7265,7 +7442,7 @@ metadata: labels: app.kubernetes.io/name: knative-serving app.kubernetes.io/component: controller - app.kubernetes.io/version: "1.15.0" + app.kubernetes.io/version: "1.22.1" annotations: knative.dev/example-checksum: "5b64ff5c" data: @@ -7419,13 +7596,13 @@ metadata: labels: app.kubernetes.io/name: knative-serving app.kubernetes.io/component: controller - app.kubernetes.io/version: "1.15.0" + app.kubernetes.io/version: "1.22.1" annotations: - knative.dev/example-checksum: "720ddb97" + knative.dev/example-checksum: "555b4826" data: # This is the Go import path for the binary that is containerized # and substituted here. - queue-sidecar-image: gcr.io/knative-releases/knative.dev/serving/cmd/queue@sha256:d313c823f25a09326a7c3c2ec9833c5e005791bc3acb4036ebf33735cbb62bee + queue-sidecar-image: gcr.io/knative-releases/knative.dev/serving/cmd/queue@sha256:b1af8bda6c1d32b1cf5fbf8f1f6068c5007a5cebf091039fdea83b88b1fd87f4 _example: |- ################################ # # @@ -7491,6 +7668,25 @@ data: # If omitted, or empty, no rootCA is added to the golang rootCAs queue-sidecar-rootca: "" + # Sets the minimum TLS version for the queue proxy sidecar's TLS server. + # Accepted values: "1.2", "1.3". Default is "1.3" if not specified. + queue-sidecar-tls-min-version: "" + + # Sets the maximum TLS version for the queue proxy sidecar's TLS server. + # Accepted values: "1.2", "1.3". If omitted, the Go default is used. + queue-sidecar-tls-max-version: "" + + # Sets the cipher suites for the queue proxy sidecar's TLS server. + # Comma-separated list of cipher suite names (e.g. "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"). + # If omitted, the Go default cipher suites are used. + # Note: cipher suites are not configurable in TLS 1.3. + queue-sidecar-tls-cipher-suites: "" + + # Sets the elliptic curve preferences for the queue proxy sidecar's TLS server. + # Comma-separated list of curve names (e.g. "X25519,CurveP256"). + # If omitted, the Go default curves are used. + queue-sidecar-tls-curve-preferences: "" + # If set, it automatically configures pod anti-affinity requirements for all Knative services. # It employs the `preferredDuringSchedulingIgnoredDuringExecution` weighted pod affinity term, # aligning with the Knative revision label. It yields the configuration below in all workloads' deployments: @@ -7522,6 +7718,15 @@ data: # selector: # use-gvisor: "please" runtime-class-name: "" + + # pod-is-always-schedulable can be used to define that Pods in the system will always be + # scheduled, and a Revision should not be marked unschedulable. + # Setting this to `true` makes sense if you have cluster-autoscaling set up for your cluster + # where unschedulable Pods trigger the addition of a new Node and are therefore a short and + # transient state. + # + # See https://github.com/knative/serving/issues/14862 + pod-is-always-schedulable: "false" --- # Copyright 2018 The Knative Authors # @@ -7545,7 +7750,7 @@ metadata: labels: app.kubernetes.io/name: knative-serving app.kubernetes.io/component: controller - app.kubernetes.io/version: "1.15.0" + app.kubernetes.io/version: "1.22.1" annotations: knative.dev/example-checksum: "26c09de5" data: @@ -7609,9 +7814,9 @@ metadata: labels: app.kubernetes.io/name: knative-serving app.kubernetes.io/component: controller - app.kubernetes.io/version: "1.15.0" + app.kubernetes.io/version: "1.22.1" annotations: - knative.dev/example-checksum: "632d47dd" + knative.dev/example-checksum: "bee75b26" data: _example: |- ################################ @@ -7632,8 +7837,11 @@ data: # Default SecurityContext settings to secure-by-default values # if unset. # - # This value will default to "enabled" in a future release, - # probably Knative 1.10 + # Disabled - do nothing; no security options are applied + # AllowRootBounded - Applies secure defaults without enforcing strict policies; sets seccompProfile + # to RuntimeDefault and drops all capabilities + # Enabled - Enforces security defaults; sets seccompProfile to RuntimeDefault, drops all capabilities, + # and sets runAsNonRoot to true if not already specified. secure-pod-defaults: "disabled" # Indicates whether multi container support is enabled @@ -7727,6 +7935,24 @@ data: # See: https://knative.dev/docs/serving/configuration/feature-flags/#kubernetes-share-process-namespace kubernetes.podspec-shareprocessnamespace: "disabled" + # Indicates whether hostIPC support is enabled + # + # WARNING: Cannot safely be disabled once enabled. + # See https://knative.dev/docs/serving/configuration/feature-flags/#kubernetes-host-ipc + kubernetes.podspec-hostipc: "disabled" + + # Indicates whether hostPID support is enabled + # + # WARNING: Cannot safely be disabled once enabled. + # See https://knative.dev/docs/serving/configuration/feature-flags/#kubernetes-host-pid + kubernetes.podspec-hostpid: "disabled" + + # Indicates whether hostNetwork support is enabled + # + # WARNING: Cannot safely be disabled once enabled. + # See See https://knative.dev/docs/serving/configuration/feature-flags/#kubernetes-host-network + kubernetes.podspec-hostnetwork: "disabled" + # Indicates whether Kubernetes PriorityClassName support is enabled # # WARNING: Cannot safely be disabled once enabled. @@ -7745,15 +7971,6 @@ data: # For a list of possible capabilities, see https://man7.org/linux/man-pages/man7/capabilities.7.html kubernetes.containerspec-addcapabilities: "disabled" - # This feature validates PodSpecs from the validating webhook - # against the K8s API Server. - # - # When "enabled", the server will always run the extra validation. - # When "allowed", the server will not run the dry-run validation by default. - # However, clients may enable the behavior on an individual Service by - # attaching the following metadata annotation: "features.knative.dev/podspec-dryrun":"enabled". - # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-dry-run - kubernetes.podspec-dryrun: "allowed" # Controls whether tag header based routing feature are enabled or not. # 1. Enabled: enabling tag header based routing @@ -7771,6 +7988,24 @@ data: # 2. Disabled: disabling EmptyDir volume support kubernetes.podspec-volumes-emptydir: "enabled" + # Controls whether volume support for image is enabled or not. + # 1. Enabled: enabling image volume support + # 2. Disabled: disabling image volume support + kubernetes.podspec-volumes-image: "disabled" + + # Controls whether volume support for HostPath is enabled or not. + # WARNING: Cannot safely be disabled once enabled. + # WARNING: If you can avoid using a hostPath volume, you should. + # Please read https://kubernetes.io/docs/concepts/storage/volumes/#hostpath before enabling this feature. + # 1. Enabled: enabling HostPath volume support + # 2. Disabled: disabling HostPath volume support + kubernetes.podspec-volumes-hostpath: "disabled" + + # Controls whether volume support for CSI is enabled or not. + # 1. Enabled: enabling CSI volume support + # 2. Disabled: disabling CSI volume support + kubernetes.podspec-volumes-csi: "disabled" + # Controls whether init containers support is enabled or not. # 1. Enabled: enabling init containers support # 2. Disabled: disabling init containers support @@ -7786,13 +8021,18 @@ data: # 2. Disabled: disabling write access for persistent volumes kubernetes.podspec-persistent-volume-write: "disabled" + # Controls whether volume mount propagation support is enabled or not. + # 1. Enabled: enabling volume mount propagation support + # 2. Disabled: disabling volume mount propagation support + kubernetes.podspec-volumes-mount-propagation: "disabled" + # Controls if the queue proxy podInfo feature is enabled, allowed or disabled # # This feature should be enabled/allowed when using queue proxy Options (Extensions) # Enabling will mount a podInfo volume to the queue proxy container. # The volume will contains an 'annotations' file (from the pod's annotation field). # The annotations in this file include the Service annotations set by the client creating the service. - # If mounted, the annotations can be accessed by queue proxy extensions at /etc/podinfo/annnotations + # If mounted, the annotations can be accessed by queue proxy extensions at /etc/podinfo/annotations # # 1. "enabled": always mount a podInfo volume # 2. "disabled": never mount a podInfo volume @@ -7828,7 +8068,7 @@ metadata: labels: app.kubernetes.io/name: knative-serving app.kubernetes.io/component: controller - app.kubernetes.io/version: "1.15.0" + app.kubernetes.io/version: "1.22.1" annotations: knative.dev/example-checksum: "aa3813a8" data: @@ -7927,7 +8167,7 @@ metadata: labels: app.kubernetes.io/name: knative-serving app.kubernetes.io/component: controller - app.kubernetes.io/version: "1.15.0" + app.kubernetes.io/version: "1.22.1" annotations: knative.dev/example-checksum: "f4b71f57" data: @@ -7986,7 +8226,7 @@ metadata: name: config-logging namespace: knative-serving labels: - app.kubernetes.io/version: "1.15.0" + app.kubernetes.io/version: "1.22.1" app.kubernetes.io/component: logging app.kubernetes.io/name: knative-serving annotations: @@ -8068,7 +8308,7 @@ metadata: labels: app.kubernetes.io/name: knative-serving app.kubernetes.io/component: networking - app.kubernetes.io/version: "1.15.0" + app.kubernetes.io/version: "1.22.1" annotations: knative.dev/example-checksum: "0573e07d" data: @@ -8272,9 +8512,9 @@ metadata: labels: app.kubernetes.io/name: knative-serving app.kubernetes.io/component: observability - app.kubernetes.io/version: "1.15.0" + app.kubernetes.io/version: "1.22.1" annotations: - knative.dev/example-checksum: "54abd711" + knative.dev/example-checksum: "59abacb5" data: _example: | ################################ @@ -8332,42 +8572,70 @@ data: # PodIP string // IP of the pod hosting the revision # } # - logging.request-log-template: '{"httpRequest": {"requestMethod": "{{.Request.Method}}", "requestUrl": "{{js .Request.RequestURI}}", "requestSize": "{{.Request.ContentLength}}", "status": {{.Response.Code}}, "responseSize": "{{.Response.Size}}", "userAgent": "{{js .Request.UserAgent}}", "remoteIp": "{{js .Request.RemoteAddr}}", "serverIp": "{{.Revision.PodIP}}", "referer": "{{js .Request.Referer}}", "latency": "{{.Response.Latency}}s", "protocol": "{{.Request.Proto}}"}, "traceId": "{{index .Request.Header "X-B3-Traceid"}}"}' + logging.request-log-template: '{"httpRequest": {"requestMethod": "{{.Request.Method}}", "requestUrl": "{{js .Request.RequestURI}}", "requestSize": "{{.Request.ContentLength}}", "status": {{.Response.Code}}, "responseSize": "{{.Response.Size}}", "userAgent": "{{js .Request.UserAgent}}", "remoteIp": "{{js .Request.RemoteAddr}}", "serverIp": "{{.Revision.PodIP}}", "referer": "{{js .Request.Referer}}", "latency": "{{.Response.Latency}}s", "protocol": "{{.Request.Proto}}"}, "traceId": "{{.TraceID}}"}' # If true, the request logging will be enabled. - # NB: up to and including Knative version 0.18 if logging.request-log-template is non-empty, this value - # will be ignored. logging.enable-request-log: "false" # If true, this enables queue proxy writing request logs for probe requests to stdout. # It uses the same template for user requests, i.e. logging.request-log-template. logging.enable-probe-request-log: "false" - # metrics.backend-destination field specifies the system metrics destination. - # It supports either prometheus (the default) or opencensus. - metrics.backend-destination: prometheus + # metrics-protocol field specifies the protocol used when exporting metrics + # It supports either 'none' (the default), 'prometheus', 'http/protobuf' (OTLP HTTP), 'grpc' (OTLP gRPC) + metrics-protocol: http/protobuf + + # metrics-endpoint field specifies the destination metrics should be exporter to. + # + # The endpoint MUST be set when the protocol is http/protobuf or grpc. + # The endpoint MUST NOT be set when the protocol is none. + # + # When the protocol is prometheus the endpoint can accept a 'host:port' string to customize the + # listening host interface and port. + metrics-endpoint: http://example.com/v1/traces + + # metrics-export-interval specifies the global metrics reporting period for control and data plane components. + # If a zero or negative value is passed the default reporting OTel period is used (60 secs). + metrics-export-interval: 60s - # metrics.reporting-period-seconds specifies the global metrics reporting period for control and data plane components. - # If a zero or negative value is passed the default reporting period is used (10 secs). - # If the attribute is not specified a default value is used per metrics backend. - # For the prometheus backend the default reporting period is 5s while for opencensus it is 60s. - metrics.reporting-period-seconds: "5" + # request-metrics-protocol field specifies the protocol used when exporting queue-proxy metrics + # It supports either 'none' (the default), 'prometheus', 'http/protobuf' (OTLP HTTP), 'grpc' (OTLP gRPC) + request-metrics-protocol: http/protobuf - # metrics.request-metrics-backend-destination specifies the request metrics - # destination. It enables queue proxy to send request metrics. - # Currently supported values: prometheus (the default), opencensus. - metrics.request-metrics-backend-destination: prometheus + # request-metrics-endpoint field specifies the destination metrics from the queue proxy should be exporter to. + # + # The endpoint MUST be set when the protocol is http/protobuf or grpc. + # The endpoint MUST NOT be set when the protocol is none. + # + # When the protocol is prometheus the endpoint can accept a 'host:port' string to customize the + # listening host interface and port. + request-metrics-endpoint: http://promstack-kube-prometheus-prometheus.observability:9090/api/v1/otlp/v1/metrics - # metrics.request-metrics-reporting-period-seconds specifies the request metrics reporting period in sec at queue proxy. - # If a zero or negative value is passed the default reporting period is used (10 secs). - # If the attribute is not specified, it is overridden by the value of metrics.reporting-period-seconds. - metrics.request-metrics-reporting-period-seconds: "5" + # request-metrics-export-interval specifies the global metrics reporting period for the queue-proxy. + # + # If a zero or negative value is passed the default reporting OTel period is used (60 secs). + request-metrics-export-interval: 60s - # profiling.enable indicates whether it is allowed to retrieve runtime profiling data from + # runtime-profiling indicates whether it is allowed to retrieve runtime profiling data from # the pods via an HTTP server in the format expected by the pprof visualization tool. When # enabled, the Knative Serving pods expose the profiling data on an alternate HTTP port 8008. # The HTTP context root for profiling is then /debug/pprof/. - profiling.enable: "false" + runtime-profiling: enabled + + # tracing-protocol field specifies the protocol used when exporting traces + # It supports either 'none' (the default), 'http/protobuf' (OTLP HTTP), 'grpc' (OTLP gRPC) + # or `stdout` for debugging purposes + tracing-protocol: http/protobuf + + # tracing-endpoint field specifies the destination traces should be exporter to. + # + # The endpoint MUST be set when the protocol is http/protobuf or grpc. + # The endpoint MUST NOT be set when the protocol is none. + tracing-endpoint: http://jaeger-collector.observability:4318/v1/traces + + # tracing-sampling-rate allows the user to specify what percentage of all traces should be exported + # The value should be between 0 (never sample) to 1 (always sample) + tracing-sampling-rate: "1" --- # Copyright 2019 The Knative Authors # @@ -8391,39 +8659,16 @@ metadata: labels: app.kubernetes.io/name: knative-serving app.kubernetes.io/component: tracing - app.kubernetes.io/version: "1.15.0" + app.kubernetes.io/version: "1.22.1" annotations: - knative.dev/example-checksum: "26614636" + knative.dev/example-checksum: "04c7e9a3" data: _example: | - ################################ - # # - # EXAMPLE CONFIGURATION # - # # - ################################ - - # This block is not actually functional configuration, - # but serves to illustrate the available configuration - # options and document them in a way that is accessible - # to users that `kubectl edit` this config map. - # - # These sample configuration options may be copied out of - # this example block and unindented to be in the data block - # to actually change the configuration. - # - # This may be "zipkin" or "none" (default) - backend: "none" - - # URL to zipkin collector where traces are sent. - # This must be specified when backend is "zipkin" - zipkin-endpoint: "http://zipkin.istio-system.svc.cluster.local:9411/api/v2/spans" - - # Enable zipkin debug mode. This allows all spans to be sent to the server - # bypassing sampling. - debug: "false" - - # Percentage (0-1) of requests to trace - sample-rate: "0.1" + ########################################################### + # # + # This config is deprecated - use config-observability # + # # + ########################################################### --- # Copyright 2020 The Knative Authors # @@ -8447,7 +8692,7 @@ metadata: labels: app.kubernetes.io/component: activator app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.15.0" + app.kubernetes.io/version: "1.22.1" spec: minReplicas: 1 maxReplicas: 20 @@ -8475,7 +8720,7 @@ metadata: labels: app.kubernetes.io/component: activator app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.15.0" + app.kubernetes.io/version: "1.22.1" spec: minAvailable: 80% selector: @@ -8503,7 +8748,7 @@ metadata: namespace: knative-serving labels: app.kubernetes.io/component: activator - app.kubernetes.io/version: "1.15.0" + app.kubernetes.io/version: "1.22.1" app.kubernetes.io/name: knative-serving spec: selector: @@ -8517,7 +8762,7 @@ spec: role: activator app.kubernetes.io/component: activator app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.15.0" + app.kubernetes.io/version: "1.22.1" spec: # To avoid node becoming SPOF, spread our replicas to different nodes. affinity: @@ -8534,7 +8779,7 @@ spec: - name: activator # This is the Go import path for the binary that is containerized # and substituted here. - image: gcr.io/knative-releases/knative.dev/serving/cmd/activator@sha256:b6d7d96edd8942d679757249f6aa07373461411104ce7c93309f23fba2884f8f + image: gcr.io/knative-releases/knative.dev/serving/cmd/activator@sha256:5deaef961fef8d1417f6d4a4dfae2fc338f2d30d72c4ad58c3ab392b2c04705b # The numbers are based on performance test results from # https://github.com/knative/serving/issues/1625#issuecomment-511930023 resources: @@ -8564,9 +8809,6 @@ spec: value: config-logging - name: CONFIG_OBSERVABILITY_NAME value: config-observability - # TODO(https://github.com/knative/pkg/pull/953): Remove stackdriver specific config - - name: METRICS_DOMAIN - value: knative.dev/internal/serving securityContext: allowPrivilegeEscalation: false readOnlyRootFilesystem: true @@ -8613,7 +8855,7 @@ metadata: labels: app: activator app.kubernetes.io/component: activator - app.kubernetes.io/version: "1.15.0" + app.kubernetes.io/version: "1.22.1" app.kubernetes.io/name: knative-serving spec: selector: @@ -8659,7 +8901,7 @@ metadata: labels: app.kubernetes.io/component: autoscaler app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.15.0" + app.kubernetes.io/version: "1.22.1" spec: replicas: 1 selector: @@ -8675,7 +8917,7 @@ spec: app: autoscaler app.kubernetes.io/component: autoscaler app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.15.0" + app.kubernetes.io/version: "1.22.1" spec: # To avoid node becoming SPOF, spread our replicas to different nodes. affinity: @@ -8692,7 +8934,7 @@ spec: - name: autoscaler # This is the Go import path for the binary that is containerized # and substituted here. - image: gcr.io/knative-releases/knative.dev/serving/cmd/autoscaler@sha256:119157d871eb3db5a54944464d9920ad378d35292d4c12fd4a765cd016e24f0f + image: gcr.io/knative-releases/knative.dev/serving/cmd/autoscaler@sha256:5bae38655d87df86b041083fbe51791816473245f752432ba9b85a7b12f73cd5 resources: requests: cpu: 100m @@ -8717,9 +8959,6 @@ spec: value: config-logging - name: CONFIG_OBSERVABILITY_NAME value: config-observability - # TODO(https://github.com/knative/pkg/pull/953): Remove stackdriver specific config - - name: METRICS_DOMAIN - value: knative.dev/serving securityContext: allowPrivilegeEscalation: false readOnlyRootFilesystem: true @@ -8751,7 +8990,7 @@ metadata: app: autoscaler app.kubernetes.io/component: autoscaler app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.15.0" + app.kubernetes.io/version: "1.22.1" name: autoscaler namespace: knative-serving spec: @@ -8791,7 +9030,7 @@ metadata: labels: app.kubernetes.io/component: controller app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.15.0" + app.kubernetes.io/version: "1.22.1" spec: selector: matchLabels: @@ -8802,7 +9041,7 @@ spec: app: controller app.kubernetes.io/component: controller app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.15.0" + app.kubernetes.io/version: "1.22.1" spec: # To avoid node becoming SPOF, spread our replicas to different nodes. affinity: @@ -8819,7 +9058,7 @@ spec: - name: controller # This is the Go import path for the binary that is containerized # and substituted here. - image: gcr.io/knative-releases/knative.dev/serving/cmd/controller@sha256:80b9865a585900af6cecead24babe03aa79487e9e6306da1444b04148c21c96f + image: gcr.io/knative-releases/knative.dev/serving/cmd/controller@sha256:94329d85200c2fc31ed1166a26568ca1357376c149c147e71f400cf28be3c816 resources: requests: cpu: 100m @@ -8840,9 +9079,6 @@ spec: value: config-logging - name: CONFIG_OBSERVABILITY_NAME value: config-observability - # TODO(https://github.com/knative/pkg/pull/953): Remove stackdriver specific config - - name: METRICS_DOMAIN - value: knative.dev/internal/serving securityContext: allowPrivilegeEscalation: false readOnlyRootFilesystem: true @@ -8881,7 +9117,7 @@ metadata: app: controller app.kubernetes.io/component: controller app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.15.0" + app.kubernetes.io/version: "1.22.1" name: controller namespace: knative-serving spec: @@ -8918,7 +9154,7 @@ metadata: labels: app.kubernetes.io/component: webhook app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.15.0" + app.kubernetes.io/version: "1.22.1" spec: minReplicas: 1 maxReplicas: 5 @@ -8944,7 +9180,7 @@ metadata: labels: app.kubernetes.io/component: webhook app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.15.0" + app.kubernetes.io/version: "1.22.1" spec: minAvailable: 80% selector: @@ -8972,7 +9208,7 @@ metadata: namespace: knative-serving labels: app.kubernetes.io/component: webhook - app.kubernetes.io/version: "1.15.0" + app.kubernetes.io/version: "1.22.1" app.kubernetes.io/name: knative-serving spec: selector: @@ -8985,7 +9221,7 @@ spec: app: webhook role: webhook app.kubernetes.io/component: webhook - app.kubernetes.io/version: "1.15.0" + app.kubernetes.io/version: "1.22.1" app.kubernetes.io/name: knative-serving spec: # To avoid node becoming SPOF, spread our replicas to different nodes. @@ -9003,7 +9239,7 @@ spec: - name: webhook # This is the Go import path for the binary that is containerized # and substituted here. - image: gcr.io/knative-releases/knative.dev/serving/cmd/webhook@sha256:732d9cdf7f5fa5c6055d26b1aa5aad40e3d74ba9f2cb76a1db0f0e4d072b7cd0 + image: gcr.io/knative-releases/knative.dev/serving/cmd/webhook@sha256:8470456be214e93a84e3c7b79a632aa9978bd8ecda553feaa47878a2c24ab84d resources: requests: cpu: 100m @@ -9028,9 +9264,6 @@ spec: value: webhook - name: WEBHOOK_PORT value: "8443" - # TODO(https://github.com/knative/pkg/pull/953): Remove stackdriver specific config - - name: METRICS_DOMAIN - value: knative.dev/internal/serving securityContext: allowPrivilegeEscalation: false readOnlyRootFilesystem: true @@ -9070,7 +9303,7 @@ metadata: app: webhook role: webhook app.kubernetes.io/component: webhook - app.kubernetes.io/version: "1.15.0" + app.kubernetes.io/version: "1.22.1" app.kubernetes.io/name: knative-serving name: webhook namespace: knative-serving @@ -9111,7 +9344,7 @@ metadata: labels: app.kubernetes.io/component: webhook app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.15.0" + app.kubernetes.io/version: "1.22.1" webhooks: - admissionReviewVersions: ["v1", "v1beta1"] clientConfig: @@ -9152,7 +9385,7 @@ metadata: labels: app.kubernetes.io/component: webhook app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.15.0" + app.kubernetes.io/version: "1.22.1" webhooks: - admissionReviewVersions: ["v1", "v1beta1"] clientConfig: @@ -9208,7 +9441,7 @@ metadata: labels: app.kubernetes.io/component: webhook app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.15.0" + app.kubernetes.io/version: "1.22.1" webhooks: - admissionReviewVersions: ["v1", "v1beta1"] clientConfig: @@ -9266,10 +9499,10 @@ metadata: labels: app.kubernetes.io/component: webhook app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.15.0" + app.kubernetes.io/version: "1.22.1" # The data is populated at install time. --- -# Source: https://github.com/knative/net-kourier/releases/download/knative-v1.15.0/kourier.yaml +# Source: https://github.com/knative-extensions/net-kourier/releases/download/knative-v1.22.1/kourier.yaml --- # Copyright 2020 The Knative Authors # @@ -9293,7 +9526,7 @@ metadata: networking.knative.dev/ingress-provider: kourier app.kubernetes.io/name: knative-serving app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.15.0" + app.kubernetes.io/version: "1.22.1" --- # Copyright 2020 The Knative Authors # @@ -9317,7 +9550,7 @@ metadata: labels: networking.knative.dev/ingress-provider: kourier app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.15.0" + app.kubernetes.io/version: "1.22.1" app.kubernetes.io/name: knative-serving data: envoy-bootstrap.yaml: | @@ -9445,7 +9678,7 @@ metadata: labels: networking.knative.dev/ingress-provider: kourier app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.15.0" + app.kubernetes.io/version: "1.22.1" app.kubernetes.io/name: knative-serving data: _example: | @@ -9469,6 +9702,11 @@ data: # probes etc. must be configured via the bootstrap config. enable-service-access-logging: "true" + # Specifies the format of the access log used by the Kourier gateway. + # This template follows the envoy format. + # see: https://www.envoyproxy.io/docs/envoy/latest/configuration/observability/access_log/usage#access-logging + service-access-log-template: "" + # Specifies whether to use proxy-protocol in order to safely # transport connection information such as a client's address # across multiple layers of TCP proxies. @@ -9497,10 +9735,76 @@ data: # right side of the x-forwarded-for HTTP header to trust. trusted-hops-count: "0" + # Configures the connection manager to use the real remote address + # of the client connection when determining internal versus external origin and manipulating various headers. + use-remote-address: "false" + # Specifies the cipher suites for TLS external listener. # Use ',' separated values like "ECDHE-ECDSA-AES128-GCM-SHA256,ECDHE-ECDSA-CHACHA20-POLY1305" # The default uses the default cipher suites of the envoy version. cipher-suites: "" + + # Disable the Envoy server header injection in the response when response has no such header. + disable-envoy-server-header: "false" + + # The external authorization service and port, my-auth:2222. + # This value overrides environment variable if defined. + extauthz-host: "" + + # The protocol used to query the ext auth service. Can be one of : grpc, http, https. Defaults to grpc + # This value overrides environment variable if defined. + extauthz-protocol: "grpc" + + # Allow traffic to go through if the ext auth service is down. Accepts true/false. + # This value overrides environment variable if defined. + extauthz-failure-mode-allow: "" + + # Max request bytes, if not set, defaults to 8192 Bytes. More info Envoy Docs + # see: https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/http/ext_authz/v3/ext_authz.proto.html#extensions-filters-http-ext-authz-v3-buffersettings + # This value overrides environment variable if defined. + extauthz-max-request-body-bytes: 8192 + + # Max time in ms to wait for the ext authz service. Defaults to 2000 ms + # This value overrides environment variable if defined. + extauthz-timeout: 2000 + + # If extauthz-protocol is equal to http or https, path to query the ext auth service. + # Example : if set to /verify, it will query /verify/ (notice the trailing /). If not set, it will query / + # This value overrides environment variable if defined. + extauthz-path-prefix: "" + + # If extauthz-protocol is equal to grpc, sends the body as raw bytes instead of a UTF-8 string. + # Accepts only true/false, t/f or 1/0. Attempting to set another value will throw an error. + # Defaults to false. More info Envoy Docs. + # see: https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/http/ext_authz/v3/ext_authz.proto.html#extensions-filters-http-ext-authz-v3-buffersettings + # This value overrides environment variable if defined. + extauthz-pack-as-byte: "false" + + # Specifies the secret that contains the TLS certificate and key pair when using HTTPS communication with Kourier Ingress. + # This value overrides environment variable if defined. + certs-secret-name: "" + certs-secret-namespace: "" + + # Specifies the OTLP collector endpoint for distributed tracing. + # The endpoint format depends on the protocol (see tracing-protocol). + # Examples: + # - For HTTP: "http://otel-collector.observability.svc:4318/v1/traces" + # - For gRPC: "http://otel-collector.observability.svc:4317" + # Use an empty value to disable distributed tracing (default). + tracing-endpoint: "" + + # Protocol for tracing collector communication. + # Valid values: http/protobuf, grpc + tracing-protocol: "grpc" + + # Tracing sampling rate (0.0 to 1.0) + # Controls the percentage of requests that are traced. + # Example: "1.0" traces 100% of requests. + tracing-sampling-rate: "1.0" + + # Service name for traces + # This identifies the Kourier gateway in your tracing system. + tracing-service-name: "kourier-knative" --- # Copyright 2020 The Knative Authors # @@ -9524,7 +9828,7 @@ metadata: labels: networking.knative.dev/ingress-provider: kourier app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.15.0" + app.kubernetes.io/version: "1.22.1" app.kubernetes.io/name: knative-serving --- apiVersion: rbac.authorization.k8s.io/v1 @@ -9534,18 +9838,21 @@ metadata: labels: networking.knative.dev/ingress-provider: kourier app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.15.0" + app.kubernetes.io/version: "1.22.1" app.kubernetes.io/name: knative-serving rules: - apiGroups: [""] resources: ["events"] verbs: ["create", "update", "patch"] - apiGroups: [""] - resources: ["pods", "endpoints", "services", "secrets"] + resources: ["pods", "services", "secrets"] verbs: ["get", "list", "watch"] - apiGroups: [""] resources: ["configmaps"] verbs: ["get", "list", "watch"] + - apiGroups: ["discovery.k8s.io"] + resources: ["endpointslices"] + verbs: ["get", "list", "watch"] - apiGroups: ["coordination.k8s.io"] resources: ["leases"] verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] @@ -9563,7 +9870,7 @@ metadata: labels: networking.knative.dev/ingress-provider: kourier app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.15.0" + app.kubernetes.io/version: "1.22.1" app.kubernetes.io/name: knative-serving roleRef: apiGroup: rbac.authorization.k8s.io @@ -9596,7 +9903,7 @@ metadata: labels: networking.knative.dev/ingress-provider: kourier app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.15.0" + app.kubernetes.io/version: "1.22.1" app.kubernetes.io/name: knative-serving spec: strategy: @@ -9618,9 +9925,11 @@ spec: app: net-kourier-controller spec: containers: - - image: gcr.io/knative-releases/knative.dev/net-kourier/cmd/kourier@sha256:c9016f34165c5118373c75dcc373d1cd802fe37ffa9e1bce65960942a59bc5f1 + - image: gcr.io/knative-releases/knative.dev/net-kourier/cmd/kourier@sha256:01abd2070ccf8680885c47990e42c05c09e30bc8595d9246f4dcd37f2220a2a2 name: controller env: + # CERTS_SECRET_NAMESPACE and CERTS_SECRET_NAME can also be configured from a ConfigMap. + # Settings configured in a configmap take precedence over environment variable settings. - name: CERTS_SECRET_NAMESPACE value: "" - name: CERTS_SECRET_NAME @@ -9686,7 +9995,7 @@ metadata: labels: networking.knative.dev/ingress-provider: kourier app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.15.0" + app.kubernetes.io/version: "1.22.1" app.kubernetes.io/name: knative-serving spec: ports: @@ -9724,7 +10033,7 @@ metadata: labels: networking.knative.dev/ingress-provider: kourier app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.15.0" + app.kubernetes.io/version: "1.22.1" app.kubernetes.io/name: knative-serving spec: strategy: @@ -9759,7 +10068,7 @@ spec: env: - name: DRAIN_TIME_SECONDS value: "15" - image: docker.io/envoyproxy/envoy:v1.26-latest + image: docker.io/envoyproxy/envoy:v1.37-latest name: kourier-gateway ports: - name: http2-external @@ -9809,6 +10118,7 @@ spec: initialDelaySeconds: 10 periodSeconds: 5 failureThreshold: 3 + timeoutSeconds: 3 livenessProbe: httpGet: httpHeaders: @@ -9820,6 +10130,7 @@ spec: initialDelaySeconds: 10 periodSeconds: 5 failureThreshold: 6 + timeoutSeconds: 3 resources: requests: cpu: 200m @@ -9843,7 +10154,7 @@ metadata: labels: networking.knative.dev/ingress-provider: kourier app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.15.0" + app.kubernetes.io/version: "1.22.1" app.kubernetes.io/name: knative-serving spec: ports: @@ -9867,7 +10178,7 @@ metadata: labels: networking.knative.dev/ingress-provider: kourier app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.15.0" + app.kubernetes.io/version: "1.22.1" app.kubernetes.io/name: knative-serving spec: ports: @@ -9891,7 +10202,7 @@ metadata: labels: networking.knative.dev/ingress-provider: kourier app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.15.0" + app.kubernetes.io/version: "1.22.1" app.kubernetes.io/name: knative-serving spec: minReplicas: 1 @@ -9917,7 +10228,7 @@ metadata: labels: networking.knative.dev/ingress-provider: kourier app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.15.0" + app.kubernetes.io/version: "1.22.1" app.kubernetes.io/name: knative-serving spec: minAvailable: 80% diff --git a/packages/manifests/operators/knative-serving/v1.22.1.yaml b/packages/manifests/operators/knative-serving/v1.22.1.yaml new file mode 100644 index 0000000..bbe9e23 --- /dev/null +++ b/packages/manifests/operators/knative-serving/v1.22.1.yaml @@ -0,0 +1,10237 @@ +# Source: https://github.com/knative/serving/releases/download/knative-v1.22.1/serving-crds.yaml +--- +# Copyright 2020 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: certificates.networking.internal.knative.dev + labels: + app.kubernetes.io/name: knative-serving + app.kubernetes.io/component: networking + app.kubernetes.io/version: "1.22.1" + knative.dev/crd-install: "true" +spec: + group: networking.internal.knative.dev + versions: + - name: v1alpha1 + served: true + storage: true + subresources: + status: {} + schema: + openAPIV3Schema: + description: |- + Certificate is responsible for provisioning a SSL certificate for the + given hosts. It is a Knative abstraction for various SSL certificate + provisioning solutions (such as cert-manager or self-signed SSL certificate). + type: object + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: |- + Spec is the desired state of the Certificate. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status + type: object + required: + - dnsNames + - secretName + properties: + dnsNames: + description: |- + DNSNames is a list of DNS names the Certificate could support. + The wildcard format of DNSNames (e.g. *.default.example.com) is supported. + type: array + items: + type: string + domain: + description: Domain is the top level domain of the values for DNSNames. + type: string + secretName: + description: SecretName is the name of the secret resource to store the SSL certificate in. + type: string + status: + description: |- + Status is the current state of the Certificate. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status + type: object + properties: + annotations: + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + additionalProperties: + type: string + conditions: + description: Conditions the latest available observations of a resource's current state. + type: array + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + type: object + required: + - status + - type + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating details about the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, False, Unknown. + type: string + type: + description: Type of condition. + type: string + http01Challenges: + description: |- + HTTP01Challenges is a list of HTTP01 challenges that need to be fulfilled + in order to get the TLS certificate.. + type: array + items: + description: |- + HTTP01Challenge defines the status of a HTTP01 challenge that a certificate needs + to fulfill. + type: object + properties: + serviceName: + description: ServiceName is the name of the service to serve HTTP01 challenge requests. + type: string + serviceNamespace: + description: ServiceNamespace is the namespace of the service to serve HTTP01 challenge requests. + type: string + servicePort: + description: ServicePort is the port of the service to serve HTTP01 challenge requests. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + url: + description: URL is the URL that the HTTP01 challenge is expected to serve on. + type: string + notAfter: + description: |- + The expiration time of the TLS certificate stored in the secret named + by this resource in spec.secretName. + type: string + format: date-time + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + type: integer + format: int64 + additionalPrinterColumns: + - name: Ready + type: string + jsonPath: ".status.conditions[?(@.type==\"Ready\")].status" + - name: Reason + type: string + jsonPath: ".status.conditions[?(@.type==\"Ready\")].reason" + names: + kind: Certificate + plural: certificates + singular: certificate + categories: + - knative-internal + - networking + shortNames: + - kcert + scope: Namespaced +--- +# Copyright 2019 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# Note: The schema part of the spec is auto-generated by hack/update-schemas.sh. + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: configurations.serving.knative.dev + labels: + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" + knative.dev/crd-install: "true" + duck.knative.dev/podspecable: "true" +spec: + group: serving.knative.dev + names: + kind: Configuration + plural: configurations + singular: configuration + categories: + - all + - knative + - serving + shortNames: + - config + - cfg + scope: Namespaced + versions: + - name: v1 + served: true + storage: true + subresources: + status: {} + additionalPrinterColumns: + - name: LatestCreated + type: string + jsonPath: .status.latestCreatedRevisionName + - name: LatestReady + type: string + jsonPath: .status.latestReadyRevisionName + - name: Ready + type: string + jsonPath: ".status.conditions[?(@.type=='Ready')].status" + - name: Reason + type: string + jsonPath: ".status.conditions[?(@.type=='Ready')].reason" + schema: + openAPIV3Schema: + description: |- + Configuration represents the "floating HEAD" of a linear history of Revisions. + Users create new Revisions by updating the Configuration's spec. + The "latest created" revision's name is available under status, as is the + "latest ready" revision's name. + See also: https://github.com/knative/serving/blob/main/docs/spec/overview.md#configuration + type: object + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: ConfigurationSpec holds the desired state of the Configuration (from the client). + type: object + properties: + template: + description: Template holds the latest specification for the Revision to be stamped out. + type: object + properties: + metadata: + type: object + properties: + annotations: + type: object + additionalProperties: + type: string + finalizers: + type: array + items: + type: string + labels: + type: object + additionalProperties: + type: string + name: + type: string + namespace: + type: string + x-kubernetes-preserve-unknown-fields: true + spec: + description: RevisionSpec holds the desired state of the Revision (from the client). + type: object + required: + - containers + properties: + affinity: + description: This is accessible behind a feature flag - kubernetes.podspec-affinity + type: object + x-kubernetes-preserve-unknown-fields: true + automountServiceAccountToken: + description: AutomountServiceAccountToken indicates whether a service account token should be automatically mounted. + type: boolean + containerConcurrency: + description: |- + ContainerConcurrency specifies the maximum allowed in-flight (concurrent) + requests per container of the Revision. Defaults to `0` which means + concurrency to the application is not limited, and the system decides the + target concurrency for the autoscaler. + type: integer + format: int64 + containers: + description: |- + List of containers belonging to the pod. + Containers cannot currently be added or removed. + There must be at least one container in a Pod. + Cannot be updated. + type: array + items: + description: A single application container that you want to run within a pod. + type: object + properties: + args: + description: |- + Arguments to the entrypoint. + The container image's CMD is used if this is not provided. + Variable references $(VAR_NAME) are expanded using the container's environment. If a variable + cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will + produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless + of whether the variable exists or not. Cannot be updated. + More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell + type: array + items: + type: string + x-kubernetes-list-type: atomic + command: + description: |- + Entrypoint array. Not executed within a shell. + The container image's ENTRYPOINT is used if this is not provided. + Variable references $(VAR_NAME) are expanded using the container's environment. If a variable + cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will + produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless + of whether the variable exists or not. Cannot be updated. + More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell + type: array + items: + type: string + x-kubernetes-list-type: atomic + env: + description: |- + List of environment variables to set in the container. + Cannot be updated. + type: array + items: + description: EnvVar represents an environment variable present in a Container. + type: object + required: + - name + properties: + name: + description: |- + Name of the environment variable. + May consist of any printable ASCII characters except '='. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's value. Cannot be used if value is not empty. + type: object + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + type: object + required: + - key + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap or its key must be defined + type: boolean + x-kubernetes-map-type: atomic + fieldRef: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-fieldref + type: object + x-kubernetes-map-type: atomic + x-kubernetes-preserve-unknown-fields: true + resourceFieldRef: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-fieldref + type: object + x-kubernetes-map-type: atomic + x-kubernetes-preserve-unknown-fields: true + secretKeyRef: + description: Selects a key of a secret in the pod's namespace + type: object + required: + - key + properties: + key: + description: The key of the secret to select from. Must be a valid secret key. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret or its key must be defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + envFrom: + description: |- + List of sources to populate environment variables in the container. + The keys defined within a source may consist of any printable ASCII characters except '='. + When a key exists in multiple + sources, the value associated with the last source will take precedence. + Values defined by an Env with a duplicate key will take precedence. + Cannot be updated. + type: array + items: + description: EnvFromSource represents the source of a set of ConfigMaps or Secrets + type: object + properties: + configMapRef: + description: The ConfigMap to select from + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap must be defined + type: boolean + x-kubernetes-map-type: atomic + prefix: + description: |- + Optional text to prepend to the name of each environment variable. + May consist of any printable ASCII characters except '='. + type: string + secretRef: + description: The Secret to select from + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret must be defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + image: + description: |- + Container image name. + More info: https://kubernetes.io/docs/concepts/containers/images + This field is optional to allow higher level config management to default or override + container images in workload controllers like Deployments and StatefulSets. + type: string + imagePullPolicy: + description: |- + Image pull policy. + One of Always, Never, IfNotPresent. + Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/containers/images#updating-images + type: string + livenessProbe: + description: |- + Periodic probe of container liveness. + Container will be restarted if the probe fails. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: object + properties: + exec: + description: Exec specifies a command to execute in the container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + failureThreshold: + description: |- + Minimum consecutive failures for the probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. + type: integer + format: int32 + grpc: + description: GRPC specifies a GRPC HealthCheckRequest. + type: object + properties: + port: + description: Port number of the gRPC service. Number must be in the range 1 to 65535. + type: integer + format: int32 + service: + description: |- + Service is the name of the service to place in the gRPC HealthCheckRequest + (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + + If this is not specified, the default behavior is defined by gRPC. + type: string + default: "" + httpGet: + description: HTTPGet specifies an HTTP GET request to perform. + type: object + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + initialDelaySeconds: + description: |- + Number of seconds after the container has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + periodSeconds: + description: |- + How often (in seconds) to perform the probe. + type: integer + format: int32 + successThreshold: + description: |- + Minimum consecutive successes for the probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. + type: integer + format: int32 + tcpSocket: + description: TCPSocket specifies a connection to a TCP port. + type: object + properties: + host: + description: 'Optional: Host name to connect to, defaults to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + timeoutSeconds: + description: |- + Number of seconds after which the probe times out. + Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + name: + description: |- + Name of the container specified as a DNS_LABEL. + Each container in a pod must have a unique name (DNS_LABEL). + Cannot be updated. + type: string + ports: + description: |- + List of ports to expose from the container. Not specifying a port here + DOES NOT prevent that port from being exposed. Any port which is + listening on the default "0.0.0.0" address inside a container will be + accessible from the network. + Modifying this array with strategic merge patch may corrupt the data. + For more information See https://github.com/kubernetes/kubernetes/issues/108255. + Cannot be updated. + type: array + items: + description: ContainerPort represents a network port in a single container. + type: object + properties: + containerPort: + description: |- + Number of port to expose on the pod's IP address. + This must be a valid port number, 0 < x < 65536. + type: integer + format: int32 + name: + description: |- + If specified, this must be an IANA_SVC_NAME and unique within the pod. Each + named port in a pod must have a unique name. Name for the port that can be + referred to by services. + type: string + protocol: + description: |- + Protocol for port. Must be UDP, TCP, or SCTP. + Defaults to "TCP". + type: string + default: TCP + readinessProbe: + description: |- + Periodic probe of container service readiness. + Container will be removed from service endpoints if the probe fails. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: object + properties: + exec: + description: Exec specifies a command to execute in the container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + failureThreshold: + description: |- + Minimum consecutive failures for the probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. + type: integer + format: int32 + grpc: + description: GRPC specifies a GRPC HealthCheckRequest. + type: object + properties: + port: + description: Port number of the gRPC service. Number must be in the range 1 to 65535. + type: integer + format: int32 + service: + description: |- + Service is the name of the service to place in the gRPC HealthCheckRequest + (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + + If this is not specified, the default behavior is defined by gRPC. + type: string + default: "" + httpGet: + description: HTTPGet specifies an HTTP GET request to perform. + type: object + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + initialDelaySeconds: + description: |- + Number of seconds after the container has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + periodSeconds: + description: |- + How often (in seconds) to perform the probe. + type: integer + format: int32 + successThreshold: + description: |- + Minimum consecutive successes for the probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. + type: integer + format: int32 + tcpSocket: + description: TCPSocket specifies a connection to a TCP port. + type: object + properties: + host: + description: 'Optional: Host name to connect to, defaults to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + timeoutSeconds: + description: |- + Number of seconds after which the probe times out. + Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + resources: + description: |- + Compute Resources required by this container. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + properties: + limits: + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + requests: + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + securityContext: + description: |- + SecurityContext defines the security options the container should be run with. + If set, the fields of SecurityContext override the equivalent fields of PodSecurityContext. + More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ + type: object + properties: + allowPrivilegeEscalation: + description: |- + AllowPrivilegeEscalation controls whether a process can gain more + privileges than its parent process. This bool directly controls if + the no_new_privs flag will be set on the container process. + AllowPrivilegeEscalation is true always when the container is: + 1) run as Privileged + 2) has CAP_SYS_ADMIN + Note that this field cannot be set when spec.os.name is windows. + type: boolean + capabilities: + description: |- + The capabilities to add/drop when running containers. + Defaults to the default set of capabilities granted by the container runtime. + Note that this field cannot be set when spec.os.name is windows. + type: object + properties: + add: + description: This is accessible behind a feature flag - kubernetes.containerspec-addcapabilities + type: array + items: + description: Capability represent POSIX capabilities type + type: string + x-kubernetes-list-type: atomic + drop: + description: Removed capabilities + type: array + items: + description: Capability represent POSIX capabilities type + type: string + x-kubernetes-list-type: atomic + privileged: + description: |- + Run container in privileged mode. This can only be set to explicitly to 'false' + type: boolean + readOnlyRootFilesystem: + description: |- + Whether this container has a read-only root filesystem. + Default is false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + runAsGroup: + description: |- + The GID to run the entrypoint of the container process. + Uses runtime default if unset. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + runAsNonRoot: + description: |- + Indicates that the container must run as a non-root user. + If true, the Kubelet will validate the image at runtime to ensure that it + does not run as UID 0 (root) and fail to start the container if it does. + If unset or false, no such validation will be performed. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: boolean + runAsUser: + description: |- + The UID to run the entrypoint of the container process. + Defaults to user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + seccompProfile: + description: |- + The seccomp options to use by this container. If seccomp options are + provided at both the pod & container level, the container options + override the pod options. + Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile defined in a file on the node should be used. + The profile must be preconfigured on the node to work. + Must be a descending path, relative to the kubelet's configured seccomp profile location. + Must be set if type is "Localhost". Must NOT be set for any other type. + type: string + type: + description: |- + type indicates which kind of seccomp profile will be applied. + Valid options are: + + Localhost - a profile defined in a file on the node should be used. + RuntimeDefault - the container runtime default profile should be used. + Unconfined - no profile should be applied. + type: string + startupProbe: + description: |- + StartupProbe indicates that the Pod has successfully initialized. + If specified, no other probes are executed until this completes successfully. + If this probe fails, the Pod will be restarted, just as if the livenessProbe failed. + This can be used to provide different probe parameters at the beginning of a Pod's lifecycle, + when it might take a long time to load data or warm a cache, than during steady-state operation. + This cannot be updated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: object + properties: + exec: + description: Exec specifies a command to execute in the container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + failureThreshold: + description: |- + Minimum consecutive failures for the probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. + type: integer + format: int32 + grpc: + description: GRPC specifies a GRPC HealthCheckRequest. + type: object + properties: + port: + description: Port number of the gRPC service. Number must be in the range 1 to 65535. + type: integer + format: int32 + service: + description: |- + Service is the name of the service to place in the gRPC HealthCheckRequest + (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + + If this is not specified, the default behavior is defined by gRPC. + type: string + default: "" + httpGet: + description: HTTPGet specifies an HTTP GET request to perform. + type: object + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + initialDelaySeconds: + description: |- + Number of seconds after the container has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + periodSeconds: + description: |- + How often (in seconds) to perform the probe. + type: integer + format: int32 + successThreshold: + description: |- + Minimum consecutive successes for the probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. + type: integer + format: int32 + tcpSocket: + description: TCPSocket specifies a connection to a TCP port. + type: object + properties: + host: + description: 'Optional: Host name to connect to, defaults to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + timeoutSeconds: + description: |- + Number of seconds after which the probe times out. + Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + terminationMessagePath: + description: |- + Optional: Path at which the file to which the container's termination message + will be written is mounted into the container's filesystem. + Message written is intended to be brief final status, such as an assertion failure message. + Will be truncated by the node if greater than 4096 bytes. The total message length across + all containers will be limited to 12kb. + Defaults to /dev/termination-log. + Cannot be updated. + type: string + terminationMessagePolicy: + description: |- + Indicate how the termination message should be populated. File will use the contents of + terminationMessagePath to populate the container status message on both success and failure. + FallbackToLogsOnError will use the last chunk of container log output if the termination + message file is empty and the container exited with an error. + The log output is limited to 2048 bytes or 80 lines, whichever is smaller. + Defaults to File. + Cannot be updated. + type: string + volumeMounts: + description: |- + Pod volumes to mount into the container's filesystem. + Cannot be updated. + type: array + items: + description: VolumeMount describes a mounting of a Volume within a container. + type: object + required: + - mountPath + - name + properties: + mountPath: + description: |- + Path within the container at which the volume should be mounted. Must + not contain ':'. + type: string + mountPropagation: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-volumes-mount-propagation + type: string + name: + description: This must match the Name of a Volume. + type: string + readOnly: + description: |- + Mounted read-only if true, read-write otherwise (false or unspecified). + Defaults to false. + type: boolean + subPath: + description: |- + Path within the volume from which the container's volume should be mounted. + Defaults to "" (volume's root). + type: string + x-kubernetes-list-map-keys: + - mountPath + x-kubernetes-list-type: map + workingDir: + description: |- + Container's working directory. + If not specified, the container runtime's default will be used, which + might be configured in the container image. + Cannot be updated. + type: string + dnsConfig: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-dnsconfig + type: object + x-kubernetes-preserve-unknown-fields: true + dnsPolicy: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-dnspolicy + type: string + enableServiceLinks: + description: |- + EnableServiceLinks indicates whether information aboutservices should be injected into pod's environment variables, matching the syntax of Docker links. Optional: Knative defaults this to false. + type: boolean + hostAliases: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-hostaliases + type: array + items: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-hostaliases + type: object + x-kubernetes-preserve-unknown-fields: true + hostIPC: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-hostipc + type: boolean + hostNetwork: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-hostnetwork + type: boolean + hostPID: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-hostpid + type: boolean + idleTimeoutSeconds: + description: |- + IdleTimeoutSeconds is the maximum duration in seconds a request will be allowed + to stay open while not receiving any bytes from the user's application. If + unspecified, a system default will be provided. + type: integer + format: int64 + imagePullSecrets: + description: |- + ImagePullSecrets is an optional list of references to secrets in the same namespace to use for pulling any of the images used by this PodSpec. + If specified, these secrets will be passed to individual puller implementations for them to use. + More info: https://kubernetes.io/docs/concepts/containers/images#specifying-imagepullsecrets-on-a-pod + type: array + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + x-kubernetes-map-type: atomic + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + initContainers: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-init-containers + type: array + items: + description: This is accessible behind a feature flag - kubernetes.podspec-init-containers + type: object + x-kubernetes-preserve-unknown-fields: true + nodeSelector: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-nodeselector + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + priorityClassName: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-priorityclassname + type: string + responseStartTimeoutSeconds: + description: |- + ResponseStartTimeoutSeconds is the maximum duration in seconds that the request + routing layer will wait for a request delivered to a container to begin + sending any network traffic. + type: integer + format: int64 + runtimeClassName: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-runtimeclassname + type: string + schedulerName: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-schedulername + type: string + securityContext: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-securitycontext + type: object + x-kubernetes-preserve-unknown-fields: true + serviceAccountName: + description: |- + ServiceAccountName is the name of the ServiceAccount to use to run this pod. + More info: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/ + type: string + shareProcessNamespace: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-shareprocessnamespace + type: boolean + timeoutSeconds: + description: |- + TimeoutSeconds is the maximum duration in seconds that the request instance + is allowed to respond to a request. If unspecified, a system default will + be provided. + type: integer + format: int64 + tolerations: + description: This is accessible behind a feature flag - kubernetes.podspec-tolerations + type: array + items: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-tolerations + type: object + x-kubernetes-preserve-unknown-fields: true + topologySpreadConstraints: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints + type: array + items: + description: This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints + type: object + x-kubernetes-preserve-unknown-fields: true + volumes: + description: |- + List of volumes that can be mounted by containers belonging to the pod. + More info: https://kubernetes.io/docs/concepts/storage/volumes + type: array + items: + description: Volume represents a named volume in a pod that may be accessed by any container in the pod. + type: object + required: + - name + properties: + configMap: + description: configMap represents a configMap that should populate this volume + type: object + properties: + defaultMode: + description: |- + defaultMode is optional: mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + Defaults to 0644. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + ConfigMap will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the ConfigMap, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: optional specify whether the ConfigMap or its keys must be defined + type: boolean + x-kubernetes-map-type: atomic + csi: + description: This is accessible behind a feature flag - kubernetes.podspec-volumes-csi + type: object + x-kubernetes-preserve-unknown-fields: true + emptyDir: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-volumes-emptydir + type: object + x-kubernetes-preserve-unknown-fields: true + hostPath: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-volumes-hostpath + type: object + x-kubernetes-preserve-unknown-fields: true + image: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-volumes-image + type: object + x-kubernetes-preserve-unknown-fields: true + name: + description: |- + name of the volume. + Must be a DNS_LABEL and unique within the pod. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + persistentVolumeClaim: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-persistent-volume-claim + type: object + x-kubernetes-preserve-unknown-fields: true + projected: + description: projected items for all in one resources secrets, configmaps, and downward API + type: object + properties: + defaultMode: + description: |- + defaultMode are the mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + sources: + description: |- + sources is the list of volume projections. Each entry in this list + handles one source. + type: array + items: + description: |- + Projection that may be projected along with other supported volume types. + Exactly one of these fields must be set. + type: object + properties: + configMap: + description: configMap information about the configMap data to project + type: object + properties: + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + ConfigMap will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the ConfigMap, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: optional specify whether the ConfigMap or its keys must be defined + type: boolean + x-kubernetes-map-type: atomic + downwardAPI: + description: downwardAPI information about the downwardAPI data to project + type: object + properties: + items: + description: Items is a list of DownwardAPIVolume file + type: array + items: + description: DownwardAPIVolumeFile represents information to create the file containing the pod field + type: object + required: + - path + properties: + fieldRef: + description: 'Required: Selects a field of the pod: only annotations, labels, name, namespace and uid are supported.' + type: object + required: + - fieldPath + properties: + apiVersion: + description: Version of the schema the FieldPath is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in the specified API version. + type: string + x-kubernetes-map-type: atomic + mode: + description: |- + Optional: mode bits used to set permissions on this file, must be an octal value + between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: 'Required: Path is the relative path name of the file to be created. Must not be absolute or contain the ''..'' path. Must be utf-8 encoded. The first item of the relative path must not start with ''..''' + type: string + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported. + type: object + required: + - resource + properties: + containerName: + description: 'Container name: required for volumes, optional for env vars' + type: string + divisor: + description: Specifies the output format of the exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + secret: + description: secret information about the secret data to project + type: object + properties: + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + Secret will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the Secret, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: optional field specify whether the Secret or its key must be defined + type: boolean + x-kubernetes-map-type: atomic + serviceAccountToken: + description: serviceAccountToken is information about the serviceAccountToken data to project + type: object + required: + - path + properties: + audience: + description: |- + audience is the intended audience of the token. A recipient of a token + must identify itself with an identifier specified in the audience of the + token, and otherwise should reject the token. The audience defaults to the + identifier of the apiserver. + type: string + expirationSeconds: + description: |- + expirationSeconds is the requested duration of validity of the service + account token. As the token approaches expiration, the kubelet volume + plugin will proactively rotate the service account token. The kubelet will + start trying to rotate the token if the token is older than 80 percent of + its time to live or if the token is older than 24 hours.Defaults to 1 hour + and must be at least 10 minutes. + type: integer + format: int64 + path: + description: |- + path is the path relative to the mount point of the file to project the + token into. + type: string + x-kubernetes-list-type: atomic + secret: + description: |- + secret represents a secret that should populate this volume. + More info: https://kubernetes.io/docs/concepts/storage/volumes#secret + type: object + properties: + defaultMode: + description: |- + defaultMode is Optional: mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values + for mode bits. Defaults to 0644. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + items: + description: |- + items If unspecified, each key-value pair in the Data field of the referenced + Secret will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the Secret, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + optional: + description: optional field specify whether the Secret or its keys must be defined + type: boolean + secretName: + description: |- + secretName is the name of the secret in the pod's namespace to use. + More info: https://kubernetes.io/docs/concepts/storage/volumes#secret + type: string + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + status: + description: ConfigurationStatus communicates the observed state of the Configuration (from the controller). + type: object + properties: + annotations: + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + additionalProperties: + type: string + conditions: + description: Conditions the latest available observations of a resource's current state. + type: array + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + type: object + required: + - status + - type + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating details about the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, False, Unknown. + type: string + type: + description: Type of condition. + type: string + latestCreatedRevisionName: + description: |- + LatestCreatedRevisionName is the last revision that was created from this + Configuration. It might not be ready yet, for that use LatestReadyRevisionName. + type: string + latestReadyRevisionName: + description: |- + LatestReadyRevisionName holds the name of the latest Revision stamped out + from this Configuration that has had its "Ready" condition become "True". + type: string + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + type: integer + format: int64 +--- +# Copyright 2020 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: clusterdomainclaims.networking.internal.knative.dev + labels: + app.kubernetes.io/name: knative-serving + app.kubernetes.io/component: networking + app.kubernetes.io/version: "1.22.1" + knative.dev/crd-install: "true" +spec: + group: networking.internal.knative.dev + versions: + - name: v1alpha1 + served: true + storage: true + subresources: + status: {} + schema: + openAPIV3Schema: + description: ClusterDomainClaim is a cluster-wide reservation for a particular domain name. + type: object + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: |- + Spec is the desired state of the ClusterDomainClaim. + More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status + type: object + required: + - namespace + properties: + namespace: + description: |- + Namespace is the namespace which is allowed to create a DomainMapping + using this ClusterDomainClaim's name. + type: string + names: + kind: ClusterDomainClaim + plural: clusterdomainclaims + singular: clusterdomainclaim + categories: + - knative-internal + - networking + shortNames: + - cdc + scope: Cluster +--- +# Copyright 2020 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: domainmappings.serving.knative.dev + labels: + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" + knative.dev/crd-install: "true" +spec: + group: serving.knative.dev + versions: + - name: v1beta1 + served: true + storage: true + subresources: + status: {} + additionalPrinterColumns: + - name: URL + type: string + jsonPath: .status.url + - name: Ready + type: string + jsonPath: ".status.conditions[?(@.type=='Ready')].status" + - name: Reason + type: string + jsonPath: ".status.conditions[?(@.type=='Ready')].reason" + "schema": + "openAPIV3Schema": + description: DomainMapping is a mapping from a custom hostname to an Addressable. + type: object + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: |- + Spec is the desired state of the DomainMapping. + More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status + type: object + required: + - ref + properties: + ref: + description: |- + Ref specifies the target of the Domain Mapping. + + The object identified by the Ref must be an Addressable with a URL of the + form `{name}.{namespace}.{domain}` where `{domain}` is the cluster domain, + and `{name}` and `{namespace}` are the name and namespace of a Kubernetes + Service. + + This contract is satisfied by Knative types such as Knative Services and + Knative Routes, and by Kubernetes Services. + type: object + required: + - kind + - name + properties: + address: + description: Address points to a specific Address Name. + type: string + apiVersion: + description: API version of the referent. + type: string + group: + description: |- + Group of the API, without the version of the group. This can be used as an alternative to the APIVersion, and then resolved using ResolveGroup. + Note: This API is EXPERIMENTAL and might break anytime. For more details: https://github.com/knative/eventing/issues/5086 + type: string + kind: + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + namespace: + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ + This is optional field, it gets defaulted to the object holding it if left out. + type: string + tls: + description: TLS allows the DomainMapping to terminate TLS traffic with an existing secret. + type: object + required: + - secretName + properties: + secretName: + description: SecretName is the name of the existing secret used to terminate TLS traffic. + type: string + status: + description: |- + Status is the current state of the DomainMapping. + More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status + type: object + properties: + address: + description: Address holds the information needed for a DomainMapping to be the target of an event. + type: object + properties: + CACerts: + description: |- + CACerts is the Certification Authority (CA) certificates in PEM format + according to https://www.rfc-editor.org/rfc/rfc7468. + type: string + audience: + description: Audience is the OIDC audience for this address. + type: string + name: + description: Name is the name of the address. + type: string + url: + type: string + annotations: + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + additionalProperties: + type: string + conditions: + description: Conditions the latest available observations of a resource's current state. + type: array + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + type: object + required: + - status + - type + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating details about the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, False, Unknown. + type: string + type: + description: Type of condition. + type: string + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + type: integer + format: int64 + url: + description: URL is the URL of this DomainMapping. + type: string + names: + kind: DomainMapping + plural: domainmappings + singular: domainmapping + categories: + - all + - knative + - serving + shortNames: + - dm + scope: Namespaced +--- +# Copyright 2020 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: ingresses.networking.internal.knative.dev + labels: + app.kubernetes.io/name: knative-serving + app.kubernetes.io/component: networking + app.kubernetes.io/version: "1.22.1" + knative.dev/crd-install: "true" +spec: + group: networking.internal.knative.dev + versions: + - name: v1alpha1 + served: true + storage: true + subresources: + status: {} + schema: + openAPIV3Schema: + description: |- + Ingress is a collection of rules that allow inbound connections to reach the endpoints defined + by a backend. An Ingress can be configured to give services externally-reachable URLs, load + balance traffic, offer name based virtual hosting, etc. + + This is heavily based on K8s Ingress https://godoc.org/k8s.io/api/networking/v1beta1#Ingress + which some highlighted modifications. + type: object + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: |- + Spec is the desired state of the Ingress. + More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status + type: object + properties: + httpOption: + description: |- + HTTPOption is the option of HTTP. It has the following two values: + `HTTPOptionEnabled`, `HTTPOptionRedirected` + type: string + rules: + description: A list of host rules used to configure the Ingress. + type: array + items: + description: |- + IngressRule represents the rules mapping the paths under a specified host to + the related backend services. Incoming requests are first evaluated for a host + match, then routed to the backend associated with the matching IngressRuleValue. + type: object + properties: + hosts: + description: |- + Host is the fully qualified domain name of a network host, as defined + by RFC 3986. Note the following deviations from the "host" part of the + URI as defined in the RFC: + 1. IPs are not allowed. Currently a rule value can only apply to the + IP in the Spec of the parent . + 2. The `:` delimiter is not respected because ports are not allowed. + Currently the port of an Ingress is implicitly :80 for http and + :443 for https. + Both these may change in the future. + If the host is unspecified, the Ingress routes all traffic based on the + specified IngressRuleValue. + If multiple matching Hosts were provided, the first rule will take precedent. + type: array + items: + type: string + http: + description: |- + HTTP represents a rule to apply against incoming requests. If the + rule is satisfied, the request is routed to the specified backend. + type: object + required: + - paths + properties: + paths: + description: |- + A collection of paths that map requests to backends. + + If they are multiple matching paths, the first match takes precedence. + type: array + items: + description: |- + HTTPIngressPath associates a path regex with a backend. Incoming URLs matching + the path are forwarded to the backend. + type: object + required: + - splits + properties: + appendHeaders: + description: |- + AppendHeaders allow specifying additional HTTP headers to add + before forwarding a request to the destination service. + + NOTE: This differs from K8s Ingress which doesn't allow header appending. + type: object + additionalProperties: + type: string + headers: + description: |- + Headers defines header matching rules which is a map from a header name + to HeaderMatch which specify a matching condition. + When a request matched with all the header matching rules, + the request is routed by the corresponding ingress rule. + If it is empty, the headers are not used for matching + type: object + additionalProperties: + description: |- + HeaderMatch represents a matching value of Headers in HTTPIngressPath. + Currently, only the exact matching is supported. + type: object + required: + - exact + properties: + exact: + type: string + path: + description: |- + Path represents a literal prefix to which this rule should apply. + Currently it can contain characters disallowed from the conventional + "path" part of a URL as defined by RFC 3986. Paths must begin with + a '/'. If unspecified, the path defaults to a catch all sending + traffic to the backend. + type: string + rewriteHost: + description: |- + RewriteHost rewrites the incoming request's host header. + + This field is currently experimental and not supported by all Ingress + implementations. + type: string + splits: + description: |- + Splits defines the referenced service endpoints to which the traffic + will be forwarded to. + type: array + items: + description: IngressBackendSplit describes all endpoints for a given service and port. + type: object + required: + - serviceName + - serviceNamespace + - servicePort + properties: + appendHeaders: + description: |- + AppendHeaders allow specifying additional HTTP headers to add + before forwarding a request to the destination service. + + NOTE: This differs from K8s Ingress which doesn't allow header appending. + type: object + additionalProperties: + type: string + percent: + description: |- + Specifies the split percentage, a number between 0 and 100. If + only one split is specified, we default to 100. + + NOTE: This differs from K8s Ingress to allow percentage split. + type: integer + serviceName: + description: Specifies the name of the referenced service. + type: string + serviceNamespace: + description: |- + Specifies the namespace of the referenced service. + + NOTE: This differs from K8s Ingress to allow routing to different namespaces. + type: string + servicePort: + description: Specifies the port of the referenced service. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + visibility: + description: |- + Visibility signifies whether this rule should `ClusterLocal`. If it's not + specified then it defaults to `ExternalIP`. + type: string + tls: + description: |- + TLS configuration. Currently Ingress only supports a single TLS + port: 443. If multiple members of this list specify different hosts, they + will be multiplexed on the same port according to the hostname specified + through the SNI TLS extension, if the ingress controller fulfilling the + ingress supports SNI. + type: array + items: + description: IngressTLS describes the transport layer security associated with an Ingress. + type: object + properties: + hosts: + description: |- + Hosts is a list of hosts included in the TLS certificate. The values in + this list must match the name/s used in the tlsSecret. Defaults to the + wildcard host setting for the loadbalancer controller fulfilling this + Ingress, if left unspecified. + type: array + items: + type: string + secretName: + description: SecretName is the name of the secret used to terminate SSL traffic. + type: string + secretNamespace: + description: |- + SecretNamespace is the namespace of the secret used to terminate SSL traffic. + If not set the namespace should be assumed to be the same as the Ingress. + If set the secret should have the same namespace as the Ingress otherwise + the behaviour is undefined and not supported. + type: string + status: + description: |- + Status is the current state of the Ingress. + More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status + type: object + properties: + annotations: + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + additionalProperties: + type: string + conditions: + description: Conditions the latest available observations of a resource's current state. + type: array + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + type: object + required: + - status + - type + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating details about the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, False, Unknown. + type: string + type: + description: Type of condition. + type: string + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + type: integer + format: int64 + privateLoadBalancer: + description: PrivateLoadBalancer contains the current status of the load-balancer. + type: object + properties: + ingress: + description: |- + Ingress is a list containing ingress points for the load-balancer. + Traffic intended for the service should be sent to these ingress points. + type: array + items: + description: |- + LoadBalancerIngressStatus represents the status of a load-balancer ingress point: + traffic intended for the service should be sent to an ingress point. + type: object + properties: + domain: + description: |- + Domain is set for load-balancer ingress points that are DNS based + (typically AWS load-balancers) + type: string + domainInternal: + description: |- + DomainInternal is set if there is a cluster-local DNS name to access the Ingress. + + NOTE: This differs from K8s Ingress, since we also desire to have a cluster-local + DNS name to allow routing in case of not having a mesh. + type: string + ip: + description: |- + IP is set for load-balancer ingress points that are IP based + (typically GCE or OpenStack load-balancers) + type: string + meshOnly: + description: MeshOnly is set if the Ingress is only load-balanced through a Service mesh. + type: boolean + publicLoadBalancer: + description: PublicLoadBalancer contains the current status of the load-balancer. + type: object + properties: + ingress: + description: |- + Ingress is a list containing ingress points for the load-balancer. + Traffic intended for the service should be sent to these ingress points. + type: array + items: + description: |- + LoadBalancerIngressStatus represents the status of a load-balancer ingress point: + traffic intended for the service should be sent to an ingress point. + type: object + properties: + domain: + description: |- + Domain is set for load-balancer ingress points that are DNS based + (typically AWS load-balancers) + type: string + domainInternal: + description: |- + DomainInternal is set if there is a cluster-local DNS name to access the Ingress. + + NOTE: This differs from K8s Ingress, since we also desire to have a cluster-local + DNS name to allow routing in case of not having a mesh. + type: string + ip: + description: |- + IP is set for load-balancer ingress points that are IP based + (typically GCE or OpenStack load-balancers) + type: string + meshOnly: + description: MeshOnly is set if the Ingress is only load-balanced through a Service mesh. + type: boolean + additionalPrinterColumns: + - name: Ready + type: string + jsonPath: ".status.conditions[?(@.type=='Ready')].status" + - name: Reason + type: string + jsonPath: ".status.conditions[?(@.type=='Ready')].reason" + names: + kind: Ingress + plural: ingresses + singular: ingress + categories: + - knative-internal + - networking + shortNames: + - kingress + - king + scope: Namespaced +--- +# Copyright 2019 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# Note: The schema part of the spec is auto-generated by hack/update-schemas.sh. + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: metrics.autoscaling.internal.knative.dev + labels: + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" + knative.dev/crd-install: "true" +spec: + group: autoscaling.internal.knative.dev + names: + kind: Metric + plural: metrics + singular: metric + categories: + - knative-internal + - autoscaling + scope: Namespaced + versions: + - name: v1alpha1 + served: true + storage: true + subresources: + status: {} + additionalPrinterColumns: + - name: Ready + type: string + jsonPath: ".status.conditions[?(@.type=='Ready')].status" + - name: Reason + type: string + jsonPath: ".status.conditions[?(@.type=='Ready')].reason" + schema: + openAPIV3Schema: + description: Metric represents a resource to configure the metric collector with. + type: object + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: Spec holds the desired state of the Metric (from the client). + type: object + required: + - panicWindow + - scrapeTarget + - stableWindow + properties: + panicWindow: + description: PanicWindow is the aggregation window for metrics where quick reactions are needed. + type: integer + format: int64 + scrapeTarget: + description: ScrapeTarget is the K8s service that publishes the metric endpoint. + type: string + stableWindow: + description: StableWindow is the aggregation window for metrics in a stable state. + type: integer + format: int64 + status: + description: Status communicates the observed state of the Metric (from the controller). + type: object + properties: + annotations: + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + additionalProperties: + type: string + conditions: + description: Conditions the latest available observations of a resource's current state. + type: array + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + type: object + required: + - status + - type + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating details about the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, False, Unknown. + type: string + type: + description: Type of condition. + type: string + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + type: integer + format: int64 +--- +# Copyright 2018 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# Note: The schema part of the spec is auto-generated by hack/update-schemas.sh. + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: podautoscalers.autoscaling.internal.knative.dev + labels: + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" + knative.dev/crd-install: "true" +spec: + group: autoscaling.internal.knative.dev + names: + kind: PodAutoscaler + plural: podautoscalers + singular: podautoscaler + categories: + - knative-internal + - autoscaling + shortNames: + - kpa + - pa + scope: Namespaced + versions: + - name: v1alpha1 + served: true + storage: true + subresources: + status: {} + additionalPrinterColumns: + - name: DesiredScale + type: integer + jsonPath: ".status.desiredScale" + - name: ActualScale + type: integer + jsonPath: ".status.actualScale" + - name: Ready + type: string + jsonPath: ".status.conditions[?(@.type=='Ready')].status" + - name: Reason + type: string + jsonPath: ".status.conditions[?(@.type=='Ready')].reason" + schema: + openAPIV3Schema: + description: |- + PodAutoscaler is a Knative abstraction that encapsulates the interface by which Knative + components instantiate autoscalers. This definition is an abstraction that may be backed + by multiple definitions. For more information, see the Knative Pluggability presentation: + https://docs.google.com/presentation/d/19vW9HFZ6Puxt31biNZF3uLRejDmu82rxJIk1cWmxF7w/edit + type: object + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: Spec holds the desired state of the PodAutoscaler (from the client). + type: object + required: + - protocolType + - scaleTargetRef + properties: + containerConcurrency: + description: |- + ContainerConcurrency specifies the maximum allowed + in-flight (concurrent) requests per container of the Revision. + Defaults to `0` which means unlimited concurrency. + type: integer + format: int64 + protocolType: + description: The application-layer protocol. Matches `ProtocolType` inferred from the revision spec. + type: string + reachability: + description: |- + Reachability specifies whether or not the `ScaleTargetRef` can be reached (ie. has a route). + Defaults to `ReachabilityUnknown` + type: string + scaleTargetRef: + description: |- + ScaleTargetRef defines the /scale-able resource that this PodAutoscaler + is responsible for quickly right-sizing. + type: object + properties: + apiVersion: + description: API version of the referent. + type: string + kind: + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + x-kubernetes-map-type: atomic + status: + description: Status communicates the observed state of the PodAutoscaler (from the controller). + type: object + required: + - metricsServiceName + - serviceName + properties: + actualScale: + description: ActualScale shows the actual number of replicas for the revision. + type: integer + format: int32 + annotations: + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + additionalProperties: + type: string + conditions: + description: Conditions the latest available observations of a resource's current state. + type: array + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + type: object + required: + - status + - type + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating details about the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, False, Unknown. + type: string + type: + description: Type of condition. + type: string + desiredScale: + description: DesiredScale shows the current desired number of replicas for the revision. + type: integer + format: int32 + metricsServiceName: + description: |- + MetricsServiceName is the K8s Service name that provides revision metrics. + The service is managed by the PA object. + type: string + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + type: integer + format: int64 + serviceName: + description: |- + ServiceName is the K8s Service name that serves the revision, scaled by this PA. + The service is created and owned by the ServerlessService object owned by this PA. + type: string +--- +# Copyright 2019 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# Note: The schema part of the spec is auto-generated by hack/update-schemas.sh. + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: revisions.serving.knative.dev + labels: + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" + knative.dev/crd-install: "true" +spec: + group: serving.knative.dev + names: + kind: Revision + plural: revisions + singular: revision + categories: + - all + - knative + - serving + shortNames: + - rev + scope: Namespaced + versions: + - name: v1 + served: true + storage: true + subresources: + status: {} + additionalPrinterColumns: + - name: Config Name + type: string + jsonPath: ".metadata.labels['serving\\.knative\\.dev/configuration']" + - name: Generation + type: string # int in string form :( + jsonPath: ".metadata.labels['serving\\.knative\\.dev/configurationGeneration']" + - name: Ready + type: string + jsonPath: ".status.conditions[?(@.type=='Ready')].status" + - name: Reason + type: string + jsonPath: ".status.conditions[?(@.type=='Ready')].reason" + - name: Actual Replicas + type: integer + jsonPath: ".status.actualReplicas" + - name: Desired Replicas + type: integer + jsonPath: ".status.desiredReplicas" + schema: + openAPIV3Schema: + description: |- + Revision is an immutable snapshot of code and configuration. A revision + references a container image. Revisions are created by updates to a + Configuration. + + See also: https://github.com/knative/serving/blob/main/docs/spec/overview.md#revision + type: object + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: RevisionSpec holds the desired state of the Revision (from the client). + type: object + required: + - containers + properties: + affinity: + description: This is accessible behind a feature flag - kubernetes.podspec-affinity + type: object + x-kubernetes-preserve-unknown-fields: true + automountServiceAccountToken: + description: AutomountServiceAccountToken indicates whether a service account token should be automatically mounted. + type: boolean + containerConcurrency: + description: |- + ContainerConcurrency specifies the maximum allowed in-flight (concurrent) + requests per container of the Revision. Defaults to `0` which means + concurrency to the application is not limited, and the system decides the + target concurrency for the autoscaler. + type: integer + format: int64 + containers: + description: |- + List of containers belonging to the pod. + Containers cannot currently be added or removed. + There must be at least one container in a Pod. + Cannot be updated. + type: array + items: + description: A single application container that you want to run within a pod. + type: object + properties: + args: + description: |- + Arguments to the entrypoint. + The container image's CMD is used if this is not provided. + Variable references $(VAR_NAME) are expanded using the container's environment. If a variable + cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will + produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless + of whether the variable exists or not. Cannot be updated. + More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell + type: array + items: + type: string + x-kubernetes-list-type: atomic + command: + description: |- + Entrypoint array. Not executed within a shell. + The container image's ENTRYPOINT is used if this is not provided. + Variable references $(VAR_NAME) are expanded using the container's environment. If a variable + cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will + produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless + of whether the variable exists or not. Cannot be updated. + More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell + type: array + items: + type: string + x-kubernetes-list-type: atomic + env: + description: |- + List of environment variables to set in the container. + Cannot be updated. + type: array + items: + description: EnvVar represents an environment variable present in a Container. + type: object + required: + - name + properties: + name: + description: |- + Name of the environment variable. + May consist of any printable ASCII characters except '='. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's value. Cannot be used if value is not empty. + type: object + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + type: object + required: + - key + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap or its key must be defined + type: boolean + x-kubernetes-map-type: atomic + fieldRef: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-fieldref + type: object + x-kubernetes-map-type: atomic + x-kubernetes-preserve-unknown-fields: true + resourceFieldRef: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-fieldref + type: object + x-kubernetes-map-type: atomic + x-kubernetes-preserve-unknown-fields: true + secretKeyRef: + description: Selects a key of a secret in the pod's namespace + type: object + required: + - key + properties: + key: + description: The key of the secret to select from. Must be a valid secret key. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret or its key must be defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + envFrom: + description: |- + List of sources to populate environment variables in the container. + The keys defined within a source may consist of any printable ASCII characters except '='. + When a key exists in multiple + sources, the value associated with the last source will take precedence. + Values defined by an Env with a duplicate key will take precedence. + Cannot be updated. + type: array + items: + description: EnvFromSource represents the source of a set of ConfigMaps or Secrets + type: object + properties: + configMapRef: + description: The ConfigMap to select from + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap must be defined + type: boolean + x-kubernetes-map-type: atomic + prefix: + description: |- + Optional text to prepend to the name of each environment variable. + May consist of any printable ASCII characters except '='. + type: string + secretRef: + description: The Secret to select from + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret must be defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + image: + description: |- + Container image name. + More info: https://kubernetes.io/docs/concepts/containers/images + This field is optional to allow higher level config management to default or override + container images in workload controllers like Deployments and StatefulSets. + type: string + imagePullPolicy: + description: |- + Image pull policy. + One of Always, Never, IfNotPresent. + Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/containers/images#updating-images + type: string + livenessProbe: + description: |- + Periodic probe of container liveness. + Container will be restarted if the probe fails. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: object + properties: + exec: + description: Exec specifies a command to execute in the container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + failureThreshold: + description: |- + Minimum consecutive failures for the probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. + type: integer + format: int32 + grpc: + description: GRPC specifies a GRPC HealthCheckRequest. + type: object + properties: + port: + description: Port number of the gRPC service. Number must be in the range 1 to 65535. + type: integer + format: int32 + service: + description: |- + Service is the name of the service to place in the gRPC HealthCheckRequest + (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + + If this is not specified, the default behavior is defined by gRPC. + type: string + default: "" + httpGet: + description: HTTPGet specifies an HTTP GET request to perform. + type: object + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + initialDelaySeconds: + description: |- + Number of seconds after the container has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + periodSeconds: + description: |- + How often (in seconds) to perform the probe. + type: integer + format: int32 + successThreshold: + description: |- + Minimum consecutive successes for the probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. + type: integer + format: int32 + tcpSocket: + description: TCPSocket specifies a connection to a TCP port. + type: object + properties: + host: + description: 'Optional: Host name to connect to, defaults to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + timeoutSeconds: + description: |- + Number of seconds after which the probe times out. + Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + name: + description: |- + Name of the container specified as a DNS_LABEL. + Each container in a pod must have a unique name (DNS_LABEL). + Cannot be updated. + type: string + ports: + description: |- + List of ports to expose from the container. Not specifying a port here + DOES NOT prevent that port from being exposed. Any port which is + listening on the default "0.0.0.0" address inside a container will be + accessible from the network. + Modifying this array with strategic merge patch may corrupt the data. + For more information See https://github.com/kubernetes/kubernetes/issues/108255. + Cannot be updated. + type: array + items: + description: ContainerPort represents a network port in a single container. + type: object + properties: + containerPort: + description: |- + Number of port to expose on the pod's IP address. + This must be a valid port number, 0 < x < 65536. + type: integer + format: int32 + name: + description: |- + If specified, this must be an IANA_SVC_NAME and unique within the pod. Each + named port in a pod must have a unique name. Name for the port that can be + referred to by services. + type: string + protocol: + description: |- + Protocol for port. Must be UDP, TCP, or SCTP. + Defaults to "TCP". + type: string + default: TCP + readinessProbe: + description: |- + Periodic probe of container service readiness. + Container will be removed from service endpoints if the probe fails. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: object + properties: + exec: + description: Exec specifies a command to execute in the container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + failureThreshold: + description: |- + Minimum consecutive failures for the probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. + type: integer + format: int32 + grpc: + description: GRPC specifies a GRPC HealthCheckRequest. + type: object + properties: + port: + description: Port number of the gRPC service. Number must be in the range 1 to 65535. + type: integer + format: int32 + service: + description: |- + Service is the name of the service to place in the gRPC HealthCheckRequest + (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + + If this is not specified, the default behavior is defined by gRPC. + type: string + default: "" + httpGet: + description: HTTPGet specifies an HTTP GET request to perform. + type: object + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + initialDelaySeconds: + description: |- + Number of seconds after the container has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + periodSeconds: + description: |- + How often (in seconds) to perform the probe. + type: integer + format: int32 + successThreshold: + description: |- + Minimum consecutive successes for the probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. + type: integer + format: int32 + tcpSocket: + description: TCPSocket specifies a connection to a TCP port. + type: object + properties: + host: + description: 'Optional: Host name to connect to, defaults to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + timeoutSeconds: + description: |- + Number of seconds after which the probe times out. + Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + resources: + description: |- + Compute Resources required by this container. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + properties: + limits: + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + requests: + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + securityContext: + description: |- + SecurityContext defines the security options the container should be run with. + If set, the fields of SecurityContext override the equivalent fields of PodSecurityContext. + More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ + type: object + properties: + allowPrivilegeEscalation: + description: |- + AllowPrivilegeEscalation controls whether a process can gain more + privileges than its parent process. This bool directly controls if + the no_new_privs flag will be set on the container process. + AllowPrivilegeEscalation is true always when the container is: + 1) run as Privileged + 2) has CAP_SYS_ADMIN + Note that this field cannot be set when spec.os.name is windows. + type: boolean + capabilities: + description: |- + The capabilities to add/drop when running containers. + Defaults to the default set of capabilities granted by the container runtime. + Note that this field cannot be set when spec.os.name is windows. + type: object + properties: + add: + description: This is accessible behind a feature flag - kubernetes.containerspec-addcapabilities + type: array + items: + description: Capability represent POSIX capabilities type + type: string + x-kubernetes-list-type: atomic + drop: + description: Removed capabilities + type: array + items: + description: Capability represent POSIX capabilities type + type: string + x-kubernetes-list-type: atomic + privileged: + description: |- + Run container in privileged mode. This can only be set to explicitly to 'false' + type: boolean + readOnlyRootFilesystem: + description: |- + Whether this container has a read-only root filesystem. + Default is false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + runAsGroup: + description: |- + The GID to run the entrypoint of the container process. + Uses runtime default if unset. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + runAsNonRoot: + description: |- + Indicates that the container must run as a non-root user. + If true, the Kubelet will validate the image at runtime to ensure that it + does not run as UID 0 (root) and fail to start the container if it does. + If unset or false, no such validation will be performed. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: boolean + runAsUser: + description: |- + The UID to run the entrypoint of the container process. + Defaults to user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + seccompProfile: + description: |- + The seccomp options to use by this container. If seccomp options are + provided at both the pod & container level, the container options + override the pod options. + Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile defined in a file on the node should be used. + The profile must be preconfigured on the node to work. + Must be a descending path, relative to the kubelet's configured seccomp profile location. + Must be set if type is "Localhost". Must NOT be set for any other type. + type: string + type: + description: |- + type indicates which kind of seccomp profile will be applied. + Valid options are: + + Localhost - a profile defined in a file on the node should be used. + RuntimeDefault - the container runtime default profile should be used. + Unconfined - no profile should be applied. + type: string + startupProbe: + description: |- + StartupProbe indicates that the Pod has successfully initialized. + If specified, no other probes are executed until this completes successfully. + If this probe fails, the Pod will be restarted, just as if the livenessProbe failed. + This can be used to provide different probe parameters at the beginning of a Pod's lifecycle, + when it might take a long time to load data or warm a cache, than during steady-state operation. + This cannot be updated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: object + properties: + exec: + description: Exec specifies a command to execute in the container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + failureThreshold: + description: |- + Minimum consecutive failures for the probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. + type: integer + format: int32 + grpc: + description: GRPC specifies a GRPC HealthCheckRequest. + type: object + properties: + port: + description: Port number of the gRPC service. Number must be in the range 1 to 65535. + type: integer + format: int32 + service: + description: |- + Service is the name of the service to place in the gRPC HealthCheckRequest + (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + + If this is not specified, the default behavior is defined by gRPC. + type: string + default: "" + httpGet: + description: HTTPGet specifies an HTTP GET request to perform. + type: object + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + initialDelaySeconds: + description: |- + Number of seconds after the container has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + periodSeconds: + description: |- + How often (in seconds) to perform the probe. + type: integer + format: int32 + successThreshold: + description: |- + Minimum consecutive successes for the probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. + type: integer + format: int32 + tcpSocket: + description: TCPSocket specifies a connection to a TCP port. + type: object + properties: + host: + description: 'Optional: Host name to connect to, defaults to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + timeoutSeconds: + description: |- + Number of seconds after which the probe times out. + Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + terminationMessagePath: + description: |- + Optional: Path at which the file to which the container's termination message + will be written is mounted into the container's filesystem. + Message written is intended to be brief final status, such as an assertion failure message. + Will be truncated by the node if greater than 4096 bytes. The total message length across + all containers will be limited to 12kb. + Defaults to /dev/termination-log. + Cannot be updated. + type: string + terminationMessagePolicy: + description: |- + Indicate how the termination message should be populated. File will use the contents of + terminationMessagePath to populate the container status message on both success and failure. + FallbackToLogsOnError will use the last chunk of container log output if the termination + message file is empty and the container exited with an error. + The log output is limited to 2048 bytes or 80 lines, whichever is smaller. + Defaults to File. + Cannot be updated. + type: string + volumeMounts: + description: |- + Pod volumes to mount into the container's filesystem. + Cannot be updated. + type: array + items: + description: VolumeMount describes a mounting of a Volume within a container. + type: object + required: + - mountPath + - name + properties: + mountPath: + description: |- + Path within the container at which the volume should be mounted. Must + not contain ':'. + type: string + mountPropagation: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-volumes-mount-propagation + type: string + name: + description: This must match the Name of a Volume. + type: string + readOnly: + description: |- + Mounted read-only if true, read-write otherwise (false or unspecified). + Defaults to false. + type: boolean + subPath: + description: |- + Path within the volume from which the container's volume should be mounted. + Defaults to "" (volume's root). + type: string + x-kubernetes-list-map-keys: + - mountPath + x-kubernetes-list-type: map + workingDir: + description: |- + Container's working directory. + If not specified, the container runtime's default will be used, which + might be configured in the container image. + Cannot be updated. + type: string + dnsConfig: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-dnsconfig + type: object + x-kubernetes-preserve-unknown-fields: true + dnsPolicy: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-dnspolicy + type: string + enableServiceLinks: + description: |- + EnableServiceLinks indicates whether information aboutservices should be injected into pod's environment variables, matching the syntax of Docker links. Optional: Knative defaults this to false. + type: boolean + hostAliases: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-hostaliases + type: array + items: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-hostaliases + type: object + x-kubernetes-preserve-unknown-fields: true + hostIPC: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-hostipc + type: boolean + hostNetwork: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-hostnetwork + type: boolean + hostPID: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-hostpid + type: boolean + idleTimeoutSeconds: + description: |- + IdleTimeoutSeconds is the maximum duration in seconds a request will be allowed + to stay open while not receiving any bytes from the user's application. If + unspecified, a system default will be provided. + type: integer + format: int64 + imagePullSecrets: + description: |- + ImagePullSecrets is an optional list of references to secrets in the same namespace to use for pulling any of the images used by this PodSpec. + If specified, these secrets will be passed to individual puller implementations for them to use. + More info: https://kubernetes.io/docs/concepts/containers/images#specifying-imagepullsecrets-on-a-pod + type: array + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + x-kubernetes-map-type: atomic + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + initContainers: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-init-containers + type: array + items: + description: This is accessible behind a feature flag - kubernetes.podspec-init-containers + type: object + x-kubernetes-preserve-unknown-fields: true + nodeSelector: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-nodeselector + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + priorityClassName: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-priorityclassname + type: string + responseStartTimeoutSeconds: + description: |- + ResponseStartTimeoutSeconds is the maximum duration in seconds that the request + routing layer will wait for a request delivered to a container to begin + sending any network traffic. + type: integer + format: int64 + runtimeClassName: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-runtimeclassname + type: string + schedulerName: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-schedulername + type: string + securityContext: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-securitycontext + type: object + x-kubernetes-preserve-unknown-fields: true + serviceAccountName: + description: |- + ServiceAccountName is the name of the ServiceAccount to use to run this pod. + More info: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/ + type: string + shareProcessNamespace: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-shareprocessnamespace + type: boolean + timeoutSeconds: + description: |- + TimeoutSeconds is the maximum duration in seconds that the request instance + is allowed to respond to a request. If unspecified, a system default will + be provided. + type: integer + format: int64 + tolerations: + description: This is accessible behind a feature flag - kubernetes.podspec-tolerations + type: array + items: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-tolerations + type: object + x-kubernetes-preserve-unknown-fields: true + topologySpreadConstraints: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints + type: array + items: + description: This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints + type: object + x-kubernetes-preserve-unknown-fields: true + volumes: + description: |- + List of volumes that can be mounted by containers belonging to the pod. + More info: https://kubernetes.io/docs/concepts/storage/volumes + type: array + items: + description: Volume represents a named volume in a pod that may be accessed by any container in the pod. + type: object + required: + - name + properties: + configMap: + description: configMap represents a configMap that should populate this volume + type: object + properties: + defaultMode: + description: |- + defaultMode is optional: mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + Defaults to 0644. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + ConfigMap will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the ConfigMap, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: optional specify whether the ConfigMap or its keys must be defined + type: boolean + x-kubernetes-map-type: atomic + csi: + description: This is accessible behind a feature flag - kubernetes.podspec-volumes-csi + type: object + x-kubernetes-preserve-unknown-fields: true + emptyDir: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-volumes-emptydir + type: object + x-kubernetes-preserve-unknown-fields: true + hostPath: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-volumes-hostpath + type: object + x-kubernetes-preserve-unknown-fields: true + image: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-volumes-image + type: object + x-kubernetes-preserve-unknown-fields: true + name: + description: |- + name of the volume. + Must be a DNS_LABEL and unique within the pod. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + persistentVolumeClaim: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-persistent-volume-claim + type: object + x-kubernetes-preserve-unknown-fields: true + projected: + description: projected items for all in one resources secrets, configmaps, and downward API + type: object + properties: + defaultMode: + description: |- + defaultMode are the mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + sources: + description: |- + sources is the list of volume projections. Each entry in this list + handles one source. + type: array + items: + description: |- + Projection that may be projected along with other supported volume types. + Exactly one of these fields must be set. + type: object + properties: + configMap: + description: configMap information about the configMap data to project + type: object + properties: + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + ConfigMap will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the ConfigMap, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: optional specify whether the ConfigMap or its keys must be defined + type: boolean + x-kubernetes-map-type: atomic + downwardAPI: + description: downwardAPI information about the downwardAPI data to project + type: object + properties: + items: + description: Items is a list of DownwardAPIVolume file + type: array + items: + description: DownwardAPIVolumeFile represents information to create the file containing the pod field + type: object + required: + - path + properties: + fieldRef: + description: 'Required: Selects a field of the pod: only annotations, labels, name, namespace and uid are supported.' + type: object + required: + - fieldPath + properties: + apiVersion: + description: Version of the schema the FieldPath is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in the specified API version. + type: string + x-kubernetes-map-type: atomic + mode: + description: |- + Optional: mode bits used to set permissions on this file, must be an octal value + between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: 'Required: Path is the relative path name of the file to be created. Must not be absolute or contain the ''..'' path. Must be utf-8 encoded. The first item of the relative path must not start with ''..''' + type: string + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported. + type: object + required: + - resource + properties: + containerName: + description: 'Container name: required for volumes, optional for env vars' + type: string + divisor: + description: Specifies the output format of the exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + secret: + description: secret information about the secret data to project + type: object + properties: + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + Secret will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the Secret, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: optional field specify whether the Secret or its key must be defined + type: boolean + x-kubernetes-map-type: atomic + serviceAccountToken: + description: serviceAccountToken is information about the serviceAccountToken data to project + type: object + required: + - path + properties: + audience: + description: |- + audience is the intended audience of the token. A recipient of a token + must identify itself with an identifier specified in the audience of the + token, and otherwise should reject the token. The audience defaults to the + identifier of the apiserver. + type: string + expirationSeconds: + description: |- + expirationSeconds is the requested duration of validity of the service + account token. As the token approaches expiration, the kubelet volume + plugin will proactively rotate the service account token. The kubelet will + start trying to rotate the token if the token is older than 80 percent of + its time to live or if the token is older than 24 hours.Defaults to 1 hour + and must be at least 10 minutes. + type: integer + format: int64 + path: + description: |- + path is the path relative to the mount point of the file to project the + token into. + type: string + x-kubernetes-list-type: atomic + secret: + description: |- + secret represents a secret that should populate this volume. + More info: https://kubernetes.io/docs/concepts/storage/volumes#secret + type: object + properties: + defaultMode: + description: |- + defaultMode is Optional: mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values + for mode bits. Defaults to 0644. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + items: + description: |- + items If unspecified, each key-value pair in the Data field of the referenced + Secret will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the Secret, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + optional: + description: optional field specify whether the Secret or its keys must be defined + type: boolean + secretName: + description: |- + secretName is the name of the secret in the pod's namespace to use. + More info: https://kubernetes.io/docs/concepts/storage/volumes#secret + type: string + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + status: + description: RevisionStatus communicates the observed state of the Revision (from the controller). + type: object + properties: + actualReplicas: + description: ActualReplicas reflects the amount of ready pods running this revision. + type: integer + format: int32 + annotations: + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + additionalProperties: + type: string + conditions: + description: Conditions the latest available observations of a resource's current state. + type: array + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + type: object + required: + - status + - type + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating details about the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, False, Unknown. + type: string + type: + description: Type of condition. + type: string + containerStatuses: + description: |- + ContainerStatuses is a slice of images present in .Spec.Container[*].Image + to their respective digests and their container name. + The digests are resolved during the creation of Revision. + ContainerStatuses holds the container name and image digests + for both serving and non serving containers. + ref: https://bit.ly/image-digests + type: array + items: + description: ContainerStatus holds the information of container name and image digest value + type: object + properties: + imageDigest: + type: string + name: + type: string + desiredReplicas: + description: DesiredReplicas reflects the desired amount of pods running this revision. + type: integer + format: int32 + initContainerStatuses: + description: |- + InitContainerStatuses is a slice of images present in .Spec.InitContainer[*].Image + to their respective digests and their container name. + The digests are resolved during the creation of Revision. + ContainerStatuses holds the container name and image digests + for both serving and non serving containers. + ref: https://bit.ly/image-digests + type: array + items: + description: ContainerStatus holds the information of container name and image digest value + type: object + properties: + imageDigest: + type: string + name: + type: string + logUrl: + description: |- + LogURL specifies the generated logging url for this particular revision + based on the revision url template specified in the controller's config. + type: string + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + type: integer + format: int64 +--- +# Copyright 2019 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# Note: The schema part of the spec is auto-generated by hack/update-schemas.sh. + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: routes.serving.knative.dev + labels: + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" + knative.dev/crd-install: "true" + duck.knative.dev/addressable: "true" +spec: + group: serving.knative.dev + names: + kind: Route + plural: routes + singular: route + categories: + - all + - knative + - serving + shortNames: + - rt + scope: Namespaced + versions: + - name: v1 + served: true + storage: true + subresources: + status: {} + additionalPrinterColumns: + - name: URL + type: string + jsonPath: .status.url + - name: Ready + type: string + jsonPath: ".status.conditions[?(@.type=='Ready')].status" + - name: Reason + type: string + jsonPath: ".status.conditions[?(@.type=='Ready')].reason" + schema: + openAPIV3Schema: + description: |- + Route is responsible for configuring ingress over a collection of Revisions. + Some of the Revisions a Route distributes traffic over may be specified by + referencing the Configuration responsible for creating them; in these cases + the Route is additionally responsible for monitoring the Configuration for + "latest ready revision" changes, and smoothly rolling out latest revisions. + See also: https://github.com/knative/serving/blob/main/docs/spec/overview.md#route + type: object + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: Spec holds the desired state of the Route (from the client). + type: object + properties: + traffic: + description: |- + Traffic specifies how to distribute traffic over a collection of + revisions and configurations. + type: array + items: + description: TrafficTarget holds a single entry of the routing table for a Route. + type: object + properties: + configurationName: + description: |- + ConfigurationName of a configuration to whose latest revision we will send + this portion of traffic. When the "status.latestReadyRevisionName" of the + referenced configuration changes, we will automatically migrate traffic + from the prior "latest ready" revision to the new one. This field is never + set in Route's status, only its spec. This is mutually exclusive with + RevisionName. + type: string + latestRevision: + description: |- + LatestRevision may be optionally provided to indicate that the latest + ready Revision of the Configuration should be used for this traffic + target. When provided LatestRevision must be true if RevisionName is + empty; it must be false when RevisionName is non-empty. + type: boolean + percent: + description: |- + Percent indicates that percentage based routing should be used and + the value indicates the percent of traffic that is be routed to this + Revision or Configuration. `0` (zero) mean no traffic, `100` means all + traffic. + When percentage based routing is being used the follow rules apply: + - the sum of all percent values must equal 100 + - when not specified, the implied value for `percent` is zero for + that particular Revision or Configuration + type: integer + format: int64 + revisionName: + description: |- + RevisionName of a specific revision to which to send this portion of + traffic. This is mutually exclusive with ConfigurationName. + type: string + tag: + description: |- + Tag is optionally used to expose a dedicated url for referencing + this target exclusively. + type: string + url: + description: |- + URL displays the URL for accessing named traffic targets. URL is displayed in + status, and is disallowed on spec. URL must contain a scheme (e.g. http://) and + a hostname, but may not contain anything else (e.g. basic auth, url path, etc.) + type: string + status: + description: Status communicates the observed state of the Route (from the controller). + type: object + properties: + address: + description: Address holds the information needed for a Route to be the target of an event. + type: object + properties: + CACerts: + description: |- + CACerts is the Certification Authority (CA) certificates in PEM format + according to https://www.rfc-editor.org/rfc/rfc7468. + type: string + audience: + description: Audience is the OIDC audience for this address. + type: string + name: + description: Name is the name of the address. + type: string + url: + type: string + annotations: + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + additionalProperties: + type: string + conditions: + description: Conditions the latest available observations of a resource's current state. + type: array + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + type: object + required: + - status + - type + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating details about the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, False, Unknown. + type: string + type: + description: Type of condition. + type: string + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + type: integer + format: int64 + traffic: + description: |- + Traffic holds the configured traffic distribution. + These entries will always contain RevisionName references. + When ConfigurationName appears in the spec, this will hold the + LatestReadyRevisionName that we last observed. + type: array + items: + description: TrafficTarget holds a single entry of the routing table for a Route. + type: object + properties: + configurationName: + description: |- + ConfigurationName of a configuration to whose latest revision we will send + this portion of traffic. When the "status.latestReadyRevisionName" of the + referenced configuration changes, we will automatically migrate traffic + from the prior "latest ready" revision to the new one. This field is never + set in Route's status, only its spec. This is mutually exclusive with + RevisionName. + type: string + latestRevision: + description: |- + LatestRevision may be optionally provided to indicate that the latest + ready Revision of the Configuration should be used for this traffic + target. When provided LatestRevision must be true if RevisionName is + empty; it must be false when RevisionName is non-empty. + type: boolean + percent: + description: |- + Percent indicates that percentage based routing should be used and + the value indicates the percent of traffic that is be routed to this + Revision or Configuration. `0` (zero) mean no traffic, `100` means all + traffic. + When percentage based routing is being used the follow rules apply: + - the sum of all percent values must equal 100 + - when not specified, the implied value for `percent` is zero for + that particular Revision or Configuration + type: integer + format: int64 + revisionName: + description: |- + RevisionName of a specific revision to which to send this portion of + traffic. This is mutually exclusive with ConfigurationName. + type: string + tag: + description: |- + Tag is optionally used to expose a dedicated url for referencing + this target exclusively. + type: string + url: + description: |- + URL displays the URL for accessing named traffic targets. URL is displayed in + status, and is disallowed on spec. URL must contain a scheme (e.g. http://) and + a hostname, but may not contain anything else (e.g. basic auth, url path, etc.) + type: string + url: + description: |- + URL holds the url that will distribute traffic over the provided traffic targets. + It generally has the form http[s]://{route-name}.{route-namespace}.{cluster-level-suffix} + type: string +--- +# Copyright 2019 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: serverlessservices.networking.internal.knative.dev + labels: + app.kubernetes.io/name: knative-serving + app.kubernetes.io/component: networking + app.kubernetes.io/version: "1.22.1" + knative.dev/crd-install: "true" +spec: + group: networking.internal.knative.dev + versions: + - name: v1alpha1 + served: true + storage: true + subresources: + status: {} + schema: + openAPIV3Schema: + description: |- + ServerlessService is a proxy for the K8s service objects containing the + endpoints for the revision, whether those are endpoints of the activator or + revision pods. + See: https://knative.page.link/naxz for details. + type: object + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: |- + Spec is the desired state of the ServerlessService. + More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status + type: object + required: + - objectRef + - protocolType + properties: + mode: + description: Mode describes the mode of operation of the ServerlessService. + type: string + numActivators: + description: |- + NumActivators contains number of Activators that this revision should be + assigned. + O means — assign all. + type: integer + format: int32 + objectRef: + description: |- + ObjectRef defines the resource that this ServerlessService + is responsible for making "serverless". + type: object + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: |- + If referring to a piece of an object instead of an entire object, this string + should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within a pod, this would take on a value like: + "spec.containers{name}" (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" (container with + index 2 in this pod). This syntax is chosen only to have some well-defined way of + referencing a part of an object. + type: string + kind: + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + namespace: + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ + type: string + resourceVersion: + description: |- + Specific resourceVersion to which this reference is made, if any. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency + type: string + uid: + description: |- + UID of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids + type: string + x-kubernetes-map-type: atomic + protocolType: + description: |- + The application-layer protocol. Matches `RevisionProtocolType` set on the owning pa/revision. + serving imports networking, so just use string. + type: string + status: + description: |- + Status is the current state of the ServerlessService. + More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status + type: object + properties: + annotations: + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + additionalProperties: + type: string + conditions: + description: Conditions the latest available observations of a resource's current state. + type: array + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + type: object + required: + - status + - type + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating details about the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, False, Unknown. + type: string + type: + description: Type of condition. + type: string + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + type: integer + format: int64 + privateServiceName: + description: |- + PrivateServiceName holds the name of a core K8s Service resource that + load balances over the user service pods backing this Revision. + type: string + serviceName: + description: |- + ServiceName holds the name of a core K8s Service resource that + load balances over the pods backing this Revision (activator or revision). + type: string + additionalPrinterColumns: + - name: Mode + type: string + jsonPath: ".spec.mode" + - name: Activators + type: integer + jsonPath: ".spec.numActivators" + - name: ServiceName + type: string + jsonPath: ".status.serviceName" + - name: PrivateServiceName + type: string + jsonPath: ".status.privateServiceName" + - name: Ready + type: string + jsonPath: ".status.conditions[?(@.type=='Ready')].status" + - name: Reason + type: string + jsonPath: ".status.conditions[?(@.type=='Ready')].reason" + names: + kind: ServerlessService + plural: serverlessservices + singular: serverlessservice + categories: + - knative-internal + - networking + shortNames: + - sks + scope: Namespaced +--- +# Copyright 2019 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# Note: The schema part of the spec is auto-generated by hack/update-schemas.sh. + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: services.serving.knative.dev + labels: + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" + knative.dev/crd-install: "true" + duck.knative.dev/addressable: "true" + duck.knative.dev/podspecable: "true" +spec: + group: serving.knative.dev + names: + kind: Service + plural: services + singular: service + categories: + - all + - knative + - serving + shortNames: + - kservice + - ksvc + scope: Namespaced + versions: + - name: v1 + served: true + storage: true + subresources: + status: {} + additionalPrinterColumns: + - name: URL + type: string + jsonPath: .status.url + - name: LatestCreated + type: string + jsonPath: .status.latestCreatedRevisionName + - name: LatestReady + type: string + jsonPath: .status.latestReadyRevisionName + - name: Ready + type: string + jsonPath: ".status.conditions[?(@.type=='Ready')].status" + - name: Reason + type: string + jsonPath: ".status.conditions[?(@.type=='Ready')].reason" + schema: + openAPIV3Schema: + description: |- + Service acts as a top-level container that manages a Route and Configuration + which implement a network service. Service exists to provide a singular + abstraction which can be access controlled, reasoned about, and which + encapsulates software lifecycle decisions such as rollout policy and + team resource ownership. Service acts only as an orchestrator of the + underlying Routes and Configurations (much as a kubernetes Deployment + orchestrates ReplicaSets), and its usage is optional but recommended. + + The Service's controller will track the statuses of its owned Configuration + and Route, reflecting their statuses and conditions as its own. + + See also: https://github.com/knative/serving/blob/main/docs/spec/overview.md#service + type: object + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: |- + ServiceSpec represents the configuration for the Service object. + A Service's specification is the union of the specifications for a Route + and Configuration. The Service restricts what can be expressed in these + fields, e.g. the Route must reference the provided Configuration; + however, these limitations also enable friendlier defaulting, + e.g. Route never needs a Configuration name, and may be defaulted to + the appropriate "run latest" spec. + type: object + properties: + template: + description: Template holds the latest specification for the Revision to be stamped out. + type: object + properties: + metadata: + type: object + properties: + annotations: + type: object + additionalProperties: + type: string + finalizers: + type: array + items: + type: string + labels: + type: object + additionalProperties: + type: string + name: + type: string + namespace: + type: string + x-kubernetes-preserve-unknown-fields: true + spec: + description: RevisionSpec holds the desired state of the Revision (from the client). + type: object + required: + - containers + properties: + affinity: + description: This is accessible behind a feature flag - kubernetes.podspec-affinity + type: object + x-kubernetes-preserve-unknown-fields: true + automountServiceAccountToken: + description: AutomountServiceAccountToken indicates whether a service account token should be automatically mounted. + type: boolean + containerConcurrency: + description: |- + ContainerConcurrency specifies the maximum allowed in-flight (concurrent) + requests per container of the Revision. Defaults to `0` which means + concurrency to the application is not limited, and the system decides the + target concurrency for the autoscaler. + type: integer + format: int64 + containers: + description: |- + List of containers belonging to the pod. + Containers cannot currently be added or removed. + There must be at least one container in a Pod. + Cannot be updated. + type: array + items: + description: A single application container that you want to run within a pod. + type: object + properties: + args: + description: |- + Arguments to the entrypoint. + The container image's CMD is used if this is not provided. + Variable references $(VAR_NAME) are expanded using the container's environment. If a variable + cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will + produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless + of whether the variable exists or not. Cannot be updated. + More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell + type: array + items: + type: string + x-kubernetes-list-type: atomic + command: + description: |- + Entrypoint array. Not executed within a shell. + The container image's ENTRYPOINT is used if this is not provided. + Variable references $(VAR_NAME) are expanded using the container's environment. If a variable + cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will + produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless + of whether the variable exists or not. Cannot be updated. + More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell + type: array + items: + type: string + x-kubernetes-list-type: atomic + env: + description: |- + List of environment variables to set in the container. + Cannot be updated. + type: array + items: + description: EnvVar represents an environment variable present in a Container. + type: object + required: + - name + properties: + name: + description: |- + Name of the environment variable. + May consist of any printable ASCII characters except '='. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's value. Cannot be used if value is not empty. + type: object + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + type: object + required: + - key + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap or its key must be defined + type: boolean + x-kubernetes-map-type: atomic + fieldRef: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-fieldref + type: object + x-kubernetes-map-type: atomic + x-kubernetes-preserve-unknown-fields: true + resourceFieldRef: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-fieldref + type: object + x-kubernetes-map-type: atomic + x-kubernetes-preserve-unknown-fields: true + secretKeyRef: + description: Selects a key of a secret in the pod's namespace + type: object + required: + - key + properties: + key: + description: The key of the secret to select from. Must be a valid secret key. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret or its key must be defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + envFrom: + description: |- + List of sources to populate environment variables in the container. + The keys defined within a source may consist of any printable ASCII characters except '='. + When a key exists in multiple + sources, the value associated with the last source will take precedence. + Values defined by an Env with a duplicate key will take precedence. + Cannot be updated. + type: array + items: + description: EnvFromSource represents the source of a set of ConfigMaps or Secrets + type: object + properties: + configMapRef: + description: The ConfigMap to select from + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap must be defined + type: boolean + x-kubernetes-map-type: atomic + prefix: + description: |- + Optional text to prepend to the name of each environment variable. + May consist of any printable ASCII characters except '='. + type: string + secretRef: + description: The Secret to select from + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret must be defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + image: + description: |- + Container image name. + More info: https://kubernetes.io/docs/concepts/containers/images + This field is optional to allow higher level config management to default or override + container images in workload controllers like Deployments and StatefulSets. + type: string + imagePullPolicy: + description: |- + Image pull policy. + One of Always, Never, IfNotPresent. + Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/containers/images#updating-images + type: string + livenessProbe: + description: |- + Periodic probe of container liveness. + Container will be restarted if the probe fails. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: object + properties: + exec: + description: Exec specifies a command to execute in the container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + failureThreshold: + description: |- + Minimum consecutive failures for the probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. + type: integer + format: int32 + grpc: + description: GRPC specifies a GRPC HealthCheckRequest. + type: object + properties: + port: + description: Port number of the gRPC service. Number must be in the range 1 to 65535. + type: integer + format: int32 + service: + description: |- + Service is the name of the service to place in the gRPC HealthCheckRequest + (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + + If this is not specified, the default behavior is defined by gRPC. + type: string + default: "" + httpGet: + description: HTTPGet specifies an HTTP GET request to perform. + type: object + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + initialDelaySeconds: + description: |- + Number of seconds after the container has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + periodSeconds: + description: |- + How often (in seconds) to perform the probe. + type: integer + format: int32 + successThreshold: + description: |- + Minimum consecutive successes for the probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. + type: integer + format: int32 + tcpSocket: + description: TCPSocket specifies a connection to a TCP port. + type: object + properties: + host: + description: 'Optional: Host name to connect to, defaults to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + timeoutSeconds: + description: |- + Number of seconds after which the probe times out. + Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + name: + description: |- + Name of the container specified as a DNS_LABEL. + Each container in a pod must have a unique name (DNS_LABEL). + Cannot be updated. + type: string + ports: + description: |- + List of ports to expose from the container. Not specifying a port here + DOES NOT prevent that port from being exposed. Any port which is + listening on the default "0.0.0.0" address inside a container will be + accessible from the network. + Modifying this array with strategic merge patch may corrupt the data. + For more information See https://github.com/kubernetes/kubernetes/issues/108255. + Cannot be updated. + type: array + items: + description: ContainerPort represents a network port in a single container. + type: object + properties: + containerPort: + description: |- + Number of port to expose on the pod's IP address. + This must be a valid port number, 0 < x < 65536. + type: integer + format: int32 + name: + description: |- + If specified, this must be an IANA_SVC_NAME and unique within the pod. Each + named port in a pod must have a unique name. Name for the port that can be + referred to by services. + type: string + protocol: + description: |- + Protocol for port. Must be UDP, TCP, or SCTP. + Defaults to "TCP". + type: string + default: TCP + readinessProbe: + description: |- + Periodic probe of container service readiness. + Container will be removed from service endpoints if the probe fails. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: object + properties: + exec: + description: Exec specifies a command to execute in the container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + failureThreshold: + description: |- + Minimum consecutive failures for the probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. + type: integer + format: int32 + grpc: + description: GRPC specifies a GRPC HealthCheckRequest. + type: object + properties: + port: + description: Port number of the gRPC service. Number must be in the range 1 to 65535. + type: integer + format: int32 + service: + description: |- + Service is the name of the service to place in the gRPC HealthCheckRequest + (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + + If this is not specified, the default behavior is defined by gRPC. + type: string + default: "" + httpGet: + description: HTTPGet specifies an HTTP GET request to perform. + type: object + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + initialDelaySeconds: + description: |- + Number of seconds after the container has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + periodSeconds: + description: |- + How often (in seconds) to perform the probe. + type: integer + format: int32 + successThreshold: + description: |- + Minimum consecutive successes for the probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. + type: integer + format: int32 + tcpSocket: + description: TCPSocket specifies a connection to a TCP port. + type: object + properties: + host: + description: 'Optional: Host name to connect to, defaults to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + timeoutSeconds: + description: |- + Number of seconds after which the probe times out. + Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + resources: + description: |- + Compute Resources required by this container. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + properties: + limits: + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + requests: + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + securityContext: + description: |- + SecurityContext defines the security options the container should be run with. + If set, the fields of SecurityContext override the equivalent fields of PodSecurityContext. + More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ + type: object + properties: + allowPrivilegeEscalation: + description: |- + AllowPrivilegeEscalation controls whether a process can gain more + privileges than its parent process. This bool directly controls if + the no_new_privs flag will be set on the container process. + AllowPrivilegeEscalation is true always when the container is: + 1) run as Privileged + 2) has CAP_SYS_ADMIN + Note that this field cannot be set when spec.os.name is windows. + type: boolean + capabilities: + description: |- + The capabilities to add/drop when running containers. + Defaults to the default set of capabilities granted by the container runtime. + Note that this field cannot be set when spec.os.name is windows. + type: object + properties: + add: + description: This is accessible behind a feature flag - kubernetes.containerspec-addcapabilities + type: array + items: + description: Capability represent POSIX capabilities type + type: string + x-kubernetes-list-type: atomic + drop: + description: Removed capabilities + type: array + items: + description: Capability represent POSIX capabilities type + type: string + x-kubernetes-list-type: atomic + privileged: + description: |- + Run container in privileged mode. This can only be set to explicitly to 'false' + type: boolean + readOnlyRootFilesystem: + description: |- + Whether this container has a read-only root filesystem. + Default is false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + runAsGroup: + description: |- + The GID to run the entrypoint of the container process. + Uses runtime default if unset. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + runAsNonRoot: + description: |- + Indicates that the container must run as a non-root user. + If true, the Kubelet will validate the image at runtime to ensure that it + does not run as UID 0 (root) and fail to start the container if it does. + If unset or false, no such validation will be performed. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: boolean + runAsUser: + description: |- + The UID to run the entrypoint of the container process. + Defaults to user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + seccompProfile: + description: |- + The seccomp options to use by this container. If seccomp options are + provided at both the pod & container level, the container options + override the pod options. + Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile defined in a file on the node should be used. + The profile must be preconfigured on the node to work. + Must be a descending path, relative to the kubelet's configured seccomp profile location. + Must be set if type is "Localhost". Must NOT be set for any other type. + type: string + type: + description: |- + type indicates which kind of seccomp profile will be applied. + Valid options are: + + Localhost - a profile defined in a file on the node should be used. + RuntimeDefault - the container runtime default profile should be used. + Unconfined - no profile should be applied. + type: string + startupProbe: + description: |- + StartupProbe indicates that the Pod has successfully initialized. + If specified, no other probes are executed until this completes successfully. + If this probe fails, the Pod will be restarted, just as if the livenessProbe failed. + This can be used to provide different probe parameters at the beginning of a Pod's lifecycle, + when it might take a long time to load data or warm a cache, than during steady-state operation. + This cannot be updated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: object + properties: + exec: + description: Exec specifies a command to execute in the container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + failureThreshold: + description: |- + Minimum consecutive failures for the probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. + type: integer + format: int32 + grpc: + description: GRPC specifies a GRPC HealthCheckRequest. + type: object + properties: + port: + description: Port number of the gRPC service. Number must be in the range 1 to 65535. + type: integer + format: int32 + service: + description: |- + Service is the name of the service to place in the gRPC HealthCheckRequest + (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + + If this is not specified, the default behavior is defined by gRPC. + type: string + default: "" + httpGet: + description: HTTPGet specifies an HTTP GET request to perform. + type: object + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + initialDelaySeconds: + description: |- + Number of seconds after the container has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + periodSeconds: + description: |- + How often (in seconds) to perform the probe. + type: integer + format: int32 + successThreshold: + description: |- + Minimum consecutive successes for the probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. + type: integer + format: int32 + tcpSocket: + description: TCPSocket specifies a connection to a TCP port. + type: object + properties: + host: + description: 'Optional: Host name to connect to, defaults to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + timeoutSeconds: + description: |- + Number of seconds after which the probe times out. + Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + terminationMessagePath: + description: |- + Optional: Path at which the file to which the container's termination message + will be written is mounted into the container's filesystem. + Message written is intended to be brief final status, such as an assertion failure message. + Will be truncated by the node if greater than 4096 bytes. The total message length across + all containers will be limited to 12kb. + Defaults to /dev/termination-log. + Cannot be updated. + type: string + terminationMessagePolicy: + description: |- + Indicate how the termination message should be populated. File will use the contents of + terminationMessagePath to populate the container status message on both success and failure. + FallbackToLogsOnError will use the last chunk of container log output if the termination + message file is empty and the container exited with an error. + The log output is limited to 2048 bytes or 80 lines, whichever is smaller. + Defaults to File. + Cannot be updated. + type: string + volumeMounts: + description: |- + Pod volumes to mount into the container's filesystem. + Cannot be updated. + type: array + items: + description: VolumeMount describes a mounting of a Volume within a container. + type: object + required: + - mountPath + - name + properties: + mountPath: + description: |- + Path within the container at which the volume should be mounted. Must + not contain ':'. + type: string + mountPropagation: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-volumes-mount-propagation + type: string + name: + description: This must match the Name of a Volume. + type: string + readOnly: + description: |- + Mounted read-only if true, read-write otherwise (false or unspecified). + Defaults to false. + type: boolean + subPath: + description: |- + Path within the volume from which the container's volume should be mounted. + Defaults to "" (volume's root). + type: string + x-kubernetes-list-map-keys: + - mountPath + x-kubernetes-list-type: map + workingDir: + description: |- + Container's working directory. + If not specified, the container runtime's default will be used, which + might be configured in the container image. + Cannot be updated. + type: string + dnsConfig: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-dnsconfig + type: object + x-kubernetes-preserve-unknown-fields: true + dnsPolicy: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-dnspolicy + type: string + enableServiceLinks: + description: |- + EnableServiceLinks indicates whether information aboutservices should be injected into pod's environment variables, matching the syntax of Docker links. Optional: Knative defaults this to false. + type: boolean + hostAliases: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-hostaliases + type: array + items: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-hostaliases + type: object + x-kubernetes-preserve-unknown-fields: true + hostIPC: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-hostipc + type: boolean + hostNetwork: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-hostnetwork + type: boolean + hostPID: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-hostpid + type: boolean + idleTimeoutSeconds: + description: |- + IdleTimeoutSeconds is the maximum duration in seconds a request will be allowed + to stay open while not receiving any bytes from the user's application. If + unspecified, a system default will be provided. + type: integer + format: int64 + imagePullSecrets: + description: |- + ImagePullSecrets is an optional list of references to secrets in the same namespace to use for pulling any of the images used by this PodSpec. + If specified, these secrets will be passed to individual puller implementations for them to use. + More info: https://kubernetes.io/docs/concepts/containers/images#specifying-imagepullsecrets-on-a-pod + type: array + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + x-kubernetes-map-type: atomic + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + initContainers: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-init-containers + type: array + items: + description: This is accessible behind a feature flag - kubernetes.podspec-init-containers + type: object + x-kubernetes-preserve-unknown-fields: true + nodeSelector: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-nodeselector + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + priorityClassName: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-priorityclassname + type: string + responseStartTimeoutSeconds: + description: |- + ResponseStartTimeoutSeconds is the maximum duration in seconds that the request + routing layer will wait for a request delivered to a container to begin + sending any network traffic. + type: integer + format: int64 + runtimeClassName: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-runtimeclassname + type: string + schedulerName: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-schedulername + type: string + securityContext: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-securitycontext + type: object + x-kubernetes-preserve-unknown-fields: true + serviceAccountName: + description: |- + ServiceAccountName is the name of the ServiceAccount to use to run this pod. + More info: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/ + type: string + shareProcessNamespace: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-shareprocessnamespace + type: boolean + timeoutSeconds: + description: |- + TimeoutSeconds is the maximum duration in seconds that the request instance + is allowed to respond to a request. If unspecified, a system default will + be provided. + type: integer + format: int64 + tolerations: + description: This is accessible behind a feature flag - kubernetes.podspec-tolerations + type: array + items: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-tolerations + type: object + x-kubernetes-preserve-unknown-fields: true + topologySpreadConstraints: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints + type: array + items: + description: This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints + type: object + x-kubernetes-preserve-unknown-fields: true + volumes: + description: |- + List of volumes that can be mounted by containers belonging to the pod. + More info: https://kubernetes.io/docs/concepts/storage/volumes + type: array + items: + description: Volume represents a named volume in a pod that may be accessed by any container in the pod. + type: object + required: + - name + properties: + configMap: + description: configMap represents a configMap that should populate this volume + type: object + properties: + defaultMode: + description: |- + defaultMode is optional: mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + Defaults to 0644. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + ConfigMap will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the ConfigMap, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: optional specify whether the ConfigMap or its keys must be defined + type: boolean + x-kubernetes-map-type: atomic + csi: + description: This is accessible behind a feature flag - kubernetes.podspec-volumes-csi + type: object + x-kubernetes-preserve-unknown-fields: true + emptyDir: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-volumes-emptydir + type: object + x-kubernetes-preserve-unknown-fields: true + hostPath: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-volumes-hostpath + type: object + x-kubernetes-preserve-unknown-fields: true + image: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-volumes-image + type: object + x-kubernetes-preserve-unknown-fields: true + name: + description: |- + name of the volume. + Must be a DNS_LABEL and unique within the pod. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + persistentVolumeClaim: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-persistent-volume-claim + type: object + x-kubernetes-preserve-unknown-fields: true + projected: + description: projected items for all in one resources secrets, configmaps, and downward API + type: object + properties: + defaultMode: + description: |- + defaultMode are the mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + sources: + description: |- + sources is the list of volume projections. Each entry in this list + handles one source. + type: array + items: + description: |- + Projection that may be projected along with other supported volume types. + Exactly one of these fields must be set. + type: object + properties: + configMap: + description: configMap information about the configMap data to project + type: object + properties: + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + ConfigMap will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the ConfigMap, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: optional specify whether the ConfigMap or its keys must be defined + type: boolean + x-kubernetes-map-type: atomic + downwardAPI: + description: downwardAPI information about the downwardAPI data to project + type: object + properties: + items: + description: Items is a list of DownwardAPIVolume file + type: array + items: + description: DownwardAPIVolumeFile represents information to create the file containing the pod field + type: object + required: + - path + properties: + fieldRef: + description: 'Required: Selects a field of the pod: only annotations, labels, name, namespace and uid are supported.' + type: object + required: + - fieldPath + properties: + apiVersion: + description: Version of the schema the FieldPath is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in the specified API version. + type: string + x-kubernetes-map-type: atomic + mode: + description: |- + Optional: mode bits used to set permissions on this file, must be an octal value + between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: 'Required: Path is the relative path name of the file to be created. Must not be absolute or contain the ''..'' path. Must be utf-8 encoded. The first item of the relative path must not start with ''..''' + type: string + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported. + type: object + required: + - resource + properties: + containerName: + description: 'Container name: required for volumes, optional for env vars' + type: string + divisor: + description: Specifies the output format of the exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + secret: + description: secret information about the secret data to project + type: object + properties: + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + Secret will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the Secret, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: optional field specify whether the Secret or its key must be defined + type: boolean + x-kubernetes-map-type: atomic + serviceAccountToken: + description: serviceAccountToken is information about the serviceAccountToken data to project + type: object + required: + - path + properties: + audience: + description: |- + audience is the intended audience of the token. A recipient of a token + must identify itself with an identifier specified in the audience of the + token, and otherwise should reject the token. The audience defaults to the + identifier of the apiserver. + type: string + expirationSeconds: + description: |- + expirationSeconds is the requested duration of validity of the service + account token. As the token approaches expiration, the kubelet volume + plugin will proactively rotate the service account token. The kubelet will + start trying to rotate the token if the token is older than 80 percent of + its time to live or if the token is older than 24 hours.Defaults to 1 hour + and must be at least 10 minutes. + type: integer + format: int64 + path: + description: |- + path is the path relative to the mount point of the file to project the + token into. + type: string + x-kubernetes-list-type: atomic + secret: + description: |- + secret represents a secret that should populate this volume. + More info: https://kubernetes.io/docs/concepts/storage/volumes#secret + type: object + properties: + defaultMode: + description: |- + defaultMode is Optional: mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values + for mode bits. Defaults to 0644. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + items: + description: |- + items If unspecified, each key-value pair in the Data field of the referenced + Secret will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the Secret, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + optional: + description: optional field specify whether the Secret or its keys must be defined + type: boolean + secretName: + description: |- + secretName is the name of the secret in the pod's namespace to use. + More info: https://kubernetes.io/docs/concepts/storage/volumes#secret + type: string + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + traffic: + description: |- + Traffic specifies how to distribute traffic over a collection of + revisions and configurations. + type: array + items: + description: TrafficTarget holds a single entry of the routing table for a Route. + type: object + properties: + configurationName: + description: |- + ConfigurationName of a configuration to whose latest revision we will send + this portion of traffic. When the "status.latestReadyRevisionName" of the + referenced configuration changes, we will automatically migrate traffic + from the prior "latest ready" revision to the new one. This field is never + set in Route's status, only its spec. This is mutually exclusive with + RevisionName. + type: string + latestRevision: + description: |- + LatestRevision may be optionally provided to indicate that the latest + ready Revision of the Configuration should be used for this traffic + target. When provided LatestRevision must be true if RevisionName is + empty; it must be false when RevisionName is non-empty. + type: boolean + percent: + description: |- + Percent indicates that percentage based routing should be used and + the value indicates the percent of traffic that is be routed to this + Revision or Configuration. `0` (zero) mean no traffic, `100` means all + traffic. + When percentage based routing is being used the follow rules apply: + - the sum of all percent values must equal 100 + - when not specified, the implied value for `percent` is zero for + that particular Revision or Configuration + type: integer + format: int64 + revisionName: + description: |- + RevisionName of a specific revision to which to send this portion of + traffic. This is mutually exclusive with ConfigurationName. + type: string + tag: + description: |- + Tag is optionally used to expose a dedicated url for referencing + this target exclusively. + type: string + url: + description: |- + URL displays the URL for accessing named traffic targets. URL is displayed in + status, and is disallowed on spec. URL must contain a scheme (e.g. http://) and + a hostname, but may not contain anything else (e.g. basic auth, url path, etc.) + type: string + status: + description: ServiceStatus represents the Status stanza of the Service resource. + type: object + properties: + address: + description: Address holds the information needed for a Route to be the target of an event. + type: object + properties: + CACerts: + description: |- + CACerts is the Certification Authority (CA) certificates in PEM format + according to https://www.rfc-editor.org/rfc/rfc7468. + type: string + audience: + description: Audience is the OIDC audience for this address. + type: string + name: + description: Name is the name of the address. + type: string + url: + type: string + annotations: + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + additionalProperties: + type: string + conditions: + description: Conditions the latest available observations of a resource's current state. + type: array + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + type: object + required: + - status + - type + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating details about the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, False, Unknown. + type: string + type: + description: Type of condition. + type: string + latestCreatedRevisionName: + description: |- + LatestCreatedRevisionName is the last revision that was created from this + Configuration. It might not be ready yet, for that use LatestReadyRevisionName. + type: string + latestReadyRevisionName: + description: |- + LatestReadyRevisionName holds the name of the latest Revision stamped out + from this Configuration that has had its "Ready" condition become "True". + type: string + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + type: integer + format: int64 + traffic: + description: |- + Traffic holds the configured traffic distribution. + These entries will always contain RevisionName references. + When ConfigurationName appears in the spec, this will hold the + LatestReadyRevisionName that we last observed. + type: array + items: + description: TrafficTarget holds a single entry of the routing table for a Route. + type: object + properties: + configurationName: + description: |- + ConfigurationName of a configuration to whose latest revision we will send + this portion of traffic. When the "status.latestReadyRevisionName" of the + referenced configuration changes, we will automatically migrate traffic + from the prior "latest ready" revision to the new one. This field is never + set in Route's status, only its spec. This is mutually exclusive with + RevisionName. + type: string + latestRevision: + description: |- + LatestRevision may be optionally provided to indicate that the latest + ready Revision of the Configuration should be used for this traffic + target. When provided LatestRevision must be true if RevisionName is + empty; it must be false when RevisionName is non-empty. + type: boolean + percent: + description: |- + Percent indicates that percentage based routing should be used and + the value indicates the percent of traffic that is be routed to this + Revision or Configuration. `0` (zero) mean no traffic, `100` means all + traffic. + When percentage based routing is being used the follow rules apply: + - the sum of all percent values must equal 100 + - when not specified, the implied value for `percent` is zero for + that particular Revision or Configuration + type: integer + format: int64 + revisionName: + description: |- + RevisionName of a specific revision to which to send this portion of + traffic. This is mutually exclusive with ConfigurationName. + type: string + tag: + description: |- + Tag is optionally used to expose a dedicated url for referencing + this target exclusively. + type: string + url: + description: |- + URL displays the URL for accessing named traffic targets. URL is displayed in + status, and is disallowed on spec. URL must contain a scheme (e.g. http://) and + a hostname, but may not contain anything else (e.g. basic auth, url path, etc.) + type: string + url: + description: |- + URL holds the url that will distribute traffic over the provided traffic targets. + It generally has the form http[s]://{route-name}.{route-namespace}.{cluster-level-suffix} + type: string +--- +# Copyright 2018 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: images.caching.internal.knative.dev + labels: + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" + knative.dev/crd-install: "true" +spec: + group: caching.internal.knative.dev + names: + kind: Image + plural: images + singular: image + categories: + - knative-internal + - caching + scope: Namespaced + versions: + - name: v1alpha1 + served: true + storage: true + subresources: + status: {} + schema: + openAPIV3Schema: + description: |- + Image is a Knative abstraction that encapsulates the interface by which Knative + components express a desire to have a particular image cached. + type: object + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: Spec holds the desired state of the Image (from the client). + type: object + required: + - image + properties: + image: + description: Image is the name of the container image url to cache across the cluster. + type: string + imagePullSecrets: + description: |- + ImagePullSecrets contains the names of the Kubernetes Secrets containing login + information used by the Pods which will run this container. + type: array + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + x-kubernetes-map-type: atomic + serviceAccountName: + description: |- + ServiceAccountName is the name of the Kubernetes ServiceAccount as which the Pods + will run this container. This is potentially used to authenticate the image pull + if the service account has attached pull secrets. For more information: + https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#add-imagepullsecrets-to-a-service-account + type: string + status: + description: Status communicates the observed state of the Image (from the controller). + type: object + properties: + annotations: + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + additionalProperties: + type: string + conditions: + description: Conditions the latest available observations of a resource's current state. + type: array + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + type: object + required: + - status + - type + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating details about the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, False, Unknown. + type: string + type: + description: Type of condition. + type: string + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + type: integer + format: int64 + additionalPrinterColumns: + - name: Image + type: string + jsonPath: .spec.image +--- +# Source: https://github.com/knative/serving/releases/download/knative-v1.22.1/serving-core.yaml +--- +# Copyright 2018 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: Namespace +metadata: + name: knative-serving + labels: + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" +--- +# Copyright 2023 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +kind: Role +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: knative-serving-activator + namespace: knative-serving + labels: + serving.knative.dev/controller: "true" + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +rules: + - apiGroups: [""] + resources: ["configmaps", "secrets"] + verbs: ["get", "list", "watch"] + - apiGroups: [""] + resources: ["secrets"] + verbs: ["get", "list", "watch"] + resourceNames: ["routing-serving-certs", "knative-serving-certs"] +--- +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: knative-serving-activator-cluster + labels: + serving.knative.dev/controller: "true" + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +rules: + - apiGroups: [""] + resources: ["services", "endpoints"] + verbs: ["get", "list", "watch"] + - apiGroups: ["serving.knative.dev"] + resources: ["revisions"] + verbs: ["get", "list", "watch"] +--- +# Copyright 2019 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# Use this aggregated ClusterRole when you need readonly access to "Addressables" +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + # Named like this to avoid clashing with eventing's existing `addressable-resolver` role + # (which should be identical, but isn't guaranteed to be installed alongside serving). + name: knative-serving-aggregated-addressable-resolver + labels: + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +aggregationRule: + clusterRoleSelectors: + - matchLabels: + duck.knative.dev/addressable: "true" +--- +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: knative-serving-addressable-resolver + labels: + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving + # Labeled to facilitate aggregated cluster roles that act on Addressables. + duck.knative.dev/addressable: "true" +# Do not use this role directly. These rules will be added to the "addressable-resolver" role. +rules: + - apiGroups: + - serving.knative.dev + resources: + - routes + - routes/status + - services + - services/status + verbs: + - get + - list + - watch +--- +# Copyright 2019 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: knative-serving-namespaced-admin + labels: + rbac.authorization.k8s.io/aggregate-to-admin: "true" + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +rules: + - apiGroups: ["serving.knative.dev"] + resources: ["*"] + verbs: ["*"] + - apiGroups: ["networking.internal.knative.dev", "autoscaling.internal.knative.dev", "caching.internal.knative.dev"] + resources: ["*"] + verbs: ["get", "list", "watch"] +--- +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: knative-serving-namespaced-edit + labels: + rbac.authorization.k8s.io/aggregate-to-edit: "true" + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +rules: + - apiGroups: ["serving.knative.dev"] + resources: ["*"] + verbs: ["create", "update", "patch", "delete"] + - apiGroups: ["networking.internal.knative.dev", "autoscaling.internal.knative.dev", "caching.internal.knative.dev"] + resources: ["*"] + verbs: ["get", "list", "watch"] +--- +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: knative-serving-namespaced-view + labels: + rbac.authorization.k8s.io/aggregate-to-view: "true" + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +rules: + - apiGroups: ["serving.knative.dev", "networking.internal.knative.dev", "autoscaling.internal.knative.dev", "caching.internal.knative.dev"] + resources: ["*"] + verbs: ["get", "list", "watch"] +--- +# Copyright 2019 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: knative-serving-core + labels: + serving.knative.dev/controller: "true" + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +rules: + - apiGroups: [""] + resources: ["pods", "namespaces", "secrets", "configmaps", "endpoints", "services", "events", "serviceaccounts"] + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] + - apiGroups: [""] + resources: ["endpoints/restricted"] # Permission for RestrictedEndpointsAdmission + verbs: ["create"] + - apiGroups: ["discovery.k8s.io"] + resources: ["endpointslices/restricted"] # Permission for RestrictedEndpointsAdmission + verbs: ["create"] + - apiGroups: [""] + resources: ["namespaces/finalizers"] # finalizers are needed for the owner reference of the webhook + verbs: ["update"] + - apiGroups: ["discovery.k8s.io"] + resources: ["endpointslices"] + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] + - apiGroups: ["apps"] + resources: ["deployments", "deployments/finalizers"] # finalizers are needed for the owner reference of the webhook + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] + - apiGroups: ["admissionregistration.k8s.io"] + resources: ["mutatingwebhookconfigurations", "validatingwebhookconfigurations"] + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] + - apiGroups: ["apiextensions.k8s.io"] + resources: ["customresourcedefinitions", "customresourcedefinitions/status"] + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] + - apiGroups: ["autoscaling"] + resources: ["horizontalpodautoscalers"] + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] + - apiGroups: ["coordination.k8s.io"] + resources: ["leases"] + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] + - apiGroups: ["serving.knative.dev", "autoscaling.internal.knative.dev", "networking.internal.knative.dev"] + resources: ["*", "*/status", "*/finalizers"] + verbs: ["get", "list", "create", "update", "delete", "deletecollection", "patch", "watch"] + - apiGroups: ["caching.internal.knative.dev"] + resources: ["images"] + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] + - apiGroups: ["cert-manager.io"] + resources: ["certificates", "clusterissuers", "certificaterequests", "issuers"] + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] + - apiGroups: ["acme.cert-manager.io"] + resources: ["challenges"] + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] + - apiGroups: ["rbac.authorization.k8s.io"] + resources: ["clusterroles"] + verbs: ["delete"] + resourceNames: ["knative-serving-certmanager"] + - apiGroups: ["*"] + resources: ["*/scale"] + verbs: ["patch"] +--- +# Copyright 2019 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: knative-serving-podspecable-binding + labels: + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving + # Labeled to facilitate aggregated cluster roles that act on PodSpecables. + duck.knative.dev/podspecable: "true" +# Do not use this role directly. These rules will be added to the "podspecable-binder" role. +rules: + - apiGroups: + - serving.knative.dev + resources: + - configurations + - services + verbs: + - list + - watch + - patch +--- +# Copyright 2018 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ServiceAccount +metadata: + name: controller + namespace: knative-serving + labels: + app.kubernetes.io/component: controller + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" +--- +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: knative-serving-admin + labels: + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" +aggregationRule: + clusterRoleSelectors: + - matchLabels: + serving.knative.dev/controller: "true" +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: knative-serving-controller-admin + labels: + app.kubernetes.io/component: controller + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" +subjects: + - kind: ServiceAccount + name: controller + namespace: knative-serving +roleRef: + kind: ClusterRole + name: knative-serving-admin + apiGroup: rbac.authorization.k8s.io +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: knative-serving-controller-addressable-resolver + labels: + app.kubernetes.io/component: controller + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" +subjects: + - kind: ServiceAccount + name: controller + namespace: knative-serving +roleRef: + kind: ClusterRole + name: knative-serving-aggregated-addressable-resolver + apiGroup: rbac.authorization.k8s.io +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: activator + namespace: knative-serving + labels: + app.kubernetes.io/component: activator + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: knative-serving-activator + namespace: knative-serving + labels: + app.kubernetes.io/component: activator + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" +subjects: + - kind: ServiceAccount + name: activator + namespace: knative-serving +roleRef: + kind: Role + name: knative-serving-activator + apiGroup: rbac.authorization.k8s.io +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: knative-serving-activator-cluster + labels: + app.kubernetes.io/component: activator + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" +subjects: + - kind: ServiceAccount + name: activator + namespace: knative-serving +roleRef: + kind: ClusterRole + name: knative-serving-activator-cluster + apiGroup: rbac.authorization.k8s.io +--- +apiVersion: networking.internal.knative.dev/v1alpha1 +kind: Certificate +metadata: + annotations: + networking.knative.dev/certificate.class: cert-manager.certificate.networking.knative.dev + labels: + networking.knative.dev/certificate-type: system-internal + name: routing-serving-certs + namespace: knative-serving +spec: + dnsNames: + - kn-routing + - data-plane.knative.dev # for reverse-compatibility with net-* implementations that do not work with multi-SANs + secretName: routing-serving-certs +--- +# Copyright 2018 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: caching.internal.knative.dev/v1alpha1 +kind: Image +metadata: + name: queue-proxy + namespace: knative-serving + labels: + app.kubernetes.io/component: queue-proxy + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" +spec: + # This is the Go import path for the binary that is containerized + # and substituted here. + image: gcr.io/knative-releases/knative.dev/serving/cmd/queue@sha256:b1af8bda6c1d32b1cf5fbf8f1f6068c5007a5cebf091039fdea83b88b1fd87f4 +--- +# Copyright 2018 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-autoscaler + namespace: knative-serving + labels: + app.kubernetes.io/component: autoscaler + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" + annotations: + knative.dev/example-checksum: "c727b3e8" +data: + _example: | + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this example block and unindented to be in the data block + # to actually change the configuration. + + # The Revision ContainerConcurrency field specifies the maximum number + # of requests the Container can handle at once. Container concurrency + # target percentage is how much of that maximum to use in a stable + # state. E.g. if a Revision specifies ContainerConcurrency of 10, then + # the Autoscaler will try to maintain 7 concurrent connections per pod + # on average. + # Note: this limit will be applied to container concurrency set at every + # level (ConfigMap, Revision Spec or Annotation). + # For legacy and backwards compatibility reasons, this value also accepts + # fractional values in (0, 1] interval (i.e. 0.7 ⇒ 70%). + # Thus minimal percentage value must be greater than 1.0, or it will be + # treated as a fraction. + # NOTE: that this value does not affect actual number of concurrent requests + # the user container may receive, but only the average number of requests + # that the revision pods will receive. + container-concurrency-target-percentage: "70" + + # The container concurrency target default is what the Autoscaler will + # try to maintain when concurrency is used as the scaling metric for the + # Revision and the Revision specifies unlimited concurrency. + # When revision explicitly specifies container concurrency, that value + # will be used as a scaling target for autoscaler. + # When specifying unlimited concurrency, the autoscaler will + # horizontally scale the application based on this target concurrency. + # This is what we call "soft limit" in the documentation, i.e. it only + # affects number of pods and does not affect the number of requests + # individual pod processes. + # The value must be a positive number such that the value multiplied + # by container-concurrency-target-percentage is greater than 0.01. + # NOTE: that this value will be adjusted by application of + # container-concurrency-target-percentage, i.e. by default + # the system will target on average 70 concurrent requests + # per revision pod. + # NOTE: Only one metric can be used for autoscaling a Revision. + container-concurrency-target-default: "100" + + # The requests per second (RPS) target default is what the Autoscaler will + # try to maintain when RPS is used as the scaling metric for a Revision and + # the Revision specifies unlimited RPS. Even when specifying unlimited RPS, + # the autoscaler will horizontally scale the application based on this + # target RPS. + # Must be greater than 1.0. + # NOTE: Only one metric can be used for autoscaling a Revision. + requests-per-second-target-default: "200" + + # The target burst capacity specifies the size of burst in concurrent + # requests that the system operator expects the system will receive. + # Autoscaler will try to protect the system from queueing by introducing + # Activator in the request path if the current spare capacity of the + # service is less than this setting. + # If this setting is 0, then Activator will be in the request path only + # when the revision is scaled to 0. + # If this setting is > 0 and container-concurrency-target-percentage is + # 100% or 1.0, then activator will always be in the request path. + # -1 denotes unlimited target-burst-capacity and activator will always + # be in the request path. + # Other negative values are invalid. + target-burst-capacity: "211" + + # When operating in a stable mode, the autoscaler operates on the + # average concurrency over the stable window. + # Stable window must be in whole seconds. + stable-window: "60s" + + # When observed average concurrency during the panic window reaches + # panic-threshold-percentage the target concurrency, the autoscaler + # enters panic mode. When operating in panic mode, the autoscaler + # scales on the average concurrency over the panic window which is + # panic-window-percentage of the stable-window. + # Must be in the [1, 100] range. + # When computing the panic window it will be rounded to the closest + # whole second, at least 1s. + panic-window-percentage: "10.0" + + # The percentage of the container concurrency target at which to + # enter panic mode when reached within the panic window. + panic-threshold-percentage: "200.0" + + # Max scale up rate limits the rate at which the autoscaler will + # increase pod count. It is the maximum ratio of desired pods versus + # observed pods. + # Cannot be less or equal to 1. + # I.e with value of 2.0 the number of pods can at most go N to 2N + # over single Autoscaler period (2s), but at least N to + # N+1, if Autoscaler needs to scale up. + max-scale-up-rate: "1000.0" + + # Max scale down rate limits the rate at which the autoscaler will + # decrease pod count. It is the maximum ratio of observed pods versus + # desired pods. + # Cannot be less or equal to 1. + # I.e. with value of 2.0 the number of pods can at most go N to N/2 + # over single Autoscaler evaluation period (2s), but at + # least N to N-1, if Autoscaler needs to scale down. + max-scale-down-rate: "2.0" + + # Scale to zero feature flag. + enable-scale-to-zero: "true" + + # Scale to zero grace period is the time an inactive revision is left + # running before it is scaled to zero (must be positive, but recommended + # at least a few seconds if running with mesh networking). + # This is the upper limit and is provided not to enforce timeout after + # the revision stopped receiving requests for stable window, but to + # ensure network reprogramming to put activator in the path has completed. + # If the system determines that a shorter period is satisfactory, + # then the system will only wait that amount of time before scaling to 0. + # NOTE: this period might actually be 0, if activator has been + # in the request path sufficiently long. + # If there is necessity for the last pod to linger longer use + # scale-to-zero-pod-retention-period flag. + scale-to-zero-grace-period: "30s" + + # Scale to zero pod retention period defines the minimum amount + # of time the last pod will remain after Autoscaler has decided to + # scale to zero. + # This flag is for the situations where the pod startup is very expensive + # and the traffic is bursty (requiring smaller windows for fast action), + # but patchy. + # The larger of this flag and `scale-to-zero-grace-period` will effectively + # determine how the last pod will hang around. + scale-to-zero-pod-retention-period: "0s" + + # pod-autoscaler-class specifies the default pod autoscaler class + # that should be used if none is specified. If omitted, + # the Knative Pod Autoscaler (KPA) is used by default. + pod-autoscaler-class: "kpa.autoscaling.knative.dev" + + # The capacity of a single activator task. + # The `unit` is one concurrent request proxied by the activator. + # activator-capacity must be at least 1. + # This value is used for computation of the Activator subset size. + # See the algorithm here: https://bit.ly/38XiCZ3. + # TODO(vagababov): tune after actual benchmarking. + activator-capacity: "100.0" + + # initial-scale is the cluster-wide default value for the initial target + # scale of a revision after creation, unless overridden by the + # "autoscaling.knative.dev/initialScale" annotation. + # This value must be greater than 0 unless allow-zero-initial-scale is true. + initial-scale: "1" + + # allow-zero-initial-scale controls whether either the cluster-wide initial-scale flag, + # or the "autoscaling.knative.dev/initialScale" annotation, can be set to 0. + allow-zero-initial-scale: "false" + + # min-scale is the cluster-wide default value for the min scale of a revision, + # unless overridden by the "autoscaling.knative.dev/minScale" annotation. + min-scale: "0" + + # max-scale is the cluster-wide default value for the max scale of a revision, + # unless overridden by the "autoscaling.knative.dev/maxScale" annotation. + # If set to 0, the revision has no maximum scale. + max-scale: "0" + + # scale-down-delay is the amount of time that must pass at reduced + # concurrency before a scale down decision is applied. This can be useful, + # for example, to maintain replica count and avoid a cold start penalty if + # more requests come in within the scale down delay period. + # The default, 0s, imposes no delay at all. + scale-down-delay: "0s" + + # max-scale-limit sets the maximum permitted value for the max scale of a revision. + # When this is set to a positive value, a revision with a maxScale above that value + # (including a maxScale of "0" = unlimited) is disallowed. + # A value of zero (the default) allows any limit, including unlimited. + max-scale-limit: "0" +--- +# Copyright 2020 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-certmanager + namespace: knative-serving + labels: + app.kubernetes.io/name: knative-serving + app.kubernetes.io/component: controller + app.kubernetes.io/version: "1.22.1" + networking.knative.dev/certificate-provider: cert-manager + annotations: + knative.dev/example-checksum: "b7a9a602" +data: + _example: | + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this block and unindented to actually change the configuration. + + # issuerRef is a reference to the issuer for external-domain certificates used for ingress. + # IssuerRef should be either `ClusterIssuer` or `Issuer`. + # Please refer `IssuerRef` in https://cert-manager.io/docs/concepts/issuer/ + # for more details about IssuerRef configuration. + # If the issuerRef is not specified, the self-signed `knative-selfsigned-issuer` ClusterIssuer is used. + issuerRef: | + kind: ClusterIssuer + name: letsencrypt-issuer + + # clusterLocalIssuerRef is a reference to the issuer for cluster-local-domain certificates used for ingress. + # clusterLocalIssuerRef should be either `ClusterIssuer` or `Issuer`. + # Please refer `IssuerRef` in https://cert-manager.io/docs/concepts/issuer/ + # for more details about ClusterInternalIssuerRef configuration. + # If the clusterLocalIssuerRef is not specified, the self-signed `knative-selfsigned-issuer` ClusterIssuer is used. + clusterLocalIssuerRef: | + kind: ClusterIssuer + name: your-company-issuer + + # systemInternalIssuerRef is a reference to the issuer for certificates for system-internal-tls certificates used by Knative internal components. + # systemInternalIssuerRef should be either `ClusterIssuer` or `Issuer`. + # Please refer `IssuerRef` in https://cert-manager.io/docs/concepts/issuer/ + # for more details about ClusterInternalIssuerRef configuration. + # If the systemInternalIssuerRef is not specified, the self-signed `knative-selfsigned-issuer` ClusterIssuer is used. + systemInternalIssuerRef: | + kind: ClusterIssuer + name: knative-selfsigned-issuer +--- +# Copyright 2019 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-defaults + namespace: knative-serving + labels: + app.kubernetes.io/name: knative-serving + app.kubernetes.io/component: controller + app.kubernetes.io/version: "1.22.1" + annotations: + knative.dev/example-checksum: "5b64ff5c" +data: + _example: | + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this example block and unindented to be in the data block + # to actually change the configuration. + + # revision-timeout-seconds contains the default number of + # seconds to use for the revision's per-request timeout, if + # none is specified. + revision-timeout-seconds: "300" # 5 minutes + + # max-revision-timeout-seconds contains the maximum number of + # seconds that can be used for revision-timeout-seconds. + # This value must be greater than or equal to revision-timeout-seconds. + # If omitted, the system default is used (600 seconds). + # + # If this value is increased, the activator's terminationGracePeriodSeconds + # should also be increased to prevent in-flight requests being disrupted. + max-revision-timeout-seconds: "600" # 10 minutes + + # revision-response-start-timeout-seconds contains the default number of + # seconds a request will be allowed to stay open while waiting to + # receive any bytes from the user's application, if none is specified. + # + # This defaults to 'revision-timeout-seconds' + revision-response-start-timeout-seconds: "300" + + # revision-idle-timeout-seconds contains the default number of + # seconds a request will be allowed to stay open while not receiving any + # bytes from the user's application, if none is specified. + revision-idle-timeout-seconds: "0" # infinite + + # revision-cpu-request contains the cpu allocation to assign + # to revisions by default. If omitted, no value is specified + # and the system default is used. + # Below is an example of setting revision-cpu-request. + # By default, it is not set by Knative. + revision-cpu-request: "400m" # 0.4 of a CPU (aka 400 milli-CPU) + + # revision-memory-request contains the memory allocation to assign + # to revisions by default. If omitted, no value is specified + # and the system default is used. + # Below is an example of setting revision-memory-request. + # By default, it is not set by Knative. + revision-memory-request: "100M" # 100 megabytes of memory + + # revision-ephemeral-storage-request contains the ephemeral storage + # allocation to assign to revisions by default. If omitted, no value is + # specified and the system default is used. + revision-ephemeral-storage-request: "500M" # 500 megabytes of storage + + # revision-cpu-limit contains the cpu allocation to limit + # revisions to by default. If omitted, no value is specified + # and the system default is used. + # Below is an example of setting revision-cpu-limit. + # By default, it is not set by Knative. + revision-cpu-limit: "1000m" # 1 CPU (aka 1000 milli-CPU) + + # revision-memory-limit contains the memory allocation to limit + # revisions to by default. If omitted, no value is specified + # and the system default is used. + # Below is an example of setting revision-memory-limit. + # By default, it is not set by Knative. + revision-memory-limit: "200M" # 200 megabytes of memory + + # revision-ephemeral-storage-limit contains the ephemeral storage + # allocation to limit revisions to by default. If omitted, no value is + # specified and the system default is used. + revision-ephemeral-storage-limit: "750M" # 750 megabytes of storage + + # container-name-template contains a template for the default + # container name, if none is specified. This field supports + # Go templating and is supplied with the ObjectMeta of the + # enclosing Service or Configuration, so values such as + # {{.Name}} are also valid. + container-name-template: "user-container" + + # init-container-name-template contains a template for the default + # init container name, if none is specified. This field supports + # Go templating and is supplied with the ObjectMeta of the + # enclosing Service or Configuration, so values such as + # {{.Name}} are also valid. + init-container-name-template: "init-container" + + # container-concurrency specifies the maximum number + # of requests the Container can handle at once, and requests + # above this threshold are queued. Setting a value of zero + # disables this throttling and lets through as many requests as + # the pod receives. + container-concurrency: "0" + + # The container concurrency max limit is an operator setting ensuring that + # the individual revisions cannot have arbitrary large concurrency + # values, or autoscaling targets. `container-concurrency` default setting + # must be at or below this value. + # + # Must be greater than 1. + # + # Note: even with this set, a user can choose a containerConcurrency + # of 0 (i.e. unbounded) unless allow-container-concurrency-zero is + # set to "false". + container-concurrency-max-limit: "1000" + + # allow-container-concurrency-zero controls whether users can + # specify 0 (i.e. unbounded) for containerConcurrency. + allow-container-concurrency-zero: "true" + + # enable-service-links specifies the default value used for the + # enableServiceLinks field of the PodSpec, when it is omitted by the user. + # See: https://kubernetes.io/docs/concepts/services-networking/connect-applications-service/#accessing-the-service + # + # This is a tri-state flag with possible values of (true|false|default). + # + # In environments with large number of services it is suggested + # to set this value to `false`. + # See https://github.com/knative/serving/issues/8498. + enable-service-links: "false" +--- +# Copyright 2019 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-deployment + namespace: knative-serving + labels: + app.kubernetes.io/name: knative-serving + app.kubernetes.io/component: controller + app.kubernetes.io/version: "1.22.1" + annotations: + knative.dev/example-checksum: "555b4826" +data: + # This is the Go import path for the binary that is containerized + # and substituted here. + queue-sidecar-image: gcr.io/knative-releases/knative.dev/serving/cmd/queue@sha256:b1af8bda6c1d32b1cf5fbf8f1f6068c5007a5cebf091039fdea83b88b1fd87f4 + _example: |- + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this example block and unindented to be in the data block + # to actually change the configuration. + + # List of repositories for which tag to digest resolving should be skipped + registries-skipping-tag-resolving: "kind.local,ko.local,dev.local" + + # Maximum time allowed for an image's digests to be resolved. + digest-resolution-timeout: "10s" + + # Duration we wait for the deployment to be ready before considering it failed. + progress-deadline: "600s" + + # Sets the queue proxy's CPU request. + # If omitted, a default value (currently "25m"), is used. + queue-sidecar-cpu-request: "25m" + + # Sets the queue proxy's CPU limit. + # If omitted, a default value (currently "1000m"), is used when + # `queueproxy.resource-defaults` is set to `Enabled`. + queue-sidecar-cpu-limit: "1000m" + + # Sets the queue proxy's memory request. + # If omitted, a default value (currently "400Mi"), is used when + # `queueproxy.resource-defaults` is set to `Enabled`. + queue-sidecar-memory-request: "400Mi" + + # Sets the queue proxy's memory limit. + # If omitted, a default value (currently "800Mi"), is used when + # `queueproxy.resource-defaults` is set to `Enabled`. + queue-sidecar-memory-limit: "800Mi" + + # Sets the queue proxy's ephemeral storage request. + # If omitted, no value is specified and the system default is used. + queue-sidecar-ephemeral-storage-request: "512Mi" + + # Sets the queue proxy's ephemeral storage limit. + # If omitted, no value is specified and the system default is used. + queue-sidecar-ephemeral-storage-limit: "1024Mi" + + # Sets tokens associated with specific audiences for queue proxy - used by QPOptions + # + # For example, to add the `service-x` audience: + # queue-sidecar-token-audiences: "service-x" + # Also supports a list of audiences, for example: + # queue-sidecar-token-audiences: "service-x,service-y" + # If omitted, or empty, no tokens are created + queue-sidecar-token-audiences: "" + + # Sets rootCA for the queue proxy - used by QPOptions + # If omitted, or empty, no rootCA is added to the golang rootCAs + queue-sidecar-rootca: "" + + # Sets the minimum TLS version for the queue proxy sidecar's TLS server. + # Accepted values: "1.2", "1.3". Default is "1.3" if not specified. + queue-sidecar-tls-min-version: "" + + # Sets the maximum TLS version for the queue proxy sidecar's TLS server. + # Accepted values: "1.2", "1.3". If omitted, the Go default is used. + queue-sidecar-tls-max-version: "" + + # Sets the cipher suites for the queue proxy sidecar's TLS server. + # Comma-separated list of cipher suite names (e.g. "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"). + # If omitted, the Go default cipher suites are used. + # Note: cipher suites are not configurable in TLS 1.3. + queue-sidecar-tls-cipher-suites: "" + + # Sets the elliptic curve preferences for the queue proxy sidecar's TLS server. + # Comma-separated list of curve names (e.g. "X25519,CurveP256"). + # If omitted, the Go default curves are used. + queue-sidecar-tls-curve-preferences: "" + + # If set, it automatically configures pod anti-affinity requirements for all Knative services. + # It employs the `preferredDuringSchedulingIgnoredDuringExecution` weighted pod affinity term, + # aligning with the Knative revision label. It yields the configuration below in all workloads' deployments: + # ` + # affinity: + # podAntiAffinity: + # preferredDuringSchedulingIgnoredDuringExecution: + # - podAffinityTerm: + # topologyKey: kubernetes.io/hostname + # labelSelector: + # matchLabels: + # serving.knative.dev/revision: {{revision-name}} + # weight: 100 + # ` + # This may be "none" or "prefer-spread-revision-over-nodes" (default) + # default-affinity-type: "prefer-spread-revision-over-nodes" + + # runtime-class-name contains the selector for which runtimeClassName + # is selected to put in a revision. + # By default, it is not set by Knative. + # + # Example: + # runtime-class-name: | + # "": + # selector: + # use-default-runc: "yes" + # kata: {} + # gvisor: + # selector: + # use-gvisor: "please" + runtime-class-name: "" + + # pod-is-always-schedulable can be used to define that Pods in the system will always be + # scheduled, and a Revision should not be marked unschedulable. + # Setting this to `true` makes sense if you have cluster-autoscaling set up for your cluster + # where unschedulable Pods trigger the addition of a new Node and are therefore a short and + # transient state. + # + # See https://github.com/knative/serving/issues/14862 + pod-is-always-schedulable: "false" +--- +# Copyright 2018 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-domain + namespace: knative-serving + labels: + app.kubernetes.io/name: knative-serving + app.kubernetes.io/component: controller + app.kubernetes.io/version: "1.22.1" + annotations: + knative.dev/example-checksum: "26c09de5" +data: + _example: | + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this example block and unindented to be in the data block + # to actually change the configuration. + + # Default value for domain. + # Routes having the cluster domain suffix (by default 'svc.cluster.local') + # will not be exposed through Ingress. You can define your own label + # selector to assign that domain suffix to your Route here, or you can set + # the label + # "networking.knative.dev/visibility=cluster-local" + # to achieve the same effect. This shows how to make routes having + # the label app=secret only exposed to the local cluster. + svc.cluster.local: | + selector: + app: secret + + # These are example settings of domain. + # example.com will be used for all routes, but it is the least-specific rule so it + # will only be used if no other domain matches. + example.com: | + + # example.org will be used for routes having app=nonprofit. + example.org: | + selector: + app: nonprofit +--- +# Copyright 2020 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-features + namespace: knative-serving + labels: + app.kubernetes.io/name: knative-serving + app.kubernetes.io/component: controller + app.kubernetes.io/version: "1.22.1" + annotations: + knative.dev/example-checksum: "bee75b26" +data: + _example: |- + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this example block and unindented to be in the data block + # to actually change the configuration. + + # Default SecurityContext settings to secure-by-default values + # if unset. + # + # Disabled - do nothing; no security options are applied + # AllowRootBounded - Applies secure defaults without enforcing strict policies; sets seccompProfile + # to RuntimeDefault and drops all capabilities + # Enabled - Enforces security defaults; sets seccompProfile to RuntimeDefault, drops all capabilities, + # and sets runAsNonRoot to true if not already specified. + secure-pod-defaults: "disabled" + + # Indicates whether multi container support is enabled + # + # WARNING: Cannot safely be disabled once enabled. + # See: https://knative.dev/docs/serving/configuration/feature-flags/#multiple-containers + multi-container: "enabled" + + # Indicates whether multi container probing is enabled + # + # WARNING: Cannot safely be disabled once enabled. + # See: https://knative.dev/docs/serving/configuration/feature-flags/#multiple-container-probing + multi-container-probing: "disabled" + + # Indicates whether Kubernetes affinity support is enabled + # + # WARNING: Cannot safely be disabled once enabled. + # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-node-affinity + kubernetes.podspec-affinity: "disabled" + + # Indicates whether Kubernetes topologySpreadConstraints support is enabled + # + # WARNING: Cannot safely be disabled once enabled. + # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-topology-spread-constraints + kubernetes.podspec-topologyspreadconstraints: "disabled" + + # Indicates whether Kubernetes hostAliases support is enabled + # + # WARNING: Cannot safely be disabled once enabled. + # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-host-aliases + kubernetes.podspec-hostaliases: "disabled" + + # Indicates whether Kubernetes nodeSelector support is enabled + # + # WARNING: Cannot safely be disabled once enabled. + # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-node-selector + kubernetes.podspec-nodeselector: "disabled" + + # Indicates whether Kubernetes tolerations support is enabled + # + # WARNING: Cannot safely be disabled once enabled + # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-toleration + kubernetes.podspec-tolerations: "disabled" + + # Indicates whether Kubernetes FieldRef support is enabled + # + # WARNING: Cannot safely be disabled once enabled. + # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-fieldref + kubernetes.podspec-fieldref: "disabled" + + # Indicates whether Kubernetes RuntimeClassName support is enabled + # + # WARNING: Cannot safely be disabled once enabled. + # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-runtime-class + kubernetes.podspec-runtimeclassname: "disabled" + + # Indicates whether Kubernetes DNSPolicy support is enabled + # + # WARNING: Cannot safely be disabled once enabled. + # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-dnspolicy + kubernetes.podspec-dnspolicy: "disabled" + + # Indicates whether Kubernetes DNSConfig support is enabled + # + # WARNING: Cannot safely be disabled once enabled. + # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-dnsconfig + kubernetes.podspec-dnsconfig: "disabled" + + # This feature allows end-users to set a subset of fields on the Pod's SecurityContext + # + # When set to "enabled" or "allowed" it allows the following + # PodSecurityContext properties: + # - FSGroup + # - RunAsGroup + # - RunAsNonRoot + # - SupplementalGroups + # - RunAsUser + # - SeccompProfile + # + # This feature flag should be used with caution as the PodSecurityContext + # properties may have a side-effect on non-user sidecar containers that come + # from Knative or your service mesh + # + # WARNING: Cannot safely be disabled once enabled. + # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-security-context + kubernetes.podspec-securitycontext: "disabled" + + # Indicated whether sharing the process namespace via ShareProcessNamespace pod spec is allowed. + # This can be especially useful for sharing data from images directly between sidecars + # + # See: https://knative.dev/docs/serving/configuration/feature-flags/#kubernetes-share-process-namespace + kubernetes.podspec-shareprocessnamespace: "disabled" + + # Indicates whether hostIPC support is enabled + # + # WARNING: Cannot safely be disabled once enabled. + # See https://knative.dev/docs/serving/configuration/feature-flags/#kubernetes-host-ipc + kubernetes.podspec-hostipc: "disabled" + + # Indicates whether hostPID support is enabled + # + # WARNING: Cannot safely be disabled once enabled. + # See https://knative.dev/docs/serving/configuration/feature-flags/#kubernetes-host-pid + kubernetes.podspec-hostpid: "disabled" + + # Indicates whether hostNetwork support is enabled + # + # WARNING: Cannot safely be disabled once enabled. + # See See https://knative.dev/docs/serving/configuration/feature-flags/#kubernetes-host-network + kubernetes.podspec-hostnetwork: "disabled" + + # Indicates whether Kubernetes PriorityClassName support is enabled + # + # WARNING: Cannot safely be disabled once enabled. + # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-priority-class-name + kubernetes.podspec-priorityclassname: "disabled" + + # Indicates whether Kubernetes SchedulerName support is enabled + # + # WARNING: Cannot safely be disabled once enabled. + # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-scheduler-name + kubernetes.podspec-schedulername: "disabled" + + # This feature flag allows end-users to add a subset of capabilities on the Pod's SecurityContext. + # + # When set to "enabled" or "allowed" it allows capabilities to be added to the container. + # For a list of possible capabilities, see https://man7.org/linux/man-pages/man7/capabilities.7.html + kubernetes.containerspec-addcapabilities: "disabled" + + + # Controls whether tag header based routing feature are enabled or not. + # 1. Enabled: enabling tag header based routing + # 2. Disabled: disabling tag header based routing + # See: https://knative.dev/docs/serving/feature-flags/#tag-header-based-routing + tag-header-based-routing: "disabled" + + # Controls whether http2 auto-detection should be enabled or not. + # 1. Enabled: http2 connection will be attempted via upgrade. + # 2. Disabled: http2 connection will only be attempted when port name is set to "h2c". + autodetect-http2: "disabled" + + # Controls whether volume support for EmptyDir is enabled or not. + # 1. Enabled: enabling EmptyDir volume support + # 2. Disabled: disabling EmptyDir volume support + kubernetes.podspec-volumes-emptydir: "enabled" + + # Controls whether volume support for image is enabled or not. + # 1. Enabled: enabling image volume support + # 2. Disabled: disabling image volume support + kubernetes.podspec-volumes-image: "disabled" + + # Controls whether volume support for HostPath is enabled or not. + # WARNING: Cannot safely be disabled once enabled. + # WARNING: If you can avoid using a hostPath volume, you should. + # Please read https://kubernetes.io/docs/concepts/storage/volumes/#hostpath before enabling this feature. + # 1. Enabled: enabling HostPath volume support + # 2. Disabled: disabling HostPath volume support + kubernetes.podspec-volumes-hostpath: "disabled" + + # Controls whether volume support for CSI is enabled or not. + # 1. Enabled: enabling CSI volume support + # 2. Disabled: disabling CSI volume support + kubernetes.podspec-volumes-csi: "disabled" + + # Controls whether init containers support is enabled or not. + # 1. Enabled: enabling init containers support + # 2. Disabled: disabling init containers support + kubernetes.podspec-init-containers: "disabled" + + # Controls whether persistent volume claim support is enabled or not. + # 1. Enabled: enabling persistent volume claim support + # 2. Disabled: disabling persistent volume claim support + kubernetes.podspec-persistent-volume-claim: "disabled" + + # Controls whether write access for persistent volumes is enabled or not. + # 1. Enabled: enabling write access for persistent volumes + # 2. Disabled: disabling write access for persistent volumes + kubernetes.podspec-persistent-volume-write: "disabled" + + # Controls whether volume mount propagation support is enabled or not. + # 1. Enabled: enabling volume mount propagation support + # 2. Disabled: disabling volume mount propagation support + kubernetes.podspec-volumes-mount-propagation: "disabled" + + # Controls if the queue proxy podInfo feature is enabled, allowed or disabled + # + # This feature should be enabled/allowed when using queue proxy Options (Extensions) + # Enabling will mount a podInfo volume to the queue proxy container. + # The volume will contains an 'annotations' file (from the pod's annotation field). + # The annotations in this file include the Service annotations set by the client creating the service. + # If mounted, the annotations can be accessed by queue proxy extensions at /etc/podinfo/annotations + # + # 1. "enabled": always mount a podInfo volume + # 2. "disabled": never mount a podInfo volume + # 3. "allowed": by default, do not mount a podInfo volume + # However, a client may mount the podInfo volume on an individual Service by attaching + # the following metadata annotation to the Service: "features.knative.dev/queueproxy-podinfo":"enabled". + # + # NOTE THAT THIS IS AN EXPERIMENTAL / ALPHA FEATURE + queueproxy.mount-podinfo: "disabled" + + # Default queue proxy resource requests and limits to good values for most cases if set. + queueproxy.resource-defaults: "disabled" +--- +# Copyright 2018 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-gc + namespace: knative-serving + labels: + app.kubernetes.io/name: knative-serving + app.kubernetes.io/component: controller + app.kubernetes.io/version: "1.22.1" + annotations: + knative.dev/example-checksum: "aa3813a8" +data: + _example: | + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this example block and unindented to be in the data block + # to actually change the configuration. + + # --------------------------------------- + # Garbage Collector Settings + # --------------------------------------- + # + # Active + # * Revisions which are referenced by a Route are considered active. + # * Individual revisions may be marked with the annotation + # "serving.knative.dev/no-gc":"true" to be permanently considered active. + # * Active revisions are not considered for GC. + # Retention + # * Revisions are retained if they are any of the following: + # 1. Active + # 2. Were created within "retain-since-create-time" + # 3. Were last referenced by a route within + # "retain-since-last-active-time" + # 4. There are fewer than "min-non-active-revisions" + # If none of these conditions are met, or if the count of revisions exceed + # "max-non-active-revisions", they will be deleted by GC. + # The special value "disabled" may be used to turn off these limits. + # + # Example config to immediately collect any inactive revision: + # min-non-active-revisions: "0" + # max-non-active-revisions: "0" + # retain-since-create-time: "disabled" + # retain-since-last-active-time: "disabled" + # + # Example config to always keep around the last ten non-active revisions: + # retain-since-create-time: "disabled" + # retain-since-last-active-time: "disabled" + # max-non-active-revisions: "10" + # + # Example config to disable all garbage collection: + # retain-since-create-time: "disabled" + # retain-since-last-active-time: "disabled" + # max-non-active-revisions: "disabled" + # + # Example config to keep recently deployed or active revisions, + # always maintain the last two in case of rollback, and prevent + # burst activity from exploding the count of old revisions: + # retain-since-create-time: "48h" + # retain-since-last-active-time: "15h" + # min-non-active-revisions: "2" + # max-non-active-revisions: "1000" + + # Duration since creation before considering a revision for GC or "disabled". + retain-since-create-time: "48h" + + # Duration since active before considering a revision for GC or "disabled". + retain-since-last-active-time: "15h" + + # Minimum number of non-active revisions to retain. + min-non-active-revisions: "20" + + # Maximum number of non-active revisions to retain + # or "disabled" to disable any maximum limit. + max-non-active-revisions: "1000" +--- +# Copyright 2020 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-leader-election + namespace: knative-serving + labels: + app.kubernetes.io/name: knative-serving + app.kubernetes.io/component: controller + app.kubernetes.io/version: "1.22.1" + annotations: + knative.dev/example-checksum: "f4b71f57" +data: + _example: | + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this example block and unindented to be in the data block + # to actually change the configuration. + + # lease-duration is how long non-leaders will wait to try to acquire the + # lock; 15 seconds is the value used by core kubernetes controllers. + lease-duration: "60s" + + # renew-deadline is how long a leader will try to renew the lease before + # giving up; 10 seconds is the value used by core kubernetes controllers. + renew-deadline: "40s" + + # retry-period is how long the leader election client waits between tries of + # actions; 2 seconds is the value used by core kubernetes controllers. + retry-period: "10s" + + # buckets is the number of buckets used to partition key space of each + # Reconciler. If this number is M and the replica number of the controller + # is N, the N replicas will compete for the M buckets. The owner of a + # bucket will take care of the reconciling for the keys partitioned into + # that bucket. + buckets: "1" +--- +# Copyright 2018 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-logging + namespace: knative-serving + labels: + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/component: logging + app.kubernetes.io/name: knative-serving + annotations: + knative.dev/example-checksum: "9f25d429" +data: + _example: | + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this example block and unindented to be in the data block + # to actually change the configuration. + + # Common configuration for all Knative codebase + zap-logger-config: | + { + "level": "info", + "development": false, + "outputPaths": ["stdout"], + "errorOutputPaths": ["stderr"], + "encoding": "json", + "encoderConfig": { + "timeKey": "timestamp", + "levelKey": "severity", + "nameKey": "logger", + "callerKey": "caller", + "messageKey": "message", + "stacktraceKey": "stacktrace", + "lineEnding": "", + "levelEncoder": "", + "timeEncoder": "iso8601", + "durationEncoder": "", + "callerEncoder": "" + } + } + + # Log level overrides + # For all components except the queue proxy, + # changes are picked up immediately. + # For queue proxy, changes require recreation of the pods. + loglevel.controller: "info" + loglevel.autoscaler: "info" + loglevel.queueproxy: "info" + loglevel.webhook: "info" + loglevel.activator: "info" + loglevel.hpaautoscaler: "info" + loglevel.net-istio-controller: "info" + loglevel.net-contour-controller: "info" + loglevel.net-kourier-controller: "info" + loglevel.net-gateway-api-controller: "info" +--- +# Copyright 2018 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-network + namespace: knative-serving + labels: + app.kubernetes.io/name: knative-serving + app.kubernetes.io/component: networking + app.kubernetes.io/version: "1.22.1" + annotations: + knative.dev/example-checksum: "0573e07d" +data: + _example: | + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this example block and unindented to be in the data block + # to actually change the configuration. + + # ingress-class specifies the default ingress class + # to use when not dictated by Route annotation. + # + # If not specified, will use the Istio ingress. + # + # Note that changing the Ingress class of an existing Route + # will result in undefined behavior. Therefore it is best to only + # update this value during the setup of Knative, to avoid getting + # undefined behavior. + ingress-class: "istio.ingress.networking.knative.dev" + + # certificate-class specifies the default Certificate class + # to use when not dictated by Route annotation. + # + # If not specified, will use the Cert-Manager Certificate. + # + # Note that changing the Certificate class of an existing Route + # will result in undefined behavior. Therefore it is best to only + # update this value during the setup of Knative, to avoid getting + # undefined behavior. + certificate-class: "cert-manager.certificate.networking.knative.dev" + + # namespace-wildcard-cert-selector specifies a LabelSelector which + # determines which namespaces should have a wildcard certificate + # provisioned. + # + # Use an empty value to disable the feature (this is the default): + # namespace-wildcard-cert-selector: "" + # + # Use an empty object to enable for all namespaces + # namespace-wildcard-cert-selector: {} + # + # Useful labels include the "kubernetes.io/metadata.name" label to + # avoid provisioning a certificate for the "kube-system" namespaces. + # Use the following selector to match pre-1.0 behavior of using + # "networking.knative.dev/disableWildcardCert" to exclude namespaces: + # + # matchExpressions: + # - key: "networking.knative.dev/disableWildcardCert" + # operator: "NotIn" + # values: ["true"] + namespace-wildcard-cert-selector: "" + + # domain-template specifies the golang text template string to use + # when constructing the Knative service's DNS name. The default + # value is "{{.Name}}.{{.Namespace}}.{{.Domain}}". + # + # Valid variables defined in the template include Name, Namespace, Domain, + # Labels, and Annotations. Name will be the result of the tag-template + # below, if a tag is specified for the route. + # + # Changing this value might be necessary when the extra levels in + # the domain name generated is problematic for wildcard certificates + # that only support a single level of domain name added to the + # certificate's domain. In those cases you might consider using a value + # of "{{.Name}}-{{.Namespace}}.{{.Domain}}", or removing the Namespace + # entirely from the template. When choosing a new value be thoughtful + # of the potential for conflicts - for example, when users choose to use + # characters such as `-` in their service, or namespace, names. + # {{.Annotations}} or {{.Labels}} can be used for any customization in the + # go template if needed. + # We strongly recommend keeping namespace part of the template to avoid + # domain name clashes: + # eg. '{{.Name}}-{{.Namespace}}.{{ index .Annotations "sub"}}.{{.Domain}}' + # and you have an annotation {"sub":"foo"}, then the generated template + # would be {Name}-{Namespace}.foo.{Domain} + domain-template: "{{.Name}}.{{.Namespace}}.{{.Domain}}" + + # tag-template specifies the golang text template string to use + # when constructing the DNS name for "tags" within the traffic blocks + # of Routes and Configuration. This is used in conjunction with the + # domain-template above to determine the full URL for the tag. + tag-template: "{{.Tag}}-{{.Name}}" + + # auto-tls is deprecated and replaced by external-domain-tls + auto-tls: "Disabled" + + # Controls whether TLS certificates are automatically provisioned and + # installed in the Knative ingress to terminate TLS connections + # for cluster external domains (like: app.example.com) + # - Enabled: enables the TLS certificate provisioning feature for cluster external domains. + # - Disabled: disables the TLS certificate provisioning feature for cluster external domains. + external-domain-tls: "Disabled" + + # Controls weather TLS certificates are automatically provisioned and + # installed in the Knative ingress to terminate TLS connections + # for cluster local domains (like: app.namespace.svc.) + # - Enabled: enables the TLS certificate provisioning feature for cluster cluster-local domains. + # - Disabled: disables the TLS certificate provisioning feature for cluster cluster local domains. + # NOTE: This flag is in an alpha state and is mostly here to enable internal testing + # for now. Use with caution. + cluster-local-domain-tls: "Disabled" + + # internal-encryption is deprecated and replaced by system-internal-tls + internal-encryption: "false" + + # system-internal-tls controls weather TLS encryption is used for connections between + # the internal components of Knative: + # - ingress to activator + # - ingress to queue-proxy + # - activator to queue-proxy + # + # Possible values for this flag are: + # - Enabled: enables the TLS certificate provisioning feature for cluster cluster-local domains. + # - Disabled: disables the TLS certificate provisioning feature for cluster cluster local domains. + # NOTE: This flag is in an alpha state and is mostly here to enable internal testing + # for now. Use with caution. + system-internal-tls: "Disabled" + + # Controls the behavior of the HTTP endpoint for the Knative ingress. + # It requires auto-tls to be enabled. + # - Enabled: The Knative ingress will be able to serve HTTP connection. + # - Redirected: The Knative ingress will send a 301 redirect for all + # http connections, asking the clients to use HTTPS. + # + # "Disabled" option is deprecated. + http-protocol: "Enabled" + + # rollout-duration contains the minimal duration in seconds over which the + # Configuration traffic targets are rolled out to the newest revision. + rollout-duration: "0" + + # autocreate-cluster-domain-claims controls whether ClusterDomainClaims should + # be automatically created (and deleted) as needed when DomainMappings are + # reconciled. + # + # If this is "false" (the default), the cluster administrator is + # responsible for creating ClusterDomainClaims and delegating them to + # namespaces via their spec.Namespace field. This setting should be used in + # multitenant environments which need to control which namespace can use a + # particular domain name in a domain mapping. + # + # If this is "true", users are able to associate arbitrary names with their + # services via the DomainMapping feature. + autocreate-cluster-domain-claims: "false" + + # If true, networking plugins can add additional information to deployed + # applications to make their pods directly accessible via their IPs even if mesh is + # enabled and thus direct-addressability is usually not possible. + # Consumers like Knative Serving can use this setting to adjust their behavior + # accordingly, i.e. to drop fallback solutions for non-pod-addressable systems. + # + # NOTE: This flag is in an alpha state and is mostly here to enable internal testing + # for now. Use with caution. + enable-mesh-pod-addressability: "false" + + # mesh-compatibility-mode indicates whether consumers of network plugins + # should directly contact Pod IPs (most efficient), or should use the + # Cluster IP (less efficient, needed when mesh is enabled unless + # `enable-mesh-pod-addressability`, above, is set). + # Permitted values are: + # - "auto" (default): automatically determine which mesh mode to use by trying Pod IP and falling back to Cluster IP as needed. + # - "enabled": always use Cluster IP and do not attempt to use Pod IPs. + # - "disabled": always use Pod IPs and do not fall back to Cluster IP on failure. + mesh-compatibility-mode: "auto" + + # Defines the scheme used for external URLs if auto-tls is not enabled. + # This can be used for making Knative report all URLs as "HTTPS" for example, if you're + # fronting Knative with an external loadbalancer that deals with TLS termination and + # Knative doesn't know about that otherwise. + default-external-scheme: "http" +--- +# Copyright 2018 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-observability + namespace: knative-serving + labels: + app.kubernetes.io/name: knative-serving + app.kubernetes.io/component: observability + app.kubernetes.io/version: "1.22.1" + annotations: + knative.dev/example-checksum: "59abacb5" +data: + _example: | + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this example block and unindented to be in the data block + # to actually change the configuration. + + # logging.enable-var-log-collection defaults to false. + # The fluentd daemon set will be set up to collect /var/log if + # this flag is true. + logging.enable-var-log-collection: "false" + + # logging.revision-url-template provides a template to use for producing the + # logging URL that is injected into the status of each Revision. + logging.revision-url-template: "http://logging.example.com/?revisionUID=${REVISION_UID}" + + # If non-empty, this enables queue proxy writing user request logs to stdout, excluding probe + # requests. + # NB: after 0.18 release logging.enable-request-log must be explicitly set to true + # in order for request logging to be enabled. + # + # The value determines the shape of the request logs and it must be a valid go text/template. + # It is important to keep this as a single line. Multiple lines are parsed as separate entities + # by most collection agents and will split the request logs into multiple records. + # + # The following fields and functions are available to the template: + # + # Request: An http.Request (see https://golang.org/pkg/net/http/#Request) + # representing an HTTP request received by the server. + # + # Response: + # struct { + # Code int // HTTP status code (see https://www.iana.org/assignments/http-status-codes/http-status-codes.xhtml) + # Size int // An int representing the size of the response. + # Latency float64 // A float64 representing the latency of the response in seconds. + # } + # + # Revision: + # struct { + # Name string // Knative revision name + # Namespace string // Knative revision namespace + # Service string // Knative service name + # Configuration string // Knative configuration name + # PodName string // Name of the pod hosting the revision + # PodIP string // IP of the pod hosting the revision + # } + # + logging.request-log-template: '{"httpRequest": {"requestMethod": "{{.Request.Method}}", "requestUrl": "{{js .Request.RequestURI}}", "requestSize": "{{.Request.ContentLength}}", "status": {{.Response.Code}}, "responseSize": "{{.Response.Size}}", "userAgent": "{{js .Request.UserAgent}}", "remoteIp": "{{js .Request.RemoteAddr}}", "serverIp": "{{.Revision.PodIP}}", "referer": "{{js .Request.Referer}}", "latency": "{{.Response.Latency}}s", "protocol": "{{.Request.Proto}}"}, "traceId": "{{.TraceID}}"}' + + # If true, the request logging will be enabled. + logging.enable-request-log: "false" + + # If true, this enables queue proxy writing request logs for probe requests to stdout. + # It uses the same template for user requests, i.e. logging.request-log-template. + logging.enable-probe-request-log: "false" + + # metrics-protocol field specifies the protocol used when exporting metrics + # It supports either 'none' (the default), 'prometheus', 'http/protobuf' (OTLP HTTP), 'grpc' (OTLP gRPC) + metrics-protocol: http/protobuf + + # metrics-endpoint field specifies the destination metrics should be exporter to. + # + # The endpoint MUST be set when the protocol is http/protobuf or grpc. + # The endpoint MUST NOT be set when the protocol is none. + # + # When the protocol is prometheus the endpoint can accept a 'host:port' string to customize the + # listening host interface and port. + metrics-endpoint: http://example.com/v1/traces + + # metrics-export-interval specifies the global metrics reporting period for control and data plane components. + # If a zero or negative value is passed the default reporting OTel period is used (60 secs). + metrics-export-interval: 60s + + # request-metrics-protocol field specifies the protocol used when exporting queue-proxy metrics + # It supports either 'none' (the default), 'prometheus', 'http/protobuf' (OTLP HTTP), 'grpc' (OTLP gRPC) + request-metrics-protocol: http/protobuf + + # request-metrics-endpoint field specifies the destination metrics from the queue proxy should be exporter to. + # + # The endpoint MUST be set when the protocol is http/protobuf or grpc. + # The endpoint MUST NOT be set when the protocol is none. + # + # When the protocol is prometheus the endpoint can accept a 'host:port' string to customize the + # listening host interface and port. + request-metrics-endpoint: http://promstack-kube-prometheus-prometheus.observability:9090/api/v1/otlp/v1/metrics + + # request-metrics-export-interval specifies the global metrics reporting period for the queue-proxy. + # + # If a zero or negative value is passed the default reporting OTel period is used (60 secs). + request-metrics-export-interval: 60s + + # runtime-profiling indicates whether it is allowed to retrieve runtime profiling data from + # the pods via an HTTP server in the format expected by the pprof visualization tool. When + # enabled, the Knative Serving pods expose the profiling data on an alternate HTTP port 8008. + # The HTTP context root for profiling is then /debug/pprof/. + runtime-profiling: enabled + + # tracing-protocol field specifies the protocol used when exporting traces + # It supports either 'none' (the default), 'http/protobuf' (OTLP HTTP), 'grpc' (OTLP gRPC) + # or `stdout` for debugging purposes + tracing-protocol: http/protobuf + + # tracing-endpoint field specifies the destination traces should be exporter to. + # + # The endpoint MUST be set when the protocol is http/protobuf or grpc. + # The endpoint MUST NOT be set when the protocol is none. + tracing-endpoint: http://jaeger-collector.observability:4318/v1/traces + + # tracing-sampling-rate allows the user to specify what percentage of all traces should be exported + # The value should be between 0 (never sample) to 1 (always sample) + tracing-sampling-rate: "1" +--- +# Copyright 2019 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-tracing + namespace: knative-serving + labels: + app.kubernetes.io/name: knative-serving + app.kubernetes.io/component: tracing + app.kubernetes.io/version: "1.22.1" + annotations: + knative.dev/example-checksum: "04c7e9a3" +data: + _example: | + ########################################################### + # # + # This config is deprecated - use config-observability # + # # + ########################################################### +--- +# Copyright 2020 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: autoscaling/v2 +kind: HorizontalPodAutoscaler +metadata: + name: activator + namespace: knative-serving + labels: + app.kubernetes.io/component: activator + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" +spec: + minReplicas: 1 + maxReplicas: 20 + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: activator + metrics: + - type: Resource + resource: + name: cpu + target: + type: Utilization + # Percentage of the requested CPU + averageUtilization: 100 +--- +# Activator PDB. Currently we permit unavailability of 20% of tasks at the same time. +# Given the subsetting and that the activators are partially stateful systems, we want +# a slow rollout of the new versions and slow migration during node upgrades. +apiVersion: policy/v1 +kind: PodDisruptionBudget +metadata: + name: activator-pdb + namespace: knative-serving + labels: + app.kubernetes.io/component: activator + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" +spec: + minAvailable: 80% + selector: + matchLabels: + app: activator +--- +# Copyright 2018 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: activator + namespace: knative-serving + labels: + app.kubernetes.io/component: activator + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +spec: + selector: + matchLabels: + app: activator + role: activator + template: + metadata: + labels: + app: activator + role: activator + app.kubernetes.io/component: activator + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" + spec: + # To avoid node becoming SPOF, spread our replicas to different nodes. + affinity: + podAntiAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchLabels: + app: activator + topologyKey: kubernetes.io/hostname + weight: 100 + serviceAccountName: activator + containers: + - name: activator + # This is the Go import path for the binary that is containerized + # and substituted here. + image: gcr.io/knative-releases/knative.dev/serving/cmd/activator@sha256:5deaef961fef8d1417f6d4a4dfae2fc338f2d30d72c4ad58c3ab392b2c04705b + # The numbers are based on performance test results from + # https://github.com/knative/serving/issues/1625#issuecomment-511930023 + resources: + requests: + cpu: 300m + memory: 60Mi + limits: + cpu: 1000m + memory: 600Mi + env: + # Run Activator with GC collection when newly generated memory is 500%. + - name: GOGC + value: "500" + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: POD_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + - name: SYSTEM_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: CONFIG_LOGGING_NAME + value: config-logging + - name: CONFIG_OBSERVABILITY_NAME + value: config-observability + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + runAsNonRoot: true + capabilities: + drop: + - ALL + seccompProfile: + type: RuntimeDefault + ports: + - name: metrics + containerPort: 9090 + - name: profiling + containerPort: 8008 + - name: http1 + containerPort: 8012 + - name: h2c + containerPort: 8013 + readinessProbe: + httpGet: + port: 8012 + periodSeconds: 5 + failureThreshold: 5 + livenessProbe: + httpGet: + port: 8012 + periodSeconds: 10 + failureThreshold: 12 + initialDelaySeconds: 15 + # The activator (often) sits on the dataplane, and may proxy long (e.g. + # streaming, websockets) requests. We give a long grace period for the + # activator to "lame duck" and drain outstanding requests before we + # forcibly terminate the pod (and outstanding connections). This value + # should be at least as large as the upper bound on the Revision's + # timeoutSeconds property to avoid servicing events disrupting + # connections. + terminationGracePeriodSeconds: 600 +--- +apiVersion: v1 +kind: Service +metadata: + name: activator-service + namespace: knative-serving + labels: + app: activator + app.kubernetes.io/component: activator + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +spec: + selector: + app: activator + ports: + # Define metrics and profiling for them to be accessible within service meshes. + - name: http-metrics + port: 9090 + targetPort: 9090 + - name: http-profiling + port: 8008 + targetPort: 8008 + - name: http + port: 80 + targetPort: 8012 + - name: http2 + port: 81 + targetPort: 8013 + - name: https + port: 443 + targetPort: 8112 + type: ClusterIP +--- +# Copyright 2018 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: autoscaler + namespace: knative-serving + labels: + app.kubernetes.io/component: autoscaler + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" +spec: + replicas: 1 + selector: + matchLabels: + app: autoscaler + strategy: + type: RollingUpdate + rollingUpdate: + maxUnavailable: 0 + template: + metadata: + labels: + app: autoscaler + app.kubernetes.io/component: autoscaler + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" + spec: + # To avoid node becoming SPOF, spread our replicas to different nodes. + affinity: + podAntiAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchLabels: + app: autoscaler + topologyKey: kubernetes.io/hostname + weight: 100 + serviceAccountName: controller + containers: + - name: autoscaler + # This is the Go import path for the binary that is containerized + # and substituted here. + image: gcr.io/knative-releases/knative.dev/serving/cmd/autoscaler@sha256:5bae38655d87df86b041083fbe51791816473245f752432ba9b85a7b12f73cd5 + resources: + requests: + cpu: 100m + memory: 100Mi + limits: + cpu: 1000m + memory: 1000Mi + env: + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: POD_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + - name: SYSTEM_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: CONFIG_LOGGING_NAME + value: config-logging + - name: CONFIG_OBSERVABILITY_NAME + value: config-observability + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + runAsNonRoot: true + capabilities: + drop: + - ALL + seccompProfile: + type: RuntimeDefault + ports: + - name: metrics + containerPort: 9090 + - name: profiling + containerPort: 8008 + - name: websocket + containerPort: 8080 + readinessProbe: + httpGet: + port: 8080 + livenessProbe: + httpGet: + port: 8080 + failureThreshold: 6 +--- +apiVersion: v1 +kind: Service +metadata: + labels: + app: autoscaler + app.kubernetes.io/component: autoscaler + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" + name: autoscaler + namespace: knative-serving +spec: + ports: + # Define metrics and profiling for them to be accessible within service meshes. + - name: http-metrics + port: 9090 + targetPort: 9090 + - name: http-profiling + port: 8008 + targetPort: 8008 + - name: http + port: 8080 + targetPort: 8080 + selector: + app: autoscaler +--- +# Copyright 2018 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: controller + namespace: knative-serving + labels: + app.kubernetes.io/component: controller + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" +spec: + selector: + matchLabels: + app: controller + template: + metadata: + labels: + app: controller + app.kubernetes.io/component: controller + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" + spec: + # To avoid node becoming SPOF, spread our replicas to different nodes. + affinity: + podAntiAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchLabels: + app: controller + topologyKey: kubernetes.io/hostname + weight: 100 + serviceAccountName: controller + containers: + - name: controller + # This is the Go import path for the binary that is containerized + # and substituted here. + image: gcr.io/knative-releases/knative.dev/serving/cmd/controller@sha256:94329d85200c2fc31ed1166a26568ca1357376c149c147e71f400cf28be3c816 + resources: + requests: + cpu: 100m + memory: 100Mi + limits: + cpu: 1000m + memory: 1000Mi + env: + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: SYSTEM_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: CONFIG_LOGGING_NAME + value: config-logging + - name: CONFIG_OBSERVABILITY_NAME + value: config-observability + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + runAsNonRoot: true + capabilities: + drop: + - ALL + seccompProfile: + type: RuntimeDefault + livenessProbe: + httpGet: + path: /health + port: probes + scheme: HTTP + periodSeconds: 5 + failureThreshold: 6 + readinessProbe: + httpGet: + path: /readiness + port: probes + scheme: HTTP + periodSeconds: 5 + failureThreshold: 3 + ports: + - name: metrics + containerPort: 9090 + - name: profiling + containerPort: 8008 + - name: probes + containerPort: 8080 +--- +apiVersion: v1 +kind: Service +metadata: + labels: + app: controller + app.kubernetes.io/component: controller + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" + name: controller + namespace: knative-serving +spec: + ports: + # Define metrics and profiling for them to be accessible within service meshes. + - name: http-metrics + port: 9090 + targetPort: 9090 + - name: http-profiling + port: 8008 + targetPort: 8008 + selector: + app: controller +--- +# Copyright 2020 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: autoscaling/v2 +kind: HorizontalPodAutoscaler +metadata: + name: webhook + namespace: knative-serving + labels: + app.kubernetes.io/component: webhook + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" +spec: + minReplicas: 1 + maxReplicas: 5 + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: webhook + metrics: + - type: Resource + resource: + name: cpu + target: + type: Utilization + # Percentage of the requested CPU + averageUtilization: 100 +--- +# Webhook PDB. +apiVersion: policy/v1 +kind: PodDisruptionBudget +metadata: + name: webhook-pdb + namespace: knative-serving + labels: + app.kubernetes.io/component: webhook + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" +spec: + minAvailable: 80% + selector: + matchLabels: + app: webhook +--- +# Copyright 2018 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: webhook + namespace: knative-serving + labels: + app.kubernetes.io/component: webhook + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +spec: + selector: + matchLabels: + app: webhook + role: webhook + template: + metadata: + labels: + app: webhook + role: webhook + app.kubernetes.io/component: webhook + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving + spec: + # To avoid node becoming SPOF, spread our replicas to different nodes. + affinity: + podAntiAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchLabels: + app: webhook + topologyKey: kubernetes.io/hostname + weight: 100 + serviceAccountName: controller + containers: + - name: webhook + # This is the Go import path for the binary that is containerized + # and substituted here. + image: gcr.io/knative-releases/knative.dev/serving/cmd/webhook@sha256:8470456be214e93a84e3c7b79a632aa9978bd8ecda553feaa47878a2c24ab84d + resources: + requests: + cpu: 100m + memory: 100Mi + limits: + cpu: 500m + memory: 500Mi + env: + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: SYSTEM_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: CONFIG_LOGGING_NAME + value: config-logging + - name: CONFIG_OBSERVABILITY_NAME + value: config-observability + - name: WEBHOOK_NAME + value: webhook + - name: WEBHOOK_PORT + value: "8443" + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + runAsNonRoot: true + capabilities: + drop: + - ALL + seccompProfile: + type: RuntimeDefault + ports: + - name: metrics + containerPort: 9090 + - name: profiling + containerPort: 8008 + - name: https-webhook + containerPort: 8443 + readinessProbe: + periodSeconds: 1 + httpGet: + scheme: HTTPS + port: 8443 + livenessProbe: + periodSeconds: 10 + httpGet: + scheme: HTTPS + port: 8443 + failureThreshold: 6 + initialDelaySeconds: 20 + # Our webhook should gracefully terminate by lame ducking first, set this to a sufficiently + # high value that we respect whatever value it has configured for the lame duck grace period. + terminationGracePeriodSeconds: 300 +--- +apiVersion: v1 +kind: Service +metadata: + labels: + app: webhook + role: webhook + app.kubernetes.io/component: webhook + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving + name: webhook + namespace: knative-serving +spec: + ports: + # Define metrics and profiling for them to be accessible within service meshes. + - name: http-metrics + port: 9090 + targetPort: 9090 + - name: http-profiling + port: 8008 + targetPort: 8008 + - name: https-webhook + port: 443 + targetPort: 8443 + selector: + app: webhook + role: webhook +--- +# Copyright 2020 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingWebhookConfiguration +metadata: + name: config.webhook.serving.knative.dev + labels: + app.kubernetes.io/component: webhook + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" +webhooks: + - admissionReviewVersions: ["v1", "v1beta1"] + clientConfig: + service: + name: webhook + namespace: knative-serving + failurePolicy: Fail + sideEffects: None + name: config.webhook.serving.knative.dev + objectSelector: + matchExpressions: + - key: app.kubernetes.io/name + operator: In + values: ["knative-serving"] + - key: app.kubernetes.io/component + operator: In + values: ["autoscaler", "controller", "logging", "networking", "observability", "tracing", "net-certmanager"] + timeoutSeconds: 10 +--- +# Copyright 2020 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: admissionregistration.k8s.io/v1 +kind: MutatingWebhookConfiguration +metadata: + name: webhook.serving.knative.dev + labels: + app.kubernetes.io/component: webhook + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" +webhooks: + - admissionReviewVersions: ["v1", "v1beta1"] + clientConfig: + service: + name: webhook + namespace: knative-serving + failurePolicy: Fail + sideEffects: None + name: webhook.serving.knative.dev + timeoutSeconds: 10 + rules: + - apiGroups: + - autoscaling.internal.knative.dev + - networking.internal.knative.dev + - serving.knative.dev + apiVersions: + - "*" + operations: + - CREATE + - UPDATE + scope: "*" + resources: + - metrics + - podautoscalers + - certificates + - ingresses + - serverlessservices + - configurations + - revisions + - routes + - services + - domainmappings + - domainmappings/status +--- +# Copyright 2020 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingWebhookConfiguration +metadata: + name: validation.webhook.serving.knative.dev + labels: + app.kubernetes.io/component: webhook + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" +webhooks: + - admissionReviewVersions: ["v1", "v1beta1"] + clientConfig: + service: + name: webhook + namespace: knative-serving + failurePolicy: Fail + sideEffects: None + name: validation.webhook.serving.knative.dev + timeoutSeconds: 10 + rules: + - apiGroups: + - autoscaling.internal.knative.dev + - networking.internal.knative.dev + - serving.knative.dev + apiVersions: + - "*" + operations: + - CREATE + - UPDATE + - DELETE + scope: "*" + resources: + - metrics + - podautoscalers + - certificates + - ingresses + - serverlessservices + - configurations + - revisions + - routes + - services + - domainmappings + - domainmappings/status +--- +# Copyright 2020 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: Secret +metadata: + name: webhook-certs + namespace: knative-serving + labels: + app.kubernetes.io/component: webhook + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" +# The data is populated at install time. +--- +# Source: https://github.com/knative-extensions/net-kourier/releases/download/knative-v1.22.1/kourier.yaml +--- +# Copyright 2020 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: Namespace +metadata: + name: kourier-system + labels: + networking.knative.dev/ingress-provider: kourier + app.kubernetes.io/name: knative-serving + app.kubernetes.io/component: net-kourier + app.kubernetes.io/version: "1.22.1" +--- +# Copyright 2020 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: kourier-bootstrap + namespace: kourier-system + labels: + networking.knative.dev/ingress-provider: kourier + app.kubernetes.io/component: net-kourier + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +data: + envoy-bootstrap.yaml: | + dynamic_resources: + ads_config: + transport_api_version: V3 + api_type: GRPC + rate_limit_settings: {} + grpc_services: + - envoy_grpc: {cluster_name: xds_cluster} + cds_config: + resource_api_version: V3 + ads: {} + lds_config: + resource_api_version: V3 + ads: {} + node: + cluster: kourier-knative + id: 3scale-kourier-gateway + static_resources: + listeners: + - name: stats_listener + address: + socket_address: + address: 0.0.0.0 + port_value: 9000 + filter_chains: + - filters: + - name: envoy.filters.network.http_connection_manager + typed_config: + "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager + stat_prefix: stats_server + http_filters: + - name: envoy.filters.http.router + typed_config: + "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router + route_config: + virtual_hosts: + - name: admin_interface + domains: + - "*" + routes: + - match: + safe_regex: + regex: '/(certs|stats(/prometheus)?|server_info|clusters|listeners|ready)?' + headers: + - name: ':method' + string_match: + exact: GET + route: + cluster: service_stats + - match: + safe_regex: + regex: '/drain_listeners' + headers: + - name: ':method' + string_match: + exact: POST + route: + cluster: service_stats + clusters: + - name: service_stats + connect_timeout: 0.250s + type: static + load_assignment: + cluster_name: service_stats + endpoints: + lb_endpoints: + endpoint: + address: + socket_address: + address: 127.0.0.1 + port_value: 9901 + - name: xds_cluster + # This keepalive is recommended by envoy docs. + # https://www.envoyproxy.io/docs/envoy/latest/api-docs/xds_protocol + typed_extension_protocol_options: + envoy.extensions.upstreams.http.v3.HttpProtocolOptions: + "@type": type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions + explicit_http_config: + http2_protocol_options: + connection_keepalive: + interval: 30s + timeout: 5s + connect_timeout: 1s + load_assignment: + cluster_name: xds_cluster + endpoints: + lb_endpoints: + endpoint: + address: + socket_address: + address: "net-kourier-controller.knative-serving" + port_value: 18000 + type: STRICT_DNS + admin: + access_log: + - name: envoy.access_loggers.stdout + typed_config: + "@type": type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog + address: + socket_address: + address: 127.0.0.1 + port_value: 9901 +--- +# Copyright 2021 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-kourier + namespace: knative-serving + labels: + networking.knative.dev/ingress-provider: kourier + app.kubernetes.io/component: net-kourier + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +data: + _example: | + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this example block and unindented to be in the data block + # to actually change the configuration. + + # Specifies whether requests reaching the Kourier gateway + # in the context of services should be logged. Readiness + # probes etc. must be configured via the bootstrap config. + enable-service-access-logging: "true" + + # Specifies the format of the access log used by the Kourier gateway. + # This template follows the envoy format. + # see: https://www.envoyproxy.io/docs/envoy/latest/configuration/observability/access_log/usage#access-logging + service-access-log-template: "" + + # Specifies whether to use proxy-protocol in order to safely + # transport connection information such as a client's address + # across multiple layers of TCP proxies. + # NOTE THAT THIS IS AN EXPERIMENTAL / ALPHA FEATURE + enable-proxy-protocol: "false" + + # The server certificates to serve the internal TLS traffic for Kourier Gateway. + # It is specified by the secret name in controller namespace, which has + # the "tls.crt" and "tls.key" data field. + # Use an empty value to disable the feature (default). + # + # NOTE: This flag is in an alpha state and is mostly here to enable internal testing + # for now. Use with caution. + cluster-cert-secret: "" + + # Specifies the amount of time that Kourier waits for the incoming requests. + # The default, 0s, imposes no timeout at all. + stream-idle-timeout: "0s" + + # Specifies whether to use CryptoMB private key provider in order to + # acclerate the TLS handshake. + # NOTE THAT THIS IS AN EXPERIMENTAL / ALPHA FEATURE. + enable-cryptomb: "false" + + # Configures the number of additional ingress proxy hops from the + # right side of the x-forwarded-for HTTP header to trust. + trusted-hops-count: "0" + + # Configures the connection manager to use the real remote address + # of the client connection when determining internal versus external origin and manipulating various headers. + use-remote-address: "false" + + # Specifies the cipher suites for TLS external listener. + # Use ',' separated values like "ECDHE-ECDSA-AES128-GCM-SHA256,ECDHE-ECDSA-CHACHA20-POLY1305" + # The default uses the default cipher suites of the envoy version. + cipher-suites: "" + + # Disable the Envoy server header injection in the response when response has no such header. + disable-envoy-server-header: "false" + + # The external authorization service and port, my-auth:2222. + # This value overrides environment variable if defined. + extauthz-host: "" + + # The protocol used to query the ext auth service. Can be one of : grpc, http, https. Defaults to grpc + # This value overrides environment variable if defined. + extauthz-protocol: "grpc" + + # Allow traffic to go through if the ext auth service is down. Accepts true/false. + # This value overrides environment variable if defined. + extauthz-failure-mode-allow: "" + + # Max request bytes, if not set, defaults to 8192 Bytes. More info Envoy Docs + # see: https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/http/ext_authz/v3/ext_authz.proto.html#extensions-filters-http-ext-authz-v3-buffersettings + # This value overrides environment variable if defined. + extauthz-max-request-body-bytes: 8192 + + # Max time in ms to wait for the ext authz service. Defaults to 2000 ms + # This value overrides environment variable if defined. + extauthz-timeout: 2000 + + # If extauthz-protocol is equal to http or https, path to query the ext auth service. + # Example : if set to /verify, it will query /verify/ (notice the trailing /). If not set, it will query / + # This value overrides environment variable if defined. + extauthz-path-prefix: "" + + # If extauthz-protocol is equal to grpc, sends the body as raw bytes instead of a UTF-8 string. + # Accepts only true/false, t/f or 1/0. Attempting to set another value will throw an error. + # Defaults to false. More info Envoy Docs. + # see: https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/http/ext_authz/v3/ext_authz.proto.html#extensions-filters-http-ext-authz-v3-buffersettings + # This value overrides environment variable if defined. + extauthz-pack-as-byte: "false" + + # Specifies the secret that contains the TLS certificate and key pair when using HTTPS communication with Kourier Ingress. + # This value overrides environment variable if defined. + certs-secret-name: "" + certs-secret-namespace: "" + + # Specifies the OTLP collector endpoint for distributed tracing. + # The endpoint format depends on the protocol (see tracing-protocol). + # Examples: + # - For HTTP: "http://otel-collector.observability.svc:4318/v1/traces" + # - For gRPC: "http://otel-collector.observability.svc:4317" + # Use an empty value to disable distributed tracing (default). + tracing-endpoint: "" + + # Protocol for tracing collector communication. + # Valid values: http/protobuf, grpc + tracing-protocol: "grpc" + + # Tracing sampling rate (0.0 to 1.0) + # Controls the percentage of requests that are traced. + # Example: "1.0" traces 100% of requests. + tracing-sampling-rate: "1.0" + + # Service name for traces + # This identifies the Kourier gateway in your tracing system. + tracing-service-name: "kourier-knative" +--- +# Copyright 2020 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ServiceAccount +metadata: + name: net-kourier + namespace: knative-serving + labels: + networking.knative.dev/ingress-provider: kourier + app.kubernetes.io/component: net-kourier + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: net-kourier + labels: + networking.knative.dev/ingress-provider: kourier + app.kubernetes.io/component: net-kourier + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +rules: + - apiGroups: [""] + resources: ["events"] + verbs: ["create", "update", "patch"] + - apiGroups: [""] + resources: ["pods", "services", "secrets"] + verbs: ["get", "list", "watch"] + - apiGroups: [""] + resources: ["configmaps"] + verbs: ["get", "list", "watch"] + - apiGroups: ["discovery.k8s.io"] + resources: ["endpointslices"] + verbs: ["get", "list", "watch"] + - apiGroups: ["coordination.k8s.io"] + resources: ["leases"] + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] + - apiGroups: ["networking.internal.knative.dev"] + resources: ["ingresses"] + verbs: ["get", "list", "watch", "patch"] + - apiGroups: ["networking.internal.knative.dev"] + resources: ["ingresses/status"] + verbs: ["update"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: net-kourier + labels: + networking.knative.dev/ingress-provider: kourier + app.kubernetes.io/component: net-kourier + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: net-kourier +subjects: + - kind: ServiceAccount + name: net-kourier + namespace: knative-serving +--- +# Copyright 2020 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: net-kourier-controller + namespace: knative-serving + labels: + networking.knative.dev/ingress-provider: kourier + app.kubernetes.io/component: net-kourier + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +spec: + strategy: + type: RollingUpdate + rollingUpdate: + maxUnavailable: 0 + maxSurge: 100% + replicas: 1 + selector: + matchLabels: + app: net-kourier-controller + template: + metadata: + annotations: + prometheus.io/scrape: "true" + prometheus.io/port: "9090" + prometheus.io/path: "/metrics" + labels: + app: net-kourier-controller + spec: + containers: + - image: gcr.io/knative-releases/knative.dev/net-kourier/cmd/kourier@sha256:01abd2070ccf8680885c47990e42c05c09e30bc8595d9246f4dcd37f2220a2a2 + name: controller + env: + # CERTS_SECRET_NAMESPACE and CERTS_SECRET_NAME can also be configured from a ConfigMap. + # Settings configured in a configmap take precedence over environment variable settings. + - name: CERTS_SECRET_NAMESPACE + value: "" + - name: CERTS_SECRET_NAME + value: "" + - name: SYSTEM_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: METRICS_DOMAIN + value: "knative.dev/samples" + - name: KOURIER_GATEWAY_NAMESPACE + value: "kourier-system" + - name: ENABLE_SECRET_INFORMER_FILTERING_BY_CERT_UID + value: "false" + # KUBE_API_BURST and KUBE_API_QPS allows to configure maximum burst for throttle and maximum QPS to the server from the client. + # Setting these values using env vars is possible since https://github.com/knative/pkg/pull/2755. + # 200 is an arbitrary value, but it speeds up kourier startup duration, and the whole ingress reconciliation process as a whole. + - name: KUBE_API_BURST + value: "200" + - name: KUBE_API_QPS + value: "200" + ports: + - name: http2-xds + containerPort: 18000 + protocol: TCP + - name: metrics + containerPort: 9090 + protocol: TCP + readinessProbe: + grpc: + port: 18000 + periodSeconds: 10 + failureThreshold: 3 + livenessProbe: + grpc: + port: 18000 + periodSeconds: 10 + failureThreshold: 6 + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + runAsNonRoot: true + capabilities: + drop: + - ALL + seccompProfile: + type: RuntimeDefault + resources: + requests: + cpu: 200m + memory: 200Mi + limits: + cpu: "1" + memory: 500Mi + restartPolicy: Always + serviceAccountName: net-kourier +--- +apiVersion: v1 +kind: Service +metadata: + name: net-kourier-controller + namespace: knative-serving + labels: + networking.knative.dev/ingress-provider: kourier + app.kubernetes.io/component: net-kourier + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +spec: + ports: + - name: grpc-xds + port: 18000 + protocol: TCP + targetPort: 18000 + - name: http-metrics + port: 9090 + protocol: TCP + targetPort: 9090 + selector: + app: net-kourier-controller + type: ClusterIP +--- +# Copyright 2020 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: 3scale-kourier-gateway + namespace: kourier-system + labels: + networking.knative.dev/ingress-provider: kourier + app.kubernetes.io/component: net-kourier + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +spec: + strategy: + type: RollingUpdate + rollingUpdate: + maxUnavailable: 0 + maxSurge: 100% + selector: + matchLabels: + app: 3scale-kourier-gateway + template: + metadata: + labels: + app: 3scale-kourier-gateway + annotations: + # v0.26 supports envoy v3 API, so + # adding this label to restart pod. + networking.knative.dev/poke: "v0.26" + prometheus.io/scrape: "true" + prometheus.io/port: "9000" + prometheus.io/path: "/stats/prometheus" + spec: + containers: + - args: + - --base-id 1 + - -c /tmp/config/envoy-bootstrap.yaml + - --log-level info + - --drain-time-s $(DRAIN_TIME_SECONDS) + - --drain-strategy immediate + command: + - /usr/local/bin/envoy + env: + - name: DRAIN_TIME_SECONDS + value: "15" + image: docker.io/envoyproxy/envoy:v1.37-latest + name: kourier-gateway + ports: + - name: http2-external + containerPort: 8080 + protocol: TCP + - name: http2-internal + containerPort: 8081 + protocol: TCP + - name: https-external + containerPort: 8443 + protocol: TCP + - name: http-probe + containerPort: 8090 + protocol: TCP + - name: https-probe + containerPort: 9443 + protocol: TCP + - name: metrics + containerPort: 9000 + protocol: TCP + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: false + runAsNonRoot: true + runAsUser: 65534 + runAsGroup: 65534 + capabilities: + drop: + - ALL + seccompProfile: + type: RuntimeDefault + volumeMounts: + - name: config-volume + mountPath: /tmp/config + lifecycle: + preStop: + exec: + command: ["/bin/sh", "-c", "curl -X POST http://localhost:9901/drain_listeners?graceful; sleep $DRAIN_TIME_SECONDS"] + readinessProbe: + httpGet: + httpHeaders: + - name: Host + value: internalkourier + path: /ready + port: 8081 + scheme: HTTP + initialDelaySeconds: 10 + periodSeconds: 5 + failureThreshold: 3 + timeoutSeconds: 3 + livenessProbe: + httpGet: + httpHeaders: + - name: Host + value: internalkourier + path: /ready + port: 8081 + scheme: HTTP + initialDelaySeconds: 10 + periodSeconds: 5 + failureThreshold: 6 + timeoutSeconds: 3 + resources: + requests: + cpu: 200m + memory: 200Mi + limits: + cpu: "1" + memory: 800Mi + # to ensure a graceful drain, terminationGracePeriodSeconds must be greater than DRAIN_TIME_SECONDS environment variable + terminationGracePeriodSeconds: 30 + volumes: + - name: config-volume + configMap: + name: kourier-bootstrap + restartPolicy: Always +--- +apiVersion: v1 +kind: Service +metadata: + name: kourier + namespace: kourier-system + labels: + networking.knative.dev/ingress-provider: kourier + app.kubernetes.io/component: net-kourier + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +spec: + ports: + - name: http2 + port: 80 + protocol: TCP + targetPort: 8080 + - name: https + port: 443 + protocol: TCP + targetPort: 8443 + selector: + app: 3scale-kourier-gateway + type: LoadBalancer +--- +apiVersion: v1 +kind: Service +metadata: + name: kourier-internal + namespace: kourier-system + labels: + networking.knative.dev/ingress-provider: kourier + app.kubernetes.io/component: net-kourier + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +spec: + ports: + - name: http2 + port: 80 + protocol: TCP + targetPort: 8081 + - name: https + port: 443 + protocol: TCP + targetPort: 8444 + selector: + app: 3scale-kourier-gateway + type: ClusterIP +--- +apiVersion: autoscaling/v2 +kind: HorizontalPodAutoscaler +metadata: + name: 3scale-kourier-gateway + namespace: kourier-system + labels: + networking.knative.dev/ingress-provider: kourier + app.kubernetes.io/component: net-kourier + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +spec: + minReplicas: 1 + maxReplicas: 10 + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: 3scale-kourier-gateway + metrics: + - type: Resource + resource: + name: cpu + target: + type: Utilization + # Percentage of the requested CPU + averageUtilization: 100 +--- +apiVersion: policy/v1 +kind: PodDisruptionBudget +metadata: + name: 3scale-kourier-gateway-pdb + namespace: kourier-system + labels: + networking.knative.dev/ingress-provider: kourier + app.kubernetes.io/component: net-kourier + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +spec: + minAvailable: 80% + selector: + matchLabels: + app: 3scale-kourier-gateway diff --git a/packages/manifests/operators/kube-prometheus-stack.yaml b/packages/manifests/operators/kube-prometheus-stack.yaml index 40d575d..7bcb9d4 100644 --- a/packages/manifests/operators/kube-prometheus-stack.yaml +++ b/packages/manifests/operators/kube-prometheus-stack.yaml @@ -71414,6 +71414,7 @@ metadata: app.kubernetes.io/version: "12.1.1" name: kube-prometheus-stack-grafana namespace: monitoring + --- # Source: kube-prometheus-stack/charts/kube-state-metrics/templates/serviceaccount.yaml apiVersion: v1 @@ -71468,6 +71469,7 @@ metadata: release: "kube-prometheus-stack" heritage: "Helm" automountServiceAccountToken: true + --- # Source: kube-prometheus-stack/templates/prometheus-operator/serviceaccount.yaml apiVersion: v1 @@ -71488,6 +71490,7 @@ metadata: app.kubernetes.io/name: kube-prometheus-stack-prometheus-operator app.kubernetes.io/component: prometheus-operator automountServiceAccountToken: true + --- # Source: kube-prometheus-stack/templates/prometheus/serviceaccount.yaml apiVersion: v1 @@ -71508,6 +71511,7 @@ metadata: release: "kube-prometheus-stack" heritage: "Helm" automountServiceAccountToken: true + --- # Source: kube-prometheus-stack/charts/grafana/templates/secret.yaml apiVersion: v1 @@ -71526,6 +71530,7 @@ data: admin-user: "YWRtaW4=" admin-password: "YWRtaW4=" ldap-toml: "" + --- # Source: kube-prometheus-stack/templates/alertmanager/secret.yaml apiVersion: v1 @@ -71545,6 +71550,7 @@ metadata: heritage: "Helm" data: alertmanager.yaml: "Z2xvYmFsOgogIHJlc29sdmVfdGltZW91dDogNW0KaW5oaWJpdF9ydWxlczoKLSBlcXVhbDoKICAtIG5hbWVzcGFjZQogIC0gYWxlcnRuYW1lCiAgc291cmNlX21hdGNoZXJzOgogIC0gc2V2ZXJpdHkgPSBjcml0aWNhbAogIHRhcmdldF9tYXRjaGVyczoKICAtIHNldmVyaXR5ID1+IHdhcm5pbmd8aW5mbwotIGVxdWFsOgogIC0gbmFtZXNwYWNlCiAgLSBhbGVydG5hbWUKICBzb3VyY2VfbWF0Y2hlcnM6CiAgLSBzZXZlcml0eSA9IHdhcm5pbmcKICB0YXJnZXRfbWF0Y2hlcnM6CiAgLSBzZXZlcml0eSA9IGluZm8KLSBlcXVhbDoKICAtIG5hbWVzcGFjZQogIHNvdXJjZV9tYXRjaGVyczoKICAtIGFsZXJ0bmFtZSA9IEluZm9JbmhpYml0b3IKICB0YXJnZXRfbWF0Y2hlcnM6CiAgLSBzZXZlcml0eSA9IGluZm8KLSB0YXJnZXRfbWF0Y2hlcnM6CiAgLSBhbGVydG5hbWUgPSBJbmZvSW5oaWJpdG9yCnJlY2VpdmVyczoKLSBuYW1lOiAibnVsbCIKcm91dGU6CiAgZ3JvdXBfYnk6CiAgLSBuYW1lc3BhY2UKICBncm91cF9pbnRlcnZhbDogNW0KICBncm91cF93YWl0OiAzMHMKICByZWNlaXZlcjogIm51bGwiCiAgcmVwZWF0X2ludGVydmFsOiAxMmgKICByb3V0ZXM6CiAgLSBtYXRjaGVyczoKICAgIC0gYWxlcnRuYW1lID0gIldhdGNoZG9nIgogICAgcmVjZWl2ZXI6ICJudWxsIgp0ZW1wbGF0ZXM6Ci0gL2V0Yy9hbGVydG1hbmFnZXIvY29uZmlnLyoudG1wbA==" + --- # Source: kube-prometheus-stack/charts/grafana/templates/configmap-dashboard-provider.yaml apiVersion: v1 @@ -71572,6 +71578,7 @@ data: options: foldersFromFilesStructure: false path: /tmp/dashboards + --- # Source: kube-prometheus-stack/charts/grafana/templates/configmap.yaml apiVersion: v1 @@ -71600,6 +71607,7 @@ data: provisioning = /etc/grafana/provisioning [server] domain = '' + --- # Source: kube-prometheus-stack/templates/grafana/configmaps-datasources.yaml apiVersion: v1 @@ -71639,6 +71647,7 @@ data: jsonData: handleGrafanaManagedAlerts: false implementation: prometheus + --- # Source: kube-prometheus-stack/templates/grafana/dashboards-1.14/alertmanager-overview.yaml apiVersion: v1 @@ -72303,6 +72312,7 @@ spec: resources: requests: storage: "5Gi" + --- # Source: kube-prometheus-stack/charts/grafana/templates/clusterrole.yaml kind: ClusterRole @@ -72318,6 +72328,7 @@ rules: - apiGroups: [""] # "" indicates the core API group resources: ["configmaps", "secrets"] verbs: ["get", "watch", "list"] + --- # Source: kube-prometheus-stack/charts/kube-state-metrics/templates/role.yaml apiVersion: rbac.authorization.k8s.io/v1 @@ -72474,6 +72485,8 @@ rules: resources: - volumeattachments verbs: ["list", "watch"] + + --- # Source: kube-prometheus-stack/templates/prometheus-operator/clusterrole.yaml apiVersion: rbac.authorization.k8s.io/v1 @@ -72584,6 +72597,7 @@ rules: - storageclasses verbs: - get + --- # Source: kube-prometheus-stack/templates/prometheus/clusterrole.yaml apiVersion: rbac.authorization.k8s.io/v1 @@ -72623,6 +72637,8 @@ rules: verbs: ["get", "list", "watch"] - nonResourceURLs: ["/metrics", "/metrics/cadvisor"] verbs: ["get"] + + --- # Source: kube-prometheus-stack/charts/grafana/templates/clusterrolebinding.yaml kind: ClusterRoleBinding @@ -72642,6 +72658,7 @@ roleRef: kind: ClusterRole name: kube-prometheus-stack-grafana-clusterrole apiGroup: rbac.authorization.k8s.io + --- # Source: kube-prometheus-stack/charts/kube-state-metrics/templates/clusterrolebinding.yaml apiVersion: rbac.authorization.k8s.io/v1 @@ -72691,6 +72708,7 @@ subjects: - kind: ServiceAccount name: kube-prometheus-stack-operator namespace: monitoring + --- # Source: kube-prometheus-stack/templates/prometheus/clusterrolebinding.yaml apiVersion: rbac.authorization.k8s.io/v1 @@ -72715,6 +72733,8 @@ subjects: - kind: ServiceAccount name: kube-prometheus-stack-prometheus namespace: monitoring + + --- # Source: kube-prometheus-stack/charts/grafana/templates/role.yaml apiVersion: rbac.authorization.k8s.io/v1 @@ -72728,6 +72748,7 @@ metadata: app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/version: "12.1.1" rules: [] + --- # Source: kube-prometheus-stack/charts/grafana/templates/rolebinding.yaml apiVersion: rbac.authorization.k8s.io/v1 @@ -72748,6 +72769,7 @@ subjects: - kind: ServiceAccount name: kube-prometheus-stack-grafana namespace: monitoring + --- # Source: kube-prometheus-stack/charts/grafana/templates/service.yaml apiVersion: v1 @@ -72770,6 +72792,7 @@ spec: selector: app.kubernetes.io/name: grafana app.kubernetes.io/instance: kube-prometheus-stack + --- # Source: kube-prometheus-stack/charts/kube-state-metrics/templates/service.yaml apiVersion: v1 @@ -72798,6 +72821,7 @@ spec: selector: app.kubernetes.io/name: kube-state-metrics app.kubernetes.io/instance: kube-prometheus-stack + --- # Source: kube-prometheus-stack/charts/prometheus-node-exporter/templates/service.yaml apiVersion: v1 @@ -72827,6 +72851,7 @@ spec: selector: app.kubernetes.io/name: prometheus-node-exporter app.kubernetes.io/instance: kube-prometheus-stack + --- # Source: kube-prometheus-stack/templates/alertmanager/service.yaml apiVersion: v1 @@ -72887,6 +72912,7 @@ spec: targetPort: 9153 selector: k8s-app: kube-dns + --- # Source: kube-prometheus-stack/templates/exporters/kube-controller-manager/service.yaml apiVersion: v1 @@ -72915,6 +72941,7 @@ spec: selector: component: kube-controller-manager type: ClusterIP + --- # Source: kube-prometheus-stack/templates/exporters/kube-etcd/service.yaml apiVersion: v1 @@ -73027,6 +73054,7 @@ spec: app: kube-prometheus-stack-operator release: "kube-prometheus-stack" type: "ClusterIP" + --- # Source: kube-prometheus-stack/templates/prometheus/service.yaml apiVersion: v1 @@ -73060,6 +73088,7 @@ spec: operator.prometheus.io/name: kube-prometheus-stack-prometheus sessionAffinity: None type: "ClusterIP" + --- # Source: kube-prometheus-stack/charts/prometheus-node-exporter/templates/daemonset.yaml apiVersion: apps/v1 @@ -73193,6 +73222,7 @@ spec: - name: root hostPath: path: / + --- # Source: kube-prometheus-stack/charts/grafana/templates/deployment.yaml apiVersion: apps/v1 @@ -73423,6 +73453,7 @@ spec: name: kube-prometheus-stack-grafana-config-dashboards - name: sc-datasources-volume emptyDir: {} + --- # Source: kube-prometheus-stack/charts/kube-state-metrics/templates/deployment.yaml apiVersion: apps/v1 @@ -73511,6 +73542,7 @@ spec: drop: - ALL readOnlyRootFilesystem: true + --- # Source: kube-prometheus-stack/templates/prometheus-operator/deployment.yaml apiVersion: apps/v1 @@ -73626,6 +73658,91 @@ spec: serviceAccountName: kube-prometheus-stack-operator automountServiceAccountToken: true terminationGracePeriodSeconds: 30 + +--- +# Source: kube-prometheus-stack/templates/prometheus-operator/admission-webhooks/mutatingWebhookConfiguration.yaml +apiVersion: admissionregistration.k8s.io/v1 +kind: MutatingWebhookConfiguration +metadata: + name: kube-prometheus-stack-admission + annotations: + + labels: + app: kube-prometheus-stack-admission + + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/instance: kube-prometheus-stack + app.kubernetes.io/version: "77.5.0" + app.kubernetes.io/part-of: kube-prometheus-stack + chart: kube-prometheus-stack-77.5.0 + release: "kube-prometheus-stack" + heritage: "Helm" + app.kubernetes.io/name: kube-prometheus-stack-prometheus-operator + app.kubernetes.io/component: prometheus-operator-webhook +webhooks: + - name: prometheusrulemutate.monitoring.coreos.com + failurePolicy: Ignore + rules: + - apiGroups: + - monitoring.coreos.com + apiVersions: + - "*" + resources: + - prometheusrules + operations: + - CREATE + - UPDATE + clientConfig: + service: + namespace: monitoring + name: kube-prometheus-stack-operator + path: /admission-prometheusrules/mutate + timeoutSeconds: 10 + admissionReviewVersions: ["v1", "v1beta1"] + sideEffects: None + +--- +# Source: kube-prometheus-stack/templates/prometheus-operator/admission-webhooks/validatingWebhookConfiguration.yaml +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingWebhookConfiguration +metadata: + name: kube-prometheus-stack-admission + annotations: + + labels: + app: kube-prometheus-stack-admission + + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/instance: kube-prometheus-stack + app.kubernetes.io/version: "77.5.0" + app.kubernetes.io/part-of: kube-prometheus-stack + chart: kube-prometheus-stack-77.5.0 + release: "kube-prometheus-stack" + heritage: "Helm" + app.kubernetes.io/name: kube-prometheus-stack-prometheus-operator + app.kubernetes.io/component: prometheus-operator-webhook +webhooks: + - name: prometheusrulemutate.monitoring.coreos.com + failurePolicy: Ignore + rules: + - apiGroups: + - monitoring.coreos.com + apiVersions: + - "*" + resources: + - prometheusrules + operations: + - CREATE + - UPDATE + clientConfig: + service: + namespace: monitoring + name: kube-prometheus-stack-operator + path: /admission-prometheusrules/validate + timeoutSeconds: 10 + admissionReviewVersions: ["v1", "v1beta1"] + sideEffects: None + --- # Source: kube-prometheus-stack/templates/alertmanager/alertmanager.yaml apiVersion: monitoring.coreos.com/v1 @@ -73678,47 +73795,7 @@ spec: - {key: app.kubernetes.io/name, operator: In, values: [alertmanager]} - {key: alertmanager, operator: In, values: [kube-prometheus-stack-alertmanager]} portName: http-web ---- -# Source: kube-prometheus-stack/templates/prometheus-operator/admission-webhooks/mutatingWebhookConfiguration.yaml -apiVersion: admissionregistration.k8s.io/v1 -kind: MutatingWebhookConfiguration -metadata: - name: kube-prometheus-stack-admission - annotations: - - labels: - app: kube-prometheus-stack-admission - - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/instance: kube-prometheus-stack - app.kubernetes.io/version: "77.5.0" - app.kubernetes.io/part-of: kube-prometheus-stack - chart: kube-prometheus-stack-77.5.0 - release: "kube-prometheus-stack" - heritage: "Helm" - app.kubernetes.io/name: kube-prometheus-stack-prometheus-operator - app.kubernetes.io/component: prometheus-operator-webhook -webhooks: - - name: prometheusrulemutate.monitoring.coreos.com - failurePolicy: Ignore - rules: - - apiGroups: - - monitoring.coreos.com - apiVersions: - - "*" - resources: - - prometheusrules - operations: - - CREATE - - UPDATE - clientConfig: - service: - namespace: monitoring - name: kube-prometheus-stack-operator - path: /admission-prometheusrules/mutate - timeoutSeconds: 10 - admissionReviewVersions: ["v1", "v1beta1"] - sideEffects: None + --- # Source: kube-prometheus-stack/templates/prometheus/prometheus.yaml apiVersion: monitoring.coreos.com/v1 @@ -73813,6 +73890,7 @@ spec: - {key: app.kubernetes.io/instance, operator: In, values: [kube-prometheus-stack-prometheus]} portName: http-web hostNetwork: false + --- # Source: kube-prometheus-stack/templates/prometheus/rules-1.14/alertmanager.rules.yaml apiVersion: monitoring.coreos.com/v1 @@ -77274,6 +77352,7 @@ spec: namespaceSelector: matchNames: - monitoring + --- # Source: kube-prometheus-stack/charts/kube-state-metrics/templates/servicemonitor.yaml apiVersion: monitoring.coreos.com/v1 @@ -77299,6 +77378,7 @@ spec: endpoints: - port: http honorLabels: true + --- # Source: kube-prometheus-stack/charts/prometheus-node-exporter/templates/servicemonitor.yaml apiVersion: monitoring.coreos.com/v1 @@ -77327,6 +77407,7 @@ spec: endpoints: - port: http-metrics scheme: http + --- # Source: kube-prometheus-stack/templates/alertmanager/servicemonitor.yaml apiVersion: monitoring.coreos.com/v1 @@ -77360,6 +77441,7 @@ spec: path: "/metrics" - port: reloader-web path: "/metrics" + --- # Source: kube-prometheus-stack/templates/exporters/core-dns/servicemonitor.yaml apiVersion: monitoring.coreos.com/v1 @@ -77390,6 +77472,7 @@ spec: endpoints: - port: http-metrics bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token + --- # Source: kube-prometheus-stack/templates/exporters/kube-api-server/servicemonitor.yaml apiVersion: monitoring.coreos.com/v1 @@ -77431,6 +77514,7 @@ spec: matchLabels: component: apiserver provider: kubernetes + --- # Source: kube-prometheus-stack/templates/exporters/kube-controller-manager/servicemonitor.yaml apiVersion: monitoring.coreos.com/v1 @@ -77465,6 +77549,7 @@ spec: tlsConfig: caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt insecureSkipVerify: true + --- # Source: kube-prometheus-stack/templates/exporters/kube-etcd/servicemonitor.yaml apiVersion: monitoring.coreos.com/v1 @@ -77495,6 +77580,7 @@ spec: endpoints: - port: http-metrics bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token + --- # Source: kube-prometheus-stack/templates/exporters/kube-proxy/servicemonitor.yaml apiVersion: monitoring.coreos.com/v1 @@ -77525,6 +77611,7 @@ spec: endpoints: - port: http-metrics bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token + --- # Source: kube-prometheus-stack/templates/exporters/kube-scheduler/servicemonitor.yaml apiVersion: monitoring.coreos.com/v1 @@ -77559,6 +77646,7 @@ spec: tlsConfig: caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt insecureSkipVerify: true + --- # Source: kube-prometheus-stack/templates/exporters/kubelet/servicemonitor.yaml apiVersion: monitoring.coreos.com/v1 @@ -77673,6 +77761,7 @@ spec: sourceLabels: - __metrics_path__ targetLabel: metrics_path + --- # Source: kube-prometheus-stack/templates/prometheus-operator/servicemonitor.yaml apiVersion: monitoring.coreos.com/v1 @@ -77712,6 +77801,7 @@ spec: namespaceSelector: matchNames: - "monitoring" + --- # Source: kube-prometheus-stack/templates/prometheus/servicemonitor.yaml apiVersion: monitoring.coreos.com/v1 @@ -77745,47 +77835,6 @@ spec: - port: reloader-web path: "/metrics" --- -# Source: kube-prometheus-stack/templates/prometheus-operator/admission-webhooks/validatingWebhookConfiguration.yaml -apiVersion: admissionregistration.k8s.io/v1 -kind: ValidatingWebhookConfiguration -metadata: - name: kube-prometheus-stack-admission - annotations: - - labels: - app: kube-prometheus-stack-admission - - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/instance: kube-prometheus-stack - app.kubernetes.io/version: "77.5.0" - app.kubernetes.io/part-of: kube-prometheus-stack - chart: kube-prometheus-stack-77.5.0 - release: "kube-prometheus-stack" - heritage: "Helm" - app.kubernetes.io/name: kube-prometheus-stack-prometheus-operator - app.kubernetes.io/component: prometheus-operator-webhook -webhooks: - - name: prometheusrulemutate.monitoring.coreos.com - failurePolicy: Ignore - rules: - - apiGroups: - - monitoring.coreos.com - apiVersions: - - "*" - resources: - - prometheusrules - operations: - - CREATE - - UPDATE - clientConfig: - service: - namespace: monitoring - name: kube-prometheus-stack-operator - path: /admission-prometheusrules/validate - timeoutSeconds: 10 - admissionReviewVersions: ["v1", "v1beta1"] - sideEffects: None ---- # Source: kube-prometheus-stack/charts/grafana/templates/tests/test-serviceaccount.yaml apiVersion: v1 kind: ServiceAccount @@ -77800,6 +77849,7 @@ metadata: annotations: "helm.sh/hook": test "helm.sh/hook-delete-policy": "before-hook-creation,hook-succeeded" + --- # Source: kube-prometheus-stack/templates/prometheus-operator/admission-webhooks/job-patch/serviceaccount.yaml apiVersion: v1 @@ -77823,6 +77873,7 @@ metadata: app.kubernetes.io/name: kube-prometheus-stack-prometheus-operator app.kubernetes.io/component: prometheus-operator-webhook automountServiceAccountToken: true + --- # Source: kube-prometheus-stack/charts/grafana/templates/tests/test-configmap.yaml apiVersion: v1 @@ -77846,6 +77897,7 @@ data: code=$(wget --server-response --spider --timeout 90 --tries 10 ${url} 2>&1 | awk '/^ HTTP/{print $2}') [ "$code" == "200" ] } + --- # Source: kube-prometheus-stack/templates/prometheus-operator/admission-webhooks/job-patch/clusterrole.yaml apiVersion: rbac.authorization.k8s.io/v1 @@ -77876,6 +77928,7 @@ rules: verbs: - get - update + --- # Source: kube-prometheus-stack/templates/prometheus-operator/admission-webhooks/job-patch/clusterrolebinding.yaml apiVersion: rbac.authorization.k8s.io/v1 @@ -77905,6 +77958,7 @@ subjects: - kind: ServiceAccount name: kube-prometheus-stack-admission namespace: monitoring + --- # Source: kube-prometheus-stack/templates/prometheus-operator/admission-webhooks/job-patch/role.yaml apiVersion: rbac.authorization.k8s.io/v1 @@ -77935,6 +77989,7 @@ rules: verbs: - get - create + --- # Source: kube-prometheus-stack/templates/prometheus-operator/admission-webhooks/job-patch/rolebinding.yaml apiVersion: rbac.authorization.k8s.io/v1 @@ -77965,6 +78020,7 @@ subjects: - kind: ServiceAccount name: kube-prometheus-stack-admission namespace: monitoring + --- # Source: kube-prometheus-stack/charts/grafana/templates/tests/test.yaml apiVersion: v1 @@ -77996,6 +78052,7 @@ spec: configMap: name: kube-prometheus-stack-grafana-test restartPolicy: Never + --- # Source: kube-prometheus-stack/templates/prometheus-operator/admission-webhooks/job-patch/job-createSecret.yaml apiVersion: batch/v1 @@ -78062,6 +78119,7 @@ spec: runAsUser: 2000 seccompProfile: type: RuntimeDefault + --- # Source: kube-prometheus-stack/templates/prometheus-operator/admission-webhooks/job-patch/job-patchWebhook.yaml apiVersion: batch/v1 diff --git a/packages/manifests/operators/kube-prometheus-stack/77.5.0.yaml b/packages/manifests/operators/kube-prometheus-stack/77.5.0.yaml index 40d575d..7bcb9d4 100644 --- a/packages/manifests/operators/kube-prometheus-stack/77.5.0.yaml +++ b/packages/manifests/operators/kube-prometheus-stack/77.5.0.yaml @@ -71414,6 +71414,7 @@ metadata: app.kubernetes.io/version: "12.1.1" name: kube-prometheus-stack-grafana namespace: monitoring + --- # Source: kube-prometheus-stack/charts/kube-state-metrics/templates/serviceaccount.yaml apiVersion: v1 @@ -71468,6 +71469,7 @@ metadata: release: "kube-prometheus-stack" heritage: "Helm" automountServiceAccountToken: true + --- # Source: kube-prometheus-stack/templates/prometheus-operator/serviceaccount.yaml apiVersion: v1 @@ -71488,6 +71490,7 @@ metadata: app.kubernetes.io/name: kube-prometheus-stack-prometheus-operator app.kubernetes.io/component: prometheus-operator automountServiceAccountToken: true + --- # Source: kube-prometheus-stack/templates/prometheus/serviceaccount.yaml apiVersion: v1 @@ -71508,6 +71511,7 @@ metadata: release: "kube-prometheus-stack" heritage: "Helm" automountServiceAccountToken: true + --- # Source: kube-prometheus-stack/charts/grafana/templates/secret.yaml apiVersion: v1 @@ -71526,6 +71530,7 @@ data: admin-user: "YWRtaW4=" admin-password: "YWRtaW4=" ldap-toml: "" + --- # Source: kube-prometheus-stack/templates/alertmanager/secret.yaml apiVersion: v1 @@ -71545,6 +71550,7 @@ metadata: heritage: "Helm" data: alertmanager.yaml: "Z2xvYmFsOgogIHJlc29sdmVfdGltZW91dDogNW0KaW5oaWJpdF9ydWxlczoKLSBlcXVhbDoKICAtIG5hbWVzcGFjZQogIC0gYWxlcnRuYW1lCiAgc291cmNlX21hdGNoZXJzOgogIC0gc2V2ZXJpdHkgPSBjcml0aWNhbAogIHRhcmdldF9tYXRjaGVyczoKICAtIHNldmVyaXR5ID1+IHdhcm5pbmd8aW5mbwotIGVxdWFsOgogIC0gbmFtZXNwYWNlCiAgLSBhbGVydG5hbWUKICBzb3VyY2VfbWF0Y2hlcnM6CiAgLSBzZXZlcml0eSA9IHdhcm5pbmcKICB0YXJnZXRfbWF0Y2hlcnM6CiAgLSBzZXZlcml0eSA9IGluZm8KLSBlcXVhbDoKICAtIG5hbWVzcGFjZQogIHNvdXJjZV9tYXRjaGVyczoKICAtIGFsZXJ0bmFtZSA9IEluZm9JbmhpYml0b3IKICB0YXJnZXRfbWF0Y2hlcnM6CiAgLSBzZXZlcml0eSA9IGluZm8KLSB0YXJnZXRfbWF0Y2hlcnM6CiAgLSBhbGVydG5hbWUgPSBJbmZvSW5oaWJpdG9yCnJlY2VpdmVyczoKLSBuYW1lOiAibnVsbCIKcm91dGU6CiAgZ3JvdXBfYnk6CiAgLSBuYW1lc3BhY2UKICBncm91cF9pbnRlcnZhbDogNW0KICBncm91cF93YWl0OiAzMHMKICByZWNlaXZlcjogIm51bGwiCiAgcmVwZWF0X2ludGVydmFsOiAxMmgKICByb3V0ZXM6CiAgLSBtYXRjaGVyczoKICAgIC0gYWxlcnRuYW1lID0gIldhdGNoZG9nIgogICAgcmVjZWl2ZXI6ICJudWxsIgp0ZW1wbGF0ZXM6Ci0gL2V0Yy9hbGVydG1hbmFnZXIvY29uZmlnLyoudG1wbA==" + --- # Source: kube-prometheus-stack/charts/grafana/templates/configmap-dashboard-provider.yaml apiVersion: v1 @@ -71572,6 +71578,7 @@ data: options: foldersFromFilesStructure: false path: /tmp/dashboards + --- # Source: kube-prometheus-stack/charts/grafana/templates/configmap.yaml apiVersion: v1 @@ -71600,6 +71607,7 @@ data: provisioning = /etc/grafana/provisioning [server] domain = '' + --- # Source: kube-prometheus-stack/templates/grafana/configmaps-datasources.yaml apiVersion: v1 @@ -71639,6 +71647,7 @@ data: jsonData: handleGrafanaManagedAlerts: false implementation: prometheus + --- # Source: kube-prometheus-stack/templates/grafana/dashboards-1.14/alertmanager-overview.yaml apiVersion: v1 @@ -72303,6 +72312,7 @@ spec: resources: requests: storage: "5Gi" + --- # Source: kube-prometheus-stack/charts/grafana/templates/clusterrole.yaml kind: ClusterRole @@ -72318,6 +72328,7 @@ rules: - apiGroups: [""] # "" indicates the core API group resources: ["configmaps", "secrets"] verbs: ["get", "watch", "list"] + --- # Source: kube-prometheus-stack/charts/kube-state-metrics/templates/role.yaml apiVersion: rbac.authorization.k8s.io/v1 @@ -72474,6 +72485,8 @@ rules: resources: - volumeattachments verbs: ["list", "watch"] + + --- # Source: kube-prometheus-stack/templates/prometheus-operator/clusterrole.yaml apiVersion: rbac.authorization.k8s.io/v1 @@ -72584,6 +72597,7 @@ rules: - storageclasses verbs: - get + --- # Source: kube-prometheus-stack/templates/prometheus/clusterrole.yaml apiVersion: rbac.authorization.k8s.io/v1 @@ -72623,6 +72637,8 @@ rules: verbs: ["get", "list", "watch"] - nonResourceURLs: ["/metrics", "/metrics/cadvisor"] verbs: ["get"] + + --- # Source: kube-prometheus-stack/charts/grafana/templates/clusterrolebinding.yaml kind: ClusterRoleBinding @@ -72642,6 +72658,7 @@ roleRef: kind: ClusterRole name: kube-prometheus-stack-grafana-clusterrole apiGroup: rbac.authorization.k8s.io + --- # Source: kube-prometheus-stack/charts/kube-state-metrics/templates/clusterrolebinding.yaml apiVersion: rbac.authorization.k8s.io/v1 @@ -72691,6 +72708,7 @@ subjects: - kind: ServiceAccount name: kube-prometheus-stack-operator namespace: monitoring + --- # Source: kube-prometheus-stack/templates/prometheus/clusterrolebinding.yaml apiVersion: rbac.authorization.k8s.io/v1 @@ -72715,6 +72733,8 @@ subjects: - kind: ServiceAccount name: kube-prometheus-stack-prometheus namespace: monitoring + + --- # Source: kube-prometheus-stack/charts/grafana/templates/role.yaml apiVersion: rbac.authorization.k8s.io/v1 @@ -72728,6 +72748,7 @@ metadata: app.kubernetes.io/instance: kube-prometheus-stack app.kubernetes.io/version: "12.1.1" rules: [] + --- # Source: kube-prometheus-stack/charts/grafana/templates/rolebinding.yaml apiVersion: rbac.authorization.k8s.io/v1 @@ -72748,6 +72769,7 @@ subjects: - kind: ServiceAccount name: kube-prometheus-stack-grafana namespace: monitoring + --- # Source: kube-prometheus-stack/charts/grafana/templates/service.yaml apiVersion: v1 @@ -72770,6 +72792,7 @@ spec: selector: app.kubernetes.io/name: grafana app.kubernetes.io/instance: kube-prometheus-stack + --- # Source: kube-prometheus-stack/charts/kube-state-metrics/templates/service.yaml apiVersion: v1 @@ -72798,6 +72821,7 @@ spec: selector: app.kubernetes.io/name: kube-state-metrics app.kubernetes.io/instance: kube-prometheus-stack + --- # Source: kube-prometheus-stack/charts/prometheus-node-exporter/templates/service.yaml apiVersion: v1 @@ -72827,6 +72851,7 @@ spec: selector: app.kubernetes.io/name: prometheus-node-exporter app.kubernetes.io/instance: kube-prometheus-stack + --- # Source: kube-prometheus-stack/templates/alertmanager/service.yaml apiVersion: v1 @@ -72887,6 +72912,7 @@ spec: targetPort: 9153 selector: k8s-app: kube-dns + --- # Source: kube-prometheus-stack/templates/exporters/kube-controller-manager/service.yaml apiVersion: v1 @@ -72915,6 +72941,7 @@ spec: selector: component: kube-controller-manager type: ClusterIP + --- # Source: kube-prometheus-stack/templates/exporters/kube-etcd/service.yaml apiVersion: v1 @@ -73027,6 +73054,7 @@ spec: app: kube-prometheus-stack-operator release: "kube-prometheus-stack" type: "ClusterIP" + --- # Source: kube-prometheus-stack/templates/prometheus/service.yaml apiVersion: v1 @@ -73060,6 +73088,7 @@ spec: operator.prometheus.io/name: kube-prometheus-stack-prometheus sessionAffinity: None type: "ClusterIP" + --- # Source: kube-prometheus-stack/charts/prometheus-node-exporter/templates/daemonset.yaml apiVersion: apps/v1 @@ -73193,6 +73222,7 @@ spec: - name: root hostPath: path: / + --- # Source: kube-prometheus-stack/charts/grafana/templates/deployment.yaml apiVersion: apps/v1 @@ -73423,6 +73453,7 @@ spec: name: kube-prometheus-stack-grafana-config-dashboards - name: sc-datasources-volume emptyDir: {} + --- # Source: kube-prometheus-stack/charts/kube-state-metrics/templates/deployment.yaml apiVersion: apps/v1 @@ -73511,6 +73542,7 @@ spec: drop: - ALL readOnlyRootFilesystem: true + --- # Source: kube-prometheus-stack/templates/prometheus-operator/deployment.yaml apiVersion: apps/v1 @@ -73626,6 +73658,91 @@ spec: serviceAccountName: kube-prometheus-stack-operator automountServiceAccountToken: true terminationGracePeriodSeconds: 30 + +--- +# Source: kube-prometheus-stack/templates/prometheus-operator/admission-webhooks/mutatingWebhookConfiguration.yaml +apiVersion: admissionregistration.k8s.io/v1 +kind: MutatingWebhookConfiguration +metadata: + name: kube-prometheus-stack-admission + annotations: + + labels: + app: kube-prometheus-stack-admission + + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/instance: kube-prometheus-stack + app.kubernetes.io/version: "77.5.0" + app.kubernetes.io/part-of: kube-prometheus-stack + chart: kube-prometheus-stack-77.5.0 + release: "kube-prometheus-stack" + heritage: "Helm" + app.kubernetes.io/name: kube-prometheus-stack-prometheus-operator + app.kubernetes.io/component: prometheus-operator-webhook +webhooks: + - name: prometheusrulemutate.monitoring.coreos.com + failurePolicy: Ignore + rules: + - apiGroups: + - monitoring.coreos.com + apiVersions: + - "*" + resources: + - prometheusrules + operations: + - CREATE + - UPDATE + clientConfig: + service: + namespace: monitoring + name: kube-prometheus-stack-operator + path: /admission-prometheusrules/mutate + timeoutSeconds: 10 + admissionReviewVersions: ["v1", "v1beta1"] + sideEffects: None + +--- +# Source: kube-prometheus-stack/templates/prometheus-operator/admission-webhooks/validatingWebhookConfiguration.yaml +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingWebhookConfiguration +metadata: + name: kube-prometheus-stack-admission + annotations: + + labels: + app: kube-prometheus-stack-admission + + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/instance: kube-prometheus-stack + app.kubernetes.io/version: "77.5.0" + app.kubernetes.io/part-of: kube-prometheus-stack + chart: kube-prometheus-stack-77.5.0 + release: "kube-prometheus-stack" + heritage: "Helm" + app.kubernetes.io/name: kube-prometheus-stack-prometheus-operator + app.kubernetes.io/component: prometheus-operator-webhook +webhooks: + - name: prometheusrulemutate.monitoring.coreos.com + failurePolicy: Ignore + rules: + - apiGroups: + - monitoring.coreos.com + apiVersions: + - "*" + resources: + - prometheusrules + operations: + - CREATE + - UPDATE + clientConfig: + service: + namespace: monitoring + name: kube-prometheus-stack-operator + path: /admission-prometheusrules/validate + timeoutSeconds: 10 + admissionReviewVersions: ["v1", "v1beta1"] + sideEffects: None + --- # Source: kube-prometheus-stack/templates/alertmanager/alertmanager.yaml apiVersion: monitoring.coreos.com/v1 @@ -73678,47 +73795,7 @@ spec: - {key: app.kubernetes.io/name, operator: In, values: [alertmanager]} - {key: alertmanager, operator: In, values: [kube-prometheus-stack-alertmanager]} portName: http-web ---- -# Source: kube-prometheus-stack/templates/prometheus-operator/admission-webhooks/mutatingWebhookConfiguration.yaml -apiVersion: admissionregistration.k8s.io/v1 -kind: MutatingWebhookConfiguration -metadata: - name: kube-prometheus-stack-admission - annotations: - - labels: - app: kube-prometheus-stack-admission - - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/instance: kube-prometheus-stack - app.kubernetes.io/version: "77.5.0" - app.kubernetes.io/part-of: kube-prometheus-stack - chart: kube-prometheus-stack-77.5.0 - release: "kube-prometheus-stack" - heritage: "Helm" - app.kubernetes.io/name: kube-prometheus-stack-prometheus-operator - app.kubernetes.io/component: prometheus-operator-webhook -webhooks: - - name: prometheusrulemutate.monitoring.coreos.com - failurePolicy: Ignore - rules: - - apiGroups: - - monitoring.coreos.com - apiVersions: - - "*" - resources: - - prometheusrules - operations: - - CREATE - - UPDATE - clientConfig: - service: - namespace: monitoring - name: kube-prometheus-stack-operator - path: /admission-prometheusrules/mutate - timeoutSeconds: 10 - admissionReviewVersions: ["v1", "v1beta1"] - sideEffects: None + --- # Source: kube-prometheus-stack/templates/prometheus/prometheus.yaml apiVersion: monitoring.coreos.com/v1 @@ -73813,6 +73890,7 @@ spec: - {key: app.kubernetes.io/instance, operator: In, values: [kube-prometheus-stack-prometheus]} portName: http-web hostNetwork: false + --- # Source: kube-prometheus-stack/templates/prometheus/rules-1.14/alertmanager.rules.yaml apiVersion: monitoring.coreos.com/v1 @@ -77274,6 +77352,7 @@ spec: namespaceSelector: matchNames: - monitoring + --- # Source: kube-prometheus-stack/charts/kube-state-metrics/templates/servicemonitor.yaml apiVersion: monitoring.coreos.com/v1 @@ -77299,6 +77378,7 @@ spec: endpoints: - port: http honorLabels: true + --- # Source: kube-prometheus-stack/charts/prometheus-node-exporter/templates/servicemonitor.yaml apiVersion: monitoring.coreos.com/v1 @@ -77327,6 +77407,7 @@ spec: endpoints: - port: http-metrics scheme: http + --- # Source: kube-prometheus-stack/templates/alertmanager/servicemonitor.yaml apiVersion: monitoring.coreos.com/v1 @@ -77360,6 +77441,7 @@ spec: path: "/metrics" - port: reloader-web path: "/metrics" + --- # Source: kube-prometheus-stack/templates/exporters/core-dns/servicemonitor.yaml apiVersion: monitoring.coreos.com/v1 @@ -77390,6 +77472,7 @@ spec: endpoints: - port: http-metrics bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token + --- # Source: kube-prometheus-stack/templates/exporters/kube-api-server/servicemonitor.yaml apiVersion: monitoring.coreos.com/v1 @@ -77431,6 +77514,7 @@ spec: matchLabels: component: apiserver provider: kubernetes + --- # Source: kube-prometheus-stack/templates/exporters/kube-controller-manager/servicemonitor.yaml apiVersion: monitoring.coreos.com/v1 @@ -77465,6 +77549,7 @@ spec: tlsConfig: caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt insecureSkipVerify: true + --- # Source: kube-prometheus-stack/templates/exporters/kube-etcd/servicemonitor.yaml apiVersion: monitoring.coreos.com/v1 @@ -77495,6 +77580,7 @@ spec: endpoints: - port: http-metrics bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token + --- # Source: kube-prometheus-stack/templates/exporters/kube-proxy/servicemonitor.yaml apiVersion: monitoring.coreos.com/v1 @@ -77525,6 +77611,7 @@ spec: endpoints: - port: http-metrics bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token + --- # Source: kube-prometheus-stack/templates/exporters/kube-scheduler/servicemonitor.yaml apiVersion: monitoring.coreos.com/v1 @@ -77559,6 +77646,7 @@ spec: tlsConfig: caFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt insecureSkipVerify: true + --- # Source: kube-prometheus-stack/templates/exporters/kubelet/servicemonitor.yaml apiVersion: monitoring.coreos.com/v1 @@ -77673,6 +77761,7 @@ spec: sourceLabels: - __metrics_path__ targetLabel: metrics_path + --- # Source: kube-prometheus-stack/templates/prometheus-operator/servicemonitor.yaml apiVersion: monitoring.coreos.com/v1 @@ -77712,6 +77801,7 @@ spec: namespaceSelector: matchNames: - "monitoring" + --- # Source: kube-prometheus-stack/templates/prometheus/servicemonitor.yaml apiVersion: monitoring.coreos.com/v1 @@ -77745,47 +77835,6 @@ spec: - port: reloader-web path: "/metrics" --- -# Source: kube-prometheus-stack/templates/prometheus-operator/admission-webhooks/validatingWebhookConfiguration.yaml -apiVersion: admissionregistration.k8s.io/v1 -kind: ValidatingWebhookConfiguration -metadata: - name: kube-prometheus-stack-admission - annotations: - - labels: - app: kube-prometheus-stack-admission - - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/instance: kube-prometheus-stack - app.kubernetes.io/version: "77.5.0" - app.kubernetes.io/part-of: kube-prometheus-stack - chart: kube-prometheus-stack-77.5.0 - release: "kube-prometheus-stack" - heritage: "Helm" - app.kubernetes.io/name: kube-prometheus-stack-prometheus-operator - app.kubernetes.io/component: prometheus-operator-webhook -webhooks: - - name: prometheusrulemutate.monitoring.coreos.com - failurePolicy: Ignore - rules: - - apiGroups: - - monitoring.coreos.com - apiVersions: - - "*" - resources: - - prometheusrules - operations: - - CREATE - - UPDATE - clientConfig: - service: - namespace: monitoring - name: kube-prometheus-stack-operator - path: /admission-prometheusrules/validate - timeoutSeconds: 10 - admissionReviewVersions: ["v1", "v1beta1"] - sideEffects: None ---- # Source: kube-prometheus-stack/charts/grafana/templates/tests/test-serviceaccount.yaml apiVersion: v1 kind: ServiceAccount @@ -77800,6 +77849,7 @@ metadata: annotations: "helm.sh/hook": test "helm.sh/hook-delete-policy": "before-hook-creation,hook-succeeded" + --- # Source: kube-prometheus-stack/templates/prometheus-operator/admission-webhooks/job-patch/serviceaccount.yaml apiVersion: v1 @@ -77823,6 +77873,7 @@ metadata: app.kubernetes.io/name: kube-prometheus-stack-prometheus-operator app.kubernetes.io/component: prometheus-operator-webhook automountServiceAccountToken: true + --- # Source: kube-prometheus-stack/charts/grafana/templates/tests/test-configmap.yaml apiVersion: v1 @@ -77846,6 +77897,7 @@ data: code=$(wget --server-response --spider --timeout 90 --tries 10 ${url} 2>&1 | awk '/^ HTTP/{print $2}') [ "$code" == "200" ] } + --- # Source: kube-prometheus-stack/templates/prometheus-operator/admission-webhooks/job-patch/clusterrole.yaml apiVersion: rbac.authorization.k8s.io/v1 @@ -77876,6 +77928,7 @@ rules: verbs: - get - update + --- # Source: kube-prometheus-stack/templates/prometheus-operator/admission-webhooks/job-patch/clusterrolebinding.yaml apiVersion: rbac.authorization.k8s.io/v1 @@ -77905,6 +77958,7 @@ subjects: - kind: ServiceAccount name: kube-prometheus-stack-admission namespace: monitoring + --- # Source: kube-prometheus-stack/templates/prometheus-operator/admission-webhooks/job-patch/role.yaml apiVersion: rbac.authorization.k8s.io/v1 @@ -77935,6 +77989,7 @@ rules: verbs: - get - create + --- # Source: kube-prometheus-stack/templates/prometheus-operator/admission-webhooks/job-patch/rolebinding.yaml apiVersion: rbac.authorization.k8s.io/v1 @@ -77965,6 +78020,7 @@ subjects: - kind: ServiceAccount name: kube-prometheus-stack-admission namespace: monitoring + --- # Source: kube-prometheus-stack/charts/grafana/templates/tests/test.yaml apiVersion: v1 @@ -77996,6 +78052,7 @@ spec: configMap: name: kube-prometheus-stack-grafana-test restartPolicy: Never + --- # Source: kube-prometheus-stack/templates/prometheus-operator/admission-webhooks/job-patch/job-createSecret.yaml apiVersion: batch/v1 @@ -78062,6 +78119,7 @@ spec: runAsUser: 2000 seccompProfile: type: RuntimeDefault + --- # Source: kube-prometheus-stack/templates/prometheus-operator/admission-webhooks/job-patch/job-patchWebhook.yaml apiVersion: batch/v1 diff --git a/packages/manifests/operators/minio-operator.yaml b/packages/manifests/operators/minio-operator.yaml index 815b550..d1648da 100644 --- a/packages/manifests/operators/minio-operator.yaml +++ b/packages/manifests/operators/minio-operator.yaml @@ -20,6 +20,7 @@ metadata: helm.sh/chart: operator-7.1.1 app.kubernetes.io/version: "v7.1.1" app.kubernetes.io/managed-by: Helm + --- # Source: operator/templates/minio.min.io_tenants.yaml apiVersion: apiextensions.k8s.io/v1 @@ -5774,6 +5775,7 @@ spec: storage: true subresources: status: {} + --- # Source: operator/templates/sts.min.io_policybindings.yaml apiVersion: apiextensions.k8s.io/v1 @@ -5908,6 +5910,7 @@ spec: storage: true subresources: status: {} + --- # Source: operator/templates/operator-clusterrole.yaml apiVersion: rbac.authorization.k8s.io/v1 @@ -6096,6 +6099,7 @@ rules: - patch - update - deletecollection + --- # Source: operator/templates/operator-clusterrolebinding.yaml apiVersion: rbac.authorization.k8s.io/v1 @@ -6114,6 +6118,7 @@ subjects: - kind: ServiceAccount name: minio-operator namespace: minio-operator + --- # Source: operator/templates/operator-service.yaml apiVersion: v1 @@ -6134,6 +6139,7 @@ spec: operator: leader app.kubernetes.io/name: operator app.kubernetes.io/instance: minio-operator + --- # Source: operator/templates/sts-service.yaml apiVersion: v1 @@ -6153,6 +6159,7 @@ spec: selector: app.kubernetes.io/name: operator app.kubernetes.io/instance: minio-operator + --- # Source: operator/templates/operator-deployment.yaml apiVersion: apps/v1 @@ -6165,7 +6172,7 @@ metadata: app.kubernetes.io/version: "v7.1.1" app.kubernetes.io/managed-by: Helm spec: - replicas: 1 + replicas: 2 selector: matchLabels: app.kubernetes.io/name: operator @@ -6185,7 +6192,16 @@ spec: runAsGroup: 1000 runAsNonRoot: true runAsUser: 1000 - # Autopilot-friendly: disable pod anti-affinity to avoid 500m CPU min requirement + affinity: + podAntiAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchExpressions: + - key: name + operator: In + values: + - minio-operator + topologyKey: kubernetes.io/hostname containers: - name: operator image: "quay.io/minio/operator:v7.1.1" @@ -6210,3 +6226,4 @@ spec: runAsUser: 1000 seccompProfile: type: RuntimeDefault + diff --git a/packages/manifests/operators/minio-operator/7.1.1.yaml b/packages/manifests/operators/minio-operator/7.1.1.yaml index 9684232..d1648da 100644 --- a/packages/manifests/operators/minio-operator/7.1.1.yaml +++ b/packages/manifests/operators/minio-operator/7.1.1.yaml @@ -20,6 +20,7 @@ metadata: helm.sh/chart: operator-7.1.1 app.kubernetes.io/version: "v7.1.1" app.kubernetes.io/managed-by: Helm + --- # Source: operator/templates/minio.min.io_tenants.yaml apiVersion: apiextensions.k8s.io/v1 @@ -5774,6 +5775,7 @@ spec: storage: true subresources: status: {} + --- # Source: operator/templates/sts.min.io_policybindings.yaml apiVersion: apiextensions.k8s.io/v1 @@ -5908,6 +5910,7 @@ spec: storage: true subresources: status: {} + --- # Source: operator/templates/operator-clusterrole.yaml apiVersion: rbac.authorization.k8s.io/v1 @@ -6096,6 +6099,7 @@ rules: - patch - update - deletecollection + --- # Source: operator/templates/operator-clusterrolebinding.yaml apiVersion: rbac.authorization.k8s.io/v1 @@ -6114,6 +6118,7 @@ subjects: - kind: ServiceAccount name: minio-operator namespace: minio-operator + --- # Source: operator/templates/operator-service.yaml apiVersion: v1 @@ -6134,6 +6139,7 @@ spec: operator: leader app.kubernetes.io/name: operator app.kubernetes.io/instance: minio-operator + --- # Source: operator/templates/sts-service.yaml apiVersion: v1 @@ -6153,6 +6159,7 @@ spec: selector: app.kubernetes.io/name: operator app.kubernetes.io/instance: minio-operator + --- # Source: operator/templates/operator-deployment.yaml apiVersion: apps/v1 diff --git a/packages/manifests/operators/tekton-pipelines.yaml b/packages/manifests/operators/tekton-pipelines.yaml new file mode 100644 index 0000000..28f3a55 --- /dev/null +++ b/packages/manifests/operators/tekton-pipelines.yaml @@ -0,0 +1,28155 @@ +# Source: https://github.com/tektoncd/pipeline/releases/download/v1.15.0/release.yaml +--- +# Copyright 2019 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: Namespace +metadata: + name: tekton-pipelines + labels: + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines + pod-security.kubernetes.io/enforce: restricted +--- +# Copyright 2020-2022 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: tekton-pipelines-controller-cluster-access + labels: + app.kubernetes.io/component: controller + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +rules: + - apiGroups: [""] + # Controller needs to watch Pods created by TaskRuns to see them progress. + resources: ["pods"] + verbs: ["list", "watch"] + - apiGroups: [""] + # Controller needs to get the list of cordoned nodes over the course of a single run + resources: ["nodes"] + verbs: ["list"] + # Controller needs cluster access to all of the CRDs that it is responsible for + # managing. + - apiGroups: ["tekton.dev"] + resources: ["tasks", "taskruns", "pipelines", "pipelineruns", "customruns", "stepactions"] + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] + - apiGroups: ["tekton.dev"] + resources: ["verificationpolicies"] + verbs: ["get", "list", "watch"] + - apiGroups: ["tekton.dev"] + resources: ["taskruns/finalizers", "pipelineruns/finalizers", "customruns/finalizers"] + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] + - apiGroups: ["tekton.dev"] + resources: ["tasks/status", "taskruns/status", "pipelines/status", "pipelineruns/status", + "customruns/status", "verificationpolicies/status", "stepactions/status"] + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] + # resolution.tekton.dev + - apiGroups: ["resolution.tekton.dev"] + resources: ["resolutionrequests", "resolutionrequests/status"] + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] +--- +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + # This is the access that the controller needs on a per-namespace basis. + name: tekton-pipelines-controller-tenant-access + labels: + app.kubernetes.io/component: controller + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +rules: + # Read-write access to create Pods and PVCs (for Workspaces) + - apiGroups: [""] + resources: ["pods", "persistentvolumeclaims"] + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] + # Write permissions to publish events. + - apiGroups: [""] + resources: ["events"] + verbs: ["create", "update", "patch"] + # Read-only access to these. + - apiGroups: [""] + resources: ["configmaps", "limitranges", "secrets", "serviceaccounts"] + verbs: ["get", "list", "watch"] + # Read-write access to StatefulSets for Affinity Assistant. + - apiGroups: ["apps"] + resources: ["statefulsets"] + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] +--- +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: tekton-pipelines-webhook-cluster-access + labels: + app.kubernetes.io/component: webhook + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +rules: + # The webhook needs to be able to get and update customresourcedefinitions, + # mainly to update the webhook certificates. + - apiGroups: ["apiextensions.k8s.io"] + resources: ["customresourcedefinitions", "customresourcedefinitions/status"] + verbs: ["get", "update", "patch"] + resourceNames: + - pipelines.tekton.dev + - pipelineruns.tekton.dev + - tasks.tekton.dev + - taskruns.tekton.dev + - resolutionrequests.resolution.tekton.dev + - customruns.tekton.dev + - verificationpolicies.tekton.dev + - stepactions.tekton.dev + # knative.dev/pkg needs list/watch permissions to set up informers for the webhook. + - apiGroups: ["apiextensions.k8s.io"] + resources: ["customresourcedefinitions"] + verbs: ["list", "watch"] + - apiGroups: ["admissionregistration.k8s.io"] + # The webhook performs a reconciliation on these two resources and continuously + # updates configuration. + resources: ["mutatingwebhookconfigurations", "validatingwebhookconfigurations"] + # knative starts informers on these things, which is why we need get, list and watch. + verbs: ["list", "watch"] + - apiGroups: ["admissionregistration.k8s.io"] + resources: ["mutatingwebhookconfigurations"] + # This mutating webhook is responsible for applying defaults to tekton objects + # as they are received. + resourceNames: ["webhook.pipeline.tekton.dev"] + # When there are changes to the configs or secrets, knative updates the mutatingwebhook config + # with the updated certificates or the refreshed set of rules. + verbs: ["get", "update", "delete"] + - apiGroups: ["admissionregistration.k8s.io"] + resources: ["validatingwebhookconfigurations"] + # validation.webhook.pipeline.tekton.dev performs schema validation when you, for example, create TaskRuns. + # config.webhook.pipeline.tekton.dev validates the logging configuration against knative's logging structure + resourceNames: ["validation.webhook.pipeline.tekton.dev", "config.webhook.pipeline.tekton.dev"] + # When there are changes to the configs or secrets, knative updates the validatingwebhook config + # with the updated certificates or the refreshed set of rules. + verbs: ["get", "update", "delete"] + - apiGroups: [""] + resources: ["namespaces"] + verbs: ["get"] + # The webhook configured the namespace as the OwnerRef on various cluster-scoped resources, + # which requires we can Get the system namespace. + resourceNames: ["tekton-pipelines"] + - apiGroups: [""] + resources: ["namespaces/finalizers"] + verbs: ["update"] + # The webhook configured the namespace as the OwnerRef on various cluster-scoped resources, + # which requires we can update the system namespace finalizers. + resourceNames: ["tekton-pipelines"] +--- +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: tekton-events-controller-cluster-access + labels: + app.kubernetes.io/component: events + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +rules: + - apiGroups: ["tekton.dev"] + resources: ["tasks", "taskruns", "pipelines", "pipelineruns", "customruns"] + verbs: ["get", "list", "watch"] + - apiGroups: [""] + resources: ["events"] + verbs: ["create", "patch"] +--- +# Copyright 2020 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +kind: Role +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: tekton-pipelines-controller + namespace: tekton-pipelines + labels: + app.kubernetes.io/component: controller + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +rules: + - apiGroups: [""] + resources: ["configmaps"] + verbs: ["list", "watch"] + # The controller needs access to these configmaps for logging information and runtime configuration. + - apiGroups: [""] + resources: ["configmaps"] + verbs: ["get"] + resourceNames: ["config-logging", "config-observability", "feature-flags", "config-leader-election-controller", + "config-registry-cert"] +--- +kind: Role +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: tekton-pipelines-webhook + namespace: tekton-pipelines + labels: + app.kubernetes.io/component: webhook + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +rules: + - apiGroups: [""] + resources: ["configmaps"] + verbs: ["list", "watch"] + # The webhook needs access to these configmaps for logging information. + - apiGroups: [""] + resources: ["configmaps"] + verbs: ["get"] + resourceNames: ["config-logging", "config-observability", "config-leader-election-webhook", + "feature-flags"] + - apiGroups: [""] + resources: ["secrets"] + verbs: ["list", "watch"] + # The webhook daemon makes a reconciliation loop on webhook-certs. Whenever + # the secret changes it updates the webhook configurations with the certificates + # stored in the secret. + - apiGroups: [""] + resources: ["secrets"] + verbs: ["get", "update"] + resourceNames: ["webhook-certs"] +--- +kind: Role +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: tekton-pipelines-events-controller + namespace: tekton-pipelines + labels: + app.kubernetes.io/component: events + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +rules: + - apiGroups: [""] + resources: ["configmaps"] + verbs: ["list", "watch"] + # The controller needs access to these configmaps for logging information and runtime configuration. + - apiGroups: [""] + resources: ["configmaps"] + verbs: ["get"] + resourceNames: ["config-logging", "config-observability", "feature-flags", "config-leader-election-events", + "config-registry-cert"] +--- +kind: Role +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: tekton-pipelines-leader-election + namespace: tekton-pipelines + labels: + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +rules: + # We uses leases for leaderelection + - apiGroups: ["coordination.k8s.io"] + resources: ["leases"] + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: tekton-pipelines-info + namespace: tekton-pipelines + labels: + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +rules: + # All system:authenticated users needs to have access + # of the pipelines-info ConfigMap even if they don't + # have access to the other resources present in the + # installed namespace. + - apiGroups: [""] + resources: ["configmaps"] + resourceNames: ["pipelines-info"] + verbs: ["get"] +--- +# Copyright 2019 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +apiVersion: v1 +kind: ServiceAccount +metadata: + name: tekton-pipelines-controller + namespace: tekton-pipelines + labels: + app.kubernetes.io/component: controller + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: tekton-pipelines-webhook + namespace: tekton-pipelines + labels: + app.kubernetes.io/component: webhook + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: tekton-events-controller + namespace: tekton-pipelines + labels: + app.kubernetes.io/component: events + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +--- +# Copyright 2019 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: tekton-pipelines-controller-cluster-access + labels: + app.kubernetes.io/component: controller + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +subjects: + - kind: ServiceAccount + name: tekton-pipelines-controller + namespace: tekton-pipelines +roleRef: + kind: ClusterRole + name: tekton-pipelines-controller-cluster-access + apiGroup: rbac.authorization.k8s.io +--- +# If this ClusterRoleBinding is replaced with a RoleBinding +# then the ClusterRole would be namespaced. The access described by +# the tekton-pipelines-controller-tenant-access ClusterRole would +# be scoped to individual tenant namespaces. +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: tekton-pipelines-controller-tenant-access + labels: + app.kubernetes.io/component: controller + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +subjects: + - kind: ServiceAccount + name: tekton-pipelines-controller + namespace: tekton-pipelines +roleRef: + kind: ClusterRole + name: tekton-pipelines-controller-tenant-access + apiGroup: rbac.authorization.k8s.io +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: tekton-pipelines-webhook-cluster-access + labels: + app.kubernetes.io/component: webhook + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +subjects: + - kind: ServiceAccount + name: tekton-pipelines-webhook + namespace: tekton-pipelines +roleRef: + kind: ClusterRole + name: tekton-pipelines-webhook-cluster-access + apiGroup: rbac.authorization.k8s.io +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: tekton-events-controller-cluster-access + labels: + app.kubernetes.io/component: events + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +subjects: + - kind: ServiceAccount + name: tekton-events-controller + namespace: tekton-pipelines +roleRef: + kind: ClusterRole + name: tekton-events-controller-cluster-access + apiGroup: rbac.authorization.k8s.io +--- +# Copyright 2020 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: tekton-pipelines-controller + namespace: tekton-pipelines + labels: + app.kubernetes.io/component: controller + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +subjects: + - kind: ServiceAccount + name: tekton-pipelines-controller + namespace: tekton-pipelines +roleRef: + kind: Role + name: tekton-pipelines-controller + apiGroup: rbac.authorization.k8s.io +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: tekton-pipelines-webhook + namespace: tekton-pipelines + labels: + app.kubernetes.io/component: webhook + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +subjects: + - kind: ServiceAccount + name: tekton-pipelines-webhook + namespace: tekton-pipelines +roleRef: + kind: Role + name: tekton-pipelines-webhook + apiGroup: rbac.authorization.k8s.io +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: tekton-pipelines-controller-leaderelection + namespace: tekton-pipelines + labels: + app.kubernetes.io/component: controller + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +subjects: + - kind: ServiceAccount + name: tekton-pipelines-controller + namespace: tekton-pipelines +roleRef: + kind: Role + name: tekton-pipelines-leader-election + apiGroup: rbac.authorization.k8s.io +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: tekton-pipelines-webhook-leaderelection + namespace: tekton-pipelines + labels: + app.kubernetes.io/component: webhook + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +subjects: + - kind: ServiceAccount + name: tekton-pipelines-webhook + namespace: tekton-pipelines +roleRef: + kind: Role + name: tekton-pipelines-leader-election + apiGroup: rbac.authorization.k8s.io +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: tekton-pipelines-info + namespace: tekton-pipelines + labels: + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +subjects: + # Giving all system:authenticated users the access of the + # ConfigMap which contains version information. + - kind: Group + name: system:authenticated + apiGroup: rbac.authorization.k8s.io +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: tekton-pipelines-info +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: tekton-pipelines-events-controller + namespace: tekton-pipelines + labels: + app.kubernetes.io/component: events + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +subjects: + - kind: ServiceAccount + name: tekton-events-controller + namespace: tekton-pipelines +roleRef: + kind: Role + name: tekton-pipelines-events-controller + apiGroup: rbac.authorization.k8s.io +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: tekton-events-controller-leaderelection + namespace: tekton-pipelines + labels: + app.kubernetes.io/component: events + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +subjects: + - kind: ServiceAccount + name: tekton-events-controller + namespace: tekton-pipelines +roleRef: + kind: Role + name: tekton-pipelines-leader-election + apiGroup: rbac.authorization.k8s.io +--- +# Copyright 2020 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: customruns.tekton.dev + labels: + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines + pipeline.tekton.dev/release: "v1.15.0" + version: "v1.15.0" +spec: + group: tekton.dev + preserveUnknownFields: false + versions: + - name: v1beta1 + served: true + storage: true + schema: + openAPIV3Schema: + description: CustomRun represents a single execution of a Custom Task. + type: object + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: CustomRunSpec defines the desired state of CustomRun + type: object + properties: + customRef: + description: TaskRef can be used to refer to a specific instance + of a task. + type: object + properties: + apiVersion: + description: |- + API version of the referent + Note: A Task with non-empty APIVersion and Kind is considered a Custom Task + type: string + bundle: + description: |- + Bundle url reference to a Tekton Bundle. + + Deprecated: Please use ResolverRef with the bundles resolver instead. + The field is staying there for go client backward compatibility, but is not used/allowed anymore. + type: string + kind: + description: |- + TaskKind indicates the Kind of the Task: + 1. Namespaced Task when Kind is set to "Task". If Kind is "", it defaults to "Task". + 2. Custom Task when Kind is non-empty and APIVersion is non-empty + type: string + name: + description: 'Name of the referent; More info: http://kubernetes.io/docs/user-guide/identifiers#names' + type: string + params: + description: |- + Params contains the parameters used to identify the + referenced Tekton resource. Example entries might include + "repo" or "path" but the set of params ultimately depends on + the chosen resolver. + type: array + items: + description: Param declares an ParamValues to use for the + parameter called name. + type: object + required: + - name + - value + properties: + name: + type: string + value: + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + resolver: + description: |- + Resolver is the name of the resolver that should perform + resolution of the referenced Tekton resource, such as "git". + type: string + customSpec: + description: Spec is a specification of a custom task + type: object + properties: + apiVersion: + type: string + kind: + type: string + metadata: + description: PipelineTaskMetadata contains the labels or annotations + for an EmbeddedTask + type: object + properties: + annotations: + type: object + additionalProperties: + type: string + labels: + type: object + additionalProperties: + type: string + spec: + description: Spec is a specification of a custom task + type: object + x-kubernetes-preserve-unknown-fields: true + params: + description: Params is a list of Param + type: array + items: + description: Param declares an ParamValues to use for the parameter + called name. + type: object + required: + - name + - value + properties: + name: + type: string + value: + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + retries: + description: Used for propagating retries count to custom tasks + type: integer + serviceAccountName: + type: string + status: + description: Used for cancelling a customrun (and maybe more later + on) + type: string + statusMessage: + description: Status message for cancellation. + type: string + timeout: + description: |- + Time after which the custom-task times out. + Refer Go's ParseDuration documentation for expected format: https://golang.org/pkg/time/#ParseDuration + type: string + workspaces: + description: Workspaces is a list of WorkspaceBindings from volumes + to workspaces. + type: array + items: + description: WorkspaceBinding maps a Task's declared workspace + to a Volume. + type: object + required: + - name + properties: + configMap: + description: ConfigMap represents a configMap that should + populate this workspace. + type: object + properties: + defaultMode: + description: |- + defaultMode is optional: mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + Defaults to 0644. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + ConfigMap will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the ConfigMap, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: optional specify whether the ConfigMap or + its keys must be defined + type: boolean + x-kubernetes-map-type: atomic + csi: + description: CSI (Container Storage Interface) represents + ephemeral storage that is handled by certain external CSI + drivers. + type: object + required: + - driver + properties: + driver: + description: |- + driver is the name of the CSI driver that handles this volume. + Consult with your admin for the correct name as registered in the cluster. + type: string + fsType: + description: |- + fsType to mount. Ex. "ext4", "xfs", "ntfs". + If not provided, the empty value is passed to the associated CSI driver + which will determine the default filesystem to apply. + type: string + nodePublishSecretRef: + description: |- + nodePublishSecretRef is a reference to the secret object containing + sensitive information to pass to the CSI driver to complete the CSI + NodePublishVolume and NodeUnpublishVolume calls. + This field is optional, and may be empty if no secret is required. If the + secret object contains more than one secret, all secret references are passed. + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + x-kubernetes-map-type: atomic + readOnly: + description: |- + readOnly specifies a read-only configuration for the volume. + Defaults to false (read/write). + type: boolean + volumeAttributes: + description: |- + volumeAttributes stores driver-specific properties that are passed to the CSI + driver. Consult your driver's documentation for supported values. + type: object + additionalProperties: + type: string + emptyDir: + description: |- + EmptyDir represents a temporary directory that shares a Task's lifetime. + More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir + Either this OR PersistentVolumeClaim can be used. + type: object + properties: + medium: + description: |- + medium represents what type of storage medium should back this directory. + The default is "" which means to use the node's default medium. + Must be an empty string (default) or Memory. + More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir + type: string + sizeLimit: + description: |- + sizeLimit is the total amount of local storage required for this EmptyDir volume. + The size limit is also applicable for memory medium. + The maximum usage on memory medium EmptyDir would be the minimum value between + the SizeLimit specified here and the sum of memory limits of all containers in a pod. + The default is nil which means that the limit is undefined. + More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + name: + description: Name is the name of the workspace populated by + the volume. + type: string + persistentVolumeClaim: + description: |- + PersistentVolumeClaimVolumeSource represents a reference to a + PersistentVolumeClaim in the same namespace. Either this OR EmptyDir can be used. + type: object + required: + - claimName + properties: + claimName: + description: |- + claimName is the name of a PersistentVolumeClaim in the same namespace as the pod using this volume. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims + type: string + readOnly: + description: |- + readOnly Will force the ReadOnly setting in VolumeMounts. + Default false. + type: boolean + projected: + description: Projected represents a projected volume that + should populate this workspace. + type: object + properties: + defaultMode: + description: |- + defaultMode are the mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + sources: + description: |- + sources is the list of volume projections. Each entry in this list + handles one source. + type: array + items: + description: |- + Projection that may be projected along with other supported volume types. + Exactly one of these fields must be set. + type: object + properties: + clusterTrustBundle: + description: |- + ClusterTrustBundle allows a pod to access the `.spec.trustBundle` field + of ClusterTrustBundle objects in an auto-updating file. + + Alpha, gated by the ClusterTrustBundleProjection feature gate. + + ClusterTrustBundle objects can either be selected by name, or by the + combination of signer name and a label selector. + + Kubelet performs aggressive normalization of the PEM contents written + into the pod filesystem. Esoteric PEM features such as inter-block + comments and block headers are stripped. Certificates are deduplicated. + The ordering of certificates within the file is arbitrary, and Kubelet + may change the order over time. + type: object + required: + - path + properties: + labelSelector: + description: |- + Select all ClusterTrustBundles that match this label selector. Only has + effect if signerName is set. Mutually-exclusive with name. If unset, + interpreted as "match nothing". If set but empty, interpreted as "match + everything". + type: object + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + name: + description: |- + Select a single ClusterTrustBundle by object name. Mutually-exclusive + with signerName and labelSelector. + type: string + optional: + description: |- + If true, don't block pod startup if the referenced ClusterTrustBundle(s) + aren't available. If using name, then the named ClusterTrustBundle is + allowed not to exist. If using signerName, then the combination of + signerName and labelSelector is allowed to match zero + ClusterTrustBundles. + type: boolean + path: + description: Relative path from the volume root + to write the bundle. + type: string + signerName: + description: |- + Select all ClusterTrustBundles that match this signer name. + Mutually-exclusive with name. The contents of all selected + ClusterTrustBundles will be unified and deduplicated. + type: string + configMap: + description: configMap information about the configMap + data to project + type: object + properties: + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + ConfigMap will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the ConfigMap, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within + a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: optional specify whether the ConfigMap + or its keys must be defined + type: boolean + x-kubernetes-map-type: atomic + downwardAPI: + description: downwardAPI information about the downwardAPI + data to project + type: object + properties: + items: + description: Items is a list of DownwardAPIVolume + file + type: array + items: + description: DownwardAPIVolumeFile represents + information to create the file containing + the pod field + type: object + required: + - path + properties: + fieldRef: + description: 'Required: Selects a field + of the pod: only annotations, labels, + name, namespace and uid are supported.' + type: object + required: + - fieldPath + properties: + apiVersion: + description: Version of the schema + the FieldPath is written in terms + of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to + select in the specified API version. + type: string + x-kubernetes-map-type: atomic + mode: + description: |- + Optional: mode bits used to set permissions on this file, must be an octal value + between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: 'Required: Path is the relative + path name of the file to be created. + Must not be absolute or contain the + ''..'' path. Must be utf-8 encoded. + The first item of the relative path + must not start with ''..''' + type: string + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported. + type: object + required: + - resource + properties: + containerName: + description: 'Container name: required + for volumes, optional for env vars' + type: string + divisor: + description: Specifies the output + format of the exposed resources, + defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to + select' + type: string + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + secret: + description: secret information about the secret + data to project + type: object + properties: + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + Secret will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the Secret, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within + a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: optional field specify whether + the Secret or its key must be defined + type: boolean + x-kubernetes-map-type: atomic + serviceAccountToken: + description: serviceAccountToken is information + about the serviceAccountToken data to project + type: object + required: + - path + properties: + audience: + description: |- + audience is the intended audience of the token. A recipient of a token + must identify itself with an identifier specified in the audience of the + token, and otherwise should reject the token. The audience defaults to the + identifier of the apiserver. + type: string + expirationSeconds: + description: |- + expirationSeconds is the requested duration of validity of the service + account token. As the token approaches expiration, the kubelet volume + plugin will proactively rotate the service account token. The kubelet will + start trying to rotate the token if the token is older than 80 percent of + its time to live or if the token is older than 24 hours.Defaults to 1 hour + and must be at least 10 minutes. + type: integer + format: int64 + path: + description: |- + path is the path relative to the mount point of the file to project the + token into. + type: string + x-kubernetes-list-type: atomic + secret: + description: Secret represents a secret that should populate + this workspace. + type: object + properties: + defaultMode: + description: |- + defaultMode is Optional: mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values + for mode bits. Defaults to 0644. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + items: + description: |- + items If unspecified, each key-value pair in the Data field of the referenced + Secret will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the Secret, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + optional: + description: optional field specify whether the Secret + or its keys must be defined + type: boolean + secretName: + description: |- + secretName is the name of the secret in the pod's namespace to use. + More info: https://kubernetes.io/docs/concepts/storage/volumes#secret + type: string + subPath: + description: |- + SubPath is optionally a directory on the volume which should be used + for this binding (i.e. the volume will be mounted at this sub directory). + type: string + volumeClaimTemplate: + description: |- + VolumeClaimTemplate is a template for a claim that will be created in the same namespace. + The PipelineRun controller is responsible for creating a unique claim for each instance of PipelineRun. + See PersistentVolumeClaim (API version: v1) + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + status: + description: CustomRunStatus defines the observed state of CustomRun + type: object + properties: + annotations: + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + additionalProperties: + type: string + completionTime: + description: CompletionTime is the time the build completed. + type: string + format: date-time + conditions: + description: Conditions the latest available observations of a resource's + current state. + type: array + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + type: object + required: + - status + - type + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating details about + the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, False, + Unknown. + type: string + type: + description: Type of condition. + type: string + extraFields: + description: |- + ExtraFields holds arbitrary fields provided by the custom task + controller. + x-kubernetes-preserve-unknown-fields: true + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + type: integer + format: int64 + results: + description: |- + Results reports any output result values to be consumed by later + tasks in a pipeline. + type: array + items: + description: CustomRunResult used to describe the results of a + task + type: object + required: + - name + - value + properties: + name: + description: Name the given name + type: string + value: + description: Value the given value of the result + type: string + retriesStatus: + description: |- + RetriesStatus contains the history of CustomRunStatus, in case of a retry. + See CustomRun.status (API version: tekton.dev/v1beta1) + x-kubernetes-preserve-unknown-fields: true + startTime: + description: StartTime is the time the build is actually started. + type: string + format: date-time + additionalPrinterColumns: + - name: Succeeded + type: string + jsonPath: ".status.conditions[?(@.type==\"Succeeded\")].status" + - name: Reason + type: string + jsonPath: ".status.conditions[?(@.type==\"Succeeded\")].reason" + - name: StartTime + type: date + jsonPath: .status.startTime + - name: CompletionTime + type: date + jsonPath: .status.completionTime + # Opt into the status subresource so metadata.generation + # starts to increment + subresources: + status: {} + names: + kind: CustomRun + plural: customruns + singular: customrun + categories: + - tekton + - tekton-pipelines + scope: Namespaced +--- +# Copyright 2019 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: pipelines.tekton.dev + labels: + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines + pipeline.tekton.dev/release: "v1.15.0" + version: "v1.15.0" +spec: + group: tekton.dev + preserveUnknownFields: false + versions: + - name: v1beta1 + served: true + storage: false + subresources: + status: {} + schema: + openAPIV3Schema: + description: |- + Pipeline + Deprecated: Please use v1.Pipeline instead. + type: object + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: Spec + type: object + properties: + description: + description: Description + type: string + displayName: + description: DisplayName + type: string + finally: + description: Finally + type: array + items: + description: PipelineTask + type: object + properties: + description: + description: Description + type: string + displayName: + description: DisplayName + type: string + matrix: + description: Matrix + type: object + properties: + include: + description: Include + type: array + items: + description: IncludeParams + type: object + properties: + name: + description: Name + type: string + params: + description: Params + type: array + items: + description: Param + type: object + required: + - name + - value + properties: + name: + type: string + value: + description: Value + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + params: + description: Params + type: array + items: + description: Param + type: object + required: + - name + - value + properties: + name: + type: string + value: + description: Value + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + name: + description: Name + type: string + onError: + description: OnError + type: string + params: + description: Params + type: array + items: + description: Param + type: object + required: + - name + - value + properties: + name: + type: string + value: + description: Value + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + pipelineRef: + description: PipelineRef + type: object + properties: + apiVersion: + description: APIVersion + type: string + bundle: + description: |- + Deprecated: Please use ResolverRef with the bundles resolver instead. + Bundle + type: string + name: + description: Name + type: string + params: + description: Params + type: array + items: + description: Param + type: object + required: + - name + - value + properties: + name: + type: string + value: + description: Value + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + resolver: + description: Resolver + type: string + pipelineSpec: + description: PipelineSpec + x-kubernetes-preserve-unknown-fields: true + resources: + description: |- + Resources + Deprecated: Unused, preserved only for backwards compatibility + type: object + properties: + inputs: + description: Inputs + type: array + items: + description: |- + PipelineTaskInputResource + Deprecated: Unused, preserved only for backwards compatibility + type: object + required: + - name + - resource + properties: + from: + description: From + type: array + items: + type: string + x-kubernetes-list-type: atomic + name: + description: Name + type: string + resource: + description: Resource + type: string + x-kubernetes-list-type: atomic + outputs: + description: Outputs + type: array + items: + description: |- + PipelineTaskOutputResource + Deprecated: Unused, preserved only for backwards compatibility + type: object + required: + - name + - resource + properties: + name: + description: Name + type: string + resource: + description: Resource + type: string + x-kubernetes-list-type: atomic + retries: + description: Retries + type: integer + runAfter: + description: RunAfter + type: array + items: + type: string + x-kubernetes-list-type: atomic + taskRef: + description: TaskRef + type: object + properties: + apiVersion: + description: APIVersion + type: string + bundle: + description: |- + Deprecated: Please use ResolverRef with the bundles resolver instead. + Bundle + type: string + kind: + description: Kind + type: string + name: + description: Name + type: string + params: + description: Params + type: array + items: + description: Param + type: object + required: + - name + - value + properties: + name: + type: string + value: + description: Value + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + resolver: + description: Resolver + type: string + taskSpec: + description: TaskSpec + x-kubernetes-preserve-unknown-fields: true + timeout: + description: Timeout + type: string + when: + description: WhenExpressions + type: array + items: + description: WhenExpression + type: object + properties: + cel: + description: CEL + type: string + input: + description: Input + type: string + operator: + description: Operator + type: string + values: + description: Values + type: array + items: + type: string + x-kubernetes-list-type: atomic + workspaces: + description: Workspaces + type: array + items: + description: WorkspacePipelineTaskBinding + type: object + required: + - name + properties: + name: + description: Name + type: string + subPath: + description: SubPath + type: string + workspace: + description: Workspace + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + params: + description: Params + type: array + items: + description: ParamSpec + type: object + required: + - name + properties: + default: + description: Default + x-kubernetes-preserve-unknown-fields: true + description: + description: Description + type: string + enum: + description: Enum + type: array + items: + type: string + name: + description: Name + type: string + properties: + description: Properties + type: object + additionalProperties: + description: PropertySpec + type: object + properties: + type: + description: ParamType + type: string + type: + description: Type + type: string + x-kubernetes-list-type: atomic + resources: + description: |- + Resources + Deprecated: Unused, preserved only for backwards compatibility + type: array + items: + description: |- + PipelineDeclaredResource + Deprecated: Unused, preserved only for backwards compatibility + type: object + required: + - name + - type + properties: + name: + description: Name + type: string + optional: + description: Optional + type: boolean + type: + description: Type + type: string + x-kubernetes-list-type: atomic + results: + description: Results + type: array + items: + description: PipelineResult + type: object + required: + - name + - value + properties: + description: + description: Description + type: string + name: + description: Name + type: string + type: + description: Type + type: string + value: + description: Value + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + tasks: + description: Tasks + type: array + items: + description: PipelineTask + type: object + properties: + description: + description: Description + type: string + displayName: + description: DisplayName + type: string + matrix: + description: Matrix + type: object + properties: + include: + description: Include + type: array + items: + description: IncludeParams + type: object + properties: + name: + description: Name + type: string + params: + description: Params + type: array + items: + description: Param + type: object + required: + - name + - value + properties: + name: + type: string + value: + description: Value + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + params: + description: Params + type: array + items: + description: Param + type: object + required: + - name + - value + properties: + name: + type: string + value: + description: Value + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + name: + description: Name + type: string + onError: + description: OnError + type: string + params: + description: Params + type: array + items: + description: Param + type: object + required: + - name + - value + properties: + name: + type: string + value: + description: Value + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + pipelineRef: + description: PipelineRef + type: object + properties: + apiVersion: + description: APIVersion + type: string + bundle: + description: |- + Deprecated: Please use ResolverRef with the bundles resolver instead. + Bundle + type: string + name: + description: Name + type: string + params: + description: Params + type: array + items: + description: Param + type: object + required: + - name + - value + properties: + name: + type: string + value: + description: Value + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + resolver: + description: Resolver + type: string + pipelineSpec: + description: PipelineSpec + x-kubernetes-preserve-unknown-fields: true + resources: + description: |- + Resources + Deprecated: Unused, preserved only for backwards compatibility + type: object + properties: + inputs: + description: Inputs + type: array + items: + description: |- + PipelineTaskInputResource + Deprecated: Unused, preserved only for backwards compatibility + type: object + required: + - name + - resource + properties: + from: + description: From + type: array + items: + type: string + x-kubernetes-list-type: atomic + name: + description: Name + type: string + resource: + description: Resource + type: string + x-kubernetes-list-type: atomic + outputs: + description: Outputs + type: array + items: + description: |- + PipelineTaskOutputResource + Deprecated: Unused, preserved only for backwards compatibility + type: object + required: + - name + - resource + properties: + name: + description: Name + type: string + resource: + description: Resource + type: string + x-kubernetes-list-type: atomic + retries: + description: Retries + type: integer + runAfter: + description: RunAfter + type: array + items: + type: string + x-kubernetes-list-type: atomic + taskRef: + description: TaskRef + type: object + properties: + apiVersion: + description: APIVersion + type: string + bundle: + description: |- + Deprecated: Please use ResolverRef with the bundles resolver instead. + Bundle + type: string + kind: + description: Kind + type: string + name: + description: Name + type: string + params: + description: Params + type: array + items: + description: Param + type: object + required: + - name + - value + properties: + name: + type: string + value: + description: Value + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + resolver: + description: Resolver + type: string + taskSpec: + description: TaskSpec + x-kubernetes-preserve-unknown-fields: true + timeout: + description: Timeout + type: string + when: + description: WhenExpressions + type: array + items: + description: WhenExpression + type: object + properties: + cel: + description: CEL + type: string + input: + description: Input + type: string + operator: + description: Operator + type: string + values: + description: Values + type: array + items: + type: string + x-kubernetes-list-type: atomic + workspaces: + description: Workspaces + type: array + items: + description: WorkspacePipelineTaskBinding + type: object + required: + - name + properties: + name: + description: Name + type: string + subPath: + description: SubPath + type: string + workspace: + description: Workspace + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + workspaces: + description: Workspaces + type: array + items: + description: PipelineWorkspaceDeclaration + type: object + required: + - name + properties: + description: + description: Description + type: string + name: + description: Name + type: string + optional: + description: Optional + type: boolean + x-kubernetes-list-type: atomic + - name: v1 + served: true + storage: true + schema: + openAPIV3Schema: + description: |- + Pipeline describes a list of Tasks to execute. It expresses how outputs + of tasks feed into inputs of subsequent tasks. + type: object + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: Spec holds the desired state of the Pipeline from the client + type: object + properties: + description: + description: |- + Description is a user-facing description of the pipeline that may be + used to populate a UI. + type: string + displayName: + description: |- + DisplayName is a user-facing name of the pipeline that may be + used to populate a UI. + type: string + finally: + description: |- + Finally declares the list of Tasks that execute just before leaving the Pipeline + i.e. either after all Tasks are finished executing successfully + or after a failure which would result in ending the Pipeline + type: array + items: + description: |- + PipelineTask defines a task in a Pipeline, passing inputs from both + Params and from the output of previous tasks. + type: object + properties: + description: + description: |- + Description is the description of this task within the context of a Pipeline. + This description may be used to populate a UI. + type: string + displayName: + description: |- + DisplayName is the display name of this task within the context of a Pipeline. + This display name may be used to populate a UI. + type: string + matrix: + description: Matrix declares parameters used to fan out this + task. + type: object + properties: + include: + description: Include is a list of IncludeParams which + allows passing in specific combinations of Parameters + into the Matrix. + type: array + items: + description: IncludeParams allows passing in a specific + combinations of Parameters into the Matrix. + type: object + properties: + name: + description: Name the specified combination + type: string + params: + description: |- + Params takes only `Parameters` of type `"string"` + The names of the `params` must match the names of the `params` in the underlying `Task` + type: array + items: + description: Param declares an ParamValues to + use for the parameter called name. + type: object + required: + - name + - value + properties: + name: + type: string + value: + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + params: + description: |- + Params is a list of parameters used to fan out the pipelineTask + Params takes only `Parameters` of type `"array"` + Each array element is supplied to the `PipelineTask` by substituting `params` of type `"string"` in the underlying `Task`. + The names of the `params` in the `Matrix` must match the names of the `params` in the underlying `Task` that they will be substituting. + type: array + items: + description: Param declares an ParamValues to use for + the parameter called name. + type: object + required: + - name + - value + properties: + name: + type: string + value: + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + name: + description: |- + Name is the name of this task within the context of a Pipeline. Name is + used as a coordinate with the `from` and `runAfter` fields to establish + the execution order of tasks relative to one another. + type: string + onError: + description: |- + OnError defines the exiting behavior of a PipelineRun on error + can be set to [ continue | stopAndFail ] + type: string + params: + description: Parameters declares parameters passed to this + task. + type: array + items: + description: Param declares an ParamValues to use for the + parameter called name. + type: object + required: + - name + - value + properties: + name: + type: string + value: + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + pipelineRef: + description: |- + PipelineRef is a reference to a pipeline definition. + This is an alpha field. You must set the "enable-api-fields" feature flag + to "alpha" for this field to be supported. When enabled, the referenced + Pipeline is executed as a child PipelineRun owned by the parent PipelineRun. + type: object + properties: + apiVersion: + description: API version of the referent + type: string + name: + description: 'Name of the referent; More info: http://kubernetes.io/docs/user-guide/identifiers#names' + type: string + params: + description: |- + Params contains the parameters used to identify the + referenced Tekton resource. Example entries might include + "repo" or "path" but the set of params ultimately depends on + the chosen resolver. + type: array + items: + description: Param declares an ParamValues to use for + the parameter called name. + type: object + required: + - name + - value + properties: + name: + type: string + value: + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + resolver: + description: |- + Resolver is the name of the resolver that should perform + resolution of the referenced Tekton resource, such as "git". + type: string + pipelineSpec: + description: |- + PipelineSpec is a specification of a pipeline. + This is an alpha field. You must set the "enable-api-fields" feature flag + to "alpha" for this field to be supported. When enabled, the embedded + Pipeline is executed as a child PipelineRun owned by the parent PipelineRun. + Specifying PipelineSpec can be disabled by setting + `disable-inline-spec` feature flag. + See Pipeline.spec (API version: tekton.dev/v1) + x-kubernetes-preserve-unknown-fields: true + retries: + description: 'Retries represents how many times this task + should be retried in case of task failure: ConditionSucceeded + set to False' + type: integer + runAfter: + description: |- + RunAfter is the list of PipelineTask names that should be executed before + this Task executes. (Used to force a specific ordering in graph execution.) + type: array + items: + type: string + x-kubernetes-list-type: atomic + taskRef: + description: TaskRef is a reference to a task definition. + type: object + properties: + apiVersion: + description: |- + API version of the referent + Note: A Task with non-empty APIVersion and Kind is considered a Custom Task + type: string + kind: + description: |- + TaskKind indicates the Kind of the Task: + 1. Namespaced Task when Kind is set to "Task". If Kind is "", it defaults to "Task". + 2. Custom Task when Kind is non-empty and APIVersion is non-empty + type: string + name: + description: 'Name of the referent; More info: http://kubernetes.io/docs/user-guide/identifiers#names' + type: string + params: + description: |- + Params contains the parameters used to identify the + referenced Tekton resource. Example entries might include + "repo" or "path" but the set of params ultimately depends on + the chosen resolver. + type: array + items: + description: Param declares an ParamValues to use for + the parameter called name. + type: object + required: + - name + - value + properties: + name: + type: string + value: + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + resolver: + description: |- + Resolver is the name of the resolver that should perform + resolution of the referenced Tekton resource, such as "git". + type: string + taskSpec: + description: |- + TaskSpec is a specification of a task + Specifying TaskSpec can be disabled by setting + `disable-inline-spec` feature flag. + See Task.spec (API version: tekton.dev/v1) + x-kubernetes-preserve-unknown-fields: true + timeout: + description: |- + Duration after which the TaskRun times out. Defaults to 1 hour. + Refer Go's ParseDuration documentation for expected format: https://golang.org/pkg/time/#ParseDuration + type: string + when: + description: When is a list of when expressions that need + to be true for the task to run + type: array + items: + description: |- + WhenExpression allows a PipelineTask to declare expressions to be evaluated before the Task is run + to determine whether the Task should be executed or skipped + type: object + properties: + cel: + description: |- + CEL is a string of Common Language Expression, which can be used to conditionally execute + the task based on the result of the expression evaluation + More info about CEL syntax: https://github.com/google/cel-spec/blob/master/doc/langdef.md + type: string + input: + description: Input is the string for guard checking + which can be a static input or an output from a parent + Task + type: string + operator: + description: Operator that represents an Input's relationship + to the values + type: string + values: + description: |- + Values is an array of strings, which is compared against the input, for guard checking + It must be non-empty + type: array + items: + type: string + x-kubernetes-list-type: atomic + workspaces: + description: |- + Workspaces maps workspaces from the pipeline spec to the workspaces + declared in the Task. + type: array + items: + description: |- + WorkspacePipelineTaskBinding describes how a workspace passed into the pipeline should be + mapped to a task's declared workspace. + type: object + required: + - name + properties: + name: + description: Name is the name of the workspace as declared + by the task + type: string + subPath: + description: |- + SubPath is optionally a directory on the volume which should be used + for this binding (i.e. the volume will be mounted at this sub directory). + type: string + workspace: + description: Workspace is the name of the workspace + declared by the pipeline + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + params: + description: |- + Params declares a list of input parameters that must be supplied when + this Pipeline is run. + type: array + items: + description: |- + ParamSpec defines arbitrary parameters needed beyond typed inputs (such as + resources). Parameter values are provided by users as inputs on a TaskRun + or PipelineRun. + type: object + required: + - name + properties: + default: + description: |- + Default is the value a parameter takes if no input value is supplied. If + default is set, a Task may be executed without a supplied value for the + parameter. + x-kubernetes-preserve-unknown-fields: true + description: + description: |- + Description is a user-facing description of the parameter that may be + used to populate a UI. + type: string + enum: + description: |- + Enum declares a set of allowed param input values for tasks/pipelines that can be validated. + If Enum is not set, no input validation is performed for the param. + type: array + items: + type: string + name: + description: Name declares the name by which a parameter is + referenced. + type: string + properties: + description: Properties is the JSON Schema properties to support + key-value pairs parameter. + type: object + additionalProperties: + description: PropertySpec defines the struct for object + keys + type: object + properties: + type: + description: |- + ParamType indicates the type of an input parameter; + Used to distinguish between a single string and an array of strings. + type: string + type: + description: |- + Type is the user-specified type of the parameter. The possible types + are currently "string", "array" and "object", and "string" is the default. + type: string + x-kubernetes-list-type: atomic + results: + description: Results are values that this pipeline can output once + run + type: array + items: + description: PipelineResult used to describe the results of a + pipeline + type: object + required: + - name + - value + properties: + description: + description: Description is a human-readable description of + the result + type: string + name: + description: Name the given name + type: string + type: + description: |- + Type is the user-specified type of the result. + The possible types are 'string', 'array', and 'object', with 'string' as the default. + 'array' and 'object' types are alpha features. + type: string + value: + description: Value the expression used to retrieve the value + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + tasks: + description: Tasks declares the graph of Tasks that execute when + this Pipeline is run. + type: array + items: + description: |- + PipelineTask defines a task in a Pipeline, passing inputs from both + Params and from the output of previous tasks. + type: object + properties: + description: + description: |- + Description is the description of this task within the context of a Pipeline. + This description may be used to populate a UI. + type: string + displayName: + description: |- + DisplayName is the display name of this task within the context of a Pipeline. + This display name may be used to populate a UI. + type: string + matrix: + description: Matrix declares parameters used to fan out this + task. + type: object + properties: + include: + description: Include is a list of IncludeParams which + allows passing in specific combinations of Parameters + into the Matrix. + type: array + items: + description: IncludeParams allows passing in a specific + combinations of Parameters into the Matrix. + type: object + properties: + name: + description: Name the specified combination + type: string + params: + description: |- + Params takes only `Parameters` of type `"string"` + The names of the `params` must match the names of the `params` in the underlying `Task` + type: array + items: + description: Param declares an ParamValues to + use for the parameter called name. + type: object + required: + - name + - value + properties: + name: + type: string + value: + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + params: + description: |- + Params is a list of parameters used to fan out the pipelineTask + Params takes only `Parameters` of type `"array"` + Each array element is supplied to the `PipelineTask` by substituting `params` of type `"string"` in the underlying `Task`. + The names of the `params` in the `Matrix` must match the names of the `params` in the underlying `Task` that they will be substituting. + type: array + items: + description: Param declares an ParamValues to use for + the parameter called name. + type: object + required: + - name + - value + properties: + name: + type: string + value: + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + name: + description: |- + Name is the name of this task within the context of a Pipeline. Name is + used as a coordinate with the `from` and `runAfter` fields to establish + the execution order of tasks relative to one another. + type: string + onError: + description: |- + OnError defines the exiting behavior of a PipelineRun on error + can be set to [ continue | stopAndFail ] + type: string + params: + description: Parameters declares parameters passed to this + task. + type: array + items: + description: Param declares an ParamValues to use for the + parameter called name. + type: object + required: + - name + - value + properties: + name: + type: string + value: + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + pipelineRef: + description: |- + PipelineRef is a reference to a pipeline definition. + This is an alpha field. You must set the "enable-api-fields" feature flag + to "alpha" for this field to be supported. When enabled, the referenced + Pipeline is executed as a child PipelineRun owned by the parent PipelineRun. + type: object + properties: + apiVersion: + description: API version of the referent + type: string + name: + description: 'Name of the referent; More info: http://kubernetes.io/docs/user-guide/identifiers#names' + type: string + params: + description: |- + Params contains the parameters used to identify the + referenced Tekton resource. Example entries might include + "repo" or "path" but the set of params ultimately depends on + the chosen resolver. + type: array + items: + description: Param declares an ParamValues to use for + the parameter called name. + type: object + required: + - name + - value + properties: + name: + type: string + value: + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + resolver: + description: |- + Resolver is the name of the resolver that should perform + resolution of the referenced Tekton resource, such as "git". + type: string + pipelineSpec: + description: |- + PipelineSpec is a specification of a pipeline. + This is an alpha field. You must set the "enable-api-fields" feature flag + to "alpha" for this field to be supported. When enabled, the embedded + Pipeline is executed as a child PipelineRun owned by the parent PipelineRun. + Specifying PipelineSpec can be disabled by setting + `disable-inline-spec` feature flag. + See Pipeline.spec (API version: tekton.dev/v1) + x-kubernetes-preserve-unknown-fields: true + retries: + description: 'Retries represents how many times this task + should be retried in case of task failure: ConditionSucceeded + set to False' + type: integer + runAfter: + description: |- + RunAfter is the list of PipelineTask names that should be executed before + this Task executes. (Used to force a specific ordering in graph execution.) + type: array + items: + type: string + x-kubernetes-list-type: atomic + taskRef: + description: TaskRef is a reference to a task definition. + type: object + properties: + apiVersion: + description: |- + API version of the referent + Note: A Task with non-empty APIVersion and Kind is considered a Custom Task + type: string + kind: + description: |- + TaskKind indicates the Kind of the Task: + 1. Namespaced Task when Kind is set to "Task". If Kind is "", it defaults to "Task". + 2. Custom Task when Kind is non-empty and APIVersion is non-empty + type: string + name: + description: 'Name of the referent; More info: http://kubernetes.io/docs/user-guide/identifiers#names' + type: string + params: + description: |- + Params contains the parameters used to identify the + referenced Tekton resource. Example entries might include + "repo" or "path" but the set of params ultimately depends on + the chosen resolver. + type: array + items: + description: Param declares an ParamValues to use for + the parameter called name. + type: object + required: + - name + - value + properties: + name: + type: string + value: + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + resolver: + description: |- + Resolver is the name of the resolver that should perform + resolution of the referenced Tekton resource, such as "git". + type: string + taskSpec: + description: |- + TaskSpec is a specification of a task + Specifying TaskSpec can be disabled by setting + `disable-inline-spec` feature flag. + See Task.spec (API version: tekton.dev/v1) + x-kubernetes-preserve-unknown-fields: true + timeout: + description: |- + Duration after which the TaskRun times out. Defaults to 1 hour. + Refer Go's ParseDuration documentation for expected format: https://golang.org/pkg/time/#ParseDuration + type: string + when: + description: When is a list of when expressions that need + to be true for the task to run + type: array + items: + description: |- + WhenExpression allows a PipelineTask to declare expressions to be evaluated before the Task is run + to determine whether the Task should be executed or skipped + type: object + properties: + cel: + description: |- + CEL is a string of Common Language Expression, which can be used to conditionally execute + the task based on the result of the expression evaluation + More info about CEL syntax: https://github.com/google/cel-spec/blob/master/doc/langdef.md + type: string + input: + description: Input is the string for guard checking + which can be a static input or an output from a parent + Task + type: string + operator: + description: Operator that represents an Input's relationship + to the values + type: string + values: + description: |- + Values is an array of strings, which is compared against the input, for guard checking + It must be non-empty + type: array + items: + type: string + x-kubernetes-list-type: atomic + workspaces: + description: |- + Workspaces maps workspaces from the pipeline spec to the workspaces + declared in the Task. + type: array + items: + description: |- + WorkspacePipelineTaskBinding describes how a workspace passed into the pipeline should be + mapped to a task's declared workspace. + type: object + required: + - name + properties: + name: + description: Name is the name of the workspace as declared + by the task + type: string + subPath: + description: |- + SubPath is optionally a directory on the volume which should be used + for this binding (i.e. the volume will be mounted at this sub directory). + type: string + workspace: + description: Workspace is the name of the workspace + declared by the pipeline + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + workspaces: + description: |- + Workspaces declares a set of named workspaces that are expected to be + provided by a PipelineRun. + type: array + items: + description: |- + PipelineWorkspaceDeclaration creates a named slot in a Pipeline that a PipelineRun + is expected to populate with a workspace binding. + type: object + required: + - name + properties: + description: + description: |- + Description is a human readable string describing how the workspace will be + used in the Pipeline. It can be useful to include a bit of detail about which + tasks are intended to have access to the data on the workspace. + type: string + name: + description: Name is the name of a workspace to be provided + by a PipelineRun. + type: string + optional: + description: |- + Optional marks a Workspace as not being required in PipelineRuns. By default + this field is false and so declared workspaces are required. + type: boolean + x-kubernetes-list-type: atomic + # Opt into the status subresource so metadata.generation + # starts to increment + subresources: + status: {} + names: + kind: Pipeline + plural: pipelines + singular: pipeline + categories: + - tekton + - tekton-pipelines + scope: Namespaced + conversion: + strategy: Webhook + webhook: + conversionReviewVersions: ["v1beta1", "v1"] + clientConfig: + service: + name: tekton-pipelines-webhook + namespace: tekton-pipelines +--- +# Copyright 2019 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: pipelineruns.tekton.dev + labels: + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines + pipeline.tekton.dev/release: "v1.15.0" + version: "v1.15.0" +spec: + group: tekton.dev + preserveUnknownFields: false + versions: + - name: v1beta1 + served: true + storage: false + schema: + openAPIV3Schema: + description: |- + PipelineRun + Deprecated: Please use v1.PipelineRun instead. + type: object + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: Spec + type: object + properties: + managedBy: + description: ManagedBy + type: string + params: + description: Params + type: array + items: + description: Param + type: object + required: + - name + - value + properties: + name: + type: string + value: + description: Value + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + pipelineRef: + description: PipelineRef + type: object + properties: + apiVersion: + description: APIVersion + type: string + bundle: + description: |- + Deprecated: Please use ResolverRef with the bundles resolver instead. + Bundle + type: string + name: + description: Name + type: string + params: + description: Params + type: array + items: + description: Param + type: object + required: + - name + - value + properties: + name: + type: string + value: + description: Value + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + resolver: + description: Resolver + type: string + pipelineSpec: + description: PipelineSpec + x-kubernetes-preserve-unknown-fields: true + podTemplate: + description: PodTemplate + type: object + properties: + affinity: + description: |- + If specified, the pod's scheduling constraints. + See Pod.spec.affinity (API version: v1) + x-kubernetes-preserve-unknown-fields: true + automountServiceAccountToken: + description: |- + AutomountServiceAccountToken indicates whether pods running as this + service account should have an API token automatically mounted. + type: boolean + dnsConfig: + description: |- + Specifies the DNS parameters of a pod. + Parameters specified here will be merged to the generated DNS + configuration based on DNSPolicy. + type: object + properties: + nameservers: + description: |- + A list of DNS name server IP addresses. + This will be appended to the base nameservers generated from DNSPolicy. + Duplicated nameservers will be removed. + type: array + items: + type: string + x-kubernetes-list-type: atomic + options: + description: |- + A list of DNS resolver options. + This will be merged with the base options generated from DNSPolicy. + Duplicated entries will be removed. Resolution options given in Options + will override those that appear in the base DNSPolicy. + type: array + items: + description: PodDNSConfigOption defines DNS resolver options + of a pod. + type: object + properties: + name: + description: |- + Name is this DNS resolver option's name. + Required. + type: string + value: + description: Value is this DNS resolver option's value. + type: string + x-kubernetes-list-type: atomic + searches: + description: |- + A list of DNS search domains for host-name lookup. + This will be appended to the base search paths generated from DNSPolicy. + Duplicated search paths will be removed. + type: array + items: + type: string + x-kubernetes-list-type: atomic + dnsPolicy: + description: |- + Set DNS policy for the pod. Defaults to "ClusterFirst". Valid values are + 'ClusterFirst', 'Default' or 'None'. DNS parameters given in DNSConfig + will be merged with the policy selected with DNSPolicy. + type: string + enableServiceLinks: + description: |- + EnableServiceLinks indicates whether information about services should be injected into pod's + environment variables, matching the syntax of Docker links. + Optional: Defaults to true. + type: boolean + env: + description: List of environment variables that can be provided + to the containers belonging to the pod. + type: array + items: + description: EnvVar represents an environment variable present + in a Container. + type: object + required: + - name + properties: + name: + description: |- + Name of the environment variable. + May consist of any printable ASCII characters except '='. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's value. + Cannot be used if value is not empty. + type: object + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + type: object + required: + - key + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap or + its key must be defined + type: boolean + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + type: object + required: + - fieldPath + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in the + specified API version. + type: string + x-kubernetes-map-type: atomic + fileKeyRef: + description: |- + FileKeyRef selects a key of the env file. + Requires the EnvFiles feature gate to be enabled. + type: object + required: + - key + - path + - volumeName + properties: + key: + description: |- + The key within the env file. An invalid key will prevent the pod from starting. + The keys defined within a source may consist of any printable ASCII characters except '='. + During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters. + type: string + optional: + description: |- + Specify whether the file or its key must be defined. If the file or key + does not exist, then the env var is not published. + If optional is set to true and the specified key does not exist, + the environment variable will not be set in the Pod's containers. + + If optional is set to false and the specified key does not exist, + an error will be returned during Pod creation. + type: boolean + default: false + path: + description: |- + The path within the volume from which to select the file. + Must be relative and may not contain the '..' path or start with '..'. + type: string + volumeName: + description: The name of the volume mount containing + the env file. + type: string + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + type: object + required: + - resource + properties: + containerName: + description: 'Container name: required for volumes, + optional for env vars' + type: string + divisor: + description: Specifies the output format of the + exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the pod's + namespace + type: object + required: + - key + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret or its + key must be defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + hostAliases: + description: |- + HostAliases is an optional list of hosts and IPs that will be injected into the pod's hosts + file if specified. This is only valid for non-hostNetwork pods. + type: array + items: + description: |- + HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the + pod's hosts file. + type: object + required: + - ip + properties: + hostnames: + description: Hostnames for the above IP address. + type: array + items: + type: string + x-kubernetes-list-type: atomic + ip: + description: IP address of the host file entry. + type: string + x-kubernetes-list-type: atomic + hostNetwork: + description: HostNetwork specifies whether the pod may use the + node network namespace + type: boolean + hostUsers: + description: |- + HostUsers indicates whether the pod will use the host's user namespace. + Optional: Default to true. + If set to true or not present, the pod will be run in the host user namespace, useful + for when the pod needs a feature only available to the host user namespace, such as + loading a kernel module with CAP_SYS_MODULE. + When set to false, a new user namespace is created for the pod. Setting false + is useful to mitigating container breakout vulnerabilities such as allowing + containers to run as root without their user having root privileges on the host. + This field depends on the kubernetes feature gate UserNamespacesSupport being enabled. + type: boolean + imagePullSecrets: + description: ImagePullSecrets gives the name of the secret used + by the pod to pull the image if specified + type: array + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + nodeSelector: + description: |- + NodeSelector is a selector which must be true for the pod to fit on a node. + Selector which must match a node's labels for the pod to be scheduled on that node. + More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ + type: object + additionalProperties: + type: string + priorityClassName: + description: |- + If specified, indicates the pod's priority. "system-node-critical" and + "system-cluster-critical" are two special keywords which indicate the + highest priorities with the former being the highest priority. Any other + name must be defined by creating a PriorityClass object with that name. + If not specified, the pod priority will be default or zero if there is no + default. + type: string + runtimeClassName: + description: |- + RuntimeClassName refers to a RuntimeClass object in the node.k8s.io + group, which should be used to run this pod. If no RuntimeClass resource + matches the named class, the pod will not be run. If unset or empty, the + "legacy" RuntimeClass will be used, which is an implicit class with an + empty definition that uses the default runtime handler. + More info: https://git.k8s.io/enhancements/keps/sig-node/runtime-class.md + This is a beta feature as of Kubernetes v1.14. + type: string + schedulerName: + description: SchedulerName specifies the scheduler to be used + to dispatch the Pod + type: string + securityContext: + description: |- + SecurityContext holds pod-level security attributes and common container settings. + Optional: Defaults to empty. See type description for default values of each field. + See Pod.spec.securityContext (API version: v1) + x-kubernetes-preserve-unknown-fields: true + tolerations: + description: If specified, the pod's tolerations. + type: array + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + type: object + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + type: integer + format: int64 + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + x-kubernetes-list-type: atomic + topologySpreadConstraints: + description: |- + TopologySpreadConstraints controls how Pods are spread across your cluster among + failure-domains such as regions, zones, nodes, and other user-defined topology domains. + type: array + items: + description: TopologySpreadConstraint specifies how to spread + matching pods among the given topology. + type: object + required: + - maxSkew + - topologyKey + - whenUnsatisfiable + properties: + labelSelector: + description: |- + LabelSelector is used to find matching pods. + Pods that match this label selector are counted to determine the number of pods + in their corresponding topology domain. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select the pods over which + spreading will be calculated. The keys are used to lookup values from the + incoming pod labels, those key-value labels are ANDed with labelSelector + to select the group of existing pods over which spreading will be calculated + for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + MatchLabelKeys cannot be set when LabelSelector isn't set. + Keys that don't exist in the incoming pod labels will + be ignored. A null or empty list means only match against labelSelector. + + This is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default). + type: array + items: + type: string + x-kubernetes-list-type: atomic + maxSkew: + description: |- + MaxSkew describes the degree to which pods may be unevenly distributed. + When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference + between the number of matching pods in the target topology and the global minimum. + The global minimum is the minimum number of matching pods in an eligible domain + or zero if the number of eligible domains is less than MinDomains. + For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same + labelSelector spread as 2/2/1: + In this case, the global minimum is 1. + | zone1 | zone2 | zone3 | + | P P | P P | P | + - if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2; + scheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2) + violate MaxSkew(1). + - if MaxSkew is 2, incoming pod can be scheduled onto any zone. + When `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence + to topologies that satisfy it. + It's a required field. Default value is 1 and 0 is not allowed. + type: integer + format: int32 + minDomains: + description: |- + MinDomains indicates a minimum number of eligible domains. + When the number of eligible domains with matching topology keys is less than minDomains, + Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed. + And when the number of eligible domains with matching topology keys equals or greater than minDomains, + this value has no effect on scheduling. + As a result, when the number of eligible domains is less than minDomains, + scheduler won't schedule more than maxSkew Pods to those domains. + If value is nil, the constraint behaves as if MinDomains is equal to 1. + Valid values are integers greater than 0. + When value is not nil, WhenUnsatisfiable must be DoNotSchedule. + + For example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same + labelSelector spread as 2/2/2: + | zone1 | zone2 | zone3 | + | P P | P P | P P | + The number of domains is less than 5(MinDomains), so "global minimum" is treated as 0. + In this situation, new pod with the same labelSelector cannot be scheduled, + because computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones, + it will violate MaxSkew. + type: integer + format: int32 + nodeAffinityPolicy: + description: |- + NodeAffinityPolicy indicates how we will treat Pod's nodeAffinity/nodeSelector + when calculating pod topology spread skew. Options are: + - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations. + - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations. + + If this value is nil, the behavior is equivalent to the Honor policy. + type: string + nodeTaintsPolicy: + description: |- + NodeTaintsPolicy indicates how we will treat node taints when calculating + pod topology spread skew. Options are: + - Honor: nodes without taints, along with tainted nodes for which the incoming pod + has a toleration, are included. + - Ignore: node taints are ignored. All nodes are included. + + If this value is nil, the behavior is equivalent to the Ignore policy. + type: string + topologyKey: + description: |- + TopologyKey is the key of node labels. Nodes that have a label with this key + and identical values are considered to be in the same topology. + We consider each as a "bucket", and try to put balanced number + of pods into each bucket. + We define a domain as a particular instance of a topology. + Also, we define an eligible domain as a domain whose nodes meet the requirements of + nodeAffinityPolicy and nodeTaintsPolicy. + e.g. If TopologyKey is "kubernetes.io/hostname", each Node is a domain of that topology. + And, if TopologyKey is "topology.kubernetes.io/zone", each zone is a domain of that topology. + It's a required field. + type: string + whenUnsatisfiable: + description: |- + WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy + the spread constraint. + - DoNotSchedule (default) tells the scheduler not to schedule it. + - ScheduleAnyway tells the scheduler to schedule the pod in any location, + but giving higher precedence to topologies that would help reduce the + skew. + A constraint is considered "Unsatisfiable" for an incoming pod + if and only if every possible node assignment for that pod would violate + "MaxSkew" on some topology. + For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same + labelSelector spread as 3/1/1: + | zone1 | zone2 | zone3 | + | P P P | P | P | + If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled + to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies + MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler + won't make it *more* imbalanced. + It's a required field. + type: string + x-kubernetes-list-type: atomic + volumes: + description: |- + List of volumes that can be mounted by containers belonging to the pod. + More info: https://kubernetes.io/docs/concepts/storage/volumes + See Pod.spec.volumes (API version: v1) + x-kubernetes-preserve-unknown-fields: true + resources: + description: |- + Resources + Deprecated: Unused, preserved only for backwards compatibility + type: array + items: + description: |- + PipelineResourceBinding + Deprecated: Unused, preserved only for backwards compatibility + type: object + properties: + name: + description: Name + type: string + resourceRef: + description: ResourceRef + type: object + properties: + apiVersion: + description: APIVersion + type: string + name: + description: Name + type: string + resourceSpec: + description: ResourceSpec + type: object + required: + - params + - type + properties: + description: + description: |- + Description is a user-facing description of the resource that may be + used to populate a UI. + type: string + params: + type: array + items: + description: |- + ResourceParam declares a string value to use for the parameter called Name, and is used in + the specific context of PipelineResources. + + Deprecated: Unused, preserved only for backwards compatibility + type: object + required: + - name + - value + properties: + name: + type: string + value: + type: string + x-kubernetes-list-type: atomic + secrets: + description: Secrets to fetch to populate some of resource + fields + type: array + items: + description: |- + SecretParam indicates which secret can be used to populate a field of the resource + + Deprecated: Unused, preserved only for backwards compatibility + type: object + required: + - fieldName + - secretKey + - secretName + properties: + fieldName: + type: string + secretKey: + type: string + secretName: + type: string + x-kubernetes-list-type: atomic + type: + description: |- + PipelineResourceType represents the type of endpoint the pipelineResource is, so that the + controller will know this pipelineResource shouldx be fetched and optionally what + additional metatdata should be provided for it. + + Deprecated: Unused, preserved only for backwards compatibility + type: string + x-kubernetes-list-type: atomic + serviceAccountName: + description: ServiceAccountName + type: string + status: + description: Status + type: string + taskRunSpecs: + description: TaskRunSpecs + type: array + items: + description: PipelineTaskRunSpec + type: object + properties: + computeResources: + description: ComputeResources + type: object + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This field depends on the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + type: array + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + type: object + required: + - name + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + requests: + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + metadata: + description: Metadata + type: object + properties: + annotations: + description: Annotations + type: object + additionalProperties: + type: string + labels: + description: Labels + type: object + additionalProperties: + type: string + pipelineTaskName: + type: string + sidecarOverrides: + description: SidecarOverrides + type: array + items: + description: TaskRunSidecarOverride + type: object + required: + - name + - resources + properties: + name: + description: Name + type: string + resources: + description: Resources + type: object + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This field depends on the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + type: array + items: + description: ResourceClaim references one entry + in PodSpec.ResourceClaims. + type: object + required: + - name + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + requests: + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + x-kubernetes-list-type: atomic + stepOverrides: + description: StepOverrides + type: array + items: + description: TaskRunStepOverride + type: object + required: + - name + - resources + properties: + name: + description: Name + type: string + resources: + description: Resources + type: object + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This field depends on the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + type: array + items: + description: ResourceClaim references one entry + in PodSpec.ResourceClaims. + type: object + required: + - name + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + requests: + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + x-kubernetes-list-type: atomic + taskPodTemplate: + description: PodTemplate holds pod specific configuration + type: object + properties: + affinity: + description: |- + If specified, the pod's scheduling constraints. + See Pod.spec.affinity (API version: v1) + x-kubernetes-preserve-unknown-fields: true + automountServiceAccountToken: + description: |- + AutomountServiceAccountToken indicates whether pods running as this + service account should have an API token automatically mounted. + type: boolean + dnsConfig: + description: |- + Specifies the DNS parameters of a pod. + Parameters specified here will be merged to the generated DNS + configuration based on DNSPolicy. + type: object + properties: + nameservers: + description: |- + A list of DNS name server IP addresses. + This will be appended to the base nameservers generated from DNSPolicy. + Duplicated nameservers will be removed. + type: array + items: + type: string + x-kubernetes-list-type: atomic + options: + description: |- + A list of DNS resolver options. + This will be merged with the base options generated from DNSPolicy. + Duplicated entries will be removed. Resolution options given in Options + will override those that appear in the base DNSPolicy. + type: array + items: + description: PodDNSConfigOption defines DNS resolver + options of a pod. + type: object + properties: + name: + description: |- + Name is this DNS resolver option's name. + Required. + type: string + value: + description: Value is this DNS resolver option's + value. + type: string + x-kubernetes-list-type: atomic + searches: + description: |- + A list of DNS search domains for host-name lookup. + This will be appended to the base search paths generated from DNSPolicy. + Duplicated search paths will be removed. + type: array + items: + type: string + x-kubernetes-list-type: atomic + dnsPolicy: + description: |- + Set DNS policy for the pod. Defaults to "ClusterFirst". Valid values are + 'ClusterFirst', 'Default' or 'None'. DNS parameters given in DNSConfig + will be merged with the policy selected with DNSPolicy. + type: string + enableServiceLinks: + description: |- + EnableServiceLinks indicates whether information about services should be injected into pod's + environment variables, matching the syntax of Docker links. + Optional: Defaults to true. + type: boolean + env: + description: List of environment variables that can be + provided to the containers belonging to the pod. + type: array + items: + description: EnvVar represents an environment variable + present in a Container. + type: object + required: + - name + properties: + name: + description: |- + Name of the environment variable. + May consist of any printable ASCII characters except '='. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's + value. Cannot be used if value is not empty. + type: object + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + type: object + required: + - key + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + type: object + required: + - fieldPath + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select + in the specified API version. + type: string + x-kubernetes-map-type: atomic + fileKeyRef: + description: |- + FileKeyRef selects a key of the env file. + Requires the EnvFiles feature gate to be enabled. + type: object + required: + - key + - path + - volumeName + properties: + key: + description: |- + The key within the env file. An invalid key will prevent the pod from starting. + The keys defined within a source may consist of any printable ASCII characters except '='. + During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters. + type: string + optional: + description: |- + Specify whether the file or its key must be defined. If the file or key + does not exist, then the env var is not published. + If optional is set to true and the specified key does not exist, + the environment variable will not be set in the Pod's containers. + + If optional is set to false and the specified key does not exist, + an error will be returned during Pod creation. + type: boolean + default: false + path: + description: |- + The path within the volume from which to select the file. + Must be relative and may not contain the '..' path or start with '..'. + type: string + volumeName: + description: The name of the volume mount + containing the env file. + type: string + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + type: object + required: + - resource + properties: + containerName: + description: 'Container name: required for + volumes, optional for env vars' + type: string + divisor: + description: Specifies the output format + of the exposed resources, defaults to + "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the + pod's namespace + type: object + required: + - key + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret + or its key must be defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + hostAliases: + description: |- + HostAliases is an optional list of hosts and IPs that will be injected into the pod's hosts + file if specified. This is only valid for non-hostNetwork pods. + type: array + items: + description: |- + HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the + pod's hosts file. + type: object + required: + - ip + properties: + hostnames: + description: Hostnames for the above IP address. + type: array + items: + type: string + x-kubernetes-list-type: atomic + ip: + description: IP address of the host file entry. + type: string + x-kubernetes-list-type: atomic + hostNetwork: + description: HostNetwork specifies whether the pod may + use the node network namespace + type: boolean + hostUsers: + description: |- + HostUsers indicates whether the pod will use the host's user namespace. + Optional: Default to true. + If set to true or not present, the pod will be run in the host user namespace, useful + for when the pod needs a feature only available to the host user namespace, such as + loading a kernel module with CAP_SYS_MODULE. + When set to false, a new user namespace is created for the pod. Setting false + is useful to mitigating container breakout vulnerabilities such as allowing + containers to run as root without their user having root privileges on the host. + This field depends on the kubernetes feature gate UserNamespacesSupport being enabled. + type: boolean + imagePullSecrets: + description: ImagePullSecrets gives the name of the secret + used by the pod to pull the image if specified + type: array + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + nodeSelector: + description: |- + NodeSelector is a selector which must be true for the pod to fit on a node. + Selector which must match a node's labels for the pod to be scheduled on that node. + More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ + type: object + additionalProperties: + type: string + priorityClassName: + description: |- + If specified, indicates the pod's priority. "system-node-critical" and + "system-cluster-critical" are two special keywords which indicate the + highest priorities with the former being the highest priority. Any other + name must be defined by creating a PriorityClass object with that name. + If not specified, the pod priority will be default or zero if there is no + default. + type: string + runtimeClassName: + description: |- + RuntimeClassName refers to a RuntimeClass object in the node.k8s.io + group, which should be used to run this pod. If no RuntimeClass resource + matches the named class, the pod will not be run. If unset or empty, the + "legacy" RuntimeClass will be used, which is an implicit class with an + empty definition that uses the default runtime handler. + More info: https://git.k8s.io/enhancements/keps/sig-node/runtime-class.md + This is a beta feature as of Kubernetes v1.14. + type: string + schedulerName: + description: SchedulerName specifies the scheduler to + be used to dispatch the Pod + type: string + securityContext: + description: |- + SecurityContext holds pod-level security attributes and common container settings. + Optional: Defaults to empty. See type description for default values of each field. + See Pod.spec.securityContext (API version: v1) + x-kubernetes-preserve-unknown-fields: true + tolerations: + description: If specified, the pod's tolerations. + type: array + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + type: object + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + type: integer + format: int64 + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + x-kubernetes-list-type: atomic + topologySpreadConstraints: + description: |- + TopologySpreadConstraints controls how Pods are spread across your cluster among + failure-domains such as regions, zones, nodes, and other user-defined topology domains. + type: array + items: + description: TopologySpreadConstraint specifies how + to spread matching pods among the given topology. + type: object + required: + - maxSkew + - topologyKey + - whenUnsatisfiable + properties: + labelSelector: + description: |- + LabelSelector is used to find matching pods. + Pods that match this label selector are counted to determine the number of pods + in their corresponding topology domain. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select the pods over which + spreading will be calculated. The keys are used to lookup values from the + incoming pod labels, those key-value labels are ANDed with labelSelector + to select the group of existing pods over which spreading will be calculated + for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + MatchLabelKeys cannot be set when LabelSelector isn't set. + Keys that don't exist in the incoming pod labels will + be ignored. A null or empty list means only match against labelSelector. + + This is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default). + type: array + items: + type: string + x-kubernetes-list-type: atomic + maxSkew: + description: |- + MaxSkew describes the degree to which pods may be unevenly distributed. + When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference + between the number of matching pods in the target topology and the global minimum. + The global minimum is the minimum number of matching pods in an eligible domain + or zero if the number of eligible domains is less than MinDomains. + For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same + labelSelector spread as 2/2/1: + In this case, the global minimum is 1. + | zone1 | zone2 | zone3 | + | P P | P P | P | + - if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2; + scheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2) + violate MaxSkew(1). + - if MaxSkew is 2, incoming pod can be scheduled onto any zone. + When `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence + to topologies that satisfy it. + It's a required field. Default value is 1 and 0 is not allowed. + type: integer + format: int32 + minDomains: + description: |- + MinDomains indicates a minimum number of eligible domains. + When the number of eligible domains with matching topology keys is less than minDomains, + Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed. + And when the number of eligible domains with matching topology keys equals or greater than minDomains, + this value has no effect on scheduling. + As a result, when the number of eligible domains is less than minDomains, + scheduler won't schedule more than maxSkew Pods to those domains. + If value is nil, the constraint behaves as if MinDomains is equal to 1. + Valid values are integers greater than 0. + When value is not nil, WhenUnsatisfiable must be DoNotSchedule. + + For example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same + labelSelector spread as 2/2/2: + | zone1 | zone2 | zone3 | + | P P | P P | P P | + The number of domains is less than 5(MinDomains), so "global minimum" is treated as 0. + In this situation, new pod with the same labelSelector cannot be scheduled, + because computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones, + it will violate MaxSkew. + type: integer + format: int32 + nodeAffinityPolicy: + description: |- + NodeAffinityPolicy indicates how we will treat Pod's nodeAffinity/nodeSelector + when calculating pod topology spread skew. Options are: + - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations. + - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations. + + If this value is nil, the behavior is equivalent to the Honor policy. + type: string + nodeTaintsPolicy: + description: |- + NodeTaintsPolicy indicates how we will treat node taints when calculating + pod topology spread skew. Options are: + - Honor: nodes without taints, along with tainted nodes for which the incoming pod + has a toleration, are included. + - Ignore: node taints are ignored. All nodes are included. + + If this value is nil, the behavior is equivalent to the Ignore policy. + type: string + topologyKey: + description: |- + TopologyKey is the key of node labels. Nodes that have a label with this key + and identical values are considered to be in the same topology. + We consider each as a "bucket", and try to put balanced number + of pods into each bucket. + We define a domain as a particular instance of a topology. + Also, we define an eligible domain as a domain whose nodes meet the requirements of + nodeAffinityPolicy and nodeTaintsPolicy. + e.g. If TopologyKey is "kubernetes.io/hostname", each Node is a domain of that topology. + And, if TopologyKey is "topology.kubernetes.io/zone", each zone is a domain of that topology. + It's a required field. + type: string + whenUnsatisfiable: + description: |- + WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy + the spread constraint. + - DoNotSchedule (default) tells the scheduler not to schedule it. + - ScheduleAnyway tells the scheduler to schedule the pod in any location, + but giving higher precedence to topologies that would help reduce the + skew. + A constraint is considered "Unsatisfiable" for an incoming pod + if and only if every possible node assignment for that pod would violate + "MaxSkew" on some topology. + For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same + labelSelector spread as 3/1/1: + | zone1 | zone2 | zone3 | + | P P P | P | P | + If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled + to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies + MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler + won't make it *more* imbalanced. + It's a required field. + type: string + x-kubernetes-list-type: atomic + volumes: + description: |- + List of volumes that can be mounted by containers belonging to the pod. + More info: https://kubernetes.io/docs/concepts/storage/volumes + See Pod.spec.volumes (API version: v1) + x-kubernetes-preserve-unknown-fields: true + taskServiceAccountName: + type: string + timeout: + description: Timeout + type: string + x-kubernetes-list-type: atomic + timeout: + description: |- + Deprecated: use pipelineRunSpec.Timeouts.Pipeline instead + Timeout + type: string + timeouts: + description: Timeouts + type: object + properties: + finally: + description: Finally + type: string + pipeline: + description: Pipeline + type: string + tasks: + description: Tasks + type: string + workspaces: + description: Workspaces + type: array + items: + description: WorkspaceBinding + type: object + required: + - name + properties: + configMap: + description: ConfigMap + type: object + properties: + defaultMode: + description: |- + defaultMode is optional: mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + Defaults to 0644. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + ConfigMap will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the ConfigMap, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: optional specify whether the ConfigMap or + its keys must be defined + type: boolean + x-kubernetes-map-type: atomic + csi: + description: CSI + type: object + required: + - driver + properties: + driver: + description: |- + driver is the name of the CSI driver that handles this volume. + Consult with your admin for the correct name as registered in the cluster. + type: string + fsType: + description: |- + fsType to mount. Ex. "ext4", "xfs", "ntfs". + If not provided, the empty value is passed to the associated CSI driver + which will determine the default filesystem to apply. + type: string + nodePublishSecretRef: + description: |- + nodePublishSecretRef is a reference to the secret object containing + sensitive information to pass to the CSI driver to complete the CSI + NodePublishVolume and NodeUnpublishVolume calls. + This field is optional, and may be empty if no secret is required. If the + secret object contains more than one secret, all secret references are passed. + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + x-kubernetes-map-type: atomic + readOnly: + description: |- + readOnly specifies a read-only configuration for the volume. + Defaults to false (read/write). + type: boolean + volumeAttributes: + description: |- + volumeAttributes stores driver-specific properties that are passed to the CSI + driver. Consult your driver's documentation for supported values. + type: object + additionalProperties: + type: string + emptyDir: + description: EmptyDir + type: object + properties: + medium: + description: |- + medium represents what type of storage medium should back this directory. + The default is "" which means to use the node's default medium. + Must be an empty string (default) or Memory. + More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir + type: string + sizeLimit: + description: |- + sizeLimit is the total amount of local storage required for this EmptyDir volume. + The size limit is also applicable for memory medium. + The maximum usage on memory medium EmptyDir would be the minimum value between + the SizeLimit specified here and the sum of memory limits of all containers in a pod. + The default is nil which means that the limit is undefined. + More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + name: + description: Name + type: string + persistentVolumeClaim: + description: PersistentVolumeClaim + type: object + required: + - claimName + properties: + claimName: + description: |- + claimName is the name of a PersistentVolumeClaim in the same namespace as the pod using this volume. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims + type: string + readOnly: + description: |- + readOnly Will force the ReadOnly setting in VolumeMounts. + Default false. + type: boolean + projected: + description: Projected + type: object + properties: + defaultMode: + description: |- + defaultMode are the mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + sources: + description: |- + sources is the list of volume projections. Each entry in this list + handles one source. + type: array + items: + description: |- + Projection that may be projected along with other supported volume types. + Exactly one of these fields must be set. + type: object + properties: + clusterTrustBundle: + description: |- + ClusterTrustBundle allows a pod to access the `.spec.trustBundle` field + of ClusterTrustBundle objects in an auto-updating file. + + Alpha, gated by the ClusterTrustBundleProjection feature gate. + + ClusterTrustBundle objects can either be selected by name, or by the + combination of signer name and a label selector. + + Kubelet performs aggressive normalization of the PEM contents written + into the pod filesystem. Esoteric PEM features such as inter-block + comments and block headers are stripped. Certificates are deduplicated. + The ordering of certificates within the file is arbitrary, and Kubelet + may change the order over time. + type: object + required: + - path + properties: + labelSelector: + description: |- + Select all ClusterTrustBundles that match this label selector. Only has + effect if signerName is set. Mutually-exclusive with name. If unset, + interpreted as "match nothing". If set but empty, interpreted as "match + everything". + type: object + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + name: + description: |- + Select a single ClusterTrustBundle by object name. Mutually-exclusive + with signerName and labelSelector. + type: string + optional: + description: |- + If true, don't block pod startup if the referenced ClusterTrustBundle(s) + aren't available. If using name, then the named ClusterTrustBundle is + allowed not to exist. If using signerName, then the combination of + signerName and labelSelector is allowed to match zero + ClusterTrustBundles. + type: boolean + path: + description: Relative path from the volume root + to write the bundle. + type: string + signerName: + description: |- + Select all ClusterTrustBundles that match this signer name. + Mutually-exclusive with name. The contents of all selected + ClusterTrustBundles will be unified and deduplicated. + type: string + configMap: + description: configMap information about the configMap + data to project + type: object + properties: + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + ConfigMap will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the ConfigMap, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within + a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: optional specify whether the ConfigMap + or its keys must be defined + type: boolean + x-kubernetes-map-type: atomic + downwardAPI: + description: downwardAPI information about the downwardAPI + data to project + type: object + properties: + items: + description: Items is a list of DownwardAPIVolume + file + type: array + items: + description: DownwardAPIVolumeFile represents + information to create the file containing + the pod field + type: object + required: + - path + properties: + fieldRef: + description: 'Required: Selects a field + of the pod: only annotations, labels, + name, namespace and uid are supported.' + type: object + required: + - fieldPath + properties: + apiVersion: + description: Version of the schema + the FieldPath is written in terms + of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to + select in the specified API version. + type: string + x-kubernetes-map-type: atomic + mode: + description: |- + Optional: mode bits used to set permissions on this file, must be an octal value + between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: 'Required: Path is the relative + path name of the file to be created. + Must not be absolute or contain the + ''..'' path. Must be utf-8 encoded. + The first item of the relative path + must not start with ''..''' + type: string + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported. + type: object + required: + - resource + properties: + containerName: + description: 'Container name: required + for volumes, optional for env vars' + type: string + divisor: + description: Specifies the output + format of the exposed resources, + defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to + select' + type: string + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + podCertificate: + description: |- + Projects an auto-rotating credential bundle (private key and certificate + chain) that the pod can use either as a TLS client or server. + + Kubelet generates a private key and uses it to send a + PodCertificateRequest to the named signer. Once the signer approves the + request and issues a certificate chain, Kubelet writes the key and + certificate chain to the pod filesystem. The pod does not start until + certificates have been issued for each podCertificate projected volume + source in its spec. + + Kubelet will begin trying to rotate the certificate at the time indicated + by the signer using the PodCertificateRequest.Status.BeginRefreshAt + timestamp. + + Kubelet can write a single file, indicated by the credentialBundlePath + field, or separate files, indicated by the keyPath and + certificateChainPath fields. + + The credential bundle is a single file in PEM format. The first PEM + entry is the private key (in PKCS#8 format), and the remaining PEM + entries are the certificate chain issued by the signer (typically, + signers will return their certificate chain in leaf-to-root order). + + Prefer using the credential bundle format, since your application code + can read it atomically. If you use keyPath and certificateChainPath, + your application must make two separate file reads. If these coincide + with a certificate rotation, it is possible that the private key and leaf + certificate you read may not correspond to each other. Your application + will need to check for this condition, and re-read until they are + consistent. + + The named signer controls chooses the format of the certificate it + issues; consult the signer implementation's documentation to learn how to + use the certificates it issues. + type: object + required: + - keyType + - signerName + properties: + certificateChainPath: + description: |- + Write the certificate chain at this path in the projected volume. + + Most applications should use credentialBundlePath. When using keyPath + and certificateChainPath, your application needs to check that the key + and leaf certificate are consistent, because it is possible to read the + files mid-rotation. + type: string + credentialBundlePath: + description: |- + Write the credential bundle at this path in the projected volume. + + The credential bundle is a single file that contains multiple PEM blocks. + The first PEM block is a PRIVATE KEY block, containing a PKCS#8 private + key. + + The remaining blocks are CERTIFICATE blocks, containing the issued + certificate chain from the signer (leaf and any intermediates). + + Using credentialBundlePath lets your Pod's application code make a single + atomic read that retrieves a consistent key and certificate chain. If you + project them to separate files, your application code will need to + additionally check that the leaf certificate was issued to the key. + type: string + keyPath: + description: |- + Write the key at this path in the projected volume. + + Most applications should use credentialBundlePath. When using keyPath + and certificateChainPath, your application needs to check that the key + and leaf certificate are consistent, because it is possible to read the + files mid-rotation. + type: string + keyType: + description: |- + The type of keypair Kubelet will generate for the pod. + + Valid values are "RSA3072", "RSA4096", "ECDSAP256", "ECDSAP384", + "ECDSAP521", and "ED25519". + type: string + maxExpirationSeconds: + description: |- + maxExpirationSeconds is the maximum lifetime permitted for the + certificate. + + Kubelet copies this value verbatim into the PodCertificateRequests it + generates for this projection. + + If omitted, kube-apiserver will set it to 86400(24 hours). kube-apiserver + will reject values shorter than 3600 (1 hour). The maximum allowable + value is 7862400 (91 days). + + The signer implementation is then free to issue a certificate with any + lifetime *shorter* than MaxExpirationSeconds, but no shorter than 3600 + seconds (1 hour). This constraint is enforced by kube-apiserver. + `kubernetes.io` signers will never issue certificates with a lifetime + longer than 24 hours. + type: integer + format: int32 + signerName: + description: Kubelet's generated CSRs will be + addressed to this signer. + type: string + userAnnotations: + description: |- + userAnnotations allow pod authors to pass additional information to + the signer implementation. Kubernetes does not restrict or validate this + metadata in any way. + + These values are copied verbatim into the `spec.unverifiedUserAnnotations` field of + the PodCertificateRequest objects that Kubelet creates. + + Entries are subject to the same validation as object metadata annotations, + with the addition that all keys must be domain-prefixed. No restrictions + are placed on values, except an overall size limitation on the entire field. + + Signers should document the keys and values they support. Signers should + deny requests that contain keys they do not recognize. + type: object + additionalProperties: + type: string + secret: + description: secret information about the secret + data to project + type: object + properties: + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + Secret will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the Secret, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within + a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: optional field specify whether + the Secret or its key must be defined + type: boolean + x-kubernetes-map-type: atomic + serviceAccountToken: + description: serviceAccountToken is information + about the serviceAccountToken data to project + type: object + required: + - path + properties: + audience: + description: |- + audience is the intended audience of the token. A recipient of a token + must identify itself with an identifier specified in the audience of the + token, and otherwise should reject the token. The audience defaults to the + identifier of the apiserver. + type: string + expirationSeconds: + description: |- + expirationSeconds is the requested duration of validity of the service + account token. As the token approaches expiration, the kubelet volume + plugin will proactively rotate the service account token. The kubelet will + start trying to rotate the token if the token is older than 80 percent of + its time to live or if the token is older than 24 hours.Defaults to 1 hour + and must be at least 10 minutes. + type: integer + format: int64 + path: + description: |- + path is the path relative to the mount point of the file to project the + token into. + type: string + x-kubernetes-list-type: atomic + secret: + description: Secret + type: object + properties: + defaultMode: + description: |- + defaultMode is Optional: mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values + for mode bits. Defaults to 0644. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + items: + description: |- + items If unspecified, each key-value pair in the Data field of the referenced + Secret will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the Secret, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + optional: + description: optional field specify whether the Secret + or its keys must be defined + type: boolean + secretName: + description: |- + secretName is the name of the secret in the pod's namespace to use. + More info: https://kubernetes.io/docs/concepts/storage/volumes#secret + type: string + subPath: + description: SubPath + type: string + volumeClaimTemplate: + description: VolumeClaimTemplate + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + status: + description: Status + type: object + properties: + annotations: + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + additionalProperties: + type: string + childReferences: + description: ChildReferences + type: array + items: + description: ChildStatusReference + type: object + properties: + apiVersion: + type: string + displayName: + description: DisplayName + type: string + kind: + type: string + name: + description: Name + type: string + pipelineTaskName: + description: PipelineTaskName + type: string + whenExpressions: + description: WhenExpressions + type: array + items: + description: WhenExpression + type: object + properties: + cel: + description: CEL + type: string + input: + description: Input + type: string + operator: + description: Operator + type: string + values: + description: Values + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + completionTime: + description: CompletionTime + type: string + format: date-time + conditions: + description: Conditions the latest available observations of a resource's + current state. + type: array + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + type: object + required: + - status + - type + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating details about + the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, False, + Unknown. + type: string + type: + description: Type of condition. + type: string + finallyStartTime: + description: FinallyStartTime + type: string + format: date-time + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + type: integer + format: int64 + pipelineResults: + description: PipelineResults + type: array + items: + description: PipelineRunResult + type: object + required: + - name + - value + properties: + name: + description: Name + type: string + value: + description: Value + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + pipelineSpec: + description: PipelineSpec + x-kubernetes-preserve-unknown-fields: true + provenance: + description: Provenance + type: object + properties: + configSource: + description: |- + ConfigSource + Deprecated: Use RefSource instead + type: object + properties: + digest: + description: Digest + type: object + additionalProperties: + type: string + entryPoint: + description: EntryPoint + type: string + uri: + description: URI + type: string + featureFlags: + description: FeatureFlags + type: object + properties: + awaitSidecarReadiness: + type: boolean + coschedule: + type: string + disableCredsInit: + type: boolean + disableInlineSpec: + type: string + enableAPIFields: + type: string + enableArtifacts: + type: boolean + enableCELInWhenExpression: + type: boolean + enableConciseResolverSyntax: + type: boolean + enableKeepPodOnCancel: + type: boolean + enableKubernetesSidecar: + type: boolean + enableParamEnum: + type: boolean + enableProvenanceInStatus: + type: boolean + enableStepActions: + description: EnableStepActions is a no-op flag since StepActions + are stable + type: boolean + enableTektonOCIBundles: + description: |- + DeprecatedEnableTektonOCIBundles is maintained for backward compatibility + to allow deletion of PipelineRuns created before v0.62.x. + This field is not used and can be removed in a future release + once we're confident old PipelineRuns have been cleaned up. + See issue #8359 for context. + type: boolean + enableTerminationMessageCompression: + type: boolean + enableWaitExponentialBackoff: + type: boolean + enforceNonfalsifiability: + type: string + maxResultSize: + type: integer + requireGitSSHSecretKnownHosts: + type: boolean + resultExtractionMethod: + type: string + runningInEnvWithInjectedSidecars: + type: boolean + sendCloudEventsForRuns: + type: boolean + setSecurityContext: + type: boolean + setSecurityContextReadOnlyRootFilesystem: + type: boolean + verificationNoMatchPolicy: + description: |- + VerificationNoMatchPolicy is the feature flag for "trusted-resources-verification-no-match-policy" + VerificationNoMatchPolicy can be set to "ignore", "warn" and "fail" values. + ignore: skip trusted resources verification when no matching verification policies found + warn: skip trusted resources verification when no matching verification policies found and log a warning + fail: fail the taskrun or pipelines run if no matching verification policies found + type: string + refSource: + description: RefSource + type: object + properties: + digest: + description: Digest + type: object + additionalProperties: + type: string + entryPoint: + description: EntryPoint + type: string + uri: + description: URI + type: string + runs: + description: Runs + type: object + additionalProperties: + description: PipelineRunRunStatus + type: object + properties: + pipelineTaskName: + description: PipelineTaskName + type: string + status: + description: Status + type: object + properties: + annotations: + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + additionalProperties: + type: string + completionTime: + description: CompletionTime is the time the build completed. + type: string + format: date-time + conditions: + description: Conditions the latest available observations + of a resource's current state. + type: array + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + type: object + required: + - status + - type + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating + details about the transition. + type: string + reason: + description: The reason for the condition's last + transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, + False, Unknown. + type: string + type: + description: Type of condition. + type: string + extraFields: + description: |- + ExtraFields holds arbitrary fields provided by the custom task + controller. + x-kubernetes-preserve-unknown-fields: true + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + type: integer + format: int64 + results: + description: |- + Results reports any output result values to be consumed by later + tasks in a pipeline. + type: array + items: + description: CustomRunResult used to describe the results + of a task + type: object + required: + - name + - value + properties: + name: + description: Name the given name + type: string + value: + description: Value the given value of the result + type: string + retriesStatus: + description: |- + RetriesStatus contains the history of CustomRunStatus, in case of a retry. + See CustomRun.status (API version: tekton.dev/v1beta1) + x-kubernetes-preserve-unknown-fields: true + startTime: + description: StartTime is the time the build is actually + started. + type: string + format: date-time + whenExpressions: + description: WhenExpressions + type: array + items: + description: WhenExpression + type: object + properties: + cel: + description: CEL + type: string + input: + description: Input + type: string + operator: + description: Operator + type: string + values: + description: Values + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + skippedTasks: + description: SkippedTasks + type: array + items: + description: SkippedTask + type: object + required: + - name + - reason + properties: + name: + description: Name + type: string + reason: + description: Reason + type: string + whenExpressions: + description: WhenExpressions + type: array + items: + description: WhenExpression + type: object + properties: + cel: + description: CEL + type: string + input: + description: Input + type: string + operator: + description: Operator + type: string + values: + description: Values + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + spanContext: + description: SpanContext + type: object + additionalProperties: + type: string + startTime: + description: StartTime + type: string + format: date-time + taskRuns: + description: TaskRuns + type: object + additionalProperties: + description: PipelineRunTaskRunStatus + type: object + properties: + pipelineTaskName: + description: PipelineTaskName + type: string + status: + description: Status + type: object + required: + - podName + properties: + annotations: + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + additionalProperties: + type: string + cloudEvents: + description: CloudEvents + type: array + items: + description: CloudEventDelivery + type: object + properties: + status: + description: CloudEventDeliveryState + type: object + required: + - message + - retryCount + properties: + condition: + description: Condition + type: string + message: + description: Error + type: string + retryCount: + description: RetryCount + type: integer + format: int32 + sentAt: + description: SentAt + type: string + format: date-time + target: + description: Target + type: string + x-kubernetes-list-type: atomic + completionTime: + description: CompletionTime + type: string + format: date-time + conditions: + description: Conditions the latest available observations + of a resource's current state. + type: array + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + type: object + required: + - status + - type + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating + details about the transition. + type: string + reason: + description: The reason for the condition's last + transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, + False, Unknown. + type: string + type: + description: Type of condition. + type: string + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + type: integer + format: int64 + podName: + description: PodName + type: string + provenance: + description: Provenance + type: object + properties: + configSource: + description: |- + ConfigSource + Deprecated: Use RefSource instead + type: object + properties: + digest: + description: Digest + type: object + additionalProperties: + type: string + entryPoint: + description: EntryPoint + type: string + uri: + description: URI + type: string + featureFlags: + description: FeatureFlags + type: object + properties: + awaitSidecarReadiness: + type: boolean + coschedule: + type: string + disableCredsInit: + type: boolean + disableInlineSpec: + type: string + enableAPIFields: + type: string + enableArtifacts: + type: boolean + enableCELInWhenExpression: + type: boolean + enableConciseResolverSyntax: + type: boolean + enableKeepPodOnCancel: + type: boolean + enableKubernetesSidecar: + type: boolean + enableParamEnum: + type: boolean + enableProvenanceInStatus: + type: boolean + enableStepActions: + description: EnableStepActions is a no-op flag + since StepActions are stable + type: boolean + enableTektonOCIBundles: + description: |- + DeprecatedEnableTektonOCIBundles is maintained for backward compatibility + to allow deletion of PipelineRuns created before v0.62.x. + This field is not used and can be removed in a future release + once we're confident old PipelineRuns have been cleaned up. + See issue #8359 for context. + type: boolean + enableTerminationMessageCompression: + type: boolean + enableWaitExponentialBackoff: + type: boolean + enforceNonfalsifiability: + type: string + maxResultSize: + type: integer + requireGitSSHSecretKnownHosts: + type: boolean + resultExtractionMethod: + type: string + runningInEnvWithInjectedSidecars: + type: boolean + sendCloudEventsForRuns: + type: boolean + setSecurityContext: + type: boolean + setSecurityContextReadOnlyRootFilesystem: + type: boolean + verificationNoMatchPolicy: + description: |- + VerificationNoMatchPolicy is the feature flag for "trusted-resources-verification-no-match-policy" + VerificationNoMatchPolicy can be set to "ignore", "warn" and "fail" values. + ignore: skip trusted resources verification when no matching verification policies found + warn: skip trusted resources verification when no matching verification policies found and log a warning + fail: fail the taskrun or pipelines run if no matching verification policies found + type: string + refSource: + description: RefSource + type: object + properties: + digest: + description: Digest + type: object + additionalProperties: + type: string + entryPoint: + description: EntryPoint + type: string + uri: + description: URI + type: string + resourcesResult: + description: |- + ResourcesResult + Deprecated: this field is not populated and is preserved only for backwards compatibility + type: array + items: + description: |- + RunResult is used to write key/value pairs to TaskRun pod termination messages. + The key/value pairs may come from the entrypoint binary, or represent a TaskRunResult. + If they represent a TaskRunResult, the key is the name of the result and the value is the + JSON-serialized value of the result. + type: object + required: + - key + - value + properties: + key: + type: string + resourceName: + description: |- + ResourceName may be used in tests, but it is not populated in termination messages. + It is preserved here for backwards compatibility and will not be ported to v1. + type: string + type: + description: |- + ResultType used to find out whether a RunResult is from a task result or not + Note that ResultsType is another type which is used to define the data type + (e.g. string, array, etc) we used for Results + type: integer + value: + type: string + x-kubernetes-list-type: atomic + retriesStatus: + description: RetriesStatus + x-kubernetes-preserve-unknown-fields: true + sidecars: + description: Sidecars + type: array + items: + description: SidecarState + type: object + properties: + container: + type: string + imageID: + type: string + name: + type: string + running: + description: Details about a running container + type: object + properties: + startedAt: + description: Time at which the container was + last (re-)started + type: string + format: date-time + terminated: + description: Details about a terminated container + type: object + required: + - exitCode + properties: + containerID: + description: Container's ID in the format '://' + type: string + exitCode: + description: Exit status from the last termination + of the container + type: integer + format: int32 + finishedAt: + description: Time at which the container last + terminated + type: string + format: date-time + message: + description: Message regarding the last termination + of the container + type: string + reason: + description: (brief) reason from the last termination + of the container + type: string + signal: + description: Signal from the last termination + of the container + type: integer + format: int32 + startedAt: + description: Time at which previous execution + of the container started + type: string + format: date-time + waiting: + description: Details about a waiting container + type: object + properties: + message: + description: Message regarding why the container + is not yet running. + type: string + reason: + description: (brief) reason the container is + not yet running. + type: string + x-kubernetes-list-type: atomic + spanContext: + description: SpanContext + type: object + additionalProperties: + type: string + startTime: + description: StartTime + type: string + format: date-time + steps: + description: Steps + type: array + items: + description: StepState + type: object + properties: + container: + type: string + imageID: + type: string + inputs: + type: array + items: + description: Artifact + type: object + properties: + buildOutput: + description: BuildOutput + type: boolean + name: + description: Name + type: string + values: + description: Values + type: array + items: + description: ArtifactValue + type: object + properties: + digest: + type: object + additionalProperties: + type: string + uri: + type: string + name: + type: string + outputs: + type: array + items: + description: Artifact + type: object + properties: + buildOutput: + description: BuildOutput + type: boolean + name: + description: Name + type: string + values: + description: Values + type: array + items: + description: ArtifactValue + type: object + properties: + digest: + type: object + additionalProperties: + type: string + uri: + type: string + provenance: + description: Provenance + type: object + properties: + configSource: + description: |- + ConfigSource + Deprecated: Use RefSource instead + type: object + properties: + digest: + description: Digest + type: object + additionalProperties: + type: string + entryPoint: + description: EntryPoint + type: string + uri: + description: URI + type: string + featureFlags: + description: FeatureFlags + type: object + properties: + awaitSidecarReadiness: + type: boolean + coschedule: + type: string + disableCredsInit: + type: boolean + disableInlineSpec: + type: string + enableAPIFields: + type: string + enableArtifacts: + type: boolean + enableCELInWhenExpression: + type: boolean + enableConciseResolverSyntax: + type: boolean + enableKeepPodOnCancel: + type: boolean + enableKubernetesSidecar: + type: boolean + enableParamEnum: + type: boolean + enableProvenanceInStatus: + type: boolean + enableStepActions: + description: EnableStepActions is a no-op + flag since StepActions are stable + type: boolean + enableTektonOCIBundles: + description: |- + DeprecatedEnableTektonOCIBundles is maintained for backward compatibility + to allow deletion of PipelineRuns created before v0.62.x. + This field is not used and can be removed in a future release + once we're confident old PipelineRuns have been cleaned up. + See issue #8359 for context. + type: boolean + enableTerminationMessageCompression: + type: boolean + enableWaitExponentialBackoff: + type: boolean + enforceNonfalsifiability: + type: string + maxResultSize: + type: integer + requireGitSSHSecretKnownHosts: + type: boolean + resultExtractionMethod: + type: string + runningInEnvWithInjectedSidecars: + type: boolean + sendCloudEventsForRuns: + type: boolean + setSecurityContext: + type: boolean + setSecurityContextReadOnlyRootFilesystem: + type: boolean + verificationNoMatchPolicy: + description: |- + VerificationNoMatchPolicy is the feature flag for "trusted-resources-verification-no-match-policy" + VerificationNoMatchPolicy can be set to "ignore", "warn" and "fail" values. + ignore: skip trusted resources verification when no matching verification policies found + warn: skip trusted resources verification when no matching verification policies found and log a warning + fail: fail the taskrun or pipelines run if no matching verification policies found + type: string + refSource: + description: RefSource + type: object + properties: + digest: + description: Digest + type: object + additionalProperties: + type: string + entryPoint: + description: EntryPoint + type: string + uri: + description: URI + type: string + results: + type: array + items: + description: TaskRunResult + type: object + required: + - name + - value + properties: + name: + description: Name + type: string + type: + description: Type + type: string + value: + description: Value + x-kubernetes-preserve-unknown-fields: true + running: + description: Details about a running container + type: object + properties: + startedAt: + description: Time at which the container was + last (re-)started + type: string + format: date-time + terminated: + description: Details about a terminated container + type: object + required: + - exitCode + properties: + containerID: + description: Container's ID in the format '://' + type: string + exitCode: + description: Exit status from the last termination + of the container + type: integer + format: int32 + finishedAt: + description: Time at which the container last + terminated + type: string + format: date-time + message: + description: Message regarding the last termination + of the container + type: string + reason: + description: (brief) reason from the last termination + of the container + type: string + signal: + description: Signal from the last termination + of the container + type: integer + format: int32 + startedAt: + description: Time at which previous execution + of the container started + type: string + format: date-time + waiting: + description: Details about a waiting container + type: object + properties: + message: + description: Message regarding why the container + is not yet running. + type: string + reason: + description: (brief) reason the container is + not yet running. + type: string + x-kubernetes-list-type: atomic + taskResults: + description: TaskRunResults + type: array + items: + description: TaskRunResult + type: object + required: + - name + - value + properties: + name: + description: Name + type: string + type: + description: Type + type: string + value: + description: Value + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + taskSpec: + description: TaskSpec + x-kubernetes-preserve-unknown-fields: true + whenExpressions: + description: WhenExpressions + type: array + items: + description: WhenExpression + type: object + properties: + cel: + description: CEL + type: string + input: + description: Input + type: string + operator: + description: Operator + type: string + values: + description: Values + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + additionalPrinterColumns: + - name: Succeeded + type: string + jsonPath: ".status.conditions[?(@.type==\"Succeeded\")].status" + - name: Reason + type: string + jsonPath: ".status.conditions[?(@.type==\"Succeeded\")].reason" + - name: StartTime + type: date + jsonPath: .status.startTime + - name: CompletionTime + type: date + jsonPath: .status.completionTime + # Opt into the status subresource so metadata.generation + # starts to increment + subresources: + status: {} + - name: v1 + served: true + storage: true + schema: + openAPIV3Schema: + description: |- + PipelineRun represents a single execution of a Pipeline. PipelineRuns are how + the graph of Tasks declared in a Pipeline are executed; they specify inputs + to Pipelines such as parameter values and capture operational aspects of the + Tasks execution such as service account and tolerations. Creating a + PipelineRun creates TaskRuns for Tasks in the referenced Pipeline. + type: object + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: PipelineRunSpec defines the desired state of PipelineRun + type: object + properties: + managedBy: + description: |- + ManagedBy indicates which controller is responsible for reconciling + this resource. If unset or set to "tekton.dev/pipeline", the default + Tekton controller will manage this resource. + This field is immutable. + type: string + params: + description: Params is a list of parameter names and values. + type: array + items: + description: Param declares an ParamValues to use for the parameter + called name. + type: object + required: + - name + - value + properties: + name: + type: string + value: + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + pipelineRef: + description: PipelineRef can be used to refer to a specific instance + of a Pipeline. + type: object + properties: + apiVersion: + description: API version of the referent + type: string + name: + description: 'Name of the referent; More info: http://kubernetes.io/docs/user-guide/identifiers#names' + type: string + params: + description: |- + Params contains the parameters used to identify the + referenced Tekton resource. Example entries might include + "repo" or "path" but the set of params ultimately depends on + the chosen resolver. + type: array + items: + description: Param declares an ParamValues to use for the + parameter called name. + type: object + required: + - name + - value + properties: + name: + type: string + value: + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + resolver: + description: |- + Resolver is the name of the resolver that should perform + resolution of the referenced Tekton resource, such as "git". + type: string + pipelineSpec: + description: |- + Specifying PipelineSpec can be disabled by setting + `disable-inline-spec` feature flag. + See Pipeline.spec (API version: tekton.dev/v1) + x-kubernetes-preserve-unknown-fields: true + status: + description: Used for cancelling a pipelinerun (and maybe more later + on) + type: string + taskRunSpecs: + description: TaskRunSpecs holds a set of runtime specs + type: array + items: + description: |- + PipelineTaskRunSpec can be used to configure specific + specs for a concrete Task + type: object + properties: + computeResources: + description: Compute resources to use for this TaskRun + type: object + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This field depends on the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + type: array + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + type: object + required: + - name + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + requests: + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + metadata: + description: PipelineTaskMetadata contains the labels or annotations + for an EmbeddedTask + type: object + properties: + annotations: + type: object + additionalProperties: + type: string + labels: + type: object + additionalProperties: + type: string + pipelineTaskName: + type: string + podTemplate: + description: PodTemplate holds pod specific configuration + type: object + properties: + affinity: + description: |- + If specified, the pod's scheduling constraints. + See Pod.spec.affinity (API version: v1) + x-kubernetes-preserve-unknown-fields: true + automountServiceAccountToken: + description: |- + AutomountServiceAccountToken indicates whether pods running as this + service account should have an API token automatically mounted. + type: boolean + dnsConfig: + description: |- + Specifies the DNS parameters of a pod. + Parameters specified here will be merged to the generated DNS + configuration based on DNSPolicy. + type: object + properties: + nameservers: + description: |- + A list of DNS name server IP addresses. + This will be appended to the base nameservers generated from DNSPolicy. + Duplicated nameservers will be removed. + type: array + items: + type: string + x-kubernetes-list-type: atomic + options: + description: |- + A list of DNS resolver options. + This will be merged with the base options generated from DNSPolicy. + Duplicated entries will be removed. Resolution options given in Options + will override those that appear in the base DNSPolicy. + type: array + items: + description: PodDNSConfigOption defines DNS resolver + options of a pod. + type: object + properties: + name: + description: |- + Name is this DNS resolver option's name. + Required. + type: string + value: + description: Value is this DNS resolver option's + value. + type: string + x-kubernetes-list-type: atomic + searches: + description: |- + A list of DNS search domains for host-name lookup. + This will be appended to the base search paths generated from DNSPolicy. + Duplicated search paths will be removed. + type: array + items: + type: string + x-kubernetes-list-type: atomic + dnsPolicy: + description: |- + Set DNS policy for the pod. Defaults to "ClusterFirst". Valid values are + 'ClusterFirst', 'Default' or 'None'. DNS parameters given in DNSConfig + will be merged with the policy selected with DNSPolicy. + type: string + enableServiceLinks: + description: |- + EnableServiceLinks indicates whether information about services should be injected into pod's + environment variables, matching the syntax of Docker links. + Optional: Defaults to true. + type: boolean + env: + description: List of environment variables that can be + provided to the containers belonging to the pod. + type: array + items: + description: EnvVar represents an environment variable + present in a Container. + type: object + required: + - name + properties: + name: + description: |- + Name of the environment variable. + May consist of any printable ASCII characters except '='. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's + value. Cannot be used if value is not empty. + type: object + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + type: object + required: + - key + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + type: object + required: + - fieldPath + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select + in the specified API version. + type: string + x-kubernetes-map-type: atomic + fileKeyRef: + description: |- + FileKeyRef selects a key of the env file. + Requires the EnvFiles feature gate to be enabled. + type: object + required: + - key + - path + - volumeName + properties: + key: + description: |- + The key within the env file. An invalid key will prevent the pod from starting. + The keys defined within a source may consist of any printable ASCII characters except '='. + During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters. + type: string + optional: + description: |- + Specify whether the file or its key must be defined. If the file or key + does not exist, then the env var is not published. + If optional is set to true and the specified key does not exist, + the environment variable will not be set in the Pod's containers. + + If optional is set to false and the specified key does not exist, + an error will be returned during Pod creation. + type: boolean + default: false + path: + description: |- + The path within the volume from which to select the file. + Must be relative and may not contain the '..' path or start with '..'. + type: string + volumeName: + description: The name of the volume mount + containing the env file. + type: string + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + type: object + required: + - resource + properties: + containerName: + description: 'Container name: required for + volumes, optional for env vars' + type: string + divisor: + description: Specifies the output format + of the exposed resources, defaults to + "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the + pod's namespace + type: object + required: + - key + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret + or its key must be defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + hostAliases: + description: |- + HostAliases is an optional list of hosts and IPs that will be injected into the pod's hosts + file if specified. This is only valid for non-hostNetwork pods. + type: array + items: + description: |- + HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the + pod's hosts file. + type: object + required: + - ip + properties: + hostnames: + description: Hostnames for the above IP address. + type: array + items: + type: string + x-kubernetes-list-type: atomic + ip: + description: IP address of the host file entry. + type: string + x-kubernetes-list-type: atomic + hostNetwork: + description: HostNetwork specifies whether the pod may + use the node network namespace + type: boolean + hostUsers: + description: |- + HostUsers indicates whether the pod will use the host's user namespace. + Optional: Default to true. + If set to true or not present, the pod will be run in the host user namespace, useful + for when the pod needs a feature only available to the host user namespace, such as + loading a kernel module with CAP_SYS_MODULE. + When set to false, a new user namespace is created for the pod. Setting false + is useful to mitigating container breakout vulnerabilities such as allowing + containers to run as root without their user having root privileges on the host. + This field depends on the kubernetes feature gate UserNamespacesSupport being enabled. + type: boolean + imagePullSecrets: + description: ImagePullSecrets gives the name of the secret + used by the pod to pull the image if specified + type: array + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + nodeSelector: + description: |- + NodeSelector is a selector which must be true for the pod to fit on a node. + Selector which must match a node's labels for the pod to be scheduled on that node. + More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ + type: object + additionalProperties: + type: string + priorityClassName: + description: |- + If specified, indicates the pod's priority. "system-node-critical" and + "system-cluster-critical" are two special keywords which indicate the + highest priorities with the former being the highest priority. Any other + name must be defined by creating a PriorityClass object with that name. + If not specified, the pod priority will be default or zero if there is no + default. + type: string + runtimeClassName: + description: |- + RuntimeClassName refers to a RuntimeClass object in the node.k8s.io + group, which should be used to run this pod. If no RuntimeClass resource + matches the named class, the pod will not be run. If unset or empty, the + "legacy" RuntimeClass will be used, which is an implicit class with an + empty definition that uses the default runtime handler. + More info: https://git.k8s.io/enhancements/keps/sig-node/runtime-class.md + This is a beta feature as of Kubernetes v1.14. + type: string + schedulerName: + description: SchedulerName specifies the scheduler to + be used to dispatch the Pod + type: string + securityContext: + description: |- + SecurityContext holds pod-level security attributes and common container settings. + Optional: Defaults to empty. See type description for default values of each field. + See Pod.spec.securityContext (API version: v1) + x-kubernetes-preserve-unknown-fields: true + tolerations: + description: If specified, the pod's tolerations. + type: array + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + type: object + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + type: integer + format: int64 + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + x-kubernetes-list-type: atomic + topologySpreadConstraints: + description: |- + TopologySpreadConstraints controls how Pods are spread across your cluster among + failure-domains such as regions, zones, nodes, and other user-defined topology domains. + type: array + items: + description: TopologySpreadConstraint specifies how + to spread matching pods among the given topology. + type: object + required: + - maxSkew + - topologyKey + - whenUnsatisfiable + properties: + labelSelector: + description: |- + LabelSelector is used to find matching pods. + Pods that match this label selector are counted to determine the number of pods + in their corresponding topology domain. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select the pods over which + spreading will be calculated. The keys are used to lookup values from the + incoming pod labels, those key-value labels are ANDed with labelSelector + to select the group of existing pods over which spreading will be calculated + for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + MatchLabelKeys cannot be set when LabelSelector isn't set. + Keys that don't exist in the incoming pod labels will + be ignored. A null or empty list means only match against labelSelector. + + This is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default). + type: array + items: + type: string + x-kubernetes-list-type: atomic + maxSkew: + description: |- + MaxSkew describes the degree to which pods may be unevenly distributed. + When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference + between the number of matching pods in the target topology and the global minimum. + The global minimum is the minimum number of matching pods in an eligible domain + or zero if the number of eligible domains is less than MinDomains. + For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same + labelSelector spread as 2/2/1: + In this case, the global minimum is 1. + | zone1 | zone2 | zone3 | + | P P | P P | P | + - if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2; + scheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2) + violate MaxSkew(1). + - if MaxSkew is 2, incoming pod can be scheduled onto any zone. + When `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence + to topologies that satisfy it. + It's a required field. Default value is 1 and 0 is not allowed. + type: integer + format: int32 + minDomains: + description: |- + MinDomains indicates a minimum number of eligible domains. + When the number of eligible domains with matching topology keys is less than minDomains, + Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed. + And when the number of eligible domains with matching topology keys equals or greater than minDomains, + this value has no effect on scheduling. + As a result, when the number of eligible domains is less than minDomains, + scheduler won't schedule more than maxSkew Pods to those domains. + If value is nil, the constraint behaves as if MinDomains is equal to 1. + Valid values are integers greater than 0. + When value is not nil, WhenUnsatisfiable must be DoNotSchedule. + + For example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same + labelSelector spread as 2/2/2: + | zone1 | zone2 | zone3 | + | P P | P P | P P | + The number of domains is less than 5(MinDomains), so "global minimum" is treated as 0. + In this situation, new pod with the same labelSelector cannot be scheduled, + because computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones, + it will violate MaxSkew. + type: integer + format: int32 + nodeAffinityPolicy: + description: |- + NodeAffinityPolicy indicates how we will treat Pod's nodeAffinity/nodeSelector + when calculating pod topology spread skew. Options are: + - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations. + - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations. + + If this value is nil, the behavior is equivalent to the Honor policy. + type: string + nodeTaintsPolicy: + description: |- + NodeTaintsPolicy indicates how we will treat node taints when calculating + pod topology spread skew. Options are: + - Honor: nodes without taints, along with tainted nodes for which the incoming pod + has a toleration, are included. + - Ignore: node taints are ignored. All nodes are included. + + If this value is nil, the behavior is equivalent to the Ignore policy. + type: string + topologyKey: + description: |- + TopologyKey is the key of node labels. Nodes that have a label with this key + and identical values are considered to be in the same topology. + We consider each as a "bucket", and try to put balanced number + of pods into each bucket. + We define a domain as a particular instance of a topology. + Also, we define an eligible domain as a domain whose nodes meet the requirements of + nodeAffinityPolicy and nodeTaintsPolicy. + e.g. If TopologyKey is "kubernetes.io/hostname", each Node is a domain of that topology. + And, if TopologyKey is "topology.kubernetes.io/zone", each zone is a domain of that topology. + It's a required field. + type: string + whenUnsatisfiable: + description: |- + WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy + the spread constraint. + - DoNotSchedule (default) tells the scheduler not to schedule it. + - ScheduleAnyway tells the scheduler to schedule the pod in any location, + but giving higher precedence to topologies that would help reduce the + skew. + A constraint is considered "Unsatisfiable" for an incoming pod + if and only if every possible node assignment for that pod would violate + "MaxSkew" on some topology. + For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same + labelSelector spread as 3/1/1: + | zone1 | zone2 | zone3 | + | P P P | P | P | + If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled + to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies + MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler + won't make it *more* imbalanced. + It's a required field. + type: string + x-kubernetes-list-type: atomic + volumes: + description: |- + List of volumes that can be mounted by containers belonging to the pod. + More info: https://kubernetes.io/docs/concepts/storage/volumes + See Pod.spec.volumes (API version: v1) + x-kubernetes-preserve-unknown-fields: true + serviceAccountName: + type: string + sidecarSpecs: + type: array + items: + description: TaskRunSidecarSpec is used to override the + values of a Sidecar in the corresponding Task. + type: object + required: + - computeResources + - name + properties: + computeResources: + description: The resource requirements to apply to the + Sidecar. + type: object + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This field depends on the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + type: array + items: + description: ResourceClaim references one entry + in PodSpec.ResourceClaims. + type: object + required: + - name + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + requests: + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + name: + description: The name of the Sidecar to override. + type: string + x-kubernetes-list-type: atomic + stepSpecs: + type: array + items: + description: TaskRunStepSpec is used to override the values + of a Step in the corresponding Task. + type: object + required: + - computeResources + - name + properties: + computeResources: + description: The resource requirements to apply to the + Step. + type: object + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This field depends on the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + type: array + items: + description: ResourceClaim references one entry + in PodSpec.ResourceClaims. + type: object + required: + - name + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + requests: + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + name: + description: The name of the Step to override. + type: string + x-kubernetes-list-type: atomic + timeout: + description: |- + Duration after which the TaskRun times out. Overrides the timeout specified + on the Task's spec if specified. Takes lower precedence to PipelineRun's + `spec.timeouts.tasks` + Refer Go's ParseDuration documentation for expected format: https://golang.org/pkg/time/#ParseDuration + type: string + x-kubernetes-list-type: atomic + taskRunTemplate: + description: TaskRunTemplate represent template of taskrun + type: object + properties: + podTemplate: + description: PodTemplate holds pod specific configuration + type: object + properties: + affinity: + description: |- + If specified, the pod's scheduling constraints. + See Pod.spec.affinity (API version: v1) + x-kubernetes-preserve-unknown-fields: true + automountServiceAccountToken: + description: |- + AutomountServiceAccountToken indicates whether pods running as this + service account should have an API token automatically mounted. + type: boolean + dnsConfig: + description: |- + Specifies the DNS parameters of a pod. + Parameters specified here will be merged to the generated DNS + configuration based on DNSPolicy. + type: object + properties: + nameservers: + description: |- + A list of DNS name server IP addresses. + This will be appended to the base nameservers generated from DNSPolicy. + Duplicated nameservers will be removed. + type: array + items: + type: string + x-kubernetes-list-type: atomic + options: + description: |- + A list of DNS resolver options. + This will be merged with the base options generated from DNSPolicy. + Duplicated entries will be removed. Resolution options given in Options + will override those that appear in the base DNSPolicy. + type: array + items: + description: PodDNSConfigOption defines DNS resolver + options of a pod. + type: object + properties: + name: + description: |- + Name is this DNS resolver option's name. + Required. + type: string + value: + description: Value is this DNS resolver option's + value. + type: string + x-kubernetes-list-type: atomic + searches: + description: |- + A list of DNS search domains for host-name lookup. + This will be appended to the base search paths generated from DNSPolicy. + Duplicated search paths will be removed. + type: array + items: + type: string + x-kubernetes-list-type: atomic + dnsPolicy: + description: |- + Set DNS policy for the pod. Defaults to "ClusterFirst". Valid values are + 'ClusterFirst', 'Default' or 'None'. DNS parameters given in DNSConfig + will be merged with the policy selected with DNSPolicy. + type: string + enableServiceLinks: + description: |- + EnableServiceLinks indicates whether information about services should be injected into pod's + environment variables, matching the syntax of Docker links. + Optional: Defaults to true. + type: boolean + env: + description: List of environment variables that can be provided + to the containers belonging to the pod. + type: array + items: + description: EnvVar represents an environment variable + present in a Container. + type: object + required: + - name + properties: + name: + description: |- + Name of the environment variable. + May consist of any printable ASCII characters except '='. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's + value. Cannot be used if value is not empty. + type: object + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + type: object + required: + - key + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + type: object + required: + - fieldPath + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in + the specified API version. + type: string + x-kubernetes-map-type: atomic + fileKeyRef: + description: |- + FileKeyRef selects a key of the env file. + Requires the EnvFiles feature gate to be enabled. + type: object + required: + - key + - path + - volumeName + properties: + key: + description: |- + The key within the env file. An invalid key will prevent the pod from starting. + The keys defined within a source may consist of any printable ASCII characters except '='. + During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters. + type: string + optional: + description: |- + Specify whether the file or its key must be defined. If the file or key + does not exist, then the env var is not published. + If optional is set to true and the specified key does not exist, + the environment variable will not be set in the Pod's containers. + + If optional is set to false and the specified key does not exist, + an error will be returned during Pod creation. + type: boolean + default: false + path: + description: |- + The path within the volume from which to select the file. + Must be relative and may not contain the '..' path or start with '..'. + type: string + volumeName: + description: The name of the volume mount + containing the env file. + type: string + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + type: object + required: + - resource + properties: + containerName: + description: 'Container name: required for + volumes, optional for env vars' + type: string + divisor: + description: Specifies the output format of + the exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the + pod's namespace + type: object + required: + - key + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + hostAliases: + description: |- + HostAliases is an optional list of hosts and IPs that will be injected into the pod's hosts + file if specified. This is only valid for non-hostNetwork pods. + type: array + items: + description: |- + HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the + pod's hosts file. + type: object + required: + - ip + properties: + hostnames: + description: Hostnames for the above IP address. + type: array + items: + type: string + x-kubernetes-list-type: atomic + ip: + description: IP address of the host file entry. + type: string + x-kubernetes-list-type: atomic + hostNetwork: + description: HostNetwork specifies whether the pod may use + the node network namespace + type: boolean + hostUsers: + description: |- + HostUsers indicates whether the pod will use the host's user namespace. + Optional: Default to true. + If set to true or not present, the pod will be run in the host user namespace, useful + for when the pod needs a feature only available to the host user namespace, such as + loading a kernel module with CAP_SYS_MODULE. + When set to false, a new user namespace is created for the pod. Setting false + is useful to mitigating container breakout vulnerabilities such as allowing + containers to run as root without their user having root privileges on the host. + This field depends on the kubernetes feature gate UserNamespacesSupport being enabled. + type: boolean + imagePullSecrets: + description: ImagePullSecrets gives the name of the secret + used by the pod to pull the image if specified + type: array + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + nodeSelector: + description: |- + NodeSelector is a selector which must be true for the pod to fit on a node. + Selector which must match a node's labels for the pod to be scheduled on that node. + More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ + type: object + additionalProperties: + type: string + priorityClassName: + description: |- + If specified, indicates the pod's priority. "system-node-critical" and + "system-cluster-critical" are two special keywords which indicate the + highest priorities with the former being the highest priority. Any other + name must be defined by creating a PriorityClass object with that name. + If not specified, the pod priority will be default or zero if there is no + default. + type: string + runtimeClassName: + description: |- + RuntimeClassName refers to a RuntimeClass object in the node.k8s.io + group, which should be used to run this pod. If no RuntimeClass resource + matches the named class, the pod will not be run. If unset or empty, the + "legacy" RuntimeClass will be used, which is an implicit class with an + empty definition that uses the default runtime handler. + More info: https://git.k8s.io/enhancements/keps/sig-node/runtime-class.md + This is a beta feature as of Kubernetes v1.14. + type: string + schedulerName: + description: SchedulerName specifies the scheduler to be + used to dispatch the Pod + type: string + securityContext: + description: |- + SecurityContext holds pod-level security attributes and common container settings. + Optional: Defaults to empty. See type description for default values of each field. + See Pod.spec.securityContext (API version: v1) + x-kubernetes-preserve-unknown-fields: true + tolerations: + description: If specified, the pod's tolerations. + type: array + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + type: object + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + type: integer + format: int64 + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + x-kubernetes-list-type: atomic + topologySpreadConstraints: + description: |- + TopologySpreadConstraints controls how Pods are spread across your cluster among + failure-domains such as regions, zones, nodes, and other user-defined topology domains. + type: array + items: + description: TopologySpreadConstraint specifies how to + spread matching pods among the given topology. + type: object + required: + - maxSkew + - topologyKey + - whenUnsatisfiable + properties: + labelSelector: + description: |- + LabelSelector is used to find matching pods. + Pods that match this label selector are counted to determine the number of pods + in their corresponding topology domain. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the + selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select the pods over which + spreading will be calculated. The keys are used to lookup values from the + incoming pod labels, those key-value labels are ANDed with labelSelector + to select the group of existing pods over which spreading will be calculated + for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + MatchLabelKeys cannot be set when LabelSelector isn't set. + Keys that don't exist in the incoming pod labels will + be ignored. A null or empty list means only match against labelSelector. + + This is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default). + type: array + items: + type: string + x-kubernetes-list-type: atomic + maxSkew: + description: |- + MaxSkew describes the degree to which pods may be unevenly distributed. + When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference + between the number of matching pods in the target topology and the global minimum. + The global minimum is the minimum number of matching pods in an eligible domain + or zero if the number of eligible domains is less than MinDomains. + For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same + labelSelector spread as 2/2/1: + In this case, the global minimum is 1. + | zone1 | zone2 | zone3 | + | P P | P P | P | + - if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2; + scheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2) + violate MaxSkew(1). + - if MaxSkew is 2, incoming pod can be scheduled onto any zone. + When `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence + to topologies that satisfy it. + It's a required field. Default value is 1 and 0 is not allowed. + type: integer + format: int32 + minDomains: + description: |- + MinDomains indicates a minimum number of eligible domains. + When the number of eligible domains with matching topology keys is less than minDomains, + Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed. + And when the number of eligible domains with matching topology keys equals or greater than minDomains, + this value has no effect on scheduling. + As a result, when the number of eligible domains is less than minDomains, + scheduler won't schedule more than maxSkew Pods to those domains. + If value is nil, the constraint behaves as if MinDomains is equal to 1. + Valid values are integers greater than 0. + When value is not nil, WhenUnsatisfiable must be DoNotSchedule. + + For example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same + labelSelector spread as 2/2/2: + | zone1 | zone2 | zone3 | + | P P | P P | P P | + The number of domains is less than 5(MinDomains), so "global minimum" is treated as 0. + In this situation, new pod with the same labelSelector cannot be scheduled, + because computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones, + it will violate MaxSkew. + type: integer + format: int32 + nodeAffinityPolicy: + description: |- + NodeAffinityPolicy indicates how we will treat Pod's nodeAffinity/nodeSelector + when calculating pod topology spread skew. Options are: + - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations. + - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations. + + If this value is nil, the behavior is equivalent to the Honor policy. + type: string + nodeTaintsPolicy: + description: |- + NodeTaintsPolicy indicates how we will treat node taints when calculating + pod topology spread skew. Options are: + - Honor: nodes without taints, along with tainted nodes for which the incoming pod + has a toleration, are included. + - Ignore: node taints are ignored. All nodes are included. + + If this value is nil, the behavior is equivalent to the Ignore policy. + type: string + topologyKey: + description: |- + TopologyKey is the key of node labels. Nodes that have a label with this key + and identical values are considered to be in the same topology. + We consider each as a "bucket", and try to put balanced number + of pods into each bucket. + We define a domain as a particular instance of a topology. + Also, we define an eligible domain as a domain whose nodes meet the requirements of + nodeAffinityPolicy and nodeTaintsPolicy. + e.g. If TopologyKey is "kubernetes.io/hostname", each Node is a domain of that topology. + And, if TopologyKey is "topology.kubernetes.io/zone", each zone is a domain of that topology. + It's a required field. + type: string + whenUnsatisfiable: + description: |- + WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy + the spread constraint. + - DoNotSchedule (default) tells the scheduler not to schedule it. + - ScheduleAnyway tells the scheduler to schedule the pod in any location, + but giving higher precedence to topologies that would help reduce the + skew. + A constraint is considered "Unsatisfiable" for an incoming pod + if and only if every possible node assignment for that pod would violate + "MaxSkew" on some topology. + For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same + labelSelector spread as 3/1/1: + | zone1 | zone2 | zone3 | + | P P P | P | P | + If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled + to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies + MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler + won't make it *more* imbalanced. + It's a required field. + type: string + x-kubernetes-list-type: atomic + volumes: + description: |- + List of volumes that can be mounted by containers belonging to the pod. + More info: https://kubernetes.io/docs/concepts/storage/volumes + See Pod.spec.volumes (API version: v1) + x-kubernetes-preserve-unknown-fields: true + serviceAccountName: + type: string + timeouts: + description: |- + Time after which the Pipeline times out. + Currently three keys are accepted in the map + pipeline, tasks and finally + with Timeouts.pipeline >= Timeouts.tasks + Timeouts.finally + type: object + properties: + finally: + description: Finally sets the maximum allowed duration of this + pipeline's finally + type: string + pipeline: + description: Pipeline sets the maximum allowed duration for + execution of the entire pipeline. The sum of individual timeouts + for tasks and finally must not exceed this value. + type: string + tasks: + description: Tasks sets the maximum allowed duration of this + pipeline's tasks + type: string + workspaces: + description: |- + Workspaces holds a set of workspace bindings that must match names + with those declared in the pipeline. + type: array + items: + description: WorkspaceBinding maps a Task's declared workspace + to a Volume. + type: object + required: + - name + properties: + configMap: + description: ConfigMap represents a configMap that should + populate this workspace. + type: object + properties: + defaultMode: + description: |- + defaultMode is optional: mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + Defaults to 0644. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + ConfigMap will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the ConfigMap, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: optional specify whether the ConfigMap or + its keys must be defined + type: boolean + x-kubernetes-map-type: atomic + csi: + description: CSI (Container Storage Interface) represents + ephemeral storage that is handled by certain external CSI + drivers. + type: object + required: + - driver + properties: + driver: + description: |- + driver is the name of the CSI driver that handles this volume. + Consult with your admin for the correct name as registered in the cluster. + type: string + fsType: + description: |- + fsType to mount. Ex. "ext4", "xfs", "ntfs". + If not provided, the empty value is passed to the associated CSI driver + which will determine the default filesystem to apply. + type: string + nodePublishSecretRef: + description: |- + nodePublishSecretRef is a reference to the secret object containing + sensitive information to pass to the CSI driver to complete the CSI + NodePublishVolume and NodeUnpublishVolume calls. + This field is optional, and may be empty if no secret is required. If the + secret object contains more than one secret, all secret references are passed. + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + x-kubernetes-map-type: atomic + readOnly: + description: |- + readOnly specifies a read-only configuration for the volume. + Defaults to false (read/write). + type: boolean + volumeAttributes: + description: |- + volumeAttributes stores driver-specific properties that are passed to the CSI + driver. Consult your driver's documentation for supported values. + type: object + additionalProperties: + type: string + emptyDir: + description: |- + EmptyDir represents a temporary directory that shares a Task's lifetime. + More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir + Either this OR PersistentVolumeClaim can be used. + type: object + properties: + medium: + description: |- + medium represents what type of storage medium should back this directory. + The default is "" which means to use the node's default medium. + Must be an empty string (default) or Memory. + More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir + type: string + sizeLimit: + description: |- + sizeLimit is the total amount of local storage required for this EmptyDir volume. + The size limit is also applicable for memory medium. + The maximum usage on memory medium EmptyDir would be the minimum value between + the SizeLimit specified here and the sum of memory limits of all containers in a pod. + The default is nil which means that the limit is undefined. + More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + name: + description: Name is the name of the workspace populated by + the volume. + type: string + persistentVolumeClaim: + description: |- + PersistentVolumeClaimVolumeSource represents a reference to a + PersistentVolumeClaim in the same namespace. Either this OR EmptyDir can be used. + type: object + required: + - claimName + properties: + claimName: + description: |- + claimName is the name of a PersistentVolumeClaim in the same namespace as the pod using this volume. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims + type: string + readOnly: + description: |- + readOnly Will force the ReadOnly setting in VolumeMounts. + Default false. + type: boolean + projected: + description: Projected represents a projected volume that + should populate this workspace. + type: object + properties: + defaultMode: + description: |- + defaultMode are the mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + sources: + description: |- + sources is the list of volume projections. Each entry in this list + handles one source. + type: array + items: + description: |- + Projection that may be projected along with other supported volume types. + Exactly one of these fields must be set. + type: object + properties: + clusterTrustBundle: + description: |- + ClusterTrustBundle allows a pod to access the `.spec.trustBundle` field + of ClusterTrustBundle objects in an auto-updating file. + + Alpha, gated by the ClusterTrustBundleProjection feature gate. + + ClusterTrustBundle objects can either be selected by name, or by the + combination of signer name and a label selector. + + Kubelet performs aggressive normalization of the PEM contents written + into the pod filesystem. Esoteric PEM features such as inter-block + comments and block headers are stripped. Certificates are deduplicated. + The ordering of certificates within the file is arbitrary, and Kubelet + may change the order over time. + type: object + required: + - path + properties: + labelSelector: + description: |- + Select all ClusterTrustBundles that match this label selector. Only has + effect if signerName is set. Mutually-exclusive with name. If unset, + interpreted as "match nothing". If set but empty, interpreted as "match + everything". + type: object + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + name: + description: |- + Select a single ClusterTrustBundle by object name. Mutually-exclusive + with signerName and labelSelector. + type: string + optional: + description: |- + If true, don't block pod startup if the referenced ClusterTrustBundle(s) + aren't available. If using name, then the named ClusterTrustBundle is + allowed not to exist. If using signerName, then the combination of + signerName and labelSelector is allowed to match zero + ClusterTrustBundles. + type: boolean + path: + description: Relative path from the volume root + to write the bundle. + type: string + signerName: + description: |- + Select all ClusterTrustBundles that match this signer name. + Mutually-exclusive with name. The contents of all selected + ClusterTrustBundles will be unified and deduplicated. + type: string + configMap: + description: configMap information about the configMap + data to project + type: object + properties: + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + ConfigMap will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the ConfigMap, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within + a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: optional specify whether the ConfigMap + or its keys must be defined + type: boolean + x-kubernetes-map-type: atomic + downwardAPI: + description: downwardAPI information about the downwardAPI + data to project + type: object + properties: + items: + description: Items is a list of DownwardAPIVolume + file + type: array + items: + description: DownwardAPIVolumeFile represents + information to create the file containing + the pod field + type: object + required: + - path + properties: + fieldRef: + description: 'Required: Selects a field + of the pod: only annotations, labels, + name, namespace and uid are supported.' + type: object + required: + - fieldPath + properties: + apiVersion: + description: Version of the schema + the FieldPath is written in terms + of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to + select in the specified API version. + type: string + x-kubernetes-map-type: atomic + mode: + description: |- + Optional: mode bits used to set permissions on this file, must be an octal value + between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: 'Required: Path is the relative + path name of the file to be created. + Must not be absolute or contain the + ''..'' path. Must be utf-8 encoded. + The first item of the relative path + must not start with ''..''' + type: string + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported. + type: object + required: + - resource + properties: + containerName: + description: 'Container name: required + for volumes, optional for env vars' + type: string + divisor: + description: Specifies the output + format of the exposed resources, + defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to + select' + type: string + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + podCertificate: + description: |- + Projects an auto-rotating credential bundle (private key and certificate + chain) that the pod can use either as a TLS client or server. + + Kubelet generates a private key and uses it to send a + PodCertificateRequest to the named signer. Once the signer approves the + request and issues a certificate chain, Kubelet writes the key and + certificate chain to the pod filesystem. The pod does not start until + certificates have been issued for each podCertificate projected volume + source in its spec. + + Kubelet will begin trying to rotate the certificate at the time indicated + by the signer using the PodCertificateRequest.Status.BeginRefreshAt + timestamp. + + Kubelet can write a single file, indicated by the credentialBundlePath + field, or separate files, indicated by the keyPath and + certificateChainPath fields. + + The credential bundle is a single file in PEM format. The first PEM + entry is the private key (in PKCS#8 format), and the remaining PEM + entries are the certificate chain issued by the signer (typically, + signers will return their certificate chain in leaf-to-root order). + + Prefer using the credential bundle format, since your application code + can read it atomically. If you use keyPath and certificateChainPath, + your application must make two separate file reads. If these coincide + with a certificate rotation, it is possible that the private key and leaf + certificate you read may not correspond to each other. Your application + will need to check for this condition, and re-read until they are + consistent. + + The named signer controls chooses the format of the certificate it + issues; consult the signer implementation's documentation to learn how to + use the certificates it issues. + type: object + required: + - keyType + - signerName + properties: + certificateChainPath: + description: |- + Write the certificate chain at this path in the projected volume. + + Most applications should use credentialBundlePath. When using keyPath + and certificateChainPath, your application needs to check that the key + and leaf certificate are consistent, because it is possible to read the + files mid-rotation. + type: string + credentialBundlePath: + description: |- + Write the credential bundle at this path in the projected volume. + + The credential bundle is a single file that contains multiple PEM blocks. + The first PEM block is a PRIVATE KEY block, containing a PKCS#8 private + key. + + The remaining blocks are CERTIFICATE blocks, containing the issued + certificate chain from the signer (leaf and any intermediates). + + Using credentialBundlePath lets your Pod's application code make a single + atomic read that retrieves a consistent key and certificate chain. If you + project them to separate files, your application code will need to + additionally check that the leaf certificate was issued to the key. + type: string + keyPath: + description: |- + Write the key at this path in the projected volume. + + Most applications should use credentialBundlePath. When using keyPath + and certificateChainPath, your application needs to check that the key + and leaf certificate are consistent, because it is possible to read the + files mid-rotation. + type: string + keyType: + description: |- + The type of keypair Kubelet will generate for the pod. + + Valid values are "RSA3072", "RSA4096", "ECDSAP256", "ECDSAP384", + "ECDSAP521", and "ED25519". + type: string + maxExpirationSeconds: + description: |- + maxExpirationSeconds is the maximum lifetime permitted for the + certificate. + + Kubelet copies this value verbatim into the PodCertificateRequests it + generates for this projection. + + If omitted, kube-apiserver will set it to 86400(24 hours). kube-apiserver + will reject values shorter than 3600 (1 hour). The maximum allowable + value is 7862400 (91 days). + + The signer implementation is then free to issue a certificate with any + lifetime *shorter* than MaxExpirationSeconds, but no shorter than 3600 + seconds (1 hour). This constraint is enforced by kube-apiserver. + `kubernetes.io` signers will never issue certificates with a lifetime + longer than 24 hours. + type: integer + format: int32 + signerName: + description: Kubelet's generated CSRs will be + addressed to this signer. + type: string + userAnnotations: + description: |- + userAnnotations allow pod authors to pass additional information to + the signer implementation. Kubernetes does not restrict or validate this + metadata in any way. + + These values are copied verbatim into the `spec.unverifiedUserAnnotations` field of + the PodCertificateRequest objects that Kubelet creates. + + Entries are subject to the same validation as object metadata annotations, + with the addition that all keys must be domain-prefixed. No restrictions + are placed on values, except an overall size limitation on the entire field. + + Signers should document the keys and values they support. Signers should + deny requests that contain keys they do not recognize. + type: object + additionalProperties: + type: string + secret: + description: secret information about the secret + data to project + type: object + properties: + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + Secret will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the Secret, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within + a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: optional field specify whether + the Secret or its key must be defined + type: boolean + x-kubernetes-map-type: atomic + serviceAccountToken: + description: serviceAccountToken is information + about the serviceAccountToken data to project + type: object + required: + - path + properties: + audience: + description: |- + audience is the intended audience of the token. A recipient of a token + must identify itself with an identifier specified in the audience of the + token, and otherwise should reject the token. The audience defaults to the + identifier of the apiserver. + type: string + expirationSeconds: + description: |- + expirationSeconds is the requested duration of validity of the service + account token. As the token approaches expiration, the kubelet volume + plugin will proactively rotate the service account token. The kubelet will + start trying to rotate the token if the token is older than 80 percent of + its time to live or if the token is older than 24 hours.Defaults to 1 hour + and must be at least 10 minutes. + type: integer + format: int64 + path: + description: |- + path is the path relative to the mount point of the file to project the + token into. + type: string + x-kubernetes-list-type: atomic + secret: + description: Secret represents a secret that should populate + this workspace. + type: object + properties: + defaultMode: + description: |- + defaultMode is Optional: mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values + for mode bits. Defaults to 0644. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + items: + description: |- + items If unspecified, each key-value pair in the Data field of the referenced + Secret will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the Secret, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + optional: + description: optional field specify whether the Secret + or its keys must be defined + type: boolean + secretName: + description: |- + secretName is the name of the secret in the pod's namespace to use. + More info: https://kubernetes.io/docs/concepts/storage/volumes#secret + type: string + subPath: + description: |- + SubPath is optionally a directory on the volume which should be used + for this binding (i.e. the volume will be mounted at this sub directory). + type: string + volumeClaimTemplate: + description: |- + VolumeClaimTemplate is a template for a claim that will be created in the same namespace. + The PipelineRun controller is responsible for creating a unique claim for each instance of PipelineRun. + See PersistentVolumeClaim (API version: v1) + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + status: + description: PipelineRunStatus defines the observed state of PipelineRun + type: object + properties: + annotations: + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + additionalProperties: + type: string + childReferences: + description: list of TaskRun and Run names, PipelineTask names, + and API versions/kinds for children of this PipelineRun. + type: array + items: + description: ChildStatusReference is used to point to the statuses + of individual TaskRuns and Runs within this PipelineRun. + type: object + properties: + apiVersion: + type: string + displayName: + description: |- + DisplayName is a user-facing name of the pipelineTask that may be + used to populate a UI. + type: string + kind: + type: string + name: + description: Name is the name of the TaskRun or Run this is + referencing. + type: string + pipelineTaskName: + description: PipelineTaskName is the name of the PipelineTask + this is referencing. + type: string + whenExpressions: + description: WhenExpressions is the list of checks guarding + the execution of the PipelineTask + type: array + items: + description: |- + WhenExpression allows a PipelineTask to declare expressions to be evaluated before the Task is run + to determine whether the Task should be executed or skipped + type: object + properties: + cel: + description: |- + CEL is a string of Common Language Expression, which can be used to conditionally execute + the task based on the result of the expression evaluation + More info about CEL syntax: https://github.com/google/cel-spec/blob/master/doc/langdef.md + type: string + input: + description: Input is the string for guard checking + which can be a static input or an output from a parent + Task + type: string + operator: + description: Operator that represents an Input's relationship + to the values + type: string + values: + description: |- + Values is an array of strings, which is compared against the input, for guard checking + It must be non-empty + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + completionTime: + description: CompletionTime is the time the PipelineRun completed. + type: string + format: date-time + conditions: + description: Conditions the latest available observations of a resource's + current state. + type: array + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + type: object + required: + - status + - type + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating details about + the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, False, + Unknown. + type: string + type: + description: Type of condition. + type: string + finallyStartTime: + description: FinallyStartTime is when all non-finally tasks have + been completed and only finally tasks are being executed. + type: string + format: date-time + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + type: integer + format: int64 + pipelineSpec: + description: |- + PipelineSpec contains the exact spec used to instantiate the run. + See Pipeline.spec (API version: tekton.dev/v1) + x-kubernetes-preserve-unknown-fields: true + provenance: + description: Provenance contains some key authenticated metadata + about how a software artifact was built (what sources, what inputs/outputs, + etc.). + type: object + properties: + featureFlags: + description: FeatureFlags identifies the feature flags that + were used during the task/pipeline run + type: object + properties: + awaitSidecarReadiness: + type: boolean + coschedule: + type: string + disableCredsInit: + type: boolean + disableInlineSpec: + type: string + enableAPIFields: + type: string + enableArtifacts: + type: boolean + enableCELInWhenExpression: + type: boolean + enableConciseResolverSyntax: + type: boolean + enableKeepPodOnCancel: + type: boolean + enableKubernetesSidecar: + type: boolean + enableParamEnum: + type: boolean + enableProvenanceInStatus: + type: boolean + enableStepActions: + description: EnableStepActions is a no-op flag since StepActions + are stable + type: boolean + enableTektonOCIBundles: + description: |- + DeprecatedEnableTektonOCIBundles is maintained for backward compatibility + to allow deletion of PipelineRuns created before v0.62.x. + This field is not used and can be removed in a future release + once we're confident old PipelineRuns have been cleaned up. + See issue #8359 for context. + type: boolean + enableTerminationMessageCompression: + type: boolean + enableWaitExponentialBackoff: + type: boolean + enforceNonfalsifiability: + type: string + maxResultSize: + type: integer + requireGitSSHSecretKnownHosts: + type: boolean + resultExtractionMethod: + type: string + runningInEnvWithInjectedSidecars: + type: boolean + sendCloudEventsForRuns: + type: boolean + setSecurityContext: + type: boolean + setSecurityContextReadOnlyRootFilesystem: + type: boolean + verificationNoMatchPolicy: + description: |- + VerificationNoMatchPolicy is the feature flag for "trusted-resources-verification-no-match-policy" + VerificationNoMatchPolicy can be set to "ignore", "warn" and "fail" values. + ignore: skip trusted resources verification when no matching verification policies found + warn: skip trusted resources verification when no matching verification policies found and log a warning + fail: fail the taskrun or pipelines run if no matching verification policies found + type: string + refSource: + description: RefSource identifies the source where a remote + task/pipeline came from. + type: object + properties: + digest: + description: |- + Digest is a collection of cryptographic digests for the contents of the artifact specified by URI. + Example: {"sha1": "f99d13e554ffcb696dee719fa85b695cb5b0f428"} + type: object + additionalProperties: + type: string + entryPoint: + description: |- + EntryPoint identifies the entry point into the build. This is often a path to a + build definition file and/or a target label within that file. + Example: "task/git-clone/0.10/git-clone.yaml" + type: string + uri: + description: |- + URI indicates the identity of the source of the build definition. + Example: "https://github.com/tektoncd/catalog" + type: string + results: + description: Results are the list of results written out by the + pipeline task's containers + type: array + items: + description: PipelineRunResult used to describe the results of + a pipeline + type: object + required: + - name + - value + properties: + name: + description: Name is the result's name as declared by the + Pipeline + type: string + value: + description: Value is the result returned from the execution + of this PipelineRun + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + skippedTasks: + description: list of tasks that were skipped due to when expressions + evaluating to false + type: array + items: + description: |- + SkippedTask is used to describe the Tasks that were skipped due to their When Expressions + evaluating to False. This is a struct because we are looking into including more details + about the When Expressions that caused this Task to be skipped. + type: object + required: + - name + - reason + properties: + name: + description: Name is the Pipeline Task name + type: string + reason: + description: Reason is the cause of the PipelineTask being + skipped. + type: string + whenExpressions: + description: WhenExpressions is the list of checks guarding + the execution of the PipelineTask + type: array + items: + description: |- + WhenExpression allows a PipelineTask to declare expressions to be evaluated before the Task is run + to determine whether the Task should be executed or skipped + type: object + properties: + cel: + description: |- + CEL is a string of Common Language Expression, which can be used to conditionally execute + the task based on the result of the expression evaluation + More info about CEL syntax: https://github.com/google/cel-spec/blob/master/doc/langdef.md + type: string + input: + description: Input is the string for guard checking + which can be a static input or an output from a parent + Task + type: string + operator: + description: Operator that represents an Input's relationship + to the values + type: string + values: + description: |- + Values is an array of strings, which is compared against the input, for guard checking + It must be non-empty + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + spanContext: + description: SpanContext contains tracing span context fields + type: object + additionalProperties: + type: string + startTime: + description: StartTime is the time the PipelineRun is actually started. + type: string + format: date-time + additionalPrinterColumns: + - name: Succeeded + type: string + jsonPath: ".status.conditions[?(@.type==\"Succeeded\")].status" + - name: Reason + type: string + jsonPath: ".status.conditions[?(@.type==\"Succeeded\")].reason" + - name: StartTime + type: date + jsonPath: .status.startTime + - name: CompletionTime + type: date + jsonPath: .status.completionTime + # Opt into the status subresource so metadata.generation + # starts to increment + subresources: + status: {} + names: + kind: PipelineRun + plural: pipelineruns + singular: pipelinerun + categories: + - tekton + - tekton-pipelines + shortNames: + - pr + - prs + scope: Namespaced + conversion: + strategy: Webhook + webhook: + conversionReviewVersions: ["v1beta1", "v1"] + clientConfig: + service: + name: tekton-pipelines-webhook + namespace: tekton-pipelines +--- +# Copyright 2022 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: resolutionrequests.resolution.tekton.dev + labels: + resolution.tekton.dev/release: devel +spec: + group: resolution.tekton.dev + scope: Namespaced + names: + kind: ResolutionRequest + plural: resolutionrequests + singular: resolutionrequest + categories: + - tekton + - tekton-pipelines + versions: + - name: v1alpha1 + served: true + deprecated: true + storage: false + subresources: + status: {} + schema: + openAPIV3Schema: + description: |- + ResolutionRequest is an object for requesting the content of + a Tekton resource like a pipeline.yaml. + type: object + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: Spec holds the information for the request part of the + resource request. + type: object + properties: + params: + description: |- + Parameters are the runtime attributes passed to + the resolver to help it figure out how to resolve the + resource being requested. For example: repo URL, commit SHA, + path to file, the kind of authentication to leverage, etc. + type: object + additionalProperties: + type: string + status: + description: |- + Status communicates the state of the request and, ultimately, + the content of the resolved resource. + type: object + required: + - data + - refSource + properties: + annotations: + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + additionalProperties: + type: string + conditions: + description: Conditions the latest available observations of a resource's + current state. + type: array + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + type: object + required: + - status + - type + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating details about + the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, False, + Unknown. + type: string + type: + description: Type of condition. + type: string + data: + description: |- + Data is a string representation of the resolved content + of the requested resource in-lined into the ResolutionRequest + object. + type: string + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + type: integer + format: int64 + refSource: + description: |- + RefSource is the source reference of the remote data that records where the remote + file came from including the url, digest and the entrypoint. + x-kubernetes-preserve-unknown-fields: true + additionalPrinterColumns: + - name: Succeeded + type: string + jsonPath: ".status.conditions[?(@.type=='Succeeded')].status" + - name: Reason + type: string + jsonPath: ".status.conditions[?(@.type=='Succeeded')].reason" + - name: v1beta1 + served: true + storage: true + subresources: + status: {} + schema: + openAPIV3Schema: + description: |- + ResolutionRequest is an object for requesting the content of + a Tekton resource like a pipeline.yaml. + type: object + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: Spec holds the information for the request part of the + resource request. + type: object + properties: + params: + description: |- + Parameters are the runtime attributes passed to + the resolver to help it figure out how to resolve the + resource being requested. For example: repo URL, commit SHA, + path to file, the kind of authentication to leverage, etc. + type: array + items: + description: Param declares an ParamValues to use for the parameter + called name. + type: object + required: + - name + - value + properties: + name: + type: string + value: + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + url: + description: |- + URL is the runtime url passed to the resolver + to help it figure out how to resolver the resource being + requested. + This is currently at an ALPHA stability level and subject to + alpha API compatibility policies. + type: string + status: + description: |- + Status communicates the state of the request and, ultimately, + the content of the resolved resource. + type: object + required: + - data + - refSource + - source + properties: + annotations: + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + additionalProperties: + type: string + conditions: + description: Conditions the latest available observations of a resource's + current state. + type: array + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + type: object + required: + - status + - type + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating details about + the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, False, + Unknown. + type: string + type: + description: Type of condition. + type: string + data: + description: |- + Data is a string representation of the resolved content + of the requested resource in-lined into the ResolutionRequest + object. + type: string + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + type: integer + format: int64 + refSource: + description: |- + RefSource is the source reference of the remote data that records the url, digest + and the entrypoint. + x-kubernetes-preserve-unknown-fields: true + source: + description: 'Deprecated: Use RefSource instead' + x-kubernetes-preserve-unknown-fields: true + additionalPrinterColumns: + - name: OwnerKind + type: string + jsonPath: ".metadata.ownerReferences[0].kind" + - name: Owner + type: string + jsonPath: ".metadata.ownerReferences[0].name" + - name: Succeeded + type: string + jsonPath: ".status.conditions[?(@.type=='Succeeded')].status" + - name: Reason + type: string + jsonPath: ".status.conditions[?(@.type=='Succeeded')].reason" + - name: StartTime + type: string + jsonPath: .metadata.creationTimestamp + - name: EndTime + type: string + jsonPath: .status.conditions[?(@.type=='Succeeded')].lastTransitionTime + conversion: + strategy: Webhook + webhook: + conversionReviewVersions: ["v1alpha1", "v1beta1"] + clientConfig: + service: + name: tekton-pipelines-webhook + namespace: tekton-pipelines +--- +# Copyright 2023 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: stepactions.tekton.dev + labels: + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines + pipeline.tekton.dev/release: "v1.15.0" + version: "v1.15.0" +spec: + group: tekton.dev + preserveUnknownFields: false + versions: + - name: v1alpha1 + served: true + storage: false + schema: + openAPIV3Schema: + description: |- + StepAction represents the actionable components of Step. + The Step can only reference it from the cluster or using remote resolution. + type: object + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: Spec holds the desired state of the Step from the client + type: object + properties: + args: + description: |- + Arguments to the entrypoint. + The image's CMD is used if this is not provided. + Variable references $(VAR_NAME) are expanded using the container's environment. If a variable + cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will + produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless + of whether the variable exists or not. Cannot be updated. + More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell + type: array + items: + type: string + x-kubernetes-list-type: atomic + command: + description: |- + Entrypoint array. Not executed within a shell. + The image's ENTRYPOINT is used if this is not provided. + Variable references $(VAR_NAME) are expanded using the container's environment. If a variable + cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will + produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless + of whether the variable exists or not. Cannot be updated. + More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell + type: array + items: + type: string + x-kubernetes-list-type: atomic + description: + description: |- + Description is a user-facing description of the stepaction that may be + used to populate a UI. + type: string + env: + description: |- + List of environment variables to set in the container. + Cannot be updated. + type: array + items: + description: EnvVar represents an environment variable present + in a Container. + type: object + required: + - name + properties: + name: + description: |- + Name of the environment variable. + May consist of any printable ASCII characters except '='. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's value. + Cannot be used if value is not empty. + type: object + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + type: object + required: + - key + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap or its + key must be defined + type: boolean + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + type: object + required: + - fieldPath + properties: + apiVersion: + description: Version of the schema the FieldPath is + written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in the specified + API version. + type: string + x-kubernetes-map-type: atomic + fileKeyRef: + description: |- + FileKeyRef selects a key of the env file. + Requires the EnvFiles feature gate to be enabled. + type: object + required: + - key + - path + - volumeName + properties: + key: + description: |- + The key within the env file. An invalid key will prevent the pod from starting. + The keys defined within a source may consist of any printable ASCII characters except '='. + During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters. + type: string + optional: + description: |- + Specify whether the file or its key must be defined. If the file or key + does not exist, then the env var is not published. + If optional is set to true and the specified key does not exist, + the environment variable will not be set in the Pod's containers. + + If optional is set to false and the specified key does not exist, + an error will be returned during Pod creation. + type: boolean + default: false + path: + description: |- + The path within the volume from which to select the file. + Must be relative and may not contain the '..' path or start with '..'. + type: string + volumeName: + description: The name of the volume mount containing + the env file. + type: string + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + type: object + required: + - resource + properties: + containerName: + description: 'Container name: required for volumes, + optional for env vars' + type: string + divisor: + description: Specifies the output format of the exposed + resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the pod's namespace + type: object + required: + - key + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + image: + description: |- + Image reference name to run for this StepAction. + More info: https://kubernetes.io/docs/concepts/containers/images + type: string + params: + description: |- + Params is a list of input parameters required to run the stepAction. + Params must be supplied as inputs in Steps unless they declare a defaultvalue. + type: array + items: + description: |- + ParamSpec defines arbitrary parameters needed beyond typed inputs (such as + resources). Parameter values are provided by users as inputs on a TaskRun + or PipelineRun. + type: object + required: + - name + properties: + default: + description: |- + Default is the value a parameter takes if no input value is supplied. If + default is set, a Task may be executed without a supplied value for the + parameter. + x-kubernetes-preserve-unknown-fields: true + description: + description: |- + Description is a user-facing description of the parameter that may be + used to populate a UI. + type: string + enum: + description: |- + Enum declares a set of allowed param input values for tasks/pipelines that can be validated. + If Enum is not set, no input validation is performed for the param. + type: array + items: + type: string + name: + description: Name declares the name by which a parameter is + referenced. + type: string + properties: + description: Properties is the JSON Schema properties to support + key-value pairs parameter. + type: object + additionalProperties: + description: PropertySpec defines the struct for object + keys + type: object + properties: + type: + description: |- + ParamType indicates the type of an input parameter; + Used to distinguish between a single string and an array of strings. + type: string + type: + description: |- + Type is the user-specified type of the parameter. The possible types + are currently "string", "array" and "object", and "string" is the default. + type: string + x-kubernetes-list-type: atomic + results: + description: Results are values that this StepAction can output + type: array + items: + description: StepResult used to describe the Results of a Step. + type: object + required: + - name + properties: + description: + description: Description is a human-readable description of + the result + type: string + name: + description: Name the given name + type: string + properties: + description: Properties is the JSON Schema properties to support + key-value pairs results. + type: object + additionalProperties: + description: PropertySpec defines the struct for object + keys + type: object + properties: + type: + description: |- + ParamType indicates the type of an input parameter; + Used to distinguish between a single string and an array of strings. + type: string + type: + description: The possible types are 'string', 'array', and + 'object', with 'string' as the default. + type: string + x-kubernetes-list-type: atomic + script: + description: |- + Script is the contents of an executable file to execute. + + If Script is not empty, the Step cannot have an Command and the Args will be passed to the Script. + type: string + securityContext: + description: |- + SecurityContext defines the security options the Step should be run with. + If set, the fields of SecurityContext override the equivalent fields of PodSecurityContext. + More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ + The value set in StepAction will take precedence over the value from Task. + type: object + properties: + allowPrivilegeEscalation: + description: |- + AllowPrivilegeEscalation controls whether a process can gain more + privileges than its parent process. This bool directly controls if + the no_new_privs flag will be set on the container process. + AllowPrivilegeEscalation is true always when the container is: + 1) run as Privileged + 2) has CAP_SYS_ADMIN + Note that this field cannot be set when spec.os.name is windows. + type: boolean + appArmorProfile: + description: |- + appArmorProfile is the AppArmor options to use by this container. If set, this profile + overrides the pod's appArmorProfile. + Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile loaded on the node that should be used. + The profile must be preconfigured on the node to work. + Must match the loaded name of the profile. + Must be set if and only if type is "Localhost". + type: string + type: + description: |- + type indicates which kind of AppArmor profile will be applied. + Valid options are: + Localhost - a profile pre-loaded on the node. + RuntimeDefault - the container runtime's default profile. + Unconfined - no AppArmor enforcement. + type: string + capabilities: + description: |- + The capabilities to add/drop when running containers. + Defaults to the default set of capabilities granted by the container runtime. + Note that this field cannot be set when spec.os.name is windows. + type: object + properties: + add: + description: Added capabilities + type: array + items: + description: Capability represent POSIX capabilities type + type: string + x-kubernetes-list-type: atomic + drop: + description: Removed capabilities + type: array + items: + description: Capability represent POSIX capabilities type + type: string + x-kubernetes-list-type: atomic + privileged: + description: |- + Run container in privileged mode. + Processes in privileged containers are essentially equivalent to root on the host. + Defaults to false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + procMount: + description: |- + procMount denotes the type of proc mount to use for the containers. + The default value is Default which uses the container runtime defaults for + readonly paths and masked paths. + This requires the ProcMountType feature flag to be enabled. + Note that this field cannot be set when spec.os.name is windows. + type: string + readOnlyRootFilesystem: + description: |- + Whether this container has a read-only root filesystem. + Default is false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + runAsGroup: + description: |- + The GID to run the entrypoint of the container process. + Uses runtime default if unset. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + runAsNonRoot: + description: |- + Indicates that the container must run as a non-root user. + If true, the Kubelet will validate the image at runtime to ensure that it + does not run as UID 0 (root) and fail to start the container if it does. + If unset or false, no such validation will be performed. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: boolean + runAsUser: + description: |- + The UID to run the entrypoint of the container process. + Defaults to user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + seLinuxOptions: + description: |- + The SELinux context to be applied to the container. + If unspecified, the container runtime will allocate a random SELinux context for each + container. May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: object + properties: + level: + description: Level is SELinux level label that applies to + the container. + type: string + role: + description: Role is a SELinux role label that applies to + the container. + type: string + type: + description: Type is a SELinux type label that applies to + the container. + type: string + user: + description: User is a SELinux user label that applies to + the container. + type: string + seccompProfile: + description: |- + The seccomp options to use by this container. If seccomp options are + provided at both the pod & container level, the container options + override the pod options. + Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile defined in a file on the node should be used. + The profile must be preconfigured on the node to work. + Must be a descending path, relative to the kubelet's configured seccomp profile location. + Must be set if type is "Localhost". Must NOT be set for any other type. + type: string + type: + description: |- + type indicates which kind of seccomp profile will be applied. + Valid options are: + + Localhost - a profile defined in a file on the node should be used. + RuntimeDefault - the container runtime default profile should be used. + Unconfined - no profile should be applied. + type: string + windowsOptions: + description: |- + The Windows specific settings applied to all containers. + If unspecified, the options from the PodSecurityContext will be used. + If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is linux. + type: object + properties: + gmsaCredentialSpec: + description: |- + GMSACredentialSpec is where the GMSA admission webhook + (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the + GMSA credential spec named by the GMSACredentialSpecName field. + type: string + gmsaCredentialSpecName: + description: GMSACredentialSpecName is the name of the GMSA + credential spec to use. + type: string + hostProcess: + description: |- + HostProcess determines if a container should be run as a 'Host Process' container. + All of a Pod's containers must have the same effective HostProcess value + (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers). + In addition, if HostProcess is true then HostNetwork must also be set to true. + type: boolean + runAsUserName: + description: |- + The UserName in Windows to run the entrypoint of the container process. + Defaults to the user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: string + volumeMounts: + description: |- + Volumes to mount into the Step's filesystem. + Cannot be updated. + type: array + items: + description: VolumeMount describes a mounting of a Volume within + a container. + type: object + required: + - mountPath + - name + properties: + mountPath: + description: |- + Path within the container at which the volume should be mounted. Must + not contain ':'. + type: string + mountPropagation: + description: |- + mountPropagation determines how mounts are propagated from the host + to container and the other way around. + When not set, MountPropagationNone is used. + This field is beta in 1.10. + When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified + (which defaults to None). + type: string + name: + description: This must match the Name of a Volume. + type: string + readOnly: + description: |- + Mounted read-only if true, read-write otherwise (false or unspecified). + Defaults to false. + type: boolean + recursiveReadOnly: + description: |- + RecursiveReadOnly specifies whether read-only mounts should be handled + recursively. + + If ReadOnly is false, this field has no meaning and must be unspecified. + + If ReadOnly is true, and this field is set to Disabled, the mount is not made + recursively read-only. If this field is set to IfPossible, the mount is made + recursively read-only, if it is supported by the container runtime. If this + field is set to Enabled, the mount is made recursively read-only if it is + supported by the container runtime, otherwise the pod will not be started and + an error will be generated to indicate the reason. + + If this field is set to IfPossible or Enabled, MountPropagation must be set to + None (or be unspecified, which defaults to None). + + If this field is not specified, it is treated as an equivalent of Disabled. + type: string + subPath: + description: |- + Path within the volume from which the container's volume should be mounted. + Defaults to "" (volume's root). + type: string + subPathExpr: + description: |- + Expanded path within the volume from which the container's volume should be mounted. + Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment. + Defaults to "" (volume's root). + SubPathExpr and SubPath are mutually exclusive. + type: string + x-kubernetes-list-type: atomic + workingDir: + description: |- + Step's working directory. + If not specified, the container runtime's default will be used, which + might be configured in the container image. + Cannot be updated. + type: string + # Opt into the status subresource so metadata.generation + # starts to increment + subresources: + status: {} + - name: v1beta1 + served: true + storage: true + schema: + openAPIV3Schema: + description: StepAction + type: object + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: Spec + type: object + properties: + args: + description: Args + type: array + items: + type: string + x-kubernetes-list-type: atomic + command: + description: Command + type: array + items: + type: string + x-kubernetes-list-type: atomic + description: + description: Description + type: string + env: + description: Env + type: array + items: + description: EnvVar represents an environment variable present + in a Container. + type: object + required: + - name + properties: + name: + description: |- + Name of the environment variable. + May consist of any printable ASCII characters except '='. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's value. + Cannot be used if value is not empty. + type: object + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + type: object + required: + - key + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap or its + key must be defined + type: boolean + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + type: object + required: + - fieldPath + properties: + apiVersion: + description: Version of the schema the FieldPath is + written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in the specified + API version. + type: string + x-kubernetes-map-type: atomic + fileKeyRef: + description: |- + FileKeyRef selects a key of the env file. + Requires the EnvFiles feature gate to be enabled. + type: object + required: + - key + - path + - volumeName + properties: + key: + description: |- + The key within the env file. An invalid key will prevent the pod from starting. + The keys defined within a source may consist of any printable ASCII characters except '='. + During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters. + type: string + optional: + description: |- + Specify whether the file or its key must be defined. If the file or key + does not exist, then the env var is not published. + If optional is set to true and the specified key does not exist, + the environment variable will not be set in the Pod's containers. + + If optional is set to false and the specified key does not exist, + an error will be returned during Pod creation. + type: boolean + default: false + path: + description: |- + The path within the volume from which to select the file. + Must be relative and may not contain the '..' path or start with '..'. + type: string + volumeName: + description: The name of the volume mount containing + the env file. + type: string + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + type: object + required: + - resource + properties: + containerName: + description: 'Container name: required for volumes, + optional for env vars' + type: string + divisor: + description: Specifies the output format of the exposed + resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the pod's namespace + type: object + required: + - key + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + image: + description: Image + type: string + params: + description: Params + type: array + items: + description: |- + ParamSpec defines arbitrary parameters needed beyond typed inputs (such as + resources). Parameter values are provided by users as inputs on a TaskRun + or PipelineRun. + type: object + required: + - name + properties: + default: + description: |- + Default is the value a parameter takes if no input value is supplied. If + default is set, a Task may be executed without a supplied value for the + parameter. + x-kubernetes-preserve-unknown-fields: true + description: + description: |- + Description is a user-facing description of the parameter that may be + used to populate a UI. + type: string + enum: + description: |- + Enum declares a set of allowed param input values for tasks/pipelines that can be validated. + If Enum is not set, no input validation is performed for the param. + type: array + items: + type: string + name: + description: Name declares the name by which a parameter is + referenced. + type: string + properties: + description: Properties is the JSON Schema properties to support + key-value pairs parameter. + type: object + additionalProperties: + description: PropertySpec defines the struct for object + keys + type: object + properties: + type: + description: |- + ParamType indicates the type of an input parameter; + Used to distinguish between a single string and an array of strings. + type: string + type: + description: |- + Type is the user-specified type of the parameter. The possible types + are currently "string", "array" and "object", and "string" is the default. + type: string + x-kubernetes-list-type: atomic + results: + description: Results + type: array + items: + description: StepResult used to describe the Results of a Step. + type: object + required: + - name + properties: + description: + description: Description is a human-readable description of + the result + type: string + name: + description: Name the given name + type: string + properties: + description: Properties is the JSON Schema properties to support + key-value pairs results. + type: object + additionalProperties: + description: PropertySpec defines the struct for object + keys + type: object + properties: + type: + description: |- + ParamType indicates the type of an input parameter; + Used to distinguish between a single string and an array of strings. + type: string + type: + description: The possible types are 'string', 'array', and + 'object', with 'string' as the default. + type: string + x-kubernetes-list-type: atomic + script: + description: Script + type: string + securityContext: + description: SecurityContext + type: object + properties: + allowPrivilegeEscalation: + description: |- + AllowPrivilegeEscalation controls whether a process can gain more + privileges than its parent process. This bool directly controls if + the no_new_privs flag will be set on the container process. + AllowPrivilegeEscalation is true always when the container is: + 1) run as Privileged + 2) has CAP_SYS_ADMIN + Note that this field cannot be set when spec.os.name is windows. + type: boolean + appArmorProfile: + description: |- + appArmorProfile is the AppArmor options to use by this container. If set, this profile + overrides the pod's appArmorProfile. + Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile loaded on the node that should be used. + The profile must be preconfigured on the node to work. + Must match the loaded name of the profile. + Must be set if and only if type is "Localhost". + type: string + type: + description: |- + type indicates which kind of AppArmor profile will be applied. + Valid options are: + Localhost - a profile pre-loaded on the node. + RuntimeDefault - the container runtime's default profile. + Unconfined - no AppArmor enforcement. + type: string + capabilities: + description: |- + The capabilities to add/drop when running containers. + Defaults to the default set of capabilities granted by the container runtime. + Note that this field cannot be set when spec.os.name is windows. + type: object + properties: + add: + description: Added capabilities + type: array + items: + description: Capability represent POSIX capabilities type + type: string + x-kubernetes-list-type: atomic + drop: + description: Removed capabilities + type: array + items: + description: Capability represent POSIX capabilities type + type: string + x-kubernetes-list-type: atomic + privileged: + description: |- + Run container in privileged mode. + Processes in privileged containers are essentially equivalent to root on the host. + Defaults to false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + procMount: + description: |- + procMount denotes the type of proc mount to use for the containers. + The default value is Default which uses the container runtime defaults for + readonly paths and masked paths. + This requires the ProcMountType feature flag to be enabled. + Note that this field cannot be set when spec.os.name is windows. + type: string + readOnlyRootFilesystem: + description: |- + Whether this container has a read-only root filesystem. + Default is false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + runAsGroup: + description: |- + The GID to run the entrypoint of the container process. + Uses runtime default if unset. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + runAsNonRoot: + description: |- + Indicates that the container must run as a non-root user. + If true, the Kubelet will validate the image at runtime to ensure that it + does not run as UID 0 (root) and fail to start the container if it does. + If unset or false, no such validation will be performed. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: boolean + runAsUser: + description: |- + The UID to run the entrypoint of the container process. + Defaults to user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + seLinuxOptions: + description: |- + The SELinux context to be applied to the container. + If unspecified, the container runtime will allocate a random SELinux context for each + container. May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: object + properties: + level: + description: Level is SELinux level label that applies to + the container. + type: string + role: + description: Role is a SELinux role label that applies to + the container. + type: string + type: + description: Type is a SELinux type label that applies to + the container. + type: string + user: + description: User is a SELinux user label that applies to + the container. + type: string + seccompProfile: + description: |- + The seccomp options to use by this container. If seccomp options are + provided at both the pod & container level, the container options + override the pod options. + Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile defined in a file on the node should be used. + The profile must be preconfigured on the node to work. + Must be a descending path, relative to the kubelet's configured seccomp profile location. + Must be set if type is "Localhost". Must NOT be set for any other type. + type: string + type: + description: |- + type indicates which kind of seccomp profile will be applied. + Valid options are: + + Localhost - a profile defined in a file on the node should be used. + RuntimeDefault - the container runtime default profile should be used. + Unconfined - no profile should be applied. + type: string + windowsOptions: + description: |- + The Windows specific settings applied to all containers. + If unspecified, the options from the PodSecurityContext will be used. + If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is linux. + type: object + properties: + gmsaCredentialSpec: + description: |- + GMSACredentialSpec is where the GMSA admission webhook + (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the + GMSA credential spec named by the GMSACredentialSpecName field. + type: string + gmsaCredentialSpecName: + description: GMSACredentialSpecName is the name of the GMSA + credential spec to use. + type: string + hostProcess: + description: |- + HostProcess determines if a container should be run as a 'Host Process' container. + All of a Pod's containers must have the same effective HostProcess value + (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers). + In addition, if HostProcess is true then HostNetwork must also be set to true. + type: boolean + runAsUserName: + description: |- + The UserName in Windows to run the entrypoint of the container process. + Defaults to the user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: string + volumeMounts: + description: VolumeMounts + type: array + items: + description: VolumeMount describes a mounting of a Volume within + a container. + type: object + required: + - mountPath + - name + properties: + mountPath: + description: |- + Path within the container at which the volume should be mounted. Must + not contain ':'. + type: string + mountPropagation: + description: |- + mountPropagation determines how mounts are propagated from the host + to container and the other way around. + When not set, MountPropagationNone is used. + This field is beta in 1.10. + When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified + (which defaults to None). + type: string + name: + description: This must match the Name of a Volume. + type: string + readOnly: + description: |- + Mounted read-only if true, read-write otherwise (false or unspecified). + Defaults to false. + type: boolean + recursiveReadOnly: + description: |- + RecursiveReadOnly specifies whether read-only mounts should be handled + recursively. + + If ReadOnly is false, this field has no meaning and must be unspecified. + + If ReadOnly is true, and this field is set to Disabled, the mount is not made + recursively read-only. If this field is set to IfPossible, the mount is made + recursively read-only, if it is supported by the container runtime. If this + field is set to Enabled, the mount is made recursively read-only if it is + supported by the container runtime, otherwise the pod will not be started and + an error will be generated to indicate the reason. + + If this field is set to IfPossible or Enabled, MountPropagation must be set to + None (or be unspecified, which defaults to None). + + If this field is not specified, it is treated as an equivalent of Disabled. + type: string + subPath: + description: |- + Path within the volume from which the container's volume should be mounted. + Defaults to "" (volume's root). + type: string + subPathExpr: + description: |- + Expanded path within the volume from which the container's volume should be mounted. + Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment. + Defaults to "" (volume's root). + SubPathExpr and SubPath are mutually exclusive. + type: string + x-kubernetes-list-type: atomic + workingDir: + description: WorkingDir + type: string + # Opt into the status subresource so metadata.generation + # starts to increment + subresources: + status: {} + names: + kind: StepAction + plural: stepactions + singular: stepaction + categories: + - tekton + - tekton-pipelines + scope: Namespaced + conversion: + strategy: Webhook + webhook: + conversionReviewVersions: ["v1alpha1", "v1beta1"] + clientConfig: + service: + name: tekton-pipelines-webhook + namespace: tekton-pipelines +--- +# Copyright 2019 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: tasks.tekton.dev + labels: + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines + pipeline.tekton.dev/release: "v1.15.0" + version: "v1.15.0" +spec: + group: tekton.dev + preserveUnknownFields: false + versions: + - name: v1beta1 + served: true + storage: false + schema: + openAPIV3Schema: + description: |- + Task + Deprecated: Please use v1.Task instead. + type: object + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: Spec + type: object + properties: + description: + description: Description + type: string + displayName: + description: DisplayName + type: string + params: + description: Params + type: array + items: + description: ParamSpec + type: object + required: + - name + properties: + default: + description: Default + x-kubernetes-preserve-unknown-fields: true + description: + description: Description + type: string + enum: + description: Enum + type: array + items: + type: string + name: + description: Name + type: string + properties: + description: Properties + type: object + additionalProperties: + description: PropertySpec + type: object + properties: + type: + description: ParamType + type: string + type: + description: Type + type: string + x-kubernetes-list-type: atomic + resources: + description: |- + Resources + Deprecated: Unused, preserved only for backwards compatibility + type: object + properties: + inputs: + description: Inputs + type: array + items: + description: |- + TaskResource + Deprecated: Unused, preserved only for backwards compatibility + type: object + required: + - name + - type + properties: + description: + description: |- + Description is a user-facing description of the declared resource that may be + used to populate a UI. + type: string + name: + description: |- + Name declares the name by which a resource is referenced in the + definition. Resources may be referenced by name in the definition of a + Task's steps. + type: string + optional: + description: |- + Optional declares the resource as optional. + By default optional is set to false which makes a resource required. + optional: true - the resource is considered optional + optional: false - the resource is considered required (equivalent of not specifying it) + type: boolean + targetPath: + description: |- + TargetPath is the path in workspace directory where the resource + will be copied. + type: string + type: + description: Type is the type of this resource; + type: string + x-kubernetes-list-type: atomic + outputs: + description: Outputs + type: array + items: + description: |- + TaskResource + Deprecated: Unused, preserved only for backwards compatibility + type: object + required: + - name + - type + properties: + description: + description: |- + Description is a user-facing description of the declared resource that may be + used to populate a UI. + type: string + name: + description: |- + Name declares the name by which a resource is referenced in the + definition. Resources may be referenced by name in the definition of a + Task's steps. + type: string + optional: + description: |- + Optional declares the resource as optional. + By default optional is set to false which makes a resource required. + optional: true - the resource is considered optional + optional: false - the resource is considered required (equivalent of not specifying it) + type: boolean + targetPath: + description: |- + TargetPath is the path in workspace directory where the resource + will be copied. + type: string + type: + description: Type is the type of this resource; + type: string + x-kubernetes-list-type: atomic + results: + description: Results + type: array + items: + description: TaskResult + type: object + required: + - name + properties: + description: + description: Description + type: string + name: + description: Name + type: string + properties: + description: Properties + type: object + additionalProperties: + description: PropertySpec + type: object + properties: + type: + description: ParamType + type: string + type: + description: Type + type: string + value: + description: Value + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + sidecars: + description: Sidecars + type: array + items: + description: Sidecar + type: object + required: + - name + properties: + args: + description: Args + type: array + items: + type: string + x-kubernetes-list-type: atomic + command: + description: Command + type: array + items: + type: string + x-kubernetes-list-type: atomic + env: + description: Env + type: array + items: + description: EnvVar represents an environment variable present + in a Container. + type: object + required: + - name + properties: + name: + description: |- + Name of the environment variable. + May consist of any printable ASCII characters except '='. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's value. + Cannot be used if value is not empty. + type: object + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + type: object + required: + - key + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap or + its key must be defined + type: boolean + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + type: object + required: + - fieldPath + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in + the specified API version. + type: string + x-kubernetes-map-type: atomic + fileKeyRef: + description: |- + FileKeyRef selects a key of the env file. + Requires the EnvFiles feature gate to be enabled. + type: object + required: + - key + - path + - volumeName + properties: + key: + description: |- + The key within the env file. An invalid key will prevent the pod from starting. + The keys defined within a source may consist of any printable ASCII characters except '='. + During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters. + type: string + optional: + description: |- + Specify whether the file or its key must be defined. If the file or key + does not exist, then the env var is not published. + If optional is set to true and the specified key does not exist, + the environment variable will not be set in the Pod's containers. + + If optional is set to false and the specified key does not exist, + an error will be returned during Pod creation. + type: boolean + default: false + path: + description: |- + The path within the volume from which to select the file. + Must be relative and may not contain the '..' path or start with '..'. + type: string + volumeName: + description: The name of the volume mount containing + the env file. + type: string + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + type: object + required: + - resource + properties: + containerName: + description: 'Container name: required for volumes, + optional for env vars' + type: string + divisor: + description: Specifies the output format of + the exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the pod's + namespace + type: object + required: + - key + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret or its + key must be defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + envFrom: + description: EnvFrom + type: array + items: + description: EnvFromSource represents the source of a set + of ConfigMaps or Secrets + type: object + properties: + configMapRef: + description: The ConfigMap to select from + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap must + be defined + type: boolean + x-kubernetes-map-type: atomic + prefix: + description: |- + Optional text to prepend to the name of each environment variable. + May consist of any printable ASCII characters except '='. + type: string + secretRef: + description: The Secret to select from + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret must be + defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + image: + description: Image + type: string + imagePullPolicy: + description: ImagePullPolicy + type: string + lifecycle: + description: Lifecycle + type: object + properties: + postStart: + description: |- + PostStart is called immediately after a container is created. If the handler fails, + the container is terminated and restarted according to its restart policy. + Other management of the container blocks until the hook completes. + More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks + type: object + properties: + exec: + description: Exec specifies a command to execute in + the container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + httpGet: + description: HTTPGet specifies an HTTP GET request + to perform. + type: object + required: + - port + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + sleep: + description: Sleep represents a duration that the + container should sleep. + type: object + required: + - seconds + properties: + seconds: + description: Seconds is the number of seconds + to sleep. + type: integer + format: int64 + tcpSocket: + description: |- + Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept + for backward compatibility. There is no validation of this field and + lifecycle hooks will fail at runtime when it is specified. + type: object + required: + - port + properties: + host: + description: 'Optional: Host name to connect to, + defaults to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + preStop: + description: |- + PreStop is called immediately before a container is terminated due to an + API request or management event such as liveness/startup probe failure, + preemption, resource contention, etc. The handler is not called if the + container crashes or exits. The Pod's termination grace period countdown begins before the + PreStop hook is executed. Regardless of the outcome of the handler, the + container will eventually terminate within the Pod's termination grace + period (unless delayed by finalizers). Other management of the container blocks until the hook completes + or until the termination grace period is reached. + More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks + type: object + properties: + exec: + description: Exec specifies a command to execute in + the container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + httpGet: + description: HTTPGet specifies an HTTP GET request + to perform. + type: object + required: + - port + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + sleep: + description: Sleep represents a duration that the + container should sleep. + type: object + required: + - seconds + properties: + seconds: + description: Seconds is the number of seconds + to sleep. + type: integer + format: int64 + tcpSocket: + description: |- + Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept + for backward compatibility. There is no validation of this field and + lifecycle hooks will fail at runtime when it is specified. + type: object + required: + - port + properties: + host: + description: 'Optional: Host name to connect to, + defaults to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + stopSignal: + description: |- + StopSignal defines which signal will be sent to a container when it is being stopped. + If not specified, the default is defined by the container runtime in use. + StopSignal can only be set for Pods with a non-empty .spec.os.name + type: string + livenessProbe: + description: LivenessProbe + type: object + properties: + exec: + description: Exec specifies a command to execute in the + container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + failureThreshold: + description: |- + Minimum consecutive failures for the probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. + type: integer + format: int32 + grpc: + description: GRPC specifies a GRPC HealthCheckRequest. + type: object + required: + - port + properties: + port: + description: Port number of the gRPC service. Number + must be in the range 1 to 65535. + type: integer + format: int32 + service: + description: |- + Service is the name of the service to place in the gRPC HealthCheckRequest + (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + + If this is not specified, the default behavior is defined by gRPC. + type: string + default: "" + httpGet: + description: HTTPGet specifies an HTTP GET request to + perform. + type: object + required: + - port + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + initialDelaySeconds: + description: |- + Number of seconds after the container has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + periodSeconds: + description: |- + How often (in seconds) to perform the probe. + Default to 10 seconds. Minimum value is 1. + type: integer + format: int32 + successThreshold: + description: |- + Minimum consecutive successes for the probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. + type: integer + format: int32 + tcpSocket: + description: TCPSocket specifies a connection to a TCP + port. + type: object + required: + - port + properties: + host: + description: 'Optional: Host name to connect to, defaults + to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + terminationGracePeriodSeconds: + description: |- + Optional duration in seconds the pod needs to terminate gracefully upon probe failure. + The grace period is the duration in seconds after the processes running in the pod are sent + a termination signal and the time when the processes are forcibly halted with a kill signal. + Set this value longer than the expected cleanup time for your process. + If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this + value overrides the value provided by the pod spec. + Value must be non-negative integer. The value zero indicates stop immediately via + the kill signal (no opportunity to shut down). + This is a beta field and requires enabling ProbeTerminationGracePeriod feature gate. + Minimum value is 1. spec.terminationGracePeriodSeconds is used if unset. + type: integer + format: int64 + timeoutSeconds: + description: |- + Number of seconds after which the probe times out. + Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + name: + description: Name + type: string + ports: + description: Ports + type: array + items: + description: ContainerPort represents a network port in + a single container. + type: object + required: + - containerPort + properties: + containerPort: + description: |- + Number of port to expose on the pod's IP address. + This must be a valid port number, 0 < x < 65536. + type: integer + format: int32 + hostIP: + description: What host IP to bind the external port + to. + type: string + hostPort: + description: |- + Number of port to expose on the host. + If specified, this must be a valid port number, 0 < x < 65536. + If HostNetwork is specified, this must match ContainerPort. + Most containers do not need this. + type: integer + format: int32 + name: + description: |- + If specified, this must be an IANA_SVC_NAME and unique within the pod. Each + named port in a pod must have a unique name. Name for the port that can be + referred to by services. + type: string + protocol: + description: |- + Protocol for port. Must be UDP, TCP, or SCTP. + Defaults to "TCP". + type: string + default: TCP + x-kubernetes-list-map-keys: + - containerPort + - protocol + x-kubernetes-list-type: map + readinessProbe: + description: ReadinessProbe + type: object + properties: + exec: + description: Exec specifies a command to execute in the + container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + failureThreshold: + description: |- + Minimum consecutive failures for the probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. + type: integer + format: int32 + grpc: + description: GRPC specifies a GRPC HealthCheckRequest. + type: object + required: + - port + properties: + port: + description: Port number of the gRPC service. Number + must be in the range 1 to 65535. + type: integer + format: int32 + service: + description: |- + Service is the name of the service to place in the gRPC HealthCheckRequest + (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + + If this is not specified, the default behavior is defined by gRPC. + type: string + default: "" + httpGet: + description: HTTPGet specifies an HTTP GET request to + perform. + type: object + required: + - port + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + initialDelaySeconds: + description: |- + Number of seconds after the container has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + periodSeconds: + description: |- + How often (in seconds) to perform the probe. + Default to 10 seconds. Minimum value is 1. + type: integer + format: int32 + successThreshold: + description: |- + Minimum consecutive successes for the probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. + type: integer + format: int32 + tcpSocket: + description: TCPSocket specifies a connection to a TCP + port. + type: object + required: + - port + properties: + host: + description: 'Optional: Host name to connect to, defaults + to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + terminationGracePeriodSeconds: + description: |- + Optional duration in seconds the pod needs to terminate gracefully upon probe failure. + The grace period is the duration in seconds after the processes running in the pod are sent + a termination signal and the time when the processes are forcibly halted with a kill signal. + Set this value longer than the expected cleanup time for your process. + If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this + value overrides the value provided by the pod spec. + Value must be non-negative integer. The value zero indicates stop immediately via + the kill signal (no opportunity to shut down). + This is a beta field and requires enabling ProbeTerminationGracePeriod feature gate. + Minimum value is 1. spec.terminationGracePeriodSeconds is used if unset. + type: integer + format: int64 + timeoutSeconds: + description: |- + Number of seconds after which the probe times out. + Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + resources: + description: Resources + type: object + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This field depends on the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + type: array + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + type: object + required: + - name + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + requests: + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + restartPolicy: + description: RestartPolicy + type: string + script: + description: Script + type: string + securityContext: + description: SecurityContext + type: object + properties: + allowPrivilegeEscalation: + description: |- + AllowPrivilegeEscalation controls whether a process can gain more + privileges than its parent process. This bool directly controls if + the no_new_privs flag will be set on the container process. + AllowPrivilegeEscalation is true always when the container is: + 1) run as Privileged + 2) has CAP_SYS_ADMIN + Note that this field cannot be set when spec.os.name is windows. + type: boolean + appArmorProfile: + description: |- + appArmorProfile is the AppArmor options to use by this container. If set, this profile + overrides the pod's appArmorProfile. + Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile loaded on the node that should be used. + The profile must be preconfigured on the node to work. + Must match the loaded name of the profile. + Must be set if and only if type is "Localhost". + type: string + type: + description: |- + type indicates which kind of AppArmor profile will be applied. + Valid options are: + Localhost - a profile pre-loaded on the node. + RuntimeDefault - the container runtime's default profile. + Unconfined - no AppArmor enforcement. + type: string + capabilities: + description: |- + The capabilities to add/drop when running containers. + Defaults to the default set of capabilities granted by the container runtime. + Note that this field cannot be set when spec.os.name is windows. + type: object + properties: + add: + description: Added capabilities + type: array + items: + description: Capability represent POSIX capabilities + type + type: string + x-kubernetes-list-type: atomic + drop: + description: Removed capabilities + type: array + items: + description: Capability represent POSIX capabilities + type + type: string + x-kubernetes-list-type: atomic + privileged: + description: |- + Run container in privileged mode. + Processes in privileged containers are essentially equivalent to root on the host. + Defaults to false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + procMount: + description: |- + procMount denotes the type of proc mount to use for the containers. + The default value is Default which uses the container runtime defaults for + readonly paths and masked paths. + This requires the ProcMountType feature flag to be enabled. + Note that this field cannot be set when spec.os.name is windows. + type: string + readOnlyRootFilesystem: + description: |- + Whether this container has a read-only root filesystem. + Default is false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + runAsGroup: + description: |- + The GID to run the entrypoint of the container process. + Uses runtime default if unset. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + runAsNonRoot: + description: |- + Indicates that the container must run as a non-root user. + If true, the Kubelet will validate the image at runtime to ensure that it + does not run as UID 0 (root) and fail to start the container if it does. + If unset or false, no such validation will be performed. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: boolean + runAsUser: + description: |- + The UID to run the entrypoint of the container process. + Defaults to user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + seLinuxOptions: + description: |- + The SELinux context to be applied to the container. + If unspecified, the container runtime will allocate a random SELinux context for each + container. May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: object + properties: + level: + description: Level is SELinux level label that applies + to the container. + type: string + role: + description: Role is a SELinux role label that applies + to the container. + type: string + type: + description: Type is a SELinux type label that applies + to the container. + type: string + user: + description: User is a SELinux user label that applies + to the container. + type: string + seccompProfile: + description: |- + The seccomp options to use by this container. If seccomp options are + provided at both the pod & container level, the container options + override the pod options. + Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile defined in a file on the node should be used. + The profile must be preconfigured on the node to work. + Must be a descending path, relative to the kubelet's configured seccomp profile location. + Must be set if type is "Localhost". Must NOT be set for any other type. + type: string + type: + description: |- + type indicates which kind of seccomp profile will be applied. + Valid options are: + + Localhost - a profile defined in a file on the node should be used. + RuntimeDefault - the container runtime default profile should be used. + Unconfined - no profile should be applied. + type: string + windowsOptions: + description: |- + The Windows specific settings applied to all containers. + If unspecified, the options from the PodSecurityContext will be used. + If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is linux. + type: object + properties: + gmsaCredentialSpec: + description: |- + GMSACredentialSpec is where the GMSA admission webhook + (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the + GMSA credential spec named by the GMSACredentialSpecName field. + type: string + gmsaCredentialSpecName: + description: GMSACredentialSpecName is the name of + the GMSA credential spec to use. + type: string + hostProcess: + description: |- + HostProcess determines if a container should be run as a 'Host Process' container. + All of a Pod's containers must have the same effective HostProcess value + (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers). + In addition, if HostProcess is true then HostNetwork must also be set to true. + type: boolean + runAsUserName: + description: |- + The UserName in Windows to run the entrypoint of the container process. + Defaults to the user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: string + startupProbe: + description: StartupProbe + type: object + properties: + exec: + description: Exec specifies a command to execute in the + container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + failureThreshold: + description: |- + Minimum consecutive failures for the probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. + type: integer + format: int32 + grpc: + description: GRPC specifies a GRPC HealthCheckRequest. + type: object + required: + - port + properties: + port: + description: Port number of the gRPC service. Number + must be in the range 1 to 65535. + type: integer + format: int32 + service: + description: |- + Service is the name of the service to place in the gRPC HealthCheckRequest + (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + + If this is not specified, the default behavior is defined by gRPC. + type: string + default: "" + httpGet: + description: HTTPGet specifies an HTTP GET request to + perform. + type: object + required: + - port + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + initialDelaySeconds: + description: |- + Number of seconds after the container has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + periodSeconds: + description: |- + How often (in seconds) to perform the probe. + Default to 10 seconds. Minimum value is 1. + type: integer + format: int32 + successThreshold: + description: |- + Minimum consecutive successes for the probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. + type: integer + format: int32 + tcpSocket: + description: TCPSocket specifies a connection to a TCP + port. + type: object + required: + - port + properties: + host: + description: 'Optional: Host name to connect to, defaults + to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + terminationGracePeriodSeconds: + description: |- + Optional duration in seconds the pod needs to terminate gracefully upon probe failure. + The grace period is the duration in seconds after the processes running in the pod are sent + a termination signal and the time when the processes are forcibly halted with a kill signal. + Set this value longer than the expected cleanup time for your process. + If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this + value overrides the value provided by the pod spec. + Value must be non-negative integer. The value zero indicates stop immediately via + the kill signal (no opportunity to shut down). + This is a beta field and requires enabling ProbeTerminationGracePeriod feature gate. + Minimum value is 1. spec.terminationGracePeriodSeconds is used if unset. + type: integer + format: int64 + timeoutSeconds: + description: |- + Number of seconds after which the probe times out. + Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + stdin: + description: Stdin + type: boolean + stdinOnce: + description: StdinOnce + type: boolean + terminationMessagePath: + description: TerminationMessagePath + type: string + terminationMessagePolicy: + description: TerminationMessagePolicy + type: string + tty: + description: TTY + type: boolean + volumeDevices: + description: VolumeDevices + type: array + items: + description: volumeDevice describes a mapping of a raw block + device within a container. + type: object + required: + - devicePath + - name + properties: + devicePath: + description: devicePath is the path inside of the container + that the device will be mapped to. + type: string + name: + description: name must match the name of a persistentVolumeClaim + in the pod + type: string + x-kubernetes-list-type: atomic + volumeMounts: + description: VolumeMounts + type: array + items: + description: VolumeMount describes a mounting of a Volume + within a container. + type: object + required: + - mountPath + - name + properties: + mountPath: + description: |- + Path within the container at which the volume should be mounted. Must + not contain ':'. + type: string + mountPropagation: + description: |- + mountPropagation determines how mounts are propagated from the host + to container and the other way around. + When not set, MountPropagationNone is used. + This field is beta in 1.10. + When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified + (which defaults to None). + type: string + name: + description: This must match the Name of a Volume. + type: string + readOnly: + description: |- + Mounted read-only if true, read-write otherwise (false or unspecified). + Defaults to false. + type: boolean + recursiveReadOnly: + description: |- + RecursiveReadOnly specifies whether read-only mounts should be handled + recursively. + + If ReadOnly is false, this field has no meaning and must be unspecified. + + If ReadOnly is true, and this field is set to Disabled, the mount is not made + recursively read-only. If this field is set to IfPossible, the mount is made + recursively read-only, if it is supported by the container runtime. If this + field is set to Enabled, the mount is made recursively read-only if it is + supported by the container runtime, otherwise the pod will not be started and + an error will be generated to indicate the reason. + + If this field is set to IfPossible or Enabled, MountPropagation must be set to + None (or be unspecified, which defaults to None). + + If this field is not specified, it is treated as an equivalent of Disabled. + type: string + subPath: + description: |- + Path within the volume from which the container's volume should be mounted. + Defaults to "" (volume's root). + type: string + subPathExpr: + description: |- + Expanded path within the volume from which the container's volume should be mounted. + Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment. + Defaults to "" (volume's root). + SubPathExpr and SubPath are mutually exclusive. + type: string + x-kubernetes-list-type: atomic + workingDir: + description: WorkingDir + type: string + workspaces: + description: Workspaces + type: array + items: + description: WorkspaceUsage + type: object + required: + - mountPath + - name + properties: + mountPath: + description: MountPath + type: string + name: + description: Name + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + stepTemplate: + description: StepTemplate + type: object + properties: + args: + description: Args + type: array + items: + type: string + x-kubernetes-list-type: atomic + command: + description: Command + type: array + items: + type: string + x-kubernetes-list-type: atomic + env: + description: Env + type: array + items: + description: EnvVar represents an environment variable present + in a Container. + type: object + required: + - name + properties: + name: + description: |- + Name of the environment variable. + May consist of any printable ASCII characters except '='. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's value. + Cannot be used if value is not empty. + type: object + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + type: object + required: + - key + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap or + its key must be defined + type: boolean + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + type: object + required: + - fieldPath + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in the + specified API version. + type: string + x-kubernetes-map-type: atomic + fileKeyRef: + description: |- + FileKeyRef selects a key of the env file. + Requires the EnvFiles feature gate to be enabled. + type: object + required: + - key + - path + - volumeName + properties: + key: + description: |- + The key within the env file. An invalid key will prevent the pod from starting. + The keys defined within a source may consist of any printable ASCII characters except '='. + During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters. + type: string + optional: + description: |- + Specify whether the file or its key must be defined. If the file or key + does not exist, then the env var is not published. + If optional is set to true and the specified key does not exist, + the environment variable will not be set in the Pod's containers. + + If optional is set to false and the specified key does not exist, + an error will be returned during Pod creation. + type: boolean + default: false + path: + description: |- + The path within the volume from which to select the file. + Must be relative and may not contain the '..' path or start with '..'. + type: string + volumeName: + description: The name of the volume mount containing + the env file. + type: string + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + type: object + required: + - resource + properties: + containerName: + description: 'Container name: required for volumes, + optional for env vars' + type: string + divisor: + description: Specifies the output format of the + exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the pod's + namespace + type: object + required: + - key + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret or its + key must be defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + envFrom: + description: EnvFrom + type: array + items: + description: EnvFromSource represents the source of a set + of ConfigMaps or Secrets + type: object + properties: + configMapRef: + description: The ConfigMap to select from + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap must be + defined + type: boolean + x-kubernetes-map-type: atomic + prefix: + description: |- + Optional text to prepend to the name of each environment variable. + May consist of any printable ASCII characters except '='. + type: string + secretRef: + description: The Secret to select from + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret must be defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + image: + description: Image + type: string + imagePullPolicy: + description: ImagePullPolicy + type: string + lifecycle: + description: |- + Deprecated: This field will be removed in a future release. + DeprecatedLifecycle + type: object + properties: + postStart: + description: |- + PostStart is called immediately after a container is created. If the handler fails, + the container is terminated and restarted according to its restart policy. + Other management of the container blocks until the hook completes. + More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks + type: object + properties: + exec: + description: Exec specifies a command to execute in + the container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + httpGet: + description: HTTPGet specifies an HTTP GET request to + perform. + type: object + required: + - port + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + sleep: + description: Sleep represents a duration that the container + should sleep. + type: object + required: + - seconds + properties: + seconds: + description: Seconds is the number of seconds to + sleep. + type: integer + format: int64 + tcpSocket: + description: |- + Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept + for backward compatibility. There is no validation of this field and + lifecycle hooks will fail at runtime when it is specified. + type: object + required: + - port + properties: + host: + description: 'Optional: Host name to connect to, + defaults to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + preStop: + description: |- + PreStop is called immediately before a container is terminated due to an + API request or management event such as liveness/startup probe failure, + preemption, resource contention, etc. The handler is not called if the + container crashes or exits. The Pod's termination grace period countdown begins before the + PreStop hook is executed. Regardless of the outcome of the handler, the + container will eventually terminate within the Pod's termination grace + period (unless delayed by finalizers). Other management of the container blocks until the hook completes + or until the termination grace period is reached. + More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks + type: object + properties: + exec: + description: Exec specifies a command to execute in + the container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + httpGet: + description: HTTPGet specifies an HTTP GET request to + perform. + type: object + required: + - port + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + sleep: + description: Sleep represents a duration that the container + should sleep. + type: object + required: + - seconds + properties: + seconds: + description: Seconds is the number of seconds to + sleep. + type: integer + format: int64 + tcpSocket: + description: |- + Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept + for backward compatibility. There is no validation of this field and + lifecycle hooks will fail at runtime when it is specified. + type: object + required: + - port + properties: + host: + description: 'Optional: Host name to connect to, + defaults to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + stopSignal: + description: |- + StopSignal defines which signal will be sent to a container when it is being stopped. + If not specified, the default is defined by the container runtime in use. + StopSignal can only be set for Pods with a non-empty .spec.os.name + type: string + livenessProbe: + description: |- + Deprecated: This field will be removed in a future release. + DeprecatedLivenessProbe + type: object + properties: + exec: + description: Exec specifies a command to execute in the + container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + failureThreshold: + description: |- + Minimum consecutive failures for the probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. + type: integer + format: int32 + grpc: + description: GRPC specifies a GRPC HealthCheckRequest. + type: object + required: + - port + properties: + port: + description: Port number of the gRPC service. Number + must be in the range 1 to 65535. + type: integer + format: int32 + service: + description: |- + Service is the name of the service to place in the gRPC HealthCheckRequest + (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + + If this is not specified, the default behavior is defined by gRPC. + type: string + default: "" + httpGet: + description: HTTPGet specifies an HTTP GET request to perform. + type: object + required: + - port + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. HTTP + allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + initialDelaySeconds: + description: |- + Number of seconds after the container has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + periodSeconds: + description: |- + How often (in seconds) to perform the probe. + Default to 10 seconds. Minimum value is 1. + type: integer + format: int32 + successThreshold: + description: |- + Minimum consecutive successes for the probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. + type: integer + format: int32 + tcpSocket: + description: TCPSocket specifies a connection to a TCP port. + type: object + required: + - port + properties: + host: + description: 'Optional: Host name to connect to, defaults + to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + terminationGracePeriodSeconds: + description: |- + Optional duration in seconds the pod needs to terminate gracefully upon probe failure. + The grace period is the duration in seconds after the processes running in the pod are sent + a termination signal and the time when the processes are forcibly halted with a kill signal. + Set this value longer than the expected cleanup time for your process. + If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this + value overrides the value provided by the pod spec. + Value must be non-negative integer. The value zero indicates stop immediately via + the kill signal (no opportunity to shut down). + This is a beta field and requires enabling ProbeTerminationGracePeriod feature gate. + Minimum value is 1. spec.terminationGracePeriodSeconds is used if unset. + type: integer + format: int64 + timeoutSeconds: + description: |- + Number of seconds after which the probe times out. + Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + name: + description: |- + Deprecated: This field will be removed in a future release. + DeprecatedName + type: string + ports: + description: |- + Deprecated: This field will be removed in a future release. + DeprecatedPorts + type: array + items: + description: ContainerPort represents a network port in a + single container. + type: object + required: + - containerPort + properties: + containerPort: + description: |- + Number of port to expose on the pod's IP address. + This must be a valid port number, 0 < x < 65536. + type: integer + format: int32 + hostIP: + description: What host IP to bind the external port to. + type: string + hostPort: + description: |- + Number of port to expose on the host. + If specified, this must be a valid port number, 0 < x < 65536. + If HostNetwork is specified, this must match ContainerPort. + Most containers do not need this. + type: integer + format: int32 + name: + description: |- + If specified, this must be an IANA_SVC_NAME and unique within the pod. Each + named port in a pod must have a unique name. Name for the port that can be + referred to by services. + type: string + protocol: + description: |- + Protocol for port. Must be UDP, TCP, or SCTP. + Defaults to "TCP". + type: string + default: TCP + x-kubernetes-list-map-keys: + - containerPort + - protocol + x-kubernetes-list-type: map + readinessProbe: + description: |- + Deprecated: This field will be removed in a future release. + DeprecatedReadinessProbe + type: object + properties: + exec: + description: Exec specifies a command to execute in the + container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + failureThreshold: + description: |- + Minimum consecutive failures for the probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. + type: integer + format: int32 + grpc: + description: GRPC specifies a GRPC HealthCheckRequest. + type: object + required: + - port + properties: + port: + description: Port number of the gRPC service. Number + must be in the range 1 to 65535. + type: integer + format: int32 + service: + description: |- + Service is the name of the service to place in the gRPC HealthCheckRequest + (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + + If this is not specified, the default behavior is defined by gRPC. + type: string + default: "" + httpGet: + description: HTTPGet specifies an HTTP GET request to perform. + type: object + required: + - port + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. HTTP + allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + initialDelaySeconds: + description: |- + Number of seconds after the container has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + periodSeconds: + description: |- + How often (in seconds) to perform the probe. + Default to 10 seconds. Minimum value is 1. + type: integer + format: int32 + successThreshold: + description: |- + Minimum consecutive successes for the probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. + type: integer + format: int32 + tcpSocket: + description: TCPSocket specifies a connection to a TCP port. + type: object + required: + - port + properties: + host: + description: 'Optional: Host name to connect to, defaults + to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + terminationGracePeriodSeconds: + description: |- + Optional duration in seconds the pod needs to terminate gracefully upon probe failure. + The grace period is the duration in seconds after the processes running in the pod are sent + a termination signal and the time when the processes are forcibly halted with a kill signal. + Set this value longer than the expected cleanup time for your process. + If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this + value overrides the value provided by the pod spec. + Value must be non-negative integer. The value zero indicates stop immediately via + the kill signal (no opportunity to shut down). + This is a beta field and requires enabling ProbeTerminationGracePeriod feature gate. + Minimum value is 1. spec.terminationGracePeriodSeconds is used if unset. + type: integer + format: int64 + timeoutSeconds: + description: |- + Number of seconds after which the probe times out. + Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + resources: + description: Resources + type: object + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This field depends on the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + type: array + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + type: object + required: + - name + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + requests: + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + securityContext: + description: SecurityContext + type: object + properties: + allowPrivilegeEscalation: + description: |- + AllowPrivilegeEscalation controls whether a process can gain more + privileges than its parent process. This bool directly controls if + the no_new_privs flag will be set on the container process. + AllowPrivilegeEscalation is true always when the container is: + 1) run as Privileged + 2) has CAP_SYS_ADMIN + Note that this field cannot be set when spec.os.name is windows. + type: boolean + appArmorProfile: + description: |- + appArmorProfile is the AppArmor options to use by this container. If set, this profile + overrides the pod's appArmorProfile. + Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile loaded on the node that should be used. + The profile must be preconfigured on the node to work. + Must match the loaded name of the profile. + Must be set if and only if type is "Localhost". + type: string + type: + description: |- + type indicates which kind of AppArmor profile will be applied. + Valid options are: + Localhost - a profile pre-loaded on the node. + RuntimeDefault - the container runtime's default profile. + Unconfined - no AppArmor enforcement. + type: string + capabilities: + description: |- + The capabilities to add/drop when running containers. + Defaults to the default set of capabilities granted by the container runtime. + Note that this field cannot be set when spec.os.name is windows. + type: object + properties: + add: + description: Added capabilities + type: array + items: + description: Capability represent POSIX capabilities + type + type: string + x-kubernetes-list-type: atomic + drop: + description: Removed capabilities + type: array + items: + description: Capability represent POSIX capabilities + type + type: string + x-kubernetes-list-type: atomic + privileged: + description: |- + Run container in privileged mode. + Processes in privileged containers are essentially equivalent to root on the host. + Defaults to false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + procMount: + description: |- + procMount denotes the type of proc mount to use for the containers. + The default value is Default which uses the container runtime defaults for + readonly paths and masked paths. + This requires the ProcMountType feature flag to be enabled. + Note that this field cannot be set when spec.os.name is windows. + type: string + readOnlyRootFilesystem: + description: |- + Whether this container has a read-only root filesystem. + Default is false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + runAsGroup: + description: |- + The GID to run the entrypoint of the container process. + Uses runtime default if unset. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + runAsNonRoot: + description: |- + Indicates that the container must run as a non-root user. + If true, the Kubelet will validate the image at runtime to ensure that it + does not run as UID 0 (root) and fail to start the container if it does. + If unset or false, no such validation will be performed. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: boolean + runAsUser: + description: |- + The UID to run the entrypoint of the container process. + Defaults to user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + seLinuxOptions: + description: |- + The SELinux context to be applied to the container. + If unspecified, the container runtime will allocate a random SELinux context for each + container. May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: object + properties: + level: + description: Level is SELinux level label that applies + to the container. + type: string + role: + description: Role is a SELinux role label that applies + to the container. + type: string + type: + description: Type is a SELinux type label that applies + to the container. + type: string + user: + description: User is a SELinux user label that applies + to the container. + type: string + seccompProfile: + description: |- + The seccomp options to use by this container. If seccomp options are + provided at both the pod & container level, the container options + override the pod options. + Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile defined in a file on the node should be used. + The profile must be preconfigured on the node to work. + Must be a descending path, relative to the kubelet's configured seccomp profile location. + Must be set if type is "Localhost". Must NOT be set for any other type. + type: string + type: + description: |- + type indicates which kind of seccomp profile will be applied. + Valid options are: + + Localhost - a profile defined in a file on the node should be used. + RuntimeDefault - the container runtime default profile should be used. + Unconfined - no profile should be applied. + type: string + windowsOptions: + description: |- + The Windows specific settings applied to all containers. + If unspecified, the options from the PodSecurityContext will be used. + If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is linux. + type: object + properties: + gmsaCredentialSpec: + description: |- + GMSACredentialSpec is where the GMSA admission webhook + (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the + GMSA credential spec named by the GMSACredentialSpecName field. + type: string + gmsaCredentialSpecName: + description: GMSACredentialSpecName is the name of the + GMSA credential spec to use. + type: string + hostProcess: + description: |- + HostProcess determines if a container should be run as a 'Host Process' container. + All of a Pod's containers must have the same effective HostProcess value + (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers). + In addition, if HostProcess is true then HostNetwork must also be set to true. + type: boolean + runAsUserName: + description: |- + The UserName in Windows to run the entrypoint of the container process. + Defaults to the user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: string + startupProbe: + description: |- + Deprecated: This field will be removed in a future release. + DeprecatedStartupProbe + type: object + properties: + exec: + description: Exec specifies a command to execute in the + container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + failureThreshold: + description: |- + Minimum consecutive failures for the probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. + type: integer + format: int32 + grpc: + description: GRPC specifies a GRPC HealthCheckRequest. + type: object + required: + - port + properties: + port: + description: Port number of the gRPC service. Number + must be in the range 1 to 65535. + type: integer + format: int32 + service: + description: |- + Service is the name of the service to place in the gRPC HealthCheckRequest + (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + + If this is not specified, the default behavior is defined by gRPC. + type: string + default: "" + httpGet: + description: HTTPGet specifies an HTTP GET request to perform. + type: object + required: + - port + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. HTTP + allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + initialDelaySeconds: + description: |- + Number of seconds after the container has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + periodSeconds: + description: |- + How often (in seconds) to perform the probe. + Default to 10 seconds. Minimum value is 1. + type: integer + format: int32 + successThreshold: + description: |- + Minimum consecutive successes for the probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. + type: integer + format: int32 + tcpSocket: + description: TCPSocket specifies a connection to a TCP port. + type: object + required: + - port + properties: + host: + description: 'Optional: Host name to connect to, defaults + to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + terminationGracePeriodSeconds: + description: |- + Optional duration in seconds the pod needs to terminate gracefully upon probe failure. + The grace period is the duration in seconds after the processes running in the pod are sent + a termination signal and the time when the processes are forcibly halted with a kill signal. + Set this value longer than the expected cleanup time for your process. + If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this + value overrides the value provided by the pod spec. + Value must be non-negative integer. The value zero indicates stop immediately via + the kill signal (no opportunity to shut down). + This is a beta field and requires enabling ProbeTerminationGracePeriod feature gate. + Minimum value is 1. spec.terminationGracePeriodSeconds is used if unset. + type: integer + format: int64 + timeoutSeconds: + description: |- + Number of seconds after which the probe times out. + Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + stdin: + description: |- + Deprecated: This field will be removed in a future release. + DeprecatedStdin + type: boolean + stdinOnce: + description: |- + Deprecated: This field will be removed in a future release. + DeprecatedStdinOnce + type: boolean + terminationMessagePath: + description: |- + DeprecatedTerminationMessagePath + Deprecated: This field will be removed in a future release and cannot be meaningfully used. + type: string + terminationMessagePolicy: + description: |- + DeprecatedTerminationMessagePolicy + Deprecated: This field will be removed in a future release and cannot be meaningfully used. + type: string + tty: + description: |- + Deprecated: This field will be removed in a future release. + DeprecatedTTY + type: boolean + volumeDevices: + description: VolumeDevices + type: array + items: + description: volumeDevice describes a mapping of a raw block + device within a container. + type: object + required: + - devicePath + - name + properties: + devicePath: + description: devicePath is the path inside of the container + that the device will be mapped to. + type: string + name: + description: name must match the name of a persistentVolumeClaim + in the pod + type: string + x-kubernetes-list-type: atomic + volumeMounts: + description: VolumeMounts + type: array + items: + description: VolumeMount describes a mounting of a Volume + within a container. + type: object + required: + - mountPath + - name + properties: + mountPath: + description: |- + Path within the container at which the volume should be mounted. Must + not contain ':'. + type: string + mountPropagation: + description: |- + mountPropagation determines how mounts are propagated from the host + to container and the other way around. + When not set, MountPropagationNone is used. + This field is beta in 1.10. + When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified + (which defaults to None). + type: string + name: + description: This must match the Name of a Volume. + type: string + readOnly: + description: |- + Mounted read-only if true, read-write otherwise (false or unspecified). + Defaults to false. + type: boolean + recursiveReadOnly: + description: |- + RecursiveReadOnly specifies whether read-only mounts should be handled + recursively. + + If ReadOnly is false, this field has no meaning and must be unspecified. + + If ReadOnly is true, and this field is set to Disabled, the mount is not made + recursively read-only. If this field is set to IfPossible, the mount is made + recursively read-only, if it is supported by the container runtime. If this + field is set to Enabled, the mount is made recursively read-only if it is + supported by the container runtime, otherwise the pod will not be started and + an error will be generated to indicate the reason. + + If this field is set to IfPossible or Enabled, MountPropagation must be set to + None (or be unspecified, which defaults to None). + + If this field is not specified, it is treated as an equivalent of Disabled. + type: string + subPath: + description: |- + Path within the volume from which the container's volume should be mounted. + Defaults to "" (volume's root). + type: string + subPathExpr: + description: |- + Expanded path within the volume from which the container's volume should be mounted. + Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment. + Defaults to "" (volume's root). + SubPathExpr and SubPath are mutually exclusive. + type: string + x-kubernetes-list-type: atomic + workingDir: + description: WorkingDir + type: string + steps: + description: Steps + type: array + items: + description: Step + type: object + required: + - name + properties: + args: + description: Args + type: array + items: + type: string + x-kubernetes-list-type: atomic + command: + description: Command + type: array + items: + type: string + x-kubernetes-list-type: atomic + displayName: + description: DisplayName + type: string + env: + description: Env + type: array + items: + description: EnvVar represents an environment variable present + in a Container. + type: object + required: + - name + properties: + name: + description: |- + Name of the environment variable. + May consist of any printable ASCII characters except '='. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's value. + Cannot be used if value is not empty. + type: object + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + type: object + required: + - key + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap or + its key must be defined + type: boolean + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + type: object + required: + - fieldPath + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in + the specified API version. + type: string + x-kubernetes-map-type: atomic + fileKeyRef: + description: |- + FileKeyRef selects a key of the env file. + Requires the EnvFiles feature gate to be enabled. + type: object + required: + - key + - path + - volumeName + properties: + key: + description: |- + The key within the env file. An invalid key will prevent the pod from starting. + The keys defined within a source may consist of any printable ASCII characters except '='. + During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters. + type: string + optional: + description: |- + Specify whether the file or its key must be defined. If the file or key + does not exist, then the env var is not published. + If optional is set to true and the specified key does not exist, + the environment variable will not be set in the Pod's containers. + + If optional is set to false and the specified key does not exist, + an error will be returned during Pod creation. + type: boolean + default: false + path: + description: |- + The path within the volume from which to select the file. + Must be relative and may not contain the '..' path or start with '..'. + type: string + volumeName: + description: The name of the volume mount containing + the env file. + type: string + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + type: object + required: + - resource + properties: + containerName: + description: 'Container name: required for volumes, + optional for env vars' + type: string + divisor: + description: Specifies the output format of + the exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the pod's + namespace + type: object + required: + - key + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret or its + key must be defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + envFrom: + description: EnvFrom + type: array + items: + description: EnvFromSource represents the source of a set + of ConfigMaps or Secrets + type: object + properties: + configMapRef: + description: The ConfigMap to select from + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap must + be defined + type: boolean + x-kubernetes-map-type: atomic + prefix: + description: |- + Optional text to prepend to the name of each environment variable. + May consist of any printable ASCII characters except '='. + type: string + secretRef: + description: The Secret to select from + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret must be + defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + image: + description: Image + type: string + imagePullPolicy: + description: ImagePullPolicy + type: string + lifecycle: + description: |- + Deprecated: This field will be removed in a future release. + DeprecatedLifecycle + type: object + properties: + postStart: + description: |- + PostStart is called immediately after a container is created. If the handler fails, + the container is terminated and restarted according to its restart policy. + Other management of the container blocks until the hook completes. + More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks + type: object + properties: + exec: + description: Exec specifies a command to execute in + the container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + httpGet: + description: HTTPGet specifies an HTTP GET request + to perform. + type: object + required: + - port + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + sleep: + description: Sleep represents a duration that the + container should sleep. + type: object + required: + - seconds + properties: + seconds: + description: Seconds is the number of seconds + to sleep. + type: integer + format: int64 + tcpSocket: + description: |- + Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept + for backward compatibility. There is no validation of this field and + lifecycle hooks will fail at runtime when it is specified. + type: object + required: + - port + properties: + host: + description: 'Optional: Host name to connect to, + defaults to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + preStop: + description: |- + PreStop is called immediately before a container is terminated due to an + API request or management event such as liveness/startup probe failure, + preemption, resource contention, etc. The handler is not called if the + container crashes or exits. The Pod's termination grace period countdown begins before the + PreStop hook is executed. Regardless of the outcome of the handler, the + container will eventually terminate within the Pod's termination grace + period (unless delayed by finalizers). Other management of the container blocks until the hook completes + or until the termination grace period is reached. + More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks + type: object + properties: + exec: + description: Exec specifies a command to execute in + the container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + httpGet: + description: HTTPGet specifies an HTTP GET request + to perform. + type: object + required: + - port + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + sleep: + description: Sleep represents a duration that the + container should sleep. + type: object + required: + - seconds + properties: + seconds: + description: Seconds is the number of seconds + to sleep. + type: integer + format: int64 + tcpSocket: + description: |- + Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept + for backward compatibility. There is no validation of this field and + lifecycle hooks will fail at runtime when it is specified. + type: object + required: + - port + properties: + host: + description: 'Optional: Host name to connect to, + defaults to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + stopSignal: + description: |- + StopSignal defines which signal will be sent to a container when it is being stopped. + If not specified, the default is defined by the container runtime in use. + StopSignal can only be set for Pods with a non-empty .spec.os.name + type: string + livenessProbe: + description: |- + Deprecated: This field will be removed in a future release. + DeprecatedLivenessProbe + type: object + properties: + exec: + description: Exec specifies a command to execute in the + container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + failureThreshold: + description: |- + Minimum consecutive failures for the probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. + type: integer + format: int32 + grpc: + description: GRPC specifies a GRPC HealthCheckRequest. + type: object + required: + - port + properties: + port: + description: Port number of the gRPC service. Number + must be in the range 1 to 65535. + type: integer + format: int32 + service: + description: |- + Service is the name of the service to place in the gRPC HealthCheckRequest + (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + + If this is not specified, the default behavior is defined by gRPC. + type: string + default: "" + httpGet: + description: HTTPGet specifies an HTTP GET request to + perform. + type: object + required: + - port + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + initialDelaySeconds: + description: |- + Number of seconds after the container has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + periodSeconds: + description: |- + How often (in seconds) to perform the probe. + Default to 10 seconds. Minimum value is 1. + type: integer + format: int32 + successThreshold: + description: |- + Minimum consecutive successes for the probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. + type: integer + format: int32 + tcpSocket: + description: TCPSocket specifies a connection to a TCP + port. + type: object + required: + - port + properties: + host: + description: 'Optional: Host name to connect to, defaults + to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + terminationGracePeriodSeconds: + description: |- + Optional duration in seconds the pod needs to terminate gracefully upon probe failure. + The grace period is the duration in seconds after the processes running in the pod are sent + a termination signal and the time when the processes are forcibly halted with a kill signal. + Set this value longer than the expected cleanup time for your process. + If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this + value overrides the value provided by the pod spec. + Value must be non-negative integer. The value zero indicates stop immediately via + the kill signal (no opportunity to shut down). + This is a beta field and requires enabling ProbeTerminationGracePeriod feature gate. + Minimum value is 1. spec.terminationGracePeriodSeconds is used if unset. + type: integer + format: int64 + timeoutSeconds: + description: |- + Number of seconds after which the probe times out. + Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + name: + description: Name + type: string + onError: + description: OnError + type: string + params: + description: Params + type: array + items: + description: Param + type: object + required: + - name + - value + properties: + name: + type: string + value: + description: Value + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + ports: + description: |- + Deprecated: This field will be removed in a future release. + DeprecatedPorts + type: array + items: + description: ContainerPort represents a network port in + a single container. + type: object + required: + - containerPort + properties: + containerPort: + description: |- + Number of port to expose on the pod's IP address. + This must be a valid port number, 0 < x < 65536. + type: integer + format: int32 + hostIP: + description: What host IP to bind the external port + to. + type: string + hostPort: + description: |- + Number of port to expose on the host. + If specified, this must be a valid port number, 0 < x < 65536. + If HostNetwork is specified, this must match ContainerPort. + Most containers do not need this. + type: integer + format: int32 + name: + description: |- + If specified, this must be an IANA_SVC_NAME and unique within the pod. Each + named port in a pod must have a unique name. Name for the port that can be + referred to by services. + type: string + protocol: + description: |- + Protocol for port. Must be UDP, TCP, or SCTP. + Defaults to "TCP". + type: string + default: TCP + x-kubernetes-list-map-keys: + - containerPort + - protocol + x-kubernetes-list-type: map + readinessProbe: + description: |- + Deprecated: This field will be removed in a future release. + DeprecatedReadinessProbe + type: object + properties: + exec: + description: Exec specifies a command to execute in the + container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + failureThreshold: + description: |- + Minimum consecutive failures for the probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. + type: integer + format: int32 + grpc: + description: GRPC specifies a GRPC HealthCheckRequest. + type: object + required: + - port + properties: + port: + description: Port number of the gRPC service. Number + must be in the range 1 to 65535. + type: integer + format: int32 + service: + description: |- + Service is the name of the service to place in the gRPC HealthCheckRequest + (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + + If this is not specified, the default behavior is defined by gRPC. + type: string + default: "" + httpGet: + description: HTTPGet specifies an HTTP GET request to + perform. + type: object + required: + - port + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + initialDelaySeconds: + description: |- + Number of seconds after the container has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + periodSeconds: + description: |- + How often (in seconds) to perform the probe. + Default to 10 seconds. Minimum value is 1. + type: integer + format: int32 + successThreshold: + description: |- + Minimum consecutive successes for the probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. + type: integer + format: int32 + tcpSocket: + description: TCPSocket specifies a connection to a TCP + port. + type: object + required: + - port + properties: + host: + description: 'Optional: Host name to connect to, defaults + to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + terminationGracePeriodSeconds: + description: |- + Optional duration in seconds the pod needs to terminate gracefully upon probe failure. + The grace period is the duration in seconds after the processes running in the pod are sent + a termination signal and the time when the processes are forcibly halted with a kill signal. + Set this value longer than the expected cleanup time for your process. + If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this + value overrides the value provided by the pod spec. + Value must be non-negative integer. The value zero indicates stop immediately via + the kill signal (no opportunity to shut down). + This is a beta field and requires enabling ProbeTerminationGracePeriod feature gate. + Minimum value is 1. spec.terminationGracePeriodSeconds is used if unset. + type: integer + format: int64 + timeoutSeconds: + description: |- + Number of seconds after which the probe times out. + Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + ref: + description: Ref + type: object + properties: + name: + description: Name + type: string + params: + description: Params + type: array + items: + description: Param + type: object + required: + - name + - value + properties: + name: + type: string + value: + description: Value + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + resolver: + description: Resolver + type: string + resources: + description: Resources + type: object + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This field depends on the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + type: array + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + type: object + required: + - name + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + requests: + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + results: + description: Results + type: array + items: + description: StepResult used to describe the Results of + a Step. + type: object + required: + - name + properties: + description: + description: Description is a human-readable description + of the result + type: string + name: + description: Name the given name + type: string + properties: + description: Properties is the JSON Schema properties + to support key-value pairs results. + type: object + additionalProperties: + description: PropertySpec defines the struct for object + keys + type: object + properties: + type: + description: |- + ParamType indicates the type of an input parameter; + Used to distinguish between a single string and an array of strings. + type: string + type: + description: The possible types are 'string', 'array', + and 'object', with 'string' as the default. + type: string + x-kubernetes-list-type: atomic + script: + description: Script + type: string + securityContext: + description: SecurityContext + type: object + properties: + allowPrivilegeEscalation: + description: |- + AllowPrivilegeEscalation controls whether a process can gain more + privileges than its parent process. This bool directly controls if + the no_new_privs flag will be set on the container process. + AllowPrivilegeEscalation is true always when the container is: + 1) run as Privileged + 2) has CAP_SYS_ADMIN + Note that this field cannot be set when spec.os.name is windows. + type: boolean + appArmorProfile: + description: |- + appArmorProfile is the AppArmor options to use by this container. If set, this profile + overrides the pod's appArmorProfile. + Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile loaded on the node that should be used. + The profile must be preconfigured on the node to work. + Must match the loaded name of the profile. + Must be set if and only if type is "Localhost". + type: string + type: + description: |- + type indicates which kind of AppArmor profile will be applied. + Valid options are: + Localhost - a profile pre-loaded on the node. + RuntimeDefault - the container runtime's default profile. + Unconfined - no AppArmor enforcement. + type: string + capabilities: + description: |- + The capabilities to add/drop when running containers. + Defaults to the default set of capabilities granted by the container runtime. + Note that this field cannot be set when spec.os.name is windows. + type: object + properties: + add: + description: Added capabilities + type: array + items: + description: Capability represent POSIX capabilities + type + type: string + x-kubernetes-list-type: atomic + drop: + description: Removed capabilities + type: array + items: + description: Capability represent POSIX capabilities + type + type: string + x-kubernetes-list-type: atomic + privileged: + description: |- + Run container in privileged mode. + Processes in privileged containers are essentially equivalent to root on the host. + Defaults to false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + procMount: + description: |- + procMount denotes the type of proc mount to use for the containers. + The default value is Default which uses the container runtime defaults for + readonly paths and masked paths. + This requires the ProcMountType feature flag to be enabled. + Note that this field cannot be set when spec.os.name is windows. + type: string + readOnlyRootFilesystem: + description: |- + Whether this container has a read-only root filesystem. + Default is false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + runAsGroup: + description: |- + The GID to run the entrypoint of the container process. + Uses runtime default if unset. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + runAsNonRoot: + description: |- + Indicates that the container must run as a non-root user. + If true, the Kubelet will validate the image at runtime to ensure that it + does not run as UID 0 (root) and fail to start the container if it does. + If unset or false, no such validation will be performed. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: boolean + runAsUser: + description: |- + The UID to run the entrypoint of the container process. + Defaults to user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + seLinuxOptions: + description: |- + The SELinux context to be applied to the container. + If unspecified, the container runtime will allocate a random SELinux context for each + container. May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: object + properties: + level: + description: Level is SELinux level label that applies + to the container. + type: string + role: + description: Role is a SELinux role label that applies + to the container. + type: string + type: + description: Type is a SELinux type label that applies + to the container. + type: string + user: + description: User is a SELinux user label that applies + to the container. + type: string + seccompProfile: + description: |- + The seccomp options to use by this container. If seccomp options are + provided at both the pod & container level, the container options + override the pod options. + Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile defined in a file on the node should be used. + The profile must be preconfigured on the node to work. + Must be a descending path, relative to the kubelet's configured seccomp profile location. + Must be set if type is "Localhost". Must NOT be set for any other type. + type: string + type: + description: |- + type indicates which kind of seccomp profile will be applied. + Valid options are: + + Localhost - a profile defined in a file on the node should be used. + RuntimeDefault - the container runtime default profile should be used. + Unconfined - no profile should be applied. + type: string + windowsOptions: + description: |- + The Windows specific settings applied to all containers. + If unspecified, the options from the PodSecurityContext will be used. + If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is linux. + type: object + properties: + gmsaCredentialSpec: + description: |- + GMSACredentialSpec is where the GMSA admission webhook + (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the + GMSA credential spec named by the GMSACredentialSpecName field. + type: string + gmsaCredentialSpecName: + description: GMSACredentialSpecName is the name of + the GMSA credential spec to use. + type: string + hostProcess: + description: |- + HostProcess determines if a container should be run as a 'Host Process' container. + All of a Pod's containers must have the same effective HostProcess value + (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers). + In addition, if HostProcess is true then HostNetwork must also be set to true. + type: boolean + runAsUserName: + description: |- + The UserName in Windows to run the entrypoint of the container process. + Defaults to the user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: string + startupProbe: + description: |- + Deprecated: This field will be removed in a future release. + DeprecatedStartupProbe + type: object + properties: + exec: + description: Exec specifies a command to execute in the + container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + failureThreshold: + description: |- + Minimum consecutive failures for the probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. + type: integer + format: int32 + grpc: + description: GRPC specifies a GRPC HealthCheckRequest. + type: object + required: + - port + properties: + port: + description: Port number of the gRPC service. Number + must be in the range 1 to 65535. + type: integer + format: int32 + service: + description: |- + Service is the name of the service to place in the gRPC HealthCheckRequest + (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + + If this is not specified, the default behavior is defined by gRPC. + type: string + default: "" + httpGet: + description: HTTPGet specifies an HTTP GET request to + perform. + type: object + required: + - port + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + initialDelaySeconds: + description: |- + Number of seconds after the container has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + periodSeconds: + description: |- + How often (in seconds) to perform the probe. + Default to 10 seconds. Minimum value is 1. + type: integer + format: int32 + successThreshold: + description: |- + Minimum consecutive successes for the probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. + type: integer + format: int32 + tcpSocket: + description: TCPSocket specifies a connection to a TCP + port. + type: object + required: + - port + properties: + host: + description: 'Optional: Host name to connect to, defaults + to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + terminationGracePeriodSeconds: + description: |- + Optional duration in seconds the pod needs to terminate gracefully upon probe failure. + The grace period is the duration in seconds after the processes running in the pod are sent + a termination signal and the time when the processes are forcibly halted with a kill signal. + Set this value longer than the expected cleanup time for your process. + If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this + value overrides the value provided by the pod spec. + Value must be non-negative integer. The value zero indicates stop immediately via + the kill signal (no opportunity to shut down). + This is a beta field and requires enabling ProbeTerminationGracePeriod feature gate. + Minimum value is 1. spec.terminationGracePeriodSeconds is used if unset. + type: integer + format: int64 + timeoutSeconds: + description: |- + Number of seconds after which the probe times out. + Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + stderrConfig: + description: StderrConfig + type: object + properties: + path: + description: Path + type: string + stdin: + description: |- + Deprecated: This field will be removed in a future release. + DeprecatedStdin + type: boolean + stdinOnce: + description: |- + Deprecated: This field will be removed in a future release. + DeprecatedStdinOnce + type: boolean + stdoutConfig: + description: StdoutConfig + type: object + properties: + path: + description: Path + type: string + terminationMessagePath: + description: |- + DeprecatedTerminationMessagePath + Deprecated: This field will be removed in a future release and can't be meaningfully used. + type: string + terminationMessagePolicy: + description: |- + DeprecatedTerminationMessagePolicy + Deprecated: This field will be removed in a future release and can't be meaningfully used. + type: string + timeout: + description: Timeout + type: string + tty: + description: |- + Deprecated: This field will be removed in a future release. + DeprecatedTTY + type: boolean + volumeDevices: + description: VolumeDevices + type: array + items: + description: volumeDevice describes a mapping of a raw block + device within a container. + type: object + required: + - devicePath + - name + properties: + devicePath: + description: devicePath is the path inside of the container + that the device will be mapped to. + type: string + name: + description: name must match the name of a persistentVolumeClaim + in the pod + type: string + x-kubernetes-list-type: atomic + volumeMounts: + description: VolumeMounts + type: array + items: + description: VolumeMount describes a mounting of a Volume + within a container. + type: object + required: + - mountPath + - name + properties: + mountPath: + description: |- + Path within the container at which the volume should be mounted. Must + not contain ':'. + type: string + mountPropagation: + description: |- + mountPropagation determines how mounts are propagated from the host + to container and the other way around. + When not set, MountPropagationNone is used. + This field is beta in 1.10. + When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified + (which defaults to None). + type: string + name: + description: This must match the Name of a Volume. + type: string + readOnly: + description: |- + Mounted read-only if true, read-write otherwise (false or unspecified). + Defaults to false. + type: boolean + recursiveReadOnly: + description: |- + RecursiveReadOnly specifies whether read-only mounts should be handled + recursively. + + If ReadOnly is false, this field has no meaning and must be unspecified. + + If ReadOnly is true, and this field is set to Disabled, the mount is not made + recursively read-only. If this field is set to IfPossible, the mount is made + recursively read-only, if it is supported by the container runtime. If this + field is set to Enabled, the mount is made recursively read-only if it is + supported by the container runtime, otherwise the pod will not be started and + an error will be generated to indicate the reason. + + If this field is set to IfPossible or Enabled, MountPropagation must be set to + None (or be unspecified, which defaults to None). + + If this field is not specified, it is treated as an equivalent of Disabled. + type: string + subPath: + description: |- + Path within the volume from which the container's volume should be mounted. + Defaults to "" (volume's root). + type: string + subPathExpr: + description: |- + Expanded path within the volume from which the container's volume should be mounted. + Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment. + Defaults to "" (volume's root). + SubPathExpr and SubPath are mutually exclusive. + type: string + x-kubernetes-list-type: atomic + when: + description: WhenExpressions + type: array + items: + description: WhenExpression + type: object + properties: + cel: + description: CEL + type: string + input: + description: Input + type: string + operator: + description: Operator + type: string + values: + description: Values + type: array + items: + type: string + x-kubernetes-list-type: atomic + workingDir: + description: WorkingDir + type: string + workspaces: + description: Workspaces + type: array + items: + description: WorkspaceUsage + type: object + required: + - mountPath + - name + properties: + mountPath: + description: MountPath + type: string + name: + description: Name + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + volumes: + description: Volumes + x-kubernetes-preserve-unknown-fields: true + workspaces: + description: Workspaces + type: array + items: + description: WorkspaceDeclaration + type: object + required: + - name + properties: + description: + description: Description + type: string + mountPath: + description: MountPath + type: string + name: + description: Name + type: string + optional: + description: Optional + type: boolean + readOnly: + description: ReadOnly + type: boolean + x-kubernetes-list-type: atomic + # Opt into the status subresource so metadata.generation + # starts to increment + subresources: + status: {} + - name: v1 + served: true + storage: true + schema: + openAPIV3Schema: + description: |- + Task represents a collection of sequential steps that are run as part of a + Pipeline using a set of inputs and producing a set of outputs. Tasks execute + when TaskRuns are created that provide the input parameters and resources and + output resources the Task requires. + type: object + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: Spec holds the desired state of the Task from the client + type: object + properties: + description: + description: |- + Description is a user-facing description of the task that may be + used to populate a UI. + type: string + displayName: + description: |- + DisplayName is a user-facing name of the task that may be + used to populate a UI. + type: string + params: + description: |- + Params is a list of input parameters required to run the task. Params + must be supplied as inputs in TaskRuns unless they declare a default + value. + type: array + items: + description: |- + ParamSpec defines arbitrary parameters needed beyond typed inputs (such as + resources). Parameter values are provided by users as inputs on a TaskRun + or PipelineRun. + type: object + required: + - name + properties: + default: + description: |- + Default is the value a parameter takes if no input value is supplied. If + default is set, a Task may be executed without a supplied value for the + parameter. + x-kubernetes-preserve-unknown-fields: true + description: + description: |- + Description is a user-facing description of the parameter that may be + used to populate a UI. + type: string + enum: + description: |- + Enum declares a set of allowed param input values for tasks/pipelines that can be validated. + If Enum is not set, no input validation is performed for the param. + type: array + items: + type: string + name: + description: Name declares the name by which a parameter is + referenced. + type: string + properties: + description: Properties is the JSON Schema properties to support + key-value pairs parameter. + type: object + additionalProperties: + description: PropertySpec defines the struct for object + keys + type: object + properties: + type: + description: |- + ParamType indicates the type of an input parameter; + Used to distinguish between a single string and an array of strings. + type: string + type: + description: |- + Type is the user-specified type of the parameter. The possible types + are currently "string", "array" and "object", and "string" is the default. + type: string + x-kubernetes-list-type: atomic + results: + description: Results are values that this Task can output + type: array + items: + description: TaskResult used to describe the results of a task + type: object + required: + - name + properties: + description: + description: Description is a human-readable description of + the result + type: string + name: + description: Name the given name + type: string + properties: + description: Properties is the JSON Schema properties to support + key-value pairs results. + type: object + additionalProperties: + description: PropertySpec defines the struct for object + keys + type: object + properties: + type: + description: |- + ParamType indicates the type of an input parameter; + Used to distinguish between a single string and an array of strings. + type: string + type: + description: |- + Type is the user-specified type of the result. The possible type + is currently "string" and will support "array" in following work. + type: string + value: + description: Value the expression used to retrieve the value + of the result from an underlying Step. + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + sidecars: + description: |- + Sidecars are run alongside the Task's step containers. They begin before + the steps start and end after the steps complete. + type: array + items: + description: Sidecar has nearly the same data structure as Step + but does not have the ability to timeout. + type: object + required: + - name + properties: + args: + description: |- + Arguments to the entrypoint. + The image's CMD is used if this is not provided. + Variable references $(VAR_NAME) are expanded using the Sidecar's environment. If a variable + cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will + produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless + of whether the variable exists or not. Cannot be updated. + More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell + type: array + items: + type: string + x-kubernetes-list-type: atomic + command: + description: |- + Entrypoint array. Not executed within a shell. + The image's ENTRYPOINT is used if this is not provided. + Variable references $(VAR_NAME) are expanded using the Sidecar's environment. If a variable + cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will + produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless + of whether the variable exists or not. Cannot be updated. + More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell + type: array + items: + type: string + x-kubernetes-list-type: atomic + computeResources: + description: |- + ComputeResources required by this Sidecar. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This field depends on the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + type: array + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + type: object + required: + - name + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + requests: + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + env: + description: |- + List of environment variables to set in the Sidecar. + Cannot be updated. + type: array + items: + description: EnvVar represents an environment variable present + in a Container. + type: object + required: + - name + properties: + name: + description: |- + Name of the environment variable. + May consist of any printable ASCII characters except '='. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's value. + Cannot be used if value is not empty. + type: object + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + type: object + required: + - key + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap or + its key must be defined + type: boolean + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + type: object + required: + - fieldPath + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in + the specified API version. + type: string + x-kubernetes-map-type: atomic + fileKeyRef: + description: |- + FileKeyRef selects a key of the env file. + Requires the EnvFiles feature gate to be enabled. + type: object + required: + - key + - path + - volumeName + properties: + key: + description: |- + The key within the env file. An invalid key will prevent the pod from starting. + The keys defined within a source may consist of any printable ASCII characters except '='. + During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters. + type: string + optional: + description: |- + Specify whether the file or its key must be defined. If the file or key + does not exist, then the env var is not published. + If optional is set to true and the specified key does not exist, + the environment variable will not be set in the Pod's containers. + + If optional is set to false and the specified key does not exist, + an error will be returned during Pod creation. + type: boolean + default: false + path: + description: |- + The path within the volume from which to select the file. + Must be relative and may not contain the '..' path or start with '..'. + type: string + volumeName: + description: The name of the volume mount containing + the env file. + type: string + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + type: object + required: + - resource + properties: + containerName: + description: 'Container name: required for volumes, + optional for env vars' + type: string + divisor: + description: Specifies the output format of + the exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the pod's + namespace + type: object + required: + - key + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret or its + key must be defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + envFrom: + description: |- + List of sources to populate environment variables in the Sidecar. + The keys defined within a source must be a C_IDENTIFIER. All invalid keys + will be reported as an event when the container is starting. When a key exists in multiple + sources, the value associated with the last source will take precedence. + Values defined by an Env with a duplicate key will take precedence. + Cannot be updated. + type: array + items: + description: EnvFromSource represents the source of a set + of ConfigMaps or Secrets + type: object + properties: + configMapRef: + description: The ConfigMap to select from + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap must + be defined + type: boolean + x-kubernetes-map-type: atomic + prefix: + description: |- + Optional text to prepend to the name of each environment variable. + May consist of any printable ASCII characters except '='. + type: string + secretRef: + description: The Secret to select from + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret must be + defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + image: + description: |- + Image reference name. + More info: https://kubernetes.io/docs/concepts/containers/images + type: string + imagePullPolicy: + description: |- + Image pull policy. + One of Always, Never, IfNotPresent. + Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/containers/images#updating-images + type: string + lifecycle: + description: |- + Actions that the management system should take in response to Sidecar lifecycle events. + Cannot be updated. + type: object + properties: + postStart: + description: |- + PostStart is called immediately after a container is created. If the handler fails, + the container is terminated and restarted according to its restart policy. + Other management of the container blocks until the hook completes. + More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks + type: object + properties: + exec: + description: Exec specifies a command to execute in + the container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + httpGet: + description: HTTPGet specifies an HTTP GET request + to perform. + type: object + required: + - port + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + sleep: + description: Sleep represents a duration that the + container should sleep. + type: object + required: + - seconds + properties: + seconds: + description: Seconds is the number of seconds + to sleep. + type: integer + format: int64 + tcpSocket: + description: |- + Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept + for backward compatibility. There is no validation of this field and + lifecycle hooks will fail at runtime when it is specified. + type: object + required: + - port + properties: + host: + description: 'Optional: Host name to connect to, + defaults to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + preStop: + description: |- + PreStop is called immediately before a container is terminated due to an + API request or management event such as liveness/startup probe failure, + preemption, resource contention, etc. The handler is not called if the + container crashes or exits. The Pod's termination grace period countdown begins before the + PreStop hook is executed. Regardless of the outcome of the handler, the + container will eventually terminate within the Pod's termination grace + period (unless delayed by finalizers). Other management of the container blocks until the hook completes + or until the termination grace period is reached. + More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks + type: object + properties: + exec: + description: Exec specifies a command to execute in + the container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + httpGet: + description: HTTPGet specifies an HTTP GET request + to perform. + type: object + required: + - port + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + sleep: + description: Sleep represents a duration that the + container should sleep. + type: object + required: + - seconds + properties: + seconds: + description: Seconds is the number of seconds + to sleep. + type: integer + format: int64 + tcpSocket: + description: |- + Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept + for backward compatibility. There is no validation of this field and + lifecycle hooks will fail at runtime when it is specified. + type: object + required: + - port + properties: + host: + description: 'Optional: Host name to connect to, + defaults to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + stopSignal: + description: |- + StopSignal defines which signal will be sent to a container when it is being stopped. + If not specified, the default is defined by the container runtime in use. + StopSignal can only be set for Pods with a non-empty .spec.os.name + type: string + livenessProbe: + description: |- + Periodic probe of Sidecar liveness. + Container will be restarted if the probe fails. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: object + properties: + exec: + description: Exec specifies a command to execute in the + container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + failureThreshold: + description: |- + Minimum consecutive failures for the probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. + type: integer + format: int32 + grpc: + description: GRPC specifies a GRPC HealthCheckRequest. + type: object + required: + - port + properties: + port: + description: Port number of the gRPC service. Number + must be in the range 1 to 65535. + type: integer + format: int32 + service: + description: |- + Service is the name of the service to place in the gRPC HealthCheckRequest + (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + + If this is not specified, the default behavior is defined by gRPC. + type: string + default: "" + httpGet: + description: HTTPGet specifies an HTTP GET request to + perform. + type: object + required: + - port + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + initialDelaySeconds: + description: |- + Number of seconds after the container has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + periodSeconds: + description: |- + How often (in seconds) to perform the probe. + Default to 10 seconds. Minimum value is 1. + type: integer + format: int32 + successThreshold: + description: |- + Minimum consecutive successes for the probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. + type: integer + format: int32 + tcpSocket: + description: TCPSocket specifies a connection to a TCP + port. + type: object + required: + - port + properties: + host: + description: 'Optional: Host name to connect to, defaults + to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + terminationGracePeriodSeconds: + description: |- + Optional duration in seconds the pod needs to terminate gracefully upon probe failure. + The grace period is the duration in seconds after the processes running in the pod are sent + a termination signal and the time when the processes are forcibly halted with a kill signal. + Set this value longer than the expected cleanup time for your process. + If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this + value overrides the value provided by the pod spec. + Value must be non-negative integer. The value zero indicates stop immediately via + the kill signal (no opportunity to shut down). + This is a beta field and requires enabling ProbeTerminationGracePeriod feature gate. + Minimum value is 1. spec.terminationGracePeriodSeconds is used if unset. + type: integer + format: int64 + timeoutSeconds: + description: |- + Number of seconds after which the probe times out. + Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + name: + description: |- + Name of the Sidecar specified as a DNS_LABEL. + Each Sidecar in a Task must have a unique name (DNS_LABEL). + Cannot be updated. + type: string + ports: + description: |- + List of ports to expose from the Sidecar. Exposing a port here gives + the system additional information about the network connections a + container uses, but is primarily informational. Not specifying a port here + DOES NOT prevent that port from being exposed. Any port which is + listening on the default "0.0.0.0" address inside a container will be + accessible from the network. + Cannot be updated. + type: array + items: + description: ContainerPort represents a network port in + a single container. + type: object + required: + - containerPort + properties: + containerPort: + description: |- + Number of port to expose on the pod's IP address. + This must be a valid port number, 0 < x < 65536. + type: integer + format: int32 + hostIP: + description: What host IP to bind the external port + to. + type: string + hostPort: + description: |- + Number of port to expose on the host. + If specified, this must be a valid port number, 0 < x < 65536. + If HostNetwork is specified, this must match ContainerPort. + Most containers do not need this. + type: integer + format: int32 + name: + description: |- + If specified, this must be an IANA_SVC_NAME and unique within the pod. Each + named port in a pod must have a unique name. Name for the port that can be + referred to by services. + type: string + protocol: + description: |- + Protocol for port. Must be UDP, TCP, or SCTP. + Defaults to "TCP". + type: string + default: TCP + x-kubernetes-list-map-keys: + - containerPort + - protocol + x-kubernetes-list-type: map + readinessProbe: + description: |- + Periodic probe of Sidecar service readiness. + Container will be removed from service endpoints if the probe fails. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: object + properties: + exec: + description: Exec specifies a command to execute in the + container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + failureThreshold: + description: |- + Minimum consecutive failures for the probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. + type: integer + format: int32 + grpc: + description: GRPC specifies a GRPC HealthCheckRequest. + type: object + required: + - port + properties: + port: + description: Port number of the gRPC service. Number + must be in the range 1 to 65535. + type: integer + format: int32 + service: + description: |- + Service is the name of the service to place in the gRPC HealthCheckRequest + (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + + If this is not specified, the default behavior is defined by gRPC. + type: string + default: "" + httpGet: + description: HTTPGet specifies an HTTP GET request to + perform. + type: object + required: + - port + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + initialDelaySeconds: + description: |- + Number of seconds after the container has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + periodSeconds: + description: |- + How often (in seconds) to perform the probe. + Default to 10 seconds. Minimum value is 1. + type: integer + format: int32 + successThreshold: + description: |- + Minimum consecutive successes for the probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. + type: integer + format: int32 + tcpSocket: + description: TCPSocket specifies a connection to a TCP + port. + type: object + required: + - port + properties: + host: + description: 'Optional: Host name to connect to, defaults + to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + terminationGracePeriodSeconds: + description: |- + Optional duration in seconds the pod needs to terminate gracefully upon probe failure. + The grace period is the duration in seconds after the processes running in the pod are sent + a termination signal and the time when the processes are forcibly halted with a kill signal. + Set this value longer than the expected cleanup time for your process. + If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this + value overrides the value provided by the pod spec. + Value must be non-negative integer. The value zero indicates stop immediately via + the kill signal (no opportunity to shut down). + This is a beta field and requires enabling ProbeTerminationGracePeriod feature gate. + Minimum value is 1. spec.terminationGracePeriodSeconds is used if unset. + type: integer + format: int64 + timeoutSeconds: + description: |- + Number of seconds after which the probe times out. + Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + restartPolicy: + description: |- + RestartPolicy refers to kubernetes RestartPolicy. It can only be set for an + initContainer and must have it's policy set to "Always". It is currently + left optional to help support Kubernetes versions prior to 1.29 when this feature + was introduced. + type: string + script: + description: |- + Script is the contents of an executable file to execute. + + If Script is not empty, the Step cannot have an Command or Args. + type: string + securityContext: + description: |- + SecurityContext defines the security options the Sidecar should be run with. + If set, the fields of SecurityContext override the equivalent fields of PodSecurityContext. + More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ + type: object + properties: + allowPrivilegeEscalation: + description: |- + AllowPrivilegeEscalation controls whether a process can gain more + privileges than its parent process. This bool directly controls if + the no_new_privs flag will be set on the container process. + AllowPrivilegeEscalation is true always when the container is: + 1) run as Privileged + 2) has CAP_SYS_ADMIN + Note that this field cannot be set when spec.os.name is windows. + type: boolean + appArmorProfile: + description: |- + appArmorProfile is the AppArmor options to use by this container. If set, this profile + overrides the pod's appArmorProfile. + Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile loaded on the node that should be used. + The profile must be preconfigured on the node to work. + Must match the loaded name of the profile. + Must be set if and only if type is "Localhost". + type: string + type: + description: |- + type indicates which kind of AppArmor profile will be applied. + Valid options are: + Localhost - a profile pre-loaded on the node. + RuntimeDefault - the container runtime's default profile. + Unconfined - no AppArmor enforcement. + type: string + capabilities: + description: |- + The capabilities to add/drop when running containers. + Defaults to the default set of capabilities granted by the container runtime. + Note that this field cannot be set when spec.os.name is windows. + type: object + properties: + add: + description: Added capabilities + type: array + items: + description: Capability represent POSIX capabilities + type + type: string + x-kubernetes-list-type: atomic + drop: + description: Removed capabilities + type: array + items: + description: Capability represent POSIX capabilities + type + type: string + x-kubernetes-list-type: atomic + privileged: + description: |- + Run container in privileged mode. + Processes in privileged containers are essentially equivalent to root on the host. + Defaults to false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + procMount: + description: |- + procMount denotes the type of proc mount to use for the containers. + The default value is Default which uses the container runtime defaults for + readonly paths and masked paths. + This requires the ProcMountType feature flag to be enabled. + Note that this field cannot be set when spec.os.name is windows. + type: string + readOnlyRootFilesystem: + description: |- + Whether this container has a read-only root filesystem. + Default is false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + runAsGroup: + description: |- + The GID to run the entrypoint of the container process. + Uses runtime default if unset. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + runAsNonRoot: + description: |- + Indicates that the container must run as a non-root user. + If true, the Kubelet will validate the image at runtime to ensure that it + does not run as UID 0 (root) and fail to start the container if it does. + If unset or false, no such validation will be performed. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: boolean + runAsUser: + description: |- + The UID to run the entrypoint of the container process. + Defaults to user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + seLinuxOptions: + description: |- + The SELinux context to be applied to the container. + If unspecified, the container runtime will allocate a random SELinux context for each + container. May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: object + properties: + level: + description: Level is SELinux level label that applies + to the container. + type: string + role: + description: Role is a SELinux role label that applies + to the container. + type: string + type: + description: Type is a SELinux type label that applies + to the container. + type: string + user: + description: User is a SELinux user label that applies + to the container. + type: string + seccompProfile: + description: |- + The seccomp options to use by this container. If seccomp options are + provided at both the pod & container level, the container options + override the pod options. + Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile defined in a file on the node should be used. + The profile must be preconfigured on the node to work. + Must be a descending path, relative to the kubelet's configured seccomp profile location. + Must be set if type is "Localhost". Must NOT be set for any other type. + type: string + type: + description: |- + type indicates which kind of seccomp profile will be applied. + Valid options are: + + Localhost - a profile defined in a file on the node should be used. + RuntimeDefault - the container runtime default profile should be used. + Unconfined - no profile should be applied. + type: string + windowsOptions: + description: |- + The Windows specific settings applied to all containers. + If unspecified, the options from the PodSecurityContext will be used. + If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is linux. + type: object + properties: + gmsaCredentialSpec: + description: |- + GMSACredentialSpec is where the GMSA admission webhook + (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the + GMSA credential spec named by the GMSACredentialSpecName field. + type: string + gmsaCredentialSpecName: + description: GMSACredentialSpecName is the name of + the GMSA credential spec to use. + type: string + hostProcess: + description: |- + HostProcess determines if a container should be run as a 'Host Process' container. + All of a Pod's containers must have the same effective HostProcess value + (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers). + In addition, if HostProcess is true then HostNetwork must also be set to true. + type: boolean + runAsUserName: + description: |- + The UserName in Windows to run the entrypoint of the container process. + Defaults to the user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: string + startupProbe: + description: |- + StartupProbe indicates that the Pod the Sidecar is running in has successfully initialized. + If specified, no other probes are executed until this completes successfully. + If this probe fails, the Pod will be restarted, just as if the livenessProbe failed. + This can be used to provide different probe parameters at the beginning of a Pod's lifecycle, + when it might take a long time to load data or warm a cache, than during steady-state operation. + This cannot be updated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: object + properties: + exec: + description: Exec specifies a command to execute in the + container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + failureThreshold: + description: |- + Minimum consecutive failures for the probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. + type: integer + format: int32 + grpc: + description: GRPC specifies a GRPC HealthCheckRequest. + type: object + required: + - port + properties: + port: + description: Port number of the gRPC service. Number + must be in the range 1 to 65535. + type: integer + format: int32 + service: + description: |- + Service is the name of the service to place in the gRPC HealthCheckRequest + (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + + If this is not specified, the default behavior is defined by gRPC. + type: string + default: "" + httpGet: + description: HTTPGet specifies an HTTP GET request to + perform. + type: object + required: + - port + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + initialDelaySeconds: + description: |- + Number of seconds after the container has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + periodSeconds: + description: |- + How often (in seconds) to perform the probe. + Default to 10 seconds. Minimum value is 1. + type: integer + format: int32 + successThreshold: + description: |- + Minimum consecutive successes for the probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. + type: integer + format: int32 + tcpSocket: + description: TCPSocket specifies a connection to a TCP + port. + type: object + required: + - port + properties: + host: + description: 'Optional: Host name to connect to, defaults + to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + terminationGracePeriodSeconds: + description: |- + Optional duration in seconds the pod needs to terminate gracefully upon probe failure. + The grace period is the duration in seconds after the processes running in the pod are sent + a termination signal and the time when the processes are forcibly halted with a kill signal. + Set this value longer than the expected cleanup time for your process. + If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this + value overrides the value provided by the pod spec. + Value must be non-negative integer. The value zero indicates stop immediately via + the kill signal (no opportunity to shut down). + This is a beta field and requires enabling ProbeTerminationGracePeriod feature gate. + Minimum value is 1. spec.terminationGracePeriodSeconds is used if unset. + type: integer + format: int64 + timeoutSeconds: + description: |- + Number of seconds after which the probe times out. + Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + stdin: + description: |- + Whether this Sidecar should allocate a buffer for stdin in the container runtime. If this + is not set, reads from stdin in the Sidecar will always result in EOF. + Default is false. + type: boolean + stdinOnce: + description: |- + Whether the container runtime should close the stdin channel after it has been opened by + a single attach. When stdin is true the stdin stream will remain open across multiple attach + sessions. If stdinOnce is set to true, stdin is opened on Sidecar start, is empty until the + first client attaches to stdin, and then remains open and accepts data until the client disconnects, + at which time stdin is closed and remains closed until the Sidecar is restarted. If this + flag is false, a container processes that reads from stdin will never receive an EOF. + Default is false + type: boolean + terminationMessagePath: + description: |- + Optional: Path at which the file to which the Sidecar's termination message + will be written is mounted into the Sidecar's filesystem. + Message written is intended to be brief final status, such as an assertion failure message. + Will be truncated by the node if greater than 4096 bytes. The total message length across + all containers will be limited to 12kb. + Defaults to /dev/termination-log. + Cannot be updated. + type: string + terminationMessagePolicy: + description: |- + Indicate how the termination message should be populated. File will use the contents of + terminationMessagePath to populate the Sidecar status message on both success and failure. + FallbackToLogsOnError will use the last chunk of Sidecar log output if the termination + message file is empty and the Sidecar exited with an error. + The log output is limited to 2048 bytes or 80 lines, whichever is smaller. + Defaults to File. + Cannot be updated. + type: string + tty: + description: |- + Whether this Sidecar should allocate a TTY for itself, also requires 'stdin' to be true. + Default is false. + type: boolean + volumeDevices: + description: volumeDevices is the list of block devices to + be used by the Sidecar. + type: array + items: + description: volumeDevice describes a mapping of a raw block + device within a container. + type: object + required: + - devicePath + - name + properties: + devicePath: + description: devicePath is the path inside of the container + that the device will be mapped to. + type: string + name: + description: name must match the name of a persistentVolumeClaim + in the pod + type: string + x-kubernetes-list-type: atomic + volumeMounts: + description: |- + Volumes to mount into the Sidecar's filesystem. + Cannot be updated. + type: array + items: + description: VolumeMount describes a mounting of a Volume + within a container. + type: object + required: + - mountPath + - name + properties: + mountPath: + description: |- + Path within the container at which the volume should be mounted. Must + not contain ':'. + type: string + mountPropagation: + description: |- + mountPropagation determines how mounts are propagated from the host + to container and the other way around. + When not set, MountPropagationNone is used. + This field is beta in 1.10. + When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified + (which defaults to None). + type: string + name: + description: This must match the Name of a Volume. + type: string + readOnly: + description: |- + Mounted read-only if true, read-write otherwise (false or unspecified). + Defaults to false. + type: boolean + recursiveReadOnly: + description: |- + RecursiveReadOnly specifies whether read-only mounts should be handled + recursively. + + If ReadOnly is false, this field has no meaning and must be unspecified. + + If ReadOnly is true, and this field is set to Disabled, the mount is not made + recursively read-only. If this field is set to IfPossible, the mount is made + recursively read-only, if it is supported by the container runtime. If this + field is set to Enabled, the mount is made recursively read-only if it is + supported by the container runtime, otherwise the pod will not be started and + an error will be generated to indicate the reason. + + If this field is set to IfPossible or Enabled, MountPropagation must be set to + None (or be unspecified, which defaults to None). + + If this field is not specified, it is treated as an equivalent of Disabled. + type: string + subPath: + description: |- + Path within the volume from which the container's volume should be mounted. + Defaults to "" (volume's root). + type: string + subPathExpr: + description: |- + Expanded path within the volume from which the container's volume should be mounted. + Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment. + Defaults to "" (volume's root). + SubPathExpr and SubPath are mutually exclusive. + type: string + x-kubernetes-list-type: atomic + workingDir: + description: |- + Sidecar's working directory. + If not specified, the container runtime's default will be used, which + might be configured in the container image. + Cannot be updated. + type: string + workspaces: + description: |- + This is an alpha field. You must set the "enable-api-fields" feature flag to "alpha" + for this field to be supported. + + Workspaces is a list of workspaces from the Task that this Sidecar wants + exclusive access to. Adding a workspace to this list means that any + other Step or Sidecar that does not also request this Workspace will + not have access to it. + type: array + items: + description: |- + WorkspaceUsage is used by a Step or Sidecar to declare that it wants isolated access + to a Workspace defined in a Task. + type: object + required: + - mountPath + - name + properties: + mountPath: + description: |- + MountPath is the path that the workspace should be mounted to inside the Step or Sidecar, + overriding any MountPath specified in the Task's WorkspaceDeclaration. + type: string + name: + description: Name is the name of the workspace this + Step or Sidecar wants access to. + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + stepTemplate: + description: |- + StepTemplate can be used as the basis for all step containers within the + Task, so that the steps inherit settings on the base container. + type: object + properties: + args: + description: |- + Arguments to the entrypoint. + The image's CMD is used if this is not provided. + Variable references $(VAR_NAME) are expanded using the Step's environment. If a variable + cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will + produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless + of whether the variable exists or not. Cannot be updated. + More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell + type: array + items: + type: string + x-kubernetes-list-type: atomic + command: + description: |- + Entrypoint array. Not executed within a shell. + The image's ENTRYPOINT is used if this is not provided. + Variable references $(VAR_NAME) are expanded using the Step's environment. If a variable + cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will + produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless + of whether the variable exists or not. Cannot be updated. + More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell + type: array + items: + type: string + x-kubernetes-list-type: atomic + computeResources: + description: |- + ComputeResources required by this Step. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This field depends on the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + type: array + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + type: object + required: + - name + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + requests: + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + env: + description: |- + List of environment variables to set in the Step. + Cannot be updated. + type: array + items: + description: EnvVar represents an environment variable present + in a Container. + type: object + required: + - name + properties: + name: + description: |- + Name of the environment variable. + May consist of any printable ASCII characters except '='. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's value. + Cannot be used if value is not empty. + type: object + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + type: object + required: + - key + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap or + its key must be defined + type: boolean + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + type: object + required: + - fieldPath + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in the + specified API version. + type: string + x-kubernetes-map-type: atomic + fileKeyRef: + description: |- + FileKeyRef selects a key of the env file. + Requires the EnvFiles feature gate to be enabled. + type: object + required: + - key + - path + - volumeName + properties: + key: + description: |- + The key within the env file. An invalid key will prevent the pod from starting. + The keys defined within a source may consist of any printable ASCII characters except '='. + During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters. + type: string + optional: + description: |- + Specify whether the file or its key must be defined. If the file or key + does not exist, then the env var is not published. + If optional is set to true and the specified key does not exist, + the environment variable will not be set in the Pod's containers. + + If optional is set to false and the specified key does not exist, + an error will be returned during Pod creation. + type: boolean + default: false + path: + description: |- + The path within the volume from which to select the file. + Must be relative and may not contain the '..' path or start with '..'. + type: string + volumeName: + description: The name of the volume mount containing + the env file. + type: string + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + type: object + required: + - resource + properties: + containerName: + description: 'Container name: required for volumes, + optional for env vars' + type: string + divisor: + description: Specifies the output format of the + exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the pod's + namespace + type: object + required: + - key + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret or its + key must be defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + envFrom: + description: |- + List of sources to populate environment variables in the Step. + The keys defined within a source must be a C_IDENTIFIER. All invalid keys + will be reported as an event when the Step is starting. When a key exists in multiple + sources, the value associated with the last source will take precedence. + Values defined by an Env with a duplicate key will take precedence. + Cannot be updated. + type: array + items: + description: EnvFromSource represents the source of a set + of ConfigMaps or Secrets + type: object + properties: + configMapRef: + description: The ConfigMap to select from + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap must be + defined + type: boolean + x-kubernetes-map-type: atomic + prefix: + description: |- + Optional text to prepend to the name of each environment variable. + May consist of any printable ASCII characters except '='. + type: string + secretRef: + description: The Secret to select from + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret must be defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + image: + description: |- + Image reference name. + More info: https://kubernetes.io/docs/concepts/containers/images + type: string + imagePullPolicy: + description: |- + Image pull policy. + One of Always, Never, IfNotPresent. + Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/containers/images#updating-images + type: string + securityContext: + description: |- + SecurityContext defines the security options the Step should be run with. + If set, the fields of SecurityContext override the equivalent fields of PodSecurityContext. + More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ + type: object + properties: + allowPrivilegeEscalation: + description: |- + AllowPrivilegeEscalation controls whether a process can gain more + privileges than its parent process. This bool directly controls if + the no_new_privs flag will be set on the container process. + AllowPrivilegeEscalation is true always when the container is: + 1) run as Privileged + 2) has CAP_SYS_ADMIN + Note that this field cannot be set when spec.os.name is windows. + type: boolean + appArmorProfile: + description: |- + appArmorProfile is the AppArmor options to use by this container. If set, this profile + overrides the pod's appArmorProfile. + Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile loaded on the node that should be used. + The profile must be preconfigured on the node to work. + Must match the loaded name of the profile. + Must be set if and only if type is "Localhost". + type: string + type: + description: |- + type indicates which kind of AppArmor profile will be applied. + Valid options are: + Localhost - a profile pre-loaded on the node. + RuntimeDefault - the container runtime's default profile. + Unconfined - no AppArmor enforcement. + type: string + capabilities: + description: |- + The capabilities to add/drop when running containers. + Defaults to the default set of capabilities granted by the container runtime. + Note that this field cannot be set when spec.os.name is windows. + type: object + properties: + add: + description: Added capabilities + type: array + items: + description: Capability represent POSIX capabilities + type + type: string + x-kubernetes-list-type: atomic + drop: + description: Removed capabilities + type: array + items: + description: Capability represent POSIX capabilities + type + type: string + x-kubernetes-list-type: atomic + privileged: + description: |- + Run container in privileged mode. + Processes in privileged containers are essentially equivalent to root on the host. + Defaults to false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + procMount: + description: |- + procMount denotes the type of proc mount to use for the containers. + The default value is Default which uses the container runtime defaults for + readonly paths and masked paths. + This requires the ProcMountType feature flag to be enabled. + Note that this field cannot be set when spec.os.name is windows. + type: string + readOnlyRootFilesystem: + description: |- + Whether this container has a read-only root filesystem. + Default is false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + runAsGroup: + description: |- + The GID to run the entrypoint of the container process. + Uses runtime default if unset. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + runAsNonRoot: + description: |- + Indicates that the container must run as a non-root user. + If true, the Kubelet will validate the image at runtime to ensure that it + does not run as UID 0 (root) and fail to start the container if it does. + If unset or false, no such validation will be performed. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: boolean + runAsUser: + description: |- + The UID to run the entrypoint of the container process. + Defaults to user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + seLinuxOptions: + description: |- + The SELinux context to be applied to the container. + If unspecified, the container runtime will allocate a random SELinux context for each + container. May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: object + properties: + level: + description: Level is SELinux level label that applies + to the container. + type: string + role: + description: Role is a SELinux role label that applies + to the container. + type: string + type: + description: Type is a SELinux type label that applies + to the container. + type: string + user: + description: User is a SELinux user label that applies + to the container. + type: string + seccompProfile: + description: |- + The seccomp options to use by this container. If seccomp options are + provided at both the pod & container level, the container options + override the pod options. + Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile defined in a file on the node should be used. + The profile must be preconfigured on the node to work. + Must be a descending path, relative to the kubelet's configured seccomp profile location. + Must be set if type is "Localhost". Must NOT be set for any other type. + type: string + type: + description: |- + type indicates which kind of seccomp profile will be applied. + Valid options are: + + Localhost - a profile defined in a file on the node should be used. + RuntimeDefault - the container runtime default profile should be used. + Unconfined - no profile should be applied. + type: string + windowsOptions: + description: |- + The Windows specific settings applied to all containers. + If unspecified, the options from the PodSecurityContext will be used. + If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is linux. + type: object + properties: + gmsaCredentialSpec: + description: |- + GMSACredentialSpec is where the GMSA admission webhook + (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the + GMSA credential spec named by the GMSACredentialSpecName field. + type: string + gmsaCredentialSpecName: + description: GMSACredentialSpecName is the name of the + GMSA credential spec to use. + type: string + hostProcess: + description: |- + HostProcess determines if a container should be run as a 'Host Process' container. + All of a Pod's containers must have the same effective HostProcess value + (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers). + In addition, if HostProcess is true then HostNetwork must also be set to true. + type: boolean + runAsUserName: + description: |- + The UserName in Windows to run the entrypoint of the container process. + Defaults to the user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: string + volumeDevices: + description: volumeDevices is the list of block devices to be + used by the Step. + type: array + items: + description: volumeDevice describes a mapping of a raw block + device within a container. + type: object + required: + - devicePath + - name + properties: + devicePath: + description: devicePath is the path inside of the container + that the device will be mapped to. + type: string + name: + description: name must match the name of a persistentVolumeClaim + in the pod + type: string + x-kubernetes-list-type: atomic + volumeMounts: + description: |- + Volumes to mount into the Step's filesystem. + Cannot be updated. + type: array + items: + description: VolumeMount describes a mounting of a Volume + within a container. + type: object + required: + - mountPath + - name + properties: + mountPath: + description: |- + Path within the container at which the volume should be mounted. Must + not contain ':'. + type: string + mountPropagation: + description: |- + mountPropagation determines how mounts are propagated from the host + to container and the other way around. + When not set, MountPropagationNone is used. + This field is beta in 1.10. + When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified + (which defaults to None). + type: string + name: + description: This must match the Name of a Volume. + type: string + readOnly: + description: |- + Mounted read-only if true, read-write otherwise (false or unspecified). + Defaults to false. + type: boolean + recursiveReadOnly: + description: |- + RecursiveReadOnly specifies whether read-only mounts should be handled + recursively. + + If ReadOnly is false, this field has no meaning and must be unspecified. + + If ReadOnly is true, and this field is set to Disabled, the mount is not made + recursively read-only. If this field is set to IfPossible, the mount is made + recursively read-only, if it is supported by the container runtime. If this + field is set to Enabled, the mount is made recursively read-only if it is + supported by the container runtime, otherwise the pod will not be started and + an error will be generated to indicate the reason. + + If this field is set to IfPossible or Enabled, MountPropagation must be set to + None (or be unspecified, which defaults to None). + + If this field is not specified, it is treated as an equivalent of Disabled. + type: string + subPath: + description: |- + Path within the volume from which the container's volume should be mounted. + Defaults to "" (volume's root). + type: string + subPathExpr: + description: |- + Expanded path within the volume from which the container's volume should be mounted. + Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment. + Defaults to "" (volume's root). + SubPathExpr and SubPath are mutually exclusive. + type: string + x-kubernetes-list-type: atomic + workingDir: + description: |- + Step's working directory. + If not specified, the container runtime's default will be used, which + might be configured in the container image. + Cannot be updated. + type: string + steps: + description: |- + Steps are the steps of the build; each step is run sequentially with the + source mounted into /workspace. + type: array + items: + description: Step runs a subcomponent of a Task + type: object + required: + - name + properties: + args: + description: |- + Arguments to the entrypoint. + The image's CMD is used if this is not provided. + Variable references $(VAR_NAME) are expanded using the container's environment. If a variable + cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will + produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless + of whether the variable exists or not. Cannot be updated. + More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell + type: array + items: + type: string + x-kubernetes-list-type: atomic + command: + description: |- + Entrypoint array. Not executed within a shell. + The image's ENTRYPOINT is used if this is not provided. + Variable references $(VAR_NAME) are expanded using the container's environment. If a variable + cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will + produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless + of whether the variable exists or not. Cannot be updated. + More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell + type: array + items: + type: string + x-kubernetes-list-type: atomic + computeResources: + description: |- + ComputeResources required by this Step. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This field depends on the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + type: array + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + type: object + required: + - name + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + requests: + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + displayName: + description: |- + DisplayName is a user-facing name of the step that may be + used to populate a UI. + type: string + env: + description: |- + List of environment variables to set in the Step. + Cannot be updated. + type: array + items: + description: EnvVar represents an environment variable present + in a Container. + type: object + required: + - name + properties: + name: + description: |- + Name of the environment variable. + May consist of any printable ASCII characters except '='. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's value. + Cannot be used if value is not empty. + type: object + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + type: object + required: + - key + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap or + its key must be defined + type: boolean + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + type: object + required: + - fieldPath + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in + the specified API version. + type: string + x-kubernetes-map-type: atomic + fileKeyRef: + description: |- + FileKeyRef selects a key of the env file. + Requires the EnvFiles feature gate to be enabled. + type: object + required: + - key + - path + - volumeName + properties: + key: + description: |- + The key within the env file. An invalid key will prevent the pod from starting. + The keys defined within a source may consist of any printable ASCII characters except '='. + During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters. + type: string + optional: + description: |- + Specify whether the file or its key must be defined. If the file or key + does not exist, then the env var is not published. + If optional is set to true and the specified key does not exist, + the environment variable will not be set in the Pod's containers. + + If optional is set to false and the specified key does not exist, + an error will be returned during Pod creation. + type: boolean + default: false + path: + description: |- + The path within the volume from which to select the file. + Must be relative and may not contain the '..' path or start with '..'. + type: string + volumeName: + description: The name of the volume mount containing + the env file. + type: string + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + type: object + required: + - resource + properties: + containerName: + description: 'Container name: required for volumes, + optional for env vars' + type: string + divisor: + description: Specifies the output format of + the exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the pod's + namespace + type: object + required: + - key + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret or its + key must be defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + envFrom: + description: |- + List of sources to populate environment variables in the Step. + The keys defined within a source must be a C_IDENTIFIER. All invalid keys + will be reported as an event when the Step is starting. When a key exists in multiple + sources, the value associated with the last source will take precedence. + Values defined by an Env with a duplicate key will take precedence. + Cannot be updated. + type: array + items: + description: EnvFromSource represents the source of a set + of ConfigMaps or Secrets + type: object + properties: + configMapRef: + description: The ConfigMap to select from + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap must + be defined + type: boolean + x-kubernetes-map-type: atomic + prefix: + description: |- + Optional text to prepend to the name of each environment variable. + May consist of any printable ASCII characters except '='. + type: string + secretRef: + description: The Secret to select from + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret must be + defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + image: + description: |- + Docker image name. + More info: https://kubernetes.io/docs/concepts/containers/images + type: string + imagePullPolicy: + description: |- + Image pull policy. + One of Always, Never, IfNotPresent. + Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/containers/images#updating-images + type: string + name: + description: |- + Name of the Step specified as a DNS_LABEL. + Each Step in a Task must have a unique name. + type: string + onError: + description: |- + OnError defines the exiting behavior of a container on error + can be set to [ continue | stopAndFail ] + type: string + params: + description: Params declares parameters passed to this step + action. + type: array + items: + description: Param declares an ParamValues to use for the + parameter called name. + type: object + required: + - name + - value + properties: + name: + type: string + value: + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + ref: + description: Contains the reference to an existing StepAction. + type: object + properties: + name: + description: Name of the referenced step + type: string + params: + description: |- + Params contains the parameters used to identify the + referenced Tekton resource. Example entries might include + "repo" or "path" but the set of params ultimately depends on + the chosen resolver. + type: array + items: + description: Param declares an ParamValues to use for + the parameter called name. + type: object + required: + - name + - value + properties: + name: + type: string + value: + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + resolver: + description: |- + Resolver is the name of the resolver that should perform + resolution of the referenced Tekton resource, such as "git". + type: string + results: + description: |- + Results declares StepResults produced by the Step. + + It can be used in an inlined Step when used to store Results to $(step.results.resultName.path). + It cannot be used when referencing StepActions using [v1.Step.Ref]. + The Results declared by the StepActions will be stored here instead. + type: array + items: + description: StepResult used to describe the Results of + a Step. + type: object + required: + - name + properties: + description: + description: Description is a human-readable description + of the result + type: string + name: + description: Name the given name + type: string + properties: + description: Properties is the JSON Schema properties + to support key-value pairs results. + type: object + additionalProperties: + description: PropertySpec defines the struct for object + keys + type: object + properties: + type: + description: |- + ParamType indicates the type of an input parameter; + Used to distinguish between a single string and an array of strings. + type: string + type: + description: The possible types are 'string', 'array', + and 'object', with 'string' as the default. + type: string + x-kubernetes-list-type: atomic + script: + description: |- + Script is the contents of an executable file to execute. + + If Script is not empty, the Step cannot have an Command and the Args will be passed to the Script. + type: string + securityContext: + description: |- + SecurityContext defines the security options the Step should be run with. + If set, the fields of SecurityContext override the equivalent fields of PodSecurityContext. + More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ + type: object + properties: + allowPrivilegeEscalation: + description: |- + AllowPrivilegeEscalation controls whether a process can gain more + privileges than its parent process. This bool directly controls if + the no_new_privs flag will be set on the container process. + AllowPrivilegeEscalation is true always when the container is: + 1) run as Privileged + 2) has CAP_SYS_ADMIN + Note that this field cannot be set when spec.os.name is windows. + type: boolean + appArmorProfile: + description: |- + appArmorProfile is the AppArmor options to use by this container. If set, this profile + overrides the pod's appArmorProfile. + Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile loaded on the node that should be used. + The profile must be preconfigured on the node to work. + Must match the loaded name of the profile. + Must be set if and only if type is "Localhost". + type: string + type: + description: |- + type indicates which kind of AppArmor profile will be applied. + Valid options are: + Localhost - a profile pre-loaded on the node. + RuntimeDefault - the container runtime's default profile. + Unconfined - no AppArmor enforcement. + type: string + capabilities: + description: |- + The capabilities to add/drop when running containers. + Defaults to the default set of capabilities granted by the container runtime. + Note that this field cannot be set when spec.os.name is windows. + type: object + properties: + add: + description: Added capabilities + type: array + items: + description: Capability represent POSIX capabilities + type + type: string + x-kubernetes-list-type: atomic + drop: + description: Removed capabilities + type: array + items: + description: Capability represent POSIX capabilities + type + type: string + x-kubernetes-list-type: atomic + privileged: + description: |- + Run container in privileged mode. + Processes in privileged containers are essentially equivalent to root on the host. + Defaults to false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + procMount: + description: |- + procMount denotes the type of proc mount to use for the containers. + The default value is Default which uses the container runtime defaults for + readonly paths and masked paths. + This requires the ProcMountType feature flag to be enabled. + Note that this field cannot be set when spec.os.name is windows. + type: string + readOnlyRootFilesystem: + description: |- + Whether this container has a read-only root filesystem. + Default is false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + runAsGroup: + description: |- + The GID to run the entrypoint of the container process. + Uses runtime default if unset. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + runAsNonRoot: + description: |- + Indicates that the container must run as a non-root user. + If true, the Kubelet will validate the image at runtime to ensure that it + does not run as UID 0 (root) and fail to start the container if it does. + If unset or false, no such validation will be performed. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: boolean + runAsUser: + description: |- + The UID to run the entrypoint of the container process. + Defaults to user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + seLinuxOptions: + description: |- + The SELinux context to be applied to the container. + If unspecified, the container runtime will allocate a random SELinux context for each + container. May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: object + properties: + level: + description: Level is SELinux level label that applies + to the container. + type: string + role: + description: Role is a SELinux role label that applies + to the container. + type: string + type: + description: Type is a SELinux type label that applies + to the container. + type: string + user: + description: User is a SELinux user label that applies + to the container. + type: string + seccompProfile: + description: |- + The seccomp options to use by this container. If seccomp options are + provided at both the pod & container level, the container options + override the pod options. + Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile defined in a file on the node should be used. + The profile must be preconfigured on the node to work. + Must be a descending path, relative to the kubelet's configured seccomp profile location. + Must be set if type is "Localhost". Must NOT be set for any other type. + type: string + type: + description: |- + type indicates which kind of seccomp profile will be applied. + Valid options are: + + Localhost - a profile defined in a file on the node should be used. + RuntimeDefault - the container runtime default profile should be used. + Unconfined - no profile should be applied. + type: string + windowsOptions: + description: |- + The Windows specific settings applied to all containers. + If unspecified, the options from the PodSecurityContext will be used. + If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is linux. + type: object + properties: + gmsaCredentialSpec: + description: |- + GMSACredentialSpec is where the GMSA admission webhook + (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the + GMSA credential spec named by the GMSACredentialSpecName field. + type: string + gmsaCredentialSpecName: + description: GMSACredentialSpecName is the name of + the GMSA credential spec to use. + type: string + hostProcess: + description: |- + HostProcess determines if a container should be run as a 'Host Process' container. + All of a Pod's containers must have the same effective HostProcess value + (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers). + In addition, if HostProcess is true then HostNetwork must also be set to true. + type: boolean + runAsUserName: + description: |- + The UserName in Windows to run the entrypoint of the container process. + Defaults to the user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: string + stderrConfig: + description: Stores configuration for the stderr stream of + the step. + type: object + properties: + path: + description: Path to duplicate stdout stream to on container's + local filesystem. + type: string + stdoutConfig: + description: Stores configuration for the stdout stream of + the step. + type: object + properties: + path: + description: Path to duplicate stdout stream to on container's + local filesystem. + type: string + timeout: + description: |- + Timeout is the time after which the step times out. Defaults to never. + Refer to Go's ParseDuration documentation for expected format: https://golang.org/pkg/time/#ParseDuration + type: string + volumeDevices: + description: volumeDevices is the list of block devices to + be used by the Step. + type: array + items: + description: volumeDevice describes a mapping of a raw block + device within a container. + type: object + required: + - devicePath + - name + properties: + devicePath: + description: devicePath is the path inside of the container + that the device will be mapped to. + type: string + name: + description: name must match the name of a persistentVolumeClaim + in the pod + type: string + x-kubernetes-list-type: atomic + volumeMounts: + description: |- + Volumes to mount into the Step's filesystem. + Cannot be updated. + type: array + items: + description: VolumeMount describes a mounting of a Volume + within a container. + type: object + required: + - mountPath + - name + properties: + mountPath: + description: |- + Path within the container at which the volume should be mounted. Must + not contain ':'. + type: string + mountPropagation: + description: |- + mountPropagation determines how mounts are propagated from the host + to container and the other way around. + When not set, MountPropagationNone is used. + This field is beta in 1.10. + When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified + (which defaults to None). + type: string + name: + description: This must match the Name of a Volume. + type: string + readOnly: + description: |- + Mounted read-only if true, read-write otherwise (false or unspecified). + Defaults to false. + type: boolean + recursiveReadOnly: + description: |- + RecursiveReadOnly specifies whether read-only mounts should be handled + recursively. + + If ReadOnly is false, this field has no meaning and must be unspecified. + + If ReadOnly is true, and this field is set to Disabled, the mount is not made + recursively read-only. If this field is set to IfPossible, the mount is made + recursively read-only, if it is supported by the container runtime. If this + field is set to Enabled, the mount is made recursively read-only if it is + supported by the container runtime, otherwise the pod will not be started and + an error will be generated to indicate the reason. + + If this field is set to IfPossible or Enabled, MountPropagation must be set to + None (or be unspecified, which defaults to None). + + If this field is not specified, it is treated as an equivalent of Disabled. + type: string + subPath: + description: |- + Path within the volume from which the container's volume should be mounted. + Defaults to "" (volume's root). + type: string + subPathExpr: + description: |- + Expanded path within the volume from which the container's volume should be mounted. + Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment. + Defaults to "" (volume's root). + SubPathExpr and SubPath are mutually exclusive. + type: string + x-kubernetes-list-type: atomic + when: + description: When is a list of when expressions that need + to be true for the task to run + type: array + items: + description: |- + WhenExpression allows a PipelineTask to declare expressions to be evaluated before the Task is run + to determine whether the Task should be executed or skipped + type: object + properties: + cel: + description: |- + CEL is a string of Common Language Expression, which can be used to conditionally execute + the task based on the result of the expression evaluation + More info about CEL syntax: https://github.com/google/cel-spec/blob/master/doc/langdef.md + type: string + input: + description: Input is the string for guard checking + which can be a static input or an output from a parent + Task + type: string + operator: + description: Operator that represents an Input's relationship + to the values + type: string + values: + description: |- + Values is an array of strings, which is compared against the input, for guard checking + It must be non-empty + type: array + items: + type: string + x-kubernetes-list-type: atomic + workingDir: + description: |- + Step's working directory. + If not specified, the container runtime's default will be used, which + might be configured in the container image. + Cannot be updated. + type: string + workspaces: + description: |- + This is an alpha field. You must set the "enable-api-fields" feature flag to "alpha" + for this field to be supported. + + Workspaces is a list of workspaces from the Task that this Step wants + exclusive access to. Adding a workspace to this list means that any + other Step or Sidecar that does not also request this Workspace will + not have access to it. + type: array + items: + description: |- + WorkspaceUsage is used by a Step or Sidecar to declare that it wants isolated access + to a Workspace defined in a Task. + type: object + required: + - mountPath + - name + properties: + mountPath: + description: |- + MountPath is the path that the workspace should be mounted to inside the Step or Sidecar, + overriding any MountPath specified in the Task's WorkspaceDeclaration. + type: string + name: + description: Name is the name of the workspace this + Step or Sidecar wants access to. + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + volumes: + description: |- + Volumes is a collection of volumes that are available to mount into the + steps of the build. + See Pod.spec.volumes (API version: v1) + x-kubernetes-preserve-unknown-fields: true + workspaces: + description: Workspaces are the volumes that this Task requires. + type: array + items: + description: WorkspaceDeclaration is a declaration of a volume + that a Task requires. + type: object + required: + - name + properties: + description: + description: Description is an optional human readable description + of this volume. + type: string + mountPath: + description: MountPath overrides the directory that the volume + will be made available at. + type: string + name: + description: Name is the name by which you can bind the volume + at runtime. + type: string + optional: + description: |- + Optional marks a Workspace as not being required in TaskRuns. By default + this field is false and so declared workspaces are required. + type: boolean + readOnly: + description: |- + ReadOnly dictates whether a mounted volume is writable. By default this + field is false and so mounted volumes are writable. + type: boolean + x-kubernetes-list-type: atomic + # Opt into the status subresource so metadata.generation + # starts to increment + subresources: + status: {} + names: + kind: Task + plural: tasks + singular: task + categories: + - tekton + - tekton-pipelines + scope: Namespaced + conversion: + strategy: Webhook + webhook: + conversionReviewVersions: ["v1beta1", "v1"] + clientConfig: + service: + name: tekton-pipelines-webhook + namespace: tekton-pipelines +--- +# Copyright 2019 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: taskruns.tekton.dev + labels: + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines + pipeline.tekton.dev/release: "v1.15.0" + version: "v1.15.0" +spec: + group: tekton.dev + preserveUnknownFields: false + versions: + - name: v1beta1 + served: true + storage: false + schema: + openAPIV3Schema: + description: |- + TaskRun + Deprecated: Please use v1.TaskRun instead. + type: object + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: Spec + type: object + properties: + computeResources: + description: ComputeResources + type: object + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This field depends on the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + type: array + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + type: object + required: + - name + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + requests: + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + debug: + description: Debug + type: object + properties: + breakpoints: + description: Breakpoints + type: object + properties: + beforeSteps: + description: BeforeSteps + type: array + items: + type: string + x-kubernetes-list-type: atomic + onFailure: + description: OnFailure + type: string + managedBy: + description: ManagedBy + type: string + params: + description: Params + type: array + items: + description: Param + type: object + required: + - name + - value + properties: + name: + type: string + value: + description: Value + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + podTemplate: + description: PodTemplate + type: object + properties: + affinity: + description: |- + If specified, the pod's scheduling constraints. + See Pod.spec.affinity (API version: v1) + x-kubernetes-preserve-unknown-fields: true + automountServiceAccountToken: + description: |- + AutomountServiceAccountToken indicates whether pods running as this + service account should have an API token automatically mounted. + type: boolean + dnsConfig: + description: |- + Specifies the DNS parameters of a pod. + Parameters specified here will be merged to the generated DNS + configuration based on DNSPolicy. + type: object + properties: + nameservers: + description: |- + A list of DNS name server IP addresses. + This will be appended to the base nameservers generated from DNSPolicy. + Duplicated nameservers will be removed. + type: array + items: + type: string + x-kubernetes-list-type: atomic + options: + description: |- + A list of DNS resolver options. + This will be merged with the base options generated from DNSPolicy. + Duplicated entries will be removed. Resolution options given in Options + will override those that appear in the base DNSPolicy. + type: array + items: + description: PodDNSConfigOption defines DNS resolver options + of a pod. + type: object + properties: + name: + description: |- + Name is this DNS resolver option's name. + Required. + type: string + value: + description: Value is this DNS resolver option's value. + type: string + x-kubernetes-list-type: atomic + searches: + description: |- + A list of DNS search domains for host-name lookup. + This will be appended to the base search paths generated from DNSPolicy. + Duplicated search paths will be removed. + type: array + items: + type: string + x-kubernetes-list-type: atomic + dnsPolicy: + description: |- + Set DNS policy for the pod. Defaults to "ClusterFirst". Valid values are + 'ClusterFirst', 'Default' or 'None'. DNS parameters given in DNSConfig + will be merged with the policy selected with DNSPolicy. + type: string + enableServiceLinks: + description: |- + EnableServiceLinks indicates whether information about services should be injected into pod's + environment variables, matching the syntax of Docker links. + Optional: Defaults to true. + type: boolean + env: + description: List of environment variables that can be provided + to the containers belonging to the pod. + type: array + items: + description: EnvVar represents an environment variable present + in a Container. + type: object + required: + - name + properties: + name: + description: |- + Name of the environment variable. + May consist of any printable ASCII characters except '='. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's value. + Cannot be used if value is not empty. + type: object + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + type: object + required: + - key + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap or + its key must be defined + type: boolean + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + type: object + required: + - fieldPath + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in the + specified API version. + type: string + x-kubernetes-map-type: atomic + fileKeyRef: + description: |- + FileKeyRef selects a key of the env file. + Requires the EnvFiles feature gate to be enabled. + type: object + required: + - key + - path + - volumeName + properties: + key: + description: |- + The key within the env file. An invalid key will prevent the pod from starting. + The keys defined within a source may consist of any printable ASCII characters except '='. + During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters. + type: string + optional: + description: |- + Specify whether the file or its key must be defined. If the file or key + does not exist, then the env var is not published. + If optional is set to true and the specified key does not exist, + the environment variable will not be set in the Pod's containers. + + If optional is set to false and the specified key does not exist, + an error will be returned during Pod creation. + type: boolean + default: false + path: + description: |- + The path within the volume from which to select the file. + Must be relative and may not contain the '..' path or start with '..'. + type: string + volumeName: + description: The name of the volume mount containing + the env file. + type: string + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + type: object + required: + - resource + properties: + containerName: + description: 'Container name: required for volumes, + optional for env vars' + type: string + divisor: + description: Specifies the output format of the + exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the pod's + namespace + type: object + required: + - key + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret or its + key must be defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + hostAliases: + description: |- + HostAliases is an optional list of hosts and IPs that will be injected into the pod's hosts + file if specified. This is only valid for non-hostNetwork pods. + type: array + items: + description: |- + HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the + pod's hosts file. + type: object + required: + - ip + properties: + hostnames: + description: Hostnames for the above IP address. + type: array + items: + type: string + x-kubernetes-list-type: atomic + ip: + description: IP address of the host file entry. + type: string + x-kubernetes-list-type: atomic + hostNetwork: + description: HostNetwork specifies whether the pod may use the + node network namespace + type: boolean + hostUsers: + description: |- + HostUsers indicates whether the pod will use the host's user namespace. + Optional: Default to true. + If set to true or not present, the pod will be run in the host user namespace, useful + for when the pod needs a feature only available to the host user namespace, such as + loading a kernel module with CAP_SYS_MODULE. + When set to false, a new user namespace is created for the pod. Setting false + is useful to mitigating container breakout vulnerabilities such as allowing + containers to run as root without their user having root privileges on the host. + This field depends on the kubernetes feature gate UserNamespacesSupport being enabled. + type: boolean + imagePullSecrets: + description: ImagePullSecrets gives the name of the secret used + by the pod to pull the image if specified + type: array + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + nodeSelector: + description: |- + NodeSelector is a selector which must be true for the pod to fit on a node. + Selector which must match a node's labels for the pod to be scheduled on that node. + More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ + type: object + additionalProperties: + type: string + priorityClassName: + description: |- + If specified, indicates the pod's priority. "system-node-critical" and + "system-cluster-critical" are two special keywords which indicate the + highest priorities with the former being the highest priority. Any other + name must be defined by creating a PriorityClass object with that name. + If not specified, the pod priority will be default or zero if there is no + default. + type: string + runtimeClassName: + description: |- + RuntimeClassName refers to a RuntimeClass object in the node.k8s.io + group, which should be used to run this pod. If no RuntimeClass resource + matches the named class, the pod will not be run. If unset or empty, the + "legacy" RuntimeClass will be used, which is an implicit class with an + empty definition that uses the default runtime handler. + More info: https://git.k8s.io/enhancements/keps/sig-node/runtime-class.md + This is a beta feature as of Kubernetes v1.14. + type: string + schedulerName: + description: SchedulerName specifies the scheduler to be used + to dispatch the Pod + type: string + securityContext: + description: |- + SecurityContext holds pod-level security attributes and common container settings. + Optional: Defaults to empty. See type description for default values of each field. + See Pod.spec.securityContext (API version: v1) + x-kubernetes-preserve-unknown-fields: true + tolerations: + description: If specified, the pod's tolerations. + type: array + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + type: object + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + type: integer + format: int64 + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + x-kubernetes-list-type: atomic + topologySpreadConstraints: + description: |- + TopologySpreadConstraints controls how Pods are spread across your cluster among + failure-domains such as regions, zones, nodes, and other user-defined topology domains. + type: array + items: + description: TopologySpreadConstraint specifies how to spread + matching pods among the given topology. + type: object + required: + - maxSkew + - topologyKey + - whenUnsatisfiable + properties: + labelSelector: + description: |- + LabelSelector is used to find matching pods. + Pods that match this label selector are counted to determine the number of pods + in their corresponding topology domain. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select the pods over which + spreading will be calculated. The keys are used to lookup values from the + incoming pod labels, those key-value labels are ANDed with labelSelector + to select the group of existing pods over which spreading will be calculated + for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + MatchLabelKeys cannot be set when LabelSelector isn't set. + Keys that don't exist in the incoming pod labels will + be ignored. A null or empty list means only match against labelSelector. + + This is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default). + type: array + items: + type: string + x-kubernetes-list-type: atomic + maxSkew: + description: |- + MaxSkew describes the degree to which pods may be unevenly distributed. + When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference + between the number of matching pods in the target topology and the global minimum. + The global minimum is the minimum number of matching pods in an eligible domain + or zero if the number of eligible domains is less than MinDomains. + For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same + labelSelector spread as 2/2/1: + In this case, the global minimum is 1. + | zone1 | zone2 | zone3 | + | P P | P P | P | + - if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2; + scheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2) + violate MaxSkew(1). + - if MaxSkew is 2, incoming pod can be scheduled onto any zone. + When `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence + to topologies that satisfy it. + It's a required field. Default value is 1 and 0 is not allowed. + type: integer + format: int32 + minDomains: + description: |- + MinDomains indicates a minimum number of eligible domains. + When the number of eligible domains with matching topology keys is less than minDomains, + Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed. + And when the number of eligible domains with matching topology keys equals or greater than minDomains, + this value has no effect on scheduling. + As a result, when the number of eligible domains is less than minDomains, + scheduler won't schedule more than maxSkew Pods to those domains. + If value is nil, the constraint behaves as if MinDomains is equal to 1. + Valid values are integers greater than 0. + When value is not nil, WhenUnsatisfiable must be DoNotSchedule. + + For example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same + labelSelector spread as 2/2/2: + | zone1 | zone2 | zone3 | + | P P | P P | P P | + The number of domains is less than 5(MinDomains), so "global minimum" is treated as 0. + In this situation, new pod with the same labelSelector cannot be scheduled, + because computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones, + it will violate MaxSkew. + type: integer + format: int32 + nodeAffinityPolicy: + description: |- + NodeAffinityPolicy indicates how we will treat Pod's nodeAffinity/nodeSelector + when calculating pod topology spread skew. Options are: + - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations. + - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations. + + If this value is nil, the behavior is equivalent to the Honor policy. + type: string + nodeTaintsPolicy: + description: |- + NodeTaintsPolicy indicates how we will treat node taints when calculating + pod topology spread skew. Options are: + - Honor: nodes without taints, along with tainted nodes for which the incoming pod + has a toleration, are included. + - Ignore: node taints are ignored. All nodes are included. + + If this value is nil, the behavior is equivalent to the Ignore policy. + type: string + topologyKey: + description: |- + TopologyKey is the key of node labels. Nodes that have a label with this key + and identical values are considered to be in the same topology. + We consider each as a "bucket", and try to put balanced number + of pods into each bucket. + We define a domain as a particular instance of a topology. + Also, we define an eligible domain as a domain whose nodes meet the requirements of + nodeAffinityPolicy and nodeTaintsPolicy. + e.g. If TopologyKey is "kubernetes.io/hostname", each Node is a domain of that topology. + And, if TopologyKey is "topology.kubernetes.io/zone", each zone is a domain of that topology. + It's a required field. + type: string + whenUnsatisfiable: + description: |- + WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy + the spread constraint. + - DoNotSchedule (default) tells the scheduler not to schedule it. + - ScheduleAnyway tells the scheduler to schedule the pod in any location, + but giving higher precedence to topologies that would help reduce the + skew. + A constraint is considered "Unsatisfiable" for an incoming pod + if and only if every possible node assignment for that pod would violate + "MaxSkew" on some topology. + For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same + labelSelector spread as 3/1/1: + | zone1 | zone2 | zone3 | + | P P P | P | P | + If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled + to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies + MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler + won't make it *more* imbalanced. + It's a required field. + type: string + x-kubernetes-list-type: atomic + volumes: + description: |- + List of volumes that can be mounted by containers belonging to the pod. + More info: https://kubernetes.io/docs/concepts/storage/volumes + See Pod.spec.volumes (API version: v1) + x-kubernetes-preserve-unknown-fields: true + resources: + description: |- + Resources + Deprecated: Unused, preserved only for backwards compatibility + type: object + properties: + inputs: + description: Inputs + type: array + items: + description: |- + TaskResourceBinding + Deprecated: Unused, preserved only for backwards compatibility + type: object + properties: + name: + description: Name + type: string + paths: + description: Paths + type: array + items: + type: string + x-kubernetes-list-type: atomic + resourceRef: + description: ResourceRef + type: object + properties: + apiVersion: + description: APIVersion + type: string + name: + description: Name + type: string + resourceSpec: + description: ResourceSpec + type: object + required: + - params + - type + properties: + description: + description: |- + Description is a user-facing description of the resource that may be + used to populate a UI. + type: string + params: + type: array + items: + description: |- + ResourceParam declares a string value to use for the parameter called Name, and is used in + the specific context of PipelineResources. + + Deprecated: Unused, preserved only for backwards compatibility + type: object + required: + - name + - value + properties: + name: + type: string + value: + type: string + x-kubernetes-list-type: atomic + secrets: + description: Secrets to fetch to populate some of + resource fields + type: array + items: + description: |- + SecretParam indicates which secret can be used to populate a field of the resource + + Deprecated: Unused, preserved only for backwards compatibility + type: object + required: + - fieldName + - secretKey + - secretName + properties: + fieldName: + type: string + secretKey: + type: string + secretName: + type: string + x-kubernetes-list-type: atomic + type: + description: |- + PipelineResourceType represents the type of endpoint the pipelineResource is, so that the + controller will know this pipelineResource shouldx be fetched and optionally what + additional metatdata should be provided for it. + + Deprecated: Unused, preserved only for backwards compatibility + type: string + x-kubernetes-list-type: atomic + outputs: + description: Outputs + type: array + items: + description: |- + TaskResourceBinding + Deprecated: Unused, preserved only for backwards compatibility + type: object + properties: + name: + description: Name + type: string + paths: + description: Paths + type: array + items: + type: string + x-kubernetes-list-type: atomic + resourceRef: + description: ResourceRef + type: object + properties: + apiVersion: + description: APIVersion + type: string + name: + description: Name + type: string + resourceSpec: + description: ResourceSpec + type: object + required: + - params + - type + properties: + description: + description: |- + Description is a user-facing description of the resource that may be + used to populate a UI. + type: string + params: + type: array + items: + description: |- + ResourceParam declares a string value to use for the parameter called Name, and is used in + the specific context of PipelineResources. + + Deprecated: Unused, preserved only for backwards compatibility + type: object + required: + - name + - value + properties: + name: + type: string + value: + type: string + x-kubernetes-list-type: atomic + secrets: + description: Secrets to fetch to populate some of + resource fields + type: array + items: + description: |- + SecretParam indicates which secret can be used to populate a field of the resource + + Deprecated: Unused, preserved only for backwards compatibility + type: object + required: + - fieldName + - secretKey + - secretName + properties: + fieldName: + type: string + secretKey: + type: string + secretName: + type: string + x-kubernetes-list-type: atomic + type: + description: |- + PipelineResourceType represents the type of endpoint the pipelineResource is, so that the + controller will know this pipelineResource shouldx be fetched and optionally what + additional metatdata should be provided for it. + + Deprecated: Unused, preserved only for backwards compatibility + type: string + x-kubernetes-list-type: atomic + retries: + description: Retries + type: integer + serviceAccountName: + description: ServiceAccountName + type: string + sidecarOverrides: + description: SidecarOverrides + type: array + items: + description: TaskRunSidecarOverride + type: object + required: + - name + - resources + properties: + name: + description: Name + type: string + resources: + description: Resources + type: object + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This field depends on the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + type: array + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + type: object + required: + - name + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + requests: + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + x-kubernetes-list-type: atomic + status: + description: Status + type: string + statusMessage: + description: StatusMessage + type: string + stepOverrides: + description: StepOverrides + type: array + items: + description: TaskRunStepOverride + type: object + required: + - name + - resources + properties: + name: + description: Name + type: string + resources: + description: Resources + type: object + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This field depends on the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + type: array + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + type: object + required: + - name + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + requests: + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + x-kubernetes-list-type: atomic + taskRef: + description: TaskRef + type: object + properties: + apiVersion: + description: APIVersion + type: string + bundle: + description: |- + Deprecated: Please use ResolverRef with the bundles resolver instead. + Bundle + type: string + kind: + description: Kind + type: string + name: + description: Name + type: string + params: + description: Params + type: array + items: + description: Param + type: object + required: + - name + - value + properties: + name: + type: string + value: + description: Value + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + resolver: + description: Resolver + type: string + taskSpec: + description: TaskSpec + x-kubernetes-preserve-unknown-fields: true + timeout: + description: Timeout + type: string + workspaces: + description: Workspaces + type: array + items: + description: WorkspaceBinding + type: object + required: + - name + properties: + configMap: + description: ConfigMap + type: object + properties: + defaultMode: + description: |- + defaultMode is optional: mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + Defaults to 0644. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + ConfigMap will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the ConfigMap, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: optional specify whether the ConfigMap or + its keys must be defined + type: boolean + x-kubernetes-map-type: atomic + csi: + description: CSI + type: object + required: + - driver + properties: + driver: + description: |- + driver is the name of the CSI driver that handles this volume. + Consult with your admin for the correct name as registered in the cluster. + type: string + fsType: + description: |- + fsType to mount. Ex. "ext4", "xfs", "ntfs". + If not provided, the empty value is passed to the associated CSI driver + which will determine the default filesystem to apply. + type: string + nodePublishSecretRef: + description: |- + nodePublishSecretRef is a reference to the secret object containing + sensitive information to pass to the CSI driver to complete the CSI + NodePublishVolume and NodeUnpublishVolume calls. + This field is optional, and may be empty if no secret is required. If the + secret object contains more than one secret, all secret references are passed. + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + x-kubernetes-map-type: atomic + readOnly: + description: |- + readOnly specifies a read-only configuration for the volume. + Defaults to false (read/write). + type: boolean + volumeAttributes: + description: |- + volumeAttributes stores driver-specific properties that are passed to the CSI + driver. Consult your driver's documentation for supported values. + type: object + additionalProperties: + type: string + emptyDir: + description: EmptyDir + type: object + properties: + medium: + description: |- + medium represents what type of storage medium should back this directory. + The default is "" which means to use the node's default medium. + Must be an empty string (default) or Memory. + More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir + type: string + sizeLimit: + description: |- + sizeLimit is the total amount of local storage required for this EmptyDir volume. + The size limit is also applicable for memory medium. + The maximum usage on memory medium EmptyDir would be the minimum value between + the SizeLimit specified here and the sum of memory limits of all containers in a pod. + The default is nil which means that the limit is undefined. + More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + name: + description: Name + type: string + persistentVolumeClaim: + description: PersistentVolumeClaim + type: object + required: + - claimName + properties: + claimName: + description: |- + claimName is the name of a PersistentVolumeClaim in the same namespace as the pod using this volume. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims + type: string + readOnly: + description: |- + readOnly Will force the ReadOnly setting in VolumeMounts. + Default false. + type: boolean + projected: + description: Projected + type: object + properties: + defaultMode: + description: |- + defaultMode are the mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + sources: + description: |- + sources is the list of volume projections. Each entry in this list + handles one source. + type: array + items: + description: |- + Projection that may be projected along with other supported volume types. + Exactly one of these fields must be set. + type: object + properties: + clusterTrustBundle: + description: |- + ClusterTrustBundle allows a pod to access the `.spec.trustBundle` field + of ClusterTrustBundle objects in an auto-updating file. + + Alpha, gated by the ClusterTrustBundleProjection feature gate. + + ClusterTrustBundle objects can either be selected by name, or by the + combination of signer name and a label selector. + + Kubelet performs aggressive normalization of the PEM contents written + into the pod filesystem. Esoteric PEM features such as inter-block + comments and block headers are stripped. Certificates are deduplicated. + The ordering of certificates within the file is arbitrary, and Kubelet + may change the order over time. + type: object + required: + - path + properties: + labelSelector: + description: |- + Select all ClusterTrustBundles that match this label selector. Only has + effect if signerName is set. Mutually-exclusive with name. If unset, + interpreted as "match nothing". If set but empty, interpreted as "match + everything". + type: object + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + name: + description: |- + Select a single ClusterTrustBundle by object name. Mutually-exclusive + with signerName and labelSelector. + type: string + optional: + description: |- + If true, don't block pod startup if the referenced ClusterTrustBundle(s) + aren't available. If using name, then the named ClusterTrustBundle is + allowed not to exist. If using signerName, then the combination of + signerName and labelSelector is allowed to match zero + ClusterTrustBundles. + type: boolean + path: + description: Relative path from the volume root + to write the bundle. + type: string + signerName: + description: |- + Select all ClusterTrustBundles that match this signer name. + Mutually-exclusive with name. The contents of all selected + ClusterTrustBundles will be unified and deduplicated. + type: string + configMap: + description: configMap information about the configMap + data to project + type: object + properties: + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + ConfigMap will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the ConfigMap, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within + a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: optional specify whether the ConfigMap + or its keys must be defined + type: boolean + x-kubernetes-map-type: atomic + downwardAPI: + description: downwardAPI information about the downwardAPI + data to project + type: object + properties: + items: + description: Items is a list of DownwardAPIVolume + file + type: array + items: + description: DownwardAPIVolumeFile represents + information to create the file containing + the pod field + type: object + required: + - path + properties: + fieldRef: + description: 'Required: Selects a field + of the pod: only annotations, labels, + name, namespace and uid are supported.' + type: object + required: + - fieldPath + properties: + apiVersion: + description: Version of the schema + the FieldPath is written in terms + of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to + select in the specified API version. + type: string + x-kubernetes-map-type: atomic + mode: + description: |- + Optional: mode bits used to set permissions on this file, must be an octal value + between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: 'Required: Path is the relative + path name of the file to be created. + Must not be absolute or contain the + ''..'' path. Must be utf-8 encoded. + The first item of the relative path + must not start with ''..''' + type: string + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported. + type: object + required: + - resource + properties: + containerName: + description: 'Container name: required + for volumes, optional for env vars' + type: string + divisor: + description: Specifies the output + format of the exposed resources, + defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to + select' + type: string + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + podCertificate: + description: |- + Projects an auto-rotating credential bundle (private key and certificate + chain) that the pod can use either as a TLS client or server. + + Kubelet generates a private key and uses it to send a + PodCertificateRequest to the named signer. Once the signer approves the + request and issues a certificate chain, Kubelet writes the key and + certificate chain to the pod filesystem. The pod does not start until + certificates have been issued for each podCertificate projected volume + source in its spec. + + Kubelet will begin trying to rotate the certificate at the time indicated + by the signer using the PodCertificateRequest.Status.BeginRefreshAt + timestamp. + + Kubelet can write a single file, indicated by the credentialBundlePath + field, or separate files, indicated by the keyPath and + certificateChainPath fields. + + The credential bundle is a single file in PEM format. The first PEM + entry is the private key (in PKCS#8 format), and the remaining PEM + entries are the certificate chain issued by the signer (typically, + signers will return their certificate chain in leaf-to-root order). + + Prefer using the credential bundle format, since your application code + can read it atomically. If you use keyPath and certificateChainPath, + your application must make two separate file reads. If these coincide + with a certificate rotation, it is possible that the private key and leaf + certificate you read may not correspond to each other. Your application + will need to check for this condition, and re-read until they are + consistent. + + The named signer controls chooses the format of the certificate it + issues; consult the signer implementation's documentation to learn how to + use the certificates it issues. + type: object + required: + - keyType + - signerName + properties: + certificateChainPath: + description: |- + Write the certificate chain at this path in the projected volume. + + Most applications should use credentialBundlePath. When using keyPath + and certificateChainPath, your application needs to check that the key + and leaf certificate are consistent, because it is possible to read the + files mid-rotation. + type: string + credentialBundlePath: + description: |- + Write the credential bundle at this path in the projected volume. + + The credential bundle is a single file that contains multiple PEM blocks. + The first PEM block is a PRIVATE KEY block, containing a PKCS#8 private + key. + + The remaining blocks are CERTIFICATE blocks, containing the issued + certificate chain from the signer (leaf and any intermediates). + + Using credentialBundlePath lets your Pod's application code make a single + atomic read that retrieves a consistent key and certificate chain. If you + project them to separate files, your application code will need to + additionally check that the leaf certificate was issued to the key. + type: string + keyPath: + description: |- + Write the key at this path in the projected volume. + + Most applications should use credentialBundlePath. When using keyPath + and certificateChainPath, your application needs to check that the key + and leaf certificate are consistent, because it is possible to read the + files mid-rotation. + type: string + keyType: + description: |- + The type of keypair Kubelet will generate for the pod. + + Valid values are "RSA3072", "RSA4096", "ECDSAP256", "ECDSAP384", + "ECDSAP521", and "ED25519". + type: string + maxExpirationSeconds: + description: |- + maxExpirationSeconds is the maximum lifetime permitted for the + certificate. + + Kubelet copies this value verbatim into the PodCertificateRequests it + generates for this projection. + + If omitted, kube-apiserver will set it to 86400(24 hours). kube-apiserver + will reject values shorter than 3600 (1 hour). The maximum allowable + value is 7862400 (91 days). + + The signer implementation is then free to issue a certificate with any + lifetime *shorter* than MaxExpirationSeconds, but no shorter than 3600 + seconds (1 hour). This constraint is enforced by kube-apiserver. + `kubernetes.io` signers will never issue certificates with a lifetime + longer than 24 hours. + type: integer + format: int32 + signerName: + description: Kubelet's generated CSRs will be + addressed to this signer. + type: string + userAnnotations: + description: |- + userAnnotations allow pod authors to pass additional information to + the signer implementation. Kubernetes does not restrict or validate this + metadata in any way. + + These values are copied verbatim into the `spec.unverifiedUserAnnotations` field of + the PodCertificateRequest objects that Kubelet creates. + + Entries are subject to the same validation as object metadata annotations, + with the addition that all keys must be domain-prefixed. No restrictions + are placed on values, except an overall size limitation on the entire field. + + Signers should document the keys and values they support. Signers should + deny requests that contain keys they do not recognize. + type: object + additionalProperties: + type: string + secret: + description: secret information about the secret + data to project + type: object + properties: + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + Secret will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the Secret, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within + a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: optional field specify whether + the Secret or its key must be defined + type: boolean + x-kubernetes-map-type: atomic + serviceAccountToken: + description: serviceAccountToken is information + about the serviceAccountToken data to project + type: object + required: + - path + properties: + audience: + description: |- + audience is the intended audience of the token. A recipient of a token + must identify itself with an identifier specified in the audience of the + token, and otherwise should reject the token. The audience defaults to the + identifier of the apiserver. + type: string + expirationSeconds: + description: |- + expirationSeconds is the requested duration of validity of the service + account token. As the token approaches expiration, the kubelet volume + plugin will proactively rotate the service account token. The kubelet will + start trying to rotate the token if the token is older than 80 percent of + its time to live or if the token is older than 24 hours.Defaults to 1 hour + and must be at least 10 minutes. + type: integer + format: int64 + path: + description: |- + path is the path relative to the mount point of the file to project the + token into. + type: string + x-kubernetes-list-type: atomic + secret: + description: Secret + type: object + properties: + defaultMode: + description: |- + defaultMode is Optional: mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values + for mode bits. Defaults to 0644. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + items: + description: |- + items If unspecified, each key-value pair in the Data field of the referenced + Secret will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the Secret, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + optional: + description: optional field specify whether the Secret + or its keys must be defined + type: boolean + secretName: + description: |- + secretName is the name of the secret in the pod's namespace to use. + More info: https://kubernetes.io/docs/concepts/storage/volumes#secret + type: string + subPath: + description: SubPath + type: string + volumeClaimTemplate: + description: VolumeClaimTemplate + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + status: + description: Status + type: object + required: + - podName + properties: + annotations: + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + additionalProperties: + type: string + cloudEvents: + description: CloudEvents + type: array + items: + description: CloudEventDelivery + type: object + properties: + status: + description: CloudEventDeliveryState + type: object + required: + - message + - retryCount + properties: + condition: + description: Condition + type: string + message: + description: Error + type: string + retryCount: + description: RetryCount + type: integer + format: int32 + sentAt: + description: SentAt + type: string + format: date-time + target: + description: Target + type: string + x-kubernetes-list-type: atomic + completionTime: + description: CompletionTime + type: string + format: date-time + conditions: + description: Conditions the latest available observations of a resource's + current state. + type: array + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + type: object + required: + - status + - type + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating details about + the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, False, + Unknown. + type: string + type: + description: Type of condition. + type: string + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + type: integer + format: int64 + podName: + description: PodName + type: string + provenance: + description: Provenance + type: object + properties: + configSource: + description: |- + ConfigSource + Deprecated: Use RefSource instead + type: object + properties: + digest: + description: Digest + type: object + additionalProperties: + type: string + entryPoint: + description: EntryPoint + type: string + uri: + description: URI + type: string + featureFlags: + description: FeatureFlags + type: object + properties: + awaitSidecarReadiness: + type: boolean + coschedule: + type: string + disableCredsInit: + type: boolean + disableInlineSpec: + type: string + enableAPIFields: + type: string + enableArtifacts: + type: boolean + enableCELInWhenExpression: + type: boolean + enableConciseResolverSyntax: + type: boolean + enableKeepPodOnCancel: + type: boolean + enableKubernetesSidecar: + type: boolean + enableParamEnum: + type: boolean + enableProvenanceInStatus: + type: boolean + enableStepActions: + description: EnableStepActions is a no-op flag since StepActions + are stable + type: boolean + enableTektonOCIBundles: + description: |- + DeprecatedEnableTektonOCIBundles is maintained for backward compatibility + to allow deletion of PipelineRuns created before v0.62.x. + This field is not used and can be removed in a future release + once we're confident old PipelineRuns have been cleaned up. + See issue #8359 for context. + type: boolean + enableTerminationMessageCompression: + type: boolean + enableWaitExponentialBackoff: + type: boolean + enforceNonfalsifiability: + type: string + maxResultSize: + type: integer + requireGitSSHSecretKnownHosts: + type: boolean + resultExtractionMethod: + type: string + runningInEnvWithInjectedSidecars: + type: boolean + sendCloudEventsForRuns: + type: boolean + setSecurityContext: + type: boolean + setSecurityContextReadOnlyRootFilesystem: + type: boolean + verificationNoMatchPolicy: + description: |- + VerificationNoMatchPolicy is the feature flag for "trusted-resources-verification-no-match-policy" + VerificationNoMatchPolicy can be set to "ignore", "warn" and "fail" values. + ignore: skip trusted resources verification when no matching verification policies found + warn: skip trusted resources verification when no matching verification policies found and log a warning + fail: fail the taskrun or pipelines run if no matching verification policies found + type: string + refSource: + description: RefSource + type: object + properties: + digest: + description: Digest + type: object + additionalProperties: + type: string + entryPoint: + description: EntryPoint + type: string + uri: + description: URI + type: string + resourcesResult: + description: |- + ResourcesResult + Deprecated: this field is not populated and is preserved only for backwards compatibility + type: array + items: + description: |- + RunResult is used to write key/value pairs to TaskRun pod termination messages. + The key/value pairs may come from the entrypoint binary, or represent a TaskRunResult. + If they represent a TaskRunResult, the key is the name of the result and the value is the + JSON-serialized value of the result. + type: object + required: + - key + - value + properties: + key: + type: string + resourceName: + description: |- + ResourceName may be used in tests, but it is not populated in termination messages. + It is preserved here for backwards compatibility and will not be ported to v1. + type: string + type: + description: |- + ResultType used to find out whether a RunResult is from a task result or not + Note that ResultsType is another type which is used to define the data type + (e.g. string, array, etc) we used for Results + type: integer + value: + type: string + x-kubernetes-list-type: atomic + retriesStatus: + description: RetriesStatus + x-kubernetes-preserve-unknown-fields: true + sidecars: + description: Sidecars + type: array + items: + description: SidecarState + type: object + properties: + container: + type: string + imageID: + type: string + name: + type: string + running: + description: Details about a running container + type: object + properties: + startedAt: + description: Time at which the container was last (re-)started + type: string + format: date-time + terminated: + description: Details about a terminated container + type: object + required: + - exitCode + properties: + containerID: + description: Container's ID in the format '://' + type: string + exitCode: + description: Exit status from the last termination of + the container + type: integer + format: int32 + finishedAt: + description: Time at which the container last terminated + type: string + format: date-time + message: + description: Message regarding the last termination of + the container + type: string + reason: + description: (brief) reason from the last termination + of the container + type: string + signal: + description: Signal from the last termination of the container + type: integer + format: int32 + startedAt: + description: Time at which previous execution of the container + started + type: string + format: date-time + waiting: + description: Details about a waiting container + type: object + properties: + message: + description: Message regarding why the container is not + yet running. + type: string + reason: + description: (brief) reason the container is not yet running. + type: string + x-kubernetes-list-type: atomic + spanContext: + description: SpanContext + type: object + additionalProperties: + type: string + startTime: + description: StartTime + type: string + format: date-time + steps: + description: Steps + type: array + items: + description: StepState + type: object + properties: + container: + type: string + imageID: + type: string + inputs: + type: array + items: + description: Artifact + type: object + properties: + buildOutput: + description: BuildOutput + type: boolean + name: + description: Name + type: string + values: + description: Values + type: array + items: + description: ArtifactValue + type: object + properties: + digest: + type: object + additionalProperties: + type: string + uri: + type: string + name: + type: string + outputs: + type: array + items: + description: Artifact + type: object + properties: + buildOutput: + description: BuildOutput + type: boolean + name: + description: Name + type: string + values: + description: Values + type: array + items: + description: ArtifactValue + type: object + properties: + digest: + type: object + additionalProperties: + type: string + uri: + type: string + provenance: + description: Provenance + type: object + properties: + configSource: + description: |- + ConfigSource + Deprecated: Use RefSource instead + type: object + properties: + digest: + description: Digest + type: object + additionalProperties: + type: string + entryPoint: + description: EntryPoint + type: string + uri: + description: URI + type: string + featureFlags: + description: FeatureFlags + type: object + properties: + awaitSidecarReadiness: + type: boolean + coschedule: + type: string + disableCredsInit: + type: boolean + disableInlineSpec: + type: string + enableAPIFields: + type: string + enableArtifacts: + type: boolean + enableCELInWhenExpression: + type: boolean + enableConciseResolverSyntax: + type: boolean + enableKeepPodOnCancel: + type: boolean + enableKubernetesSidecar: + type: boolean + enableParamEnum: + type: boolean + enableProvenanceInStatus: + type: boolean + enableStepActions: + description: EnableStepActions is a no-op flag since + StepActions are stable + type: boolean + enableTektonOCIBundles: + description: |- + DeprecatedEnableTektonOCIBundles is maintained for backward compatibility + to allow deletion of PipelineRuns created before v0.62.x. + This field is not used and can be removed in a future release + once we're confident old PipelineRuns have been cleaned up. + See issue #8359 for context. + type: boolean + enableTerminationMessageCompression: + type: boolean + enableWaitExponentialBackoff: + type: boolean + enforceNonfalsifiability: + type: string + maxResultSize: + type: integer + requireGitSSHSecretKnownHosts: + type: boolean + resultExtractionMethod: + type: string + runningInEnvWithInjectedSidecars: + type: boolean + sendCloudEventsForRuns: + type: boolean + setSecurityContext: + type: boolean + setSecurityContextReadOnlyRootFilesystem: + type: boolean + verificationNoMatchPolicy: + description: |- + VerificationNoMatchPolicy is the feature flag for "trusted-resources-verification-no-match-policy" + VerificationNoMatchPolicy can be set to "ignore", "warn" and "fail" values. + ignore: skip trusted resources verification when no matching verification policies found + warn: skip trusted resources verification when no matching verification policies found and log a warning + fail: fail the taskrun or pipelines run if no matching verification policies found + type: string + refSource: + description: RefSource + type: object + properties: + digest: + description: Digest + type: object + additionalProperties: + type: string + entryPoint: + description: EntryPoint + type: string + uri: + description: URI + type: string + results: + type: array + items: + description: TaskRunResult + type: object + required: + - name + - value + properties: + name: + description: Name + type: string + type: + description: Type + type: string + value: + description: Value + x-kubernetes-preserve-unknown-fields: true + running: + description: Details about a running container + type: object + properties: + startedAt: + description: Time at which the container was last (re-)started + type: string + format: date-time + terminated: + description: Details about a terminated container + type: object + required: + - exitCode + properties: + containerID: + description: Container's ID in the format '://' + type: string + exitCode: + description: Exit status from the last termination of + the container + type: integer + format: int32 + finishedAt: + description: Time at which the container last terminated + type: string + format: date-time + message: + description: Message regarding the last termination of + the container + type: string + reason: + description: (brief) reason from the last termination + of the container + type: string + signal: + description: Signal from the last termination of the container + type: integer + format: int32 + startedAt: + description: Time at which previous execution of the container + started + type: string + format: date-time + waiting: + description: Details about a waiting container + type: object + properties: + message: + description: Message regarding why the container is not + yet running. + type: string + reason: + description: (brief) reason the container is not yet running. + type: string + x-kubernetes-list-type: atomic + taskResults: + description: TaskRunResults + type: array + items: + description: TaskRunResult + type: object + required: + - name + - value + properties: + name: + description: Name + type: string + type: + description: Type + type: string + value: + description: Value + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + taskSpec: + description: TaskSpec + x-kubernetes-preserve-unknown-fields: true + additionalPrinterColumns: + - name: Succeeded + type: string + jsonPath: ".status.conditions[?(@.type==\"Succeeded\")].status" + - name: Reason + type: string + jsonPath: ".status.conditions[?(@.type==\"Succeeded\")].reason" + - name: StartTime + type: date + jsonPath: .status.startTime + - name: CompletionTime + type: date + jsonPath: .status.completionTime + # Opt into the status subresource so metadata.generation + # starts to increment + subresources: + status: {} + - name: v1 + served: true + storage: true + schema: + openAPIV3Schema: + description: |- + TaskRun represents a single execution of a Task. TaskRuns are how the steps + specified in a Task are executed; they specify the parameters and resources + used to run the steps in a Task. + type: object + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: TaskRunSpec defines the desired state of TaskRun + type: object + properties: + computeResources: + description: Compute resources to use for this TaskRun + type: object + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This field depends on the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + type: array + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + type: object + required: + - name + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + requests: + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + debug: + description: TaskRunDebug defines the breakpoint config for a particular + TaskRun + type: object + properties: + breakpoints: + description: TaskBreakpoints defines the breakpoint config for + a particular Task + type: object + properties: + beforeSteps: + type: array + items: + type: string + x-kubernetes-list-type: atomic + onFailure: + description: |- + if enabled, pause TaskRun on failure of a step + failed step will not exit + type: string + managedBy: + description: |- + ManagedBy indicates which controller is responsible for reconciling + this resource. If unset or set to "tekton.dev/pipeline", the default + Tekton controller will manage this resource. + This field is immutable. + type: string + params: + description: Params is a list of Param + type: array + items: + description: Param declares an ParamValues to use for the parameter + called name. + type: object + required: + - name + - value + properties: + name: + type: string + value: + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + podTemplate: + description: PodTemplate holds pod specific configuration + type: object + properties: + affinity: + description: |- + If specified, the pod's scheduling constraints. + See Pod.spec.affinity (API version: v1) + x-kubernetes-preserve-unknown-fields: true + automountServiceAccountToken: + description: |- + AutomountServiceAccountToken indicates whether pods running as this + service account should have an API token automatically mounted. + type: boolean + dnsConfig: + description: |- + Specifies the DNS parameters of a pod. + Parameters specified here will be merged to the generated DNS + configuration based on DNSPolicy. + type: object + properties: + nameservers: + description: |- + A list of DNS name server IP addresses. + This will be appended to the base nameservers generated from DNSPolicy. + Duplicated nameservers will be removed. + type: array + items: + type: string + x-kubernetes-list-type: atomic + options: + description: |- + A list of DNS resolver options. + This will be merged with the base options generated from DNSPolicy. + Duplicated entries will be removed. Resolution options given in Options + will override those that appear in the base DNSPolicy. + type: array + items: + description: PodDNSConfigOption defines DNS resolver options + of a pod. + type: object + properties: + name: + description: |- + Name is this DNS resolver option's name. + Required. + type: string + value: + description: Value is this DNS resolver option's value. + type: string + x-kubernetes-list-type: atomic + searches: + description: |- + A list of DNS search domains for host-name lookup. + This will be appended to the base search paths generated from DNSPolicy. + Duplicated search paths will be removed. + type: array + items: + type: string + x-kubernetes-list-type: atomic + dnsPolicy: + description: |- + Set DNS policy for the pod. Defaults to "ClusterFirst". Valid values are + 'ClusterFirst', 'Default' or 'None'. DNS parameters given in DNSConfig + will be merged with the policy selected with DNSPolicy. + type: string + enableServiceLinks: + description: |- + EnableServiceLinks indicates whether information about services should be injected into pod's + environment variables, matching the syntax of Docker links. + Optional: Defaults to true. + type: boolean + env: + description: List of environment variables that can be provided + to the containers belonging to the pod. + type: array + items: + description: EnvVar represents an environment variable present + in a Container. + type: object + required: + - name + properties: + name: + description: |- + Name of the environment variable. + May consist of any printable ASCII characters except '='. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's value. + Cannot be used if value is not empty. + type: object + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + type: object + required: + - key + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap or + its key must be defined + type: boolean + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + type: object + required: + - fieldPath + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in the + specified API version. + type: string + x-kubernetes-map-type: atomic + fileKeyRef: + description: |- + FileKeyRef selects a key of the env file. + Requires the EnvFiles feature gate to be enabled. + type: object + required: + - key + - path + - volumeName + properties: + key: + description: |- + The key within the env file. An invalid key will prevent the pod from starting. + The keys defined within a source may consist of any printable ASCII characters except '='. + During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters. + type: string + optional: + description: |- + Specify whether the file or its key must be defined. If the file or key + does not exist, then the env var is not published. + If optional is set to true and the specified key does not exist, + the environment variable will not be set in the Pod's containers. + + If optional is set to false and the specified key does not exist, + an error will be returned during Pod creation. + type: boolean + default: false + path: + description: |- + The path within the volume from which to select the file. + Must be relative and may not contain the '..' path or start with '..'. + type: string + volumeName: + description: The name of the volume mount containing + the env file. + type: string + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + type: object + required: + - resource + properties: + containerName: + description: 'Container name: required for volumes, + optional for env vars' + type: string + divisor: + description: Specifies the output format of the + exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the pod's + namespace + type: object + required: + - key + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret or its + key must be defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + hostAliases: + description: |- + HostAliases is an optional list of hosts and IPs that will be injected into the pod's hosts + file if specified. This is only valid for non-hostNetwork pods. + type: array + items: + description: |- + HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the + pod's hosts file. + type: object + required: + - ip + properties: + hostnames: + description: Hostnames for the above IP address. + type: array + items: + type: string + x-kubernetes-list-type: atomic + ip: + description: IP address of the host file entry. + type: string + x-kubernetes-list-type: atomic + hostNetwork: + description: HostNetwork specifies whether the pod may use the + node network namespace + type: boolean + hostUsers: + description: |- + HostUsers indicates whether the pod will use the host's user namespace. + Optional: Default to true. + If set to true or not present, the pod will be run in the host user namespace, useful + for when the pod needs a feature only available to the host user namespace, such as + loading a kernel module with CAP_SYS_MODULE. + When set to false, a new user namespace is created for the pod. Setting false + is useful to mitigating container breakout vulnerabilities such as allowing + containers to run as root without their user having root privileges on the host. + This field depends on the kubernetes feature gate UserNamespacesSupport being enabled. + type: boolean + imagePullSecrets: + description: ImagePullSecrets gives the name of the secret used + by the pod to pull the image if specified + type: array + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + nodeSelector: + description: |- + NodeSelector is a selector which must be true for the pod to fit on a node. + Selector which must match a node's labels for the pod to be scheduled on that node. + More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ + type: object + additionalProperties: + type: string + priorityClassName: + description: |- + If specified, indicates the pod's priority. "system-node-critical" and + "system-cluster-critical" are two special keywords which indicate the + highest priorities with the former being the highest priority. Any other + name must be defined by creating a PriorityClass object with that name. + If not specified, the pod priority will be default or zero if there is no + default. + type: string + runtimeClassName: + description: |- + RuntimeClassName refers to a RuntimeClass object in the node.k8s.io + group, which should be used to run this pod. If no RuntimeClass resource + matches the named class, the pod will not be run. If unset or empty, the + "legacy" RuntimeClass will be used, which is an implicit class with an + empty definition that uses the default runtime handler. + More info: https://git.k8s.io/enhancements/keps/sig-node/runtime-class.md + This is a beta feature as of Kubernetes v1.14. + type: string + schedulerName: + description: SchedulerName specifies the scheduler to be used + to dispatch the Pod + type: string + securityContext: + description: |- + SecurityContext holds pod-level security attributes and common container settings. + Optional: Defaults to empty. See type description for default values of each field. + See Pod.spec.securityContext (API version: v1) + x-kubernetes-preserve-unknown-fields: true + tolerations: + description: If specified, the pod's tolerations. + type: array + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + type: object + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + type: integer + format: int64 + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + x-kubernetes-list-type: atomic + topologySpreadConstraints: + description: |- + TopologySpreadConstraints controls how Pods are spread across your cluster among + failure-domains such as regions, zones, nodes, and other user-defined topology domains. + type: array + items: + description: TopologySpreadConstraint specifies how to spread + matching pods among the given topology. + type: object + required: + - maxSkew + - topologyKey + - whenUnsatisfiable + properties: + labelSelector: + description: |- + LabelSelector is used to find matching pods. + Pods that match this label selector are counted to determine the number of pods + in their corresponding topology domain. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select the pods over which + spreading will be calculated. The keys are used to lookup values from the + incoming pod labels, those key-value labels are ANDed with labelSelector + to select the group of existing pods over which spreading will be calculated + for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + MatchLabelKeys cannot be set when LabelSelector isn't set. + Keys that don't exist in the incoming pod labels will + be ignored. A null or empty list means only match against labelSelector. + + This is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default). + type: array + items: + type: string + x-kubernetes-list-type: atomic + maxSkew: + description: |- + MaxSkew describes the degree to which pods may be unevenly distributed. + When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference + between the number of matching pods in the target topology and the global minimum. + The global minimum is the minimum number of matching pods in an eligible domain + or zero if the number of eligible domains is less than MinDomains. + For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same + labelSelector spread as 2/2/1: + In this case, the global minimum is 1. + | zone1 | zone2 | zone3 | + | P P | P P | P | + - if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2; + scheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2) + violate MaxSkew(1). + - if MaxSkew is 2, incoming pod can be scheduled onto any zone. + When `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence + to topologies that satisfy it. + It's a required field. Default value is 1 and 0 is not allowed. + type: integer + format: int32 + minDomains: + description: |- + MinDomains indicates a minimum number of eligible domains. + When the number of eligible domains with matching topology keys is less than minDomains, + Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed. + And when the number of eligible domains with matching topology keys equals or greater than minDomains, + this value has no effect on scheduling. + As a result, when the number of eligible domains is less than minDomains, + scheduler won't schedule more than maxSkew Pods to those domains. + If value is nil, the constraint behaves as if MinDomains is equal to 1. + Valid values are integers greater than 0. + When value is not nil, WhenUnsatisfiable must be DoNotSchedule. + + For example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same + labelSelector spread as 2/2/2: + | zone1 | zone2 | zone3 | + | P P | P P | P P | + The number of domains is less than 5(MinDomains), so "global minimum" is treated as 0. + In this situation, new pod with the same labelSelector cannot be scheduled, + because computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones, + it will violate MaxSkew. + type: integer + format: int32 + nodeAffinityPolicy: + description: |- + NodeAffinityPolicy indicates how we will treat Pod's nodeAffinity/nodeSelector + when calculating pod topology spread skew. Options are: + - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations. + - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations. + + If this value is nil, the behavior is equivalent to the Honor policy. + type: string + nodeTaintsPolicy: + description: |- + NodeTaintsPolicy indicates how we will treat node taints when calculating + pod topology spread skew. Options are: + - Honor: nodes without taints, along with tainted nodes for which the incoming pod + has a toleration, are included. + - Ignore: node taints are ignored. All nodes are included. + + If this value is nil, the behavior is equivalent to the Ignore policy. + type: string + topologyKey: + description: |- + TopologyKey is the key of node labels. Nodes that have a label with this key + and identical values are considered to be in the same topology. + We consider each as a "bucket", and try to put balanced number + of pods into each bucket. + We define a domain as a particular instance of a topology. + Also, we define an eligible domain as a domain whose nodes meet the requirements of + nodeAffinityPolicy and nodeTaintsPolicy. + e.g. If TopologyKey is "kubernetes.io/hostname", each Node is a domain of that topology. + And, if TopologyKey is "topology.kubernetes.io/zone", each zone is a domain of that topology. + It's a required field. + type: string + whenUnsatisfiable: + description: |- + WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy + the spread constraint. + - DoNotSchedule (default) tells the scheduler not to schedule it. + - ScheduleAnyway tells the scheduler to schedule the pod in any location, + but giving higher precedence to topologies that would help reduce the + skew. + A constraint is considered "Unsatisfiable" for an incoming pod + if and only if every possible node assignment for that pod would violate + "MaxSkew" on some topology. + For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same + labelSelector spread as 3/1/1: + | zone1 | zone2 | zone3 | + | P P P | P | P | + If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled + to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies + MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler + won't make it *more* imbalanced. + It's a required field. + type: string + x-kubernetes-list-type: atomic + volumes: + description: |- + List of volumes that can be mounted by containers belonging to the pod. + More info: https://kubernetes.io/docs/concepts/storage/volumes + See Pod.spec.volumes (API version: v1) + x-kubernetes-preserve-unknown-fields: true + retries: + description: Retries represents how many times this TaskRun should + be retried in the event of task failure. + type: integer + serviceAccountName: + type: string + sidecarSpecs: + description: |- + Specs to apply to Sidecars in this TaskRun. + If a field is specified in both a Sidecar and a SidecarSpec, + the value from the SidecarSpec will be used. + This field is only supported when the alpha feature gate is enabled. + type: array + items: + description: TaskRunSidecarSpec is used to override the values + of a Sidecar in the corresponding Task. + type: object + required: + - computeResources + - name + properties: + computeResources: + description: The resource requirements to apply to the Sidecar. + type: object + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This field depends on the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + type: array + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + type: object + required: + - name + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + requests: + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + name: + description: The name of the Sidecar to override. + type: string + x-kubernetes-list-type: atomic + status: + description: Used for cancelling a TaskRun (and maybe more later + on) + type: string + statusMessage: + description: Status message for cancellation. + type: string + stepSpecs: + description: |- + Specs to apply to Steps in this TaskRun. + If a field is specified in both a Step and a StepSpec, + the value from the StepSpec will be used. + This field is only supported when the alpha feature gate is enabled. + type: array + items: + description: TaskRunStepSpec is used to override the values of + a Step in the corresponding Task. + type: object + required: + - computeResources + - name + properties: + computeResources: + description: The resource requirements to apply to the Step. + type: object + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This field depends on the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + type: array + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + type: object + required: + - name + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + requests: + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + name: + description: The name of the Step to override. + type: string + x-kubernetes-list-type: atomic + taskRef: + description: no more than one of the TaskRef and TaskSpec may be + specified. + type: object + properties: + apiVersion: + description: |- + API version of the referent + Note: A Task with non-empty APIVersion and Kind is considered a Custom Task + type: string + kind: + description: |- + TaskKind indicates the Kind of the Task: + 1. Namespaced Task when Kind is set to "Task". If Kind is "", it defaults to "Task". + 2. Custom Task when Kind is non-empty and APIVersion is non-empty + type: string + name: + description: 'Name of the referent; More info: http://kubernetes.io/docs/user-guide/identifiers#names' + type: string + params: + description: |- + Params contains the parameters used to identify the + referenced Tekton resource. Example entries might include + "repo" or "path" but the set of params ultimately depends on + the chosen resolver. + type: array + items: + description: Param declares an ParamValues to use for the + parameter called name. + type: object + required: + - name + - value + properties: + name: + type: string + value: + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + resolver: + description: |- + Resolver is the name of the resolver that should perform + resolution of the referenced Tekton resource, such as "git". + type: string + taskSpec: + description: |- + Specifying TaskSpec can be disabled by setting + `disable-inline-spec` feature flag. + See Task.spec (API version: tekton.dev/v1) + x-kubernetes-preserve-unknown-fields: true + timeout: + description: |- + Time after which one retry attempt times out. Defaults to 1 hour. + Refer Go's ParseDuration documentation for expected format: https://golang.org/pkg/time/#ParseDuration + type: string + workspaces: + description: Workspaces is a list of WorkspaceBindings from volumes + to workspaces. + type: array + items: + description: WorkspaceBinding maps a Task's declared workspace + to a Volume. + type: object + required: + - name + properties: + configMap: + description: ConfigMap represents a configMap that should + populate this workspace. + type: object + properties: + defaultMode: + description: |- + defaultMode is optional: mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + Defaults to 0644. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + ConfigMap will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the ConfigMap, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: optional specify whether the ConfigMap or + its keys must be defined + type: boolean + x-kubernetes-map-type: atomic + csi: + description: CSI (Container Storage Interface) represents + ephemeral storage that is handled by certain external CSI + drivers. + type: object + required: + - driver + properties: + driver: + description: |- + driver is the name of the CSI driver that handles this volume. + Consult with your admin for the correct name as registered in the cluster. + type: string + fsType: + description: |- + fsType to mount. Ex. "ext4", "xfs", "ntfs". + If not provided, the empty value is passed to the associated CSI driver + which will determine the default filesystem to apply. + type: string + nodePublishSecretRef: + description: |- + nodePublishSecretRef is a reference to the secret object containing + sensitive information to pass to the CSI driver to complete the CSI + NodePublishVolume and NodeUnpublishVolume calls. + This field is optional, and may be empty if no secret is required. If the + secret object contains more than one secret, all secret references are passed. + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + x-kubernetes-map-type: atomic + readOnly: + description: |- + readOnly specifies a read-only configuration for the volume. + Defaults to false (read/write). + type: boolean + volumeAttributes: + description: |- + volumeAttributes stores driver-specific properties that are passed to the CSI + driver. Consult your driver's documentation for supported values. + type: object + additionalProperties: + type: string + emptyDir: + description: |- + EmptyDir represents a temporary directory that shares a Task's lifetime. + More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir + Either this OR PersistentVolumeClaim can be used. + type: object + properties: + medium: + description: |- + medium represents what type of storage medium should back this directory. + The default is "" which means to use the node's default medium. + Must be an empty string (default) or Memory. + More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir + type: string + sizeLimit: + description: |- + sizeLimit is the total amount of local storage required for this EmptyDir volume. + The size limit is also applicable for memory medium. + The maximum usage on memory medium EmptyDir would be the minimum value between + the SizeLimit specified here and the sum of memory limits of all containers in a pod. + The default is nil which means that the limit is undefined. + More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + name: + description: Name is the name of the workspace populated by + the volume. + type: string + persistentVolumeClaim: + description: |- + PersistentVolumeClaimVolumeSource represents a reference to a + PersistentVolumeClaim in the same namespace. Either this OR EmptyDir can be used. + type: object + required: + - claimName + properties: + claimName: + description: |- + claimName is the name of a PersistentVolumeClaim in the same namespace as the pod using this volume. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims + type: string + readOnly: + description: |- + readOnly Will force the ReadOnly setting in VolumeMounts. + Default false. + type: boolean + projected: + description: Projected represents a projected volume that + should populate this workspace. + type: object + properties: + defaultMode: + description: |- + defaultMode are the mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + sources: + description: |- + sources is the list of volume projections. Each entry in this list + handles one source. + type: array + items: + description: |- + Projection that may be projected along with other supported volume types. + Exactly one of these fields must be set. + type: object + properties: + clusterTrustBundle: + description: |- + ClusterTrustBundle allows a pod to access the `.spec.trustBundle` field + of ClusterTrustBundle objects in an auto-updating file. + + Alpha, gated by the ClusterTrustBundleProjection feature gate. + + ClusterTrustBundle objects can either be selected by name, or by the + combination of signer name and a label selector. + + Kubelet performs aggressive normalization of the PEM contents written + into the pod filesystem. Esoteric PEM features such as inter-block + comments and block headers are stripped. Certificates are deduplicated. + The ordering of certificates within the file is arbitrary, and Kubelet + may change the order over time. + type: object + required: + - path + properties: + labelSelector: + description: |- + Select all ClusterTrustBundles that match this label selector. Only has + effect if signerName is set. Mutually-exclusive with name. If unset, + interpreted as "match nothing". If set but empty, interpreted as "match + everything". + type: object + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + name: + description: |- + Select a single ClusterTrustBundle by object name. Mutually-exclusive + with signerName and labelSelector. + type: string + optional: + description: |- + If true, don't block pod startup if the referenced ClusterTrustBundle(s) + aren't available. If using name, then the named ClusterTrustBundle is + allowed not to exist. If using signerName, then the combination of + signerName and labelSelector is allowed to match zero + ClusterTrustBundles. + type: boolean + path: + description: Relative path from the volume root + to write the bundle. + type: string + signerName: + description: |- + Select all ClusterTrustBundles that match this signer name. + Mutually-exclusive with name. The contents of all selected + ClusterTrustBundles will be unified and deduplicated. + type: string + configMap: + description: configMap information about the configMap + data to project + type: object + properties: + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + ConfigMap will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the ConfigMap, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within + a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: optional specify whether the ConfigMap + or its keys must be defined + type: boolean + x-kubernetes-map-type: atomic + downwardAPI: + description: downwardAPI information about the downwardAPI + data to project + type: object + properties: + items: + description: Items is a list of DownwardAPIVolume + file + type: array + items: + description: DownwardAPIVolumeFile represents + information to create the file containing + the pod field + type: object + required: + - path + properties: + fieldRef: + description: 'Required: Selects a field + of the pod: only annotations, labels, + name, namespace and uid are supported.' + type: object + required: + - fieldPath + properties: + apiVersion: + description: Version of the schema + the FieldPath is written in terms + of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to + select in the specified API version. + type: string + x-kubernetes-map-type: atomic + mode: + description: |- + Optional: mode bits used to set permissions on this file, must be an octal value + between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: 'Required: Path is the relative + path name of the file to be created. + Must not be absolute or contain the + ''..'' path. Must be utf-8 encoded. + The first item of the relative path + must not start with ''..''' + type: string + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported. + type: object + required: + - resource + properties: + containerName: + description: 'Container name: required + for volumes, optional for env vars' + type: string + divisor: + description: Specifies the output + format of the exposed resources, + defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to + select' + type: string + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + podCertificate: + description: |- + Projects an auto-rotating credential bundle (private key and certificate + chain) that the pod can use either as a TLS client or server. + + Kubelet generates a private key and uses it to send a + PodCertificateRequest to the named signer. Once the signer approves the + request and issues a certificate chain, Kubelet writes the key and + certificate chain to the pod filesystem. The pod does not start until + certificates have been issued for each podCertificate projected volume + source in its spec. + + Kubelet will begin trying to rotate the certificate at the time indicated + by the signer using the PodCertificateRequest.Status.BeginRefreshAt + timestamp. + + Kubelet can write a single file, indicated by the credentialBundlePath + field, or separate files, indicated by the keyPath and + certificateChainPath fields. + + The credential bundle is a single file in PEM format. The first PEM + entry is the private key (in PKCS#8 format), and the remaining PEM + entries are the certificate chain issued by the signer (typically, + signers will return their certificate chain in leaf-to-root order). + + Prefer using the credential bundle format, since your application code + can read it atomically. If you use keyPath and certificateChainPath, + your application must make two separate file reads. If these coincide + with a certificate rotation, it is possible that the private key and leaf + certificate you read may not correspond to each other. Your application + will need to check for this condition, and re-read until they are + consistent. + + The named signer controls chooses the format of the certificate it + issues; consult the signer implementation's documentation to learn how to + use the certificates it issues. + type: object + required: + - keyType + - signerName + properties: + certificateChainPath: + description: |- + Write the certificate chain at this path in the projected volume. + + Most applications should use credentialBundlePath. When using keyPath + and certificateChainPath, your application needs to check that the key + and leaf certificate are consistent, because it is possible to read the + files mid-rotation. + type: string + credentialBundlePath: + description: |- + Write the credential bundle at this path in the projected volume. + + The credential bundle is a single file that contains multiple PEM blocks. + The first PEM block is a PRIVATE KEY block, containing a PKCS#8 private + key. + + The remaining blocks are CERTIFICATE blocks, containing the issued + certificate chain from the signer (leaf and any intermediates). + + Using credentialBundlePath lets your Pod's application code make a single + atomic read that retrieves a consistent key and certificate chain. If you + project them to separate files, your application code will need to + additionally check that the leaf certificate was issued to the key. + type: string + keyPath: + description: |- + Write the key at this path in the projected volume. + + Most applications should use credentialBundlePath. When using keyPath + and certificateChainPath, your application needs to check that the key + and leaf certificate are consistent, because it is possible to read the + files mid-rotation. + type: string + keyType: + description: |- + The type of keypair Kubelet will generate for the pod. + + Valid values are "RSA3072", "RSA4096", "ECDSAP256", "ECDSAP384", + "ECDSAP521", and "ED25519". + type: string + maxExpirationSeconds: + description: |- + maxExpirationSeconds is the maximum lifetime permitted for the + certificate. + + Kubelet copies this value verbatim into the PodCertificateRequests it + generates for this projection. + + If omitted, kube-apiserver will set it to 86400(24 hours). kube-apiserver + will reject values shorter than 3600 (1 hour). The maximum allowable + value is 7862400 (91 days). + + The signer implementation is then free to issue a certificate with any + lifetime *shorter* than MaxExpirationSeconds, but no shorter than 3600 + seconds (1 hour). This constraint is enforced by kube-apiserver. + `kubernetes.io` signers will never issue certificates with a lifetime + longer than 24 hours. + type: integer + format: int32 + signerName: + description: Kubelet's generated CSRs will be + addressed to this signer. + type: string + userAnnotations: + description: |- + userAnnotations allow pod authors to pass additional information to + the signer implementation. Kubernetes does not restrict or validate this + metadata in any way. + + These values are copied verbatim into the `spec.unverifiedUserAnnotations` field of + the PodCertificateRequest objects that Kubelet creates. + + Entries are subject to the same validation as object metadata annotations, + with the addition that all keys must be domain-prefixed. No restrictions + are placed on values, except an overall size limitation on the entire field. + + Signers should document the keys and values they support. Signers should + deny requests that contain keys they do not recognize. + type: object + additionalProperties: + type: string + secret: + description: secret information about the secret + data to project + type: object + properties: + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + Secret will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the Secret, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within + a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: optional field specify whether + the Secret or its key must be defined + type: boolean + x-kubernetes-map-type: atomic + serviceAccountToken: + description: serviceAccountToken is information + about the serviceAccountToken data to project + type: object + required: + - path + properties: + audience: + description: |- + audience is the intended audience of the token. A recipient of a token + must identify itself with an identifier specified in the audience of the + token, and otherwise should reject the token. The audience defaults to the + identifier of the apiserver. + type: string + expirationSeconds: + description: |- + expirationSeconds is the requested duration of validity of the service + account token. As the token approaches expiration, the kubelet volume + plugin will proactively rotate the service account token. The kubelet will + start trying to rotate the token if the token is older than 80 percent of + its time to live or if the token is older than 24 hours.Defaults to 1 hour + and must be at least 10 minutes. + type: integer + format: int64 + path: + description: |- + path is the path relative to the mount point of the file to project the + token into. + type: string + x-kubernetes-list-type: atomic + secret: + description: Secret represents a secret that should populate + this workspace. + type: object + properties: + defaultMode: + description: |- + defaultMode is Optional: mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values + for mode bits. Defaults to 0644. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + items: + description: |- + items If unspecified, each key-value pair in the Data field of the referenced + Secret will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the Secret, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + optional: + description: optional field specify whether the Secret + or its keys must be defined + type: boolean + secretName: + description: |- + secretName is the name of the secret in the pod's namespace to use. + More info: https://kubernetes.io/docs/concepts/storage/volumes#secret + type: string + subPath: + description: |- + SubPath is optionally a directory on the volume which should be used + for this binding (i.e. the volume will be mounted at this sub directory). + type: string + volumeClaimTemplate: + description: |- + VolumeClaimTemplate is a template for a claim that will be created in the same namespace. + The PipelineRun controller is responsible for creating a unique claim for each instance of PipelineRun. + See PersistentVolumeClaim (API version: v1) + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + status: + description: TaskRunStatus defines the observed state of TaskRun + type: object + required: + - podName + properties: + annotations: + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + additionalProperties: + type: string + artifacts: + description: Artifacts are the list of artifacts written out by + the task's containers + type: object + properties: + inputs: + type: array + items: + description: |- + Artifact represents an artifact within a system, potentially containing multiple values + associated with it. + type: object + properties: + buildOutput: + description: Indicate if the artifact is a build output + or a by-product + type: boolean + name: + description: The artifact's identifying category name + type: string + values: + description: A collection of values related to the artifact + type: array + items: + description: ArtifactValue represents a specific value + or data element within an Artifact. + type: object + properties: + digest: + type: object + additionalProperties: + type: string + uri: + type: string + x-kubernetes-list-type: atomic + outputs: + type: array + items: + description: |- + Artifact represents an artifact within a system, potentially containing multiple values + associated with it. + type: object + properties: + buildOutput: + description: Indicate if the artifact is a build output + or a by-product + type: boolean + name: + description: The artifact's identifying category name + type: string + values: + description: A collection of values related to the artifact + type: array + items: + description: ArtifactValue represents a specific value + or data element within an Artifact. + type: object + properties: + digest: + type: object + additionalProperties: + type: string + uri: + type: string + x-kubernetes-list-type: atomic + completionTime: + description: CompletionTime is the time the build completed. + type: string + format: date-time + conditions: + description: Conditions the latest available observations of a resource's + current state. + type: array + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + type: object + required: + - status + - type + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating details about + the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, False, + Unknown. + type: string + type: + description: Type of condition. + type: string + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + type: integer + format: int64 + podName: + description: PodName is the name of the pod responsible for executing + this task's steps. + type: string + provenance: + description: Provenance contains some key authenticated metadata + about how a software artifact was built (what sources, what inputs/outputs, + etc.). + type: object + properties: + featureFlags: + description: FeatureFlags identifies the feature flags that + were used during the task/pipeline run + type: object + properties: + awaitSidecarReadiness: + type: boolean + coschedule: + type: string + disableCredsInit: + type: boolean + disableInlineSpec: + type: string + enableAPIFields: + type: string + enableArtifacts: + type: boolean + enableCELInWhenExpression: + type: boolean + enableConciseResolverSyntax: + type: boolean + enableKeepPodOnCancel: + type: boolean + enableKubernetesSidecar: + type: boolean + enableParamEnum: + type: boolean + enableProvenanceInStatus: + type: boolean + enableStepActions: + description: EnableStepActions is a no-op flag since StepActions + are stable + type: boolean + enableTektonOCIBundles: + description: |- + DeprecatedEnableTektonOCIBundles is maintained for backward compatibility + to allow deletion of PipelineRuns created before v0.62.x. + This field is not used and can be removed in a future release + once we're confident old PipelineRuns have been cleaned up. + See issue #8359 for context. + type: boolean + enableTerminationMessageCompression: + type: boolean + enableWaitExponentialBackoff: + type: boolean + enforceNonfalsifiability: + type: string + maxResultSize: + type: integer + requireGitSSHSecretKnownHosts: + type: boolean + resultExtractionMethod: + type: string + runningInEnvWithInjectedSidecars: + type: boolean + sendCloudEventsForRuns: + type: boolean + setSecurityContext: + type: boolean + setSecurityContextReadOnlyRootFilesystem: + type: boolean + verificationNoMatchPolicy: + description: |- + VerificationNoMatchPolicy is the feature flag for "trusted-resources-verification-no-match-policy" + VerificationNoMatchPolicy can be set to "ignore", "warn" and "fail" values. + ignore: skip trusted resources verification when no matching verification policies found + warn: skip trusted resources verification when no matching verification policies found and log a warning + fail: fail the taskrun or pipelines run if no matching verification policies found + type: string + refSource: + description: RefSource identifies the source where a remote + task/pipeline came from. + type: object + properties: + digest: + description: |- + Digest is a collection of cryptographic digests for the contents of the artifact specified by URI. + Example: {"sha1": "f99d13e554ffcb696dee719fa85b695cb5b0f428"} + type: object + additionalProperties: + type: string + entryPoint: + description: |- + EntryPoint identifies the entry point into the build. This is often a path to a + build definition file and/or a target label within that file. + Example: "task/git-clone/0.10/git-clone.yaml" + type: string + uri: + description: |- + URI indicates the identity of the source of the build definition. + Example: "https://github.com/tektoncd/catalog" + type: string + results: + description: Results are the list of results written out by the + task's containers + type: array + items: + description: TaskRunResult used to describe the results of a task + type: object + required: + - name + - value + properties: + name: + description: Name the given name + type: string + type: + description: |- + Type is the user-specified type of the result. The possible type + is currently "string" and will support "array" in following work. + type: string + value: + description: Value the given value of the result + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + retriesStatus: + description: |- + RetriesStatus contains the history of TaskRunStatus in case of a retry in order to keep record of failures. + All TaskRunStatus stored in RetriesStatus will have no date within the RetriesStatus as is redundant. + x-kubernetes-preserve-unknown-fields: true + sidecars: + description: |- + The list has one entry per sidecar in the manifest. Each entry is + represents the imageid of the corresponding sidecar. + type: array + items: + description: SidecarState reports the results of running a sidecar + in a Task. + type: object + properties: + container: + type: string + imageID: + type: string + name: + type: string + running: + description: Details about a running container + type: object + properties: + startedAt: + description: Time at which the container was last (re-)started + type: string + format: date-time + terminated: + description: Details about a terminated container + type: object + required: + - exitCode + properties: + containerID: + description: Container's ID in the format '://' + type: string + exitCode: + description: Exit status from the last termination of + the container + type: integer + format: int32 + finishedAt: + description: Time at which the container last terminated + type: string + format: date-time + message: + description: Message regarding the last termination of + the container + type: string + reason: + description: (brief) reason from the last termination + of the container + type: string + signal: + description: Signal from the last termination of the container + type: integer + format: int32 + startedAt: + description: Time at which previous execution of the container + started + type: string + format: date-time + waiting: + description: Details about a waiting container + type: object + properties: + message: + description: Message regarding why the container is not + yet running. + type: string + reason: + description: (brief) reason the container is not yet running. + type: string + x-kubernetes-list-type: atomic + spanContext: + description: SpanContext contains tracing span context fields + type: object + additionalProperties: + type: string + startTime: + description: StartTime is the time the build is actually started. + type: string + format: date-time + steps: + description: Steps describes the state of each build step container. + type: array + items: + description: StepState reports the results of running a step in + a Task. + type: object + properties: + container: + type: string + imageID: + type: string + inputs: + type: array + items: + description: |- + Artifact represents an artifact within a system, potentially containing multiple values + associated with it. + type: object + properties: + buildOutput: + description: Indicate if the artifact is a build output + or a by-product + type: boolean + name: + description: The artifact's identifying category name + type: string + values: + description: A collection of values related to the artifact + type: array + items: + description: ArtifactValue represents a specific value + or data element within an Artifact. + type: object + properties: + digest: + type: object + additionalProperties: + type: string + uri: + type: string + name: + type: string + outputs: + type: array + items: + description: |- + Artifact represents an artifact within a system, potentially containing multiple values + associated with it. + type: object + properties: + buildOutput: + description: Indicate if the artifact is a build output + or a by-product + type: boolean + name: + description: The artifact's identifying category name + type: string + values: + description: A collection of values related to the artifact + type: array + items: + description: ArtifactValue represents a specific value + or data element within an Artifact. + type: object + properties: + digest: + type: object + additionalProperties: + type: string + uri: + type: string + provenance: + description: |- + Provenance contains metadata about resources used in the TaskRun/PipelineRun + such as the source from where a remote build definition was fetched. + This field aims to carry minimum amoumt of metadata in *Run status so that + Tekton Chains can capture them in the provenance. + type: object + properties: + featureFlags: + description: FeatureFlags identifies the feature flags + that were used during the task/pipeline run + type: object + properties: + awaitSidecarReadiness: + type: boolean + coschedule: + type: string + disableCredsInit: + type: boolean + disableInlineSpec: + type: string + enableAPIFields: + type: string + enableArtifacts: + type: boolean + enableCELInWhenExpression: + type: boolean + enableConciseResolverSyntax: + type: boolean + enableKeepPodOnCancel: + type: boolean + enableKubernetesSidecar: + type: boolean + enableParamEnum: + type: boolean + enableProvenanceInStatus: + type: boolean + enableStepActions: + description: EnableStepActions is a no-op flag since + StepActions are stable + type: boolean + enableTektonOCIBundles: + description: |- + DeprecatedEnableTektonOCIBundles is maintained for backward compatibility + to allow deletion of PipelineRuns created before v0.62.x. + This field is not used and can be removed in a future release + once we're confident old PipelineRuns have been cleaned up. + See issue #8359 for context. + type: boolean + enableTerminationMessageCompression: + type: boolean + enableWaitExponentialBackoff: + type: boolean + enforceNonfalsifiability: + type: string + maxResultSize: + type: integer + requireGitSSHSecretKnownHosts: + type: boolean + resultExtractionMethod: + type: string + runningInEnvWithInjectedSidecars: + type: boolean + sendCloudEventsForRuns: + type: boolean + setSecurityContext: + type: boolean + setSecurityContextReadOnlyRootFilesystem: + type: boolean + verificationNoMatchPolicy: + description: |- + VerificationNoMatchPolicy is the feature flag for "trusted-resources-verification-no-match-policy" + VerificationNoMatchPolicy can be set to "ignore", "warn" and "fail" values. + ignore: skip trusted resources verification when no matching verification policies found + warn: skip trusted resources verification when no matching verification policies found and log a warning + fail: fail the taskrun or pipelines run if no matching verification policies found + type: string + refSource: + description: RefSource identifies the source where a remote + task/pipeline came from. + type: object + properties: + digest: + description: |- + Digest is a collection of cryptographic digests for the contents of the artifact specified by URI. + Example: {"sha1": "f99d13e554ffcb696dee719fa85b695cb5b0f428"} + type: object + additionalProperties: + type: string + entryPoint: + description: |- + EntryPoint identifies the entry point into the build. This is often a path to a + build definition file and/or a target label within that file. + Example: "task/git-clone/0.10/git-clone.yaml" + type: string + uri: + description: |- + URI indicates the identity of the source of the build definition. + Example: "https://github.com/tektoncd/catalog" + type: string + results: + type: array + items: + description: TaskRunResult used to describe the results + of a task + type: object + required: + - name + - value + properties: + name: + description: Name the given name + type: string + type: + description: |- + Type is the user-specified type of the result. The possible type + is currently "string" and will support "array" in following work. + type: string + value: + description: Value the given value of the result + x-kubernetes-preserve-unknown-fields: true + running: + description: Details about a running container + type: object + properties: + startedAt: + description: Time at which the container was last (re-)started + type: string + format: date-time + terminated: + description: Details about a terminated container + type: object + required: + - exitCode + properties: + containerID: + description: Container's ID in the format '://' + type: string + exitCode: + description: Exit status from the last termination of + the container + type: integer + format: int32 + finishedAt: + description: Time at which the container last terminated + type: string + format: date-time + message: + description: Message regarding the last termination of + the container + type: string + reason: + description: (brief) reason from the last termination + of the container + type: string + signal: + description: Signal from the last termination of the container + type: integer + format: int32 + startedAt: + description: Time at which previous execution of the container + started + type: string + format: date-time + terminationReason: + type: string + waiting: + description: Details about a waiting container + type: object + properties: + message: + description: Message regarding why the container is not + yet running. + type: string + reason: + description: (brief) reason the container is not yet running. + type: string + x-kubernetes-list-type: atomic + taskSpec: + description: TaskSpec contains the Spec from the dereferenced Task + definition used to instantiate this TaskRun. + type: object + properties: + description: + description: |- + Description is a user-facing description of the task that may be + used to populate a UI. + type: string + displayName: + description: |- + DisplayName is a user-facing name of the task that may be + used to populate a UI. + type: string + params: + description: |- + Params is a list of input parameters required to run the task. Params + must be supplied as inputs in TaskRuns unless they declare a default + value. + type: array + items: + description: |- + ParamSpec defines arbitrary parameters needed beyond typed inputs (such as + resources). Parameter values are provided by users as inputs on a TaskRun + or PipelineRun. + type: object + required: + - name + properties: + default: + description: |- + Default is the value a parameter takes if no input value is supplied. If + default is set, a Task may be executed without a supplied value for the + parameter. + x-kubernetes-preserve-unknown-fields: true + description: + description: |- + Description is a user-facing description of the parameter that may be + used to populate a UI. + type: string + enum: + description: |- + Enum declares a set of allowed param input values for tasks/pipelines that can be validated. + If Enum is not set, no input validation is performed for the param. + type: array + items: + type: string + name: + description: Name declares the name by which a parameter + is referenced. + type: string + properties: + description: Properties is the JSON Schema properties + to support key-value pairs parameter. + type: object + additionalProperties: + description: PropertySpec defines the struct for object + keys + type: object + properties: + type: + description: |- + ParamType indicates the type of an input parameter; + Used to distinguish between a single string and an array of strings. + type: string + type: + description: |- + Type is the user-specified type of the parameter. The possible types + are currently "string", "array" and "object", and "string" is the default. + type: string + x-kubernetes-list-type: atomic + results: + description: Results are values that this Task can output + type: array + items: + description: TaskResult used to describe the results of a + task + type: object + required: + - name + properties: + description: + description: Description is a human-readable description + of the result + type: string + name: + description: Name the given name + type: string + properties: + description: Properties is the JSON Schema properties + to support key-value pairs results. + type: object + additionalProperties: + description: PropertySpec defines the struct for object + keys + type: object + properties: + type: + description: |- + ParamType indicates the type of an input parameter; + Used to distinguish between a single string and an array of strings. + type: string + type: + description: |- + Type is the user-specified type of the result. The possible type + is currently "string" and will support "array" in following work. + type: string + value: + description: Value the expression used to retrieve the + value of the result from an underlying Step. + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + sidecars: + description: |- + Sidecars are run alongside the Task's step containers. They begin before + the steps start and end after the steps complete. + type: array + items: + description: Sidecar has nearly the same data structure as + Step but does not have the ability to timeout. + type: object + required: + - name + properties: + args: + description: |- + Arguments to the entrypoint. + The image's CMD is used if this is not provided. + Variable references $(VAR_NAME) are expanded using the Sidecar's environment. If a variable + cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will + produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless + of whether the variable exists or not. Cannot be updated. + More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell + type: array + items: + type: string + x-kubernetes-list-type: atomic + command: + description: |- + Entrypoint array. Not executed within a shell. + The image's ENTRYPOINT is used if this is not provided. + Variable references $(VAR_NAME) are expanded using the Sidecar's environment. If a variable + cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will + produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless + of whether the variable exists or not. Cannot be updated. + More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell + type: array + items: + type: string + x-kubernetes-list-type: atomic + computeResources: + description: |- + ComputeResources required by this Sidecar. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This field depends on the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + type: array + items: + description: ResourceClaim references one entry + in PodSpec.ResourceClaims. + type: object + required: + - name + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + requests: + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + env: + description: |- + List of environment variables to set in the Sidecar. + Cannot be updated. + type: array + items: + description: EnvVar represents an environment variable + present in a Container. + type: object + required: + - name + properties: + name: + description: |- + Name of the environment variable. + May consist of any printable ASCII characters except '='. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's + value. Cannot be used if value is not empty. + type: object + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + type: object + required: + - key + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + type: object + required: + - fieldPath + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select + in the specified API version. + type: string + x-kubernetes-map-type: atomic + fileKeyRef: + description: |- + FileKeyRef selects a key of the env file. + Requires the EnvFiles feature gate to be enabled. + type: object + required: + - key + - path + - volumeName + properties: + key: + description: |- + The key within the env file. An invalid key will prevent the pod from starting. + The keys defined within a source may consist of any printable ASCII characters except '='. + During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters. + type: string + optional: + description: |- + Specify whether the file or its key must be defined. If the file or key + does not exist, then the env var is not published. + If optional is set to true and the specified key does not exist, + the environment variable will not be set in the Pod's containers. + + If optional is set to false and the specified key does not exist, + an error will be returned during Pod creation. + type: boolean + default: false + path: + description: |- + The path within the volume from which to select the file. + Must be relative and may not contain the '..' path or start with '..'. + type: string + volumeName: + description: The name of the volume mount + containing the env file. + type: string + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + type: object + required: + - resource + properties: + containerName: + description: 'Container name: required for + volumes, optional for env vars' + type: string + divisor: + description: Specifies the output format + of the exposed resources, defaults to + "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the + pod's namespace + type: object + required: + - key + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret + or its key must be defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + envFrom: + description: |- + List of sources to populate environment variables in the Sidecar. + The keys defined within a source must be a C_IDENTIFIER. All invalid keys + will be reported as an event when the container is starting. When a key exists in multiple + sources, the value associated with the last source will take precedence. + Values defined by an Env with a duplicate key will take precedence. + Cannot be updated. + type: array + items: + description: EnvFromSource represents the source of + a set of ConfigMaps or Secrets + type: object + properties: + configMapRef: + description: The ConfigMap to select from + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap must + be defined + type: boolean + x-kubernetes-map-type: atomic + prefix: + description: |- + Optional text to prepend to the name of each environment variable. + May consist of any printable ASCII characters except '='. + type: string + secretRef: + description: The Secret to select from + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret must + be defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + image: + description: |- + Image reference name. + More info: https://kubernetes.io/docs/concepts/containers/images + type: string + imagePullPolicy: + description: |- + Image pull policy. + One of Always, Never, IfNotPresent. + Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/containers/images#updating-images + type: string + lifecycle: + description: |- + Actions that the management system should take in response to Sidecar lifecycle events. + Cannot be updated. + type: object + properties: + postStart: + description: |- + PostStart is called immediately after a container is created. If the handler fails, + the container is terminated and restarted according to its restart policy. + Other management of the container blocks until the hook completes. + More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks + type: object + properties: + exec: + description: Exec specifies a command to execute + in the container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + httpGet: + description: HTTPGet specifies an HTTP GET request + to perform. + type: object + required: + - port + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the + request. HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom + header to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + sleep: + description: Sleep represents a duration that + the container should sleep. + type: object + required: + - seconds + properties: + seconds: + description: Seconds is the number of seconds + to sleep. + type: integer + format: int64 + tcpSocket: + description: |- + Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept + for backward compatibility. There is no validation of this field and + lifecycle hooks will fail at runtime when it is specified. + type: object + required: + - port + properties: + host: + description: 'Optional: Host name to connect + to, defaults to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + preStop: + description: |- + PreStop is called immediately before a container is terminated due to an + API request or management event such as liveness/startup probe failure, + preemption, resource contention, etc. The handler is not called if the + container crashes or exits. The Pod's termination grace period countdown begins before the + PreStop hook is executed. Regardless of the outcome of the handler, the + container will eventually terminate within the Pod's termination grace + period (unless delayed by finalizers). Other management of the container blocks until the hook completes + or until the termination grace period is reached. + More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks + type: object + properties: + exec: + description: Exec specifies a command to execute + in the container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + httpGet: + description: HTTPGet specifies an HTTP GET request + to perform. + type: object + required: + - port + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the + request. HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom + header to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + sleep: + description: Sleep represents a duration that + the container should sleep. + type: object + required: + - seconds + properties: + seconds: + description: Seconds is the number of seconds + to sleep. + type: integer + format: int64 + tcpSocket: + description: |- + Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept + for backward compatibility. There is no validation of this field and + lifecycle hooks will fail at runtime when it is specified. + type: object + required: + - port + properties: + host: + description: 'Optional: Host name to connect + to, defaults to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + stopSignal: + description: |- + StopSignal defines which signal will be sent to a container when it is being stopped. + If not specified, the default is defined by the container runtime in use. + StopSignal can only be set for Pods with a non-empty .spec.os.name + type: string + livenessProbe: + description: |- + Periodic probe of Sidecar liveness. + Container will be restarted if the probe fails. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: object + properties: + exec: + description: Exec specifies a command to execute in + the container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + failureThreshold: + description: |- + Minimum consecutive failures for the probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. + type: integer + format: int32 + grpc: + description: GRPC specifies a GRPC HealthCheckRequest. + type: object + required: + - port + properties: + port: + description: Port number of the gRPC service. + Number must be in the range 1 to 65535. + type: integer + format: int32 + service: + description: |- + Service is the name of the service to place in the gRPC HealthCheckRequest + (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + + If this is not specified, the default behavior is defined by gRPC. + type: string + default: "" + httpGet: + description: HTTPGet specifies an HTTP GET request + to perform. + type: object + required: + - port + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + initialDelaySeconds: + description: |- + Number of seconds after the container has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + periodSeconds: + description: |- + How often (in seconds) to perform the probe. + Default to 10 seconds. Minimum value is 1. + type: integer + format: int32 + successThreshold: + description: |- + Minimum consecutive successes for the probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. + type: integer + format: int32 + tcpSocket: + description: TCPSocket specifies a connection to a + TCP port. + type: object + required: + - port + properties: + host: + description: 'Optional: Host name to connect to, + defaults to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + terminationGracePeriodSeconds: + description: |- + Optional duration in seconds the pod needs to terminate gracefully upon probe failure. + The grace period is the duration in seconds after the processes running in the pod are sent + a termination signal and the time when the processes are forcibly halted with a kill signal. + Set this value longer than the expected cleanup time for your process. + If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this + value overrides the value provided by the pod spec. + Value must be non-negative integer. The value zero indicates stop immediately via + the kill signal (no opportunity to shut down). + This is a beta field and requires enabling ProbeTerminationGracePeriod feature gate. + Minimum value is 1. spec.terminationGracePeriodSeconds is used if unset. + type: integer + format: int64 + timeoutSeconds: + description: |- + Number of seconds after which the probe times out. + Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + name: + description: |- + Name of the Sidecar specified as a DNS_LABEL. + Each Sidecar in a Task must have a unique name (DNS_LABEL). + Cannot be updated. + type: string + ports: + description: |- + List of ports to expose from the Sidecar. Exposing a port here gives + the system additional information about the network connections a + container uses, but is primarily informational. Not specifying a port here + DOES NOT prevent that port from being exposed. Any port which is + listening on the default "0.0.0.0" address inside a container will be + accessible from the network. + Cannot be updated. + type: array + items: + description: ContainerPort represents a network port + in a single container. + type: object + required: + - containerPort + properties: + containerPort: + description: |- + Number of port to expose on the pod's IP address. + This must be a valid port number, 0 < x < 65536. + type: integer + format: int32 + hostIP: + description: What host IP to bind the external port + to. + type: string + hostPort: + description: |- + Number of port to expose on the host. + If specified, this must be a valid port number, 0 < x < 65536. + If HostNetwork is specified, this must match ContainerPort. + Most containers do not need this. + type: integer + format: int32 + name: + description: |- + If specified, this must be an IANA_SVC_NAME and unique within the pod. Each + named port in a pod must have a unique name. Name for the port that can be + referred to by services. + type: string + protocol: + description: |- + Protocol for port. Must be UDP, TCP, or SCTP. + Defaults to "TCP". + type: string + default: TCP + x-kubernetes-list-map-keys: + - containerPort + - protocol + x-kubernetes-list-type: map + readinessProbe: + description: |- + Periodic probe of Sidecar service readiness. + Container will be removed from service endpoints if the probe fails. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: object + properties: + exec: + description: Exec specifies a command to execute in + the container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + failureThreshold: + description: |- + Minimum consecutive failures for the probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. + type: integer + format: int32 + grpc: + description: GRPC specifies a GRPC HealthCheckRequest. + type: object + required: + - port + properties: + port: + description: Port number of the gRPC service. + Number must be in the range 1 to 65535. + type: integer + format: int32 + service: + description: |- + Service is the name of the service to place in the gRPC HealthCheckRequest + (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + + If this is not specified, the default behavior is defined by gRPC. + type: string + default: "" + httpGet: + description: HTTPGet specifies an HTTP GET request + to perform. + type: object + required: + - port + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + initialDelaySeconds: + description: |- + Number of seconds after the container has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + periodSeconds: + description: |- + How often (in seconds) to perform the probe. + Default to 10 seconds. Minimum value is 1. + type: integer + format: int32 + successThreshold: + description: |- + Minimum consecutive successes for the probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. + type: integer + format: int32 + tcpSocket: + description: TCPSocket specifies a connection to a + TCP port. + type: object + required: + - port + properties: + host: + description: 'Optional: Host name to connect to, + defaults to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + terminationGracePeriodSeconds: + description: |- + Optional duration in seconds the pod needs to terminate gracefully upon probe failure. + The grace period is the duration in seconds after the processes running in the pod are sent + a termination signal and the time when the processes are forcibly halted with a kill signal. + Set this value longer than the expected cleanup time for your process. + If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this + value overrides the value provided by the pod spec. + Value must be non-negative integer. The value zero indicates stop immediately via + the kill signal (no opportunity to shut down). + This is a beta field and requires enabling ProbeTerminationGracePeriod feature gate. + Minimum value is 1. spec.terminationGracePeriodSeconds is used if unset. + type: integer + format: int64 + timeoutSeconds: + description: |- + Number of seconds after which the probe times out. + Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + restartPolicy: + description: |- + RestartPolicy refers to kubernetes RestartPolicy. It can only be set for an + initContainer and must have it's policy set to "Always". It is currently + left optional to help support Kubernetes versions prior to 1.29 when this feature + was introduced. + type: string + script: + description: |- + Script is the contents of an executable file to execute. + + If Script is not empty, the Step cannot have an Command or Args. + type: string + securityContext: + description: |- + SecurityContext defines the security options the Sidecar should be run with. + If set, the fields of SecurityContext override the equivalent fields of PodSecurityContext. + More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ + type: object + properties: + allowPrivilegeEscalation: + description: |- + AllowPrivilegeEscalation controls whether a process can gain more + privileges than its parent process. This bool directly controls if + the no_new_privs flag will be set on the container process. + AllowPrivilegeEscalation is true always when the container is: + 1) run as Privileged + 2) has CAP_SYS_ADMIN + Note that this field cannot be set when spec.os.name is windows. + type: boolean + appArmorProfile: + description: |- + appArmorProfile is the AppArmor options to use by this container. If set, this profile + overrides the pod's appArmorProfile. + Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile loaded on the node that should be used. + The profile must be preconfigured on the node to work. + Must match the loaded name of the profile. + Must be set if and only if type is "Localhost". + type: string + type: + description: |- + type indicates which kind of AppArmor profile will be applied. + Valid options are: + Localhost - a profile pre-loaded on the node. + RuntimeDefault - the container runtime's default profile. + Unconfined - no AppArmor enforcement. + type: string + capabilities: + description: |- + The capabilities to add/drop when running containers. + Defaults to the default set of capabilities granted by the container runtime. + Note that this field cannot be set when spec.os.name is windows. + type: object + properties: + add: + description: Added capabilities + type: array + items: + description: Capability represent POSIX capabilities + type + type: string + x-kubernetes-list-type: atomic + drop: + description: Removed capabilities + type: array + items: + description: Capability represent POSIX capabilities + type + type: string + x-kubernetes-list-type: atomic + privileged: + description: |- + Run container in privileged mode. + Processes in privileged containers are essentially equivalent to root on the host. + Defaults to false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + procMount: + description: |- + procMount denotes the type of proc mount to use for the containers. + The default value is Default which uses the container runtime defaults for + readonly paths and masked paths. + This requires the ProcMountType feature flag to be enabled. + Note that this field cannot be set when spec.os.name is windows. + type: string + readOnlyRootFilesystem: + description: |- + Whether this container has a read-only root filesystem. + Default is false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + runAsGroup: + description: |- + The GID to run the entrypoint of the container process. + Uses runtime default if unset. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + runAsNonRoot: + description: |- + Indicates that the container must run as a non-root user. + If true, the Kubelet will validate the image at runtime to ensure that it + does not run as UID 0 (root) and fail to start the container if it does. + If unset or false, no such validation will be performed. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: boolean + runAsUser: + description: |- + The UID to run the entrypoint of the container process. + Defaults to user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + seLinuxOptions: + description: |- + The SELinux context to be applied to the container. + If unspecified, the container runtime will allocate a random SELinux context for each + container. May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: object + properties: + level: + description: Level is SELinux level label that + applies to the container. + type: string + role: + description: Role is a SELinux role label that + applies to the container. + type: string + type: + description: Type is a SELinux type label that + applies to the container. + type: string + user: + description: User is a SELinux user label that + applies to the container. + type: string + seccompProfile: + description: |- + The seccomp options to use by this container. If seccomp options are + provided at both the pod & container level, the container options + override the pod options. + Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile defined in a file on the node should be used. + The profile must be preconfigured on the node to work. + Must be a descending path, relative to the kubelet's configured seccomp profile location. + Must be set if type is "Localhost". Must NOT be set for any other type. + type: string + type: + description: |- + type indicates which kind of seccomp profile will be applied. + Valid options are: + + Localhost - a profile defined in a file on the node should be used. + RuntimeDefault - the container runtime default profile should be used. + Unconfined - no profile should be applied. + type: string + windowsOptions: + description: |- + The Windows specific settings applied to all containers. + If unspecified, the options from the PodSecurityContext will be used. + If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is linux. + type: object + properties: + gmsaCredentialSpec: + description: |- + GMSACredentialSpec is where the GMSA admission webhook + (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the + GMSA credential spec named by the GMSACredentialSpecName field. + type: string + gmsaCredentialSpecName: + description: GMSACredentialSpecName is the name + of the GMSA credential spec to use. + type: string + hostProcess: + description: |- + HostProcess determines if a container should be run as a 'Host Process' container. + All of a Pod's containers must have the same effective HostProcess value + (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers). + In addition, if HostProcess is true then HostNetwork must also be set to true. + type: boolean + runAsUserName: + description: |- + The UserName in Windows to run the entrypoint of the container process. + Defaults to the user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: string + startupProbe: + description: |- + StartupProbe indicates that the Pod the Sidecar is running in has successfully initialized. + If specified, no other probes are executed until this completes successfully. + If this probe fails, the Pod will be restarted, just as if the livenessProbe failed. + This can be used to provide different probe parameters at the beginning of a Pod's lifecycle, + when it might take a long time to load data or warm a cache, than during steady-state operation. + This cannot be updated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: object + properties: + exec: + description: Exec specifies a command to execute in + the container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + failureThreshold: + description: |- + Minimum consecutive failures for the probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. + type: integer + format: int32 + grpc: + description: GRPC specifies a GRPC HealthCheckRequest. + type: object + required: + - port + properties: + port: + description: Port number of the gRPC service. + Number must be in the range 1 to 65535. + type: integer + format: int32 + service: + description: |- + Service is the name of the service to place in the gRPC HealthCheckRequest + (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + + If this is not specified, the default behavior is defined by gRPC. + type: string + default: "" + httpGet: + description: HTTPGet specifies an HTTP GET request + to perform. + type: object + required: + - port + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + initialDelaySeconds: + description: |- + Number of seconds after the container has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + periodSeconds: + description: |- + How often (in seconds) to perform the probe. + Default to 10 seconds. Minimum value is 1. + type: integer + format: int32 + successThreshold: + description: |- + Minimum consecutive successes for the probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. + type: integer + format: int32 + tcpSocket: + description: TCPSocket specifies a connection to a + TCP port. + type: object + required: + - port + properties: + host: + description: 'Optional: Host name to connect to, + defaults to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + terminationGracePeriodSeconds: + description: |- + Optional duration in seconds the pod needs to terminate gracefully upon probe failure. + The grace period is the duration in seconds after the processes running in the pod are sent + a termination signal and the time when the processes are forcibly halted with a kill signal. + Set this value longer than the expected cleanup time for your process. + If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this + value overrides the value provided by the pod spec. + Value must be non-negative integer. The value zero indicates stop immediately via + the kill signal (no opportunity to shut down). + This is a beta field and requires enabling ProbeTerminationGracePeriod feature gate. + Minimum value is 1. spec.terminationGracePeriodSeconds is used if unset. + type: integer + format: int64 + timeoutSeconds: + description: |- + Number of seconds after which the probe times out. + Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + stdin: + description: |- + Whether this Sidecar should allocate a buffer for stdin in the container runtime. If this + is not set, reads from stdin in the Sidecar will always result in EOF. + Default is false. + type: boolean + stdinOnce: + description: |- + Whether the container runtime should close the stdin channel after it has been opened by + a single attach. When stdin is true the stdin stream will remain open across multiple attach + sessions. If stdinOnce is set to true, stdin is opened on Sidecar start, is empty until the + first client attaches to stdin, and then remains open and accepts data until the client disconnects, + at which time stdin is closed and remains closed until the Sidecar is restarted. If this + flag is false, a container processes that reads from stdin will never receive an EOF. + Default is false + type: boolean + terminationMessagePath: + description: |- + Optional: Path at which the file to which the Sidecar's termination message + will be written is mounted into the Sidecar's filesystem. + Message written is intended to be brief final status, such as an assertion failure message. + Will be truncated by the node if greater than 4096 bytes. The total message length across + all containers will be limited to 12kb. + Defaults to /dev/termination-log. + Cannot be updated. + type: string + terminationMessagePolicy: + description: |- + Indicate how the termination message should be populated. File will use the contents of + terminationMessagePath to populate the Sidecar status message on both success and failure. + FallbackToLogsOnError will use the last chunk of Sidecar log output if the termination + message file is empty and the Sidecar exited with an error. + The log output is limited to 2048 bytes or 80 lines, whichever is smaller. + Defaults to File. + Cannot be updated. + type: string + tty: + description: |- + Whether this Sidecar should allocate a TTY for itself, also requires 'stdin' to be true. + Default is false. + type: boolean + volumeDevices: + description: volumeDevices is the list of block devices + to be used by the Sidecar. + type: array + items: + description: volumeDevice describes a mapping of a raw + block device within a container. + type: object + required: + - devicePath + - name + properties: + devicePath: + description: devicePath is the path inside of the + container that the device will be mapped to. + type: string + name: + description: name must match the name of a persistentVolumeClaim + in the pod + type: string + x-kubernetes-list-type: atomic + volumeMounts: + description: |- + Volumes to mount into the Sidecar's filesystem. + Cannot be updated. + type: array + items: + description: VolumeMount describes a mounting of a Volume + within a container. + type: object + required: + - mountPath + - name + properties: + mountPath: + description: |- + Path within the container at which the volume should be mounted. Must + not contain ':'. + type: string + mountPropagation: + description: |- + mountPropagation determines how mounts are propagated from the host + to container and the other way around. + When not set, MountPropagationNone is used. + This field is beta in 1.10. + When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified + (which defaults to None). + type: string + name: + description: This must match the Name of a Volume. + type: string + readOnly: + description: |- + Mounted read-only if true, read-write otherwise (false or unspecified). + Defaults to false. + type: boolean + recursiveReadOnly: + description: |- + RecursiveReadOnly specifies whether read-only mounts should be handled + recursively. + + If ReadOnly is false, this field has no meaning and must be unspecified. + + If ReadOnly is true, and this field is set to Disabled, the mount is not made + recursively read-only. If this field is set to IfPossible, the mount is made + recursively read-only, if it is supported by the container runtime. If this + field is set to Enabled, the mount is made recursively read-only if it is + supported by the container runtime, otherwise the pod will not be started and + an error will be generated to indicate the reason. + + If this field is set to IfPossible or Enabled, MountPropagation must be set to + None (or be unspecified, which defaults to None). + + If this field is not specified, it is treated as an equivalent of Disabled. + type: string + subPath: + description: |- + Path within the volume from which the container's volume should be mounted. + Defaults to "" (volume's root). + type: string + subPathExpr: + description: |- + Expanded path within the volume from which the container's volume should be mounted. + Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment. + Defaults to "" (volume's root). + SubPathExpr and SubPath are mutually exclusive. + type: string + x-kubernetes-list-type: atomic + workingDir: + description: |- + Sidecar's working directory. + If not specified, the container runtime's default will be used, which + might be configured in the container image. + Cannot be updated. + type: string + workspaces: + description: |- + This is an alpha field. You must set the "enable-api-fields" feature flag to "alpha" + for this field to be supported. + + Workspaces is a list of workspaces from the Task that this Sidecar wants + exclusive access to. Adding a workspace to this list means that any + other Step or Sidecar that does not also request this Workspace will + not have access to it. + type: array + items: + description: |- + WorkspaceUsage is used by a Step or Sidecar to declare that it wants isolated access + to a Workspace defined in a Task. + type: object + required: + - mountPath + - name + properties: + mountPath: + description: |- + MountPath is the path that the workspace should be mounted to inside the Step or Sidecar, + overriding any MountPath specified in the Task's WorkspaceDeclaration. + type: string + name: + description: Name is the name of the workspace this + Step or Sidecar wants access to. + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + stepTemplate: + description: |- + StepTemplate can be used as the basis for all step containers within the + Task, so that the steps inherit settings on the base container. + type: object + properties: + args: + description: |- + Arguments to the entrypoint. + The image's CMD is used if this is not provided. + Variable references $(VAR_NAME) are expanded using the Step's environment. If a variable + cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will + produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless + of whether the variable exists or not. Cannot be updated. + More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell + type: array + items: + type: string + x-kubernetes-list-type: atomic + command: + description: |- + Entrypoint array. Not executed within a shell. + The image's ENTRYPOINT is used if this is not provided. + Variable references $(VAR_NAME) are expanded using the Step's environment. If a variable + cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will + produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless + of whether the variable exists or not. Cannot be updated. + More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell + type: array + items: + type: string + x-kubernetes-list-type: atomic + computeResources: + description: |- + ComputeResources required by this Step. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This field depends on the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + type: array + items: + description: ResourceClaim references one entry in + PodSpec.ResourceClaims. + type: object + required: + - name + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + requests: + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + env: + description: |- + List of environment variables to set in the Step. + Cannot be updated. + type: array + items: + description: EnvVar represents an environment variable + present in a Container. + type: object + required: + - name + properties: + name: + description: |- + Name of the environment variable. + May consist of any printable ASCII characters except '='. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's + value. Cannot be used if value is not empty. + type: object + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + type: object + required: + - key + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + type: object + required: + - fieldPath + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in + the specified API version. + type: string + x-kubernetes-map-type: atomic + fileKeyRef: + description: |- + FileKeyRef selects a key of the env file. + Requires the EnvFiles feature gate to be enabled. + type: object + required: + - key + - path + - volumeName + properties: + key: + description: |- + The key within the env file. An invalid key will prevent the pod from starting. + The keys defined within a source may consist of any printable ASCII characters except '='. + During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters. + type: string + optional: + description: |- + Specify whether the file or its key must be defined. If the file or key + does not exist, then the env var is not published. + If optional is set to true and the specified key does not exist, + the environment variable will not be set in the Pod's containers. + + If optional is set to false and the specified key does not exist, + an error will be returned during Pod creation. + type: boolean + default: false + path: + description: |- + The path within the volume from which to select the file. + Must be relative and may not contain the '..' path or start with '..'. + type: string + volumeName: + description: The name of the volume mount + containing the env file. + type: string + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + type: object + required: + - resource + properties: + containerName: + description: 'Container name: required for + volumes, optional for env vars' + type: string + divisor: + description: Specifies the output format of + the exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the + pod's namespace + type: object + required: + - key + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + envFrom: + description: |- + List of sources to populate environment variables in the Step. + The keys defined within a source must be a C_IDENTIFIER. All invalid keys + will be reported as an event when the Step is starting. When a key exists in multiple + sources, the value associated with the last source will take precedence. + Values defined by an Env with a duplicate key will take precedence. + Cannot be updated. + type: array + items: + description: EnvFromSource represents the source of a + set of ConfigMaps or Secrets + type: object + properties: + configMapRef: + description: The ConfigMap to select from + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap must + be defined + type: boolean + x-kubernetes-map-type: atomic + prefix: + description: |- + Optional text to prepend to the name of each environment variable. + May consist of any printable ASCII characters except '='. + type: string + secretRef: + description: The Secret to select from + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret must be + defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + image: + description: |- + Image reference name. + More info: https://kubernetes.io/docs/concepts/containers/images + type: string + imagePullPolicy: + description: |- + Image pull policy. + One of Always, Never, IfNotPresent. + Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/containers/images#updating-images + type: string + securityContext: + description: |- + SecurityContext defines the security options the Step should be run with. + If set, the fields of SecurityContext override the equivalent fields of PodSecurityContext. + More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ + type: object + properties: + allowPrivilegeEscalation: + description: |- + AllowPrivilegeEscalation controls whether a process can gain more + privileges than its parent process. This bool directly controls if + the no_new_privs flag will be set on the container process. + AllowPrivilegeEscalation is true always when the container is: + 1) run as Privileged + 2) has CAP_SYS_ADMIN + Note that this field cannot be set when spec.os.name is windows. + type: boolean + appArmorProfile: + description: |- + appArmorProfile is the AppArmor options to use by this container. If set, this profile + overrides the pod's appArmorProfile. + Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile loaded on the node that should be used. + The profile must be preconfigured on the node to work. + Must match the loaded name of the profile. + Must be set if and only if type is "Localhost". + type: string + type: + description: |- + type indicates which kind of AppArmor profile will be applied. + Valid options are: + Localhost - a profile pre-loaded on the node. + RuntimeDefault - the container runtime's default profile. + Unconfined - no AppArmor enforcement. + type: string + capabilities: + description: |- + The capabilities to add/drop when running containers. + Defaults to the default set of capabilities granted by the container runtime. + Note that this field cannot be set when spec.os.name is windows. + type: object + properties: + add: + description: Added capabilities + type: array + items: + description: Capability represent POSIX capabilities + type + type: string + x-kubernetes-list-type: atomic + drop: + description: Removed capabilities + type: array + items: + description: Capability represent POSIX capabilities + type + type: string + x-kubernetes-list-type: atomic + privileged: + description: |- + Run container in privileged mode. + Processes in privileged containers are essentially equivalent to root on the host. + Defaults to false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + procMount: + description: |- + procMount denotes the type of proc mount to use for the containers. + The default value is Default which uses the container runtime defaults for + readonly paths and masked paths. + This requires the ProcMountType feature flag to be enabled. + Note that this field cannot be set when spec.os.name is windows. + type: string + readOnlyRootFilesystem: + description: |- + Whether this container has a read-only root filesystem. + Default is false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + runAsGroup: + description: |- + The GID to run the entrypoint of the container process. + Uses runtime default if unset. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + runAsNonRoot: + description: |- + Indicates that the container must run as a non-root user. + If true, the Kubelet will validate the image at runtime to ensure that it + does not run as UID 0 (root) and fail to start the container if it does. + If unset or false, no such validation will be performed. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: boolean + runAsUser: + description: |- + The UID to run the entrypoint of the container process. + Defaults to user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + seLinuxOptions: + description: |- + The SELinux context to be applied to the container. + If unspecified, the container runtime will allocate a random SELinux context for each + container. May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: object + properties: + level: + description: Level is SELinux level label that applies + to the container. + type: string + role: + description: Role is a SELinux role label that applies + to the container. + type: string + type: + description: Type is a SELinux type label that applies + to the container. + type: string + user: + description: User is a SELinux user label that applies + to the container. + type: string + seccompProfile: + description: |- + The seccomp options to use by this container. If seccomp options are + provided at both the pod & container level, the container options + override the pod options. + Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile defined in a file on the node should be used. + The profile must be preconfigured on the node to work. + Must be a descending path, relative to the kubelet's configured seccomp profile location. + Must be set if type is "Localhost". Must NOT be set for any other type. + type: string + type: + description: |- + type indicates which kind of seccomp profile will be applied. + Valid options are: + + Localhost - a profile defined in a file on the node should be used. + RuntimeDefault - the container runtime default profile should be used. + Unconfined - no profile should be applied. + type: string + windowsOptions: + description: |- + The Windows specific settings applied to all containers. + If unspecified, the options from the PodSecurityContext will be used. + If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is linux. + type: object + properties: + gmsaCredentialSpec: + description: |- + GMSACredentialSpec is where the GMSA admission webhook + (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the + GMSA credential spec named by the GMSACredentialSpecName field. + type: string + gmsaCredentialSpecName: + description: GMSACredentialSpecName is the name + of the GMSA credential spec to use. + type: string + hostProcess: + description: |- + HostProcess determines if a container should be run as a 'Host Process' container. + All of a Pod's containers must have the same effective HostProcess value + (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers). + In addition, if HostProcess is true then HostNetwork must also be set to true. + type: boolean + runAsUserName: + description: |- + The UserName in Windows to run the entrypoint of the container process. + Defaults to the user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: string + volumeDevices: + description: volumeDevices is the list of block devices + to be used by the Step. + type: array + items: + description: volumeDevice describes a mapping of a raw + block device within a container. + type: object + required: + - devicePath + - name + properties: + devicePath: + description: devicePath is the path inside of the + container that the device will be mapped to. + type: string + name: + description: name must match the name of a persistentVolumeClaim + in the pod + type: string + x-kubernetes-list-type: atomic + volumeMounts: + description: |- + Volumes to mount into the Step's filesystem. + Cannot be updated. + type: array + items: + description: VolumeMount describes a mounting of a Volume + within a container. + type: object + required: + - mountPath + - name + properties: + mountPath: + description: |- + Path within the container at which the volume should be mounted. Must + not contain ':'. + type: string + mountPropagation: + description: |- + mountPropagation determines how mounts are propagated from the host + to container and the other way around. + When not set, MountPropagationNone is used. + This field is beta in 1.10. + When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified + (which defaults to None). + type: string + name: + description: This must match the Name of a Volume. + type: string + readOnly: + description: |- + Mounted read-only if true, read-write otherwise (false or unspecified). + Defaults to false. + type: boolean + recursiveReadOnly: + description: |- + RecursiveReadOnly specifies whether read-only mounts should be handled + recursively. + + If ReadOnly is false, this field has no meaning and must be unspecified. + + If ReadOnly is true, and this field is set to Disabled, the mount is not made + recursively read-only. If this field is set to IfPossible, the mount is made + recursively read-only, if it is supported by the container runtime. If this + field is set to Enabled, the mount is made recursively read-only if it is + supported by the container runtime, otherwise the pod will not be started and + an error will be generated to indicate the reason. + + If this field is set to IfPossible or Enabled, MountPropagation must be set to + None (or be unspecified, which defaults to None). + + If this field is not specified, it is treated as an equivalent of Disabled. + type: string + subPath: + description: |- + Path within the volume from which the container's volume should be mounted. + Defaults to "" (volume's root). + type: string + subPathExpr: + description: |- + Expanded path within the volume from which the container's volume should be mounted. + Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment. + Defaults to "" (volume's root). + SubPathExpr and SubPath are mutually exclusive. + type: string + x-kubernetes-list-type: atomic + workingDir: + description: |- + Step's working directory. + If not specified, the container runtime's default will be used, which + might be configured in the container image. + Cannot be updated. + type: string + steps: + description: |- + Steps are the steps of the build; each step is run sequentially with the + source mounted into /workspace. + type: array + items: + description: Step runs a subcomponent of a Task + type: object + required: + - name + properties: + args: + description: |- + Arguments to the entrypoint. + The image's CMD is used if this is not provided. + Variable references $(VAR_NAME) are expanded using the container's environment. If a variable + cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will + produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless + of whether the variable exists or not. Cannot be updated. + More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell + type: array + items: + type: string + x-kubernetes-list-type: atomic + command: + description: |- + Entrypoint array. Not executed within a shell. + The image's ENTRYPOINT is used if this is not provided. + Variable references $(VAR_NAME) are expanded using the container's environment. If a variable + cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will + produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless + of whether the variable exists or not. Cannot be updated. + More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell + type: array + items: + type: string + x-kubernetes-list-type: atomic + computeResources: + description: |- + ComputeResources required by this Step. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This field depends on the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + type: array + items: + description: ResourceClaim references one entry + in PodSpec.ResourceClaims. + type: object + required: + - name + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + requests: + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + displayName: + description: |- + DisplayName is a user-facing name of the step that may be + used to populate a UI. + type: string + env: + description: |- + List of environment variables to set in the Step. + Cannot be updated. + type: array + items: + description: EnvVar represents an environment variable + present in a Container. + type: object + required: + - name + properties: + name: + description: |- + Name of the environment variable. + May consist of any printable ASCII characters except '='. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's + value. Cannot be used if value is not empty. + type: object + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + type: object + required: + - key + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + type: object + required: + - fieldPath + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select + in the specified API version. + type: string + x-kubernetes-map-type: atomic + fileKeyRef: + description: |- + FileKeyRef selects a key of the env file. + Requires the EnvFiles feature gate to be enabled. + type: object + required: + - key + - path + - volumeName + properties: + key: + description: |- + The key within the env file. An invalid key will prevent the pod from starting. + The keys defined within a source may consist of any printable ASCII characters except '='. + During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters. + type: string + optional: + description: |- + Specify whether the file or its key must be defined. If the file or key + does not exist, then the env var is not published. + If optional is set to true and the specified key does not exist, + the environment variable will not be set in the Pod's containers. + + If optional is set to false and the specified key does not exist, + an error will be returned during Pod creation. + type: boolean + default: false + path: + description: |- + The path within the volume from which to select the file. + Must be relative and may not contain the '..' path or start with '..'. + type: string + volumeName: + description: The name of the volume mount + containing the env file. + type: string + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + type: object + required: + - resource + properties: + containerName: + description: 'Container name: required for + volumes, optional for env vars' + type: string + divisor: + description: Specifies the output format + of the exposed resources, defaults to + "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the + pod's namespace + type: object + required: + - key + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret + or its key must be defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + envFrom: + description: |- + List of sources to populate environment variables in the Step. + The keys defined within a source must be a C_IDENTIFIER. All invalid keys + will be reported as an event when the Step is starting. When a key exists in multiple + sources, the value associated with the last source will take precedence. + Values defined by an Env with a duplicate key will take precedence. + Cannot be updated. + type: array + items: + description: EnvFromSource represents the source of + a set of ConfigMaps or Secrets + type: object + properties: + configMapRef: + description: The ConfigMap to select from + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap must + be defined + type: boolean + x-kubernetes-map-type: atomic + prefix: + description: |- + Optional text to prepend to the name of each environment variable. + May consist of any printable ASCII characters except '='. + type: string + secretRef: + description: The Secret to select from + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret must + be defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + image: + description: |- + Docker image name. + More info: https://kubernetes.io/docs/concepts/containers/images + type: string + imagePullPolicy: + description: |- + Image pull policy. + One of Always, Never, IfNotPresent. + Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/containers/images#updating-images + type: string + name: + description: |- + Name of the Step specified as a DNS_LABEL. + Each Step in a Task must have a unique name. + type: string + onError: + description: |- + OnError defines the exiting behavior of a container on error + can be set to [ continue | stopAndFail ] + type: string + params: + description: Params declares parameters passed to this + step action. + type: array + items: + description: Param declares an ParamValues to use for + the parameter called name. + type: object + required: + - name + - value + properties: + name: + type: string + value: + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + ref: + description: Contains the reference to an existing StepAction. + type: object + properties: + name: + description: Name of the referenced step + type: string + params: + description: |- + Params contains the parameters used to identify the + referenced Tekton resource. Example entries might include + "repo" or "path" but the set of params ultimately depends on + the chosen resolver. + type: array + items: + description: Param declares an ParamValues to use + for the parameter called name. + type: object + required: + - name + - value + properties: + name: + type: string + value: + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + resolver: + description: |- + Resolver is the name of the resolver that should perform + resolution of the referenced Tekton resource, such as "git". + type: string + results: + description: |- + Results declares StepResults produced by the Step. + + It can be used in an inlined Step when used to store Results to $(step.results.resultName.path). + It cannot be used when referencing StepActions using [v1.Step.Ref]. + The Results declared by the StepActions will be stored here instead. + type: array + items: + description: StepResult used to describe the Results + of a Step. + type: object + required: + - name + properties: + description: + description: Description is a human-readable description + of the result + type: string + name: + description: Name the given name + type: string + properties: + description: Properties is the JSON Schema properties + to support key-value pairs results. + type: object + additionalProperties: + description: PropertySpec defines the struct for + object keys + type: object + properties: + type: + description: |- + ParamType indicates the type of an input parameter; + Used to distinguish between a single string and an array of strings. + type: string + type: + description: The possible types are 'string', 'array', + and 'object', with 'string' as the default. + type: string + x-kubernetes-list-type: atomic + script: + description: |- + Script is the contents of an executable file to execute. + + If Script is not empty, the Step cannot have an Command and the Args will be passed to the Script. + type: string + securityContext: + description: |- + SecurityContext defines the security options the Step should be run with. + If set, the fields of SecurityContext override the equivalent fields of PodSecurityContext. + More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ + type: object + properties: + allowPrivilegeEscalation: + description: |- + AllowPrivilegeEscalation controls whether a process can gain more + privileges than its parent process. This bool directly controls if + the no_new_privs flag will be set on the container process. + AllowPrivilegeEscalation is true always when the container is: + 1) run as Privileged + 2) has CAP_SYS_ADMIN + Note that this field cannot be set when spec.os.name is windows. + type: boolean + appArmorProfile: + description: |- + appArmorProfile is the AppArmor options to use by this container. If set, this profile + overrides the pod's appArmorProfile. + Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile loaded on the node that should be used. + The profile must be preconfigured on the node to work. + Must match the loaded name of the profile. + Must be set if and only if type is "Localhost". + type: string + type: + description: |- + type indicates which kind of AppArmor profile will be applied. + Valid options are: + Localhost - a profile pre-loaded on the node. + RuntimeDefault - the container runtime's default profile. + Unconfined - no AppArmor enforcement. + type: string + capabilities: + description: |- + The capabilities to add/drop when running containers. + Defaults to the default set of capabilities granted by the container runtime. + Note that this field cannot be set when spec.os.name is windows. + type: object + properties: + add: + description: Added capabilities + type: array + items: + description: Capability represent POSIX capabilities + type + type: string + x-kubernetes-list-type: atomic + drop: + description: Removed capabilities + type: array + items: + description: Capability represent POSIX capabilities + type + type: string + x-kubernetes-list-type: atomic + privileged: + description: |- + Run container in privileged mode. + Processes in privileged containers are essentially equivalent to root on the host. + Defaults to false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + procMount: + description: |- + procMount denotes the type of proc mount to use for the containers. + The default value is Default which uses the container runtime defaults for + readonly paths and masked paths. + This requires the ProcMountType feature flag to be enabled. + Note that this field cannot be set when spec.os.name is windows. + type: string + readOnlyRootFilesystem: + description: |- + Whether this container has a read-only root filesystem. + Default is false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + runAsGroup: + description: |- + The GID to run the entrypoint of the container process. + Uses runtime default if unset. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + runAsNonRoot: + description: |- + Indicates that the container must run as a non-root user. + If true, the Kubelet will validate the image at runtime to ensure that it + does not run as UID 0 (root) and fail to start the container if it does. + If unset or false, no such validation will be performed. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: boolean + runAsUser: + description: |- + The UID to run the entrypoint of the container process. + Defaults to user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + seLinuxOptions: + description: |- + The SELinux context to be applied to the container. + If unspecified, the container runtime will allocate a random SELinux context for each + container. May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: object + properties: + level: + description: Level is SELinux level label that + applies to the container. + type: string + role: + description: Role is a SELinux role label that + applies to the container. + type: string + type: + description: Type is a SELinux type label that + applies to the container. + type: string + user: + description: User is a SELinux user label that + applies to the container. + type: string + seccompProfile: + description: |- + The seccomp options to use by this container. If seccomp options are + provided at both the pod & container level, the container options + override the pod options. + Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile defined in a file on the node should be used. + The profile must be preconfigured on the node to work. + Must be a descending path, relative to the kubelet's configured seccomp profile location. + Must be set if type is "Localhost". Must NOT be set for any other type. + type: string + type: + description: |- + type indicates which kind of seccomp profile will be applied. + Valid options are: + + Localhost - a profile defined in a file on the node should be used. + RuntimeDefault - the container runtime default profile should be used. + Unconfined - no profile should be applied. + type: string + windowsOptions: + description: |- + The Windows specific settings applied to all containers. + If unspecified, the options from the PodSecurityContext will be used. + If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is linux. + type: object + properties: + gmsaCredentialSpec: + description: |- + GMSACredentialSpec is where the GMSA admission webhook + (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the + GMSA credential spec named by the GMSACredentialSpecName field. + type: string + gmsaCredentialSpecName: + description: GMSACredentialSpecName is the name + of the GMSA credential spec to use. + type: string + hostProcess: + description: |- + HostProcess determines if a container should be run as a 'Host Process' container. + All of a Pod's containers must have the same effective HostProcess value + (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers). + In addition, if HostProcess is true then HostNetwork must also be set to true. + type: boolean + runAsUserName: + description: |- + The UserName in Windows to run the entrypoint of the container process. + Defaults to the user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: string + stderrConfig: + description: Stores configuration for the stderr stream + of the step. + type: object + properties: + path: + description: Path to duplicate stdout stream to on + container's local filesystem. + type: string + stdoutConfig: + description: Stores configuration for the stdout stream + of the step. + type: object + properties: + path: + description: Path to duplicate stdout stream to on + container's local filesystem. + type: string + timeout: + description: |- + Timeout is the time after which the step times out. Defaults to never. + Refer to Go's ParseDuration documentation for expected format: https://golang.org/pkg/time/#ParseDuration + type: string + volumeDevices: + description: volumeDevices is the list of block devices + to be used by the Step. + type: array + items: + description: volumeDevice describes a mapping of a raw + block device within a container. + type: object + required: + - devicePath + - name + properties: + devicePath: + description: devicePath is the path inside of the + container that the device will be mapped to. + type: string + name: + description: name must match the name of a persistentVolumeClaim + in the pod + type: string + x-kubernetes-list-type: atomic + volumeMounts: + description: |- + Volumes to mount into the Step's filesystem. + Cannot be updated. + type: array + items: + description: VolumeMount describes a mounting of a Volume + within a container. + type: object + required: + - mountPath + - name + properties: + mountPath: + description: |- + Path within the container at which the volume should be mounted. Must + not contain ':'. + type: string + mountPropagation: + description: |- + mountPropagation determines how mounts are propagated from the host + to container and the other way around. + When not set, MountPropagationNone is used. + This field is beta in 1.10. + When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified + (which defaults to None). + type: string + name: + description: This must match the Name of a Volume. + type: string + readOnly: + description: |- + Mounted read-only if true, read-write otherwise (false or unspecified). + Defaults to false. + type: boolean + recursiveReadOnly: + description: |- + RecursiveReadOnly specifies whether read-only mounts should be handled + recursively. + + If ReadOnly is false, this field has no meaning and must be unspecified. + + If ReadOnly is true, and this field is set to Disabled, the mount is not made + recursively read-only. If this field is set to IfPossible, the mount is made + recursively read-only, if it is supported by the container runtime. If this + field is set to Enabled, the mount is made recursively read-only if it is + supported by the container runtime, otherwise the pod will not be started and + an error will be generated to indicate the reason. + + If this field is set to IfPossible or Enabled, MountPropagation must be set to + None (or be unspecified, which defaults to None). + + If this field is not specified, it is treated as an equivalent of Disabled. + type: string + subPath: + description: |- + Path within the volume from which the container's volume should be mounted. + Defaults to "" (volume's root). + type: string + subPathExpr: + description: |- + Expanded path within the volume from which the container's volume should be mounted. + Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment. + Defaults to "" (volume's root). + SubPathExpr and SubPath are mutually exclusive. + type: string + x-kubernetes-list-type: atomic + when: + description: When is a list of when expressions that need + to be true for the task to run + type: array + items: + description: |- + WhenExpression allows a PipelineTask to declare expressions to be evaluated before the Task is run + to determine whether the Task should be executed or skipped + type: object + properties: + cel: + description: |- + CEL is a string of Common Language Expression, which can be used to conditionally execute + the task based on the result of the expression evaluation + More info about CEL syntax: https://github.com/google/cel-spec/blob/master/doc/langdef.md + type: string + input: + description: Input is the string for guard checking + which can be a static input or an output from + a parent Task + type: string + operator: + description: Operator that represents an Input's + relationship to the values + type: string + values: + description: |- + Values is an array of strings, which is compared against the input, for guard checking + It must be non-empty + type: array + items: + type: string + x-kubernetes-list-type: atomic + workingDir: + description: |- + Step's working directory. + If not specified, the container runtime's default will be used, which + might be configured in the container image. + Cannot be updated. + type: string + workspaces: + description: |- + This is an alpha field. You must set the "enable-api-fields" feature flag to "alpha" + for this field to be supported. + + Workspaces is a list of workspaces from the Task that this Step wants + exclusive access to. Adding a workspace to this list means that any + other Step or Sidecar that does not also request this Workspace will + not have access to it. + type: array + items: + description: |- + WorkspaceUsage is used by a Step or Sidecar to declare that it wants isolated access + to a Workspace defined in a Task. + type: object + required: + - mountPath + - name + properties: + mountPath: + description: |- + MountPath is the path that the workspace should be mounted to inside the Step or Sidecar, + overriding any MountPath specified in the Task's WorkspaceDeclaration. + type: string + name: + description: Name is the name of the workspace this + Step or Sidecar wants access to. + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + volumes: + description: |- + Volumes is a collection of volumes that are available to mount into the + steps of the build. + See Pod.spec.volumes (API version: v1) + x-kubernetes-preserve-unknown-fields: true + workspaces: + description: Workspaces are the volumes that this Task requires. + type: array + items: + description: WorkspaceDeclaration is a declaration of a volume + that a Task requires. + type: object + required: + - name + properties: + description: + description: Description is an optional human readable + description of this volume. + type: string + mountPath: + description: MountPath overrides the directory that the + volume will be made available at. + type: string + name: + description: Name is the name by which you can bind the + volume at runtime. + type: string + optional: + description: |- + Optional marks a Workspace as not being required in TaskRuns. By default + this field is false and so declared workspaces are required. + type: boolean + readOnly: + description: |- + ReadOnly dictates whether a mounted volume is writable. By default this + field is false and so mounted volumes are writable. + type: boolean + x-kubernetes-list-type: atomic + additionalPrinterColumns: + - name: Succeeded + type: string + jsonPath: ".status.conditions[?(@.type==\"Succeeded\")].status" + - name: Reason + type: string + jsonPath: ".status.conditions[?(@.type==\"Succeeded\")].reason" + - name: StartTime + type: date + jsonPath: .status.startTime + - name: CompletionTime + type: date + jsonPath: .status.completionTime + # Opt into the status subresource so metadata.generation + # starts to increment + subresources: + status: {} + names: + kind: TaskRun + plural: taskruns + singular: taskrun + categories: + - tekton + - tekton-pipelines + shortNames: + - tr + - trs + scope: Namespaced + conversion: + strategy: Webhook + webhook: + conversionReviewVersions: ["v1beta1", "v1"] + clientConfig: + service: + name: tekton-pipelines-webhook + namespace: tekton-pipelines +--- +# Copyright 2022 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: verificationpolicies.tekton.dev + labels: + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines + pipeline.tekton.dev/release: "v1.15.0" + version: "v1.15.0" +spec: + group: tekton.dev + versions: + - name: v1alpha1 + served: true + storage: true + schema: + openAPIV3Schema: + description: |- + VerificationPolicy defines the rules to verify Tekton resources. + VerificationPolicy can config the mapping from resources to a list of public + keys, so when verifying the resources we can use the corresponding public keys. + type: object + required: + - spec + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: Spec holds the desired state of the VerificationPolicy. + type: object + required: + - authorities + - resources + properties: + authorities: + description: Authorities defines the rules for validating signatures. + type: array + items: + description: The Authority block defines the keys for validating + signatures. + type: object + required: + - name + properties: + key: + description: Key contains the public key to validate the resource. + type: object + properties: + data: + description: Data contains the inline public key. + type: string + hashAlgorithm: + description: HashAlgorithm always defaults to sha256 if + the algorithm hasn't been explicitly set + type: string + kms: + description: |- + KMS contains the KMS url of the public key + Supported formats differ based on the KMS system used. + One example of a KMS url could be: + gcpkms://projects/[PROJECT]/locations/[LOCATION]>/keyRings/[KEYRING]/cryptoKeys/[KEY]/cryptoKeyVersions/[KEY_VERSION] + For more examples please refer https://docs.sigstore.dev/cosign/kms_support. + Note that the KMS is not supported yet. + type: string + secretRef: + description: SecretRef sets a reference to a secret with + the key. + type: object + properties: + name: + description: name is unique within a namespace to + reference a secret resource. + type: string + namespace: + description: namespace defines the space within which + the secret name must be unique. + type: string + x-kubernetes-map-type: atomic + name: + description: Name is the name for this authority. + type: string + mode: + description: |- + Mode controls whether a failing policy will fail the taskrun/pipelinerun, or only log the warnings + enforce - fail the taskrun/pipelinerun if verification fails (default) + warn - don't fail the taskrun/pipelinerun if verification fails but log warnings + type: string + resources: + description: |- + Resources defines the patterns of resources sources that should be subject to this policy. + For example, we may want to apply this Policy from a certain GitHub repo. + Then the ResourcesPattern should be valid regex. E.g. If using gitresolver, and we want to config keys from a certain git repo. + `ResourcesPattern` can be `https://github.com/tektoncd/catalog.git`, we will use regex to filter out those resources. + type: array + items: + description: ResourcePattern defines the pattern of the resource + source + type: object + required: + - pattern + properties: + pattern: + description: |- + Pattern defines a resource pattern. Regex is created to filter resources based on `Pattern` + Example patterns: + GitHub resource: https://github.com/tektoncd/catalog.git, https://github.com/tektoncd/* + Bundle resource: gcr.io/tekton-releases/catalog/upstream/git-clone, gcr.io/tekton-releases/catalog/upstream/* + Hub resource: https://artifacthub.io/*, + type: string + names: + kind: VerificationPolicy + plural: verificationpolicies + singular: verificationpolicy + categories: + - tekton + - tekton-pipelines + scope: Namespaced +--- +# Copyright 2020 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: Secret +metadata: + name: webhook-certs + namespace: tekton-pipelines + labels: + app.kubernetes.io/component: webhook + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines + pipeline.tekton.dev/release: "v1.15.0" +# The data is populated at install time. +--- +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingWebhookConfiguration +metadata: + name: validation.webhook.pipeline.tekton.dev + labels: + app.kubernetes.io/component: webhook + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines + pipeline.tekton.dev/release: "v1.15.0" +webhooks: + - admissionReviewVersions: ["v1"] + clientConfig: + service: + name: tekton-pipelines-webhook + namespace: tekton-pipelines + failurePolicy: Fail + sideEffects: None + name: validation.webhook.pipeline.tekton.dev +--- +apiVersion: admissionregistration.k8s.io/v1 +kind: MutatingWebhookConfiguration +metadata: + name: webhook.pipeline.tekton.dev + labels: + app.kubernetes.io/component: webhook + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines + pipeline.tekton.dev/release: "v1.15.0" +webhooks: + - admissionReviewVersions: ["v1"] + clientConfig: + service: + name: tekton-pipelines-webhook + namespace: tekton-pipelines + failurePolicy: Fail + sideEffects: None + name: webhook.pipeline.tekton.dev +--- +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingWebhookConfiguration +metadata: + name: config.webhook.pipeline.tekton.dev + labels: + app.kubernetes.io/component: webhook + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines + pipeline.tekton.dev/release: "v1.15.0" +webhooks: + - admissionReviewVersions: ["v1"] + clientConfig: + service: + name: tekton-pipelines-webhook + namespace: tekton-pipelines + failurePolicy: Fail + sideEffects: None + name: config.webhook.pipeline.tekton.dev + objectSelector: + matchLabels: + app.kubernetes.io/part-of: tekton-pipelines +--- +# Copyright 2019-2022 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: tekton-aggregate-edit + labels: + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines + rbac.authorization.k8s.io/aggregate-to-edit: "true" + rbac.authorization.k8s.io/aggregate-to-admin: "true" +rules: + - apiGroups: + - tekton.dev + resources: + - tasks + - taskruns + - pipelines + - pipelineruns + - runs + - customruns + - stepactions + verbs: + - create + - delete + - deletecollection + - get + - list + - patch + - update + - watch +--- +# Copyright 2019-2022 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: tekton-aggregate-view + labels: + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines + rbac.authorization.k8s.io/aggregate-to-view: "true" +rules: + - apiGroups: + - tekton.dev + resources: + - tasks + - taskruns + - pipelines + - pipelineruns + - runs + - customruns + - stepactions + verbs: + - get + - list + - watch +--- +# Copyright 2019 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-defaults + namespace: tekton-pipelines + labels: + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +data: + _example: | + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this example block and unindented to be in the data block + # to actually change the configuration. + + # default-timeout-minutes contains the default number of + # minutes to use for TaskRun and PipelineRun, if none is specified. + default-timeout-minutes: "60" # 60 minutes + + # default-service-account contains the default service account name + # to use for TaskRun and PipelineRun, if none is specified. + default-service-account: "default" + + # default-managed-by-label-value contains the default value given to the + # "app.kubernetes.io/managed-by" label applied to all Pods created for + # TaskRuns. If a user's requested TaskRun specifies another value for this + # label, the user's request supercedes. + default-managed-by-label-value: "tekton-pipelines" + + # default-pod-template contains the default pod template to use for + # TaskRun and PipelineRun. If a pod template is specified on the + # PipelineRun, the default-pod-template is merged with that one. + # default-pod-template: + + # default-affinity-assistant-pod-template contains the default pod template + # to use for affinity assistant pods. If a pod template is specified on the + # PipelineRun, the default-affinity-assistant-pod-template is merged with + # that one. + # default-affinity-assistant-pod-template: + + # default-cloud-events-sink contains the default CloudEvents sink to be + # used for TaskRun and PipelineRun, when no sink is specified. + # Note that right now it is still not possible to set a PipelineRun or + # TaskRun specific sink, so the default is the only option available. + # If no sink is specified, no CloudEvent is generated + # default-cloud-events-sink: + + # default-task-run-workspace-binding contains the default workspace + # configuration provided for any Workspaces that a Task declares + # but that a TaskRun does not explicitly provide. + # default-task-run-workspace-binding: | + # emptyDir: {} + + # default-max-matrix-combinations-count contains the default maximum number + # of combinations from a Matrix, if none is specified. + default-max-matrix-combinations-count: "256" + + # default-forbidden-env contains comma seperated environment variables that cannot be + # overridden by podTemplate. + default-forbidden-env: + + # default-resolver-type contains the default resolver type to be used in the cluster, + # no default-resolver-type is specified by default + default-resolver-type: + + # default-imagepullbackoff-timeout contains the default duration to wait + # before requeuing the TaskRun to retry, specifying 0 here is equivalent to fail fast + # possible values could be 1m, 5m, 10s, 1h, etc + # default-imagepullbackoff-timeout: "5m" + + # default-create-container-error-timeout contains the default duration to wait + # before failing a TaskRun when a container fails with "context deadline exceeded" + # (e.g. CRI-O under heavy load). Specifying 0 here is equivalent to fail fast. + # possible values could be 1m, 5m, 10s, 1h, etc + # default-create-container-error-timeout: "5m" + + # default-maximum-resolution-timeout specifies the default duration used by the + # resolution controller before timing out when exceeded. + # Possible values include "1m", "5m", "10s", "1h", etc. + # Example: default-maximum-resolution-timeout: "1m" + + # default-container-resource-requirements allow users to configure default resource + # requirements for init containers and containers in pods created by the controller. + # No resource requirements are applied by default when this key is unset. + # Note: All the resource requirements are applied to init-containers and containers + # only if the existing resource requirements are empty, except Tekton internal + # containers can be overridden by named entries such as prepare or place-scripts. + # default-container-resource-requirements: | + # place-scripts: # updates resource requirements of a 'place-scripts' container + # requests: + # memory: "64Mi" + # cpu: "250m" + # limits: + # memory: "128Mi" + # cpu: "500m" + # + # prepare: # updates resource requirements of a 'prepare' container + # requests: + # memory: "64Mi" + # cpu: "250m" + # limits: + # memory: "256Mi" + # cpu: "500m" + # + # working-dir-initializer: # updates resource requirements of a 'working-dir-initializer' container + # requests: + # memory: "64Mi" + # cpu: "250m" + # limits: + # memory: "512Mi" + # cpu: "500m" + # + # prefix-scripts: # updates resource requirements of containers which starts with 'scripts-' + # requests: + # memory: "64Mi" + # cpu: "250m" + # limits: + # memory: "128Mi" + # cpu: "500m" + # + # prefix-sidecar-scripts: # updates resource requirements of containers which starts with 'sidecar-scripts-' + # requests: + # memory: "64Mi" + # cpu: "250m" + # limits: + # memory: "128Mi" + # cpu: "500m" + # + # default: # updates resource requirements of init-containers and containers which has empty resource requirements + # requests: + # memory: "64Mi" + # cpu: "250m" + # limits: + # memory: "256Mi" + # cpu: "500m" + + # default-sidecar-log-polling-interval specifies the polling interval for the Tekton sidecar log results container. + # This controls how frequently the sidecar checks for step completion files written by steps in a TaskRun. + # Lower values (e.g., "10ms") make the sidecar more responsive but may increase CPU usage; higher values (e.g., "1s") + # reduce resource usage but may delay result collection. + # This value is used by the sidecar-tekton-log-results container and can be tuned for performance or test scenarios. + # Example values: "100ms", "500ms", "1s" + default-sidecar-log-polling-interval: "100ms" + + # default-step-ref-concurrency-limit specifies the concurrency limit for resolving step references. + # This setting controls the maximum number of concurrent goroutines used to resolve + # step references (`step.ref` fields) simultaneously. This limit acts as a throttle + # to prevent overwhelming remote servers (e.g., git providers, OCI registries) or + # the Kubernetes API server, especially when a TaskRun contains many steps that + # reference StepActions. + default-step-ref-concurrency-limit: "5" +--- +# Copyright 2023 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-events + namespace: tekton-pipelines + labels: + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +data: + _example: | + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this example block and unindented to be in the data block + # to actually change the configuration. + + # formats contains a comma separated list of event formats to be used + # the only format supported today is "tektonv1". An empty string is not + # a valid configuration. To disable events, do not specify the sink. + formats: "tektonv1" + + # sink contains the event sink to be used for TaskRun, PipelineRun and + # CustomRun. If no sink is specified, no CloudEvent is generated. + # This setting supercedes the "default-cloud-events-sink" from the + # "config-defaults" config map + sink: "https://events.sink/cdevents" +--- +# Copyright 2019 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: feature-flags + namespace: tekton-pipelines + labels: + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +data: + # Setting this flag will determine how PipelineRun Pods are scheduled with Affinity Assistant. + # Acceptable values are "workspaces" (default), "pipelineruns", "isolate-pipelinerun", or "disabled". + # + # Setting it to "workspaces" will schedule all the taskruns sharing the same PVC-based workspace in a pipelinerun to the same node. + # Setting it to "pipelineruns" will schedule all the taskruns in a pipelinerun to the same node. + # Setting it to "isolate-pipelinerun" will schedule all the taskruns in a pipelinerun to the same node, + # and only allows one pipelinerun to run on a node at a time. + # Setting it to "disabled" will not apply any coschedule policy. + # + # See more in the Affinity Assistant documentation + # https://github.com/tektoncd/pipeline/blob/main/docs/affinityassistants.md + coschedule: "workspaces" + # Setting this flag to "true" will prevent Tekton scanning attached + # service accounts and injecting any credentials it finds into your + # Steps. + # + # The default behaviour currently is for Tekton to search service + # accounts for secrets matching a specified format and automatically + # mount those into your Steps. + # + # Note: setting this to "true" will prevent PipelineResources from + # working. + # + # See https://github.com/tektoncd/pipeline/issues/2791 for more + # info. + disable-creds-init: "false" + # Setting this flag to "false" will stop Tekton from waiting for a + # TaskRun's sidecar containers to be running before starting the first + # step. This will allow Tasks to be run in environments that don't + # support the DownwardAPI volume type, but may lead to unintended + # behaviour if sidecars are used. + # + # See https://github.com/tektoncd/pipeline/issues/4937 for more info. + await-sidecar-readiness: "true" + # This option should be set to false when Pipelines is running in a + # cluster that does not use injected sidecars such as Istio. Setting + # it to false should decrease the time it takes for a TaskRun to start + # running. For clusters that use injected sidecars, setting this + # option to false can lead to unexpected behavior. + # + # See https://github.com/tektoncd/pipeline/issues/2080 for more info. + running-in-environment-with-injected-sidecars: "true" + # Setting this flag to "true" will require that any Git SSH Secret + # offered to Tekton must have known_hosts included. + # + # See https://github.com/tektoncd/pipeline/issues/2981 for more + # info. + require-git-ssh-secret-known-hosts: "false" + # Setting this flag to "true" enables the use of Tekton OCI bundle. + # This is an experimental feature and thus should still be considered + # an alpha feature. + enable-tekton-oci-bundles: "false" + # Setting this flag will determine which gated features are enabled. + # Acceptable values are "stable", "beta", or "alpha". + enable-api-fields: "beta" + # DEPRECATED: send-cloudevents-for-runs is deprecated and will be removed in a future + # release. CloudEvents are now enabled by default when a sink is configured in the + # config-events ConfigMap. This flag only affects CustomRuns; it has no effect on + # TaskRuns or PipelineRuns. + send-cloudevents-for-runs: "true" + # This flag affects the behavior of taskruns and pipelineruns in cases where no VerificationPolicies match them. + # If it is set to "fail", TaskRuns and PipelineRuns will fail verification if no matching policies are found. + # If it is set to "warn", TaskRuns and PipelineRuns will run to completion if no matching policies are found, and an error will be logged. + # If it is set to "ignore", TaskRuns and PipelineRuns will run to completion if no matching policies are found, and no error will be logged. + trusted-resources-verification-no-match-policy: "ignore" + # Setting this flag to "true" enables populating the "provenance" field in TaskRun + # and PipelineRun status. This field contains metadata about resources used + # in the TaskRun/PipelineRun such as the source from where a remote Task/Pipeline + # definition was fetched. + enable-provenance-in-status: "true" + # Setting this flag will determine how Tekton pipelines will handle non-falsifiable provenance. + # If set to "spire", then SPIRE will be used to ensure non-falsifiable provenance. + # If set to "none", then Tekton will not have non-falsifiable provenance. + # This is an experimental feature and thus should still be considered an alpha feature. + enforce-nonfalsifiability: "none" + # Setting this flag will determine how Tekton pipelines will handle extracting results from the task. + # Acceptable values are "termination-message" or "sidecar-logs". + # "sidecar-logs" is now a beta feature. + results-from: "termination-message" + # Setting this flag will determine the upper limit of each task result + # This flag is optional and only associated with the previous flag, results-from + # When results-from is set to "sidecar-logs", this flag can be used to configure the upper limit of a task result + # max-result-size: "4096" + # Setting this flag to "true" will limit privileges for containers injected by Tekton into TaskRuns. + # This allows TaskRuns to run in namespaces with "restricted" pod security standards. + # Not all Kubernetes implementations support this option. + set-security-context: "false" + # Setting this flag to "true" will set readOnlyRootFilesystem in securityContext for all containers used in TaskRuns and AffinityAssistant. + set-security-context-read-only-root-filesystem: "false" + # Setting this flag to "true" will keep pod on cancellation + # allowing examination of the logs on the pods from cancelled taskruns + keep-pod-on-cancel: "false" + # Setting this flag to "true" will enable the CEL evaluation in WhenExpression + enable-cel-in-whenexpression: "false" + # Setting this flag to "true" will enable the use of Artifacts in Steps + # This feature is in preview mode and not implemented yet. Please check #7693 for updates. + enable-artifacts: "false" + # Setting this flag to "true" will enable the built-in param input validation via param enum. + enable-param-enum: "false" + # Setting this flag to "pipeline,pipelinerun,taskrun" will prevent users from creating + # embedded spec Taskruns or Pipelineruns for Pipeline, Pipelinerun and taskrun + # respectively. We can specify "pipeline" to disable for Pipeline resource only. + # "pipelinerun" for Pipelinerun and "taskrun" for Taskrun. Or a combination of + # these. + disable-inline-spec: "" + # Setting this flag to "true" will enable the use of concise resolver syntax + enable-concise-resolver-syntax: "false" + # Setthing this flag to "true" will enable native Kubernetes Sidecar support + enable-kubernetes-sidecar: "false" + # Setting this flag to "false" will have no effect since StepActions are a stable feature + enable-step-actions: "true" + # Controls whether exponential backoff is enabled when creating TaskRuns or CustomRuns. + # If set to "true", the controller will use exponential backoff when retrying failed create operations, + # which can help mitigate issues caused by temporary API server or webhook unavailability. + # If set to "false", exponential backoff will be disabled. + # For advanced tuning of backoff parameters, update the 'wait-exponential-backoff' ConfigMap. + enable-wait-exponential-backoff: "false" + # Setting this flag to "true" will compress termination messages with flate + # to fit more results in the 4KB Kubernetes termination message limit. + # Only applies when results-from is set to "termination-message" (the default); + # ignored when results-from is "sidecar-logs". + # Alpha feature — this is a short-term measure. External result storage + # (TEP-0164) will address the underlying 4KB limitation. + enable-termination-message-compression: "false" + # Controls whether informer cache transforms are enabled. When enabled (default), + # the controller strips large, unnecessary metadata fields (managedFields and the + # kubectl last-applied-configuration annotation) from PipelineRuns, TaskRuns, + # CustomRuns, and Pods stored in the informer cache to reduce memory usage. + # + # Set to "false" to disable if you encounter issues with missing data in cached objects. + # Changes require a controller restart to take effect. + # + # See https://github.com/tektoncd/pipeline/issues/7691 for more info. + enable-informer-cache-transforms: "true" +--- +# Copyright 2021 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: pipelines-info + namespace: tekton-pipelines + labels: + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +data: + # Contains pipelines version which can be queried by external + # tools such as CLI. Elevated permissions are already given to + # this ConfigMap such that even if we don't have access to + # other resources in the namespace we still can have access to + # this ConfigMap. + version: "v1.15.0" +--- +# Copyright 2020 Tekton Authors LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-leader-election-controller + namespace: tekton-pipelines + labels: + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +data: + _example: | + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this example block and unindented to be in the data block + # to actually change the configuration. + # lease-duration is how long non-leaders will wait to try to acquire the + # lock; 15 seconds is the value used by core kubernetes controllers. + lease-duration: "60s" + # renew-deadline is how long a leader will try to renew the lease before + # giving up; 10 seconds is the value used by core kubernetes controllers. + renew-deadline: "40s" + # retry-period is how long the leader election client waits between tries of + # actions; 2 seconds is the value used by core kubernetes controllers. + retry-period: "10s" + # buckets is the number of buckets used to partition key space of each + # Reconciler. If this number is M and the replica number of the controller + # is N, the N replicas will compete for the M buckets. The owner of a + # bucket will take care of the reconciling for the keys partitioned into + # that bucket. + buckets: "1" +--- +# Copyright 2023 Tekton Authors LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-leader-election-events + namespace: tekton-pipelines + labels: + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +data: + _example: | + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this example block and unindented to be in the data block + # to actually change the configuration. + # lease-duration is how long non-leaders will wait to try to acquire the + # lock; 15 seconds is the value used by core kubernetes controllers. + lease-duration: "60s" + # renew-deadline is how long a leader will try to renew the lease before + # giving up; 10 seconds is the value used by core kubernetes controllers. + renew-deadline: "40s" + # retry-period is how long the leader election client waits between tries of + # actions; 2 seconds is the value used by core kubernetes controllers. + retry-period: "10s" + # buckets is the number of buckets used to partition key space of each + # Reconciler. If this number is M and the replica number of the controller + # is N, the N replicas will compete for the M buckets. The owner of a + # bucket will take care of the reconciling for the keys partitioned into + # that bucket. + buckets: "1" +--- +# Copyright 2023 Tekton Authors LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-leader-election-webhook + namespace: tekton-pipelines + labels: + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +data: + _example: | + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this example block and unindented to be in the data block + # to actually change the configuration. + # lease-duration is how long non-leaders will wait to try to acquire the + # lock; 15 seconds is the value used by core kubernetes controllers. + lease-duration: "60s" + # renew-deadline is how long a leader will try to renew the lease before + # giving up; 10 seconds is the value used by core kubernetes controllers. + renew-deadline: "40s" + # retry-period is how long the leader election client waits between tries of + # actions; 2 seconds is the value used by core kubernetes controllers. + retry-period: "10s" + # buckets is the number of buckets used to partition key space of each + # Reconciler. If this number is M and the replica number of the controller + # is N, the N replicas will compete for the M buckets. The owner of a + # bucket will take care of the reconciling for the keys partitioned into + # that bucket. + buckets: "1" +--- +# Copyright 2019 Tekton Authors LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-logging + namespace: tekton-pipelines + labels: + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +data: + zap-logger-config: | + { + "level": "info", + "development": false, + "sampling": { + "initial": 100, + "thereafter": 100 + }, + "outputPaths": ["stdout"], + "errorOutputPaths": ["stderr"], + "encoding": "json", + "encoderConfig": { + "timeKey": "timestamp", + "levelKey": "severity", + "nameKey": "logger", + "callerKey": "caller", + "messageKey": "message", + "stacktraceKey": "stacktrace", + "lineEnding": "", + "levelEncoder": "", + "timeEncoder": "iso8601", + "durationEncoder": "", + "callerEncoder": "" + } + } + # Log level overrides + loglevel.controller: "info" + loglevel.webhook: "info" +--- +# Copyright 2019 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-observability + namespace: tekton-pipelines + labels: + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +data: + metrics-protocol: prometheus + _example: | + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this example block and unindented to be in the data block + # to actually change the configuration. + + # OpenTelemetry Metrics Configuration + # Protocol for metrics export (prometheus, grpc, http/protobuf, none) + # Default if not specified: "none" + metrics-protocol: prometheus + + # Metrics endpoint (for grpc/http protocols) + # Default: empty (uses default OTLP endpoint) + metrics-endpoint: "" + + # Metrics export interval (e.g., "30s", "1m") + # Default: empty (uses default interval) + metrics-export-interval: "" + + # OpenTelemetry Tracing Configuration + # Protocol for tracing export (grpc, http/protobuf, none, stdout) + # Default: none + tracing-protocol: none + + # Tracing endpoint (for grpc/http protocols) + # Default: empty + tracing-endpoint: "" + + # Tracing sampling rate (0.0 to 1.0) + # Default: 1.0 (100% sampling) + tracing-sampling-rate: "1.0" + + # Runtime Configuration + # Enable profiling (enabled, disabled) + # Default: disabled + runtime-profiling: disabled + + # Runtime export interval (e.g., "15s") + # Default: 15s + runtime-export-interval: "15s" + + # Note: Legacy OpenCensus configuration (metrics.backend-destination, etc.) has been + # removed as OpenCensus support is no longer provided by the underlying infrastructure. + # Please use the OpenTelemetry configuration options above. + + # Tekton-specific metrics configuration + metrics.taskrun.level: "task" + metrics.taskrun.duration-type: "histogram" + metrics.pipelinerun.level: "pipeline" + metrics.pipelinerun.duration-type: "histogram" + metrics.count.enable-reason: "false" + metrics.running-pipelinerun.level: "" +--- +# Copyright 2020 Tekton Authors LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-registry-cert + namespace: tekton-pipelines + labels: + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +# data: +# # Registry's self-signed certificate +# cert: | +--- +# Copyright 2022 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-spire + namespace: tekton-pipelines + labels: + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +data: + _example: | + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this example block and unindented to be in the data block + # to actually change the configuration. + # + # spire-trust-domain specifies the SPIRE trust domain to use. + # spire-trust-domain: "example.org" + # + # spire-socket-path specifies the SPIRE agent socket for SPIFFE workload API. + # spire-socket-path: "unix:///spiffe-workload-api/spire-agent.sock" + # + # spire-server-addr specifies the SPIRE server address for workload/node registration. + # spire-server-addr: "spire-server.spire.svc.cluster.local:8081" + # + # spire-node-alias-prefix specifies the SPIRE node alias prefix to use. + # spire-node-alias-prefix: "/tekton-node/" +--- +# Copyright 2023 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# NOTE: Exported traces may include Kubernetes resource identifiers (e.g. TaskRun/PipelineRun +# names and namespaces) as span attributes. Treat the trace backend as a trusted observability +# system. See docs/developers/tracing.md for details. +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-tracing + namespace: tekton-pipelines + labels: + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +data: + _example: | + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this example block and unindented to be in the data block + # to actually change the configuration. + # + # Enable sending traces to defined endpoint by setting this to true + enabled: "true" + # + # API endpoint to send the traces to + # (optional): The default value is given below + endpoint: "http://jaeger-collector.jaeger.svc.cluster.local:4318/v1/traces" + # (optional) Name of the k8s secret which contains basic auth credentials + credentialsSecret: "jaeger-creds" +--- +# Copyright 2025 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# This ConfigMap allows cluster operators to configure the exponential backoff +# parameters used by Tekton Pipelines when retrying Kubernetes API operations, +# such as creating TaskRuns or CustomRuns. Adjusting these values can help +# tune retry behavior in response to webhook timeouts or transient errors. +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-wait-exponential-backoff + namespace: tekton-pipelines + labels: + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +data: + duration: "10s" # The initial duration before the first retry (Go duration string, e.g. "1s"). + factor: "2.0" # The factor by which the duration increases after each retry (should not be negative). + jitter: "0.0" # Jitter factor (0.0 = no jitter, 0.2 = up to 20% random additional wait). + steps: "5" # The number of times the duration may change (number of backoff steps). + cap: "60s" # The maximum duration between retries (Go duration string, e.g. "30s"). +--- +# Copyright 2019 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: tekton-pipelines-controller + namespace: tekton-pipelines + labels: + app.kubernetes.io/name: controller + app.kubernetes.io/component: controller + app.kubernetes.io/instance: default + app.kubernetes.io/version: "v1.15.0" + app.kubernetes.io/part-of: tekton-pipelines + # tekton.dev/release value replaced with inputs.params.versionTag in pipeline/tekton/publish.yaml + pipeline.tekton.dev/release: "v1.15.0" + # labels below are related to istio and should not be used for resource lookup + version: "v1.15.0" +spec: + replicas: 1 + selector: + matchLabels: + app.kubernetes.io/name: controller + app.kubernetes.io/component: controller + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines + template: + metadata: + labels: + app.kubernetes.io/name: controller + app.kubernetes.io/component: controller + app.kubernetes.io/instance: default + app.kubernetes.io/version: "v1.15.0" + app.kubernetes.io/part-of: tekton-pipelines + # tekton.dev/release value replaced with inputs.params.versionTag in pipeline/tekton/publish.yaml + pipeline.tekton.dev/release: "v1.15.0" + # labels below are related to istio and should not be used for resource lookup + app: tekton-pipelines-controller + version: "v1.15.0" + spec: + affinity: + nodeAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: kubernetes.io/os + operator: NotIn + values: + - windows + podAntiAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchLabels: + app.kubernetes.io/name: controller + app.kubernetes.io/component: controller + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines + topologyKey: kubernetes.io/hostname + weight: 100 + serviceAccountName: tekton-pipelines-controller + containers: + - name: tekton-pipelines-controller + image: ghcr.io/tektoncd/pipeline/controller-10a3e32792f33651396d02b6855a6e36:v1.15.0@sha256:ed33d9696b882716ab58062ec928828d5c15f4f9bac94661fb6b76ea5d27ff17 + args: [ + # These images are built on-demand by `ko resolve` and are replaced + # by image references by digest. + "-entrypoint-image", "ghcr.io/tektoncd/pipeline/entrypoint-bff0a22da108bc2f16c818c97641a296:v1.15.0@sha256:1ae5944a51f5c5f19e575de5abf268ea7a49a3a54bdad411cf27e3142af5f5c0", + "-nop-image", "ghcr.io/tektoncd/pipeline/nop-8eac7c133edad5df719dc37b36b62482:v1.15.0@sha256:f49260b33c3142f8224d26d6204b15b96b312997a169bc79fe4792981af9580c", + "-sidecarlogresults-image", "ghcr.io/tektoncd/pipeline/sidecarlogresults-7501c6a20d741631510a448b48ab098f:v1.15.0@sha256:9dbe5ed48cce1324daa49784c6fc729d8b62a7c0d15c9656126bdada1a870b98", + "-workingdirinit-image", "ghcr.io/tektoncd/pipeline/workingdirinit-0c558922ec6a1b739e550e349f2d5fc1:v1.15.0@sha256:fc38f8bc3c196e8f7cc2c22ea19194afd093175a23c9ab1b900cb150fd38307f", + # The shell image must allow root in order to create directories and copy files to PVCs. + # cgr.dev/chainguard/busybox as of April 14 2022 + # image shall not contains tag, so it will be supported on a runtime like cri-o + "-shell-image", "cgr.dev/chainguard/busybox@sha256:19f02276bf8dbdd62f069b922f10c65262cc34b710eea26ff928129a736be791", + # for script mode to work with windows we need a powershell image + # pinning to nanoserver tag as of July 15 2021 + "-shell-image-win", "mcr.microsoft.com/powershell:nanoserver@sha256:b6d5ff841b78bdf2dfed7550000fd4f3437385b8fa686ec0f010be24777654d6"] + volumeMounts: + - name: config-logging + mountPath: /etc/config-logging + - name: config-registry-cert + mountPath: /etc/config-registry-cert + env: + - name: SYSTEM_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: KUBERNETES_MIN_VERSION + value: "v1.28.0" + # If you are changing these names, you will also need to update + # the controller's Role in 200-role.yaml to include the new + # values in the "configmaps" "get" rule. + - name: CONFIG_DEFAULTS_NAME + value: config-defaults + - name: CONFIG_LOGGING_NAME + value: config-logging + - name: CONFIG_OBSERVABILITY_NAME + value: config-observability + - name: CONFIG_FEATURE_FLAGS_NAME + value: feature-flags + - name: CONFIG_LEADERELECTION_NAME + value: config-leader-election-controller + - name: CONFIG_SPIRE + value: config-spire + - name: SSL_CERT_FILE + value: /etc/config-registry-cert/cert + - name: SSL_CERT_DIR + value: /etc/ssl/certs + - name: METRICS_DOMAIN + value: tekton.dev/pipeline + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + capabilities: + drop: + - "ALL" + # User 65532 is the nonroot user ID + runAsUser: 65532 + runAsGroup: 65532 + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault + ports: + - name: metrics + containerPort: 9090 + - name: profiling + containerPort: 8008 + - name: probes + containerPort: 8080 + livenessProbe: + httpGet: + path: /health + port: probes + scheme: HTTP + initialDelaySeconds: 5 + periodSeconds: 10 + timeoutSeconds: 5 + readinessProbe: + httpGet: + path: /readiness + port: probes + scheme: HTTP + initialDelaySeconds: 5 + periodSeconds: 10 + timeoutSeconds: 5 + volumes: + - name: config-logging + configMap: + name: config-logging + - name: config-registry-cert + configMap: + name: config-registry-cert +--- +apiVersion: v1 +kind: Service +metadata: + labels: + app.kubernetes.io/name: controller + app.kubernetes.io/component: controller + app.kubernetes.io/instance: default + app.kubernetes.io/version: "v1.15.0" + app.kubernetes.io/part-of: tekton-pipelines + # tekton.dev/release value replaced with inputs.params.versionTag in pipeline/tekton/publish.yaml + pipeline.tekton.dev/release: "v1.15.0" + # labels below are related to istio and should not be used for resource lookup + app: tekton-pipelines-controller + version: "v1.15.0" + name: tekton-pipelines-controller + namespace: tekton-pipelines +spec: + ports: + - name: http-metrics + port: 9090 + protocol: TCP + targetPort: 9090 + - name: http-profiling + port: 8008 + targetPort: 8008 + - name: probes + port: 8080 + selector: + app.kubernetes.io/name: controller + app.kubernetes.io/component: controller + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +--- +# Copyright 2023 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: tekton-events-controller + namespace: tekton-pipelines + labels: + app.kubernetes.io/name: events + app.kubernetes.io/component: events + app.kubernetes.io/instance: default + app.kubernetes.io/version: "v1.15.0" + app.kubernetes.io/part-of: tekton-pipelines + # tekton.dev/release value replaced with inputs.params.versionTag in pipeline/tekton/publish.yaml + pipeline.tekton.dev/release: "v1.15.0" + # labels below are related to istio and should not be used for resource lookup + version: "v1.15.0" +spec: + replicas: 1 + selector: + matchLabels: + app.kubernetes.io/name: events + app.kubernetes.io/component: events + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines + template: + metadata: + labels: + app.kubernetes.io/name: events + app.kubernetes.io/component: events + app.kubernetes.io/instance: default + app.kubernetes.io/version: "v1.15.0" + app.kubernetes.io/part-of: tekton-pipelines + # tekton.dev/release value replaced with inputs.params.versionTag in pipeline/tekton/publish.yaml + pipeline.tekton.dev/release: "v1.15.0" + # labels below are related to istio and should not be used for resource lookup + app: tekton-events-controller + version: "v1.15.0" + spec: + affinity: + nodeAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: kubernetes.io/os + operator: NotIn + values: + - windows + serviceAccountName: tekton-events-controller + containers: + - name: tekton-events-controller + image: ghcr.io/tektoncd/pipeline/events-a9042f7efb0cbade2a868a1ee5ddd52c:v1.15.0@sha256:050f4ae0fee5d2f9b9a9b9a6270b131c0b0ecd8a1c24707746aa18d10b435604 + args: [] + volumeMounts: + - name: config-logging + mountPath: /etc/config-logging + - name: config-registry-cert + mountPath: /etc/config-registry-cert + env: + - name: SYSTEM_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: KUBERNETES_MIN_VERSION + value: "v1.28.0" + # If you are changing these names, you will also need to update + # the controller's Role in 200-role.yaml to include the new + # values in the "configmaps" "get" rule. + - name: CONFIG_DEFAULTS_NAME + value: config-defaults + - name: CONFIG_LOGGING_NAME + value: config-logging + - name: CONFIG_OBSERVABILITY_NAME + value: config-observability + - name: CONFIG_LEADERELECTION_NAME + value: config-leader-election-events + - name: SSL_CERT_FILE + value: /etc/config-registry-cert/cert + - name: SSL_CERT_DIR + value: /etc/ssl/certs + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + capabilities: + drop: + - "ALL" + # User 65532 is the nonroot user ID + runAsUser: 65532 + runAsGroup: 65532 + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault + ports: + - name: metrics + containerPort: 9090 + - name: profiling + containerPort: 8008 + - name: probes + containerPort: 8080 + livenessProbe: + httpGet: + path: /health + port: probes + scheme: HTTP + initialDelaySeconds: 5 + periodSeconds: 10 + timeoutSeconds: 5 + readinessProbe: + httpGet: + path: /readiness + port: probes + scheme: HTTP + initialDelaySeconds: 5 + periodSeconds: 10 + timeoutSeconds: 5 + volumes: + - name: config-logging + configMap: + name: config-logging + - name: config-registry-cert + configMap: + name: config-registry-cert +--- +apiVersion: v1 +kind: Service +metadata: + labels: + app.kubernetes.io/name: events + app.kubernetes.io/component: events + app.kubernetes.io/instance: default + app.kubernetes.io/version: "v1.15.0" + app.kubernetes.io/part-of: tekton-pipelines + # tekton.dev/release value replaced with inputs.params.versionTag in pipeline/tekton/publish.yaml + pipeline.tekton.dev/release: "v1.15.0" + # labels below are related to istio and should not be used for resource lookup + app: tekton-events-controller + version: "v1.15.0" + name: tekton-events-controller + namespace: tekton-pipelines +spec: + ports: + - name: http-metrics + port: 9090 + protocol: TCP + targetPort: 9090 + - name: http-profiling + port: 8008 + targetPort: 8008 + - name: probes + port: 8080 + selector: + app.kubernetes.io/name: events + app.kubernetes.io/component: events + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +--- +# Copyright 2022 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: Namespace +metadata: + name: tekton-pipelines-resolvers + labels: + app.kubernetes.io/component: resolvers + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines + pod-security.kubernetes.io/enforce: restricted +--- +# Copyright 2022 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + # ClusterRole for resolvers to monitor and update resolutionrequests. + name: tekton-pipelines-resolvers-resolution-request-updates + labels: + app.kubernetes.io/component: resolvers + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +rules: + - apiGroups: ["resolution.tekton.dev"] + resources: ["resolutionrequests", "resolutionrequests/status"] + verbs: ["get", "list", "watch", "update", "patch"] + - apiGroups: ["tekton.dev"] + resources: ["tasks", "pipelines", "stepactions"] + verbs: ["get", "list"] + # Read-only access to these. + - apiGroups: [""] + resources: ["secrets", "serviceaccounts"] + verbs: ["get", "list", "watch"] +--- +# Copyright 2022 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +kind: Role +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: tekton-pipelines-resolvers-namespace-rbac + namespace: tekton-pipelines-resolvers + labels: + app.kubernetes.io/component: resolvers + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +rules: + # Needed to watch and load configuration and secret data. + - apiGroups: [""] + resources: ["configmaps", "secrets"] + verbs: ["get", "list", "update", "watch"] + # This is needed by leader election to run the controller in HA. + - apiGroups: ["coordination.k8s.io"] + resources: ["leases"] + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] +--- +# Copyright 2022 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ServiceAccount +metadata: + name: tekton-pipelines-resolvers + namespace: tekton-pipelines-resolvers + labels: + app.kubernetes.io/component: resolvers + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +--- +# Copyright 2021 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: tekton-pipelines-resolvers + labels: + app.kubernetes.io/component: resolvers + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +subjects: + - kind: ServiceAccount + name: tekton-pipelines-resolvers + namespace: tekton-pipelines-resolvers +roleRef: + kind: ClusterRole + name: tekton-pipelines-resolvers-resolution-request-updates + apiGroup: rbac.authorization.k8s.io +--- +# Copyright 2021 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: tekton-pipelines-resolvers-namespace-rbac + namespace: tekton-pipelines-resolvers + labels: + app.kubernetes.io/component: resolvers + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +subjects: + - kind: ServiceAccount + name: tekton-pipelines-resolvers + namespace: tekton-pipelines-resolvers +roleRef: + kind: Role + name: tekton-pipelines-resolvers-namespace-rbac + apiGroup: rbac.authorization.k8s.io +--- +# Copyright 2022 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: bundleresolver-config + namespace: tekton-pipelines-resolvers + labels: + app.kubernetes.io/component: resolvers + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +data: + # the default service account name to use for bundle requests. + default-service-account: "default" + # The default layer kind in the bundle image. + default-kind: "task" + # Optional: Default cache mode for this resolver. Valid values: "always", "never", "auto" (default: "auto") + # "always" - Always cache resolved resources + # "never" - Never cache resolved resources + # "auto" - Only cache bundles with digest references (@sha256:...) + # default-cache-mode: "auto" +--- +# Copyright 2022 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: cluster-resolver-config + namespace: tekton-pipelines-resolvers + labels: + app.kubernetes.io/component: resolvers + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +data: + # The default kind to fetch. + default-kind: "task" + # The default namespace to look for resources in. + default-namespace: "" + # An optional comma-separated list of namespaces which the resolver is allowed to access. Defaults to empty, meaning all namespaces are allowed. + allowed-namespaces: "" + # An optional comma-separated list of namespaces which the resolver is blocked from accessing. Defaults to empty, meaning all namespaces are allowed. + blocked-namespaces: "" + # Optional: Default cache mode for this resolver. Valid values: "always", "never", "auto" (default: "auto") + # "always" - Always cache resolved resources + # "never" - Never cache resolved resources (recommended for cluster resolver since resources are mutable) + # "auto" - Never cache for cluster resolver (same as "never") + # default-cache-mode: "auto" +--- +# Copyright 2019 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: resolvers-feature-flags + namespace: tekton-pipelines-resolvers + labels: + app.kubernetes.io/component: resolvers + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +data: + # Setting this flag to "true" enables remote resolution of Tekton OCI bundles. + enable-bundles-resolver: "true" + # Setting this flag to "true" enables remote resolution of tasks and pipelines via the Tekton Hub. + enable-hub-resolver: "true" + # Setting this flag to "true" enables remote resolution of tasks and pipelines from Git repositories. + enable-git-resolver: "true" + # Setting this flag to "true" enables remote resolution of tasks and pipelines from other namespaces within the cluster. + enable-cluster-resolver: "true" + # Setting this flag to "true" enables remote resolution of tasks and pipelines from HTTP URLs. + enable-http-resolver: "true" +--- +# Copyright 2020 Tekton Authors LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-leader-election-resolvers + namespace: tekton-pipelines-resolvers + labels: + app.kubernetes.io/component: resolvers + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +data: + _example: | + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this example block and unindented to be in the data block + # to actually change the configuration. + # lease-duration is how long non-leaders will wait to try to acquire the + # lock; 15 seconds is the value used by core kubernetes controllers. + lease-duration: "60s" + # renew-deadline is how long a leader will try to renew the lease before + # giving up; 10 seconds is the value used by core kubernetes controllers. + renew-deadline: "40s" + # retry-period is how long the leader election client waits between tries of + # actions; 2 seconds is the value used by core kubernetes controllers. + retry-period: "10s" + # buckets is the number of buckets used to partition key space of each + # Reconciler. If this number is M and the replica number of the controller + # is N, the N replicas will compete for the M buckets. The owner of a + # bucket will take care of the reconciling for the keys partitioned into + # that bucket. + buckets: "1" +--- +# Copyright 2019 Tekton Authors LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-logging + namespace: tekton-pipelines-resolvers + labels: + app.kubernetes.io/component: resolvers + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +data: + zap-logger-config: | + { + "level": "info", + "development": false, + "sampling": { + "initial": 100, + "thereafter": 100 + }, + "outputPaths": ["stdout"], + "errorOutputPaths": ["stderr"], + "encoding": "json", + "encoderConfig": { + "timeKey": "timestamp", + "levelKey": "severity", + "nameKey": "logger", + "callerKey": "caller", + "messageKey": "message", + "stacktraceKey": "stacktrace", + "lineEnding": "", + "levelEncoder": "", + "timeEncoder": "iso8601", + "durationEncoder": "", + "callerEncoder": "" + } + } + # Log level overrides + loglevel.controller: "info" + loglevel.webhook: "info" +--- +# Copyright 2022 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-observability + namespace: tekton-pipelines-resolvers + labels: + app.kubernetes.io/component: resolvers + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +data: + metrics-protocol: prometheus + _example: | + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this example block and unindented to be in the data block + # to actually change the configuration. + + # OpenTelemetry Metrics Configuration + # Protocol for metrics export (prometheus, grpc, http/protobuf, none) + # Default if not specified: "none" + metrics-protocol: prometheus + + # Metrics endpoint (for grpc/http protocols) + # Default: empty (uses default OTLP endpoint) + metrics-endpoint: "" + + # Metrics export interval (e.g., "30s", "1m") + # Default: empty (uses default interval) + metrics-export-interval: "" + + # OpenTelemetry Tracing Configuration + # Protocol for tracing export (grpc, http/protobuf, none, stdout) + # Default: none + tracing-protocol: none + + # Tracing endpoint (for grpc/http protocols) + # Default: empty + tracing-endpoint: "" + + # Tracing sampling rate (0.0 to 1.0) + # Default: 1.0 (100% sampling) + tracing-sampling-rate: "1.0" + + # Runtime Configuration + # Enable profiling (enabled, disabled) + # Default: disabled + runtime-profiling: disabled + + # Runtime export interval (e.g., "15s") + # Default: 15s + runtime-export-interval: "15s" + + # Note: Legacy OpenCensus configuration (metrics.backend-destination, etc.) has been + # removed as OpenCensus support is no longer provided by the underlying infrastructure. + # Please use the OpenTelemetry configuration options above. +--- +# Copyright 2022 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: git-resolver-config + namespace: tekton-pipelines-resolvers + labels: + app.kubernetes.io/component: resolvers + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +data: + # The maximum amount of time a single anonymous cloning resolution may take. + fetch-timeout: "1m" + # The git url to fetch the remote resource from when using anonymous cloning. + default-url: "https://github.com/tektoncd/catalog.git" + # The git revision to fetch the remote resource from with either anonymous cloning or the authenticated API. + default-revision: "main" + # The SCM type to use with the authenticated API. Can be github, gitlab, gitea, bitbucketserver, bitbucketcloud + scm-type: "github" + # The SCM server URL to use with the authenticated API. Not needed when using github.com, gitlab.com, or BitBucket Cloud + server-url: "" + # The Kubernetes secret containing the API token for the SCM provider. Required when using the authenticated API. + api-token-secret-name: "" + # The key in the API token secret containing the actual token. Required when using the authenticated API. + api-token-secret-key: "" + # The namespace containing the API token secret. Defaults to "default". + api-token-secret-namespace: "default" + # The default organization to look for repositories under when using the authenticated API, + # if not specified in the resolver parameters. Optional. + default-org: "" + # Optional: Default cache mode for this resolver. Valid values: "always", "never", "auto" (default: "auto") + # "always" - Always cache resolved resources + # "never" - Never cache resolved resources + # "auto" - Only cache when revision is a commit hash + # default-cache-mode: "auto" + # Optional: Backoff configuration for retrying failed git resolution requests. + # These settings control the exponential backoff behavior when transient errors occur. + # backoff-duration: "2s" + # backoff-factor: "2.0" + # backoff-jitter: "0.1" + # backoff-steps: "2" # total number of resolution attempts (must be >= 1) + # backoff-cap: "10s" +--- +# Copyright 2023 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: http-resolver-config + namespace: tekton-pipelines-resolvers + labels: + app.kubernetes.io/component: resolvers + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +data: + # The maximum amount of time the http resolver will wait for a response from the server. + fetch-timeout: "1m" +--- +# Copyright 2022 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: hubresolver-config + namespace: tekton-pipelines-resolvers + labels: + app.kubernetes.io/component: resolvers + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +data: + # the default Tekton Hub catalog from where to pull the resource. + default-tekton-hub-catalog: "Tekton" + # the default Artifact Hub Task catalog from where to pull the resource. + default-artifact-hub-task-catalog: "tekton-catalog-tasks" + # the default Artifact Hub Pipeline catalog from where to pull the resource. + default-artifact-hub-pipeline-catalog: "tekton-catalog-pipelines" + # the default layer kind in the hub image. + default-kind: "task" + # the default hub source to pull the resource from. + default-type: "artifact" + # Ordered list of Artifact Hub API URLs to try. First successful response wins. + # If not set, the ARTIFACT_HUB_API env var or default (https://artifacthub.io) is used. + # URLs must use http or https scheme. + # artifact-hub-urls: | + # - https://internal-hub.example.com/ + # - https://artifacthub.io/ + # Ordered list of Tekton Hub API URLs to try. First successful response wins. + # If not set, the TEKTON_HUB_API env var is used. + # URLs must use http or https scheme. + # tekton-hub-urls: | + # - https://api.hub.tekton.dev/ +--- +# Copyright 2025 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: resolver-cache-config + namespace: tekton-pipelines-resolvers + labels: + app.kubernetes.io/component: resolvers + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +data: + # Maximum number of entries in the resolver cache + max-size: "1000" + # Time-to-live for cache entries (examples: 5m, 10m, 1h) + ttl: "5m" +--- +# Copyright 2022 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +apiVersion: apps/v1 +kind: Deployment +metadata: + name: tekton-pipelines-remote-resolvers + namespace: tekton-pipelines-resolvers + labels: + app.kubernetes.io/name: resolvers + app.kubernetes.io/component: resolvers + app.kubernetes.io/instance: default + app.kubernetes.io/version: "v1.15.0" + app.kubernetes.io/part-of: tekton-pipelines + # tekton.dev/release value replaced with inputs.params.versionTag in pipeline/tekton/publish.yaml + pipeline.tekton.dev/release: "v1.15.0" + # labels below are related to istio and should not be used for resource lookup + version: "v1.15.0" +spec: + replicas: 1 + selector: + matchLabels: + app.kubernetes.io/name: resolvers + app.kubernetes.io/component: resolvers + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines + template: + metadata: + labels: + app.kubernetes.io/name: resolvers + app.kubernetes.io/component: resolvers + app.kubernetes.io/instance: default + app.kubernetes.io/version: "v1.15.0" + app.kubernetes.io/part-of: tekton-pipelines + # tekton.dev/release value replaced with inputs.params.versionTag in pipeline/tekton/publish.yaml + pipeline.tekton.dev/release: "v1.15.0" + # labels below are related to istio and should not be used for resource lookup + app: tekton-pipelines-resolvers + version: "v1.15.0" + spec: + affinity: + nodeAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: kubernetes.io/os + operator: NotIn + values: + - windows + podAntiAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchLabels: + app.kubernetes.io/name: resolvers + app.kubernetes.io/component: resolvers + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines + topologyKey: kubernetes.io/hostname + weight: 100 + serviceAccountName: tekton-pipelines-resolvers + containers: + - name: controller + image: ghcr.io/tektoncd/pipeline/resolvers-ff86b24f130c42b88983d3c13993056d:v1.15.0@sha256:fac274d8185ad9f3ef14ab8f1a316d92c478254c7d17efa52bc60f1899a889d2 + command: + - /sbin/tini + - -- + - /ko-app/resolvers + args: [] + resources: + requests: + cpu: 100m + memory: 100Mi + limits: + cpu: 1000m + memory: 4Gi + ports: + - name: metrics + containerPort: 9090 + - name: profiling + containerPort: 8008 + # This must match the value of the environment variable PROBES_PORT. + - name: probes + containerPort: 8080 + env: + - name: SYSTEM_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: KUBERNETES_MIN_VERSION + value: "v1.28.0" + # If you are changing these names, you will also need to update + # the controller's Role in 200-role.yaml to include the new + # values in the "configmaps" "get" rule. + - name: CONFIG_LOGGING_NAME + value: config-logging + - name: CONFIG_OBSERVABILITY_NAME + value: config-observability + - name: CONFIG_FEATURE_FLAGS_NAME + value: feature-flags + - name: CONFIG_LEADERELECTION_NAME + value: config-leader-election-resolvers + - name: METRICS_DOMAIN + value: tekton.dev/resolution + - name: PROBES_PORT + value: "8080" + - name: TEKTON_HUB_API + value: "" # Override this env var to set a private hub api endpoint + - name: ARTIFACT_HUB_API + value: "https://artifacthub.io/" + volumeMounts: + - name: tmp-clone-volume + mountPath: "/tmp" + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + runAsNonRoot: true + runAsUser: 65532 + capabilities: + drop: + - "ALL" + seccompProfile: + type: RuntimeDefault + volumes: + - name: tmp-clone-volume + emptyDir: + sizeLimit: 4Gi +--- +# Copyright 2023 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +apiVersion: v1 +kind: Service +metadata: + labels: + app.kubernetes.io/name: resolvers + app.kubernetes.io/component: resolvers + app.kubernetes.io/instance: default + app.kubernetes.io/version: "v1.15.0" + app.kubernetes.io/part-of: tekton-pipelines + # tekton.dev/release value replaced with inputs.params.versionTag in pipeline/tekton/publish.yaml + pipeline.tekton.dev/release: "v1.15.0" + # labels below are related to istio and should not be used for resource lookup + app: tekton-pipelines-remote-resolvers + version: "v1.15.0" + name: tekton-pipelines-remote-resolvers + namespace: tekton-pipelines-resolvers +spec: + ports: + - name: http-metrics + port: 9090 + protocol: TCP + targetPort: 9090 + - name: http-profiling + port: 8008 + targetPort: 8008 + - name: probes + port: 8080 + selector: + app.kubernetes.io/name: resolvers + app.kubernetes.io/component: resolvers + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +--- +# Copyright 2020 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: autoscaling/v2 +kind: HorizontalPodAutoscaler +metadata: + name: tekton-pipelines-webhook + namespace: tekton-pipelines + labels: + app.kubernetes.io/name: webhook + app.kubernetes.io/component: webhook + app.kubernetes.io/instance: default + app.kubernetes.io/version: "v1.15.0" + app.kubernetes.io/part-of: tekton-pipelines + # tekton.dev/release value replaced with inputs.params.versionTag in pipeline/tekton/publish.yaml + pipeline.tekton.dev/release: "v1.15.0" + # labels below are related to istio and should not be used for resource lookup + version: "v1.15.0" +spec: + minReplicas: 1 + maxReplicas: 5 + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: tekton-pipelines-webhook + metrics: + - type: Resource + resource: + name: cpu + target: + type: Utilization + averageUtilization: 100 +--- +# Copyright 2020 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: apps/v1 +kind: Deployment +metadata: + # Note: the Deployment name must be the same as the Service name specified in + # config/400-webhook-service.yaml. If you change this name, you must also + # change the value of WEBHOOK_SERVICE_NAME below. + name: tekton-pipelines-webhook + namespace: tekton-pipelines + labels: + app.kubernetes.io/name: webhook + app.kubernetes.io/component: webhook + app.kubernetes.io/instance: default + app.kubernetes.io/version: "v1.15.0" + app.kubernetes.io/part-of: tekton-pipelines + # tekton.dev/release value replaced with inputs.params.versionTag in pipeline/tekton/publish.yaml + pipeline.tekton.dev/release: "v1.15.0" + # labels below are related to istio and should not be used for resource lookup + version: "v1.15.0" +spec: + selector: + matchLabels: + app.kubernetes.io/name: webhook + app.kubernetes.io/component: webhook + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines + template: + metadata: + labels: + app.kubernetes.io/name: webhook + app.kubernetes.io/component: webhook + app.kubernetes.io/instance: default + app.kubernetes.io/version: "v1.15.0" + app.kubernetes.io/part-of: tekton-pipelines + # tekton.dev/release value replaced with inputs.params.versionTag in pipeline/tekton/publish.yaml + pipeline.tekton.dev/release: "v1.15.0" + # labels below are related to istio and should not be used for resource lookup + app: tekton-pipelines-webhook + version: "v1.15.0" + spec: + affinity: + nodeAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: kubernetes.io/os + operator: NotIn + values: + - windows + podAntiAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchLabels: + app.kubernetes.io/name: webhook + app.kubernetes.io/component: webhook + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines + topologyKey: kubernetes.io/hostname + weight: 100 + serviceAccountName: tekton-pipelines-webhook + containers: + - name: webhook + # This is the Go import path for the binary that is containerized + # and substituted here. + image: ghcr.io/tektoncd/pipeline/webhook-d4749e605405422fd87700164e31b2d1:v1.15.0@sha256:660a4a3bc55eaafcf8672d2c8c2469d9cf0e6090cd367a3d4bac82f834487947 + # Resource request required for autoscaler to take any action for a metric + resources: + requests: + cpu: 100m + memory: 100Mi + limits: + cpu: 500m + memory: 500Mi + env: + - name: SYSTEM_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: KUBERNETES_MIN_VERSION + value: "v1.28.0" + # If you are changing these names, you will also need to update + # the webhook's Role in 200-role.yaml to include the new + # values in the "configmaps" "get" rule. + - name: CONFIG_LOGGING_NAME + value: config-logging + - name: CONFIG_OBSERVABILITY_NAME + value: config-observability + - name: CONFIG_LEADERELECTION_NAME + value: config-leader-election-webhook + - name: CONFIG_FEATURE_FLAGS_NAME + value: feature-flags + # If you change PROBES_PORT, you will also need to change the + # containerPort "probes" to the same value. + - name: PROBES_PORT + value: "8080" + # If you change WEBHOOK_PORT, you will also need to change the + # containerPort "https-webhook" to the same value. + - name: WEBHOOK_PORT + value: "8443" + # if you change WEBHOOK_ADMISSION_CONTROLLER_NAME, you will also need to update + # the webhooks.name in 500-webhooks.yaml to include the new names of admission webhooks. + # Additionally, you will also need to change the resource names (metadata.name) of + # "MutatingWebhookConfiguration" and "ValidatingWebhookConfiguration" in 500-webhooks.yaml + # to reflect the change in the name of the admission webhook. + # Followed by changing the webhook's Role in 200-clusterrole.yaml to update the "resourceNames" of + # "mutatingwebhookconfigurations" and "validatingwebhookconfigurations" resources. + - name: WEBHOOK_ADMISSION_CONTROLLER_NAME + value: webhook.pipeline.tekton.dev + - name: WEBHOOK_SERVICE_NAME + value: tekton-pipelines-webhook + - name: WEBHOOK_SECRET_NAME + value: webhook-certs + - name: METRICS_DOMAIN + value: tekton.dev/pipeline + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + capabilities: + drop: + - "ALL" + # User 65532 is the distroless nonroot user ID + runAsUser: 65532 + runAsGroup: 65532 + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault + ports: + - name: metrics + containerPort: 9090 + - name: profiling + containerPort: 8008 + # This must match the value of the environment variable WEBHOOK_PORT. + - name: https-webhook + containerPort: 8443 + # This must match the value of the environment variable PROBES_PORT. + - name: probes + containerPort: 8080 + livenessProbe: + httpGet: + path: /health + port: probes + scheme: HTTP + initialDelaySeconds: 5 + periodSeconds: 10 + timeoutSeconds: 5 + readinessProbe: + httpGet: + path: /readiness + port: probes + scheme: HTTP + initialDelaySeconds: 5 + periodSeconds: 10 + timeoutSeconds: 5 +--- +apiVersion: v1 +kind: Service +metadata: + labels: + app.kubernetes.io/name: webhook + app.kubernetes.io/component: webhook + app.kubernetes.io/instance: default + app.kubernetes.io/version: "v1.15.0" + app.kubernetes.io/part-of: tekton-pipelines + # tekton.dev/release value replaced with inputs.params.versionTag in pipeline/tekton/publish.yaml + pipeline.tekton.dev/release: "v1.15.0" + # labels below are related to istio and should not be used for resource lookup + app: tekton-pipelines-webhook + version: "v1.15.0" + name: tekton-pipelines-webhook + namespace: tekton-pipelines +spec: + ports: + # Define metrics and profiling for them to be accessible within service meshes. + - name: http-metrics + port: 9090 + targetPort: metrics + - name: http-profiling + port: 8008 + targetPort: profiling + - name: https-webhook + port: 443 + targetPort: https-webhook + - name: probes + port: 8080 + targetPort: probes + selector: + app.kubernetes.io/name: webhook + app.kubernetes.io/component: webhook + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines diff --git a/packages/manifests/operators/tekton-pipelines/v1.15.0.yaml b/packages/manifests/operators/tekton-pipelines/v1.15.0.yaml new file mode 100644 index 0000000..28f3a55 --- /dev/null +++ b/packages/manifests/operators/tekton-pipelines/v1.15.0.yaml @@ -0,0 +1,28155 @@ +# Source: https://github.com/tektoncd/pipeline/releases/download/v1.15.0/release.yaml +--- +# Copyright 2019 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: Namespace +metadata: + name: tekton-pipelines + labels: + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines + pod-security.kubernetes.io/enforce: restricted +--- +# Copyright 2020-2022 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: tekton-pipelines-controller-cluster-access + labels: + app.kubernetes.io/component: controller + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +rules: + - apiGroups: [""] + # Controller needs to watch Pods created by TaskRuns to see them progress. + resources: ["pods"] + verbs: ["list", "watch"] + - apiGroups: [""] + # Controller needs to get the list of cordoned nodes over the course of a single run + resources: ["nodes"] + verbs: ["list"] + # Controller needs cluster access to all of the CRDs that it is responsible for + # managing. + - apiGroups: ["tekton.dev"] + resources: ["tasks", "taskruns", "pipelines", "pipelineruns", "customruns", "stepactions"] + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] + - apiGroups: ["tekton.dev"] + resources: ["verificationpolicies"] + verbs: ["get", "list", "watch"] + - apiGroups: ["tekton.dev"] + resources: ["taskruns/finalizers", "pipelineruns/finalizers", "customruns/finalizers"] + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] + - apiGroups: ["tekton.dev"] + resources: ["tasks/status", "taskruns/status", "pipelines/status", "pipelineruns/status", + "customruns/status", "verificationpolicies/status", "stepactions/status"] + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] + # resolution.tekton.dev + - apiGroups: ["resolution.tekton.dev"] + resources: ["resolutionrequests", "resolutionrequests/status"] + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] +--- +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + # This is the access that the controller needs on a per-namespace basis. + name: tekton-pipelines-controller-tenant-access + labels: + app.kubernetes.io/component: controller + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +rules: + # Read-write access to create Pods and PVCs (for Workspaces) + - apiGroups: [""] + resources: ["pods", "persistentvolumeclaims"] + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] + # Write permissions to publish events. + - apiGroups: [""] + resources: ["events"] + verbs: ["create", "update", "patch"] + # Read-only access to these. + - apiGroups: [""] + resources: ["configmaps", "limitranges", "secrets", "serviceaccounts"] + verbs: ["get", "list", "watch"] + # Read-write access to StatefulSets for Affinity Assistant. + - apiGroups: ["apps"] + resources: ["statefulsets"] + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] +--- +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: tekton-pipelines-webhook-cluster-access + labels: + app.kubernetes.io/component: webhook + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +rules: + # The webhook needs to be able to get and update customresourcedefinitions, + # mainly to update the webhook certificates. + - apiGroups: ["apiextensions.k8s.io"] + resources: ["customresourcedefinitions", "customresourcedefinitions/status"] + verbs: ["get", "update", "patch"] + resourceNames: + - pipelines.tekton.dev + - pipelineruns.tekton.dev + - tasks.tekton.dev + - taskruns.tekton.dev + - resolutionrequests.resolution.tekton.dev + - customruns.tekton.dev + - verificationpolicies.tekton.dev + - stepactions.tekton.dev + # knative.dev/pkg needs list/watch permissions to set up informers for the webhook. + - apiGroups: ["apiextensions.k8s.io"] + resources: ["customresourcedefinitions"] + verbs: ["list", "watch"] + - apiGroups: ["admissionregistration.k8s.io"] + # The webhook performs a reconciliation on these two resources and continuously + # updates configuration. + resources: ["mutatingwebhookconfigurations", "validatingwebhookconfigurations"] + # knative starts informers on these things, which is why we need get, list and watch. + verbs: ["list", "watch"] + - apiGroups: ["admissionregistration.k8s.io"] + resources: ["mutatingwebhookconfigurations"] + # This mutating webhook is responsible for applying defaults to tekton objects + # as they are received. + resourceNames: ["webhook.pipeline.tekton.dev"] + # When there are changes to the configs or secrets, knative updates the mutatingwebhook config + # with the updated certificates or the refreshed set of rules. + verbs: ["get", "update", "delete"] + - apiGroups: ["admissionregistration.k8s.io"] + resources: ["validatingwebhookconfigurations"] + # validation.webhook.pipeline.tekton.dev performs schema validation when you, for example, create TaskRuns. + # config.webhook.pipeline.tekton.dev validates the logging configuration against knative's logging structure + resourceNames: ["validation.webhook.pipeline.tekton.dev", "config.webhook.pipeline.tekton.dev"] + # When there are changes to the configs or secrets, knative updates the validatingwebhook config + # with the updated certificates or the refreshed set of rules. + verbs: ["get", "update", "delete"] + - apiGroups: [""] + resources: ["namespaces"] + verbs: ["get"] + # The webhook configured the namespace as the OwnerRef on various cluster-scoped resources, + # which requires we can Get the system namespace. + resourceNames: ["tekton-pipelines"] + - apiGroups: [""] + resources: ["namespaces/finalizers"] + verbs: ["update"] + # The webhook configured the namespace as the OwnerRef on various cluster-scoped resources, + # which requires we can update the system namespace finalizers. + resourceNames: ["tekton-pipelines"] +--- +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: tekton-events-controller-cluster-access + labels: + app.kubernetes.io/component: events + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +rules: + - apiGroups: ["tekton.dev"] + resources: ["tasks", "taskruns", "pipelines", "pipelineruns", "customruns"] + verbs: ["get", "list", "watch"] + - apiGroups: [""] + resources: ["events"] + verbs: ["create", "patch"] +--- +# Copyright 2020 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +kind: Role +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: tekton-pipelines-controller + namespace: tekton-pipelines + labels: + app.kubernetes.io/component: controller + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +rules: + - apiGroups: [""] + resources: ["configmaps"] + verbs: ["list", "watch"] + # The controller needs access to these configmaps for logging information and runtime configuration. + - apiGroups: [""] + resources: ["configmaps"] + verbs: ["get"] + resourceNames: ["config-logging", "config-observability", "feature-flags", "config-leader-election-controller", + "config-registry-cert"] +--- +kind: Role +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: tekton-pipelines-webhook + namespace: tekton-pipelines + labels: + app.kubernetes.io/component: webhook + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +rules: + - apiGroups: [""] + resources: ["configmaps"] + verbs: ["list", "watch"] + # The webhook needs access to these configmaps for logging information. + - apiGroups: [""] + resources: ["configmaps"] + verbs: ["get"] + resourceNames: ["config-logging", "config-observability", "config-leader-election-webhook", + "feature-flags"] + - apiGroups: [""] + resources: ["secrets"] + verbs: ["list", "watch"] + # The webhook daemon makes a reconciliation loop on webhook-certs. Whenever + # the secret changes it updates the webhook configurations with the certificates + # stored in the secret. + - apiGroups: [""] + resources: ["secrets"] + verbs: ["get", "update"] + resourceNames: ["webhook-certs"] +--- +kind: Role +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: tekton-pipelines-events-controller + namespace: tekton-pipelines + labels: + app.kubernetes.io/component: events + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +rules: + - apiGroups: [""] + resources: ["configmaps"] + verbs: ["list", "watch"] + # The controller needs access to these configmaps for logging information and runtime configuration. + - apiGroups: [""] + resources: ["configmaps"] + verbs: ["get"] + resourceNames: ["config-logging", "config-observability", "feature-flags", "config-leader-election-events", + "config-registry-cert"] +--- +kind: Role +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: tekton-pipelines-leader-election + namespace: tekton-pipelines + labels: + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +rules: + # We uses leases for leaderelection + - apiGroups: ["coordination.k8s.io"] + resources: ["leases"] + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: tekton-pipelines-info + namespace: tekton-pipelines + labels: + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +rules: + # All system:authenticated users needs to have access + # of the pipelines-info ConfigMap even if they don't + # have access to the other resources present in the + # installed namespace. + - apiGroups: [""] + resources: ["configmaps"] + resourceNames: ["pipelines-info"] + verbs: ["get"] +--- +# Copyright 2019 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +apiVersion: v1 +kind: ServiceAccount +metadata: + name: tekton-pipelines-controller + namespace: tekton-pipelines + labels: + app.kubernetes.io/component: controller + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: tekton-pipelines-webhook + namespace: tekton-pipelines + labels: + app.kubernetes.io/component: webhook + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: tekton-events-controller + namespace: tekton-pipelines + labels: + app.kubernetes.io/component: events + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +--- +# Copyright 2019 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: tekton-pipelines-controller-cluster-access + labels: + app.kubernetes.io/component: controller + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +subjects: + - kind: ServiceAccount + name: tekton-pipelines-controller + namespace: tekton-pipelines +roleRef: + kind: ClusterRole + name: tekton-pipelines-controller-cluster-access + apiGroup: rbac.authorization.k8s.io +--- +# If this ClusterRoleBinding is replaced with a RoleBinding +# then the ClusterRole would be namespaced. The access described by +# the tekton-pipelines-controller-tenant-access ClusterRole would +# be scoped to individual tenant namespaces. +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: tekton-pipelines-controller-tenant-access + labels: + app.kubernetes.io/component: controller + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +subjects: + - kind: ServiceAccount + name: tekton-pipelines-controller + namespace: tekton-pipelines +roleRef: + kind: ClusterRole + name: tekton-pipelines-controller-tenant-access + apiGroup: rbac.authorization.k8s.io +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: tekton-pipelines-webhook-cluster-access + labels: + app.kubernetes.io/component: webhook + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +subjects: + - kind: ServiceAccount + name: tekton-pipelines-webhook + namespace: tekton-pipelines +roleRef: + kind: ClusterRole + name: tekton-pipelines-webhook-cluster-access + apiGroup: rbac.authorization.k8s.io +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: tekton-events-controller-cluster-access + labels: + app.kubernetes.io/component: events + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +subjects: + - kind: ServiceAccount + name: tekton-events-controller + namespace: tekton-pipelines +roleRef: + kind: ClusterRole + name: tekton-events-controller-cluster-access + apiGroup: rbac.authorization.k8s.io +--- +# Copyright 2020 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: tekton-pipelines-controller + namespace: tekton-pipelines + labels: + app.kubernetes.io/component: controller + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +subjects: + - kind: ServiceAccount + name: tekton-pipelines-controller + namespace: tekton-pipelines +roleRef: + kind: Role + name: tekton-pipelines-controller + apiGroup: rbac.authorization.k8s.io +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: tekton-pipelines-webhook + namespace: tekton-pipelines + labels: + app.kubernetes.io/component: webhook + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +subjects: + - kind: ServiceAccount + name: tekton-pipelines-webhook + namespace: tekton-pipelines +roleRef: + kind: Role + name: tekton-pipelines-webhook + apiGroup: rbac.authorization.k8s.io +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: tekton-pipelines-controller-leaderelection + namespace: tekton-pipelines + labels: + app.kubernetes.io/component: controller + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +subjects: + - kind: ServiceAccount + name: tekton-pipelines-controller + namespace: tekton-pipelines +roleRef: + kind: Role + name: tekton-pipelines-leader-election + apiGroup: rbac.authorization.k8s.io +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: tekton-pipelines-webhook-leaderelection + namespace: tekton-pipelines + labels: + app.kubernetes.io/component: webhook + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +subjects: + - kind: ServiceAccount + name: tekton-pipelines-webhook + namespace: tekton-pipelines +roleRef: + kind: Role + name: tekton-pipelines-leader-election + apiGroup: rbac.authorization.k8s.io +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: tekton-pipelines-info + namespace: tekton-pipelines + labels: + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +subjects: + # Giving all system:authenticated users the access of the + # ConfigMap which contains version information. + - kind: Group + name: system:authenticated + apiGroup: rbac.authorization.k8s.io +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: tekton-pipelines-info +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: tekton-pipelines-events-controller + namespace: tekton-pipelines + labels: + app.kubernetes.io/component: events + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +subjects: + - kind: ServiceAccount + name: tekton-events-controller + namespace: tekton-pipelines +roleRef: + kind: Role + name: tekton-pipelines-events-controller + apiGroup: rbac.authorization.k8s.io +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: tekton-events-controller-leaderelection + namespace: tekton-pipelines + labels: + app.kubernetes.io/component: events + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +subjects: + - kind: ServiceAccount + name: tekton-events-controller + namespace: tekton-pipelines +roleRef: + kind: Role + name: tekton-pipelines-leader-election + apiGroup: rbac.authorization.k8s.io +--- +# Copyright 2020 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: customruns.tekton.dev + labels: + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines + pipeline.tekton.dev/release: "v1.15.0" + version: "v1.15.0" +spec: + group: tekton.dev + preserveUnknownFields: false + versions: + - name: v1beta1 + served: true + storage: true + schema: + openAPIV3Schema: + description: CustomRun represents a single execution of a Custom Task. + type: object + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: CustomRunSpec defines the desired state of CustomRun + type: object + properties: + customRef: + description: TaskRef can be used to refer to a specific instance + of a task. + type: object + properties: + apiVersion: + description: |- + API version of the referent + Note: A Task with non-empty APIVersion and Kind is considered a Custom Task + type: string + bundle: + description: |- + Bundle url reference to a Tekton Bundle. + + Deprecated: Please use ResolverRef with the bundles resolver instead. + The field is staying there for go client backward compatibility, but is not used/allowed anymore. + type: string + kind: + description: |- + TaskKind indicates the Kind of the Task: + 1. Namespaced Task when Kind is set to "Task". If Kind is "", it defaults to "Task". + 2. Custom Task when Kind is non-empty and APIVersion is non-empty + type: string + name: + description: 'Name of the referent; More info: http://kubernetes.io/docs/user-guide/identifiers#names' + type: string + params: + description: |- + Params contains the parameters used to identify the + referenced Tekton resource. Example entries might include + "repo" or "path" but the set of params ultimately depends on + the chosen resolver. + type: array + items: + description: Param declares an ParamValues to use for the + parameter called name. + type: object + required: + - name + - value + properties: + name: + type: string + value: + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + resolver: + description: |- + Resolver is the name of the resolver that should perform + resolution of the referenced Tekton resource, such as "git". + type: string + customSpec: + description: Spec is a specification of a custom task + type: object + properties: + apiVersion: + type: string + kind: + type: string + metadata: + description: PipelineTaskMetadata contains the labels or annotations + for an EmbeddedTask + type: object + properties: + annotations: + type: object + additionalProperties: + type: string + labels: + type: object + additionalProperties: + type: string + spec: + description: Spec is a specification of a custom task + type: object + x-kubernetes-preserve-unknown-fields: true + params: + description: Params is a list of Param + type: array + items: + description: Param declares an ParamValues to use for the parameter + called name. + type: object + required: + - name + - value + properties: + name: + type: string + value: + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + retries: + description: Used for propagating retries count to custom tasks + type: integer + serviceAccountName: + type: string + status: + description: Used for cancelling a customrun (and maybe more later + on) + type: string + statusMessage: + description: Status message for cancellation. + type: string + timeout: + description: |- + Time after which the custom-task times out. + Refer Go's ParseDuration documentation for expected format: https://golang.org/pkg/time/#ParseDuration + type: string + workspaces: + description: Workspaces is a list of WorkspaceBindings from volumes + to workspaces. + type: array + items: + description: WorkspaceBinding maps a Task's declared workspace + to a Volume. + type: object + required: + - name + properties: + configMap: + description: ConfigMap represents a configMap that should + populate this workspace. + type: object + properties: + defaultMode: + description: |- + defaultMode is optional: mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + Defaults to 0644. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + ConfigMap will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the ConfigMap, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: optional specify whether the ConfigMap or + its keys must be defined + type: boolean + x-kubernetes-map-type: atomic + csi: + description: CSI (Container Storage Interface) represents + ephemeral storage that is handled by certain external CSI + drivers. + type: object + required: + - driver + properties: + driver: + description: |- + driver is the name of the CSI driver that handles this volume. + Consult with your admin for the correct name as registered in the cluster. + type: string + fsType: + description: |- + fsType to mount. Ex. "ext4", "xfs", "ntfs". + If not provided, the empty value is passed to the associated CSI driver + which will determine the default filesystem to apply. + type: string + nodePublishSecretRef: + description: |- + nodePublishSecretRef is a reference to the secret object containing + sensitive information to pass to the CSI driver to complete the CSI + NodePublishVolume and NodeUnpublishVolume calls. + This field is optional, and may be empty if no secret is required. If the + secret object contains more than one secret, all secret references are passed. + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + x-kubernetes-map-type: atomic + readOnly: + description: |- + readOnly specifies a read-only configuration for the volume. + Defaults to false (read/write). + type: boolean + volumeAttributes: + description: |- + volumeAttributes stores driver-specific properties that are passed to the CSI + driver. Consult your driver's documentation for supported values. + type: object + additionalProperties: + type: string + emptyDir: + description: |- + EmptyDir represents a temporary directory that shares a Task's lifetime. + More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir + Either this OR PersistentVolumeClaim can be used. + type: object + properties: + medium: + description: |- + medium represents what type of storage medium should back this directory. + The default is "" which means to use the node's default medium. + Must be an empty string (default) or Memory. + More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir + type: string + sizeLimit: + description: |- + sizeLimit is the total amount of local storage required for this EmptyDir volume. + The size limit is also applicable for memory medium. + The maximum usage on memory medium EmptyDir would be the minimum value between + the SizeLimit specified here and the sum of memory limits of all containers in a pod. + The default is nil which means that the limit is undefined. + More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + name: + description: Name is the name of the workspace populated by + the volume. + type: string + persistentVolumeClaim: + description: |- + PersistentVolumeClaimVolumeSource represents a reference to a + PersistentVolumeClaim in the same namespace. Either this OR EmptyDir can be used. + type: object + required: + - claimName + properties: + claimName: + description: |- + claimName is the name of a PersistentVolumeClaim in the same namespace as the pod using this volume. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims + type: string + readOnly: + description: |- + readOnly Will force the ReadOnly setting in VolumeMounts. + Default false. + type: boolean + projected: + description: Projected represents a projected volume that + should populate this workspace. + type: object + properties: + defaultMode: + description: |- + defaultMode are the mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + sources: + description: |- + sources is the list of volume projections. Each entry in this list + handles one source. + type: array + items: + description: |- + Projection that may be projected along with other supported volume types. + Exactly one of these fields must be set. + type: object + properties: + clusterTrustBundle: + description: |- + ClusterTrustBundle allows a pod to access the `.spec.trustBundle` field + of ClusterTrustBundle objects in an auto-updating file. + + Alpha, gated by the ClusterTrustBundleProjection feature gate. + + ClusterTrustBundle objects can either be selected by name, or by the + combination of signer name and a label selector. + + Kubelet performs aggressive normalization of the PEM contents written + into the pod filesystem. Esoteric PEM features such as inter-block + comments and block headers are stripped. Certificates are deduplicated. + The ordering of certificates within the file is arbitrary, and Kubelet + may change the order over time. + type: object + required: + - path + properties: + labelSelector: + description: |- + Select all ClusterTrustBundles that match this label selector. Only has + effect if signerName is set. Mutually-exclusive with name. If unset, + interpreted as "match nothing". If set but empty, interpreted as "match + everything". + type: object + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + name: + description: |- + Select a single ClusterTrustBundle by object name. Mutually-exclusive + with signerName and labelSelector. + type: string + optional: + description: |- + If true, don't block pod startup if the referenced ClusterTrustBundle(s) + aren't available. If using name, then the named ClusterTrustBundle is + allowed not to exist. If using signerName, then the combination of + signerName and labelSelector is allowed to match zero + ClusterTrustBundles. + type: boolean + path: + description: Relative path from the volume root + to write the bundle. + type: string + signerName: + description: |- + Select all ClusterTrustBundles that match this signer name. + Mutually-exclusive with name. The contents of all selected + ClusterTrustBundles will be unified and deduplicated. + type: string + configMap: + description: configMap information about the configMap + data to project + type: object + properties: + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + ConfigMap will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the ConfigMap, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within + a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: optional specify whether the ConfigMap + or its keys must be defined + type: boolean + x-kubernetes-map-type: atomic + downwardAPI: + description: downwardAPI information about the downwardAPI + data to project + type: object + properties: + items: + description: Items is a list of DownwardAPIVolume + file + type: array + items: + description: DownwardAPIVolumeFile represents + information to create the file containing + the pod field + type: object + required: + - path + properties: + fieldRef: + description: 'Required: Selects a field + of the pod: only annotations, labels, + name, namespace and uid are supported.' + type: object + required: + - fieldPath + properties: + apiVersion: + description: Version of the schema + the FieldPath is written in terms + of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to + select in the specified API version. + type: string + x-kubernetes-map-type: atomic + mode: + description: |- + Optional: mode bits used to set permissions on this file, must be an octal value + between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: 'Required: Path is the relative + path name of the file to be created. + Must not be absolute or contain the + ''..'' path. Must be utf-8 encoded. + The first item of the relative path + must not start with ''..''' + type: string + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported. + type: object + required: + - resource + properties: + containerName: + description: 'Container name: required + for volumes, optional for env vars' + type: string + divisor: + description: Specifies the output + format of the exposed resources, + defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to + select' + type: string + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + secret: + description: secret information about the secret + data to project + type: object + properties: + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + Secret will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the Secret, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within + a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: optional field specify whether + the Secret or its key must be defined + type: boolean + x-kubernetes-map-type: atomic + serviceAccountToken: + description: serviceAccountToken is information + about the serviceAccountToken data to project + type: object + required: + - path + properties: + audience: + description: |- + audience is the intended audience of the token. A recipient of a token + must identify itself with an identifier specified in the audience of the + token, and otherwise should reject the token. The audience defaults to the + identifier of the apiserver. + type: string + expirationSeconds: + description: |- + expirationSeconds is the requested duration of validity of the service + account token. As the token approaches expiration, the kubelet volume + plugin will proactively rotate the service account token. The kubelet will + start trying to rotate the token if the token is older than 80 percent of + its time to live or if the token is older than 24 hours.Defaults to 1 hour + and must be at least 10 minutes. + type: integer + format: int64 + path: + description: |- + path is the path relative to the mount point of the file to project the + token into. + type: string + x-kubernetes-list-type: atomic + secret: + description: Secret represents a secret that should populate + this workspace. + type: object + properties: + defaultMode: + description: |- + defaultMode is Optional: mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values + for mode bits. Defaults to 0644. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + items: + description: |- + items If unspecified, each key-value pair in the Data field of the referenced + Secret will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the Secret, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + optional: + description: optional field specify whether the Secret + or its keys must be defined + type: boolean + secretName: + description: |- + secretName is the name of the secret in the pod's namespace to use. + More info: https://kubernetes.io/docs/concepts/storage/volumes#secret + type: string + subPath: + description: |- + SubPath is optionally a directory on the volume which should be used + for this binding (i.e. the volume will be mounted at this sub directory). + type: string + volumeClaimTemplate: + description: |- + VolumeClaimTemplate is a template for a claim that will be created in the same namespace. + The PipelineRun controller is responsible for creating a unique claim for each instance of PipelineRun. + See PersistentVolumeClaim (API version: v1) + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + status: + description: CustomRunStatus defines the observed state of CustomRun + type: object + properties: + annotations: + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + additionalProperties: + type: string + completionTime: + description: CompletionTime is the time the build completed. + type: string + format: date-time + conditions: + description: Conditions the latest available observations of a resource's + current state. + type: array + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + type: object + required: + - status + - type + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating details about + the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, False, + Unknown. + type: string + type: + description: Type of condition. + type: string + extraFields: + description: |- + ExtraFields holds arbitrary fields provided by the custom task + controller. + x-kubernetes-preserve-unknown-fields: true + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + type: integer + format: int64 + results: + description: |- + Results reports any output result values to be consumed by later + tasks in a pipeline. + type: array + items: + description: CustomRunResult used to describe the results of a + task + type: object + required: + - name + - value + properties: + name: + description: Name the given name + type: string + value: + description: Value the given value of the result + type: string + retriesStatus: + description: |- + RetriesStatus contains the history of CustomRunStatus, in case of a retry. + See CustomRun.status (API version: tekton.dev/v1beta1) + x-kubernetes-preserve-unknown-fields: true + startTime: + description: StartTime is the time the build is actually started. + type: string + format: date-time + additionalPrinterColumns: + - name: Succeeded + type: string + jsonPath: ".status.conditions[?(@.type==\"Succeeded\")].status" + - name: Reason + type: string + jsonPath: ".status.conditions[?(@.type==\"Succeeded\")].reason" + - name: StartTime + type: date + jsonPath: .status.startTime + - name: CompletionTime + type: date + jsonPath: .status.completionTime + # Opt into the status subresource so metadata.generation + # starts to increment + subresources: + status: {} + names: + kind: CustomRun + plural: customruns + singular: customrun + categories: + - tekton + - tekton-pipelines + scope: Namespaced +--- +# Copyright 2019 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: pipelines.tekton.dev + labels: + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines + pipeline.tekton.dev/release: "v1.15.0" + version: "v1.15.0" +spec: + group: tekton.dev + preserveUnknownFields: false + versions: + - name: v1beta1 + served: true + storage: false + subresources: + status: {} + schema: + openAPIV3Schema: + description: |- + Pipeline + Deprecated: Please use v1.Pipeline instead. + type: object + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: Spec + type: object + properties: + description: + description: Description + type: string + displayName: + description: DisplayName + type: string + finally: + description: Finally + type: array + items: + description: PipelineTask + type: object + properties: + description: + description: Description + type: string + displayName: + description: DisplayName + type: string + matrix: + description: Matrix + type: object + properties: + include: + description: Include + type: array + items: + description: IncludeParams + type: object + properties: + name: + description: Name + type: string + params: + description: Params + type: array + items: + description: Param + type: object + required: + - name + - value + properties: + name: + type: string + value: + description: Value + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + params: + description: Params + type: array + items: + description: Param + type: object + required: + - name + - value + properties: + name: + type: string + value: + description: Value + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + name: + description: Name + type: string + onError: + description: OnError + type: string + params: + description: Params + type: array + items: + description: Param + type: object + required: + - name + - value + properties: + name: + type: string + value: + description: Value + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + pipelineRef: + description: PipelineRef + type: object + properties: + apiVersion: + description: APIVersion + type: string + bundle: + description: |- + Deprecated: Please use ResolverRef with the bundles resolver instead. + Bundle + type: string + name: + description: Name + type: string + params: + description: Params + type: array + items: + description: Param + type: object + required: + - name + - value + properties: + name: + type: string + value: + description: Value + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + resolver: + description: Resolver + type: string + pipelineSpec: + description: PipelineSpec + x-kubernetes-preserve-unknown-fields: true + resources: + description: |- + Resources + Deprecated: Unused, preserved only for backwards compatibility + type: object + properties: + inputs: + description: Inputs + type: array + items: + description: |- + PipelineTaskInputResource + Deprecated: Unused, preserved only for backwards compatibility + type: object + required: + - name + - resource + properties: + from: + description: From + type: array + items: + type: string + x-kubernetes-list-type: atomic + name: + description: Name + type: string + resource: + description: Resource + type: string + x-kubernetes-list-type: atomic + outputs: + description: Outputs + type: array + items: + description: |- + PipelineTaskOutputResource + Deprecated: Unused, preserved only for backwards compatibility + type: object + required: + - name + - resource + properties: + name: + description: Name + type: string + resource: + description: Resource + type: string + x-kubernetes-list-type: atomic + retries: + description: Retries + type: integer + runAfter: + description: RunAfter + type: array + items: + type: string + x-kubernetes-list-type: atomic + taskRef: + description: TaskRef + type: object + properties: + apiVersion: + description: APIVersion + type: string + bundle: + description: |- + Deprecated: Please use ResolverRef with the bundles resolver instead. + Bundle + type: string + kind: + description: Kind + type: string + name: + description: Name + type: string + params: + description: Params + type: array + items: + description: Param + type: object + required: + - name + - value + properties: + name: + type: string + value: + description: Value + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + resolver: + description: Resolver + type: string + taskSpec: + description: TaskSpec + x-kubernetes-preserve-unknown-fields: true + timeout: + description: Timeout + type: string + when: + description: WhenExpressions + type: array + items: + description: WhenExpression + type: object + properties: + cel: + description: CEL + type: string + input: + description: Input + type: string + operator: + description: Operator + type: string + values: + description: Values + type: array + items: + type: string + x-kubernetes-list-type: atomic + workspaces: + description: Workspaces + type: array + items: + description: WorkspacePipelineTaskBinding + type: object + required: + - name + properties: + name: + description: Name + type: string + subPath: + description: SubPath + type: string + workspace: + description: Workspace + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + params: + description: Params + type: array + items: + description: ParamSpec + type: object + required: + - name + properties: + default: + description: Default + x-kubernetes-preserve-unknown-fields: true + description: + description: Description + type: string + enum: + description: Enum + type: array + items: + type: string + name: + description: Name + type: string + properties: + description: Properties + type: object + additionalProperties: + description: PropertySpec + type: object + properties: + type: + description: ParamType + type: string + type: + description: Type + type: string + x-kubernetes-list-type: atomic + resources: + description: |- + Resources + Deprecated: Unused, preserved only for backwards compatibility + type: array + items: + description: |- + PipelineDeclaredResource + Deprecated: Unused, preserved only for backwards compatibility + type: object + required: + - name + - type + properties: + name: + description: Name + type: string + optional: + description: Optional + type: boolean + type: + description: Type + type: string + x-kubernetes-list-type: atomic + results: + description: Results + type: array + items: + description: PipelineResult + type: object + required: + - name + - value + properties: + description: + description: Description + type: string + name: + description: Name + type: string + type: + description: Type + type: string + value: + description: Value + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + tasks: + description: Tasks + type: array + items: + description: PipelineTask + type: object + properties: + description: + description: Description + type: string + displayName: + description: DisplayName + type: string + matrix: + description: Matrix + type: object + properties: + include: + description: Include + type: array + items: + description: IncludeParams + type: object + properties: + name: + description: Name + type: string + params: + description: Params + type: array + items: + description: Param + type: object + required: + - name + - value + properties: + name: + type: string + value: + description: Value + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + params: + description: Params + type: array + items: + description: Param + type: object + required: + - name + - value + properties: + name: + type: string + value: + description: Value + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + name: + description: Name + type: string + onError: + description: OnError + type: string + params: + description: Params + type: array + items: + description: Param + type: object + required: + - name + - value + properties: + name: + type: string + value: + description: Value + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + pipelineRef: + description: PipelineRef + type: object + properties: + apiVersion: + description: APIVersion + type: string + bundle: + description: |- + Deprecated: Please use ResolverRef with the bundles resolver instead. + Bundle + type: string + name: + description: Name + type: string + params: + description: Params + type: array + items: + description: Param + type: object + required: + - name + - value + properties: + name: + type: string + value: + description: Value + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + resolver: + description: Resolver + type: string + pipelineSpec: + description: PipelineSpec + x-kubernetes-preserve-unknown-fields: true + resources: + description: |- + Resources + Deprecated: Unused, preserved only for backwards compatibility + type: object + properties: + inputs: + description: Inputs + type: array + items: + description: |- + PipelineTaskInputResource + Deprecated: Unused, preserved only for backwards compatibility + type: object + required: + - name + - resource + properties: + from: + description: From + type: array + items: + type: string + x-kubernetes-list-type: atomic + name: + description: Name + type: string + resource: + description: Resource + type: string + x-kubernetes-list-type: atomic + outputs: + description: Outputs + type: array + items: + description: |- + PipelineTaskOutputResource + Deprecated: Unused, preserved only for backwards compatibility + type: object + required: + - name + - resource + properties: + name: + description: Name + type: string + resource: + description: Resource + type: string + x-kubernetes-list-type: atomic + retries: + description: Retries + type: integer + runAfter: + description: RunAfter + type: array + items: + type: string + x-kubernetes-list-type: atomic + taskRef: + description: TaskRef + type: object + properties: + apiVersion: + description: APIVersion + type: string + bundle: + description: |- + Deprecated: Please use ResolverRef with the bundles resolver instead. + Bundle + type: string + kind: + description: Kind + type: string + name: + description: Name + type: string + params: + description: Params + type: array + items: + description: Param + type: object + required: + - name + - value + properties: + name: + type: string + value: + description: Value + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + resolver: + description: Resolver + type: string + taskSpec: + description: TaskSpec + x-kubernetes-preserve-unknown-fields: true + timeout: + description: Timeout + type: string + when: + description: WhenExpressions + type: array + items: + description: WhenExpression + type: object + properties: + cel: + description: CEL + type: string + input: + description: Input + type: string + operator: + description: Operator + type: string + values: + description: Values + type: array + items: + type: string + x-kubernetes-list-type: atomic + workspaces: + description: Workspaces + type: array + items: + description: WorkspacePipelineTaskBinding + type: object + required: + - name + properties: + name: + description: Name + type: string + subPath: + description: SubPath + type: string + workspace: + description: Workspace + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + workspaces: + description: Workspaces + type: array + items: + description: PipelineWorkspaceDeclaration + type: object + required: + - name + properties: + description: + description: Description + type: string + name: + description: Name + type: string + optional: + description: Optional + type: boolean + x-kubernetes-list-type: atomic + - name: v1 + served: true + storage: true + schema: + openAPIV3Schema: + description: |- + Pipeline describes a list of Tasks to execute. It expresses how outputs + of tasks feed into inputs of subsequent tasks. + type: object + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: Spec holds the desired state of the Pipeline from the client + type: object + properties: + description: + description: |- + Description is a user-facing description of the pipeline that may be + used to populate a UI. + type: string + displayName: + description: |- + DisplayName is a user-facing name of the pipeline that may be + used to populate a UI. + type: string + finally: + description: |- + Finally declares the list of Tasks that execute just before leaving the Pipeline + i.e. either after all Tasks are finished executing successfully + or after a failure which would result in ending the Pipeline + type: array + items: + description: |- + PipelineTask defines a task in a Pipeline, passing inputs from both + Params and from the output of previous tasks. + type: object + properties: + description: + description: |- + Description is the description of this task within the context of a Pipeline. + This description may be used to populate a UI. + type: string + displayName: + description: |- + DisplayName is the display name of this task within the context of a Pipeline. + This display name may be used to populate a UI. + type: string + matrix: + description: Matrix declares parameters used to fan out this + task. + type: object + properties: + include: + description: Include is a list of IncludeParams which + allows passing in specific combinations of Parameters + into the Matrix. + type: array + items: + description: IncludeParams allows passing in a specific + combinations of Parameters into the Matrix. + type: object + properties: + name: + description: Name the specified combination + type: string + params: + description: |- + Params takes only `Parameters` of type `"string"` + The names of the `params` must match the names of the `params` in the underlying `Task` + type: array + items: + description: Param declares an ParamValues to + use for the parameter called name. + type: object + required: + - name + - value + properties: + name: + type: string + value: + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + params: + description: |- + Params is a list of parameters used to fan out the pipelineTask + Params takes only `Parameters` of type `"array"` + Each array element is supplied to the `PipelineTask` by substituting `params` of type `"string"` in the underlying `Task`. + The names of the `params` in the `Matrix` must match the names of the `params` in the underlying `Task` that they will be substituting. + type: array + items: + description: Param declares an ParamValues to use for + the parameter called name. + type: object + required: + - name + - value + properties: + name: + type: string + value: + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + name: + description: |- + Name is the name of this task within the context of a Pipeline. Name is + used as a coordinate with the `from` and `runAfter` fields to establish + the execution order of tasks relative to one another. + type: string + onError: + description: |- + OnError defines the exiting behavior of a PipelineRun on error + can be set to [ continue | stopAndFail ] + type: string + params: + description: Parameters declares parameters passed to this + task. + type: array + items: + description: Param declares an ParamValues to use for the + parameter called name. + type: object + required: + - name + - value + properties: + name: + type: string + value: + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + pipelineRef: + description: |- + PipelineRef is a reference to a pipeline definition. + This is an alpha field. You must set the "enable-api-fields" feature flag + to "alpha" for this field to be supported. When enabled, the referenced + Pipeline is executed as a child PipelineRun owned by the parent PipelineRun. + type: object + properties: + apiVersion: + description: API version of the referent + type: string + name: + description: 'Name of the referent; More info: http://kubernetes.io/docs/user-guide/identifiers#names' + type: string + params: + description: |- + Params contains the parameters used to identify the + referenced Tekton resource. Example entries might include + "repo" or "path" but the set of params ultimately depends on + the chosen resolver. + type: array + items: + description: Param declares an ParamValues to use for + the parameter called name. + type: object + required: + - name + - value + properties: + name: + type: string + value: + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + resolver: + description: |- + Resolver is the name of the resolver that should perform + resolution of the referenced Tekton resource, such as "git". + type: string + pipelineSpec: + description: |- + PipelineSpec is a specification of a pipeline. + This is an alpha field. You must set the "enable-api-fields" feature flag + to "alpha" for this field to be supported. When enabled, the embedded + Pipeline is executed as a child PipelineRun owned by the parent PipelineRun. + Specifying PipelineSpec can be disabled by setting + `disable-inline-spec` feature flag. + See Pipeline.spec (API version: tekton.dev/v1) + x-kubernetes-preserve-unknown-fields: true + retries: + description: 'Retries represents how many times this task + should be retried in case of task failure: ConditionSucceeded + set to False' + type: integer + runAfter: + description: |- + RunAfter is the list of PipelineTask names that should be executed before + this Task executes. (Used to force a specific ordering in graph execution.) + type: array + items: + type: string + x-kubernetes-list-type: atomic + taskRef: + description: TaskRef is a reference to a task definition. + type: object + properties: + apiVersion: + description: |- + API version of the referent + Note: A Task with non-empty APIVersion and Kind is considered a Custom Task + type: string + kind: + description: |- + TaskKind indicates the Kind of the Task: + 1. Namespaced Task when Kind is set to "Task". If Kind is "", it defaults to "Task". + 2. Custom Task when Kind is non-empty and APIVersion is non-empty + type: string + name: + description: 'Name of the referent; More info: http://kubernetes.io/docs/user-guide/identifiers#names' + type: string + params: + description: |- + Params contains the parameters used to identify the + referenced Tekton resource. Example entries might include + "repo" or "path" but the set of params ultimately depends on + the chosen resolver. + type: array + items: + description: Param declares an ParamValues to use for + the parameter called name. + type: object + required: + - name + - value + properties: + name: + type: string + value: + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + resolver: + description: |- + Resolver is the name of the resolver that should perform + resolution of the referenced Tekton resource, such as "git". + type: string + taskSpec: + description: |- + TaskSpec is a specification of a task + Specifying TaskSpec can be disabled by setting + `disable-inline-spec` feature flag. + See Task.spec (API version: tekton.dev/v1) + x-kubernetes-preserve-unknown-fields: true + timeout: + description: |- + Duration after which the TaskRun times out. Defaults to 1 hour. + Refer Go's ParseDuration documentation for expected format: https://golang.org/pkg/time/#ParseDuration + type: string + when: + description: When is a list of when expressions that need + to be true for the task to run + type: array + items: + description: |- + WhenExpression allows a PipelineTask to declare expressions to be evaluated before the Task is run + to determine whether the Task should be executed or skipped + type: object + properties: + cel: + description: |- + CEL is a string of Common Language Expression, which can be used to conditionally execute + the task based on the result of the expression evaluation + More info about CEL syntax: https://github.com/google/cel-spec/blob/master/doc/langdef.md + type: string + input: + description: Input is the string for guard checking + which can be a static input or an output from a parent + Task + type: string + operator: + description: Operator that represents an Input's relationship + to the values + type: string + values: + description: |- + Values is an array of strings, which is compared against the input, for guard checking + It must be non-empty + type: array + items: + type: string + x-kubernetes-list-type: atomic + workspaces: + description: |- + Workspaces maps workspaces from the pipeline spec to the workspaces + declared in the Task. + type: array + items: + description: |- + WorkspacePipelineTaskBinding describes how a workspace passed into the pipeline should be + mapped to a task's declared workspace. + type: object + required: + - name + properties: + name: + description: Name is the name of the workspace as declared + by the task + type: string + subPath: + description: |- + SubPath is optionally a directory on the volume which should be used + for this binding (i.e. the volume will be mounted at this sub directory). + type: string + workspace: + description: Workspace is the name of the workspace + declared by the pipeline + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + params: + description: |- + Params declares a list of input parameters that must be supplied when + this Pipeline is run. + type: array + items: + description: |- + ParamSpec defines arbitrary parameters needed beyond typed inputs (such as + resources). Parameter values are provided by users as inputs on a TaskRun + or PipelineRun. + type: object + required: + - name + properties: + default: + description: |- + Default is the value a parameter takes if no input value is supplied. If + default is set, a Task may be executed without a supplied value for the + parameter. + x-kubernetes-preserve-unknown-fields: true + description: + description: |- + Description is a user-facing description of the parameter that may be + used to populate a UI. + type: string + enum: + description: |- + Enum declares a set of allowed param input values for tasks/pipelines that can be validated. + If Enum is not set, no input validation is performed for the param. + type: array + items: + type: string + name: + description: Name declares the name by which a parameter is + referenced. + type: string + properties: + description: Properties is the JSON Schema properties to support + key-value pairs parameter. + type: object + additionalProperties: + description: PropertySpec defines the struct for object + keys + type: object + properties: + type: + description: |- + ParamType indicates the type of an input parameter; + Used to distinguish between a single string and an array of strings. + type: string + type: + description: |- + Type is the user-specified type of the parameter. The possible types + are currently "string", "array" and "object", and "string" is the default. + type: string + x-kubernetes-list-type: atomic + results: + description: Results are values that this pipeline can output once + run + type: array + items: + description: PipelineResult used to describe the results of a + pipeline + type: object + required: + - name + - value + properties: + description: + description: Description is a human-readable description of + the result + type: string + name: + description: Name the given name + type: string + type: + description: |- + Type is the user-specified type of the result. + The possible types are 'string', 'array', and 'object', with 'string' as the default. + 'array' and 'object' types are alpha features. + type: string + value: + description: Value the expression used to retrieve the value + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + tasks: + description: Tasks declares the graph of Tasks that execute when + this Pipeline is run. + type: array + items: + description: |- + PipelineTask defines a task in a Pipeline, passing inputs from both + Params and from the output of previous tasks. + type: object + properties: + description: + description: |- + Description is the description of this task within the context of a Pipeline. + This description may be used to populate a UI. + type: string + displayName: + description: |- + DisplayName is the display name of this task within the context of a Pipeline. + This display name may be used to populate a UI. + type: string + matrix: + description: Matrix declares parameters used to fan out this + task. + type: object + properties: + include: + description: Include is a list of IncludeParams which + allows passing in specific combinations of Parameters + into the Matrix. + type: array + items: + description: IncludeParams allows passing in a specific + combinations of Parameters into the Matrix. + type: object + properties: + name: + description: Name the specified combination + type: string + params: + description: |- + Params takes only `Parameters` of type `"string"` + The names of the `params` must match the names of the `params` in the underlying `Task` + type: array + items: + description: Param declares an ParamValues to + use for the parameter called name. + type: object + required: + - name + - value + properties: + name: + type: string + value: + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + params: + description: |- + Params is a list of parameters used to fan out the pipelineTask + Params takes only `Parameters` of type `"array"` + Each array element is supplied to the `PipelineTask` by substituting `params` of type `"string"` in the underlying `Task`. + The names of the `params` in the `Matrix` must match the names of the `params` in the underlying `Task` that they will be substituting. + type: array + items: + description: Param declares an ParamValues to use for + the parameter called name. + type: object + required: + - name + - value + properties: + name: + type: string + value: + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + name: + description: |- + Name is the name of this task within the context of a Pipeline. Name is + used as a coordinate with the `from` and `runAfter` fields to establish + the execution order of tasks relative to one another. + type: string + onError: + description: |- + OnError defines the exiting behavior of a PipelineRun on error + can be set to [ continue | stopAndFail ] + type: string + params: + description: Parameters declares parameters passed to this + task. + type: array + items: + description: Param declares an ParamValues to use for the + parameter called name. + type: object + required: + - name + - value + properties: + name: + type: string + value: + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + pipelineRef: + description: |- + PipelineRef is a reference to a pipeline definition. + This is an alpha field. You must set the "enable-api-fields" feature flag + to "alpha" for this field to be supported. When enabled, the referenced + Pipeline is executed as a child PipelineRun owned by the parent PipelineRun. + type: object + properties: + apiVersion: + description: API version of the referent + type: string + name: + description: 'Name of the referent; More info: http://kubernetes.io/docs/user-guide/identifiers#names' + type: string + params: + description: |- + Params contains the parameters used to identify the + referenced Tekton resource. Example entries might include + "repo" or "path" but the set of params ultimately depends on + the chosen resolver. + type: array + items: + description: Param declares an ParamValues to use for + the parameter called name. + type: object + required: + - name + - value + properties: + name: + type: string + value: + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + resolver: + description: |- + Resolver is the name of the resolver that should perform + resolution of the referenced Tekton resource, such as "git". + type: string + pipelineSpec: + description: |- + PipelineSpec is a specification of a pipeline. + This is an alpha field. You must set the "enable-api-fields" feature flag + to "alpha" for this field to be supported. When enabled, the embedded + Pipeline is executed as a child PipelineRun owned by the parent PipelineRun. + Specifying PipelineSpec can be disabled by setting + `disable-inline-spec` feature flag. + See Pipeline.spec (API version: tekton.dev/v1) + x-kubernetes-preserve-unknown-fields: true + retries: + description: 'Retries represents how many times this task + should be retried in case of task failure: ConditionSucceeded + set to False' + type: integer + runAfter: + description: |- + RunAfter is the list of PipelineTask names that should be executed before + this Task executes. (Used to force a specific ordering in graph execution.) + type: array + items: + type: string + x-kubernetes-list-type: atomic + taskRef: + description: TaskRef is a reference to a task definition. + type: object + properties: + apiVersion: + description: |- + API version of the referent + Note: A Task with non-empty APIVersion and Kind is considered a Custom Task + type: string + kind: + description: |- + TaskKind indicates the Kind of the Task: + 1. Namespaced Task when Kind is set to "Task". If Kind is "", it defaults to "Task". + 2. Custom Task when Kind is non-empty and APIVersion is non-empty + type: string + name: + description: 'Name of the referent; More info: http://kubernetes.io/docs/user-guide/identifiers#names' + type: string + params: + description: |- + Params contains the parameters used to identify the + referenced Tekton resource. Example entries might include + "repo" or "path" but the set of params ultimately depends on + the chosen resolver. + type: array + items: + description: Param declares an ParamValues to use for + the parameter called name. + type: object + required: + - name + - value + properties: + name: + type: string + value: + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + resolver: + description: |- + Resolver is the name of the resolver that should perform + resolution of the referenced Tekton resource, such as "git". + type: string + taskSpec: + description: |- + TaskSpec is a specification of a task + Specifying TaskSpec can be disabled by setting + `disable-inline-spec` feature flag. + See Task.spec (API version: tekton.dev/v1) + x-kubernetes-preserve-unknown-fields: true + timeout: + description: |- + Duration after which the TaskRun times out. Defaults to 1 hour. + Refer Go's ParseDuration documentation for expected format: https://golang.org/pkg/time/#ParseDuration + type: string + when: + description: When is a list of when expressions that need + to be true for the task to run + type: array + items: + description: |- + WhenExpression allows a PipelineTask to declare expressions to be evaluated before the Task is run + to determine whether the Task should be executed or skipped + type: object + properties: + cel: + description: |- + CEL is a string of Common Language Expression, which can be used to conditionally execute + the task based on the result of the expression evaluation + More info about CEL syntax: https://github.com/google/cel-spec/blob/master/doc/langdef.md + type: string + input: + description: Input is the string for guard checking + which can be a static input or an output from a parent + Task + type: string + operator: + description: Operator that represents an Input's relationship + to the values + type: string + values: + description: |- + Values is an array of strings, which is compared against the input, for guard checking + It must be non-empty + type: array + items: + type: string + x-kubernetes-list-type: atomic + workspaces: + description: |- + Workspaces maps workspaces from the pipeline spec to the workspaces + declared in the Task. + type: array + items: + description: |- + WorkspacePipelineTaskBinding describes how a workspace passed into the pipeline should be + mapped to a task's declared workspace. + type: object + required: + - name + properties: + name: + description: Name is the name of the workspace as declared + by the task + type: string + subPath: + description: |- + SubPath is optionally a directory on the volume which should be used + for this binding (i.e. the volume will be mounted at this sub directory). + type: string + workspace: + description: Workspace is the name of the workspace + declared by the pipeline + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + workspaces: + description: |- + Workspaces declares a set of named workspaces that are expected to be + provided by a PipelineRun. + type: array + items: + description: |- + PipelineWorkspaceDeclaration creates a named slot in a Pipeline that a PipelineRun + is expected to populate with a workspace binding. + type: object + required: + - name + properties: + description: + description: |- + Description is a human readable string describing how the workspace will be + used in the Pipeline. It can be useful to include a bit of detail about which + tasks are intended to have access to the data on the workspace. + type: string + name: + description: Name is the name of a workspace to be provided + by a PipelineRun. + type: string + optional: + description: |- + Optional marks a Workspace as not being required in PipelineRuns. By default + this field is false and so declared workspaces are required. + type: boolean + x-kubernetes-list-type: atomic + # Opt into the status subresource so metadata.generation + # starts to increment + subresources: + status: {} + names: + kind: Pipeline + plural: pipelines + singular: pipeline + categories: + - tekton + - tekton-pipelines + scope: Namespaced + conversion: + strategy: Webhook + webhook: + conversionReviewVersions: ["v1beta1", "v1"] + clientConfig: + service: + name: tekton-pipelines-webhook + namespace: tekton-pipelines +--- +# Copyright 2019 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: pipelineruns.tekton.dev + labels: + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines + pipeline.tekton.dev/release: "v1.15.0" + version: "v1.15.0" +spec: + group: tekton.dev + preserveUnknownFields: false + versions: + - name: v1beta1 + served: true + storage: false + schema: + openAPIV3Schema: + description: |- + PipelineRun + Deprecated: Please use v1.PipelineRun instead. + type: object + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: Spec + type: object + properties: + managedBy: + description: ManagedBy + type: string + params: + description: Params + type: array + items: + description: Param + type: object + required: + - name + - value + properties: + name: + type: string + value: + description: Value + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + pipelineRef: + description: PipelineRef + type: object + properties: + apiVersion: + description: APIVersion + type: string + bundle: + description: |- + Deprecated: Please use ResolverRef with the bundles resolver instead. + Bundle + type: string + name: + description: Name + type: string + params: + description: Params + type: array + items: + description: Param + type: object + required: + - name + - value + properties: + name: + type: string + value: + description: Value + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + resolver: + description: Resolver + type: string + pipelineSpec: + description: PipelineSpec + x-kubernetes-preserve-unknown-fields: true + podTemplate: + description: PodTemplate + type: object + properties: + affinity: + description: |- + If specified, the pod's scheduling constraints. + See Pod.spec.affinity (API version: v1) + x-kubernetes-preserve-unknown-fields: true + automountServiceAccountToken: + description: |- + AutomountServiceAccountToken indicates whether pods running as this + service account should have an API token automatically mounted. + type: boolean + dnsConfig: + description: |- + Specifies the DNS parameters of a pod. + Parameters specified here will be merged to the generated DNS + configuration based on DNSPolicy. + type: object + properties: + nameservers: + description: |- + A list of DNS name server IP addresses. + This will be appended to the base nameservers generated from DNSPolicy. + Duplicated nameservers will be removed. + type: array + items: + type: string + x-kubernetes-list-type: atomic + options: + description: |- + A list of DNS resolver options. + This will be merged with the base options generated from DNSPolicy. + Duplicated entries will be removed. Resolution options given in Options + will override those that appear in the base DNSPolicy. + type: array + items: + description: PodDNSConfigOption defines DNS resolver options + of a pod. + type: object + properties: + name: + description: |- + Name is this DNS resolver option's name. + Required. + type: string + value: + description: Value is this DNS resolver option's value. + type: string + x-kubernetes-list-type: atomic + searches: + description: |- + A list of DNS search domains for host-name lookup. + This will be appended to the base search paths generated from DNSPolicy. + Duplicated search paths will be removed. + type: array + items: + type: string + x-kubernetes-list-type: atomic + dnsPolicy: + description: |- + Set DNS policy for the pod. Defaults to "ClusterFirst". Valid values are + 'ClusterFirst', 'Default' or 'None'. DNS parameters given in DNSConfig + will be merged with the policy selected with DNSPolicy. + type: string + enableServiceLinks: + description: |- + EnableServiceLinks indicates whether information about services should be injected into pod's + environment variables, matching the syntax of Docker links. + Optional: Defaults to true. + type: boolean + env: + description: List of environment variables that can be provided + to the containers belonging to the pod. + type: array + items: + description: EnvVar represents an environment variable present + in a Container. + type: object + required: + - name + properties: + name: + description: |- + Name of the environment variable. + May consist of any printable ASCII characters except '='. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's value. + Cannot be used if value is not empty. + type: object + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + type: object + required: + - key + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap or + its key must be defined + type: boolean + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + type: object + required: + - fieldPath + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in the + specified API version. + type: string + x-kubernetes-map-type: atomic + fileKeyRef: + description: |- + FileKeyRef selects a key of the env file. + Requires the EnvFiles feature gate to be enabled. + type: object + required: + - key + - path + - volumeName + properties: + key: + description: |- + The key within the env file. An invalid key will prevent the pod from starting. + The keys defined within a source may consist of any printable ASCII characters except '='. + During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters. + type: string + optional: + description: |- + Specify whether the file or its key must be defined. If the file or key + does not exist, then the env var is not published. + If optional is set to true and the specified key does not exist, + the environment variable will not be set in the Pod's containers. + + If optional is set to false and the specified key does not exist, + an error will be returned during Pod creation. + type: boolean + default: false + path: + description: |- + The path within the volume from which to select the file. + Must be relative and may not contain the '..' path or start with '..'. + type: string + volumeName: + description: The name of the volume mount containing + the env file. + type: string + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + type: object + required: + - resource + properties: + containerName: + description: 'Container name: required for volumes, + optional for env vars' + type: string + divisor: + description: Specifies the output format of the + exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the pod's + namespace + type: object + required: + - key + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret or its + key must be defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + hostAliases: + description: |- + HostAliases is an optional list of hosts and IPs that will be injected into the pod's hosts + file if specified. This is only valid for non-hostNetwork pods. + type: array + items: + description: |- + HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the + pod's hosts file. + type: object + required: + - ip + properties: + hostnames: + description: Hostnames for the above IP address. + type: array + items: + type: string + x-kubernetes-list-type: atomic + ip: + description: IP address of the host file entry. + type: string + x-kubernetes-list-type: atomic + hostNetwork: + description: HostNetwork specifies whether the pod may use the + node network namespace + type: boolean + hostUsers: + description: |- + HostUsers indicates whether the pod will use the host's user namespace. + Optional: Default to true. + If set to true or not present, the pod will be run in the host user namespace, useful + for when the pod needs a feature only available to the host user namespace, such as + loading a kernel module with CAP_SYS_MODULE. + When set to false, a new user namespace is created for the pod. Setting false + is useful to mitigating container breakout vulnerabilities such as allowing + containers to run as root without their user having root privileges on the host. + This field depends on the kubernetes feature gate UserNamespacesSupport being enabled. + type: boolean + imagePullSecrets: + description: ImagePullSecrets gives the name of the secret used + by the pod to pull the image if specified + type: array + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + nodeSelector: + description: |- + NodeSelector is a selector which must be true for the pod to fit on a node. + Selector which must match a node's labels for the pod to be scheduled on that node. + More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ + type: object + additionalProperties: + type: string + priorityClassName: + description: |- + If specified, indicates the pod's priority. "system-node-critical" and + "system-cluster-critical" are two special keywords which indicate the + highest priorities with the former being the highest priority. Any other + name must be defined by creating a PriorityClass object with that name. + If not specified, the pod priority will be default or zero if there is no + default. + type: string + runtimeClassName: + description: |- + RuntimeClassName refers to a RuntimeClass object in the node.k8s.io + group, which should be used to run this pod. If no RuntimeClass resource + matches the named class, the pod will not be run. If unset or empty, the + "legacy" RuntimeClass will be used, which is an implicit class with an + empty definition that uses the default runtime handler. + More info: https://git.k8s.io/enhancements/keps/sig-node/runtime-class.md + This is a beta feature as of Kubernetes v1.14. + type: string + schedulerName: + description: SchedulerName specifies the scheduler to be used + to dispatch the Pod + type: string + securityContext: + description: |- + SecurityContext holds pod-level security attributes and common container settings. + Optional: Defaults to empty. See type description for default values of each field. + See Pod.spec.securityContext (API version: v1) + x-kubernetes-preserve-unknown-fields: true + tolerations: + description: If specified, the pod's tolerations. + type: array + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + type: object + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + type: integer + format: int64 + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + x-kubernetes-list-type: atomic + topologySpreadConstraints: + description: |- + TopologySpreadConstraints controls how Pods are spread across your cluster among + failure-domains such as regions, zones, nodes, and other user-defined topology domains. + type: array + items: + description: TopologySpreadConstraint specifies how to spread + matching pods among the given topology. + type: object + required: + - maxSkew + - topologyKey + - whenUnsatisfiable + properties: + labelSelector: + description: |- + LabelSelector is used to find matching pods. + Pods that match this label selector are counted to determine the number of pods + in their corresponding topology domain. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select the pods over which + spreading will be calculated. The keys are used to lookup values from the + incoming pod labels, those key-value labels are ANDed with labelSelector + to select the group of existing pods over which spreading will be calculated + for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + MatchLabelKeys cannot be set when LabelSelector isn't set. + Keys that don't exist in the incoming pod labels will + be ignored. A null or empty list means only match against labelSelector. + + This is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default). + type: array + items: + type: string + x-kubernetes-list-type: atomic + maxSkew: + description: |- + MaxSkew describes the degree to which pods may be unevenly distributed. + When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference + between the number of matching pods in the target topology and the global minimum. + The global minimum is the minimum number of matching pods in an eligible domain + or zero if the number of eligible domains is less than MinDomains. + For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same + labelSelector spread as 2/2/1: + In this case, the global minimum is 1. + | zone1 | zone2 | zone3 | + | P P | P P | P | + - if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2; + scheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2) + violate MaxSkew(1). + - if MaxSkew is 2, incoming pod can be scheduled onto any zone. + When `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence + to topologies that satisfy it. + It's a required field. Default value is 1 and 0 is not allowed. + type: integer + format: int32 + minDomains: + description: |- + MinDomains indicates a minimum number of eligible domains. + When the number of eligible domains with matching topology keys is less than minDomains, + Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed. + And when the number of eligible domains with matching topology keys equals or greater than minDomains, + this value has no effect on scheduling. + As a result, when the number of eligible domains is less than minDomains, + scheduler won't schedule more than maxSkew Pods to those domains. + If value is nil, the constraint behaves as if MinDomains is equal to 1. + Valid values are integers greater than 0. + When value is not nil, WhenUnsatisfiable must be DoNotSchedule. + + For example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same + labelSelector spread as 2/2/2: + | zone1 | zone2 | zone3 | + | P P | P P | P P | + The number of domains is less than 5(MinDomains), so "global minimum" is treated as 0. + In this situation, new pod with the same labelSelector cannot be scheduled, + because computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones, + it will violate MaxSkew. + type: integer + format: int32 + nodeAffinityPolicy: + description: |- + NodeAffinityPolicy indicates how we will treat Pod's nodeAffinity/nodeSelector + when calculating pod topology spread skew. Options are: + - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations. + - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations. + + If this value is nil, the behavior is equivalent to the Honor policy. + type: string + nodeTaintsPolicy: + description: |- + NodeTaintsPolicy indicates how we will treat node taints when calculating + pod topology spread skew. Options are: + - Honor: nodes without taints, along with tainted nodes for which the incoming pod + has a toleration, are included. + - Ignore: node taints are ignored. All nodes are included. + + If this value is nil, the behavior is equivalent to the Ignore policy. + type: string + topologyKey: + description: |- + TopologyKey is the key of node labels. Nodes that have a label with this key + and identical values are considered to be in the same topology. + We consider each as a "bucket", and try to put balanced number + of pods into each bucket. + We define a domain as a particular instance of a topology. + Also, we define an eligible domain as a domain whose nodes meet the requirements of + nodeAffinityPolicy and nodeTaintsPolicy. + e.g. If TopologyKey is "kubernetes.io/hostname", each Node is a domain of that topology. + And, if TopologyKey is "topology.kubernetes.io/zone", each zone is a domain of that topology. + It's a required field. + type: string + whenUnsatisfiable: + description: |- + WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy + the spread constraint. + - DoNotSchedule (default) tells the scheduler not to schedule it. + - ScheduleAnyway tells the scheduler to schedule the pod in any location, + but giving higher precedence to topologies that would help reduce the + skew. + A constraint is considered "Unsatisfiable" for an incoming pod + if and only if every possible node assignment for that pod would violate + "MaxSkew" on some topology. + For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same + labelSelector spread as 3/1/1: + | zone1 | zone2 | zone3 | + | P P P | P | P | + If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled + to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies + MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler + won't make it *more* imbalanced. + It's a required field. + type: string + x-kubernetes-list-type: atomic + volumes: + description: |- + List of volumes that can be mounted by containers belonging to the pod. + More info: https://kubernetes.io/docs/concepts/storage/volumes + See Pod.spec.volumes (API version: v1) + x-kubernetes-preserve-unknown-fields: true + resources: + description: |- + Resources + Deprecated: Unused, preserved only for backwards compatibility + type: array + items: + description: |- + PipelineResourceBinding + Deprecated: Unused, preserved only for backwards compatibility + type: object + properties: + name: + description: Name + type: string + resourceRef: + description: ResourceRef + type: object + properties: + apiVersion: + description: APIVersion + type: string + name: + description: Name + type: string + resourceSpec: + description: ResourceSpec + type: object + required: + - params + - type + properties: + description: + description: |- + Description is a user-facing description of the resource that may be + used to populate a UI. + type: string + params: + type: array + items: + description: |- + ResourceParam declares a string value to use for the parameter called Name, and is used in + the specific context of PipelineResources. + + Deprecated: Unused, preserved only for backwards compatibility + type: object + required: + - name + - value + properties: + name: + type: string + value: + type: string + x-kubernetes-list-type: atomic + secrets: + description: Secrets to fetch to populate some of resource + fields + type: array + items: + description: |- + SecretParam indicates which secret can be used to populate a field of the resource + + Deprecated: Unused, preserved only for backwards compatibility + type: object + required: + - fieldName + - secretKey + - secretName + properties: + fieldName: + type: string + secretKey: + type: string + secretName: + type: string + x-kubernetes-list-type: atomic + type: + description: |- + PipelineResourceType represents the type of endpoint the pipelineResource is, so that the + controller will know this pipelineResource shouldx be fetched and optionally what + additional metatdata should be provided for it. + + Deprecated: Unused, preserved only for backwards compatibility + type: string + x-kubernetes-list-type: atomic + serviceAccountName: + description: ServiceAccountName + type: string + status: + description: Status + type: string + taskRunSpecs: + description: TaskRunSpecs + type: array + items: + description: PipelineTaskRunSpec + type: object + properties: + computeResources: + description: ComputeResources + type: object + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This field depends on the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + type: array + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + type: object + required: + - name + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + requests: + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + metadata: + description: Metadata + type: object + properties: + annotations: + description: Annotations + type: object + additionalProperties: + type: string + labels: + description: Labels + type: object + additionalProperties: + type: string + pipelineTaskName: + type: string + sidecarOverrides: + description: SidecarOverrides + type: array + items: + description: TaskRunSidecarOverride + type: object + required: + - name + - resources + properties: + name: + description: Name + type: string + resources: + description: Resources + type: object + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This field depends on the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + type: array + items: + description: ResourceClaim references one entry + in PodSpec.ResourceClaims. + type: object + required: + - name + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + requests: + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + x-kubernetes-list-type: atomic + stepOverrides: + description: StepOverrides + type: array + items: + description: TaskRunStepOverride + type: object + required: + - name + - resources + properties: + name: + description: Name + type: string + resources: + description: Resources + type: object + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This field depends on the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + type: array + items: + description: ResourceClaim references one entry + in PodSpec.ResourceClaims. + type: object + required: + - name + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + requests: + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + x-kubernetes-list-type: atomic + taskPodTemplate: + description: PodTemplate holds pod specific configuration + type: object + properties: + affinity: + description: |- + If specified, the pod's scheduling constraints. + See Pod.spec.affinity (API version: v1) + x-kubernetes-preserve-unknown-fields: true + automountServiceAccountToken: + description: |- + AutomountServiceAccountToken indicates whether pods running as this + service account should have an API token automatically mounted. + type: boolean + dnsConfig: + description: |- + Specifies the DNS parameters of a pod. + Parameters specified here will be merged to the generated DNS + configuration based on DNSPolicy. + type: object + properties: + nameservers: + description: |- + A list of DNS name server IP addresses. + This will be appended to the base nameservers generated from DNSPolicy. + Duplicated nameservers will be removed. + type: array + items: + type: string + x-kubernetes-list-type: atomic + options: + description: |- + A list of DNS resolver options. + This will be merged with the base options generated from DNSPolicy. + Duplicated entries will be removed. Resolution options given in Options + will override those that appear in the base DNSPolicy. + type: array + items: + description: PodDNSConfigOption defines DNS resolver + options of a pod. + type: object + properties: + name: + description: |- + Name is this DNS resolver option's name. + Required. + type: string + value: + description: Value is this DNS resolver option's + value. + type: string + x-kubernetes-list-type: atomic + searches: + description: |- + A list of DNS search domains for host-name lookup. + This will be appended to the base search paths generated from DNSPolicy. + Duplicated search paths will be removed. + type: array + items: + type: string + x-kubernetes-list-type: atomic + dnsPolicy: + description: |- + Set DNS policy for the pod. Defaults to "ClusterFirst". Valid values are + 'ClusterFirst', 'Default' or 'None'. DNS parameters given in DNSConfig + will be merged with the policy selected with DNSPolicy. + type: string + enableServiceLinks: + description: |- + EnableServiceLinks indicates whether information about services should be injected into pod's + environment variables, matching the syntax of Docker links. + Optional: Defaults to true. + type: boolean + env: + description: List of environment variables that can be + provided to the containers belonging to the pod. + type: array + items: + description: EnvVar represents an environment variable + present in a Container. + type: object + required: + - name + properties: + name: + description: |- + Name of the environment variable. + May consist of any printable ASCII characters except '='. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's + value. Cannot be used if value is not empty. + type: object + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + type: object + required: + - key + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + type: object + required: + - fieldPath + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select + in the specified API version. + type: string + x-kubernetes-map-type: atomic + fileKeyRef: + description: |- + FileKeyRef selects a key of the env file. + Requires the EnvFiles feature gate to be enabled. + type: object + required: + - key + - path + - volumeName + properties: + key: + description: |- + The key within the env file. An invalid key will prevent the pod from starting. + The keys defined within a source may consist of any printable ASCII characters except '='. + During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters. + type: string + optional: + description: |- + Specify whether the file or its key must be defined. If the file or key + does not exist, then the env var is not published. + If optional is set to true and the specified key does not exist, + the environment variable will not be set in the Pod's containers. + + If optional is set to false and the specified key does not exist, + an error will be returned during Pod creation. + type: boolean + default: false + path: + description: |- + The path within the volume from which to select the file. + Must be relative and may not contain the '..' path or start with '..'. + type: string + volumeName: + description: The name of the volume mount + containing the env file. + type: string + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + type: object + required: + - resource + properties: + containerName: + description: 'Container name: required for + volumes, optional for env vars' + type: string + divisor: + description: Specifies the output format + of the exposed resources, defaults to + "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the + pod's namespace + type: object + required: + - key + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret + or its key must be defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + hostAliases: + description: |- + HostAliases is an optional list of hosts and IPs that will be injected into the pod's hosts + file if specified. This is only valid for non-hostNetwork pods. + type: array + items: + description: |- + HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the + pod's hosts file. + type: object + required: + - ip + properties: + hostnames: + description: Hostnames for the above IP address. + type: array + items: + type: string + x-kubernetes-list-type: atomic + ip: + description: IP address of the host file entry. + type: string + x-kubernetes-list-type: atomic + hostNetwork: + description: HostNetwork specifies whether the pod may + use the node network namespace + type: boolean + hostUsers: + description: |- + HostUsers indicates whether the pod will use the host's user namespace. + Optional: Default to true. + If set to true or not present, the pod will be run in the host user namespace, useful + for when the pod needs a feature only available to the host user namespace, such as + loading a kernel module with CAP_SYS_MODULE. + When set to false, a new user namespace is created for the pod. Setting false + is useful to mitigating container breakout vulnerabilities such as allowing + containers to run as root without their user having root privileges on the host. + This field depends on the kubernetes feature gate UserNamespacesSupport being enabled. + type: boolean + imagePullSecrets: + description: ImagePullSecrets gives the name of the secret + used by the pod to pull the image if specified + type: array + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + nodeSelector: + description: |- + NodeSelector is a selector which must be true for the pod to fit on a node. + Selector which must match a node's labels for the pod to be scheduled on that node. + More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ + type: object + additionalProperties: + type: string + priorityClassName: + description: |- + If specified, indicates the pod's priority. "system-node-critical" and + "system-cluster-critical" are two special keywords which indicate the + highest priorities with the former being the highest priority. Any other + name must be defined by creating a PriorityClass object with that name. + If not specified, the pod priority will be default or zero if there is no + default. + type: string + runtimeClassName: + description: |- + RuntimeClassName refers to a RuntimeClass object in the node.k8s.io + group, which should be used to run this pod. If no RuntimeClass resource + matches the named class, the pod will not be run. If unset or empty, the + "legacy" RuntimeClass will be used, which is an implicit class with an + empty definition that uses the default runtime handler. + More info: https://git.k8s.io/enhancements/keps/sig-node/runtime-class.md + This is a beta feature as of Kubernetes v1.14. + type: string + schedulerName: + description: SchedulerName specifies the scheduler to + be used to dispatch the Pod + type: string + securityContext: + description: |- + SecurityContext holds pod-level security attributes and common container settings. + Optional: Defaults to empty. See type description for default values of each field. + See Pod.spec.securityContext (API version: v1) + x-kubernetes-preserve-unknown-fields: true + tolerations: + description: If specified, the pod's tolerations. + type: array + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + type: object + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + type: integer + format: int64 + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + x-kubernetes-list-type: atomic + topologySpreadConstraints: + description: |- + TopologySpreadConstraints controls how Pods are spread across your cluster among + failure-domains such as regions, zones, nodes, and other user-defined topology domains. + type: array + items: + description: TopologySpreadConstraint specifies how + to spread matching pods among the given topology. + type: object + required: + - maxSkew + - topologyKey + - whenUnsatisfiable + properties: + labelSelector: + description: |- + LabelSelector is used to find matching pods. + Pods that match this label selector are counted to determine the number of pods + in their corresponding topology domain. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select the pods over which + spreading will be calculated. The keys are used to lookup values from the + incoming pod labels, those key-value labels are ANDed with labelSelector + to select the group of existing pods over which spreading will be calculated + for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + MatchLabelKeys cannot be set when LabelSelector isn't set. + Keys that don't exist in the incoming pod labels will + be ignored. A null or empty list means only match against labelSelector. + + This is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default). + type: array + items: + type: string + x-kubernetes-list-type: atomic + maxSkew: + description: |- + MaxSkew describes the degree to which pods may be unevenly distributed. + When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference + between the number of matching pods in the target topology and the global minimum. + The global minimum is the minimum number of matching pods in an eligible domain + or zero if the number of eligible domains is less than MinDomains. + For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same + labelSelector spread as 2/2/1: + In this case, the global minimum is 1. + | zone1 | zone2 | zone3 | + | P P | P P | P | + - if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2; + scheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2) + violate MaxSkew(1). + - if MaxSkew is 2, incoming pod can be scheduled onto any zone. + When `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence + to topologies that satisfy it. + It's a required field. Default value is 1 and 0 is not allowed. + type: integer + format: int32 + minDomains: + description: |- + MinDomains indicates a minimum number of eligible domains. + When the number of eligible domains with matching topology keys is less than minDomains, + Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed. + And when the number of eligible domains with matching topology keys equals or greater than minDomains, + this value has no effect on scheduling. + As a result, when the number of eligible domains is less than minDomains, + scheduler won't schedule more than maxSkew Pods to those domains. + If value is nil, the constraint behaves as if MinDomains is equal to 1. + Valid values are integers greater than 0. + When value is not nil, WhenUnsatisfiable must be DoNotSchedule. + + For example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same + labelSelector spread as 2/2/2: + | zone1 | zone2 | zone3 | + | P P | P P | P P | + The number of domains is less than 5(MinDomains), so "global minimum" is treated as 0. + In this situation, new pod with the same labelSelector cannot be scheduled, + because computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones, + it will violate MaxSkew. + type: integer + format: int32 + nodeAffinityPolicy: + description: |- + NodeAffinityPolicy indicates how we will treat Pod's nodeAffinity/nodeSelector + when calculating pod topology spread skew. Options are: + - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations. + - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations. + + If this value is nil, the behavior is equivalent to the Honor policy. + type: string + nodeTaintsPolicy: + description: |- + NodeTaintsPolicy indicates how we will treat node taints when calculating + pod topology spread skew. Options are: + - Honor: nodes without taints, along with tainted nodes for which the incoming pod + has a toleration, are included. + - Ignore: node taints are ignored. All nodes are included. + + If this value is nil, the behavior is equivalent to the Ignore policy. + type: string + topologyKey: + description: |- + TopologyKey is the key of node labels. Nodes that have a label with this key + and identical values are considered to be in the same topology. + We consider each as a "bucket", and try to put balanced number + of pods into each bucket. + We define a domain as a particular instance of a topology. + Also, we define an eligible domain as a domain whose nodes meet the requirements of + nodeAffinityPolicy and nodeTaintsPolicy. + e.g. If TopologyKey is "kubernetes.io/hostname", each Node is a domain of that topology. + And, if TopologyKey is "topology.kubernetes.io/zone", each zone is a domain of that topology. + It's a required field. + type: string + whenUnsatisfiable: + description: |- + WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy + the spread constraint. + - DoNotSchedule (default) tells the scheduler not to schedule it. + - ScheduleAnyway tells the scheduler to schedule the pod in any location, + but giving higher precedence to topologies that would help reduce the + skew. + A constraint is considered "Unsatisfiable" for an incoming pod + if and only if every possible node assignment for that pod would violate + "MaxSkew" on some topology. + For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same + labelSelector spread as 3/1/1: + | zone1 | zone2 | zone3 | + | P P P | P | P | + If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled + to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies + MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler + won't make it *more* imbalanced. + It's a required field. + type: string + x-kubernetes-list-type: atomic + volumes: + description: |- + List of volumes that can be mounted by containers belonging to the pod. + More info: https://kubernetes.io/docs/concepts/storage/volumes + See Pod.spec.volumes (API version: v1) + x-kubernetes-preserve-unknown-fields: true + taskServiceAccountName: + type: string + timeout: + description: Timeout + type: string + x-kubernetes-list-type: atomic + timeout: + description: |- + Deprecated: use pipelineRunSpec.Timeouts.Pipeline instead + Timeout + type: string + timeouts: + description: Timeouts + type: object + properties: + finally: + description: Finally + type: string + pipeline: + description: Pipeline + type: string + tasks: + description: Tasks + type: string + workspaces: + description: Workspaces + type: array + items: + description: WorkspaceBinding + type: object + required: + - name + properties: + configMap: + description: ConfigMap + type: object + properties: + defaultMode: + description: |- + defaultMode is optional: mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + Defaults to 0644. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + ConfigMap will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the ConfigMap, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: optional specify whether the ConfigMap or + its keys must be defined + type: boolean + x-kubernetes-map-type: atomic + csi: + description: CSI + type: object + required: + - driver + properties: + driver: + description: |- + driver is the name of the CSI driver that handles this volume. + Consult with your admin for the correct name as registered in the cluster. + type: string + fsType: + description: |- + fsType to mount. Ex. "ext4", "xfs", "ntfs". + If not provided, the empty value is passed to the associated CSI driver + which will determine the default filesystem to apply. + type: string + nodePublishSecretRef: + description: |- + nodePublishSecretRef is a reference to the secret object containing + sensitive information to pass to the CSI driver to complete the CSI + NodePublishVolume and NodeUnpublishVolume calls. + This field is optional, and may be empty if no secret is required. If the + secret object contains more than one secret, all secret references are passed. + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + x-kubernetes-map-type: atomic + readOnly: + description: |- + readOnly specifies a read-only configuration for the volume. + Defaults to false (read/write). + type: boolean + volumeAttributes: + description: |- + volumeAttributes stores driver-specific properties that are passed to the CSI + driver. Consult your driver's documentation for supported values. + type: object + additionalProperties: + type: string + emptyDir: + description: EmptyDir + type: object + properties: + medium: + description: |- + medium represents what type of storage medium should back this directory. + The default is "" which means to use the node's default medium. + Must be an empty string (default) or Memory. + More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir + type: string + sizeLimit: + description: |- + sizeLimit is the total amount of local storage required for this EmptyDir volume. + The size limit is also applicable for memory medium. + The maximum usage on memory medium EmptyDir would be the minimum value between + the SizeLimit specified here and the sum of memory limits of all containers in a pod. + The default is nil which means that the limit is undefined. + More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + name: + description: Name + type: string + persistentVolumeClaim: + description: PersistentVolumeClaim + type: object + required: + - claimName + properties: + claimName: + description: |- + claimName is the name of a PersistentVolumeClaim in the same namespace as the pod using this volume. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims + type: string + readOnly: + description: |- + readOnly Will force the ReadOnly setting in VolumeMounts. + Default false. + type: boolean + projected: + description: Projected + type: object + properties: + defaultMode: + description: |- + defaultMode are the mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + sources: + description: |- + sources is the list of volume projections. Each entry in this list + handles one source. + type: array + items: + description: |- + Projection that may be projected along with other supported volume types. + Exactly one of these fields must be set. + type: object + properties: + clusterTrustBundle: + description: |- + ClusterTrustBundle allows a pod to access the `.spec.trustBundle` field + of ClusterTrustBundle objects in an auto-updating file. + + Alpha, gated by the ClusterTrustBundleProjection feature gate. + + ClusterTrustBundle objects can either be selected by name, or by the + combination of signer name and a label selector. + + Kubelet performs aggressive normalization of the PEM contents written + into the pod filesystem. Esoteric PEM features such as inter-block + comments and block headers are stripped. Certificates are deduplicated. + The ordering of certificates within the file is arbitrary, and Kubelet + may change the order over time. + type: object + required: + - path + properties: + labelSelector: + description: |- + Select all ClusterTrustBundles that match this label selector. Only has + effect if signerName is set. Mutually-exclusive with name. If unset, + interpreted as "match nothing". If set but empty, interpreted as "match + everything". + type: object + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + name: + description: |- + Select a single ClusterTrustBundle by object name. Mutually-exclusive + with signerName and labelSelector. + type: string + optional: + description: |- + If true, don't block pod startup if the referenced ClusterTrustBundle(s) + aren't available. If using name, then the named ClusterTrustBundle is + allowed not to exist. If using signerName, then the combination of + signerName and labelSelector is allowed to match zero + ClusterTrustBundles. + type: boolean + path: + description: Relative path from the volume root + to write the bundle. + type: string + signerName: + description: |- + Select all ClusterTrustBundles that match this signer name. + Mutually-exclusive with name. The contents of all selected + ClusterTrustBundles will be unified and deduplicated. + type: string + configMap: + description: configMap information about the configMap + data to project + type: object + properties: + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + ConfigMap will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the ConfigMap, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within + a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: optional specify whether the ConfigMap + or its keys must be defined + type: boolean + x-kubernetes-map-type: atomic + downwardAPI: + description: downwardAPI information about the downwardAPI + data to project + type: object + properties: + items: + description: Items is a list of DownwardAPIVolume + file + type: array + items: + description: DownwardAPIVolumeFile represents + information to create the file containing + the pod field + type: object + required: + - path + properties: + fieldRef: + description: 'Required: Selects a field + of the pod: only annotations, labels, + name, namespace and uid are supported.' + type: object + required: + - fieldPath + properties: + apiVersion: + description: Version of the schema + the FieldPath is written in terms + of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to + select in the specified API version. + type: string + x-kubernetes-map-type: atomic + mode: + description: |- + Optional: mode bits used to set permissions on this file, must be an octal value + between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: 'Required: Path is the relative + path name of the file to be created. + Must not be absolute or contain the + ''..'' path. Must be utf-8 encoded. + The first item of the relative path + must not start with ''..''' + type: string + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported. + type: object + required: + - resource + properties: + containerName: + description: 'Container name: required + for volumes, optional for env vars' + type: string + divisor: + description: Specifies the output + format of the exposed resources, + defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to + select' + type: string + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + podCertificate: + description: |- + Projects an auto-rotating credential bundle (private key and certificate + chain) that the pod can use either as a TLS client or server. + + Kubelet generates a private key and uses it to send a + PodCertificateRequest to the named signer. Once the signer approves the + request and issues a certificate chain, Kubelet writes the key and + certificate chain to the pod filesystem. The pod does not start until + certificates have been issued for each podCertificate projected volume + source in its spec. + + Kubelet will begin trying to rotate the certificate at the time indicated + by the signer using the PodCertificateRequest.Status.BeginRefreshAt + timestamp. + + Kubelet can write a single file, indicated by the credentialBundlePath + field, or separate files, indicated by the keyPath and + certificateChainPath fields. + + The credential bundle is a single file in PEM format. The first PEM + entry is the private key (in PKCS#8 format), and the remaining PEM + entries are the certificate chain issued by the signer (typically, + signers will return their certificate chain in leaf-to-root order). + + Prefer using the credential bundle format, since your application code + can read it atomically. If you use keyPath and certificateChainPath, + your application must make two separate file reads. If these coincide + with a certificate rotation, it is possible that the private key and leaf + certificate you read may not correspond to each other. Your application + will need to check for this condition, and re-read until they are + consistent. + + The named signer controls chooses the format of the certificate it + issues; consult the signer implementation's documentation to learn how to + use the certificates it issues. + type: object + required: + - keyType + - signerName + properties: + certificateChainPath: + description: |- + Write the certificate chain at this path in the projected volume. + + Most applications should use credentialBundlePath. When using keyPath + and certificateChainPath, your application needs to check that the key + and leaf certificate are consistent, because it is possible to read the + files mid-rotation. + type: string + credentialBundlePath: + description: |- + Write the credential bundle at this path in the projected volume. + + The credential bundle is a single file that contains multiple PEM blocks. + The first PEM block is a PRIVATE KEY block, containing a PKCS#8 private + key. + + The remaining blocks are CERTIFICATE blocks, containing the issued + certificate chain from the signer (leaf and any intermediates). + + Using credentialBundlePath lets your Pod's application code make a single + atomic read that retrieves a consistent key and certificate chain. If you + project them to separate files, your application code will need to + additionally check that the leaf certificate was issued to the key. + type: string + keyPath: + description: |- + Write the key at this path in the projected volume. + + Most applications should use credentialBundlePath. When using keyPath + and certificateChainPath, your application needs to check that the key + and leaf certificate are consistent, because it is possible to read the + files mid-rotation. + type: string + keyType: + description: |- + The type of keypair Kubelet will generate for the pod. + + Valid values are "RSA3072", "RSA4096", "ECDSAP256", "ECDSAP384", + "ECDSAP521", and "ED25519". + type: string + maxExpirationSeconds: + description: |- + maxExpirationSeconds is the maximum lifetime permitted for the + certificate. + + Kubelet copies this value verbatim into the PodCertificateRequests it + generates for this projection. + + If omitted, kube-apiserver will set it to 86400(24 hours). kube-apiserver + will reject values shorter than 3600 (1 hour). The maximum allowable + value is 7862400 (91 days). + + The signer implementation is then free to issue a certificate with any + lifetime *shorter* than MaxExpirationSeconds, but no shorter than 3600 + seconds (1 hour). This constraint is enforced by kube-apiserver. + `kubernetes.io` signers will never issue certificates with a lifetime + longer than 24 hours. + type: integer + format: int32 + signerName: + description: Kubelet's generated CSRs will be + addressed to this signer. + type: string + userAnnotations: + description: |- + userAnnotations allow pod authors to pass additional information to + the signer implementation. Kubernetes does not restrict or validate this + metadata in any way. + + These values are copied verbatim into the `spec.unverifiedUserAnnotations` field of + the PodCertificateRequest objects that Kubelet creates. + + Entries are subject to the same validation as object metadata annotations, + with the addition that all keys must be domain-prefixed. No restrictions + are placed on values, except an overall size limitation on the entire field. + + Signers should document the keys and values they support. Signers should + deny requests that contain keys they do not recognize. + type: object + additionalProperties: + type: string + secret: + description: secret information about the secret + data to project + type: object + properties: + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + Secret will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the Secret, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within + a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: optional field specify whether + the Secret or its key must be defined + type: boolean + x-kubernetes-map-type: atomic + serviceAccountToken: + description: serviceAccountToken is information + about the serviceAccountToken data to project + type: object + required: + - path + properties: + audience: + description: |- + audience is the intended audience of the token. A recipient of a token + must identify itself with an identifier specified in the audience of the + token, and otherwise should reject the token. The audience defaults to the + identifier of the apiserver. + type: string + expirationSeconds: + description: |- + expirationSeconds is the requested duration of validity of the service + account token. As the token approaches expiration, the kubelet volume + plugin will proactively rotate the service account token. The kubelet will + start trying to rotate the token if the token is older than 80 percent of + its time to live or if the token is older than 24 hours.Defaults to 1 hour + and must be at least 10 minutes. + type: integer + format: int64 + path: + description: |- + path is the path relative to the mount point of the file to project the + token into. + type: string + x-kubernetes-list-type: atomic + secret: + description: Secret + type: object + properties: + defaultMode: + description: |- + defaultMode is Optional: mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values + for mode bits. Defaults to 0644. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + items: + description: |- + items If unspecified, each key-value pair in the Data field of the referenced + Secret will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the Secret, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + optional: + description: optional field specify whether the Secret + or its keys must be defined + type: boolean + secretName: + description: |- + secretName is the name of the secret in the pod's namespace to use. + More info: https://kubernetes.io/docs/concepts/storage/volumes#secret + type: string + subPath: + description: SubPath + type: string + volumeClaimTemplate: + description: VolumeClaimTemplate + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + status: + description: Status + type: object + properties: + annotations: + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + additionalProperties: + type: string + childReferences: + description: ChildReferences + type: array + items: + description: ChildStatusReference + type: object + properties: + apiVersion: + type: string + displayName: + description: DisplayName + type: string + kind: + type: string + name: + description: Name + type: string + pipelineTaskName: + description: PipelineTaskName + type: string + whenExpressions: + description: WhenExpressions + type: array + items: + description: WhenExpression + type: object + properties: + cel: + description: CEL + type: string + input: + description: Input + type: string + operator: + description: Operator + type: string + values: + description: Values + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + completionTime: + description: CompletionTime + type: string + format: date-time + conditions: + description: Conditions the latest available observations of a resource's + current state. + type: array + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + type: object + required: + - status + - type + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating details about + the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, False, + Unknown. + type: string + type: + description: Type of condition. + type: string + finallyStartTime: + description: FinallyStartTime + type: string + format: date-time + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + type: integer + format: int64 + pipelineResults: + description: PipelineResults + type: array + items: + description: PipelineRunResult + type: object + required: + - name + - value + properties: + name: + description: Name + type: string + value: + description: Value + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + pipelineSpec: + description: PipelineSpec + x-kubernetes-preserve-unknown-fields: true + provenance: + description: Provenance + type: object + properties: + configSource: + description: |- + ConfigSource + Deprecated: Use RefSource instead + type: object + properties: + digest: + description: Digest + type: object + additionalProperties: + type: string + entryPoint: + description: EntryPoint + type: string + uri: + description: URI + type: string + featureFlags: + description: FeatureFlags + type: object + properties: + awaitSidecarReadiness: + type: boolean + coschedule: + type: string + disableCredsInit: + type: boolean + disableInlineSpec: + type: string + enableAPIFields: + type: string + enableArtifacts: + type: boolean + enableCELInWhenExpression: + type: boolean + enableConciseResolverSyntax: + type: boolean + enableKeepPodOnCancel: + type: boolean + enableKubernetesSidecar: + type: boolean + enableParamEnum: + type: boolean + enableProvenanceInStatus: + type: boolean + enableStepActions: + description: EnableStepActions is a no-op flag since StepActions + are stable + type: boolean + enableTektonOCIBundles: + description: |- + DeprecatedEnableTektonOCIBundles is maintained for backward compatibility + to allow deletion of PipelineRuns created before v0.62.x. + This field is not used and can be removed in a future release + once we're confident old PipelineRuns have been cleaned up. + See issue #8359 for context. + type: boolean + enableTerminationMessageCompression: + type: boolean + enableWaitExponentialBackoff: + type: boolean + enforceNonfalsifiability: + type: string + maxResultSize: + type: integer + requireGitSSHSecretKnownHosts: + type: boolean + resultExtractionMethod: + type: string + runningInEnvWithInjectedSidecars: + type: boolean + sendCloudEventsForRuns: + type: boolean + setSecurityContext: + type: boolean + setSecurityContextReadOnlyRootFilesystem: + type: boolean + verificationNoMatchPolicy: + description: |- + VerificationNoMatchPolicy is the feature flag for "trusted-resources-verification-no-match-policy" + VerificationNoMatchPolicy can be set to "ignore", "warn" and "fail" values. + ignore: skip trusted resources verification when no matching verification policies found + warn: skip trusted resources verification when no matching verification policies found and log a warning + fail: fail the taskrun or pipelines run if no matching verification policies found + type: string + refSource: + description: RefSource + type: object + properties: + digest: + description: Digest + type: object + additionalProperties: + type: string + entryPoint: + description: EntryPoint + type: string + uri: + description: URI + type: string + runs: + description: Runs + type: object + additionalProperties: + description: PipelineRunRunStatus + type: object + properties: + pipelineTaskName: + description: PipelineTaskName + type: string + status: + description: Status + type: object + properties: + annotations: + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + additionalProperties: + type: string + completionTime: + description: CompletionTime is the time the build completed. + type: string + format: date-time + conditions: + description: Conditions the latest available observations + of a resource's current state. + type: array + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + type: object + required: + - status + - type + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating + details about the transition. + type: string + reason: + description: The reason for the condition's last + transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, + False, Unknown. + type: string + type: + description: Type of condition. + type: string + extraFields: + description: |- + ExtraFields holds arbitrary fields provided by the custom task + controller. + x-kubernetes-preserve-unknown-fields: true + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + type: integer + format: int64 + results: + description: |- + Results reports any output result values to be consumed by later + tasks in a pipeline. + type: array + items: + description: CustomRunResult used to describe the results + of a task + type: object + required: + - name + - value + properties: + name: + description: Name the given name + type: string + value: + description: Value the given value of the result + type: string + retriesStatus: + description: |- + RetriesStatus contains the history of CustomRunStatus, in case of a retry. + See CustomRun.status (API version: tekton.dev/v1beta1) + x-kubernetes-preserve-unknown-fields: true + startTime: + description: StartTime is the time the build is actually + started. + type: string + format: date-time + whenExpressions: + description: WhenExpressions + type: array + items: + description: WhenExpression + type: object + properties: + cel: + description: CEL + type: string + input: + description: Input + type: string + operator: + description: Operator + type: string + values: + description: Values + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + skippedTasks: + description: SkippedTasks + type: array + items: + description: SkippedTask + type: object + required: + - name + - reason + properties: + name: + description: Name + type: string + reason: + description: Reason + type: string + whenExpressions: + description: WhenExpressions + type: array + items: + description: WhenExpression + type: object + properties: + cel: + description: CEL + type: string + input: + description: Input + type: string + operator: + description: Operator + type: string + values: + description: Values + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + spanContext: + description: SpanContext + type: object + additionalProperties: + type: string + startTime: + description: StartTime + type: string + format: date-time + taskRuns: + description: TaskRuns + type: object + additionalProperties: + description: PipelineRunTaskRunStatus + type: object + properties: + pipelineTaskName: + description: PipelineTaskName + type: string + status: + description: Status + type: object + required: + - podName + properties: + annotations: + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + additionalProperties: + type: string + cloudEvents: + description: CloudEvents + type: array + items: + description: CloudEventDelivery + type: object + properties: + status: + description: CloudEventDeliveryState + type: object + required: + - message + - retryCount + properties: + condition: + description: Condition + type: string + message: + description: Error + type: string + retryCount: + description: RetryCount + type: integer + format: int32 + sentAt: + description: SentAt + type: string + format: date-time + target: + description: Target + type: string + x-kubernetes-list-type: atomic + completionTime: + description: CompletionTime + type: string + format: date-time + conditions: + description: Conditions the latest available observations + of a resource's current state. + type: array + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + type: object + required: + - status + - type + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating + details about the transition. + type: string + reason: + description: The reason for the condition's last + transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, + False, Unknown. + type: string + type: + description: Type of condition. + type: string + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + type: integer + format: int64 + podName: + description: PodName + type: string + provenance: + description: Provenance + type: object + properties: + configSource: + description: |- + ConfigSource + Deprecated: Use RefSource instead + type: object + properties: + digest: + description: Digest + type: object + additionalProperties: + type: string + entryPoint: + description: EntryPoint + type: string + uri: + description: URI + type: string + featureFlags: + description: FeatureFlags + type: object + properties: + awaitSidecarReadiness: + type: boolean + coschedule: + type: string + disableCredsInit: + type: boolean + disableInlineSpec: + type: string + enableAPIFields: + type: string + enableArtifacts: + type: boolean + enableCELInWhenExpression: + type: boolean + enableConciseResolverSyntax: + type: boolean + enableKeepPodOnCancel: + type: boolean + enableKubernetesSidecar: + type: boolean + enableParamEnum: + type: boolean + enableProvenanceInStatus: + type: boolean + enableStepActions: + description: EnableStepActions is a no-op flag + since StepActions are stable + type: boolean + enableTektonOCIBundles: + description: |- + DeprecatedEnableTektonOCIBundles is maintained for backward compatibility + to allow deletion of PipelineRuns created before v0.62.x. + This field is not used and can be removed in a future release + once we're confident old PipelineRuns have been cleaned up. + See issue #8359 for context. + type: boolean + enableTerminationMessageCompression: + type: boolean + enableWaitExponentialBackoff: + type: boolean + enforceNonfalsifiability: + type: string + maxResultSize: + type: integer + requireGitSSHSecretKnownHosts: + type: boolean + resultExtractionMethod: + type: string + runningInEnvWithInjectedSidecars: + type: boolean + sendCloudEventsForRuns: + type: boolean + setSecurityContext: + type: boolean + setSecurityContextReadOnlyRootFilesystem: + type: boolean + verificationNoMatchPolicy: + description: |- + VerificationNoMatchPolicy is the feature flag for "trusted-resources-verification-no-match-policy" + VerificationNoMatchPolicy can be set to "ignore", "warn" and "fail" values. + ignore: skip trusted resources verification when no matching verification policies found + warn: skip trusted resources verification when no matching verification policies found and log a warning + fail: fail the taskrun or pipelines run if no matching verification policies found + type: string + refSource: + description: RefSource + type: object + properties: + digest: + description: Digest + type: object + additionalProperties: + type: string + entryPoint: + description: EntryPoint + type: string + uri: + description: URI + type: string + resourcesResult: + description: |- + ResourcesResult + Deprecated: this field is not populated and is preserved only for backwards compatibility + type: array + items: + description: |- + RunResult is used to write key/value pairs to TaskRun pod termination messages. + The key/value pairs may come from the entrypoint binary, or represent a TaskRunResult. + If they represent a TaskRunResult, the key is the name of the result and the value is the + JSON-serialized value of the result. + type: object + required: + - key + - value + properties: + key: + type: string + resourceName: + description: |- + ResourceName may be used in tests, but it is not populated in termination messages. + It is preserved here for backwards compatibility and will not be ported to v1. + type: string + type: + description: |- + ResultType used to find out whether a RunResult is from a task result or not + Note that ResultsType is another type which is used to define the data type + (e.g. string, array, etc) we used for Results + type: integer + value: + type: string + x-kubernetes-list-type: atomic + retriesStatus: + description: RetriesStatus + x-kubernetes-preserve-unknown-fields: true + sidecars: + description: Sidecars + type: array + items: + description: SidecarState + type: object + properties: + container: + type: string + imageID: + type: string + name: + type: string + running: + description: Details about a running container + type: object + properties: + startedAt: + description: Time at which the container was + last (re-)started + type: string + format: date-time + terminated: + description: Details about a terminated container + type: object + required: + - exitCode + properties: + containerID: + description: Container's ID in the format '://' + type: string + exitCode: + description: Exit status from the last termination + of the container + type: integer + format: int32 + finishedAt: + description: Time at which the container last + terminated + type: string + format: date-time + message: + description: Message regarding the last termination + of the container + type: string + reason: + description: (brief) reason from the last termination + of the container + type: string + signal: + description: Signal from the last termination + of the container + type: integer + format: int32 + startedAt: + description: Time at which previous execution + of the container started + type: string + format: date-time + waiting: + description: Details about a waiting container + type: object + properties: + message: + description: Message regarding why the container + is not yet running. + type: string + reason: + description: (brief) reason the container is + not yet running. + type: string + x-kubernetes-list-type: atomic + spanContext: + description: SpanContext + type: object + additionalProperties: + type: string + startTime: + description: StartTime + type: string + format: date-time + steps: + description: Steps + type: array + items: + description: StepState + type: object + properties: + container: + type: string + imageID: + type: string + inputs: + type: array + items: + description: Artifact + type: object + properties: + buildOutput: + description: BuildOutput + type: boolean + name: + description: Name + type: string + values: + description: Values + type: array + items: + description: ArtifactValue + type: object + properties: + digest: + type: object + additionalProperties: + type: string + uri: + type: string + name: + type: string + outputs: + type: array + items: + description: Artifact + type: object + properties: + buildOutput: + description: BuildOutput + type: boolean + name: + description: Name + type: string + values: + description: Values + type: array + items: + description: ArtifactValue + type: object + properties: + digest: + type: object + additionalProperties: + type: string + uri: + type: string + provenance: + description: Provenance + type: object + properties: + configSource: + description: |- + ConfigSource + Deprecated: Use RefSource instead + type: object + properties: + digest: + description: Digest + type: object + additionalProperties: + type: string + entryPoint: + description: EntryPoint + type: string + uri: + description: URI + type: string + featureFlags: + description: FeatureFlags + type: object + properties: + awaitSidecarReadiness: + type: boolean + coschedule: + type: string + disableCredsInit: + type: boolean + disableInlineSpec: + type: string + enableAPIFields: + type: string + enableArtifacts: + type: boolean + enableCELInWhenExpression: + type: boolean + enableConciseResolverSyntax: + type: boolean + enableKeepPodOnCancel: + type: boolean + enableKubernetesSidecar: + type: boolean + enableParamEnum: + type: boolean + enableProvenanceInStatus: + type: boolean + enableStepActions: + description: EnableStepActions is a no-op + flag since StepActions are stable + type: boolean + enableTektonOCIBundles: + description: |- + DeprecatedEnableTektonOCIBundles is maintained for backward compatibility + to allow deletion of PipelineRuns created before v0.62.x. + This field is not used and can be removed in a future release + once we're confident old PipelineRuns have been cleaned up. + See issue #8359 for context. + type: boolean + enableTerminationMessageCompression: + type: boolean + enableWaitExponentialBackoff: + type: boolean + enforceNonfalsifiability: + type: string + maxResultSize: + type: integer + requireGitSSHSecretKnownHosts: + type: boolean + resultExtractionMethod: + type: string + runningInEnvWithInjectedSidecars: + type: boolean + sendCloudEventsForRuns: + type: boolean + setSecurityContext: + type: boolean + setSecurityContextReadOnlyRootFilesystem: + type: boolean + verificationNoMatchPolicy: + description: |- + VerificationNoMatchPolicy is the feature flag for "trusted-resources-verification-no-match-policy" + VerificationNoMatchPolicy can be set to "ignore", "warn" and "fail" values. + ignore: skip trusted resources verification when no matching verification policies found + warn: skip trusted resources verification when no matching verification policies found and log a warning + fail: fail the taskrun or pipelines run if no matching verification policies found + type: string + refSource: + description: RefSource + type: object + properties: + digest: + description: Digest + type: object + additionalProperties: + type: string + entryPoint: + description: EntryPoint + type: string + uri: + description: URI + type: string + results: + type: array + items: + description: TaskRunResult + type: object + required: + - name + - value + properties: + name: + description: Name + type: string + type: + description: Type + type: string + value: + description: Value + x-kubernetes-preserve-unknown-fields: true + running: + description: Details about a running container + type: object + properties: + startedAt: + description: Time at which the container was + last (re-)started + type: string + format: date-time + terminated: + description: Details about a terminated container + type: object + required: + - exitCode + properties: + containerID: + description: Container's ID in the format '://' + type: string + exitCode: + description: Exit status from the last termination + of the container + type: integer + format: int32 + finishedAt: + description: Time at which the container last + terminated + type: string + format: date-time + message: + description: Message regarding the last termination + of the container + type: string + reason: + description: (brief) reason from the last termination + of the container + type: string + signal: + description: Signal from the last termination + of the container + type: integer + format: int32 + startedAt: + description: Time at which previous execution + of the container started + type: string + format: date-time + waiting: + description: Details about a waiting container + type: object + properties: + message: + description: Message regarding why the container + is not yet running. + type: string + reason: + description: (brief) reason the container is + not yet running. + type: string + x-kubernetes-list-type: atomic + taskResults: + description: TaskRunResults + type: array + items: + description: TaskRunResult + type: object + required: + - name + - value + properties: + name: + description: Name + type: string + type: + description: Type + type: string + value: + description: Value + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + taskSpec: + description: TaskSpec + x-kubernetes-preserve-unknown-fields: true + whenExpressions: + description: WhenExpressions + type: array + items: + description: WhenExpression + type: object + properties: + cel: + description: CEL + type: string + input: + description: Input + type: string + operator: + description: Operator + type: string + values: + description: Values + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + additionalPrinterColumns: + - name: Succeeded + type: string + jsonPath: ".status.conditions[?(@.type==\"Succeeded\")].status" + - name: Reason + type: string + jsonPath: ".status.conditions[?(@.type==\"Succeeded\")].reason" + - name: StartTime + type: date + jsonPath: .status.startTime + - name: CompletionTime + type: date + jsonPath: .status.completionTime + # Opt into the status subresource so metadata.generation + # starts to increment + subresources: + status: {} + - name: v1 + served: true + storage: true + schema: + openAPIV3Schema: + description: |- + PipelineRun represents a single execution of a Pipeline. PipelineRuns are how + the graph of Tasks declared in a Pipeline are executed; they specify inputs + to Pipelines such as parameter values and capture operational aspects of the + Tasks execution such as service account and tolerations. Creating a + PipelineRun creates TaskRuns for Tasks in the referenced Pipeline. + type: object + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: PipelineRunSpec defines the desired state of PipelineRun + type: object + properties: + managedBy: + description: |- + ManagedBy indicates which controller is responsible for reconciling + this resource. If unset or set to "tekton.dev/pipeline", the default + Tekton controller will manage this resource. + This field is immutable. + type: string + params: + description: Params is a list of parameter names and values. + type: array + items: + description: Param declares an ParamValues to use for the parameter + called name. + type: object + required: + - name + - value + properties: + name: + type: string + value: + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + pipelineRef: + description: PipelineRef can be used to refer to a specific instance + of a Pipeline. + type: object + properties: + apiVersion: + description: API version of the referent + type: string + name: + description: 'Name of the referent; More info: http://kubernetes.io/docs/user-guide/identifiers#names' + type: string + params: + description: |- + Params contains the parameters used to identify the + referenced Tekton resource. Example entries might include + "repo" or "path" but the set of params ultimately depends on + the chosen resolver. + type: array + items: + description: Param declares an ParamValues to use for the + parameter called name. + type: object + required: + - name + - value + properties: + name: + type: string + value: + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + resolver: + description: |- + Resolver is the name of the resolver that should perform + resolution of the referenced Tekton resource, such as "git". + type: string + pipelineSpec: + description: |- + Specifying PipelineSpec can be disabled by setting + `disable-inline-spec` feature flag. + See Pipeline.spec (API version: tekton.dev/v1) + x-kubernetes-preserve-unknown-fields: true + status: + description: Used for cancelling a pipelinerun (and maybe more later + on) + type: string + taskRunSpecs: + description: TaskRunSpecs holds a set of runtime specs + type: array + items: + description: |- + PipelineTaskRunSpec can be used to configure specific + specs for a concrete Task + type: object + properties: + computeResources: + description: Compute resources to use for this TaskRun + type: object + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This field depends on the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + type: array + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + type: object + required: + - name + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + requests: + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + metadata: + description: PipelineTaskMetadata contains the labels or annotations + for an EmbeddedTask + type: object + properties: + annotations: + type: object + additionalProperties: + type: string + labels: + type: object + additionalProperties: + type: string + pipelineTaskName: + type: string + podTemplate: + description: PodTemplate holds pod specific configuration + type: object + properties: + affinity: + description: |- + If specified, the pod's scheduling constraints. + See Pod.spec.affinity (API version: v1) + x-kubernetes-preserve-unknown-fields: true + automountServiceAccountToken: + description: |- + AutomountServiceAccountToken indicates whether pods running as this + service account should have an API token automatically mounted. + type: boolean + dnsConfig: + description: |- + Specifies the DNS parameters of a pod. + Parameters specified here will be merged to the generated DNS + configuration based on DNSPolicy. + type: object + properties: + nameservers: + description: |- + A list of DNS name server IP addresses. + This will be appended to the base nameservers generated from DNSPolicy. + Duplicated nameservers will be removed. + type: array + items: + type: string + x-kubernetes-list-type: atomic + options: + description: |- + A list of DNS resolver options. + This will be merged with the base options generated from DNSPolicy. + Duplicated entries will be removed. Resolution options given in Options + will override those that appear in the base DNSPolicy. + type: array + items: + description: PodDNSConfigOption defines DNS resolver + options of a pod. + type: object + properties: + name: + description: |- + Name is this DNS resolver option's name. + Required. + type: string + value: + description: Value is this DNS resolver option's + value. + type: string + x-kubernetes-list-type: atomic + searches: + description: |- + A list of DNS search domains for host-name lookup. + This will be appended to the base search paths generated from DNSPolicy. + Duplicated search paths will be removed. + type: array + items: + type: string + x-kubernetes-list-type: atomic + dnsPolicy: + description: |- + Set DNS policy for the pod. Defaults to "ClusterFirst". Valid values are + 'ClusterFirst', 'Default' or 'None'. DNS parameters given in DNSConfig + will be merged with the policy selected with DNSPolicy. + type: string + enableServiceLinks: + description: |- + EnableServiceLinks indicates whether information about services should be injected into pod's + environment variables, matching the syntax of Docker links. + Optional: Defaults to true. + type: boolean + env: + description: List of environment variables that can be + provided to the containers belonging to the pod. + type: array + items: + description: EnvVar represents an environment variable + present in a Container. + type: object + required: + - name + properties: + name: + description: |- + Name of the environment variable. + May consist of any printable ASCII characters except '='. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's + value. Cannot be used if value is not empty. + type: object + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + type: object + required: + - key + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + type: object + required: + - fieldPath + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select + in the specified API version. + type: string + x-kubernetes-map-type: atomic + fileKeyRef: + description: |- + FileKeyRef selects a key of the env file. + Requires the EnvFiles feature gate to be enabled. + type: object + required: + - key + - path + - volumeName + properties: + key: + description: |- + The key within the env file. An invalid key will prevent the pod from starting. + The keys defined within a source may consist of any printable ASCII characters except '='. + During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters. + type: string + optional: + description: |- + Specify whether the file or its key must be defined. If the file or key + does not exist, then the env var is not published. + If optional is set to true and the specified key does not exist, + the environment variable will not be set in the Pod's containers. + + If optional is set to false and the specified key does not exist, + an error will be returned during Pod creation. + type: boolean + default: false + path: + description: |- + The path within the volume from which to select the file. + Must be relative and may not contain the '..' path or start with '..'. + type: string + volumeName: + description: The name of the volume mount + containing the env file. + type: string + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + type: object + required: + - resource + properties: + containerName: + description: 'Container name: required for + volumes, optional for env vars' + type: string + divisor: + description: Specifies the output format + of the exposed resources, defaults to + "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the + pod's namespace + type: object + required: + - key + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret + or its key must be defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + hostAliases: + description: |- + HostAliases is an optional list of hosts and IPs that will be injected into the pod's hosts + file if specified. This is only valid for non-hostNetwork pods. + type: array + items: + description: |- + HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the + pod's hosts file. + type: object + required: + - ip + properties: + hostnames: + description: Hostnames for the above IP address. + type: array + items: + type: string + x-kubernetes-list-type: atomic + ip: + description: IP address of the host file entry. + type: string + x-kubernetes-list-type: atomic + hostNetwork: + description: HostNetwork specifies whether the pod may + use the node network namespace + type: boolean + hostUsers: + description: |- + HostUsers indicates whether the pod will use the host's user namespace. + Optional: Default to true. + If set to true or not present, the pod will be run in the host user namespace, useful + for when the pod needs a feature only available to the host user namespace, such as + loading a kernel module with CAP_SYS_MODULE. + When set to false, a new user namespace is created for the pod. Setting false + is useful to mitigating container breakout vulnerabilities such as allowing + containers to run as root without their user having root privileges on the host. + This field depends on the kubernetes feature gate UserNamespacesSupport being enabled. + type: boolean + imagePullSecrets: + description: ImagePullSecrets gives the name of the secret + used by the pod to pull the image if specified + type: array + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + nodeSelector: + description: |- + NodeSelector is a selector which must be true for the pod to fit on a node. + Selector which must match a node's labels for the pod to be scheduled on that node. + More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ + type: object + additionalProperties: + type: string + priorityClassName: + description: |- + If specified, indicates the pod's priority. "system-node-critical" and + "system-cluster-critical" are two special keywords which indicate the + highest priorities with the former being the highest priority. Any other + name must be defined by creating a PriorityClass object with that name. + If not specified, the pod priority will be default or zero if there is no + default. + type: string + runtimeClassName: + description: |- + RuntimeClassName refers to a RuntimeClass object in the node.k8s.io + group, which should be used to run this pod. If no RuntimeClass resource + matches the named class, the pod will not be run. If unset or empty, the + "legacy" RuntimeClass will be used, which is an implicit class with an + empty definition that uses the default runtime handler. + More info: https://git.k8s.io/enhancements/keps/sig-node/runtime-class.md + This is a beta feature as of Kubernetes v1.14. + type: string + schedulerName: + description: SchedulerName specifies the scheduler to + be used to dispatch the Pod + type: string + securityContext: + description: |- + SecurityContext holds pod-level security attributes and common container settings. + Optional: Defaults to empty. See type description for default values of each field. + See Pod.spec.securityContext (API version: v1) + x-kubernetes-preserve-unknown-fields: true + tolerations: + description: If specified, the pod's tolerations. + type: array + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + type: object + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + type: integer + format: int64 + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + x-kubernetes-list-type: atomic + topologySpreadConstraints: + description: |- + TopologySpreadConstraints controls how Pods are spread across your cluster among + failure-domains such as regions, zones, nodes, and other user-defined topology domains. + type: array + items: + description: TopologySpreadConstraint specifies how + to spread matching pods among the given topology. + type: object + required: + - maxSkew + - topologyKey + - whenUnsatisfiable + properties: + labelSelector: + description: |- + LabelSelector is used to find matching pods. + Pods that match this label selector are counted to determine the number of pods + in their corresponding topology domain. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select the pods over which + spreading will be calculated. The keys are used to lookup values from the + incoming pod labels, those key-value labels are ANDed with labelSelector + to select the group of existing pods over which spreading will be calculated + for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + MatchLabelKeys cannot be set when LabelSelector isn't set. + Keys that don't exist in the incoming pod labels will + be ignored. A null or empty list means only match against labelSelector. + + This is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default). + type: array + items: + type: string + x-kubernetes-list-type: atomic + maxSkew: + description: |- + MaxSkew describes the degree to which pods may be unevenly distributed. + When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference + between the number of matching pods in the target topology and the global minimum. + The global minimum is the minimum number of matching pods in an eligible domain + or zero if the number of eligible domains is less than MinDomains. + For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same + labelSelector spread as 2/2/1: + In this case, the global minimum is 1. + | zone1 | zone2 | zone3 | + | P P | P P | P | + - if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2; + scheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2) + violate MaxSkew(1). + - if MaxSkew is 2, incoming pod can be scheduled onto any zone. + When `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence + to topologies that satisfy it. + It's a required field. Default value is 1 and 0 is not allowed. + type: integer + format: int32 + minDomains: + description: |- + MinDomains indicates a minimum number of eligible domains. + When the number of eligible domains with matching topology keys is less than minDomains, + Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed. + And when the number of eligible domains with matching topology keys equals or greater than minDomains, + this value has no effect on scheduling. + As a result, when the number of eligible domains is less than minDomains, + scheduler won't schedule more than maxSkew Pods to those domains. + If value is nil, the constraint behaves as if MinDomains is equal to 1. + Valid values are integers greater than 0. + When value is not nil, WhenUnsatisfiable must be DoNotSchedule. + + For example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same + labelSelector spread as 2/2/2: + | zone1 | zone2 | zone3 | + | P P | P P | P P | + The number of domains is less than 5(MinDomains), so "global minimum" is treated as 0. + In this situation, new pod with the same labelSelector cannot be scheduled, + because computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones, + it will violate MaxSkew. + type: integer + format: int32 + nodeAffinityPolicy: + description: |- + NodeAffinityPolicy indicates how we will treat Pod's nodeAffinity/nodeSelector + when calculating pod topology spread skew. Options are: + - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations. + - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations. + + If this value is nil, the behavior is equivalent to the Honor policy. + type: string + nodeTaintsPolicy: + description: |- + NodeTaintsPolicy indicates how we will treat node taints when calculating + pod topology spread skew. Options are: + - Honor: nodes without taints, along with tainted nodes for which the incoming pod + has a toleration, are included. + - Ignore: node taints are ignored. All nodes are included. + + If this value is nil, the behavior is equivalent to the Ignore policy. + type: string + topologyKey: + description: |- + TopologyKey is the key of node labels. Nodes that have a label with this key + and identical values are considered to be in the same topology. + We consider each as a "bucket", and try to put balanced number + of pods into each bucket. + We define a domain as a particular instance of a topology. + Also, we define an eligible domain as a domain whose nodes meet the requirements of + nodeAffinityPolicy and nodeTaintsPolicy. + e.g. If TopologyKey is "kubernetes.io/hostname", each Node is a domain of that topology. + And, if TopologyKey is "topology.kubernetes.io/zone", each zone is a domain of that topology. + It's a required field. + type: string + whenUnsatisfiable: + description: |- + WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy + the spread constraint. + - DoNotSchedule (default) tells the scheduler not to schedule it. + - ScheduleAnyway tells the scheduler to schedule the pod in any location, + but giving higher precedence to topologies that would help reduce the + skew. + A constraint is considered "Unsatisfiable" for an incoming pod + if and only if every possible node assignment for that pod would violate + "MaxSkew" on some topology. + For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same + labelSelector spread as 3/1/1: + | zone1 | zone2 | zone3 | + | P P P | P | P | + If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled + to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies + MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler + won't make it *more* imbalanced. + It's a required field. + type: string + x-kubernetes-list-type: atomic + volumes: + description: |- + List of volumes that can be mounted by containers belonging to the pod. + More info: https://kubernetes.io/docs/concepts/storage/volumes + See Pod.spec.volumes (API version: v1) + x-kubernetes-preserve-unknown-fields: true + serviceAccountName: + type: string + sidecarSpecs: + type: array + items: + description: TaskRunSidecarSpec is used to override the + values of a Sidecar in the corresponding Task. + type: object + required: + - computeResources + - name + properties: + computeResources: + description: The resource requirements to apply to the + Sidecar. + type: object + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This field depends on the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + type: array + items: + description: ResourceClaim references one entry + in PodSpec.ResourceClaims. + type: object + required: + - name + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + requests: + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + name: + description: The name of the Sidecar to override. + type: string + x-kubernetes-list-type: atomic + stepSpecs: + type: array + items: + description: TaskRunStepSpec is used to override the values + of a Step in the corresponding Task. + type: object + required: + - computeResources + - name + properties: + computeResources: + description: The resource requirements to apply to the + Step. + type: object + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This field depends on the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + type: array + items: + description: ResourceClaim references one entry + in PodSpec.ResourceClaims. + type: object + required: + - name + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + requests: + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + name: + description: The name of the Step to override. + type: string + x-kubernetes-list-type: atomic + timeout: + description: |- + Duration after which the TaskRun times out. Overrides the timeout specified + on the Task's spec if specified. Takes lower precedence to PipelineRun's + `spec.timeouts.tasks` + Refer Go's ParseDuration documentation for expected format: https://golang.org/pkg/time/#ParseDuration + type: string + x-kubernetes-list-type: atomic + taskRunTemplate: + description: TaskRunTemplate represent template of taskrun + type: object + properties: + podTemplate: + description: PodTemplate holds pod specific configuration + type: object + properties: + affinity: + description: |- + If specified, the pod's scheduling constraints. + See Pod.spec.affinity (API version: v1) + x-kubernetes-preserve-unknown-fields: true + automountServiceAccountToken: + description: |- + AutomountServiceAccountToken indicates whether pods running as this + service account should have an API token automatically mounted. + type: boolean + dnsConfig: + description: |- + Specifies the DNS parameters of a pod. + Parameters specified here will be merged to the generated DNS + configuration based on DNSPolicy. + type: object + properties: + nameservers: + description: |- + A list of DNS name server IP addresses. + This will be appended to the base nameservers generated from DNSPolicy. + Duplicated nameservers will be removed. + type: array + items: + type: string + x-kubernetes-list-type: atomic + options: + description: |- + A list of DNS resolver options. + This will be merged with the base options generated from DNSPolicy. + Duplicated entries will be removed. Resolution options given in Options + will override those that appear in the base DNSPolicy. + type: array + items: + description: PodDNSConfigOption defines DNS resolver + options of a pod. + type: object + properties: + name: + description: |- + Name is this DNS resolver option's name. + Required. + type: string + value: + description: Value is this DNS resolver option's + value. + type: string + x-kubernetes-list-type: atomic + searches: + description: |- + A list of DNS search domains for host-name lookup. + This will be appended to the base search paths generated from DNSPolicy. + Duplicated search paths will be removed. + type: array + items: + type: string + x-kubernetes-list-type: atomic + dnsPolicy: + description: |- + Set DNS policy for the pod. Defaults to "ClusterFirst". Valid values are + 'ClusterFirst', 'Default' or 'None'. DNS parameters given in DNSConfig + will be merged with the policy selected with DNSPolicy. + type: string + enableServiceLinks: + description: |- + EnableServiceLinks indicates whether information about services should be injected into pod's + environment variables, matching the syntax of Docker links. + Optional: Defaults to true. + type: boolean + env: + description: List of environment variables that can be provided + to the containers belonging to the pod. + type: array + items: + description: EnvVar represents an environment variable + present in a Container. + type: object + required: + - name + properties: + name: + description: |- + Name of the environment variable. + May consist of any printable ASCII characters except '='. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's + value. Cannot be used if value is not empty. + type: object + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + type: object + required: + - key + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + type: object + required: + - fieldPath + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in + the specified API version. + type: string + x-kubernetes-map-type: atomic + fileKeyRef: + description: |- + FileKeyRef selects a key of the env file. + Requires the EnvFiles feature gate to be enabled. + type: object + required: + - key + - path + - volumeName + properties: + key: + description: |- + The key within the env file. An invalid key will prevent the pod from starting. + The keys defined within a source may consist of any printable ASCII characters except '='. + During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters. + type: string + optional: + description: |- + Specify whether the file or its key must be defined. If the file or key + does not exist, then the env var is not published. + If optional is set to true and the specified key does not exist, + the environment variable will not be set in the Pod's containers. + + If optional is set to false and the specified key does not exist, + an error will be returned during Pod creation. + type: boolean + default: false + path: + description: |- + The path within the volume from which to select the file. + Must be relative and may not contain the '..' path or start with '..'. + type: string + volumeName: + description: The name of the volume mount + containing the env file. + type: string + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + type: object + required: + - resource + properties: + containerName: + description: 'Container name: required for + volumes, optional for env vars' + type: string + divisor: + description: Specifies the output format of + the exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the + pod's namespace + type: object + required: + - key + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + hostAliases: + description: |- + HostAliases is an optional list of hosts and IPs that will be injected into the pod's hosts + file if specified. This is only valid for non-hostNetwork pods. + type: array + items: + description: |- + HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the + pod's hosts file. + type: object + required: + - ip + properties: + hostnames: + description: Hostnames for the above IP address. + type: array + items: + type: string + x-kubernetes-list-type: atomic + ip: + description: IP address of the host file entry. + type: string + x-kubernetes-list-type: atomic + hostNetwork: + description: HostNetwork specifies whether the pod may use + the node network namespace + type: boolean + hostUsers: + description: |- + HostUsers indicates whether the pod will use the host's user namespace. + Optional: Default to true. + If set to true or not present, the pod will be run in the host user namespace, useful + for when the pod needs a feature only available to the host user namespace, such as + loading a kernel module with CAP_SYS_MODULE. + When set to false, a new user namespace is created for the pod. Setting false + is useful to mitigating container breakout vulnerabilities such as allowing + containers to run as root without their user having root privileges on the host. + This field depends on the kubernetes feature gate UserNamespacesSupport being enabled. + type: boolean + imagePullSecrets: + description: ImagePullSecrets gives the name of the secret + used by the pod to pull the image if specified + type: array + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + nodeSelector: + description: |- + NodeSelector is a selector which must be true for the pod to fit on a node. + Selector which must match a node's labels for the pod to be scheduled on that node. + More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ + type: object + additionalProperties: + type: string + priorityClassName: + description: |- + If specified, indicates the pod's priority. "system-node-critical" and + "system-cluster-critical" are two special keywords which indicate the + highest priorities with the former being the highest priority. Any other + name must be defined by creating a PriorityClass object with that name. + If not specified, the pod priority will be default or zero if there is no + default. + type: string + runtimeClassName: + description: |- + RuntimeClassName refers to a RuntimeClass object in the node.k8s.io + group, which should be used to run this pod. If no RuntimeClass resource + matches the named class, the pod will not be run. If unset or empty, the + "legacy" RuntimeClass will be used, which is an implicit class with an + empty definition that uses the default runtime handler. + More info: https://git.k8s.io/enhancements/keps/sig-node/runtime-class.md + This is a beta feature as of Kubernetes v1.14. + type: string + schedulerName: + description: SchedulerName specifies the scheduler to be + used to dispatch the Pod + type: string + securityContext: + description: |- + SecurityContext holds pod-level security attributes and common container settings. + Optional: Defaults to empty. See type description for default values of each field. + See Pod.spec.securityContext (API version: v1) + x-kubernetes-preserve-unknown-fields: true + tolerations: + description: If specified, the pod's tolerations. + type: array + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + type: object + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + type: integer + format: int64 + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + x-kubernetes-list-type: atomic + topologySpreadConstraints: + description: |- + TopologySpreadConstraints controls how Pods are spread across your cluster among + failure-domains such as regions, zones, nodes, and other user-defined topology domains. + type: array + items: + description: TopologySpreadConstraint specifies how to + spread matching pods among the given topology. + type: object + required: + - maxSkew + - topologyKey + - whenUnsatisfiable + properties: + labelSelector: + description: |- + LabelSelector is used to find matching pods. + Pods that match this label selector are counted to determine the number of pods + in their corresponding topology domain. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the + selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select the pods over which + spreading will be calculated. The keys are used to lookup values from the + incoming pod labels, those key-value labels are ANDed with labelSelector + to select the group of existing pods over which spreading will be calculated + for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + MatchLabelKeys cannot be set when LabelSelector isn't set. + Keys that don't exist in the incoming pod labels will + be ignored. A null or empty list means only match against labelSelector. + + This is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default). + type: array + items: + type: string + x-kubernetes-list-type: atomic + maxSkew: + description: |- + MaxSkew describes the degree to which pods may be unevenly distributed. + When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference + between the number of matching pods in the target topology and the global minimum. + The global minimum is the minimum number of matching pods in an eligible domain + or zero if the number of eligible domains is less than MinDomains. + For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same + labelSelector spread as 2/2/1: + In this case, the global minimum is 1. + | zone1 | zone2 | zone3 | + | P P | P P | P | + - if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2; + scheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2) + violate MaxSkew(1). + - if MaxSkew is 2, incoming pod can be scheduled onto any zone. + When `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence + to topologies that satisfy it. + It's a required field. Default value is 1 and 0 is not allowed. + type: integer + format: int32 + minDomains: + description: |- + MinDomains indicates a minimum number of eligible domains. + When the number of eligible domains with matching topology keys is less than minDomains, + Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed. + And when the number of eligible domains with matching topology keys equals or greater than minDomains, + this value has no effect on scheduling. + As a result, when the number of eligible domains is less than minDomains, + scheduler won't schedule more than maxSkew Pods to those domains. + If value is nil, the constraint behaves as if MinDomains is equal to 1. + Valid values are integers greater than 0. + When value is not nil, WhenUnsatisfiable must be DoNotSchedule. + + For example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same + labelSelector spread as 2/2/2: + | zone1 | zone2 | zone3 | + | P P | P P | P P | + The number of domains is less than 5(MinDomains), so "global minimum" is treated as 0. + In this situation, new pod with the same labelSelector cannot be scheduled, + because computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones, + it will violate MaxSkew. + type: integer + format: int32 + nodeAffinityPolicy: + description: |- + NodeAffinityPolicy indicates how we will treat Pod's nodeAffinity/nodeSelector + when calculating pod topology spread skew. Options are: + - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations. + - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations. + + If this value is nil, the behavior is equivalent to the Honor policy. + type: string + nodeTaintsPolicy: + description: |- + NodeTaintsPolicy indicates how we will treat node taints when calculating + pod topology spread skew. Options are: + - Honor: nodes without taints, along with tainted nodes for which the incoming pod + has a toleration, are included. + - Ignore: node taints are ignored. All nodes are included. + + If this value is nil, the behavior is equivalent to the Ignore policy. + type: string + topologyKey: + description: |- + TopologyKey is the key of node labels. Nodes that have a label with this key + and identical values are considered to be in the same topology. + We consider each as a "bucket", and try to put balanced number + of pods into each bucket. + We define a domain as a particular instance of a topology. + Also, we define an eligible domain as a domain whose nodes meet the requirements of + nodeAffinityPolicy and nodeTaintsPolicy. + e.g. If TopologyKey is "kubernetes.io/hostname", each Node is a domain of that topology. + And, if TopologyKey is "topology.kubernetes.io/zone", each zone is a domain of that topology. + It's a required field. + type: string + whenUnsatisfiable: + description: |- + WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy + the spread constraint. + - DoNotSchedule (default) tells the scheduler not to schedule it. + - ScheduleAnyway tells the scheduler to schedule the pod in any location, + but giving higher precedence to topologies that would help reduce the + skew. + A constraint is considered "Unsatisfiable" for an incoming pod + if and only if every possible node assignment for that pod would violate + "MaxSkew" on some topology. + For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same + labelSelector spread as 3/1/1: + | zone1 | zone2 | zone3 | + | P P P | P | P | + If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled + to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies + MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler + won't make it *more* imbalanced. + It's a required field. + type: string + x-kubernetes-list-type: atomic + volumes: + description: |- + List of volumes that can be mounted by containers belonging to the pod. + More info: https://kubernetes.io/docs/concepts/storage/volumes + See Pod.spec.volumes (API version: v1) + x-kubernetes-preserve-unknown-fields: true + serviceAccountName: + type: string + timeouts: + description: |- + Time after which the Pipeline times out. + Currently three keys are accepted in the map + pipeline, tasks and finally + with Timeouts.pipeline >= Timeouts.tasks + Timeouts.finally + type: object + properties: + finally: + description: Finally sets the maximum allowed duration of this + pipeline's finally + type: string + pipeline: + description: Pipeline sets the maximum allowed duration for + execution of the entire pipeline. The sum of individual timeouts + for tasks and finally must not exceed this value. + type: string + tasks: + description: Tasks sets the maximum allowed duration of this + pipeline's tasks + type: string + workspaces: + description: |- + Workspaces holds a set of workspace bindings that must match names + with those declared in the pipeline. + type: array + items: + description: WorkspaceBinding maps a Task's declared workspace + to a Volume. + type: object + required: + - name + properties: + configMap: + description: ConfigMap represents a configMap that should + populate this workspace. + type: object + properties: + defaultMode: + description: |- + defaultMode is optional: mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + Defaults to 0644. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + ConfigMap will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the ConfigMap, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: optional specify whether the ConfigMap or + its keys must be defined + type: boolean + x-kubernetes-map-type: atomic + csi: + description: CSI (Container Storage Interface) represents + ephemeral storage that is handled by certain external CSI + drivers. + type: object + required: + - driver + properties: + driver: + description: |- + driver is the name of the CSI driver that handles this volume. + Consult with your admin for the correct name as registered in the cluster. + type: string + fsType: + description: |- + fsType to mount. Ex. "ext4", "xfs", "ntfs". + If not provided, the empty value is passed to the associated CSI driver + which will determine the default filesystem to apply. + type: string + nodePublishSecretRef: + description: |- + nodePublishSecretRef is a reference to the secret object containing + sensitive information to pass to the CSI driver to complete the CSI + NodePublishVolume and NodeUnpublishVolume calls. + This field is optional, and may be empty if no secret is required. If the + secret object contains more than one secret, all secret references are passed. + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + x-kubernetes-map-type: atomic + readOnly: + description: |- + readOnly specifies a read-only configuration for the volume. + Defaults to false (read/write). + type: boolean + volumeAttributes: + description: |- + volumeAttributes stores driver-specific properties that are passed to the CSI + driver. Consult your driver's documentation for supported values. + type: object + additionalProperties: + type: string + emptyDir: + description: |- + EmptyDir represents a temporary directory that shares a Task's lifetime. + More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir + Either this OR PersistentVolumeClaim can be used. + type: object + properties: + medium: + description: |- + medium represents what type of storage medium should back this directory. + The default is "" which means to use the node's default medium. + Must be an empty string (default) or Memory. + More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir + type: string + sizeLimit: + description: |- + sizeLimit is the total amount of local storage required for this EmptyDir volume. + The size limit is also applicable for memory medium. + The maximum usage on memory medium EmptyDir would be the minimum value between + the SizeLimit specified here and the sum of memory limits of all containers in a pod. + The default is nil which means that the limit is undefined. + More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + name: + description: Name is the name of the workspace populated by + the volume. + type: string + persistentVolumeClaim: + description: |- + PersistentVolumeClaimVolumeSource represents a reference to a + PersistentVolumeClaim in the same namespace. Either this OR EmptyDir can be used. + type: object + required: + - claimName + properties: + claimName: + description: |- + claimName is the name of a PersistentVolumeClaim in the same namespace as the pod using this volume. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims + type: string + readOnly: + description: |- + readOnly Will force the ReadOnly setting in VolumeMounts. + Default false. + type: boolean + projected: + description: Projected represents a projected volume that + should populate this workspace. + type: object + properties: + defaultMode: + description: |- + defaultMode are the mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + sources: + description: |- + sources is the list of volume projections. Each entry in this list + handles one source. + type: array + items: + description: |- + Projection that may be projected along with other supported volume types. + Exactly one of these fields must be set. + type: object + properties: + clusterTrustBundle: + description: |- + ClusterTrustBundle allows a pod to access the `.spec.trustBundle` field + of ClusterTrustBundle objects in an auto-updating file. + + Alpha, gated by the ClusterTrustBundleProjection feature gate. + + ClusterTrustBundle objects can either be selected by name, or by the + combination of signer name and a label selector. + + Kubelet performs aggressive normalization of the PEM contents written + into the pod filesystem. Esoteric PEM features such as inter-block + comments and block headers are stripped. Certificates are deduplicated. + The ordering of certificates within the file is arbitrary, and Kubelet + may change the order over time. + type: object + required: + - path + properties: + labelSelector: + description: |- + Select all ClusterTrustBundles that match this label selector. Only has + effect if signerName is set. Mutually-exclusive with name. If unset, + interpreted as "match nothing". If set but empty, interpreted as "match + everything". + type: object + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + name: + description: |- + Select a single ClusterTrustBundle by object name. Mutually-exclusive + with signerName and labelSelector. + type: string + optional: + description: |- + If true, don't block pod startup if the referenced ClusterTrustBundle(s) + aren't available. If using name, then the named ClusterTrustBundle is + allowed not to exist. If using signerName, then the combination of + signerName and labelSelector is allowed to match zero + ClusterTrustBundles. + type: boolean + path: + description: Relative path from the volume root + to write the bundle. + type: string + signerName: + description: |- + Select all ClusterTrustBundles that match this signer name. + Mutually-exclusive with name. The contents of all selected + ClusterTrustBundles will be unified and deduplicated. + type: string + configMap: + description: configMap information about the configMap + data to project + type: object + properties: + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + ConfigMap will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the ConfigMap, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within + a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: optional specify whether the ConfigMap + or its keys must be defined + type: boolean + x-kubernetes-map-type: atomic + downwardAPI: + description: downwardAPI information about the downwardAPI + data to project + type: object + properties: + items: + description: Items is a list of DownwardAPIVolume + file + type: array + items: + description: DownwardAPIVolumeFile represents + information to create the file containing + the pod field + type: object + required: + - path + properties: + fieldRef: + description: 'Required: Selects a field + of the pod: only annotations, labels, + name, namespace and uid are supported.' + type: object + required: + - fieldPath + properties: + apiVersion: + description: Version of the schema + the FieldPath is written in terms + of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to + select in the specified API version. + type: string + x-kubernetes-map-type: atomic + mode: + description: |- + Optional: mode bits used to set permissions on this file, must be an octal value + between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: 'Required: Path is the relative + path name of the file to be created. + Must not be absolute or contain the + ''..'' path. Must be utf-8 encoded. + The first item of the relative path + must not start with ''..''' + type: string + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported. + type: object + required: + - resource + properties: + containerName: + description: 'Container name: required + for volumes, optional for env vars' + type: string + divisor: + description: Specifies the output + format of the exposed resources, + defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to + select' + type: string + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + podCertificate: + description: |- + Projects an auto-rotating credential bundle (private key and certificate + chain) that the pod can use either as a TLS client or server. + + Kubelet generates a private key and uses it to send a + PodCertificateRequest to the named signer. Once the signer approves the + request and issues a certificate chain, Kubelet writes the key and + certificate chain to the pod filesystem. The pod does not start until + certificates have been issued for each podCertificate projected volume + source in its spec. + + Kubelet will begin trying to rotate the certificate at the time indicated + by the signer using the PodCertificateRequest.Status.BeginRefreshAt + timestamp. + + Kubelet can write a single file, indicated by the credentialBundlePath + field, or separate files, indicated by the keyPath and + certificateChainPath fields. + + The credential bundle is a single file in PEM format. The first PEM + entry is the private key (in PKCS#8 format), and the remaining PEM + entries are the certificate chain issued by the signer (typically, + signers will return their certificate chain in leaf-to-root order). + + Prefer using the credential bundle format, since your application code + can read it atomically. If you use keyPath and certificateChainPath, + your application must make two separate file reads. If these coincide + with a certificate rotation, it is possible that the private key and leaf + certificate you read may not correspond to each other. Your application + will need to check for this condition, and re-read until they are + consistent. + + The named signer controls chooses the format of the certificate it + issues; consult the signer implementation's documentation to learn how to + use the certificates it issues. + type: object + required: + - keyType + - signerName + properties: + certificateChainPath: + description: |- + Write the certificate chain at this path in the projected volume. + + Most applications should use credentialBundlePath. When using keyPath + and certificateChainPath, your application needs to check that the key + and leaf certificate are consistent, because it is possible to read the + files mid-rotation. + type: string + credentialBundlePath: + description: |- + Write the credential bundle at this path in the projected volume. + + The credential bundle is a single file that contains multiple PEM blocks. + The first PEM block is a PRIVATE KEY block, containing a PKCS#8 private + key. + + The remaining blocks are CERTIFICATE blocks, containing the issued + certificate chain from the signer (leaf and any intermediates). + + Using credentialBundlePath lets your Pod's application code make a single + atomic read that retrieves a consistent key and certificate chain. If you + project them to separate files, your application code will need to + additionally check that the leaf certificate was issued to the key. + type: string + keyPath: + description: |- + Write the key at this path in the projected volume. + + Most applications should use credentialBundlePath. When using keyPath + and certificateChainPath, your application needs to check that the key + and leaf certificate are consistent, because it is possible to read the + files mid-rotation. + type: string + keyType: + description: |- + The type of keypair Kubelet will generate for the pod. + + Valid values are "RSA3072", "RSA4096", "ECDSAP256", "ECDSAP384", + "ECDSAP521", and "ED25519". + type: string + maxExpirationSeconds: + description: |- + maxExpirationSeconds is the maximum lifetime permitted for the + certificate. + + Kubelet copies this value verbatim into the PodCertificateRequests it + generates for this projection. + + If omitted, kube-apiserver will set it to 86400(24 hours). kube-apiserver + will reject values shorter than 3600 (1 hour). The maximum allowable + value is 7862400 (91 days). + + The signer implementation is then free to issue a certificate with any + lifetime *shorter* than MaxExpirationSeconds, but no shorter than 3600 + seconds (1 hour). This constraint is enforced by kube-apiserver. + `kubernetes.io` signers will never issue certificates with a lifetime + longer than 24 hours. + type: integer + format: int32 + signerName: + description: Kubelet's generated CSRs will be + addressed to this signer. + type: string + userAnnotations: + description: |- + userAnnotations allow pod authors to pass additional information to + the signer implementation. Kubernetes does not restrict or validate this + metadata in any way. + + These values are copied verbatim into the `spec.unverifiedUserAnnotations` field of + the PodCertificateRequest objects that Kubelet creates. + + Entries are subject to the same validation as object metadata annotations, + with the addition that all keys must be domain-prefixed. No restrictions + are placed on values, except an overall size limitation on the entire field. + + Signers should document the keys and values they support. Signers should + deny requests that contain keys they do not recognize. + type: object + additionalProperties: + type: string + secret: + description: secret information about the secret + data to project + type: object + properties: + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + Secret will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the Secret, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within + a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: optional field specify whether + the Secret or its key must be defined + type: boolean + x-kubernetes-map-type: atomic + serviceAccountToken: + description: serviceAccountToken is information + about the serviceAccountToken data to project + type: object + required: + - path + properties: + audience: + description: |- + audience is the intended audience of the token. A recipient of a token + must identify itself with an identifier specified in the audience of the + token, and otherwise should reject the token. The audience defaults to the + identifier of the apiserver. + type: string + expirationSeconds: + description: |- + expirationSeconds is the requested duration of validity of the service + account token. As the token approaches expiration, the kubelet volume + plugin will proactively rotate the service account token. The kubelet will + start trying to rotate the token if the token is older than 80 percent of + its time to live or if the token is older than 24 hours.Defaults to 1 hour + and must be at least 10 minutes. + type: integer + format: int64 + path: + description: |- + path is the path relative to the mount point of the file to project the + token into. + type: string + x-kubernetes-list-type: atomic + secret: + description: Secret represents a secret that should populate + this workspace. + type: object + properties: + defaultMode: + description: |- + defaultMode is Optional: mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values + for mode bits. Defaults to 0644. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + items: + description: |- + items If unspecified, each key-value pair in the Data field of the referenced + Secret will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the Secret, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + optional: + description: optional field specify whether the Secret + or its keys must be defined + type: boolean + secretName: + description: |- + secretName is the name of the secret in the pod's namespace to use. + More info: https://kubernetes.io/docs/concepts/storage/volumes#secret + type: string + subPath: + description: |- + SubPath is optionally a directory on the volume which should be used + for this binding (i.e. the volume will be mounted at this sub directory). + type: string + volumeClaimTemplate: + description: |- + VolumeClaimTemplate is a template for a claim that will be created in the same namespace. + The PipelineRun controller is responsible for creating a unique claim for each instance of PipelineRun. + See PersistentVolumeClaim (API version: v1) + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + status: + description: PipelineRunStatus defines the observed state of PipelineRun + type: object + properties: + annotations: + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + additionalProperties: + type: string + childReferences: + description: list of TaskRun and Run names, PipelineTask names, + and API versions/kinds for children of this PipelineRun. + type: array + items: + description: ChildStatusReference is used to point to the statuses + of individual TaskRuns and Runs within this PipelineRun. + type: object + properties: + apiVersion: + type: string + displayName: + description: |- + DisplayName is a user-facing name of the pipelineTask that may be + used to populate a UI. + type: string + kind: + type: string + name: + description: Name is the name of the TaskRun or Run this is + referencing. + type: string + pipelineTaskName: + description: PipelineTaskName is the name of the PipelineTask + this is referencing. + type: string + whenExpressions: + description: WhenExpressions is the list of checks guarding + the execution of the PipelineTask + type: array + items: + description: |- + WhenExpression allows a PipelineTask to declare expressions to be evaluated before the Task is run + to determine whether the Task should be executed or skipped + type: object + properties: + cel: + description: |- + CEL is a string of Common Language Expression, which can be used to conditionally execute + the task based on the result of the expression evaluation + More info about CEL syntax: https://github.com/google/cel-spec/blob/master/doc/langdef.md + type: string + input: + description: Input is the string for guard checking + which can be a static input or an output from a parent + Task + type: string + operator: + description: Operator that represents an Input's relationship + to the values + type: string + values: + description: |- + Values is an array of strings, which is compared against the input, for guard checking + It must be non-empty + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + completionTime: + description: CompletionTime is the time the PipelineRun completed. + type: string + format: date-time + conditions: + description: Conditions the latest available observations of a resource's + current state. + type: array + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + type: object + required: + - status + - type + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating details about + the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, False, + Unknown. + type: string + type: + description: Type of condition. + type: string + finallyStartTime: + description: FinallyStartTime is when all non-finally tasks have + been completed and only finally tasks are being executed. + type: string + format: date-time + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + type: integer + format: int64 + pipelineSpec: + description: |- + PipelineSpec contains the exact spec used to instantiate the run. + See Pipeline.spec (API version: tekton.dev/v1) + x-kubernetes-preserve-unknown-fields: true + provenance: + description: Provenance contains some key authenticated metadata + about how a software artifact was built (what sources, what inputs/outputs, + etc.). + type: object + properties: + featureFlags: + description: FeatureFlags identifies the feature flags that + were used during the task/pipeline run + type: object + properties: + awaitSidecarReadiness: + type: boolean + coschedule: + type: string + disableCredsInit: + type: boolean + disableInlineSpec: + type: string + enableAPIFields: + type: string + enableArtifacts: + type: boolean + enableCELInWhenExpression: + type: boolean + enableConciseResolverSyntax: + type: boolean + enableKeepPodOnCancel: + type: boolean + enableKubernetesSidecar: + type: boolean + enableParamEnum: + type: boolean + enableProvenanceInStatus: + type: boolean + enableStepActions: + description: EnableStepActions is a no-op flag since StepActions + are stable + type: boolean + enableTektonOCIBundles: + description: |- + DeprecatedEnableTektonOCIBundles is maintained for backward compatibility + to allow deletion of PipelineRuns created before v0.62.x. + This field is not used and can be removed in a future release + once we're confident old PipelineRuns have been cleaned up. + See issue #8359 for context. + type: boolean + enableTerminationMessageCompression: + type: boolean + enableWaitExponentialBackoff: + type: boolean + enforceNonfalsifiability: + type: string + maxResultSize: + type: integer + requireGitSSHSecretKnownHosts: + type: boolean + resultExtractionMethod: + type: string + runningInEnvWithInjectedSidecars: + type: boolean + sendCloudEventsForRuns: + type: boolean + setSecurityContext: + type: boolean + setSecurityContextReadOnlyRootFilesystem: + type: boolean + verificationNoMatchPolicy: + description: |- + VerificationNoMatchPolicy is the feature flag for "trusted-resources-verification-no-match-policy" + VerificationNoMatchPolicy can be set to "ignore", "warn" and "fail" values. + ignore: skip trusted resources verification when no matching verification policies found + warn: skip trusted resources verification when no matching verification policies found and log a warning + fail: fail the taskrun or pipelines run if no matching verification policies found + type: string + refSource: + description: RefSource identifies the source where a remote + task/pipeline came from. + type: object + properties: + digest: + description: |- + Digest is a collection of cryptographic digests for the contents of the artifact specified by URI. + Example: {"sha1": "f99d13e554ffcb696dee719fa85b695cb5b0f428"} + type: object + additionalProperties: + type: string + entryPoint: + description: |- + EntryPoint identifies the entry point into the build. This is often a path to a + build definition file and/or a target label within that file. + Example: "task/git-clone/0.10/git-clone.yaml" + type: string + uri: + description: |- + URI indicates the identity of the source of the build definition. + Example: "https://github.com/tektoncd/catalog" + type: string + results: + description: Results are the list of results written out by the + pipeline task's containers + type: array + items: + description: PipelineRunResult used to describe the results of + a pipeline + type: object + required: + - name + - value + properties: + name: + description: Name is the result's name as declared by the + Pipeline + type: string + value: + description: Value is the result returned from the execution + of this PipelineRun + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + skippedTasks: + description: list of tasks that were skipped due to when expressions + evaluating to false + type: array + items: + description: |- + SkippedTask is used to describe the Tasks that were skipped due to their When Expressions + evaluating to False. This is a struct because we are looking into including more details + about the When Expressions that caused this Task to be skipped. + type: object + required: + - name + - reason + properties: + name: + description: Name is the Pipeline Task name + type: string + reason: + description: Reason is the cause of the PipelineTask being + skipped. + type: string + whenExpressions: + description: WhenExpressions is the list of checks guarding + the execution of the PipelineTask + type: array + items: + description: |- + WhenExpression allows a PipelineTask to declare expressions to be evaluated before the Task is run + to determine whether the Task should be executed or skipped + type: object + properties: + cel: + description: |- + CEL is a string of Common Language Expression, which can be used to conditionally execute + the task based on the result of the expression evaluation + More info about CEL syntax: https://github.com/google/cel-spec/blob/master/doc/langdef.md + type: string + input: + description: Input is the string for guard checking + which can be a static input or an output from a parent + Task + type: string + operator: + description: Operator that represents an Input's relationship + to the values + type: string + values: + description: |- + Values is an array of strings, which is compared against the input, for guard checking + It must be non-empty + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + spanContext: + description: SpanContext contains tracing span context fields + type: object + additionalProperties: + type: string + startTime: + description: StartTime is the time the PipelineRun is actually started. + type: string + format: date-time + additionalPrinterColumns: + - name: Succeeded + type: string + jsonPath: ".status.conditions[?(@.type==\"Succeeded\")].status" + - name: Reason + type: string + jsonPath: ".status.conditions[?(@.type==\"Succeeded\")].reason" + - name: StartTime + type: date + jsonPath: .status.startTime + - name: CompletionTime + type: date + jsonPath: .status.completionTime + # Opt into the status subresource so metadata.generation + # starts to increment + subresources: + status: {} + names: + kind: PipelineRun + plural: pipelineruns + singular: pipelinerun + categories: + - tekton + - tekton-pipelines + shortNames: + - pr + - prs + scope: Namespaced + conversion: + strategy: Webhook + webhook: + conversionReviewVersions: ["v1beta1", "v1"] + clientConfig: + service: + name: tekton-pipelines-webhook + namespace: tekton-pipelines +--- +# Copyright 2022 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: resolutionrequests.resolution.tekton.dev + labels: + resolution.tekton.dev/release: devel +spec: + group: resolution.tekton.dev + scope: Namespaced + names: + kind: ResolutionRequest + plural: resolutionrequests + singular: resolutionrequest + categories: + - tekton + - tekton-pipelines + versions: + - name: v1alpha1 + served: true + deprecated: true + storage: false + subresources: + status: {} + schema: + openAPIV3Schema: + description: |- + ResolutionRequest is an object for requesting the content of + a Tekton resource like a pipeline.yaml. + type: object + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: Spec holds the information for the request part of the + resource request. + type: object + properties: + params: + description: |- + Parameters are the runtime attributes passed to + the resolver to help it figure out how to resolve the + resource being requested. For example: repo URL, commit SHA, + path to file, the kind of authentication to leverage, etc. + type: object + additionalProperties: + type: string + status: + description: |- + Status communicates the state of the request and, ultimately, + the content of the resolved resource. + type: object + required: + - data + - refSource + properties: + annotations: + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + additionalProperties: + type: string + conditions: + description: Conditions the latest available observations of a resource's + current state. + type: array + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + type: object + required: + - status + - type + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating details about + the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, False, + Unknown. + type: string + type: + description: Type of condition. + type: string + data: + description: |- + Data is a string representation of the resolved content + of the requested resource in-lined into the ResolutionRequest + object. + type: string + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + type: integer + format: int64 + refSource: + description: |- + RefSource is the source reference of the remote data that records where the remote + file came from including the url, digest and the entrypoint. + x-kubernetes-preserve-unknown-fields: true + additionalPrinterColumns: + - name: Succeeded + type: string + jsonPath: ".status.conditions[?(@.type=='Succeeded')].status" + - name: Reason + type: string + jsonPath: ".status.conditions[?(@.type=='Succeeded')].reason" + - name: v1beta1 + served: true + storage: true + subresources: + status: {} + schema: + openAPIV3Schema: + description: |- + ResolutionRequest is an object for requesting the content of + a Tekton resource like a pipeline.yaml. + type: object + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: Spec holds the information for the request part of the + resource request. + type: object + properties: + params: + description: |- + Parameters are the runtime attributes passed to + the resolver to help it figure out how to resolve the + resource being requested. For example: repo URL, commit SHA, + path to file, the kind of authentication to leverage, etc. + type: array + items: + description: Param declares an ParamValues to use for the parameter + called name. + type: object + required: + - name + - value + properties: + name: + type: string + value: + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + url: + description: |- + URL is the runtime url passed to the resolver + to help it figure out how to resolver the resource being + requested. + This is currently at an ALPHA stability level and subject to + alpha API compatibility policies. + type: string + status: + description: |- + Status communicates the state of the request and, ultimately, + the content of the resolved resource. + type: object + required: + - data + - refSource + - source + properties: + annotations: + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + additionalProperties: + type: string + conditions: + description: Conditions the latest available observations of a resource's + current state. + type: array + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + type: object + required: + - status + - type + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating details about + the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, False, + Unknown. + type: string + type: + description: Type of condition. + type: string + data: + description: |- + Data is a string representation of the resolved content + of the requested resource in-lined into the ResolutionRequest + object. + type: string + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + type: integer + format: int64 + refSource: + description: |- + RefSource is the source reference of the remote data that records the url, digest + and the entrypoint. + x-kubernetes-preserve-unknown-fields: true + source: + description: 'Deprecated: Use RefSource instead' + x-kubernetes-preserve-unknown-fields: true + additionalPrinterColumns: + - name: OwnerKind + type: string + jsonPath: ".metadata.ownerReferences[0].kind" + - name: Owner + type: string + jsonPath: ".metadata.ownerReferences[0].name" + - name: Succeeded + type: string + jsonPath: ".status.conditions[?(@.type=='Succeeded')].status" + - name: Reason + type: string + jsonPath: ".status.conditions[?(@.type=='Succeeded')].reason" + - name: StartTime + type: string + jsonPath: .metadata.creationTimestamp + - name: EndTime + type: string + jsonPath: .status.conditions[?(@.type=='Succeeded')].lastTransitionTime + conversion: + strategy: Webhook + webhook: + conversionReviewVersions: ["v1alpha1", "v1beta1"] + clientConfig: + service: + name: tekton-pipelines-webhook + namespace: tekton-pipelines +--- +# Copyright 2023 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: stepactions.tekton.dev + labels: + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines + pipeline.tekton.dev/release: "v1.15.0" + version: "v1.15.0" +spec: + group: tekton.dev + preserveUnknownFields: false + versions: + - name: v1alpha1 + served: true + storage: false + schema: + openAPIV3Schema: + description: |- + StepAction represents the actionable components of Step. + The Step can only reference it from the cluster or using remote resolution. + type: object + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: Spec holds the desired state of the Step from the client + type: object + properties: + args: + description: |- + Arguments to the entrypoint. + The image's CMD is used if this is not provided. + Variable references $(VAR_NAME) are expanded using the container's environment. If a variable + cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will + produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless + of whether the variable exists or not. Cannot be updated. + More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell + type: array + items: + type: string + x-kubernetes-list-type: atomic + command: + description: |- + Entrypoint array. Not executed within a shell. + The image's ENTRYPOINT is used if this is not provided. + Variable references $(VAR_NAME) are expanded using the container's environment. If a variable + cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will + produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless + of whether the variable exists or not. Cannot be updated. + More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell + type: array + items: + type: string + x-kubernetes-list-type: atomic + description: + description: |- + Description is a user-facing description of the stepaction that may be + used to populate a UI. + type: string + env: + description: |- + List of environment variables to set in the container. + Cannot be updated. + type: array + items: + description: EnvVar represents an environment variable present + in a Container. + type: object + required: + - name + properties: + name: + description: |- + Name of the environment variable. + May consist of any printable ASCII characters except '='. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's value. + Cannot be used if value is not empty. + type: object + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + type: object + required: + - key + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap or its + key must be defined + type: boolean + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + type: object + required: + - fieldPath + properties: + apiVersion: + description: Version of the schema the FieldPath is + written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in the specified + API version. + type: string + x-kubernetes-map-type: atomic + fileKeyRef: + description: |- + FileKeyRef selects a key of the env file. + Requires the EnvFiles feature gate to be enabled. + type: object + required: + - key + - path + - volumeName + properties: + key: + description: |- + The key within the env file. An invalid key will prevent the pod from starting. + The keys defined within a source may consist of any printable ASCII characters except '='. + During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters. + type: string + optional: + description: |- + Specify whether the file or its key must be defined. If the file or key + does not exist, then the env var is not published. + If optional is set to true and the specified key does not exist, + the environment variable will not be set in the Pod's containers. + + If optional is set to false and the specified key does not exist, + an error will be returned during Pod creation. + type: boolean + default: false + path: + description: |- + The path within the volume from which to select the file. + Must be relative and may not contain the '..' path or start with '..'. + type: string + volumeName: + description: The name of the volume mount containing + the env file. + type: string + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + type: object + required: + - resource + properties: + containerName: + description: 'Container name: required for volumes, + optional for env vars' + type: string + divisor: + description: Specifies the output format of the exposed + resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the pod's namespace + type: object + required: + - key + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + image: + description: |- + Image reference name to run for this StepAction. + More info: https://kubernetes.io/docs/concepts/containers/images + type: string + params: + description: |- + Params is a list of input parameters required to run the stepAction. + Params must be supplied as inputs in Steps unless they declare a defaultvalue. + type: array + items: + description: |- + ParamSpec defines arbitrary parameters needed beyond typed inputs (such as + resources). Parameter values are provided by users as inputs on a TaskRun + or PipelineRun. + type: object + required: + - name + properties: + default: + description: |- + Default is the value a parameter takes if no input value is supplied. If + default is set, a Task may be executed without a supplied value for the + parameter. + x-kubernetes-preserve-unknown-fields: true + description: + description: |- + Description is a user-facing description of the parameter that may be + used to populate a UI. + type: string + enum: + description: |- + Enum declares a set of allowed param input values for tasks/pipelines that can be validated. + If Enum is not set, no input validation is performed for the param. + type: array + items: + type: string + name: + description: Name declares the name by which a parameter is + referenced. + type: string + properties: + description: Properties is the JSON Schema properties to support + key-value pairs parameter. + type: object + additionalProperties: + description: PropertySpec defines the struct for object + keys + type: object + properties: + type: + description: |- + ParamType indicates the type of an input parameter; + Used to distinguish between a single string and an array of strings. + type: string + type: + description: |- + Type is the user-specified type of the parameter. The possible types + are currently "string", "array" and "object", and "string" is the default. + type: string + x-kubernetes-list-type: atomic + results: + description: Results are values that this StepAction can output + type: array + items: + description: StepResult used to describe the Results of a Step. + type: object + required: + - name + properties: + description: + description: Description is a human-readable description of + the result + type: string + name: + description: Name the given name + type: string + properties: + description: Properties is the JSON Schema properties to support + key-value pairs results. + type: object + additionalProperties: + description: PropertySpec defines the struct for object + keys + type: object + properties: + type: + description: |- + ParamType indicates the type of an input parameter; + Used to distinguish between a single string and an array of strings. + type: string + type: + description: The possible types are 'string', 'array', and + 'object', with 'string' as the default. + type: string + x-kubernetes-list-type: atomic + script: + description: |- + Script is the contents of an executable file to execute. + + If Script is not empty, the Step cannot have an Command and the Args will be passed to the Script. + type: string + securityContext: + description: |- + SecurityContext defines the security options the Step should be run with. + If set, the fields of SecurityContext override the equivalent fields of PodSecurityContext. + More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ + The value set in StepAction will take precedence over the value from Task. + type: object + properties: + allowPrivilegeEscalation: + description: |- + AllowPrivilegeEscalation controls whether a process can gain more + privileges than its parent process. This bool directly controls if + the no_new_privs flag will be set on the container process. + AllowPrivilegeEscalation is true always when the container is: + 1) run as Privileged + 2) has CAP_SYS_ADMIN + Note that this field cannot be set when spec.os.name is windows. + type: boolean + appArmorProfile: + description: |- + appArmorProfile is the AppArmor options to use by this container. If set, this profile + overrides the pod's appArmorProfile. + Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile loaded on the node that should be used. + The profile must be preconfigured on the node to work. + Must match the loaded name of the profile. + Must be set if and only if type is "Localhost". + type: string + type: + description: |- + type indicates which kind of AppArmor profile will be applied. + Valid options are: + Localhost - a profile pre-loaded on the node. + RuntimeDefault - the container runtime's default profile. + Unconfined - no AppArmor enforcement. + type: string + capabilities: + description: |- + The capabilities to add/drop when running containers. + Defaults to the default set of capabilities granted by the container runtime. + Note that this field cannot be set when spec.os.name is windows. + type: object + properties: + add: + description: Added capabilities + type: array + items: + description: Capability represent POSIX capabilities type + type: string + x-kubernetes-list-type: atomic + drop: + description: Removed capabilities + type: array + items: + description: Capability represent POSIX capabilities type + type: string + x-kubernetes-list-type: atomic + privileged: + description: |- + Run container in privileged mode. + Processes in privileged containers are essentially equivalent to root on the host. + Defaults to false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + procMount: + description: |- + procMount denotes the type of proc mount to use for the containers. + The default value is Default which uses the container runtime defaults for + readonly paths and masked paths. + This requires the ProcMountType feature flag to be enabled. + Note that this field cannot be set when spec.os.name is windows. + type: string + readOnlyRootFilesystem: + description: |- + Whether this container has a read-only root filesystem. + Default is false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + runAsGroup: + description: |- + The GID to run the entrypoint of the container process. + Uses runtime default if unset. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + runAsNonRoot: + description: |- + Indicates that the container must run as a non-root user. + If true, the Kubelet will validate the image at runtime to ensure that it + does not run as UID 0 (root) and fail to start the container if it does. + If unset or false, no such validation will be performed. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: boolean + runAsUser: + description: |- + The UID to run the entrypoint of the container process. + Defaults to user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + seLinuxOptions: + description: |- + The SELinux context to be applied to the container. + If unspecified, the container runtime will allocate a random SELinux context for each + container. May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: object + properties: + level: + description: Level is SELinux level label that applies to + the container. + type: string + role: + description: Role is a SELinux role label that applies to + the container. + type: string + type: + description: Type is a SELinux type label that applies to + the container. + type: string + user: + description: User is a SELinux user label that applies to + the container. + type: string + seccompProfile: + description: |- + The seccomp options to use by this container. If seccomp options are + provided at both the pod & container level, the container options + override the pod options. + Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile defined in a file on the node should be used. + The profile must be preconfigured on the node to work. + Must be a descending path, relative to the kubelet's configured seccomp profile location. + Must be set if type is "Localhost". Must NOT be set for any other type. + type: string + type: + description: |- + type indicates which kind of seccomp profile will be applied. + Valid options are: + + Localhost - a profile defined in a file on the node should be used. + RuntimeDefault - the container runtime default profile should be used. + Unconfined - no profile should be applied. + type: string + windowsOptions: + description: |- + The Windows specific settings applied to all containers. + If unspecified, the options from the PodSecurityContext will be used. + If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is linux. + type: object + properties: + gmsaCredentialSpec: + description: |- + GMSACredentialSpec is where the GMSA admission webhook + (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the + GMSA credential spec named by the GMSACredentialSpecName field. + type: string + gmsaCredentialSpecName: + description: GMSACredentialSpecName is the name of the GMSA + credential spec to use. + type: string + hostProcess: + description: |- + HostProcess determines if a container should be run as a 'Host Process' container. + All of a Pod's containers must have the same effective HostProcess value + (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers). + In addition, if HostProcess is true then HostNetwork must also be set to true. + type: boolean + runAsUserName: + description: |- + The UserName in Windows to run the entrypoint of the container process. + Defaults to the user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: string + volumeMounts: + description: |- + Volumes to mount into the Step's filesystem. + Cannot be updated. + type: array + items: + description: VolumeMount describes a mounting of a Volume within + a container. + type: object + required: + - mountPath + - name + properties: + mountPath: + description: |- + Path within the container at which the volume should be mounted. Must + not contain ':'. + type: string + mountPropagation: + description: |- + mountPropagation determines how mounts are propagated from the host + to container and the other way around. + When not set, MountPropagationNone is used. + This field is beta in 1.10. + When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified + (which defaults to None). + type: string + name: + description: This must match the Name of a Volume. + type: string + readOnly: + description: |- + Mounted read-only if true, read-write otherwise (false or unspecified). + Defaults to false. + type: boolean + recursiveReadOnly: + description: |- + RecursiveReadOnly specifies whether read-only mounts should be handled + recursively. + + If ReadOnly is false, this field has no meaning and must be unspecified. + + If ReadOnly is true, and this field is set to Disabled, the mount is not made + recursively read-only. If this field is set to IfPossible, the mount is made + recursively read-only, if it is supported by the container runtime. If this + field is set to Enabled, the mount is made recursively read-only if it is + supported by the container runtime, otherwise the pod will not be started and + an error will be generated to indicate the reason. + + If this field is set to IfPossible or Enabled, MountPropagation must be set to + None (or be unspecified, which defaults to None). + + If this field is not specified, it is treated as an equivalent of Disabled. + type: string + subPath: + description: |- + Path within the volume from which the container's volume should be mounted. + Defaults to "" (volume's root). + type: string + subPathExpr: + description: |- + Expanded path within the volume from which the container's volume should be mounted. + Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment. + Defaults to "" (volume's root). + SubPathExpr and SubPath are mutually exclusive. + type: string + x-kubernetes-list-type: atomic + workingDir: + description: |- + Step's working directory. + If not specified, the container runtime's default will be used, which + might be configured in the container image. + Cannot be updated. + type: string + # Opt into the status subresource so metadata.generation + # starts to increment + subresources: + status: {} + - name: v1beta1 + served: true + storage: true + schema: + openAPIV3Schema: + description: StepAction + type: object + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: Spec + type: object + properties: + args: + description: Args + type: array + items: + type: string + x-kubernetes-list-type: atomic + command: + description: Command + type: array + items: + type: string + x-kubernetes-list-type: atomic + description: + description: Description + type: string + env: + description: Env + type: array + items: + description: EnvVar represents an environment variable present + in a Container. + type: object + required: + - name + properties: + name: + description: |- + Name of the environment variable. + May consist of any printable ASCII characters except '='. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's value. + Cannot be used if value is not empty. + type: object + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + type: object + required: + - key + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap or its + key must be defined + type: boolean + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + type: object + required: + - fieldPath + properties: + apiVersion: + description: Version of the schema the FieldPath is + written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in the specified + API version. + type: string + x-kubernetes-map-type: atomic + fileKeyRef: + description: |- + FileKeyRef selects a key of the env file. + Requires the EnvFiles feature gate to be enabled. + type: object + required: + - key + - path + - volumeName + properties: + key: + description: |- + The key within the env file. An invalid key will prevent the pod from starting. + The keys defined within a source may consist of any printable ASCII characters except '='. + During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters. + type: string + optional: + description: |- + Specify whether the file or its key must be defined. If the file or key + does not exist, then the env var is not published. + If optional is set to true and the specified key does not exist, + the environment variable will not be set in the Pod's containers. + + If optional is set to false and the specified key does not exist, + an error will be returned during Pod creation. + type: boolean + default: false + path: + description: |- + The path within the volume from which to select the file. + Must be relative and may not contain the '..' path or start with '..'. + type: string + volumeName: + description: The name of the volume mount containing + the env file. + type: string + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + type: object + required: + - resource + properties: + containerName: + description: 'Container name: required for volumes, + optional for env vars' + type: string + divisor: + description: Specifies the output format of the exposed + resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the pod's namespace + type: object + required: + - key + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + image: + description: Image + type: string + params: + description: Params + type: array + items: + description: |- + ParamSpec defines arbitrary parameters needed beyond typed inputs (such as + resources). Parameter values are provided by users as inputs on a TaskRun + or PipelineRun. + type: object + required: + - name + properties: + default: + description: |- + Default is the value a parameter takes if no input value is supplied. If + default is set, a Task may be executed without a supplied value for the + parameter. + x-kubernetes-preserve-unknown-fields: true + description: + description: |- + Description is a user-facing description of the parameter that may be + used to populate a UI. + type: string + enum: + description: |- + Enum declares a set of allowed param input values for tasks/pipelines that can be validated. + If Enum is not set, no input validation is performed for the param. + type: array + items: + type: string + name: + description: Name declares the name by which a parameter is + referenced. + type: string + properties: + description: Properties is the JSON Schema properties to support + key-value pairs parameter. + type: object + additionalProperties: + description: PropertySpec defines the struct for object + keys + type: object + properties: + type: + description: |- + ParamType indicates the type of an input parameter; + Used to distinguish between a single string and an array of strings. + type: string + type: + description: |- + Type is the user-specified type of the parameter. The possible types + are currently "string", "array" and "object", and "string" is the default. + type: string + x-kubernetes-list-type: atomic + results: + description: Results + type: array + items: + description: StepResult used to describe the Results of a Step. + type: object + required: + - name + properties: + description: + description: Description is a human-readable description of + the result + type: string + name: + description: Name the given name + type: string + properties: + description: Properties is the JSON Schema properties to support + key-value pairs results. + type: object + additionalProperties: + description: PropertySpec defines the struct for object + keys + type: object + properties: + type: + description: |- + ParamType indicates the type of an input parameter; + Used to distinguish between a single string and an array of strings. + type: string + type: + description: The possible types are 'string', 'array', and + 'object', with 'string' as the default. + type: string + x-kubernetes-list-type: atomic + script: + description: Script + type: string + securityContext: + description: SecurityContext + type: object + properties: + allowPrivilegeEscalation: + description: |- + AllowPrivilegeEscalation controls whether a process can gain more + privileges than its parent process. This bool directly controls if + the no_new_privs flag will be set on the container process. + AllowPrivilegeEscalation is true always when the container is: + 1) run as Privileged + 2) has CAP_SYS_ADMIN + Note that this field cannot be set when spec.os.name is windows. + type: boolean + appArmorProfile: + description: |- + appArmorProfile is the AppArmor options to use by this container. If set, this profile + overrides the pod's appArmorProfile. + Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile loaded on the node that should be used. + The profile must be preconfigured on the node to work. + Must match the loaded name of the profile. + Must be set if and only if type is "Localhost". + type: string + type: + description: |- + type indicates which kind of AppArmor profile will be applied. + Valid options are: + Localhost - a profile pre-loaded on the node. + RuntimeDefault - the container runtime's default profile. + Unconfined - no AppArmor enforcement. + type: string + capabilities: + description: |- + The capabilities to add/drop when running containers. + Defaults to the default set of capabilities granted by the container runtime. + Note that this field cannot be set when spec.os.name is windows. + type: object + properties: + add: + description: Added capabilities + type: array + items: + description: Capability represent POSIX capabilities type + type: string + x-kubernetes-list-type: atomic + drop: + description: Removed capabilities + type: array + items: + description: Capability represent POSIX capabilities type + type: string + x-kubernetes-list-type: atomic + privileged: + description: |- + Run container in privileged mode. + Processes in privileged containers are essentially equivalent to root on the host. + Defaults to false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + procMount: + description: |- + procMount denotes the type of proc mount to use for the containers. + The default value is Default which uses the container runtime defaults for + readonly paths and masked paths. + This requires the ProcMountType feature flag to be enabled. + Note that this field cannot be set when spec.os.name is windows. + type: string + readOnlyRootFilesystem: + description: |- + Whether this container has a read-only root filesystem. + Default is false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + runAsGroup: + description: |- + The GID to run the entrypoint of the container process. + Uses runtime default if unset. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + runAsNonRoot: + description: |- + Indicates that the container must run as a non-root user. + If true, the Kubelet will validate the image at runtime to ensure that it + does not run as UID 0 (root) and fail to start the container if it does. + If unset or false, no such validation will be performed. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: boolean + runAsUser: + description: |- + The UID to run the entrypoint of the container process. + Defaults to user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + seLinuxOptions: + description: |- + The SELinux context to be applied to the container. + If unspecified, the container runtime will allocate a random SELinux context for each + container. May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: object + properties: + level: + description: Level is SELinux level label that applies to + the container. + type: string + role: + description: Role is a SELinux role label that applies to + the container. + type: string + type: + description: Type is a SELinux type label that applies to + the container. + type: string + user: + description: User is a SELinux user label that applies to + the container. + type: string + seccompProfile: + description: |- + The seccomp options to use by this container. If seccomp options are + provided at both the pod & container level, the container options + override the pod options. + Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile defined in a file on the node should be used. + The profile must be preconfigured on the node to work. + Must be a descending path, relative to the kubelet's configured seccomp profile location. + Must be set if type is "Localhost". Must NOT be set for any other type. + type: string + type: + description: |- + type indicates which kind of seccomp profile will be applied. + Valid options are: + + Localhost - a profile defined in a file on the node should be used. + RuntimeDefault - the container runtime default profile should be used. + Unconfined - no profile should be applied. + type: string + windowsOptions: + description: |- + The Windows specific settings applied to all containers. + If unspecified, the options from the PodSecurityContext will be used. + If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is linux. + type: object + properties: + gmsaCredentialSpec: + description: |- + GMSACredentialSpec is where the GMSA admission webhook + (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the + GMSA credential spec named by the GMSACredentialSpecName field. + type: string + gmsaCredentialSpecName: + description: GMSACredentialSpecName is the name of the GMSA + credential spec to use. + type: string + hostProcess: + description: |- + HostProcess determines if a container should be run as a 'Host Process' container. + All of a Pod's containers must have the same effective HostProcess value + (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers). + In addition, if HostProcess is true then HostNetwork must also be set to true. + type: boolean + runAsUserName: + description: |- + The UserName in Windows to run the entrypoint of the container process. + Defaults to the user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: string + volumeMounts: + description: VolumeMounts + type: array + items: + description: VolumeMount describes a mounting of a Volume within + a container. + type: object + required: + - mountPath + - name + properties: + mountPath: + description: |- + Path within the container at which the volume should be mounted. Must + not contain ':'. + type: string + mountPropagation: + description: |- + mountPropagation determines how mounts are propagated from the host + to container and the other way around. + When not set, MountPropagationNone is used. + This field is beta in 1.10. + When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified + (which defaults to None). + type: string + name: + description: This must match the Name of a Volume. + type: string + readOnly: + description: |- + Mounted read-only if true, read-write otherwise (false or unspecified). + Defaults to false. + type: boolean + recursiveReadOnly: + description: |- + RecursiveReadOnly specifies whether read-only mounts should be handled + recursively. + + If ReadOnly is false, this field has no meaning and must be unspecified. + + If ReadOnly is true, and this field is set to Disabled, the mount is not made + recursively read-only. If this field is set to IfPossible, the mount is made + recursively read-only, if it is supported by the container runtime. If this + field is set to Enabled, the mount is made recursively read-only if it is + supported by the container runtime, otherwise the pod will not be started and + an error will be generated to indicate the reason. + + If this field is set to IfPossible or Enabled, MountPropagation must be set to + None (or be unspecified, which defaults to None). + + If this field is not specified, it is treated as an equivalent of Disabled. + type: string + subPath: + description: |- + Path within the volume from which the container's volume should be mounted. + Defaults to "" (volume's root). + type: string + subPathExpr: + description: |- + Expanded path within the volume from which the container's volume should be mounted. + Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment. + Defaults to "" (volume's root). + SubPathExpr and SubPath are mutually exclusive. + type: string + x-kubernetes-list-type: atomic + workingDir: + description: WorkingDir + type: string + # Opt into the status subresource so metadata.generation + # starts to increment + subresources: + status: {} + names: + kind: StepAction + plural: stepactions + singular: stepaction + categories: + - tekton + - tekton-pipelines + scope: Namespaced + conversion: + strategy: Webhook + webhook: + conversionReviewVersions: ["v1alpha1", "v1beta1"] + clientConfig: + service: + name: tekton-pipelines-webhook + namespace: tekton-pipelines +--- +# Copyright 2019 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: tasks.tekton.dev + labels: + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines + pipeline.tekton.dev/release: "v1.15.0" + version: "v1.15.0" +spec: + group: tekton.dev + preserveUnknownFields: false + versions: + - name: v1beta1 + served: true + storage: false + schema: + openAPIV3Schema: + description: |- + Task + Deprecated: Please use v1.Task instead. + type: object + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: Spec + type: object + properties: + description: + description: Description + type: string + displayName: + description: DisplayName + type: string + params: + description: Params + type: array + items: + description: ParamSpec + type: object + required: + - name + properties: + default: + description: Default + x-kubernetes-preserve-unknown-fields: true + description: + description: Description + type: string + enum: + description: Enum + type: array + items: + type: string + name: + description: Name + type: string + properties: + description: Properties + type: object + additionalProperties: + description: PropertySpec + type: object + properties: + type: + description: ParamType + type: string + type: + description: Type + type: string + x-kubernetes-list-type: atomic + resources: + description: |- + Resources + Deprecated: Unused, preserved only for backwards compatibility + type: object + properties: + inputs: + description: Inputs + type: array + items: + description: |- + TaskResource + Deprecated: Unused, preserved only for backwards compatibility + type: object + required: + - name + - type + properties: + description: + description: |- + Description is a user-facing description of the declared resource that may be + used to populate a UI. + type: string + name: + description: |- + Name declares the name by which a resource is referenced in the + definition. Resources may be referenced by name in the definition of a + Task's steps. + type: string + optional: + description: |- + Optional declares the resource as optional. + By default optional is set to false which makes a resource required. + optional: true - the resource is considered optional + optional: false - the resource is considered required (equivalent of not specifying it) + type: boolean + targetPath: + description: |- + TargetPath is the path in workspace directory where the resource + will be copied. + type: string + type: + description: Type is the type of this resource; + type: string + x-kubernetes-list-type: atomic + outputs: + description: Outputs + type: array + items: + description: |- + TaskResource + Deprecated: Unused, preserved only for backwards compatibility + type: object + required: + - name + - type + properties: + description: + description: |- + Description is a user-facing description of the declared resource that may be + used to populate a UI. + type: string + name: + description: |- + Name declares the name by which a resource is referenced in the + definition. Resources may be referenced by name in the definition of a + Task's steps. + type: string + optional: + description: |- + Optional declares the resource as optional. + By default optional is set to false which makes a resource required. + optional: true - the resource is considered optional + optional: false - the resource is considered required (equivalent of not specifying it) + type: boolean + targetPath: + description: |- + TargetPath is the path in workspace directory where the resource + will be copied. + type: string + type: + description: Type is the type of this resource; + type: string + x-kubernetes-list-type: atomic + results: + description: Results + type: array + items: + description: TaskResult + type: object + required: + - name + properties: + description: + description: Description + type: string + name: + description: Name + type: string + properties: + description: Properties + type: object + additionalProperties: + description: PropertySpec + type: object + properties: + type: + description: ParamType + type: string + type: + description: Type + type: string + value: + description: Value + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + sidecars: + description: Sidecars + type: array + items: + description: Sidecar + type: object + required: + - name + properties: + args: + description: Args + type: array + items: + type: string + x-kubernetes-list-type: atomic + command: + description: Command + type: array + items: + type: string + x-kubernetes-list-type: atomic + env: + description: Env + type: array + items: + description: EnvVar represents an environment variable present + in a Container. + type: object + required: + - name + properties: + name: + description: |- + Name of the environment variable. + May consist of any printable ASCII characters except '='. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's value. + Cannot be used if value is not empty. + type: object + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + type: object + required: + - key + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap or + its key must be defined + type: boolean + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + type: object + required: + - fieldPath + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in + the specified API version. + type: string + x-kubernetes-map-type: atomic + fileKeyRef: + description: |- + FileKeyRef selects a key of the env file. + Requires the EnvFiles feature gate to be enabled. + type: object + required: + - key + - path + - volumeName + properties: + key: + description: |- + The key within the env file. An invalid key will prevent the pod from starting. + The keys defined within a source may consist of any printable ASCII characters except '='. + During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters. + type: string + optional: + description: |- + Specify whether the file or its key must be defined. If the file or key + does not exist, then the env var is not published. + If optional is set to true and the specified key does not exist, + the environment variable will not be set in the Pod's containers. + + If optional is set to false and the specified key does not exist, + an error will be returned during Pod creation. + type: boolean + default: false + path: + description: |- + The path within the volume from which to select the file. + Must be relative and may not contain the '..' path or start with '..'. + type: string + volumeName: + description: The name of the volume mount containing + the env file. + type: string + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + type: object + required: + - resource + properties: + containerName: + description: 'Container name: required for volumes, + optional for env vars' + type: string + divisor: + description: Specifies the output format of + the exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the pod's + namespace + type: object + required: + - key + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret or its + key must be defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + envFrom: + description: EnvFrom + type: array + items: + description: EnvFromSource represents the source of a set + of ConfigMaps or Secrets + type: object + properties: + configMapRef: + description: The ConfigMap to select from + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap must + be defined + type: boolean + x-kubernetes-map-type: atomic + prefix: + description: |- + Optional text to prepend to the name of each environment variable. + May consist of any printable ASCII characters except '='. + type: string + secretRef: + description: The Secret to select from + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret must be + defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + image: + description: Image + type: string + imagePullPolicy: + description: ImagePullPolicy + type: string + lifecycle: + description: Lifecycle + type: object + properties: + postStart: + description: |- + PostStart is called immediately after a container is created. If the handler fails, + the container is terminated and restarted according to its restart policy. + Other management of the container blocks until the hook completes. + More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks + type: object + properties: + exec: + description: Exec specifies a command to execute in + the container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + httpGet: + description: HTTPGet specifies an HTTP GET request + to perform. + type: object + required: + - port + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + sleep: + description: Sleep represents a duration that the + container should sleep. + type: object + required: + - seconds + properties: + seconds: + description: Seconds is the number of seconds + to sleep. + type: integer + format: int64 + tcpSocket: + description: |- + Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept + for backward compatibility. There is no validation of this field and + lifecycle hooks will fail at runtime when it is specified. + type: object + required: + - port + properties: + host: + description: 'Optional: Host name to connect to, + defaults to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + preStop: + description: |- + PreStop is called immediately before a container is terminated due to an + API request or management event such as liveness/startup probe failure, + preemption, resource contention, etc. The handler is not called if the + container crashes or exits. The Pod's termination grace period countdown begins before the + PreStop hook is executed. Regardless of the outcome of the handler, the + container will eventually terminate within the Pod's termination grace + period (unless delayed by finalizers). Other management of the container blocks until the hook completes + or until the termination grace period is reached. + More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks + type: object + properties: + exec: + description: Exec specifies a command to execute in + the container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + httpGet: + description: HTTPGet specifies an HTTP GET request + to perform. + type: object + required: + - port + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + sleep: + description: Sleep represents a duration that the + container should sleep. + type: object + required: + - seconds + properties: + seconds: + description: Seconds is the number of seconds + to sleep. + type: integer + format: int64 + tcpSocket: + description: |- + Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept + for backward compatibility. There is no validation of this field and + lifecycle hooks will fail at runtime when it is specified. + type: object + required: + - port + properties: + host: + description: 'Optional: Host name to connect to, + defaults to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + stopSignal: + description: |- + StopSignal defines which signal will be sent to a container when it is being stopped. + If not specified, the default is defined by the container runtime in use. + StopSignal can only be set for Pods with a non-empty .spec.os.name + type: string + livenessProbe: + description: LivenessProbe + type: object + properties: + exec: + description: Exec specifies a command to execute in the + container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + failureThreshold: + description: |- + Minimum consecutive failures for the probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. + type: integer + format: int32 + grpc: + description: GRPC specifies a GRPC HealthCheckRequest. + type: object + required: + - port + properties: + port: + description: Port number of the gRPC service. Number + must be in the range 1 to 65535. + type: integer + format: int32 + service: + description: |- + Service is the name of the service to place in the gRPC HealthCheckRequest + (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + + If this is not specified, the default behavior is defined by gRPC. + type: string + default: "" + httpGet: + description: HTTPGet specifies an HTTP GET request to + perform. + type: object + required: + - port + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + initialDelaySeconds: + description: |- + Number of seconds after the container has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + periodSeconds: + description: |- + How often (in seconds) to perform the probe. + Default to 10 seconds. Minimum value is 1. + type: integer + format: int32 + successThreshold: + description: |- + Minimum consecutive successes for the probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. + type: integer + format: int32 + tcpSocket: + description: TCPSocket specifies a connection to a TCP + port. + type: object + required: + - port + properties: + host: + description: 'Optional: Host name to connect to, defaults + to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + terminationGracePeriodSeconds: + description: |- + Optional duration in seconds the pod needs to terminate gracefully upon probe failure. + The grace period is the duration in seconds after the processes running in the pod are sent + a termination signal and the time when the processes are forcibly halted with a kill signal. + Set this value longer than the expected cleanup time for your process. + If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this + value overrides the value provided by the pod spec. + Value must be non-negative integer. The value zero indicates stop immediately via + the kill signal (no opportunity to shut down). + This is a beta field and requires enabling ProbeTerminationGracePeriod feature gate. + Minimum value is 1. spec.terminationGracePeriodSeconds is used if unset. + type: integer + format: int64 + timeoutSeconds: + description: |- + Number of seconds after which the probe times out. + Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + name: + description: Name + type: string + ports: + description: Ports + type: array + items: + description: ContainerPort represents a network port in + a single container. + type: object + required: + - containerPort + properties: + containerPort: + description: |- + Number of port to expose on the pod's IP address. + This must be a valid port number, 0 < x < 65536. + type: integer + format: int32 + hostIP: + description: What host IP to bind the external port + to. + type: string + hostPort: + description: |- + Number of port to expose on the host. + If specified, this must be a valid port number, 0 < x < 65536. + If HostNetwork is specified, this must match ContainerPort. + Most containers do not need this. + type: integer + format: int32 + name: + description: |- + If specified, this must be an IANA_SVC_NAME and unique within the pod. Each + named port in a pod must have a unique name. Name for the port that can be + referred to by services. + type: string + protocol: + description: |- + Protocol for port. Must be UDP, TCP, or SCTP. + Defaults to "TCP". + type: string + default: TCP + x-kubernetes-list-map-keys: + - containerPort + - protocol + x-kubernetes-list-type: map + readinessProbe: + description: ReadinessProbe + type: object + properties: + exec: + description: Exec specifies a command to execute in the + container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + failureThreshold: + description: |- + Minimum consecutive failures for the probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. + type: integer + format: int32 + grpc: + description: GRPC specifies a GRPC HealthCheckRequest. + type: object + required: + - port + properties: + port: + description: Port number of the gRPC service. Number + must be in the range 1 to 65535. + type: integer + format: int32 + service: + description: |- + Service is the name of the service to place in the gRPC HealthCheckRequest + (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + + If this is not specified, the default behavior is defined by gRPC. + type: string + default: "" + httpGet: + description: HTTPGet specifies an HTTP GET request to + perform. + type: object + required: + - port + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + initialDelaySeconds: + description: |- + Number of seconds after the container has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + periodSeconds: + description: |- + How often (in seconds) to perform the probe. + Default to 10 seconds. Minimum value is 1. + type: integer + format: int32 + successThreshold: + description: |- + Minimum consecutive successes for the probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. + type: integer + format: int32 + tcpSocket: + description: TCPSocket specifies a connection to a TCP + port. + type: object + required: + - port + properties: + host: + description: 'Optional: Host name to connect to, defaults + to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + terminationGracePeriodSeconds: + description: |- + Optional duration in seconds the pod needs to terminate gracefully upon probe failure. + The grace period is the duration in seconds after the processes running in the pod are sent + a termination signal and the time when the processes are forcibly halted with a kill signal. + Set this value longer than the expected cleanup time for your process. + If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this + value overrides the value provided by the pod spec. + Value must be non-negative integer. The value zero indicates stop immediately via + the kill signal (no opportunity to shut down). + This is a beta field and requires enabling ProbeTerminationGracePeriod feature gate. + Minimum value is 1. spec.terminationGracePeriodSeconds is used if unset. + type: integer + format: int64 + timeoutSeconds: + description: |- + Number of seconds after which the probe times out. + Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + resources: + description: Resources + type: object + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This field depends on the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + type: array + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + type: object + required: + - name + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + requests: + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + restartPolicy: + description: RestartPolicy + type: string + script: + description: Script + type: string + securityContext: + description: SecurityContext + type: object + properties: + allowPrivilegeEscalation: + description: |- + AllowPrivilegeEscalation controls whether a process can gain more + privileges than its parent process. This bool directly controls if + the no_new_privs flag will be set on the container process. + AllowPrivilegeEscalation is true always when the container is: + 1) run as Privileged + 2) has CAP_SYS_ADMIN + Note that this field cannot be set when spec.os.name is windows. + type: boolean + appArmorProfile: + description: |- + appArmorProfile is the AppArmor options to use by this container. If set, this profile + overrides the pod's appArmorProfile. + Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile loaded on the node that should be used. + The profile must be preconfigured on the node to work. + Must match the loaded name of the profile. + Must be set if and only if type is "Localhost". + type: string + type: + description: |- + type indicates which kind of AppArmor profile will be applied. + Valid options are: + Localhost - a profile pre-loaded on the node. + RuntimeDefault - the container runtime's default profile. + Unconfined - no AppArmor enforcement. + type: string + capabilities: + description: |- + The capabilities to add/drop when running containers. + Defaults to the default set of capabilities granted by the container runtime. + Note that this field cannot be set when spec.os.name is windows. + type: object + properties: + add: + description: Added capabilities + type: array + items: + description: Capability represent POSIX capabilities + type + type: string + x-kubernetes-list-type: atomic + drop: + description: Removed capabilities + type: array + items: + description: Capability represent POSIX capabilities + type + type: string + x-kubernetes-list-type: atomic + privileged: + description: |- + Run container in privileged mode. + Processes in privileged containers are essentially equivalent to root on the host. + Defaults to false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + procMount: + description: |- + procMount denotes the type of proc mount to use for the containers. + The default value is Default which uses the container runtime defaults for + readonly paths and masked paths. + This requires the ProcMountType feature flag to be enabled. + Note that this field cannot be set when spec.os.name is windows. + type: string + readOnlyRootFilesystem: + description: |- + Whether this container has a read-only root filesystem. + Default is false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + runAsGroup: + description: |- + The GID to run the entrypoint of the container process. + Uses runtime default if unset. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + runAsNonRoot: + description: |- + Indicates that the container must run as a non-root user. + If true, the Kubelet will validate the image at runtime to ensure that it + does not run as UID 0 (root) and fail to start the container if it does. + If unset or false, no such validation will be performed. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: boolean + runAsUser: + description: |- + The UID to run the entrypoint of the container process. + Defaults to user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + seLinuxOptions: + description: |- + The SELinux context to be applied to the container. + If unspecified, the container runtime will allocate a random SELinux context for each + container. May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: object + properties: + level: + description: Level is SELinux level label that applies + to the container. + type: string + role: + description: Role is a SELinux role label that applies + to the container. + type: string + type: + description: Type is a SELinux type label that applies + to the container. + type: string + user: + description: User is a SELinux user label that applies + to the container. + type: string + seccompProfile: + description: |- + The seccomp options to use by this container. If seccomp options are + provided at both the pod & container level, the container options + override the pod options. + Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile defined in a file on the node should be used. + The profile must be preconfigured on the node to work. + Must be a descending path, relative to the kubelet's configured seccomp profile location. + Must be set if type is "Localhost". Must NOT be set for any other type. + type: string + type: + description: |- + type indicates which kind of seccomp profile will be applied. + Valid options are: + + Localhost - a profile defined in a file on the node should be used. + RuntimeDefault - the container runtime default profile should be used. + Unconfined - no profile should be applied. + type: string + windowsOptions: + description: |- + The Windows specific settings applied to all containers. + If unspecified, the options from the PodSecurityContext will be used. + If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is linux. + type: object + properties: + gmsaCredentialSpec: + description: |- + GMSACredentialSpec is where the GMSA admission webhook + (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the + GMSA credential spec named by the GMSACredentialSpecName field. + type: string + gmsaCredentialSpecName: + description: GMSACredentialSpecName is the name of + the GMSA credential spec to use. + type: string + hostProcess: + description: |- + HostProcess determines if a container should be run as a 'Host Process' container. + All of a Pod's containers must have the same effective HostProcess value + (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers). + In addition, if HostProcess is true then HostNetwork must also be set to true. + type: boolean + runAsUserName: + description: |- + The UserName in Windows to run the entrypoint of the container process. + Defaults to the user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: string + startupProbe: + description: StartupProbe + type: object + properties: + exec: + description: Exec specifies a command to execute in the + container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + failureThreshold: + description: |- + Minimum consecutive failures for the probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. + type: integer + format: int32 + grpc: + description: GRPC specifies a GRPC HealthCheckRequest. + type: object + required: + - port + properties: + port: + description: Port number of the gRPC service. Number + must be in the range 1 to 65535. + type: integer + format: int32 + service: + description: |- + Service is the name of the service to place in the gRPC HealthCheckRequest + (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + + If this is not specified, the default behavior is defined by gRPC. + type: string + default: "" + httpGet: + description: HTTPGet specifies an HTTP GET request to + perform. + type: object + required: + - port + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + initialDelaySeconds: + description: |- + Number of seconds after the container has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + periodSeconds: + description: |- + How often (in seconds) to perform the probe. + Default to 10 seconds. Minimum value is 1. + type: integer + format: int32 + successThreshold: + description: |- + Minimum consecutive successes for the probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. + type: integer + format: int32 + tcpSocket: + description: TCPSocket specifies a connection to a TCP + port. + type: object + required: + - port + properties: + host: + description: 'Optional: Host name to connect to, defaults + to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + terminationGracePeriodSeconds: + description: |- + Optional duration in seconds the pod needs to terminate gracefully upon probe failure. + The grace period is the duration in seconds after the processes running in the pod are sent + a termination signal and the time when the processes are forcibly halted with a kill signal. + Set this value longer than the expected cleanup time for your process. + If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this + value overrides the value provided by the pod spec. + Value must be non-negative integer. The value zero indicates stop immediately via + the kill signal (no opportunity to shut down). + This is a beta field and requires enabling ProbeTerminationGracePeriod feature gate. + Minimum value is 1. spec.terminationGracePeriodSeconds is used if unset. + type: integer + format: int64 + timeoutSeconds: + description: |- + Number of seconds after which the probe times out. + Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + stdin: + description: Stdin + type: boolean + stdinOnce: + description: StdinOnce + type: boolean + terminationMessagePath: + description: TerminationMessagePath + type: string + terminationMessagePolicy: + description: TerminationMessagePolicy + type: string + tty: + description: TTY + type: boolean + volumeDevices: + description: VolumeDevices + type: array + items: + description: volumeDevice describes a mapping of a raw block + device within a container. + type: object + required: + - devicePath + - name + properties: + devicePath: + description: devicePath is the path inside of the container + that the device will be mapped to. + type: string + name: + description: name must match the name of a persistentVolumeClaim + in the pod + type: string + x-kubernetes-list-type: atomic + volumeMounts: + description: VolumeMounts + type: array + items: + description: VolumeMount describes a mounting of a Volume + within a container. + type: object + required: + - mountPath + - name + properties: + mountPath: + description: |- + Path within the container at which the volume should be mounted. Must + not contain ':'. + type: string + mountPropagation: + description: |- + mountPropagation determines how mounts are propagated from the host + to container and the other way around. + When not set, MountPropagationNone is used. + This field is beta in 1.10. + When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified + (which defaults to None). + type: string + name: + description: This must match the Name of a Volume. + type: string + readOnly: + description: |- + Mounted read-only if true, read-write otherwise (false or unspecified). + Defaults to false. + type: boolean + recursiveReadOnly: + description: |- + RecursiveReadOnly specifies whether read-only mounts should be handled + recursively. + + If ReadOnly is false, this field has no meaning and must be unspecified. + + If ReadOnly is true, and this field is set to Disabled, the mount is not made + recursively read-only. If this field is set to IfPossible, the mount is made + recursively read-only, if it is supported by the container runtime. If this + field is set to Enabled, the mount is made recursively read-only if it is + supported by the container runtime, otherwise the pod will not be started and + an error will be generated to indicate the reason. + + If this field is set to IfPossible or Enabled, MountPropagation must be set to + None (or be unspecified, which defaults to None). + + If this field is not specified, it is treated as an equivalent of Disabled. + type: string + subPath: + description: |- + Path within the volume from which the container's volume should be mounted. + Defaults to "" (volume's root). + type: string + subPathExpr: + description: |- + Expanded path within the volume from which the container's volume should be mounted. + Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment. + Defaults to "" (volume's root). + SubPathExpr and SubPath are mutually exclusive. + type: string + x-kubernetes-list-type: atomic + workingDir: + description: WorkingDir + type: string + workspaces: + description: Workspaces + type: array + items: + description: WorkspaceUsage + type: object + required: + - mountPath + - name + properties: + mountPath: + description: MountPath + type: string + name: + description: Name + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + stepTemplate: + description: StepTemplate + type: object + properties: + args: + description: Args + type: array + items: + type: string + x-kubernetes-list-type: atomic + command: + description: Command + type: array + items: + type: string + x-kubernetes-list-type: atomic + env: + description: Env + type: array + items: + description: EnvVar represents an environment variable present + in a Container. + type: object + required: + - name + properties: + name: + description: |- + Name of the environment variable. + May consist of any printable ASCII characters except '='. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's value. + Cannot be used if value is not empty. + type: object + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + type: object + required: + - key + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap or + its key must be defined + type: boolean + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + type: object + required: + - fieldPath + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in the + specified API version. + type: string + x-kubernetes-map-type: atomic + fileKeyRef: + description: |- + FileKeyRef selects a key of the env file. + Requires the EnvFiles feature gate to be enabled. + type: object + required: + - key + - path + - volumeName + properties: + key: + description: |- + The key within the env file. An invalid key will prevent the pod from starting. + The keys defined within a source may consist of any printable ASCII characters except '='. + During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters. + type: string + optional: + description: |- + Specify whether the file or its key must be defined. If the file or key + does not exist, then the env var is not published. + If optional is set to true and the specified key does not exist, + the environment variable will not be set in the Pod's containers. + + If optional is set to false and the specified key does not exist, + an error will be returned during Pod creation. + type: boolean + default: false + path: + description: |- + The path within the volume from which to select the file. + Must be relative and may not contain the '..' path or start with '..'. + type: string + volumeName: + description: The name of the volume mount containing + the env file. + type: string + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + type: object + required: + - resource + properties: + containerName: + description: 'Container name: required for volumes, + optional for env vars' + type: string + divisor: + description: Specifies the output format of the + exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the pod's + namespace + type: object + required: + - key + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret or its + key must be defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + envFrom: + description: EnvFrom + type: array + items: + description: EnvFromSource represents the source of a set + of ConfigMaps or Secrets + type: object + properties: + configMapRef: + description: The ConfigMap to select from + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap must be + defined + type: boolean + x-kubernetes-map-type: atomic + prefix: + description: |- + Optional text to prepend to the name of each environment variable. + May consist of any printable ASCII characters except '='. + type: string + secretRef: + description: The Secret to select from + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret must be defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + image: + description: Image + type: string + imagePullPolicy: + description: ImagePullPolicy + type: string + lifecycle: + description: |- + Deprecated: This field will be removed in a future release. + DeprecatedLifecycle + type: object + properties: + postStart: + description: |- + PostStart is called immediately after a container is created. If the handler fails, + the container is terminated and restarted according to its restart policy. + Other management of the container blocks until the hook completes. + More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks + type: object + properties: + exec: + description: Exec specifies a command to execute in + the container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + httpGet: + description: HTTPGet specifies an HTTP GET request to + perform. + type: object + required: + - port + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + sleep: + description: Sleep represents a duration that the container + should sleep. + type: object + required: + - seconds + properties: + seconds: + description: Seconds is the number of seconds to + sleep. + type: integer + format: int64 + tcpSocket: + description: |- + Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept + for backward compatibility. There is no validation of this field and + lifecycle hooks will fail at runtime when it is specified. + type: object + required: + - port + properties: + host: + description: 'Optional: Host name to connect to, + defaults to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + preStop: + description: |- + PreStop is called immediately before a container is terminated due to an + API request or management event such as liveness/startup probe failure, + preemption, resource contention, etc. The handler is not called if the + container crashes or exits. The Pod's termination grace period countdown begins before the + PreStop hook is executed. Regardless of the outcome of the handler, the + container will eventually terminate within the Pod's termination grace + period (unless delayed by finalizers). Other management of the container blocks until the hook completes + or until the termination grace period is reached. + More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks + type: object + properties: + exec: + description: Exec specifies a command to execute in + the container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + httpGet: + description: HTTPGet specifies an HTTP GET request to + perform. + type: object + required: + - port + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + sleep: + description: Sleep represents a duration that the container + should sleep. + type: object + required: + - seconds + properties: + seconds: + description: Seconds is the number of seconds to + sleep. + type: integer + format: int64 + tcpSocket: + description: |- + Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept + for backward compatibility. There is no validation of this field and + lifecycle hooks will fail at runtime when it is specified. + type: object + required: + - port + properties: + host: + description: 'Optional: Host name to connect to, + defaults to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + stopSignal: + description: |- + StopSignal defines which signal will be sent to a container when it is being stopped. + If not specified, the default is defined by the container runtime in use. + StopSignal can only be set for Pods with a non-empty .spec.os.name + type: string + livenessProbe: + description: |- + Deprecated: This field will be removed in a future release. + DeprecatedLivenessProbe + type: object + properties: + exec: + description: Exec specifies a command to execute in the + container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + failureThreshold: + description: |- + Minimum consecutive failures for the probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. + type: integer + format: int32 + grpc: + description: GRPC specifies a GRPC HealthCheckRequest. + type: object + required: + - port + properties: + port: + description: Port number of the gRPC service. Number + must be in the range 1 to 65535. + type: integer + format: int32 + service: + description: |- + Service is the name of the service to place in the gRPC HealthCheckRequest + (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + + If this is not specified, the default behavior is defined by gRPC. + type: string + default: "" + httpGet: + description: HTTPGet specifies an HTTP GET request to perform. + type: object + required: + - port + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. HTTP + allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + initialDelaySeconds: + description: |- + Number of seconds after the container has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + periodSeconds: + description: |- + How often (in seconds) to perform the probe. + Default to 10 seconds. Minimum value is 1. + type: integer + format: int32 + successThreshold: + description: |- + Minimum consecutive successes for the probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. + type: integer + format: int32 + tcpSocket: + description: TCPSocket specifies a connection to a TCP port. + type: object + required: + - port + properties: + host: + description: 'Optional: Host name to connect to, defaults + to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + terminationGracePeriodSeconds: + description: |- + Optional duration in seconds the pod needs to terminate gracefully upon probe failure. + The grace period is the duration in seconds after the processes running in the pod are sent + a termination signal and the time when the processes are forcibly halted with a kill signal. + Set this value longer than the expected cleanup time for your process. + If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this + value overrides the value provided by the pod spec. + Value must be non-negative integer. The value zero indicates stop immediately via + the kill signal (no opportunity to shut down). + This is a beta field and requires enabling ProbeTerminationGracePeriod feature gate. + Minimum value is 1. spec.terminationGracePeriodSeconds is used if unset. + type: integer + format: int64 + timeoutSeconds: + description: |- + Number of seconds after which the probe times out. + Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + name: + description: |- + Deprecated: This field will be removed in a future release. + DeprecatedName + type: string + ports: + description: |- + Deprecated: This field will be removed in a future release. + DeprecatedPorts + type: array + items: + description: ContainerPort represents a network port in a + single container. + type: object + required: + - containerPort + properties: + containerPort: + description: |- + Number of port to expose on the pod's IP address. + This must be a valid port number, 0 < x < 65536. + type: integer + format: int32 + hostIP: + description: What host IP to bind the external port to. + type: string + hostPort: + description: |- + Number of port to expose on the host. + If specified, this must be a valid port number, 0 < x < 65536. + If HostNetwork is specified, this must match ContainerPort. + Most containers do not need this. + type: integer + format: int32 + name: + description: |- + If specified, this must be an IANA_SVC_NAME and unique within the pod. Each + named port in a pod must have a unique name. Name for the port that can be + referred to by services. + type: string + protocol: + description: |- + Protocol for port. Must be UDP, TCP, or SCTP. + Defaults to "TCP". + type: string + default: TCP + x-kubernetes-list-map-keys: + - containerPort + - protocol + x-kubernetes-list-type: map + readinessProbe: + description: |- + Deprecated: This field will be removed in a future release. + DeprecatedReadinessProbe + type: object + properties: + exec: + description: Exec specifies a command to execute in the + container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + failureThreshold: + description: |- + Minimum consecutive failures for the probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. + type: integer + format: int32 + grpc: + description: GRPC specifies a GRPC HealthCheckRequest. + type: object + required: + - port + properties: + port: + description: Port number of the gRPC service. Number + must be in the range 1 to 65535. + type: integer + format: int32 + service: + description: |- + Service is the name of the service to place in the gRPC HealthCheckRequest + (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + + If this is not specified, the default behavior is defined by gRPC. + type: string + default: "" + httpGet: + description: HTTPGet specifies an HTTP GET request to perform. + type: object + required: + - port + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. HTTP + allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + initialDelaySeconds: + description: |- + Number of seconds after the container has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + periodSeconds: + description: |- + How often (in seconds) to perform the probe. + Default to 10 seconds. Minimum value is 1. + type: integer + format: int32 + successThreshold: + description: |- + Minimum consecutive successes for the probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. + type: integer + format: int32 + tcpSocket: + description: TCPSocket specifies a connection to a TCP port. + type: object + required: + - port + properties: + host: + description: 'Optional: Host name to connect to, defaults + to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + terminationGracePeriodSeconds: + description: |- + Optional duration in seconds the pod needs to terminate gracefully upon probe failure. + The grace period is the duration in seconds after the processes running in the pod are sent + a termination signal and the time when the processes are forcibly halted with a kill signal. + Set this value longer than the expected cleanup time for your process. + If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this + value overrides the value provided by the pod spec. + Value must be non-negative integer. The value zero indicates stop immediately via + the kill signal (no opportunity to shut down). + This is a beta field and requires enabling ProbeTerminationGracePeriod feature gate. + Minimum value is 1. spec.terminationGracePeriodSeconds is used if unset. + type: integer + format: int64 + timeoutSeconds: + description: |- + Number of seconds after which the probe times out. + Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + resources: + description: Resources + type: object + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This field depends on the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + type: array + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + type: object + required: + - name + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + requests: + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + securityContext: + description: SecurityContext + type: object + properties: + allowPrivilegeEscalation: + description: |- + AllowPrivilegeEscalation controls whether a process can gain more + privileges than its parent process. This bool directly controls if + the no_new_privs flag will be set on the container process. + AllowPrivilegeEscalation is true always when the container is: + 1) run as Privileged + 2) has CAP_SYS_ADMIN + Note that this field cannot be set when spec.os.name is windows. + type: boolean + appArmorProfile: + description: |- + appArmorProfile is the AppArmor options to use by this container. If set, this profile + overrides the pod's appArmorProfile. + Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile loaded on the node that should be used. + The profile must be preconfigured on the node to work. + Must match the loaded name of the profile. + Must be set if and only if type is "Localhost". + type: string + type: + description: |- + type indicates which kind of AppArmor profile will be applied. + Valid options are: + Localhost - a profile pre-loaded on the node. + RuntimeDefault - the container runtime's default profile. + Unconfined - no AppArmor enforcement. + type: string + capabilities: + description: |- + The capabilities to add/drop when running containers. + Defaults to the default set of capabilities granted by the container runtime. + Note that this field cannot be set when spec.os.name is windows. + type: object + properties: + add: + description: Added capabilities + type: array + items: + description: Capability represent POSIX capabilities + type + type: string + x-kubernetes-list-type: atomic + drop: + description: Removed capabilities + type: array + items: + description: Capability represent POSIX capabilities + type + type: string + x-kubernetes-list-type: atomic + privileged: + description: |- + Run container in privileged mode. + Processes in privileged containers are essentially equivalent to root on the host. + Defaults to false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + procMount: + description: |- + procMount denotes the type of proc mount to use for the containers. + The default value is Default which uses the container runtime defaults for + readonly paths and masked paths. + This requires the ProcMountType feature flag to be enabled. + Note that this field cannot be set when spec.os.name is windows. + type: string + readOnlyRootFilesystem: + description: |- + Whether this container has a read-only root filesystem. + Default is false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + runAsGroup: + description: |- + The GID to run the entrypoint of the container process. + Uses runtime default if unset. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + runAsNonRoot: + description: |- + Indicates that the container must run as a non-root user. + If true, the Kubelet will validate the image at runtime to ensure that it + does not run as UID 0 (root) and fail to start the container if it does. + If unset or false, no such validation will be performed. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: boolean + runAsUser: + description: |- + The UID to run the entrypoint of the container process. + Defaults to user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + seLinuxOptions: + description: |- + The SELinux context to be applied to the container. + If unspecified, the container runtime will allocate a random SELinux context for each + container. May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: object + properties: + level: + description: Level is SELinux level label that applies + to the container. + type: string + role: + description: Role is a SELinux role label that applies + to the container. + type: string + type: + description: Type is a SELinux type label that applies + to the container. + type: string + user: + description: User is a SELinux user label that applies + to the container. + type: string + seccompProfile: + description: |- + The seccomp options to use by this container. If seccomp options are + provided at both the pod & container level, the container options + override the pod options. + Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile defined in a file on the node should be used. + The profile must be preconfigured on the node to work. + Must be a descending path, relative to the kubelet's configured seccomp profile location. + Must be set if type is "Localhost". Must NOT be set for any other type. + type: string + type: + description: |- + type indicates which kind of seccomp profile will be applied. + Valid options are: + + Localhost - a profile defined in a file on the node should be used. + RuntimeDefault - the container runtime default profile should be used. + Unconfined - no profile should be applied. + type: string + windowsOptions: + description: |- + The Windows specific settings applied to all containers. + If unspecified, the options from the PodSecurityContext will be used. + If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is linux. + type: object + properties: + gmsaCredentialSpec: + description: |- + GMSACredentialSpec is where the GMSA admission webhook + (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the + GMSA credential spec named by the GMSACredentialSpecName field. + type: string + gmsaCredentialSpecName: + description: GMSACredentialSpecName is the name of the + GMSA credential spec to use. + type: string + hostProcess: + description: |- + HostProcess determines if a container should be run as a 'Host Process' container. + All of a Pod's containers must have the same effective HostProcess value + (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers). + In addition, if HostProcess is true then HostNetwork must also be set to true. + type: boolean + runAsUserName: + description: |- + The UserName in Windows to run the entrypoint of the container process. + Defaults to the user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: string + startupProbe: + description: |- + Deprecated: This field will be removed in a future release. + DeprecatedStartupProbe + type: object + properties: + exec: + description: Exec specifies a command to execute in the + container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + failureThreshold: + description: |- + Minimum consecutive failures for the probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. + type: integer + format: int32 + grpc: + description: GRPC specifies a GRPC HealthCheckRequest. + type: object + required: + - port + properties: + port: + description: Port number of the gRPC service. Number + must be in the range 1 to 65535. + type: integer + format: int32 + service: + description: |- + Service is the name of the service to place in the gRPC HealthCheckRequest + (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + + If this is not specified, the default behavior is defined by gRPC. + type: string + default: "" + httpGet: + description: HTTPGet specifies an HTTP GET request to perform. + type: object + required: + - port + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. HTTP + allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + initialDelaySeconds: + description: |- + Number of seconds after the container has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + periodSeconds: + description: |- + How often (in seconds) to perform the probe. + Default to 10 seconds. Minimum value is 1. + type: integer + format: int32 + successThreshold: + description: |- + Minimum consecutive successes for the probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. + type: integer + format: int32 + tcpSocket: + description: TCPSocket specifies a connection to a TCP port. + type: object + required: + - port + properties: + host: + description: 'Optional: Host name to connect to, defaults + to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + terminationGracePeriodSeconds: + description: |- + Optional duration in seconds the pod needs to terminate gracefully upon probe failure. + The grace period is the duration in seconds after the processes running in the pod are sent + a termination signal and the time when the processes are forcibly halted with a kill signal. + Set this value longer than the expected cleanup time for your process. + If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this + value overrides the value provided by the pod spec. + Value must be non-negative integer. The value zero indicates stop immediately via + the kill signal (no opportunity to shut down). + This is a beta field and requires enabling ProbeTerminationGracePeriod feature gate. + Minimum value is 1. spec.terminationGracePeriodSeconds is used if unset. + type: integer + format: int64 + timeoutSeconds: + description: |- + Number of seconds after which the probe times out. + Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + stdin: + description: |- + Deprecated: This field will be removed in a future release. + DeprecatedStdin + type: boolean + stdinOnce: + description: |- + Deprecated: This field will be removed in a future release. + DeprecatedStdinOnce + type: boolean + terminationMessagePath: + description: |- + DeprecatedTerminationMessagePath + Deprecated: This field will be removed in a future release and cannot be meaningfully used. + type: string + terminationMessagePolicy: + description: |- + DeprecatedTerminationMessagePolicy + Deprecated: This field will be removed in a future release and cannot be meaningfully used. + type: string + tty: + description: |- + Deprecated: This field will be removed in a future release. + DeprecatedTTY + type: boolean + volumeDevices: + description: VolumeDevices + type: array + items: + description: volumeDevice describes a mapping of a raw block + device within a container. + type: object + required: + - devicePath + - name + properties: + devicePath: + description: devicePath is the path inside of the container + that the device will be mapped to. + type: string + name: + description: name must match the name of a persistentVolumeClaim + in the pod + type: string + x-kubernetes-list-type: atomic + volumeMounts: + description: VolumeMounts + type: array + items: + description: VolumeMount describes a mounting of a Volume + within a container. + type: object + required: + - mountPath + - name + properties: + mountPath: + description: |- + Path within the container at which the volume should be mounted. Must + not contain ':'. + type: string + mountPropagation: + description: |- + mountPropagation determines how mounts are propagated from the host + to container and the other way around. + When not set, MountPropagationNone is used. + This field is beta in 1.10. + When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified + (which defaults to None). + type: string + name: + description: This must match the Name of a Volume. + type: string + readOnly: + description: |- + Mounted read-only if true, read-write otherwise (false or unspecified). + Defaults to false. + type: boolean + recursiveReadOnly: + description: |- + RecursiveReadOnly specifies whether read-only mounts should be handled + recursively. + + If ReadOnly is false, this field has no meaning and must be unspecified. + + If ReadOnly is true, and this field is set to Disabled, the mount is not made + recursively read-only. If this field is set to IfPossible, the mount is made + recursively read-only, if it is supported by the container runtime. If this + field is set to Enabled, the mount is made recursively read-only if it is + supported by the container runtime, otherwise the pod will not be started and + an error will be generated to indicate the reason. + + If this field is set to IfPossible or Enabled, MountPropagation must be set to + None (or be unspecified, which defaults to None). + + If this field is not specified, it is treated as an equivalent of Disabled. + type: string + subPath: + description: |- + Path within the volume from which the container's volume should be mounted. + Defaults to "" (volume's root). + type: string + subPathExpr: + description: |- + Expanded path within the volume from which the container's volume should be mounted. + Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment. + Defaults to "" (volume's root). + SubPathExpr and SubPath are mutually exclusive. + type: string + x-kubernetes-list-type: atomic + workingDir: + description: WorkingDir + type: string + steps: + description: Steps + type: array + items: + description: Step + type: object + required: + - name + properties: + args: + description: Args + type: array + items: + type: string + x-kubernetes-list-type: atomic + command: + description: Command + type: array + items: + type: string + x-kubernetes-list-type: atomic + displayName: + description: DisplayName + type: string + env: + description: Env + type: array + items: + description: EnvVar represents an environment variable present + in a Container. + type: object + required: + - name + properties: + name: + description: |- + Name of the environment variable. + May consist of any printable ASCII characters except '='. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's value. + Cannot be used if value is not empty. + type: object + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + type: object + required: + - key + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap or + its key must be defined + type: boolean + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + type: object + required: + - fieldPath + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in + the specified API version. + type: string + x-kubernetes-map-type: atomic + fileKeyRef: + description: |- + FileKeyRef selects a key of the env file. + Requires the EnvFiles feature gate to be enabled. + type: object + required: + - key + - path + - volumeName + properties: + key: + description: |- + The key within the env file. An invalid key will prevent the pod from starting. + The keys defined within a source may consist of any printable ASCII characters except '='. + During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters. + type: string + optional: + description: |- + Specify whether the file or its key must be defined. If the file or key + does not exist, then the env var is not published. + If optional is set to true and the specified key does not exist, + the environment variable will not be set in the Pod's containers. + + If optional is set to false and the specified key does not exist, + an error will be returned during Pod creation. + type: boolean + default: false + path: + description: |- + The path within the volume from which to select the file. + Must be relative and may not contain the '..' path or start with '..'. + type: string + volumeName: + description: The name of the volume mount containing + the env file. + type: string + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + type: object + required: + - resource + properties: + containerName: + description: 'Container name: required for volumes, + optional for env vars' + type: string + divisor: + description: Specifies the output format of + the exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the pod's + namespace + type: object + required: + - key + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret or its + key must be defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + envFrom: + description: EnvFrom + type: array + items: + description: EnvFromSource represents the source of a set + of ConfigMaps or Secrets + type: object + properties: + configMapRef: + description: The ConfigMap to select from + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap must + be defined + type: boolean + x-kubernetes-map-type: atomic + prefix: + description: |- + Optional text to prepend to the name of each environment variable. + May consist of any printable ASCII characters except '='. + type: string + secretRef: + description: The Secret to select from + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret must be + defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + image: + description: Image + type: string + imagePullPolicy: + description: ImagePullPolicy + type: string + lifecycle: + description: |- + Deprecated: This field will be removed in a future release. + DeprecatedLifecycle + type: object + properties: + postStart: + description: |- + PostStart is called immediately after a container is created. If the handler fails, + the container is terminated and restarted according to its restart policy. + Other management of the container blocks until the hook completes. + More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks + type: object + properties: + exec: + description: Exec specifies a command to execute in + the container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + httpGet: + description: HTTPGet specifies an HTTP GET request + to perform. + type: object + required: + - port + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + sleep: + description: Sleep represents a duration that the + container should sleep. + type: object + required: + - seconds + properties: + seconds: + description: Seconds is the number of seconds + to sleep. + type: integer + format: int64 + tcpSocket: + description: |- + Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept + for backward compatibility. There is no validation of this field and + lifecycle hooks will fail at runtime when it is specified. + type: object + required: + - port + properties: + host: + description: 'Optional: Host name to connect to, + defaults to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + preStop: + description: |- + PreStop is called immediately before a container is terminated due to an + API request or management event such as liveness/startup probe failure, + preemption, resource contention, etc. The handler is not called if the + container crashes or exits. The Pod's termination grace period countdown begins before the + PreStop hook is executed. Regardless of the outcome of the handler, the + container will eventually terminate within the Pod's termination grace + period (unless delayed by finalizers). Other management of the container blocks until the hook completes + or until the termination grace period is reached. + More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks + type: object + properties: + exec: + description: Exec specifies a command to execute in + the container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + httpGet: + description: HTTPGet specifies an HTTP GET request + to perform. + type: object + required: + - port + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + sleep: + description: Sleep represents a duration that the + container should sleep. + type: object + required: + - seconds + properties: + seconds: + description: Seconds is the number of seconds + to sleep. + type: integer + format: int64 + tcpSocket: + description: |- + Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept + for backward compatibility. There is no validation of this field and + lifecycle hooks will fail at runtime when it is specified. + type: object + required: + - port + properties: + host: + description: 'Optional: Host name to connect to, + defaults to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + stopSignal: + description: |- + StopSignal defines which signal will be sent to a container when it is being stopped. + If not specified, the default is defined by the container runtime in use. + StopSignal can only be set for Pods with a non-empty .spec.os.name + type: string + livenessProbe: + description: |- + Deprecated: This field will be removed in a future release. + DeprecatedLivenessProbe + type: object + properties: + exec: + description: Exec specifies a command to execute in the + container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + failureThreshold: + description: |- + Minimum consecutive failures for the probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. + type: integer + format: int32 + grpc: + description: GRPC specifies a GRPC HealthCheckRequest. + type: object + required: + - port + properties: + port: + description: Port number of the gRPC service. Number + must be in the range 1 to 65535. + type: integer + format: int32 + service: + description: |- + Service is the name of the service to place in the gRPC HealthCheckRequest + (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + + If this is not specified, the default behavior is defined by gRPC. + type: string + default: "" + httpGet: + description: HTTPGet specifies an HTTP GET request to + perform. + type: object + required: + - port + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + initialDelaySeconds: + description: |- + Number of seconds after the container has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + periodSeconds: + description: |- + How often (in seconds) to perform the probe. + Default to 10 seconds. Minimum value is 1. + type: integer + format: int32 + successThreshold: + description: |- + Minimum consecutive successes for the probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. + type: integer + format: int32 + tcpSocket: + description: TCPSocket specifies a connection to a TCP + port. + type: object + required: + - port + properties: + host: + description: 'Optional: Host name to connect to, defaults + to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + terminationGracePeriodSeconds: + description: |- + Optional duration in seconds the pod needs to terminate gracefully upon probe failure. + The grace period is the duration in seconds after the processes running in the pod are sent + a termination signal and the time when the processes are forcibly halted with a kill signal. + Set this value longer than the expected cleanup time for your process. + If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this + value overrides the value provided by the pod spec. + Value must be non-negative integer. The value zero indicates stop immediately via + the kill signal (no opportunity to shut down). + This is a beta field and requires enabling ProbeTerminationGracePeriod feature gate. + Minimum value is 1. spec.terminationGracePeriodSeconds is used if unset. + type: integer + format: int64 + timeoutSeconds: + description: |- + Number of seconds after which the probe times out. + Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + name: + description: Name + type: string + onError: + description: OnError + type: string + params: + description: Params + type: array + items: + description: Param + type: object + required: + - name + - value + properties: + name: + type: string + value: + description: Value + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + ports: + description: |- + Deprecated: This field will be removed in a future release. + DeprecatedPorts + type: array + items: + description: ContainerPort represents a network port in + a single container. + type: object + required: + - containerPort + properties: + containerPort: + description: |- + Number of port to expose on the pod's IP address. + This must be a valid port number, 0 < x < 65536. + type: integer + format: int32 + hostIP: + description: What host IP to bind the external port + to. + type: string + hostPort: + description: |- + Number of port to expose on the host. + If specified, this must be a valid port number, 0 < x < 65536. + If HostNetwork is specified, this must match ContainerPort. + Most containers do not need this. + type: integer + format: int32 + name: + description: |- + If specified, this must be an IANA_SVC_NAME and unique within the pod. Each + named port in a pod must have a unique name. Name for the port that can be + referred to by services. + type: string + protocol: + description: |- + Protocol for port. Must be UDP, TCP, or SCTP. + Defaults to "TCP". + type: string + default: TCP + x-kubernetes-list-map-keys: + - containerPort + - protocol + x-kubernetes-list-type: map + readinessProbe: + description: |- + Deprecated: This field will be removed in a future release. + DeprecatedReadinessProbe + type: object + properties: + exec: + description: Exec specifies a command to execute in the + container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + failureThreshold: + description: |- + Minimum consecutive failures for the probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. + type: integer + format: int32 + grpc: + description: GRPC specifies a GRPC HealthCheckRequest. + type: object + required: + - port + properties: + port: + description: Port number of the gRPC service. Number + must be in the range 1 to 65535. + type: integer + format: int32 + service: + description: |- + Service is the name of the service to place in the gRPC HealthCheckRequest + (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + + If this is not specified, the default behavior is defined by gRPC. + type: string + default: "" + httpGet: + description: HTTPGet specifies an HTTP GET request to + perform. + type: object + required: + - port + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + initialDelaySeconds: + description: |- + Number of seconds after the container has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + periodSeconds: + description: |- + How often (in seconds) to perform the probe. + Default to 10 seconds. Minimum value is 1. + type: integer + format: int32 + successThreshold: + description: |- + Minimum consecutive successes for the probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. + type: integer + format: int32 + tcpSocket: + description: TCPSocket specifies a connection to a TCP + port. + type: object + required: + - port + properties: + host: + description: 'Optional: Host name to connect to, defaults + to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + terminationGracePeriodSeconds: + description: |- + Optional duration in seconds the pod needs to terminate gracefully upon probe failure. + The grace period is the duration in seconds after the processes running in the pod are sent + a termination signal and the time when the processes are forcibly halted with a kill signal. + Set this value longer than the expected cleanup time for your process. + If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this + value overrides the value provided by the pod spec. + Value must be non-negative integer. The value zero indicates stop immediately via + the kill signal (no opportunity to shut down). + This is a beta field and requires enabling ProbeTerminationGracePeriod feature gate. + Minimum value is 1. spec.terminationGracePeriodSeconds is used if unset. + type: integer + format: int64 + timeoutSeconds: + description: |- + Number of seconds after which the probe times out. + Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + ref: + description: Ref + type: object + properties: + name: + description: Name + type: string + params: + description: Params + type: array + items: + description: Param + type: object + required: + - name + - value + properties: + name: + type: string + value: + description: Value + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + resolver: + description: Resolver + type: string + resources: + description: Resources + type: object + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This field depends on the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + type: array + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + type: object + required: + - name + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + requests: + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + results: + description: Results + type: array + items: + description: StepResult used to describe the Results of + a Step. + type: object + required: + - name + properties: + description: + description: Description is a human-readable description + of the result + type: string + name: + description: Name the given name + type: string + properties: + description: Properties is the JSON Schema properties + to support key-value pairs results. + type: object + additionalProperties: + description: PropertySpec defines the struct for object + keys + type: object + properties: + type: + description: |- + ParamType indicates the type of an input parameter; + Used to distinguish between a single string and an array of strings. + type: string + type: + description: The possible types are 'string', 'array', + and 'object', with 'string' as the default. + type: string + x-kubernetes-list-type: atomic + script: + description: Script + type: string + securityContext: + description: SecurityContext + type: object + properties: + allowPrivilegeEscalation: + description: |- + AllowPrivilegeEscalation controls whether a process can gain more + privileges than its parent process. This bool directly controls if + the no_new_privs flag will be set on the container process. + AllowPrivilegeEscalation is true always when the container is: + 1) run as Privileged + 2) has CAP_SYS_ADMIN + Note that this field cannot be set when spec.os.name is windows. + type: boolean + appArmorProfile: + description: |- + appArmorProfile is the AppArmor options to use by this container. If set, this profile + overrides the pod's appArmorProfile. + Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile loaded on the node that should be used. + The profile must be preconfigured on the node to work. + Must match the loaded name of the profile. + Must be set if and only if type is "Localhost". + type: string + type: + description: |- + type indicates which kind of AppArmor profile will be applied. + Valid options are: + Localhost - a profile pre-loaded on the node. + RuntimeDefault - the container runtime's default profile. + Unconfined - no AppArmor enforcement. + type: string + capabilities: + description: |- + The capabilities to add/drop when running containers. + Defaults to the default set of capabilities granted by the container runtime. + Note that this field cannot be set when spec.os.name is windows. + type: object + properties: + add: + description: Added capabilities + type: array + items: + description: Capability represent POSIX capabilities + type + type: string + x-kubernetes-list-type: atomic + drop: + description: Removed capabilities + type: array + items: + description: Capability represent POSIX capabilities + type + type: string + x-kubernetes-list-type: atomic + privileged: + description: |- + Run container in privileged mode. + Processes in privileged containers are essentially equivalent to root on the host. + Defaults to false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + procMount: + description: |- + procMount denotes the type of proc mount to use for the containers. + The default value is Default which uses the container runtime defaults for + readonly paths and masked paths. + This requires the ProcMountType feature flag to be enabled. + Note that this field cannot be set when spec.os.name is windows. + type: string + readOnlyRootFilesystem: + description: |- + Whether this container has a read-only root filesystem. + Default is false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + runAsGroup: + description: |- + The GID to run the entrypoint of the container process. + Uses runtime default if unset. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + runAsNonRoot: + description: |- + Indicates that the container must run as a non-root user. + If true, the Kubelet will validate the image at runtime to ensure that it + does not run as UID 0 (root) and fail to start the container if it does. + If unset or false, no such validation will be performed. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: boolean + runAsUser: + description: |- + The UID to run the entrypoint of the container process. + Defaults to user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + seLinuxOptions: + description: |- + The SELinux context to be applied to the container. + If unspecified, the container runtime will allocate a random SELinux context for each + container. May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: object + properties: + level: + description: Level is SELinux level label that applies + to the container. + type: string + role: + description: Role is a SELinux role label that applies + to the container. + type: string + type: + description: Type is a SELinux type label that applies + to the container. + type: string + user: + description: User is a SELinux user label that applies + to the container. + type: string + seccompProfile: + description: |- + The seccomp options to use by this container. If seccomp options are + provided at both the pod & container level, the container options + override the pod options. + Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile defined in a file on the node should be used. + The profile must be preconfigured on the node to work. + Must be a descending path, relative to the kubelet's configured seccomp profile location. + Must be set if type is "Localhost". Must NOT be set for any other type. + type: string + type: + description: |- + type indicates which kind of seccomp profile will be applied. + Valid options are: + + Localhost - a profile defined in a file on the node should be used. + RuntimeDefault - the container runtime default profile should be used. + Unconfined - no profile should be applied. + type: string + windowsOptions: + description: |- + The Windows specific settings applied to all containers. + If unspecified, the options from the PodSecurityContext will be used. + If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is linux. + type: object + properties: + gmsaCredentialSpec: + description: |- + GMSACredentialSpec is where the GMSA admission webhook + (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the + GMSA credential spec named by the GMSACredentialSpecName field. + type: string + gmsaCredentialSpecName: + description: GMSACredentialSpecName is the name of + the GMSA credential spec to use. + type: string + hostProcess: + description: |- + HostProcess determines if a container should be run as a 'Host Process' container. + All of a Pod's containers must have the same effective HostProcess value + (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers). + In addition, if HostProcess is true then HostNetwork must also be set to true. + type: boolean + runAsUserName: + description: |- + The UserName in Windows to run the entrypoint of the container process. + Defaults to the user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: string + startupProbe: + description: |- + Deprecated: This field will be removed in a future release. + DeprecatedStartupProbe + type: object + properties: + exec: + description: Exec specifies a command to execute in the + container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + failureThreshold: + description: |- + Minimum consecutive failures for the probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. + type: integer + format: int32 + grpc: + description: GRPC specifies a GRPC HealthCheckRequest. + type: object + required: + - port + properties: + port: + description: Port number of the gRPC service. Number + must be in the range 1 to 65535. + type: integer + format: int32 + service: + description: |- + Service is the name of the service to place in the gRPC HealthCheckRequest + (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + + If this is not specified, the default behavior is defined by gRPC. + type: string + default: "" + httpGet: + description: HTTPGet specifies an HTTP GET request to + perform. + type: object + required: + - port + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + initialDelaySeconds: + description: |- + Number of seconds after the container has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + periodSeconds: + description: |- + How often (in seconds) to perform the probe. + Default to 10 seconds. Minimum value is 1. + type: integer + format: int32 + successThreshold: + description: |- + Minimum consecutive successes for the probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. + type: integer + format: int32 + tcpSocket: + description: TCPSocket specifies a connection to a TCP + port. + type: object + required: + - port + properties: + host: + description: 'Optional: Host name to connect to, defaults + to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + terminationGracePeriodSeconds: + description: |- + Optional duration in seconds the pod needs to terminate gracefully upon probe failure. + The grace period is the duration in seconds after the processes running in the pod are sent + a termination signal and the time when the processes are forcibly halted with a kill signal. + Set this value longer than the expected cleanup time for your process. + If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this + value overrides the value provided by the pod spec. + Value must be non-negative integer. The value zero indicates stop immediately via + the kill signal (no opportunity to shut down). + This is a beta field and requires enabling ProbeTerminationGracePeriod feature gate. + Minimum value is 1. spec.terminationGracePeriodSeconds is used if unset. + type: integer + format: int64 + timeoutSeconds: + description: |- + Number of seconds after which the probe times out. + Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + stderrConfig: + description: StderrConfig + type: object + properties: + path: + description: Path + type: string + stdin: + description: |- + Deprecated: This field will be removed in a future release. + DeprecatedStdin + type: boolean + stdinOnce: + description: |- + Deprecated: This field will be removed in a future release. + DeprecatedStdinOnce + type: boolean + stdoutConfig: + description: StdoutConfig + type: object + properties: + path: + description: Path + type: string + terminationMessagePath: + description: |- + DeprecatedTerminationMessagePath + Deprecated: This field will be removed in a future release and can't be meaningfully used. + type: string + terminationMessagePolicy: + description: |- + DeprecatedTerminationMessagePolicy + Deprecated: This field will be removed in a future release and can't be meaningfully used. + type: string + timeout: + description: Timeout + type: string + tty: + description: |- + Deprecated: This field will be removed in a future release. + DeprecatedTTY + type: boolean + volumeDevices: + description: VolumeDevices + type: array + items: + description: volumeDevice describes a mapping of a raw block + device within a container. + type: object + required: + - devicePath + - name + properties: + devicePath: + description: devicePath is the path inside of the container + that the device will be mapped to. + type: string + name: + description: name must match the name of a persistentVolumeClaim + in the pod + type: string + x-kubernetes-list-type: atomic + volumeMounts: + description: VolumeMounts + type: array + items: + description: VolumeMount describes a mounting of a Volume + within a container. + type: object + required: + - mountPath + - name + properties: + mountPath: + description: |- + Path within the container at which the volume should be mounted. Must + not contain ':'. + type: string + mountPropagation: + description: |- + mountPropagation determines how mounts are propagated from the host + to container and the other way around. + When not set, MountPropagationNone is used. + This field is beta in 1.10. + When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified + (which defaults to None). + type: string + name: + description: This must match the Name of a Volume. + type: string + readOnly: + description: |- + Mounted read-only if true, read-write otherwise (false or unspecified). + Defaults to false. + type: boolean + recursiveReadOnly: + description: |- + RecursiveReadOnly specifies whether read-only mounts should be handled + recursively. + + If ReadOnly is false, this field has no meaning and must be unspecified. + + If ReadOnly is true, and this field is set to Disabled, the mount is not made + recursively read-only. If this field is set to IfPossible, the mount is made + recursively read-only, if it is supported by the container runtime. If this + field is set to Enabled, the mount is made recursively read-only if it is + supported by the container runtime, otherwise the pod will not be started and + an error will be generated to indicate the reason. + + If this field is set to IfPossible or Enabled, MountPropagation must be set to + None (or be unspecified, which defaults to None). + + If this field is not specified, it is treated as an equivalent of Disabled. + type: string + subPath: + description: |- + Path within the volume from which the container's volume should be mounted. + Defaults to "" (volume's root). + type: string + subPathExpr: + description: |- + Expanded path within the volume from which the container's volume should be mounted. + Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment. + Defaults to "" (volume's root). + SubPathExpr and SubPath are mutually exclusive. + type: string + x-kubernetes-list-type: atomic + when: + description: WhenExpressions + type: array + items: + description: WhenExpression + type: object + properties: + cel: + description: CEL + type: string + input: + description: Input + type: string + operator: + description: Operator + type: string + values: + description: Values + type: array + items: + type: string + x-kubernetes-list-type: atomic + workingDir: + description: WorkingDir + type: string + workspaces: + description: Workspaces + type: array + items: + description: WorkspaceUsage + type: object + required: + - mountPath + - name + properties: + mountPath: + description: MountPath + type: string + name: + description: Name + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + volumes: + description: Volumes + x-kubernetes-preserve-unknown-fields: true + workspaces: + description: Workspaces + type: array + items: + description: WorkspaceDeclaration + type: object + required: + - name + properties: + description: + description: Description + type: string + mountPath: + description: MountPath + type: string + name: + description: Name + type: string + optional: + description: Optional + type: boolean + readOnly: + description: ReadOnly + type: boolean + x-kubernetes-list-type: atomic + # Opt into the status subresource so metadata.generation + # starts to increment + subresources: + status: {} + - name: v1 + served: true + storage: true + schema: + openAPIV3Schema: + description: |- + Task represents a collection of sequential steps that are run as part of a + Pipeline using a set of inputs and producing a set of outputs. Tasks execute + when TaskRuns are created that provide the input parameters and resources and + output resources the Task requires. + type: object + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: Spec holds the desired state of the Task from the client + type: object + properties: + description: + description: |- + Description is a user-facing description of the task that may be + used to populate a UI. + type: string + displayName: + description: |- + DisplayName is a user-facing name of the task that may be + used to populate a UI. + type: string + params: + description: |- + Params is a list of input parameters required to run the task. Params + must be supplied as inputs in TaskRuns unless they declare a default + value. + type: array + items: + description: |- + ParamSpec defines arbitrary parameters needed beyond typed inputs (such as + resources). Parameter values are provided by users as inputs on a TaskRun + or PipelineRun. + type: object + required: + - name + properties: + default: + description: |- + Default is the value a parameter takes if no input value is supplied. If + default is set, a Task may be executed without a supplied value for the + parameter. + x-kubernetes-preserve-unknown-fields: true + description: + description: |- + Description is a user-facing description of the parameter that may be + used to populate a UI. + type: string + enum: + description: |- + Enum declares a set of allowed param input values for tasks/pipelines that can be validated. + If Enum is not set, no input validation is performed for the param. + type: array + items: + type: string + name: + description: Name declares the name by which a parameter is + referenced. + type: string + properties: + description: Properties is the JSON Schema properties to support + key-value pairs parameter. + type: object + additionalProperties: + description: PropertySpec defines the struct for object + keys + type: object + properties: + type: + description: |- + ParamType indicates the type of an input parameter; + Used to distinguish between a single string and an array of strings. + type: string + type: + description: |- + Type is the user-specified type of the parameter. The possible types + are currently "string", "array" and "object", and "string" is the default. + type: string + x-kubernetes-list-type: atomic + results: + description: Results are values that this Task can output + type: array + items: + description: TaskResult used to describe the results of a task + type: object + required: + - name + properties: + description: + description: Description is a human-readable description of + the result + type: string + name: + description: Name the given name + type: string + properties: + description: Properties is the JSON Schema properties to support + key-value pairs results. + type: object + additionalProperties: + description: PropertySpec defines the struct for object + keys + type: object + properties: + type: + description: |- + ParamType indicates the type of an input parameter; + Used to distinguish between a single string and an array of strings. + type: string + type: + description: |- + Type is the user-specified type of the result. The possible type + is currently "string" and will support "array" in following work. + type: string + value: + description: Value the expression used to retrieve the value + of the result from an underlying Step. + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + sidecars: + description: |- + Sidecars are run alongside the Task's step containers. They begin before + the steps start and end after the steps complete. + type: array + items: + description: Sidecar has nearly the same data structure as Step + but does not have the ability to timeout. + type: object + required: + - name + properties: + args: + description: |- + Arguments to the entrypoint. + The image's CMD is used if this is not provided. + Variable references $(VAR_NAME) are expanded using the Sidecar's environment. If a variable + cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will + produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless + of whether the variable exists or not. Cannot be updated. + More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell + type: array + items: + type: string + x-kubernetes-list-type: atomic + command: + description: |- + Entrypoint array. Not executed within a shell. + The image's ENTRYPOINT is used if this is not provided. + Variable references $(VAR_NAME) are expanded using the Sidecar's environment. If a variable + cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will + produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless + of whether the variable exists or not. Cannot be updated. + More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell + type: array + items: + type: string + x-kubernetes-list-type: atomic + computeResources: + description: |- + ComputeResources required by this Sidecar. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This field depends on the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + type: array + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + type: object + required: + - name + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + requests: + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + env: + description: |- + List of environment variables to set in the Sidecar. + Cannot be updated. + type: array + items: + description: EnvVar represents an environment variable present + in a Container. + type: object + required: + - name + properties: + name: + description: |- + Name of the environment variable. + May consist of any printable ASCII characters except '='. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's value. + Cannot be used if value is not empty. + type: object + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + type: object + required: + - key + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap or + its key must be defined + type: boolean + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + type: object + required: + - fieldPath + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in + the specified API version. + type: string + x-kubernetes-map-type: atomic + fileKeyRef: + description: |- + FileKeyRef selects a key of the env file. + Requires the EnvFiles feature gate to be enabled. + type: object + required: + - key + - path + - volumeName + properties: + key: + description: |- + The key within the env file. An invalid key will prevent the pod from starting. + The keys defined within a source may consist of any printable ASCII characters except '='. + During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters. + type: string + optional: + description: |- + Specify whether the file or its key must be defined. If the file or key + does not exist, then the env var is not published. + If optional is set to true and the specified key does not exist, + the environment variable will not be set in the Pod's containers. + + If optional is set to false and the specified key does not exist, + an error will be returned during Pod creation. + type: boolean + default: false + path: + description: |- + The path within the volume from which to select the file. + Must be relative and may not contain the '..' path or start with '..'. + type: string + volumeName: + description: The name of the volume mount containing + the env file. + type: string + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + type: object + required: + - resource + properties: + containerName: + description: 'Container name: required for volumes, + optional for env vars' + type: string + divisor: + description: Specifies the output format of + the exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the pod's + namespace + type: object + required: + - key + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret or its + key must be defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + envFrom: + description: |- + List of sources to populate environment variables in the Sidecar. + The keys defined within a source must be a C_IDENTIFIER. All invalid keys + will be reported as an event when the container is starting. When a key exists in multiple + sources, the value associated with the last source will take precedence. + Values defined by an Env with a duplicate key will take precedence. + Cannot be updated. + type: array + items: + description: EnvFromSource represents the source of a set + of ConfigMaps or Secrets + type: object + properties: + configMapRef: + description: The ConfigMap to select from + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap must + be defined + type: boolean + x-kubernetes-map-type: atomic + prefix: + description: |- + Optional text to prepend to the name of each environment variable. + May consist of any printable ASCII characters except '='. + type: string + secretRef: + description: The Secret to select from + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret must be + defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + image: + description: |- + Image reference name. + More info: https://kubernetes.io/docs/concepts/containers/images + type: string + imagePullPolicy: + description: |- + Image pull policy. + One of Always, Never, IfNotPresent. + Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/containers/images#updating-images + type: string + lifecycle: + description: |- + Actions that the management system should take in response to Sidecar lifecycle events. + Cannot be updated. + type: object + properties: + postStart: + description: |- + PostStart is called immediately after a container is created. If the handler fails, + the container is terminated and restarted according to its restart policy. + Other management of the container blocks until the hook completes. + More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks + type: object + properties: + exec: + description: Exec specifies a command to execute in + the container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + httpGet: + description: HTTPGet specifies an HTTP GET request + to perform. + type: object + required: + - port + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + sleep: + description: Sleep represents a duration that the + container should sleep. + type: object + required: + - seconds + properties: + seconds: + description: Seconds is the number of seconds + to sleep. + type: integer + format: int64 + tcpSocket: + description: |- + Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept + for backward compatibility. There is no validation of this field and + lifecycle hooks will fail at runtime when it is specified. + type: object + required: + - port + properties: + host: + description: 'Optional: Host name to connect to, + defaults to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + preStop: + description: |- + PreStop is called immediately before a container is terminated due to an + API request or management event such as liveness/startup probe failure, + preemption, resource contention, etc. The handler is not called if the + container crashes or exits. The Pod's termination grace period countdown begins before the + PreStop hook is executed. Regardless of the outcome of the handler, the + container will eventually terminate within the Pod's termination grace + period (unless delayed by finalizers). Other management of the container blocks until the hook completes + or until the termination grace period is reached. + More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks + type: object + properties: + exec: + description: Exec specifies a command to execute in + the container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + httpGet: + description: HTTPGet specifies an HTTP GET request + to perform. + type: object + required: + - port + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + sleep: + description: Sleep represents a duration that the + container should sleep. + type: object + required: + - seconds + properties: + seconds: + description: Seconds is the number of seconds + to sleep. + type: integer + format: int64 + tcpSocket: + description: |- + Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept + for backward compatibility. There is no validation of this field and + lifecycle hooks will fail at runtime when it is specified. + type: object + required: + - port + properties: + host: + description: 'Optional: Host name to connect to, + defaults to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + stopSignal: + description: |- + StopSignal defines which signal will be sent to a container when it is being stopped. + If not specified, the default is defined by the container runtime in use. + StopSignal can only be set for Pods with a non-empty .spec.os.name + type: string + livenessProbe: + description: |- + Periodic probe of Sidecar liveness. + Container will be restarted if the probe fails. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: object + properties: + exec: + description: Exec specifies a command to execute in the + container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + failureThreshold: + description: |- + Minimum consecutive failures for the probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. + type: integer + format: int32 + grpc: + description: GRPC specifies a GRPC HealthCheckRequest. + type: object + required: + - port + properties: + port: + description: Port number of the gRPC service. Number + must be in the range 1 to 65535. + type: integer + format: int32 + service: + description: |- + Service is the name of the service to place in the gRPC HealthCheckRequest + (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + + If this is not specified, the default behavior is defined by gRPC. + type: string + default: "" + httpGet: + description: HTTPGet specifies an HTTP GET request to + perform. + type: object + required: + - port + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + initialDelaySeconds: + description: |- + Number of seconds after the container has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + periodSeconds: + description: |- + How often (in seconds) to perform the probe. + Default to 10 seconds. Minimum value is 1. + type: integer + format: int32 + successThreshold: + description: |- + Minimum consecutive successes for the probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. + type: integer + format: int32 + tcpSocket: + description: TCPSocket specifies a connection to a TCP + port. + type: object + required: + - port + properties: + host: + description: 'Optional: Host name to connect to, defaults + to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + terminationGracePeriodSeconds: + description: |- + Optional duration in seconds the pod needs to terminate gracefully upon probe failure. + The grace period is the duration in seconds after the processes running in the pod are sent + a termination signal and the time when the processes are forcibly halted with a kill signal. + Set this value longer than the expected cleanup time for your process. + If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this + value overrides the value provided by the pod spec. + Value must be non-negative integer. The value zero indicates stop immediately via + the kill signal (no opportunity to shut down). + This is a beta field and requires enabling ProbeTerminationGracePeriod feature gate. + Minimum value is 1. spec.terminationGracePeriodSeconds is used if unset. + type: integer + format: int64 + timeoutSeconds: + description: |- + Number of seconds after which the probe times out. + Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + name: + description: |- + Name of the Sidecar specified as a DNS_LABEL. + Each Sidecar in a Task must have a unique name (DNS_LABEL). + Cannot be updated. + type: string + ports: + description: |- + List of ports to expose from the Sidecar. Exposing a port here gives + the system additional information about the network connections a + container uses, but is primarily informational. Not specifying a port here + DOES NOT prevent that port from being exposed. Any port which is + listening on the default "0.0.0.0" address inside a container will be + accessible from the network. + Cannot be updated. + type: array + items: + description: ContainerPort represents a network port in + a single container. + type: object + required: + - containerPort + properties: + containerPort: + description: |- + Number of port to expose on the pod's IP address. + This must be a valid port number, 0 < x < 65536. + type: integer + format: int32 + hostIP: + description: What host IP to bind the external port + to. + type: string + hostPort: + description: |- + Number of port to expose on the host. + If specified, this must be a valid port number, 0 < x < 65536. + If HostNetwork is specified, this must match ContainerPort. + Most containers do not need this. + type: integer + format: int32 + name: + description: |- + If specified, this must be an IANA_SVC_NAME and unique within the pod. Each + named port in a pod must have a unique name. Name for the port that can be + referred to by services. + type: string + protocol: + description: |- + Protocol for port. Must be UDP, TCP, or SCTP. + Defaults to "TCP". + type: string + default: TCP + x-kubernetes-list-map-keys: + - containerPort + - protocol + x-kubernetes-list-type: map + readinessProbe: + description: |- + Periodic probe of Sidecar service readiness. + Container will be removed from service endpoints if the probe fails. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: object + properties: + exec: + description: Exec specifies a command to execute in the + container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + failureThreshold: + description: |- + Minimum consecutive failures for the probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. + type: integer + format: int32 + grpc: + description: GRPC specifies a GRPC HealthCheckRequest. + type: object + required: + - port + properties: + port: + description: Port number of the gRPC service. Number + must be in the range 1 to 65535. + type: integer + format: int32 + service: + description: |- + Service is the name of the service to place in the gRPC HealthCheckRequest + (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + + If this is not specified, the default behavior is defined by gRPC. + type: string + default: "" + httpGet: + description: HTTPGet specifies an HTTP GET request to + perform. + type: object + required: + - port + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + initialDelaySeconds: + description: |- + Number of seconds after the container has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + periodSeconds: + description: |- + How often (in seconds) to perform the probe. + Default to 10 seconds. Minimum value is 1. + type: integer + format: int32 + successThreshold: + description: |- + Minimum consecutive successes for the probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. + type: integer + format: int32 + tcpSocket: + description: TCPSocket specifies a connection to a TCP + port. + type: object + required: + - port + properties: + host: + description: 'Optional: Host name to connect to, defaults + to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + terminationGracePeriodSeconds: + description: |- + Optional duration in seconds the pod needs to terminate gracefully upon probe failure. + The grace period is the duration in seconds after the processes running in the pod are sent + a termination signal and the time when the processes are forcibly halted with a kill signal. + Set this value longer than the expected cleanup time for your process. + If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this + value overrides the value provided by the pod spec. + Value must be non-negative integer. The value zero indicates stop immediately via + the kill signal (no opportunity to shut down). + This is a beta field and requires enabling ProbeTerminationGracePeriod feature gate. + Minimum value is 1. spec.terminationGracePeriodSeconds is used if unset. + type: integer + format: int64 + timeoutSeconds: + description: |- + Number of seconds after which the probe times out. + Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + restartPolicy: + description: |- + RestartPolicy refers to kubernetes RestartPolicy. It can only be set for an + initContainer and must have it's policy set to "Always". It is currently + left optional to help support Kubernetes versions prior to 1.29 when this feature + was introduced. + type: string + script: + description: |- + Script is the contents of an executable file to execute. + + If Script is not empty, the Step cannot have an Command or Args. + type: string + securityContext: + description: |- + SecurityContext defines the security options the Sidecar should be run with. + If set, the fields of SecurityContext override the equivalent fields of PodSecurityContext. + More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ + type: object + properties: + allowPrivilegeEscalation: + description: |- + AllowPrivilegeEscalation controls whether a process can gain more + privileges than its parent process. This bool directly controls if + the no_new_privs flag will be set on the container process. + AllowPrivilegeEscalation is true always when the container is: + 1) run as Privileged + 2) has CAP_SYS_ADMIN + Note that this field cannot be set when spec.os.name is windows. + type: boolean + appArmorProfile: + description: |- + appArmorProfile is the AppArmor options to use by this container. If set, this profile + overrides the pod's appArmorProfile. + Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile loaded on the node that should be used. + The profile must be preconfigured on the node to work. + Must match the loaded name of the profile. + Must be set if and only if type is "Localhost". + type: string + type: + description: |- + type indicates which kind of AppArmor profile will be applied. + Valid options are: + Localhost - a profile pre-loaded on the node. + RuntimeDefault - the container runtime's default profile. + Unconfined - no AppArmor enforcement. + type: string + capabilities: + description: |- + The capabilities to add/drop when running containers. + Defaults to the default set of capabilities granted by the container runtime. + Note that this field cannot be set when spec.os.name is windows. + type: object + properties: + add: + description: Added capabilities + type: array + items: + description: Capability represent POSIX capabilities + type + type: string + x-kubernetes-list-type: atomic + drop: + description: Removed capabilities + type: array + items: + description: Capability represent POSIX capabilities + type + type: string + x-kubernetes-list-type: atomic + privileged: + description: |- + Run container in privileged mode. + Processes in privileged containers are essentially equivalent to root on the host. + Defaults to false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + procMount: + description: |- + procMount denotes the type of proc mount to use for the containers. + The default value is Default which uses the container runtime defaults for + readonly paths and masked paths. + This requires the ProcMountType feature flag to be enabled. + Note that this field cannot be set when spec.os.name is windows. + type: string + readOnlyRootFilesystem: + description: |- + Whether this container has a read-only root filesystem. + Default is false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + runAsGroup: + description: |- + The GID to run the entrypoint of the container process. + Uses runtime default if unset. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + runAsNonRoot: + description: |- + Indicates that the container must run as a non-root user. + If true, the Kubelet will validate the image at runtime to ensure that it + does not run as UID 0 (root) and fail to start the container if it does. + If unset or false, no such validation will be performed. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: boolean + runAsUser: + description: |- + The UID to run the entrypoint of the container process. + Defaults to user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + seLinuxOptions: + description: |- + The SELinux context to be applied to the container. + If unspecified, the container runtime will allocate a random SELinux context for each + container. May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: object + properties: + level: + description: Level is SELinux level label that applies + to the container. + type: string + role: + description: Role is a SELinux role label that applies + to the container. + type: string + type: + description: Type is a SELinux type label that applies + to the container. + type: string + user: + description: User is a SELinux user label that applies + to the container. + type: string + seccompProfile: + description: |- + The seccomp options to use by this container. If seccomp options are + provided at both the pod & container level, the container options + override the pod options. + Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile defined in a file on the node should be used. + The profile must be preconfigured on the node to work. + Must be a descending path, relative to the kubelet's configured seccomp profile location. + Must be set if type is "Localhost". Must NOT be set for any other type. + type: string + type: + description: |- + type indicates which kind of seccomp profile will be applied. + Valid options are: + + Localhost - a profile defined in a file on the node should be used. + RuntimeDefault - the container runtime default profile should be used. + Unconfined - no profile should be applied. + type: string + windowsOptions: + description: |- + The Windows specific settings applied to all containers. + If unspecified, the options from the PodSecurityContext will be used. + If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is linux. + type: object + properties: + gmsaCredentialSpec: + description: |- + GMSACredentialSpec is where the GMSA admission webhook + (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the + GMSA credential spec named by the GMSACredentialSpecName field. + type: string + gmsaCredentialSpecName: + description: GMSACredentialSpecName is the name of + the GMSA credential spec to use. + type: string + hostProcess: + description: |- + HostProcess determines if a container should be run as a 'Host Process' container. + All of a Pod's containers must have the same effective HostProcess value + (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers). + In addition, if HostProcess is true then HostNetwork must also be set to true. + type: boolean + runAsUserName: + description: |- + The UserName in Windows to run the entrypoint of the container process. + Defaults to the user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: string + startupProbe: + description: |- + StartupProbe indicates that the Pod the Sidecar is running in has successfully initialized. + If specified, no other probes are executed until this completes successfully. + If this probe fails, the Pod will be restarted, just as if the livenessProbe failed. + This can be used to provide different probe parameters at the beginning of a Pod's lifecycle, + when it might take a long time to load data or warm a cache, than during steady-state operation. + This cannot be updated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: object + properties: + exec: + description: Exec specifies a command to execute in the + container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + failureThreshold: + description: |- + Minimum consecutive failures for the probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. + type: integer + format: int32 + grpc: + description: GRPC specifies a GRPC HealthCheckRequest. + type: object + required: + - port + properties: + port: + description: Port number of the gRPC service. Number + must be in the range 1 to 65535. + type: integer + format: int32 + service: + description: |- + Service is the name of the service to place in the gRPC HealthCheckRequest + (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + + If this is not specified, the default behavior is defined by gRPC. + type: string + default: "" + httpGet: + description: HTTPGet specifies an HTTP GET request to + perform. + type: object + required: + - port + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + initialDelaySeconds: + description: |- + Number of seconds after the container has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + periodSeconds: + description: |- + How often (in seconds) to perform the probe. + Default to 10 seconds. Minimum value is 1. + type: integer + format: int32 + successThreshold: + description: |- + Minimum consecutive successes for the probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. + type: integer + format: int32 + tcpSocket: + description: TCPSocket specifies a connection to a TCP + port. + type: object + required: + - port + properties: + host: + description: 'Optional: Host name to connect to, defaults + to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + terminationGracePeriodSeconds: + description: |- + Optional duration in seconds the pod needs to terminate gracefully upon probe failure. + The grace period is the duration in seconds after the processes running in the pod are sent + a termination signal and the time when the processes are forcibly halted with a kill signal. + Set this value longer than the expected cleanup time for your process. + If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this + value overrides the value provided by the pod spec. + Value must be non-negative integer. The value zero indicates stop immediately via + the kill signal (no opportunity to shut down). + This is a beta field and requires enabling ProbeTerminationGracePeriod feature gate. + Minimum value is 1. spec.terminationGracePeriodSeconds is used if unset. + type: integer + format: int64 + timeoutSeconds: + description: |- + Number of seconds after which the probe times out. + Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + stdin: + description: |- + Whether this Sidecar should allocate a buffer for stdin in the container runtime. If this + is not set, reads from stdin in the Sidecar will always result in EOF. + Default is false. + type: boolean + stdinOnce: + description: |- + Whether the container runtime should close the stdin channel after it has been opened by + a single attach. When stdin is true the stdin stream will remain open across multiple attach + sessions. If stdinOnce is set to true, stdin is opened on Sidecar start, is empty until the + first client attaches to stdin, and then remains open and accepts data until the client disconnects, + at which time stdin is closed and remains closed until the Sidecar is restarted. If this + flag is false, a container processes that reads from stdin will never receive an EOF. + Default is false + type: boolean + terminationMessagePath: + description: |- + Optional: Path at which the file to which the Sidecar's termination message + will be written is mounted into the Sidecar's filesystem. + Message written is intended to be brief final status, such as an assertion failure message. + Will be truncated by the node if greater than 4096 bytes. The total message length across + all containers will be limited to 12kb. + Defaults to /dev/termination-log. + Cannot be updated. + type: string + terminationMessagePolicy: + description: |- + Indicate how the termination message should be populated. File will use the contents of + terminationMessagePath to populate the Sidecar status message on both success and failure. + FallbackToLogsOnError will use the last chunk of Sidecar log output if the termination + message file is empty and the Sidecar exited with an error. + The log output is limited to 2048 bytes or 80 lines, whichever is smaller. + Defaults to File. + Cannot be updated. + type: string + tty: + description: |- + Whether this Sidecar should allocate a TTY for itself, also requires 'stdin' to be true. + Default is false. + type: boolean + volumeDevices: + description: volumeDevices is the list of block devices to + be used by the Sidecar. + type: array + items: + description: volumeDevice describes a mapping of a raw block + device within a container. + type: object + required: + - devicePath + - name + properties: + devicePath: + description: devicePath is the path inside of the container + that the device will be mapped to. + type: string + name: + description: name must match the name of a persistentVolumeClaim + in the pod + type: string + x-kubernetes-list-type: atomic + volumeMounts: + description: |- + Volumes to mount into the Sidecar's filesystem. + Cannot be updated. + type: array + items: + description: VolumeMount describes a mounting of a Volume + within a container. + type: object + required: + - mountPath + - name + properties: + mountPath: + description: |- + Path within the container at which the volume should be mounted. Must + not contain ':'. + type: string + mountPropagation: + description: |- + mountPropagation determines how mounts are propagated from the host + to container and the other way around. + When not set, MountPropagationNone is used. + This field is beta in 1.10. + When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified + (which defaults to None). + type: string + name: + description: This must match the Name of a Volume. + type: string + readOnly: + description: |- + Mounted read-only if true, read-write otherwise (false or unspecified). + Defaults to false. + type: boolean + recursiveReadOnly: + description: |- + RecursiveReadOnly specifies whether read-only mounts should be handled + recursively. + + If ReadOnly is false, this field has no meaning and must be unspecified. + + If ReadOnly is true, and this field is set to Disabled, the mount is not made + recursively read-only. If this field is set to IfPossible, the mount is made + recursively read-only, if it is supported by the container runtime. If this + field is set to Enabled, the mount is made recursively read-only if it is + supported by the container runtime, otherwise the pod will not be started and + an error will be generated to indicate the reason. + + If this field is set to IfPossible or Enabled, MountPropagation must be set to + None (or be unspecified, which defaults to None). + + If this field is not specified, it is treated as an equivalent of Disabled. + type: string + subPath: + description: |- + Path within the volume from which the container's volume should be mounted. + Defaults to "" (volume's root). + type: string + subPathExpr: + description: |- + Expanded path within the volume from which the container's volume should be mounted. + Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment. + Defaults to "" (volume's root). + SubPathExpr and SubPath are mutually exclusive. + type: string + x-kubernetes-list-type: atomic + workingDir: + description: |- + Sidecar's working directory. + If not specified, the container runtime's default will be used, which + might be configured in the container image. + Cannot be updated. + type: string + workspaces: + description: |- + This is an alpha field. You must set the "enable-api-fields" feature flag to "alpha" + for this field to be supported. + + Workspaces is a list of workspaces from the Task that this Sidecar wants + exclusive access to. Adding a workspace to this list means that any + other Step or Sidecar that does not also request this Workspace will + not have access to it. + type: array + items: + description: |- + WorkspaceUsage is used by a Step or Sidecar to declare that it wants isolated access + to a Workspace defined in a Task. + type: object + required: + - mountPath + - name + properties: + mountPath: + description: |- + MountPath is the path that the workspace should be mounted to inside the Step or Sidecar, + overriding any MountPath specified in the Task's WorkspaceDeclaration. + type: string + name: + description: Name is the name of the workspace this + Step or Sidecar wants access to. + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + stepTemplate: + description: |- + StepTemplate can be used as the basis for all step containers within the + Task, so that the steps inherit settings on the base container. + type: object + properties: + args: + description: |- + Arguments to the entrypoint. + The image's CMD is used if this is not provided. + Variable references $(VAR_NAME) are expanded using the Step's environment. If a variable + cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will + produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless + of whether the variable exists or not. Cannot be updated. + More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell + type: array + items: + type: string + x-kubernetes-list-type: atomic + command: + description: |- + Entrypoint array. Not executed within a shell. + The image's ENTRYPOINT is used if this is not provided. + Variable references $(VAR_NAME) are expanded using the Step's environment. If a variable + cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will + produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless + of whether the variable exists or not. Cannot be updated. + More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell + type: array + items: + type: string + x-kubernetes-list-type: atomic + computeResources: + description: |- + ComputeResources required by this Step. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This field depends on the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + type: array + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + type: object + required: + - name + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + requests: + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + env: + description: |- + List of environment variables to set in the Step. + Cannot be updated. + type: array + items: + description: EnvVar represents an environment variable present + in a Container. + type: object + required: + - name + properties: + name: + description: |- + Name of the environment variable. + May consist of any printable ASCII characters except '='. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's value. + Cannot be used if value is not empty. + type: object + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + type: object + required: + - key + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap or + its key must be defined + type: boolean + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + type: object + required: + - fieldPath + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in the + specified API version. + type: string + x-kubernetes-map-type: atomic + fileKeyRef: + description: |- + FileKeyRef selects a key of the env file. + Requires the EnvFiles feature gate to be enabled. + type: object + required: + - key + - path + - volumeName + properties: + key: + description: |- + The key within the env file. An invalid key will prevent the pod from starting. + The keys defined within a source may consist of any printable ASCII characters except '='. + During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters. + type: string + optional: + description: |- + Specify whether the file or its key must be defined. If the file or key + does not exist, then the env var is not published. + If optional is set to true and the specified key does not exist, + the environment variable will not be set in the Pod's containers. + + If optional is set to false and the specified key does not exist, + an error will be returned during Pod creation. + type: boolean + default: false + path: + description: |- + The path within the volume from which to select the file. + Must be relative and may not contain the '..' path or start with '..'. + type: string + volumeName: + description: The name of the volume mount containing + the env file. + type: string + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + type: object + required: + - resource + properties: + containerName: + description: 'Container name: required for volumes, + optional for env vars' + type: string + divisor: + description: Specifies the output format of the + exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the pod's + namespace + type: object + required: + - key + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret or its + key must be defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + envFrom: + description: |- + List of sources to populate environment variables in the Step. + The keys defined within a source must be a C_IDENTIFIER. All invalid keys + will be reported as an event when the Step is starting. When a key exists in multiple + sources, the value associated with the last source will take precedence. + Values defined by an Env with a duplicate key will take precedence. + Cannot be updated. + type: array + items: + description: EnvFromSource represents the source of a set + of ConfigMaps or Secrets + type: object + properties: + configMapRef: + description: The ConfigMap to select from + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap must be + defined + type: boolean + x-kubernetes-map-type: atomic + prefix: + description: |- + Optional text to prepend to the name of each environment variable. + May consist of any printable ASCII characters except '='. + type: string + secretRef: + description: The Secret to select from + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret must be defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + image: + description: |- + Image reference name. + More info: https://kubernetes.io/docs/concepts/containers/images + type: string + imagePullPolicy: + description: |- + Image pull policy. + One of Always, Never, IfNotPresent. + Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/containers/images#updating-images + type: string + securityContext: + description: |- + SecurityContext defines the security options the Step should be run with. + If set, the fields of SecurityContext override the equivalent fields of PodSecurityContext. + More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ + type: object + properties: + allowPrivilegeEscalation: + description: |- + AllowPrivilegeEscalation controls whether a process can gain more + privileges than its parent process. This bool directly controls if + the no_new_privs flag will be set on the container process. + AllowPrivilegeEscalation is true always when the container is: + 1) run as Privileged + 2) has CAP_SYS_ADMIN + Note that this field cannot be set when spec.os.name is windows. + type: boolean + appArmorProfile: + description: |- + appArmorProfile is the AppArmor options to use by this container. If set, this profile + overrides the pod's appArmorProfile. + Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile loaded on the node that should be used. + The profile must be preconfigured on the node to work. + Must match the loaded name of the profile. + Must be set if and only if type is "Localhost". + type: string + type: + description: |- + type indicates which kind of AppArmor profile will be applied. + Valid options are: + Localhost - a profile pre-loaded on the node. + RuntimeDefault - the container runtime's default profile. + Unconfined - no AppArmor enforcement. + type: string + capabilities: + description: |- + The capabilities to add/drop when running containers. + Defaults to the default set of capabilities granted by the container runtime. + Note that this field cannot be set when spec.os.name is windows. + type: object + properties: + add: + description: Added capabilities + type: array + items: + description: Capability represent POSIX capabilities + type + type: string + x-kubernetes-list-type: atomic + drop: + description: Removed capabilities + type: array + items: + description: Capability represent POSIX capabilities + type + type: string + x-kubernetes-list-type: atomic + privileged: + description: |- + Run container in privileged mode. + Processes in privileged containers are essentially equivalent to root on the host. + Defaults to false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + procMount: + description: |- + procMount denotes the type of proc mount to use for the containers. + The default value is Default which uses the container runtime defaults for + readonly paths and masked paths. + This requires the ProcMountType feature flag to be enabled. + Note that this field cannot be set when spec.os.name is windows. + type: string + readOnlyRootFilesystem: + description: |- + Whether this container has a read-only root filesystem. + Default is false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + runAsGroup: + description: |- + The GID to run the entrypoint of the container process. + Uses runtime default if unset. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + runAsNonRoot: + description: |- + Indicates that the container must run as a non-root user. + If true, the Kubelet will validate the image at runtime to ensure that it + does not run as UID 0 (root) and fail to start the container if it does. + If unset or false, no such validation will be performed. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: boolean + runAsUser: + description: |- + The UID to run the entrypoint of the container process. + Defaults to user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + seLinuxOptions: + description: |- + The SELinux context to be applied to the container. + If unspecified, the container runtime will allocate a random SELinux context for each + container. May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: object + properties: + level: + description: Level is SELinux level label that applies + to the container. + type: string + role: + description: Role is a SELinux role label that applies + to the container. + type: string + type: + description: Type is a SELinux type label that applies + to the container. + type: string + user: + description: User is a SELinux user label that applies + to the container. + type: string + seccompProfile: + description: |- + The seccomp options to use by this container. If seccomp options are + provided at both the pod & container level, the container options + override the pod options. + Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile defined in a file on the node should be used. + The profile must be preconfigured on the node to work. + Must be a descending path, relative to the kubelet's configured seccomp profile location. + Must be set if type is "Localhost". Must NOT be set for any other type. + type: string + type: + description: |- + type indicates which kind of seccomp profile will be applied. + Valid options are: + + Localhost - a profile defined in a file on the node should be used. + RuntimeDefault - the container runtime default profile should be used. + Unconfined - no profile should be applied. + type: string + windowsOptions: + description: |- + The Windows specific settings applied to all containers. + If unspecified, the options from the PodSecurityContext will be used. + If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is linux. + type: object + properties: + gmsaCredentialSpec: + description: |- + GMSACredentialSpec is where the GMSA admission webhook + (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the + GMSA credential spec named by the GMSACredentialSpecName field. + type: string + gmsaCredentialSpecName: + description: GMSACredentialSpecName is the name of the + GMSA credential spec to use. + type: string + hostProcess: + description: |- + HostProcess determines if a container should be run as a 'Host Process' container. + All of a Pod's containers must have the same effective HostProcess value + (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers). + In addition, if HostProcess is true then HostNetwork must also be set to true. + type: boolean + runAsUserName: + description: |- + The UserName in Windows to run the entrypoint of the container process. + Defaults to the user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: string + volumeDevices: + description: volumeDevices is the list of block devices to be + used by the Step. + type: array + items: + description: volumeDevice describes a mapping of a raw block + device within a container. + type: object + required: + - devicePath + - name + properties: + devicePath: + description: devicePath is the path inside of the container + that the device will be mapped to. + type: string + name: + description: name must match the name of a persistentVolumeClaim + in the pod + type: string + x-kubernetes-list-type: atomic + volumeMounts: + description: |- + Volumes to mount into the Step's filesystem. + Cannot be updated. + type: array + items: + description: VolumeMount describes a mounting of a Volume + within a container. + type: object + required: + - mountPath + - name + properties: + mountPath: + description: |- + Path within the container at which the volume should be mounted. Must + not contain ':'. + type: string + mountPropagation: + description: |- + mountPropagation determines how mounts are propagated from the host + to container and the other way around. + When not set, MountPropagationNone is used. + This field is beta in 1.10. + When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified + (which defaults to None). + type: string + name: + description: This must match the Name of a Volume. + type: string + readOnly: + description: |- + Mounted read-only if true, read-write otherwise (false or unspecified). + Defaults to false. + type: boolean + recursiveReadOnly: + description: |- + RecursiveReadOnly specifies whether read-only mounts should be handled + recursively. + + If ReadOnly is false, this field has no meaning and must be unspecified. + + If ReadOnly is true, and this field is set to Disabled, the mount is not made + recursively read-only. If this field is set to IfPossible, the mount is made + recursively read-only, if it is supported by the container runtime. If this + field is set to Enabled, the mount is made recursively read-only if it is + supported by the container runtime, otherwise the pod will not be started and + an error will be generated to indicate the reason. + + If this field is set to IfPossible or Enabled, MountPropagation must be set to + None (or be unspecified, which defaults to None). + + If this field is not specified, it is treated as an equivalent of Disabled. + type: string + subPath: + description: |- + Path within the volume from which the container's volume should be mounted. + Defaults to "" (volume's root). + type: string + subPathExpr: + description: |- + Expanded path within the volume from which the container's volume should be mounted. + Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment. + Defaults to "" (volume's root). + SubPathExpr and SubPath are mutually exclusive. + type: string + x-kubernetes-list-type: atomic + workingDir: + description: |- + Step's working directory. + If not specified, the container runtime's default will be used, which + might be configured in the container image. + Cannot be updated. + type: string + steps: + description: |- + Steps are the steps of the build; each step is run sequentially with the + source mounted into /workspace. + type: array + items: + description: Step runs a subcomponent of a Task + type: object + required: + - name + properties: + args: + description: |- + Arguments to the entrypoint. + The image's CMD is used if this is not provided. + Variable references $(VAR_NAME) are expanded using the container's environment. If a variable + cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will + produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless + of whether the variable exists or not. Cannot be updated. + More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell + type: array + items: + type: string + x-kubernetes-list-type: atomic + command: + description: |- + Entrypoint array. Not executed within a shell. + The image's ENTRYPOINT is used if this is not provided. + Variable references $(VAR_NAME) are expanded using the container's environment. If a variable + cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will + produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless + of whether the variable exists or not. Cannot be updated. + More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell + type: array + items: + type: string + x-kubernetes-list-type: atomic + computeResources: + description: |- + ComputeResources required by this Step. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This field depends on the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + type: array + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + type: object + required: + - name + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + requests: + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + displayName: + description: |- + DisplayName is a user-facing name of the step that may be + used to populate a UI. + type: string + env: + description: |- + List of environment variables to set in the Step. + Cannot be updated. + type: array + items: + description: EnvVar represents an environment variable present + in a Container. + type: object + required: + - name + properties: + name: + description: |- + Name of the environment variable. + May consist of any printable ASCII characters except '='. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's value. + Cannot be used if value is not empty. + type: object + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + type: object + required: + - key + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap or + its key must be defined + type: boolean + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + type: object + required: + - fieldPath + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in + the specified API version. + type: string + x-kubernetes-map-type: atomic + fileKeyRef: + description: |- + FileKeyRef selects a key of the env file. + Requires the EnvFiles feature gate to be enabled. + type: object + required: + - key + - path + - volumeName + properties: + key: + description: |- + The key within the env file. An invalid key will prevent the pod from starting. + The keys defined within a source may consist of any printable ASCII characters except '='. + During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters. + type: string + optional: + description: |- + Specify whether the file or its key must be defined. If the file or key + does not exist, then the env var is not published. + If optional is set to true and the specified key does not exist, + the environment variable will not be set in the Pod's containers. + + If optional is set to false and the specified key does not exist, + an error will be returned during Pod creation. + type: boolean + default: false + path: + description: |- + The path within the volume from which to select the file. + Must be relative and may not contain the '..' path or start with '..'. + type: string + volumeName: + description: The name of the volume mount containing + the env file. + type: string + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + type: object + required: + - resource + properties: + containerName: + description: 'Container name: required for volumes, + optional for env vars' + type: string + divisor: + description: Specifies the output format of + the exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the pod's + namespace + type: object + required: + - key + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret or its + key must be defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + envFrom: + description: |- + List of sources to populate environment variables in the Step. + The keys defined within a source must be a C_IDENTIFIER. All invalid keys + will be reported as an event when the Step is starting. When a key exists in multiple + sources, the value associated with the last source will take precedence. + Values defined by an Env with a duplicate key will take precedence. + Cannot be updated. + type: array + items: + description: EnvFromSource represents the source of a set + of ConfigMaps or Secrets + type: object + properties: + configMapRef: + description: The ConfigMap to select from + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap must + be defined + type: boolean + x-kubernetes-map-type: atomic + prefix: + description: |- + Optional text to prepend to the name of each environment variable. + May consist of any printable ASCII characters except '='. + type: string + secretRef: + description: The Secret to select from + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret must be + defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + image: + description: |- + Docker image name. + More info: https://kubernetes.io/docs/concepts/containers/images + type: string + imagePullPolicy: + description: |- + Image pull policy. + One of Always, Never, IfNotPresent. + Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/containers/images#updating-images + type: string + name: + description: |- + Name of the Step specified as a DNS_LABEL. + Each Step in a Task must have a unique name. + type: string + onError: + description: |- + OnError defines the exiting behavior of a container on error + can be set to [ continue | stopAndFail ] + type: string + params: + description: Params declares parameters passed to this step + action. + type: array + items: + description: Param declares an ParamValues to use for the + parameter called name. + type: object + required: + - name + - value + properties: + name: + type: string + value: + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + ref: + description: Contains the reference to an existing StepAction. + type: object + properties: + name: + description: Name of the referenced step + type: string + params: + description: |- + Params contains the parameters used to identify the + referenced Tekton resource. Example entries might include + "repo" or "path" but the set of params ultimately depends on + the chosen resolver. + type: array + items: + description: Param declares an ParamValues to use for + the parameter called name. + type: object + required: + - name + - value + properties: + name: + type: string + value: + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + resolver: + description: |- + Resolver is the name of the resolver that should perform + resolution of the referenced Tekton resource, such as "git". + type: string + results: + description: |- + Results declares StepResults produced by the Step. + + It can be used in an inlined Step when used to store Results to $(step.results.resultName.path). + It cannot be used when referencing StepActions using [v1.Step.Ref]. + The Results declared by the StepActions will be stored here instead. + type: array + items: + description: StepResult used to describe the Results of + a Step. + type: object + required: + - name + properties: + description: + description: Description is a human-readable description + of the result + type: string + name: + description: Name the given name + type: string + properties: + description: Properties is the JSON Schema properties + to support key-value pairs results. + type: object + additionalProperties: + description: PropertySpec defines the struct for object + keys + type: object + properties: + type: + description: |- + ParamType indicates the type of an input parameter; + Used to distinguish between a single string and an array of strings. + type: string + type: + description: The possible types are 'string', 'array', + and 'object', with 'string' as the default. + type: string + x-kubernetes-list-type: atomic + script: + description: |- + Script is the contents of an executable file to execute. + + If Script is not empty, the Step cannot have an Command and the Args will be passed to the Script. + type: string + securityContext: + description: |- + SecurityContext defines the security options the Step should be run with. + If set, the fields of SecurityContext override the equivalent fields of PodSecurityContext. + More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ + type: object + properties: + allowPrivilegeEscalation: + description: |- + AllowPrivilegeEscalation controls whether a process can gain more + privileges than its parent process. This bool directly controls if + the no_new_privs flag will be set on the container process. + AllowPrivilegeEscalation is true always when the container is: + 1) run as Privileged + 2) has CAP_SYS_ADMIN + Note that this field cannot be set when spec.os.name is windows. + type: boolean + appArmorProfile: + description: |- + appArmorProfile is the AppArmor options to use by this container. If set, this profile + overrides the pod's appArmorProfile. + Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile loaded on the node that should be used. + The profile must be preconfigured on the node to work. + Must match the loaded name of the profile. + Must be set if and only if type is "Localhost". + type: string + type: + description: |- + type indicates which kind of AppArmor profile will be applied. + Valid options are: + Localhost - a profile pre-loaded on the node. + RuntimeDefault - the container runtime's default profile. + Unconfined - no AppArmor enforcement. + type: string + capabilities: + description: |- + The capabilities to add/drop when running containers. + Defaults to the default set of capabilities granted by the container runtime. + Note that this field cannot be set when spec.os.name is windows. + type: object + properties: + add: + description: Added capabilities + type: array + items: + description: Capability represent POSIX capabilities + type + type: string + x-kubernetes-list-type: atomic + drop: + description: Removed capabilities + type: array + items: + description: Capability represent POSIX capabilities + type + type: string + x-kubernetes-list-type: atomic + privileged: + description: |- + Run container in privileged mode. + Processes in privileged containers are essentially equivalent to root on the host. + Defaults to false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + procMount: + description: |- + procMount denotes the type of proc mount to use for the containers. + The default value is Default which uses the container runtime defaults for + readonly paths and masked paths. + This requires the ProcMountType feature flag to be enabled. + Note that this field cannot be set when spec.os.name is windows. + type: string + readOnlyRootFilesystem: + description: |- + Whether this container has a read-only root filesystem. + Default is false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + runAsGroup: + description: |- + The GID to run the entrypoint of the container process. + Uses runtime default if unset. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + runAsNonRoot: + description: |- + Indicates that the container must run as a non-root user. + If true, the Kubelet will validate the image at runtime to ensure that it + does not run as UID 0 (root) and fail to start the container if it does. + If unset or false, no such validation will be performed. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: boolean + runAsUser: + description: |- + The UID to run the entrypoint of the container process. + Defaults to user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + seLinuxOptions: + description: |- + The SELinux context to be applied to the container. + If unspecified, the container runtime will allocate a random SELinux context for each + container. May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: object + properties: + level: + description: Level is SELinux level label that applies + to the container. + type: string + role: + description: Role is a SELinux role label that applies + to the container. + type: string + type: + description: Type is a SELinux type label that applies + to the container. + type: string + user: + description: User is a SELinux user label that applies + to the container. + type: string + seccompProfile: + description: |- + The seccomp options to use by this container. If seccomp options are + provided at both the pod & container level, the container options + override the pod options. + Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile defined in a file on the node should be used. + The profile must be preconfigured on the node to work. + Must be a descending path, relative to the kubelet's configured seccomp profile location. + Must be set if type is "Localhost". Must NOT be set for any other type. + type: string + type: + description: |- + type indicates which kind of seccomp profile will be applied. + Valid options are: + + Localhost - a profile defined in a file on the node should be used. + RuntimeDefault - the container runtime default profile should be used. + Unconfined - no profile should be applied. + type: string + windowsOptions: + description: |- + The Windows specific settings applied to all containers. + If unspecified, the options from the PodSecurityContext will be used. + If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is linux. + type: object + properties: + gmsaCredentialSpec: + description: |- + GMSACredentialSpec is where the GMSA admission webhook + (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the + GMSA credential spec named by the GMSACredentialSpecName field. + type: string + gmsaCredentialSpecName: + description: GMSACredentialSpecName is the name of + the GMSA credential spec to use. + type: string + hostProcess: + description: |- + HostProcess determines if a container should be run as a 'Host Process' container. + All of a Pod's containers must have the same effective HostProcess value + (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers). + In addition, if HostProcess is true then HostNetwork must also be set to true. + type: boolean + runAsUserName: + description: |- + The UserName in Windows to run the entrypoint of the container process. + Defaults to the user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: string + stderrConfig: + description: Stores configuration for the stderr stream of + the step. + type: object + properties: + path: + description: Path to duplicate stdout stream to on container's + local filesystem. + type: string + stdoutConfig: + description: Stores configuration for the stdout stream of + the step. + type: object + properties: + path: + description: Path to duplicate stdout stream to on container's + local filesystem. + type: string + timeout: + description: |- + Timeout is the time after which the step times out. Defaults to never. + Refer to Go's ParseDuration documentation for expected format: https://golang.org/pkg/time/#ParseDuration + type: string + volumeDevices: + description: volumeDevices is the list of block devices to + be used by the Step. + type: array + items: + description: volumeDevice describes a mapping of a raw block + device within a container. + type: object + required: + - devicePath + - name + properties: + devicePath: + description: devicePath is the path inside of the container + that the device will be mapped to. + type: string + name: + description: name must match the name of a persistentVolumeClaim + in the pod + type: string + x-kubernetes-list-type: atomic + volumeMounts: + description: |- + Volumes to mount into the Step's filesystem. + Cannot be updated. + type: array + items: + description: VolumeMount describes a mounting of a Volume + within a container. + type: object + required: + - mountPath + - name + properties: + mountPath: + description: |- + Path within the container at which the volume should be mounted. Must + not contain ':'. + type: string + mountPropagation: + description: |- + mountPropagation determines how mounts are propagated from the host + to container and the other way around. + When not set, MountPropagationNone is used. + This field is beta in 1.10. + When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified + (which defaults to None). + type: string + name: + description: This must match the Name of a Volume. + type: string + readOnly: + description: |- + Mounted read-only if true, read-write otherwise (false or unspecified). + Defaults to false. + type: boolean + recursiveReadOnly: + description: |- + RecursiveReadOnly specifies whether read-only mounts should be handled + recursively. + + If ReadOnly is false, this field has no meaning and must be unspecified. + + If ReadOnly is true, and this field is set to Disabled, the mount is not made + recursively read-only. If this field is set to IfPossible, the mount is made + recursively read-only, if it is supported by the container runtime. If this + field is set to Enabled, the mount is made recursively read-only if it is + supported by the container runtime, otherwise the pod will not be started and + an error will be generated to indicate the reason. + + If this field is set to IfPossible or Enabled, MountPropagation must be set to + None (or be unspecified, which defaults to None). + + If this field is not specified, it is treated as an equivalent of Disabled. + type: string + subPath: + description: |- + Path within the volume from which the container's volume should be mounted. + Defaults to "" (volume's root). + type: string + subPathExpr: + description: |- + Expanded path within the volume from which the container's volume should be mounted. + Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment. + Defaults to "" (volume's root). + SubPathExpr and SubPath are mutually exclusive. + type: string + x-kubernetes-list-type: atomic + when: + description: When is a list of when expressions that need + to be true for the task to run + type: array + items: + description: |- + WhenExpression allows a PipelineTask to declare expressions to be evaluated before the Task is run + to determine whether the Task should be executed or skipped + type: object + properties: + cel: + description: |- + CEL is a string of Common Language Expression, which can be used to conditionally execute + the task based on the result of the expression evaluation + More info about CEL syntax: https://github.com/google/cel-spec/blob/master/doc/langdef.md + type: string + input: + description: Input is the string for guard checking + which can be a static input or an output from a parent + Task + type: string + operator: + description: Operator that represents an Input's relationship + to the values + type: string + values: + description: |- + Values is an array of strings, which is compared against the input, for guard checking + It must be non-empty + type: array + items: + type: string + x-kubernetes-list-type: atomic + workingDir: + description: |- + Step's working directory. + If not specified, the container runtime's default will be used, which + might be configured in the container image. + Cannot be updated. + type: string + workspaces: + description: |- + This is an alpha field. You must set the "enable-api-fields" feature flag to "alpha" + for this field to be supported. + + Workspaces is a list of workspaces from the Task that this Step wants + exclusive access to. Adding a workspace to this list means that any + other Step or Sidecar that does not also request this Workspace will + not have access to it. + type: array + items: + description: |- + WorkspaceUsage is used by a Step or Sidecar to declare that it wants isolated access + to a Workspace defined in a Task. + type: object + required: + - mountPath + - name + properties: + mountPath: + description: |- + MountPath is the path that the workspace should be mounted to inside the Step or Sidecar, + overriding any MountPath specified in the Task's WorkspaceDeclaration. + type: string + name: + description: Name is the name of the workspace this + Step or Sidecar wants access to. + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + volumes: + description: |- + Volumes is a collection of volumes that are available to mount into the + steps of the build. + See Pod.spec.volumes (API version: v1) + x-kubernetes-preserve-unknown-fields: true + workspaces: + description: Workspaces are the volumes that this Task requires. + type: array + items: + description: WorkspaceDeclaration is a declaration of a volume + that a Task requires. + type: object + required: + - name + properties: + description: + description: Description is an optional human readable description + of this volume. + type: string + mountPath: + description: MountPath overrides the directory that the volume + will be made available at. + type: string + name: + description: Name is the name by which you can bind the volume + at runtime. + type: string + optional: + description: |- + Optional marks a Workspace as not being required in TaskRuns. By default + this field is false and so declared workspaces are required. + type: boolean + readOnly: + description: |- + ReadOnly dictates whether a mounted volume is writable. By default this + field is false and so mounted volumes are writable. + type: boolean + x-kubernetes-list-type: atomic + # Opt into the status subresource so metadata.generation + # starts to increment + subresources: + status: {} + names: + kind: Task + plural: tasks + singular: task + categories: + - tekton + - tekton-pipelines + scope: Namespaced + conversion: + strategy: Webhook + webhook: + conversionReviewVersions: ["v1beta1", "v1"] + clientConfig: + service: + name: tekton-pipelines-webhook + namespace: tekton-pipelines +--- +# Copyright 2019 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: taskruns.tekton.dev + labels: + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines + pipeline.tekton.dev/release: "v1.15.0" + version: "v1.15.0" +spec: + group: tekton.dev + preserveUnknownFields: false + versions: + - name: v1beta1 + served: true + storage: false + schema: + openAPIV3Schema: + description: |- + TaskRun + Deprecated: Please use v1.TaskRun instead. + type: object + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: Spec + type: object + properties: + computeResources: + description: ComputeResources + type: object + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This field depends on the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + type: array + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + type: object + required: + - name + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + requests: + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + debug: + description: Debug + type: object + properties: + breakpoints: + description: Breakpoints + type: object + properties: + beforeSteps: + description: BeforeSteps + type: array + items: + type: string + x-kubernetes-list-type: atomic + onFailure: + description: OnFailure + type: string + managedBy: + description: ManagedBy + type: string + params: + description: Params + type: array + items: + description: Param + type: object + required: + - name + - value + properties: + name: + type: string + value: + description: Value + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + podTemplate: + description: PodTemplate + type: object + properties: + affinity: + description: |- + If specified, the pod's scheduling constraints. + See Pod.spec.affinity (API version: v1) + x-kubernetes-preserve-unknown-fields: true + automountServiceAccountToken: + description: |- + AutomountServiceAccountToken indicates whether pods running as this + service account should have an API token automatically mounted. + type: boolean + dnsConfig: + description: |- + Specifies the DNS parameters of a pod. + Parameters specified here will be merged to the generated DNS + configuration based on DNSPolicy. + type: object + properties: + nameservers: + description: |- + A list of DNS name server IP addresses. + This will be appended to the base nameservers generated from DNSPolicy. + Duplicated nameservers will be removed. + type: array + items: + type: string + x-kubernetes-list-type: atomic + options: + description: |- + A list of DNS resolver options. + This will be merged with the base options generated from DNSPolicy. + Duplicated entries will be removed. Resolution options given in Options + will override those that appear in the base DNSPolicy. + type: array + items: + description: PodDNSConfigOption defines DNS resolver options + of a pod. + type: object + properties: + name: + description: |- + Name is this DNS resolver option's name. + Required. + type: string + value: + description: Value is this DNS resolver option's value. + type: string + x-kubernetes-list-type: atomic + searches: + description: |- + A list of DNS search domains for host-name lookup. + This will be appended to the base search paths generated from DNSPolicy. + Duplicated search paths will be removed. + type: array + items: + type: string + x-kubernetes-list-type: atomic + dnsPolicy: + description: |- + Set DNS policy for the pod. Defaults to "ClusterFirst". Valid values are + 'ClusterFirst', 'Default' or 'None'. DNS parameters given in DNSConfig + will be merged with the policy selected with DNSPolicy. + type: string + enableServiceLinks: + description: |- + EnableServiceLinks indicates whether information about services should be injected into pod's + environment variables, matching the syntax of Docker links. + Optional: Defaults to true. + type: boolean + env: + description: List of environment variables that can be provided + to the containers belonging to the pod. + type: array + items: + description: EnvVar represents an environment variable present + in a Container. + type: object + required: + - name + properties: + name: + description: |- + Name of the environment variable. + May consist of any printable ASCII characters except '='. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's value. + Cannot be used if value is not empty. + type: object + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + type: object + required: + - key + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap or + its key must be defined + type: boolean + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + type: object + required: + - fieldPath + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in the + specified API version. + type: string + x-kubernetes-map-type: atomic + fileKeyRef: + description: |- + FileKeyRef selects a key of the env file. + Requires the EnvFiles feature gate to be enabled. + type: object + required: + - key + - path + - volumeName + properties: + key: + description: |- + The key within the env file. An invalid key will prevent the pod from starting. + The keys defined within a source may consist of any printable ASCII characters except '='. + During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters. + type: string + optional: + description: |- + Specify whether the file or its key must be defined. If the file or key + does not exist, then the env var is not published. + If optional is set to true and the specified key does not exist, + the environment variable will not be set in the Pod's containers. + + If optional is set to false and the specified key does not exist, + an error will be returned during Pod creation. + type: boolean + default: false + path: + description: |- + The path within the volume from which to select the file. + Must be relative and may not contain the '..' path or start with '..'. + type: string + volumeName: + description: The name of the volume mount containing + the env file. + type: string + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + type: object + required: + - resource + properties: + containerName: + description: 'Container name: required for volumes, + optional for env vars' + type: string + divisor: + description: Specifies the output format of the + exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the pod's + namespace + type: object + required: + - key + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret or its + key must be defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + hostAliases: + description: |- + HostAliases is an optional list of hosts and IPs that will be injected into the pod's hosts + file if specified. This is only valid for non-hostNetwork pods. + type: array + items: + description: |- + HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the + pod's hosts file. + type: object + required: + - ip + properties: + hostnames: + description: Hostnames for the above IP address. + type: array + items: + type: string + x-kubernetes-list-type: atomic + ip: + description: IP address of the host file entry. + type: string + x-kubernetes-list-type: atomic + hostNetwork: + description: HostNetwork specifies whether the pod may use the + node network namespace + type: boolean + hostUsers: + description: |- + HostUsers indicates whether the pod will use the host's user namespace. + Optional: Default to true. + If set to true or not present, the pod will be run in the host user namespace, useful + for when the pod needs a feature only available to the host user namespace, such as + loading a kernel module with CAP_SYS_MODULE. + When set to false, a new user namespace is created for the pod. Setting false + is useful to mitigating container breakout vulnerabilities such as allowing + containers to run as root without their user having root privileges on the host. + This field depends on the kubernetes feature gate UserNamespacesSupport being enabled. + type: boolean + imagePullSecrets: + description: ImagePullSecrets gives the name of the secret used + by the pod to pull the image if specified + type: array + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + nodeSelector: + description: |- + NodeSelector is a selector which must be true for the pod to fit on a node. + Selector which must match a node's labels for the pod to be scheduled on that node. + More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ + type: object + additionalProperties: + type: string + priorityClassName: + description: |- + If specified, indicates the pod's priority. "system-node-critical" and + "system-cluster-critical" are two special keywords which indicate the + highest priorities with the former being the highest priority. Any other + name must be defined by creating a PriorityClass object with that name. + If not specified, the pod priority will be default or zero if there is no + default. + type: string + runtimeClassName: + description: |- + RuntimeClassName refers to a RuntimeClass object in the node.k8s.io + group, which should be used to run this pod. If no RuntimeClass resource + matches the named class, the pod will not be run. If unset or empty, the + "legacy" RuntimeClass will be used, which is an implicit class with an + empty definition that uses the default runtime handler. + More info: https://git.k8s.io/enhancements/keps/sig-node/runtime-class.md + This is a beta feature as of Kubernetes v1.14. + type: string + schedulerName: + description: SchedulerName specifies the scheduler to be used + to dispatch the Pod + type: string + securityContext: + description: |- + SecurityContext holds pod-level security attributes and common container settings. + Optional: Defaults to empty. See type description for default values of each field. + See Pod.spec.securityContext (API version: v1) + x-kubernetes-preserve-unknown-fields: true + tolerations: + description: If specified, the pod's tolerations. + type: array + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + type: object + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + type: integer + format: int64 + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + x-kubernetes-list-type: atomic + topologySpreadConstraints: + description: |- + TopologySpreadConstraints controls how Pods are spread across your cluster among + failure-domains such as regions, zones, nodes, and other user-defined topology domains. + type: array + items: + description: TopologySpreadConstraint specifies how to spread + matching pods among the given topology. + type: object + required: + - maxSkew + - topologyKey + - whenUnsatisfiable + properties: + labelSelector: + description: |- + LabelSelector is used to find matching pods. + Pods that match this label selector are counted to determine the number of pods + in their corresponding topology domain. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select the pods over which + spreading will be calculated. The keys are used to lookup values from the + incoming pod labels, those key-value labels are ANDed with labelSelector + to select the group of existing pods over which spreading will be calculated + for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + MatchLabelKeys cannot be set when LabelSelector isn't set. + Keys that don't exist in the incoming pod labels will + be ignored. A null or empty list means only match against labelSelector. + + This is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default). + type: array + items: + type: string + x-kubernetes-list-type: atomic + maxSkew: + description: |- + MaxSkew describes the degree to which pods may be unevenly distributed. + When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference + between the number of matching pods in the target topology and the global minimum. + The global minimum is the minimum number of matching pods in an eligible domain + or zero if the number of eligible domains is less than MinDomains. + For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same + labelSelector spread as 2/2/1: + In this case, the global minimum is 1. + | zone1 | zone2 | zone3 | + | P P | P P | P | + - if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2; + scheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2) + violate MaxSkew(1). + - if MaxSkew is 2, incoming pod can be scheduled onto any zone. + When `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence + to topologies that satisfy it. + It's a required field. Default value is 1 and 0 is not allowed. + type: integer + format: int32 + minDomains: + description: |- + MinDomains indicates a minimum number of eligible domains. + When the number of eligible domains with matching topology keys is less than minDomains, + Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed. + And when the number of eligible domains with matching topology keys equals or greater than minDomains, + this value has no effect on scheduling. + As a result, when the number of eligible domains is less than minDomains, + scheduler won't schedule more than maxSkew Pods to those domains. + If value is nil, the constraint behaves as if MinDomains is equal to 1. + Valid values are integers greater than 0. + When value is not nil, WhenUnsatisfiable must be DoNotSchedule. + + For example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same + labelSelector spread as 2/2/2: + | zone1 | zone2 | zone3 | + | P P | P P | P P | + The number of domains is less than 5(MinDomains), so "global minimum" is treated as 0. + In this situation, new pod with the same labelSelector cannot be scheduled, + because computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones, + it will violate MaxSkew. + type: integer + format: int32 + nodeAffinityPolicy: + description: |- + NodeAffinityPolicy indicates how we will treat Pod's nodeAffinity/nodeSelector + when calculating pod topology spread skew. Options are: + - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations. + - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations. + + If this value is nil, the behavior is equivalent to the Honor policy. + type: string + nodeTaintsPolicy: + description: |- + NodeTaintsPolicy indicates how we will treat node taints when calculating + pod topology spread skew. Options are: + - Honor: nodes without taints, along with tainted nodes for which the incoming pod + has a toleration, are included. + - Ignore: node taints are ignored. All nodes are included. + + If this value is nil, the behavior is equivalent to the Ignore policy. + type: string + topologyKey: + description: |- + TopologyKey is the key of node labels. Nodes that have a label with this key + and identical values are considered to be in the same topology. + We consider each as a "bucket", and try to put balanced number + of pods into each bucket. + We define a domain as a particular instance of a topology. + Also, we define an eligible domain as a domain whose nodes meet the requirements of + nodeAffinityPolicy and nodeTaintsPolicy. + e.g. If TopologyKey is "kubernetes.io/hostname", each Node is a domain of that topology. + And, if TopologyKey is "topology.kubernetes.io/zone", each zone is a domain of that topology. + It's a required field. + type: string + whenUnsatisfiable: + description: |- + WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy + the spread constraint. + - DoNotSchedule (default) tells the scheduler not to schedule it. + - ScheduleAnyway tells the scheduler to schedule the pod in any location, + but giving higher precedence to topologies that would help reduce the + skew. + A constraint is considered "Unsatisfiable" for an incoming pod + if and only if every possible node assignment for that pod would violate + "MaxSkew" on some topology. + For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same + labelSelector spread as 3/1/1: + | zone1 | zone2 | zone3 | + | P P P | P | P | + If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled + to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies + MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler + won't make it *more* imbalanced. + It's a required field. + type: string + x-kubernetes-list-type: atomic + volumes: + description: |- + List of volumes that can be mounted by containers belonging to the pod. + More info: https://kubernetes.io/docs/concepts/storage/volumes + See Pod.spec.volumes (API version: v1) + x-kubernetes-preserve-unknown-fields: true + resources: + description: |- + Resources + Deprecated: Unused, preserved only for backwards compatibility + type: object + properties: + inputs: + description: Inputs + type: array + items: + description: |- + TaskResourceBinding + Deprecated: Unused, preserved only for backwards compatibility + type: object + properties: + name: + description: Name + type: string + paths: + description: Paths + type: array + items: + type: string + x-kubernetes-list-type: atomic + resourceRef: + description: ResourceRef + type: object + properties: + apiVersion: + description: APIVersion + type: string + name: + description: Name + type: string + resourceSpec: + description: ResourceSpec + type: object + required: + - params + - type + properties: + description: + description: |- + Description is a user-facing description of the resource that may be + used to populate a UI. + type: string + params: + type: array + items: + description: |- + ResourceParam declares a string value to use for the parameter called Name, and is used in + the specific context of PipelineResources. + + Deprecated: Unused, preserved only for backwards compatibility + type: object + required: + - name + - value + properties: + name: + type: string + value: + type: string + x-kubernetes-list-type: atomic + secrets: + description: Secrets to fetch to populate some of + resource fields + type: array + items: + description: |- + SecretParam indicates which secret can be used to populate a field of the resource + + Deprecated: Unused, preserved only for backwards compatibility + type: object + required: + - fieldName + - secretKey + - secretName + properties: + fieldName: + type: string + secretKey: + type: string + secretName: + type: string + x-kubernetes-list-type: atomic + type: + description: |- + PipelineResourceType represents the type of endpoint the pipelineResource is, so that the + controller will know this pipelineResource shouldx be fetched and optionally what + additional metatdata should be provided for it. + + Deprecated: Unused, preserved only for backwards compatibility + type: string + x-kubernetes-list-type: atomic + outputs: + description: Outputs + type: array + items: + description: |- + TaskResourceBinding + Deprecated: Unused, preserved only for backwards compatibility + type: object + properties: + name: + description: Name + type: string + paths: + description: Paths + type: array + items: + type: string + x-kubernetes-list-type: atomic + resourceRef: + description: ResourceRef + type: object + properties: + apiVersion: + description: APIVersion + type: string + name: + description: Name + type: string + resourceSpec: + description: ResourceSpec + type: object + required: + - params + - type + properties: + description: + description: |- + Description is a user-facing description of the resource that may be + used to populate a UI. + type: string + params: + type: array + items: + description: |- + ResourceParam declares a string value to use for the parameter called Name, and is used in + the specific context of PipelineResources. + + Deprecated: Unused, preserved only for backwards compatibility + type: object + required: + - name + - value + properties: + name: + type: string + value: + type: string + x-kubernetes-list-type: atomic + secrets: + description: Secrets to fetch to populate some of + resource fields + type: array + items: + description: |- + SecretParam indicates which secret can be used to populate a field of the resource + + Deprecated: Unused, preserved only for backwards compatibility + type: object + required: + - fieldName + - secretKey + - secretName + properties: + fieldName: + type: string + secretKey: + type: string + secretName: + type: string + x-kubernetes-list-type: atomic + type: + description: |- + PipelineResourceType represents the type of endpoint the pipelineResource is, so that the + controller will know this pipelineResource shouldx be fetched and optionally what + additional metatdata should be provided for it. + + Deprecated: Unused, preserved only for backwards compatibility + type: string + x-kubernetes-list-type: atomic + retries: + description: Retries + type: integer + serviceAccountName: + description: ServiceAccountName + type: string + sidecarOverrides: + description: SidecarOverrides + type: array + items: + description: TaskRunSidecarOverride + type: object + required: + - name + - resources + properties: + name: + description: Name + type: string + resources: + description: Resources + type: object + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This field depends on the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + type: array + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + type: object + required: + - name + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + requests: + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + x-kubernetes-list-type: atomic + status: + description: Status + type: string + statusMessage: + description: StatusMessage + type: string + stepOverrides: + description: StepOverrides + type: array + items: + description: TaskRunStepOverride + type: object + required: + - name + - resources + properties: + name: + description: Name + type: string + resources: + description: Resources + type: object + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This field depends on the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + type: array + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + type: object + required: + - name + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + requests: + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + x-kubernetes-list-type: atomic + taskRef: + description: TaskRef + type: object + properties: + apiVersion: + description: APIVersion + type: string + bundle: + description: |- + Deprecated: Please use ResolverRef with the bundles resolver instead. + Bundle + type: string + kind: + description: Kind + type: string + name: + description: Name + type: string + params: + description: Params + type: array + items: + description: Param + type: object + required: + - name + - value + properties: + name: + type: string + value: + description: Value + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + resolver: + description: Resolver + type: string + taskSpec: + description: TaskSpec + x-kubernetes-preserve-unknown-fields: true + timeout: + description: Timeout + type: string + workspaces: + description: Workspaces + type: array + items: + description: WorkspaceBinding + type: object + required: + - name + properties: + configMap: + description: ConfigMap + type: object + properties: + defaultMode: + description: |- + defaultMode is optional: mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + Defaults to 0644. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + ConfigMap will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the ConfigMap, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: optional specify whether the ConfigMap or + its keys must be defined + type: boolean + x-kubernetes-map-type: atomic + csi: + description: CSI + type: object + required: + - driver + properties: + driver: + description: |- + driver is the name of the CSI driver that handles this volume. + Consult with your admin for the correct name as registered in the cluster. + type: string + fsType: + description: |- + fsType to mount. Ex. "ext4", "xfs", "ntfs". + If not provided, the empty value is passed to the associated CSI driver + which will determine the default filesystem to apply. + type: string + nodePublishSecretRef: + description: |- + nodePublishSecretRef is a reference to the secret object containing + sensitive information to pass to the CSI driver to complete the CSI + NodePublishVolume and NodeUnpublishVolume calls. + This field is optional, and may be empty if no secret is required. If the + secret object contains more than one secret, all secret references are passed. + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + x-kubernetes-map-type: atomic + readOnly: + description: |- + readOnly specifies a read-only configuration for the volume. + Defaults to false (read/write). + type: boolean + volumeAttributes: + description: |- + volumeAttributes stores driver-specific properties that are passed to the CSI + driver. Consult your driver's documentation for supported values. + type: object + additionalProperties: + type: string + emptyDir: + description: EmptyDir + type: object + properties: + medium: + description: |- + medium represents what type of storage medium should back this directory. + The default is "" which means to use the node's default medium. + Must be an empty string (default) or Memory. + More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir + type: string + sizeLimit: + description: |- + sizeLimit is the total amount of local storage required for this EmptyDir volume. + The size limit is also applicable for memory medium. + The maximum usage on memory medium EmptyDir would be the minimum value between + the SizeLimit specified here and the sum of memory limits of all containers in a pod. + The default is nil which means that the limit is undefined. + More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + name: + description: Name + type: string + persistentVolumeClaim: + description: PersistentVolumeClaim + type: object + required: + - claimName + properties: + claimName: + description: |- + claimName is the name of a PersistentVolumeClaim in the same namespace as the pod using this volume. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims + type: string + readOnly: + description: |- + readOnly Will force the ReadOnly setting in VolumeMounts. + Default false. + type: boolean + projected: + description: Projected + type: object + properties: + defaultMode: + description: |- + defaultMode are the mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + sources: + description: |- + sources is the list of volume projections. Each entry in this list + handles one source. + type: array + items: + description: |- + Projection that may be projected along with other supported volume types. + Exactly one of these fields must be set. + type: object + properties: + clusterTrustBundle: + description: |- + ClusterTrustBundle allows a pod to access the `.spec.trustBundle` field + of ClusterTrustBundle objects in an auto-updating file. + + Alpha, gated by the ClusterTrustBundleProjection feature gate. + + ClusterTrustBundle objects can either be selected by name, or by the + combination of signer name and a label selector. + + Kubelet performs aggressive normalization of the PEM contents written + into the pod filesystem. Esoteric PEM features such as inter-block + comments and block headers are stripped. Certificates are deduplicated. + The ordering of certificates within the file is arbitrary, and Kubelet + may change the order over time. + type: object + required: + - path + properties: + labelSelector: + description: |- + Select all ClusterTrustBundles that match this label selector. Only has + effect if signerName is set. Mutually-exclusive with name. If unset, + interpreted as "match nothing". If set but empty, interpreted as "match + everything". + type: object + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + name: + description: |- + Select a single ClusterTrustBundle by object name. Mutually-exclusive + with signerName and labelSelector. + type: string + optional: + description: |- + If true, don't block pod startup if the referenced ClusterTrustBundle(s) + aren't available. If using name, then the named ClusterTrustBundle is + allowed not to exist. If using signerName, then the combination of + signerName and labelSelector is allowed to match zero + ClusterTrustBundles. + type: boolean + path: + description: Relative path from the volume root + to write the bundle. + type: string + signerName: + description: |- + Select all ClusterTrustBundles that match this signer name. + Mutually-exclusive with name. The contents of all selected + ClusterTrustBundles will be unified and deduplicated. + type: string + configMap: + description: configMap information about the configMap + data to project + type: object + properties: + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + ConfigMap will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the ConfigMap, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within + a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: optional specify whether the ConfigMap + or its keys must be defined + type: boolean + x-kubernetes-map-type: atomic + downwardAPI: + description: downwardAPI information about the downwardAPI + data to project + type: object + properties: + items: + description: Items is a list of DownwardAPIVolume + file + type: array + items: + description: DownwardAPIVolumeFile represents + information to create the file containing + the pod field + type: object + required: + - path + properties: + fieldRef: + description: 'Required: Selects a field + of the pod: only annotations, labels, + name, namespace and uid are supported.' + type: object + required: + - fieldPath + properties: + apiVersion: + description: Version of the schema + the FieldPath is written in terms + of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to + select in the specified API version. + type: string + x-kubernetes-map-type: atomic + mode: + description: |- + Optional: mode bits used to set permissions on this file, must be an octal value + between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: 'Required: Path is the relative + path name of the file to be created. + Must not be absolute or contain the + ''..'' path. Must be utf-8 encoded. + The first item of the relative path + must not start with ''..''' + type: string + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported. + type: object + required: + - resource + properties: + containerName: + description: 'Container name: required + for volumes, optional for env vars' + type: string + divisor: + description: Specifies the output + format of the exposed resources, + defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to + select' + type: string + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + podCertificate: + description: |- + Projects an auto-rotating credential bundle (private key and certificate + chain) that the pod can use either as a TLS client or server. + + Kubelet generates a private key and uses it to send a + PodCertificateRequest to the named signer. Once the signer approves the + request and issues a certificate chain, Kubelet writes the key and + certificate chain to the pod filesystem. The pod does not start until + certificates have been issued for each podCertificate projected volume + source in its spec. + + Kubelet will begin trying to rotate the certificate at the time indicated + by the signer using the PodCertificateRequest.Status.BeginRefreshAt + timestamp. + + Kubelet can write a single file, indicated by the credentialBundlePath + field, or separate files, indicated by the keyPath and + certificateChainPath fields. + + The credential bundle is a single file in PEM format. The first PEM + entry is the private key (in PKCS#8 format), and the remaining PEM + entries are the certificate chain issued by the signer (typically, + signers will return their certificate chain in leaf-to-root order). + + Prefer using the credential bundle format, since your application code + can read it atomically. If you use keyPath and certificateChainPath, + your application must make two separate file reads. If these coincide + with a certificate rotation, it is possible that the private key and leaf + certificate you read may not correspond to each other. Your application + will need to check for this condition, and re-read until they are + consistent. + + The named signer controls chooses the format of the certificate it + issues; consult the signer implementation's documentation to learn how to + use the certificates it issues. + type: object + required: + - keyType + - signerName + properties: + certificateChainPath: + description: |- + Write the certificate chain at this path in the projected volume. + + Most applications should use credentialBundlePath. When using keyPath + and certificateChainPath, your application needs to check that the key + and leaf certificate are consistent, because it is possible to read the + files mid-rotation. + type: string + credentialBundlePath: + description: |- + Write the credential bundle at this path in the projected volume. + + The credential bundle is a single file that contains multiple PEM blocks. + The first PEM block is a PRIVATE KEY block, containing a PKCS#8 private + key. + + The remaining blocks are CERTIFICATE blocks, containing the issued + certificate chain from the signer (leaf and any intermediates). + + Using credentialBundlePath lets your Pod's application code make a single + atomic read that retrieves a consistent key and certificate chain. If you + project them to separate files, your application code will need to + additionally check that the leaf certificate was issued to the key. + type: string + keyPath: + description: |- + Write the key at this path in the projected volume. + + Most applications should use credentialBundlePath. When using keyPath + and certificateChainPath, your application needs to check that the key + and leaf certificate are consistent, because it is possible to read the + files mid-rotation. + type: string + keyType: + description: |- + The type of keypair Kubelet will generate for the pod. + + Valid values are "RSA3072", "RSA4096", "ECDSAP256", "ECDSAP384", + "ECDSAP521", and "ED25519". + type: string + maxExpirationSeconds: + description: |- + maxExpirationSeconds is the maximum lifetime permitted for the + certificate. + + Kubelet copies this value verbatim into the PodCertificateRequests it + generates for this projection. + + If omitted, kube-apiserver will set it to 86400(24 hours). kube-apiserver + will reject values shorter than 3600 (1 hour). The maximum allowable + value is 7862400 (91 days). + + The signer implementation is then free to issue a certificate with any + lifetime *shorter* than MaxExpirationSeconds, but no shorter than 3600 + seconds (1 hour). This constraint is enforced by kube-apiserver. + `kubernetes.io` signers will never issue certificates with a lifetime + longer than 24 hours. + type: integer + format: int32 + signerName: + description: Kubelet's generated CSRs will be + addressed to this signer. + type: string + userAnnotations: + description: |- + userAnnotations allow pod authors to pass additional information to + the signer implementation. Kubernetes does not restrict or validate this + metadata in any way. + + These values are copied verbatim into the `spec.unverifiedUserAnnotations` field of + the PodCertificateRequest objects that Kubelet creates. + + Entries are subject to the same validation as object metadata annotations, + with the addition that all keys must be domain-prefixed. No restrictions + are placed on values, except an overall size limitation on the entire field. + + Signers should document the keys and values they support. Signers should + deny requests that contain keys they do not recognize. + type: object + additionalProperties: + type: string + secret: + description: secret information about the secret + data to project + type: object + properties: + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + Secret will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the Secret, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within + a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: optional field specify whether + the Secret or its key must be defined + type: boolean + x-kubernetes-map-type: atomic + serviceAccountToken: + description: serviceAccountToken is information + about the serviceAccountToken data to project + type: object + required: + - path + properties: + audience: + description: |- + audience is the intended audience of the token. A recipient of a token + must identify itself with an identifier specified in the audience of the + token, and otherwise should reject the token. The audience defaults to the + identifier of the apiserver. + type: string + expirationSeconds: + description: |- + expirationSeconds is the requested duration of validity of the service + account token. As the token approaches expiration, the kubelet volume + plugin will proactively rotate the service account token. The kubelet will + start trying to rotate the token if the token is older than 80 percent of + its time to live or if the token is older than 24 hours.Defaults to 1 hour + and must be at least 10 minutes. + type: integer + format: int64 + path: + description: |- + path is the path relative to the mount point of the file to project the + token into. + type: string + x-kubernetes-list-type: atomic + secret: + description: Secret + type: object + properties: + defaultMode: + description: |- + defaultMode is Optional: mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values + for mode bits. Defaults to 0644. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + items: + description: |- + items If unspecified, each key-value pair in the Data field of the referenced + Secret will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the Secret, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + optional: + description: optional field specify whether the Secret + or its keys must be defined + type: boolean + secretName: + description: |- + secretName is the name of the secret in the pod's namespace to use. + More info: https://kubernetes.io/docs/concepts/storage/volumes#secret + type: string + subPath: + description: SubPath + type: string + volumeClaimTemplate: + description: VolumeClaimTemplate + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + status: + description: Status + type: object + required: + - podName + properties: + annotations: + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + additionalProperties: + type: string + cloudEvents: + description: CloudEvents + type: array + items: + description: CloudEventDelivery + type: object + properties: + status: + description: CloudEventDeliveryState + type: object + required: + - message + - retryCount + properties: + condition: + description: Condition + type: string + message: + description: Error + type: string + retryCount: + description: RetryCount + type: integer + format: int32 + sentAt: + description: SentAt + type: string + format: date-time + target: + description: Target + type: string + x-kubernetes-list-type: atomic + completionTime: + description: CompletionTime + type: string + format: date-time + conditions: + description: Conditions the latest available observations of a resource's + current state. + type: array + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + type: object + required: + - status + - type + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating details about + the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, False, + Unknown. + type: string + type: + description: Type of condition. + type: string + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + type: integer + format: int64 + podName: + description: PodName + type: string + provenance: + description: Provenance + type: object + properties: + configSource: + description: |- + ConfigSource + Deprecated: Use RefSource instead + type: object + properties: + digest: + description: Digest + type: object + additionalProperties: + type: string + entryPoint: + description: EntryPoint + type: string + uri: + description: URI + type: string + featureFlags: + description: FeatureFlags + type: object + properties: + awaitSidecarReadiness: + type: boolean + coschedule: + type: string + disableCredsInit: + type: boolean + disableInlineSpec: + type: string + enableAPIFields: + type: string + enableArtifacts: + type: boolean + enableCELInWhenExpression: + type: boolean + enableConciseResolverSyntax: + type: boolean + enableKeepPodOnCancel: + type: boolean + enableKubernetesSidecar: + type: boolean + enableParamEnum: + type: boolean + enableProvenanceInStatus: + type: boolean + enableStepActions: + description: EnableStepActions is a no-op flag since StepActions + are stable + type: boolean + enableTektonOCIBundles: + description: |- + DeprecatedEnableTektonOCIBundles is maintained for backward compatibility + to allow deletion of PipelineRuns created before v0.62.x. + This field is not used and can be removed in a future release + once we're confident old PipelineRuns have been cleaned up. + See issue #8359 for context. + type: boolean + enableTerminationMessageCompression: + type: boolean + enableWaitExponentialBackoff: + type: boolean + enforceNonfalsifiability: + type: string + maxResultSize: + type: integer + requireGitSSHSecretKnownHosts: + type: boolean + resultExtractionMethod: + type: string + runningInEnvWithInjectedSidecars: + type: boolean + sendCloudEventsForRuns: + type: boolean + setSecurityContext: + type: boolean + setSecurityContextReadOnlyRootFilesystem: + type: boolean + verificationNoMatchPolicy: + description: |- + VerificationNoMatchPolicy is the feature flag for "trusted-resources-verification-no-match-policy" + VerificationNoMatchPolicy can be set to "ignore", "warn" and "fail" values. + ignore: skip trusted resources verification when no matching verification policies found + warn: skip trusted resources verification when no matching verification policies found and log a warning + fail: fail the taskrun or pipelines run if no matching verification policies found + type: string + refSource: + description: RefSource + type: object + properties: + digest: + description: Digest + type: object + additionalProperties: + type: string + entryPoint: + description: EntryPoint + type: string + uri: + description: URI + type: string + resourcesResult: + description: |- + ResourcesResult + Deprecated: this field is not populated and is preserved only for backwards compatibility + type: array + items: + description: |- + RunResult is used to write key/value pairs to TaskRun pod termination messages. + The key/value pairs may come from the entrypoint binary, or represent a TaskRunResult. + If they represent a TaskRunResult, the key is the name of the result and the value is the + JSON-serialized value of the result. + type: object + required: + - key + - value + properties: + key: + type: string + resourceName: + description: |- + ResourceName may be used in tests, but it is not populated in termination messages. + It is preserved here for backwards compatibility and will not be ported to v1. + type: string + type: + description: |- + ResultType used to find out whether a RunResult is from a task result or not + Note that ResultsType is another type which is used to define the data type + (e.g. string, array, etc) we used for Results + type: integer + value: + type: string + x-kubernetes-list-type: atomic + retriesStatus: + description: RetriesStatus + x-kubernetes-preserve-unknown-fields: true + sidecars: + description: Sidecars + type: array + items: + description: SidecarState + type: object + properties: + container: + type: string + imageID: + type: string + name: + type: string + running: + description: Details about a running container + type: object + properties: + startedAt: + description: Time at which the container was last (re-)started + type: string + format: date-time + terminated: + description: Details about a terminated container + type: object + required: + - exitCode + properties: + containerID: + description: Container's ID in the format '://' + type: string + exitCode: + description: Exit status from the last termination of + the container + type: integer + format: int32 + finishedAt: + description: Time at which the container last terminated + type: string + format: date-time + message: + description: Message regarding the last termination of + the container + type: string + reason: + description: (brief) reason from the last termination + of the container + type: string + signal: + description: Signal from the last termination of the container + type: integer + format: int32 + startedAt: + description: Time at which previous execution of the container + started + type: string + format: date-time + waiting: + description: Details about a waiting container + type: object + properties: + message: + description: Message regarding why the container is not + yet running. + type: string + reason: + description: (brief) reason the container is not yet running. + type: string + x-kubernetes-list-type: atomic + spanContext: + description: SpanContext + type: object + additionalProperties: + type: string + startTime: + description: StartTime + type: string + format: date-time + steps: + description: Steps + type: array + items: + description: StepState + type: object + properties: + container: + type: string + imageID: + type: string + inputs: + type: array + items: + description: Artifact + type: object + properties: + buildOutput: + description: BuildOutput + type: boolean + name: + description: Name + type: string + values: + description: Values + type: array + items: + description: ArtifactValue + type: object + properties: + digest: + type: object + additionalProperties: + type: string + uri: + type: string + name: + type: string + outputs: + type: array + items: + description: Artifact + type: object + properties: + buildOutput: + description: BuildOutput + type: boolean + name: + description: Name + type: string + values: + description: Values + type: array + items: + description: ArtifactValue + type: object + properties: + digest: + type: object + additionalProperties: + type: string + uri: + type: string + provenance: + description: Provenance + type: object + properties: + configSource: + description: |- + ConfigSource + Deprecated: Use RefSource instead + type: object + properties: + digest: + description: Digest + type: object + additionalProperties: + type: string + entryPoint: + description: EntryPoint + type: string + uri: + description: URI + type: string + featureFlags: + description: FeatureFlags + type: object + properties: + awaitSidecarReadiness: + type: boolean + coschedule: + type: string + disableCredsInit: + type: boolean + disableInlineSpec: + type: string + enableAPIFields: + type: string + enableArtifacts: + type: boolean + enableCELInWhenExpression: + type: boolean + enableConciseResolverSyntax: + type: boolean + enableKeepPodOnCancel: + type: boolean + enableKubernetesSidecar: + type: boolean + enableParamEnum: + type: boolean + enableProvenanceInStatus: + type: boolean + enableStepActions: + description: EnableStepActions is a no-op flag since + StepActions are stable + type: boolean + enableTektonOCIBundles: + description: |- + DeprecatedEnableTektonOCIBundles is maintained for backward compatibility + to allow deletion of PipelineRuns created before v0.62.x. + This field is not used and can be removed in a future release + once we're confident old PipelineRuns have been cleaned up. + See issue #8359 for context. + type: boolean + enableTerminationMessageCompression: + type: boolean + enableWaitExponentialBackoff: + type: boolean + enforceNonfalsifiability: + type: string + maxResultSize: + type: integer + requireGitSSHSecretKnownHosts: + type: boolean + resultExtractionMethod: + type: string + runningInEnvWithInjectedSidecars: + type: boolean + sendCloudEventsForRuns: + type: boolean + setSecurityContext: + type: boolean + setSecurityContextReadOnlyRootFilesystem: + type: boolean + verificationNoMatchPolicy: + description: |- + VerificationNoMatchPolicy is the feature flag for "trusted-resources-verification-no-match-policy" + VerificationNoMatchPolicy can be set to "ignore", "warn" and "fail" values. + ignore: skip trusted resources verification when no matching verification policies found + warn: skip trusted resources verification when no matching verification policies found and log a warning + fail: fail the taskrun or pipelines run if no matching verification policies found + type: string + refSource: + description: RefSource + type: object + properties: + digest: + description: Digest + type: object + additionalProperties: + type: string + entryPoint: + description: EntryPoint + type: string + uri: + description: URI + type: string + results: + type: array + items: + description: TaskRunResult + type: object + required: + - name + - value + properties: + name: + description: Name + type: string + type: + description: Type + type: string + value: + description: Value + x-kubernetes-preserve-unknown-fields: true + running: + description: Details about a running container + type: object + properties: + startedAt: + description: Time at which the container was last (re-)started + type: string + format: date-time + terminated: + description: Details about a terminated container + type: object + required: + - exitCode + properties: + containerID: + description: Container's ID in the format '://' + type: string + exitCode: + description: Exit status from the last termination of + the container + type: integer + format: int32 + finishedAt: + description: Time at which the container last terminated + type: string + format: date-time + message: + description: Message regarding the last termination of + the container + type: string + reason: + description: (brief) reason from the last termination + of the container + type: string + signal: + description: Signal from the last termination of the container + type: integer + format: int32 + startedAt: + description: Time at which previous execution of the container + started + type: string + format: date-time + waiting: + description: Details about a waiting container + type: object + properties: + message: + description: Message regarding why the container is not + yet running. + type: string + reason: + description: (brief) reason the container is not yet running. + type: string + x-kubernetes-list-type: atomic + taskResults: + description: TaskRunResults + type: array + items: + description: TaskRunResult + type: object + required: + - name + - value + properties: + name: + description: Name + type: string + type: + description: Type + type: string + value: + description: Value + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + taskSpec: + description: TaskSpec + x-kubernetes-preserve-unknown-fields: true + additionalPrinterColumns: + - name: Succeeded + type: string + jsonPath: ".status.conditions[?(@.type==\"Succeeded\")].status" + - name: Reason + type: string + jsonPath: ".status.conditions[?(@.type==\"Succeeded\")].reason" + - name: StartTime + type: date + jsonPath: .status.startTime + - name: CompletionTime + type: date + jsonPath: .status.completionTime + # Opt into the status subresource so metadata.generation + # starts to increment + subresources: + status: {} + - name: v1 + served: true + storage: true + schema: + openAPIV3Schema: + description: |- + TaskRun represents a single execution of a Task. TaskRuns are how the steps + specified in a Task are executed; they specify the parameters and resources + used to run the steps in a Task. + type: object + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: TaskRunSpec defines the desired state of TaskRun + type: object + properties: + computeResources: + description: Compute resources to use for this TaskRun + type: object + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This field depends on the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + type: array + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + type: object + required: + - name + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + requests: + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + debug: + description: TaskRunDebug defines the breakpoint config for a particular + TaskRun + type: object + properties: + breakpoints: + description: TaskBreakpoints defines the breakpoint config for + a particular Task + type: object + properties: + beforeSteps: + type: array + items: + type: string + x-kubernetes-list-type: atomic + onFailure: + description: |- + if enabled, pause TaskRun on failure of a step + failed step will not exit + type: string + managedBy: + description: |- + ManagedBy indicates which controller is responsible for reconciling + this resource. If unset or set to "tekton.dev/pipeline", the default + Tekton controller will manage this resource. + This field is immutable. + type: string + params: + description: Params is a list of Param + type: array + items: + description: Param declares an ParamValues to use for the parameter + called name. + type: object + required: + - name + - value + properties: + name: + type: string + value: + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + podTemplate: + description: PodTemplate holds pod specific configuration + type: object + properties: + affinity: + description: |- + If specified, the pod's scheduling constraints. + See Pod.spec.affinity (API version: v1) + x-kubernetes-preserve-unknown-fields: true + automountServiceAccountToken: + description: |- + AutomountServiceAccountToken indicates whether pods running as this + service account should have an API token automatically mounted. + type: boolean + dnsConfig: + description: |- + Specifies the DNS parameters of a pod. + Parameters specified here will be merged to the generated DNS + configuration based on DNSPolicy. + type: object + properties: + nameservers: + description: |- + A list of DNS name server IP addresses. + This will be appended to the base nameservers generated from DNSPolicy. + Duplicated nameservers will be removed. + type: array + items: + type: string + x-kubernetes-list-type: atomic + options: + description: |- + A list of DNS resolver options. + This will be merged with the base options generated from DNSPolicy. + Duplicated entries will be removed. Resolution options given in Options + will override those that appear in the base DNSPolicy. + type: array + items: + description: PodDNSConfigOption defines DNS resolver options + of a pod. + type: object + properties: + name: + description: |- + Name is this DNS resolver option's name. + Required. + type: string + value: + description: Value is this DNS resolver option's value. + type: string + x-kubernetes-list-type: atomic + searches: + description: |- + A list of DNS search domains for host-name lookup. + This will be appended to the base search paths generated from DNSPolicy. + Duplicated search paths will be removed. + type: array + items: + type: string + x-kubernetes-list-type: atomic + dnsPolicy: + description: |- + Set DNS policy for the pod. Defaults to "ClusterFirst". Valid values are + 'ClusterFirst', 'Default' or 'None'. DNS parameters given in DNSConfig + will be merged with the policy selected with DNSPolicy. + type: string + enableServiceLinks: + description: |- + EnableServiceLinks indicates whether information about services should be injected into pod's + environment variables, matching the syntax of Docker links. + Optional: Defaults to true. + type: boolean + env: + description: List of environment variables that can be provided + to the containers belonging to the pod. + type: array + items: + description: EnvVar represents an environment variable present + in a Container. + type: object + required: + - name + properties: + name: + description: |- + Name of the environment variable. + May consist of any printable ASCII characters except '='. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's value. + Cannot be used if value is not empty. + type: object + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + type: object + required: + - key + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap or + its key must be defined + type: boolean + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + type: object + required: + - fieldPath + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in the + specified API version. + type: string + x-kubernetes-map-type: atomic + fileKeyRef: + description: |- + FileKeyRef selects a key of the env file. + Requires the EnvFiles feature gate to be enabled. + type: object + required: + - key + - path + - volumeName + properties: + key: + description: |- + The key within the env file. An invalid key will prevent the pod from starting. + The keys defined within a source may consist of any printable ASCII characters except '='. + During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters. + type: string + optional: + description: |- + Specify whether the file or its key must be defined. If the file or key + does not exist, then the env var is not published. + If optional is set to true and the specified key does not exist, + the environment variable will not be set in the Pod's containers. + + If optional is set to false and the specified key does not exist, + an error will be returned during Pod creation. + type: boolean + default: false + path: + description: |- + The path within the volume from which to select the file. + Must be relative and may not contain the '..' path or start with '..'. + type: string + volumeName: + description: The name of the volume mount containing + the env file. + type: string + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + type: object + required: + - resource + properties: + containerName: + description: 'Container name: required for volumes, + optional for env vars' + type: string + divisor: + description: Specifies the output format of the + exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the pod's + namespace + type: object + required: + - key + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret or its + key must be defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + hostAliases: + description: |- + HostAliases is an optional list of hosts and IPs that will be injected into the pod's hosts + file if specified. This is only valid for non-hostNetwork pods. + type: array + items: + description: |- + HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the + pod's hosts file. + type: object + required: + - ip + properties: + hostnames: + description: Hostnames for the above IP address. + type: array + items: + type: string + x-kubernetes-list-type: atomic + ip: + description: IP address of the host file entry. + type: string + x-kubernetes-list-type: atomic + hostNetwork: + description: HostNetwork specifies whether the pod may use the + node network namespace + type: boolean + hostUsers: + description: |- + HostUsers indicates whether the pod will use the host's user namespace. + Optional: Default to true. + If set to true or not present, the pod will be run in the host user namespace, useful + for when the pod needs a feature only available to the host user namespace, such as + loading a kernel module with CAP_SYS_MODULE. + When set to false, a new user namespace is created for the pod. Setting false + is useful to mitigating container breakout vulnerabilities such as allowing + containers to run as root without their user having root privileges on the host. + This field depends on the kubernetes feature gate UserNamespacesSupport being enabled. + type: boolean + imagePullSecrets: + description: ImagePullSecrets gives the name of the secret used + by the pod to pull the image if specified + type: array + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + nodeSelector: + description: |- + NodeSelector is a selector which must be true for the pod to fit on a node. + Selector which must match a node's labels for the pod to be scheduled on that node. + More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ + type: object + additionalProperties: + type: string + priorityClassName: + description: |- + If specified, indicates the pod's priority. "system-node-critical" and + "system-cluster-critical" are two special keywords which indicate the + highest priorities with the former being the highest priority. Any other + name must be defined by creating a PriorityClass object with that name. + If not specified, the pod priority will be default or zero if there is no + default. + type: string + runtimeClassName: + description: |- + RuntimeClassName refers to a RuntimeClass object in the node.k8s.io + group, which should be used to run this pod. If no RuntimeClass resource + matches the named class, the pod will not be run. If unset or empty, the + "legacy" RuntimeClass will be used, which is an implicit class with an + empty definition that uses the default runtime handler. + More info: https://git.k8s.io/enhancements/keps/sig-node/runtime-class.md + This is a beta feature as of Kubernetes v1.14. + type: string + schedulerName: + description: SchedulerName specifies the scheduler to be used + to dispatch the Pod + type: string + securityContext: + description: |- + SecurityContext holds pod-level security attributes and common container settings. + Optional: Defaults to empty. See type description for default values of each field. + See Pod.spec.securityContext (API version: v1) + x-kubernetes-preserve-unknown-fields: true + tolerations: + description: If specified, the pod's tolerations. + type: array + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + type: object + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + type: integer + format: int64 + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + x-kubernetes-list-type: atomic + topologySpreadConstraints: + description: |- + TopologySpreadConstraints controls how Pods are spread across your cluster among + failure-domains such as regions, zones, nodes, and other user-defined topology domains. + type: array + items: + description: TopologySpreadConstraint specifies how to spread + matching pods among the given topology. + type: object + required: + - maxSkew + - topologyKey + - whenUnsatisfiable + properties: + labelSelector: + description: |- + LabelSelector is used to find matching pods. + Pods that match this label selector are counted to determine the number of pods + in their corresponding topology domain. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select the pods over which + spreading will be calculated. The keys are used to lookup values from the + incoming pod labels, those key-value labels are ANDed with labelSelector + to select the group of existing pods over which spreading will be calculated + for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + MatchLabelKeys cannot be set when LabelSelector isn't set. + Keys that don't exist in the incoming pod labels will + be ignored. A null or empty list means only match against labelSelector. + + This is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default). + type: array + items: + type: string + x-kubernetes-list-type: atomic + maxSkew: + description: |- + MaxSkew describes the degree to which pods may be unevenly distributed. + When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference + between the number of matching pods in the target topology and the global minimum. + The global minimum is the minimum number of matching pods in an eligible domain + or zero if the number of eligible domains is less than MinDomains. + For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same + labelSelector spread as 2/2/1: + In this case, the global minimum is 1. + | zone1 | zone2 | zone3 | + | P P | P P | P | + - if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2; + scheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2) + violate MaxSkew(1). + - if MaxSkew is 2, incoming pod can be scheduled onto any zone. + When `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence + to topologies that satisfy it. + It's a required field. Default value is 1 and 0 is not allowed. + type: integer + format: int32 + minDomains: + description: |- + MinDomains indicates a minimum number of eligible domains. + When the number of eligible domains with matching topology keys is less than minDomains, + Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed. + And when the number of eligible domains with matching topology keys equals or greater than minDomains, + this value has no effect on scheduling. + As a result, when the number of eligible domains is less than minDomains, + scheduler won't schedule more than maxSkew Pods to those domains. + If value is nil, the constraint behaves as if MinDomains is equal to 1. + Valid values are integers greater than 0. + When value is not nil, WhenUnsatisfiable must be DoNotSchedule. + + For example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same + labelSelector spread as 2/2/2: + | zone1 | zone2 | zone3 | + | P P | P P | P P | + The number of domains is less than 5(MinDomains), so "global minimum" is treated as 0. + In this situation, new pod with the same labelSelector cannot be scheduled, + because computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones, + it will violate MaxSkew. + type: integer + format: int32 + nodeAffinityPolicy: + description: |- + NodeAffinityPolicy indicates how we will treat Pod's nodeAffinity/nodeSelector + when calculating pod topology spread skew. Options are: + - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations. + - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations. + + If this value is nil, the behavior is equivalent to the Honor policy. + type: string + nodeTaintsPolicy: + description: |- + NodeTaintsPolicy indicates how we will treat node taints when calculating + pod topology spread skew. Options are: + - Honor: nodes without taints, along with tainted nodes for which the incoming pod + has a toleration, are included. + - Ignore: node taints are ignored. All nodes are included. + + If this value is nil, the behavior is equivalent to the Ignore policy. + type: string + topologyKey: + description: |- + TopologyKey is the key of node labels. Nodes that have a label with this key + and identical values are considered to be in the same topology. + We consider each as a "bucket", and try to put balanced number + of pods into each bucket. + We define a domain as a particular instance of a topology. + Also, we define an eligible domain as a domain whose nodes meet the requirements of + nodeAffinityPolicy and nodeTaintsPolicy. + e.g. If TopologyKey is "kubernetes.io/hostname", each Node is a domain of that topology. + And, if TopologyKey is "topology.kubernetes.io/zone", each zone is a domain of that topology. + It's a required field. + type: string + whenUnsatisfiable: + description: |- + WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy + the spread constraint. + - DoNotSchedule (default) tells the scheduler not to schedule it. + - ScheduleAnyway tells the scheduler to schedule the pod in any location, + but giving higher precedence to topologies that would help reduce the + skew. + A constraint is considered "Unsatisfiable" for an incoming pod + if and only if every possible node assignment for that pod would violate + "MaxSkew" on some topology. + For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same + labelSelector spread as 3/1/1: + | zone1 | zone2 | zone3 | + | P P P | P | P | + If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled + to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies + MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler + won't make it *more* imbalanced. + It's a required field. + type: string + x-kubernetes-list-type: atomic + volumes: + description: |- + List of volumes that can be mounted by containers belonging to the pod. + More info: https://kubernetes.io/docs/concepts/storage/volumes + See Pod.spec.volumes (API version: v1) + x-kubernetes-preserve-unknown-fields: true + retries: + description: Retries represents how many times this TaskRun should + be retried in the event of task failure. + type: integer + serviceAccountName: + type: string + sidecarSpecs: + description: |- + Specs to apply to Sidecars in this TaskRun. + If a field is specified in both a Sidecar and a SidecarSpec, + the value from the SidecarSpec will be used. + This field is only supported when the alpha feature gate is enabled. + type: array + items: + description: TaskRunSidecarSpec is used to override the values + of a Sidecar in the corresponding Task. + type: object + required: + - computeResources + - name + properties: + computeResources: + description: The resource requirements to apply to the Sidecar. + type: object + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This field depends on the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + type: array + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + type: object + required: + - name + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + requests: + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + name: + description: The name of the Sidecar to override. + type: string + x-kubernetes-list-type: atomic + status: + description: Used for cancelling a TaskRun (and maybe more later + on) + type: string + statusMessage: + description: Status message for cancellation. + type: string + stepSpecs: + description: |- + Specs to apply to Steps in this TaskRun. + If a field is specified in both a Step and a StepSpec, + the value from the StepSpec will be used. + This field is only supported when the alpha feature gate is enabled. + type: array + items: + description: TaskRunStepSpec is used to override the values of + a Step in the corresponding Task. + type: object + required: + - computeResources + - name + properties: + computeResources: + description: The resource requirements to apply to the Step. + type: object + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This field depends on the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + type: array + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + type: object + required: + - name + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + requests: + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + name: + description: The name of the Step to override. + type: string + x-kubernetes-list-type: atomic + taskRef: + description: no more than one of the TaskRef and TaskSpec may be + specified. + type: object + properties: + apiVersion: + description: |- + API version of the referent + Note: A Task with non-empty APIVersion and Kind is considered a Custom Task + type: string + kind: + description: |- + TaskKind indicates the Kind of the Task: + 1. Namespaced Task when Kind is set to "Task". If Kind is "", it defaults to "Task". + 2. Custom Task when Kind is non-empty and APIVersion is non-empty + type: string + name: + description: 'Name of the referent; More info: http://kubernetes.io/docs/user-guide/identifiers#names' + type: string + params: + description: |- + Params contains the parameters used to identify the + referenced Tekton resource. Example entries might include + "repo" or "path" but the set of params ultimately depends on + the chosen resolver. + type: array + items: + description: Param declares an ParamValues to use for the + parameter called name. + type: object + required: + - name + - value + properties: + name: + type: string + value: + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + resolver: + description: |- + Resolver is the name of the resolver that should perform + resolution of the referenced Tekton resource, such as "git". + type: string + taskSpec: + description: |- + Specifying TaskSpec can be disabled by setting + `disable-inline-spec` feature flag. + See Task.spec (API version: tekton.dev/v1) + x-kubernetes-preserve-unknown-fields: true + timeout: + description: |- + Time after which one retry attempt times out. Defaults to 1 hour. + Refer Go's ParseDuration documentation for expected format: https://golang.org/pkg/time/#ParseDuration + type: string + workspaces: + description: Workspaces is a list of WorkspaceBindings from volumes + to workspaces. + type: array + items: + description: WorkspaceBinding maps a Task's declared workspace + to a Volume. + type: object + required: + - name + properties: + configMap: + description: ConfigMap represents a configMap that should + populate this workspace. + type: object + properties: + defaultMode: + description: |- + defaultMode is optional: mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + Defaults to 0644. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + ConfigMap will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the ConfigMap, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: optional specify whether the ConfigMap or + its keys must be defined + type: boolean + x-kubernetes-map-type: atomic + csi: + description: CSI (Container Storage Interface) represents + ephemeral storage that is handled by certain external CSI + drivers. + type: object + required: + - driver + properties: + driver: + description: |- + driver is the name of the CSI driver that handles this volume. + Consult with your admin for the correct name as registered in the cluster. + type: string + fsType: + description: |- + fsType to mount. Ex. "ext4", "xfs", "ntfs". + If not provided, the empty value is passed to the associated CSI driver + which will determine the default filesystem to apply. + type: string + nodePublishSecretRef: + description: |- + nodePublishSecretRef is a reference to the secret object containing + sensitive information to pass to the CSI driver to complete the CSI + NodePublishVolume and NodeUnpublishVolume calls. + This field is optional, and may be empty if no secret is required. If the + secret object contains more than one secret, all secret references are passed. + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + x-kubernetes-map-type: atomic + readOnly: + description: |- + readOnly specifies a read-only configuration for the volume. + Defaults to false (read/write). + type: boolean + volumeAttributes: + description: |- + volumeAttributes stores driver-specific properties that are passed to the CSI + driver. Consult your driver's documentation for supported values. + type: object + additionalProperties: + type: string + emptyDir: + description: |- + EmptyDir represents a temporary directory that shares a Task's lifetime. + More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir + Either this OR PersistentVolumeClaim can be used. + type: object + properties: + medium: + description: |- + medium represents what type of storage medium should back this directory. + The default is "" which means to use the node's default medium. + Must be an empty string (default) or Memory. + More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir + type: string + sizeLimit: + description: |- + sizeLimit is the total amount of local storage required for this EmptyDir volume. + The size limit is also applicable for memory medium. + The maximum usage on memory medium EmptyDir would be the minimum value between + the SizeLimit specified here and the sum of memory limits of all containers in a pod. + The default is nil which means that the limit is undefined. + More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + name: + description: Name is the name of the workspace populated by + the volume. + type: string + persistentVolumeClaim: + description: |- + PersistentVolumeClaimVolumeSource represents a reference to a + PersistentVolumeClaim in the same namespace. Either this OR EmptyDir can be used. + type: object + required: + - claimName + properties: + claimName: + description: |- + claimName is the name of a PersistentVolumeClaim in the same namespace as the pod using this volume. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims + type: string + readOnly: + description: |- + readOnly Will force the ReadOnly setting in VolumeMounts. + Default false. + type: boolean + projected: + description: Projected represents a projected volume that + should populate this workspace. + type: object + properties: + defaultMode: + description: |- + defaultMode are the mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + sources: + description: |- + sources is the list of volume projections. Each entry in this list + handles one source. + type: array + items: + description: |- + Projection that may be projected along with other supported volume types. + Exactly one of these fields must be set. + type: object + properties: + clusterTrustBundle: + description: |- + ClusterTrustBundle allows a pod to access the `.spec.trustBundle` field + of ClusterTrustBundle objects in an auto-updating file. + + Alpha, gated by the ClusterTrustBundleProjection feature gate. + + ClusterTrustBundle objects can either be selected by name, or by the + combination of signer name and a label selector. + + Kubelet performs aggressive normalization of the PEM contents written + into the pod filesystem. Esoteric PEM features such as inter-block + comments and block headers are stripped. Certificates are deduplicated. + The ordering of certificates within the file is arbitrary, and Kubelet + may change the order over time. + type: object + required: + - path + properties: + labelSelector: + description: |- + Select all ClusterTrustBundles that match this label selector. Only has + effect if signerName is set. Mutually-exclusive with name. If unset, + interpreted as "match nothing". If set but empty, interpreted as "match + everything". + type: object + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + name: + description: |- + Select a single ClusterTrustBundle by object name. Mutually-exclusive + with signerName and labelSelector. + type: string + optional: + description: |- + If true, don't block pod startup if the referenced ClusterTrustBundle(s) + aren't available. If using name, then the named ClusterTrustBundle is + allowed not to exist. If using signerName, then the combination of + signerName and labelSelector is allowed to match zero + ClusterTrustBundles. + type: boolean + path: + description: Relative path from the volume root + to write the bundle. + type: string + signerName: + description: |- + Select all ClusterTrustBundles that match this signer name. + Mutually-exclusive with name. The contents of all selected + ClusterTrustBundles will be unified and deduplicated. + type: string + configMap: + description: configMap information about the configMap + data to project + type: object + properties: + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + ConfigMap will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the ConfigMap, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within + a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: optional specify whether the ConfigMap + or its keys must be defined + type: boolean + x-kubernetes-map-type: atomic + downwardAPI: + description: downwardAPI information about the downwardAPI + data to project + type: object + properties: + items: + description: Items is a list of DownwardAPIVolume + file + type: array + items: + description: DownwardAPIVolumeFile represents + information to create the file containing + the pod field + type: object + required: + - path + properties: + fieldRef: + description: 'Required: Selects a field + of the pod: only annotations, labels, + name, namespace and uid are supported.' + type: object + required: + - fieldPath + properties: + apiVersion: + description: Version of the schema + the FieldPath is written in terms + of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to + select in the specified API version. + type: string + x-kubernetes-map-type: atomic + mode: + description: |- + Optional: mode bits used to set permissions on this file, must be an octal value + between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: 'Required: Path is the relative + path name of the file to be created. + Must not be absolute or contain the + ''..'' path. Must be utf-8 encoded. + The first item of the relative path + must not start with ''..''' + type: string + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported. + type: object + required: + - resource + properties: + containerName: + description: 'Container name: required + for volumes, optional for env vars' + type: string + divisor: + description: Specifies the output + format of the exposed resources, + defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to + select' + type: string + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + podCertificate: + description: |- + Projects an auto-rotating credential bundle (private key and certificate + chain) that the pod can use either as a TLS client or server. + + Kubelet generates a private key and uses it to send a + PodCertificateRequest to the named signer. Once the signer approves the + request and issues a certificate chain, Kubelet writes the key and + certificate chain to the pod filesystem. The pod does not start until + certificates have been issued for each podCertificate projected volume + source in its spec. + + Kubelet will begin trying to rotate the certificate at the time indicated + by the signer using the PodCertificateRequest.Status.BeginRefreshAt + timestamp. + + Kubelet can write a single file, indicated by the credentialBundlePath + field, or separate files, indicated by the keyPath and + certificateChainPath fields. + + The credential bundle is a single file in PEM format. The first PEM + entry is the private key (in PKCS#8 format), and the remaining PEM + entries are the certificate chain issued by the signer (typically, + signers will return their certificate chain in leaf-to-root order). + + Prefer using the credential bundle format, since your application code + can read it atomically. If you use keyPath and certificateChainPath, + your application must make two separate file reads. If these coincide + with a certificate rotation, it is possible that the private key and leaf + certificate you read may not correspond to each other. Your application + will need to check for this condition, and re-read until they are + consistent. + + The named signer controls chooses the format of the certificate it + issues; consult the signer implementation's documentation to learn how to + use the certificates it issues. + type: object + required: + - keyType + - signerName + properties: + certificateChainPath: + description: |- + Write the certificate chain at this path in the projected volume. + + Most applications should use credentialBundlePath. When using keyPath + and certificateChainPath, your application needs to check that the key + and leaf certificate are consistent, because it is possible to read the + files mid-rotation. + type: string + credentialBundlePath: + description: |- + Write the credential bundle at this path in the projected volume. + + The credential bundle is a single file that contains multiple PEM blocks. + The first PEM block is a PRIVATE KEY block, containing a PKCS#8 private + key. + + The remaining blocks are CERTIFICATE blocks, containing the issued + certificate chain from the signer (leaf and any intermediates). + + Using credentialBundlePath lets your Pod's application code make a single + atomic read that retrieves a consistent key and certificate chain. If you + project them to separate files, your application code will need to + additionally check that the leaf certificate was issued to the key. + type: string + keyPath: + description: |- + Write the key at this path in the projected volume. + + Most applications should use credentialBundlePath. When using keyPath + and certificateChainPath, your application needs to check that the key + and leaf certificate are consistent, because it is possible to read the + files mid-rotation. + type: string + keyType: + description: |- + The type of keypair Kubelet will generate for the pod. + + Valid values are "RSA3072", "RSA4096", "ECDSAP256", "ECDSAP384", + "ECDSAP521", and "ED25519". + type: string + maxExpirationSeconds: + description: |- + maxExpirationSeconds is the maximum lifetime permitted for the + certificate. + + Kubelet copies this value verbatim into the PodCertificateRequests it + generates for this projection. + + If omitted, kube-apiserver will set it to 86400(24 hours). kube-apiserver + will reject values shorter than 3600 (1 hour). The maximum allowable + value is 7862400 (91 days). + + The signer implementation is then free to issue a certificate with any + lifetime *shorter* than MaxExpirationSeconds, but no shorter than 3600 + seconds (1 hour). This constraint is enforced by kube-apiserver. + `kubernetes.io` signers will never issue certificates with a lifetime + longer than 24 hours. + type: integer + format: int32 + signerName: + description: Kubelet's generated CSRs will be + addressed to this signer. + type: string + userAnnotations: + description: |- + userAnnotations allow pod authors to pass additional information to + the signer implementation. Kubernetes does not restrict or validate this + metadata in any way. + + These values are copied verbatim into the `spec.unverifiedUserAnnotations` field of + the PodCertificateRequest objects that Kubelet creates. + + Entries are subject to the same validation as object metadata annotations, + with the addition that all keys must be domain-prefixed. No restrictions + are placed on values, except an overall size limitation on the entire field. + + Signers should document the keys and values they support. Signers should + deny requests that contain keys they do not recognize. + type: object + additionalProperties: + type: string + secret: + description: secret information about the secret + data to project + type: object + properties: + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + Secret will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the Secret, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within + a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: optional field specify whether + the Secret or its key must be defined + type: boolean + x-kubernetes-map-type: atomic + serviceAccountToken: + description: serviceAccountToken is information + about the serviceAccountToken data to project + type: object + required: + - path + properties: + audience: + description: |- + audience is the intended audience of the token. A recipient of a token + must identify itself with an identifier specified in the audience of the + token, and otherwise should reject the token. The audience defaults to the + identifier of the apiserver. + type: string + expirationSeconds: + description: |- + expirationSeconds is the requested duration of validity of the service + account token. As the token approaches expiration, the kubelet volume + plugin will proactively rotate the service account token. The kubelet will + start trying to rotate the token if the token is older than 80 percent of + its time to live or if the token is older than 24 hours.Defaults to 1 hour + and must be at least 10 minutes. + type: integer + format: int64 + path: + description: |- + path is the path relative to the mount point of the file to project the + token into. + type: string + x-kubernetes-list-type: atomic + secret: + description: Secret represents a secret that should populate + this workspace. + type: object + properties: + defaultMode: + description: |- + defaultMode is Optional: mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values + for mode bits. Defaults to 0644. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + items: + description: |- + items If unspecified, each key-value pair in the Data field of the referenced + Secret will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the Secret, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + optional: + description: optional field specify whether the Secret + or its keys must be defined + type: boolean + secretName: + description: |- + secretName is the name of the secret in the pod's namespace to use. + More info: https://kubernetes.io/docs/concepts/storage/volumes#secret + type: string + subPath: + description: |- + SubPath is optionally a directory on the volume which should be used + for this binding (i.e. the volume will be mounted at this sub directory). + type: string + volumeClaimTemplate: + description: |- + VolumeClaimTemplate is a template for a claim that will be created in the same namespace. + The PipelineRun controller is responsible for creating a unique claim for each instance of PipelineRun. + See PersistentVolumeClaim (API version: v1) + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + status: + description: TaskRunStatus defines the observed state of TaskRun + type: object + required: + - podName + properties: + annotations: + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + additionalProperties: + type: string + artifacts: + description: Artifacts are the list of artifacts written out by + the task's containers + type: object + properties: + inputs: + type: array + items: + description: |- + Artifact represents an artifact within a system, potentially containing multiple values + associated with it. + type: object + properties: + buildOutput: + description: Indicate if the artifact is a build output + or a by-product + type: boolean + name: + description: The artifact's identifying category name + type: string + values: + description: A collection of values related to the artifact + type: array + items: + description: ArtifactValue represents a specific value + or data element within an Artifact. + type: object + properties: + digest: + type: object + additionalProperties: + type: string + uri: + type: string + x-kubernetes-list-type: atomic + outputs: + type: array + items: + description: |- + Artifact represents an artifact within a system, potentially containing multiple values + associated with it. + type: object + properties: + buildOutput: + description: Indicate if the artifact is a build output + or a by-product + type: boolean + name: + description: The artifact's identifying category name + type: string + values: + description: A collection of values related to the artifact + type: array + items: + description: ArtifactValue represents a specific value + or data element within an Artifact. + type: object + properties: + digest: + type: object + additionalProperties: + type: string + uri: + type: string + x-kubernetes-list-type: atomic + completionTime: + description: CompletionTime is the time the build completed. + type: string + format: date-time + conditions: + description: Conditions the latest available observations of a resource's + current state. + type: array + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + type: object + required: + - status + - type + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating details about + the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, False, + Unknown. + type: string + type: + description: Type of condition. + type: string + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + type: integer + format: int64 + podName: + description: PodName is the name of the pod responsible for executing + this task's steps. + type: string + provenance: + description: Provenance contains some key authenticated metadata + about how a software artifact was built (what sources, what inputs/outputs, + etc.). + type: object + properties: + featureFlags: + description: FeatureFlags identifies the feature flags that + were used during the task/pipeline run + type: object + properties: + awaitSidecarReadiness: + type: boolean + coschedule: + type: string + disableCredsInit: + type: boolean + disableInlineSpec: + type: string + enableAPIFields: + type: string + enableArtifacts: + type: boolean + enableCELInWhenExpression: + type: boolean + enableConciseResolverSyntax: + type: boolean + enableKeepPodOnCancel: + type: boolean + enableKubernetesSidecar: + type: boolean + enableParamEnum: + type: boolean + enableProvenanceInStatus: + type: boolean + enableStepActions: + description: EnableStepActions is a no-op flag since StepActions + are stable + type: boolean + enableTektonOCIBundles: + description: |- + DeprecatedEnableTektonOCIBundles is maintained for backward compatibility + to allow deletion of PipelineRuns created before v0.62.x. + This field is not used and can be removed in a future release + once we're confident old PipelineRuns have been cleaned up. + See issue #8359 for context. + type: boolean + enableTerminationMessageCompression: + type: boolean + enableWaitExponentialBackoff: + type: boolean + enforceNonfalsifiability: + type: string + maxResultSize: + type: integer + requireGitSSHSecretKnownHosts: + type: boolean + resultExtractionMethod: + type: string + runningInEnvWithInjectedSidecars: + type: boolean + sendCloudEventsForRuns: + type: boolean + setSecurityContext: + type: boolean + setSecurityContextReadOnlyRootFilesystem: + type: boolean + verificationNoMatchPolicy: + description: |- + VerificationNoMatchPolicy is the feature flag for "trusted-resources-verification-no-match-policy" + VerificationNoMatchPolicy can be set to "ignore", "warn" and "fail" values. + ignore: skip trusted resources verification when no matching verification policies found + warn: skip trusted resources verification when no matching verification policies found and log a warning + fail: fail the taskrun or pipelines run if no matching verification policies found + type: string + refSource: + description: RefSource identifies the source where a remote + task/pipeline came from. + type: object + properties: + digest: + description: |- + Digest is a collection of cryptographic digests for the contents of the artifact specified by URI. + Example: {"sha1": "f99d13e554ffcb696dee719fa85b695cb5b0f428"} + type: object + additionalProperties: + type: string + entryPoint: + description: |- + EntryPoint identifies the entry point into the build. This is often a path to a + build definition file and/or a target label within that file. + Example: "task/git-clone/0.10/git-clone.yaml" + type: string + uri: + description: |- + URI indicates the identity of the source of the build definition. + Example: "https://github.com/tektoncd/catalog" + type: string + results: + description: Results are the list of results written out by the + task's containers + type: array + items: + description: TaskRunResult used to describe the results of a task + type: object + required: + - name + - value + properties: + name: + description: Name the given name + type: string + type: + description: |- + Type is the user-specified type of the result. The possible type + is currently "string" and will support "array" in following work. + type: string + value: + description: Value the given value of the result + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + retriesStatus: + description: |- + RetriesStatus contains the history of TaskRunStatus in case of a retry in order to keep record of failures. + All TaskRunStatus stored in RetriesStatus will have no date within the RetriesStatus as is redundant. + x-kubernetes-preserve-unknown-fields: true + sidecars: + description: |- + The list has one entry per sidecar in the manifest. Each entry is + represents the imageid of the corresponding sidecar. + type: array + items: + description: SidecarState reports the results of running a sidecar + in a Task. + type: object + properties: + container: + type: string + imageID: + type: string + name: + type: string + running: + description: Details about a running container + type: object + properties: + startedAt: + description: Time at which the container was last (re-)started + type: string + format: date-time + terminated: + description: Details about a terminated container + type: object + required: + - exitCode + properties: + containerID: + description: Container's ID in the format '://' + type: string + exitCode: + description: Exit status from the last termination of + the container + type: integer + format: int32 + finishedAt: + description: Time at which the container last terminated + type: string + format: date-time + message: + description: Message regarding the last termination of + the container + type: string + reason: + description: (brief) reason from the last termination + of the container + type: string + signal: + description: Signal from the last termination of the container + type: integer + format: int32 + startedAt: + description: Time at which previous execution of the container + started + type: string + format: date-time + waiting: + description: Details about a waiting container + type: object + properties: + message: + description: Message regarding why the container is not + yet running. + type: string + reason: + description: (brief) reason the container is not yet running. + type: string + x-kubernetes-list-type: atomic + spanContext: + description: SpanContext contains tracing span context fields + type: object + additionalProperties: + type: string + startTime: + description: StartTime is the time the build is actually started. + type: string + format: date-time + steps: + description: Steps describes the state of each build step container. + type: array + items: + description: StepState reports the results of running a step in + a Task. + type: object + properties: + container: + type: string + imageID: + type: string + inputs: + type: array + items: + description: |- + Artifact represents an artifact within a system, potentially containing multiple values + associated with it. + type: object + properties: + buildOutput: + description: Indicate if the artifact is a build output + or a by-product + type: boolean + name: + description: The artifact's identifying category name + type: string + values: + description: A collection of values related to the artifact + type: array + items: + description: ArtifactValue represents a specific value + or data element within an Artifact. + type: object + properties: + digest: + type: object + additionalProperties: + type: string + uri: + type: string + name: + type: string + outputs: + type: array + items: + description: |- + Artifact represents an artifact within a system, potentially containing multiple values + associated with it. + type: object + properties: + buildOutput: + description: Indicate if the artifact is a build output + or a by-product + type: boolean + name: + description: The artifact's identifying category name + type: string + values: + description: A collection of values related to the artifact + type: array + items: + description: ArtifactValue represents a specific value + or data element within an Artifact. + type: object + properties: + digest: + type: object + additionalProperties: + type: string + uri: + type: string + provenance: + description: |- + Provenance contains metadata about resources used in the TaskRun/PipelineRun + such as the source from where a remote build definition was fetched. + This field aims to carry minimum amoumt of metadata in *Run status so that + Tekton Chains can capture them in the provenance. + type: object + properties: + featureFlags: + description: FeatureFlags identifies the feature flags + that were used during the task/pipeline run + type: object + properties: + awaitSidecarReadiness: + type: boolean + coschedule: + type: string + disableCredsInit: + type: boolean + disableInlineSpec: + type: string + enableAPIFields: + type: string + enableArtifacts: + type: boolean + enableCELInWhenExpression: + type: boolean + enableConciseResolverSyntax: + type: boolean + enableKeepPodOnCancel: + type: boolean + enableKubernetesSidecar: + type: boolean + enableParamEnum: + type: boolean + enableProvenanceInStatus: + type: boolean + enableStepActions: + description: EnableStepActions is a no-op flag since + StepActions are stable + type: boolean + enableTektonOCIBundles: + description: |- + DeprecatedEnableTektonOCIBundles is maintained for backward compatibility + to allow deletion of PipelineRuns created before v0.62.x. + This field is not used and can be removed in a future release + once we're confident old PipelineRuns have been cleaned up. + See issue #8359 for context. + type: boolean + enableTerminationMessageCompression: + type: boolean + enableWaitExponentialBackoff: + type: boolean + enforceNonfalsifiability: + type: string + maxResultSize: + type: integer + requireGitSSHSecretKnownHosts: + type: boolean + resultExtractionMethod: + type: string + runningInEnvWithInjectedSidecars: + type: boolean + sendCloudEventsForRuns: + type: boolean + setSecurityContext: + type: boolean + setSecurityContextReadOnlyRootFilesystem: + type: boolean + verificationNoMatchPolicy: + description: |- + VerificationNoMatchPolicy is the feature flag for "trusted-resources-verification-no-match-policy" + VerificationNoMatchPolicy can be set to "ignore", "warn" and "fail" values. + ignore: skip trusted resources verification when no matching verification policies found + warn: skip trusted resources verification when no matching verification policies found and log a warning + fail: fail the taskrun or pipelines run if no matching verification policies found + type: string + refSource: + description: RefSource identifies the source where a remote + task/pipeline came from. + type: object + properties: + digest: + description: |- + Digest is a collection of cryptographic digests for the contents of the artifact specified by URI. + Example: {"sha1": "f99d13e554ffcb696dee719fa85b695cb5b0f428"} + type: object + additionalProperties: + type: string + entryPoint: + description: |- + EntryPoint identifies the entry point into the build. This is often a path to a + build definition file and/or a target label within that file. + Example: "task/git-clone/0.10/git-clone.yaml" + type: string + uri: + description: |- + URI indicates the identity of the source of the build definition. + Example: "https://github.com/tektoncd/catalog" + type: string + results: + type: array + items: + description: TaskRunResult used to describe the results + of a task + type: object + required: + - name + - value + properties: + name: + description: Name the given name + type: string + type: + description: |- + Type is the user-specified type of the result. The possible type + is currently "string" and will support "array" in following work. + type: string + value: + description: Value the given value of the result + x-kubernetes-preserve-unknown-fields: true + running: + description: Details about a running container + type: object + properties: + startedAt: + description: Time at which the container was last (re-)started + type: string + format: date-time + terminated: + description: Details about a terminated container + type: object + required: + - exitCode + properties: + containerID: + description: Container's ID in the format '://' + type: string + exitCode: + description: Exit status from the last termination of + the container + type: integer + format: int32 + finishedAt: + description: Time at which the container last terminated + type: string + format: date-time + message: + description: Message regarding the last termination of + the container + type: string + reason: + description: (brief) reason from the last termination + of the container + type: string + signal: + description: Signal from the last termination of the container + type: integer + format: int32 + startedAt: + description: Time at which previous execution of the container + started + type: string + format: date-time + terminationReason: + type: string + waiting: + description: Details about a waiting container + type: object + properties: + message: + description: Message regarding why the container is not + yet running. + type: string + reason: + description: (brief) reason the container is not yet running. + type: string + x-kubernetes-list-type: atomic + taskSpec: + description: TaskSpec contains the Spec from the dereferenced Task + definition used to instantiate this TaskRun. + type: object + properties: + description: + description: |- + Description is a user-facing description of the task that may be + used to populate a UI. + type: string + displayName: + description: |- + DisplayName is a user-facing name of the task that may be + used to populate a UI. + type: string + params: + description: |- + Params is a list of input parameters required to run the task. Params + must be supplied as inputs in TaskRuns unless they declare a default + value. + type: array + items: + description: |- + ParamSpec defines arbitrary parameters needed beyond typed inputs (such as + resources). Parameter values are provided by users as inputs on a TaskRun + or PipelineRun. + type: object + required: + - name + properties: + default: + description: |- + Default is the value a parameter takes if no input value is supplied. If + default is set, a Task may be executed without a supplied value for the + parameter. + x-kubernetes-preserve-unknown-fields: true + description: + description: |- + Description is a user-facing description of the parameter that may be + used to populate a UI. + type: string + enum: + description: |- + Enum declares a set of allowed param input values for tasks/pipelines that can be validated. + If Enum is not set, no input validation is performed for the param. + type: array + items: + type: string + name: + description: Name declares the name by which a parameter + is referenced. + type: string + properties: + description: Properties is the JSON Schema properties + to support key-value pairs parameter. + type: object + additionalProperties: + description: PropertySpec defines the struct for object + keys + type: object + properties: + type: + description: |- + ParamType indicates the type of an input parameter; + Used to distinguish between a single string and an array of strings. + type: string + type: + description: |- + Type is the user-specified type of the parameter. The possible types + are currently "string", "array" and "object", and "string" is the default. + type: string + x-kubernetes-list-type: atomic + results: + description: Results are values that this Task can output + type: array + items: + description: TaskResult used to describe the results of a + task + type: object + required: + - name + properties: + description: + description: Description is a human-readable description + of the result + type: string + name: + description: Name the given name + type: string + properties: + description: Properties is the JSON Schema properties + to support key-value pairs results. + type: object + additionalProperties: + description: PropertySpec defines the struct for object + keys + type: object + properties: + type: + description: |- + ParamType indicates the type of an input parameter; + Used to distinguish between a single string and an array of strings. + type: string + type: + description: |- + Type is the user-specified type of the result. The possible type + is currently "string" and will support "array" in following work. + type: string + value: + description: Value the expression used to retrieve the + value of the result from an underlying Step. + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + sidecars: + description: |- + Sidecars are run alongside the Task's step containers. They begin before + the steps start and end after the steps complete. + type: array + items: + description: Sidecar has nearly the same data structure as + Step but does not have the ability to timeout. + type: object + required: + - name + properties: + args: + description: |- + Arguments to the entrypoint. + The image's CMD is used if this is not provided. + Variable references $(VAR_NAME) are expanded using the Sidecar's environment. If a variable + cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will + produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless + of whether the variable exists or not. Cannot be updated. + More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell + type: array + items: + type: string + x-kubernetes-list-type: atomic + command: + description: |- + Entrypoint array. Not executed within a shell. + The image's ENTRYPOINT is used if this is not provided. + Variable references $(VAR_NAME) are expanded using the Sidecar's environment. If a variable + cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will + produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless + of whether the variable exists or not. Cannot be updated. + More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell + type: array + items: + type: string + x-kubernetes-list-type: atomic + computeResources: + description: |- + ComputeResources required by this Sidecar. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This field depends on the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + type: array + items: + description: ResourceClaim references one entry + in PodSpec.ResourceClaims. + type: object + required: + - name + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + requests: + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + env: + description: |- + List of environment variables to set in the Sidecar. + Cannot be updated. + type: array + items: + description: EnvVar represents an environment variable + present in a Container. + type: object + required: + - name + properties: + name: + description: |- + Name of the environment variable. + May consist of any printable ASCII characters except '='. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's + value. Cannot be used if value is not empty. + type: object + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + type: object + required: + - key + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + type: object + required: + - fieldPath + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select + in the specified API version. + type: string + x-kubernetes-map-type: atomic + fileKeyRef: + description: |- + FileKeyRef selects a key of the env file. + Requires the EnvFiles feature gate to be enabled. + type: object + required: + - key + - path + - volumeName + properties: + key: + description: |- + The key within the env file. An invalid key will prevent the pod from starting. + The keys defined within a source may consist of any printable ASCII characters except '='. + During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters. + type: string + optional: + description: |- + Specify whether the file or its key must be defined. If the file or key + does not exist, then the env var is not published. + If optional is set to true and the specified key does not exist, + the environment variable will not be set in the Pod's containers. + + If optional is set to false and the specified key does not exist, + an error will be returned during Pod creation. + type: boolean + default: false + path: + description: |- + The path within the volume from which to select the file. + Must be relative and may not contain the '..' path or start with '..'. + type: string + volumeName: + description: The name of the volume mount + containing the env file. + type: string + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + type: object + required: + - resource + properties: + containerName: + description: 'Container name: required for + volumes, optional for env vars' + type: string + divisor: + description: Specifies the output format + of the exposed resources, defaults to + "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the + pod's namespace + type: object + required: + - key + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret + or its key must be defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + envFrom: + description: |- + List of sources to populate environment variables in the Sidecar. + The keys defined within a source must be a C_IDENTIFIER. All invalid keys + will be reported as an event when the container is starting. When a key exists in multiple + sources, the value associated with the last source will take precedence. + Values defined by an Env with a duplicate key will take precedence. + Cannot be updated. + type: array + items: + description: EnvFromSource represents the source of + a set of ConfigMaps or Secrets + type: object + properties: + configMapRef: + description: The ConfigMap to select from + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap must + be defined + type: boolean + x-kubernetes-map-type: atomic + prefix: + description: |- + Optional text to prepend to the name of each environment variable. + May consist of any printable ASCII characters except '='. + type: string + secretRef: + description: The Secret to select from + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret must + be defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + image: + description: |- + Image reference name. + More info: https://kubernetes.io/docs/concepts/containers/images + type: string + imagePullPolicy: + description: |- + Image pull policy. + One of Always, Never, IfNotPresent. + Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/containers/images#updating-images + type: string + lifecycle: + description: |- + Actions that the management system should take in response to Sidecar lifecycle events. + Cannot be updated. + type: object + properties: + postStart: + description: |- + PostStart is called immediately after a container is created. If the handler fails, + the container is terminated and restarted according to its restart policy. + Other management of the container blocks until the hook completes. + More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks + type: object + properties: + exec: + description: Exec specifies a command to execute + in the container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + httpGet: + description: HTTPGet specifies an HTTP GET request + to perform. + type: object + required: + - port + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the + request. HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom + header to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + sleep: + description: Sleep represents a duration that + the container should sleep. + type: object + required: + - seconds + properties: + seconds: + description: Seconds is the number of seconds + to sleep. + type: integer + format: int64 + tcpSocket: + description: |- + Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept + for backward compatibility. There is no validation of this field and + lifecycle hooks will fail at runtime when it is specified. + type: object + required: + - port + properties: + host: + description: 'Optional: Host name to connect + to, defaults to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + preStop: + description: |- + PreStop is called immediately before a container is terminated due to an + API request or management event such as liveness/startup probe failure, + preemption, resource contention, etc. The handler is not called if the + container crashes or exits. The Pod's termination grace period countdown begins before the + PreStop hook is executed. Regardless of the outcome of the handler, the + container will eventually terminate within the Pod's termination grace + period (unless delayed by finalizers). Other management of the container blocks until the hook completes + or until the termination grace period is reached. + More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks + type: object + properties: + exec: + description: Exec specifies a command to execute + in the container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + httpGet: + description: HTTPGet specifies an HTTP GET request + to perform. + type: object + required: + - port + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the + request. HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom + header to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + sleep: + description: Sleep represents a duration that + the container should sleep. + type: object + required: + - seconds + properties: + seconds: + description: Seconds is the number of seconds + to sleep. + type: integer + format: int64 + tcpSocket: + description: |- + Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept + for backward compatibility. There is no validation of this field and + lifecycle hooks will fail at runtime when it is specified. + type: object + required: + - port + properties: + host: + description: 'Optional: Host name to connect + to, defaults to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + stopSignal: + description: |- + StopSignal defines which signal will be sent to a container when it is being stopped. + If not specified, the default is defined by the container runtime in use. + StopSignal can only be set for Pods with a non-empty .spec.os.name + type: string + livenessProbe: + description: |- + Periodic probe of Sidecar liveness. + Container will be restarted if the probe fails. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: object + properties: + exec: + description: Exec specifies a command to execute in + the container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + failureThreshold: + description: |- + Minimum consecutive failures for the probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. + type: integer + format: int32 + grpc: + description: GRPC specifies a GRPC HealthCheckRequest. + type: object + required: + - port + properties: + port: + description: Port number of the gRPC service. + Number must be in the range 1 to 65535. + type: integer + format: int32 + service: + description: |- + Service is the name of the service to place in the gRPC HealthCheckRequest + (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + + If this is not specified, the default behavior is defined by gRPC. + type: string + default: "" + httpGet: + description: HTTPGet specifies an HTTP GET request + to perform. + type: object + required: + - port + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + initialDelaySeconds: + description: |- + Number of seconds after the container has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + periodSeconds: + description: |- + How often (in seconds) to perform the probe. + Default to 10 seconds. Minimum value is 1. + type: integer + format: int32 + successThreshold: + description: |- + Minimum consecutive successes for the probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. + type: integer + format: int32 + tcpSocket: + description: TCPSocket specifies a connection to a + TCP port. + type: object + required: + - port + properties: + host: + description: 'Optional: Host name to connect to, + defaults to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + terminationGracePeriodSeconds: + description: |- + Optional duration in seconds the pod needs to terminate gracefully upon probe failure. + The grace period is the duration in seconds after the processes running in the pod are sent + a termination signal and the time when the processes are forcibly halted with a kill signal. + Set this value longer than the expected cleanup time for your process. + If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this + value overrides the value provided by the pod spec. + Value must be non-negative integer. The value zero indicates stop immediately via + the kill signal (no opportunity to shut down). + This is a beta field and requires enabling ProbeTerminationGracePeriod feature gate. + Minimum value is 1. spec.terminationGracePeriodSeconds is used if unset. + type: integer + format: int64 + timeoutSeconds: + description: |- + Number of seconds after which the probe times out. + Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + name: + description: |- + Name of the Sidecar specified as a DNS_LABEL. + Each Sidecar in a Task must have a unique name (DNS_LABEL). + Cannot be updated. + type: string + ports: + description: |- + List of ports to expose from the Sidecar. Exposing a port here gives + the system additional information about the network connections a + container uses, but is primarily informational. Not specifying a port here + DOES NOT prevent that port from being exposed. Any port which is + listening on the default "0.0.0.0" address inside a container will be + accessible from the network. + Cannot be updated. + type: array + items: + description: ContainerPort represents a network port + in a single container. + type: object + required: + - containerPort + properties: + containerPort: + description: |- + Number of port to expose on the pod's IP address. + This must be a valid port number, 0 < x < 65536. + type: integer + format: int32 + hostIP: + description: What host IP to bind the external port + to. + type: string + hostPort: + description: |- + Number of port to expose on the host. + If specified, this must be a valid port number, 0 < x < 65536. + If HostNetwork is specified, this must match ContainerPort. + Most containers do not need this. + type: integer + format: int32 + name: + description: |- + If specified, this must be an IANA_SVC_NAME and unique within the pod. Each + named port in a pod must have a unique name. Name for the port that can be + referred to by services. + type: string + protocol: + description: |- + Protocol for port. Must be UDP, TCP, or SCTP. + Defaults to "TCP". + type: string + default: TCP + x-kubernetes-list-map-keys: + - containerPort + - protocol + x-kubernetes-list-type: map + readinessProbe: + description: |- + Periodic probe of Sidecar service readiness. + Container will be removed from service endpoints if the probe fails. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: object + properties: + exec: + description: Exec specifies a command to execute in + the container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + failureThreshold: + description: |- + Minimum consecutive failures for the probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. + type: integer + format: int32 + grpc: + description: GRPC specifies a GRPC HealthCheckRequest. + type: object + required: + - port + properties: + port: + description: Port number of the gRPC service. + Number must be in the range 1 to 65535. + type: integer + format: int32 + service: + description: |- + Service is the name of the service to place in the gRPC HealthCheckRequest + (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + + If this is not specified, the default behavior is defined by gRPC. + type: string + default: "" + httpGet: + description: HTTPGet specifies an HTTP GET request + to perform. + type: object + required: + - port + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + initialDelaySeconds: + description: |- + Number of seconds after the container has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + periodSeconds: + description: |- + How often (in seconds) to perform the probe. + Default to 10 seconds. Minimum value is 1. + type: integer + format: int32 + successThreshold: + description: |- + Minimum consecutive successes for the probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. + type: integer + format: int32 + tcpSocket: + description: TCPSocket specifies a connection to a + TCP port. + type: object + required: + - port + properties: + host: + description: 'Optional: Host name to connect to, + defaults to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + terminationGracePeriodSeconds: + description: |- + Optional duration in seconds the pod needs to terminate gracefully upon probe failure. + The grace period is the duration in seconds after the processes running in the pod are sent + a termination signal and the time when the processes are forcibly halted with a kill signal. + Set this value longer than the expected cleanup time for your process. + If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this + value overrides the value provided by the pod spec. + Value must be non-negative integer. The value zero indicates stop immediately via + the kill signal (no opportunity to shut down). + This is a beta field and requires enabling ProbeTerminationGracePeriod feature gate. + Minimum value is 1. spec.terminationGracePeriodSeconds is used if unset. + type: integer + format: int64 + timeoutSeconds: + description: |- + Number of seconds after which the probe times out. + Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + restartPolicy: + description: |- + RestartPolicy refers to kubernetes RestartPolicy. It can only be set for an + initContainer and must have it's policy set to "Always". It is currently + left optional to help support Kubernetes versions prior to 1.29 when this feature + was introduced. + type: string + script: + description: |- + Script is the contents of an executable file to execute. + + If Script is not empty, the Step cannot have an Command or Args. + type: string + securityContext: + description: |- + SecurityContext defines the security options the Sidecar should be run with. + If set, the fields of SecurityContext override the equivalent fields of PodSecurityContext. + More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ + type: object + properties: + allowPrivilegeEscalation: + description: |- + AllowPrivilegeEscalation controls whether a process can gain more + privileges than its parent process. This bool directly controls if + the no_new_privs flag will be set on the container process. + AllowPrivilegeEscalation is true always when the container is: + 1) run as Privileged + 2) has CAP_SYS_ADMIN + Note that this field cannot be set when spec.os.name is windows. + type: boolean + appArmorProfile: + description: |- + appArmorProfile is the AppArmor options to use by this container. If set, this profile + overrides the pod's appArmorProfile. + Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile loaded on the node that should be used. + The profile must be preconfigured on the node to work. + Must match the loaded name of the profile. + Must be set if and only if type is "Localhost". + type: string + type: + description: |- + type indicates which kind of AppArmor profile will be applied. + Valid options are: + Localhost - a profile pre-loaded on the node. + RuntimeDefault - the container runtime's default profile. + Unconfined - no AppArmor enforcement. + type: string + capabilities: + description: |- + The capabilities to add/drop when running containers. + Defaults to the default set of capabilities granted by the container runtime. + Note that this field cannot be set when spec.os.name is windows. + type: object + properties: + add: + description: Added capabilities + type: array + items: + description: Capability represent POSIX capabilities + type + type: string + x-kubernetes-list-type: atomic + drop: + description: Removed capabilities + type: array + items: + description: Capability represent POSIX capabilities + type + type: string + x-kubernetes-list-type: atomic + privileged: + description: |- + Run container in privileged mode. + Processes in privileged containers are essentially equivalent to root on the host. + Defaults to false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + procMount: + description: |- + procMount denotes the type of proc mount to use for the containers. + The default value is Default which uses the container runtime defaults for + readonly paths and masked paths. + This requires the ProcMountType feature flag to be enabled. + Note that this field cannot be set when spec.os.name is windows. + type: string + readOnlyRootFilesystem: + description: |- + Whether this container has a read-only root filesystem. + Default is false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + runAsGroup: + description: |- + The GID to run the entrypoint of the container process. + Uses runtime default if unset. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + runAsNonRoot: + description: |- + Indicates that the container must run as a non-root user. + If true, the Kubelet will validate the image at runtime to ensure that it + does not run as UID 0 (root) and fail to start the container if it does. + If unset or false, no such validation will be performed. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: boolean + runAsUser: + description: |- + The UID to run the entrypoint of the container process. + Defaults to user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + seLinuxOptions: + description: |- + The SELinux context to be applied to the container. + If unspecified, the container runtime will allocate a random SELinux context for each + container. May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: object + properties: + level: + description: Level is SELinux level label that + applies to the container. + type: string + role: + description: Role is a SELinux role label that + applies to the container. + type: string + type: + description: Type is a SELinux type label that + applies to the container. + type: string + user: + description: User is a SELinux user label that + applies to the container. + type: string + seccompProfile: + description: |- + The seccomp options to use by this container. If seccomp options are + provided at both the pod & container level, the container options + override the pod options. + Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile defined in a file on the node should be used. + The profile must be preconfigured on the node to work. + Must be a descending path, relative to the kubelet's configured seccomp profile location. + Must be set if type is "Localhost". Must NOT be set for any other type. + type: string + type: + description: |- + type indicates which kind of seccomp profile will be applied. + Valid options are: + + Localhost - a profile defined in a file on the node should be used. + RuntimeDefault - the container runtime default profile should be used. + Unconfined - no profile should be applied. + type: string + windowsOptions: + description: |- + The Windows specific settings applied to all containers. + If unspecified, the options from the PodSecurityContext will be used. + If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is linux. + type: object + properties: + gmsaCredentialSpec: + description: |- + GMSACredentialSpec is where the GMSA admission webhook + (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the + GMSA credential spec named by the GMSACredentialSpecName field. + type: string + gmsaCredentialSpecName: + description: GMSACredentialSpecName is the name + of the GMSA credential spec to use. + type: string + hostProcess: + description: |- + HostProcess determines if a container should be run as a 'Host Process' container. + All of a Pod's containers must have the same effective HostProcess value + (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers). + In addition, if HostProcess is true then HostNetwork must also be set to true. + type: boolean + runAsUserName: + description: |- + The UserName in Windows to run the entrypoint of the container process. + Defaults to the user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: string + startupProbe: + description: |- + StartupProbe indicates that the Pod the Sidecar is running in has successfully initialized. + If specified, no other probes are executed until this completes successfully. + If this probe fails, the Pod will be restarted, just as if the livenessProbe failed. + This can be used to provide different probe parameters at the beginning of a Pod's lifecycle, + when it might take a long time to load data or warm a cache, than during steady-state operation. + This cannot be updated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: object + properties: + exec: + description: Exec specifies a command to execute in + the container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + failureThreshold: + description: |- + Minimum consecutive failures for the probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. + type: integer + format: int32 + grpc: + description: GRPC specifies a GRPC HealthCheckRequest. + type: object + required: + - port + properties: + port: + description: Port number of the gRPC service. + Number must be in the range 1 to 65535. + type: integer + format: int32 + service: + description: |- + Service is the name of the service to place in the gRPC HealthCheckRequest + (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + + If this is not specified, the default behavior is defined by gRPC. + type: string + default: "" + httpGet: + description: HTTPGet specifies an HTTP GET request + to perform. + type: object + required: + - port + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + initialDelaySeconds: + description: |- + Number of seconds after the container has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + periodSeconds: + description: |- + How often (in seconds) to perform the probe. + Default to 10 seconds. Minimum value is 1. + type: integer + format: int32 + successThreshold: + description: |- + Minimum consecutive successes for the probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. + type: integer + format: int32 + tcpSocket: + description: TCPSocket specifies a connection to a + TCP port. + type: object + required: + - port + properties: + host: + description: 'Optional: Host name to connect to, + defaults to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + terminationGracePeriodSeconds: + description: |- + Optional duration in seconds the pod needs to terminate gracefully upon probe failure. + The grace period is the duration in seconds after the processes running in the pod are sent + a termination signal and the time when the processes are forcibly halted with a kill signal. + Set this value longer than the expected cleanup time for your process. + If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this + value overrides the value provided by the pod spec. + Value must be non-negative integer. The value zero indicates stop immediately via + the kill signal (no opportunity to shut down). + This is a beta field and requires enabling ProbeTerminationGracePeriod feature gate. + Minimum value is 1. spec.terminationGracePeriodSeconds is used if unset. + type: integer + format: int64 + timeoutSeconds: + description: |- + Number of seconds after which the probe times out. + Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + stdin: + description: |- + Whether this Sidecar should allocate a buffer for stdin in the container runtime. If this + is not set, reads from stdin in the Sidecar will always result in EOF. + Default is false. + type: boolean + stdinOnce: + description: |- + Whether the container runtime should close the stdin channel after it has been opened by + a single attach. When stdin is true the stdin stream will remain open across multiple attach + sessions. If stdinOnce is set to true, stdin is opened on Sidecar start, is empty until the + first client attaches to stdin, and then remains open and accepts data until the client disconnects, + at which time stdin is closed and remains closed until the Sidecar is restarted. If this + flag is false, a container processes that reads from stdin will never receive an EOF. + Default is false + type: boolean + terminationMessagePath: + description: |- + Optional: Path at which the file to which the Sidecar's termination message + will be written is mounted into the Sidecar's filesystem. + Message written is intended to be brief final status, such as an assertion failure message. + Will be truncated by the node if greater than 4096 bytes. The total message length across + all containers will be limited to 12kb. + Defaults to /dev/termination-log. + Cannot be updated. + type: string + terminationMessagePolicy: + description: |- + Indicate how the termination message should be populated. File will use the contents of + terminationMessagePath to populate the Sidecar status message on both success and failure. + FallbackToLogsOnError will use the last chunk of Sidecar log output if the termination + message file is empty and the Sidecar exited with an error. + The log output is limited to 2048 bytes or 80 lines, whichever is smaller. + Defaults to File. + Cannot be updated. + type: string + tty: + description: |- + Whether this Sidecar should allocate a TTY for itself, also requires 'stdin' to be true. + Default is false. + type: boolean + volumeDevices: + description: volumeDevices is the list of block devices + to be used by the Sidecar. + type: array + items: + description: volumeDevice describes a mapping of a raw + block device within a container. + type: object + required: + - devicePath + - name + properties: + devicePath: + description: devicePath is the path inside of the + container that the device will be mapped to. + type: string + name: + description: name must match the name of a persistentVolumeClaim + in the pod + type: string + x-kubernetes-list-type: atomic + volumeMounts: + description: |- + Volumes to mount into the Sidecar's filesystem. + Cannot be updated. + type: array + items: + description: VolumeMount describes a mounting of a Volume + within a container. + type: object + required: + - mountPath + - name + properties: + mountPath: + description: |- + Path within the container at which the volume should be mounted. Must + not contain ':'. + type: string + mountPropagation: + description: |- + mountPropagation determines how mounts are propagated from the host + to container and the other way around. + When not set, MountPropagationNone is used. + This field is beta in 1.10. + When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified + (which defaults to None). + type: string + name: + description: This must match the Name of a Volume. + type: string + readOnly: + description: |- + Mounted read-only if true, read-write otherwise (false or unspecified). + Defaults to false. + type: boolean + recursiveReadOnly: + description: |- + RecursiveReadOnly specifies whether read-only mounts should be handled + recursively. + + If ReadOnly is false, this field has no meaning and must be unspecified. + + If ReadOnly is true, and this field is set to Disabled, the mount is not made + recursively read-only. If this field is set to IfPossible, the mount is made + recursively read-only, if it is supported by the container runtime. If this + field is set to Enabled, the mount is made recursively read-only if it is + supported by the container runtime, otherwise the pod will not be started and + an error will be generated to indicate the reason. + + If this field is set to IfPossible or Enabled, MountPropagation must be set to + None (or be unspecified, which defaults to None). + + If this field is not specified, it is treated as an equivalent of Disabled. + type: string + subPath: + description: |- + Path within the volume from which the container's volume should be mounted. + Defaults to "" (volume's root). + type: string + subPathExpr: + description: |- + Expanded path within the volume from which the container's volume should be mounted. + Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment. + Defaults to "" (volume's root). + SubPathExpr and SubPath are mutually exclusive. + type: string + x-kubernetes-list-type: atomic + workingDir: + description: |- + Sidecar's working directory. + If not specified, the container runtime's default will be used, which + might be configured in the container image. + Cannot be updated. + type: string + workspaces: + description: |- + This is an alpha field. You must set the "enable-api-fields" feature flag to "alpha" + for this field to be supported. + + Workspaces is a list of workspaces from the Task that this Sidecar wants + exclusive access to. Adding a workspace to this list means that any + other Step or Sidecar that does not also request this Workspace will + not have access to it. + type: array + items: + description: |- + WorkspaceUsage is used by a Step or Sidecar to declare that it wants isolated access + to a Workspace defined in a Task. + type: object + required: + - mountPath + - name + properties: + mountPath: + description: |- + MountPath is the path that the workspace should be mounted to inside the Step or Sidecar, + overriding any MountPath specified in the Task's WorkspaceDeclaration. + type: string + name: + description: Name is the name of the workspace this + Step or Sidecar wants access to. + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + stepTemplate: + description: |- + StepTemplate can be used as the basis for all step containers within the + Task, so that the steps inherit settings on the base container. + type: object + properties: + args: + description: |- + Arguments to the entrypoint. + The image's CMD is used if this is not provided. + Variable references $(VAR_NAME) are expanded using the Step's environment. If a variable + cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will + produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless + of whether the variable exists or not. Cannot be updated. + More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell + type: array + items: + type: string + x-kubernetes-list-type: atomic + command: + description: |- + Entrypoint array. Not executed within a shell. + The image's ENTRYPOINT is used if this is not provided. + Variable references $(VAR_NAME) are expanded using the Step's environment. If a variable + cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will + produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless + of whether the variable exists or not. Cannot be updated. + More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell + type: array + items: + type: string + x-kubernetes-list-type: atomic + computeResources: + description: |- + ComputeResources required by this Step. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This field depends on the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + type: array + items: + description: ResourceClaim references one entry in + PodSpec.ResourceClaims. + type: object + required: + - name + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + requests: + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + env: + description: |- + List of environment variables to set in the Step. + Cannot be updated. + type: array + items: + description: EnvVar represents an environment variable + present in a Container. + type: object + required: + - name + properties: + name: + description: |- + Name of the environment variable. + May consist of any printable ASCII characters except '='. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's + value. Cannot be used if value is not empty. + type: object + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + type: object + required: + - key + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + type: object + required: + - fieldPath + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in + the specified API version. + type: string + x-kubernetes-map-type: atomic + fileKeyRef: + description: |- + FileKeyRef selects a key of the env file. + Requires the EnvFiles feature gate to be enabled. + type: object + required: + - key + - path + - volumeName + properties: + key: + description: |- + The key within the env file. An invalid key will prevent the pod from starting. + The keys defined within a source may consist of any printable ASCII characters except '='. + During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters. + type: string + optional: + description: |- + Specify whether the file or its key must be defined. If the file or key + does not exist, then the env var is not published. + If optional is set to true and the specified key does not exist, + the environment variable will not be set in the Pod's containers. + + If optional is set to false and the specified key does not exist, + an error will be returned during Pod creation. + type: boolean + default: false + path: + description: |- + The path within the volume from which to select the file. + Must be relative and may not contain the '..' path or start with '..'. + type: string + volumeName: + description: The name of the volume mount + containing the env file. + type: string + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + type: object + required: + - resource + properties: + containerName: + description: 'Container name: required for + volumes, optional for env vars' + type: string + divisor: + description: Specifies the output format of + the exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the + pod's namespace + type: object + required: + - key + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + envFrom: + description: |- + List of sources to populate environment variables in the Step. + The keys defined within a source must be a C_IDENTIFIER. All invalid keys + will be reported as an event when the Step is starting. When a key exists in multiple + sources, the value associated with the last source will take precedence. + Values defined by an Env with a duplicate key will take precedence. + Cannot be updated. + type: array + items: + description: EnvFromSource represents the source of a + set of ConfigMaps or Secrets + type: object + properties: + configMapRef: + description: The ConfigMap to select from + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap must + be defined + type: boolean + x-kubernetes-map-type: atomic + prefix: + description: |- + Optional text to prepend to the name of each environment variable. + May consist of any printable ASCII characters except '='. + type: string + secretRef: + description: The Secret to select from + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret must be + defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + image: + description: |- + Image reference name. + More info: https://kubernetes.io/docs/concepts/containers/images + type: string + imagePullPolicy: + description: |- + Image pull policy. + One of Always, Never, IfNotPresent. + Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/containers/images#updating-images + type: string + securityContext: + description: |- + SecurityContext defines the security options the Step should be run with. + If set, the fields of SecurityContext override the equivalent fields of PodSecurityContext. + More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ + type: object + properties: + allowPrivilegeEscalation: + description: |- + AllowPrivilegeEscalation controls whether a process can gain more + privileges than its parent process. This bool directly controls if + the no_new_privs flag will be set on the container process. + AllowPrivilegeEscalation is true always when the container is: + 1) run as Privileged + 2) has CAP_SYS_ADMIN + Note that this field cannot be set when spec.os.name is windows. + type: boolean + appArmorProfile: + description: |- + appArmorProfile is the AppArmor options to use by this container. If set, this profile + overrides the pod's appArmorProfile. + Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile loaded on the node that should be used. + The profile must be preconfigured on the node to work. + Must match the loaded name of the profile. + Must be set if and only if type is "Localhost". + type: string + type: + description: |- + type indicates which kind of AppArmor profile will be applied. + Valid options are: + Localhost - a profile pre-loaded on the node. + RuntimeDefault - the container runtime's default profile. + Unconfined - no AppArmor enforcement. + type: string + capabilities: + description: |- + The capabilities to add/drop when running containers. + Defaults to the default set of capabilities granted by the container runtime. + Note that this field cannot be set when spec.os.name is windows. + type: object + properties: + add: + description: Added capabilities + type: array + items: + description: Capability represent POSIX capabilities + type + type: string + x-kubernetes-list-type: atomic + drop: + description: Removed capabilities + type: array + items: + description: Capability represent POSIX capabilities + type + type: string + x-kubernetes-list-type: atomic + privileged: + description: |- + Run container in privileged mode. + Processes in privileged containers are essentially equivalent to root on the host. + Defaults to false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + procMount: + description: |- + procMount denotes the type of proc mount to use for the containers. + The default value is Default which uses the container runtime defaults for + readonly paths and masked paths. + This requires the ProcMountType feature flag to be enabled. + Note that this field cannot be set when spec.os.name is windows. + type: string + readOnlyRootFilesystem: + description: |- + Whether this container has a read-only root filesystem. + Default is false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + runAsGroup: + description: |- + The GID to run the entrypoint of the container process. + Uses runtime default if unset. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + runAsNonRoot: + description: |- + Indicates that the container must run as a non-root user. + If true, the Kubelet will validate the image at runtime to ensure that it + does not run as UID 0 (root) and fail to start the container if it does. + If unset or false, no such validation will be performed. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: boolean + runAsUser: + description: |- + The UID to run the entrypoint of the container process. + Defaults to user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + seLinuxOptions: + description: |- + The SELinux context to be applied to the container. + If unspecified, the container runtime will allocate a random SELinux context for each + container. May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: object + properties: + level: + description: Level is SELinux level label that applies + to the container. + type: string + role: + description: Role is a SELinux role label that applies + to the container. + type: string + type: + description: Type is a SELinux type label that applies + to the container. + type: string + user: + description: User is a SELinux user label that applies + to the container. + type: string + seccompProfile: + description: |- + The seccomp options to use by this container. If seccomp options are + provided at both the pod & container level, the container options + override the pod options. + Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile defined in a file on the node should be used. + The profile must be preconfigured on the node to work. + Must be a descending path, relative to the kubelet's configured seccomp profile location. + Must be set if type is "Localhost". Must NOT be set for any other type. + type: string + type: + description: |- + type indicates which kind of seccomp profile will be applied. + Valid options are: + + Localhost - a profile defined in a file on the node should be used. + RuntimeDefault - the container runtime default profile should be used. + Unconfined - no profile should be applied. + type: string + windowsOptions: + description: |- + The Windows specific settings applied to all containers. + If unspecified, the options from the PodSecurityContext will be used. + If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is linux. + type: object + properties: + gmsaCredentialSpec: + description: |- + GMSACredentialSpec is where the GMSA admission webhook + (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the + GMSA credential spec named by the GMSACredentialSpecName field. + type: string + gmsaCredentialSpecName: + description: GMSACredentialSpecName is the name + of the GMSA credential spec to use. + type: string + hostProcess: + description: |- + HostProcess determines if a container should be run as a 'Host Process' container. + All of a Pod's containers must have the same effective HostProcess value + (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers). + In addition, if HostProcess is true then HostNetwork must also be set to true. + type: boolean + runAsUserName: + description: |- + The UserName in Windows to run the entrypoint of the container process. + Defaults to the user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: string + volumeDevices: + description: volumeDevices is the list of block devices + to be used by the Step. + type: array + items: + description: volumeDevice describes a mapping of a raw + block device within a container. + type: object + required: + - devicePath + - name + properties: + devicePath: + description: devicePath is the path inside of the + container that the device will be mapped to. + type: string + name: + description: name must match the name of a persistentVolumeClaim + in the pod + type: string + x-kubernetes-list-type: atomic + volumeMounts: + description: |- + Volumes to mount into the Step's filesystem. + Cannot be updated. + type: array + items: + description: VolumeMount describes a mounting of a Volume + within a container. + type: object + required: + - mountPath + - name + properties: + mountPath: + description: |- + Path within the container at which the volume should be mounted. Must + not contain ':'. + type: string + mountPropagation: + description: |- + mountPropagation determines how mounts are propagated from the host + to container and the other way around. + When not set, MountPropagationNone is used. + This field is beta in 1.10. + When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified + (which defaults to None). + type: string + name: + description: This must match the Name of a Volume. + type: string + readOnly: + description: |- + Mounted read-only if true, read-write otherwise (false or unspecified). + Defaults to false. + type: boolean + recursiveReadOnly: + description: |- + RecursiveReadOnly specifies whether read-only mounts should be handled + recursively. + + If ReadOnly is false, this field has no meaning and must be unspecified. + + If ReadOnly is true, and this field is set to Disabled, the mount is not made + recursively read-only. If this field is set to IfPossible, the mount is made + recursively read-only, if it is supported by the container runtime. If this + field is set to Enabled, the mount is made recursively read-only if it is + supported by the container runtime, otherwise the pod will not be started and + an error will be generated to indicate the reason. + + If this field is set to IfPossible or Enabled, MountPropagation must be set to + None (or be unspecified, which defaults to None). + + If this field is not specified, it is treated as an equivalent of Disabled. + type: string + subPath: + description: |- + Path within the volume from which the container's volume should be mounted. + Defaults to "" (volume's root). + type: string + subPathExpr: + description: |- + Expanded path within the volume from which the container's volume should be mounted. + Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment. + Defaults to "" (volume's root). + SubPathExpr and SubPath are mutually exclusive. + type: string + x-kubernetes-list-type: atomic + workingDir: + description: |- + Step's working directory. + If not specified, the container runtime's default will be used, which + might be configured in the container image. + Cannot be updated. + type: string + steps: + description: |- + Steps are the steps of the build; each step is run sequentially with the + source mounted into /workspace. + type: array + items: + description: Step runs a subcomponent of a Task + type: object + required: + - name + properties: + args: + description: |- + Arguments to the entrypoint. + The image's CMD is used if this is not provided. + Variable references $(VAR_NAME) are expanded using the container's environment. If a variable + cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will + produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless + of whether the variable exists or not. Cannot be updated. + More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell + type: array + items: + type: string + x-kubernetes-list-type: atomic + command: + description: |- + Entrypoint array. Not executed within a shell. + The image's ENTRYPOINT is used if this is not provided. + Variable references $(VAR_NAME) are expanded using the container's environment. If a variable + cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will + produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless + of whether the variable exists or not. Cannot be updated. + More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell + type: array + items: + type: string + x-kubernetes-list-type: atomic + computeResources: + description: |- + ComputeResources required by this Step. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This field depends on the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + type: array + items: + description: ResourceClaim references one entry + in PodSpec.ResourceClaims. + type: object + required: + - name + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + requests: + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + displayName: + description: |- + DisplayName is a user-facing name of the step that may be + used to populate a UI. + type: string + env: + description: |- + List of environment variables to set in the Step. + Cannot be updated. + type: array + items: + description: EnvVar represents an environment variable + present in a Container. + type: object + required: + - name + properties: + name: + description: |- + Name of the environment variable. + May consist of any printable ASCII characters except '='. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's + value. Cannot be used if value is not empty. + type: object + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + type: object + required: + - key + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + type: object + required: + - fieldPath + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select + in the specified API version. + type: string + x-kubernetes-map-type: atomic + fileKeyRef: + description: |- + FileKeyRef selects a key of the env file. + Requires the EnvFiles feature gate to be enabled. + type: object + required: + - key + - path + - volumeName + properties: + key: + description: |- + The key within the env file. An invalid key will prevent the pod from starting. + The keys defined within a source may consist of any printable ASCII characters except '='. + During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters. + type: string + optional: + description: |- + Specify whether the file or its key must be defined. If the file or key + does not exist, then the env var is not published. + If optional is set to true and the specified key does not exist, + the environment variable will not be set in the Pod's containers. + + If optional is set to false and the specified key does not exist, + an error will be returned during Pod creation. + type: boolean + default: false + path: + description: |- + The path within the volume from which to select the file. + Must be relative and may not contain the '..' path or start with '..'. + type: string + volumeName: + description: The name of the volume mount + containing the env file. + type: string + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + type: object + required: + - resource + properties: + containerName: + description: 'Container name: required for + volumes, optional for env vars' + type: string + divisor: + description: Specifies the output format + of the exposed resources, defaults to + "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the + pod's namespace + type: object + required: + - key + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret + or its key must be defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + envFrom: + description: |- + List of sources to populate environment variables in the Step. + The keys defined within a source must be a C_IDENTIFIER. All invalid keys + will be reported as an event when the Step is starting. When a key exists in multiple + sources, the value associated with the last source will take precedence. + Values defined by an Env with a duplicate key will take precedence. + Cannot be updated. + type: array + items: + description: EnvFromSource represents the source of + a set of ConfigMaps or Secrets + type: object + properties: + configMapRef: + description: The ConfigMap to select from + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap must + be defined + type: boolean + x-kubernetes-map-type: atomic + prefix: + description: |- + Optional text to prepend to the name of each environment variable. + May consist of any printable ASCII characters except '='. + type: string + secretRef: + description: The Secret to select from + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret must + be defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + image: + description: |- + Docker image name. + More info: https://kubernetes.io/docs/concepts/containers/images + type: string + imagePullPolicy: + description: |- + Image pull policy. + One of Always, Never, IfNotPresent. + Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/containers/images#updating-images + type: string + name: + description: |- + Name of the Step specified as a DNS_LABEL. + Each Step in a Task must have a unique name. + type: string + onError: + description: |- + OnError defines the exiting behavior of a container on error + can be set to [ continue | stopAndFail ] + type: string + params: + description: Params declares parameters passed to this + step action. + type: array + items: + description: Param declares an ParamValues to use for + the parameter called name. + type: object + required: + - name + - value + properties: + name: + type: string + value: + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + ref: + description: Contains the reference to an existing StepAction. + type: object + properties: + name: + description: Name of the referenced step + type: string + params: + description: |- + Params contains the parameters used to identify the + referenced Tekton resource. Example entries might include + "repo" or "path" but the set of params ultimately depends on + the chosen resolver. + type: array + items: + description: Param declares an ParamValues to use + for the parameter called name. + type: object + required: + - name + - value + properties: + name: + type: string + value: + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + resolver: + description: |- + Resolver is the name of the resolver that should perform + resolution of the referenced Tekton resource, such as "git". + type: string + results: + description: |- + Results declares StepResults produced by the Step. + + It can be used in an inlined Step when used to store Results to $(step.results.resultName.path). + It cannot be used when referencing StepActions using [v1.Step.Ref]. + The Results declared by the StepActions will be stored here instead. + type: array + items: + description: StepResult used to describe the Results + of a Step. + type: object + required: + - name + properties: + description: + description: Description is a human-readable description + of the result + type: string + name: + description: Name the given name + type: string + properties: + description: Properties is the JSON Schema properties + to support key-value pairs results. + type: object + additionalProperties: + description: PropertySpec defines the struct for + object keys + type: object + properties: + type: + description: |- + ParamType indicates the type of an input parameter; + Used to distinguish between a single string and an array of strings. + type: string + type: + description: The possible types are 'string', 'array', + and 'object', with 'string' as the default. + type: string + x-kubernetes-list-type: atomic + script: + description: |- + Script is the contents of an executable file to execute. + + If Script is not empty, the Step cannot have an Command and the Args will be passed to the Script. + type: string + securityContext: + description: |- + SecurityContext defines the security options the Step should be run with. + If set, the fields of SecurityContext override the equivalent fields of PodSecurityContext. + More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ + type: object + properties: + allowPrivilegeEscalation: + description: |- + AllowPrivilegeEscalation controls whether a process can gain more + privileges than its parent process. This bool directly controls if + the no_new_privs flag will be set on the container process. + AllowPrivilegeEscalation is true always when the container is: + 1) run as Privileged + 2) has CAP_SYS_ADMIN + Note that this field cannot be set when spec.os.name is windows. + type: boolean + appArmorProfile: + description: |- + appArmorProfile is the AppArmor options to use by this container. If set, this profile + overrides the pod's appArmorProfile. + Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile loaded on the node that should be used. + The profile must be preconfigured on the node to work. + Must match the loaded name of the profile. + Must be set if and only if type is "Localhost". + type: string + type: + description: |- + type indicates which kind of AppArmor profile will be applied. + Valid options are: + Localhost - a profile pre-loaded on the node. + RuntimeDefault - the container runtime's default profile. + Unconfined - no AppArmor enforcement. + type: string + capabilities: + description: |- + The capabilities to add/drop when running containers. + Defaults to the default set of capabilities granted by the container runtime. + Note that this field cannot be set when spec.os.name is windows. + type: object + properties: + add: + description: Added capabilities + type: array + items: + description: Capability represent POSIX capabilities + type + type: string + x-kubernetes-list-type: atomic + drop: + description: Removed capabilities + type: array + items: + description: Capability represent POSIX capabilities + type + type: string + x-kubernetes-list-type: atomic + privileged: + description: |- + Run container in privileged mode. + Processes in privileged containers are essentially equivalent to root on the host. + Defaults to false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + procMount: + description: |- + procMount denotes the type of proc mount to use for the containers. + The default value is Default which uses the container runtime defaults for + readonly paths and masked paths. + This requires the ProcMountType feature flag to be enabled. + Note that this field cannot be set when spec.os.name is windows. + type: string + readOnlyRootFilesystem: + description: |- + Whether this container has a read-only root filesystem. + Default is false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + runAsGroup: + description: |- + The GID to run the entrypoint of the container process. + Uses runtime default if unset. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + runAsNonRoot: + description: |- + Indicates that the container must run as a non-root user. + If true, the Kubelet will validate the image at runtime to ensure that it + does not run as UID 0 (root) and fail to start the container if it does. + If unset or false, no such validation will be performed. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: boolean + runAsUser: + description: |- + The UID to run the entrypoint of the container process. + Defaults to user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + seLinuxOptions: + description: |- + The SELinux context to be applied to the container. + If unspecified, the container runtime will allocate a random SELinux context for each + container. May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: object + properties: + level: + description: Level is SELinux level label that + applies to the container. + type: string + role: + description: Role is a SELinux role label that + applies to the container. + type: string + type: + description: Type is a SELinux type label that + applies to the container. + type: string + user: + description: User is a SELinux user label that + applies to the container. + type: string + seccompProfile: + description: |- + The seccomp options to use by this container. If seccomp options are + provided at both the pod & container level, the container options + override the pod options. + Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile defined in a file on the node should be used. + The profile must be preconfigured on the node to work. + Must be a descending path, relative to the kubelet's configured seccomp profile location. + Must be set if type is "Localhost". Must NOT be set for any other type. + type: string + type: + description: |- + type indicates which kind of seccomp profile will be applied. + Valid options are: + + Localhost - a profile defined in a file on the node should be used. + RuntimeDefault - the container runtime default profile should be used. + Unconfined - no profile should be applied. + type: string + windowsOptions: + description: |- + The Windows specific settings applied to all containers. + If unspecified, the options from the PodSecurityContext will be used. + If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is linux. + type: object + properties: + gmsaCredentialSpec: + description: |- + GMSACredentialSpec is where the GMSA admission webhook + (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the + GMSA credential spec named by the GMSACredentialSpecName field. + type: string + gmsaCredentialSpecName: + description: GMSACredentialSpecName is the name + of the GMSA credential spec to use. + type: string + hostProcess: + description: |- + HostProcess determines if a container should be run as a 'Host Process' container. + All of a Pod's containers must have the same effective HostProcess value + (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers). + In addition, if HostProcess is true then HostNetwork must also be set to true. + type: boolean + runAsUserName: + description: |- + The UserName in Windows to run the entrypoint of the container process. + Defaults to the user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: string + stderrConfig: + description: Stores configuration for the stderr stream + of the step. + type: object + properties: + path: + description: Path to duplicate stdout stream to on + container's local filesystem. + type: string + stdoutConfig: + description: Stores configuration for the stdout stream + of the step. + type: object + properties: + path: + description: Path to duplicate stdout stream to on + container's local filesystem. + type: string + timeout: + description: |- + Timeout is the time after which the step times out. Defaults to never. + Refer to Go's ParseDuration documentation for expected format: https://golang.org/pkg/time/#ParseDuration + type: string + volumeDevices: + description: volumeDevices is the list of block devices + to be used by the Step. + type: array + items: + description: volumeDevice describes a mapping of a raw + block device within a container. + type: object + required: + - devicePath + - name + properties: + devicePath: + description: devicePath is the path inside of the + container that the device will be mapped to. + type: string + name: + description: name must match the name of a persistentVolumeClaim + in the pod + type: string + x-kubernetes-list-type: atomic + volumeMounts: + description: |- + Volumes to mount into the Step's filesystem. + Cannot be updated. + type: array + items: + description: VolumeMount describes a mounting of a Volume + within a container. + type: object + required: + - mountPath + - name + properties: + mountPath: + description: |- + Path within the container at which the volume should be mounted. Must + not contain ':'. + type: string + mountPropagation: + description: |- + mountPropagation determines how mounts are propagated from the host + to container and the other way around. + When not set, MountPropagationNone is used. + This field is beta in 1.10. + When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified + (which defaults to None). + type: string + name: + description: This must match the Name of a Volume. + type: string + readOnly: + description: |- + Mounted read-only if true, read-write otherwise (false or unspecified). + Defaults to false. + type: boolean + recursiveReadOnly: + description: |- + RecursiveReadOnly specifies whether read-only mounts should be handled + recursively. + + If ReadOnly is false, this field has no meaning and must be unspecified. + + If ReadOnly is true, and this field is set to Disabled, the mount is not made + recursively read-only. If this field is set to IfPossible, the mount is made + recursively read-only, if it is supported by the container runtime. If this + field is set to Enabled, the mount is made recursively read-only if it is + supported by the container runtime, otherwise the pod will not be started and + an error will be generated to indicate the reason. + + If this field is set to IfPossible or Enabled, MountPropagation must be set to + None (or be unspecified, which defaults to None). + + If this field is not specified, it is treated as an equivalent of Disabled. + type: string + subPath: + description: |- + Path within the volume from which the container's volume should be mounted. + Defaults to "" (volume's root). + type: string + subPathExpr: + description: |- + Expanded path within the volume from which the container's volume should be mounted. + Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment. + Defaults to "" (volume's root). + SubPathExpr and SubPath are mutually exclusive. + type: string + x-kubernetes-list-type: atomic + when: + description: When is a list of when expressions that need + to be true for the task to run + type: array + items: + description: |- + WhenExpression allows a PipelineTask to declare expressions to be evaluated before the Task is run + to determine whether the Task should be executed or skipped + type: object + properties: + cel: + description: |- + CEL is a string of Common Language Expression, which can be used to conditionally execute + the task based on the result of the expression evaluation + More info about CEL syntax: https://github.com/google/cel-spec/blob/master/doc/langdef.md + type: string + input: + description: Input is the string for guard checking + which can be a static input or an output from + a parent Task + type: string + operator: + description: Operator that represents an Input's + relationship to the values + type: string + values: + description: |- + Values is an array of strings, which is compared against the input, for guard checking + It must be non-empty + type: array + items: + type: string + x-kubernetes-list-type: atomic + workingDir: + description: |- + Step's working directory. + If not specified, the container runtime's default will be used, which + might be configured in the container image. + Cannot be updated. + type: string + workspaces: + description: |- + This is an alpha field. You must set the "enable-api-fields" feature flag to "alpha" + for this field to be supported. + + Workspaces is a list of workspaces from the Task that this Step wants + exclusive access to. Adding a workspace to this list means that any + other Step or Sidecar that does not also request this Workspace will + not have access to it. + type: array + items: + description: |- + WorkspaceUsage is used by a Step or Sidecar to declare that it wants isolated access + to a Workspace defined in a Task. + type: object + required: + - mountPath + - name + properties: + mountPath: + description: |- + MountPath is the path that the workspace should be mounted to inside the Step or Sidecar, + overriding any MountPath specified in the Task's WorkspaceDeclaration. + type: string + name: + description: Name is the name of the workspace this + Step or Sidecar wants access to. + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + volumes: + description: |- + Volumes is a collection of volumes that are available to mount into the + steps of the build. + See Pod.spec.volumes (API version: v1) + x-kubernetes-preserve-unknown-fields: true + workspaces: + description: Workspaces are the volumes that this Task requires. + type: array + items: + description: WorkspaceDeclaration is a declaration of a volume + that a Task requires. + type: object + required: + - name + properties: + description: + description: Description is an optional human readable + description of this volume. + type: string + mountPath: + description: MountPath overrides the directory that the + volume will be made available at. + type: string + name: + description: Name is the name by which you can bind the + volume at runtime. + type: string + optional: + description: |- + Optional marks a Workspace as not being required in TaskRuns. By default + this field is false and so declared workspaces are required. + type: boolean + readOnly: + description: |- + ReadOnly dictates whether a mounted volume is writable. By default this + field is false and so mounted volumes are writable. + type: boolean + x-kubernetes-list-type: atomic + additionalPrinterColumns: + - name: Succeeded + type: string + jsonPath: ".status.conditions[?(@.type==\"Succeeded\")].status" + - name: Reason + type: string + jsonPath: ".status.conditions[?(@.type==\"Succeeded\")].reason" + - name: StartTime + type: date + jsonPath: .status.startTime + - name: CompletionTime + type: date + jsonPath: .status.completionTime + # Opt into the status subresource so metadata.generation + # starts to increment + subresources: + status: {} + names: + kind: TaskRun + plural: taskruns + singular: taskrun + categories: + - tekton + - tekton-pipelines + shortNames: + - tr + - trs + scope: Namespaced + conversion: + strategy: Webhook + webhook: + conversionReviewVersions: ["v1beta1", "v1"] + clientConfig: + service: + name: tekton-pipelines-webhook + namespace: tekton-pipelines +--- +# Copyright 2022 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: verificationpolicies.tekton.dev + labels: + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines + pipeline.tekton.dev/release: "v1.15.0" + version: "v1.15.0" +spec: + group: tekton.dev + versions: + - name: v1alpha1 + served: true + storage: true + schema: + openAPIV3Schema: + description: |- + VerificationPolicy defines the rules to verify Tekton resources. + VerificationPolicy can config the mapping from resources to a list of public + keys, so when verifying the resources we can use the corresponding public keys. + type: object + required: + - spec + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: Spec holds the desired state of the VerificationPolicy. + type: object + required: + - authorities + - resources + properties: + authorities: + description: Authorities defines the rules for validating signatures. + type: array + items: + description: The Authority block defines the keys for validating + signatures. + type: object + required: + - name + properties: + key: + description: Key contains the public key to validate the resource. + type: object + properties: + data: + description: Data contains the inline public key. + type: string + hashAlgorithm: + description: HashAlgorithm always defaults to sha256 if + the algorithm hasn't been explicitly set + type: string + kms: + description: |- + KMS contains the KMS url of the public key + Supported formats differ based on the KMS system used. + One example of a KMS url could be: + gcpkms://projects/[PROJECT]/locations/[LOCATION]>/keyRings/[KEYRING]/cryptoKeys/[KEY]/cryptoKeyVersions/[KEY_VERSION] + For more examples please refer https://docs.sigstore.dev/cosign/kms_support. + Note that the KMS is not supported yet. + type: string + secretRef: + description: SecretRef sets a reference to a secret with + the key. + type: object + properties: + name: + description: name is unique within a namespace to + reference a secret resource. + type: string + namespace: + description: namespace defines the space within which + the secret name must be unique. + type: string + x-kubernetes-map-type: atomic + name: + description: Name is the name for this authority. + type: string + mode: + description: |- + Mode controls whether a failing policy will fail the taskrun/pipelinerun, or only log the warnings + enforce - fail the taskrun/pipelinerun if verification fails (default) + warn - don't fail the taskrun/pipelinerun if verification fails but log warnings + type: string + resources: + description: |- + Resources defines the patterns of resources sources that should be subject to this policy. + For example, we may want to apply this Policy from a certain GitHub repo. + Then the ResourcesPattern should be valid regex. E.g. If using gitresolver, and we want to config keys from a certain git repo. + `ResourcesPattern` can be `https://github.com/tektoncd/catalog.git`, we will use regex to filter out those resources. + type: array + items: + description: ResourcePattern defines the pattern of the resource + source + type: object + required: + - pattern + properties: + pattern: + description: |- + Pattern defines a resource pattern. Regex is created to filter resources based on `Pattern` + Example patterns: + GitHub resource: https://github.com/tektoncd/catalog.git, https://github.com/tektoncd/* + Bundle resource: gcr.io/tekton-releases/catalog/upstream/git-clone, gcr.io/tekton-releases/catalog/upstream/* + Hub resource: https://artifacthub.io/*, + type: string + names: + kind: VerificationPolicy + plural: verificationpolicies + singular: verificationpolicy + categories: + - tekton + - tekton-pipelines + scope: Namespaced +--- +# Copyright 2020 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: Secret +metadata: + name: webhook-certs + namespace: tekton-pipelines + labels: + app.kubernetes.io/component: webhook + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines + pipeline.tekton.dev/release: "v1.15.0" +# The data is populated at install time. +--- +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingWebhookConfiguration +metadata: + name: validation.webhook.pipeline.tekton.dev + labels: + app.kubernetes.io/component: webhook + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines + pipeline.tekton.dev/release: "v1.15.0" +webhooks: + - admissionReviewVersions: ["v1"] + clientConfig: + service: + name: tekton-pipelines-webhook + namespace: tekton-pipelines + failurePolicy: Fail + sideEffects: None + name: validation.webhook.pipeline.tekton.dev +--- +apiVersion: admissionregistration.k8s.io/v1 +kind: MutatingWebhookConfiguration +metadata: + name: webhook.pipeline.tekton.dev + labels: + app.kubernetes.io/component: webhook + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines + pipeline.tekton.dev/release: "v1.15.0" +webhooks: + - admissionReviewVersions: ["v1"] + clientConfig: + service: + name: tekton-pipelines-webhook + namespace: tekton-pipelines + failurePolicy: Fail + sideEffects: None + name: webhook.pipeline.tekton.dev +--- +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingWebhookConfiguration +metadata: + name: config.webhook.pipeline.tekton.dev + labels: + app.kubernetes.io/component: webhook + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines + pipeline.tekton.dev/release: "v1.15.0" +webhooks: + - admissionReviewVersions: ["v1"] + clientConfig: + service: + name: tekton-pipelines-webhook + namespace: tekton-pipelines + failurePolicy: Fail + sideEffects: None + name: config.webhook.pipeline.tekton.dev + objectSelector: + matchLabels: + app.kubernetes.io/part-of: tekton-pipelines +--- +# Copyright 2019-2022 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: tekton-aggregate-edit + labels: + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines + rbac.authorization.k8s.io/aggregate-to-edit: "true" + rbac.authorization.k8s.io/aggregate-to-admin: "true" +rules: + - apiGroups: + - tekton.dev + resources: + - tasks + - taskruns + - pipelines + - pipelineruns + - runs + - customruns + - stepactions + verbs: + - create + - delete + - deletecollection + - get + - list + - patch + - update + - watch +--- +# Copyright 2019-2022 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: tekton-aggregate-view + labels: + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines + rbac.authorization.k8s.io/aggregate-to-view: "true" +rules: + - apiGroups: + - tekton.dev + resources: + - tasks + - taskruns + - pipelines + - pipelineruns + - runs + - customruns + - stepactions + verbs: + - get + - list + - watch +--- +# Copyright 2019 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-defaults + namespace: tekton-pipelines + labels: + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +data: + _example: | + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this example block and unindented to be in the data block + # to actually change the configuration. + + # default-timeout-minutes contains the default number of + # minutes to use for TaskRun and PipelineRun, if none is specified. + default-timeout-minutes: "60" # 60 minutes + + # default-service-account contains the default service account name + # to use for TaskRun and PipelineRun, if none is specified. + default-service-account: "default" + + # default-managed-by-label-value contains the default value given to the + # "app.kubernetes.io/managed-by" label applied to all Pods created for + # TaskRuns. If a user's requested TaskRun specifies another value for this + # label, the user's request supercedes. + default-managed-by-label-value: "tekton-pipelines" + + # default-pod-template contains the default pod template to use for + # TaskRun and PipelineRun. If a pod template is specified on the + # PipelineRun, the default-pod-template is merged with that one. + # default-pod-template: + + # default-affinity-assistant-pod-template contains the default pod template + # to use for affinity assistant pods. If a pod template is specified on the + # PipelineRun, the default-affinity-assistant-pod-template is merged with + # that one. + # default-affinity-assistant-pod-template: + + # default-cloud-events-sink contains the default CloudEvents sink to be + # used for TaskRun and PipelineRun, when no sink is specified. + # Note that right now it is still not possible to set a PipelineRun or + # TaskRun specific sink, so the default is the only option available. + # If no sink is specified, no CloudEvent is generated + # default-cloud-events-sink: + + # default-task-run-workspace-binding contains the default workspace + # configuration provided for any Workspaces that a Task declares + # but that a TaskRun does not explicitly provide. + # default-task-run-workspace-binding: | + # emptyDir: {} + + # default-max-matrix-combinations-count contains the default maximum number + # of combinations from a Matrix, if none is specified. + default-max-matrix-combinations-count: "256" + + # default-forbidden-env contains comma seperated environment variables that cannot be + # overridden by podTemplate. + default-forbidden-env: + + # default-resolver-type contains the default resolver type to be used in the cluster, + # no default-resolver-type is specified by default + default-resolver-type: + + # default-imagepullbackoff-timeout contains the default duration to wait + # before requeuing the TaskRun to retry, specifying 0 here is equivalent to fail fast + # possible values could be 1m, 5m, 10s, 1h, etc + # default-imagepullbackoff-timeout: "5m" + + # default-create-container-error-timeout contains the default duration to wait + # before failing a TaskRun when a container fails with "context deadline exceeded" + # (e.g. CRI-O under heavy load). Specifying 0 here is equivalent to fail fast. + # possible values could be 1m, 5m, 10s, 1h, etc + # default-create-container-error-timeout: "5m" + + # default-maximum-resolution-timeout specifies the default duration used by the + # resolution controller before timing out when exceeded. + # Possible values include "1m", "5m", "10s", "1h", etc. + # Example: default-maximum-resolution-timeout: "1m" + + # default-container-resource-requirements allow users to configure default resource + # requirements for init containers and containers in pods created by the controller. + # No resource requirements are applied by default when this key is unset. + # Note: All the resource requirements are applied to init-containers and containers + # only if the existing resource requirements are empty, except Tekton internal + # containers can be overridden by named entries such as prepare or place-scripts. + # default-container-resource-requirements: | + # place-scripts: # updates resource requirements of a 'place-scripts' container + # requests: + # memory: "64Mi" + # cpu: "250m" + # limits: + # memory: "128Mi" + # cpu: "500m" + # + # prepare: # updates resource requirements of a 'prepare' container + # requests: + # memory: "64Mi" + # cpu: "250m" + # limits: + # memory: "256Mi" + # cpu: "500m" + # + # working-dir-initializer: # updates resource requirements of a 'working-dir-initializer' container + # requests: + # memory: "64Mi" + # cpu: "250m" + # limits: + # memory: "512Mi" + # cpu: "500m" + # + # prefix-scripts: # updates resource requirements of containers which starts with 'scripts-' + # requests: + # memory: "64Mi" + # cpu: "250m" + # limits: + # memory: "128Mi" + # cpu: "500m" + # + # prefix-sidecar-scripts: # updates resource requirements of containers which starts with 'sidecar-scripts-' + # requests: + # memory: "64Mi" + # cpu: "250m" + # limits: + # memory: "128Mi" + # cpu: "500m" + # + # default: # updates resource requirements of init-containers and containers which has empty resource requirements + # requests: + # memory: "64Mi" + # cpu: "250m" + # limits: + # memory: "256Mi" + # cpu: "500m" + + # default-sidecar-log-polling-interval specifies the polling interval for the Tekton sidecar log results container. + # This controls how frequently the sidecar checks for step completion files written by steps in a TaskRun. + # Lower values (e.g., "10ms") make the sidecar more responsive but may increase CPU usage; higher values (e.g., "1s") + # reduce resource usage but may delay result collection. + # This value is used by the sidecar-tekton-log-results container and can be tuned for performance or test scenarios. + # Example values: "100ms", "500ms", "1s" + default-sidecar-log-polling-interval: "100ms" + + # default-step-ref-concurrency-limit specifies the concurrency limit for resolving step references. + # This setting controls the maximum number of concurrent goroutines used to resolve + # step references (`step.ref` fields) simultaneously. This limit acts as a throttle + # to prevent overwhelming remote servers (e.g., git providers, OCI registries) or + # the Kubernetes API server, especially when a TaskRun contains many steps that + # reference StepActions. + default-step-ref-concurrency-limit: "5" +--- +# Copyright 2023 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-events + namespace: tekton-pipelines + labels: + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +data: + _example: | + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this example block and unindented to be in the data block + # to actually change the configuration. + + # formats contains a comma separated list of event formats to be used + # the only format supported today is "tektonv1". An empty string is not + # a valid configuration. To disable events, do not specify the sink. + formats: "tektonv1" + + # sink contains the event sink to be used for TaskRun, PipelineRun and + # CustomRun. If no sink is specified, no CloudEvent is generated. + # This setting supercedes the "default-cloud-events-sink" from the + # "config-defaults" config map + sink: "https://events.sink/cdevents" +--- +# Copyright 2019 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: feature-flags + namespace: tekton-pipelines + labels: + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +data: + # Setting this flag will determine how PipelineRun Pods are scheduled with Affinity Assistant. + # Acceptable values are "workspaces" (default), "pipelineruns", "isolate-pipelinerun", or "disabled". + # + # Setting it to "workspaces" will schedule all the taskruns sharing the same PVC-based workspace in a pipelinerun to the same node. + # Setting it to "pipelineruns" will schedule all the taskruns in a pipelinerun to the same node. + # Setting it to "isolate-pipelinerun" will schedule all the taskruns in a pipelinerun to the same node, + # and only allows one pipelinerun to run on a node at a time. + # Setting it to "disabled" will not apply any coschedule policy. + # + # See more in the Affinity Assistant documentation + # https://github.com/tektoncd/pipeline/blob/main/docs/affinityassistants.md + coschedule: "workspaces" + # Setting this flag to "true" will prevent Tekton scanning attached + # service accounts and injecting any credentials it finds into your + # Steps. + # + # The default behaviour currently is for Tekton to search service + # accounts for secrets matching a specified format and automatically + # mount those into your Steps. + # + # Note: setting this to "true" will prevent PipelineResources from + # working. + # + # See https://github.com/tektoncd/pipeline/issues/2791 for more + # info. + disable-creds-init: "false" + # Setting this flag to "false" will stop Tekton from waiting for a + # TaskRun's sidecar containers to be running before starting the first + # step. This will allow Tasks to be run in environments that don't + # support the DownwardAPI volume type, but may lead to unintended + # behaviour if sidecars are used. + # + # See https://github.com/tektoncd/pipeline/issues/4937 for more info. + await-sidecar-readiness: "true" + # This option should be set to false when Pipelines is running in a + # cluster that does not use injected sidecars such as Istio. Setting + # it to false should decrease the time it takes for a TaskRun to start + # running. For clusters that use injected sidecars, setting this + # option to false can lead to unexpected behavior. + # + # See https://github.com/tektoncd/pipeline/issues/2080 for more info. + running-in-environment-with-injected-sidecars: "true" + # Setting this flag to "true" will require that any Git SSH Secret + # offered to Tekton must have known_hosts included. + # + # See https://github.com/tektoncd/pipeline/issues/2981 for more + # info. + require-git-ssh-secret-known-hosts: "false" + # Setting this flag to "true" enables the use of Tekton OCI bundle. + # This is an experimental feature and thus should still be considered + # an alpha feature. + enable-tekton-oci-bundles: "false" + # Setting this flag will determine which gated features are enabled. + # Acceptable values are "stable", "beta", or "alpha". + enable-api-fields: "beta" + # DEPRECATED: send-cloudevents-for-runs is deprecated and will be removed in a future + # release. CloudEvents are now enabled by default when a sink is configured in the + # config-events ConfigMap. This flag only affects CustomRuns; it has no effect on + # TaskRuns or PipelineRuns. + send-cloudevents-for-runs: "true" + # This flag affects the behavior of taskruns and pipelineruns in cases where no VerificationPolicies match them. + # If it is set to "fail", TaskRuns and PipelineRuns will fail verification if no matching policies are found. + # If it is set to "warn", TaskRuns and PipelineRuns will run to completion if no matching policies are found, and an error will be logged. + # If it is set to "ignore", TaskRuns and PipelineRuns will run to completion if no matching policies are found, and no error will be logged. + trusted-resources-verification-no-match-policy: "ignore" + # Setting this flag to "true" enables populating the "provenance" field in TaskRun + # and PipelineRun status. This field contains metadata about resources used + # in the TaskRun/PipelineRun such as the source from where a remote Task/Pipeline + # definition was fetched. + enable-provenance-in-status: "true" + # Setting this flag will determine how Tekton pipelines will handle non-falsifiable provenance. + # If set to "spire", then SPIRE will be used to ensure non-falsifiable provenance. + # If set to "none", then Tekton will not have non-falsifiable provenance. + # This is an experimental feature and thus should still be considered an alpha feature. + enforce-nonfalsifiability: "none" + # Setting this flag will determine how Tekton pipelines will handle extracting results from the task. + # Acceptable values are "termination-message" or "sidecar-logs". + # "sidecar-logs" is now a beta feature. + results-from: "termination-message" + # Setting this flag will determine the upper limit of each task result + # This flag is optional and only associated with the previous flag, results-from + # When results-from is set to "sidecar-logs", this flag can be used to configure the upper limit of a task result + # max-result-size: "4096" + # Setting this flag to "true" will limit privileges for containers injected by Tekton into TaskRuns. + # This allows TaskRuns to run in namespaces with "restricted" pod security standards. + # Not all Kubernetes implementations support this option. + set-security-context: "false" + # Setting this flag to "true" will set readOnlyRootFilesystem in securityContext for all containers used in TaskRuns and AffinityAssistant. + set-security-context-read-only-root-filesystem: "false" + # Setting this flag to "true" will keep pod on cancellation + # allowing examination of the logs on the pods from cancelled taskruns + keep-pod-on-cancel: "false" + # Setting this flag to "true" will enable the CEL evaluation in WhenExpression + enable-cel-in-whenexpression: "false" + # Setting this flag to "true" will enable the use of Artifacts in Steps + # This feature is in preview mode and not implemented yet. Please check #7693 for updates. + enable-artifacts: "false" + # Setting this flag to "true" will enable the built-in param input validation via param enum. + enable-param-enum: "false" + # Setting this flag to "pipeline,pipelinerun,taskrun" will prevent users from creating + # embedded spec Taskruns or Pipelineruns for Pipeline, Pipelinerun and taskrun + # respectively. We can specify "pipeline" to disable for Pipeline resource only. + # "pipelinerun" for Pipelinerun and "taskrun" for Taskrun. Or a combination of + # these. + disable-inline-spec: "" + # Setting this flag to "true" will enable the use of concise resolver syntax + enable-concise-resolver-syntax: "false" + # Setthing this flag to "true" will enable native Kubernetes Sidecar support + enable-kubernetes-sidecar: "false" + # Setting this flag to "false" will have no effect since StepActions are a stable feature + enable-step-actions: "true" + # Controls whether exponential backoff is enabled when creating TaskRuns or CustomRuns. + # If set to "true", the controller will use exponential backoff when retrying failed create operations, + # which can help mitigate issues caused by temporary API server or webhook unavailability. + # If set to "false", exponential backoff will be disabled. + # For advanced tuning of backoff parameters, update the 'wait-exponential-backoff' ConfigMap. + enable-wait-exponential-backoff: "false" + # Setting this flag to "true" will compress termination messages with flate + # to fit more results in the 4KB Kubernetes termination message limit. + # Only applies when results-from is set to "termination-message" (the default); + # ignored when results-from is "sidecar-logs". + # Alpha feature — this is a short-term measure. External result storage + # (TEP-0164) will address the underlying 4KB limitation. + enable-termination-message-compression: "false" + # Controls whether informer cache transforms are enabled. When enabled (default), + # the controller strips large, unnecessary metadata fields (managedFields and the + # kubectl last-applied-configuration annotation) from PipelineRuns, TaskRuns, + # CustomRuns, and Pods stored in the informer cache to reduce memory usage. + # + # Set to "false" to disable if you encounter issues with missing data in cached objects. + # Changes require a controller restart to take effect. + # + # See https://github.com/tektoncd/pipeline/issues/7691 for more info. + enable-informer-cache-transforms: "true" +--- +# Copyright 2021 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: pipelines-info + namespace: tekton-pipelines + labels: + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +data: + # Contains pipelines version which can be queried by external + # tools such as CLI. Elevated permissions are already given to + # this ConfigMap such that even if we don't have access to + # other resources in the namespace we still can have access to + # this ConfigMap. + version: "v1.15.0" +--- +# Copyright 2020 Tekton Authors LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-leader-election-controller + namespace: tekton-pipelines + labels: + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +data: + _example: | + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this example block and unindented to be in the data block + # to actually change the configuration. + # lease-duration is how long non-leaders will wait to try to acquire the + # lock; 15 seconds is the value used by core kubernetes controllers. + lease-duration: "60s" + # renew-deadline is how long a leader will try to renew the lease before + # giving up; 10 seconds is the value used by core kubernetes controllers. + renew-deadline: "40s" + # retry-period is how long the leader election client waits between tries of + # actions; 2 seconds is the value used by core kubernetes controllers. + retry-period: "10s" + # buckets is the number of buckets used to partition key space of each + # Reconciler. If this number is M and the replica number of the controller + # is N, the N replicas will compete for the M buckets. The owner of a + # bucket will take care of the reconciling for the keys partitioned into + # that bucket. + buckets: "1" +--- +# Copyright 2023 Tekton Authors LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-leader-election-events + namespace: tekton-pipelines + labels: + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +data: + _example: | + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this example block and unindented to be in the data block + # to actually change the configuration. + # lease-duration is how long non-leaders will wait to try to acquire the + # lock; 15 seconds is the value used by core kubernetes controllers. + lease-duration: "60s" + # renew-deadline is how long a leader will try to renew the lease before + # giving up; 10 seconds is the value used by core kubernetes controllers. + renew-deadline: "40s" + # retry-period is how long the leader election client waits between tries of + # actions; 2 seconds is the value used by core kubernetes controllers. + retry-period: "10s" + # buckets is the number of buckets used to partition key space of each + # Reconciler. If this number is M and the replica number of the controller + # is N, the N replicas will compete for the M buckets. The owner of a + # bucket will take care of the reconciling for the keys partitioned into + # that bucket. + buckets: "1" +--- +# Copyright 2023 Tekton Authors LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-leader-election-webhook + namespace: tekton-pipelines + labels: + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +data: + _example: | + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this example block and unindented to be in the data block + # to actually change the configuration. + # lease-duration is how long non-leaders will wait to try to acquire the + # lock; 15 seconds is the value used by core kubernetes controllers. + lease-duration: "60s" + # renew-deadline is how long a leader will try to renew the lease before + # giving up; 10 seconds is the value used by core kubernetes controllers. + renew-deadline: "40s" + # retry-period is how long the leader election client waits between tries of + # actions; 2 seconds is the value used by core kubernetes controllers. + retry-period: "10s" + # buckets is the number of buckets used to partition key space of each + # Reconciler. If this number is M and the replica number of the controller + # is N, the N replicas will compete for the M buckets. The owner of a + # bucket will take care of the reconciling for the keys partitioned into + # that bucket. + buckets: "1" +--- +# Copyright 2019 Tekton Authors LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-logging + namespace: tekton-pipelines + labels: + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +data: + zap-logger-config: | + { + "level": "info", + "development": false, + "sampling": { + "initial": 100, + "thereafter": 100 + }, + "outputPaths": ["stdout"], + "errorOutputPaths": ["stderr"], + "encoding": "json", + "encoderConfig": { + "timeKey": "timestamp", + "levelKey": "severity", + "nameKey": "logger", + "callerKey": "caller", + "messageKey": "message", + "stacktraceKey": "stacktrace", + "lineEnding": "", + "levelEncoder": "", + "timeEncoder": "iso8601", + "durationEncoder": "", + "callerEncoder": "" + } + } + # Log level overrides + loglevel.controller: "info" + loglevel.webhook: "info" +--- +# Copyright 2019 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-observability + namespace: tekton-pipelines + labels: + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +data: + metrics-protocol: prometheus + _example: | + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this example block and unindented to be in the data block + # to actually change the configuration. + + # OpenTelemetry Metrics Configuration + # Protocol for metrics export (prometheus, grpc, http/protobuf, none) + # Default if not specified: "none" + metrics-protocol: prometheus + + # Metrics endpoint (for grpc/http protocols) + # Default: empty (uses default OTLP endpoint) + metrics-endpoint: "" + + # Metrics export interval (e.g., "30s", "1m") + # Default: empty (uses default interval) + metrics-export-interval: "" + + # OpenTelemetry Tracing Configuration + # Protocol for tracing export (grpc, http/protobuf, none, stdout) + # Default: none + tracing-protocol: none + + # Tracing endpoint (for grpc/http protocols) + # Default: empty + tracing-endpoint: "" + + # Tracing sampling rate (0.0 to 1.0) + # Default: 1.0 (100% sampling) + tracing-sampling-rate: "1.0" + + # Runtime Configuration + # Enable profiling (enabled, disabled) + # Default: disabled + runtime-profiling: disabled + + # Runtime export interval (e.g., "15s") + # Default: 15s + runtime-export-interval: "15s" + + # Note: Legacy OpenCensus configuration (metrics.backend-destination, etc.) has been + # removed as OpenCensus support is no longer provided by the underlying infrastructure. + # Please use the OpenTelemetry configuration options above. + + # Tekton-specific metrics configuration + metrics.taskrun.level: "task" + metrics.taskrun.duration-type: "histogram" + metrics.pipelinerun.level: "pipeline" + metrics.pipelinerun.duration-type: "histogram" + metrics.count.enable-reason: "false" + metrics.running-pipelinerun.level: "" +--- +# Copyright 2020 Tekton Authors LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-registry-cert + namespace: tekton-pipelines + labels: + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +# data: +# # Registry's self-signed certificate +# cert: | +--- +# Copyright 2022 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-spire + namespace: tekton-pipelines + labels: + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +data: + _example: | + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this example block and unindented to be in the data block + # to actually change the configuration. + # + # spire-trust-domain specifies the SPIRE trust domain to use. + # spire-trust-domain: "example.org" + # + # spire-socket-path specifies the SPIRE agent socket for SPIFFE workload API. + # spire-socket-path: "unix:///spiffe-workload-api/spire-agent.sock" + # + # spire-server-addr specifies the SPIRE server address for workload/node registration. + # spire-server-addr: "spire-server.spire.svc.cluster.local:8081" + # + # spire-node-alias-prefix specifies the SPIRE node alias prefix to use. + # spire-node-alias-prefix: "/tekton-node/" +--- +# Copyright 2023 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# NOTE: Exported traces may include Kubernetes resource identifiers (e.g. TaskRun/PipelineRun +# names and namespaces) as span attributes. Treat the trace backend as a trusted observability +# system. See docs/developers/tracing.md for details. +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-tracing + namespace: tekton-pipelines + labels: + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +data: + _example: | + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this example block and unindented to be in the data block + # to actually change the configuration. + # + # Enable sending traces to defined endpoint by setting this to true + enabled: "true" + # + # API endpoint to send the traces to + # (optional): The default value is given below + endpoint: "http://jaeger-collector.jaeger.svc.cluster.local:4318/v1/traces" + # (optional) Name of the k8s secret which contains basic auth credentials + credentialsSecret: "jaeger-creds" +--- +# Copyright 2025 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# This ConfigMap allows cluster operators to configure the exponential backoff +# parameters used by Tekton Pipelines when retrying Kubernetes API operations, +# such as creating TaskRuns or CustomRuns. Adjusting these values can help +# tune retry behavior in response to webhook timeouts or transient errors. +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-wait-exponential-backoff + namespace: tekton-pipelines + labels: + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +data: + duration: "10s" # The initial duration before the first retry (Go duration string, e.g. "1s"). + factor: "2.0" # The factor by which the duration increases after each retry (should not be negative). + jitter: "0.0" # Jitter factor (0.0 = no jitter, 0.2 = up to 20% random additional wait). + steps: "5" # The number of times the duration may change (number of backoff steps). + cap: "60s" # The maximum duration between retries (Go duration string, e.g. "30s"). +--- +# Copyright 2019 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: tekton-pipelines-controller + namespace: tekton-pipelines + labels: + app.kubernetes.io/name: controller + app.kubernetes.io/component: controller + app.kubernetes.io/instance: default + app.kubernetes.io/version: "v1.15.0" + app.kubernetes.io/part-of: tekton-pipelines + # tekton.dev/release value replaced with inputs.params.versionTag in pipeline/tekton/publish.yaml + pipeline.tekton.dev/release: "v1.15.0" + # labels below are related to istio and should not be used for resource lookup + version: "v1.15.0" +spec: + replicas: 1 + selector: + matchLabels: + app.kubernetes.io/name: controller + app.kubernetes.io/component: controller + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines + template: + metadata: + labels: + app.kubernetes.io/name: controller + app.kubernetes.io/component: controller + app.kubernetes.io/instance: default + app.kubernetes.io/version: "v1.15.0" + app.kubernetes.io/part-of: tekton-pipelines + # tekton.dev/release value replaced with inputs.params.versionTag in pipeline/tekton/publish.yaml + pipeline.tekton.dev/release: "v1.15.0" + # labels below are related to istio and should not be used for resource lookup + app: tekton-pipelines-controller + version: "v1.15.0" + spec: + affinity: + nodeAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: kubernetes.io/os + operator: NotIn + values: + - windows + podAntiAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchLabels: + app.kubernetes.io/name: controller + app.kubernetes.io/component: controller + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines + topologyKey: kubernetes.io/hostname + weight: 100 + serviceAccountName: tekton-pipelines-controller + containers: + - name: tekton-pipelines-controller + image: ghcr.io/tektoncd/pipeline/controller-10a3e32792f33651396d02b6855a6e36:v1.15.0@sha256:ed33d9696b882716ab58062ec928828d5c15f4f9bac94661fb6b76ea5d27ff17 + args: [ + # These images are built on-demand by `ko resolve` and are replaced + # by image references by digest. + "-entrypoint-image", "ghcr.io/tektoncd/pipeline/entrypoint-bff0a22da108bc2f16c818c97641a296:v1.15.0@sha256:1ae5944a51f5c5f19e575de5abf268ea7a49a3a54bdad411cf27e3142af5f5c0", + "-nop-image", "ghcr.io/tektoncd/pipeline/nop-8eac7c133edad5df719dc37b36b62482:v1.15.0@sha256:f49260b33c3142f8224d26d6204b15b96b312997a169bc79fe4792981af9580c", + "-sidecarlogresults-image", "ghcr.io/tektoncd/pipeline/sidecarlogresults-7501c6a20d741631510a448b48ab098f:v1.15.0@sha256:9dbe5ed48cce1324daa49784c6fc729d8b62a7c0d15c9656126bdada1a870b98", + "-workingdirinit-image", "ghcr.io/tektoncd/pipeline/workingdirinit-0c558922ec6a1b739e550e349f2d5fc1:v1.15.0@sha256:fc38f8bc3c196e8f7cc2c22ea19194afd093175a23c9ab1b900cb150fd38307f", + # The shell image must allow root in order to create directories and copy files to PVCs. + # cgr.dev/chainguard/busybox as of April 14 2022 + # image shall not contains tag, so it will be supported on a runtime like cri-o + "-shell-image", "cgr.dev/chainguard/busybox@sha256:19f02276bf8dbdd62f069b922f10c65262cc34b710eea26ff928129a736be791", + # for script mode to work with windows we need a powershell image + # pinning to nanoserver tag as of July 15 2021 + "-shell-image-win", "mcr.microsoft.com/powershell:nanoserver@sha256:b6d5ff841b78bdf2dfed7550000fd4f3437385b8fa686ec0f010be24777654d6"] + volumeMounts: + - name: config-logging + mountPath: /etc/config-logging + - name: config-registry-cert + mountPath: /etc/config-registry-cert + env: + - name: SYSTEM_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: KUBERNETES_MIN_VERSION + value: "v1.28.0" + # If you are changing these names, you will also need to update + # the controller's Role in 200-role.yaml to include the new + # values in the "configmaps" "get" rule. + - name: CONFIG_DEFAULTS_NAME + value: config-defaults + - name: CONFIG_LOGGING_NAME + value: config-logging + - name: CONFIG_OBSERVABILITY_NAME + value: config-observability + - name: CONFIG_FEATURE_FLAGS_NAME + value: feature-flags + - name: CONFIG_LEADERELECTION_NAME + value: config-leader-election-controller + - name: CONFIG_SPIRE + value: config-spire + - name: SSL_CERT_FILE + value: /etc/config-registry-cert/cert + - name: SSL_CERT_DIR + value: /etc/ssl/certs + - name: METRICS_DOMAIN + value: tekton.dev/pipeline + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + capabilities: + drop: + - "ALL" + # User 65532 is the nonroot user ID + runAsUser: 65532 + runAsGroup: 65532 + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault + ports: + - name: metrics + containerPort: 9090 + - name: profiling + containerPort: 8008 + - name: probes + containerPort: 8080 + livenessProbe: + httpGet: + path: /health + port: probes + scheme: HTTP + initialDelaySeconds: 5 + periodSeconds: 10 + timeoutSeconds: 5 + readinessProbe: + httpGet: + path: /readiness + port: probes + scheme: HTTP + initialDelaySeconds: 5 + periodSeconds: 10 + timeoutSeconds: 5 + volumes: + - name: config-logging + configMap: + name: config-logging + - name: config-registry-cert + configMap: + name: config-registry-cert +--- +apiVersion: v1 +kind: Service +metadata: + labels: + app.kubernetes.io/name: controller + app.kubernetes.io/component: controller + app.kubernetes.io/instance: default + app.kubernetes.io/version: "v1.15.0" + app.kubernetes.io/part-of: tekton-pipelines + # tekton.dev/release value replaced with inputs.params.versionTag in pipeline/tekton/publish.yaml + pipeline.tekton.dev/release: "v1.15.0" + # labels below are related to istio and should not be used for resource lookup + app: tekton-pipelines-controller + version: "v1.15.0" + name: tekton-pipelines-controller + namespace: tekton-pipelines +spec: + ports: + - name: http-metrics + port: 9090 + protocol: TCP + targetPort: 9090 + - name: http-profiling + port: 8008 + targetPort: 8008 + - name: probes + port: 8080 + selector: + app.kubernetes.io/name: controller + app.kubernetes.io/component: controller + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +--- +# Copyright 2023 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: tekton-events-controller + namespace: tekton-pipelines + labels: + app.kubernetes.io/name: events + app.kubernetes.io/component: events + app.kubernetes.io/instance: default + app.kubernetes.io/version: "v1.15.0" + app.kubernetes.io/part-of: tekton-pipelines + # tekton.dev/release value replaced with inputs.params.versionTag in pipeline/tekton/publish.yaml + pipeline.tekton.dev/release: "v1.15.0" + # labels below are related to istio and should not be used for resource lookup + version: "v1.15.0" +spec: + replicas: 1 + selector: + matchLabels: + app.kubernetes.io/name: events + app.kubernetes.io/component: events + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines + template: + metadata: + labels: + app.kubernetes.io/name: events + app.kubernetes.io/component: events + app.kubernetes.io/instance: default + app.kubernetes.io/version: "v1.15.0" + app.kubernetes.io/part-of: tekton-pipelines + # tekton.dev/release value replaced with inputs.params.versionTag in pipeline/tekton/publish.yaml + pipeline.tekton.dev/release: "v1.15.0" + # labels below are related to istio and should not be used for resource lookup + app: tekton-events-controller + version: "v1.15.0" + spec: + affinity: + nodeAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: kubernetes.io/os + operator: NotIn + values: + - windows + serviceAccountName: tekton-events-controller + containers: + - name: tekton-events-controller + image: ghcr.io/tektoncd/pipeline/events-a9042f7efb0cbade2a868a1ee5ddd52c:v1.15.0@sha256:050f4ae0fee5d2f9b9a9b9a6270b131c0b0ecd8a1c24707746aa18d10b435604 + args: [] + volumeMounts: + - name: config-logging + mountPath: /etc/config-logging + - name: config-registry-cert + mountPath: /etc/config-registry-cert + env: + - name: SYSTEM_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: KUBERNETES_MIN_VERSION + value: "v1.28.0" + # If you are changing these names, you will also need to update + # the controller's Role in 200-role.yaml to include the new + # values in the "configmaps" "get" rule. + - name: CONFIG_DEFAULTS_NAME + value: config-defaults + - name: CONFIG_LOGGING_NAME + value: config-logging + - name: CONFIG_OBSERVABILITY_NAME + value: config-observability + - name: CONFIG_LEADERELECTION_NAME + value: config-leader-election-events + - name: SSL_CERT_FILE + value: /etc/config-registry-cert/cert + - name: SSL_CERT_DIR + value: /etc/ssl/certs + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + capabilities: + drop: + - "ALL" + # User 65532 is the nonroot user ID + runAsUser: 65532 + runAsGroup: 65532 + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault + ports: + - name: metrics + containerPort: 9090 + - name: profiling + containerPort: 8008 + - name: probes + containerPort: 8080 + livenessProbe: + httpGet: + path: /health + port: probes + scheme: HTTP + initialDelaySeconds: 5 + periodSeconds: 10 + timeoutSeconds: 5 + readinessProbe: + httpGet: + path: /readiness + port: probes + scheme: HTTP + initialDelaySeconds: 5 + periodSeconds: 10 + timeoutSeconds: 5 + volumes: + - name: config-logging + configMap: + name: config-logging + - name: config-registry-cert + configMap: + name: config-registry-cert +--- +apiVersion: v1 +kind: Service +metadata: + labels: + app.kubernetes.io/name: events + app.kubernetes.io/component: events + app.kubernetes.io/instance: default + app.kubernetes.io/version: "v1.15.0" + app.kubernetes.io/part-of: tekton-pipelines + # tekton.dev/release value replaced with inputs.params.versionTag in pipeline/tekton/publish.yaml + pipeline.tekton.dev/release: "v1.15.0" + # labels below are related to istio and should not be used for resource lookup + app: tekton-events-controller + version: "v1.15.0" + name: tekton-events-controller + namespace: tekton-pipelines +spec: + ports: + - name: http-metrics + port: 9090 + protocol: TCP + targetPort: 9090 + - name: http-profiling + port: 8008 + targetPort: 8008 + - name: probes + port: 8080 + selector: + app.kubernetes.io/name: events + app.kubernetes.io/component: events + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +--- +# Copyright 2022 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: Namespace +metadata: + name: tekton-pipelines-resolvers + labels: + app.kubernetes.io/component: resolvers + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines + pod-security.kubernetes.io/enforce: restricted +--- +# Copyright 2022 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + # ClusterRole for resolvers to monitor and update resolutionrequests. + name: tekton-pipelines-resolvers-resolution-request-updates + labels: + app.kubernetes.io/component: resolvers + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +rules: + - apiGroups: ["resolution.tekton.dev"] + resources: ["resolutionrequests", "resolutionrequests/status"] + verbs: ["get", "list", "watch", "update", "patch"] + - apiGroups: ["tekton.dev"] + resources: ["tasks", "pipelines", "stepactions"] + verbs: ["get", "list"] + # Read-only access to these. + - apiGroups: [""] + resources: ["secrets", "serviceaccounts"] + verbs: ["get", "list", "watch"] +--- +# Copyright 2022 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +kind: Role +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: tekton-pipelines-resolvers-namespace-rbac + namespace: tekton-pipelines-resolvers + labels: + app.kubernetes.io/component: resolvers + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +rules: + # Needed to watch and load configuration and secret data. + - apiGroups: [""] + resources: ["configmaps", "secrets"] + verbs: ["get", "list", "update", "watch"] + # This is needed by leader election to run the controller in HA. + - apiGroups: ["coordination.k8s.io"] + resources: ["leases"] + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] +--- +# Copyright 2022 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ServiceAccount +metadata: + name: tekton-pipelines-resolvers + namespace: tekton-pipelines-resolvers + labels: + app.kubernetes.io/component: resolvers + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +--- +# Copyright 2021 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: tekton-pipelines-resolvers + labels: + app.kubernetes.io/component: resolvers + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +subjects: + - kind: ServiceAccount + name: tekton-pipelines-resolvers + namespace: tekton-pipelines-resolvers +roleRef: + kind: ClusterRole + name: tekton-pipelines-resolvers-resolution-request-updates + apiGroup: rbac.authorization.k8s.io +--- +# Copyright 2021 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: tekton-pipelines-resolvers-namespace-rbac + namespace: tekton-pipelines-resolvers + labels: + app.kubernetes.io/component: resolvers + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +subjects: + - kind: ServiceAccount + name: tekton-pipelines-resolvers + namespace: tekton-pipelines-resolvers +roleRef: + kind: Role + name: tekton-pipelines-resolvers-namespace-rbac + apiGroup: rbac.authorization.k8s.io +--- +# Copyright 2022 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: bundleresolver-config + namespace: tekton-pipelines-resolvers + labels: + app.kubernetes.io/component: resolvers + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +data: + # the default service account name to use for bundle requests. + default-service-account: "default" + # The default layer kind in the bundle image. + default-kind: "task" + # Optional: Default cache mode for this resolver. Valid values: "always", "never", "auto" (default: "auto") + # "always" - Always cache resolved resources + # "never" - Never cache resolved resources + # "auto" - Only cache bundles with digest references (@sha256:...) + # default-cache-mode: "auto" +--- +# Copyright 2022 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: cluster-resolver-config + namespace: tekton-pipelines-resolvers + labels: + app.kubernetes.io/component: resolvers + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +data: + # The default kind to fetch. + default-kind: "task" + # The default namespace to look for resources in. + default-namespace: "" + # An optional comma-separated list of namespaces which the resolver is allowed to access. Defaults to empty, meaning all namespaces are allowed. + allowed-namespaces: "" + # An optional comma-separated list of namespaces which the resolver is blocked from accessing. Defaults to empty, meaning all namespaces are allowed. + blocked-namespaces: "" + # Optional: Default cache mode for this resolver. Valid values: "always", "never", "auto" (default: "auto") + # "always" - Always cache resolved resources + # "never" - Never cache resolved resources (recommended for cluster resolver since resources are mutable) + # "auto" - Never cache for cluster resolver (same as "never") + # default-cache-mode: "auto" +--- +# Copyright 2019 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: resolvers-feature-flags + namespace: tekton-pipelines-resolvers + labels: + app.kubernetes.io/component: resolvers + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +data: + # Setting this flag to "true" enables remote resolution of Tekton OCI bundles. + enable-bundles-resolver: "true" + # Setting this flag to "true" enables remote resolution of tasks and pipelines via the Tekton Hub. + enable-hub-resolver: "true" + # Setting this flag to "true" enables remote resolution of tasks and pipelines from Git repositories. + enable-git-resolver: "true" + # Setting this flag to "true" enables remote resolution of tasks and pipelines from other namespaces within the cluster. + enable-cluster-resolver: "true" + # Setting this flag to "true" enables remote resolution of tasks and pipelines from HTTP URLs. + enable-http-resolver: "true" +--- +# Copyright 2020 Tekton Authors LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-leader-election-resolvers + namespace: tekton-pipelines-resolvers + labels: + app.kubernetes.io/component: resolvers + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +data: + _example: | + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this example block and unindented to be in the data block + # to actually change the configuration. + # lease-duration is how long non-leaders will wait to try to acquire the + # lock; 15 seconds is the value used by core kubernetes controllers. + lease-duration: "60s" + # renew-deadline is how long a leader will try to renew the lease before + # giving up; 10 seconds is the value used by core kubernetes controllers. + renew-deadline: "40s" + # retry-period is how long the leader election client waits between tries of + # actions; 2 seconds is the value used by core kubernetes controllers. + retry-period: "10s" + # buckets is the number of buckets used to partition key space of each + # Reconciler. If this number is M and the replica number of the controller + # is N, the N replicas will compete for the M buckets. The owner of a + # bucket will take care of the reconciling for the keys partitioned into + # that bucket. + buckets: "1" +--- +# Copyright 2019 Tekton Authors LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-logging + namespace: tekton-pipelines-resolvers + labels: + app.kubernetes.io/component: resolvers + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +data: + zap-logger-config: | + { + "level": "info", + "development": false, + "sampling": { + "initial": 100, + "thereafter": 100 + }, + "outputPaths": ["stdout"], + "errorOutputPaths": ["stderr"], + "encoding": "json", + "encoderConfig": { + "timeKey": "timestamp", + "levelKey": "severity", + "nameKey": "logger", + "callerKey": "caller", + "messageKey": "message", + "stacktraceKey": "stacktrace", + "lineEnding": "", + "levelEncoder": "", + "timeEncoder": "iso8601", + "durationEncoder": "", + "callerEncoder": "" + } + } + # Log level overrides + loglevel.controller: "info" + loglevel.webhook: "info" +--- +# Copyright 2022 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-observability + namespace: tekton-pipelines-resolvers + labels: + app.kubernetes.io/component: resolvers + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +data: + metrics-protocol: prometheus + _example: | + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this example block and unindented to be in the data block + # to actually change the configuration. + + # OpenTelemetry Metrics Configuration + # Protocol for metrics export (prometheus, grpc, http/protobuf, none) + # Default if not specified: "none" + metrics-protocol: prometheus + + # Metrics endpoint (for grpc/http protocols) + # Default: empty (uses default OTLP endpoint) + metrics-endpoint: "" + + # Metrics export interval (e.g., "30s", "1m") + # Default: empty (uses default interval) + metrics-export-interval: "" + + # OpenTelemetry Tracing Configuration + # Protocol for tracing export (grpc, http/protobuf, none, stdout) + # Default: none + tracing-protocol: none + + # Tracing endpoint (for grpc/http protocols) + # Default: empty + tracing-endpoint: "" + + # Tracing sampling rate (0.0 to 1.0) + # Default: 1.0 (100% sampling) + tracing-sampling-rate: "1.0" + + # Runtime Configuration + # Enable profiling (enabled, disabled) + # Default: disabled + runtime-profiling: disabled + + # Runtime export interval (e.g., "15s") + # Default: 15s + runtime-export-interval: "15s" + + # Note: Legacy OpenCensus configuration (metrics.backend-destination, etc.) has been + # removed as OpenCensus support is no longer provided by the underlying infrastructure. + # Please use the OpenTelemetry configuration options above. +--- +# Copyright 2022 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: git-resolver-config + namespace: tekton-pipelines-resolvers + labels: + app.kubernetes.io/component: resolvers + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +data: + # The maximum amount of time a single anonymous cloning resolution may take. + fetch-timeout: "1m" + # The git url to fetch the remote resource from when using anonymous cloning. + default-url: "https://github.com/tektoncd/catalog.git" + # The git revision to fetch the remote resource from with either anonymous cloning or the authenticated API. + default-revision: "main" + # The SCM type to use with the authenticated API. Can be github, gitlab, gitea, bitbucketserver, bitbucketcloud + scm-type: "github" + # The SCM server URL to use with the authenticated API. Not needed when using github.com, gitlab.com, or BitBucket Cloud + server-url: "" + # The Kubernetes secret containing the API token for the SCM provider. Required when using the authenticated API. + api-token-secret-name: "" + # The key in the API token secret containing the actual token. Required when using the authenticated API. + api-token-secret-key: "" + # The namespace containing the API token secret. Defaults to "default". + api-token-secret-namespace: "default" + # The default organization to look for repositories under when using the authenticated API, + # if not specified in the resolver parameters. Optional. + default-org: "" + # Optional: Default cache mode for this resolver. Valid values: "always", "never", "auto" (default: "auto") + # "always" - Always cache resolved resources + # "never" - Never cache resolved resources + # "auto" - Only cache when revision is a commit hash + # default-cache-mode: "auto" + # Optional: Backoff configuration for retrying failed git resolution requests. + # These settings control the exponential backoff behavior when transient errors occur. + # backoff-duration: "2s" + # backoff-factor: "2.0" + # backoff-jitter: "0.1" + # backoff-steps: "2" # total number of resolution attempts (must be >= 1) + # backoff-cap: "10s" +--- +# Copyright 2023 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: http-resolver-config + namespace: tekton-pipelines-resolvers + labels: + app.kubernetes.io/component: resolvers + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +data: + # The maximum amount of time the http resolver will wait for a response from the server. + fetch-timeout: "1m" +--- +# Copyright 2022 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: hubresolver-config + namespace: tekton-pipelines-resolvers + labels: + app.kubernetes.io/component: resolvers + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +data: + # the default Tekton Hub catalog from where to pull the resource. + default-tekton-hub-catalog: "Tekton" + # the default Artifact Hub Task catalog from where to pull the resource. + default-artifact-hub-task-catalog: "tekton-catalog-tasks" + # the default Artifact Hub Pipeline catalog from where to pull the resource. + default-artifact-hub-pipeline-catalog: "tekton-catalog-pipelines" + # the default layer kind in the hub image. + default-kind: "task" + # the default hub source to pull the resource from. + default-type: "artifact" + # Ordered list of Artifact Hub API URLs to try. First successful response wins. + # If not set, the ARTIFACT_HUB_API env var or default (https://artifacthub.io) is used. + # URLs must use http or https scheme. + # artifact-hub-urls: | + # - https://internal-hub.example.com/ + # - https://artifacthub.io/ + # Ordered list of Tekton Hub API URLs to try. First successful response wins. + # If not set, the TEKTON_HUB_API env var is used. + # URLs must use http or https scheme. + # tekton-hub-urls: | + # - https://api.hub.tekton.dev/ +--- +# Copyright 2025 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: resolver-cache-config + namespace: tekton-pipelines-resolvers + labels: + app.kubernetes.io/component: resolvers + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +data: + # Maximum number of entries in the resolver cache + max-size: "1000" + # Time-to-live for cache entries (examples: 5m, 10m, 1h) + ttl: "5m" +--- +# Copyright 2022 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +apiVersion: apps/v1 +kind: Deployment +metadata: + name: tekton-pipelines-remote-resolvers + namespace: tekton-pipelines-resolvers + labels: + app.kubernetes.io/name: resolvers + app.kubernetes.io/component: resolvers + app.kubernetes.io/instance: default + app.kubernetes.io/version: "v1.15.0" + app.kubernetes.io/part-of: tekton-pipelines + # tekton.dev/release value replaced with inputs.params.versionTag in pipeline/tekton/publish.yaml + pipeline.tekton.dev/release: "v1.15.0" + # labels below are related to istio and should not be used for resource lookup + version: "v1.15.0" +spec: + replicas: 1 + selector: + matchLabels: + app.kubernetes.io/name: resolvers + app.kubernetes.io/component: resolvers + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines + template: + metadata: + labels: + app.kubernetes.io/name: resolvers + app.kubernetes.io/component: resolvers + app.kubernetes.io/instance: default + app.kubernetes.io/version: "v1.15.0" + app.kubernetes.io/part-of: tekton-pipelines + # tekton.dev/release value replaced with inputs.params.versionTag in pipeline/tekton/publish.yaml + pipeline.tekton.dev/release: "v1.15.0" + # labels below are related to istio and should not be used for resource lookup + app: tekton-pipelines-resolvers + version: "v1.15.0" + spec: + affinity: + nodeAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: kubernetes.io/os + operator: NotIn + values: + - windows + podAntiAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchLabels: + app.kubernetes.io/name: resolvers + app.kubernetes.io/component: resolvers + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines + topologyKey: kubernetes.io/hostname + weight: 100 + serviceAccountName: tekton-pipelines-resolvers + containers: + - name: controller + image: ghcr.io/tektoncd/pipeline/resolvers-ff86b24f130c42b88983d3c13993056d:v1.15.0@sha256:fac274d8185ad9f3ef14ab8f1a316d92c478254c7d17efa52bc60f1899a889d2 + command: + - /sbin/tini + - -- + - /ko-app/resolvers + args: [] + resources: + requests: + cpu: 100m + memory: 100Mi + limits: + cpu: 1000m + memory: 4Gi + ports: + - name: metrics + containerPort: 9090 + - name: profiling + containerPort: 8008 + # This must match the value of the environment variable PROBES_PORT. + - name: probes + containerPort: 8080 + env: + - name: SYSTEM_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: KUBERNETES_MIN_VERSION + value: "v1.28.0" + # If you are changing these names, you will also need to update + # the controller's Role in 200-role.yaml to include the new + # values in the "configmaps" "get" rule. + - name: CONFIG_LOGGING_NAME + value: config-logging + - name: CONFIG_OBSERVABILITY_NAME + value: config-observability + - name: CONFIG_FEATURE_FLAGS_NAME + value: feature-flags + - name: CONFIG_LEADERELECTION_NAME + value: config-leader-election-resolvers + - name: METRICS_DOMAIN + value: tekton.dev/resolution + - name: PROBES_PORT + value: "8080" + - name: TEKTON_HUB_API + value: "" # Override this env var to set a private hub api endpoint + - name: ARTIFACT_HUB_API + value: "https://artifacthub.io/" + volumeMounts: + - name: tmp-clone-volume + mountPath: "/tmp" + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + runAsNonRoot: true + runAsUser: 65532 + capabilities: + drop: + - "ALL" + seccompProfile: + type: RuntimeDefault + volumes: + - name: tmp-clone-volume + emptyDir: + sizeLimit: 4Gi +--- +# Copyright 2023 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +apiVersion: v1 +kind: Service +metadata: + labels: + app.kubernetes.io/name: resolvers + app.kubernetes.io/component: resolvers + app.kubernetes.io/instance: default + app.kubernetes.io/version: "v1.15.0" + app.kubernetes.io/part-of: tekton-pipelines + # tekton.dev/release value replaced with inputs.params.versionTag in pipeline/tekton/publish.yaml + pipeline.tekton.dev/release: "v1.15.0" + # labels below are related to istio and should not be used for resource lookup + app: tekton-pipelines-remote-resolvers + version: "v1.15.0" + name: tekton-pipelines-remote-resolvers + namespace: tekton-pipelines-resolvers +spec: + ports: + - name: http-metrics + port: 9090 + protocol: TCP + targetPort: 9090 + - name: http-profiling + port: 8008 + targetPort: 8008 + - name: probes + port: 8080 + selector: + app.kubernetes.io/name: resolvers + app.kubernetes.io/component: resolvers + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +--- +# Copyright 2020 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: autoscaling/v2 +kind: HorizontalPodAutoscaler +metadata: + name: tekton-pipelines-webhook + namespace: tekton-pipelines + labels: + app.kubernetes.io/name: webhook + app.kubernetes.io/component: webhook + app.kubernetes.io/instance: default + app.kubernetes.io/version: "v1.15.0" + app.kubernetes.io/part-of: tekton-pipelines + # tekton.dev/release value replaced with inputs.params.versionTag in pipeline/tekton/publish.yaml + pipeline.tekton.dev/release: "v1.15.0" + # labels below are related to istio and should not be used for resource lookup + version: "v1.15.0" +spec: + minReplicas: 1 + maxReplicas: 5 + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: tekton-pipelines-webhook + metrics: + - type: Resource + resource: + name: cpu + target: + type: Utilization + averageUtilization: 100 +--- +# Copyright 2020 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: apps/v1 +kind: Deployment +metadata: + # Note: the Deployment name must be the same as the Service name specified in + # config/400-webhook-service.yaml. If you change this name, you must also + # change the value of WEBHOOK_SERVICE_NAME below. + name: tekton-pipelines-webhook + namespace: tekton-pipelines + labels: + app.kubernetes.io/name: webhook + app.kubernetes.io/component: webhook + app.kubernetes.io/instance: default + app.kubernetes.io/version: "v1.15.0" + app.kubernetes.io/part-of: tekton-pipelines + # tekton.dev/release value replaced with inputs.params.versionTag in pipeline/tekton/publish.yaml + pipeline.tekton.dev/release: "v1.15.0" + # labels below are related to istio and should not be used for resource lookup + version: "v1.15.0" +spec: + selector: + matchLabels: + app.kubernetes.io/name: webhook + app.kubernetes.io/component: webhook + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines + template: + metadata: + labels: + app.kubernetes.io/name: webhook + app.kubernetes.io/component: webhook + app.kubernetes.io/instance: default + app.kubernetes.io/version: "v1.15.0" + app.kubernetes.io/part-of: tekton-pipelines + # tekton.dev/release value replaced with inputs.params.versionTag in pipeline/tekton/publish.yaml + pipeline.tekton.dev/release: "v1.15.0" + # labels below are related to istio and should not be used for resource lookup + app: tekton-pipelines-webhook + version: "v1.15.0" + spec: + affinity: + nodeAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: kubernetes.io/os + operator: NotIn + values: + - windows + podAntiAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchLabels: + app.kubernetes.io/name: webhook + app.kubernetes.io/component: webhook + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines + topologyKey: kubernetes.io/hostname + weight: 100 + serviceAccountName: tekton-pipelines-webhook + containers: + - name: webhook + # This is the Go import path for the binary that is containerized + # and substituted here. + image: ghcr.io/tektoncd/pipeline/webhook-d4749e605405422fd87700164e31b2d1:v1.15.0@sha256:660a4a3bc55eaafcf8672d2c8c2469d9cf0e6090cd367a3d4bac82f834487947 + # Resource request required for autoscaler to take any action for a metric + resources: + requests: + cpu: 100m + memory: 100Mi + limits: + cpu: 500m + memory: 500Mi + env: + - name: SYSTEM_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: KUBERNETES_MIN_VERSION + value: "v1.28.0" + # If you are changing these names, you will also need to update + # the webhook's Role in 200-role.yaml to include the new + # values in the "configmaps" "get" rule. + - name: CONFIG_LOGGING_NAME + value: config-logging + - name: CONFIG_OBSERVABILITY_NAME + value: config-observability + - name: CONFIG_LEADERELECTION_NAME + value: config-leader-election-webhook + - name: CONFIG_FEATURE_FLAGS_NAME + value: feature-flags + # If you change PROBES_PORT, you will also need to change the + # containerPort "probes" to the same value. + - name: PROBES_PORT + value: "8080" + # If you change WEBHOOK_PORT, you will also need to change the + # containerPort "https-webhook" to the same value. + - name: WEBHOOK_PORT + value: "8443" + # if you change WEBHOOK_ADMISSION_CONTROLLER_NAME, you will also need to update + # the webhooks.name in 500-webhooks.yaml to include the new names of admission webhooks. + # Additionally, you will also need to change the resource names (metadata.name) of + # "MutatingWebhookConfiguration" and "ValidatingWebhookConfiguration" in 500-webhooks.yaml + # to reflect the change in the name of the admission webhook. + # Followed by changing the webhook's Role in 200-clusterrole.yaml to update the "resourceNames" of + # "mutatingwebhookconfigurations" and "validatingwebhookconfigurations" resources. + - name: WEBHOOK_ADMISSION_CONTROLLER_NAME + value: webhook.pipeline.tekton.dev + - name: WEBHOOK_SERVICE_NAME + value: tekton-pipelines-webhook + - name: WEBHOOK_SECRET_NAME + value: webhook-certs + - name: METRICS_DOMAIN + value: tekton.dev/pipeline + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + capabilities: + drop: + - "ALL" + # User 65532 is the distroless nonroot user ID + runAsUser: 65532 + runAsGroup: 65532 + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault + ports: + - name: metrics + containerPort: 9090 + - name: profiling + containerPort: 8008 + # This must match the value of the environment variable WEBHOOK_PORT. + - name: https-webhook + containerPort: 8443 + # This must match the value of the environment variable PROBES_PORT. + - name: probes + containerPort: 8080 + livenessProbe: + httpGet: + path: /health + port: probes + scheme: HTTP + initialDelaySeconds: 5 + periodSeconds: 10 + timeoutSeconds: 5 + readinessProbe: + httpGet: + path: /readiness + port: probes + scheme: HTTP + initialDelaySeconds: 5 + periodSeconds: 10 + timeoutSeconds: 5 +--- +apiVersion: v1 +kind: Service +metadata: + labels: + app.kubernetes.io/name: webhook + app.kubernetes.io/component: webhook + app.kubernetes.io/instance: default + app.kubernetes.io/version: "v1.15.0" + app.kubernetes.io/part-of: tekton-pipelines + # tekton.dev/release value replaced with inputs.params.versionTag in pipeline/tekton/publish.yaml + pipeline.tekton.dev/release: "v1.15.0" + # labels below are related to istio and should not be used for resource lookup + app: tekton-pipelines-webhook + version: "v1.15.0" + name: tekton-pipelines-webhook + namespace: tekton-pipelines +spec: + ports: + # Define metrics and profiling for them to be accessible within service meshes. + - name: http-metrics + port: 9090 + targetPort: metrics + - name: http-profiling + port: 8008 + targetPort: profiling + - name: https-webhook + port: 443 + targetPort: https-webhook + - name: probes + port: 8080 + targetPort: probes + selector: + app.kubernetes.io/name: webhook + app.kubernetes.io/component: webhook + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines diff --git a/packages/manifests/operators/traefik.yaml b/packages/manifests/operators/traefik.yaml new file mode 100644 index 0000000..32a3fe5 --- /dev/null +++ b/packages/manifests/operators/traefik.yaml @@ -0,0 +1,16116 @@ +# Source: traefik/traefik@34.4.1 +--- +# Added by pull-manifests.ts to ensure namespace exists +apiVersion: v1 +kind: Namespace +metadata: + name: traefik + labels: + app.kubernetes.io/name: traefik + +--- +--- +# Source: traefik/crds/gateway-standard-install.yaml +# Copyright 2024 The Kubernetes Authors. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# +# Gateway API Standard channel install +# +--- +# +# config/crd/standard/gateway.networking.k8s.io_gatewayclasses.yaml +# +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328 + gateway.networking.k8s.io/bundle-version: v1.2.1 + gateway.networking.k8s.io/channel: standard + creationTimestamp: null + name: gatewayclasses.gateway.networking.k8s.io +spec: + group: gateway.networking.k8s.io + names: + categories: + - gateway-api + kind: GatewayClass + listKind: GatewayClassList + plural: gatewayclasses + shortNames: + - gc + singular: gatewayclass + scope: Cluster + versions: + - additionalPrinterColumns: + - jsonPath: .spec.controllerName + name: Controller + type: string + - jsonPath: .status.conditions[?(@.type=="Accepted")].status + name: Accepted + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + - jsonPath: .spec.description + name: Description + priority: 1 + type: string + name: v1 + schema: + openAPIV3Schema: + description: |- + GatewayClass describes a class of Gateways available to the user for creating + Gateway resources. + + It is recommended that this resource be used as a template for Gateways. This + means that a Gateway is based on the state of the GatewayClass at the time it + was created and changes to the GatewayClass or associated parameters are not + propagated down to existing Gateways. This recommendation is intended to + limit the blast radius of changes to GatewayClass or associated parameters. + If implementations choose to propagate GatewayClass changes to existing + Gateways, that MUST be clearly documented by the implementation. + + Whenever one or more Gateways are using a GatewayClass, implementations SHOULD + add the `gateway-exists-finalizer.gateway.networking.k8s.io` finalizer on the + associated GatewayClass. This ensures that a GatewayClass associated with a + Gateway is not deleted while in use. + + GatewayClass is a Cluster level resource. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: Spec defines the desired state of GatewayClass. + properties: + controllerName: + description: |- + ControllerName is the name of the controller that is managing Gateways of + this class. The value of this field MUST be a domain prefixed path. + + Example: "example.net/gateway-controller". + + This field is not mutable and cannot be empty. + + Support: Core + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$ + type: string + x-kubernetes-validations: + - message: Value is immutable + rule: self == oldSelf + description: + description: Description helps describe a GatewayClass with more details. + maxLength: 64 + type: string + parametersRef: + description: |- + ParametersRef is a reference to a resource that contains the configuration + parameters corresponding to the GatewayClass. This is optional if the + controller does not require any additional configuration. + + ParametersRef can reference a standard Kubernetes resource, i.e. ConfigMap, + or an implementation-specific custom resource. The resource can be + cluster-scoped or namespace-scoped. + + If the referent cannot be found, refers to an unsupported kind, or when + the data within that resource is malformed, the GatewayClass SHOULD be + rejected with the "Accepted" status condition set to "False" and an + "InvalidParameters" reason. + + A Gateway for this GatewayClass may provide its own `parametersRef`. When both are specified, + the merging behavior is implementation specific. + It is generally recommended that GatewayClass provides defaults that can be overridden by a Gateway. + + Support: Implementation-specific + properties: + group: + description: Group is the group of the referent. + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + description: Kind is kind of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: Name is the name of the referent. + maxLength: 253 + minLength: 1 + type: string + namespace: + description: |- + Namespace is the namespace of the referent. + This field is required when referring to a Namespace-scoped resource and + MUST be unset when referring to a Cluster-scoped resource. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - group + - kind + - name + type: object + required: + - controllerName + type: object + status: + default: + conditions: + - lastTransitionTime: "1970-01-01T00:00:00Z" + message: Waiting for controller + reason: Pending + status: Unknown + type: Accepted + description: |- + Status defines the current state of GatewayClass. + + Implementations MUST populate status on all GatewayClass resources which + specify their controller name. + properties: + conditions: + default: + - lastTransitionTime: "1970-01-01T00:00:00Z" + message: Waiting for controller + reason: Pending + status: Unknown + type: Accepted + description: |- + Conditions is the current status from the controller for + this GatewayClass. + + Controllers should prefer to publish conditions using values + of GatewayClassConditionType for the type of each Condition. + items: + description: Condition contains details for one aspect of the current + state of this API Resource. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + maxItems: 8 + type: array + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + type: object + required: + - spec + type: object + served: true + storage: true + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .spec.controllerName + name: Controller + type: string + - jsonPath: .status.conditions[?(@.type=="Accepted")].status + name: Accepted + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + - jsonPath: .spec.description + name: Description + priority: 1 + type: string + name: v1beta1 + schema: + openAPIV3Schema: + description: |- + GatewayClass describes a class of Gateways available to the user for creating + Gateway resources. + + It is recommended that this resource be used as a template for Gateways. This + means that a Gateway is based on the state of the GatewayClass at the time it + was created and changes to the GatewayClass or associated parameters are not + propagated down to existing Gateways. This recommendation is intended to + limit the blast radius of changes to GatewayClass or associated parameters. + If implementations choose to propagate GatewayClass changes to existing + Gateways, that MUST be clearly documented by the implementation. + + Whenever one or more Gateways are using a GatewayClass, implementations SHOULD + add the `gateway-exists-finalizer.gateway.networking.k8s.io` finalizer on the + associated GatewayClass. This ensures that a GatewayClass associated with a + Gateway is not deleted while in use. + + GatewayClass is a Cluster level resource. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: Spec defines the desired state of GatewayClass. + properties: + controllerName: + description: |- + ControllerName is the name of the controller that is managing Gateways of + this class. The value of this field MUST be a domain prefixed path. + + Example: "example.net/gateway-controller". + + This field is not mutable and cannot be empty. + + Support: Core + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$ + type: string + x-kubernetes-validations: + - message: Value is immutable + rule: self == oldSelf + description: + description: Description helps describe a GatewayClass with more details. + maxLength: 64 + type: string + parametersRef: + description: |- + ParametersRef is a reference to a resource that contains the configuration + parameters corresponding to the GatewayClass. This is optional if the + controller does not require any additional configuration. + + ParametersRef can reference a standard Kubernetes resource, i.e. ConfigMap, + or an implementation-specific custom resource. The resource can be + cluster-scoped or namespace-scoped. + + If the referent cannot be found, refers to an unsupported kind, or when + the data within that resource is malformed, the GatewayClass SHOULD be + rejected with the "Accepted" status condition set to "False" and an + "InvalidParameters" reason. + + A Gateway for this GatewayClass may provide its own `parametersRef`. When both are specified, + the merging behavior is implementation specific. + It is generally recommended that GatewayClass provides defaults that can be overridden by a Gateway. + + Support: Implementation-specific + properties: + group: + description: Group is the group of the referent. + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + description: Kind is kind of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: Name is the name of the referent. + maxLength: 253 + minLength: 1 + type: string + namespace: + description: |- + Namespace is the namespace of the referent. + This field is required when referring to a Namespace-scoped resource and + MUST be unset when referring to a Cluster-scoped resource. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - group + - kind + - name + type: object + required: + - controllerName + type: object + status: + default: + conditions: + - lastTransitionTime: "1970-01-01T00:00:00Z" + message: Waiting for controller + reason: Pending + status: Unknown + type: Accepted + description: |- + Status defines the current state of GatewayClass. + + Implementations MUST populate status on all GatewayClass resources which + specify their controller name. + properties: + conditions: + default: + - lastTransitionTime: "1970-01-01T00:00:00Z" + message: Waiting for controller + reason: Pending + status: Unknown + type: Accepted + description: |- + Conditions is the current status from the controller for + this GatewayClass. + + Controllers should prefer to publish conditions using values + of GatewayClassConditionType for the type of each Condition. + items: + description: Condition contains details for one aspect of the current + state of this API Resource. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + maxItems: 8 + type: array + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + type: object + required: + - spec + type: object + served: true + storage: false + subresources: + status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: null + storedVersions: null +--- +# +# config/crd/standard/gateway.networking.k8s.io_gateways.yaml +# +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328 + gateway.networking.k8s.io/bundle-version: v1.2.1 + gateway.networking.k8s.io/channel: standard + creationTimestamp: null + name: gateways.gateway.networking.k8s.io +spec: + group: gateway.networking.k8s.io + names: + categories: + - gateway-api + kind: Gateway + listKind: GatewayList + plural: gateways + shortNames: + - gtw + singular: gateway + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .spec.gatewayClassName + name: Class + type: string + - jsonPath: .status.addresses[*].value + name: Address + type: string + - jsonPath: .status.conditions[?(@.type=="Programmed")].status + name: Programmed + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1 + schema: + openAPIV3Schema: + description: |- + Gateway represents an instance of a service-traffic handling infrastructure + by binding Listeners to a set of IP addresses. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: Spec defines the desired state of Gateway. + properties: + addresses: + description: |+ + Addresses requested for this Gateway. This is optional and behavior can + depend on the implementation. If a value is set in the spec and the + requested address is invalid or unavailable, the implementation MUST + indicate this in the associated entry in GatewayStatus.Addresses. + + The Addresses field represents a request for the address(es) on the + "outside of the Gateway", that traffic bound for this Gateway will use. + This could be the IP address or hostname of an external load balancer or + other networking infrastructure, or some other address that traffic will + be sent to. + + If no Addresses are specified, the implementation MAY schedule the + Gateway in an implementation-specific manner, assigning an appropriate + set of Addresses. + + The implementation MUST bind all Listeners to every GatewayAddress that + it assigns to the Gateway and add a corresponding entry in + GatewayStatus.Addresses. + + Support: Extended + + items: + description: GatewayAddress describes an address that can be bound + to a Gateway. + oneOf: + - properties: + type: + enum: + - IPAddress + value: + anyOf: + - format: ipv4 + - format: ipv6 + - properties: + type: + not: + enum: + - IPAddress + properties: + type: + default: IPAddress + description: Type of the address. + maxLength: 253 + minLength: 1 + pattern: ^Hostname|IPAddress|NamedAddress|[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$ + type: string + value: + description: |- + Value of the address. The validity of the values will depend + on the type and support by the controller. + + Examples: `1.2.3.4`, `128::1`, `my-ip-address`. + maxLength: 253 + minLength: 1 + type: string + required: + - value + type: object + x-kubernetes-validations: + - message: Hostname value must only contain valid characters (matching + ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$) + rule: 'self.type == ''Hostname'' ? self.value.matches(r"""^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$"""): + true' + maxItems: 16 + type: array + x-kubernetes-validations: + - message: IPAddress values must be unique + rule: 'self.all(a1, a1.type == ''IPAddress'' ? self.exists_one(a2, + a2.type == a1.type && a2.value == a1.value) : true )' + - message: Hostname values must be unique + rule: 'self.all(a1, a1.type == ''Hostname'' ? self.exists_one(a2, + a2.type == a1.type && a2.value == a1.value) : true )' + gatewayClassName: + description: |- + GatewayClassName used for this Gateway. This is the name of a + GatewayClass resource. + maxLength: 253 + minLength: 1 + type: string + infrastructure: + description: |- + Infrastructure defines infrastructure level attributes about this Gateway instance. + + Support: Extended + properties: + annotations: + additionalProperties: + description: |- + AnnotationValue is the value of an annotation in Gateway API. This is used + for validation of maps such as TLS options. This roughly matches Kubernetes + annotation validation, although the length validation in that case is based + on the entire size of the annotations struct. + maxLength: 4096 + minLength: 0 + type: string + description: |- + Annotations that SHOULD be applied to any resources created in response to this Gateway. + + For implementations creating other Kubernetes objects, this should be the `metadata.annotations` field on resources. + For other implementations, this refers to any relevant (implementation specific) "annotations" concepts. + + An implementation may chose to add additional implementation-specific annotations as they see fit. + + Support: Extended + maxProperties: 8 + type: object + x-kubernetes-validations: + - message: Annotation keys must be in the form of an optional + DNS subdomain prefix followed by a required name segment of + up to 63 characters. + rule: self.all(key, key.matches(r"""^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?([A-Za-z0-9][-A-Za-z0-9_.]{0,61})?[A-Za-z0-9]$""")) + - message: If specified, the annotation key's prefix must be a + DNS subdomain not longer than 253 characters in total. + rule: self.all(key, key.split("/")[0].size() < 253) + labels: + additionalProperties: + description: |- + LabelValue is the value of a label in the Gateway API. This is used for validation + of maps such as Gateway infrastructure labels. This matches the Kubernetes + label validation rules: + * must be 63 characters or less (can be empty), + * unless empty, must begin and end with an alphanumeric character ([a-z0-9A-Z]), + * could contain dashes (-), underscores (_), dots (.), and alphanumerics between. + + Valid values include: + + * MyValue + * my.name + * 123-my-value + maxLength: 63 + minLength: 0 + pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$ + type: string + description: |- + Labels that SHOULD be applied to any resources created in response to this Gateway. + + For implementations creating other Kubernetes objects, this should be the `metadata.labels` field on resources. + For other implementations, this refers to any relevant (implementation specific) "labels" concepts. + + An implementation may chose to add additional implementation-specific labels as they see fit. + + If an implementation maps these labels to Pods, or any other resource that would need to be recreated when labels + change, it SHOULD clearly warn about this behavior in documentation. + + Support: Extended + maxProperties: 8 + type: object + x-kubernetes-validations: + - message: Label keys must be in the form of an optional DNS subdomain + prefix followed by a required name segment of up to 63 characters. + rule: self.all(key, key.matches(r"""^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?([A-Za-z0-9][-A-Za-z0-9_.]{0,61})?[A-Za-z0-9]$""")) + - message: If specified, the label key's prefix must be a DNS + subdomain not longer than 253 characters in total. + rule: self.all(key, key.split("/")[0].size() < 253) + parametersRef: + description: |- + ParametersRef is a reference to a resource that contains the configuration + parameters corresponding to the Gateway. This is optional if the + controller does not require any additional configuration. + + This follows the same semantics as GatewayClass's `parametersRef`, but on a per-Gateway basis + + The Gateway's GatewayClass may provide its own `parametersRef`. When both are specified, + the merging behavior is implementation specific. + It is generally recommended that GatewayClass provides defaults that can be overridden by a Gateway. + + Support: Implementation-specific + properties: + group: + description: Group is the group of the referent. + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + description: Kind is kind of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: Name is the name of the referent. + maxLength: 253 + minLength: 1 + type: string + required: + - group + - kind + - name + type: object + type: object + listeners: + description: |- + Listeners associated with this Gateway. Listeners define + logical endpoints that are bound on this Gateway's addresses. + At least one Listener MUST be specified. + + Each Listener in a set of Listeners (for example, in a single Gateway) + MUST be _distinct_, in that a traffic flow MUST be able to be assigned to + exactly one listener. (This section uses "set of Listeners" rather than + "Listeners in a single Gateway" because implementations MAY merge configuration + from multiple Gateways onto a single data plane, and these rules _also_ + apply in that case). + + Practically, this means that each listener in a set MUST have a unique + combination of Port, Protocol, and, if supported by the protocol, Hostname. + + Some combinations of port, protocol, and TLS settings are considered + Core support and MUST be supported by implementations based on their + targeted conformance profile: + + HTTP Profile + + 1. HTTPRoute, Port: 80, Protocol: HTTP + 2. HTTPRoute, Port: 443, Protocol: HTTPS, TLS Mode: Terminate, TLS keypair provided + + TLS Profile + + 1. TLSRoute, Port: 443, Protocol: TLS, TLS Mode: Passthrough + + "Distinct" Listeners have the following property: + + The implementation can match inbound requests to a single distinct + Listener. When multiple Listeners share values for fields (for + example, two Listeners with the same Port value), the implementation + can match requests to only one of the Listeners using other + Listener fields. + + For example, the following Listener scenarios are distinct: + + 1. Multiple Listeners with the same Port that all use the "HTTP" + Protocol that all have unique Hostname values. + 2. Multiple Listeners with the same Port that use either the "HTTPS" or + "TLS" Protocol that all have unique Hostname values. + 3. A mixture of "TCP" and "UDP" Protocol Listeners, where no Listener + with the same Protocol has the same Port value. + + Some fields in the Listener struct have possible values that affect + whether the Listener is distinct. Hostname is particularly relevant + for HTTP or HTTPS protocols. + + When using the Hostname value to select between same-Port, same-Protocol + Listeners, the Hostname value must be different on each Listener for the + Listener to be distinct. + + When the Listeners are distinct based on Hostname, inbound request + hostnames MUST match from the most specific to least specific Hostname + values to choose the correct Listener and its associated set of Routes. + + Exact matches must be processed before wildcard matches, and wildcard + matches must be processed before fallback (empty Hostname value) + matches. For example, `"foo.example.com"` takes precedence over + `"*.example.com"`, and `"*.example.com"` takes precedence over `""`. + + Additionally, if there are multiple wildcard entries, more specific + wildcard entries must be processed before less specific wildcard entries. + For example, `"*.foo.example.com"` takes precedence over `"*.example.com"`. + The precise definition here is that the higher the number of dots in the + hostname to the right of the wildcard character, the higher the precedence. + + The wildcard character will match any number of characters _and dots_ to + the left, however, so `"*.example.com"` will match both + `"foo.bar.example.com"` _and_ `"bar.example.com"`. + + If a set of Listeners contains Listeners that are not distinct, then those + Listeners are Conflicted, and the implementation MUST set the "Conflicted" + condition in the Listener Status to "True". + + Implementations MAY choose to accept a Gateway with some Conflicted + Listeners only if they only accept the partial Listener set that contains + no Conflicted Listeners. To put this another way, implementations may + accept a partial Listener set only if they throw out *all* the conflicting + Listeners. No picking one of the conflicting listeners as the winner. + This also means that the Gateway must have at least one non-conflicting + Listener in this case, otherwise it violates the requirement that at + least one Listener must be present. + + The implementation MUST set a "ListenersNotValid" condition on the + Gateway Status when the Gateway contains Conflicted Listeners whether or + not they accept the Gateway. That Condition SHOULD clearly + indicate in the Message which Listeners are conflicted, and which are + Accepted. Additionally, the Listener status for those listeners SHOULD + indicate which Listeners are conflicted and not Accepted. + + A Gateway's Listeners are considered "compatible" if: + + 1. They are distinct. + 2. The implementation can serve them in compliance with the Addresses + requirement that all Listeners are available on all assigned + addresses. + + Compatible combinations in Extended support are expected to vary across + implementations. A combination that is compatible for one implementation + may not be compatible for another. + + For example, an implementation that cannot serve both TCP and UDP listeners + on the same address, or cannot mix HTTPS and generic TLS listens on the same port + would not consider those cases compatible, even though they are distinct. + + Note that requests SHOULD match at most one Listener. For example, if + Listeners are defined for "foo.example.com" and "*.example.com", a + request to "foo.example.com" SHOULD only be routed using routes attached + to the "foo.example.com" Listener (and not the "*.example.com" Listener). + This concept is known as "Listener Isolation". Implementations that do + not support Listener Isolation MUST clearly document this. + + Implementations MAY merge separate Gateways onto a single set of + Addresses if all Listeners across all Gateways are compatible. + + Support: Core + items: + description: |- + Listener embodies the concept of a logical endpoint where a Gateway accepts + network connections. + properties: + allowedRoutes: + default: + namespaces: + from: Same + description: |- + AllowedRoutes defines the types of routes that MAY be attached to a + Listener and the trusted namespaces where those Route resources MAY be + present. + + Although a client request may match multiple route rules, only one rule + may ultimately receive the request. Matching precedence MUST be + determined in order of the following criteria: + + * The most specific match as defined by the Route type. + * The oldest Route based on creation timestamp. For example, a Route with + a creation timestamp of "2020-09-08 01:02:03" is given precedence over + a Route with a creation timestamp of "2020-09-08 01:02:04". + * If everything else is equivalent, the Route appearing first in + alphabetical order (namespace/name) should be given precedence. For + example, foo/bar is given precedence over foo/baz. + + All valid rules within a Route attached to this Listener should be + implemented. Invalid Route rules can be ignored (sometimes that will mean + the full Route). If a Route rule transitions from valid to invalid, + support for that Route rule should be dropped to ensure consistency. For + example, even if a filter specified by a Route rule is invalid, the rest + of the rules within that Route should still be supported. + + Support: Core + properties: + kinds: + description: |- + Kinds specifies the groups and kinds of Routes that are allowed to bind + to this Gateway Listener. When unspecified or empty, the kinds of Routes + selected are determined using the Listener protocol. + + A RouteGroupKind MUST correspond to kinds of Routes that are compatible + with the application protocol specified in the Listener's Protocol field. + If an implementation does not support or recognize this resource type, it + MUST set the "ResolvedRefs" condition to False for this Listener with the + "InvalidRouteKinds" reason. + + Support: Core + items: + description: RouteGroupKind indicates the group and kind + of a Route resource. + properties: + group: + default: gateway.networking.k8s.io + description: Group is the group of the Route. + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + description: Kind is the kind of the Route. + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + required: + - kind + type: object + maxItems: 8 + type: array + namespaces: + default: + from: Same + description: |- + Namespaces indicates namespaces from which Routes may be attached to this + Listener. This is restricted to the namespace of this Gateway by default. + + Support: Core + properties: + from: + default: Same + description: |- + From indicates where Routes will be selected for this Gateway. Possible + values are: + + * All: Routes in all namespaces may be used by this Gateway. + * Selector: Routes in namespaces selected by the selector may be used by + this Gateway. + * Same: Only Routes in the same namespace may be used by this Gateway. + + Support: Core + enum: + - All + - Selector + - Same + type: string + selector: + description: |- + Selector must be specified when From is set to "Selector". In that case, + only Routes in Namespaces matching this Selector will be selected by this + Gateway. This field is ignored for other values of "From". + + Support: Core + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the + selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: object + type: object + hostname: + description: |- + Hostname specifies the virtual hostname to match for protocol types that + define this concept. When unspecified, all hostnames are matched. This + field is ignored for protocols that don't require hostname based + matching. + + Implementations MUST apply Hostname matching appropriately for each of + the following protocols: + + * TLS: The Listener Hostname MUST match the SNI. + * HTTP: The Listener Hostname MUST match the Host header of the request. + * HTTPS: The Listener Hostname SHOULD match at both the TLS and HTTP + protocol layers as described above. If an implementation does not + ensure that both the SNI and Host header match the Listener hostname, + it MUST clearly document that. + + For HTTPRoute and TLSRoute resources, there is an interaction with the + `spec.hostnames` array. When both listener and route specify hostnames, + there MUST be an intersection between the values for a Route to be + accepted. For more information, refer to the Route specific Hostnames + documentation. + + Hostnames that are prefixed with a wildcard label (`*.`) are interpreted + as a suffix match. That means that a match for `*.example.com` would match + both `test.example.com`, and `foo.test.example.com`, but not `example.com`. + + Support: Core + maxLength: 253 + minLength: 1 + pattern: ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + name: + description: |- + Name is the name of the Listener. This name MUST be unique within a + Gateway. + + Support: Core + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + port: + description: |- + Port is the network port. Multiple listeners may use the + same port, subject to the Listener compatibility rules. + + Support: Core + format: int32 + maximum: 65535 + minimum: 1 + type: integer + protocol: + description: |- + Protocol specifies the network protocol this listener expects to receive. + + Support: Core + maxLength: 255 + minLength: 1 + pattern: ^[a-zA-Z0-9]([-a-zA-Z0-9]*[a-zA-Z0-9])?$|[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9]+$ + type: string + tls: + description: |- + TLS is the TLS configuration for the Listener. This field is required if + the Protocol field is "HTTPS" or "TLS". It is invalid to set this field + if the Protocol field is "HTTP", "TCP", or "UDP". + + The association of SNIs to Certificate defined in GatewayTLSConfig is + defined based on the Hostname field for this listener. + + The GatewayClass MUST use the longest matching SNI out of all + available certificates for any TLS handshake. + + Support: Core + properties: + certificateRefs: + description: |- + CertificateRefs contains a series of references to Kubernetes objects that + contains TLS certificates and private keys. These certificates are used to + establish a TLS handshake for requests that match the hostname of the + associated listener. + + A single CertificateRef to a Kubernetes Secret has "Core" support. + Implementations MAY choose to support attaching multiple certificates to + a Listener, but this behavior is implementation-specific. + + References to a resource in different namespace are invalid UNLESS there + is a ReferenceGrant in the target namespace that allows the certificate + to be attached. If a ReferenceGrant does not allow this reference, the + "ResolvedRefs" condition MUST be set to False for this listener with the + "RefNotPermitted" reason. + + This field is required to have at least one element when the mode is set + to "Terminate" (default) and is optional otherwise. + + CertificateRefs can reference to standard Kubernetes resources, i.e. + Secret, or implementation-specific custom resources. + + Support: Core - A single reference to a Kubernetes Secret of type kubernetes.io/tls + + Support: Implementation-specific (More than one reference or other resource types) + items: + description: |- + SecretObjectReference identifies an API object including its namespace, + defaulting to Secret. + + The API object must be valid in the cluster; the Group and Kind must + be registered in the cluster for this reference to be valid. + + References to objects with invalid Group and Kind are not valid, and must + be rejected by the implementation, with appropriate Conditions set + on the containing object. + properties: + group: + default: "" + description: |- + Group is the group of the referent. For example, "gateway.networking.k8s.io". + When unspecified or empty string, core API group is inferred. + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + default: Secret + description: Kind is kind of the referent. For example + "Secret". + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: Name is the name of the referent. + maxLength: 253 + minLength: 1 + type: string + namespace: + description: |- + Namespace is the namespace of the referenced object. When unspecified, the local + namespace is inferred. + + Note that when a namespace different than the local namespace is specified, + a ReferenceGrant object is required in the referent namespace to allow that + namespace's owner to accept the reference. See the ReferenceGrant + documentation for details. + + Support: Core + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - name + type: object + maxItems: 64 + type: array + mode: + default: Terminate + description: |- + Mode defines the TLS behavior for the TLS session initiated by the client. + There are two possible modes: + + - Terminate: The TLS session between the downstream client and the + Gateway is terminated at the Gateway. This mode requires certificates + to be specified in some way, such as populating the certificateRefs + field. + - Passthrough: The TLS session is NOT terminated by the Gateway. This + implies that the Gateway can't decipher the TLS stream except for + the ClientHello message of the TLS protocol. The certificateRefs field + is ignored in this mode. + + Support: Core + enum: + - Terminate + - Passthrough + type: string + options: + additionalProperties: + description: |- + AnnotationValue is the value of an annotation in Gateway API. This is used + for validation of maps such as TLS options. This roughly matches Kubernetes + annotation validation, although the length validation in that case is based + on the entire size of the annotations struct. + maxLength: 4096 + minLength: 0 + type: string + description: |- + Options are a list of key/value pairs to enable extended TLS + configuration for each implementation. For example, configuring the + minimum TLS version or supported cipher suites. + + A set of common keys MAY be defined by the API in the future. To avoid + any ambiguity, implementation-specific definitions MUST use + domain-prefixed names, such as `example.com/my-custom-option`. + Un-prefixed names are reserved for key names defined by Gateway API. + + Support: Implementation-specific + maxProperties: 16 + type: object + type: object + x-kubernetes-validations: + - message: certificateRefs or options must be specified when + mode is Terminate + rule: 'self.mode == ''Terminate'' ? size(self.certificateRefs) + > 0 || size(self.options) > 0 : true' + required: + - name + - port + - protocol + type: object + maxItems: 64 + minItems: 1 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + x-kubernetes-validations: + - message: tls must not be specified for protocols ['HTTP', 'TCP', + 'UDP'] + rule: 'self.all(l, l.protocol in [''HTTP'', ''TCP'', ''UDP''] ? + !has(l.tls) : true)' + - message: tls mode must be Terminate for protocol HTTPS + rule: 'self.all(l, (l.protocol == ''HTTPS'' && has(l.tls)) ? (l.tls.mode + == '''' || l.tls.mode == ''Terminate'') : true)' + - message: hostname must not be specified for protocols ['TCP', 'UDP'] + rule: 'self.all(l, l.protocol in [''TCP'', ''UDP''] ? (!has(l.hostname) + || l.hostname == '''') : true)' + - message: Listener name must be unique within the Gateway + rule: self.all(l1, self.exists_one(l2, l1.name == l2.name)) + - message: Combination of port, protocol and hostname must be unique + for each listener + rule: 'self.all(l1, self.exists_one(l2, l1.port == l2.port && l1.protocol + == l2.protocol && (has(l1.hostname) && has(l2.hostname) ? l1.hostname + == l2.hostname : !has(l1.hostname) && !has(l2.hostname))))' + required: + - gatewayClassName + - listeners + type: object + status: + default: + conditions: + - lastTransitionTime: "1970-01-01T00:00:00Z" + message: Waiting for controller + reason: Pending + status: Unknown + type: Accepted + - lastTransitionTime: "1970-01-01T00:00:00Z" + message: Waiting for controller + reason: Pending + status: Unknown + type: Programmed + description: Status defines the current state of Gateway. + properties: + addresses: + description: |+ + Addresses lists the network addresses that have been bound to the + Gateway. + + This list may differ from the addresses provided in the spec under some + conditions: + + * no addresses are specified, all addresses are dynamically assigned + * a combination of specified and dynamic addresses are assigned + * a specified address was unusable (e.g. already in use) + + items: + description: GatewayStatusAddress describes a network address that + is bound to a Gateway. + oneOf: + - properties: + type: + enum: + - IPAddress + value: + anyOf: + - format: ipv4 + - format: ipv6 + - properties: + type: + not: + enum: + - IPAddress + properties: + type: + default: IPAddress + description: Type of the address. + maxLength: 253 + minLength: 1 + pattern: ^Hostname|IPAddress|NamedAddress|[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$ + type: string + value: + description: |- + Value of the address. The validity of the values will depend + on the type and support by the controller. + + Examples: `1.2.3.4`, `128::1`, `my-ip-address`. + maxLength: 253 + minLength: 1 + type: string + required: + - value + type: object + x-kubernetes-validations: + - message: Hostname value must only contain valid characters (matching + ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$) + rule: 'self.type == ''Hostname'' ? self.value.matches(r"""^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$"""): + true' + maxItems: 16 + type: array + conditions: + default: + - lastTransitionTime: "1970-01-01T00:00:00Z" + message: Waiting for controller + reason: Pending + status: Unknown + type: Accepted + - lastTransitionTime: "1970-01-01T00:00:00Z" + message: Waiting for controller + reason: Pending + status: Unknown + type: Programmed + description: |- + Conditions describe the current conditions of the Gateway. + + Implementations should prefer to express Gateway conditions + using the `GatewayConditionType` and `GatewayConditionReason` + constants so that operators and tools can converge on a common + vocabulary to describe Gateway state. + + Known condition types are: + + * "Accepted" + * "Programmed" + * "Ready" + items: + description: Condition contains details for one aspect of the current + state of this API Resource. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + maxItems: 8 + type: array + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + listeners: + description: Listeners provide status for each unique listener port + defined in the Spec. + items: + description: ListenerStatus is the status associated with a Listener. + properties: + attachedRoutes: + description: |- + AttachedRoutes represents the total number of Routes that have been + successfully attached to this Listener. + + Successful attachment of a Route to a Listener is based solely on the + combination of the AllowedRoutes field on the corresponding Listener + and the Route's ParentRefs field. A Route is successfully attached to + a Listener when it is selected by the Listener's AllowedRoutes field + AND the Route has a valid ParentRef selecting the whole Gateway + resource or a specific Listener as a parent resource (more detail on + attachment semantics can be found in the documentation on the various + Route kinds ParentRefs fields). Listener or Route status does not impact + successful attachment, i.e. the AttachedRoutes field count MUST be set + for Listeners with condition Accepted: false and MUST count successfully + attached Routes that may themselves have Accepted: false conditions. + + Uses for this field include troubleshooting Route attachment and + measuring blast radius/impact of changes to a Listener. + format: int32 + type: integer + conditions: + description: Conditions describe the current condition of this + listener. + items: + description: Condition contains details for one aspect of + the current state of this API Resource. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, + Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + maxItems: 8 + type: array + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + name: + description: Name is the name of the Listener that this status + corresponds to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + supportedKinds: + description: |- + SupportedKinds is the list indicating the Kinds supported by this + listener. This MUST represent the kinds an implementation supports for + that Listener configuration. + + If kinds are specified in Spec that are not supported, they MUST NOT + appear in this list and an implementation MUST set the "ResolvedRefs" + condition to "False" with the "InvalidRouteKinds" reason. If both valid + and invalid Route kinds are specified, the implementation MUST + reference the valid Route kinds that have been specified. + items: + description: RouteGroupKind indicates the group and kind of + a Route resource. + properties: + group: + default: gateway.networking.k8s.io + description: Group is the group of the Route. + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + description: Kind is the kind of the Route. + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + required: + - kind + type: object + maxItems: 8 + type: array + required: + - attachedRoutes + - conditions + - name + - supportedKinds + type: object + maxItems: 64 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + type: object + required: + - spec + type: object + served: true + storage: true + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .spec.gatewayClassName + name: Class + type: string + - jsonPath: .status.addresses[*].value + name: Address + type: string + - jsonPath: .status.conditions[?(@.type=="Programmed")].status + name: Programmed + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1beta1 + schema: + openAPIV3Schema: + description: |- + Gateway represents an instance of a service-traffic handling infrastructure + by binding Listeners to a set of IP addresses. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: Spec defines the desired state of Gateway. + properties: + addresses: + description: |+ + Addresses requested for this Gateway. This is optional and behavior can + depend on the implementation. If a value is set in the spec and the + requested address is invalid or unavailable, the implementation MUST + indicate this in the associated entry in GatewayStatus.Addresses. + + The Addresses field represents a request for the address(es) on the + "outside of the Gateway", that traffic bound for this Gateway will use. + This could be the IP address or hostname of an external load balancer or + other networking infrastructure, or some other address that traffic will + be sent to. + + If no Addresses are specified, the implementation MAY schedule the + Gateway in an implementation-specific manner, assigning an appropriate + set of Addresses. + + The implementation MUST bind all Listeners to every GatewayAddress that + it assigns to the Gateway and add a corresponding entry in + GatewayStatus.Addresses. + + Support: Extended + + items: + description: GatewayAddress describes an address that can be bound + to a Gateway. + oneOf: + - properties: + type: + enum: + - IPAddress + value: + anyOf: + - format: ipv4 + - format: ipv6 + - properties: + type: + not: + enum: + - IPAddress + properties: + type: + default: IPAddress + description: Type of the address. + maxLength: 253 + minLength: 1 + pattern: ^Hostname|IPAddress|NamedAddress|[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$ + type: string + value: + description: |- + Value of the address. The validity of the values will depend + on the type and support by the controller. + + Examples: `1.2.3.4`, `128::1`, `my-ip-address`. + maxLength: 253 + minLength: 1 + type: string + required: + - value + type: object + x-kubernetes-validations: + - message: Hostname value must only contain valid characters (matching + ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$) + rule: 'self.type == ''Hostname'' ? self.value.matches(r"""^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$"""): + true' + maxItems: 16 + type: array + x-kubernetes-validations: + - message: IPAddress values must be unique + rule: 'self.all(a1, a1.type == ''IPAddress'' ? self.exists_one(a2, + a2.type == a1.type && a2.value == a1.value) : true )' + - message: Hostname values must be unique + rule: 'self.all(a1, a1.type == ''Hostname'' ? self.exists_one(a2, + a2.type == a1.type && a2.value == a1.value) : true )' + gatewayClassName: + description: |- + GatewayClassName used for this Gateway. This is the name of a + GatewayClass resource. + maxLength: 253 + minLength: 1 + type: string + infrastructure: + description: |- + Infrastructure defines infrastructure level attributes about this Gateway instance. + + Support: Extended + properties: + annotations: + additionalProperties: + description: |- + AnnotationValue is the value of an annotation in Gateway API. This is used + for validation of maps such as TLS options. This roughly matches Kubernetes + annotation validation, although the length validation in that case is based + on the entire size of the annotations struct. + maxLength: 4096 + minLength: 0 + type: string + description: |- + Annotations that SHOULD be applied to any resources created in response to this Gateway. + + For implementations creating other Kubernetes objects, this should be the `metadata.annotations` field on resources. + For other implementations, this refers to any relevant (implementation specific) "annotations" concepts. + + An implementation may chose to add additional implementation-specific annotations as they see fit. + + Support: Extended + maxProperties: 8 + type: object + x-kubernetes-validations: + - message: Annotation keys must be in the form of an optional + DNS subdomain prefix followed by a required name segment of + up to 63 characters. + rule: self.all(key, key.matches(r"""^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?([A-Za-z0-9][-A-Za-z0-9_.]{0,61})?[A-Za-z0-9]$""")) + - message: If specified, the annotation key's prefix must be a + DNS subdomain not longer than 253 characters in total. + rule: self.all(key, key.split("/")[0].size() < 253) + labels: + additionalProperties: + description: |- + LabelValue is the value of a label in the Gateway API. This is used for validation + of maps such as Gateway infrastructure labels. This matches the Kubernetes + label validation rules: + * must be 63 characters or less (can be empty), + * unless empty, must begin and end with an alphanumeric character ([a-z0-9A-Z]), + * could contain dashes (-), underscores (_), dots (.), and alphanumerics between. + + Valid values include: + + * MyValue + * my.name + * 123-my-value + maxLength: 63 + minLength: 0 + pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$ + type: string + description: |- + Labels that SHOULD be applied to any resources created in response to this Gateway. + + For implementations creating other Kubernetes objects, this should be the `metadata.labels` field on resources. + For other implementations, this refers to any relevant (implementation specific) "labels" concepts. + + An implementation may chose to add additional implementation-specific labels as they see fit. + + If an implementation maps these labels to Pods, or any other resource that would need to be recreated when labels + change, it SHOULD clearly warn about this behavior in documentation. + + Support: Extended + maxProperties: 8 + type: object + x-kubernetes-validations: + - message: Label keys must be in the form of an optional DNS subdomain + prefix followed by a required name segment of up to 63 characters. + rule: self.all(key, key.matches(r"""^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?([A-Za-z0-9][-A-Za-z0-9_.]{0,61})?[A-Za-z0-9]$""")) + - message: If specified, the label key's prefix must be a DNS + subdomain not longer than 253 characters in total. + rule: self.all(key, key.split("/")[0].size() < 253) + parametersRef: + description: |- + ParametersRef is a reference to a resource that contains the configuration + parameters corresponding to the Gateway. This is optional if the + controller does not require any additional configuration. + + This follows the same semantics as GatewayClass's `parametersRef`, but on a per-Gateway basis + + The Gateway's GatewayClass may provide its own `parametersRef`. When both are specified, + the merging behavior is implementation specific. + It is generally recommended that GatewayClass provides defaults that can be overridden by a Gateway. + + Support: Implementation-specific + properties: + group: + description: Group is the group of the referent. + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + description: Kind is kind of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: Name is the name of the referent. + maxLength: 253 + minLength: 1 + type: string + required: + - group + - kind + - name + type: object + type: object + listeners: + description: |- + Listeners associated with this Gateway. Listeners define + logical endpoints that are bound on this Gateway's addresses. + At least one Listener MUST be specified. + + Each Listener in a set of Listeners (for example, in a single Gateway) + MUST be _distinct_, in that a traffic flow MUST be able to be assigned to + exactly one listener. (This section uses "set of Listeners" rather than + "Listeners in a single Gateway" because implementations MAY merge configuration + from multiple Gateways onto a single data plane, and these rules _also_ + apply in that case). + + Practically, this means that each listener in a set MUST have a unique + combination of Port, Protocol, and, if supported by the protocol, Hostname. + + Some combinations of port, protocol, and TLS settings are considered + Core support and MUST be supported by implementations based on their + targeted conformance profile: + + HTTP Profile + + 1. HTTPRoute, Port: 80, Protocol: HTTP + 2. HTTPRoute, Port: 443, Protocol: HTTPS, TLS Mode: Terminate, TLS keypair provided + + TLS Profile + + 1. TLSRoute, Port: 443, Protocol: TLS, TLS Mode: Passthrough + + "Distinct" Listeners have the following property: + + The implementation can match inbound requests to a single distinct + Listener. When multiple Listeners share values for fields (for + example, two Listeners with the same Port value), the implementation + can match requests to only one of the Listeners using other + Listener fields. + + For example, the following Listener scenarios are distinct: + + 1. Multiple Listeners with the same Port that all use the "HTTP" + Protocol that all have unique Hostname values. + 2. Multiple Listeners with the same Port that use either the "HTTPS" or + "TLS" Protocol that all have unique Hostname values. + 3. A mixture of "TCP" and "UDP" Protocol Listeners, where no Listener + with the same Protocol has the same Port value. + + Some fields in the Listener struct have possible values that affect + whether the Listener is distinct. Hostname is particularly relevant + for HTTP or HTTPS protocols. + + When using the Hostname value to select between same-Port, same-Protocol + Listeners, the Hostname value must be different on each Listener for the + Listener to be distinct. + + When the Listeners are distinct based on Hostname, inbound request + hostnames MUST match from the most specific to least specific Hostname + values to choose the correct Listener and its associated set of Routes. + + Exact matches must be processed before wildcard matches, and wildcard + matches must be processed before fallback (empty Hostname value) + matches. For example, `"foo.example.com"` takes precedence over + `"*.example.com"`, and `"*.example.com"` takes precedence over `""`. + + Additionally, if there are multiple wildcard entries, more specific + wildcard entries must be processed before less specific wildcard entries. + For example, `"*.foo.example.com"` takes precedence over `"*.example.com"`. + The precise definition here is that the higher the number of dots in the + hostname to the right of the wildcard character, the higher the precedence. + + The wildcard character will match any number of characters _and dots_ to + the left, however, so `"*.example.com"` will match both + `"foo.bar.example.com"` _and_ `"bar.example.com"`. + + If a set of Listeners contains Listeners that are not distinct, then those + Listeners are Conflicted, and the implementation MUST set the "Conflicted" + condition in the Listener Status to "True". + + Implementations MAY choose to accept a Gateway with some Conflicted + Listeners only if they only accept the partial Listener set that contains + no Conflicted Listeners. To put this another way, implementations may + accept a partial Listener set only if they throw out *all* the conflicting + Listeners. No picking one of the conflicting listeners as the winner. + This also means that the Gateway must have at least one non-conflicting + Listener in this case, otherwise it violates the requirement that at + least one Listener must be present. + + The implementation MUST set a "ListenersNotValid" condition on the + Gateway Status when the Gateway contains Conflicted Listeners whether or + not they accept the Gateway. That Condition SHOULD clearly + indicate in the Message which Listeners are conflicted, and which are + Accepted. Additionally, the Listener status for those listeners SHOULD + indicate which Listeners are conflicted and not Accepted. + + A Gateway's Listeners are considered "compatible" if: + + 1. They are distinct. + 2. The implementation can serve them in compliance with the Addresses + requirement that all Listeners are available on all assigned + addresses. + + Compatible combinations in Extended support are expected to vary across + implementations. A combination that is compatible for one implementation + may not be compatible for another. + + For example, an implementation that cannot serve both TCP and UDP listeners + on the same address, or cannot mix HTTPS and generic TLS listens on the same port + would not consider those cases compatible, even though they are distinct. + + Note that requests SHOULD match at most one Listener. For example, if + Listeners are defined for "foo.example.com" and "*.example.com", a + request to "foo.example.com" SHOULD only be routed using routes attached + to the "foo.example.com" Listener (and not the "*.example.com" Listener). + This concept is known as "Listener Isolation". Implementations that do + not support Listener Isolation MUST clearly document this. + + Implementations MAY merge separate Gateways onto a single set of + Addresses if all Listeners across all Gateways are compatible. + + Support: Core + items: + description: |- + Listener embodies the concept of a logical endpoint where a Gateway accepts + network connections. + properties: + allowedRoutes: + default: + namespaces: + from: Same + description: |- + AllowedRoutes defines the types of routes that MAY be attached to a + Listener and the trusted namespaces where those Route resources MAY be + present. + + Although a client request may match multiple route rules, only one rule + may ultimately receive the request. Matching precedence MUST be + determined in order of the following criteria: + + * The most specific match as defined by the Route type. + * The oldest Route based on creation timestamp. For example, a Route with + a creation timestamp of "2020-09-08 01:02:03" is given precedence over + a Route with a creation timestamp of "2020-09-08 01:02:04". + * If everything else is equivalent, the Route appearing first in + alphabetical order (namespace/name) should be given precedence. For + example, foo/bar is given precedence over foo/baz. + + All valid rules within a Route attached to this Listener should be + implemented. Invalid Route rules can be ignored (sometimes that will mean + the full Route). If a Route rule transitions from valid to invalid, + support for that Route rule should be dropped to ensure consistency. For + example, even if a filter specified by a Route rule is invalid, the rest + of the rules within that Route should still be supported. + + Support: Core + properties: + kinds: + description: |- + Kinds specifies the groups and kinds of Routes that are allowed to bind + to this Gateway Listener. When unspecified or empty, the kinds of Routes + selected are determined using the Listener protocol. + + A RouteGroupKind MUST correspond to kinds of Routes that are compatible + with the application protocol specified in the Listener's Protocol field. + If an implementation does not support or recognize this resource type, it + MUST set the "ResolvedRefs" condition to False for this Listener with the + "InvalidRouteKinds" reason. + + Support: Core + items: + description: RouteGroupKind indicates the group and kind + of a Route resource. + properties: + group: + default: gateway.networking.k8s.io + description: Group is the group of the Route. + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + description: Kind is the kind of the Route. + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + required: + - kind + type: object + maxItems: 8 + type: array + namespaces: + default: + from: Same + description: |- + Namespaces indicates namespaces from which Routes may be attached to this + Listener. This is restricted to the namespace of this Gateway by default. + + Support: Core + properties: + from: + default: Same + description: |- + From indicates where Routes will be selected for this Gateway. Possible + values are: + + * All: Routes in all namespaces may be used by this Gateway. + * Selector: Routes in namespaces selected by the selector may be used by + this Gateway. + * Same: Only Routes in the same namespace may be used by this Gateway. + + Support: Core + enum: + - All + - Selector + - Same + type: string + selector: + description: |- + Selector must be specified when From is set to "Selector". In that case, + only Routes in Namespaces matching this Selector will be selected by this + Gateway. This field is ignored for other values of "From". + + Support: Core + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the + selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: object + type: object + hostname: + description: |- + Hostname specifies the virtual hostname to match for protocol types that + define this concept. When unspecified, all hostnames are matched. This + field is ignored for protocols that don't require hostname based + matching. + + Implementations MUST apply Hostname matching appropriately for each of + the following protocols: + + * TLS: The Listener Hostname MUST match the SNI. + * HTTP: The Listener Hostname MUST match the Host header of the request. + * HTTPS: The Listener Hostname SHOULD match at both the TLS and HTTP + protocol layers as described above. If an implementation does not + ensure that both the SNI and Host header match the Listener hostname, + it MUST clearly document that. + + For HTTPRoute and TLSRoute resources, there is an interaction with the + `spec.hostnames` array. When both listener and route specify hostnames, + there MUST be an intersection between the values for a Route to be + accepted. For more information, refer to the Route specific Hostnames + documentation. + + Hostnames that are prefixed with a wildcard label (`*.`) are interpreted + as a suffix match. That means that a match for `*.example.com` would match + both `test.example.com`, and `foo.test.example.com`, but not `example.com`. + + Support: Core + maxLength: 253 + minLength: 1 + pattern: ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + name: + description: |- + Name is the name of the Listener. This name MUST be unique within a + Gateway. + + Support: Core + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + port: + description: |- + Port is the network port. Multiple listeners may use the + same port, subject to the Listener compatibility rules. + + Support: Core + format: int32 + maximum: 65535 + minimum: 1 + type: integer + protocol: + description: |- + Protocol specifies the network protocol this listener expects to receive. + + Support: Core + maxLength: 255 + minLength: 1 + pattern: ^[a-zA-Z0-9]([-a-zA-Z0-9]*[a-zA-Z0-9])?$|[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9]+$ + type: string + tls: + description: |- + TLS is the TLS configuration for the Listener. This field is required if + the Protocol field is "HTTPS" or "TLS". It is invalid to set this field + if the Protocol field is "HTTP", "TCP", or "UDP". + + The association of SNIs to Certificate defined in GatewayTLSConfig is + defined based on the Hostname field for this listener. + + The GatewayClass MUST use the longest matching SNI out of all + available certificates for any TLS handshake. + + Support: Core + properties: + certificateRefs: + description: |- + CertificateRefs contains a series of references to Kubernetes objects that + contains TLS certificates and private keys. These certificates are used to + establish a TLS handshake for requests that match the hostname of the + associated listener. + + A single CertificateRef to a Kubernetes Secret has "Core" support. + Implementations MAY choose to support attaching multiple certificates to + a Listener, but this behavior is implementation-specific. + + References to a resource in different namespace are invalid UNLESS there + is a ReferenceGrant in the target namespace that allows the certificate + to be attached. If a ReferenceGrant does not allow this reference, the + "ResolvedRefs" condition MUST be set to False for this listener with the + "RefNotPermitted" reason. + + This field is required to have at least one element when the mode is set + to "Terminate" (default) and is optional otherwise. + + CertificateRefs can reference to standard Kubernetes resources, i.e. + Secret, or implementation-specific custom resources. + + Support: Core - A single reference to a Kubernetes Secret of type kubernetes.io/tls + + Support: Implementation-specific (More than one reference or other resource types) + items: + description: |- + SecretObjectReference identifies an API object including its namespace, + defaulting to Secret. + + The API object must be valid in the cluster; the Group and Kind must + be registered in the cluster for this reference to be valid. + + References to objects with invalid Group and Kind are not valid, and must + be rejected by the implementation, with appropriate Conditions set + on the containing object. + properties: + group: + default: "" + description: |- + Group is the group of the referent. For example, "gateway.networking.k8s.io". + When unspecified or empty string, core API group is inferred. + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + default: Secret + description: Kind is kind of the referent. For example + "Secret". + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: Name is the name of the referent. + maxLength: 253 + minLength: 1 + type: string + namespace: + description: |- + Namespace is the namespace of the referenced object. When unspecified, the local + namespace is inferred. + + Note that when a namespace different than the local namespace is specified, + a ReferenceGrant object is required in the referent namespace to allow that + namespace's owner to accept the reference. See the ReferenceGrant + documentation for details. + + Support: Core + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - name + type: object + maxItems: 64 + type: array + mode: + default: Terminate + description: |- + Mode defines the TLS behavior for the TLS session initiated by the client. + There are two possible modes: + + - Terminate: The TLS session between the downstream client and the + Gateway is terminated at the Gateway. This mode requires certificates + to be specified in some way, such as populating the certificateRefs + field. + - Passthrough: The TLS session is NOT terminated by the Gateway. This + implies that the Gateway can't decipher the TLS stream except for + the ClientHello message of the TLS protocol. The certificateRefs field + is ignored in this mode. + + Support: Core + enum: + - Terminate + - Passthrough + type: string + options: + additionalProperties: + description: |- + AnnotationValue is the value of an annotation in Gateway API. This is used + for validation of maps such as TLS options. This roughly matches Kubernetes + annotation validation, although the length validation in that case is based + on the entire size of the annotations struct. + maxLength: 4096 + minLength: 0 + type: string + description: |- + Options are a list of key/value pairs to enable extended TLS + configuration for each implementation. For example, configuring the + minimum TLS version or supported cipher suites. + + A set of common keys MAY be defined by the API in the future. To avoid + any ambiguity, implementation-specific definitions MUST use + domain-prefixed names, such as `example.com/my-custom-option`. + Un-prefixed names are reserved for key names defined by Gateway API. + + Support: Implementation-specific + maxProperties: 16 + type: object + type: object + x-kubernetes-validations: + - message: certificateRefs or options must be specified when + mode is Terminate + rule: 'self.mode == ''Terminate'' ? size(self.certificateRefs) + > 0 || size(self.options) > 0 : true' + required: + - name + - port + - protocol + type: object + maxItems: 64 + minItems: 1 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + x-kubernetes-validations: + - message: tls must not be specified for protocols ['HTTP', 'TCP', + 'UDP'] + rule: 'self.all(l, l.protocol in [''HTTP'', ''TCP'', ''UDP''] ? + !has(l.tls) : true)' + - message: tls mode must be Terminate for protocol HTTPS + rule: 'self.all(l, (l.protocol == ''HTTPS'' && has(l.tls)) ? (l.tls.mode + == '''' || l.tls.mode == ''Terminate'') : true)' + - message: hostname must not be specified for protocols ['TCP', 'UDP'] + rule: 'self.all(l, l.protocol in [''TCP'', ''UDP''] ? (!has(l.hostname) + || l.hostname == '''') : true)' + - message: Listener name must be unique within the Gateway + rule: self.all(l1, self.exists_one(l2, l1.name == l2.name)) + - message: Combination of port, protocol and hostname must be unique + for each listener + rule: 'self.all(l1, self.exists_one(l2, l1.port == l2.port && l1.protocol + == l2.protocol && (has(l1.hostname) && has(l2.hostname) ? l1.hostname + == l2.hostname : !has(l1.hostname) && !has(l2.hostname))))' + required: + - gatewayClassName + - listeners + type: object + status: + default: + conditions: + - lastTransitionTime: "1970-01-01T00:00:00Z" + message: Waiting for controller + reason: Pending + status: Unknown + type: Accepted + - lastTransitionTime: "1970-01-01T00:00:00Z" + message: Waiting for controller + reason: Pending + status: Unknown + type: Programmed + description: Status defines the current state of Gateway. + properties: + addresses: + description: |+ + Addresses lists the network addresses that have been bound to the + Gateway. + + This list may differ from the addresses provided in the spec under some + conditions: + + * no addresses are specified, all addresses are dynamically assigned + * a combination of specified and dynamic addresses are assigned + * a specified address was unusable (e.g. already in use) + + items: + description: GatewayStatusAddress describes a network address that + is bound to a Gateway. + oneOf: + - properties: + type: + enum: + - IPAddress + value: + anyOf: + - format: ipv4 + - format: ipv6 + - properties: + type: + not: + enum: + - IPAddress + properties: + type: + default: IPAddress + description: Type of the address. + maxLength: 253 + minLength: 1 + pattern: ^Hostname|IPAddress|NamedAddress|[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$ + type: string + value: + description: |- + Value of the address. The validity of the values will depend + on the type and support by the controller. + + Examples: `1.2.3.4`, `128::1`, `my-ip-address`. + maxLength: 253 + minLength: 1 + type: string + required: + - value + type: object + x-kubernetes-validations: + - message: Hostname value must only contain valid characters (matching + ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$) + rule: 'self.type == ''Hostname'' ? self.value.matches(r"""^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$"""): + true' + maxItems: 16 + type: array + conditions: + default: + - lastTransitionTime: "1970-01-01T00:00:00Z" + message: Waiting for controller + reason: Pending + status: Unknown + type: Accepted + - lastTransitionTime: "1970-01-01T00:00:00Z" + message: Waiting for controller + reason: Pending + status: Unknown + type: Programmed + description: |- + Conditions describe the current conditions of the Gateway. + + Implementations should prefer to express Gateway conditions + using the `GatewayConditionType` and `GatewayConditionReason` + constants so that operators and tools can converge on a common + vocabulary to describe Gateway state. + + Known condition types are: + + * "Accepted" + * "Programmed" + * "Ready" + items: + description: Condition contains details for one aspect of the current + state of this API Resource. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + maxItems: 8 + type: array + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + listeners: + description: Listeners provide status for each unique listener port + defined in the Spec. + items: + description: ListenerStatus is the status associated with a Listener. + properties: + attachedRoutes: + description: |- + AttachedRoutes represents the total number of Routes that have been + successfully attached to this Listener. + + Successful attachment of a Route to a Listener is based solely on the + combination of the AllowedRoutes field on the corresponding Listener + and the Route's ParentRefs field. A Route is successfully attached to + a Listener when it is selected by the Listener's AllowedRoutes field + AND the Route has a valid ParentRef selecting the whole Gateway + resource or a specific Listener as a parent resource (more detail on + attachment semantics can be found in the documentation on the various + Route kinds ParentRefs fields). Listener or Route status does not impact + successful attachment, i.e. the AttachedRoutes field count MUST be set + for Listeners with condition Accepted: false and MUST count successfully + attached Routes that may themselves have Accepted: false conditions. + + Uses for this field include troubleshooting Route attachment and + measuring blast radius/impact of changes to a Listener. + format: int32 + type: integer + conditions: + description: Conditions describe the current condition of this + listener. + items: + description: Condition contains details for one aspect of + the current state of this API Resource. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, + Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + maxItems: 8 + type: array + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + name: + description: Name is the name of the Listener that this status + corresponds to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + supportedKinds: + description: |- + SupportedKinds is the list indicating the Kinds supported by this + listener. This MUST represent the kinds an implementation supports for + that Listener configuration. + + If kinds are specified in Spec that are not supported, they MUST NOT + appear in this list and an implementation MUST set the "ResolvedRefs" + condition to "False" with the "InvalidRouteKinds" reason. If both valid + and invalid Route kinds are specified, the implementation MUST + reference the valid Route kinds that have been specified. + items: + description: RouteGroupKind indicates the group and kind of + a Route resource. + properties: + group: + default: gateway.networking.k8s.io + description: Group is the group of the Route. + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + description: Kind is the kind of the Route. + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + required: + - kind + type: object + maxItems: 8 + type: array + required: + - attachedRoutes + - conditions + - name + - supportedKinds + type: object + maxItems: 64 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + type: object + required: + - spec + type: object + served: true + storage: false + subresources: + status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: null + storedVersions: null +--- +# +# config/crd/standard/gateway.networking.k8s.io_grpcroutes.yaml +# +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328 + gateway.networking.k8s.io/bundle-version: v1.2.1 + gateway.networking.k8s.io/channel: standard + creationTimestamp: null + name: grpcroutes.gateway.networking.k8s.io +spec: + group: gateway.networking.k8s.io + names: + categories: + - gateway-api + kind: GRPCRoute + listKind: GRPCRouteList + plural: grpcroutes + singular: grpcroute + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .spec.hostnames + name: Hostnames + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1 + schema: + openAPIV3Schema: + description: |- + GRPCRoute provides a way to route gRPC requests. This includes the capability + to match requests by hostname, gRPC service, gRPC method, or HTTP/2 header. + Filters can be used to specify additional processing steps. Backends specify + where matching requests will be routed. + + GRPCRoute falls under extended support within the Gateway API. Within the + following specification, the word "MUST" indicates that an implementation + supporting GRPCRoute must conform to the indicated requirement, but an + implementation not supporting this route type need not follow the requirement + unless explicitly indicated. + + Implementations supporting `GRPCRoute` with the `HTTPS` `ProtocolType` MUST + accept HTTP/2 connections without an initial upgrade from HTTP/1.1, i.e. via + ALPN. If the implementation does not support this, then it MUST set the + "Accepted" condition to "False" for the affected listener with a reason of + "UnsupportedProtocol". Implementations MAY also accept HTTP/2 connections + with an upgrade from HTTP/1. + + Implementations supporting `GRPCRoute` with the `HTTP` `ProtocolType` MUST + support HTTP/2 over cleartext TCP (h2c, + https://www.rfc-editor.org/rfc/rfc7540#section-3.1) without an initial + upgrade from HTTP/1.1, i.e. with prior knowledge + (https://www.rfc-editor.org/rfc/rfc7540#section-3.4). If the implementation + does not support this, then it MUST set the "Accepted" condition to "False" + for the affected listener with a reason of "UnsupportedProtocol". + Implementations MAY also accept HTTP/2 connections with an upgrade from + HTTP/1, i.e. without prior knowledge. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: Spec defines the desired state of GRPCRoute. + properties: + hostnames: + description: |- + Hostnames defines a set of hostnames to match against the GRPC + Host header to select a GRPCRoute to process the request. This matches + the RFC 1123 definition of a hostname with 2 notable exceptions: + + 1. IPs are not allowed. + 2. A hostname may be prefixed with a wildcard label (`*.`). The wildcard + label MUST appear by itself as the first label. + + If a hostname is specified by both the Listener and GRPCRoute, there + MUST be at least one intersecting hostname for the GRPCRoute to be + attached to the Listener. For example: + + * A Listener with `test.example.com` as the hostname matches GRPCRoutes + that have either not specified any hostnames, or have specified at + least one of `test.example.com` or `*.example.com`. + * A Listener with `*.example.com` as the hostname matches GRPCRoutes + that have either not specified any hostnames or have specified at least + one hostname that matches the Listener hostname. For example, + `test.example.com` and `*.example.com` would both match. On the other + hand, `example.com` and `test.example.net` would not match. + + Hostnames that are prefixed with a wildcard label (`*.`) are interpreted + as a suffix match. That means that a match for `*.example.com` would match + both `test.example.com`, and `foo.test.example.com`, but not `example.com`. + + If both the Listener and GRPCRoute have specified hostnames, any + GRPCRoute hostnames that do not match the Listener hostname MUST be + ignored. For example, if a Listener specified `*.example.com`, and the + GRPCRoute specified `test.example.com` and `test.example.net`, + `test.example.net` MUST NOT be considered for a match. + + If both the Listener and GRPCRoute have specified hostnames, and none + match with the criteria above, then the GRPCRoute MUST NOT be accepted by + the implementation. The implementation MUST raise an 'Accepted' Condition + with a status of `False` in the corresponding RouteParentStatus. + + If a Route (A) of type HTTPRoute or GRPCRoute is attached to a + Listener and that listener already has another Route (B) of the other + type attached and the intersection of the hostnames of A and B is + non-empty, then the implementation MUST accept exactly one of these two + routes, determined by the following criteria, in order: + + * The oldest Route based on creation timestamp. + * The Route appearing first in alphabetical order by + "{namespace}/{name}". + + The rejected Route MUST raise an 'Accepted' condition with a status of + 'False' in the corresponding RouteParentStatus. + + Support: Core + items: + description: |- + Hostname is the fully qualified domain name of a network host. This matches + the RFC 1123 definition of a hostname with 2 notable exceptions: + + 1. IPs are not allowed. + 2. A hostname may be prefixed with a wildcard label (`*.`). The wildcard + label must appear by itself as the first label. + + Hostname can be "precise" which is a domain name without the terminating + dot of a network host (e.g. "foo.example.com") or "wildcard", which is a + domain name prefixed with a single wildcard label (e.g. `*.example.com`). + + Note that as per RFC1035 and RFC1123, a *label* must consist of lower case + alphanumeric characters or '-', and must start and end with an alphanumeric + character. No other punctuation is allowed. + maxLength: 253 + minLength: 1 + pattern: ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + maxItems: 16 + type: array + parentRefs: + description: |+ + ParentRefs references the resources (usually Gateways) that a Route wants + to be attached to. Note that the referenced parent resource needs to + allow this for the attachment to be complete. For Gateways, that means + the Gateway needs to allow attachment from Routes of this kind and + namespace. For Services, that means the Service must either be in the same + namespace for a "producer" route, or the mesh implementation must support + and allow "consumer" routes for the referenced Service. ReferenceGrant is + not applicable for governing ParentRefs to Services - it is not possible to + create a "producer" route for a Service in a different namespace from the + Route. + + There are two kinds of parent resources with "Core" support: + + * Gateway (Gateway conformance profile) + * Service (Mesh conformance profile, ClusterIP Services only) + + This API may be extended in the future to support additional kinds of parent + resources. + + ParentRefs must be _distinct_. This means either that: + + * They select different objects. If this is the case, then parentRef + entries are distinct. In terms of fields, this means that the + multi-part key defined by `group`, `kind`, `namespace`, and `name` must + be unique across all parentRef entries in the Route. + * They do not select different objects, but for each optional field used, + each ParentRef that selects the same object must set the same set of + optional fields to different values. If one ParentRef sets a + combination of optional fields, all must set the same combination. + + Some examples: + + * If one ParentRef sets `sectionName`, all ParentRefs referencing the + same object must also set `sectionName`. + * If one ParentRef sets `port`, all ParentRefs referencing the same + object must also set `port`. + * If one ParentRef sets `sectionName` and `port`, all ParentRefs + referencing the same object must also set `sectionName` and `port`. + + It is possible to separately reference multiple distinct objects that may + be collapsed by an implementation. For example, some implementations may + choose to merge compatible Gateway Listeners together. If that is the + case, the list of routes attached to those resources should also be + merged. + + Note that for ParentRefs that cross namespace boundaries, there are specific + rules. Cross-namespace references are only valid if they are explicitly + allowed by something in the namespace they are referring to. For example, + Gateway has the AllowedRoutes field, and ReferenceGrant provides a + generic way to enable other kinds of cross-namespace reference. + + + + + + + items: + description: |- + ParentReference identifies an API object (usually a Gateway) that can be considered + a parent of this resource (usually a route). There are two kinds of parent resources + with "Core" support: + + * Gateway (Gateway conformance profile) + * Service (Mesh conformance profile, ClusterIP Services only) + + This API may be extended in the future to support additional kinds of parent + resources. + + The API object must be valid in the cluster; the Group and Kind must + be registered in the cluster for this reference to be valid. + properties: + group: + default: gateway.networking.k8s.io + description: |- + Group is the group of the referent. + When unspecified, "gateway.networking.k8s.io" is inferred. + To set the core API group (such as for a "Service" kind referent), + Group must be explicitly set to "" (empty string). + + Support: Core + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + default: Gateway + description: |- + Kind is kind of the referent. + + There are two kinds of parent resources with "Core" support: + + * Gateway (Gateway conformance profile) + * Service (Mesh conformance profile, ClusterIP Services only) + + Support for other resources is Implementation-Specific. + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: |- + Name is the name of the referent. + + Support: Core + maxLength: 253 + minLength: 1 + type: string + namespace: + description: |- + Namespace is the namespace of the referent. When unspecified, this refers + to the local namespace of the Route. + + Note that there are specific rules for ParentRefs which cross namespace + boundaries. Cross-namespace references are only valid if they are explicitly + allowed by something in the namespace they are referring to. For example: + Gateway has the AllowedRoutes field, and ReferenceGrant provides a + generic way to enable any other kind of cross-namespace reference. + + + + Support: Core + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + port: + description: |- + Port is the network port this Route targets. It can be interpreted + differently based on the type of parent resource. + + When the parent resource is a Gateway, this targets all listeners + listening on the specified port that also support this kind of Route(and + select this Route). It's not recommended to set `Port` unless the + networking behaviors specified in a Route must apply to a specific port + as opposed to a listener(s) whose port(s) may be changed. When both Port + and SectionName are specified, the name and port of the selected listener + must match both specified values. + + + + Implementations MAY choose to support other parent resources. + Implementations supporting other types of parent resources MUST clearly + document how/if Port is interpreted. + + For the purpose of status, an attachment is considered successful as + long as the parent resource accepts it partially. For example, Gateway + listeners can restrict which Routes can attach to them by Route kind, + namespace, or hostname. If 1 of 2 Gateway listeners accept attachment + from the referencing Route, the Route MUST be considered successfully + attached. If no Gateway listeners accept attachment from this Route, + the Route MUST be considered detached from the Gateway. + + Support: Extended + format: int32 + maximum: 65535 + minimum: 1 + type: integer + sectionName: + description: |- + SectionName is the name of a section within the target resource. In the + following resources, SectionName is interpreted as the following: + + * Gateway: Listener name. When both Port (experimental) and SectionName + are specified, the name and port of the selected listener must match + both specified values. + * Service: Port name. When both Port (experimental) and SectionName + are specified, the name and port of the selected listener must match + both specified values. + + Implementations MAY choose to support attaching Routes to other resources. + If that is the case, they MUST clearly document how SectionName is + interpreted. + + When unspecified (empty string), this will reference the entire resource. + For the purpose of status, an attachment is considered successful if at + least one section in the parent resource accepts it. For example, Gateway + listeners can restrict which Routes can attach to them by Route kind, + namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from + the referencing Route, the Route MUST be considered successfully + attached. If no Gateway listeners accept attachment from this Route, the + Route MUST be considered detached from the Gateway. + + Support: Core + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + required: + - name + type: object + maxItems: 32 + type: array + x-kubernetes-validations: + - message: sectionName must be specified when parentRefs includes + 2 or more references to the same parent + rule: 'self.all(p1, self.all(p2, p1.group == p2.group && p1.kind + == p2.kind && p1.name == p2.name && (((!has(p1.__namespace__) + || p1.__namespace__ == '''') && (!has(p2.__namespace__) || p2.__namespace__ + == '''')) || (has(p1.__namespace__) && has(p2.__namespace__) && + p1.__namespace__ == p2.__namespace__ )) ? ((!has(p1.sectionName) + || p1.sectionName == '''') == (!has(p2.sectionName) || p2.sectionName + == '''')) : true))' + - message: sectionName must be unique when parentRefs includes 2 or + more references to the same parent + rule: self.all(p1, self.exists_one(p2, p1.group == p2.group && p1.kind + == p2.kind && p1.name == p2.name && (((!has(p1.__namespace__) + || p1.__namespace__ == '') && (!has(p2.__namespace__) || p2.__namespace__ + == '')) || (has(p1.__namespace__) && has(p2.__namespace__) && + p1.__namespace__ == p2.__namespace__ )) && (((!has(p1.sectionName) + || p1.sectionName == '') && (!has(p2.sectionName) || p2.sectionName + == '')) || (has(p1.sectionName) && has(p2.sectionName) && p1.sectionName + == p2.sectionName)))) + rules: + description: |+ + Rules are a list of GRPC matchers, filters and actions. + + items: + description: |- + GRPCRouteRule defines the semantics for matching a gRPC request based on + conditions (matches), processing it (filters), and forwarding the request to + an API object (backendRefs). + properties: + backendRefs: + description: |- + BackendRefs defines the backend(s) where matching requests should be + sent. + + Failure behavior here depends on how many BackendRefs are specified and + how many are invalid. + + If *all* entries in BackendRefs are invalid, and there are also no filters + specified in this route rule, *all* traffic which matches this rule MUST + receive an `UNAVAILABLE` status. + + See the GRPCBackendRef definition for the rules about what makes a single + GRPCBackendRef invalid. + + When a GRPCBackendRef is invalid, `UNAVAILABLE` statuses MUST be returned for + requests that would have otherwise been routed to an invalid backend. If + multiple backends are specified, and some are invalid, the proportion of + requests that would otherwise have been routed to an invalid backend + MUST receive an `UNAVAILABLE` status. + + For example, if two backends are specified with equal weights, and one is + invalid, 50 percent of traffic MUST receive an `UNAVAILABLE` status. + Implementations may choose how that 50 percent is determined. + + Support: Core for Kubernetes Service + + Support: Implementation-specific for any other resource + + Support for weight: Core + items: + description: |- + GRPCBackendRef defines how a GRPCRoute forwards a gRPC request. + + Note that when a namespace different than the local namespace is specified, a + ReferenceGrant object is required in the referent namespace to allow that + namespace's owner to accept the reference. See the ReferenceGrant + documentation for details. + + + + When the BackendRef points to a Kubernetes Service, implementations SHOULD + honor the appProtocol field if it is set for the target Service Port. + + Implementations supporting appProtocol SHOULD recognize the Kubernetes + Standard Application Protocols defined in KEP-3726. + + If a Service appProtocol isn't specified, an implementation MAY infer the + backend protocol through its own means. Implementations MAY infer the + protocol from the Route type referring to the backend Service. + + If a Route is not able to send traffic to the backend using the specified + protocol then the backend is considered invalid. Implementations MUST set the + "ResolvedRefs" condition to "False" with the "UnsupportedProtocol" reason. + + + properties: + filters: + description: |- + Filters defined at this level MUST be executed if and only if the + request is being forwarded to the backend defined here. + + Support: Implementation-specific (For broader support of filters, use the + Filters field in GRPCRouteRule.) + items: + description: |- + GRPCRouteFilter defines processing steps that must be completed during the + request or response lifecycle. GRPCRouteFilters are meant as an extension + point to express processing that may be done in Gateway implementations. Some + examples include request or response modification, implementing + authentication strategies, rate-limiting, and traffic shaping. API + guarantee/conformance is defined based on the type of the filter. + properties: + extensionRef: + description: |- + ExtensionRef is an optional, implementation-specific extension to the + "filter" behavior. For example, resource "myroutefilter" in group + "networking.example.net"). ExtensionRef MUST NOT be used for core and + extended filters. + + Support: Implementation-specific + + This filter can be used multiple times within the same rule. + properties: + group: + description: |- + Group is the group of the referent. For example, "gateway.networking.k8s.io". + When unspecified or empty string, core API group is inferred. + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + description: Kind is kind of the referent. For + example "HTTPRoute" or "Service". + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: Name is the name of the referent. + maxLength: 253 + minLength: 1 + type: string + required: + - group + - kind + - name + type: object + requestHeaderModifier: + description: |- + RequestHeaderModifier defines a schema for a filter that modifies request + headers. + + Support: Core + properties: + add: + description: |- + Add adds the given header(s) (name, value) to the request + before the action. It appends to any existing values associated + with the header name. + + Input: + GET /foo HTTP/1.1 + my-header: foo + + Config: + add: + - name: "my-header" + value: "bar,baz" + + Output: + GET /foo HTTP/1.1 + my-header: foo,bar,baz + items: + description: HTTPHeader represents an HTTP + Header name and value as defined by RFC + 7230. + properties: + name: + description: |- + Name is the name of the HTTP Header to be matched. Name matching MUST be + case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). + + If multiple entries specify equivalent header names, the first entry with + an equivalent name MUST be considered for a match. Subsequent entries + with an equivalent header name MUST be ignored. Due to the + case-insensitivity of header names, "foo" and "Foo" are considered + equivalent. + maxLength: 256 + minLength: 1 + pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ + type: string + value: + description: Value is the value of HTTP + Header to be matched. + maxLength: 4096 + minLength: 1 + type: string + required: + - name + - value + type: object + maxItems: 16 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + remove: + description: |- + Remove the given header(s) from the HTTP request before the action. The + value of Remove is a list of HTTP header names. Note that the header + names are case-insensitive (see + https://datatracker.ietf.org/doc/html/rfc2616#section-4.2). + + Input: + GET /foo HTTP/1.1 + my-header1: foo + my-header2: bar + my-header3: baz + + Config: + remove: ["my-header1", "my-header3"] + + Output: + GET /foo HTTP/1.1 + my-header2: bar + items: + type: string + maxItems: 16 + type: array + x-kubernetes-list-type: set + set: + description: |- + Set overwrites the request with the given header (name, value) + before the action. + + Input: + GET /foo HTTP/1.1 + my-header: foo + + Config: + set: + - name: "my-header" + value: "bar" + + Output: + GET /foo HTTP/1.1 + my-header: bar + items: + description: HTTPHeader represents an HTTP + Header name and value as defined by RFC + 7230. + properties: + name: + description: |- + Name is the name of the HTTP Header to be matched. Name matching MUST be + case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). + + If multiple entries specify equivalent header names, the first entry with + an equivalent name MUST be considered for a match. Subsequent entries + with an equivalent header name MUST be ignored. Due to the + case-insensitivity of header names, "foo" and "Foo" are considered + equivalent. + maxLength: 256 + minLength: 1 + pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ + type: string + value: + description: Value is the value of HTTP + Header to be matched. + maxLength: 4096 + minLength: 1 + type: string + required: + - name + - value + type: object + maxItems: 16 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + type: object + requestMirror: + description: |+ + RequestMirror defines a schema for a filter that mirrors requests. + Requests are sent to the specified destination, but responses from + that destination are ignored. + + This filter can be used multiple times within the same rule. Note that + not all implementations will be able to support mirroring to multiple + backends. + + Support: Extended + + properties: + backendRef: + description: |- + BackendRef references a resource where mirrored requests are sent. + + Mirrored requests must be sent only to a single destination endpoint + within this BackendRef, irrespective of how many endpoints are present + within this BackendRef. + + If the referent cannot be found, this BackendRef is invalid and must be + dropped from the Gateway. The controller must ensure the "ResolvedRefs" + condition on the Route status is set to `status: False` and not configure + this backend in the underlying implementation. + + If there is a cross-namespace reference to an *existing* object + that is not allowed by a ReferenceGrant, the controller must ensure the + "ResolvedRefs" condition on the Route is set to `status: False`, + with the "RefNotPermitted" reason and not configure this backend in the + underlying implementation. + + In either error case, the Message of the `ResolvedRefs` Condition + should be used to provide more detail about the problem. + + Support: Extended for Kubernetes Service + + Support: Implementation-specific for any other resource + properties: + group: + default: "" + description: |- + Group is the group of the referent. For example, "gateway.networking.k8s.io". + When unspecified or empty string, core API group is inferred. + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + default: Service + description: |- + Kind is the Kubernetes resource kind of the referent. For example + "Service". + + Defaults to "Service" when not specified. + + ExternalName services can refer to CNAME DNS records that may live + outside of the cluster and as such are difficult to reason about in + terms of conformance. They also may not be safe to forward to (see + CVE-2021-25740 for more information). Implementations SHOULD NOT + support ExternalName Services. + + Support: Core (Services with a type other than ExternalName) + + Support: Implementation-specific (Services with type ExternalName) + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: Name is the name of the referent. + maxLength: 253 + minLength: 1 + type: string + namespace: + description: |- + Namespace is the namespace of the backend. When unspecified, the local + namespace is inferred. + + Note that when a namespace different than the local namespace is specified, + a ReferenceGrant object is required in the referent namespace to allow that + namespace's owner to accept the reference. See the ReferenceGrant + documentation for details. + + Support: Core + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + port: + description: |- + Port specifies the destination port number to use for this resource. + Port is required when the referent is a Kubernetes Service. In this + case, the port number is the service port number, not the target port. + For other resources, destination port might be derived from the referent + resource or this field. + format: int32 + maximum: 65535 + minimum: 1 + type: integer + required: + - name + type: object + x-kubernetes-validations: + - message: Must have port for Service reference + rule: '(size(self.group) == 0 && self.kind + == ''Service'') ? has(self.port) : true' + required: + - backendRef + type: object + responseHeaderModifier: + description: |- + ResponseHeaderModifier defines a schema for a filter that modifies response + headers. + + Support: Extended + properties: + add: + description: |- + Add adds the given header(s) (name, value) to the request + before the action. It appends to any existing values associated + with the header name. + + Input: + GET /foo HTTP/1.1 + my-header: foo + + Config: + add: + - name: "my-header" + value: "bar,baz" + + Output: + GET /foo HTTP/1.1 + my-header: foo,bar,baz + items: + description: HTTPHeader represents an HTTP + Header name and value as defined by RFC + 7230. + properties: + name: + description: |- + Name is the name of the HTTP Header to be matched. Name matching MUST be + case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). + + If multiple entries specify equivalent header names, the first entry with + an equivalent name MUST be considered for a match. Subsequent entries + with an equivalent header name MUST be ignored. Due to the + case-insensitivity of header names, "foo" and "Foo" are considered + equivalent. + maxLength: 256 + minLength: 1 + pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ + type: string + value: + description: Value is the value of HTTP + Header to be matched. + maxLength: 4096 + minLength: 1 + type: string + required: + - name + - value + type: object + maxItems: 16 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + remove: + description: |- + Remove the given header(s) from the HTTP request before the action. The + value of Remove is a list of HTTP header names. Note that the header + names are case-insensitive (see + https://datatracker.ietf.org/doc/html/rfc2616#section-4.2). + + Input: + GET /foo HTTP/1.1 + my-header1: foo + my-header2: bar + my-header3: baz + + Config: + remove: ["my-header1", "my-header3"] + + Output: + GET /foo HTTP/1.1 + my-header2: bar + items: + type: string + maxItems: 16 + type: array + x-kubernetes-list-type: set + set: + description: |- + Set overwrites the request with the given header (name, value) + before the action. + + Input: + GET /foo HTTP/1.1 + my-header: foo + + Config: + set: + - name: "my-header" + value: "bar" + + Output: + GET /foo HTTP/1.1 + my-header: bar + items: + description: HTTPHeader represents an HTTP + Header name and value as defined by RFC + 7230. + properties: + name: + description: |- + Name is the name of the HTTP Header to be matched. Name matching MUST be + case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). + + If multiple entries specify equivalent header names, the first entry with + an equivalent name MUST be considered for a match. Subsequent entries + with an equivalent header name MUST be ignored. Due to the + case-insensitivity of header names, "foo" and "Foo" are considered + equivalent. + maxLength: 256 + minLength: 1 + pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ + type: string + value: + description: Value is the value of HTTP + Header to be matched. + maxLength: 4096 + minLength: 1 + type: string + required: + - name + - value + type: object + maxItems: 16 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + type: object + type: + description: |+ + Type identifies the type of filter to apply. As with other API fields, + types are classified into three conformance levels: + + - Core: Filter types and their corresponding configuration defined by + "Support: Core" in this package, e.g. "RequestHeaderModifier". All + implementations supporting GRPCRoute MUST support core filters. + + - Extended: Filter types and their corresponding configuration defined by + "Support: Extended" in this package, e.g. "RequestMirror". Implementers + are encouraged to support extended filters. + + - Implementation-specific: Filters that are defined and supported by specific vendors. + In the future, filters showing convergence in behavior across multiple + implementations will be considered for inclusion in extended or core + conformance levels. Filter-specific configuration for such filters + is specified using the ExtensionRef field. `Type` MUST be set to + "ExtensionRef" for custom filters. + + Implementers are encouraged to define custom implementation types to + extend the core API with implementation-specific behavior. + + If a reference to a custom filter type cannot be resolved, the filter + MUST NOT be skipped. Instead, requests that would have been processed by + that filter MUST receive a HTTP error response. + + enum: + - ResponseHeaderModifier + - RequestHeaderModifier + - RequestMirror + - ExtensionRef + type: string + required: + - type + type: object + x-kubernetes-validations: + - message: filter.requestHeaderModifier must be nil + if the filter.type is not RequestHeaderModifier + rule: '!(has(self.requestHeaderModifier) && self.type + != ''RequestHeaderModifier'')' + - message: filter.requestHeaderModifier must be specified + for RequestHeaderModifier filter.type + rule: '!(!has(self.requestHeaderModifier) && self.type + == ''RequestHeaderModifier'')' + - message: filter.responseHeaderModifier must be nil + if the filter.type is not ResponseHeaderModifier + rule: '!(has(self.responseHeaderModifier) && self.type + != ''ResponseHeaderModifier'')' + - message: filter.responseHeaderModifier must be specified + for ResponseHeaderModifier filter.type + rule: '!(!has(self.responseHeaderModifier) && self.type + == ''ResponseHeaderModifier'')' + - message: filter.requestMirror must be nil if the filter.type + is not RequestMirror + rule: '!(has(self.requestMirror) && self.type != ''RequestMirror'')' + - message: filter.requestMirror must be specified for + RequestMirror filter.type + rule: '!(!has(self.requestMirror) && self.type == + ''RequestMirror'')' + - message: filter.extensionRef must be nil if the filter.type + is not ExtensionRef + rule: '!(has(self.extensionRef) && self.type != ''ExtensionRef'')' + - message: filter.extensionRef must be specified for + ExtensionRef filter.type + rule: '!(!has(self.extensionRef) && self.type == ''ExtensionRef'')' + maxItems: 16 + type: array + x-kubernetes-validations: + - message: RequestHeaderModifier filter cannot be repeated + rule: self.filter(f, f.type == 'RequestHeaderModifier').size() + <= 1 + - message: ResponseHeaderModifier filter cannot be repeated + rule: self.filter(f, f.type == 'ResponseHeaderModifier').size() + <= 1 + group: + default: "" + description: |- + Group is the group of the referent. For example, "gateway.networking.k8s.io". + When unspecified or empty string, core API group is inferred. + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + default: Service + description: |- + Kind is the Kubernetes resource kind of the referent. For example + "Service". + + Defaults to "Service" when not specified. + + ExternalName services can refer to CNAME DNS records that may live + outside of the cluster and as such are difficult to reason about in + terms of conformance. They also may not be safe to forward to (see + CVE-2021-25740 for more information). Implementations SHOULD NOT + support ExternalName Services. + + Support: Core (Services with a type other than ExternalName) + + Support: Implementation-specific (Services with type ExternalName) + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: Name is the name of the referent. + maxLength: 253 + minLength: 1 + type: string + namespace: + description: |- + Namespace is the namespace of the backend. When unspecified, the local + namespace is inferred. + + Note that when a namespace different than the local namespace is specified, + a ReferenceGrant object is required in the referent namespace to allow that + namespace's owner to accept the reference. See the ReferenceGrant + documentation for details. + + Support: Core + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + port: + description: |- + Port specifies the destination port number to use for this resource. + Port is required when the referent is a Kubernetes Service. In this + case, the port number is the service port number, not the target port. + For other resources, destination port might be derived from the referent + resource or this field. + format: int32 + maximum: 65535 + minimum: 1 + type: integer + weight: + default: 1 + description: |- + Weight specifies the proportion of requests forwarded to the referenced + backend. This is computed as weight/(sum of all weights in this + BackendRefs list). For non-zero values, there may be some epsilon from + the exact proportion defined here depending on the precision an + implementation supports. Weight is not a percentage and the sum of + weights does not need to equal 100. + + If only one backend is specified and it has a weight greater than 0, 100% + of the traffic is forwarded to that backend. If weight is set to 0, no + traffic should be forwarded for this entry. If unspecified, weight + defaults to 1. + + Support for this field varies based on the context where used. + format: int32 + maximum: 1000000 + minimum: 0 + type: integer + required: + - name + type: object + x-kubernetes-validations: + - message: Must have port for Service reference + rule: '(size(self.group) == 0 && self.kind == ''Service'') + ? has(self.port) : true' + maxItems: 16 + type: array + filters: + description: |- + Filters define the filters that are applied to requests that match + this rule. + + The effects of ordering of multiple behaviors are currently unspecified. + This can change in the future based on feedback during the alpha stage. + + Conformance-levels at this level are defined based on the type of filter: + + - ALL core filters MUST be supported by all implementations that support + GRPCRoute. + - Implementers are encouraged to support extended filters. + - Implementation-specific custom filters have no API guarantees across + implementations. + + Specifying the same filter multiple times is not supported unless explicitly + indicated in the filter. + + If an implementation can not support a combination of filters, it must clearly + document that limitation. In cases where incompatible or unsupported + filters are specified and cause the `Accepted` condition to be set to status + `False`, implementations may use the `IncompatibleFilters` reason to specify + this configuration error. + + Support: Core + items: + description: |- + GRPCRouteFilter defines processing steps that must be completed during the + request or response lifecycle. GRPCRouteFilters are meant as an extension + point to express processing that may be done in Gateway implementations. Some + examples include request or response modification, implementing + authentication strategies, rate-limiting, and traffic shaping. API + guarantee/conformance is defined based on the type of the filter. + properties: + extensionRef: + description: |- + ExtensionRef is an optional, implementation-specific extension to the + "filter" behavior. For example, resource "myroutefilter" in group + "networking.example.net"). ExtensionRef MUST NOT be used for core and + extended filters. + + Support: Implementation-specific + + This filter can be used multiple times within the same rule. + properties: + group: + description: |- + Group is the group of the referent. For example, "gateway.networking.k8s.io". + When unspecified or empty string, core API group is inferred. + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + description: Kind is kind of the referent. For example + "HTTPRoute" or "Service". + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: Name is the name of the referent. + maxLength: 253 + minLength: 1 + type: string + required: + - group + - kind + - name + type: object + requestHeaderModifier: + description: |- + RequestHeaderModifier defines a schema for a filter that modifies request + headers. + + Support: Core + properties: + add: + description: |- + Add adds the given header(s) (name, value) to the request + before the action. It appends to any existing values associated + with the header name. + + Input: + GET /foo HTTP/1.1 + my-header: foo + + Config: + add: + - name: "my-header" + value: "bar,baz" + + Output: + GET /foo HTTP/1.1 + my-header: foo,bar,baz + items: + description: HTTPHeader represents an HTTP Header + name and value as defined by RFC 7230. + properties: + name: + description: |- + Name is the name of the HTTP Header to be matched. Name matching MUST be + case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). + + If multiple entries specify equivalent header names, the first entry with + an equivalent name MUST be considered for a match. Subsequent entries + with an equivalent header name MUST be ignored. Due to the + case-insensitivity of header names, "foo" and "Foo" are considered + equivalent. + maxLength: 256 + minLength: 1 + pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ + type: string + value: + description: Value is the value of HTTP Header + to be matched. + maxLength: 4096 + minLength: 1 + type: string + required: + - name + - value + type: object + maxItems: 16 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + remove: + description: |- + Remove the given header(s) from the HTTP request before the action. The + value of Remove is a list of HTTP header names. Note that the header + names are case-insensitive (see + https://datatracker.ietf.org/doc/html/rfc2616#section-4.2). + + Input: + GET /foo HTTP/1.1 + my-header1: foo + my-header2: bar + my-header3: baz + + Config: + remove: ["my-header1", "my-header3"] + + Output: + GET /foo HTTP/1.1 + my-header2: bar + items: + type: string + maxItems: 16 + type: array + x-kubernetes-list-type: set + set: + description: |- + Set overwrites the request with the given header (name, value) + before the action. + + Input: + GET /foo HTTP/1.1 + my-header: foo + + Config: + set: + - name: "my-header" + value: "bar" + + Output: + GET /foo HTTP/1.1 + my-header: bar + items: + description: HTTPHeader represents an HTTP Header + name and value as defined by RFC 7230. + properties: + name: + description: |- + Name is the name of the HTTP Header to be matched. Name matching MUST be + case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). + + If multiple entries specify equivalent header names, the first entry with + an equivalent name MUST be considered for a match. Subsequent entries + with an equivalent header name MUST be ignored. Due to the + case-insensitivity of header names, "foo" and "Foo" are considered + equivalent. + maxLength: 256 + minLength: 1 + pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ + type: string + value: + description: Value is the value of HTTP Header + to be matched. + maxLength: 4096 + minLength: 1 + type: string + required: + - name + - value + type: object + maxItems: 16 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + type: object + requestMirror: + description: |+ + RequestMirror defines a schema for a filter that mirrors requests. + Requests are sent to the specified destination, but responses from + that destination are ignored. + + This filter can be used multiple times within the same rule. Note that + not all implementations will be able to support mirroring to multiple + backends. + + Support: Extended + + properties: + backendRef: + description: |- + BackendRef references a resource where mirrored requests are sent. + + Mirrored requests must be sent only to a single destination endpoint + within this BackendRef, irrespective of how many endpoints are present + within this BackendRef. + + If the referent cannot be found, this BackendRef is invalid and must be + dropped from the Gateway. The controller must ensure the "ResolvedRefs" + condition on the Route status is set to `status: False` and not configure + this backend in the underlying implementation. + + If there is a cross-namespace reference to an *existing* object + that is not allowed by a ReferenceGrant, the controller must ensure the + "ResolvedRefs" condition on the Route is set to `status: False`, + with the "RefNotPermitted" reason and not configure this backend in the + underlying implementation. + + In either error case, the Message of the `ResolvedRefs` Condition + should be used to provide more detail about the problem. + + Support: Extended for Kubernetes Service + + Support: Implementation-specific for any other resource + properties: + group: + default: "" + description: |- + Group is the group of the referent. For example, "gateway.networking.k8s.io". + When unspecified or empty string, core API group is inferred. + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + default: Service + description: |- + Kind is the Kubernetes resource kind of the referent. For example + "Service". + + Defaults to "Service" when not specified. + + ExternalName services can refer to CNAME DNS records that may live + outside of the cluster and as such are difficult to reason about in + terms of conformance. They also may not be safe to forward to (see + CVE-2021-25740 for more information). Implementations SHOULD NOT + support ExternalName Services. + + Support: Core (Services with a type other than ExternalName) + + Support: Implementation-specific (Services with type ExternalName) + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: Name is the name of the referent. + maxLength: 253 + minLength: 1 + type: string + namespace: + description: |- + Namespace is the namespace of the backend. When unspecified, the local + namespace is inferred. + + Note that when a namespace different than the local namespace is specified, + a ReferenceGrant object is required in the referent namespace to allow that + namespace's owner to accept the reference. See the ReferenceGrant + documentation for details. + + Support: Core + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + port: + description: |- + Port specifies the destination port number to use for this resource. + Port is required when the referent is a Kubernetes Service. In this + case, the port number is the service port number, not the target port. + For other resources, destination port might be derived from the referent + resource or this field. + format: int32 + maximum: 65535 + minimum: 1 + type: integer + required: + - name + type: object + x-kubernetes-validations: + - message: Must have port for Service reference + rule: '(size(self.group) == 0 && self.kind == ''Service'') + ? has(self.port) : true' + required: + - backendRef + type: object + responseHeaderModifier: + description: |- + ResponseHeaderModifier defines a schema for a filter that modifies response + headers. + + Support: Extended + properties: + add: + description: |- + Add adds the given header(s) (name, value) to the request + before the action. It appends to any existing values associated + with the header name. + + Input: + GET /foo HTTP/1.1 + my-header: foo + + Config: + add: + - name: "my-header" + value: "bar,baz" + + Output: + GET /foo HTTP/1.1 + my-header: foo,bar,baz + items: + description: HTTPHeader represents an HTTP Header + name and value as defined by RFC 7230. + properties: + name: + description: |- + Name is the name of the HTTP Header to be matched. Name matching MUST be + case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). + + If multiple entries specify equivalent header names, the first entry with + an equivalent name MUST be considered for a match. Subsequent entries + with an equivalent header name MUST be ignored. Due to the + case-insensitivity of header names, "foo" and "Foo" are considered + equivalent. + maxLength: 256 + minLength: 1 + pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ + type: string + value: + description: Value is the value of HTTP Header + to be matched. + maxLength: 4096 + minLength: 1 + type: string + required: + - name + - value + type: object + maxItems: 16 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + remove: + description: |- + Remove the given header(s) from the HTTP request before the action. The + value of Remove is a list of HTTP header names. Note that the header + names are case-insensitive (see + https://datatracker.ietf.org/doc/html/rfc2616#section-4.2). + + Input: + GET /foo HTTP/1.1 + my-header1: foo + my-header2: bar + my-header3: baz + + Config: + remove: ["my-header1", "my-header3"] + + Output: + GET /foo HTTP/1.1 + my-header2: bar + items: + type: string + maxItems: 16 + type: array + x-kubernetes-list-type: set + set: + description: |- + Set overwrites the request with the given header (name, value) + before the action. + + Input: + GET /foo HTTP/1.1 + my-header: foo + + Config: + set: + - name: "my-header" + value: "bar" + + Output: + GET /foo HTTP/1.1 + my-header: bar + items: + description: HTTPHeader represents an HTTP Header + name and value as defined by RFC 7230. + properties: + name: + description: |- + Name is the name of the HTTP Header to be matched. Name matching MUST be + case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). + + If multiple entries specify equivalent header names, the first entry with + an equivalent name MUST be considered for a match. Subsequent entries + with an equivalent header name MUST be ignored. Due to the + case-insensitivity of header names, "foo" and "Foo" are considered + equivalent. + maxLength: 256 + minLength: 1 + pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ + type: string + value: + description: Value is the value of HTTP Header + to be matched. + maxLength: 4096 + minLength: 1 + type: string + required: + - name + - value + type: object + maxItems: 16 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + type: object + type: + description: |+ + Type identifies the type of filter to apply. As with other API fields, + types are classified into three conformance levels: + + - Core: Filter types and their corresponding configuration defined by + "Support: Core" in this package, e.g. "RequestHeaderModifier". All + implementations supporting GRPCRoute MUST support core filters. + + - Extended: Filter types and their corresponding configuration defined by + "Support: Extended" in this package, e.g. "RequestMirror". Implementers + are encouraged to support extended filters. + + - Implementation-specific: Filters that are defined and supported by specific vendors. + In the future, filters showing convergence in behavior across multiple + implementations will be considered for inclusion in extended or core + conformance levels. Filter-specific configuration for such filters + is specified using the ExtensionRef field. `Type` MUST be set to + "ExtensionRef" for custom filters. + + Implementers are encouraged to define custom implementation types to + extend the core API with implementation-specific behavior. + + If a reference to a custom filter type cannot be resolved, the filter + MUST NOT be skipped. Instead, requests that would have been processed by + that filter MUST receive a HTTP error response. + + enum: + - ResponseHeaderModifier + - RequestHeaderModifier + - RequestMirror + - ExtensionRef + type: string + required: + - type + type: object + x-kubernetes-validations: + - message: filter.requestHeaderModifier must be nil if the + filter.type is not RequestHeaderModifier + rule: '!(has(self.requestHeaderModifier) && self.type != + ''RequestHeaderModifier'')' + - message: filter.requestHeaderModifier must be specified + for RequestHeaderModifier filter.type + rule: '!(!has(self.requestHeaderModifier) && self.type == + ''RequestHeaderModifier'')' + - message: filter.responseHeaderModifier must be nil if the + filter.type is not ResponseHeaderModifier + rule: '!(has(self.responseHeaderModifier) && self.type != + ''ResponseHeaderModifier'')' + - message: filter.responseHeaderModifier must be specified + for ResponseHeaderModifier filter.type + rule: '!(!has(self.responseHeaderModifier) && self.type + == ''ResponseHeaderModifier'')' + - message: filter.requestMirror must be nil if the filter.type + is not RequestMirror + rule: '!(has(self.requestMirror) && self.type != ''RequestMirror'')' + - message: filter.requestMirror must be specified for RequestMirror + filter.type + rule: '!(!has(self.requestMirror) && self.type == ''RequestMirror'')' + - message: filter.extensionRef must be nil if the filter.type + is not ExtensionRef + rule: '!(has(self.extensionRef) && self.type != ''ExtensionRef'')' + - message: filter.extensionRef must be specified for ExtensionRef + filter.type + rule: '!(!has(self.extensionRef) && self.type == ''ExtensionRef'')' + maxItems: 16 + type: array + x-kubernetes-validations: + - message: RequestHeaderModifier filter cannot be repeated + rule: self.filter(f, f.type == 'RequestHeaderModifier').size() + <= 1 + - message: ResponseHeaderModifier filter cannot be repeated + rule: self.filter(f, f.type == 'ResponseHeaderModifier').size() + <= 1 + matches: + description: |- + Matches define conditions used for matching the rule against incoming + gRPC requests. Each match is independent, i.e. this rule will be matched + if **any** one of the matches is satisfied. + + For example, take the following matches configuration: + + ``` + matches: + - method: + service: foo.bar + headers: + values: + version: 2 + - method: + service: foo.bar.v2 + ``` + + For a request to match against this rule, it MUST satisfy + EITHER of the two conditions: + + - service of foo.bar AND contains the header `version: 2` + - service of foo.bar.v2 + + See the documentation for GRPCRouteMatch on how to specify multiple + match conditions to be ANDed together. + + If no matches are specified, the implementation MUST match every gRPC request. + + Proxy or Load Balancer routing configuration generated from GRPCRoutes + MUST prioritize rules based on the following criteria, continuing on + ties. Merging MUST not be done between GRPCRoutes and HTTPRoutes. + Precedence MUST be given to the rule with the largest number of: + + * Characters in a matching non-wildcard hostname. + * Characters in a matching hostname. + * Characters in a matching service. + * Characters in a matching method. + * Header matches. + + If ties still exist across multiple Routes, matching precedence MUST be + determined in order of the following criteria, continuing on ties: + + * The oldest Route based on creation timestamp. + * The Route appearing first in alphabetical order by + "{namespace}/{name}". + + If ties still exist within the Route that has been given precedence, + matching precedence MUST be granted to the first matching rule meeting + the above criteria. + items: + description: |- + GRPCRouteMatch defines the predicate used to match requests to a given + action. Multiple match types are ANDed together, i.e. the match will + evaluate to true only if all conditions are satisfied. + + For example, the match below will match a gRPC request only if its service + is `foo` AND it contains the `version: v1` header: + + ``` + matches: + - method: + type: Exact + service: "foo" + headers: + - name: "version" + value "v1" + + ``` + properties: + headers: + description: |- + Headers specifies gRPC request header matchers. Multiple match values are + ANDed together, meaning, a request MUST match all the specified headers + to select the route. + items: + description: |- + GRPCHeaderMatch describes how to select a gRPC route by matching gRPC request + headers. + properties: + name: + description: |- + Name is the name of the gRPC Header to be matched. + + If multiple entries specify equivalent header names, only the first + entry with an equivalent name MUST be considered for a match. Subsequent + entries with an equivalent header name MUST be ignored. Due to the + case-insensitivity of header names, "foo" and "Foo" are considered + equivalent. + maxLength: 256 + minLength: 1 + pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ + type: string + type: + default: Exact + description: Type specifies how to match against + the value of the header. + enum: + - Exact + - RegularExpression + type: string + value: + description: Value is the value of the gRPC Header + to be matched. + maxLength: 4096 + minLength: 1 + type: string + required: + - name + - value + type: object + maxItems: 16 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + method: + description: |- + Method specifies a gRPC request service/method matcher. If this field is + not specified, all services and methods will match. + properties: + method: + description: |- + Value of the method to match against. If left empty or omitted, will + match all services. + + At least one of Service and Method MUST be a non-empty string. + maxLength: 1024 + type: string + service: + description: |- + Value of the service to match against. If left empty or omitted, will + match any service. + + At least one of Service and Method MUST be a non-empty string. + maxLength: 1024 + type: string + type: + default: Exact + description: |- + Type specifies how to match against the service and/or method. + Support: Core (Exact with service and method specified) + + Support: Implementation-specific (Exact with method specified but no service specified) + + Support: Implementation-specific (RegularExpression) + enum: + - Exact + - RegularExpression + type: string + type: object + x-kubernetes-validations: + - message: One or both of 'service' or 'method' must be + specified + rule: 'has(self.type) ? has(self.service) || has(self.method) + : true' + - message: service must only contain valid characters + (matching ^(?i)\.?[a-z_][a-z_0-9]*(\.[a-z_][a-z_0-9]*)*$) + rule: '(!has(self.type) || self.type == ''Exact'') && + has(self.service) ? self.service.matches(r"""^(?i)\.?[a-z_][a-z_0-9]*(\.[a-z_][a-z_0-9]*)*$"""): + true' + - message: method must only contain valid characters (matching + ^[A-Za-z_][A-Za-z_0-9]*$) + rule: '(!has(self.type) || self.type == ''Exact'') && + has(self.method) ? self.method.matches(r"""^[A-Za-z_][A-Za-z_0-9]*$"""): + true' + type: object + maxItems: 8 + type: array + type: object + maxItems: 16 + type: array + x-kubernetes-validations: + - message: While 16 rules and 64 matches per rule are allowed, the + total number of matches across all rules in a route must be less + than 128 + rule: '(self.size() > 0 ? (has(self[0].matches) ? self[0].matches.size() + : 0) : 0) + (self.size() > 1 ? (has(self[1].matches) ? self[1].matches.size() + : 0) : 0) + (self.size() > 2 ? (has(self[2].matches) ? self[2].matches.size() + : 0) : 0) + (self.size() > 3 ? (has(self[3].matches) ? self[3].matches.size() + : 0) : 0) + (self.size() > 4 ? (has(self[4].matches) ? self[4].matches.size() + : 0) : 0) + (self.size() > 5 ? (has(self[5].matches) ? self[5].matches.size() + : 0) : 0) + (self.size() > 6 ? (has(self[6].matches) ? self[6].matches.size() + : 0) : 0) + (self.size() > 7 ? (has(self[7].matches) ? self[7].matches.size() + : 0) : 0) + (self.size() > 8 ? (has(self[8].matches) ? self[8].matches.size() + : 0) : 0) + (self.size() > 9 ? (has(self[9].matches) ? self[9].matches.size() + : 0) : 0) + (self.size() > 10 ? (has(self[10].matches) ? self[10].matches.size() + : 0) : 0) + (self.size() > 11 ? (has(self[11].matches) ? self[11].matches.size() + : 0) : 0) + (self.size() > 12 ? (has(self[12].matches) ? self[12].matches.size() + : 0) : 0) + (self.size() > 13 ? (has(self[13].matches) ? self[13].matches.size() + : 0) : 0) + (self.size() > 14 ? (has(self[14].matches) ? self[14].matches.size() + : 0) : 0) + (self.size() > 15 ? (has(self[15].matches) ? self[15].matches.size() + : 0) : 0) <= 128' + type: object + status: + description: Status defines the current state of GRPCRoute. + properties: + parents: + description: |- + Parents is a list of parent resources (usually Gateways) that are + associated with the route, and the status of the route with respect to + each parent. When this route attaches to a parent, the controller that + manages the parent must add an entry to this list when the controller + first sees the route and should update the entry as appropriate when the + route or gateway is modified. + + Note that parent references that cannot be resolved by an implementation + of this API will not be added to this list. Implementations of this API + can only populate Route status for the Gateways/parent resources they are + responsible for. + + A maximum of 32 Gateways will be represented in this list. An empty list + means the route has not been attached to any Gateway. + items: + description: |- + RouteParentStatus describes the status of a route with respect to an + associated Parent. + properties: + conditions: + description: |- + Conditions describes the status of the route with respect to the Gateway. + Note that the route's availability is also subject to the Gateway's own + status conditions and listener status. + + If the Route's ParentRef specifies an existing Gateway that supports + Routes of this kind AND that Gateway's controller has sufficient access, + then that Gateway's controller MUST set the "Accepted" condition on the + Route, to indicate whether the route has been accepted or rejected by the + Gateway, and why. + + A Route MUST be considered "Accepted" if at least one of the Route's + rules is implemented by the Gateway. + + There are a number of cases where the "Accepted" condition may not be set + due to lack of controller visibility, that includes when: + + * The Route refers to a non-existent parent. + * The Route is of a type that the controller does not support. + * The Route is in a namespace the controller does not have access to. + items: + description: Condition contains details for one aspect of + the current state of this API Resource. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, + Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + maxItems: 8 + minItems: 1 + type: array + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + controllerName: + description: |- + ControllerName is a domain/path string that indicates the name of the + controller that wrote this status. This corresponds with the + controllerName field on GatewayClass. + + Example: "example.net/gateway-controller". + + The format of this field is DOMAIN "/" PATH, where DOMAIN and PATH are + valid Kubernetes names + (https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names). + + Controllers MUST populate this field when writing status. Controllers should ensure that + entries to status populated with their ControllerName are cleaned up when they are no + longer necessary. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$ + type: string + parentRef: + description: |- + ParentRef corresponds with a ParentRef in the spec that this + RouteParentStatus struct describes the status of. + properties: + group: + default: gateway.networking.k8s.io + description: |- + Group is the group of the referent. + When unspecified, "gateway.networking.k8s.io" is inferred. + To set the core API group (such as for a "Service" kind referent), + Group must be explicitly set to "" (empty string). + + Support: Core + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + default: Gateway + description: |- + Kind is kind of the referent. + + There are two kinds of parent resources with "Core" support: + + * Gateway (Gateway conformance profile) + * Service (Mesh conformance profile, ClusterIP Services only) + + Support for other resources is Implementation-Specific. + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: |- + Name is the name of the referent. + + Support: Core + maxLength: 253 + minLength: 1 + type: string + namespace: + description: |- + Namespace is the namespace of the referent. When unspecified, this refers + to the local namespace of the Route. + + Note that there are specific rules for ParentRefs which cross namespace + boundaries. Cross-namespace references are only valid if they are explicitly + allowed by something in the namespace they are referring to. For example: + Gateway has the AllowedRoutes field, and ReferenceGrant provides a + generic way to enable any other kind of cross-namespace reference. + + + + Support: Core + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + port: + description: |- + Port is the network port this Route targets. It can be interpreted + differently based on the type of parent resource. + + When the parent resource is a Gateway, this targets all listeners + listening on the specified port that also support this kind of Route(and + select this Route). It's not recommended to set `Port` unless the + networking behaviors specified in a Route must apply to a specific port + as opposed to a listener(s) whose port(s) may be changed. When both Port + and SectionName are specified, the name and port of the selected listener + must match both specified values. + + + + Implementations MAY choose to support other parent resources. + Implementations supporting other types of parent resources MUST clearly + document how/if Port is interpreted. + + For the purpose of status, an attachment is considered successful as + long as the parent resource accepts it partially. For example, Gateway + listeners can restrict which Routes can attach to them by Route kind, + namespace, or hostname. If 1 of 2 Gateway listeners accept attachment + from the referencing Route, the Route MUST be considered successfully + attached. If no Gateway listeners accept attachment from this Route, + the Route MUST be considered detached from the Gateway. + + Support: Extended + format: int32 + maximum: 65535 + minimum: 1 + type: integer + sectionName: + description: |- + SectionName is the name of a section within the target resource. In the + following resources, SectionName is interpreted as the following: + + * Gateway: Listener name. When both Port (experimental) and SectionName + are specified, the name and port of the selected listener must match + both specified values. + * Service: Port name. When both Port (experimental) and SectionName + are specified, the name and port of the selected listener must match + both specified values. + + Implementations MAY choose to support attaching Routes to other resources. + If that is the case, they MUST clearly document how SectionName is + interpreted. + + When unspecified (empty string), this will reference the entire resource. + For the purpose of status, an attachment is considered successful if at + least one section in the parent resource accepts it. For example, Gateway + listeners can restrict which Routes can attach to them by Route kind, + namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from + the referencing Route, the Route MUST be considered successfully + attached. If no Gateway listeners accept attachment from this Route, the + Route MUST be considered detached from the Gateway. + + Support: Core + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + required: + - name + type: object + required: + - controllerName + - parentRef + type: object + maxItems: 32 + type: array + required: + - parents + type: object + type: object + served: true + storage: true + subresources: + status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: null + storedVersions: null +--- +# +# config/crd/standard/gateway.networking.k8s.io_httproutes.yaml +# +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328 + gateway.networking.k8s.io/bundle-version: v1.2.1 + gateway.networking.k8s.io/channel: standard + creationTimestamp: null + name: httproutes.gateway.networking.k8s.io +spec: + group: gateway.networking.k8s.io + names: + categories: + - gateway-api + kind: HTTPRoute + listKind: HTTPRouteList + plural: httproutes + singular: httproute + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .spec.hostnames + name: Hostnames + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1 + schema: + openAPIV3Schema: + description: |- + HTTPRoute provides a way to route HTTP requests. This includes the capability + to match requests by hostname, path, header, or query param. Filters can be + used to specify additional processing steps. Backends specify where matching + requests should be routed. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: Spec defines the desired state of HTTPRoute. + properties: + hostnames: + description: |- + Hostnames defines a set of hostnames that should match against the HTTP Host + header to select a HTTPRoute used to process the request. Implementations + MUST ignore any port value specified in the HTTP Host header while + performing a match and (absent of any applicable header modification + configuration) MUST forward this header unmodified to the backend. + + Valid values for Hostnames are determined by RFC 1123 definition of a + hostname with 2 notable exceptions: + + 1. IPs are not allowed. + 2. A hostname may be prefixed with a wildcard label (`*.`). The wildcard + label must appear by itself as the first label. + + If a hostname is specified by both the Listener and HTTPRoute, there + must be at least one intersecting hostname for the HTTPRoute to be + attached to the Listener. For example: + + * A Listener with `test.example.com` as the hostname matches HTTPRoutes + that have either not specified any hostnames, or have specified at + least one of `test.example.com` or `*.example.com`. + * A Listener with `*.example.com` as the hostname matches HTTPRoutes + that have either not specified any hostnames or have specified at least + one hostname that matches the Listener hostname. For example, + `*.example.com`, `test.example.com`, and `foo.test.example.com` would + all match. On the other hand, `example.com` and `test.example.net` would + not match. + + Hostnames that are prefixed with a wildcard label (`*.`) are interpreted + as a suffix match. That means that a match for `*.example.com` would match + both `test.example.com`, and `foo.test.example.com`, but not `example.com`. + + If both the Listener and HTTPRoute have specified hostnames, any + HTTPRoute hostnames that do not match the Listener hostname MUST be + ignored. For example, if a Listener specified `*.example.com`, and the + HTTPRoute specified `test.example.com` and `test.example.net`, + `test.example.net` must not be considered for a match. + + If both the Listener and HTTPRoute have specified hostnames, and none + match with the criteria above, then the HTTPRoute is not accepted. The + implementation must raise an 'Accepted' Condition with a status of + `False` in the corresponding RouteParentStatus. + + In the event that multiple HTTPRoutes specify intersecting hostnames (e.g. + overlapping wildcard matching and exact matching hostnames), precedence must + be given to rules from the HTTPRoute with the largest number of: + + * Characters in a matching non-wildcard hostname. + * Characters in a matching hostname. + + If ties exist across multiple Routes, the matching precedence rules for + HTTPRouteMatches takes over. + + Support: Core + items: + description: |- + Hostname is the fully qualified domain name of a network host. This matches + the RFC 1123 definition of a hostname with 2 notable exceptions: + + 1. IPs are not allowed. + 2. A hostname may be prefixed with a wildcard label (`*.`). The wildcard + label must appear by itself as the first label. + + Hostname can be "precise" which is a domain name without the terminating + dot of a network host (e.g. "foo.example.com") or "wildcard", which is a + domain name prefixed with a single wildcard label (e.g. `*.example.com`). + + Note that as per RFC1035 and RFC1123, a *label* must consist of lower case + alphanumeric characters or '-', and must start and end with an alphanumeric + character. No other punctuation is allowed. + maxLength: 253 + minLength: 1 + pattern: ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + maxItems: 16 + type: array + parentRefs: + description: |+ + ParentRefs references the resources (usually Gateways) that a Route wants + to be attached to. Note that the referenced parent resource needs to + allow this for the attachment to be complete. For Gateways, that means + the Gateway needs to allow attachment from Routes of this kind and + namespace. For Services, that means the Service must either be in the same + namespace for a "producer" route, or the mesh implementation must support + and allow "consumer" routes for the referenced Service. ReferenceGrant is + not applicable for governing ParentRefs to Services - it is not possible to + create a "producer" route for a Service in a different namespace from the + Route. + + There are two kinds of parent resources with "Core" support: + + * Gateway (Gateway conformance profile) + * Service (Mesh conformance profile, ClusterIP Services only) + + This API may be extended in the future to support additional kinds of parent + resources. + + ParentRefs must be _distinct_. This means either that: + + * They select different objects. If this is the case, then parentRef + entries are distinct. In terms of fields, this means that the + multi-part key defined by `group`, `kind`, `namespace`, and `name` must + be unique across all parentRef entries in the Route. + * They do not select different objects, but for each optional field used, + each ParentRef that selects the same object must set the same set of + optional fields to different values. If one ParentRef sets a + combination of optional fields, all must set the same combination. + + Some examples: + + * If one ParentRef sets `sectionName`, all ParentRefs referencing the + same object must also set `sectionName`. + * If one ParentRef sets `port`, all ParentRefs referencing the same + object must also set `port`. + * If one ParentRef sets `sectionName` and `port`, all ParentRefs + referencing the same object must also set `sectionName` and `port`. + + It is possible to separately reference multiple distinct objects that may + be collapsed by an implementation. For example, some implementations may + choose to merge compatible Gateway Listeners together. If that is the + case, the list of routes attached to those resources should also be + merged. + + Note that for ParentRefs that cross namespace boundaries, there are specific + rules. Cross-namespace references are only valid if they are explicitly + allowed by something in the namespace they are referring to. For example, + Gateway has the AllowedRoutes field, and ReferenceGrant provides a + generic way to enable other kinds of cross-namespace reference. + + + + + + + items: + description: |- + ParentReference identifies an API object (usually a Gateway) that can be considered + a parent of this resource (usually a route). There are two kinds of parent resources + with "Core" support: + + * Gateway (Gateway conformance profile) + * Service (Mesh conformance profile, ClusterIP Services only) + + This API may be extended in the future to support additional kinds of parent + resources. + + The API object must be valid in the cluster; the Group and Kind must + be registered in the cluster for this reference to be valid. + properties: + group: + default: gateway.networking.k8s.io + description: |- + Group is the group of the referent. + When unspecified, "gateway.networking.k8s.io" is inferred. + To set the core API group (such as for a "Service" kind referent), + Group must be explicitly set to "" (empty string). + + Support: Core + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + default: Gateway + description: |- + Kind is kind of the referent. + + There are two kinds of parent resources with "Core" support: + + * Gateway (Gateway conformance profile) + * Service (Mesh conformance profile, ClusterIP Services only) + + Support for other resources is Implementation-Specific. + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: |- + Name is the name of the referent. + + Support: Core + maxLength: 253 + minLength: 1 + type: string + namespace: + description: |- + Namespace is the namespace of the referent. When unspecified, this refers + to the local namespace of the Route. + + Note that there are specific rules for ParentRefs which cross namespace + boundaries. Cross-namespace references are only valid if they are explicitly + allowed by something in the namespace they are referring to. For example: + Gateway has the AllowedRoutes field, and ReferenceGrant provides a + generic way to enable any other kind of cross-namespace reference. + + + + Support: Core + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + port: + description: |- + Port is the network port this Route targets. It can be interpreted + differently based on the type of parent resource. + + When the parent resource is a Gateway, this targets all listeners + listening on the specified port that also support this kind of Route(and + select this Route). It's not recommended to set `Port` unless the + networking behaviors specified in a Route must apply to a specific port + as opposed to a listener(s) whose port(s) may be changed. When both Port + and SectionName are specified, the name and port of the selected listener + must match both specified values. + + + + Implementations MAY choose to support other parent resources. + Implementations supporting other types of parent resources MUST clearly + document how/if Port is interpreted. + + For the purpose of status, an attachment is considered successful as + long as the parent resource accepts it partially. For example, Gateway + listeners can restrict which Routes can attach to them by Route kind, + namespace, or hostname. If 1 of 2 Gateway listeners accept attachment + from the referencing Route, the Route MUST be considered successfully + attached. If no Gateway listeners accept attachment from this Route, + the Route MUST be considered detached from the Gateway. + + Support: Extended + format: int32 + maximum: 65535 + minimum: 1 + type: integer + sectionName: + description: |- + SectionName is the name of a section within the target resource. In the + following resources, SectionName is interpreted as the following: + + * Gateway: Listener name. When both Port (experimental) and SectionName + are specified, the name and port of the selected listener must match + both specified values. + * Service: Port name. When both Port (experimental) and SectionName + are specified, the name and port of the selected listener must match + both specified values. + + Implementations MAY choose to support attaching Routes to other resources. + If that is the case, they MUST clearly document how SectionName is + interpreted. + + When unspecified (empty string), this will reference the entire resource. + For the purpose of status, an attachment is considered successful if at + least one section in the parent resource accepts it. For example, Gateway + listeners can restrict which Routes can attach to them by Route kind, + namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from + the referencing Route, the Route MUST be considered successfully + attached. If no Gateway listeners accept attachment from this Route, the + Route MUST be considered detached from the Gateway. + + Support: Core + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + required: + - name + type: object + maxItems: 32 + type: array + x-kubernetes-validations: + - message: sectionName must be specified when parentRefs includes + 2 or more references to the same parent + rule: 'self.all(p1, self.all(p2, p1.group == p2.group && p1.kind + == p2.kind && p1.name == p2.name && (((!has(p1.__namespace__) + || p1.__namespace__ == '''') && (!has(p2.__namespace__) || p2.__namespace__ + == '''')) || (has(p1.__namespace__) && has(p2.__namespace__) && + p1.__namespace__ == p2.__namespace__ )) ? ((!has(p1.sectionName) + || p1.sectionName == '''') == (!has(p2.sectionName) || p2.sectionName + == '''')) : true))' + - message: sectionName must be unique when parentRefs includes 2 or + more references to the same parent + rule: self.all(p1, self.exists_one(p2, p1.group == p2.group && p1.kind + == p2.kind && p1.name == p2.name && (((!has(p1.__namespace__) + || p1.__namespace__ == '') && (!has(p2.__namespace__) || p2.__namespace__ + == '')) || (has(p1.__namespace__) && has(p2.__namespace__) && + p1.__namespace__ == p2.__namespace__ )) && (((!has(p1.sectionName) + || p1.sectionName == '') && (!has(p2.sectionName) || p2.sectionName + == '')) || (has(p1.sectionName) && has(p2.sectionName) && p1.sectionName + == p2.sectionName)))) + rules: + default: + - matches: + - path: + type: PathPrefix + value: / + description: |+ + Rules are a list of HTTP matchers, filters and actions. + + items: + description: |- + HTTPRouteRule defines semantics for matching an HTTP request based on + conditions (matches), processing it (filters), and forwarding the request to + an API object (backendRefs). + properties: + backendRefs: + description: |- + BackendRefs defines the backend(s) where matching requests should be + sent. + + Failure behavior here depends on how many BackendRefs are specified and + how many are invalid. + + If *all* entries in BackendRefs are invalid, and there are also no filters + specified in this route rule, *all* traffic which matches this rule MUST + receive a 500 status code. + + See the HTTPBackendRef definition for the rules about what makes a single + HTTPBackendRef invalid. + + When a HTTPBackendRef is invalid, 500 status codes MUST be returned for + requests that would have otherwise been routed to an invalid backend. If + multiple backends are specified, and some are invalid, the proportion of + requests that would otherwise have been routed to an invalid backend + MUST receive a 500 status code. + + For example, if two backends are specified with equal weights, and one is + invalid, 50 percent of traffic must receive a 500. Implementations may + choose how that 50 percent is determined. + + When a HTTPBackendRef refers to a Service that has no ready endpoints, + implementations SHOULD return a 503 for requests to that backend instead. + If an implementation chooses to do this, all of the above rules for 500 responses + MUST also apply for responses that return a 503. + + Support: Core for Kubernetes Service + + Support: Extended for Kubernetes ServiceImport + + Support: Implementation-specific for any other resource + + Support for weight: Core + items: + description: |- + HTTPBackendRef defines how a HTTPRoute forwards a HTTP request. + + Note that when a namespace different than the local namespace is specified, a + ReferenceGrant object is required in the referent namespace to allow that + namespace's owner to accept the reference. See the ReferenceGrant + documentation for details. + + + + When the BackendRef points to a Kubernetes Service, implementations SHOULD + honor the appProtocol field if it is set for the target Service Port. + + Implementations supporting appProtocol SHOULD recognize the Kubernetes + Standard Application Protocols defined in KEP-3726. + + If a Service appProtocol isn't specified, an implementation MAY infer the + backend protocol through its own means. Implementations MAY infer the + protocol from the Route type referring to the backend Service. + + If a Route is not able to send traffic to the backend using the specified + protocol then the backend is considered invalid. Implementations MUST set the + "ResolvedRefs" condition to "False" with the "UnsupportedProtocol" reason. + + + properties: + filters: + description: |- + Filters defined at this level should be executed if and only if the + request is being forwarded to the backend defined here. + + Support: Implementation-specific (For broader support of filters, use the + Filters field in HTTPRouteRule.) + items: + description: |- + HTTPRouteFilter defines processing steps that must be completed during the + request or response lifecycle. HTTPRouteFilters are meant as an extension + point to express processing that may be done in Gateway implementations. Some + examples include request or response modification, implementing + authentication strategies, rate-limiting, and traffic shaping. API + guarantee/conformance is defined based on the type of the filter. + properties: + extensionRef: + description: |- + ExtensionRef is an optional, implementation-specific extension to the + "filter" behavior. For example, resource "myroutefilter" in group + "networking.example.net"). ExtensionRef MUST NOT be used for core and + extended filters. + + This filter can be used multiple times within the same rule. + + Support: Implementation-specific + properties: + group: + description: |- + Group is the group of the referent. For example, "gateway.networking.k8s.io". + When unspecified or empty string, core API group is inferred. + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + description: Kind is kind of the referent. For + example "HTTPRoute" or "Service". + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: Name is the name of the referent. + maxLength: 253 + minLength: 1 + type: string + required: + - group + - kind + - name + type: object + requestHeaderModifier: + description: |- + RequestHeaderModifier defines a schema for a filter that modifies request + headers. + + Support: Core + properties: + add: + description: |- + Add adds the given header(s) (name, value) to the request + before the action. It appends to any existing values associated + with the header name. + + Input: + GET /foo HTTP/1.1 + my-header: foo + + Config: + add: + - name: "my-header" + value: "bar,baz" + + Output: + GET /foo HTTP/1.1 + my-header: foo,bar,baz + items: + description: HTTPHeader represents an HTTP + Header name and value as defined by RFC + 7230. + properties: + name: + description: |- + Name is the name of the HTTP Header to be matched. Name matching MUST be + case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). + + If multiple entries specify equivalent header names, the first entry with + an equivalent name MUST be considered for a match. Subsequent entries + with an equivalent header name MUST be ignored. Due to the + case-insensitivity of header names, "foo" and "Foo" are considered + equivalent. + maxLength: 256 + minLength: 1 + pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ + type: string + value: + description: Value is the value of HTTP + Header to be matched. + maxLength: 4096 + minLength: 1 + type: string + required: + - name + - value + type: object + maxItems: 16 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + remove: + description: |- + Remove the given header(s) from the HTTP request before the action. The + value of Remove is a list of HTTP header names. Note that the header + names are case-insensitive (see + https://datatracker.ietf.org/doc/html/rfc2616#section-4.2). + + Input: + GET /foo HTTP/1.1 + my-header1: foo + my-header2: bar + my-header3: baz + + Config: + remove: ["my-header1", "my-header3"] + + Output: + GET /foo HTTP/1.1 + my-header2: bar + items: + type: string + maxItems: 16 + type: array + x-kubernetes-list-type: set + set: + description: |- + Set overwrites the request with the given header (name, value) + before the action. + + Input: + GET /foo HTTP/1.1 + my-header: foo + + Config: + set: + - name: "my-header" + value: "bar" + + Output: + GET /foo HTTP/1.1 + my-header: bar + items: + description: HTTPHeader represents an HTTP + Header name and value as defined by RFC + 7230. + properties: + name: + description: |- + Name is the name of the HTTP Header to be matched. Name matching MUST be + case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). + + If multiple entries specify equivalent header names, the first entry with + an equivalent name MUST be considered for a match. Subsequent entries + with an equivalent header name MUST be ignored. Due to the + case-insensitivity of header names, "foo" and "Foo" are considered + equivalent. + maxLength: 256 + minLength: 1 + pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ + type: string + value: + description: Value is the value of HTTP + Header to be matched. + maxLength: 4096 + minLength: 1 + type: string + required: + - name + - value + type: object + maxItems: 16 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + type: object + requestMirror: + description: |+ + RequestMirror defines a schema for a filter that mirrors requests. + Requests are sent to the specified destination, but responses from + that destination are ignored. + + This filter can be used multiple times within the same rule. Note that + not all implementations will be able to support mirroring to multiple + backends. + + Support: Extended + + properties: + backendRef: + description: |- + BackendRef references a resource where mirrored requests are sent. + + Mirrored requests must be sent only to a single destination endpoint + within this BackendRef, irrespective of how many endpoints are present + within this BackendRef. + + If the referent cannot be found, this BackendRef is invalid and must be + dropped from the Gateway. The controller must ensure the "ResolvedRefs" + condition on the Route status is set to `status: False` and not configure + this backend in the underlying implementation. + + If there is a cross-namespace reference to an *existing* object + that is not allowed by a ReferenceGrant, the controller must ensure the + "ResolvedRefs" condition on the Route is set to `status: False`, + with the "RefNotPermitted" reason and not configure this backend in the + underlying implementation. + + In either error case, the Message of the `ResolvedRefs` Condition + should be used to provide more detail about the problem. + + Support: Extended for Kubernetes Service + + Support: Implementation-specific for any other resource + properties: + group: + default: "" + description: |- + Group is the group of the referent. For example, "gateway.networking.k8s.io". + When unspecified or empty string, core API group is inferred. + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + default: Service + description: |- + Kind is the Kubernetes resource kind of the referent. For example + "Service". + + Defaults to "Service" when not specified. + + ExternalName services can refer to CNAME DNS records that may live + outside of the cluster and as such are difficult to reason about in + terms of conformance. They also may not be safe to forward to (see + CVE-2021-25740 for more information). Implementations SHOULD NOT + support ExternalName Services. + + Support: Core (Services with a type other than ExternalName) + + Support: Implementation-specific (Services with type ExternalName) + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: Name is the name of the referent. + maxLength: 253 + minLength: 1 + type: string + namespace: + description: |- + Namespace is the namespace of the backend. When unspecified, the local + namespace is inferred. + + Note that when a namespace different than the local namespace is specified, + a ReferenceGrant object is required in the referent namespace to allow that + namespace's owner to accept the reference. See the ReferenceGrant + documentation for details. + + Support: Core + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + port: + description: |- + Port specifies the destination port number to use for this resource. + Port is required when the referent is a Kubernetes Service. In this + case, the port number is the service port number, not the target port. + For other resources, destination port might be derived from the referent + resource or this field. + format: int32 + maximum: 65535 + minimum: 1 + type: integer + required: + - name + type: object + x-kubernetes-validations: + - message: Must have port for Service reference + rule: '(size(self.group) == 0 && self.kind + == ''Service'') ? has(self.port) : true' + required: + - backendRef + type: object + requestRedirect: + description: |- + RequestRedirect defines a schema for a filter that responds to the + request with an HTTP redirection. + + Support: Core + properties: + hostname: + description: |- + Hostname is the hostname to be used in the value of the `Location` + header in the response. + When empty, the hostname in the `Host` header of the request is used. + + Support: Core + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + path: + description: |- + Path defines parameters used to modify the path of the incoming request. + The modified path is then used to construct the `Location` header. When + empty, the request path is used as-is. + + Support: Extended + properties: + replaceFullPath: + description: |- + ReplaceFullPath specifies the value with which to replace the full path + of a request during a rewrite or redirect. + maxLength: 1024 + type: string + replacePrefixMatch: + description: |- + ReplacePrefixMatch specifies the value with which to replace the prefix + match of a request during a rewrite or redirect. For example, a request + to "/foo/bar" with a prefix match of "/foo" and a ReplacePrefixMatch + of "/xyz" would be modified to "/xyz/bar". + + Note that this matches the behavior of the PathPrefix match type. This + matches full path elements. A path element refers to the list of labels + in the path split by the `/` separator. When specified, a trailing `/` is + ignored. For example, the paths `/abc`, `/abc/`, and `/abc/def` would all + match the prefix `/abc`, but the path `/abcd` would not. + + ReplacePrefixMatch is only compatible with a `PathPrefix` HTTPRouteMatch. + Using any other HTTPRouteMatch type on the same HTTPRouteRule will result in + the implementation setting the Accepted Condition for the Route to `status: False`. + + Request Path | Prefix Match | Replace Prefix | Modified Path + maxLength: 1024 + type: string + type: + description: |- + Type defines the type of path modifier. Additional types may be + added in a future release of the API. + + Note that values may be added to this enum, implementations + must ensure that unknown values will not cause a crash. + + Unknown values here must result in the implementation setting the + Accepted Condition for the Route to `status: False`, with a + Reason of `UnsupportedValue`. + enum: + - ReplaceFullPath + - ReplacePrefixMatch + type: string + required: + - type + type: object + x-kubernetes-validations: + - message: replaceFullPath must be specified + when type is set to 'ReplaceFullPath' + rule: 'self.type == ''ReplaceFullPath'' ? + has(self.replaceFullPath) : true' + - message: type must be 'ReplaceFullPath' when + replaceFullPath is set + rule: 'has(self.replaceFullPath) ? self.type + == ''ReplaceFullPath'' : true' + - message: replacePrefixMatch must be specified + when type is set to 'ReplacePrefixMatch' + rule: 'self.type == ''ReplacePrefixMatch'' + ? has(self.replacePrefixMatch) : true' + - message: type must be 'ReplacePrefixMatch' + when replacePrefixMatch is set + rule: 'has(self.replacePrefixMatch) ? self.type + == ''ReplacePrefixMatch'' : true' + port: + description: |- + Port is the port to be used in the value of the `Location` + header in the response. + + If no port is specified, the redirect port MUST be derived using the + following rules: + + * If redirect scheme is not-empty, the redirect port MUST be the well-known + port associated with the redirect scheme. Specifically "http" to port 80 + and "https" to port 443. If the redirect scheme does not have a + well-known port, the listener port of the Gateway SHOULD be used. + * If redirect scheme is empty, the redirect port MUST be the Gateway + Listener port. + + Implementations SHOULD NOT add the port number in the 'Location' + header in the following cases: + + * A Location header that will use HTTP (whether that is determined via + the Listener protocol or the Scheme field) _and_ use port 80. + * A Location header that will use HTTPS (whether that is determined via + the Listener protocol or the Scheme field) _and_ use port 443. + + Support: Extended + format: int32 + maximum: 65535 + minimum: 1 + type: integer + scheme: + description: |- + Scheme is the scheme to be used in the value of the `Location` header in + the response. When empty, the scheme of the request is used. + + Scheme redirects can affect the port of the redirect, for more information, + refer to the documentation for the port field of this filter. + + Note that values may be added to this enum, implementations + must ensure that unknown values will not cause a crash. + + Unknown values here must result in the implementation setting the + Accepted Condition for the Route to `status: False`, with a + Reason of `UnsupportedValue`. + + Support: Extended + enum: + - http + - https + type: string + statusCode: + default: 302 + description: |- + StatusCode is the HTTP status code to be used in response. + + Note that values may be added to this enum, implementations + must ensure that unknown values will not cause a crash. + + Unknown values here must result in the implementation setting the + Accepted Condition for the Route to `status: False`, with a + Reason of `UnsupportedValue`. + + Support: Core + enum: + - 301 + - 302 + type: integer + type: object + responseHeaderModifier: + description: |- + ResponseHeaderModifier defines a schema for a filter that modifies response + headers. + + Support: Extended + properties: + add: + description: |- + Add adds the given header(s) (name, value) to the request + before the action. It appends to any existing values associated + with the header name. + + Input: + GET /foo HTTP/1.1 + my-header: foo + + Config: + add: + - name: "my-header" + value: "bar,baz" + + Output: + GET /foo HTTP/1.1 + my-header: foo,bar,baz + items: + description: HTTPHeader represents an HTTP + Header name and value as defined by RFC + 7230. + properties: + name: + description: |- + Name is the name of the HTTP Header to be matched. Name matching MUST be + case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). + + If multiple entries specify equivalent header names, the first entry with + an equivalent name MUST be considered for a match. Subsequent entries + with an equivalent header name MUST be ignored. Due to the + case-insensitivity of header names, "foo" and "Foo" are considered + equivalent. + maxLength: 256 + minLength: 1 + pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ + type: string + value: + description: Value is the value of HTTP + Header to be matched. + maxLength: 4096 + minLength: 1 + type: string + required: + - name + - value + type: object + maxItems: 16 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + remove: + description: |- + Remove the given header(s) from the HTTP request before the action. The + value of Remove is a list of HTTP header names. Note that the header + names are case-insensitive (see + https://datatracker.ietf.org/doc/html/rfc2616#section-4.2). + + Input: + GET /foo HTTP/1.1 + my-header1: foo + my-header2: bar + my-header3: baz + + Config: + remove: ["my-header1", "my-header3"] + + Output: + GET /foo HTTP/1.1 + my-header2: bar + items: + type: string + maxItems: 16 + type: array + x-kubernetes-list-type: set + set: + description: |- + Set overwrites the request with the given header (name, value) + before the action. + + Input: + GET /foo HTTP/1.1 + my-header: foo + + Config: + set: + - name: "my-header" + value: "bar" + + Output: + GET /foo HTTP/1.1 + my-header: bar + items: + description: HTTPHeader represents an HTTP + Header name and value as defined by RFC + 7230. + properties: + name: + description: |- + Name is the name of the HTTP Header to be matched. Name matching MUST be + case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). + + If multiple entries specify equivalent header names, the first entry with + an equivalent name MUST be considered for a match. Subsequent entries + with an equivalent header name MUST be ignored. Due to the + case-insensitivity of header names, "foo" and "Foo" are considered + equivalent. + maxLength: 256 + minLength: 1 + pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ + type: string + value: + description: Value is the value of HTTP + Header to be matched. + maxLength: 4096 + minLength: 1 + type: string + required: + - name + - value + type: object + maxItems: 16 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + type: object + type: + description: |- + Type identifies the type of filter to apply. As with other API fields, + types are classified into three conformance levels: + + - Core: Filter types and their corresponding configuration defined by + "Support: Core" in this package, e.g. "RequestHeaderModifier". All + implementations must support core filters. + + - Extended: Filter types and their corresponding configuration defined by + "Support: Extended" in this package, e.g. "RequestMirror". Implementers + are encouraged to support extended filters. + + - Implementation-specific: Filters that are defined and supported by + specific vendors. + In the future, filters showing convergence in behavior across multiple + implementations will be considered for inclusion in extended or core + conformance levels. Filter-specific configuration for such filters + is specified using the ExtensionRef field. `Type` should be set to + "ExtensionRef" for custom filters. + + Implementers are encouraged to define custom implementation types to + extend the core API with implementation-specific behavior. + + If a reference to a custom filter type cannot be resolved, the filter + MUST NOT be skipped. Instead, requests that would have been processed by + that filter MUST receive a HTTP error response. + + Note that values may be added to this enum, implementations + must ensure that unknown values will not cause a crash. + + Unknown values here must result in the implementation setting the + Accepted Condition for the Route to `status: False`, with a + Reason of `UnsupportedValue`. + enum: + - RequestHeaderModifier + - ResponseHeaderModifier + - RequestMirror + - RequestRedirect + - URLRewrite + - ExtensionRef + type: string + urlRewrite: + description: |- + URLRewrite defines a schema for a filter that modifies a request during forwarding. + + Support: Extended + properties: + hostname: + description: |- + Hostname is the value to be used to replace the Host header value during + forwarding. + + Support: Extended + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + path: + description: |- + Path defines a path rewrite. + + Support: Extended + properties: + replaceFullPath: + description: |- + ReplaceFullPath specifies the value with which to replace the full path + of a request during a rewrite or redirect. + maxLength: 1024 + type: string + replacePrefixMatch: + description: |- + ReplacePrefixMatch specifies the value with which to replace the prefix + match of a request during a rewrite or redirect. For example, a request + to "/foo/bar" with a prefix match of "/foo" and a ReplacePrefixMatch + of "/xyz" would be modified to "/xyz/bar". + + Note that this matches the behavior of the PathPrefix match type. This + matches full path elements. A path element refers to the list of labels + in the path split by the `/` separator. When specified, a trailing `/` is + ignored. For example, the paths `/abc`, `/abc/`, and `/abc/def` would all + match the prefix `/abc`, but the path `/abcd` would not. + + ReplacePrefixMatch is only compatible with a `PathPrefix` HTTPRouteMatch. + Using any other HTTPRouteMatch type on the same HTTPRouteRule will result in + the implementation setting the Accepted Condition for the Route to `status: False`. + + Request Path | Prefix Match | Replace Prefix | Modified Path + maxLength: 1024 + type: string + type: + description: |- + Type defines the type of path modifier. Additional types may be + added in a future release of the API. + + Note that values may be added to this enum, implementations + must ensure that unknown values will not cause a crash. + + Unknown values here must result in the implementation setting the + Accepted Condition for the Route to `status: False`, with a + Reason of `UnsupportedValue`. + enum: + - ReplaceFullPath + - ReplacePrefixMatch + type: string + required: + - type + type: object + x-kubernetes-validations: + - message: replaceFullPath must be specified + when type is set to 'ReplaceFullPath' + rule: 'self.type == ''ReplaceFullPath'' ? + has(self.replaceFullPath) : true' + - message: type must be 'ReplaceFullPath' when + replaceFullPath is set + rule: 'has(self.replaceFullPath) ? self.type + == ''ReplaceFullPath'' : true' + - message: replacePrefixMatch must be specified + when type is set to 'ReplacePrefixMatch' + rule: 'self.type == ''ReplacePrefixMatch'' + ? has(self.replacePrefixMatch) : true' + - message: type must be 'ReplacePrefixMatch' + when replacePrefixMatch is set + rule: 'has(self.replacePrefixMatch) ? self.type + == ''ReplacePrefixMatch'' : true' + type: object + required: + - type + type: object + x-kubernetes-validations: + - message: filter.requestHeaderModifier must be nil + if the filter.type is not RequestHeaderModifier + rule: '!(has(self.requestHeaderModifier) && self.type + != ''RequestHeaderModifier'')' + - message: filter.requestHeaderModifier must be specified + for RequestHeaderModifier filter.type + rule: '!(!has(self.requestHeaderModifier) && self.type + == ''RequestHeaderModifier'')' + - message: filter.responseHeaderModifier must be nil + if the filter.type is not ResponseHeaderModifier + rule: '!(has(self.responseHeaderModifier) && self.type + != ''ResponseHeaderModifier'')' + - message: filter.responseHeaderModifier must be specified + for ResponseHeaderModifier filter.type + rule: '!(!has(self.responseHeaderModifier) && self.type + == ''ResponseHeaderModifier'')' + - message: filter.requestMirror must be nil if the filter.type + is not RequestMirror + rule: '!(has(self.requestMirror) && self.type != ''RequestMirror'')' + - message: filter.requestMirror must be specified for + RequestMirror filter.type + rule: '!(!has(self.requestMirror) && self.type == + ''RequestMirror'')' + - message: filter.requestRedirect must be nil if the + filter.type is not RequestRedirect + rule: '!(has(self.requestRedirect) && self.type != + ''RequestRedirect'')' + - message: filter.requestRedirect must be specified + for RequestRedirect filter.type + rule: '!(!has(self.requestRedirect) && self.type == + ''RequestRedirect'')' + - message: filter.urlRewrite must be nil if the filter.type + is not URLRewrite + rule: '!(has(self.urlRewrite) && self.type != ''URLRewrite'')' + - message: filter.urlRewrite must be specified for URLRewrite + filter.type + rule: '!(!has(self.urlRewrite) && self.type == ''URLRewrite'')' + - message: filter.extensionRef must be nil if the filter.type + is not ExtensionRef + rule: '!(has(self.extensionRef) && self.type != ''ExtensionRef'')' + - message: filter.extensionRef must be specified for + ExtensionRef filter.type + rule: '!(!has(self.extensionRef) && self.type == ''ExtensionRef'')' + maxItems: 16 + type: array + x-kubernetes-validations: + - message: May specify either httpRouteFilterRequestRedirect + or httpRouteFilterRequestRewrite, but not both + rule: '!(self.exists(f, f.type == ''RequestRedirect'') + && self.exists(f, f.type == ''URLRewrite''))' + - message: May specify either httpRouteFilterRequestRedirect + or httpRouteFilterRequestRewrite, but not both + rule: '!(self.exists(f, f.type == ''RequestRedirect'') + && self.exists(f, f.type == ''URLRewrite''))' + - message: RequestHeaderModifier filter cannot be repeated + rule: self.filter(f, f.type == 'RequestHeaderModifier').size() + <= 1 + - message: ResponseHeaderModifier filter cannot be repeated + rule: self.filter(f, f.type == 'ResponseHeaderModifier').size() + <= 1 + - message: RequestRedirect filter cannot be repeated + rule: self.filter(f, f.type == 'RequestRedirect').size() + <= 1 + - message: URLRewrite filter cannot be repeated + rule: self.filter(f, f.type == 'URLRewrite').size() + <= 1 + group: + default: "" + description: |- + Group is the group of the referent. For example, "gateway.networking.k8s.io". + When unspecified or empty string, core API group is inferred. + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + default: Service + description: |- + Kind is the Kubernetes resource kind of the referent. For example + "Service". + + Defaults to "Service" when not specified. + + ExternalName services can refer to CNAME DNS records that may live + outside of the cluster and as such are difficult to reason about in + terms of conformance. They also may not be safe to forward to (see + CVE-2021-25740 for more information). Implementations SHOULD NOT + support ExternalName Services. + + Support: Core (Services with a type other than ExternalName) + + Support: Implementation-specific (Services with type ExternalName) + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: Name is the name of the referent. + maxLength: 253 + minLength: 1 + type: string + namespace: + description: |- + Namespace is the namespace of the backend. When unspecified, the local + namespace is inferred. + + Note that when a namespace different than the local namespace is specified, + a ReferenceGrant object is required in the referent namespace to allow that + namespace's owner to accept the reference. See the ReferenceGrant + documentation for details. + + Support: Core + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + port: + description: |- + Port specifies the destination port number to use for this resource. + Port is required when the referent is a Kubernetes Service. In this + case, the port number is the service port number, not the target port. + For other resources, destination port might be derived from the referent + resource or this field. + format: int32 + maximum: 65535 + minimum: 1 + type: integer + weight: + default: 1 + description: |- + Weight specifies the proportion of requests forwarded to the referenced + backend. This is computed as weight/(sum of all weights in this + BackendRefs list). For non-zero values, there may be some epsilon from + the exact proportion defined here depending on the precision an + implementation supports. Weight is not a percentage and the sum of + weights does not need to equal 100. + + If only one backend is specified and it has a weight greater than 0, 100% + of the traffic is forwarded to that backend. If weight is set to 0, no + traffic should be forwarded for this entry. If unspecified, weight + defaults to 1. + + Support for this field varies based on the context where used. + format: int32 + maximum: 1000000 + minimum: 0 + type: integer + required: + - name + type: object + x-kubernetes-validations: + - message: Must have port for Service reference + rule: '(size(self.group) == 0 && self.kind == ''Service'') + ? has(self.port) : true' + maxItems: 16 + type: array + filters: + description: |- + Filters define the filters that are applied to requests that match + this rule. + + Wherever possible, implementations SHOULD implement filters in the order + they are specified. + + Implementations MAY choose to implement this ordering strictly, rejecting + any combination or order of filters that can not be supported. If implementations + choose a strict interpretation of filter ordering, they MUST clearly document + that behavior. + + To reject an invalid combination or order of filters, implementations SHOULD + consider the Route Rules with this configuration invalid. If all Route Rules + in a Route are invalid, the entire Route would be considered invalid. If only + a portion of Route Rules are invalid, implementations MUST set the + "PartiallyInvalid" condition for the Route. + + Conformance-levels at this level are defined based on the type of filter: + + - ALL core filters MUST be supported by all implementations. + - Implementers are encouraged to support extended filters. + - Implementation-specific custom filters have no API guarantees across + implementations. + + Specifying the same filter multiple times is not supported unless explicitly + indicated in the filter. + + All filters are expected to be compatible with each other except for the + URLRewrite and RequestRedirect filters, which may not be combined. If an + implementation can not support other combinations of filters, they must clearly + document that limitation. In cases where incompatible or unsupported + filters are specified and cause the `Accepted` condition to be set to status + `False`, implementations may use the `IncompatibleFilters` reason to specify + this configuration error. + + Support: Core + items: + description: |- + HTTPRouteFilter defines processing steps that must be completed during the + request or response lifecycle. HTTPRouteFilters are meant as an extension + point to express processing that may be done in Gateway implementations. Some + examples include request or response modification, implementing + authentication strategies, rate-limiting, and traffic shaping. API + guarantee/conformance is defined based on the type of the filter. + properties: + extensionRef: + description: |- + ExtensionRef is an optional, implementation-specific extension to the + "filter" behavior. For example, resource "myroutefilter" in group + "networking.example.net"). ExtensionRef MUST NOT be used for core and + extended filters. + + This filter can be used multiple times within the same rule. + + Support: Implementation-specific + properties: + group: + description: |- + Group is the group of the referent. For example, "gateway.networking.k8s.io". + When unspecified or empty string, core API group is inferred. + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + description: Kind is kind of the referent. For example + "HTTPRoute" or "Service". + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: Name is the name of the referent. + maxLength: 253 + minLength: 1 + type: string + required: + - group + - kind + - name + type: object + requestHeaderModifier: + description: |- + RequestHeaderModifier defines a schema for a filter that modifies request + headers. + + Support: Core + properties: + add: + description: |- + Add adds the given header(s) (name, value) to the request + before the action. It appends to any existing values associated + with the header name. + + Input: + GET /foo HTTP/1.1 + my-header: foo + + Config: + add: + - name: "my-header" + value: "bar,baz" + + Output: + GET /foo HTTP/1.1 + my-header: foo,bar,baz + items: + description: HTTPHeader represents an HTTP Header + name and value as defined by RFC 7230. + properties: + name: + description: |- + Name is the name of the HTTP Header to be matched. Name matching MUST be + case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). + + If multiple entries specify equivalent header names, the first entry with + an equivalent name MUST be considered for a match. Subsequent entries + with an equivalent header name MUST be ignored. Due to the + case-insensitivity of header names, "foo" and "Foo" are considered + equivalent. + maxLength: 256 + minLength: 1 + pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ + type: string + value: + description: Value is the value of HTTP Header + to be matched. + maxLength: 4096 + minLength: 1 + type: string + required: + - name + - value + type: object + maxItems: 16 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + remove: + description: |- + Remove the given header(s) from the HTTP request before the action. The + value of Remove is a list of HTTP header names. Note that the header + names are case-insensitive (see + https://datatracker.ietf.org/doc/html/rfc2616#section-4.2). + + Input: + GET /foo HTTP/1.1 + my-header1: foo + my-header2: bar + my-header3: baz + + Config: + remove: ["my-header1", "my-header3"] + + Output: + GET /foo HTTP/1.1 + my-header2: bar + items: + type: string + maxItems: 16 + type: array + x-kubernetes-list-type: set + set: + description: |- + Set overwrites the request with the given header (name, value) + before the action. + + Input: + GET /foo HTTP/1.1 + my-header: foo + + Config: + set: + - name: "my-header" + value: "bar" + + Output: + GET /foo HTTP/1.1 + my-header: bar + items: + description: HTTPHeader represents an HTTP Header + name and value as defined by RFC 7230. + properties: + name: + description: |- + Name is the name of the HTTP Header to be matched. Name matching MUST be + case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). + + If multiple entries specify equivalent header names, the first entry with + an equivalent name MUST be considered for a match. Subsequent entries + with an equivalent header name MUST be ignored. Due to the + case-insensitivity of header names, "foo" and "Foo" are considered + equivalent. + maxLength: 256 + minLength: 1 + pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ + type: string + value: + description: Value is the value of HTTP Header + to be matched. + maxLength: 4096 + minLength: 1 + type: string + required: + - name + - value + type: object + maxItems: 16 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + type: object + requestMirror: + description: |+ + RequestMirror defines a schema for a filter that mirrors requests. + Requests are sent to the specified destination, but responses from + that destination are ignored. + + This filter can be used multiple times within the same rule. Note that + not all implementations will be able to support mirroring to multiple + backends. + + Support: Extended + + properties: + backendRef: + description: |- + BackendRef references a resource where mirrored requests are sent. + + Mirrored requests must be sent only to a single destination endpoint + within this BackendRef, irrespective of how many endpoints are present + within this BackendRef. + + If the referent cannot be found, this BackendRef is invalid and must be + dropped from the Gateway. The controller must ensure the "ResolvedRefs" + condition on the Route status is set to `status: False` and not configure + this backend in the underlying implementation. + + If there is a cross-namespace reference to an *existing* object + that is not allowed by a ReferenceGrant, the controller must ensure the + "ResolvedRefs" condition on the Route is set to `status: False`, + with the "RefNotPermitted" reason and not configure this backend in the + underlying implementation. + + In either error case, the Message of the `ResolvedRefs` Condition + should be used to provide more detail about the problem. + + Support: Extended for Kubernetes Service + + Support: Implementation-specific for any other resource + properties: + group: + default: "" + description: |- + Group is the group of the referent. For example, "gateway.networking.k8s.io". + When unspecified or empty string, core API group is inferred. + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + default: Service + description: |- + Kind is the Kubernetes resource kind of the referent. For example + "Service". + + Defaults to "Service" when not specified. + + ExternalName services can refer to CNAME DNS records that may live + outside of the cluster and as such are difficult to reason about in + terms of conformance. They also may not be safe to forward to (see + CVE-2021-25740 for more information). Implementations SHOULD NOT + support ExternalName Services. + + Support: Core (Services with a type other than ExternalName) + + Support: Implementation-specific (Services with type ExternalName) + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: Name is the name of the referent. + maxLength: 253 + minLength: 1 + type: string + namespace: + description: |- + Namespace is the namespace of the backend. When unspecified, the local + namespace is inferred. + + Note that when a namespace different than the local namespace is specified, + a ReferenceGrant object is required in the referent namespace to allow that + namespace's owner to accept the reference. See the ReferenceGrant + documentation for details. + + Support: Core + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + port: + description: |- + Port specifies the destination port number to use for this resource. + Port is required when the referent is a Kubernetes Service. In this + case, the port number is the service port number, not the target port. + For other resources, destination port might be derived from the referent + resource or this field. + format: int32 + maximum: 65535 + minimum: 1 + type: integer + required: + - name + type: object + x-kubernetes-validations: + - message: Must have port for Service reference + rule: '(size(self.group) == 0 && self.kind == ''Service'') + ? has(self.port) : true' + required: + - backendRef + type: object + requestRedirect: + description: |- + RequestRedirect defines a schema for a filter that responds to the + request with an HTTP redirection. + + Support: Core + properties: + hostname: + description: |- + Hostname is the hostname to be used in the value of the `Location` + header in the response. + When empty, the hostname in the `Host` header of the request is used. + + Support: Core + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + path: + description: |- + Path defines parameters used to modify the path of the incoming request. + The modified path is then used to construct the `Location` header. When + empty, the request path is used as-is. + + Support: Extended + properties: + replaceFullPath: + description: |- + ReplaceFullPath specifies the value with which to replace the full path + of a request during a rewrite or redirect. + maxLength: 1024 + type: string + replacePrefixMatch: + description: |- + ReplacePrefixMatch specifies the value with which to replace the prefix + match of a request during a rewrite or redirect. For example, a request + to "/foo/bar" with a prefix match of "/foo" and a ReplacePrefixMatch + of "/xyz" would be modified to "/xyz/bar". + + Note that this matches the behavior of the PathPrefix match type. This + matches full path elements. A path element refers to the list of labels + in the path split by the `/` separator. When specified, a trailing `/` is + ignored. For example, the paths `/abc`, `/abc/`, and `/abc/def` would all + match the prefix `/abc`, but the path `/abcd` would not. + + ReplacePrefixMatch is only compatible with a `PathPrefix` HTTPRouteMatch. + Using any other HTTPRouteMatch type on the same HTTPRouteRule will result in + the implementation setting the Accepted Condition for the Route to `status: False`. + + Request Path | Prefix Match | Replace Prefix | Modified Path + maxLength: 1024 + type: string + type: + description: |- + Type defines the type of path modifier. Additional types may be + added in a future release of the API. + + Note that values may be added to this enum, implementations + must ensure that unknown values will not cause a crash. + + Unknown values here must result in the implementation setting the + Accepted Condition for the Route to `status: False`, with a + Reason of `UnsupportedValue`. + enum: + - ReplaceFullPath + - ReplacePrefixMatch + type: string + required: + - type + type: object + x-kubernetes-validations: + - message: replaceFullPath must be specified when + type is set to 'ReplaceFullPath' + rule: 'self.type == ''ReplaceFullPath'' ? has(self.replaceFullPath) + : true' + - message: type must be 'ReplaceFullPath' when replaceFullPath + is set + rule: 'has(self.replaceFullPath) ? self.type == + ''ReplaceFullPath'' : true' + - message: replacePrefixMatch must be specified when + type is set to 'ReplacePrefixMatch' + rule: 'self.type == ''ReplacePrefixMatch'' ? has(self.replacePrefixMatch) + : true' + - message: type must be 'ReplacePrefixMatch' when + replacePrefixMatch is set + rule: 'has(self.replacePrefixMatch) ? self.type + == ''ReplacePrefixMatch'' : true' + port: + description: |- + Port is the port to be used in the value of the `Location` + header in the response. + + If no port is specified, the redirect port MUST be derived using the + following rules: + + * If redirect scheme is not-empty, the redirect port MUST be the well-known + port associated with the redirect scheme. Specifically "http" to port 80 + and "https" to port 443. If the redirect scheme does not have a + well-known port, the listener port of the Gateway SHOULD be used. + * If redirect scheme is empty, the redirect port MUST be the Gateway + Listener port. + + Implementations SHOULD NOT add the port number in the 'Location' + header in the following cases: + + * A Location header that will use HTTP (whether that is determined via + the Listener protocol or the Scheme field) _and_ use port 80. + * A Location header that will use HTTPS (whether that is determined via + the Listener protocol or the Scheme field) _and_ use port 443. + + Support: Extended + format: int32 + maximum: 65535 + minimum: 1 + type: integer + scheme: + description: |- + Scheme is the scheme to be used in the value of the `Location` header in + the response. When empty, the scheme of the request is used. + + Scheme redirects can affect the port of the redirect, for more information, + refer to the documentation for the port field of this filter. + + Note that values may be added to this enum, implementations + must ensure that unknown values will not cause a crash. + + Unknown values here must result in the implementation setting the + Accepted Condition for the Route to `status: False`, with a + Reason of `UnsupportedValue`. + + Support: Extended + enum: + - http + - https + type: string + statusCode: + default: 302 + description: |- + StatusCode is the HTTP status code to be used in response. + + Note that values may be added to this enum, implementations + must ensure that unknown values will not cause a crash. + + Unknown values here must result in the implementation setting the + Accepted Condition for the Route to `status: False`, with a + Reason of `UnsupportedValue`. + + Support: Core + enum: + - 301 + - 302 + type: integer + type: object + responseHeaderModifier: + description: |- + ResponseHeaderModifier defines a schema for a filter that modifies response + headers. + + Support: Extended + properties: + add: + description: |- + Add adds the given header(s) (name, value) to the request + before the action. It appends to any existing values associated + with the header name. + + Input: + GET /foo HTTP/1.1 + my-header: foo + + Config: + add: + - name: "my-header" + value: "bar,baz" + + Output: + GET /foo HTTP/1.1 + my-header: foo,bar,baz + items: + description: HTTPHeader represents an HTTP Header + name and value as defined by RFC 7230. + properties: + name: + description: |- + Name is the name of the HTTP Header to be matched. Name matching MUST be + case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). + + If multiple entries specify equivalent header names, the first entry with + an equivalent name MUST be considered for a match. Subsequent entries + with an equivalent header name MUST be ignored. Due to the + case-insensitivity of header names, "foo" and "Foo" are considered + equivalent. + maxLength: 256 + minLength: 1 + pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ + type: string + value: + description: Value is the value of HTTP Header + to be matched. + maxLength: 4096 + minLength: 1 + type: string + required: + - name + - value + type: object + maxItems: 16 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + remove: + description: |- + Remove the given header(s) from the HTTP request before the action. The + value of Remove is a list of HTTP header names. Note that the header + names are case-insensitive (see + https://datatracker.ietf.org/doc/html/rfc2616#section-4.2). + + Input: + GET /foo HTTP/1.1 + my-header1: foo + my-header2: bar + my-header3: baz + + Config: + remove: ["my-header1", "my-header3"] + + Output: + GET /foo HTTP/1.1 + my-header2: bar + items: + type: string + maxItems: 16 + type: array + x-kubernetes-list-type: set + set: + description: |- + Set overwrites the request with the given header (name, value) + before the action. + + Input: + GET /foo HTTP/1.1 + my-header: foo + + Config: + set: + - name: "my-header" + value: "bar" + + Output: + GET /foo HTTP/1.1 + my-header: bar + items: + description: HTTPHeader represents an HTTP Header + name and value as defined by RFC 7230. + properties: + name: + description: |- + Name is the name of the HTTP Header to be matched. Name matching MUST be + case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). + + If multiple entries specify equivalent header names, the first entry with + an equivalent name MUST be considered for a match. Subsequent entries + with an equivalent header name MUST be ignored. Due to the + case-insensitivity of header names, "foo" and "Foo" are considered + equivalent. + maxLength: 256 + minLength: 1 + pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ + type: string + value: + description: Value is the value of HTTP Header + to be matched. + maxLength: 4096 + minLength: 1 + type: string + required: + - name + - value + type: object + maxItems: 16 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + type: object + type: + description: |- + Type identifies the type of filter to apply. As with other API fields, + types are classified into three conformance levels: + + - Core: Filter types and their corresponding configuration defined by + "Support: Core" in this package, e.g. "RequestHeaderModifier". All + implementations must support core filters. + + - Extended: Filter types and their corresponding configuration defined by + "Support: Extended" in this package, e.g. "RequestMirror". Implementers + are encouraged to support extended filters. + + - Implementation-specific: Filters that are defined and supported by + specific vendors. + In the future, filters showing convergence in behavior across multiple + implementations will be considered for inclusion in extended or core + conformance levels. Filter-specific configuration for such filters + is specified using the ExtensionRef field. `Type` should be set to + "ExtensionRef" for custom filters. + + Implementers are encouraged to define custom implementation types to + extend the core API with implementation-specific behavior. + + If a reference to a custom filter type cannot be resolved, the filter + MUST NOT be skipped. Instead, requests that would have been processed by + that filter MUST receive a HTTP error response. + + Note that values may be added to this enum, implementations + must ensure that unknown values will not cause a crash. + + Unknown values here must result in the implementation setting the + Accepted Condition for the Route to `status: False`, with a + Reason of `UnsupportedValue`. + enum: + - RequestHeaderModifier + - ResponseHeaderModifier + - RequestMirror + - RequestRedirect + - URLRewrite + - ExtensionRef + type: string + urlRewrite: + description: |- + URLRewrite defines a schema for a filter that modifies a request during forwarding. + + Support: Extended + properties: + hostname: + description: |- + Hostname is the value to be used to replace the Host header value during + forwarding. + + Support: Extended + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + path: + description: |- + Path defines a path rewrite. + + Support: Extended + properties: + replaceFullPath: + description: |- + ReplaceFullPath specifies the value with which to replace the full path + of a request during a rewrite or redirect. + maxLength: 1024 + type: string + replacePrefixMatch: + description: |- + ReplacePrefixMatch specifies the value with which to replace the prefix + match of a request during a rewrite or redirect. For example, a request + to "/foo/bar" with a prefix match of "/foo" and a ReplacePrefixMatch + of "/xyz" would be modified to "/xyz/bar". + + Note that this matches the behavior of the PathPrefix match type. This + matches full path elements. A path element refers to the list of labels + in the path split by the `/` separator. When specified, a trailing `/` is + ignored. For example, the paths `/abc`, `/abc/`, and `/abc/def` would all + match the prefix `/abc`, but the path `/abcd` would not. + + ReplacePrefixMatch is only compatible with a `PathPrefix` HTTPRouteMatch. + Using any other HTTPRouteMatch type on the same HTTPRouteRule will result in + the implementation setting the Accepted Condition for the Route to `status: False`. + + Request Path | Prefix Match | Replace Prefix | Modified Path + maxLength: 1024 + type: string + type: + description: |- + Type defines the type of path modifier. Additional types may be + added in a future release of the API. + + Note that values may be added to this enum, implementations + must ensure that unknown values will not cause a crash. + + Unknown values here must result in the implementation setting the + Accepted Condition for the Route to `status: False`, with a + Reason of `UnsupportedValue`. + enum: + - ReplaceFullPath + - ReplacePrefixMatch + type: string + required: + - type + type: object + x-kubernetes-validations: + - message: replaceFullPath must be specified when + type is set to 'ReplaceFullPath' + rule: 'self.type == ''ReplaceFullPath'' ? has(self.replaceFullPath) + : true' + - message: type must be 'ReplaceFullPath' when replaceFullPath + is set + rule: 'has(self.replaceFullPath) ? self.type == + ''ReplaceFullPath'' : true' + - message: replacePrefixMatch must be specified when + type is set to 'ReplacePrefixMatch' + rule: 'self.type == ''ReplacePrefixMatch'' ? has(self.replacePrefixMatch) + : true' + - message: type must be 'ReplacePrefixMatch' when + replacePrefixMatch is set + rule: 'has(self.replacePrefixMatch) ? self.type + == ''ReplacePrefixMatch'' : true' + type: object + required: + - type + type: object + x-kubernetes-validations: + - message: filter.requestHeaderModifier must be nil if the + filter.type is not RequestHeaderModifier + rule: '!(has(self.requestHeaderModifier) && self.type != + ''RequestHeaderModifier'')' + - message: filter.requestHeaderModifier must be specified + for RequestHeaderModifier filter.type + rule: '!(!has(self.requestHeaderModifier) && self.type == + ''RequestHeaderModifier'')' + - message: filter.responseHeaderModifier must be nil if the + filter.type is not ResponseHeaderModifier + rule: '!(has(self.responseHeaderModifier) && self.type != + ''ResponseHeaderModifier'')' + - message: filter.responseHeaderModifier must be specified + for ResponseHeaderModifier filter.type + rule: '!(!has(self.responseHeaderModifier) && self.type + == ''ResponseHeaderModifier'')' + - message: filter.requestMirror must be nil if the filter.type + is not RequestMirror + rule: '!(has(self.requestMirror) && self.type != ''RequestMirror'')' + - message: filter.requestMirror must be specified for RequestMirror + filter.type + rule: '!(!has(self.requestMirror) && self.type == ''RequestMirror'')' + - message: filter.requestRedirect must be nil if the filter.type + is not RequestRedirect + rule: '!(has(self.requestRedirect) && self.type != ''RequestRedirect'')' + - message: filter.requestRedirect must be specified for RequestRedirect + filter.type + rule: '!(!has(self.requestRedirect) && self.type == ''RequestRedirect'')' + - message: filter.urlRewrite must be nil if the filter.type + is not URLRewrite + rule: '!(has(self.urlRewrite) && self.type != ''URLRewrite'')' + - message: filter.urlRewrite must be specified for URLRewrite + filter.type + rule: '!(!has(self.urlRewrite) && self.type == ''URLRewrite'')' + - message: filter.extensionRef must be nil if the filter.type + is not ExtensionRef + rule: '!(has(self.extensionRef) && self.type != ''ExtensionRef'')' + - message: filter.extensionRef must be specified for ExtensionRef + filter.type + rule: '!(!has(self.extensionRef) && self.type == ''ExtensionRef'')' + maxItems: 16 + type: array + x-kubernetes-validations: + - message: May specify either httpRouteFilterRequestRedirect + or httpRouteFilterRequestRewrite, but not both + rule: '!(self.exists(f, f.type == ''RequestRedirect'') && + self.exists(f, f.type == ''URLRewrite''))' + - message: RequestHeaderModifier filter cannot be repeated + rule: self.filter(f, f.type == 'RequestHeaderModifier').size() + <= 1 + - message: ResponseHeaderModifier filter cannot be repeated + rule: self.filter(f, f.type == 'ResponseHeaderModifier').size() + <= 1 + - message: RequestRedirect filter cannot be repeated + rule: self.filter(f, f.type == 'RequestRedirect').size() <= + 1 + - message: URLRewrite filter cannot be repeated + rule: self.filter(f, f.type == 'URLRewrite').size() <= 1 + matches: + default: + - path: + type: PathPrefix + value: / + description: |- + Matches define conditions used for matching the rule against incoming + HTTP requests. Each match is independent, i.e. this rule will be matched + if **any** one of the matches is satisfied. + + For example, take the following matches configuration: + + ``` + matches: + - path: + value: "/foo" + headers: + - name: "version" + value: "v2" + - path: + value: "/v2/foo" + ``` + + For a request to match against this rule, a request must satisfy + EITHER of the two conditions: + + - path prefixed with `/foo` AND contains the header `version: v2` + - path prefix of `/v2/foo` + + See the documentation for HTTPRouteMatch on how to specify multiple + match conditions that should be ANDed together. + + If no matches are specified, the default is a prefix + path match on "/", which has the effect of matching every + HTTP request. + + Proxy or Load Balancer routing configuration generated from HTTPRoutes + MUST prioritize matches based on the following criteria, continuing on + ties. Across all rules specified on applicable Routes, precedence must be + given to the match having: + + * "Exact" path match. + * "Prefix" path match with largest number of characters. + * Method match. + * Largest number of header matches. + * Largest number of query param matches. + + Note: The precedence of RegularExpression path matches are implementation-specific. + + If ties still exist across multiple Routes, matching precedence MUST be + determined in order of the following criteria, continuing on ties: + + * The oldest Route based on creation timestamp. + * The Route appearing first in alphabetical order by + "{namespace}/{name}". + + If ties still exist within an HTTPRoute, matching precedence MUST be granted + to the FIRST matching rule (in list order) with a match meeting the above + criteria. + + When no rules matching a request have been successfully attached to the + parent a request is coming from, a HTTP 404 status code MUST be returned. + items: + description: "HTTPRouteMatch defines the predicate used to + match requests to a given\naction. Multiple match types + are ANDed together, i.e. the match will\nevaluate to true + only if all conditions are satisfied.\n\nFor example, the + match below will match a HTTP request only if its path\nstarts + with `/foo` AND it contains the `version: v1` header:\n\n```\nmatch:\n\n\tpath:\n\t + \ value: \"/foo\"\n\theaders:\n\t- name: \"version\"\n\t + \ value \"v1\"\n\n```" + properties: + headers: + description: |- + Headers specifies HTTP request header matchers. Multiple match values are + ANDed together, meaning, a request must match all the specified headers + to select the route. + items: + description: |- + HTTPHeaderMatch describes how to select a HTTP route by matching HTTP request + headers. + properties: + name: + description: |- + Name is the name of the HTTP Header to be matched. Name matching MUST be + case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). + + If multiple entries specify equivalent header names, only the first + entry with an equivalent name MUST be considered for a match. Subsequent + entries with an equivalent header name MUST be ignored. Due to the + case-insensitivity of header names, "foo" and "Foo" are considered + equivalent. + + When a header is repeated in an HTTP request, it is + implementation-specific behavior as to how this is represented. + Generally, proxies should follow the guidance from the RFC: + https://www.rfc-editor.org/rfc/rfc7230.html#section-3.2.2 regarding + processing a repeated header, with special handling for "Set-Cookie". + maxLength: 256 + minLength: 1 + pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ + type: string + type: + default: Exact + description: |- + Type specifies how to match against the value of the header. + + Support: Core (Exact) + + Support: Implementation-specific (RegularExpression) + + Since RegularExpression HeaderMatchType has implementation-specific + conformance, implementations can support POSIX, PCRE or any other dialects + of regular expressions. Please read the implementation's documentation to + determine the supported dialect. + enum: + - Exact + - RegularExpression + type: string + value: + description: Value is the value of HTTP Header to + be matched. + maxLength: 4096 + minLength: 1 + type: string + required: + - name + - value + type: object + maxItems: 16 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + method: + description: |- + Method specifies HTTP method matcher. + When specified, this route will be matched only if the request has the + specified method. + + Support: Extended + enum: + - GET + - HEAD + - POST + - PUT + - DELETE + - CONNECT + - OPTIONS + - TRACE + - PATCH + type: string + path: + default: + type: PathPrefix + value: / + description: |- + Path specifies a HTTP request path matcher. If this field is not + specified, a default prefix match on the "/" path is provided. + properties: + type: + default: PathPrefix + description: |- + Type specifies how to match against the path Value. + + Support: Core (Exact, PathPrefix) + + Support: Implementation-specific (RegularExpression) + enum: + - Exact + - PathPrefix + - RegularExpression + type: string + value: + default: / + description: Value of the HTTP path to match against. + maxLength: 1024 + type: string + type: object + x-kubernetes-validations: + - message: value must be an absolute path and start with + '/' when type one of ['Exact', 'PathPrefix'] + rule: '(self.type in [''Exact'',''PathPrefix'']) ? self.value.startsWith(''/'') + : true' + - message: must not contain '//' when type one of ['Exact', + 'PathPrefix'] + rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.contains(''//'') + : true' + - message: must not contain '/./' when type one of ['Exact', + 'PathPrefix'] + rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.contains(''/./'') + : true' + - message: must not contain '/../' when type one of ['Exact', + 'PathPrefix'] + rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.contains(''/../'') + : true' + - message: must not contain '%2f' when type one of ['Exact', + 'PathPrefix'] + rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.contains(''%2f'') + : true' + - message: must not contain '%2F' when type one of ['Exact', + 'PathPrefix'] + rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.contains(''%2F'') + : true' + - message: must not contain '#' when type one of ['Exact', + 'PathPrefix'] + rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.contains(''#'') + : true' + - message: must not end with '/..' when type one of ['Exact', + 'PathPrefix'] + rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.endsWith(''/..'') + : true' + - message: must not end with '/.' when type one of ['Exact', + 'PathPrefix'] + rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.endsWith(''/.'') + : true' + - message: type must be one of ['Exact', 'PathPrefix', + 'RegularExpression'] + rule: self.type in ['Exact','PathPrefix'] || self.type + == 'RegularExpression' + - message: must only contain valid characters (matching + ^(?:[-A-Za-z0-9/._~!$&'()*+,;=:@]|[%][0-9a-fA-F]{2})+$) + for types ['Exact', 'PathPrefix'] + rule: '(self.type in [''Exact'',''PathPrefix'']) ? self.value.matches(r"""^(?:[-A-Za-z0-9/._~!$&''()*+,;=:@]|[%][0-9a-fA-F]{2})+$""") + : true' + queryParams: + description: |- + QueryParams specifies HTTP query parameter matchers. Multiple match + values are ANDed together, meaning, a request must match all the + specified query parameters to select the route. + + Support: Extended + items: + description: |- + HTTPQueryParamMatch describes how to select a HTTP route by matching HTTP + query parameters. + properties: + name: + description: |- + Name is the name of the HTTP query param to be matched. This must be an + exact string match. (See + https://tools.ietf.org/html/rfc7230#section-2.7.3). + + If multiple entries specify equivalent query param names, only the first + entry with an equivalent name MUST be considered for a match. Subsequent + entries with an equivalent query param name MUST be ignored. + + If a query param is repeated in an HTTP request, the behavior is + purposely left undefined, since different data planes have different + capabilities. However, it is *recommended* that implementations should + match against the first value of the param if the data plane supports it, + as this behavior is expected in other load balancing contexts outside of + the Gateway API. + + Users SHOULD NOT route traffic based on repeated query params to guard + themselves against potential differences in the implementations. + maxLength: 256 + minLength: 1 + pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ + type: string + type: + default: Exact + description: |- + Type specifies how to match against the value of the query parameter. + + Support: Extended (Exact) + + Support: Implementation-specific (RegularExpression) + + Since RegularExpression QueryParamMatchType has Implementation-specific + conformance, implementations can support POSIX, PCRE or any other + dialects of regular expressions. Please read the implementation's + documentation to determine the supported dialect. + enum: + - Exact + - RegularExpression + type: string + value: + description: Value is the value of HTTP query param + to be matched. + maxLength: 1024 + minLength: 1 + type: string + required: + - name + - value + type: object + maxItems: 16 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + type: object + maxItems: 64 + type: array + timeouts: + description: |- + Timeouts defines the timeouts that can be configured for an HTTP request. + + Support: Extended + properties: + backendRequest: + description: |- + BackendRequest specifies a timeout for an individual request from the gateway + to a backend. This covers the time from when the request first starts being + sent from the gateway to when the full response has been received from the backend. + + Setting a timeout to the zero duration (e.g. "0s") SHOULD disable the timeout + completely. Implementations that cannot completely disable the timeout MUST + instead interpret the zero duration as the longest possible value to which + the timeout can be set. + + An entire client HTTP transaction with a gateway, covered by the Request timeout, + may result in more than one call from the gateway to the destination backend, + for example, if automatic retries are supported. + + The value of BackendRequest must be a Gateway API Duration string as defined by + GEP-2257. When this field is unspecified, its behavior is implementation-specific; + when specified, the value of BackendRequest must be no more than the value of the + Request timeout (since the Request timeout encompasses the BackendRequest timeout). + + Support: Extended + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string + request: + description: |- + Request specifies the maximum duration for a gateway to respond to an HTTP request. + If the gateway has not been able to respond before this deadline is met, the gateway + MUST return a timeout error. + + For example, setting the `rules.timeouts.request` field to the value `10s` in an + `HTTPRoute` will cause a timeout if a client request is taking longer than 10 seconds + to complete. + + Setting a timeout to the zero duration (e.g. "0s") SHOULD disable the timeout + completely. Implementations that cannot completely disable the timeout MUST + instead interpret the zero duration as the longest possible value to which + the timeout can be set. + + This timeout is intended to cover as close to the whole request-response transaction + as possible although an implementation MAY choose to start the timeout after the entire + request stream has been received instead of immediately after the transaction is + initiated by the client. + + The value of Request is a Gateway API Duration string as defined by GEP-2257. When this + field is unspecified, request timeout behavior is implementation-specific. + + Support: Extended + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string + type: object + x-kubernetes-validations: + - message: backendRequest timeout cannot be longer than request + timeout + rule: '!(has(self.request) && has(self.backendRequest) && + duration(self.request) != duration(''0s'') && duration(self.backendRequest) + > duration(self.request))' + type: object + x-kubernetes-validations: + - message: RequestRedirect filter must not be used together with + backendRefs + rule: '(has(self.backendRefs) && size(self.backendRefs) > 0) ? + (!has(self.filters) || self.filters.all(f, !has(f.requestRedirect))): + true' + - message: When using RequestRedirect filter with path.replacePrefixMatch, + exactly one PathPrefix match must be specified + rule: '(has(self.filters) && self.filters.exists_one(f, has(f.requestRedirect) + && has(f.requestRedirect.path) && f.requestRedirect.path.type + == ''ReplacePrefixMatch'' && has(f.requestRedirect.path.replacePrefixMatch))) + ? ((size(self.matches) != 1 || !has(self.matches[0].path) || + self.matches[0].path.type != ''PathPrefix'') ? false : true) + : true' + - message: When using URLRewrite filter with path.replacePrefixMatch, + exactly one PathPrefix match must be specified + rule: '(has(self.filters) && self.filters.exists_one(f, has(f.urlRewrite) + && has(f.urlRewrite.path) && f.urlRewrite.path.type == ''ReplacePrefixMatch'' + && has(f.urlRewrite.path.replacePrefixMatch))) ? ((size(self.matches) + != 1 || !has(self.matches[0].path) || self.matches[0].path.type + != ''PathPrefix'') ? false : true) : true' + - message: Within backendRefs, when using RequestRedirect filter + with path.replacePrefixMatch, exactly one PathPrefix match must + be specified + rule: '(has(self.backendRefs) && self.backendRefs.exists_one(b, + (has(b.filters) && b.filters.exists_one(f, has(f.requestRedirect) + && has(f.requestRedirect.path) && f.requestRedirect.path.type + == ''ReplacePrefixMatch'' && has(f.requestRedirect.path.replacePrefixMatch))) + )) ? ((size(self.matches) != 1 || !has(self.matches[0].path) + || self.matches[0].path.type != ''PathPrefix'') ? false : true) + : true' + - message: Within backendRefs, When using URLRewrite filter with + path.replacePrefixMatch, exactly one PathPrefix match must be + specified + rule: '(has(self.backendRefs) && self.backendRefs.exists_one(b, + (has(b.filters) && b.filters.exists_one(f, has(f.urlRewrite) + && has(f.urlRewrite.path) && f.urlRewrite.path.type == ''ReplacePrefixMatch'' + && has(f.urlRewrite.path.replacePrefixMatch))) )) ? ((size(self.matches) + != 1 || !has(self.matches[0].path) || self.matches[0].path.type + != ''PathPrefix'') ? false : true) : true' + maxItems: 16 + type: array + x-kubernetes-validations: + - message: While 16 rules and 64 matches per rule are allowed, the + total number of matches across all rules in a route must be less + than 128 + rule: '(self.size() > 0 ? self[0].matches.size() : 0) + (self.size() + > 1 ? self[1].matches.size() : 0) + (self.size() > 2 ? self[2].matches.size() + : 0) + (self.size() > 3 ? self[3].matches.size() : 0) + (self.size() + > 4 ? self[4].matches.size() : 0) + (self.size() > 5 ? self[5].matches.size() + : 0) + (self.size() > 6 ? self[6].matches.size() : 0) + (self.size() + > 7 ? self[7].matches.size() : 0) + (self.size() > 8 ? self[8].matches.size() + : 0) + (self.size() > 9 ? self[9].matches.size() : 0) + (self.size() + > 10 ? self[10].matches.size() : 0) + (self.size() > 11 ? self[11].matches.size() + : 0) + (self.size() > 12 ? self[12].matches.size() : 0) + (self.size() + > 13 ? self[13].matches.size() : 0) + (self.size() > 14 ? self[14].matches.size() + : 0) + (self.size() > 15 ? self[15].matches.size() : 0) <= 128' + type: object + status: + description: Status defines the current state of HTTPRoute. + properties: + parents: + description: |- + Parents is a list of parent resources (usually Gateways) that are + associated with the route, and the status of the route with respect to + each parent. When this route attaches to a parent, the controller that + manages the parent must add an entry to this list when the controller + first sees the route and should update the entry as appropriate when the + route or gateway is modified. + + Note that parent references that cannot be resolved by an implementation + of this API will not be added to this list. Implementations of this API + can only populate Route status for the Gateways/parent resources they are + responsible for. + + A maximum of 32 Gateways will be represented in this list. An empty list + means the route has not been attached to any Gateway. + items: + description: |- + RouteParentStatus describes the status of a route with respect to an + associated Parent. + properties: + conditions: + description: |- + Conditions describes the status of the route with respect to the Gateway. + Note that the route's availability is also subject to the Gateway's own + status conditions and listener status. + + If the Route's ParentRef specifies an existing Gateway that supports + Routes of this kind AND that Gateway's controller has sufficient access, + then that Gateway's controller MUST set the "Accepted" condition on the + Route, to indicate whether the route has been accepted or rejected by the + Gateway, and why. + + A Route MUST be considered "Accepted" if at least one of the Route's + rules is implemented by the Gateway. + + There are a number of cases where the "Accepted" condition may not be set + due to lack of controller visibility, that includes when: + + * The Route refers to a non-existent parent. + * The Route is of a type that the controller does not support. + * The Route is in a namespace the controller does not have access to. + items: + description: Condition contains details for one aspect of + the current state of this API Resource. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, + Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + maxItems: 8 + minItems: 1 + type: array + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + controllerName: + description: |- + ControllerName is a domain/path string that indicates the name of the + controller that wrote this status. This corresponds with the + controllerName field on GatewayClass. + + Example: "example.net/gateway-controller". + + The format of this field is DOMAIN "/" PATH, where DOMAIN and PATH are + valid Kubernetes names + (https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names). + + Controllers MUST populate this field when writing status. Controllers should ensure that + entries to status populated with their ControllerName are cleaned up when they are no + longer necessary. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$ + type: string + parentRef: + description: |- + ParentRef corresponds with a ParentRef in the spec that this + RouteParentStatus struct describes the status of. + properties: + group: + default: gateway.networking.k8s.io + description: |- + Group is the group of the referent. + When unspecified, "gateway.networking.k8s.io" is inferred. + To set the core API group (such as for a "Service" kind referent), + Group must be explicitly set to "" (empty string). + + Support: Core + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + default: Gateway + description: |- + Kind is kind of the referent. + + There are two kinds of parent resources with "Core" support: + + * Gateway (Gateway conformance profile) + * Service (Mesh conformance profile, ClusterIP Services only) + + Support for other resources is Implementation-Specific. + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: |- + Name is the name of the referent. + + Support: Core + maxLength: 253 + minLength: 1 + type: string + namespace: + description: |- + Namespace is the namespace of the referent. When unspecified, this refers + to the local namespace of the Route. + + Note that there are specific rules for ParentRefs which cross namespace + boundaries. Cross-namespace references are only valid if they are explicitly + allowed by something in the namespace they are referring to. For example: + Gateway has the AllowedRoutes field, and ReferenceGrant provides a + generic way to enable any other kind of cross-namespace reference. + + + + Support: Core + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + port: + description: |- + Port is the network port this Route targets. It can be interpreted + differently based on the type of parent resource. + + When the parent resource is a Gateway, this targets all listeners + listening on the specified port that also support this kind of Route(and + select this Route). It's not recommended to set `Port` unless the + networking behaviors specified in a Route must apply to a specific port + as opposed to a listener(s) whose port(s) may be changed. When both Port + and SectionName are specified, the name and port of the selected listener + must match both specified values. + + + + Implementations MAY choose to support other parent resources. + Implementations supporting other types of parent resources MUST clearly + document how/if Port is interpreted. + + For the purpose of status, an attachment is considered successful as + long as the parent resource accepts it partially. For example, Gateway + listeners can restrict which Routes can attach to them by Route kind, + namespace, or hostname. If 1 of 2 Gateway listeners accept attachment + from the referencing Route, the Route MUST be considered successfully + attached. If no Gateway listeners accept attachment from this Route, + the Route MUST be considered detached from the Gateway. + + Support: Extended + format: int32 + maximum: 65535 + minimum: 1 + type: integer + sectionName: + description: |- + SectionName is the name of a section within the target resource. In the + following resources, SectionName is interpreted as the following: + + * Gateway: Listener name. When both Port (experimental) and SectionName + are specified, the name and port of the selected listener must match + both specified values. + * Service: Port name. When both Port (experimental) and SectionName + are specified, the name and port of the selected listener must match + both specified values. + + Implementations MAY choose to support attaching Routes to other resources. + If that is the case, they MUST clearly document how SectionName is + interpreted. + + When unspecified (empty string), this will reference the entire resource. + For the purpose of status, an attachment is considered successful if at + least one section in the parent resource accepts it. For example, Gateway + listeners can restrict which Routes can attach to them by Route kind, + namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from + the referencing Route, the Route MUST be considered successfully + attached. If no Gateway listeners accept attachment from this Route, the + Route MUST be considered detached from the Gateway. + + Support: Core + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + required: + - name + type: object + required: + - controllerName + - parentRef + type: object + maxItems: 32 + type: array + required: + - parents + type: object + required: + - spec + type: object + served: true + storage: true + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .spec.hostnames + name: Hostnames + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1beta1 + schema: + openAPIV3Schema: + description: |- + HTTPRoute provides a way to route HTTP requests. This includes the capability + to match requests by hostname, path, header, or query param. Filters can be + used to specify additional processing steps. Backends specify where matching + requests should be routed. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: Spec defines the desired state of HTTPRoute. + properties: + hostnames: + description: |- + Hostnames defines a set of hostnames that should match against the HTTP Host + header to select a HTTPRoute used to process the request. Implementations + MUST ignore any port value specified in the HTTP Host header while + performing a match and (absent of any applicable header modification + configuration) MUST forward this header unmodified to the backend. + + Valid values for Hostnames are determined by RFC 1123 definition of a + hostname with 2 notable exceptions: + + 1. IPs are not allowed. + 2. A hostname may be prefixed with a wildcard label (`*.`). The wildcard + label must appear by itself as the first label. + + If a hostname is specified by both the Listener and HTTPRoute, there + must be at least one intersecting hostname for the HTTPRoute to be + attached to the Listener. For example: + + * A Listener with `test.example.com` as the hostname matches HTTPRoutes + that have either not specified any hostnames, or have specified at + least one of `test.example.com` or `*.example.com`. + * A Listener with `*.example.com` as the hostname matches HTTPRoutes + that have either not specified any hostnames or have specified at least + one hostname that matches the Listener hostname. For example, + `*.example.com`, `test.example.com`, and `foo.test.example.com` would + all match. On the other hand, `example.com` and `test.example.net` would + not match. + + Hostnames that are prefixed with a wildcard label (`*.`) are interpreted + as a suffix match. That means that a match for `*.example.com` would match + both `test.example.com`, and `foo.test.example.com`, but not `example.com`. + + If both the Listener and HTTPRoute have specified hostnames, any + HTTPRoute hostnames that do not match the Listener hostname MUST be + ignored. For example, if a Listener specified `*.example.com`, and the + HTTPRoute specified `test.example.com` and `test.example.net`, + `test.example.net` must not be considered for a match. + + If both the Listener and HTTPRoute have specified hostnames, and none + match with the criteria above, then the HTTPRoute is not accepted. The + implementation must raise an 'Accepted' Condition with a status of + `False` in the corresponding RouteParentStatus. + + In the event that multiple HTTPRoutes specify intersecting hostnames (e.g. + overlapping wildcard matching and exact matching hostnames), precedence must + be given to rules from the HTTPRoute with the largest number of: + + * Characters in a matching non-wildcard hostname. + * Characters in a matching hostname. + + If ties exist across multiple Routes, the matching precedence rules for + HTTPRouteMatches takes over. + + Support: Core + items: + description: |- + Hostname is the fully qualified domain name of a network host. This matches + the RFC 1123 definition of a hostname with 2 notable exceptions: + + 1. IPs are not allowed. + 2. A hostname may be prefixed with a wildcard label (`*.`). The wildcard + label must appear by itself as the first label. + + Hostname can be "precise" which is a domain name without the terminating + dot of a network host (e.g. "foo.example.com") or "wildcard", which is a + domain name prefixed with a single wildcard label (e.g. `*.example.com`). + + Note that as per RFC1035 and RFC1123, a *label* must consist of lower case + alphanumeric characters or '-', and must start and end with an alphanumeric + character. No other punctuation is allowed. + maxLength: 253 + minLength: 1 + pattern: ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + maxItems: 16 + type: array + parentRefs: + description: |+ + ParentRefs references the resources (usually Gateways) that a Route wants + to be attached to. Note that the referenced parent resource needs to + allow this for the attachment to be complete. For Gateways, that means + the Gateway needs to allow attachment from Routes of this kind and + namespace. For Services, that means the Service must either be in the same + namespace for a "producer" route, or the mesh implementation must support + and allow "consumer" routes for the referenced Service. ReferenceGrant is + not applicable for governing ParentRefs to Services - it is not possible to + create a "producer" route for a Service in a different namespace from the + Route. + + There are two kinds of parent resources with "Core" support: + + * Gateway (Gateway conformance profile) + * Service (Mesh conformance profile, ClusterIP Services only) + + This API may be extended in the future to support additional kinds of parent + resources. + + ParentRefs must be _distinct_. This means either that: + + * They select different objects. If this is the case, then parentRef + entries are distinct. In terms of fields, this means that the + multi-part key defined by `group`, `kind`, `namespace`, and `name` must + be unique across all parentRef entries in the Route. + * They do not select different objects, but for each optional field used, + each ParentRef that selects the same object must set the same set of + optional fields to different values. If one ParentRef sets a + combination of optional fields, all must set the same combination. + + Some examples: + + * If one ParentRef sets `sectionName`, all ParentRefs referencing the + same object must also set `sectionName`. + * If one ParentRef sets `port`, all ParentRefs referencing the same + object must also set `port`. + * If one ParentRef sets `sectionName` and `port`, all ParentRefs + referencing the same object must also set `sectionName` and `port`. + + It is possible to separately reference multiple distinct objects that may + be collapsed by an implementation. For example, some implementations may + choose to merge compatible Gateway Listeners together. If that is the + case, the list of routes attached to those resources should also be + merged. + + Note that for ParentRefs that cross namespace boundaries, there are specific + rules. Cross-namespace references are only valid if they are explicitly + allowed by something in the namespace they are referring to. For example, + Gateway has the AllowedRoutes field, and ReferenceGrant provides a + generic way to enable other kinds of cross-namespace reference. + + + + + + + items: + description: |- + ParentReference identifies an API object (usually a Gateway) that can be considered + a parent of this resource (usually a route). There are two kinds of parent resources + with "Core" support: + + * Gateway (Gateway conformance profile) + * Service (Mesh conformance profile, ClusterIP Services only) + + This API may be extended in the future to support additional kinds of parent + resources. + + The API object must be valid in the cluster; the Group and Kind must + be registered in the cluster for this reference to be valid. + properties: + group: + default: gateway.networking.k8s.io + description: |- + Group is the group of the referent. + When unspecified, "gateway.networking.k8s.io" is inferred. + To set the core API group (such as for a "Service" kind referent), + Group must be explicitly set to "" (empty string). + + Support: Core + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + default: Gateway + description: |- + Kind is kind of the referent. + + There are two kinds of parent resources with "Core" support: + + * Gateway (Gateway conformance profile) + * Service (Mesh conformance profile, ClusterIP Services only) + + Support for other resources is Implementation-Specific. + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: |- + Name is the name of the referent. + + Support: Core + maxLength: 253 + minLength: 1 + type: string + namespace: + description: |- + Namespace is the namespace of the referent. When unspecified, this refers + to the local namespace of the Route. + + Note that there are specific rules for ParentRefs which cross namespace + boundaries. Cross-namespace references are only valid if they are explicitly + allowed by something in the namespace they are referring to. For example: + Gateway has the AllowedRoutes field, and ReferenceGrant provides a + generic way to enable any other kind of cross-namespace reference. + + + + Support: Core + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + port: + description: |- + Port is the network port this Route targets. It can be interpreted + differently based on the type of parent resource. + + When the parent resource is a Gateway, this targets all listeners + listening on the specified port that also support this kind of Route(and + select this Route). It's not recommended to set `Port` unless the + networking behaviors specified in a Route must apply to a specific port + as opposed to a listener(s) whose port(s) may be changed. When both Port + and SectionName are specified, the name and port of the selected listener + must match both specified values. + + + + Implementations MAY choose to support other parent resources. + Implementations supporting other types of parent resources MUST clearly + document how/if Port is interpreted. + + For the purpose of status, an attachment is considered successful as + long as the parent resource accepts it partially. For example, Gateway + listeners can restrict which Routes can attach to them by Route kind, + namespace, or hostname. If 1 of 2 Gateway listeners accept attachment + from the referencing Route, the Route MUST be considered successfully + attached. If no Gateway listeners accept attachment from this Route, + the Route MUST be considered detached from the Gateway. + + Support: Extended + format: int32 + maximum: 65535 + minimum: 1 + type: integer + sectionName: + description: |- + SectionName is the name of a section within the target resource. In the + following resources, SectionName is interpreted as the following: + + * Gateway: Listener name. When both Port (experimental) and SectionName + are specified, the name and port of the selected listener must match + both specified values. + * Service: Port name. When both Port (experimental) and SectionName + are specified, the name and port of the selected listener must match + both specified values. + + Implementations MAY choose to support attaching Routes to other resources. + If that is the case, they MUST clearly document how SectionName is + interpreted. + + When unspecified (empty string), this will reference the entire resource. + For the purpose of status, an attachment is considered successful if at + least one section in the parent resource accepts it. For example, Gateway + listeners can restrict which Routes can attach to them by Route kind, + namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from + the referencing Route, the Route MUST be considered successfully + attached. If no Gateway listeners accept attachment from this Route, the + Route MUST be considered detached from the Gateway. + + Support: Core + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + required: + - name + type: object + maxItems: 32 + type: array + x-kubernetes-validations: + - message: sectionName must be specified when parentRefs includes + 2 or more references to the same parent + rule: 'self.all(p1, self.all(p2, p1.group == p2.group && p1.kind + == p2.kind && p1.name == p2.name && (((!has(p1.__namespace__) + || p1.__namespace__ == '''') && (!has(p2.__namespace__) || p2.__namespace__ + == '''')) || (has(p1.__namespace__) && has(p2.__namespace__) && + p1.__namespace__ == p2.__namespace__ )) ? ((!has(p1.sectionName) + || p1.sectionName == '''') == (!has(p2.sectionName) || p2.sectionName + == '''')) : true))' + - message: sectionName must be unique when parentRefs includes 2 or + more references to the same parent + rule: self.all(p1, self.exists_one(p2, p1.group == p2.group && p1.kind + == p2.kind && p1.name == p2.name && (((!has(p1.__namespace__) + || p1.__namespace__ == '') && (!has(p2.__namespace__) || p2.__namespace__ + == '')) || (has(p1.__namespace__) && has(p2.__namespace__) && + p1.__namespace__ == p2.__namespace__ )) && (((!has(p1.sectionName) + || p1.sectionName == '') && (!has(p2.sectionName) || p2.sectionName + == '')) || (has(p1.sectionName) && has(p2.sectionName) && p1.sectionName + == p2.sectionName)))) + rules: + default: + - matches: + - path: + type: PathPrefix + value: / + description: |+ + Rules are a list of HTTP matchers, filters and actions. + + items: + description: |- + HTTPRouteRule defines semantics for matching an HTTP request based on + conditions (matches), processing it (filters), and forwarding the request to + an API object (backendRefs). + properties: + backendRefs: + description: |- + BackendRefs defines the backend(s) where matching requests should be + sent. + + Failure behavior here depends on how many BackendRefs are specified and + how many are invalid. + + If *all* entries in BackendRefs are invalid, and there are also no filters + specified in this route rule, *all* traffic which matches this rule MUST + receive a 500 status code. + + See the HTTPBackendRef definition for the rules about what makes a single + HTTPBackendRef invalid. + + When a HTTPBackendRef is invalid, 500 status codes MUST be returned for + requests that would have otherwise been routed to an invalid backend. If + multiple backends are specified, and some are invalid, the proportion of + requests that would otherwise have been routed to an invalid backend + MUST receive a 500 status code. + + For example, if two backends are specified with equal weights, and one is + invalid, 50 percent of traffic must receive a 500. Implementations may + choose how that 50 percent is determined. + + When a HTTPBackendRef refers to a Service that has no ready endpoints, + implementations SHOULD return a 503 for requests to that backend instead. + If an implementation chooses to do this, all of the above rules for 500 responses + MUST also apply for responses that return a 503. + + Support: Core for Kubernetes Service + + Support: Extended for Kubernetes ServiceImport + + Support: Implementation-specific for any other resource + + Support for weight: Core + items: + description: |- + HTTPBackendRef defines how a HTTPRoute forwards a HTTP request. + + Note that when a namespace different than the local namespace is specified, a + ReferenceGrant object is required in the referent namespace to allow that + namespace's owner to accept the reference. See the ReferenceGrant + documentation for details. + + + + When the BackendRef points to a Kubernetes Service, implementations SHOULD + honor the appProtocol field if it is set for the target Service Port. + + Implementations supporting appProtocol SHOULD recognize the Kubernetes + Standard Application Protocols defined in KEP-3726. + + If a Service appProtocol isn't specified, an implementation MAY infer the + backend protocol through its own means. Implementations MAY infer the + protocol from the Route type referring to the backend Service. + + If a Route is not able to send traffic to the backend using the specified + protocol then the backend is considered invalid. Implementations MUST set the + "ResolvedRefs" condition to "False" with the "UnsupportedProtocol" reason. + + + properties: + filters: + description: |- + Filters defined at this level should be executed if and only if the + request is being forwarded to the backend defined here. + + Support: Implementation-specific (For broader support of filters, use the + Filters field in HTTPRouteRule.) + items: + description: |- + HTTPRouteFilter defines processing steps that must be completed during the + request or response lifecycle. HTTPRouteFilters are meant as an extension + point to express processing that may be done in Gateway implementations. Some + examples include request or response modification, implementing + authentication strategies, rate-limiting, and traffic shaping. API + guarantee/conformance is defined based on the type of the filter. + properties: + extensionRef: + description: |- + ExtensionRef is an optional, implementation-specific extension to the + "filter" behavior. For example, resource "myroutefilter" in group + "networking.example.net"). ExtensionRef MUST NOT be used for core and + extended filters. + + This filter can be used multiple times within the same rule. + + Support: Implementation-specific + properties: + group: + description: |- + Group is the group of the referent. For example, "gateway.networking.k8s.io". + When unspecified or empty string, core API group is inferred. + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + description: Kind is kind of the referent. For + example "HTTPRoute" or "Service". + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: Name is the name of the referent. + maxLength: 253 + minLength: 1 + type: string + required: + - group + - kind + - name + type: object + requestHeaderModifier: + description: |- + RequestHeaderModifier defines a schema for a filter that modifies request + headers. + + Support: Core + properties: + add: + description: |- + Add adds the given header(s) (name, value) to the request + before the action. It appends to any existing values associated + with the header name. + + Input: + GET /foo HTTP/1.1 + my-header: foo + + Config: + add: + - name: "my-header" + value: "bar,baz" + + Output: + GET /foo HTTP/1.1 + my-header: foo,bar,baz + items: + description: HTTPHeader represents an HTTP + Header name and value as defined by RFC + 7230. + properties: + name: + description: |- + Name is the name of the HTTP Header to be matched. Name matching MUST be + case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). + + If multiple entries specify equivalent header names, the first entry with + an equivalent name MUST be considered for a match. Subsequent entries + with an equivalent header name MUST be ignored. Due to the + case-insensitivity of header names, "foo" and "Foo" are considered + equivalent. + maxLength: 256 + minLength: 1 + pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ + type: string + value: + description: Value is the value of HTTP + Header to be matched. + maxLength: 4096 + minLength: 1 + type: string + required: + - name + - value + type: object + maxItems: 16 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + remove: + description: |- + Remove the given header(s) from the HTTP request before the action. The + value of Remove is a list of HTTP header names. Note that the header + names are case-insensitive (see + https://datatracker.ietf.org/doc/html/rfc2616#section-4.2). + + Input: + GET /foo HTTP/1.1 + my-header1: foo + my-header2: bar + my-header3: baz + + Config: + remove: ["my-header1", "my-header3"] + + Output: + GET /foo HTTP/1.1 + my-header2: bar + items: + type: string + maxItems: 16 + type: array + x-kubernetes-list-type: set + set: + description: |- + Set overwrites the request with the given header (name, value) + before the action. + + Input: + GET /foo HTTP/1.1 + my-header: foo + + Config: + set: + - name: "my-header" + value: "bar" + + Output: + GET /foo HTTP/1.1 + my-header: bar + items: + description: HTTPHeader represents an HTTP + Header name and value as defined by RFC + 7230. + properties: + name: + description: |- + Name is the name of the HTTP Header to be matched. Name matching MUST be + case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). + + If multiple entries specify equivalent header names, the first entry with + an equivalent name MUST be considered for a match. Subsequent entries + with an equivalent header name MUST be ignored. Due to the + case-insensitivity of header names, "foo" and "Foo" are considered + equivalent. + maxLength: 256 + minLength: 1 + pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ + type: string + value: + description: Value is the value of HTTP + Header to be matched. + maxLength: 4096 + minLength: 1 + type: string + required: + - name + - value + type: object + maxItems: 16 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + type: object + requestMirror: + description: |+ + RequestMirror defines a schema for a filter that mirrors requests. + Requests are sent to the specified destination, but responses from + that destination are ignored. + + This filter can be used multiple times within the same rule. Note that + not all implementations will be able to support mirroring to multiple + backends. + + Support: Extended + + properties: + backendRef: + description: |- + BackendRef references a resource where mirrored requests are sent. + + Mirrored requests must be sent only to a single destination endpoint + within this BackendRef, irrespective of how many endpoints are present + within this BackendRef. + + If the referent cannot be found, this BackendRef is invalid and must be + dropped from the Gateway. The controller must ensure the "ResolvedRefs" + condition on the Route status is set to `status: False` and not configure + this backend in the underlying implementation. + + If there is a cross-namespace reference to an *existing* object + that is not allowed by a ReferenceGrant, the controller must ensure the + "ResolvedRefs" condition on the Route is set to `status: False`, + with the "RefNotPermitted" reason and not configure this backend in the + underlying implementation. + + In either error case, the Message of the `ResolvedRefs` Condition + should be used to provide more detail about the problem. + + Support: Extended for Kubernetes Service + + Support: Implementation-specific for any other resource + properties: + group: + default: "" + description: |- + Group is the group of the referent. For example, "gateway.networking.k8s.io". + When unspecified or empty string, core API group is inferred. + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + default: Service + description: |- + Kind is the Kubernetes resource kind of the referent. For example + "Service". + + Defaults to "Service" when not specified. + + ExternalName services can refer to CNAME DNS records that may live + outside of the cluster and as such are difficult to reason about in + terms of conformance. They also may not be safe to forward to (see + CVE-2021-25740 for more information). Implementations SHOULD NOT + support ExternalName Services. + + Support: Core (Services with a type other than ExternalName) + + Support: Implementation-specific (Services with type ExternalName) + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: Name is the name of the referent. + maxLength: 253 + minLength: 1 + type: string + namespace: + description: |- + Namespace is the namespace of the backend. When unspecified, the local + namespace is inferred. + + Note that when a namespace different than the local namespace is specified, + a ReferenceGrant object is required in the referent namespace to allow that + namespace's owner to accept the reference. See the ReferenceGrant + documentation for details. + + Support: Core + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + port: + description: |- + Port specifies the destination port number to use for this resource. + Port is required when the referent is a Kubernetes Service. In this + case, the port number is the service port number, not the target port. + For other resources, destination port might be derived from the referent + resource or this field. + format: int32 + maximum: 65535 + minimum: 1 + type: integer + required: + - name + type: object + x-kubernetes-validations: + - message: Must have port for Service reference + rule: '(size(self.group) == 0 && self.kind + == ''Service'') ? has(self.port) : true' + required: + - backendRef + type: object + requestRedirect: + description: |- + RequestRedirect defines a schema for a filter that responds to the + request with an HTTP redirection. + + Support: Core + properties: + hostname: + description: |- + Hostname is the hostname to be used in the value of the `Location` + header in the response. + When empty, the hostname in the `Host` header of the request is used. + + Support: Core + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + path: + description: |- + Path defines parameters used to modify the path of the incoming request. + The modified path is then used to construct the `Location` header. When + empty, the request path is used as-is. + + Support: Extended + properties: + replaceFullPath: + description: |- + ReplaceFullPath specifies the value with which to replace the full path + of a request during a rewrite or redirect. + maxLength: 1024 + type: string + replacePrefixMatch: + description: |- + ReplacePrefixMatch specifies the value with which to replace the prefix + match of a request during a rewrite or redirect. For example, a request + to "/foo/bar" with a prefix match of "/foo" and a ReplacePrefixMatch + of "/xyz" would be modified to "/xyz/bar". + + Note that this matches the behavior of the PathPrefix match type. This + matches full path elements. A path element refers to the list of labels + in the path split by the `/` separator. When specified, a trailing `/` is + ignored. For example, the paths `/abc`, `/abc/`, and `/abc/def` would all + match the prefix `/abc`, but the path `/abcd` would not. + + ReplacePrefixMatch is only compatible with a `PathPrefix` HTTPRouteMatch. + Using any other HTTPRouteMatch type on the same HTTPRouteRule will result in + the implementation setting the Accepted Condition for the Route to `status: False`. + + Request Path | Prefix Match | Replace Prefix | Modified Path + maxLength: 1024 + type: string + type: + description: |- + Type defines the type of path modifier. Additional types may be + added in a future release of the API. + + Note that values may be added to this enum, implementations + must ensure that unknown values will not cause a crash. + + Unknown values here must result in the implementation setting the + Accepted Condition for the Route to `status: False`, with a + Reason of `UnsupportedValue`. + enum: + - ReplaceFullPath + - ReplacePrefixMatch + type: string + required: + - type + type: object + x-kubernetes-validations: + - message: replaceFullPath must be specified + when type is set to 'ReplaceFullPath' + rule: 'self.type == ''ReplaceFullPath'' ? + has(self.replaceFullPath) : true' + - message: type must be 'ReplaceFullPath' when + replaceFullPath is set + rule: 'has(self.replaceFullPath) ? self.type + == ''ReplaceFullPath'' : true' + - message: replacePrefixMatch must be specified + when type is set to 'ReplacePrefixMatch' + rule: 'self.type == ''ReplacePrefixMatch'' + ? has(self.replacePrefixMatch) : true' + - message: type must be 'ReplacePrefixMatch' + when replacePrefixMatch is set + rule: 'has(self.replacePrefixMatch) ? self.type + == ''ReplacePrefixMatch'' : true' + port: + description: |- + Port is the port to be used in the value of the `Location` + header in the response. + + If no port is specified, the redirect port MUST be derived using the + following rules: + + * If redirect scheme is not-empty, the redirect port MUST be the well-known + port associated with the redirect scheme. Specifically "http" to port 80 + and "https" to port 443. If the redirect scheme does not have a + well-known port, the listener port of the Gateway SHOULD be used. + * If redirect scheme is empty, the redirect port MUST be the Gateway + Listener port. + + Implementations SHOULD NOT add the port number in the 'Location' + header in the following cases: + + * A Location header that will use HTTP (whether that is determined via + the Listener protocol or the Scheme field) _and_ use port 80. + * A Location header that will use HTTPS (whether that is determined via + the Listener protocol or the Scheme field) _and_ use port 443. + + Support: Extended + format: int32 + maximum: 65535 + minimum: 1 + type: integer + scheme: + description: |- + Scheme is the scheme to be used in the value of the `Location` header in + the response. When empty, the scheme of the request is used. + + Scheme redirects can affect the port of the redirect, for more information, + refer to the documentation for the port field of this filter. + + Note that values may be added to this enum, implementations + must ensure that unknown values will not cause a crash. + + Unknown values here must result in the implementation setting the + Accepted Condition for the Route to `status: False`, with a + Reason of `UnsupportedValue`. + + Support: Extended + enum: + - http + - https + type: string + statusCode: + default: 302 + description: |- + StatusCode is the HTTP status code to be used in response. + + Note that values may be added to this enum, implementations + must ensure that unknown values will not cause a crash. + + Unknown values here must result in the implementation setting the + Accepted Condition for the Route to `status: False`, with a + Reason of `UnsupportedValue`. + + Support: Core + enum: + - 301 + - 302 + type: integer + type: object + responseHeaderModifier: + description: |- + ResponseHeaderModifier defines a schema for a filter that modifies response + headers. + + Support: Extended + properties: + add: + description: |- + Add adds the given header(s) (name, value) to the request + before the action. It appends to any existing values associated + with the header name. + + Input: + GET /foo HTTP/1.1 + my-header: foo + + Config: + add: + - name: "my-header" + value: "bar,baz" + + Output: + GET /foo HTTP/1.1 + my-header: foo,bar,baz + items: + description: HTTPHeader represents an HTTP + Header name and value as defined by RFC + 7230. + properties: + name: + description: |- + Name is the name of the HTTP Header to be matched. Name matching MUST be + case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). + + If multiple entries specify equivalent header names, the first entry with + an equivalent name MUST be considered for a match. Subsequent entries + with an equivalent header name MUST be ignored. Due to the + case-insensitivity of header names, "foo" and "Foo" are considered + equivalent. + maxLength: 256 + minLength: 1 + pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ + type: string + value: + description: Value is the value of HTTP + Header to be matched. + maxLength: 4096 + minLength: 1 + type: string + required: + - name + - value + type: object + maxItems: 16 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + remove: + description: |- + Remove the given header(s) from the HTTP request before the action. The + value of Remove is a list of HTTP header names. Note that the header + names are case-insensitive (see + https://datatracker.ietf.org/doc/html/rfc2616#section-4.2). + + Input: + GET /foo HTTP/1.1 + my-header1: foo + my-header2: bar + my-header3: baz + + Config: + remove: ["my-header1", "my-header3"] + + Output: + GET /foo HTTP/1.1 + my-header2: bar + items: + type: string + maxItems: 16 + type: array + x-kubernetes-list-type: set + set: + description: |- + Set overwrites the request with the given header (name, value) + before the action. + + Input: + GET /foo HTTP/1.1 + my-header: foo + + Config: + set: + - name: "my-header" + value: "bar" + + Output: + GET /foo HTTP/1.1 + my-header: bar + items: + description: HTTPHeader represents an HTTP + Header name and value as defined by RFC + 7230. + properties: + name: + description: |- + Name is the name of the HTTP Header to be matched. Name matching MUST be + case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). + + If multiple entries specify equivalent header names, the first entry with + an equivalent name MUST be considered for a match. Subsequent entries + with an equivalent header name MUST be ignored. Due to the + case-insensitivity of header names, "foo" and "Foo" are considered + equivalent. + maxLength: 256 + minLength: 1 + pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ + type: string + value: + description: Value is the value of HTTP + Header to be matched. + maxLength: 4096 + minLength: 1 + type: string + required: + - name + - value + type: object + maxItems: 16 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + type: object + type: + description: |- + Type identifies the type of filter to apply. As with other API fields, + types are classified into three conformance levels: + + - Core: Filter types and their corresponding configuration defined by + "Support: Core" in this package, e.g. "RequestHeaderModifier". All + implementations must support core filters. + + - Extended: Filter types and their corresponding configuration defined by + "Support: Extended" in this package, e.g. "RequestMirror". Implementers + are encouraged to support extended filters. + + - Implementation-specific: Filters that are defined and supported by + specific vendors. + In the future, filters showing convergence in behavior across multiple + implementations will be considered for inclusion in extended or core + conformance levels. Filter-specific configuration for such filters + is specified using the ExtensionRef field. `Type` should be set to + "ExtensionRef" for custom filters. + + Implementers are encouraged to define custom implementation types to + extend the core API with implementation-specific behavior. + + If a reference to a custom filter type cannot be resolved, the filter + MUST NOT be skipped. Instead, requests that would have been processed by + that filter MUST receive a HTTP error response. + + Note that values may be added to this enum, implementations + must ensure that unknown values will not cause a crash. + + Unknown values here must result in the implementation setting the + Accepted Condition for the Route to `status: False`, with a + Reason of `UnsupportedValue`. + enum: + - RequestHeaderModifier + - ResponseHeaderModifier + - RequestMirror + - RequestRedirect + - URLRewrite + - ExtensionRef + type: string + urlRewrite: + description: |- + URLRewrite defines a schema for a filter that modifies a request during forwarding. + + Support: Extended + properties: + hostname: + description: |- + Hostname is the value to be used to replace the Host header value during + forwarding. + + Support: Extended + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + path: + description: |- + Path defines a path rewrite. + + Support: Extended + properties: + replaceFullPath: + description: |- + ReplaceFullPath specifies the value with which to replace the full path + of a request during a rewrite or redirect. + maxLength: 1024 + type: string + replacePrefixMatch: + description: |- + ReplacePrefixMatch specifies the value with which to replace the prefix + match of a request during a rewrite or redirect. For example, a request + to "/foo/bar" with a prefix match of "/foo" and a ReplacePrefixMatch + of "/xyz" would be modified to "/xyz/bar". + + Note that this matches the behavior of the PathPrefix match type. This + matches full path elements. A path element refers to the list of labels + in the path split by the `/` separator. When specified, a trailing `/` is + ignored. For example, the paths `/abc`, `/abc/`, and `/abc/def` would all + match the prefix `/abc`, but the path `/abcd` would not. + + ReplacePrefixMatch is only compatible with a `PathPrefix` HTTPRouteMatch. + Using any other HTTPRouteMatch type on the same HTTPRouteRule will result in + the implementation setting the Accepted Condition for the Route to `status: False`. + + Request Path | Prefix Match | Replace Prefix | Modified Path + maxLength: 1024 + type: string + type: + description: |- + Type defines the type of path modifier. Additional types may be + added in a future release of the API. + + Note that values may be added to this enum, implementations + must ensure that unknown values will not cause a crash. + + Unknown values here must result in the implementation setting the + Accepted Condition for the Route to `status: False`, with a + Reason of `UnsupportedValue`. + enum: + - ReplaceFullPath + - ReplacePrefixMatch + type: string + required: + - type + type: object + x-kubernetes-validations: + - message: replaceFullPath must be specified + when type is set to 'ReplaceFullPath' + rule: 'self.type == ''ReplaceFullPath'' ? + has(self.replaceFullPath) : true' + - message: type must be 'ReplaceFullPath' when + replaceFullPath is set + rule: 'has(self.replaceFullPath) ? self.type + == ''ReplaceFullPath'' : true' + - message: replacePrefixMatch must be specified + when type is set to 'ReplacePrefixMatch' + rule: 'self.type == ''ReplacePrefixMatch'' + ? has(self.replacePrefixMatch) : true' + - message: type must be 'ReplacePrefixMatch' + when replacePrefixMatch is set + rule: 'has(self.replacePrefixMatch) ? self.type + == ''ReplacePrefixMatch'' : true' + type: object + required: + - type + type: object + x-kubernetes-validations: + - message: filter.requestHeaderModifier must be nil + if the filter.type is not RequestHeaderModifier + rule: '!(has(self.requestHeaderModifier) && self.type + != ''RequestHeaderModifier'')' + - message: filter.requestHeaderModifier must be specified + for RequestHeaderModifier filter.type + rule: '!(!has(self.requestHeaderModifier) && self.type + == ''RequestHeaderModifier'')' + - message: filter.responseHeaderModifier must be nil + if the filter.type is not ResponseHeaderModifier + rule: '!(has(self.responseHeaderModifier) && self.type + != ''ResponseHeaderModifier'')' + - message: filter.responseHeaderModifier must be specified + for ResponseHeaderModifier filter.type + rule: '!(!has(self.responseHeaderModifier) && self.type + == ''ResponseHeaderModifier'')' + - message: filter.requestMirror must be nil if the filter.type + is not RequestMirror + rule: '!(has(self.requestMirror) && self.type != ''RequestMirror'')' + - message: filter.requestMirror must be specified for + RequestMirror filter.type + rule: '!(!has(self.requestMirror) && self.type == + ''RequestMirror'')' + - message: filter.requestRedirect must be nil if the + filter.type is not RequestRedirect + rule: '!(has(self.requestRedirect) && self.type != + ''RequestRedirect'')' + - message: filter.requestRedirect must be specified + for RequestRedirect filter.type + rule: '!(!has(self.requestRedirect) && self.type == + ''RequestRedirect'')' + - message: filter.urlRewrite must be nil if the filter.type + is not URLRewrite + rule: '!(has(self.urlRewrite) && self.type != ''URLRewrite'')' + - message: filter.urlRewrite must be specified for URLRewrite + filter.type + rule: '!(!has(self.urlRewrite) && self.type == ''URLRewrite'')' + - message: filter.extensionRef must be nil if the filter.type + is not ExtensionRef + rule: '!(has(self.extensionRef) && self.type != ''ExtensionRef'')' + - message: filter.extensionRef must be specified for + ExtensionRef filter.type + rule: '!(!has(self.extensionRef) && self.type == ''ExtensionRef'')' + maxItems: 16 + type: array + x-kubernetes-validations: + - message: May specify either httpRouteFilterRequestRedirect + or httpRouteFilterRequestRewrite, but not both + rule: '!(self.exists(f, f.type == ''RequestRedirect'') + && self.exists(f, f.type == ''URLRewrite''))' + - message: May specify either httpRouteFilterRequestRedirect + or httpRouteFilterRequestRewrite, but not both + rule: '!(self.exists(f, f.type == ''RequestRedirect'') + && self.exists(f, f.type == ''URLRewrite''))' + - message: RequestHeaderModifier filter cannot be repeated + rule: self.filter(f, f.type == 'RequestHeaderModifier').size() + <= 1 + - message: ResponseHeaderModifier filter cannot be repeated + rule: self.filter(f, f.type == 'ResponseHeaderModifier').size() + <= 1 + - message: RequestRedirect filter cannot be repeated + rule: self.filter(f, f.type == 'RequestRedirect').size() + <= 1 + - message: URLRewrite filter cannot be repeated + rule: self.filter(f, f.type == 'URLRewrite').size() + <= 1 + group: + default: "" + description: |- + Group is the group of the referent. For example, "gateway.networking.k8s.io". + When unspecified or empty string, core API group is inferred. + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + default: Service + description: |- + Kind is the Kubernetes resource kind of the referent. For example + "Service". + + Defaults to "Service" when not specified. + + ExternalName services can refer to CNAME DNS records that may live + outside of the cluster and as such are difficult to reason about in + terms of conformance. They also may not be safe to forward to (see + CVE-2021-25740 for more information). Implementations SHOULD NOT + support ExternalName Services. + + Support: Core (Services with a type other than ExternalName) + + Support: Implementation-specific (Services with type ExternalName) + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: Name is the name of the referent. + maxLength: 253 + minLength: 1 + type: string + namespace: + description: |- + Namespace is the namespace of the backend. When unspecified, the local + namespace is inferred. + + Note that when a namespace different than the local namespace is specified, + a ReferenceGrant object is required in the referent namespace to allow that + namespace's owner to accept the reference. See the ReferenceGrant + documentation for details. + + Support: Core + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + port: + description: |- + Port specifies the destination port number to use for this resource. + Port is required when the referent is a Kubernetes Service. In this + case, the port number is the service port number, not the target port. + For other resources, destination port might be derived from the referent + resource or this field. + format: int32 + maximum: 65535 + minimum: 1 + type: integer + weight: + default: 1 + description: |- + Weight specifies the proportion of requests forwarded to the referenced + backend. This is computed as weight/(sum of all weights in this + BackendRefs list). For non-zero values, there may be some epsilon from + the exact proportion defined here depending on the precision an + implementation supports. Weight is not a percentage and the sum of + weights does not need to equal 100. + + If only one backend is specified and it has a weight greater than 0, 100% + of the traffic is forwarded to that backend. If weight is set to 0, no + traffic should be forwarded for this entry. If unspecified, weight + defaults to 1. + + Support for this field varies based on the context where used. + format: int32 + maximum: 1000000 + minimum: 0 + type: integer + required: + - name + type: object + x-kubernetes-validations: + - message: Must have port for Service reference + rule: '(size(self.group) == 0 && self.kind == ''Service'') + ? has(self.port) : true' + maxItems: 16 + type: array + filters: + description: |- + Filters define the filters that are applied to requests that match + this rule. + + Wherever possible, implementations SHOULD implement filters in the order + they are specified. + + Implementations MAY choose to implement this ordering strictly, rejecting + any combination or order of filters that can not be supported. If implementations + choose a strict interpretation of filter ordering, they MUST clearly document + that behavior. + + To reject an invalid combination or order of filters, implementations SHOULD + consider the Route Rules with this configuration invalid. If all Route Rules + in a Route are invalid, the entire Route would be considered invalid. If only + a portion of Route Rules are invalid, implementations MUST set the + "PartiallyInvalid" condition for the Route. + + Conformance-levels at this level are defined based on the type of filter: + + - ALL core filters MUST be supported by all implementations. + - Implementers are encouraged to support extended filters. + - Implementation-specific custom filters have no API guarantees across + implementations. + + Specifying the same filter multiple times is not supported unless explicitly + indicated in the filter. + + All filters are expected to be compatible with each other except for the + URLRewrite and RequestRedirect filters, which may not be combined. If an + implementation can not support other combinations of filters, they must clearly + document that limitation. In cases where incompatible or unsupported + filters are specified and cause the `Accepted` condition to be set to status + `False`, implementations may use the `IncompatibleFilters` reason to specify + this configuration error. + + Support: Core + items: + description: |- + HTTPRouteFilter defines processing steps that must be completed during the + request or response lifecycle. HTTPRouteFilters are meant as an extension + point to express processing that may be done in Gateway implementations. Some + examples include request or response modification, implementing + authentication strategies, rate-limiting, and traffic shaping. API + guarantee/conformance is defined based on the type of the filter. + properties: + extensionRef: + description: |- + ExtensionRef is an optional, implementation-specific extension to the + "filter" behavior. For example, resource "myroutefilter" in group + "networking.example.net"). ExtensionRef MUST NOT be used for core and + extended filters. + + This filter can be used multiple times within the same rule. + + Support: Implementation-specific + properties: + group: + description: |- + Group is the group of the referent. For example, "gateway.networking.k8s.io". + When unspecified or empty string, core API group is inferred. + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + description: Kind is kind of the referent. For example + "HTTPRoute" or "Service". + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: Name is the name of the referent. + maxLength: 253 + minLength: 1 + type: string + required: + - group + - kind + - name + type: object + requestHeaderModifier: + description: |- + RequestHeaderModifier defines a schema for a filter that modifies request + headers. + + Support: Core + properties: + add: + description: |- + Add adds the given header(s) (name, value) to the request + before the action. It appends to any existing values associated + with the header name. + + Input: + GET /foo HTTP/1.1 + my-header: foo + + Config: + add: + - name: "my-header" + value: "bar,baz" + + Output: + GET /foo HTTP/1.1 + my-header: foo,bar,baz + items: + description: HTTPHeader represents an HTTP Header + name and value as defined by RFC 7230. + properties: + name: + description: |- + Name is the name of the HTTP Header to be matched. Name matching MUST be + case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). + + If multiple entries specify equivalent header names, the first entry with + an equivalent name MUST be considered for a match. Subsequent entries + with an equivalent header name MUST be ignored. Due to the + case-insensitivity of header names, "foo" and "Foo" are considered + equivalent. + maxLength: 256 + minLength: 1 + pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ + type: string + value: + description: Value is the value of HTTP Header + to be matched. + maxLength: 4096 + minLength: 1 + type: string + required: + - name + - value + type: object + maxItems: 16 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + remove: + description: |- + Remove the given header(s) from the HTTP request before the action. The + value of Remove is a list of HTTP header names. Note that the header + names are case-insensitive (see + https://datatracker.ietf.org/doc/html/rfc2616#section-4.2). + + Input: + GET /foo HTTP/1.1 + my-header1: foo + my-header2: bar + my-header3: baz + + Config: + remove: ["my-header1", "my-header3"] + + Output: + GET /foo HTTP/1.1 + my-header2: bar + items: + type: string + maxItems: 16 + type: array + x-kubernetes-list-type: set + set: + description: |- + Set overwrites the request with the given header (name, value) + before the action. + + Input: + GET /foo HTTP/1.1 + my-header: foo + + Config: + set: + - name: "my-header" + value: "bar" + + Output: + GET /foo HTTP/1.1 + my-header: bar + items: + description: HTTPHeader represents an HTTP Header + name and value as defined by RFC 7230. + properties: + name: + description: |- + Name is the name of the HTTP Header to be matched. Name matching MUST be + case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). + + If multiple entries specify equivalent header names, the first entry with + an equivalent name MUST be considered for a match. Subsequent entries + with an equivalent header name MUST be ignored. Due to the + case-insensitivity of header names, "foo" and "Foo" are considered + equivalent. + maxLength: 256 + minLength: 1 + pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ + type: string + value: + description: Value is the value of HTTP Header + to be matched. + maxLength: 4096 + minLength: 1 + type: string + required: + - name + - value + type: object + maxItems: 16 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + type: object + requestMirror: + description: |+ + RequestMirror defines a schema for a filter that mirrors requests. + Requests are sent to the specified destination, but responses from + that destination are ignored. + + This filter can be used multiple times within the same rule. Note that + not all implementations will be able to support mirroring to multiple + backends. + + Support: Extended + + properties: + backendRef: + description: |- + BackendRef references a resource where mirrored requests are sent. + + Mirrored requests must be sent only to a single destination endpoint + within this BackendRef, irrespective of how many endpoints are present + within this BackendRef. + + If the referent cannot be found, this BackendRef is invalid and must be + dropped from the Gateway. The controller must ensure the "ResolvedRefs" + condition on the Route status is set to `status: False` and not configure + this backend in the underlying implementation. + + If there is a cross-namespace reference to an *existing* object + that is not allowed by a ReferenceGrant, the controller must ensure the + "ResolvedRefs" condition on the Route is set to `status: False`, + with the "RefNotPermitted" reason and not configure this backend in the + underlying implementation. + + In either error case, the Message of the `ResolvedRefs` Condition + should be used to provide more detail about the problem. + + Support: Extended for Kubernetes Service + + Support: Implementation-specific for any other resource + properties: + group: + default: "" + description: |- + Group is the group of the referent. For example, "gateway.networking.k8s.io". + When unspecified or empty string, core API group is inferred. + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + default: Service + description: |- + Kind is the Kubernetes resource kind of the referent. For example + "Service". + + Defaults to "Service" when not specified. + + ExternalName services can refer to CNAME DNS records that may live + outside of the cluster and as such are difficult to reason about in + terms of conformance. They also may not be safe to forward to (see + CVE-2021-25740 for more information). Implementations SHOULD NOT + support ExternalName Services. + + Support: Core (Services with a type other than ExternalName) + + Support: Implementation-specific (Services with type ExternalName) + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: Name is the name of the referent. + maxLength: 253 + minLength: 1 + type: string + namespace: + description: |- + Namespace is the namespace of the backend. When unspecified, the local + namespace is inferred. + + Note that when a namespace different than the local namespace is specified, + a ReferenceGrant object is required in the referent namespace to allow that + namespace's owner to accept the reference. See the ReferenceGrant + documentation for details. + + Support: Core + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + port: + description: |- + Port specifies the destination port number to use for this resource. + Port is required when the referent is a Kubernetes Service. In this + case, the port number is the service port number, not the target port. + For other resources, destination port might be derived from the referent + resource or this field. + format: int32 + maximum: 65535 + minimum: 1 + type: integer + required: + - name + type: object + x-kubernetes-validations: + - message: Must have port for Service reference + rule: '(size(self.group) == 0 && self.kind == ''Service'') + ? has(self.port) : true' + required: + - backendRef + type: object + requestRedirect: + description: |- + RequestRedirect defines a schema for a filter that responds to the + request with an HTTP redirection. + + Support: Core + properties: + hostname: + description: |- + Hostname is the hostname to be used in the value of the `Location` + header in the response. + When empty, the hostname in the `Host` header of the request is used. + + Support: Core + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + path: + description: |- + Path defines parameters used to modify the path of the incoming request. + The modified path is then used to construct the `Location` header. When + empty, the request path is used as-is. + + Support: Extended + properties: + replaceFullPath: + description: |- + ReplaceFullPath specifies the value with which to replace the full path + of a request during a rewrite or redirect. + maxLength: 1024 + type: string + replacePrefixMatch: + description: |- + ReplacePrefixMatch specifies the value with which to replace the prefix + match of a request during a rewrite or redirect. For example, a request + to "/foo/bar" with a prefix match of "/foo" and a ReplacePrefixMatch + of "/xyz" would be modified to "/xyz/bar". + + Note that this matches the behavior of the PathPrefix match type. This + matches full path elements. A path element refers to the list of labels + in the path split by the `/` separator. When specified, a trailing `/` is + ignored. For example, the paths `/abc`, `/abc/`, and `/abc/def` would all + match the prefix `/abc`, but the path `/abcd` would not. + + ReplacePrefixMatch is only compatible with a `PathPrefix` HTTPRouteMatch. + Using any other HTTPRouteMatch type on the same HTTPRouteRule will result in + the implementation setting the Accepted Condition for the Route to `status: False`. + + Request Path | Prefix Match | Replace Prefix | Modified Path + maxLength: 1024 + type: string + type: + description: |- + Type defines the type of path modifier. Additional types may be + added in a future release of the API. + + Note that values may be added to this enum, implementations + must ensure that unknown values will not cause a crash. + + Unknown values here must result in the implementation setting the + Accepted Condition for the Route to `status: False`, with a + Reason of `UnsupportedValue`. + enum: + - ReplaceFullPath + - ReplacePrefixMatch + type: string + required: + - type + type: object + x-kubernetes-validations: + - message: replaceFullPath must be specified when + type is set to 'ReplaceFullPath' + rule: 'self.type == ''ReplaceFullPath'' ? has(self.replaceFullPath) + : true' + - message: type must be 'ReplaceFullPath' when replaceFullPath + is set + rule: 'has(self.replaceFullPath) ? self.type == + ''ReplaceFullPath'' : true' + - message: replacePrefixMatch must be specified when + type is set to 'ReplacePrefixMatch' + rule: 'self.type == ''ReplacePrefixMatch'' ? has(self.replacePrefixMatch) + : true' + - message: type must be 'ReplacePrefixMatch' when + replacePrefixMatch is set + rule: 'has(self.replacePrefixMatch) ? self.type + == ''ReplacePrefixMatch'' : true' + port: + description: |- + Port is the port to be used in the value of the `Location` + header in the response. + + If no port is specified, the redirect port MUST be derived using the + following rules: + + * If redirect scheme is not-empty, the redirect port MUST be the well-known + port associated with the redirect scheme. Specifically "http" to port 80 + and "https" to port 443. If the redirect scheme does not have a + well-known port, the listener port of the Gateway SHOULD be used. + * If redirect scheme is empty, the redirect port MUST be the Gateway + Listener port. + + Implementations SHOULD NOT add the port number in the 'Location' + header in the following cases: + + * A Location header that will use HTTP (whether that is determined via + the Listener protocol or the Scheme field) _and_ use port 80. + * A Location header that will use HTTPS (whether that is determined via + the Listener protocol or the Scheme field) _and_ use port 443. + + Support: Extended + format: int32 + maximum: 65535 + minimum: 1 + type: integer + scheme: + description: |- + Scheme is the scheme to be used in the value of the `Location` header in + the response. When empty, the scheme of the request is used. + + Scheme redirects can affect the port of the redirect, for more information, + refer to the documentation for the port field of this filter. + + Note that values may be added to this enum, implementations + must ensure that unknown values will not cause a crash. + + Unknown values here must result in the implementation setting the + Accepted Condition for the Route to `status: False`, with a + Reason of `UnsupportedValue`. + + Support: Extended + enum: + - http + - https + type: string + statusCode: + default: 302 + description: |- + StatusCode is the HTTP status code to be used in response. + + Note that values may be added to this enum, implementations + must ensure that unknown values will not cause a crash. + + Unknown values here must result in the implementation setting the + Accepted Condition for the Route to `status: False`, with a + Reason of `UnsupportedValue`. + + Support: Core + enum: + - 301 + - 302 + type: integer + type: object + responseHeaderModifier: + description: |- + ResponseHeaderModifier defines a schema for a filter that modifies response + headers. + + Support: Extended + properties: + add: + description: |- + Add adds the given header(s) (name, value) to the request + before the action. It appends to any existing values associated + with the header name. + + Input: + GET /foo HTTP/1.1 + my-header: foo + + Config: + add: + - name: "my-header" + value: "bar,baz" + + Output: + GET /foo HTTP/1.1 + my-header: foo,bar,baz + items: + description: HTTPHeader represents an HTTP Header + name and value as defined by RFC 7230. + properties: + name: + description: |- + Name is the name of the HTTP Header to be matched. Name matching MUST be + case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). + + If multiple entries specify equivalent header names, the first entry with + an equivalent name MUST be considered for a match. Subsequent entries + with an equivalent header name MUST be ignored. Due to the + case-insensitivity of header names, "foo" and "Foo" are considered + equivalent. + maxLength: 256 + minLength: 1 + pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ + type: string + value: + description: Value is the value of HTTP Header + to be matched. + maxLength: 4096 + minLength: 1 + type: string + required: + - name + - value + type: object + maxItems: 16 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + remove: + description: |- + Remove the given header(s) from the HTTP request before the action. The + value of Remove is a list of HTTP header names. Note that the header + names are case-insensitive (see + https://datatracker.ietf.org/doc/html/rfc2616#section-4.2). + + Input: + GET /foo HTTP/1.1 + my-header1: foo + my-header2: bar + my-header3: baz + + Config: + remove: ["my-header1", "my-header3"] + + Output: + GET /foo HTTP/1.1 + my-header2: bar + items: + type: string + maxItems: 16 + type: array + x-kubernetes-list-type: set + set: + description: |- + Set overwrites the request with the given header (name, value) + before the action. + + Input: + GET /foo HTTP/1.1 + my-header: foo + + Config: + set: + - name: "my-header" + value: "bar" + + Output: + GET /foo HTTP/1.1 + my-header: bar + items: + description: HTTPHeader represents an HTTP Header + name and value as defined by RFC 7230. + properties: + name: + description: |- + Name is the name of the HTTP Header to be matched. Name matching MUST be + case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). + + If multiple entries specify equivalent header names, the first entry with + an equivalent name MUST be considered for a match. Subsequent entries + with an equivalent header name MUST be ignored. Due to the + case-insensitivity of header names, "foo" and "Foo" are considered + equivalent. + maxLength: 256 + minLength: 1 + pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ + type: string + value: + description: Value is the value of HTTP Header + to be matched. + maxLength: 4096 + minLength: 1 + type: string + required: + - name + - value + type: object + maxItems: 16 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + type: object + type: + description: |- + Type identifies the type of filter to apply. As with other API fields, + types are classified into three conformance levels: + + - Core: Filter types and their corresponding configuration defined by + "Support: Core" in this package, e.g. "RequestHeaderModifier". All + implementations must support core filters. + + - Extended: Filter types and their corresponding configuration defined by + "Support: Extended" in this package, e.g. "RequestMirror". Implementers + are encouraged to support extended filters. + + - Implementation-specific: Filters that are defined and supported by + specific vendors. + In the future, filters showing convergence in behavior across multiple + implementations will be considered for inclusion in extended or core + conformance levels. Filter-specific configuration for such filters + is specified using the ExtensionRef field. `Type` should be set to + "ExtensionRef" for custom filters. + + Implementers are encouraged to define custom implementation types to + extend the core API with implementation-specific behavior. + + If a reference to a custom filter type cannot be resolved, the filter + MUST NOT be skipped. Instead, requests that would have been processed by + that filter MUST receive a HTTP error response. + + Note that values may be added to this enum, implementations + must ensure that unknown values will not cause a crash. + + Unknown values here must result in the implementation setting the + Accepted Condition for the Route to `status: False`, with a + Reason of `UnsupportedValue`. + enum: + - RequestHeaderModifier + - ResponseHeaderModifier + - RequestMirror + - RequestRedirect + - URLRewrite + - ExtensionRef + type: string + urlRewrite: + description: |- + URLRewrite defines a schema for a filter that modifies a request during forwarding. + + Support: Extended + properties: + hostname: + description: |- + Hostname is the value to be used to replace the Host header value during + forwarding. + + Support: Extended + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + path: + description: |- + Path defines a path rewrite. + + Support: Extended + properties: + replaceFullPath: + description: |- + ReplaceFullPath specifies the value with which to replace the full path + of a request during a rewrite or redirect. + maxLength: 1024 + type: string + replacePrefixMatch: + description: |- + ReplacePrefixMatch specifies the value with which to replace the prefix + match of a request during a rewrite or redirect. For example, a request + to "/foo/bar" with a prefix match of "/foo" and a ReplacePrefixMatch + of "/xyz" would be modified to "/xyz/bar". + + Note that this matches the behavior of the PathPrefix match type. This + matches full path elements. A path element refers to the list of labels + in the path split by the `/` separator. When specified, a trailing `/` is + ignored. For example, the paths `/abc`, `/abc/`, and `/abc/def` would all + match the prefix `/abc`, but the path `/abcd` would not. + + ReplacePrefixMatch is only compatible with a `PathPrefix` HTTPRouteMatch. + Using any other HTTPRouteMatch type on the same HTTPRouteRule will result in + the implementation setting the Accepted Condition for the Route to `status: False`. + + Request Path | Prefix Match | Replace Prefix | Modified Path + maxLength: 1024 + type: string + type: + description: |- + Type defines the type of path modifier. Additional types may be + added in a future release of the API. + + Note that values may be added to this enum, implementations + must ensure that unknown values will not cause a crash. + + Unknown values here must result in the implementation setting the + Accepted Condition for the Route to `status: False`, with a + Reason of `UnsupportedValue`. + enum: + - ReplaceFullPath + - ReplacePrefixMatch + type: string + required: + - type + type: object + x-kubernetes-validations: + - message: replaceFullPath must be specified when + type is set to 'ReplaceFullPath' + rule: 'self.type == ''ReplaceFullPath'' ? has(self.replaceFullPath) + : true' + - message: type must be 'ReplaceFullPath' when replaceFullPath + is set + rule: 'has(self.replaceFullPath) ? self.type == + ''ReplaceFullPath'' : true' + - message: replacePrefixMatch must be specified when + type is set to 'ReplacePrefixMatch' + rule: 'self.type == ''ReplacePrefixMatch'' ? has(self.replacePrefixMatch) + : true' + - message: type must be 'ReplacePrefixMatch' when + replacePrefixMatch is set + rule: 'has(self.replacePrefixMatch) ? self.type + == ''ReplacePrefixMatch'' : true' + type: object + required: + - type + type: object + x-kubernetes-validations: + - message: filter.requestHeaderModifier must be nil if the + filter.type is not RequestHeaderModifier + rule: '!(has(self.requestHeaderModifier) && self.type != + ''RequestHeaderModifier'')' + - message: filter.requestHeaderModifier must be specified + for RequestHeaderModifier filter.type + rule: '!(!has(self.requestHeaderModifier) && self.type == + ''RequestHeaderModifier'')' + - message: filter.responseHeaderModifier must be nil if the + filter.type is not ResponseHeaderModifier + rule: '!(has(self.responseHeaderModifier) && self.type != + ''ResponseHeaderModifier'')' + - message: filter.responseHeaderModifier must be specified + for ResponseHeaderModifier filter.type + rule: '!(!has(self.responseHeaderModifier) && self.type + == ''ResponseHeaderModifier'')' + - message: filter.requestMirror must be nil if the filter.type + is not RequestMirror + rule: '!(has(self.requestMirror) && self.type != ''RequestMirror'')' + - message: filter.requestMirror must be specified for RequestMirror + filter.type + rule: '!(!has(self.requestMirror) && self.type == ''RequestMirror'')' + - message: filter.requestRedirect must be nil if the filter.type + is not RequestRedirect + rule: '!(has(self.requestRedirect) && self.type != ''RequestRedirect'')' + - message: filter.requestRedirect must be specified for RequestRedirect + filter.type + rule: '!(!has(self.requestRedirect) && self.type == ''RequestRedirect'')' + - message: filter.urlRewrite must be nil if the filter.type + is not URLRewrite + rule: '!(has(self.urlRewrite) && self.type != ''URLRewrite'')' + - message: filter.urlRewrite must be specified for URLRewrite + filter.type + rule: '!(!has(self.urlRewrite) && self.type == ''URLRewrite'')' + - message: filter.extensionRef must be nil if the filter.type + is not ExtensionRef + rule: '!(has(self.extensionRef) && self.type != ''ExtensionRef'')' + - message: filter.extensionRef must be specified for ExtensionRef + filter.type + rule: '!(!has(self.extensionRef) && self.type == ''ExtensionRef'')' + maxItems: 16 + type: array + x-kubernetes-validations: + - message: May specify either httpRouteFilterRequestRedirect + or httpRouteFilterRequestRewrite, but not both + rule: '!(self.exists(f, f.type == ''RequestRedirect'') && + self.exists(f, f.type == ''URLRewrite''))' + - message: RequestHeaderModifier filter cannot be repeated + rule: self.filter(f, f.type == 'RequestHeaderModifier').size() + <= 1 + - message: ResponseHeaderModifier filter cannot be repeated + rule: self.filter(f, f.type == 'ResponseHeaderModifier').size() + <= 1 + - message: RequestRedirect filter cannot be repeated + rule: self.filter(f, f.type == 'RequestRedirect').size() <= + 1 + - message: URLRewrite filter cannot be repeated + rule: self.filter(f, f.type == 'URLRewrite').size() <= 1 + matches: + default: + - path: + type: PathPrefix + value: / + description: |- + Matches define conditions used for matching the rule against incoming + HTTP requests. Each match is independent, i.e. this rule will be matched + if **any** one of the matches is satisfied. + + For example, take the following matches configuration: + + ``` + matches: + - path: + value: "/foo" + headers: + - name: "version" + value: "v2" + - path: + value: "/v2/foo" + ``` + + For a request to match against this rule, a request must satisfy + EITHER of the two conditions: + + - path prefixed with `/foo` AND contains the header `version: v2` + - path prefix of `/v2/foo` + + See the documentation for HTTPRouteMatch on how to specify multiple + match conditions that should be ANDed together. + + If no matches are specified, the default is a prefix + path match on "/", which has the effect of matching every + HTTP request. + + Proxy or Load Balancer routing configuration generated from HTTPRoutes + MUST prioritize matches based on the following criteria, continuing on + ties. Across all rules specified on applicable Routes, precedence must be + given to the match having: + + * "Exact" path match. + * "Prefix" path match with largest number of characters. + * Method match. + * Largest number of header matches. + * Largest number of query param matches. + + Note: The precedence of RegularExpression path matches are implementation-specific. + + If ties still exist across multiple Routes, matching precedence MUST be + determined in order of the following criteria, continuing on ties: + + * The oldest Route based on creation timestamp. + * The Route appearing first in alphabetical order by + "{namespace}/{name}". + + If ties still exist within an HTTPRoute, matching precedence MUST be granted + to the FIRST matching rule (in list order) with a match meeting the above + criteria. + + When no rules matching a request have been successfully attached to the + parent a request is coming from, a HTTP 404 status code MUST be returned. + items: + description: "HTTPRouteMatch defines the predicate used to + match requests to a given\naction. Multiple match types + are ANDed together, i.e. the match will\nevaluate to true + only if all conditions are satisfied.\n\nFor example, the + match below will match a HTTP request only if its path\nstarts + with `/foo` AND it contains the `version: v1` header:\n\n```\nmatch:\n\n\tpath:\n\t + \ value: \"/foo\"\n\theaders:\n\t- name: \"version\"\n\t + \ value \"v1\"\n\n```" + properties: + headers: + description: |- + Headers specifies HTTP request header matchers. Multiple match values are + ANDed together, meaning, a request must match all the specified headers + to select the route. + items: + description: |- + HTTPHeaderMatch describes how to select a HTTP route by matching HTTP request + headers. + properties: + name: + description: |- + Name is the name of the HTTP Header to be matched. Name matching MUST be + case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). + + If multiple entries specify equivalent header names, only the first + entry with an equivalent name MUST be considered for a match. Subsequent + entries with an equivalent header name MUST be ignored. Due to the + case-insensitivity of header names, "foo" and "Foo" are considered + equivalent. + + When a header is repeated in an HTTP request, it is + implementation-specific behavior as to how this is represented. + Generally, proxies should follow the guidance from the RFC: + https://www.rfc-editor.org/rfc/rfc7230.html#section-3.2.2 regarding + processing a repeated header, with special handling for "Set-Cookie". + maxLength: 256 + minLength: 1 + pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ + type: string + type: + default: Exact + description: |- + Type specifies how to match against the value of the header. + + Support: Core (Exact) + + Support: Implementation-specific (RegularExpression) + + Since RegularExpression HeaderMatchType has implementation-specific + conformance, implementations can support POSIX, PCRE or any other dialects + of regular expressions. Please read the implementation's documentation to + determine the supported dialect. + enum: + - Exact + - RegularExpression + type: string + value: + description: Value is the value of HTTP Header to + be matched. + maxLength: 4096 + minLength: 1 + type: string + required: + - name + - value + type: object + maxItems: 16 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + method: + description: |- + Method specifies HTTP method matcher. + When specified, this route will be matched only if the request has the + specified method. + + Support: Extended + enum: + - GET + - HEAD + - POST + - PUT + - DELETE + - CONNECT + - OPTIONS + - TRACE + - PATCH + type: string + path: + default: + type: PathPrefix + value: / + description: |- + Path specifies a HTTP request path matcher. If this field is not + specified, a default prefix match on the "/" path is provided. + properties: + type: + default: PathPrefix + description: |- + Type specifies how to match against the path Value. + + Support: Core (Exact, PathPrefix) + + Support: Implementation-specific (RegularExpression) + enum: + - Exact + - PathPrefix + - RegularExpression + type: string + value: + default: / + description: Value of the HTTP path to match against. + maxLength: 1024 + type: string + type: object + x-kubernetes-validations: + - message: value must be an absolute path and start with + '/' when type one of ['Exact', 'PathPrefix'] + rule: '(self.type in [''Exact'',''PathPrefix'']) ? self.value.startsWith(''/'') + : true' + - message: must not contain '//' when type one of ['Exact', + 'PathPrefix'] + rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.contains(''//'') + : true' + - message: must not contain '/./' when type one of ['Exact', + 'PathPrefix'] + rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.contains(''/./'') + : true' + - message: must not contain '/../' when type one of ['Exact', + 'PathPrefix'] + rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.contains(''/../'') + : true' + - message: must not contain '%2f' when type one of ['Exact', + 'PathPrefix'] + rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.contains(''%2f'') + : true' + - message: must not contain '%2F' when type one of ['Exact', + 'PathPrefix'] + rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.contains(''%2F'') + : true' + - message: must not contain '#' when type one of ['Exact', + 'PathPrefix'] + rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.contains(''#'') + : true' + - message: must not end with '/..' when type one of ['Exact', + 'PathPrefix'] + rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.endsWith(''/..'') + : true' + - message: must not end with '/.' when type one of ['Exact', + 'PathPrefix'] + rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.endsWith(''/.'') + : true' + - message: type must be one of ['Exact', 'PathPrefix', + 'RegularExpression'] + rule: self.type in ['Exact','PathPrefix'] || self.type + == 'RegularExpression' + - message: must only contain valid characters (matching + ^(?:[-A-Za-z0-9/._~!$&'()*+,;=:@]|[%][0-9a-fA-F]{2})+$) + for types ['Exact', 'PathPrefix'] + rule: '(self.type in [''Exact'',''PathPrefix'']) ? self.value.matches(r"""^(?:[-A-Za-z0-9/._~!$&''()*+,;=:@]|[%][0-9a-fA-F]{2})+$""") + : true' + queryParams: + description: |- + QueryParams specifies HTTP query parameter matchers. Multiple match + values are ANDed together, meaning, a request must match all the + specified query parameters to select the route. + + Support: Extended + items: + description: |- + HTTPQueryParamMatch describes how to select a HTTP route by matching HTTP + query parameters. + properties: + name: + description: |- + Name is the name of the HTTP query param to be matched. This must be an + exact string match. (See + https://tools.ietf.org/html/rfc7230#section-2.7.3). + + If multiple entries specify equivalent query param names, only the first + entry with an equivalent name MUST be considered for a match. Subsequent + entries with an equivalent query param name MUST be ignored. + + If a query param is repeated in an HTTP request, the behavior is + purposely left undefined, since different data planes have different + capabilities. However, it is *recommended* that implementations should + match against the first value of the param if the data plane supports it, + as this behavior is expected in other load balancing contexts outside of + the Gateway API. + + Users SHOULD NOT route traffic based on repeated query params to guard + themselves against potential differences in the implementations. + maxLength: 256 + minLength: 1 + pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ + type: string + type: + default: Exact + description: |- + Type specifies how to match against the value of the query parameter. + + Support: Extended (Exact) + + Support: Implementation-specific (RegularExpression) + + Since RegularExpression QueryParamMatchType has Implementation-specific + conformance, implementations can support POSIX, PCRE or any other + dialects of regular expressions. Please read the implementation's + documentation to determine the supported dialect. + enum: + - Exact + - RegularExpression + type: string + value: + description: Value is the value of HTTP query param + to be matched. + maxLength: 1024 + minLength: 1 + type: string + required: + - name + - value + type: object + maxItems: 16 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + type: object + maxItems: 64 + type: array + timeouts: + description: |- + Timeouts defines the timeouts that can be configured for an HTTP request. + + Support: Extended + properties: + backendRequest: + description: |- + BackendRequest specifies a timeout for an individual request from the gateway + to a backend. This covers the time from when the request first starts being + sent from the gateway to when the full response has been received from the backend. + + Setting a timeout to the zero duration (e.g. "0s") SHOULD disable the timeout + completely. Implementations that cannot completely disable the timeout MUST + instead interpret the zero duration as the longest possible value to which + the timeout can be set. + + An entire client HTTP transaction with a gateway, covered by the Request timeout, + may result in more than one call from the gateway to the destination backend, + for example, if automatic retries are supported. + + The value of BackendRequest must be a Gateway API Duration string as defined by + GEP-2257. When this field is unspecified, its behavior is implementation-specific; + when specified, the value of BackendRequest must be no more than the value of the + Request timeout (since the Request timeout encompasses the BackendRequest timeout). + + Support: Extended + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string + request: + description: |- + Request specifies the maximum duration for a gateway to respond to an HTTP request. + If the gateway has not been able to respond before this deadline is met, the gateway + MUST return a timeout error. + + For example, setting the `rules.timeouts.request` field to the value `10s` in an + `HTTPRoute` will cause a timeout if a client request is taking longer than 10 seconds + to complete. + + Setting a timeout to the zero duration (e.g. "0s") SHOULD disable the timeout + completely. Implementations that cannot completely disable the timeout MUST + instead interpret the zero duration as the longest possible value to which + the timeout can be set. + + This timeout is intended to cover as close to the whole request-response transaction + as possible although an implementation MAY choose to start the timeout after the entire + request stream has been received instead of immediately after the transaction is + initiated by the client. + + The value of Request is a Gateway API Duration string as defined by GEP-2257. When this + field is unspecified, request timeout behavior is implementation-specific. + + Support: Extended + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string + type: object + x-kubernetes-validations: + - message: backendRequest timeout cannot be longer than request + timeout + rule: '!(has(self.request) && has(self.backendRequest) && + duration(self.request) != duration(''0s'') && duration(self.backendRequest) + > duration(self.request))' + type: object + x-kubernetes-validations: + - message: RequestRedirect filter must not be used together with + backendRefs + rule: '(has(self.backendRefs) && size(self.backendRefs) > 0) ? + (!has(self.filters) || self.filters.all(f, !has(f.requestRedirect))): + true' + - message: When using RequestRedirect filter with path.replacePrefixMatch, + exactly one PathPrefix match must be specified + rule: '(has(self.filters) && self.filters.exists_one(f, has(f.requestRedirect) + && has(f.requestRedirect.path) && f.requestRedirect.path.type + == ''ReplacePrefixMatch'' && has(f.requestRedirect.path.replacePrefixMatch))) + ? ((size(self.matches) != 1 || !has(self.matches[0].path) || + self.matches[0].path.type != ''PathPrefix'') ? false : true) + : true' + - message: When using URLRewrite filter with path.replacePrefixMatch, + exactly one PathPrefix match must be specified + rule: '(has(self.filters) && self.filters.exists_one(f, has(f.urlRewrite) + && has(f.urlRewrite.path) && f.urlRewrite.path.type == ''ReplacePrefixMatch'' + && has(f.urlRewrite.path.replacePrefixMatch))) ? ((size(self.matches) + != 1 || !has(self.matches[0].path) || self.matches[0].path.type + != ''PathPrefix'') ? false : true) : true' + - message: Within backendRefs, when using RequestRedirect filter + with path.replacePrefixMatch, exactly one PathPrefix match must + be specified + rule: '(has(self.backendRefs) && self.backendRefs.exists_one(b, + (has(b.filters) && b.filters.exists_one(f, has(f.requestRedirect) + && has(f.requestRedirect.path) && f.requestRedirect.path.type + == ''ReplacePrefixMatch'' && has(f.requestRedirect.path.replacePrefixMatch))) + )) ? ((size(self.matches) != 1 || !has(self.matches[0].path) + || self.matches[0].path.type != ''PathPrefix'') ? false : true) + : true' + - message: Within backendRefs, When using URLRewrite filter with + path.replacePrefixMatch, exactly one PathPrefix match must be + specified + rule: '(has(self.backendRefs) && self.backendRefs.exists_one(b, + (has(b.filters) && b.filters.exists_one(f, has(f.urlRewrite) + && has(f.urlRewrite.path) && f.urlRewrite.path.type == ''ReplacePrefixMatch'' + && has(f.urlRewrite.path.replacePrefixMatch))) )) ? ((size(self.matches) + != 1 || !has(self.matches[0].path) || self.matches[0].path.type + != ''PathPrefix'') ? false : true) : true' + maxItems: 16 + type: array + x-kubernetes-validations: + - message: While 16 rules and 64 matches per rule are allowed, the + total number of matches across all rules in a route must be less + than 128 + rule: '(self.size() > 0 ? self[0].matches.size() : 0) + (self.size() + > 1 ? self[1].matches.size() : 0) + (self.size() > 2 ? self[2].matches.size() + : 0) + (self.size() > 3 ? self[3].matches.size() : 0) + (self.size() + > 4 ? self[4].matches.size() : 0) + (self.size() > 5 ? self[5].matches.size() + : 0) + (self.size() > 6 ? self[6].matches.size() : 0) + (self.size() + > 7 ? self[7].matches.size() : 0) + (self.size() > 8 ? self[8].matches.size() + : 0) + (self.size() > 9 ? self[9].matches.size() : 0) + (self.size() + > 10 ? self[10].matches.size() : 0) + (self.size() > 11 ? self[11].matches.size() + : 0) + (self.size() > 12 ? self[12].matches.size() : 0) + (self.size() + > 13 ? self[13].matches.size() : 0) + (self.size() > 14 ? self[14].matches.size() + : 0) + (self.size() > 15 ? self[15].matches.size() : 0) <= 128' + type: object + status: + description: Status defines the current state of HTTPRoute. + properties: + parents: + description: |- + Parents is a list of parent resources (usually Gateways) that are + associated with the route, and the status of the route with respect to + each parent. When this route attaches to a parent, the controller that + manages the parent must add an entry to this list when the controller + first sees the route and should update the entry as appropriate when the + route or gateway is modified. + + Note that parent references that cannot be resolved by an implementation + of this API will not be added to this list. Implementations of this API + can only populate Route status for the Gateways/parent resources they are + responsible for. + + A maximum of 32 Gateways will be represented in this list. An empty list + means the route has not been attached to any Gateway. + items: + description: |- + RouteParentStatus describes the status of a route with respect to an + associated Parent. + properties: + conditions: + description: |- + Conditions describes the status of the route with respect to the Gateway. + Note that the route's availability is also subject to the Gateway's own + status conditions and listener status. + + If the Route's ParentRef specifies an existing Gateway that supports + Routes of this kind AND that Gateway's controller has sufficient access, + then that Gateway's controller MUST set the "Accepted" condition on the + Route, to indicate whether the route has been accepted or rejected by the + Gateway, and why. + + A Route MUST be considered "Accepted" if at least one of the Route's + rules is implemented by the Gateway. + + There are a number of cases where the "Accepted" condition may not be set + due to lack of controller visibility, that includes when: + + * The Route refers to a non-existent parent. + * The Route is of a type that the controller does not support. + * The Route is in a namespace the controller does not have access to. + items: + description: Condition contains details for one aspect of + the current state of this API Resource. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, + Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + maxItems: 8 + minItems: 1 + type: array + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + controllerName: + description: |- + ControllerName is a domain/path string that indicates the name of the + controller that wrote this status. This corresponds with the + controllerName field on GatewayClass. + + Example: "example.net/gateway-controller". + + The format of this field is DOMAIN "/" PATH, where DOMAIN and PATH are + valid Kubernetes names + (https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names). + + Controllers MUST populate this field when writing status. Controllers should ensure that + entries to status populated with their ControllerName are cleaned up when they are no + longer necessary. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$ + type: string + parentRef: + description: |- + ParentRef corresponds with a ParentRef in the spec that this + RouteParentStatus struct describes the status of. + properties: + group: + default: gateway.networking.k8s.io + description: |- + Group is the group of the referent. + When unspecified, "gateway.networking.k8s.io" is inferred. + To set the core API group (such as for a "Service" kind referent), + Group must be explicitly set to "" (empty string). + + Support: Core + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + default: Gateway + description: |- + Kind is kind of the referent. + + There are two kinds of parent resources with "Core" support: + + * Gateway (Gateway conformance profile) + * Service (Mesh conformance profile, ClusterIP Services only) + + Support for other resources is Implementation-Specific. + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: |- + Name is the name of the referent. + + Support: Core + maxLength: 253 + minLength: 1 + type: string + namespace: + description: |- + Namespace is the namespace of the referent. When unspecified, this refers + to the local namespace of the Route. + + Note that there are specific rules for ParentRefs which cross namespace + boundaries. Cross-namespace references are only valid if they are explicitly + allowed by something in the namespace they are referring to. For example: + Gateway has the AllowedRoutes field, and ReferenceGrant provides a + generic way to enable any other kind of cross-namespace reference. + + + + Support: Core + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + port: + description: |- + Port is the network port this Route targets. It can be interpreted + differently based on the type of parent resource. + + When the parent resource is a Gateway, this targets all listeners + listening on the specified port that also support this kind of Route(and + select this Route). It's not recommended to set `Port` unless the + networking behaviors specified in a Route must apply to a specific port + as opposed to a listener(s) whose port(s) may be changed. When both Port + and SectionName are specified, the name and port of the selected listener + must match both specified values. + + + + Implementations MAY choose to support other parent resources. + Implementations supporting other types of parent resources MUST clearly + document how/if Port is interpreted. + + For the purpose of status, an attachment is considered successful as + long as the parent resource accepts it partially. For example, Gateway + listeners can restrict which Routes can attach to them by Route kind, + namespace, or hostname. If 1 of 2 Gateway listeners accept attachment + from the referencing Route, the Route MUST be considered successfully + attached. If no Gateway listeners accept attachment from this Route, + the Route MUST be considered detached from the Gateway. + + Support: Extended + format: int32 + maximum: 65535 + minimum: 1 + type: integer + sectionName: + description: |- + SectionName is the name of a section within the target resource. In the + following resources, SectionName is interpreted as the following: + + * Gateway: Listener name. When both Port (experimental) and SectionName + are specified, the name and port of the selected listener must match + both specified values. + * Service: Port name. When both Port (experimental) and SectionName + are specified, the name and port of the selected listener must match + both specified values. + + Implementations MAY choose to support attaching Routes to other resources. + If that is the case, they MUST clearly document how SectionName is + interpreted. + + When unspecified (empty string), this will reference the entire resource. + For the purpose of status, an attachment is considered successful if at + least one section in the parent resource accepts it. For example, Gateway + listeners can restrict which Routes can attach to them by Route kind, + namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from + the referencing Route, the Route MUST be considered successfully + attached. If no Gateway listeners accept attachment from this Route, the + Route MUST be considered detached from the Gateway. + + Support: Core + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + required: + - name + type: object + required: + - controllerName + - parentRef + type: object + maxItems: 32 + type: array + required: + - parents + type: object + required: + - spec + type: object + served: true + storage: false + subresources: + status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: null + storedVersions: null +--- +# +# config/crd/standard/gateway.networking.k8s.io_referencegrants.yaml +# +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328 + gateway.networking.k8s.io/bundle-version: v1.2.1 + gateway.networking.k8s.io/channel: standard + creationTimestamp: null + name: referencegrants.gateway.networking.k8s.io +spec: + group: gateway.networking.k8s.io + names: + categories: + - gateway-api + kind: ReferenceGrant + listKind: ReferenceGrantList + plural: referencegrants + shortNames: + - refgrant + singular: referencegrant + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1beta1 + schema: + openAPIV3Schema: + description: |- + ReferenceGrant identifies kinds of resources in other namespaces that are + trusted to reference the specified kinds of resources in the same namespace + as the policy. + + Each ReferenceGrant can be used to represent a unique trust relationship. + Additional Reference Grants can be used to add to the set of trusted + sources of inbound references for the namespace they are defined within. + + All cross-namespace references in Gateway API (with the exception of cross-namespace + Gateway-route attachment) require a ReferenceGrant. + + ReferenceGrant is a form of runtime verification allowing users to assert + which cross-namespace object references are permitted. Implementations that + support ReferenceGrant MUST NOT permit cross-namespace references which have + no grant, and MUST respond to the removal of a grant by revoking the access + that the grant allowed. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: Spec defines the desired state of ReferenceGrant. + properties: + from: + description: |- + From describes the trusted namespaces and kinds that can reference the + resources described in "To". Each entry in this list MUST be considered + to be an additional place that references can be valid from, or to put + this another way, entries MUST be combined using OR. + + Support: Core + items: + description: ReferenceGrantFrom describes trusted namespaces and + kinds. + properties: + group: + description: |- + Group is the group of the referent. + When empty, the Kubernetes core API group is inferred. + + Support: Core + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + description: |- + Kind is the kind of the referent. Although implementations may support + additional resources, the following types are part of the "Core" + support level for this field. + + When used to permit a SecretObjectReference: + + * Gateway + + When used to permit a BackendObjectReference: + + * GRPCRoute + * HTTPRoute + * TCPRoute + * TLSRoute + * UDPRoute + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + namespace: + description: |- + Namespace is the namespace of the referent. + + Support: Core + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - group + - kind + - namespace + type: object + maxItems: 16 + minItems: 1 + type: array + to: + description: |- + To describes the resources that may be referenced by the resources + described in "From". Each entry in this list MUST be considered to be an + additional place that references can be valid to, or to put this another + way, entries MUST be combined using OR. + + Support: Core + items: + description: |- + ReferenceGrantTo describes what Kinds are allowed as targets of the + references. + properties: + group: + description: |- + Group is the group of the referent. + When empty, the Kubernetes core API group is inferred. + + Support: Core + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + description: |- + Kind is the kind of the referent. Although implementations may support + additional resources, the following types are part of the "Core" + support level for this field: + + * Secret when used to permit a SecretObjectReference + * Service when used to permit a BackendObjectReference + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: |- + Name is the name of the referent. When unspecified, this policy + refers to all resources of the specified Group and Kind in the local + namespace. + maxLength: 253 + minLength: 1 + type: string + required: + - group + - kind + type: object + maxItems: 16 + minItems: 1 + type: array + required: + - from + - to + type: object + type: object + served: true + storage: true + subresources: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: null + storedVersions: null + +--- +# Source: traefik/crds/hub.traefik.io_accesscontrolpolicies.yaml +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.17.1 + name: accesscontrolpolicies.hub.traefik.io +spec: + group: hub.traefik.io + names: + kind: AccessControlPolicy + listKind: AccessControlPolicyList + plural: accesscontrolpolicies + singular: accesscontrolpolicy + scope: Cluster + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: AccessControlPolicy defines an access control policy. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: AccessControlPolicySpec configures an access control policy. + properties: + apiKey: + description: AccessControlPolicyAPIKey configure an APIKey control + policy. + properties: + forwardHeaders: + additionalProperties: + type: string + description: ForwardHeaders instructs the middleware to forward + key metadata as header values upon successful authentication. + type: object + keySource: + description: KeySource defines how to extract API keys from requests. + properties: + cookie: + description: Cookie is the name of a cookie. + type: string + header: + description: Header is the name of a header. + type: string + headerAuthScheme: + description: |- + HeaderAuthScheme sets an optional auth scheme when Header is set to "Authorization". + If set, this scheme is removed from the token, and all requests not including it are dropped. + type: string + query: + description: Query is the name of a query parameter. + type: string + type: object + keys: + description: Keys define the set of authorized keys to access + a protected resource. + items: + description: AccessControlPolicyAPIKeyKey defines an API key. + properties: + id: + description: ID is the unique identifier of the key. + type: string + metadata: + additionalProperties: + type: string + description: Metadata holds arbitrary metadata for this + key, can be used by ForwardHeaders. + type: object + value: + description: Value is the SHAKE-256 hash (using 64 bytes) + of the API key. + type: string + required: + - id + - value + type: object + type: array + required: + - keySource + type: object + basicAuth: + description: AccessControlPolicyBasicAuth holds the HTTP basic authentication + configuration. + properties: + forwardUsernameHeader: + type: string + realm: + type: string + stripAuthorizationHeader: + type: boolean + users: + items: + type: string + type: array + type: object + jwt: + description: AccessControlPolicyJWT configures a JWT access control + policy. + properties: + claims: + type: string + forwardHeaders: + additionalProperties: + type: string + type: object + jwksFile: + type: string + jwksUrl: + type: string + publicKey: + type: string + signingSecret: + type: string + signingSecretBase64Encoded: + type: boolean + stripAuthorizationHeader: + type: boolean + tokenQueryKey: + type: string + type: object + oAuthIntro: + description: AccessControlOAuthIntro configures an OAuth 2.0 Token + Introspection access control policy. + properties: + claims: + type: string + clientConfig: + description: AccessControlOAuthIntroClientConfig configures the + OAuth 2.0 client for issuing token introspection requests. + properties: + headers: + additionalProperties: + type: string + description: Headers to set when sending requests to the Authorization + Server. + type: object + maxRetries: + default: 3 + description: MaxRetries defines the number of retries for + introspection requests. + type: integer + timeoutSeconds: + default: 5 + description: TimeoutSeconds configures the maximum amount + of seconds to wait before giving up on requests. + type: integer + tls: + description: TLS configures TLS communication with the Authorization + Server. + properties: + ca: + description: CA sets the CA bundle used to sign the Authorization + Server certificate. + type: string + insecureSkipVerify: + description: |- + InsecureSkipVerify skips the Authorization Server certificate validation. + For testing purposes only, do not use in production. + type: boolean + type: object + tokenTypeHint: + description: |- + TokenTypeHint is a hint to pass to the Authorization Server. + See https://tools.ietf.org/html/rfc7662#section-2.1 for more information. + type: string + url: + description: URL of the Authorization Server. + type: string + required: + - url + type: object + forwardHeaders: + additionalProperties: + type: string + type: object + tokenSource: + description: |- + TokenSource describes how to extract tokens from HTTP requests. + If multiple sources are set, the order is the following: header > query > cookie. + properties: + cookie: + description: Cookie is the name of a cookie. + type: string + header: + description: Header is the name of a header. + type: string + headerAuthScheme: + description: |- + HeaderAuthScheme sets an optional auth scheme when Header is set to "Authorization". + If set, this scheme is removed from the token, and all requests not including it are dropped. + type: string + query: + description: Query is the name of a query parameter. + type: string + type: object + required: + - clientConfig + - tokenSource + type: object + oidc: + description: AccessControlPolicyOIDC holds the OIDC authentication + configuration. + properties: + authParams: + additionalProperties: + type: string + type: object + claims: + type: string + clientId: + type: string + disableAuthRedirectionPaths: + items: + type: string + type: array + forwardHeaders: + additionalProperties: + type: string + type: object + issuer: + type: string + logoutUrl: + type: string + redirectUrl: + type: string + scopes: + items: + type: string + type: array + secret: + description: |- + SecretReference represents a Secret Reference. It has enough information to retrieve secret + in any namespace + properties: + name: + description: name is unique within a namespace to reference + a secret resource. + type: string + namespace: + description: namespace defines the space within which the + secret name must be unique. + type: string + type: object + x-kubernetes-map-type: atomic + session: + description: Session holds session configuration. + properties: + domain: + type: string + path: + type: string + refresh: + type: boolean + sameSite: + type: string + secure: + type: boolean + type: object + stateCookie: + description: StateCookie holds state cookie configuration. + properties: + domain: + type: string + path: + type: string + sameSite: + type: string + secure: + type: boolean + type: object + type: object + oidcGoogle: + description: AccessControlPolicyOIDCGoogle holds the Google OIDC authentication + configuration. + properties: + authParams: + additionalProperties: + type: string + type: object + clientId: + type: string + emails: + description: Emails are the allowed emails to connect. + items: + type: string + minItems: 1 + type: array + forwardHeaders: + additionalProperties: + type: string + type: object + logoutUrl: + type: string + redirectUrl: + type: string + secret: + description: |- + SecretReference represents a Secret Reference. It has enough information to retrieve secret + in any namespace + properties: + name: + description: name is unique within a namespace to reference + a secret resource. + type: string + namespace: + description: namespace defines the space within which the + secret name must be unique. + type: string + type: object + x-kubernetes-map-type: atomic + session: + description: Session holds session configuration. + properties: + domain: + type: string + path: + type: string + refresh: + type: boolean + sameSite: + type: string + secure: + type: boolean + type: object + stateCookie: + description: StateCookie holds state cookie configuration. + properties: + domain: + type: string + path: + type: string + sameSite: + type: string + secure: + type: boolean + type: object + type: object + type: object + status: + description: The current status of this access control policy. + properties: + specHash: + type: string + syncedAt: + format: date-time + type: string + version: + type: string + type: object + type: object + served: true + storage: true + +--- +# Source: traefik/crds/hub.traefik.io_aiservices.yaml +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.17.1 + name: aiservices.hub.traefik.io +spec: + group: hub.traefik.io + names: + kind: AIService + listKind: AIServiceList + plural: aiservices + singular: aiservice + scope: Namespaced + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: AIService is a Kubernetes-like Service to interact with a text-based + LLM provider. It defines the parameters and credentials required to interact + with various LLM providers. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: The desired behavior of this AIService. + properties: + anthropic: + description: Anthropic configures Anthropic backend. + properties: + model: + type: string + params: + description: Params holds the LLM hyperparameters. + properties: + frequencyPenalty: + type: number + maxTokens: + type: integer + presencePenalty: + type: number + temperature: + type: number + topP: + type: number + type: object + token: + type: string + required: + - token + type: object + azureOpenai: + description: AzureOpenAI configures AzureOpenAI. + properties: + apiKey: + type: string + baseUrl: + type: string + deploymentName: + type: string + model: + type: string + params: + description: Params holds the LLM hyperparameters. + properties: + frequencyPenalty: + type: number + maxTokens: + type: integer + presencePenalty: + type: number + temperature: + type: number + topP: + type: number + type: object + required: + - apiKey + - baseUrl + - deploymentName + type: object + bedrock: + description: Bedrock configures Bedrock backend. + properties: + model: + type: string + params: + description: Params holds the LLM hyperparameters. + properties: + frequencyPenalty: + type: number + maxTokens: + type: integer + presencePenalty: + type: number + temperature: + type: number + topP: + type: number + type: object + region: + type: string + systemMessage: + type: boolean + type: object + cohere: + description: Cohere configures Cohere backend. + properties: + model: + type: string + params: + description: Params holds the LLM hyperparameters. + properties: + frequencyPenalty: + type: number + maxTokens: + type: integer + presencePenalty: + type: number + temperature: + type: number + topP: + type: number + type: object + token: + type: string + required: + - token + type: object + deepSeek: + description: DeepSeek configures DeepSeek. + properties: + baseUrl: + type: string + model: + type: string + params: + description: Params holds the LLM hyperparameters. + properties: + frequencyPenalty: + type: number + maxTokens: + type: integer + presencePenalty: + type: number + temperature: + type: number + topP: + type: number + type: object + token: + type: string + required: + - token + type: object + gemini: + description: Gemini configures Gemini backend. + properties: + apiKey: + type: string + model: + type: string + params: + description: Params holds the LLM hyperparameters. + properties: + frequencyPenalty: + type: number + maxTokens: + type: integer + presencePenalty: + type: number + temperature: + type: number + topP: + type: number + type: object + required: + - apiKey + type: object + mistral: + description: Mistral configures Mistral AI backend. + properties: + apiKey: + type: string + model: + type: string + params: + description: Params holds the LLM hyperparameters. + properties: + frequencyPenalty: + type: number + maxTokens: + type: integer + presencePenalty: + type: number + temperature: + type: number + topP: + type: number + type: object + required: + - apiKey + type: object + ollama: + description: Ollama configures Ollama backend. + properties: + baseUrl: + type: string + model: + type: string + params: + description: Params holds the LLM hyperparameters. + properties: + frequencyPenalty: + type: number + maxTokens: + type: integer + presencePenalty: + type: number + temperature: + type: number + topP: + type: number + type: object + required: + - baseUrl + type: object + openai: + description: OpenAI configures OpenAI. + properties: + baseUrl: + type: string + model: + type: string + params: + description: Params holds the LLM hyperparameters. + properties: + frequencyPenalty: + type: number + maxTokens: + type: integer + presencePenalty: + type: number + temperature: + type: number + topP: + type: number + type: object + token: + type: string + required: + - token + type: object + qWen: + description: QWen configures QWen. + properties: + baseUrl: + type: string + model: + type: string + params: + description: Params holds the LLM hyperparameters. + properties: + frequencyPenalty: + type: number + maxTokens: + type: integer + presencePenalty: + type: number + temperature: + type: number + topP: + type: number + type: object + token: + type: string + required: + - token + type: object + type: object + type: object + served: true + storage: true + +--- +# Source: traefik/crds/hub.traefik.io_apiaccesses.yaml +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.17.1 + name: apiaccesses.hub.traefik.io +spec: + group: hub.traefik.io + names: + kind: APIAccess + listKind: APIAccessList + plural: apiaccesses + singular: apiaccess + scope: Namespaced + versions: + - deprecated: true + deprecationWarning: APIAccess is deprecated in favor of APICatalogItems and ManagedSubscription + name: v1alpha1 + schema: + openAPIV3Schema: + description: APIAccess defines who can access to a set of APIs. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: The desired behavior of this APIAccess. + properties: + apiBundles: + description: |- + APIBundles defines a set of APIBundle that will be accessible to the configured audience. + Multiple APIAccesses can select the same APIBundles. + items: + description: APIBundleReference references an APIBundle. + properties: + name: + description: Name of the APIBundle. + maxLength: 253 + type: string + required: + - name + type: object + maxItems: 100 + type: array + x-kubernetes-validations: + - message: duplicated apiBundles + rule: self.all(x, self.exists_one(y, x.name == y.name)) + apiPlan: + description: APIPlan defines which APIPlan will be used. + properties: + name: + description: Name of the APIPlan. + maxLength: 253 + type: string + required: + - name + type: object + apiSelector: + description: |- + APISelector selects the APIs that will be accessible to the configured audience. + Multiple APIAccesses can select the same set of APIs. + This field is optional and follows standard label selector semantics. + An empty APISelector matches any API. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + apis: + description: |- + APIs defines a set of APIs that will be accessible to the configured audience. + Multiple APIAccesses can select the same APIs. + When combined with APISelector, this set of APIs is appended to the matching APIs. + items: + description: APIReference references an API. + properties: + name: + description: Name of the API. + maxLength: 253 + type: string + required: + - name + type: object + maxItems: 100 + type: array + x-kubernetes-validations: + - message: duplicated apis + rule: self.all(x, self.exists_one(y, x.name == y.name)) + everyone: + description: Everyone indicates that all users will have access to + the selected APIs. + type: boolean + groups: + description: Groups are the consumer groups that will gain access + to the selected APIs. + items: + type: string + type: array + operationFilter: + description: |- + OperationFilter specifies the allowed operations on APIs and APIVersions. + If not set, all operations are available. + An empty OperationFilter prohibits all operations. + properties: + include: + description: Include defines the names of OperationSets that will + be accessible. + items: + type: string + maxItems: 100 + type: array + type: object + weight: + description: Weight specifies the evaluation order of the plan. + type: integer + x-kubernetes-validations: + - message: must be a positive number + rule: self >= 0 + type: object + x-kubernetes-validations: + - message: groups and everyone are mutually exclusive + rule: '(has(self.everyone) && has(self.groups)) ? !(self.everyone && + self.groups.size() > 0) : true' + status: + description: The current status of this APIAccess. + properties: + hash: + description: Hash is a hash representing the APIAccess. + type: string + syncedAt: + format: date-time + type: string + version: + type: string + type: object + type: object + served: true + storage: true + +--- +# Source: traefik/crds/hub.traefik.io_apibundles.yaml +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.17.1 + name: apibundles.hub.traefik.io +spec: + group: hub.traefik.io + names: + kind: APIBundle + listKind: APIBundleList + plural: apibundles + singular: apibundle + scope: Namespaced + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: APIBundle defines a set of APIs. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: The desired behavior of this APIBundle. + properties: + apiSelector: + description: |- + APISelector selects the APIs that will be accessible to the configured audience. + Multiple APIBundles can select the same set of APIs. + This field is optional and follows standard label selector semantics. + An empty APISelector matches any API. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + apis: + description: |- + APIs defines a set of APIs that will be accessible to the configured audience. + Multiple APIBundles can select the same APIs. + When combined with APISelector, this set of APIs is appended to the matching APIs. + items: + description: APIReference references an API. + properties: + name: + description: Name of the API. + maxLength: 253 + type: string + required: + - name + type: object + maxItems: 100 + type: array + x-kubernetes-validations: + - message: duplicated apis + rule: self.all(x, self.exists_one(y, x.name == y.name)) + title: + description: Title is the human-readable name of the APIBundle that + will be used on the portal. + maxLength: 253 + type: string + type: object + status: + description: The current status of this APIBundle. + properties: + hash: + description: Hash is a hash representing the APIBundle. + type: string + syncedAt: + format: date-time + type: string + version: + type: string + type: object + type: object + served: true + storage: true + +--- +# Source: traefik/crds/hub.traefik.io_apicatalogitems.yaml +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.17.1 + name: apicatalogitems.hub.traefik.io +spec: + group: hub.traefik.io + names: + kind: APICatalogItem + listKind: APICatalogItemList + plural: apicatalogitems + singular: apicatalogitem + scope: Namespaced + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: APICatalogItem defines APIs that will be part of the API catalog + on the portal. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: The desired behavior of this APICatalogItem. + properties: + apiBundles: + description: |- + APIBundles defines a set of APIBundle that will be visible to the configured audience. + Multiple APICatalogItem can select the same APIBundles. + items: + description: APIBundleReference references an APIBundle. + properties: + name: + description: Name of the APIBundle. + maxLength: 253 + type: string + required: + - name + type: object + maxItems: 100 + type: array + x-kubernetes-validations: + - message: duplicated apiBundles + rule: self.all(x, self.exists_one(y, x.name == y.name)) + apiPlan: + description: |- + APIPlan defines which APIPlan will be available. + If multiple APICatalogItem specify the same API with different APIPlan, the API consumer will be able to pick + a plan from this list. + properties: + name: + description: Name of the APIPlan. + maxLength: 253 + type: string + required: + - name + type: object + apiSelector: + description: |- + APISelector selects the APIs that will be visible to the configured audience. + Multiple APICatalogItem can select the same set of APIs. + This field is optional and follows standard label selector semantics. + An empty APISelector matches any API. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + apis: + description: |- + APIs defines a set of APIs that will be visible to the configured audience. + Multiple APICatalogItem can select the same APIs. + When combined with APISelector, this set of APIs is appended to the matching APIs. + items: + description: APIReference references an API. + properties: + name: + description: Name of the API. + maxLength: 253 + type: string + required: + - name + type: object + maxItems: 100 + type: array + x-kubernetes-validations: + - message: duplicated apis + rule: self.all(x, self.exists_one(y, x.name == y.name)) + everyone: + description: Everyone indicates that all users will see these APIs. + type: boolean + groups: + description: Groups are the consumer groups that will see the APIs. + items: + type: string + type: array + operationFilter: + description: |- + OperationFilter specifies the visible operations on APIs and APIVersions. + If not set, all operations are available. + An empty OperationFilter prohibits all operations. + properties: + include: + description: Include defines the names of OperationSets that will + be accessible. + items: + type: string + maxItems: 100 + type: array + type: object + type: object + x-kubernetes-validations: + - message: groups and everyone are mutually exclusive + rule: '(has(self.everyone) && has(self.groups)) ? !(self.everyone && + self.groups.size() > 0) : true' + status: + description: The current status of this APICatalogItem. + properties: + hash: + description: Hash is a hash representing the APICatalogItem. + type: string + syncedAt: + format: date-time + type: string + version: + type: string + type: object + type: object + served: true + storage: true + +--- +# Source: traefik/crds/hub.traefik.io_apiplans.yaml +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.17.1 + name: apiplans.hub.traefik.io +spec: + group: hub.traefik.io + names: + kind: APIPlan + listKind: APIPlanList + plural: apiplans + singular: apiplan + scope: Namespaced + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: APIPlan defines API Plan policy. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: The desired behavior of this APIPlan. + properties: + description: + description: Description describes the plan. + type: string + quota: + description: Quota defines the quota policy. + properties: + limit: + description: Limit is the maximum number of token in the bucket. + type: integer + x-kubernetes-validations: + - message: must be a positive number + rule: self >= 0 + period: + description: Period is the unit of time for the Limit. + format: duration + type: string + x-kubernetes-validations: + - message: must be between 1s and 9999h + rule: self >= duration('1s') && self <= duration('9999h') + required: + - limit + type: object + rateLimit: + description: RateLimit defines the rate limit policy. + properties: + limit: + description: Limit is the maximum number of token in the bucket. + type: integer + x-kubernetes-validations: + - message: must be a positive number + rule: self >= 0 + period: + description: Period is the unit of time for the Limit. + format: duration + type: string + x-kubernetes-validations: + - message: must be between 1s and 1h + rule: self >= duration('1s') && self <= duration('1h') + required: + - limit + type: object + title: + description: Title is the human-readable name of the plan. + type: string + required: + - title + type: object + status: + description: The current status of this APIPlan. + properties: + hash: + description: Hash is a hash representing the APIPlan. + type: string + syncedAt: + format: date-time + type: string + version: + type: string + type: object + type: object + served: true + storage: true + +--- +# Source: traefik/crds/hub.traefik.io_apiportals.yaml +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.17.1 + name: apiportals.hub.traefik.io +spec: + group: hub.traefik.io + names: + kind: APIPortal + listKind: APIPortalList + plural: apiportals + singular: apiportal + scope: Namespaced + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: APIPortal defines a developer portal for accessing the documentation + of APIs. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: The desired behavior of this APIPortal. + properties: + description: + description: Description of the APIPortal. + type: string + title: + description: Title is the public facing name of the APIPortal. + type: string + trustedUrls: + description: TrustedURLs are the urls that are trusted by the OAuth + 2.0 authorization server. + items: + type: string + maxItems: 1 + minItems: 1 + type: array + x-kubernetes-validations: + - message: must be a valid URLs + rule: self.all(x, isURL(x)) + ui: + description: UI holds the UI customization options. + properties: + logoUrl: + description: LogoURL is the public URL of the logo. + type: string + type: object + required: + - trustedUrls + type: object + status: + description: The current status of this APIPortal. + properties: + hash: + description: Hash is a hash representing the APIPortal. + type: string + oidc: + description: OIDC is the OIDC configuration for accessing the exposed + APIPortal WebUI. + properties: + clientId: + description: ClientID is the OIDC ClientID for accessing the exposed + APIPortal WebUI. + type: string + companyClaim: + description: CompanyClaim is the name of the JWT claim containing + the user company. + type: string + emailClaim: + description: EmailClaim is the name of the JWT claim containing + the user email. + type: string + firstnameClaim: + description: FirstnameClaim is the name of the JWT claim containing + the user firstname. + type: string + generic: + description: Generic indicates whether or not the APIPortal authentication + relies on Generic OIDC. + type: boolean + groupsClaim: + description: GroupsClaim is the name of the JWT claim containing + the user groups. + type: string + issuer: + description: Issuer is the OIDC issuer for accessing the exposed + APIPortal WebUI. + type: string + lastnameClaim: + description: LastnameClaim is the name of the JWT claim containing + the user lastname. + type: string + scopes: + description: Scopes is the OIDC scopes for getting user attributes + during the authentication to the exposed APIPortal WebUI. + type: string + secretName: + description: SecretName is the name of the secret containing the + OIDC ClientSecret for accessing the exposed APIPortal WebUI. + type: string + syncedAttributes: + description: SyncedAttributes configure the user attributes to + sync. + items: + type: string + type: array + userIdClaim: + description: UserIDClaim is the name of the JWT claim containing + the user ID. + type: string + type: object + syncedAt: + format: date-time + type: string + version: + type: string + type: object + type: object + served: true + storage: true + +--- +# Source: traefik/crds/hub.traefik.io_apiratelimits.yaml +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.17.1 + name: apiratelimits.hub.traefik.io +spec: + group: hub.traefik.io + names: + kind: APIRateLimit + listKind: APIRateLimitList + plural: apiratelimits + singular: apiratelimit + scope: Namespaced + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: APIRateLimit defines how group of consumers are rate limited + on a set of APIs. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: The desired behavior of this APIRateLimit. + properties: + apiSelector: + description: |- + APISelector selects the APIs that will be rate limited. + Multiple APIRateLimits can select the same set of APIs. + This field is optional and follows standard label selector semantics. + An empty APISelector matches any API. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + apis: + description: |- + APIs defines a set of APIs that will be rate limited. + Multiple APIRateLimits can select the same APIs. + When combined with APISelector, this set of APIs is appended to the matching APIs. + items: + description: APIReference references an API. + properties: + name: + description: Name of the API. + maxLength: 253 + type: string + required: + - name + type: object + maxItems: 100 + type: array + x-kubernetes-validations: + - message: duplicated apis + rule: self.all(x, self.exists_one(y, x.name == y.name)) + everyone: + description: |- + Everyone indicates that all users will, by default, be rate limited with this configuration. + If an APIRateLimit explicitly target a group, the default rate limit will be ignored. + type: boolean + groups: + description: |- + Groups are the consumer groups that will be rate limited. + Multiple APIRateLimits can target the same set of consumer groups, the most restrictive one applies. + When a consumer belongs to multiple groups, the least restrictive APIRateLimit applies. + items: + type: string + type: array + limit: + description: Limit is the maximum number of token in the bucket. + type: integer + x-kubernetes-validations: + - message: must be a positive number + rule: self >= 0 + period: + description: Period is the unit of time for the Limit. + format: duration + type: string + x-kubernetes-validations: + - message: must be between 1s and 1h + rule: self >= duration('1s') && self <= duration('1h') + strategy: + description: |- + Strategy defines how the bucket state will be synchronized between the different Traefik Hub instances. + It can be, either "local" or "distributed". + enum: + - local + - distributed + type: string + required: + - limit + type: object + x-kubernetes-validations: + - message: groups and everyone are mutually exclusive + rule: '(has(self.everyone) && has(self.groups)) ? !(self.everyone && + self.groups.size() > 0) : true' + status: + description: The current status of this APIRateLimit. + properties: + hash: + description: Hash is a hash representing the APIRateLimit. + type: string + syncedAt: + format: date-time + type: string + version: + type: string + type: object + type: object + served: true + storage: true + +--- +# Source: traefik/crds/hub.traefik.io_apis.yaml +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.17.1 + name: apis.hub.traefik.io +spec: + group: hub.traefik.io + names: + kind: API + listKind: APIList + plural: apis + singular: api + scope: Namespaced + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: |- + API defines an HTTP interface that is exposed to external clients. It specifies the supported versions + and provides instructions for accessing its documentation. Once instantiated, an API object is associated + with an Ingress, IngressRoute, or HTTPRoute resource, enabling the exposure of the described API to the outside world. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: APISpec describes the API. + properties: + cors: + description: Cors defines the Cross-Origin Resource Sharing configuration. + properties: + addVaryHeader: + description: AddVaryHeader defines whether the Vary header is + automatically added/updated when the AllowOriginsList is set. + type: boolean + allowCredentials: + description: AllowCredentials defines whether the request can + include user credentials. + type: boolean + allowHeadersList: + description: AllowHeadersList defines the Access-Control-Request-Headers + values sent in preflight response. + items: + type: string + type: array + allowMethodsList: + description: AllowMethodsList defines the Access-Control-Request-Method + values sent in preflight response. + items: + type: string + type: array + allowOriginListRegex: + description: AllowOriginListRegex is a list of allowable origins + written following the Regular Expression syntax (https://golang.org/pkg/regexp/). + items: + type: string + type: array + allowOriginsList: + description: AllowOriginsList is a list of allowable origins. + Can also be a wildcard origin "*". + items: + type: string + type: array + exposeHeadersList: + description: ExposeHeadersList defines the Access-Control-Expose-Headers + values sent in preflight response. + items: + type: string + type: array + maxAge: + description: MaxAge defines the time that a preflight request + may be cached. + format: int64 + type: integer + type: object + description: + description: Description explains what the API does. + type: string + openApiSpec: + description: OpenAPISpec defines the API contract as an OpenAPI specification. + properties: + operationSets: + description: OperationSets defines the sets of operations to be + referenced for granular filtering in APIAccesses. + items: + description: |- + OperationSet gives a name to a set of matching OpenAPI operations. + This set of operations can then be referenced for granular filtering in APIAccesses. + properties: + matchers: + description: Matchers defines a list of alternative rules + for matching OpenAPI operations. + items: + description: OperationMatcher defines criteria for matching + an OpenAPI operation. + minProperties: 1 + properties: + methods: + description: Methods specifies the HTTP methods to + be included for selection. + items: + type: string + maxItems: 10 + type: array + path: + description: Path specifies the exact path of the + operations to select. + maxLength: 255 + type: string + x-kubernetes-validations: + - message: must start with a '/' + rule: self.startsWith('/') + - message: cannot contains '../' + rule: '!self.matches(r"""(\/\.\.\/)|(\/\.\.$)""")' + pathPrefix: + description: PathPrefix specifies the path prefix + of the operations to select. + maxLength: 255 + type: string + x-kubernetes-validations: + - message: must start with a '/' + rule: self.startsWith('/') + - message: cannot contains '../' + rule: '!self.matches(r"""(\/\.\.\/)|(\/\.\.$)""")' + pathRegex: + description: PathRegex specifies a regular expression + pattern for matching operations based on their paths. + type: string + type: object + x-kubernetes-validations: + - message: path, pathPrefix and pathRegex are mutually + exclusive + rule: '[has(self.path), has(self.pathPrefix), has(self.pathRegex)].filter(x, + x).size() <= 1' + maxItems: 100 + minItems: 1 + type: array + name: + description: Name is the name of the OperationSet to reference + in APIAccesses. + maxLength: 253 + type: string + required: + - matchers + - name + type: object + maxItems: 100 + type: array + override: + description: Override holds data used to override OpenAPI specification. + properties: + servers: + items: + properties: + url: + type: string + x-kubernetes-validations: + - message: must be a valid URL + rule: isURL(self) + required: + - url + type: object + maxItems: 100 + minItems: 1 + type: array + required: + - servers + type: object + path: + description: |- + Path specifies the endpoint path within the Kubernetes Service where the OpenAPI specification can be obtained. + The Service queried is determined by the associated Ingress, IngressRoute, or HTTPRoute resource to which the API is attached. + It's important to note that this option is incompatible if the Ingress or IngressRoute specifies multiple backend services. + The Path must be accessible via a GET request method and should serve a YAML or JSON document containing the OpenAPI specification. + maxLength: 255 + type: string + x-kubernetes-validations: + - message: must start with a '/' + rule: self.startsWith('/') + - message: cannot contains '../' + rule: '!self.matches(r"""(\/\.\.\/)|(\/\.\.$)""")' + url: + description: |- + URL is a Traefik Hub agent accessible URL for obtaining the OpenAPI specification. + The URL must be accessible via a GET request method and should serve a YAML or JSON document containing the OpenAPI specification. + type: string + x-kubernetes-validations: + - message: must be a valid URL + rule: isURL(self) + validateRequestMethodAndPath: + description: |- + ValidateRequestMethodAndPath validates that the path and method matches an operation defined in the OpenAPI specification. + This option overrides the default behavior configured in the static configuration. + type: boolean + type: object + x-kubernetes-validations: + - message: path or url must be defined + rule: has(self.path) || has(self.url) + title: + description: Title is the human-readable name of the API that will + be used on the portal. + maxLength: 253 + type: string + versions: + description: Versions are the different APIVersions available. + items: + description: APIVersionRef references an APIVersion. + properties: + name: + description: Name of the APIVersion. + maxLength: 253 + type: string + required: + - name + type: object + maxItems: 100 + minItems: 1 + type: array + type: object + status: + description: The current status of this API. + properties: + hash: + description: Hash is a hash representing the API. + type: string + syncedAt: + format: date-time + type: string + version: + type: string + type: object + type: object + served: true + storage: true + +--- +# Source: traefik/crds/hub.traefik.io_apiversions.yaml +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.17.1 + name: apiversions.hub.traefik.io +spec: + group: hub.traefik.io + names: + kind: APIVersion + listKind: APIVersionList + plural: apiversions + singular: apiversion + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .spec.title + name: Title + type: string + - jsonPath: .spec.release + name: Release + type: string + name: v1alpha1 + schema: + openAPIV3Schema: + description: APIVersion defines a version of an API. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: The desired behavior of this APIVersion. + properties: + cors: + description: Cors defines the Cross-Origin Resource Sharing configuration. + properties: + addVaryHeader: + description: AddVaryHeader defines whether the Vary header is + automatically added/updated when the AllowOriginsList is set. + type: boolean + allowCredentials: + description: AllowCredentials defines whether the request can + include user credentials. + type: boolean + allowHeadersList: + description: AllowHeadersList defines the Access-Control-Request-Headers + values sent in preflight response. + items: + type: string + type: array + allowMethodsList: + description: AllowMethodsList defines the Access-Control-Request-Method + values sent in preflight response. + items: + type: string + type: array + allowOriginListRegex: + description: AllowOriginListRegex is a list of allowable origins + written following the Regular Expression syntax (https://golang.org/pkg/regexp/). + items: + type: string + type: array + allowOriginsList: + description: AllowOriginsList is a list of allowable origins. + Can also be a wildcard origin "*". + items: + type: string + type: array + exposeHeadersList: + description: ExposeHeadersList defines the Access-Control-Expose-Headers + values sent in preflight response. + items: + type: string + type: array + maxAge: + description: MaxAge defines the time that a preflight request + may be cached. + format: int64 + type: integer + type: object + description: + description: Description explains what the APIVersion does. + type: string + openApiSpec: + description: OpenAPISpec defines the API contract as an OpenAPI specification. + properties: + operationSets: + description: OperationSets defines the sets of operations to be + referenced for granular filtering in APIAccesses. + items: + description: |- + OperationSet gives a name to a set of matching OpenAPI operations. + This set of operations can then be referenced for granular filtering in APIAccesses. + properties: + matchers: + description: Matchers defines a list of alternative rules + for matching OpenAPI operations. + items: + description: OperationMatcher defines criteria for matching + an OpenAPI operation. + minProperties: 1 + properties: + methods: + description: Methods specifies the HTTP methods to + be included for selection. + items: + type: string + maxItems: 10 + type: array + path: + description: Path specifies the exact path of the + operations to select. + maxLength: 255 + type: string + x-kubernetes-validations: + - message: must start with a '/' + rule: self.startsWith('/') + - message: cannot contains '../' + rule: '!self.matches(r"""(\/\.\.\/)|(\/\.\.$)""")' + pathPrefix: + description: PathPrefix specifies the path prefix + of the operations to select. + maxLength: 255 + type: string + x-kubernetes-validations: + - message: must start with a '/' + rule: self.startsWith('/') + - message: cannot contains '../' + rule: '!self.matches(r"""(\/\.\.\/)|(\/\.\.$)""")' + pathRegex: + description: PathRegex specifies a regular expression + pattern for matching operations based on their paths. + type: string + type: object + x-kubernetes-validations: + - message: path, pathPrefix and pathRegex are mutually + exclusive + rule: '[has(self.path), has(self.pathPrefix), has(self.pathRegex)].filter(x, + x).size() <= 1' + maxItems: 100 + minItems: 1 + type: array + name: + description: Name is the name of the OperationSet to reference + in APIAccesses. + maxLength: 253 + type: string + required: + - matchers + - name + type: object + maxItems: 100 + type: array + override: + description: Override holds data used to override OpenAPI specification. + properties: + servers: + items: + properties: + url: + type: string + x-kubernetes-validations: + - message: must be a valid URL + rule: isURL(self) + required: + - url + type: object + maxItems: 100 + minItems: 1 + type: array + required: + - servers + type: object + path: + description: |- + Path specifies the endpoint path within the Kubernetes Service where the OpenAPI specification can be obtained. + The Service queried is determined by the associated Ingress, IngressRoute, or HTTPRoute resource to which the API is attached. + It's important to note that this option is incompatible if the Ingress or IngressRoute specifies multiple backend services. + The Path must be accessible via a GET request method and should serve a YAML or JSON document containing the OpenAPI specification. + maxLength: 255 + type: string + x-kubernetes-validations: + - message: must start with a '/' + rule: self.startsWith('/') + - message: cannot contains '../' + rule: '!self.matches(r"""(\/\.\.\/)|(\/\.\.$)""")' + url: + description: |- + URL is a Traefik Hub agent accessible URL for obtaining the OpenAPI specification. + The URL must be accessible via a GET request method and should serve a YAML or JSON document containing the OpenAPI specification. + type: string + x-kubernetes-validations: + - message: must be a valid URL + rule: isURL(self) + validateRequestMethodAndPath: + description: |- + ValidateRequestMethodAndPath validates that the path and method matches an operation defined in the OpenAPI specification. + This option overrides the default behavior configured in the static configuration. + type: boolean + type: object + x-kubernetes-validations: + - message: path or url must be defined + rule: has(self.path) || has(self.url) + release: + description: |- + Release is the version number of the API. + This value must follow the SemVer format: https://semver.org/ + maxLength: 100 + type: string + x-kubernetes-validations: + - message: must be a valid semver version + rule: self.matches(r"""^v?(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?$""") + title: + description: Title is the public facing name of the APIVersion. + type: string + required: + - release + type: object + status: + description: The current status of this APIVersion. + properties: + hash: + description: Hash is a hash representing the APIVersion. + type: string + syncedAt: + format: date-time + type: string + version: + type: string + type: object + type: object + served: true + storage: true + subresources: {} + +--- +# Source: traefik/crds/hub.traefik.io_managedsubscriptions.yaml +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.17.1 + name: managedsubscriptions.hub.traefik.io +spec: + group: hub.traefik.io + names: + kind: ManagedSubscription + listKind: ManagedSubscriptionList + plural: managedsubscriptions + singular: managedsubscription + scope: Namespaced + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: |- + ManagedSubscription defines a Subscription managed by the API manager as the result of a pre-negotiation with its + API consumers. This subscription grant consuming access to a set of APIs to a set of Applications. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: The desired behavior of this ManagedSubscription. + properties: + apiBundles: + description: |- + APIBundles defines a set of APIBundle that will be accessible. + Multiple ManagedSubscriptions can select the same APIBundles. + items: + description: APIBundleReference references an APIBundle. + properties: + name: + description: Name of the APIBundle. + maxLength: 253 + type: string + required: + - name + type: object + maxItems: 100 + type: array + x-kubernetes-validations: + - message: duplicated apiBundles + rule: self.all(x, self.exists_one(y, x.name == y.name)) + apiPlan: + description: APIPlan defines which APIPlan will be used. + properties: + name: + description: Name of the APIPlan. + maxLength: 253 + type: string + required: + - name + type: object + apiSelector: + description: |- + APISelector selects the APIs that will be accessible. + Multiple ManagedSubscriptions can select the same set of APIs. + This field is optional and follows standard label selector semantics. + An empty APISelector matches any API. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + apis: + description: |- + APIs defines a set of APIs that will be accessible. + Multiple ManagedSubscriptions can select the same APIs. + When combined with APISelector, this set of APIs is appended to the matching APIs. + items: + description: APIReference references an API. + properties: + name: + description: Name of the API. + maxLength: 253 + type: string + required: + - name + type: object + maxItems: 100 + type: array + x-kubernetes-validations: + - message: duplicated apis + rule: self.all(x, self.exists_one(y, x.name == y.name)) + applications: + description: |- + Applications references the Applications that will gain access to the specified APIs. + Multiple ManagedSubscriptions can select the same AppID. + items: + description: ApplicationReference references an Application. + properties: + appId: + description: |- + AppID is the public identifier of the application. + In the case of OIDC, it corresponds to the clientId. + maxLength: 253 + type: string + required: + - appId + type: object + maxItems: 100 + minItems: 1 + type: array + claims: + description: Claims specifies an expression that validate claims in + order to authorize the request. + type: string + operationFilter: + description: |- + OperationFilter specifies the allowed operations on APIs and APIVersions. + If not set, all operations are available. + An empty OperationFilter prohibits all operations. + properties: + include: + description: Include defines the names of OperationSets that will + be accessible. + items: + type: string + maxItems: 100 + type: array + type: object + weight: + description: |- + Weight specifies the evaluation order of the APIPlan. + When multiple ManagedSubscriptions targets the same API and Application with different APIPlan, + the APIPlan with the highest weight will be enforced. If weights are equal, alphabetical order is used. + type: integer + x-kubernetes-validations: + - message: must be a positive number + rule: self >= 0 + required: + - apiPlan + - applications + type: object + status: + description: The current status of this ManagedSubscription. + properties: + hash: + description: Hash is a hash representing the ManagedSubscription. + type: string + syncedAt: + format: date-time + type: string + version: + type: string + type: object + type: object + served: true + storage: true + +--- +# Source: traefik/crds/traefik.io_ingressroutes.yaml +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.16.1 + name: ingressroutes.traefik.io +spec: + group: traefik.io + names: + kind: IngressRoute + listKind: IngressRouteList + plural: ingressroutes + singular: ingressroute + scope: Namespaced + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: IngressRoute is the CRD implementation of a Traefik HTTP Router. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: IngressRouteSpec defines the desired state of IngressRoute. + properties: + entryPoints: + description: |- + EntryPoints defines the list of entry point names to bind to. + Entry points have to be configured in the static configuration. + More info: https://doc.traefik.io/traefik/v3.3/routing/entrypoints/ + Default: all. + items: + type: string + type: array + routes: + description: Routes defines the list of routes. + items: + description: Route holds the HTTP route configuration. + properties: + kind: + description: |- + Kind defines the kind of the route. + Rule is the only supported kind. + If not defined, defaults to Rule. + enum: + - Rule + type: string + match: + description: |- + Match defines the router's rule. + More info: https://doc.traefik.io/traefik/v3.3/routing/routers/#rule + type: string + middlewares: + description: |- + Middlewares defines the list of references to Middleware resources. + More info: https://doc.traefik.io/traefik/v3.3/routing/providers/kubernetes-crd/#kind-middleware + items: + description: MiddlewareRef is a reference to a Middleware + resource. + properties: + name: + description: Name defines the name of the referenced Middleware + resource. + type: string + namespace: + description: Namespace defines the namespace of the referenced + Middleware resource. + type: string + required: + - name + type: object + type: array + observability: + description: |- + Observability defines the observability configuration for a router. + More info: https://doc.traefik.io/traefik/v3.2/routing/routers/#observability + properties: + accessLogs: + type: boolean + metrics: + type: boolean + tracing: + type: boolean + type: object + priority: + description: |- + Priority defines the router's priority. + More info: https://doc.traefik.io/traefik/v3.3/routing/routers/#priority + type: integer + services: + description: |- + Services defines the list of Service. + It can contain any combination of TraefikService and/or reference to a Kubernetes Service. + items: + description: Service defines an upstream HTTP service to proxy + traffic to. + properties: + healthCheck: + description: Healthcheck defines health checks for ExternalName + services. + properties: + followRedirects: + description: |- + FollowRedirects defines whether redirects should be followed during the health check calls. + Default: true + type: boolean + headers: + additionalProperties: + type: string + description: Headers defines custom headers to be + sent to the health check endpoint. + type: object + hostname: + description: Hostname defines the value of hostname + in the Host header of the health check request. + type: string + interval: + anyOf: + - type: integer + - type: string + description: |- + Interval defines the frequency of the health check calls. + Default: 30s + x-kubernetes-int-or-string: true + method: + description: Method defines the healthcheck method. + type: string + mode: + description: |- + Mode defines the health check mode. + If defined to grpc, will use the gRPC health check protocol to probe the server. + Default: http + type: string + path: + description: Path defines the server URL path for + the health check endpoint. + type: string + port: + description: Port defines the server URL port for + the health check endpoint. + type: integer + scheme: + description: Scheme replaces the server URL scheme + for the health check endpoint. + type: string + status: + description: Status defines the expected HTTP status + code of the response to the health check request. + type: integer + timeout: + anyOf: + - type: integer + - type: string + description: |- + Timeout defines the maximum duration Traefik will wait for a health check request before considering the server unhealthy. + Default: 5s + x-kubernetes-int-or-string: true + type: object + kind: + description: Kind defines the kind of the Service. + enum: + - Service + - TraefikService + type: string + name: + description: |- + Name defines the name of the referenced Kubernetes Service or TraefikService. + The differentiation between the two is specified in the Kind field. + type: string + namespace: + description: Namespace defines the namespace of the referenced + Kubernetes Service or TraefikService. + type: string + nativeLB: + description: |- + NativeLB controls, when creating the load-balancer, + whether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP. + The Kubernetes Service itself does load-balance to the pods. + By default, NativeLB is false. + type: boolean + nodePortLB: + description: |- + NodePortLB controls, when creating the load-balancer, + whether the LB's children are directly the nodes internal IPs using the nodePort when the service type is NodePort. + It allows services to be reachable when Traefik runs externally from the Kubernetes cluster but within the same network of the nodes. + By default, NodePortLB is false. + type: boolean + passHostHeader: + description: |- + PassHostHeader defines whether the client Host header is forwarded to the upstream Kubernetes Service. + By default, passHostHeader is true. + type: boolean + port: + anyOf: + - type: integer + - type: string + description: |- + Port defines the port of a Kubernetes Service. + This can be a reference to a named port. + x-kubernetes-int-or-string: true + responseForwarding: + description: ResponseForwarding defines how Traefik forwards + the response from the upstream Kubernetes Service to + the client. + properties: + flushInterval: + description: |- + FlushInterval defines the interval, in milliseconds, in between flushes to the client while copying the response body. + A negative value means to flush immediately after each write to the client. + This configuration is ignored when ReverseProxy recognizes a response as a streaming response; + for such responses, writes are flushed to the client immediately. + Default: 100ms + type: string + type: object + scheme: + description: |- + Scheme defines the scheme to use for the request to the upstream Kubernetes Service. + It defaults to https when Kubernetes Service port is 443, http otherwise. + type: string + serversTransport: + description: |- + ServersTransport defines the name of ServersTransport resource to use. + It allows to configure the transport between Traefik and your servers. + Can only be used on a Kubernetes Service. + type: string + sticky: + description: |- + Sticky defines the sticky sessions configuration. + More info: https://doc.traefik.io/traefik/v3.3/routing/services/#sticky-sessions + properties: + cookie: + description: Cookie defines the sticky cookie configuration. + properties: + httpOnly: + description: HTTPOnly defines whether the cookie + can be accessed by client-side APIs, such as + JavaScript. + type: boolean + maxAge: + description: |- + MaxAge defines the number of seconds until the cookie expires. + When set to a negative number, the cookie expires immediately. + When set to zero, the cookie never expires. + type: integer + name: + description: Name defines the Cookie name. + type: string + path: + description: |- + Path defines the path that must exist in the requested URL for the browser to send the Cookie header. + When not provided the cookie will be sent on every request to the domain. + More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#pathpath-value + type: string + sameSite: + description: |- + SameSite defines the same site policy. + More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite + type: string + secure: + description: Secure defines whether the cookie + can only be transmitted over an encrypted connection + (i.e. HTTPS). + type: boolean + type: object + type: object + strategy: + description: |- + Strategy defines the load balancing strategy between the servers. + RoundRobin is the only supported value at the moment. + type: string + weight: + description: |- + Weight defines the weight and should only be specified when Name references a TraefikService object + (and to be precise, one that embeds a Weighted Round Robin). + type: integer + required: + - name + type: object + type: array + syntax: + description: |- + Syntax defines the router's rule syntax. + More info: https://doc.traefik.io/traefik/v3.3/routing/routers/#rulesyntax + type: string + required: + - match + type: object + type: array + tls: + description: |- + TLS defines the TLS configuration. + More info: https://doc.traefik.io/traefik/v3.3/routing/routers/#tls + properties: + certResolver: + description: |- + CertResolver defines the name of the certificate resolver to use. + Cert resolvers have to be configured in the static configuration. + More info: https://doc.traefik.io/traefik/v3.3/https/acme/#certificate-resolvers + type: string + domains: + description: |- + Domains defines the list of domains that will be used to issue certificates. + More info: https://doc.traefik.io/traefik/v3.3/routing/routers/#domains + items: + description: Domain holds a domain name with SANs. + properties: + main: + description: Main defines the main domain name. + type: string + sans: + description: SANs defines the subject alternative domain + names. + items: + type: string + type: array + type: object + type: array + options: + description: |- + Options defines the reference to a TLSOption, that specifies the parameters of the TLS connection. + If not defined, the `default` TLSOption is used. + More info: https://doc.traefik.io/traefik/v3.3/https/tls/#tls-options + properties: + name: + description: |- + Name defines the name of the referenced TLSOption. + More info: https://doc.traefik.io/traefik/v3.3/routing/providers/kubernetes-crd/#kind-tlsoption + type: string + namespace: + description: |- + Namespace defines the namespace of the referenced TLSOption. + More info: https://doc.traefik.io/traefik/v3.3/routing/providers/kubernetes-crd/#kind-tlsoption + type: string + required: + - name + type: object + secretName: + description: SecretName is the name of the referenced Kubernetes + Secret to specify the certificate details. + type: string + store: + description: |- + Store defines the reference to the TLSStore, that will be used to store certificates. + Please note that only `default` TLSStore can be used. + properties: + name: + description: |- + Name defines the name of the referenced TLSStore. + More info: https://doc.traefik.io/traefik/v3.3/routing/providers/kubernetes-crd/#kind-tlsstore + type: string + namespace: + description: |- + Namespace defines the namespace of the referenced TLSStore. + More info: https://doc.traefik.io/traefik/v3.3/routing/providers/kubernetes-crd/#kind-tlsstore + type: string + required: + - name + type: object + type: object + required: + - routes + type: object + required: + - metadata + - spec + type: object + served: true + storage: true + +--- +# Source: traefik/crds/traefik.io_ingressroutetcps.yaml +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.16.1 + name: ingressroutetcps.traefik.io +spec: + group: traefik.io + names: + kind: IngressRouteTCP + listKind: IngressRouteTCPList + plural: ingressroutetcps + singular: ingressroutetcp + scope: Namespaced + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: IngressRouteTCP is the CRD implementation of a Traefik TCP Router. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: IngressRouteTCPSpec defines the desired state of IngressRouteTCP. + properties: + entryPoints: + description: |- + EntryPoints defines the list of entry point names to bind to. + Entry points have to be configured in the static configuration. + More info: https://doc.traefik.io/traefik/v3.3/routing/entrypoints/ + Default: all. + items: + type: string + type: array + routes: + description: Routes defines the list of routes. + items: + description: RouteTCP holds the TCP route configuration. + properties: + match: + description: |- + Match defines the router's rule. + More info: https://doc.traefik.io/traefik/v3.3/routing/routers/#rule_1 + type: string + middlewares: + description: Middlewares defines the list of references to MiddlewareTCP + resources. + items: + description: ObjectReference is a generic reference to a Traefik + resource. + properties: + name: + description: Name defines the name of the referenced Traefik + resource. + type: string + namespace: + description: Namespace defines the namespace of the referenced + Traefik resource. + type: string + required: + - name + type: object + type: array + priority: + description: |- + Priority defines the router's priority. + More info: https://doc.traefik.io/traefik/v3.3/routing/routers/#priority_1 + type: integer + services: + description: Services defines the list of TCP services. + items: + description: ServiceTCP defines an upstream TCP service to + proxy traffic to. + properties: + name: + description: Name defines the name of the referenced Kubernetes + Service. + type: string + namespace: + description: Namespace defines the namespace of the referenced + Kubernetes Service. + type: string + nativeLB: + description: |- + NativeLB controls, when creating the load-balancer, + whether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP. + The Kubernetes Service itself does load-balance to the pods. + By default, NativeLB is false. + type: boolean + nodePortLB: + description: |- + NodePortLB controls, when creating the load-balancer, + whether the LB's children are directly the nodes internal IPs using the nodePort when the service type is NodePort. + It allows services to be reachable when Traefik runs externally from the Kubernetes cluster but within the same network of the nodes. + By default, NodePortLB is false. + type: boolean + port: + anyOf: + - type: integer + - type: string + description: |- + Port defines the port of a Kubernetes Service. + This can be a reference to a named port. + x-kubernetes-int-or-string: true + proxyProtocol: + description: |- + ProxyProtocol defines the PROXY protocol configuration. + More info: https://doc.traefik.io/traefik/v3.3/routing/services/#proxy-protocol + properties: + version: + description: Version defines the PROXY Protocol version + to use. + type: integer + type: object + serversTransport: + description: |- + ServersTransport defines the name of ServersTransportTCP resource to use. + It allows to configure the transport between Traefik and your servers. + Can only be used on a Kubernetes Service. + type: string + terminationDelay: + description: |- + TerminationDelay defines the deadline that the proxy sets, after one of its connected peers indicates + it has closed the writing capability of its connection, to close the reading capability as well, + hence fully terminating the connection. + It is a duration in milliseconds, defaulting to 100. + A negative value means an infinite deadline (i.e. the reading capability is never closed). + Deprecated: TerminationDelay will not be supported in future APIVersions, please use ServersTransport to configure the TerminationDelay instead. + type: integer + tls: + description: TLS determines whether to use TLS when dialing + with the backend. + type: boolean + weight: + description: Weight defines the weight used when balancing + requests between multiple Kubernetes Service. + type: integer + required: + - name + - port + type: object + type: array + syntax: + description: |- + Syntax defines the router's rule syntax. + More info: https://doc.traefik.io/traefik/v3.3/routing/routers/#rulesyntax_1 + type: string + required: + - match + type: object + type: array + tls: + description: |- + TLS defines the TLS configuration on a layer 4 / TCP Route. + More info: https://doc.traefik.io/traefik/v3.3/routing/routers/#tls_1 + properties: + certResolver: + description: |- + CertResolver defines the name of the certificate resolver to use. + Cert resolvers have to be configured in the static configuration. + More info: https://doc.traefik.io/traefik/v3.3/https/acme/#certificate-resolvers + type: string + domains: + description: |- + Domains defines the list of domains that will be used to issue certificates. + More info: https://doc.traefik.io/traefik/v3.3/routing/routers/#domains + items: + description: Domain holds a domain name with SANs. + properties: + main: + description: Main defines the main domain name. + type: string + sans: + description: SANs defines the subject alternative domain + names. + items: + type: string + type: array + type: object + type: array + options: + description: |- + Options defines the reference to a TLSOption, that specifies the parameters of the TLS connection. + If not defined, the `default` TLSOption is used. + More info: https://doc.traefik.io/traefik/v3.3/https/tls/#tls-options + properties: + name: + description: Name defines the name of the referenced Traefik + resource. + type: string + namespace: + description: Namespace defines the namespace of the referenced + Traefik resource. + type: string + required: + - name + type: object + passthrough: + description: Passthrough defines whether a TLS router will terminate + the TLS connection. + type: boolean + secretName: + description: SecretName is the name of the referenced Kubernetes + Secret to specify the certificate details. + type: string + store: + description: |- + Store defines the reference to the TLSStore, that will be used to store certificates. + Please note that only `default` TLSStore can be used. + properties: + name: + description: Name defines the name of the referenced Traefik + resource. + type: string + namespace: + description: Namespace defines the namespace of the referenced + Traefik resource. + type: string + required: + - name + type: object + type: object + required: + - routes + type: object + required: + - metadata + - spec + type: object + served: true + storage: true + +--- +# Source: traefik/crds/traefik.io_ingressrouteudps.yaml +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.16.1 + name: ingressrouteudps.traefik.io +spec: + group: traefik.io + names: + kind: IngressRouteUDP + listKind: IngressRouteUDPList + plural: ingressrouteudps + singular: ingressrouteudp + scope: Namespaced + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: IngressRouteUDP is a CRD implementation of a Traefik UDP Router. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: IngressRouteUDPSpec defines the desired state of a IngressRouteUDP. + properties: + entryPoints: + description: |- + EntryPoints defines the list of entry point names to bind to. + Entry points have to be configured in the static configuration. + More info: https://doc.traefik.io/traefik/v3.3/routing/entrypoints/ + Default: all. + items: + type: string + type: array + routes: + description: Routes defines the list of routes. + items: + description: RouteUDP holds the UDP route configuration. + properties: + services: + description: Services defines the list of UDP services. + items: + description: ServiceUDP defines an upstream UDP service to + proxy traffic to. + properties: + name: + description: Name defines the name of the referenced Kubernetes + Service. + type: string + namespace: + description: Namespace defines the namespace of the referenced + Kubernetes Service. + type: string + nativeLB: + description: |- + NativeLB controls, when creating the load-balancer, + whether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP. + The Kubernetes Service itself does load-balance to the pods. + By default, NativeLB is false. + type: boolean + nodePortLB: + description: |- + NodePortLB controls, when creating the load-balancer, + whether the LB's children are directly the nodes internal IPs using the nodePort when the service type is NodePort. + It allows services to be reachable when Traefik runs externally from the Kubernetes cluster but within the same network of the nodes. + By default, NodePortLB is false. + type: boolean + port: + anyOf: + - type: integer + - type: string + description: |- + Port defines the port of a Kubernetes Service. + This can be a reference to a named port. + x-kubernetes-int-or-string: true + weight: + description: Weight defines the weight used when balancing + requests between multiple Kubernetes Service. + type: integer + required: + - name + - port + type: object + type: array + type: object + type: array + required: + - routes + type: object + required: + - metadata + - spec + type: object + served: true + storage: true + +--- +# Source: traefik/crds/traefik.io_middlewares.yaml +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.16.1 + name: middlewares.traefik.io +spec: + group: traefik.io + names: + kind: Middleware + listKind: MiddlewareList + plural: middlewares + singular: middleware + scope: Namespaced + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: |- + Middleware is the CRD implementation of a Traefik Middleware. + More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/overview/ + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: MiddlewareSpec defines the desired state of a Middleware. + properties: + addPrefix: + description: |- + AddPrefix holds the add prefix middleware configuration. + This middleware updates the path of a request before forwarding it. + More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/addprefix/ + properties: + prefix: + description: |- + Prefix is the string to add before the current path in the requested URL. + It should include a leading slash (/). + type: string + type: object + basicAuth: + description: |- + BasicAuth holds the basic auth middleware configuration. + This middleware restricts access to your services to known users. + More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/basicauth/ + properties: + headerField: + description: |- + HeaderField defines a header field to store the authenticated user. + More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/basicauth/#headerfield + type: string + realm: + description: |- + Realm allows the protected resources on a server to be partitioned into a set of protection spaces, each with its own authentication scheme. + Default: traefik. + type: string + removeHeader: + description: |- + RemoveHeader sets the removeHeader option to true to remove the authorization header before forwarding the request to your service. + Default: false. + type: boolean + secret: + description: Secret is the name of the referenced Kubernetes Secret + containing user credentials. + type: string + type: object + buffering: + description: |- + Buffering holds the buffering middleware configuration. + This middleware retries or limits the size of requests that can be forwarded to backends. + More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/buffering/#maxrequestbodybytes + properties: + maxRequestBodyBytes: + description: |- + MaxRequestBodyBytes defines the maximum allowed body size for the request (in bytes). + If the request exceeds the allowed size, it is not forwarded to the service, and the client gets a 413 (Request Entity Too Large) response. + Default: 0 (no maximum). + format: int64 + type: integer + maxResponseBodyBytes: + description: |- + MaxResponseBodyBytes defines the maximum allowed response size from the service (in bytes). + If the response exceeds the allowed size, it is not forwarded to the client. The client gets a 500 (Internal Server Error) response instead. + Default: 0 (no maximum). + format: int64 + type: integer + memRequestBodyBytes: + description: |- + MemRequestBodyBytes defines the threshold (in bytes) from which the request will be buffered on disk instead of in memory. + Default: 1048576 (1Mi). + format: int64 + type: integer + memResponseBodyBytes: + description: |- + MemResponseBodyBytes defines the threshold (in bytes) from which the response will be buffered on disk instead of in memory. + Default: 1048576 (1Mi). + format: int64 + type: integer + retryExpression: + description: |- + RetryExpression defines the retry conditions. + It is a logical combination of functions with operators AND (&&) and OR (||). + More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/buffering/#retryexpression + type: string + type: object + chain: + description: |- + Chain holds the configuration of the chain middleware. + This middleware enables to define reusable combinations of other pieces of middleware. + More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/chain/ + properties: + middlewares: + description: Middlewares is the list of MiddlewareRef which composes + the chain. + items: + description: MiddlewareRef is a reference to a Middleware resource. + properties: + name: + description: Name defines the name of the referenced Middleware + resource. + type: string + namespace: + description: Namespace defines the namespace of the referenced + Middleware resource. + type: string + required: + - name + type: object + type: array + type: object + circuitBreaker: + description: CircuitBreaker holds the circuit breaker configuration. + properties: + checkPeriod: + anyOf: + - type: integer + - type: string + description: CheckPeriod is the interval between successive checks + of the circuit breaker condition (when in standby state). + x-kubernetes-int-or-string: true + expression: + description: Expression is the condition that triggers the tripped + state. + type: string + fallbackDuration: + anyOf: + - type: integer + - type: string + description: FallbackDuration is the duration for which the circuit + breaker will wait before trying to recover (from a tripped state). + x-kubernetes-int-or-string: true + recoveryDuration: + anyOf: + - type: integer + - type: string + description: RecoveryDuration is the duration for which the circuit + breaker will try to recover (as soon as it is in recovering + state). + x-kubernetes-int-or-string: true + responseCode: + description: ResponseCode is the status code that the circuit + breaker will return while it is in the open state. + type: integer + type: object + compress: + description: |- + Compress holds the compress middleware configuration. + This middleware compresses responses before sending them to the client, using gzip, brotli, or zstd compression. + More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/compress/ + properties: + defaultEncoding: + description: DefaultEncoding specifies the default encoding if + the `Accept-Encoding` header is not in the request or contains + a wildcard (`*`). + type: string + encodings: + description: Encodings defines the list of supported compression + algorithms. + items: + type: string + type: array + excludedContentTypes: + description: |- + ExcludedContentTypes defines the list of content types to compare the Content-Type header of the incoming requests and responses before compressing. + `application/grpc` is always excluded. + items: + type: string + type: array + includedContentTypes: + description: IncludedContentTypes defines the list of content + types to compare the Content-Type header of the responses before + compressing. + items: + type: string + type: array + minResponseBodyBytes: + description: |- + MinResponseBodyBytes defines the minimum amount of bytes a response body must have to be compressed. + Default: 1024. + type: integer + type: object + contentType: + description: |- + ContentType holds the content-type middleware configuration. + This middleware exists to enable the correct behavior until at least the default one can be changed in a future version. + properties: + autoDetect: + description: |- + AutoDetect specifies whether to let the `Content-Type` header, if it has not been set by the backend, + be automatically set to a value derived from the contents of the response. + Deprecated: AutoDetect option is deprecated, Content-Type middleware is only meant to be used to enable the content-type detection, please remove any usage of this option. + type: boolean + type: object + digestAuth: + description: |- + DigestAuth holds the digest auth middleware configuration. + This middleware restricts access to your services to known users. + More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/digestauth/ + properties: + headerField: + description: |- + HeaderField defines a header field to store the authenticated user. + More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/basicauth/#headerfield + type: string + realm: + description: |- + Realm allows the protected resources on a server to be partitioned into a set of protection spaces, each with its own authentication scheme. + Default: traefik. + type: string + removeHeader: + description: RemoveHeader defines whether to remove the authorization + header before forwarding the request to the backend. + type: boolean + secret: + description: Secret is the name of the referenced Kubernetes Secret + containing user credentials. + type: string + type: object + errors: + description: |- + ErrorPage holds the custom error middleware configuration. + This middleware returns a custom page in lieu of the default, according to configured ranges of HTTP Status codes. + More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/errorpages/ + properties: + query: + description: |- + Query defines the URL for the error page (hosted by service). + The {status} variable can be used in order to insert the status code in the URL. + type: string + service: + description: |- + Service defines the reference to a Kubernetes Service that will serve the error page. + More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/errorpages/#service + properties: + healthCheck: + description: Healthcheck defines health checks for ExternalName + services. + properties: + followRedirects: + description: |- + FollowRedirects defines whether redirects should be followed during the health check calls. + Default: true + type: boolean + headers: + additionalProperties: + type: string + description: Headers defines custom headers to be sent + to the health check endpoint. + type: object + hostname: + description: Hostname defines the value of hostname in + the Host header of the health check request. + type: string + interval: + anyOf: + - type: integer + - type: string + description: |- + Interval defines the frequency of the health check calls. + Default: 30s + x-kubernetes-int-or-string: true + method: + description: Method defines the healthcheck method. + type: string + mode: + description: |- + Mode defines the health check mode. + If defined to grpc, will use the gRPC health check protocol to probe the server. + Default: http + type: string + path: + description: Path defines the server URL path for the + health check endpoint. + type: string + port: + description: Port defines the server URL port for the + health check endpoint. + type: integer + scheme: + description: Scheme replaces the server URL scheme for + the health check endpoint. + type: string + status: + description: Status defines the expected HTTP status code + of the response to the health check request. + type: integer + timeout: + anyOf: + - type: integer + - type: string + description: |- + Timeout defines the maximum duration Traefik will wait for a health check request before considering the server unhealthy. + Default: 5s + x-kubernetes-int-or-string: true + type: object + kind: + description: Kind defines the kind of the Service. + enum: + - Service + - TraefikService + type: string + name: + description: |- + Name defines the name of the referenced Kubernetes Service or TraefikService. + The differentiation between the two is specified in the Kind field. + type: string + namespace: + description: Namespace defines the namespace of the referenced + Kubernetes Service or TraefikService. + type: string + nativeLB: + description: |- + NativeLB controls, when creating the load-balancer, + whether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP. + The Kubernetes Service itself does load-balance to the pods. + By default, NativeLB is false. + type: boolean + nodePortLB: + description: |- + NodePortLB controls, when creating the load-balancer, + whether the LB's children are directly the nodes internal IPs using the nodePort when the service type is NodePort. + It allows services to be reachable when Traefik runs externally from the Kubernetes cluster but within the same network of the nodes. + By default, NodePortLB is false. + type: boolean + passHostHeader: + description: |- + PassHostHeader defines whether the client Host header is forwarded to the upstream Kubernetes Service. + By default, passHostHeader is true. + type: boolean + port: + anyOf: + - type: integer + - type: string + description: |- + Port defines the port of a Kubernetes Service. + This can be a reference to a named port. + x-kubernetes-int-or-string: true + responseForwarding: + description: ResponseForwarding defines how Traefik forwards + the response from the upstream Kubernetes Service to the + client. + properties: + flushInterval: + description: |- + FlushInterval defines the interval, in milliseconds, in between flushes to the client while copying the response body. + A negative value means to flush immediately after each write to the client. + This configuration is ignored when ReverseProxy recognizes a response as a streaming response; + for such responses, writes are flushed to the client immediately. + Default: 100ms + type: string + type: object + scheme: + description: |- + Scheme defines the scheme to use for the request to the upstream Kubernetes Service. + It defaults to https when Kubernetes Service port is 443, http otherwise. + type: string + serversTransport: + description: |- + ServersTransport defines the name of ServersTransport resource to use. + It allows to configure the transport between Traefik and your servers. + Can only be used on a Kubernetes Service. + type: string + sticky: + description: |- + Sticky defines the sticky sessions configuration. + More info: https://doc.traefik.io/traefik/v3.3/routing/services/#sticky-sessions + properties: + cookie: + description: Cookie defines the sticky cookie configuration. + properties: + httpOnly: + description: HTTPOnly defines whether the cookie can + be accessed by client-side APIs, such as JavaScript. + type: boolean + maxAge: + description: |- + MaxAge defines the number of seconds until the cookie expires. + When set to a negative number, the cookie expires immediately. + When set to zero, the cookie never expires. + type: integer + name: + description: Name defines the Cookie name. + type: string + path: + description: |- + Path defines the path that must exist in the requested URL for the browser to send the Cookie header. + When not provided the cookie will be sent on every request to the domain. + More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#pathpath-value + type: string + sameSite: + description: |- + SameSite defines the same site policy. + More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite + type: string + secure: + description: Secure defines whether the cookie can + only be transmitted over an encrypted connection + (i.e. HTTPS). + type: boolean + type: object + type: object + strategy: + description: |- + Strategy defines the load balancing strategy between the servers. + RoundRobin is the only supported value at the moment. + type: string + weight: + description: |- + Weight defines the weight and should only be specified when Name references a TraefikService object + (and to be precise, one that embeds a Weighted Round Robin). + type: integer + required: + - name + type: object + status: + description: |- + Status defines which status or range of statuses should result in an error page. + It can be either a status code as a number (500), + as multiple comma-separated numbers (500,502), + as ranges by separating two codes with a dash (500-599), + or a combination of the two (404,418,500-599). + items: + type: string + type: array + type: object + forwardAuth: + description: |- + ForwardAuth holds the forward auth middleware configuration. + This middleware delegates the request authentication to a Service. + More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/forwardauth/ + properties: + addAuthCookiesToResponse: + description: AddAuthCookiesToResponse defines the list of cookies + to copy from the authentication server response to the response. + items: + type: string + type: array + address: + description: Address defines the authentication server address. + type: string + authRequestHeaders: + description: |- + AuthRequestHeaders defines the list of the headers to copy from the request to the authentication server. + If not set or empty then all request headers are passed. + items: + type: string + type: array + authResponseHeaders: + description: AuthResponseHeaders defines the list of headers to + copy from the authentication server response and set on forwarded + request, replacing any existing conflicting headers. + items: + type: string + type: array + authResponseHeadersRegex: + description: |- + AuthResponseHeadersRegex defines the regex to match headers to copy from the authentication server response and set on forwarded request, after stripping all headers that match the regex. + More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/forwardauth/#authresponseheadersregex + type: string + forwardBody: + description: ForwardBody defines whether to send the request body + to the authentication server. + type: boolean + headerField: + description: |- + HeaderField defines a header field to store the authenticated user. + More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/forwardauth/#headerfield + type: string + maxBodySize: + description: MaxBodySize defines the maximum body size in bytes + allowed to be forwarded to the authentication server. + format: int64 + type: integer + preserveLocationHeader: + description: PreserveLocationHeader defines whether to forward + the Location header to the client as is or prefix it with the + domain name of the authentication server. + type: boolean + tls: + description: TLS defines the configuration used to secure the + connection to the authentication server. + properties: + caOptional: + description: 'Deprecated: TLS client authentication is a server + side option (see https://github.com/golang/go/blob/740a490f71d026bb7d2d13cb8fa2d6d6e0572b70/src/crypto/tls/common.go#L634).' + type: boolean + caSecret: + description: |- + CASecret is the name of the referenced Kubernetes Secret containing the CA to validate the server certificate. + The CA certificate is extracted from key `tls.ca` or `ca.crt`. + type: string + certSecret: + description: |- + CertSecret is the name of the referenced Kubernetes Secret containing the client certificate. + The client certificate is extracted from the keys `tls.crt` and `tls.key`. + type: string + insecureSkipVerify: + description: InsecureSkipVerify defines whether the server + certificates should be validated. + type: boolean + type: object + trustForwardHeader: + description: 'TrustForwardHeader defines whether to trust (ie: + forward) all X-Forwarded-* headers.' + type: boolean + type: object + grpcWeb: + description: |- + GrpcWeb holds the gRPC web middleware configuration. + This middleware converts a gRPC web request to an HTTP/2 gRPC request. + properties: + allowOrigins: + description: |- + AllowOrigins is a list of allowable origins. + Can also be a wildcard origin "*". + items: + type: string + type: array + type: object + headers: + description: |- + Headers holds the headers middleware configuration. + This middleware manages the requests and responses headers. + More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/headers/#customrequestheaders + properties: + accessControlAllowCredentials: + description: AccessControlAllowCredentials defines whether the + request can include user credentials. + type: boolean + accessControlAllowHeaders: + description: AccessControlAllowHeaders defines the Access-Control-Request-Headers + values sent in preflight response. + items: + type: string + type: array + accessControlAllowMethods: + description: AccessControlAllowMethods defines the Access-Control-Request-Method + values sent in preflight response. + items: + type: string + type: array + accessControlAllowOriginList: + description: AccessControlAllowOriginList is a list of allowable + origins. Can also be a wildcard origin "*". + items: + type: string + type: array + accessControlAllowOriginListRegex: + description: AccessControlAllowOriginListRegex is a list of allowable + origins written following the Regular Expression syntax (https://golang.org/pkg/regexp/). + items: + type: string + type: array + accessControlExposeHeaders: + description: AccessControlExposeHeaders defines the Access-Control-Expose-Headers + values sent in preflight response. + items: + type: string + type: array + accessControlMaxAge: + description: AccessControlMaxAge defines the time that a preflight + request may be cached. + format: int64 + type: integer + addVaryHeader: + description: AddVaryHeader defines whether the Vary header is + automatically added/updated when the AccessControlAllowOriginList + is set. + type: boolean + allowedHosts: + description: AllowedHosts defines the fully qualified list of + allowed domain names. + items: + type: string + type: array + browserXssFilter: + description: BrowserXSSFilter defines whether to add the X-XSS-Protection + header with the value 1; mode=block. + type: boolean + contentSecurityPolicy: + description: ContentSecurityPolicy defines the Content-Security-Policy + header value. + type: string + contentSecurityPolicyReportOnly: + description: ContentSecurityPolicyReportOnly defines the Content-Security-Policy-Report-Only + header value. + type: string + contentTypeNosniff: + description: ContentTypeNosniff defines whether to add the X-Content-Type-Options + header with the nosniff value. + type: boolean + customBrowserXSSValue: + description: |- + CustomBrowserXSSValue defines the X-XSS-Protection header value. + This overrides the BrowserXssFilter option. + type: string + customFrameOptionsValue: + description: |- + CustomFrameOptionsValue defines the X-Frame-Options header value. + This overrides the FrameDeny option. + type: string + customRequestHeaders: + additionalProperties: + type: string + description: CustomRequestHeaders defines the header names and + values to apply to the request. + type: object + customResponseHeaders: + additionalProperties: + type: string + description: CustomResponseHeaders defines the header names and + values to apply to the response. + type: object + featurePolicy: + description: 'Deprecated: FeaturePolicy option is deprecated, + please use PermissionsPolicy instead.' + type: string + forceSTSHeader: + description: ForceSTSHeader defines whether to add the STS header + even when the connection is HTTP. + type: boolean + frameDeny: + description: FrameDeny defines whether to add the X-Frame-Options + header with the DENY value. + type: boolean + hostsProxyHeaders: + description: HostsProxyHeaders defines the header keys that may + hold a proxied hostname value for the request. + items: + type: string + type: array + isDevelopment: + description: |- + IsDevelopment defines whether to mitigate the unwanted effects of the AllowedHosts, SSL, and STS options when developing. + Usually testing takes place using HTTP, not HTTPS, and on localhost, not your production domain. + If you would like your development environment to mimic production with complete Host blocking, SSL redirects, + and STS headers, leave this as false. + type: boolean + permissionsPolicy: + description: |- + PermissionsPolicy defines the Permissions-Policy header value. + This allows sites to control browser features. + type: string + publicKey: + description: PublicKey is the public key that implements HPKP + to prevent MITM attacks with forged certificates. + type: string + referrerPolicy: + description: |- + ReferrerPolicy defines the Referrer-Policy header value. + This allows sites to control whether browsers forward the Referer header to other sites. + type: string + sslForceHost: + description: 'Deprecated: SSLForceHost option is deprecated, please + use RedirectRegex instead.' + type: boolean + sslHost: + description: 'Deprecated: SSLHost option is deprecated, please + use RedirectRegex instead.' + type: string + sslProxyHeaders: + additionalProperties: + type: string + description: |- + SSLProxyHeaders defines the header keys with associated values that would indicate a valid HTTPS request. + It can be useful when using other proxies (example: "X-Forwarded-Proto": "https"). + type: object + sslRedirect: + description: 'Deprecated: SSLRedirect option is deprecated, please + use EntryPoint redirection or RedirectScheme instead.' + type: boolean + sslTemporaryRedirect: + description: 'Deprecated: SSLTemporaryRedirect option is deprecated, + please use EntryPoint redirection or RedirectScheme instead.' + type: boolean + stsIncludeSubdomains: + description: STSIncludeSubdomains defines whether the includeSubDomains + directive is appended to the Strict-Transport-Security header. + type: boolean + stsPreload: + description: STSPreload defines whether the preload flag is appended + to the Strict-Transport-Security header. + type: boolean + stsSeconds: + description: |- + STSSeconds defines the max-age of the Strict-Transport-Security header. + If set to 0, the header is not set. + format: int64 + type: integer + type: object + inFlightReq: + description: |- + InFlightReq holds the in-flight request middleware configuration. + This middleware limits the number of requests being processed and served concurrently. + More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/inflightreq/ + properties: + amount: + description: |- + Amount defines the maximum amount of allowed simultaneous in-flight request. + The middleware responds with HTTP 429 Too Many Requests if there are already amount requests in progress (based on the same sourceCriterion strategy). + format: int64 + type: integer + sourceCriterion: + description: |- + SourceCriterion defines what criterion is used to group requests as originating from a common source. + If several strategies are defined at the same time, an error will be raised. + If none are set, the default is to use the requestHost. + More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/inflightreq/#sourcecriterion + properties: + ipStrategy: + description: |- + IPStrategy holds the IP strategy configuration used by Traefik to determine the client IP. + More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/ipallowlist/#ipstrategy + properties: + depth: + description: Depth tells Traefik to use the X-Forwarded-For + header and take the IP located at the depth position + (starting from the right). + type: integer + excludedIPs: + description: ExcludedIPs configures Traefik to scan the + X-Forwarded-For header and select the first IP not in + the list. + items: + type: string + type: array + ipv6Subnet: + description: IPv6Subnet configures Traefik to consider + all IPv6 addresses from the defined subnet as originating + from the same IP. Applies to RemoteAddrStrategy and + DepthStrategy. + type: integer + type: object + requestHeaderName: + description: RequestHeaderName defines the name of the header + used to group incoming requests. + type: string + requestHost: + description: RequestHost defines whether to consider the request + Host as the source. + type: boolean + type: object + type: object + ipAllowList: + description: |- + IPAllowList holds the IP allowlist middleware configuration. + This middleware limits allowed requests based on the client IP. + More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/ipallowlist/ + properties: + ipStrategy: + description: |- + IPStrategy holds the IP strategy configuration used by Traefik to determine the client IP. + More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/ipallowlist/#ipstrategy + properties: + depth: + description: Depth tells Traefik to use the X-Forwarded-For + header and take the IP located at the depth position (starting + from the right). + type: integer + excludedIPs: + description: ExcludedIPs configures Traefik to scan the X-Forwarded-For + header and select the first IP not in the list. + items: + type: string + type: array + ipv6Subnet: + description: IPv6Subnet configures Traefik to consider all + IPv6 addresses from the defined subnet as originating from + the same IP. Applies to RemoteAddrStrategy and DepthStrategy. + type: integer + type: object + rejectStatusCode: + description: |- + RejectStatusCode defines the HTTP status code used for refused requests. + If not set, the default is 403 (Forbidden). + type: integer + sourceRange: + description: SourceRange defines the set of allowed IPs (or ranges + of allowed IPs by using CIDR notation). + items: + type: string + type: array + type: object + ipWhiteList: + description: 'Deprecated: please use IPAllowList instead.' + properties: + ipStrategy: + description: |- + IPStrategy holds the IP strategy configuration used by Traefik to determine the client IP. + More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/ipallowlist/#ipstrategy + properties: + depth: + description: Depth tells Traefik to use the X-Forwarded-For + header and take the IP located at the depth position (starting + from the right). + type: integer + excludedIPs: + description: ExcludedIPs configures Traefik to scan the X-Forwarded-For + header and select the first IP not in the list. + items: + type: string + type: array + ipv6Subnet: + description: IPv6Subnet configures Traefik to consider all + IPv6 addresses from the defined subnet as originating from + the same IP. Applies to RemoteAddrStrategy and DepthStrategy. + type: integer + type: object + sourceRange: + description: SourceRange defines the set of allowed IPs (or ranges + of allowed IPs by using CIDR notation). Required. + items: + type: string + type: array + type: object + passTLSClientCert: + description: |- + PassTLSClientCert holds the pass TLS client cert middleware configuration. + This middleware adds the selected data from the passed client TLS certificate to a header. + More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/passtlsclientcert/ + properties: + info: + description: Info selects the specific client certificate details + you want to add to the X-Forwarded-Tls-Client-Cert-Info header. + properties: + issuer: + description: Issuer defines the client certificate issuer + details to add to the X-Forwarded-Tls-Client-Cert-Info header. + properties: + commonName: + description: CommonName defines whether to add the organizationalUnit + information into the issuer. + type: boolean + country: + description: Country defines whether to add the country + information into the issuer. + type: boolean + domainComponent: + description: DomainComponent defines whether to add the + domainComponent information into the issuer. + type: boolean + locality: + description: Locality defines whether to add the locality + information into the issuer. + type: boolean + organization: + description: Organization defines whether to add the organization + information into the issuer. + type: boolean + province: + description: Province defines whether to add the province + information into the issuer. + type: boolean + serialNumber: + description: SerialNumber defines whether to add the serialNumber + information into the issuer. + type: boolean + type: object + notAfter: + description: NotAfter defines whether to add the Not After + information from the Validity part. + type: boolean + notBefore: + description: NotBefore defines whether to add the Not Before + information from the Validity part. + type: boolean + sans: + description: Sans defines whether to add the Subject Alternative + Name information from the Subject Alternative Name part. + type: boolean + serialNumber: + description: SerialNumber defines whether to add the client + serialNumber information. + type: boolean + subject: + description: Subject defines the client certificate subject + details to add to the X-Forwarded-Tls-Client-Cert-Info header. + properties: + commonName: + description: CommonName defines whether to add the organizationalUnit + information into the subject. + type: boolean + country: + description: Country defines whether to add the country + information into the subject. + type: boolean + domainComponent: + description: DomainComponent defines whether to add the + domainComponent information into the subject. + type: boolean + locality: + description: Locality defines whether to add the locality + information into the subject. + type: boolean + organization: + description: Organization defines whether to add the organization + information into the subject. + type: boolean + organizationalUnit: + description: OrganizationalUnit defines whether to add + the organizationalUnit information into the subject. + type: boolean + province: + description: Province defines whether to add the province + information into the subject. + type: boolean + serialNumber: + description: SerialNumber defines whether to add the serialNumber + information into the subject. + type: boolean + type: object + type: object + pem: + description: PEM sets the X-Forwarded-Tls-Client-Cert header with + the certificate. + type: boolean + type: object + plugin: + additionalProperties: + x-kubernetes-preserve-unknown-fields: true + description: |- + Plugin defines the middleware plugin configuration. + More info: https://doc.traefik.io/traefik/plugins/ + type: object + rateLimit: + description: |- + RateLimit holds the rate limit configuration. + This middleware ensures that services will receive a fair amount of requests, and allows one to define what fair is. + More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/ratelimit/ + properties: + average: + description: |- + Average is the maximum rate, by default in requests/s, allowed for the given source. + It defaults to 0, which means no rate limiting. + The rate is actually defined by dividing Average by Period. So for a rate below 1req/s, + one needs to define a Period larger than a second. + format: int64 + type: integer + burst: + description: |- + Burst is the maximum number of requests allowed to arrive in the same arbitrarily small period of time. + It defaults to 1. + format: int64 + type: integer + period: + anyOf: + - type: integer + - type: string + description: |- + Period, in combination with Average, defines the actual maximum rate, such as: + r = Average / Period. It defaults to a second. + x-kubernetes-int-or-string: true + sourceCriterion: + description: |- + SourceCriterion defines what criterion is used to group requests as originating from a common source. + If several strategies are defined at the same time, an error will be raised. + If none are set, the default is to use the request's remote address field (as an ipStrategy). + properties: + ipStrategy: + description: |- + IPStrategy holds the IP strategy configuration used by Traefik to determine the client IP. + More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/ipallowlist/#ipstrategy + properties: + depth: + description: Depth tells Traefik to use the X-Forwarded-For + header and take the IP located at the depth position + (starting from the right). + type: integer + excludedIPs: + description: ExcludedIPs configures Traefik to scan the + X-Forwarded-For header and select the first IP not in + the list. + items: + type: string + type: array + ipv6Subnet: + description: IPv6Subnet configures Traefik to consider + all IPv6 addresses from the defined subnet as originating + from the same IP. Applies to RemoteAddrStrategy and + DepthStrategy. + type: integer + type: object + requestHeaderName: + description: RequestHeaderName defines the name of the header + used to group incoming requests. + type: string + requestHost: + description: RequestHost defines whether to consider the request + Host as the source. + type: boolean + type: object + type: object + redirectRegex: + description: |- + RedirectRegex holds the redirect regex middleware configuration. + This middleware redirects a request using regex matching and replacement. + More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/redirectregex/#regex + properties: + permanent: + description: Permanent defines whether the redirection is permanent + (301). + type: boolean + regex: + description: Regex defines the regex used to match and capture + elements from the request URL. + type: string + replacement: + description: Replacement defines how to modify the URL to have + the new target URL. + type: string + type: object + redirectScheme: + description: |- + RedirectScheme holds the redirect scheme middleware configuration. + This middleware redirects requests from a scheme/port to another. + More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/redirectscheme/ + properties: + permanent: + description: Permanent defines whether the redirection is permanent + (301). + type: boolean + port: + description: Port defines the port of the new URL. + type: string + scheme: + description: Scheme defines the scheme of the new URL. + type: string + type: object + replacePath: + description: |- + ReplacePath holds the replace path middleware configuration. + This middleware replaces the path of the request URL and store the original path in an X-Replaced-Path header. + More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/replacepath/ + properties: + path: + description: Path defines the path to use as replacement in the + request URL. + type: string + type: object + replacePathRegex: + description: |- + ReplacePathRegex holds the replace path regex middleware configuration. + This middleware replaces the path of a URL using regex matching and replacement. + More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/replacepathregex/ + properties: + regex: + description: Regex defines the regular expression used to match + and capture the path from the request URL. + type: string + replacement: + description: Replacement defines the replacement path format, + which can include captured variables. + type: string + type: object + retry: + description: |- + Retry holds the retry middleware configuration. + This middleware reissues requests a given number of times to a backend server if that server does not reply. + As soon as the server answers, the middleware stops retrying, regardless of the response status. + More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/retry/ + properties: + attempts: + description: Attempts defines how many times the request should + be retried. + type: integer + initialInterval: + anyOf: + - type: integer + - type: string + description: |- + InitialInterval defines the first wait time in the exponential backoff series. + The maximum interval is calculated as twice the initialInterval. + If unspecified, requests will be retried immediately. + The value of initialInterval should be provided in seconds or as a valid duration format, + see https://pkg.go.dev/time#ParseDuration. + x-kubernetes-int-or-string: true + type: object + stripPrefix: + description: |- + StripPrefix holds the strip prefix middleware configuration. + This middleware removes the specified prefixes from the URL path. + More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/stripprefix/ + properties: + forceSlash: + description: |- + Deprecated: ForceSlash option is deprecated, please remove any usage of this option. + ForceSlash ensures that the resulting stripped path is not the empty string, by replacing it with / when necessary. + Default: true. + type: boolean + prefixes: + description: Prefixes defines the prefixes to strip from the request + URL. + items: + type: string + type: array + type: object + stripPrefixRegex: + description: |- + StripPrefixRegex holds the strip prefix regex middleware configuration. + This middleware removes the matching prefixes from the URL path. + More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/stripprefixregex/ + properties: + regex: + description: Regex defines the regular expression to match the + path prefix from the request URL. + items: + type: string + type: array + type: object + type: object + required: + - metadata + - spec + type: object + served: true + storage: true + +--- +# Source: traefik/crds/traefik.io_middlewaretcps.yaml +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.16.1 + name: middlewaretcps.traefik.io +spec: + group: traefik.io + names: + kind: MiddlewareTCP + listKind: MiddlewareTCPList + plural: middlewaretcps + singular: middlewaretcp + scope: Namespaced + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: |- + MiddlewareTCP is the CRD implementation of a Traefik TCP middleware. + More info: https://doc.traefik.io/traefik/v3.3/middlewares/overview/ + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: MiddlewareTCPSpec defines the desired state of a MiddlewareTCP. + properties: + inFlightConn: + description: InFlightConn defines the InFlightConn middleware configuration. + properties: + amount: + description: |- + Amount defines the maximum amount of allowed simultaneous connections. + The middleware closes the connection if there are already amount connections opened. + format: int64 + type: integer + type: object + ipAllowList: + description: |- + IPAllowList defines the IPAllowList middleware configuration. + This middleware accepts/refuses connections based on the client IP. + More info: https://doc.traefik.io/traefik/v3.3/middlewares/tcp/ipallowlist/ + properties: + sourceRange: + description: SourceRange defines the allowed IPs (or ranges of + allowed IPs by using CIDR notation). + items: + type: string + type: array + type: object + ipWhiteList: + description: |- + IPWhiteList defines the IPWhiteList middleware configuration. + This middleware accepts/refuses connections based on the client IP. + Deprecated: please use IPAllowList instead. + More info: https://doc.traefik.io/traefik/v3.3/middlewares/tcp/ipwhitelist/ + properties: + sourceRange: + description: SourceRange defines the allowed IPs (or ranges of + allowed IPs by using CIDR notation). + items: + type: string + type: array + type: object + type: object + required: + - metadata + - spec + type: object + served: true + storage: true + +--- +# Source: traefik/crds/traefik.io_serverstransports.yaml +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.16.1 + name: serverstransports.traefik.io +spec: + group: traefik.io + names: + kind: ServersTransport + listKind: ServersTransportList + plural: serverstransports + singular: serverstransport + scope: Namespaced + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: |- + ServersTransport is the CRD implementation of a ServersTransport. + If no serversTransport is specified, the default@internal will be used. + The default@internal serversTransport is created from the static configuration. + More info: https://doc.traefik.io/traefik/v3.3/routing/services/#serverstransport_1 + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: ServersTransportSpec defines the desired state of a ServersTransport. + properties: + certificatesSecrets: + description: CertificatesSecrets defines a list of secret storing + client certificates for mTLS. + items: + type: string + type: array + disableHTTP2: + description: DisableHTTP2 disables HTTP/2 for connections with backend + servers. + type: boolean + forwardingTimeouts: + description: ForwardingTimeouts defines the timeouts for requests + forwarded to the backend servers. + properties: + dialTimeout: + anyOf: + - type: integer + - type: string + description: DialTimeout is the amount of time to wait until a + connection to a backend server can be established. + x-kubernetes-int-or-string: true + idleConnTimeout: + anyOf: + - type: integer + - type: string + description: IdleConnTimeout is the maximum period for which an + idle HTTP keep-alive connection will remain open before closing + itself. + x-kubernetes-int-or-string: true + pingTimeout: + anyOf: + - type: integer + - type: string + description: PingTimeout is the timeout after which the HTTP/2 + connection will be closed if a response to ping is not received. + x-kubernetes-int-or-string: true + readIdleTimeout: + anyOf: + - type: integer + - type: string + description: ReadIdleTimeout is the timeout after which a health + check using ping frame will be carried out if no frame is received + on the HTTP/2 connection. + x-kubernetes-int-or-string: true + responseHeaderTimeout: + anyOf: + - type: integer + - type: string + description: ResponseHeaderTimeout is the amount of time to wait + for a server's response headers after fully writing the request + (including its body, if any). + x-kubernetes-int-or-string: true + type: object + insecureSkipVerify: + description: InsecureSkipVerify disables SSL certificate verification. + type: boolean + maxIdleConnsPerHost: + description: MaxIdleConnsPerHost controls the maximum idle (keep-alive) + to keep per-host. + type: integer + peerCertURI: + description: PeerCertURI defines the peer cert URI used to match against + SAN URI during the peer certificate verification. + type: string + rootCAsSecrets: + description: RootCAsSecrets defines a list of CA secret used to validate + self-signed certificate. + items: + type: string + type: array + serverName: + description: ServerName defines the server name used to contact the + server. + type: string + spiffe: + description: Spiffe defines the SPIFFE configuration. + properties: + ids: + description: IDs defines the allowed SPIFFE IDs (takes precedence + over the SPIFFE TrustDomain). + items: + type: string + type: array + trustDomain: + description: TrustDomain defines the allowed SPIFFE trust domain. + type: string + type: object + type: object + required: + - metadata + - spec + type: object + served: true + storage: true + +--- +# Source: traefik/crds/traefik.io_serverstransporttcps.yaml +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.16.1 + name: serverstransporttcps.traefik.io +spec: + group: traefik.io + names: + kind: ServersTransportTCP + listKind: ServersTransportTCPList + plural: serverstransporttcps + singular: serverstransporttcp + scope: Namespaced + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: |- + ServersTransportTCP is the CRD implementation of a TCPServersTransport. + If no tcpServersTransport is specified, a default one named default@internal will be used. + The default@internal tcpServersTransport can be configured in the static configuration. + More info: https://doc.traefik.io/traefik/v3.3/routing/services/#serverstransport_3 + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: ServersTransportTCPSpec defines the desired state of a ServersTransportTCP. + properties: + dialKeepAlive: + anyOf: + - type: integer + - type: string + description: DialKeepAlive is the interval between keep-alive probes + for an active network connection. If zero, keep-alive probes are + sent with a default value (currently 15 seconds), if supported by + the protocol and operating system. Network protocols or operating + systems that do not support keep-alives ignore this field. If negative, + keep-alive probes are disabled. + x-kubernetes-int-or-string: true + dialTimeout: + anyOf: + - type: integer + - type: string + description: DialTimeout is the amount of time to wait until a connection + to a backend server can be established. + x-kubernetes-int-or-string: true + terminationDelay: + anyOf: + - type: integer + - type: string + description: TerminationDelay defines the delay to wait before fully + terminating the connection, after one connected peer has closed + its writing capability. + x-kubernetes-int-or-string: true + tls: + description: TLS defines the TLS configuration + properties: + certificatesSecrets: + description: CertificatesSecrets defines a list of secret storing + client certificates for mTLS. + items: + type: string + type: array + insecureSkipVerify: + description: InsecureSkipVerify disables TLS certificate verification. + type: boolean + peerCertURI: + description: |- + MaxIdleConnsPerHost controls the maximum idle (keep-alive) to keep per-host. + PeerCertURI defines the peer cert URI used to match against SAN URI during the peer certificate verification. + type: string + rootCAsSecrets: + description: RootCAsSecrets defines a list of CA secret used to + validate self-signed certificates. + items: + type: string + type: array + serverName: + description: ServerName defines the server name used to contact + the server. + type: string + spiffe: + description: Spiffe defines the SPIFFE configuration. + properties: + ids: + description: IDs defines the allowed SPIFFE IDs (takes precedence + over the SPIFFE TrustDomain). + items: + type: string + type: array + trustDomain: + description: TrustDomain defines the allowed SPIFFE trust + domain. + type: string + type: object + type: object + type: object + required: + - metadata + - spec + type: object + served: true + storage: true + +--- +# Source: traefik/crds/traefik.io_tlsoptions.yaml +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.16.1 + name: tlsoptions.traefik.io +spec: + group: traefik.io + names: + kind: TLSOption + listKind: TLSOptionList + plural: tlsoptions + singular: tlsoption + scope: Namespaced + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: |- + TLSOption is the CRD implementation of a Traefik TLS Option, allowing to configure some parameters of the TLS connection. + More info: https://doc.traefik.io/traefik/v3.3/https/tls/#tls-options + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: TLSOptionSpec defines the desired state of a TLSOption. + properties: + alpnProtocols: + description: |- + ALPNProtocols defines the list of supported application level protocols for the TLS handshake, in order of preference. + More info: https://doc.traefik.io/traefik/v3.3/https/tls/#alpn-protocols + items: + type: string + type: array + cipherSuites: + description: |- + CipherSuites defines the list of supported cipher suites for TLS versions up to TLS 1.2. + More info: https://doc.traefik.io/traefik/v3.3/https/tls/#cipher-suites + items: + type: string + type: array + clientAuth: + description: ClientAuth defines the server's policy for TLS Client + Authentication. + properties: + clientAuthType: + description: ClientAuthType defines the client authentication + type to apply. + enum: + - NoClientCert + - RequestClientCert + - RequireAnyClientCert + - VerifyClientCertIfGiven + - RequireAndVerifyClientCert + type: string + secretNames: + description: SecretNames defines the names of the referenced Kubernetes + Secret storing certificate details. + items: + type: string + type: array + type: object + curvePreferences: + description: |- + CurvePreferences defines the preferred elliptic curves in a specific order. + More info: https://doc.traefik.io/traefik/v3.3/https/tls/#curve-preferences + items: + type: string + type: array + maxVersion: + description: |- + MaxVersion defines the maximum TLS version that Traefik will accept. + Possible values: VersionTLS10, VersionTLS11, VersionTLS12, VersionTLS13. + Default: None. + type: string + minVersion: + description: |- + MinVersion defines the minimum TLS version that Traefik will accept. + Possible values: VersionTLS10, VersionTLS11, VersionTLS12, VersionTLS13. + Default: VersionTLS10. + type: string + preferServerCipherSuites: + description: |- + PreferServerCipherSuites defines whether the server chooses a cipher suite among his own instead of among the client's. + It is enabled automatically when minVersion or maxVersion is set. + Deprecated: https://github.com/golang/go/issues/45430 + type: boolean + sniStrict: + description: SniStrict defines whether Traefik allows connections + from clients connections that do not specify a server_name extension. + type: boolean + type: object + required: + - metadata + - spec + type: object + served: true + storage: true + +--- +# Source: traefik/crds/traefik.io_tlsstores.yaml +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.16.1 + name: tlsstores.traefik.io +spec: + group: traefik.io + names: + kind: TLSStore + listKind: TLSStoreList + plural: tlsstores + singular: tlsstore + scope: Namespaced + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: |- + TLSStore is the CRD implementation of a Traefik TLS Store. + For the time being, only the TLSStore named default is supported. + This means that you cannot have two stores that are named default in different Kubernetes namespaces. + More info: https://doc.traefik.io/traefik/v3.3/https/tls/#certificates-stores + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: TLSStoreSpec defines the desired state of a TLSStore. + properties: + certificates: + description: Certificates is a list of secret names, each secret holding + a key/certificate pair to add to the store. + items: + description: Certificate holds a secret name for the TLSStore resource. + properties: + secretName: + description: SecretName is the name of the referenced Kubernetes + Secret to specify the certificate details. + type: string + required: + - secretName + type: object + type: array + defaultCertificate: + description: DefaultCertificate defines the default certificate configuration. + properties: + secretName: + description: SecretName is the name of the referenced Kubernetes + Secret to specify the certificate details. + type: string + required: + - secretName + type: object + defaultGeneratedCert: + description: DefaultGeneratedCert defines the default generated certificate + configuration. + properties: + domain: + description: Domain is the domain definition for the DefaultCertificate. + properties: + main: + description: Main defines the main domain name. + type: string + sans: + description: SANs defines the subject alternative domain names. + items: + type: string + type: array + type: object + resolver: + description: Resolver is the name of the resolver that will be + used to issue the DefaultCertificate. + type: string + type: object + type: object + required: + - metadata + - spec + type: object + served: true + storage: true + +--- +# Source: traefik/crds/traefik.io_traefikservices.yaml +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.16.1 + name: traefikservices.traefik.io +spec: + group: traefik.io + names: + kind: TraefikService + listKind: TraefikServiceList + plural: traefikservices + singular: traefikservice + scope: Namespaced + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: |- + TraefikService is the CRD implementation of a Traefik Service. + TraefikService object allows to: + - Apply weight to Services on load-balancing + - Mirror traffic on services + More info: https://doc.traefik.io/traefik/v3.3/routing/providers/kubernetes-crd/#kind-traefikservice + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: TraefikServiceSpec defines the desired state of a TraefikService. + properties: + mirroring: + description: Mirroring defines the Mirroring service configuration. + properties: + healthCheck: + description: Healthcheck defines health checks for ExternalName + services. + properties: + followRedirects: + description: |- + FollowRedirects defines whether redirects should be followed during the health check calls. + Default: true + type: boolean + headers: + additionalProperties: + type: string + description: Headers defines custom headers to be sent to + the health check endpoint. + type: object + hostname: + description: Hostname defines the value of hostname in the + Host header of the health check request. + type: string + interval: + anyOf: + - type: integer + - type: string + description: |- + Interval defines the frequency of the health check calls. + Default: 30s + x-kubernetes-int-or-string: true + method: + description: Method defines the healthcheck method. + type: string + mode: + description: |- + Mode defines the health check mode. + If defined to grpc, will use the gRPC health check protocol to probe the server. + Default: http + type: string + path: + description: Path defines the server URL path for the health + check endpoint. + type: string + port: + description: Port defines the server URL port for the health + check endpoint. + type: integer + scheme: + description: Scheme replaces the server URL scheme for the + health check endpoint. + type: string + status: + description: Status defines the expected HTTP status code + of the response to the health check request. + type: integer + timeout: + anyOf: + - type: integer + - type: string + description: |- + Timeout defines the maximum duration Traefik will wait for a health check request before considering the server unhealthy. + Default: 5s + x-kubernetes-int-or-string: true + type: object + kind: + description: Kind defines the kind of the Service. + enum: + - Service + - TraefikService + type: string + maxBodySize: + description: |- + MaxBodySize defines the maximum size allowed for the body of the request. + If the body is larger, the request is not mirrored. + Default value is -1, which means unlimited size. + format: int64 + type: integer + mirrorBody: + description: |- + MirrorBody defines whether the body of the request should be mirrored. + Default value is true. + type: boolean + mirrors: + description: Mirrors defines the list of mirrors where Traefik + will duplicate the traffic. + items: + description: MirrorService holds the mirror configuration. + properties: + healthCheck: + description: Healthcheck defines health checks for ExternalName + services. + properties: + followRedirects: + description: |- + FollowRedirects defines whether redirects should be followed during the health check calls. + Default: true + type: boolean + headers: + additionalProperties: + type: string + description: Headers defines custom headers to be sent + to the health check endpoint. + type: object + hostname: + description: Hostname defines the value of hostname + in the Host header of the health check request. + type: string + interval: + anyOf: + - type: integer + - type: string + description: |- + Interval defines the frequency of the health check calls. + Default: 30s + x-kubernetes-int-or-string: true + method: + description: Method defines the healthcheck method. + type: string + mode: + description: |- + Mode defines the health check mode. + If defined to grpc, will use the gRPC health check protocol to probe the server. + Default: http + type: string + path: + description: Path defines the server URL path for the + health check endpoint. + type: string + port: + description: Port defines the server URL port for the + health check endpoint. + type: integer + scheme: + description: Scheme replaces the server URL scheme for + the health check endpoint. + type: string + status: + description: Status defines the expected HTTP status + code of the response to the health check request. + type: integer + timeout: + anyOf: + - type: integer + - type: string + description: |- + Timeout defines the maximum duration Traefik will wait for a health check request before considering the server unhealthy. + Default: 5s + x-kubernetes-int-or-string: true + type: object + kind: + description: Kind defines the kind of the Service. + enum: + - Service + - TraefikService + type: string + name: + description: |- + Name defines the name of the referenced Kubernetes Service or TraefikService. + The differentiation between the two is specified in the Kind field. + type: string + namespace: + description: Namespace defines the namespace of the referenced + Kubernetes Service or TraefikService. + type: string + nativeLB: + description: |- + NativeLB controls, when creating the load-balancer, + whether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP. + The Kubernetes Service itself does load-balance to the pods. + By default, NativeLB is false. + type: boolean + nodePortLB: + description: |- + NodePortLB controls, when creating the load-balancer, + whether the LB's children are directly the nodes internal IPs using the nodePort when the service type is NodePort. + It allows services to be reachable when Traefik runs externally from the Kubernetes cluster but within the same network of the nodes. + By default, NodePortLB is false. + type: boolean + passHostHeader: + description: |- + PassHostHeader defines whether the client Host header is forwarded to the upstream Kubernetes Service. + By default, passHostHeader is true. + type: boolean + percent: + description: |- + Percent defines the part of the traffic to mirror. + Supported values: 0 to 100. + type: integer + port: + anyOf: + - type: integer + - type: string + description: |- + Port defines the port of a Kubernetes Service. + This can be a reference to a named port. + x-kubernetes-int-or-string: true + responseForwarding: + description: ResponseForwarding defines how Traefik forwards + the response from the upstream Kubernetes Service to the + client. + properties: + flushInterval: + description: |- + FlushInterval defines the interval, in milliseconds, in between flushes to the client while copying the response body. + A negative value means to flush immediately after each write to the client. + This configuration is ignored when ReverseProxy recognizes a response as a streaming response; + for such responses, writes are flushed to the client immediately. + Default: 100ms + type: string + type: object + scheme: + description: |- + Scheme defines the scheme to use for the request to the upstream Kubernetes Service. + It defaults to https when Kubernetes Service port is 443, http otherwise. + type: string + serversTransport: + description: |- + ServersTransport defines the name of ServersTransport resource to use. + It allows to configure the transport between Traefik and your servers. + Can only be used on a Kubernetes Service. + type: string + sticky: + description: |- + Sticky defines the sticky sessions configuration. + More info: https://doc.traefik.io/traefik/v3.3/routing/services/#sticky-sessions + properties: + cookie: + description: Cookie defines the sticky cookie configuration. + properties: + httpOnly: + description: HTTPOnly defines whether the cookie + can be accessed by client-side APIs, such as JavaScript. + type: boolean + maxAge: + description: |- + MaxAge defines the number of seconds until the cookie expires. + When set to a negative number, the cookie expires immediately. + When set to zero, the cookie never expires. + type: integer + name: + description: Name defines the Cookie name. + type: string + path: + description: |- + Path defines the path that must exist in the requested URL for the browser to send the Cookie header. + When not provided the cookie will be sent on every request to the domain. + More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#pathpath-value + type: string + sameSite: + description: |- + SameSite defines the same site policy. + More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite + type: string + secure: + description: Secure defines whether the cookie can + only be transmitted over an encrypted connection + (i.e. HTTPS). + type: boolean + type: object + type: object + strategy: + description: |- + Strategy defines the load balancing strategy between the servers. + RoundRobin is the only supported value at the moment. + type: string + weight: + description: |- + Weight defines the weight and should only be specified when Name references a TraefikService object + (and to be precise, one that embeds a Weighted Round Robin). + type: integer + required: + - name + type: object + type: array + name: + description: |- + Name defines the name of the referenced Kubernetes Service or TraefikService. + The differentiation between the two is specified in the Kind field. + type: string + namespace: + description: Namespace defines the namespace of the referenced + Kubernetes Service or TraefikService. + type: string + nativeLB: + description: |- + NativeLB controls, when creating the load-balancer, + whether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP. + The Kubernetes Service itself does load-balance to the pods. + By default, NativeLB is false. + type: boolean + nodePortLB: + description: |- + NodePortLB controls, when creating the load-balancer, + whether the LB's children are directly the nodes internal IPs using the nodePort when the service type is NodePort. + It allows services to be reachable when Traefik runs externally from the Kubernetes cluster but within the same network of the nodes. + By default, NodePortLB is false. + type: boolean + passHostHeader: + description: |- + PassHostHeader defines whether the client Host header is forwarded to the upstream Kubernetes Service. + By default, passHostHeader is true. + type: boolean + port: + anyOf: + - type: integer + - type: string + description: |- + Port defines the port of a Kubernetes Service. + This can be a reference to a named port. + x-kubernetes-int-or-string: true + responseForwarding: + description: ResponseForwarding defines how Traefik forwards the + response from the upstream Kubernetes Service to the client. + properties: + flushInterval: + description: |- + FlushInterval defines the interval, in milliseconds, in between flushes to the client while copying the response body. + A negative value means to flush immediately after each write to the client. + This configuration is ignored when ReverseProxy recognizes a response as a streaming response; + for such responses, writes are flushed to the client immediately. + Default: 100ms + type: string + type: object + scheme: + description: |- + Scheme defines the scheme to use for the request to the upstream Kubernetes Service. + It defaults to https when Kubernetes Service port is 443, http otherwise. + type: string + serversTransport: + description: |- + ServersTransport defines the name of ServersTransport resource to use. + It allows to configure the transport between Traefik and your servers. + Can only be used on a Kubernetes Service. + type: string + sticky: + description: |- + Sticky defines the sticky sessions configuration. + More info: https://doc.traefik.io/traefik/v3.3/routing/services/#sticky-sessions + properties: + cookie: + description: Cookie defines the sticky cookie configuration. + properties: + httpOnly: + description: HTTPOnly defines whether the cookie can be + accessed by client-side APIs, such as JavaScript. + type: boolean + maxAge: + description: |- + MaxAge defines the number of seconds until the cookie expires. + When set to a negative number, the cookie expires immediately. + When set to zero, the cookie never expires. + type: integer + name: + description: Name defines the Cookie name. + type: string + path: + description: |- + Path defines the path that must exist in the requested URL for the browser to send the Cookie header. + When not provided the cookie will be sent on every request to the domain. + More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#pathpath-value + type: string + sameSite: + description: |- + SameSite defines the same site policy. + More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite + type: string + secure: + description: Secure defines whether the cookie can only + be transmitted over an encrypted connection (i.e. HTTPS). + type: boolean + type: object + type: object + strategy: + description: |- + Strategy defines the load balancing strategy between the servers. + RoundRobin is the only supported value at the moment. + type: string + weight: + description: |- + Weight defines the weight and should only be specified when Name references a TraefikService object + (and to be precise, one that embeds a Weighted Round Robin). + type: integer + required: + - name + type: object + weighted: + description: Weighted defines the Weighted Round Robin configuration. + properties: + services: + description: Services defines the list of Kubernetes Service and/or + TraefikService to load-balance, with weight. + items: + description: Service defines an upstream HTTP service to proxy + traffic to. + properties: + healthCheck: + description: Healthcheck defines health checks for ExternalName + services. + properties: + followRedirects: + description: |- + FollowRedirects defines whether redirects should be followed during the health check calls. + Default: true + type: boolean + headers: + additionalProperties: + type: string + description: Headers defines custom headers to be sent + to the health check endpoint. + type: object + hostname: + description: Hostname defines the value of hostname + in the Host header of the health check request. + type: string + interval: + anyOf: + - type: integer + - type: string + description: |- + Interval defines the frequency of the health check calls. + Default: 30s + x-kubernetes-int-or-string: true + method: + description: Method defines the healthcheck method. + type: string + mode: + description: |- + Mode defines the health check mode. + If defined to grpc, will use the gRPC health check protocol to probe the server. + Default: http + type: string + path: + description: Path defines the server URL path for the + health check endpoint. + type: string + port: + description: Port defines the server URL port for the + health check endpoint. + type: integer + scheme: + description: Scheme replaces the server URL scheme for + the health check endpoint. + type: string + status: + description: Status defines the expected HTTP status + code of the response to the health check request. + type: integer + timeout: + anyOf: + - type: integer + - type: string + description: |- + Timeout defines the maximum duration Traefik will wait for a health check request before considering the server unhealthy. + Default: 5s + x-kubernetes-int-or-string: true + type: object + kind: + description: Kind defines the kind of the Service. + enum: + - Service + - TraefikService + type: string + name: + description: |- + Name defines the name of the referenced Kubernetes Service or TraefikService. + The differentiation between the two is specified in the Kind field. + type: string + namespace: + description: Namespace defines the namespace of the referenced + Kubernetes Service or TraefikService. + type: string + nativeLB: + description: |- + NativeLB controls, when creating the load-balancer, + whether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP. + The Kubernetes Service itself does load-balance to the pods. + By default, NativeLB is false. + type: boolean + nodePortLB: + description: |- + NodePortLB controls, when creating the load-balancer, + whether the LB's children are directly the nodes internal IPs using the nodePort when the service type is NodePort. + It allows services to be reachable when Traefik runs externally from the Kubernetes cluster but within the same network of the nodes. + By default, NodePortLB is false. + type: boolean + passHostHeader: + description: |- + PassHostHeader defines whether the client Host header is forwarded to the upstream Kubernetes Service. + By default, passHostHeader is true. + type: boolean + port: + anyOf: + - type: integer + - type: string + description: |- + Port defines the port of a Kubernetes Service. + This can be a reference to a named port. + x-kubernetes-int-or-string: true + responseForwarding: + description: ResponseForwarding defines how Traefik forwards + the response from the upstream Kubernetes Service to the + client. + properties: + flushInterval: + description: |- + FlushInterval defines the interval, in milliseconds, in between flushes to the client while copying the response body. + A negative value means to flush immediately after each write to the client. + This configuration is ignored when ReverseProxy recognizes a response as a streaming response; + for such responses, writes are flushed to the client immediately. + Default: 100ms + type: string + type: object + scheme: + description: |- + Scheme defines the scheme to use for the request to the upstream Kubernetes Service. + It defaults to https when Kubernetes Service port is 443, http otherwise. + type: string + serversTransport: + description: |- + ServersTransport defines the name of ServersTransport resource to use. + It allows to configure the transport between Traefik and your servers. + Can only be used on a Kubernetes Service. + type: string + sticky: + description: |- + Sticky defines the sticky sessions configuration. + More info: https://doc.traefik.io/traefik/v3.3/routing/services/#sticky-sessions + properties: + cookie: + description: Cookie defines the sticky cookie configuration. + properties: + httpOnly: + description: HTTPOnly defines whether the cookie + can be accessed by client-side APIs, such as JavaScript. + type: boolean + maxAge: + description: |- + MaxAge defines the number of seconds until the cookie expires. + When set to a negative number, the cookie expires immediately. + When set to zero, the cookie never expires. + type: integer + name: + description: Name defines the Cookie name. + type: string + path: + description: |- + Path defines the path that must exist in the requested URL for the browser to send the Cookie header. + When not provided the cookie will be sent on every request to the domain. + More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#pathpath-value + type: string + sameSite: + description: |- + SameSite defines the same site policy. + More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite + type: string + secure: + description: Secure defines whether the cookie can + only be transmitted over an encrypted connection + (i.e. HTTPS). + type: boolean + type: object + type: object + strategy: + description: |- + Strategy defines the load balancing strategy between the servers. + RoundRobin is the only supported value at the moment. + type: string + weight: + description: |- + Weight defines the weight and should only be specified when Name references a TraefikService object + (and to be precise, one that embeds a Weighted Round Robin). + type: integer + required: + - name + type: object + type: array + sticky: + description: |- + Sticky defines whether sticky sessions are enabled. + More info: https://doc.traefik.io/traefik/v3.3/routing/providers/kubernetes-crd/#stickiness-and-load-balancing + properties: + cookie: + description: Cookie defines the sticky cookie configuration. + properties: + httpOnly: + description: HTTPOnly defines whether the cookie can be + accessed by client-side APIs, such as JavaScript. + type: boolean + maxAge: + description: |- + MaxAge defines the number of seconds until the cookie expires. + When set to a negative number, the cookie expires immediately. + When set to zero, the cookie never expires. + type: integer + name: + description: Name defines the Cookie name. + type: string + path: + description: |- + Path defines the path that must exist in the requested URL for the browser to send the Cookie header. + When not provided the cookie will be sent on every request to the domain. + More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#pathpath-value + type: string + sameSite: + description: |- + SameSite defines the same site policy. + More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite + type: string + secure: + description: Secure defines whether the cookie can only + be transmitted over an encrypted connection (i.e. HTTPS). + type: boolean + type: object + type: object + type: object + type: object + required: + - metadata + - spec + type: object + served: true + storage: true + +--- +# Source: traefik/templates/rbac/serviceaccount.yaml +kind: ServiceAccount +apiVersion: v1 +metadata: + name: traefik + namespace: traefik + labels: + app.kubernetes.io/name: traefik + app.kubernetes.io/instance: traefik-traefik + helm.sh/chart: traefik-34.4.1 + app.kubernetes.io/managed-by: Helm + annotations: +automountServiceAccountToken: false +--- +# Source: traefik/templates/rbac/clusterrole.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: traefik-traefik + labels: + app.kubernetes.io/name: traefik + app.kubernetes.io/instance: traefik-traefik + helm.sh/chart: traefik-34.4.1 + app.kubernetes.io/managed-by: Helm +rules: + - apiGroups: + - "" + resources: + - nodes + verbs: + - get + - list + - watch + - apiGroups: + - "" + resources: + - services + verbs: + - get + - list + - watch + - apiGroups: + - discovery.k8s.io + resources: + - endpointslices + verbs: + - list + - watch + - apiGroups: + - "" + resources: + - secrets + verbs: + - get + - list + - watch + - apiGroups: + - extensions + - networking.k8s.io + resources: + - ingressclasses + - ingresses + verbs: + - get + - list + - watch + - apiGroups: + - extensions + - networking.k8s.io + resources: + - ingresses/status + verbs: + - update + - apiGroups: + - traefik.io + resources: + - ingressroutes + - ingressroutetcps + - ingressrouteudps + - middlewares + - middlewaretcps + - serverstransports + - serverstransporttcps + - tlsoptions + - tlsstores + - traefikservices + verbs: + - get + - list + - watch + +--- +# Source: traefik/templates/rbac/clusterrolebinding.yaml +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: traefik-traefik + labels: + app.kubernetes.io/name: traefik + app.kubernetes.io/instance: traefik-traefik + helm.sh/chart: traefik-34.4.1 + app.kubernetes.io/managed-by: Helm +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: traefik-traefik +subjects: + - kind: ServiceAccount + name: traefik + namespace: traefik +--- +# Source: traefik/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + name: traefik + namespace: traefik + labels: + app.kubernetes.io/name: traefik + app.kubernetes.io/instance: traefik-traefik + helm.sh/chart: traefik-34.4.1 + app.kubernetes.io/managed-by: Helm + annotations: +spec: + type: LoadBalancer + selector: + app.kubernetes.io/name: traefik + app.kubernetes.io/instance: traefik-traefik + ports: + - port: 80 + name: "web" + targetPort: web + protocol: TCP + - port: 443 + name: "websecure" + targetPort: websecure + protocol: TCP +--- +# Source: traefik/templates/deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + name: traefik + namespace: traefik + labels: + app.kubernetes.io/name: traefik + app.kubernetes.io/instance: traefik-traefik + helm.sh/chart: traefik-34.4.1 + app.kubernetes.io/managed-by: Helm + annotations: +spec: + replicas: 1 + selector: + matchLabels: + app.kubernetes.io/name: traefik + app.kubernetes.io/instance: traefik-traefik + strategy: + type: RollingUpdate + rollingUpdate: + maxUnavailable: 0 + maxSurge: 1 + minReadySeconds: 0 + template: + metadata: + annotations: + prometheus.io/scrape: "true" + prometheus.io/path: "/metrics" + prometheus.io/port: "9100" + labels: + app.kubernetes.io/name: traefik + app.kubernetes.io/instance: traefik-traefik + helm.sh/chart: traefik-34.4.1 + app.kubernetes.io/managed-by: Helm + spec: + serviceAccountName: traefik + automountServiceAccountToken: true + terminationGracePeriodSeconds: 60 + hostNetwork: false + containers: + - image: docker.io/traefik:v3.3.4 + imagePullPolicy: IfNotPresent + name: traefik + resources: + readinessProbe: + httpGet: + path: /ping + port: 8080 + scheme: HTTP + failureThreshold: 1 + initialDelaySeconds: 2 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 2 + livenessProbe: + httpGet: + path: /ping + port: 8080 + scheme: HTTP + failureThreshold: 3 + initialDelaySeconds: 2 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 2 + lifecycle: + ports: + - name: "metrics" + containerPort: 9100 + protocol: "TCP" + - name: "traefik" + containerPort: 8080 + protocol: "TCP" + - name: "web" + containerPort: 8000 + protocol: "TCP" + - name: "websecure" + containerPort: 8443 + protocol: "TCP" + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + volumeMounts: + - name: data + mountPath: /data + - name: tmp + mountPath: /tmp + args: + - "--global.checknewversion" + - "--global.sendanonymoususage" + - "--entryPoints.metrics.address=:9100/tcp" + - "--entryPoints.traefik.address=:8080/tcp" + - "--entryPoints.web.address=:8000/tcp" + - "--entryPoints.websecure.address=:8443/tcp" + - "--api.dashboard=true" + - "--ping=true" + - "--metrics.prometheus=true" + - "--metrics.prometheus.entrypoint=metrics" + - "--providers.kubernetescrd" + - "--providers.kubernetescrd.allowEmptyServices=true" + - "--providers.kubernetesingress" + - "--providers.kubernetesingress.allowEmptyServices=true" + - "--providers.kubernetesingress.ingressendpoint.publishedservice=traefik/traefik" + - "--entryPoints.websecure.http.tls=true" + - "--log.level=INFO" + + env: + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + volumes: + - name: data + emptyDir: {} + - name: tmp + emptyDir: {} + securityContext: + runAsGroup: 65532 + runAsNonRoot: true + runAsUser: 65532 + +--- +# Source: traefik/templates/ingressclass.yaml +apiVersion: networking.k8s.io/v1 +kind: IngressClass +metadata: + annotations: + ingressclass.kubernetes.io/is-default-class: "true" + labels: + app.kubernetes.io/name: traefik + app.kubernetes.io/instance: traefik-traefik + helm.sh/chart: traefik-34.4.1 + app.kubernetes.io/managed-by: Helm + name: traefik +spec: + controller: traefik.io/ingress-controller + diff --git a/packages/manifests/operators/traefik/34.4.1.yaml b/packages/manifests/operators/traefik/34.4.1.yaml new file mode 100644 index 0000000..32a3fe5 --- /dev/null +++ b/packages/manifests/operators/traefik/34.4.1.yaml @@ -0,0 +1,16116 @@ +# Source: traefik/traefik@34.4.1 +--- +# Added by pull-manifests.ts to ensure namespace exists +apiVersion: v1 +kind: Namespace +metadata: + name: traefik + labels: + app.kubernetes.io/name: traefik + +--- +--- +# Source: traefik/crds/gateway-standard-install.yaml +# Copyright 2024 The Kubernetes Authors. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# +# Gateway API Standard channel install +# +--- +# +# config/crd/standard/gateway.networking.k8s.io_gatewayclasses.yaml +# +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328 + gateway.networking.k8s.io/bundle-version: v1.2.1 + gateway.networking.k8s.io/channel: standard + creationTimestamp: null + name: gatewayclasses.gateway.networking.k8s.io +spec: + group: gateway.networking.k8s.io + names: + categories: + - gateway-api + kind: GatewayClass + listKind: GatewayClassList + plural: gatewayclasses + shortNames: + - gc + singular: gatewayclass + scope: Cluster + versions: + - additionalPrinterColumns: + - jsonPath: .spec.controllerName + name: Controller + type: string + - jsonPath: .status.conditions[?(@.type=="Accepted")].status + name: Accepted + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + - jsonPath: .spec.description + name: Description + priority: 1 + type: string + name: v1 + schema: + openAPIV3Schema: + description: |- + GatewayClass describes a class of Gateways available to the user for creating + Gateway resources. + + It is recommended that this resource be used as a template for Gateways. This + means that a Gateway is based on the state of the GatewayClass at the time it + was created and changes to the GatewayClass or associated parameters are not + propagated down to existing Gateways. This recommendation is intended to + limit the blast radius of changes to GatewayClass or associated parameters. + If implementations choose to propagate GatewayClass changes to existing + Gateways, that MUST be clearly documented by the implementation. + + Whenever one or more Gateways are using a GatewayClass, implementations SHOULD + add the `gateway-exists-finalizer.gateway.networking.k8s.io` finalizer on the + associated GatewayClass. This ensures that a GatewayClass associated with a + Gateway is not deleted while in use. + + GatewayClass is a Cluster level resource. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: Spec defines the desired state of GatewayClass. + properties: + controllerName: + description: |- + ControllerName is the name of the controller that is managing Gateways of + this class. The value of this field MUST be a domain prefixed path. + + Example: "example.net/gateway-controller". + + This field is not mutable and cannot be empty. + + Support: Core + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$ + type: string + x-kubernetes-validations: + - message: Value is immutable + rule: self == oldSelf + description: + description: Description helps describe a GatewayClass with more details. + maxLength: 64 + type: string + parametersRef: + description: |- + ParametersRef is a reference to a resource that contains the configuration + parameters corresponding to the GatewayClass. This is optional if the + controller does not require any additional configuration. + + ParametersRef can reference a standard Kubernetes resource, i.e. ConfigMap, + or an implementation-specific custom resource. The resource can be + cluster-scoped or namespace-scoped. + + If the referent cannot be found, refers to an unsupported kind, or when + the data within that resource is malformed, the GatewayClass SHOULD be + rejected with the "Accepted" status condition set to "False" and an + "InvalidParameters" reason. + + A Gateway for this GatewayClass may provide its own `parametersRef`. When both are specified, + the merging behavior is implementation specific. + It is generally recommended that GatewayClass provides defaults that can be overridden by a Gateway. + + Support: Implementation-specific + properties: + group: + description: Group is the group of the referent. + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + description: Kind is kind of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: Name is the name of the referent. + maxLength: 253 + minLength: 1 + type: string + namespace: + description: |- + Namespace is the namespace of the referent. + This field is required when referring to a Namespace-scoped resource and + MUST be unset when referring to a Cluster-scoped resource. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - group + - kind + - name + type: object + required: + - controllerName + type: object + status: + default: + conditions: + - lastTransitionTime: "1970-01-01T00:00:00Z" + message: Waiting for controller + reason: Pending + status: Unknown + type: Accepted + description: |- + Status defines the current state of GatewayClass. + + Implementations MUST populate status on all GatewayClass resources which + specify their controller name. + properties: + conditions: + default: + - lastTransitionTime: "1970-01-01T00:00:00Z" + message: Waiting for controller + reason: Pending + status: Unknown + type: Accepted + description: |- + Conditions is the current status from the controller for + this GatewayClass. + + Controllers should prefer to publish conditions using values + of GatewayClassConditionType for the type of each Condition. + items: + description: Condition contains details for one aspect of the current + state of this API Resource. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + maxItems: 8 + type: array + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + type: object + required: + - spec + type: object + served: true + storage: true + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .spec.controllerName + name: Controller + type: string + - jsonPath: .status.conditions[?(@.type=="Accepted")].status + name: Accepted + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + - jsonPath: .spec.description + name: Description + priority: 1 + type: string + name: v1beta1 + schema: + openAPIV3Schema: + description: |- + GatewayClass describes a class of Gateways available to the user for creating + Gateway resources. + + It is recommended that this resource be used as a template for Gateways. This + means that a Gateway is based on the state of the GatewayClass at the time it + was created and changes to the GatewayClass or associated parameters are not + propagated down to existing Gateways. This recommendation is intended to + limit the blast radius of changes to GatewayClass or associated parameters. + If implementations choose to propagate GatewayClass changes to existing + Gateways, that MUST be clearly documented by the implementation. + + Whenever one or more Gateways are using a GatewayClass, implementations SHOULD + add the `gateway-exists-finalizer.gateway.networking.k8s.io` finalizer on the + associated GatewayClass. This ensures that a GatewayClass associated with a + Gateway is not deleted while in use. + + GatewayClass is a Cluster level resource. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: Spec defines the desired state of GatewayClass. + properties: + controllerName: + description: |- + ControllerName is the name of the controller that is managing Gateways of + this class. The value of this field MUST be a domain prefixed path. + + Example: "example.net/gateway-controller". + + This field is not mutable and cannot be empty. + + Support: Core + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$ + type: string + x-kubernetes-validations: + - message: Value is immutable + rule: self == oldSelf + description: + description: Description helps describe a GatewayClass with more details. + maxLength: 64 + type: string + parametersRef: + description: |- + ParametersRef is a reference to a resource that contains the configuration + parameters corresponding to the GatewayClass. This is optional if the + controller does not require any additional configuration. + + ParametersRef can reference a standard Kubernetes resource, i.e. ConfigMap, + or an implementation-specific custom resource. The resource can be + cluster-scoped or namespace-scoped. + + If the referent cannot be found, refers to an unsupported kind, or when + the data within that resource is malformed, the GatewayClass SHOULD be + rejected with the "Accepted" status condition set to "False" and an + "InvalidParameters" reason. + + A Gateway for this GatewayClass may provide its own `parametersRef`. When both are specified, + the merging behavior is implementation specific. + It is generally recommended that GatewayClass provides defaults that can be overridden by a Gateway. + + Support: Implementation-specific + properties: + group: + description: Group is the group of the referent. + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + description: Kind is kind of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: Name is the name of the referent. + maxLength: 253 + minLength: 1 + type: string + namespace: + description: |- + Namespace is the namespace of the referent. + This field is required when referring to a Namespace-scoped resource and + MUST be unset when referring to a Cluster-scoped resource. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - group + - kind + - name + type: object + required: + - controllerName + type: object + status: + default: + conditions: + - lastTransitionTime: "1970-01-01T00:00:00Z" + message: Waiting for controller + reason: Pending + status: Unknown + type: Accepted + description: |- + Status defines the current state of GatewayClass. + + Implementations MUST populate status on all GatewayClass resources which + specify their controller name. + properties: + conditions: + default: + - lastTransitionTime: "1970-01-01T00:00:00Z" + message: Waiting for controller + reason: Pending + status: Unknown + type: Accepted + description: |- + Conditions is the current status from the controller for + this GatewayClass. + + Controllers should prefer to publish conditions using values + of GatewayClassConditionType for the type of each Condition. + items: + description: Condition contains details for one aspect of the current + state of this API Resource. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + maxItems: 8 + type: array + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + type: object + required: + - spec + type: object + served: true + storage: false + subresources: + status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: null + storedVersions: null +--- +# +# config/crd/standard/gateway.networking.k8s.io_gateways.yaml +# +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328 + gateway.networking.k8s.io/bundle-version: v1.2.1 + gateway.networking.k8s.io/channel: standard + creationTimestamp: null + name: gateways.gateway.networking.k8s.io +spec: + group: gateway.networking.k8s.io + names: + categories: + - gateway-api + kind: Gateway + listKind: GatewayList + plural: gateways + shortNames: + - gtw + singular: gateway + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .spec.gatewayClassName + name: Class + type: string + - jsonPath: .status.addresses[*].value + name: Address + type: string + - jsonPath: .status.conditions[?(@.type=="Programmed")].status + name: Programmed + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1 + schema: + openAPIV3Schema: + description: |- + Gateway represents an instance of a service-traffic handling infrastructure + by binding Listeners to a set of IP addresses. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: Spec defines the desired state of Gateway. + properties: + addresses: + description: |+ + Addresses requested for this Gateway. This is optional and behavior can + depend on the implementation. If a value is set in the spec and the + requested address is invalid or unavailable, the implementation MUST + indicate this in the associated entry in GatewayStatus.Addresses. + + The Addresses field represents a request for the address(es) on the + "outside of the Gateway", that traffic bound for this Gateway will use. + This could be the IP address or hostname of an external load balancer or + other networking infrastructure, or some other address that traffic will + be sent to. + + If no Addresses are specified, the implementation MAY schedule the + Gateway in an implementation-specific manner, assigning an appropriate + set of Addresses. + + The implementation MUST bind all Listeners to every GatewayAddress that + it assigns to the Gateway and add a corresponding entry in + GatewayStatus.Addresses. + + Support: Extended + + items: + description: GatewayAddress describes an address that can be bound + to a Gateway. + oneOf: + - properties: + type: + enum: + - IPAddress + value: + anyOf: + - format: ipv4 + - format: ipv6 + - properties: + type: + not: + enum: + - IPAddress + properties: + type: + default: IPAddress + description: Type of the address. + maxLength: 253 + minLength: 1 + pattern: ^Hostname|IPAddress|NamedAddress|[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$ + type: string + value: + description: |- + Value of the address. The validity of the values will depend + on the type and support by the controller. + + Examples: `1.2.3.4`, `128::1`, `my-ip-address`. + maxLength: 253 + minLength: 1 + type: string + required: + - value + type: object + x-kubernetes-validations: + - message: Hostname value must only contain valid characters (matching + ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$) + rule: 'self.type == ''Hostname'' ? self.value.matches(r"""^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$"""): + true' + maxItems: 16 + type: array + x-kubernetes-validations: + - message: IPAddress values must be unique + rule: 'self.all(a1, a1.type == ''IPAddress'' ? self.exists_one(a2, + a2.type == a1.type && a2.value == a1.value) : true )' + - message: Hostname values must be unique + rule: 'self.all(a1, a1.type == ''Hostname'' ? self.exists_one(a2, + a2.type == a1.type && a2.value == a1.value) : true )' + gatewayClassName: + description: |- + GatewayClassName used for this Gateway. This is the name of a + GatewayClass resource. + maxLength: 253 + minLength: 1 + type: string + infrastructure: + description: |- + Infrastructure defines infrastructure level attributes about this Gateway instance. + + Support: Extended + properties: + annotations: + additionalProperties: + description: |- + AnnotationValue is the value of an annotation in Gateway API. This is used + for validation of maps such as TLS options. This roughly matches Kubernetes + annotation validation, although the length validation in that case is based + on the entire size of the annotations struct. + maxLength: 4096 + minLength: 0 + type: string + description: |- + Annotations that SHOULD be applied to any resources created in response to this Gateway. + + For implementations creating other Kubernetes objects, this should be the `metadata.annotations` field on resources. + For other implementations, this refers to any relevant (implementation specific) "annotations" concepts. + + An implementation may chose to add additional implementation-specific annotations as they see fit. + + Support: Extended + maxProperties: 8 + type: object + x-kubernetes-validations: + - message: Annotation keys must be in the form of an optional + DNS subdomain prefix followed by a required name segment of + up to 63 characters. + rule: self.all(key, key.matches(r"""^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?([A-Za-z0-9][-A-Za-z0-9_.]{0,61})?[A-Za-z0-9]$""")) + - message: If specified, the annotation key's prefix must be a + DNS subdomain not longer than 253 characters in total. + rule: self.all(key, key.split("/")[0].size() < 253) + labels: + additionalProperties: + description: |- + LabelValue is the value of a label in the Gateway API. This is used for validation + of maps such as Gateway infrastructure labels. This matches the Kubernetes + label validation rules: + * must be 63 characters or less (can be empty), + * unless empty, must begin and end with an alphanumeric character ([a-z0-9A-Z]), + * could contain dashes (-), underscores (_), dots (.), and alphanumerics between. + + Valid values include: + + * MyValue + * my.name + * 123-my-value + maxLength: 63 + minLength: 0 + pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$ + type: string + description: |- + Labels that SHOULD be applied to any resources created in response to this Gateway. + + For implementations creating other Kubernetes objects, this should be the `metadata.labels` field on resources. + For other implementations, this refers to any relevant (implementation specific) "labels" concepts. + + An implementation may chose to add additional implementation-specific labels as they see fit. + + If an implementation maps these labels to Pods, or any other resource that would need to be recreated when labels + change, it SHOULD clearly warn about this behavior in documentation. + + Support: Extended + maxProperties: 8 + type: object + x-kubernetes-validations: + - message: Label keys must be in the form of an optional DNS subdomain + prefix followed by a required name segment of up to 63 characters. + rule: self.all(key, key.matches(r"""^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?([A-Za-z0-9][-A-Za-z0-9_.]{0,61})?[A-Za-z0-9]$""")) + - message: If specified, the label key's prefix must be a DNS + subdomain not longer than 253 characters in total. + rule: self.all(key, key.split("/")[0].size() < 253) + parametersRef: + description: |- + ParametersRef is a reference to a resource that contains the configuration + parameters corresponding to the Gateway. This is optional if the + controller does not require any additional configuration. + + This follows the same semantics as GatewayClass's `parametersRef`, but on a per-Gateway basis + + The Gateway's GatewayClass may provide its own `parametersRef`. When both are specified, + the merging behavior is implementation specific. + It is generally recommended that GatewayClass provides defaults that can be overridden by a Gateway. + + Support: Implementation-specific + properties: + group: + description: Group is the group of the referent. + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + description: Kind is kind of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: Name is the name of the referent. + maxLength: 253 + minLength: 1 + type: string + required: + - group + - kind + - name + type: object + type: object + listeners: + description: |- + Listeners associated with this Gateway. Listeners define + logical endpoints that are bound on this Gateway's addresses. + At least one Listener MUST be specified. + + Each Listener in a set of Listeners (for example, in a single Gateway) + MUST be _distinct_, in that a traffic flow MUST be able to be assigned to + exactly one listener. (This section uses "set of Listeners" rather than + "Listeners in a single Gateway" because implementations MAY merge configuration + from multiple Gateways onto a single data plane, and these rules _also_ + apply in that case). + + Practically, this means that each listener in a set MUST have a unique + combination of Port, Protocol, and, if supported by the protocol, Hostname. + + Some combinations of port, protocol, and TLS settings are considered + Core support and MUST be supported by implementations based on their + targeted conformance profile: + + HTTP Profile + + 1. HTTPRoute, Port: 80, Protocol: HTTP + 2. HTTPRoute, Port: 443, Protocol: HTTPS, TLS Mode: Terminate, TLS keypair provided + + TLS Profile + + 1. TLSRoute, Port: 443, Protocol: TLS, TLS Mode: Passthrough + + "Distinct" Listeners have the following property: + + The implementation can match inbound requests to a single distinct + Listener. When multiple Listeners share values for fields (for + example, two Listeners with the same Port value), the implementation + can match requests to only one of the Listeners using other + Listener fields. + + For example, the following Listener scenarios are distinct: + + 1. Multiple Listeners with the same Port that all use the "HTTP" + Protocol that all have unique Hostname values. + 2. Multiple Listeners with the same Port that use either the "HTTPS" or + "TLS" Protocol that all have unique Hostname values. + 3. A mixture of "TCP" and "UDP" Protocol Listeners, where no Listener + with the same Protocol has the same Port value. + + Some fields in the Listener struct have possible values that affect + whether the Listener is distinct. Hostname is particularly relevant + for HTTP or HTTPS protocols. + + When using the Hostname value to select between same-Port, same-Protocol + Listeners, the Hostname value must be different on each Listener for the + Listener to be distinct. + + When the Listeners are distinct based on Hostname, inbound request + hostnames MUST match from the most specific to least specific Hostname + values to choose the correct Listener and its associated set of Routes. + + Exact matches must be processed before wildcard matches, and wildcard + matches must be processed before fallback (empty Hostname value) + matches. For example, `"foo.example.com"` takes precedence over + `"*.example.com"`, and `"*.example.com"` takes precedence over `""`. + + Additionally, if there are multiple wildcard entries, more specific + wildcard entries must be processed before less specific wildcard entries. + For example, `"*.foo.example.com"` takes precedence over `"*.example.com"`. + The precise definition here is that the higher the number of dots in the + hostname to the right of the wildcard character, the higher the precedence. + + The wildcard character will match any number of characters _and dots_ to + the left, however, so `"*.example.com"` will match both + `"foo.bar.example.com"` _and_ `"bar.example.com"`. + + If a set of Listeners contains Listeners that are not distinct, then those + Listeners are Conflicted, and the implementation MUST set the "Conflicted" + condition in the Listener Status to "True". + + Implementations MAY choose to accept a Gateway with some Conflicted + Listeners only if they only accept the partial Listener set that contains + no Conflicted Listeners. To put this another way, implementations may + accept a partial Listener set only if they throw out *all* the conflicting + Listeners. No picking one of the conflicting listeners as the winner. + This also means that the Gateway must have at least one non-conflicting + Listener in this case, otherwise it violates the requirement that at + least one Listener must be present. + + The implementation MUST set a "ListenersNotValid" condition on the + Gateway Status when the Gateway contains Conflicted Listeners whether or + not they accept the Gateway. That Condition SHOULD clearly + indicate in the Message which Listeners are conflicted, and which are + Accepted. Additionally, the Listener status for those listeners SHOULD + indicate which Listeners are conflicted and not Accepted. + + A Gateway's Listeners are considered "compatible" if: + + 1. They are distinct. + 2. The implementation can serve them in compliance with the Addresses + requirement that all Listeners are available on all assigned + addresses. + + Compatible combinations in Extended support are expected to vary across + implementations. A combination that is compatible for one implementation + may not be compatible for another. + + For example, an implementation that cannot serve both TCP and UDP listeners + on the same address, or cannot mix HTTPS and generic TLS listens on the same port + would not consider those cases compatible, even though they are distinct. + + Note that requests SHOULD match at most one Listener. For example, if + Listeners are defined for "foo.example.com" and "*.example.com", a + request to "foo.example.com" SHOULD only be routed using routes attached + to the "foo.example.com" Listener (and not the "*.example.com" Listener). + This concept is known as "Listener Isolation". Implementations that do + not support Listener Isolation MUST clearly document this. + + Implementations MAY merge separate Gateways onto a single set of + Addresses if all Listeners across all Gateways are compatible. + + Support: Core + items: + description: |- + Listener embodies the concept of a logical endpoint where a Gateway accepts + network connections. + properties: + allowedRoutes: + default: + namespaces: + from: Same + description: |- + AllowedRoutes defines the types of routes that MAY be attached to a + Listener and the trusted namespaces where those Route resources MAY be + present. + + Although a client request may match multiple route rules, only one rule + may ultimately receive the request. Matching precedence MUST be + determined in order of the following criteria: + + * The most specific match as defined by the Route type. + * The oldest Route based on creation timestamp. For example, a Route with + a creation timestamp of "2020-09-08 01:02:03" is given precedence over + a Route with a creation timestamp of "2020-09-08 01:02:04". + * If everything else is equivalent, the Route appearing first in + alphabetical order (namespace/name) should be given precedence. For + example, foo/bar is given precedence over foo/baz. + + All valid rules within a Route attached to this Listener should be + implemented. Invalid Route rules can be ignored (sometimes that will mean + the full Route). If a Route rule transitions from valid to invalid, + support for that Route rule should be dropped to ensure consistency. For + example, even if a filter specified by a Route rule is invalid, the rest + of the rules within that Route should still be supported. + + Support: Core + properties: + kinds: + description: |- + Kinds specifies the groups and kinds of Routes that are allowed to bind + to this Gateway Listener. When unspecified or empty, the kinds of Routes + selected are determined using the Listener protocol. + + A RouteGroupKind MUST correspond to kinds of Routes that are compatible + with the application protocol specified in the Listener's Protocol field. + If an implementation does not support or recognize this resource type, it + MUST set the "ResolvedRefs" condition to False for this Listener with the + "InvalidRouteKinds" reason. + + Support: Core + items: + description: RouteGroupKind indicates the group and kind + of a Route resource. + properties: + group: + default: gateway.networking.k8s.io + description: Group is the group of the Route. + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + description: Kind is the kind of the Route. + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + required: + - kind + type: object + maxItems: 8 + type: array + namespaces: + default: + from: Same + description: |- + Namespaces indicates namespaces from which Routes may be attached to this + Listener. This is restricted to the namespace of this Gateway by default. + + Support: Core + properties: + from: + default: Same + description: |- + From indicates where Routes will be selected for this Gateway. Possible + values are: + + * All: Routes in all namespaces may be used by this Gateway. + * Selector: Routes in namespaces selected by the selector may be used by + this Gateway. + * Same: Only Routes in the same namespace may be used by this Gateway. + + Support: Core + enum: + - All + - Selector + - Same + type: string + selector: + description: |- + Selector must be specified when From is set to "Selector". In that case, + only Routes in Namespaces matching this Selector will be selected by this + Gateway. This field is ignored for other values of "From". + + Support: Core + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the + selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: object + type: object + hostname: + description: |- + Hostname specifies the virtual hostname to match for protocol types that + define this concept. When unspecified, all hostnames are matched. This + field is ignored for protocols that don't require hostname based + matching. + + Implementations MUST apply Hostname matching appropriately for each of + the following protocols: + + * TLS: The Listener Hostname MUST match the SNI. + * HTTP: The Listener Hostname MUST match the Host header of the request. + * HTTPS: The Listener Hostname SHOULD match at both the TLS and HTTP + protocol layers as described above. If an implementation does not + ensure that both the SNI and Host header match the Listener hostname, + it MUST clearly document that. + + For HTTPRoute and TLSRoute resources, there is an interaction with the + `spec.hostnames` array. When both listener and route specify hostnames, + there MUST be an intersection between the values for a Route to be + accepted. For more information, refer to the Route specific Hostnames + documentation. + + Hostnames that are prefixed with a wildcard label (`*.`) are interpreted + as a suffix match. That means that a match for `*.example.com` would match + both `test.example.com`, and `foo.test.example.com`, but not `example.com`. + + Support: Core + maxLength: 253 + minLength: 1 + pattern: ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + name: + description: |- + Name is the name of the Listener. This name MUST be unique within a + Gateway. + + Support: Core + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + port: + description: |- + Port is the network port. Multiple listeners may use the + same port, subject to the Listener compatibility rules. + + Support: Core + format: int32 + maximum: 65535 + minimum: 1 + type: integer + protocol: + description: |- + Protocol specifies the network protocol this listener expects to receive. + + Support: Core + maxLength: 255 + minLength: 1 + pattern: ^[a-zA-Z0-9]([-a-zA-Z0-9]*[a-zA-Z0-9])?$|[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9]+$ + type: string + tls: + description: |- + TLS is the TLS configuration for the Listener. This field is required if + the Protocol field is "HTTPS" or "TLS". It is invalid to set this field + if the Protocol field is "HTTP", "TCP", or "UDP". + + The association of SNIs to Certificate defined in GatewayTLSConfig is + defined based on the Hostname field for this listener. + + The GatewayClass MUST use the longest matching SNI out of all + available certificates for any TLS handshake. + + Support: Core + properties: + certificateRefs: + description: |- + CertificateRefs contains a series of references to Kubernetes objects that + contains TLS certificates and private keys. These certificates are used to + establish a TLS handshake for requests that match the hostname of the + associated listener. + + A single CertificateRef to a Kubernetes Secret has "Core" support. + Implementations MAY choose to support attaching multiple certificates to + a Listener, but this behavior is implementation-specific. + + References to a resource in different namespace are invalid UNLESS there + is a ReferenceGrant in the target namespace that allows the certificate + to be attached. If a ReferenceGrant does not allow this reference, the + "ResolvedRefs" condition MUST be set to False for this listener with the + "RefNotPermitted" reason. + + This field is required to have at least one element when the mode is set + to "Terminate" (default) and is optional otherwise. + + CertificateRefs can reference to standard Kubernetes resources, i.e. + Secret, or implementation-specific custom resources. + + Support: Core - A single reference to a Kubernetes Secret of type kubernetes.io/tls + + Support: Implementation-specific (More than one reference or other resource types) + items: + description: |- + SecretObjectReference identifies an API object including its namespace, + defaulting to Secret. + + The API object must be valid in the cluster; the Group and Kind must + be registered in the cluster for this reference to be valid. + + References to objects with invalid Group and Kind are not valid, and must + be rejected by the implementation, with appropriate Conditions set + on the containing object. + properties: + group: + default: "" + description: |- + Group is the group of the referent. For example, "gateway.networking.k8s.io". + When unspecified or empty string, core API group is inferred. + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + default: Secret + description: Kind is kind of the referent. For example + "Secret". + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: Name is the name of the referent. + maxLength: 253 + minLength: 1 + type: string + namespace: + description: |- + Namespace is the namespace of the referenced object. When unspecified, the local + namespace is inferred. + + Note that when a namespace different than the local namespace is specified, + a ReferenceGrant object is required in the referent namespace to allow that + namespace's owner to accept the reference. See the ReferenceGrant + documentation for details. + + Support: Core + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - name + type: object + maxItems: 64 + type: array + mode: + default: Terminate + description: |- + Mode defines the TLS behavior for the TLS session initiated by the client. + There are two possible modes: + + - Terminate: The TLS session between the downstream client and the + Gateway is terminated at the Gateway. This mode requires certificates + to be specified in some way, such as populating the certificateRefs + field. + - Passthrough: The TLS session is NOT terminated by the Gateway. This + implies that the Gateway can't decipher the TLS stream except for + the ClientHello message of the TLS protocol. The certificateRefs field + is ignored in this mode. + + Support: Core + enum: + - Terminate + - Passthrough + type: string + options: + additionalProperties: + description: |- + AnnotationValue is the value of an annotation in Gateway API. This is used + for validation of maps such as TLS options. This roughly matches Kubernetes + annotation validation, although the length validation in that case is based + on the entire size of the annotations struct. + maxLength: 4096 + minLength: 0 + type: string + description: |- + Options are a list of key/value pairs to enable extended TLS + configuration for each implementation. For example, configuring the + minimum TLS version or supported cipher suites. + + A set of common keys MAY be defined by the API in the future. To avoid + any ambiguity, implementation-specific definitions MUST use + domain-prefixed names, such as `example.com/my-custom-option`. + Un-prefixed names are reserved for key names defined by Gateway API. + + Support: Implementation-specific + maxProperties: 16 + type: object + type: object + x-kubernetes-validations: + - message: certificateRefs or options must be specified when + mode is Terminate + rule: 'self.mode == ''Terminate'' ? size(self.certificateRefs) + > 0 || size(self.options) > 0 : true' + required: + - name + - port + - protocol + type: object + maxItems: 64 + minItems: 1 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + x-kubernetes-validations: + - message: tls must not be specified for protocols ['HTTP', 'TCP', + 'UDP'] + rule: 'self.all(l, l.protocol in [''HTTP'', ''TCP'', ''UDP''] ? + !has(l.tls) : true)' + - message: tls mode must be Terminate for protocol HTTPS + rule: 'self.all(l, (l.protocol == ''HTTPS'' && has(l.tls)) ? (l.tls.mode + == '''' || l.tls.mode == ''Terminate'') : true)' + - message: hostname must not be specified for protocols ['TCP', 'UDP'] + rule: 'self.all(l, l.protocol in [''TCP'', ''UDP''] ? (!has(l.hostname) + || l.hostname == '''') : true)' + - message: Listener name must be unique within the Gateway + rule: self.all(l1, self.exists_one(l2, l1.name == l2.name)) + - message: Combination of port, protocol and hostname must be unique + for each listener + rule: 'self.all(l1, self.exists_one(l2, l1.port == l2.port && l1.protocol + == l2.protocol && (has(l1.hostname) && has(l2.hostname) ? l1.hostname + == l2.hostname : !has(l1.hostname) && !has(l2.hostname))))' + required: + - gatewayClassName + - listeners + type: object + status: + default: + conditions: + - lastTransitionTime: "1970-01-01T00:00:00Z" + message: Waiting for controller + reason: Pending + status: Unknown + type: Accepted + - lastTransitionTime: "1970-01-01T00:00:00Z" + message: Waiting for controller + reason: Pending + status: Unknown + type: Programmed + description: Status defines the current state of Gateway. + properties: + addresses: + description: |+ + Addresses lists the network addresses that have been bound to the + Gateway. + + This list may differ from the addresses provided in the spec under some + conditions: + + * no addresses are specified, all addresses are dynamically assigned + * a combination of specified and dynamic addresses are assigned + * a specified address was unusable (e.g. already in use) + + items: + description: GatewayStatusAddress describes a network address that + is bound to a Gateway. + oneOf: + - properties: + type: + enum: + - IPAddress + value: + anyOf: + - format: ipv4 + - format: ipv6 + - properties: + type: + not: + enum: + - IPAddress + properties: + type: + default: IPAddress + description: Type of the address. + maxLength: 253 + minLength: 1 + pattern: ^Hostname|IPAddress|NamedAddress|[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$ + type: string + value: + description: |- + Value of the address. The validity of the values will depend + on the type and support by the controller. + + Examples: `1.2.3.4`, `128::1`, `my-ip-address`. + maxLength: 253 + minLength: 1 + type: string + required: + - value + type: object + x-kubernetes-validations: + - message: Hostname value must only contain valid characters (matching + ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$) + rule: 'self.type == ''Hostname'' ? self.value.matches(r"""^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$"""): + true' + maxItems: 16 + type: array + conditions: + default: + - lastTransitionTime: "1970-01-01T00:00:00Z" + message: Waiting for controller + reason: Pending + status: Unknown + type: Accepted + - lastTransitionTime: "1970-01-01T00:00:00Z" + message: Waiting for controller + reason: Pending + status: Unknown + type: Programmed + description: |- + Conditions describe the current conditions of the Gateway. + + Implementations should prefer to express Gateway conditions + using the `GatewayConditionType` and `GatewayConditionReason` + constants so that operators and tools can converge on a common + vocabulary to describe Gateway state. + + Known condition types are: + + * "Accepted" + * "Programmed" + * "Ready" + items: + description: Condition contains details for one aspect of the current + state of this API Resource. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + maxItems: 8 + type: array + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + listeners: + description: Listeners provide status for each unique listener port + defined in the Spec. + items: + description: ListenerStatus is the status associated with a Listener. + properties: + attachedRoutes: + description: |- + AttachedRoutes represents the total number of Routes that have been + successfully attached to this Listener. + + Successful attachment of a Route to a Listener is based solely on the + combination of the AllowedRoutes field on the corresponding Listener + and the Route's ParentRefs field. A Route is successfully attached to + a Listener when it is selected by the Listener's AllowedRoutes field + AND the Route has a valid ParentRef selecting the whole Gateway + resource or a specific Listener as a parent resource (more detail on + attachment semantics can be found in the documentation on the various + Route kinds ParentRefs fields). Listener or Route status does not impact + successful attachment, i.e. the AttachedRoutes field count MUST be set + for Listeners with condition Accepted: false and MUST count successfully + attached Routes that may themselves have Accepted: false conditions. + + Uses for this field include troubleshooting Route attachment and + measuring blast radius/impact of changes to a Listener. + format: int32 + type: integer + conditions: + description: Conditions describe the current condition of this + listener. + items: + description: Condition contains details for one aspect of + the current state of this API Resource. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, + Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + maxItems: 8 + type: array + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + name: + description: Name is the name of the Listener that this status + corresponds to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + supportedKinds: + description: |- + SupportedKinds is the list indicating the Kinds supported by this + listener. This MUST represent the kinds an implementation supports for + that Listener configuration. + + If kinds are specified in Spec that are not supported, they MUST NOT + appear in this list and an implementation MUST set the "ResolvedRefs" + condition to "False" with the "InvalidRouteKinds" reason. If both valid + and invalid Route kinds are specified, the implementation MUST + reference the valid Route kinds that have been specified. + items: + description: RouteGroupKind indicates the group and kind of + a Route resource. + properties: + group: + default: gateway.networking.k8s.io + description: Group is the group of the Route. + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + description: Kind is the kind of the Route. + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + required: + - kind + type: object + maxItems: 8 + type: array + required: + - attachedRoutes + - conditions + - name + - supportedKinds + type: object + maxItems: 64 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + type: object + required: + - spec + type: object + served: true + storage: true + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .spec.gatewayClassName + name: Class + type: string + - jsonPath: .status.addresses[*].value + name: Address + type: string + - jsonPath: .status.conditions[?(@.type=="Programmed")].status + name: Programmed + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1beta1 + schema: + openAPIV3Schema: + description: |- + Gateway represents an instance of a service-traffic handling infrastructure + by binding Listeners to a set of IP addresses. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: Spec defines the desired state of Gateway. + properties: + addresses: + description: |+ + Addresses requested for this Gateway. This is optional and behavior can + depend on the implementation. If a value is set in the spec and the + requested address is invalid or unavailable, the implementation MUST + indicate this in the associated entry in GatewayStatus.Addresses. + + The Addresses field represents a request for the address(es) on the + "outside of the Gateway", that traffic bound for this Gateway will use. + This could be the IP address or hostname of an external load balancer or + other networking infrastructure, or some other address that traffic will + be sent to. + + If no Addresses are specified, the implementation MAY schedule the + Gateway in an implementation-specific manner, assigning an appropriate + set of Addresses. + + The implementation MUST bind all Listeners to every GatewayAddress that + it assigns to the Gateway and add a corresponding entry in + GatewayStatus.Addresses. + + Support: Extended + + items: + description: GatewayAddress describes an address that can be bound + to a Gateway. + oneOf: + - properties: + type: + enum: + - IPAddress + value: + anyOf: + - format: ipv4 + - format: ipv6 + - properties: + type: + not: + enum: + - IPAddress + properties: + type: + default: IPAddress + description: Type of the address. + maxLength: 253 + minLength: 1 + pattern: ^Hostname|IPAddress|NamedAddress|[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$ + type: string + value: + description: |- + Value of the address. The validity of the values will depend + on the type and support by the controller. + + Examples: `1.2.3.4`, `128::1`, `my-ip-address`. + maxLength: 253 + minLength: 1 + type: string + required: + - value + type: object + x-kubernetes-validations: + - message: Hostname value must only contain valid characters (matching + ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$) + rule: 'self.type == ''Hostname'' ? self.value.matches(r"""^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$"""): + true' + maxItems: 16 + type: array + x-kubernetes-validations: + - message: IPAddress values must be unique + rule: 'self.all(a1, a1.type == ''IPAddress'' ? self.exists_one(a2, + a2.type == a1.type && a2.value == a1.value) : true )' + - message: Hostname values must be unique + rule: 'self.all(a1, a1.type == ''Hostname'' ? self.exists_one(a2, + a2.type == a1.type && a2.value == a1.value) : true )' + gatewayClassName: + description: |- + GatewayClassName used for this Gateway. This is the name of a + GatewayClass resource. + maxLength: 253 + minLength: 1 + type: string + infrastructure: + description: |- + Infrastructure defines infrastructure level attributes about this Gateway instance. + + Support: Extended + properties: + annotations: + additionalProperties: + description: |- + AnnotationValue is the value of an annotation in Gateway API. This is used + for validation of maps such as TLS options. This roughly matches Kubernetes + annotation validation, although the length validation in that case is based + on the entire size of the annotations struct. + maxLength: 4096 + minLength: 0 + type: string + description: |- + Annotations that SHOULD be applied to any resources created in response to this Gateway. + + For implementations creating other Kubernetes objects, this should be the `metadata.annotations` field on resources. + For other implementations, this refers to any relevant (implementation specific) "annotations" concepts. + + An implementation may chose to add additional implementation-specific annotations as they see fit. + + Support: Extended + maxProperties: 8 + type: object + x-kubernetes-validations: + - message: Annotation keys must be in the form of an optional + DNS subdomain prefix followed by a required name segment of + up to 63 characters. + rule: self.all(key, key.matches(r"""^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?([A-Za-z0-9][-A-Za-z0-9_.]{0,61})?[A-Za-z0-9]$""")) + - message: If specified, the annotation key's prefix must be a + DNS subdomain not longer than 253 characters in total. + rule: self.all(key, key.split("/")[0].size() < 253) + labels: + additionalProperties: + description: |- + LabelValue is the value of a label in the Gateway API. This is used for validation + of maps such as Gateway infrastructure labels. This matches the Kubernetes + label validation rules: + * must be 63 characters or less (can be empty), + * unless empty, must begin and end with an alphanumeric character ([a-z0-9A-Z]), + * could contain dashes (-), underscores (_), dots (.), and alphanumerics between. + + Valid values include: + + * MyValue + * my.name + * 123-my-value + maxLength: 63 + minLength: 0 + pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$ + type: string + description: |- + Labels that SHOULD be applied to any resources created in response to this Gateway. + + For implementations creating other Kubernetes objects, this should be the `metadata.labels` field on resources. + For other implementations, this refers to any relevant (implementation specific) "labels" concepts. + + An implementation may chose to add additional implementation-specific labels as they see fit. + + If an implementation maps these labels to Pods, or any other resource that would need to be recreated when labels + change, it SHOULD clearly warn about this behavior in documentation. + + Support: Extended + maxProperties: 8 + type: object + x-kubernetes-validations: + - message: Label keys must be in the form of an optional DNS subdomain + prefix followed by a required name segment of up to 63 characters. + rule: self.all(key, key.matches(r"""^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?([A-Za-z0-9][-A-Za-z0-9_.]{0,61})?[A-Za-z0-9]$""")) + - message: If specified, the label key's prefix must be a DNS + subdomain not longer than 253 characters in total. + rule: self.all(key, key.split("/")[0].size() < 253) + parametersRef: + description: |- + ParametersRef is a reference to a resource that contains the configuration + parameters corresponding to the Gateway. This is optional if the + controller does not require any additional configuration. + + This follows the same semantics as GatewayClass's `parametersRef`, but on a per-Gateway basis + + The Gateway's GatewayClass may provide its own `parametersRef`. When both are specified, + the merging behavior is implementation specific. + It is generally recommended that GatewayClass provides defaults that can be overridden by a Gateway. + + Support: Implementation-specific + properties: + group: + description: Group is the group of the referent. + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + description: Kind is kind of the referent. + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: Name is the name of the referent. + maxLength: 253 + minLength: 1 + type: string + required: + - group + - kind + - name + type: object + type: object + listeners: + description: |- + Listeners associated with this Gateway. Listeners define + logical endpoints that are bound on this Gateway's addresses. + At least one Listener MUST be specified. + + Each Listener in a set of Listeners (for example, in a single Gateway) + MUST be _distinct_, in that a traffic flow MUST be able to be assigned to + exactly one listener. (This section uses "set of Listeners" rather than + "Listeners in a single Gateway" because implementations MAY merge configuration + from multiple Gateways onto a single data plane, and these rules _also_ + apply in that case). + + Practically, this means that each listener in a set MUST have a unique + combination of Port, Protocol, and, if supported by the protocol, Hostname. + + Some combinations of port, protocol, and TLS settings are considered + Core support and MUST be supported by implementations based on their + targeted conformance profile: + + HTTP Profile + + 1. HTTPRoute, Port: 80, Protocol: HTTP + 2. HTTPRoute, Port: 443, Protocol: HTTPS, TLS Mode: Terminate, TLS keypair provided + + TLS Profile + + 1. TLSRoute, Port: 443, Protocol: TLS, TLS Mode: Passthrough + + "Distinct" Listeners have the following property: + + The implementation can match inbound requests to a single distinct + Listener. When multiple Listeners share values for fields (for + example, two Listeners with the same Port value), the implementation + can match requests to only one of the Listeners using other + Listener fields. + + For example, the following Listener scenarios are distinct: + + 1. Multiple Listeners with the same Port that all use the "HTTP" + Protocol that all have unique Hostname values. + 2. Multiple Listeners with the same Port that use either the "HTTPS" or + "TLS" Protocol that all have unique Hostname values. + 3. A mixture of "TCP" and "UDP" Protocol Listeners, where no Listener + with the same Protocol has the same Port value. + + Some fields in the Listener struct have possible values that affect + whether the Listener is distinct. Hostname is particularly relevant + for HTTP or HTTPS protocols. + + When using the Hostname value to select between same-Port, same-Protocol + Listeners, the Hostname value must be different on each Listener for the + Listener to be distinct. + + When the Listeners are distinct based on Hostname, inbound request + hostnames MUST match from the most specific to least specific Hostname + values to choose the correct Listener and its associated set of Routes. + + Exact matches must be processed before wildcard matches, and wildcard + matches must be processed before fallback (empty Hostname value) + matches. For example, `"foo.example.com"` takes precedence over + `"*.example.com"`, and `"*.example.com"` takes precedence over `""`. + + Additionally, if there are multiple wildcard entries, more specific + wildcard entries must be processed before less specific wildcard entries. + For example, `"*.foo.example.com"` takes precedence over `"*.example.com"`. + The precise definition here is that the higher the number of dots in the + hostname to the right of the wildcard character, the higher the precedence. + + The wildcard character will match any number of characters _and dots_ to + the left, however, so `"*.example.com"` will match both + `"foo.bar.example.com"` _and_ `"bar.example.com"`. + + If a set of Listeners contains Listeners that are not distinct, then those + Listeners are Conflicted, and the implementation MUST set the "Conflicted" + condition in the Listener Status to "True". + + Implementations MAY choose to accept a Gateway with some Conflicted + Listeners only if they only accept the partial Listener set that contains + no Conflicted Listeners. To put this another way, implementations may + accept a partial Listener set only if they throw out *all* the conflicting + Listeners. No picking one of the conflicting listeners as the winner. + This also means that the Gateway must have at least one non-conflicting + Listener in this case, otherwise it violates the requirement that at + least one Listener must be present. + + The implementation MUST set a "ListenersNotValid" condition on the + Gateway Status when the Gateway contains Conflicted Listeners whether or + not they accept the Gateway. That Condition SHOULD clearly + indicate in the Message which Listeners are conflicted, and which are + Accepted. Additionally, the Listener status for those listeners SHOULD + indicate which Listeners are conflicted and not Accepted. + + A Gateway's Listeners are considered "compatible" if: + + 1. They are distinct. + 2. The implementation can serve them in compliance with the Addresses + requirement that all Listeners are available on all assigned + addresses. + + Compatible combinations in Extended support are expected to vary across + implementations. A combination that is compatible for one implementation + may not be compatible for another. + + For example, an implementation that cannot serve both TCP and UDP listeners + on the same address, or cannot mix HTTPS and generic TLS listens on the same port + would not consider those cases compatible, even though they are distinct. + + Note that requests SHOULD match at most one Listener. For example, if + Listeners are defined for "foo.example.com" and "*.example.com", a + request to "foo.example.com" SHOULD only be routed using routes attached + to the "foo.example.com" Listener (and not the "*.example.com" Listener). + This concept is known as "Listener Isolation". Implementations that do + not support Listener Isolation MUST clearly document this. + + Implementations MAY merge separate Gateways onto a single set of + Addresses if all Listeners across all Gateways are compatible. + + Support: Core + items: + description: |- + Listener embodies the concept of a logical endpoint where a Gateway accepts + network connections. + properties: + allowedRoutes: + default: + namespaces: + from: Same + description: |- + AllowedRoutes defines the types of routes that MAY be attached to a + Listener and the trusted namespaces where those Route resources MAY be + present. + + Although a client request may match multiple route rules, only one rule + may ultimately receive the request. Matching precedence MUST be + determined in order of the following criteria: + + * The most specific match as defined by the Route type. + * The oldest Route based on creation timestamp. For example, a Route with + a creation timestamp of "2020-09-08 01:02:03" is given precedence over + a Route with a creation timestamp of "2020-09-08 01:02:04". + * If everything else is equivalent, the Route appearing first in + alphabetical order (namespace/name) should be given precedence. For + example, foo/bar is given precedence over foo/baz. + + All valid rules within a Route attached to this Listener should be + implemented. Invalid Route rules can be ignored (sometimes that will mean + the full Route). If a Route rule transitions from valid to invalid, + support for that Route rule should be dropped to ensure consistency. For + example, even if a filter specified by a Route rule is invalid, the rest + of the rules within that Route should still be supported. + + Support: Core + properties: + kinds: + description: |- + Kinds specifies the groups and kinds of Routes that are allowed to bind + to this Gateway Listener. When unspecified or empty, the kinds of Routes + selected are determined using the Listener protocol. + + A RouteGroupKind MUST correspond to kinds of Routes that are compatible + with the application protocol specified in the Listener's Protocol field. + If an implementation does not support or recognize this resource type, it + MUST set the "ResolvedRefs" condition to False for this Listener with the + "InvalidRouteKinds" reason. + + Support: Core + items: + description: RouteGroupKind indicates the group and kind + of a Route resource. + properties: + group: + default: gateway.networking.k8s.io + description: Group is the group of the Route. + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + description: Kind is the kind of the Route. + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + required: + - kind + type: object + maxItems: 8 + type: array + namespaces: + default: + from: Same + description: |- + Namespaces indicates namespaces from which Routes may be attached to this + Listener. This is restricted to the namespace of this Gateway by default. + + Support: Core + properties: + from: + default: Same + description: |- + From indicates where Routes will be selected for this Gateway. Possible + values are: + + * All: Routes in all namespaces may be used by this Gateway. + * Selector: Routes in namespaces selected by the selector may be used by + this Gateway. + * Same: Only Routes in the same namespace may be used by this Gateway. + + Support: Core + enum: + - All + - Selector + - Same + type: string + selector: + description: |- + Selector must be specified when From is set to "Selector". In that case, + only Routes in Namespaces matching this Selector will be selected by this + Gateway. This field is ignored for other values of "From". + + Support: Core + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the + selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + type: object + type: object + hostname: + description: |- + Hostname specifies the virtual hostname to match for protocol types that + define this concept. When unspecified, all hostnames are matched. This + field is ignored for protocols that don't require hostname based + matching. + + Implementations MUST apply Hostname matching appropriately for each of + the following protocols: + + * TLS: The Listener Hostname MUST match the SNI. + * HTTP: The Listener Hostname MUST match the Host header of the request. + * HTTPS: The Listener Hostname SHOULD match at both the TLS and HTTP + protocol layers as described above. If an implementation does not + ensure that both the SNI and Host header match the Listener hostname, + it MUST clearly document that. + + For HTTPRoute and TLSRoute resources, there is an interaction with the + `spec.hostnames` array. When both listener and route specify hostnames, + there MUST be an intersection between the values for a Route to be + accepted. For more information, refer to the Route specific Hostnames + documentation. + + Hostnames that are prefixed with a wildcard label (`*.`) are interpreted + as a suffix match. That means that a match for `*.example.com` would match + both `test.example.com`, and `foo.test.example.com`, but not `example.com`. + + Support: Core + maxLength: 253 + minLength: 1 + pattern: ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + name: + description: |- + Name is the name of the Listener. This name MUST be unique within a + Gateway. + + Support: Core + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + port: + description: |- + Port is the network port. Multiple listeners may use the + same port, subject to the Listener compatibility rules. + + Support: Core + format: int32 + maximum: 65535 + minimum: 1 + type: integer + protocol: + description: |- + Protocol specifies the network protocol this listener expects to receive. + + Support: Core + maxLength: 255 + minLength: 1 + pattern: ^[a-zA-Z0-9]([-a-zA-Z0-9]*[a-zA-Z0-9])?$|[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9]+$ + type: string + tls: + description: |- + TLS is the TLS configuration for the Listener. This field is required if + the Protocol field is "HTTPS" or "TLS". It is invalid to set this field + if the Protocol field is "HTTP", "TCP", or "UDP". + + The association of SNIs to Certificate defined in GatewayTLSConfig is + defined based on the Hostname field for this listener. + + The GatewayClass MUST use the longest matching SNI out of all + available certificates for any TLS handshake. + + Support: Core + properties: + certificateRefs: + description: |- + CertificateRefs contains a series of references to Kubernetes objects that + contains TLS certificates and private keys. These certificates are used to + establish a TLS handshake for requests that match the hostname of the + associated listener. + + A single CertificateRef to a Kubernetes Secret has "Core" support. + Implementations MAY choose to support attaching multiple certificates to + a Listener, but this behavior is implementation-specific. + + References to a resource in different namespace are invalid UNLESS there + is a ReferenceGrant in the target namespace that allows the certificate + to be attached. If a ReferenceGrant does not allow this reference, the + "ResolvedRefs" condition MUST be set to False for this listener with the + "RefNotPermitted" reason. + + This field is required to have at least one element when the mode is set + to "Terminate" (default) and is optional otherwise. + + CertificateRefs can reference to standard Kubernetes resources, i.e. + Secret, or implementation-specific custom resources. + + Support: Core - A single reference to a Kubernetes Secret of type kubernetes.io/tls + + Support: Implementation-specific (More than one reference or other resource types) + items: + description: |- + SecretObjectReference identifies an API object including its namespace, + defaulting to Secret. + + The API object must be valid in the cluster; the Group and Kind must + be registered in the cluster for this reference to be valid. + + References to objects with invalid Group and Kind are not valid, and must + be rejected by the implementation, with appropriate Conditions set + on the containing object. + properties: + group: + default: "" + description: |- + Group is the group of the referent. For example, "gateway.networking.k8s.io". + When unspecified or empty string, core API group is inferred. + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + default: Secret + description: Kind is kind of the referent. For example + "Secret". + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: Name is the name of the referent. + maxLength: 253 + minLength: 1 + type: string + namespace: + description: |- + Namespace is the namespace of the referenced object. When unspecified, the local + namespace is inferred. + + Note that when a namespace different than the local namespace is specified, + a ReferenceGrant object is required in the referent namespace to allow that + namespace's owner to accept the reference. See the ReferenceGrant + documentation for details. + + Support: Core + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - name + type: object + maxItems: 64 + type: array + mode: + default: Terminate + description: |- + Mode defines the TLS behavior for the TLS session initiated by the client. + There are two possible modes: + + - Terminate: The TLS session between the downstream client and the + Gateway is terminated at the Gateway. This mode requires certificates + to be specified in some way, such as populating the certificateRefs + field. + - Passthrough: The TLS session is NOT terminated by the Gateway. This + implies that the Gateway can't decipher the TLS stream except for + the ClientHello message of the TLS protocol. The certificateRefs field + is ignored in this mode. + + Support: Core + enum: + - Terminate + - Passthrough + type: string + options: + additionalProperties: + description: |- + AnnotationValue is the value of an annotation in Gateway API. This is used + for validation of maps such as TLS options. This roughly matches Kubernetes + annotation validation, although the length validation in that case is based + on the entire size of the annotations struct. + maxLength: 4096 + minLength: 0 + type: string + description: |- + Options are a list of key/value pairs to enable extended TLS + configuration for each implementation. For example, configuring the + minimum TLS version or supported cipher suites. + + A set of common keys MAY be defined by the API in the future. To avoid + any ambiguity, implementation-specific definitions MUST use + domain-prefixed names, such as `example.com/my-custom-option`. + Un-prefixed names are reserved for key names defined by Gateway API. + + Support: Implementation-specific + maxProperties: 16 + type: object + type: object + x-kubernetes-validations: + - message: certificateRefs or options must be specified when + mode is Terminate + rule: 'self.mode == ''Terminate'' ? size(self.certificateRefs) + > 0 || size(self.options) > 0 : true' + required: + - name + - port + - protocol + type: object + maxItems: 64 + minItems: 1 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + x-kubernetes-validations: + - message: tls must not be specified for protocols ['HTTP', 'TCP', + 'UDP'] + rule: 'self.all(l, l.protocol in [''HTTP'', ''TCP'', ''UDP''] ? + !has(l.tls) : true)' + - message: tls mode must be Terminate for protocol HTTPS + rule: 'self.all(l, (l.protocol == ''HTTPS'' && has(l.tls)) ? (l.tls.mode + == '''' || l.tls.mode == ''Terminate'') : true)' + - message: hostname must not be specified for protocols ['TCP', 'UDP'] + rule: 'self.all(l, l.protocol in [''TCP'', ''UDP''] ? (!has(l.hostname) + || l.hostname == '''') : true)' + - message: Listener name must be unique within the Gateway + rule: self.all(l1, self.exists_one(l2, l1.name == l2.name)) + - message: Combination of port, protocol and hostname must be unique + for each listener + rule: 'self.all(l1, self.exists_one(l2, l1.port == l2.port && l1.protocol + == l2.protocol && (has(l1.hostname) && has(l2.hostname) ? l1.hostname + == l2.hostname : !has(l1.hostname) && !has(l2.hostname))))' + required: + - gatewayClassName + - listeners + type: object + status: + default: + conditions: + - lastTransitionTime: "1970-01-01T00:00:00Z" + message: Waiting for controller + reason: Pending + status: Unknown + type: Accepted + - lastTransitionTime: "1970-01-01T00:00:00Z" + message: Waiting for controller + reason: Pending + status: Unknown + type: Programmed + description: Status defines the current state of Gateway. + properties: + addresses: + description: |+ + Addresses lists the network addresses that have been bound to the + Gateway. + + This list may differ from the addresses provided in the spec under some + conditions: + + * no addresses are specified, all addresses are dynamically assigned + * a combination of specified and dynamic addresses are assigned + * a specified address was unusable (e.g. already in use) + + items: + description: GatewayStatusAddress describes a network address that + is bound to a Gateway. + oneOf: + - properties: + type: + enum: + - IPAddress + value: + anyOf: + - format: ipv4 + - format: ipv6 + - properties: + type: + not: + enum: + - IPAddress + properties: + type: + default: IPAddress + description: Type of the address. + maxLength: 253 + minLength: 1 + pattern: ^Hostname|IPAddress|NamedAddress|[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$ + type: string + value: + description: |- + Value of the address. The validity of the values will depend + on the type and support by the controller. + + Examples: `1.2.3.4`, `128::1`, `my-ip-address`. + maxLength: 253 + minLength: 1 + type: string + required: + - value + type: object + x-kubernetes-validations: + - message: Hostname value must only contain valid characters (matching + ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$) + rule: 'self.type == ''Hostname'' ? self.value.matches(r"""^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$"""): + true' + maxItems: 16 + type: array + conditions: + default: + - lastTransitionTime: "1970-01-01T00:00:00Z" + message: Waiting for controller + reason: Pending + status: Unknown + type: Accepted + - lastTransitionTime: "1970-01-01T00:00:00Z" + message: Waiting for controller + reason: Pending + status: Unknown + type: Programmed + description: |- + Conditions describe the current conditions of the Gateway. + + Implementations should prefer to express Gateway conditions + using the `GatewayConditionType` and `GatewayConditionReason` + constants so that operators and tools can converge on a common + vocabulary to describe Gateway state. + + Known condition types are: + + * "Accepted" + * "Programmed" + * "Ready" + items: + description: Condition contains details for one aspect of the current + state of this API Resource. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + maxItems: 8 + type: array + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + listeners: + description: Listeners provide status for each unique listener port + defined in the Spec. + items: + description: ListenerStatus is the status associated with a Listener. + properties: + attachedRoutes: + description: |- + AttachedRoutes represents the total number of Routes that have been + successfully attached to this Listener. + + Successful attachment of a Route to a Listener is based solely on the + combination of the AllowedRoutes field on the corresponding Listener + and the Route's ParentRefs field. A Route is successfully attached to + a Listener when it is selected by the Listener's AllowedRoutes field + AND the Route has a valid ParentRef selecting the whole Gateway + resource or a specific Listener as a parent resource (more detail on + attachment semantics can be found in the documentation on the various + Route kinds ParentRefs fields). Listener or Route status does not impact + successful attachment, i.e. the AttachedRoutes field count MUST be set + for Listeners with condition Accepted: false and MUST count successfully + attached Routes that may themselves have Accepted: false conditions. + + Uses for this field include troubleshooting Route attachment and + measuring blast radius/impact of changes to a Listener. + format: int32 + type: integer + conditions: + description: Conditions describe the current condition of this + listener. + items: + description: Condition contains details for one aspect of + the current state of this API Resource. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, + Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + maxItems: 8 + type: array + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + name: + description: Name is the name of the Listener that this status + corresponds to. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + supportedKinds: + description: |- + SupportedKinds is the list indicating the Kinds supported by this + listener. This MUST represent the kinds an implementation supports for + that Listener configuration. + + If kinds are specified in Spec that are not supported, they MUST NOT + appear in this list and an implementation MUST set the "ResolvedRefs" + condition to "False" with the "InvalidRouteKinds" reason. If both valid + and invalid Route kinds are specified, the implementation MUST + reference the valid Route kinds that have been specified. + items: + description: RouteGroupKind indicates the group and kind of + a Route resource. + properties: + group: + default: gateway.networking.k8s.io + description: Group is the group of the Route. + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + description: Kind is the kind of the Route. + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + required: + - kind + type: object + maxItems: 8 + type: array + required: + - attachedRoutes + - conditions + - name + - supportedKinds + type: object + maxItems: 64 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + type: object + required: + - spec + type: object + served: true + storage: false + subresources: + status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: null + storedVersions: null +--- +# +# config/crd/standard/gateway.networking.k8s.io_grpcroutes.yaml +# +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328 + gateway.networking.k8s.io/bundle-version: v1.2.1 + gateway.networking.k8s.io/channel: standard + creationTimestamp: null + name: grpcroutes.gateway.networking.k8s.io +spec: + group: gateway.networking.k8s.io + names: + categories: + - gateway-api + kind: GRPCRoute + listKind: GRPCRouteList + plural: grpcroutes + singular: grpcroute + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .spec.hostnames + name: Hostnames + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1 + schema: + openAPIV3Schema: + description: |- + GRPCRoute provides a way to route gRPC requests. This includes the capability + to match requests by hostname, gRPC service, gRPC method, or HTTP/2 header. + Filters can be used to specify additional processing steps. Backends specify + where matching requests will be routed. + + GRPCRoute falls under extended support within the Gateway API. Within the + following specification, the word "MUST" indicates that an implementation + supporting GRPCRoute must conform to the indicated requirement, but an + implementation not supporting this route type need not follow the requirement + unless explicitly indicated. + + Implementations supporting `GRPCRoute` with the `HTTPS` `ProtocolType` MUST + accept HTTP/2 connections without an initial upgrade from HTTP/1.1, i.e. via + ALPN. If the implementation does not support this, then it MUST set the + "Accepted" condition to "False" for the affected listener with a reason of + "UnsupportedProtocol". Implementations MAY also accept HTTP/2 connections + with an upgrade from HTTP/1. + + Implementations supporting `GRPCRoute` with the `HTTP` `ProtocolType` MUST + support HTTP/2 over cleartext TCP (h2c, + https://www.rfc-editor.org/rfc/rfc7540#section-3.1) without an initial + upgrade from HTTP/1.1, i.e. with prior knowledge + (https://www.rfc-editor.org/rfc/rfc7540#section-3.4). If the implementation + does not support this, then it MUST set the "Accepted" condition to "False" + for the affected listener with a reason of "UnsupportedProtocol". + Implementations MAY also accept HTTP/2 connections with an upgrade from + HTTP/1, i.e. without prior knowledge. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: Spec defines the desired state of GRPCRoute. + properties: + hostnames: + description: |- + Hostnames defines a set of hostnames to match against the GRPC + Host header to select a GRPCRoute to process the request. This matches + the RFC 1123 definition of a hostname with 2 notable exceptions: + + 1. IPs are not allowed. + 2. A hostname may be prefixed with a wildcard label (`*.`). The wildcard + label MUST appear by itself as the first label. + + If a hostname is specified by both the Listener and GRPCRoute, there + MUST be at least one intersecting hostname for the GRPCRoute to be + attached to the Listener. For example: + + * A Listener with `test.example.com` as the hostname matches GRPCRoutes + that have either not specified any hostnames, or have specified at + least one of `test.example.com` or `*.example.com`. + * A Listener with `*.example.com` as the hostname matches GRPCRoutes + that have either not specified any hostnames or have specified at least + one hostname that matches the Listener hostname. For example, + `test.example.com` and `*.example.com` would both match. On the other + hand, `example.com` and `test.example.net` would not match. + + Hostnames that are prefixed with a wildcard label (`*.`) are interpreted + as a suffix match. That means that a match for `*.example.com` would match + both `test.example.com`, and `foo.test.example.com`, but not `example.com`. + + If both the Listener and GRPCRoute have specified hostnames, any + GRPCRoute hostnames that do not match the Listener hostname MUST be + ignored. For example, if a Listener specified `*.example.com`, and the + GRPCRoute specified `test.example.com` and `test.example.net`, + `test.example.net` MUST NOT be considered for a match. + + If both the Listener and GRPCRoute have specified hostnames, and none + match with the criteria above, then the GRPCRoute MUST NOT be accepted by + the implementation. The implementation MUST raise an 'Accepted' Condition + with a status of `False` in the corresponding RouteParentStatus. + + If a Route (A) of type HTTPRoute or GRPCRoute is attached to a + Listener and that listener already has another Route (B) of the other + type attached and the intersection of the hostnames of A and B is + non-empty, then the implementation MUST accept exactly one of these two + routes, determined by the following criteria, in order: + + * The oldest Route based on creation timestamp. + * The Route appearing first in alphabetical order by + "{namespace}/{name}". + + The rejected Route MUST raise an 'Accepted' condition with a status of + 'False' in the corresponding RouteParentStatus. + + Support: Core + items: + description: |- + Hostname is the fully qualified domain name of a network host. This matches + the RFC 1123 definition of a hostname with 2 notable exceptions: + + 1. IPs are not allowed. + 2. A hostname may be prefixed with a wildcard label (`*.`). The wildcard + label must appear by itself as the first label. + + Hostname can be "precise" which is a domain name without the terminating + dot of a network host (e.g. "foo.example.com") or "wildcard", which is a + domain name prefixed with a single wildcard label (e.g. `*.example.com`). + + Note that as per RFC1035 and RFC1123, a *label* must consist of lower case + alphanumeric characters or '-', and must start and end with an alphanumeric + character. No other punctuation is allowed. + maxLength: 253 + minLength: 1 + pattern: ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + maxItems: 16 + type: array + parentRefs: + description: |+ + ParentRefs references the resources (usually Gateways) that a Route wants + to be attached to. Note that the referenced parent resource needs to + allow this for the attachment to be complete. For Gateways, that means + the Gateway needs to allow attachment from Routes of this kind and + namespace. For Services, that means the Service must either be in the same + namespace for a "producer" route, or the mesh implementation must support + and allow "consumer" routes for the referenced Service. ReferenceGrant is + not applicable for governing ParentRefs to Services - it is not possible to + create a "producer" route for a Service in a different namespace from the + Route. + + There are two kinds of parent resources with "Core" support: + + * Gateway (Gateway conformance profile) + * Service (Mesh conformance profile, ClusterIP Services only) + + This API may be extended in the future to support additional kinds of parent + resources. + + ParentRefs must be _distinct_. This means either that: + + * They select different objects. If this is the case, then parentRef + entries are distinct. In terms of fields, this means that the + multi-part key defined by `group`, `kind`, `namespace`, and `name` must + be unique across all parentRef entries in the Route. + * They do not select different objects, but for each optional field used, + each ParentRef that selects the same object must set the same set of + optional fields to different values. If one ParentRef sets a + combination of optional fields, all must set the same combination. + + Some examples: + + * If one ParentRef sets `sectionName`, all ParentRefs referencing the + same object must also set `sectionName`. + * If one ParentRef sets `port`, all ParentRefs referencing the same + object must also set `port`. + * If one ParentRef sets `sectionName` and `port`, all ParentRefs + referencing the same object must also set `sectionName` and `port`. + + It is possible to separately reference multiple distinct objects that may + be collapsed by an implementation. For example, some implementations may + choose to merge compatible Gateway Listeners together. If that is the + case, the list of routes attached to those resources should also be + merged. + + Note that for ParentRefs that cross namespace boundaries, there are specific + rules. Cross-namespace references are only valid if they are explicitly + allowed by something in the namespace they are referring to. For example, + Gateway has the AllowedRoutes field, and ReferenceGrant provides a + generic way to enable other kinds of cross-namespace reference. + + + + + + + items: + description: |- + ParentReference identifies an API object (usually a Gateway) that can be considered + a parent of this resource (usually a route). There are two kinds of parent resources + with "Core" support: + + * Gateway (Gateway conformance profile) + * Service (Mesh conformance profile, ClusterIP Services only) + + This API may be extended in the future to support additional kinds of parent + resources. + + The API object must be valid in the cluster; the Group and Kind must + be registered in the cluster for this reference to be valid. + properties: + group: + default: gateway.networking.k8s.io + description: |- + Group is the group of the referent. + When unspecified, "gateway.networking.k8s.io" is inferred. + To set the core API group (such as for a "Service" kind referent), + Group must be explicitly set to "" (empty string). + + Support: Core + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + default: Gateway + description: |- + Kind is kind of the referent. + + There are two kinds of parent resources with "Core" support: + + * Gateway (Gateway conformance profile) + * Service (Mesh conformance profile, ClusterIP Services only) + + Support for other resources is Implementation-Specific. + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: |- + Name is the name of the referent. + + Support: Core + maxLength: 253 + minLength: 1 + type: string + namespace: + description: |- + Namespace is the namespace of the referent. When unspecified, this refers + to the local namespace of the Route. + + Note that there are specific rules for ParentRefs which cross namespace + boundaries. Cross-namespace references are only valid if they are explicitly + allowed by something in the namespace they are referring to. For example: + Gateway has the AllowedRoutes field, and ReferenceGrant provides a + generic way to enable any other kind of cross-namespace reference. + + + + Support: Core + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + port: + description: |- + Port is the network port this Route targets. It can be interpreted + differently based on the type of parent resource. + + When the parent resource is a Gateway, this targets all listeners + listening on the specified port that also support this kind of Route(and + select this Route). It's not recommended to set `Port` unless the + networking behaviors specified in a Route must apply to a specific port + as opposed to a listener(s) whose port(s) may be changed. When both Port + and SectionName are specified, the name and port of the selected listener + must match both specified values. + + + + Implementations MAY choose to support other parent resources. + Implementations supporting other types of parent resources MUST clearly + document how/if Port is interpreted. + + For the purpose of status, an attachment is considered successful as + long as the parent resource accepts it partially. For example, Gateway + listeners can restrict which Routes can attach to them by Route kind, + namespace, or hostname. If 1 of 2 Gateway listeners accept attachment + from the referencing Route, the Route MUST be considered successfully + attached. If no Gateway listeners accept attachment from this Route, + the Route MUST be considered detached from the Gateway. + + Support: Extended + format: int32 + maximum: 65535 + minimum: 1 + type: integer + sectionName: + description: |- + SectionName is the name of a section within the target resource. In the + following resources, SectionName is interpreted as the following: + + * Gateway: Listener name. When both Port (experimental) and SectionName + are specified, the name and port of the selected listener must match + both specified values. + * Service: Port name. When both Port (experimental) and SectionName + are specified, the name and port of the selected listener must match + both specified values. + + Implementations MAY choose to support attaching Routes to other resources. + If that is the case, they MUST clearly document how SectionName is + interpreted. + + When unspecified (empty string), this will reference the entire resource. + For the purpose of status, an attachment is considered successful if at + least one section in the parent resource accepts it. For example, Gateway + listeners can restrict which Routes can attach to them by Route kind, + namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from + the referencing Route, the Route MUST be considered successfully + attached. If no Gateway listeners accept attachment from this Route, the + Route MUST be considered detached from the Gateway. + + Support: Core + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + required: + - name + type: object + maxItems: 32 + type: array + x-kubernetes-validations: + - message: sectionName must be specified when parentRefs includes + 2 or more references to the same parent + rule: 'self.all(p1, self.all(p2, p1.group == p2.group && p1.kind + == p2.kind && p1.name == p2.name && (((!has(p1.__namespace__) + || p1.__namespace__ == '''') && (!has(p2.__namespace__) || p2.__namespace__ + == '''')) || (has(p1.__namespace__) && has(p2.__namespace__) && + p1.__namespace__ == p2.__namespace__ )) ? ((!has(p1.sectionName) + || p1.sectionName == '''') == (!has(p2.sectionName) || p2.sectionName + == '''')) : true))' + - message: sectionName must be unique when parentRefs includes 2 or + more references to the same parent + rule: self.all(p1, self.exists_one(p2, p1.group == p2.group && p1.kind + == p2.kind && p1.name == p2.name && (((!has(p1.__namespace__) + || p1.__namespace__ == '') && (!has(p2.__namespace__) || p2.__namespace__ + == '')) || (has(p1.__namespace__) && has(p2.__namespace__) && + p1.__namespace__ == p2.__namespace__ )) && (((!has(p1.sectionName) + || p1.sectionName == '') && (!has(p2.sectionName) || p2.sectionName + == '')) || (has(p1.sectionName) && has(p2.sectionName) && p1.sectionName + == p2.sectionName)))) + rules: + description: |+ + Rules are a list of GRPC matchers, filters and actions. + + items: + description: |- + GRPCRouteRule defines the semantics for matching a gRPC request based on + conditions (matches), processing it (filters), and forwarding the request to + an API object (backendRefs). + properties: + backendRefs: + description: |- + BackendRefs defines the backend(s) where matching requests should be + sent. + + Failure behavior here depends on how many BackendRefs are specified and + how many are invalid. + + If *all* entries in BackendRefs are invalid, and there are also no filters + specified in this route rule, *all* traffic which matches this rule MUST + receive an `UNAVAILABLE` status. + + See the GRPCBackendRef definition for the rules about what makes a single + GRPCBackendRef invalid. + + When a GRPCBackendRef is invalid, `UNAVAILABLE` statuses MUST be returned for + requests that would have otherwise been routed to an invalid backend. If + multiple backends are specified, and some are invalid, the proportion of + requests that would otherwise have been routed to an invalid backend + MUST receive an `UNAVAILABLE` status. + + For example, if two backends are specified with equal weights, and one is + invalid, 50 percent of traffic MUST receive an `UNAVAILABLE` status. + Implementations may choose how that 50 percent is determined. + + Support: Core for Kubernetes Service + + Support: Implementation-specific for any other resource + + Support for weight: Core + items: + description: |- + GRPCBackendRef defines how a GRPCRoute forwards a gRPC request. + + Note that when a namespace different than the local namespace is specified, a + ReferenceGrant object is required in the referent namespace to allow that + namespace's owner to accept the reference. See the ReferenceGrant + documentation for details. + + + + When the BackendRef points to a Kubernetes Service, implementations SHOULD + honor the appProtocol field if it is set for the target Service Port. + + Implementations supporting appProtocol SHOULD recognize the Kubernetes + Standard Application Protocols defined in KEP-3726. + + If a Service appProtocol isn't specified, an implementation MAY infer the + backend protocol through its own means. Implementations MAY infer the + protocol from the Route type referring to the backend Service. + + If a Route is not able to send traffic to the backend using the specified + protocol then the backend is considered invalid. Implementations MUST set the + "ResolvedRefs" condition to "False" with the "UnsupportedProtocol" reason. + + + properties: + filters: + description: |- + Filters defined at this level MUST be executed if and only if the + request is being forwarded to the backend defined here. + + Support: Implementation-specific (For broader support of filters, use the + Filters field in GRPCRouteRule.) + items: + description: |- + GRPCRouteFilter defines processing steps that must be completed during the + request or response lifecycle. GRPCRouteFilters are meant as an extension + point to express processing that may be done in Gateway implementations. Some + examples include request or response modification, implementing + authentication strategies, rate-limiting, and traffic shaping. API + guarantee/conformance is defined based on the type of the filter. + properties: + extensionRef: + description: |- + ExtensionRef is an optional, implementation-specific extension to the + "filter" behavior. For example, resource "myroutefilter" in group + "networking.example.net"). ExtensionRef MUST NOT be used for core and + extended filters. + + Support: Implementation-specific + + This filter can be used multiple times within the same rule. + properties: + group: + description: |- + Group is the group of the referent. For example, "gateway.networking.k8s.io". + When unspecified or empty string, core API group is inferred. + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + description: Kind is kind of the referent. For + example "HTTPRoute" or "Service". + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: Name is the name of the referent. + maxLength: 253 + minLength: 1 + type: string + required: + - group + - kind + - name + type: object + requestHeaderModifier: + description: |- + RequestHeaderModifier defines a schema for a filter that modifies request + headers. + + Support: Core + properties: + add: + description: |- + Add adds the given header(s) (name, value) to the request + before the action. It appends to any existing values associated + with the header name. + + Input: + GET /foo HTTP/1.1 + my-header: foo + + Config: + add: + - name: "my-header" + value: "bar,baz" + + Output: + GET /foo HTTP/1.1 + my-header: foo,bar,baz + items: + description: HTTPHeader represents an HTTP + Header name and value as defined by RFC + 7230. + properties: + name: + description: |- + Name is the name of the HTTP Header to be matched. Name matching MUST be + case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). + + If multiple entries specify equivalent header names, the first entry with + an equivalent name MUST be considered for a match. Subsequent entries + with an equivalent header name MUST be ignored. Due to the + case-insensitivity of header names, "foo" and "Foo" are considered + equivalent. + maxLength: 256 + minLength: 1 + pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ + type: string + value: + description: Value is the value of HTTP + Header to be matched. + maxLength: 4096 + minLength: 1 + type: string + required: + - name + - value + type: object + maxItems: 16 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + remove: + description: |- + Remove the given header(s) from the HTTP request before the action. The + value of Remove is a list of HTTP header names. Note that the header + names are case-insensitive (see + https://datatracker.ietf.org/doc/html/rfc2616#section-4.2). + + Input: + GET /foo HTTP/1.1 + my-header1: foo + my-header2: bar + my-header3: baz + + Config: + remove: ["my-header1", "my-header3"] + + Output: + GET /foo HTTP/1.1 + my-header2: bar + items: + type: string + maxItems: 16 + type: array + x-kubernetes-list-type: set + set: + description: |- + Set overwrites the request with the given header (name, value) + before the action. + + Input: + GET /foo HTTP/1.1 + my-header: foo + + Config: + set: + - name: "my-header" + value: "bar" + + Output: + GET /foo HTTP/1.1 + my-header: bar + items: + description: HTTPHeader represents an HTTP + Header name and value as defined by RFC + 7230. + properties: + name: + description: |- + Name is the name of the HTTP Header to be matched. Name matching MUST be + case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). + + If multiple entries specify equivalent header names, the first entry with + an equivalent name MUST be considered for a match. Subsequent entries + with an equivalent header name MUST be ignored. Due to the + case-insensitivity of header names, "foo" and "Foo" are considered + equivalent. + maxLength: 256 + minLength: 1 + pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ + type: string + value: + description: Value is the value of HTTP + Header to be matched. + maxLength: 4096 + minLength: 1 + type: string + required: + - name + - value + type: object + maxItems: 16 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + type: object + requestMirror: + description: |+ + RequestMirror defines a schema for a filter that mirrors requests. + Requests are sent to the specified destination, but responses from + that destination are ignored. + + This filter can be used multiple times within the same rule. Note that + not all implementations will be able to support mirroring to multiple + backends. + + Support: Extended + + properties: + backendRef: + description: |- + BackendRef references a resource where mirrored requests are sent. + + Mirrored requests must be sent only to a single destination endpoint + within this BackendRef, irrespective of how many endpoints are present + within this BackendRef. + + If the referent cannot be found, this BackendRef is invalid and must be + dropped from the Gateway. The controller must ensure the "ResolvedRefs" + condition on the Route status is set to `status: False` and not configure + this backend in the underlying implementation. + + If there is a cross-namespace reference to an *existing* object + that is not allowed by a ReferenceGrant, the controller must ensure the + "ResolvedRefs" condition on the Route is set to `status: False`, + with the "RefNotPermitted" reason and not configure this backend in the + underlying implementation. + + In either error case, the Message of the `ResolvedRefs` Condition + should be used to provide more detail about the problem. + + Support: Extended for Kubernetes Service + + Support: Implementation-specific for any other resource + properties: + group: + default: "" + description: |- + Group is the group of the referent. For example, "gateway.networking.k8s.io". + When unspecified or empty string, core API group is inferred. + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + default: Service + description: |- + Kind is the Kubernetes resource kind of the referent. For example + "Service". + + Defaults to "Service" when not specified. + + ExternalName services can refer to CNAME DNS records that may live + outside of the cluster and as such are difficult to reason about in + terms of conformance. They also may not be safe to forward to (see + CVE-2021-25740 for more information). Implementations SHOULD NOT + support ExternalName Services. + + Support: Core (Services with a type other than ExternalName) + + Support: Implementation-specific (Services with type ExternalName) + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: Name is the name of the referent. + maxLength: 253 + minLength: 1 + type: string + namespace: + description: |- + Namespace is the namespace of the backend. When unspecified, the local + namespace is inferred. + + Note that when a namespace different than the local namespace is specified, + a ReferenceGrant object is required in the referent namespace to allow that + namespace's owner to accept the reference. See the ReferenceGrant + documentation for details. + + Support: Core + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + port: + description: |- + Port specifies the destination port number to use for this resource. + Port is required when the referent is a Kubernetes Service. In this + case, the port number is the service port number, not the target port. + For other resources, destination port might be derived from the referent + resource or this field. + format: int32 + maximum: 65535 + minimum: 1 + type: integer + required: + - name + type: object + x-kubernetes-validations: + - message: Must have port for Service reference + rule: '(size(self.group) == 0 && self.kind + == ''Service'') ? has(self.port) : true' + required: + - backendRef + type: object + responseHeaderModifier: + description: |- + ResponseHeaderModifier defines a schema for a filter that modifies response + headers. + + Support: Extended + properties: + add: + description: |- + Add adds the given header(s) (name, value) to the request + before the action. It appends to any existing values associated + with the header name. + + Input: + GET /foo HTTP/1.1 + my-header: foo + + Config: + add: + - name: "my-header" + value: "bar,baz" + + Output: + GET /foo HTTP/1.1 + my-header: foo,bar,baz + items: + description: HTTPHeader represents an HTTP + Header name and value as defined by RFC + 7230. + properties: + name: + description: |- + Name is the name of the HTTP Header to be matched. Name matching MUST be + case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). + + If multiple entries specify equivalent header names, the first entry with + an equivalent name MUST be considered for a match. Subsequent entries + with an equivalent header name MUST be ignored. Due to the + case-insensitivity of header names, "foo" and "Foo" are considered + equivalent. + maxLength: 256 + minLength: 1 + pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ + type: string + value: + description: Value is the value of HTTP + Header to be matched. + maxLength: 4096 + minLength: 1 + type: string + required: + - name + - value + type: object + maxItems: 16 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + remove: + description: |- + Remove the given header(s) from the HTTP request before the action. The + value of Remove is a list of HTTP header names. Note that the header + names are case-insensitive (see + https://datatracker.ietf.org/doc/html/rfc2616#section-4.2). + + Input: + GET /foo HTTP/1.1 + my-header1: foo + my-header2: bar + my-header3: baz + + Config: + remove: ["my-header1", "my-header3"] + + Output: + GET /foo HTTP/1.1 + my-header2: bar + items: + type: string + maxItems: 16 + type: array + x-kubernetes-list-type: set + set: + description: |- + Set overwrites the request with the given header (name, value) + before the action. + + Input: + GET /foo HTTP/1.1 + my-header: foo + + Config: + set: + - name: "my-header" + value: "bar" + + Output: + GET /foo HTTP/1.1 + my-header: bar + items: + description: HTTPHeader represents an HTTP + Header name and value as defined by RFC + 7230. + properties: + name: + description: |- + Name is the name of the HTTP Header to be matched. Name matching MUST be + case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). + + If multiple entries specify equivalent header names, the first entry with + an equivalent name MUST be considered for a match. Subsequent entries + with an equivalent header name MUST be ignored. Due to the + case-insensitivity of header names, "foo" and "Foo" are considered + equivalent. + maxLength: 256 + minLength: 1 + pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ + type: string + value: + description: Value is the value of HTTP + Header to be matched. + maxLength: 4096 + minLength: 1 + type: string + required: + - name + - value + type: object + maxItems: 16 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + type: object + type: + description: |+ + Type identifies the type of filter to apply. As with other API fields, + types are classified into three conformance levels: + + - Core: Filter types and their corresponding configuration defined by + "Support: Core" in this package, e.g. "RequestHeaderModifier". All + implementations supporting GRPCRoute MUST support core filters. + + - Extended: Filter types and their corresponding configuration defined by + "Support: Extended" in this package, e.g. "RequestMirror". Implementers + are encouraged to support extended filters. + + - Implementation-specific: Filters that are defined and supported by specific vendors. + In the future, filters showing convergence in behavior across multiple + implementations will be considered for inclusion in extended or core + conformance levels. Filter-specific configuration for such filters + is specified using the ExtensionRef field. `Type` MUST be set to + "ExtensionRef" for custom filters. + + Implementers are encouraged to define custom implementation types to + extend the core API with implementation-specific behavior. + + If a reference to a custom filter type cannot be resolved, the filter + MUST NOT be skipped. Instead, requests that would have been processed by + that filter MUST receive a HTTP error response. + + enum: + - ResponseHeaderModifier + - RequestHeaderModifier + - RequestMirror + - ExtensionRef + type: string + required: + - type + type: object + x-kubernetes-validations: + - message: filter.requestHeaderModifier must be nil + if the filter.type is not RequestHeaderModifier + rule: '!(has(self.requestHeaderModifier) && self.type + != ''RequestHeaderModifier'')' + - message: filter.requestHeaderModifier must be specified + for RequestHeaderModifier filter.type + rule: '!(!has(self.requestHeaderModifier) && self.type + == ''RequestHeaderModifier'')' + - message: filter.responseHeaderModifier must be nil + if the filter.type is not ResponseHeaderModifier + rule: '!(has(self.responseHeaderModifier) && self.type + != ''ResponseHeaderModifier'')' + - message: filter.responseHeaderModifier must be specified + for ResponseHeaderModifier filter.type + rule: '!(!has(self.responseHeaderModifier) && self.type + == ''ResponseHeaderModifier'')' + - message: filter.requestMirror must be nil if the filter.type + is not RequestMirror + rule: '!(has(self.requestMirror) && self.type != ''RequestMirror'')' + - message: filter.requestMirror must be specified for + RequestMirror filter.type + rule: '!(!has(self.requestMirror) && self.type == + ''RequestMirror'')' + - message: filter.extensionRef must be nil if the filter.type + is not ExtensionRef + rule: '!(has(self.extensionRef) && self.type != ''ExtensionRef'')' + - message: filter.extensionRef must be specified for + ExtensionRef filter.type + rule: '!(!has(self.extensionRef) && self.type == ''ExtensionRef'')' + maxItems: 16 + type: array + x-kubernetes-validations: + - message: RequestHeaderModifier filter cannot be repeated + rule: self.filter(f, f.type == 'RequestHeaderModifier').size() + <= 1 + - message: ResponseHeaderModifier filter cannot be repeated + rule: self.filter(f, f.type == 'ResponseHeaderModifier').size() + <= 1 + group: + default: "" + description: |- + Group is the group of the referent. For example, "gateway.networking.k8s.io". + When unspecified or empty string, core API group is inferred. + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + default: Service + description: |- + Kind is the Kubernetes resource kind of the referent. For example + "Service". + + Defaults to "Service" when not specified. + + ExternalName services can refer to CNAME DNS records that may live + outside of the cluster and as such are difficult to reason about in + terms of conformance. They also may not be safe to forward to (see + CVE-2021-25740 for more information). Implementations SHOULD NOT + support ExternalName Services. + + Support: Core (Services with a type other than ExternalName) + + Support: Implementation-specific (Services with type ExternalName) + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: Name is the name of the referent. + maxLength: 253 + minLength: 1 + type: string + namespace: + description: |- + Namespace is the namespace of the backend. When unspecified, the local + namespace is inferred. + + Note that when a namespace different than the local namespace is specified, + a ReferenceGrant object is required in the referent namespace to allow that + namespace's owner to accept the reference. See the ReferenceGrant + documentation for details. + + Support: Core + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + port: + description: |- + Port specifies the destination port number to use for this resource. + Port is required when the referent is a Kubernetes Service. In this + case, the port number is the service port number, not the target port. + For other resources, destination port might be derived from the referent + resource or this field. + format: int32 + maximum: 65535 + minimum: 1 + type: integer + weight: + default: 1 + description: |- + Weight specifies the proportion of requests forwarded to the referenced + backend. This is computed as weight/(sum of all weights in this + BackendRefs list). For non-zero values, there may be some epsilon from + the exact proportion defined here depending on the precision an + implementation supports. Weight is not a percentage and the sum of + weights does not need to equal 100. + + If only one backend is specified and it has a weight greater than 0, 100% + of the traffic is forwarded to that backend. If weight is set to 0, no + traffic should be forwarded for this entry. If unspecified, weight + defaults to 1. + + Support for this field varies based on the context where used. + format: int32 + maximum: 1000000 + minimum: 0 + type: integer + required: + - name + type: object + x-kubernetes-validations: + - message: Must have port for Service reference + rule: '(size(self.group) == 0 && self.kind == ''Service'') + ? has(self.port) : true' + maxItems: 16 + type: array + filters: + description: |- + Filters define the filters that are applied to requests that match + this rule. + + The effects of ordering of multiple behaviors are currently unspecified. + This can change in the future based on feedback during the alpha stage. + + Conformance-levels at this level are defined based on the type of filter: + + - ALL core filters MUST be supported by all implementations that support + GRPCRoute. + - Implementers are encouraged to support extended filters. + - Implementation-specific custom filters have no API guarantees across + implementations. + + Specifying the same filter multiple times is not supported unless explicitly + indicated in the filter. + + If an implementation can not support a combination of filters, it must clearly + document that limitation. In cases where incompatible or unsupported + filters are specified and cause the `Accepted` condition to be set to status + `False`, implementations may use the `IncompatibleFilters` reason to specify + this configuration error. + + Support: Core + items: + description: |- + GRPCRouteFilter defines processing steps that must be completed during the + request or response lifecycle. GRPCRouteFilters are meant as an extension + point to express processing that may be done in Gateway implementations. Some + examples include request or response modification, implementing + authentication strategies, rate-limiting, and traffic shaping. API + guarantee/conformance is defined based on the type of the filter. + properties: + extensionRef: + description: |- + ExtensionRef is an optional, implementation-specific extension to the + "filter" behavior. For example, resource "myroutefilter" in group + "networking.example.net"). ExtensionRef MUST NOT be used for core and + extended filters. + + Support: Implementation-specific + + This filter can be used multiple times within the same rule. + properties: + group: + description: |- + Group is the group of the referent. For example, "gateway.networking.k8s.io". + When unspecified or empty string, core API group is inferred. + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + description: Kind is kind of the referent. For example + "HTTPRoute" or "Service". + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: Name is the name of the referent. + maxLength: 253 + minLength: 1 + type: string + required: + - group + - kind + - name + type: object + requestHeaderModifier: + description: |- + RequestHeaderModifier defines a schema for a filter that modifies request + headers. + + Support: Core + properties: + add: + description: |- + Add adds the given header(s) (name, value) to the request + before the action. It appends to any existing values associated + with the header name. + + Input: + GET /foo HTTP/1.1 + my-header: foo + + Config: + add: + - name: "my-header" + value: "bar,baz" + + Output: + GET /foo HTTP/1.1 + my-header: foo,bar,baz + items: + description: HTTPHeader represents an HTTP Header + name and value as defined by RFC 7230. + properties: + name: + description: |- + Name is the name of the HTTP Header to be matched. Name matching MUST be + case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). + + If multiple entries specify equivalent header names, the first entry with + an equivalent name MUST be considered for a match. Subsequent entries + with an equivalent header name MUST be ignored. Due to the + case-insensitivity of header names, "foo" and "Foo" are considered + equivalent. + maxLength: 256 + minLength: 1 + pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ + type: string + value: + description: Value is the value of HTTP Header + to be matched. + maxLength: 4096 + minLength: 1 + type: string + required: + - name + - value + type: object + maxItems: 16 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + remove: + description: |- + Remove the given header(s) from the HTTP request before the action. The + value of Remove is a list of HTTP header names. Note that the header + names are case-insensitive (see + https://datatracker.ietf.org/doc/html/rfc2616#section-4.2). + + Input: + GET /foo HTTP/1.1 + my-header1: foo + my-header2: bar + my-header3: baz + + Config: + remove: ["my-header1", "my-header3"] + + Output: + GET /foo HTTP/1.1 + my-header2: bar + items: + type: string + maxItems: 16 + type: array + x-kubernetes-list-type: set + set: + description: |- + Set overwrites the request with the given header (name, value) + before the action. + + Input: + GET /foo HTTP/1.1 + my-header: foo + + Config: + set: + - name: "my-header" + value: "bar" + + Output: + GET /foo HTTP/1.1 + my-header: bar + items: + description: HTTPHeader represents an HTTP Header + name and value as defined by RFC 7230. + properties: + name: + description: |- + Name is the name of the HTTP Header to be matched. Name matching MUST be + case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). + + If multiple entries specify equivalent header names, the first entry with + an equivalent name MUST be considered for a match. Subsequent entries + with an equivalent header name MUST be ignored. Due to the + case-insensitivity of header names, "foo" and "Foo" are considered + equivalent. + maxLength: 256 + minLength: 1 + pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ + type: string + value: + description: Value is the value of HTTP Header + to be matched. + maxLength: 4096 + minLength: 1 + type: string + required: + - name + - value + type: object + maxItems: 16 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + type: object + requestMirror: + description: |+ + RequestMirror defines a schema for a filter that mirrors requests. + Requests are sent to the specified destination, but responses from + that destination are ignored. + + This filter can be used multiple times within the same rule. Note that + not all implementations will be able to support mirroring to multiple + backends. + + Support: Extended + + properties: + backendRef: + description: |- + BackendRef references a resource where mirrored requests are sent. + + Mirrored requests must be sent only to a single destination endpoint + within this BackendRef, irrespective of how many endpoints are present + within this BackendRef. + + If the referent cannot be found, this BackendRef is invalid and must be + dropped from the Gateway. The controller must ensure the "ResolvedRefs" + condition on the Route status is set to `status: False` and not configure + this backend in the underlying implementation. + + If there is a cross-namespace reference to an *existing* object + that is not allowed by a ReferenceGrant, the controller must ensure the + "ResolvedRefs" condition on the Route is set to `status: False`, + with the "RefNotPermitted" reason and not configure this backend in the + underlying implementation. + + In either error case, the Message of the `ResolvedRefs` Condition + should be used to provide more detail about the problem. + + Support: Extended for Kubernetes Service + + Support: Implementation-specific for any other resource + properties: + group: + default: "" + description: |- + Group is the group of the referent. For example, "gateway.networking.k8s.io". + When unspecified or empty string, core API group is inferred. + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + default: Service + description: |- + Kind is the Kubernetes resource kind of the referent. For example + "Service". + + Defaults to "Service" when not specified. + + ExternalName services can refer to CNAME DNS records that may live + outside of the cluster and as such are difficult to reason about in + terms of conformance. They also may not be safe to forward to (see + CVE-2021-25740 for more information). Implementations SHOULD NOT + support ExternalName Services. + + Support: Core (Services with a type other than ExternalName) + + Support: Implementation-specific (Services with type ExternalName) + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: Name is the name of the referent. + maxLength: 253 + minLength: 1 + type: string + namespace: + description: |- + Namespace is the namespace of the backend. When unspecified, the local + namespace is inferred. + + Note that when a namespace different than the local namespace is specified, + a ReferenceGrant object is required in the referent namespace to allow that + namespace's owner to accept the reference. See the ReferenceGrant + documentation for details. + + Support: Core + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + port: + description: |- + Port specifies the destination port number to use for this resource. + Port is required when the referent is a Kubernetes Service. In this + case, the port number is the service port number, not the target port. + For other resources, destination port might be derived from the referent + resource or this field. + format: int32 + maximum: 65535 + minimum: 1 + type: integer + required: + - name + type: object + x-kubernetes-validations: + - message: Must have port for Service reference + rule: '(size(self.group) == 0 && self.kind == ''Service'') + ? has(self.port) : true' + required: + - backendRef + type: object + responseHeaderModifier: + description: |- + ResponseHeaderModifier defines a schema for a filter that modifies response + headers. + + Support: Extended + properties: + add: + description: |- + Add adds the given header(s) (name, value) to the request + before the action. It appends to any existing values associated + with the header name. + + Input: + GET /foo HTTP/1.1 + my-header: foo + + Config: + add: + - name: "my-header" + value: "bar,baz" + + Output: + GET /foo HTTP/1.1 + my-header: foo,bar,baz + items: + description: HTTPHeader represents an HTTP Header + name and value as defined by RFC 7230. + properties: + name: + description: |- + Name is the name of the HTTP Header to be matched. Name matching MUST be + case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). + + If multiple entries specify equivalent header names, the first entry with + an equivalent name MUST be considered for a match. Subsequent entries + with an equivalent header name MUST be ignored. Due to the + case-insensitivity of header names, "foo" and "Foo" are considered + equivalent. + maxLength: 256 + minLength: 1 + pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ + type: string + value: + description: Value is the value of HTTP Header + to be matched. + maxLength: 4096 + minLength: 1 + type: string + required: + - name + - value + type: object + maxItems: 16 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + remove: + description: |- + Remove the given header(s) from the HTTP request before the action. The + value of Remove is a list of HTTP header names. Note that the header + names are case-insensitive (see + https://datatracker.ietf.org/doc/html/rfc2616#section-4.2). + + Input: + GET /foo HTTP/1.1 + my-header1: foo + my-header2: bar + my-header3: baz + + Config: + remove: ["my-header1", "my-header3"] + + Output: + GET /foo HTTP/1.1 + my-header2: bar + items: + type: string + maxItems: 16 + type: array + x-kubernetes-list-type: set + set: + description: |- + Set overwrites the request with the given header (name, value) + before the action. + + Input: + GET /foo HTTP/1.1 + my-header: foo + + Config: + set: + - name: "my-header" + value: "bar" + + Output: + GET /foo HTTP/1.1 + my-header: bar + items: + description: HTTPHeader represents an HTTP Header + name and value as defined by RFC 7230. + properties: + name: + description: |- + Name is the name of the HTTP Header to be matched. Name matching MUST be + case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). + + If multiple entries specify equivalent header names, the first entry with + an equivalent name MUST be considered for a match. Subsequent entries + with an equivalent header name MUST be ignored. Due to the + case-insensitivity of header names, "foo" and "Foo" are considered + equivalent. + maxLength: 256 + minLength: 1 + pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ + type: string + value: + description: Value is the value of HTTP Header + to be matched. + maxLength: 4096 + minLength: 1 + type: string + required: + - name + - value + type: object + maxItems: 16 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + type: object + type: + description: |+ + Type identifies the type of filter to apply. As with other API fields, + types are classified into three conformance levels: + + - Core: Filter types and their corresponding configuration defined by + "Support: Core" in this package, e.g. "RequestHeaderModifier". All + implementations supporting GRPCRoute MUST support core filters. + + - Extended: Filter types and their corresponding configuration defined by + "Support: Extended" in this package, e.g. "RequestMirror". Implementers + are encouraged to support extended filters. + + - Implementation-specific: Filters that are defined and supported by specific vendors. + In the future, filters showing convergence in behavior across multiple + implementations will be considered for inclusion in extended or core + conformance levels. Filter-specific configuration for such filters + is specified using the ExtensionRef field. `Type` MUST be set to + "ExtensionRef" for custom filters. + + Implementers are encouraged to define custom implementation types to + extend the core API with implementation-specific behavior. + + If a reference to a custom filter type cannot be resolved, the filter + MUST NOT be skipped. Instead, requests that would have been processed by + that filter MUST receive a HTTP error response. + + enum: + - ResponseHeaderModifier + - RequestHeaderModifier + - RequestMirror + - ExtensionRef + type: string + required: + - type + type: object + x-kubernetes-validations: + - message: filter.requestHeaderModifier must be nil if the + filter.type is not RequestHeaderModifier + rule: '!(has(self.requestHeaderModifier) && self.type != + ''RequestHeaderModifier'')' + - message: filter.requestHeaderModifier must be specified + for RequestHeaderModifier filter.type + rule: '!(!has(self.requestHeaderModifier) && self.type == + ''RequestHeaderModifier'')' + - message: filter.responseHeaderModifier must be nil if the + filter.type is not ResponseHeaderModifier + rule: '!(has(self.responseHeaderModifier) && self.type != + ''ResponseHeaderModifier'')' + - message: filter.responseHeaderModifier must be specified + for ResponseHeaderModifier filter.type + rule: '!(!has(self.responseHeaderModifier) && self.type + == ''ResponseHeaderModifier'')' + - message: filter.requestMirror must be nil if the filter.type + is not RequestMirror + rule: '!(has(self.requestMirror) && self.type != ''RequestMirror'')' + - message: filter.requestMirror must be specified for RequestMirror + filter.type + rule: '!(!has(self.requestMirror) && self.type == ''RequestMirror'')' + - message: filter.extensionRef must be nil if the filter.type + is not ExtensionRef + rule: '!(has(self.extensionRef) && self.type != ''ExtensionRef'')' + - message: filter.extensionRef must be specified for ExtensionRef + filter.type + rule: '!(!has(self.extensionRef) && self.type == ''ExtensionRef'')' + maxItems: 16 + type: array + x-kubernetes-validations: + - message: RequestHeaderModifier filter cannot be repeated + rule: self.filter(f, f.type == 'RequestHeaderModifier').size() + <= 1 + - message: ResponseHeaderModifier filter cannot be repeated + rule: self.filter(f, f.type == 'ResponseHeaderModifier').size() + <= 1 + matches: + description: |- + Matches define conditions used for matching the rule against incoming + gRPC requests. Each match is independent, i.e. this rule will be matched + if **any** one of the matches is satisfied. + + For example, take the following matches configuration: + + ``` + matches: + - method: + service: foo.bar + headers: + values: + version: 2 + - method: + service: foo.bar.v2 + ``` + + For a request to match against this rule, it MUST satisfy + EITHER of the two conditions: + + - service of foo.bar AND contains the header `version: 2` + - service of foo.bar.v2 + + See the documentation for GRPCRouteMatch on how to specify multiple + match conditions to be ANDed together. + + If no matches are specified, the implementation MUST match every gRPC request. + + Proxy or Load Balancer routing configuration generated from GRPCRoutes + MUST prioritize rules based on the following criteria, continuing on + ties. Merging MUST not be done between GRPCRoutes and HTTPRoutes. + Precedence MUST be given to the rule with the largest number of: + + * Characters in a matching non-wildcard hostname. + * Characters in a matching hostname. + * Characters in a matching service. + * Characters in a matching method. + * Header matches. + + If ties still exist across multiple Routes, matching precedence MUST be + determined in order of the following criteria, continuing on ties: + + * The oldest Route based on creation timestamp. + * The Route appearing first in alphabetical order by + "{namespace}/{name}". + + If ties still exist within the Route that has been given precedence, + matching precedence MUST be granted to the first matching rule meeting + the above criteria. + items: + description: |- + GRPCRouteMatch defines the predicate used to match requests to a given + action. Multiple match types are ANDed together, i.e. the match will + evaluate to true only if all conditions are satisfied. + + For example, the match below will match a gRPC request only if its service + is `foo` AND it contains the `version: v1` header: + + ``` + matches: + - method: + type: Exact + service: "foo" + headers: + - name: "version" + value "v1" + + ``` + properties: + headers: + description: |- + Headers specifies gRPC request header matchers. Multiple match values are + ANDed together, meaning, a request MUST match all the specified headers + to select the route. + items: + description: |- + GRPCHeaderMatch describes how to select a gRPC route by matching gRPC request + headers. + properties: + name: + description: |- + Name is the name of the gRPC Header to be matched. + + If multiple entries specify equivalent header names, only the first + entry with an equivalent name MUST be considered for a match. Subsequent + entries with an equivalent header name MUST be ignored. Due to the + case-insensitivity of header names, "foo" and "Foo" are considered + equivalent. + maxLength: 256 + minLength: 1 + pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ + type: string + type: + default: Exact + description: Type specifies how to match against + the value of the header. + enum: + - Exact + - RegularExpression + type: string + value: + description: Value is the value of the gRPC Header + to be matched. + maxLength: 4096 + minLength: 1 + type: string + required: + - name + - value + type: object + maxItems: 16 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + method: + description: |- + Method specifies a gRPC request service/method matcher. If this field is + not specified, all services and methods will match. + properties: + method: + description: |- + Value of the method to match against. If left empty or omitted, will + match all services. + + At least one of Service and Method MUST be a non-empty string. + maxLength: 1024 + type: string + service: + description: |- + Value of the service to match against. If left empty or omitted, will + match any service. + + At least one of Service and Method MUST be a non-empty string. + maxLength: 1024 + type: string + type: + default: Exact + description: |- + Type specifies how to match against the service and/or method. + Support: Core (Exact with service and method specified) + + Support: Implementation-specific (Exact with method specified but no service specified) + + Support: Implementation-specific (RegularExpression) + enum: + - Exact + - RegularExpression + type: string + type: object + x-kubernetes-validations: + - message: One or both of 'service' or 'method' must be + specified + rule: 'has(self.type) ? has(self.service) || has(self.method) + : true' + - message: service must only contain valid characters + (matching ^(?i)\.?[a-z_][a-z_0-9]*(\.[a-z_][a-z_0-9]*)*$) + rule: '(!has(self.type) || self.type == ''Exact'') && + has(self.service) ? self.service.matches(r"""^(?i)\.?[a-z_][a-z_0-9]*(\.[a-z_][a-z_0-9]*)*$"""): + true' + - message: method must only contain valid characters (matching + ^[A-Za-z_][A-Za-z_0-9]*$) + rule: '(!has(self.type) || self.type == ''Exact'') && + has(self.method) ? self.method.matches(r"""^[A-Za-z_][A-Za-z_0-9]*$"""): + true' + type: object + maxItems: 8 + type: array + type: object + maxItems: 16 + type: array + x-kubernetes-validations: + - message: While 16 rules and 64 matches per rule are allowed, the + total number of matches across all rules in a route must be less + than 128 + rule: '(self.size() > 0 ? (has(self[0].matches) ? self[0].matches.size() + : 0) : 0) + (self.size() > 1 ? (has(self[1].matches) ? self[1].matches.size() + : 0) : 0) + (self.size() > 2 ? (has(self[2].matches) ? self[2].matches.size() + : 0) : 0) + (self.size() > 3 ? (has(self[3].matches) ? self[3].matches.size() + : 0) : 0) + (self.size() > 4 ? (has(self[4].matches) ? self[4].matches.size() + : 0) : 0) + (self.size() > 5 ? (has(self[5].matches) ? self[5].matches.size() + : 0) : 0) + (self.size() > 6 ? (has(self[6].matches) ? self[6].matches.size() + : 0) : 0) + (self.size() > 7 ? (has(self[7].matches) ? self[7].matches.size() + : 0) : 0) + (self.size() > 8 ? (has(self[8].matches) ? self[8].matches.size() + : 0) : 0) + (self.size() > 9 ? (has(self[9].matches) ? self[9].matches.size() + : 0) : 0) + (self.size() > 10 ? (has(self[10].matches) ? self[10].matches.size() + : 0) : 0) + (self.size() > 11 ? (has(self[11].matches) ? self[11].matches.size() + : 0) : 0) + (self.size() > 12 ? (has(self[12].matches) ? self[12].matches.size() + : 0) : 0) + (self.size() > 13 ? (has(self[13].matches) ? self[13].matches.size() + : 0) : 0) + (self.size() > 14 ? (has(self[14].matches) ? self[14].matches.size() + : 0) : 0) + (self.size() > 15 ? (has(self[15].matches) ? self[15].matches.size() + : 0) : 0) <= 128' + type: object + status: + description: Status defines the current state of GRPCRoute. + properties: + parents: + description: |- + Parents is a list of parent resources (usually Gateways) that are + associated with the route, and the status of the route with respect to + each parent. When this route attaches to a parent, the controller that + manages the parent must add an entry to this list when the controller + first sees the route and should update the entry as appropriate when the + route or gateway is modified. + + Note that parent references that cannot be resolved by an implementation + of this API will not be added to this list. Implementations of this API + can only populate Route status for the Gateways/parent resources they are + responsible for. + + A maximum of 32 Gateways will be represented in this list. An empty list + means the route has not been attached to any Gateway. + items: + description: |- + RouteParentStatus describes the status of a route with respect to an + associated Parent. + properties: + conditions: + description: |- + Conditions describes the status of the route with respect to the Gateway. + Note that the route's availability is also subject to the Gateway's own + status conditions and listener status. + + If the Route's ParentRef specifies an existing Gateway that supports + Routes of this kind AND that Gateway's controller has sufficient access, + then that Gateway's controller MUST set the "Accepted" condition on the + Route, to indicate whether the route has been accepted or rejected by the + Gateway, and why. + + A Route MUST be considered "Accepted" if at least one of the Route's + rules is implemented by the Gateway. + + There are a number of cases where the "Accepted" condition may not be set + due to lack of controller visibility, that includes when: + + * The Route refers to a non-existent parent. + * The Route is of a type that the controller does not support. + * The Route is in a namespace the controller does not have access to. + items: + description: Condition contains details for one aspect of + the current state of this API Resource. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, + Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + maxItems: 8 + minItems: 1 + type: array + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + controllerName: + description: |- + ControllerName is a domain/path string that indicates the name of the + controller that wrote this status. This corresponds with the + controllerName field on GatewayClass. + + Example: "example.net/gateway-controller". + + The format of this field is DOMAIN "/" PATH, where DOMAIN and PATH are + valid Kubernetes names + (https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names). + + Controllers MUST populate this field when writing status. Controllers should ensure that + entries to status populated with their ControllerName are cleaned up when they are no + longer necessary. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$ + type: string + parentRef: + description: |- + ParentRef corresponds with a ParentRef in the spec that this + RouteParentStatus struct describes the status of. + properties: + group: + default: gateway.networking.k8s.io + description: |- + Group is the group of the referent. + When unspecified, "gateway.networking.k8s.io" is inferred. + To set the core API group (such as for a "Service" kind referent), + Group must be explicitly set to "" (empty string). + + Support: Core + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + default: Gateway + description: |- + Kind is kind of the referent. + + There are two kinds of parent resources with "Core" support: + + * Gateway (Gateway conformance profile) + * Service (Mesh conformance profile, ClusterIP Services only) + + Support for other resources is Implementation-Specific. + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: |- + Name is the name of the referent. + + Support: Core + maxLength: 253 + minLength: 1 + type: string + namespace: + description: |- + Namespace is the namespace of the referent. When unspecified, this refers + to the local namespace of the Route. + + Note that there are specific rules for ParentRefs which cross namespace + boundaries. Cross-namespace references are only valid if they are explicitly + allowed by something in the namespace they are referring to. For example: + Gateway has the AllowedRoutes field, and ReferenceGrant provides a + generic way to enable any other kind of cross-namespace reference. + + + + Support: Core + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + port: + description: |- + Port is the network port this Route targets. It can be interpreted + differently based on the type of parent resource. + + When the parent resource is a Gateway, this targets all listeners + listening on the specified port that also support this kind of Route(and + select this Route). It's not recommended to set `Port` unless the + networking behaviors specified in a Route must apply to a specific port + as opposed to a listener(s) whose port(s) may be changed. When both Port + and SectionName are specified, the name and port of the selected listener + must match both specified values. + + + + Implementations MAY choose to support other parent resources. + Implementations supporting other types of parent resources MUST clearly + document how/if Port is interpreted. + + For the purpose of status, an attachment is considered successful as + long as the parent resource accepts it partially. For example, Gateway + listeners can restrict which Routes can attach to them by Route kind, + namespace, or hostname. If 1 of 2 Gateway listeners accept attachment + from the referencing Route, the Route MUST be considered successfully + attached. If no Gateway listeners accept attachment from this Route, + the Route MUST be considered detached from the Gateway. + + Support: Extended + format: int32 + maximum: 65535 + minimum: 1 + type: integer + sectionName: + description: |- + SectionName is the name of a section within the target resource. In the + following resources, SectionName is interpreted as the following: + + * Gateway: Listener name. When both Port (experimental) and SectionName + are specified, the name and port of the selected listener must match + both specified values. + * Service: Port name. When both Port (experimental) and SectionName + are specified, the name and port of the selected listener must match + both specified values. + + Implementations MAY choose to support attaching Routes to other resources. + If that is the case, they MUST clearly document how SectionName is + interpreted. + + When unspecified (empty string), this will reference the entire resource. + For the purpose of status, an attachment is considered successful if at + least one section in the parent resource accepts it. For example, Gateway + listeners can restrict which Routes can attach to them by Route kind, + namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from + the referencing Route, the Route MUST be considered successfully + attached. If no Gateway listeners accept attachment from this Route, the + Route MUST be considered detached from the Gateway. + + Support: Core + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + required: + - name + type: object + required: + - controllerName + - parentRef + type: object + maxItems: 32 + type: array + required: + - parents + type: object + type: object + served: true + storage: true + subresources: + status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: null + storedVersions: null +--- +# +# config/crd/standard/gateway.networking.k8s.io_httproutes.yaml +# +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328 + gateway.networking.k8s.io/bundle-version: v1.2.1 + gateway.networking.k8s.io/channel: standard + creationTimestamp: null + name: httproutes.gateway.networking.k8s.io +spec: + group: gateway.networking.k8s.io + names: + categories: + - gateway-api + kind: HTTPRoute + listKind: HTTPRouteList + plural: httproutes + singular: httproute + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .spec.hostnames + name: Hostnames + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1 + schema: + openAPIV3Schema: + description: |- + HTTPRoute provides a way to route HTTP requests. This includes the capability + to match requests by hostname, path, header, or query param. Filters can be + used to specify additional processing steps. Backends specify where matching + requests should be routed. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: Spec defines the desired state of HTTPRoute. + properties: + hostnames: + description: |- + Hostnames defines a set of hostnames that should match against the HTTP Host + header to select a HTTPRoute used to process the request. Implementations + MUST ignore any port value specified in the HTTP Host header while + performing a match and (absent of any applicable header modification + configuration) MUST forward this header unmodified to the backend. + + Valid values for Hostnames are determined by RFC 1123 definition of a + hostname with 2 notable exceptions: + + 1. IPs are not allowed. + 2. A hostname may be prefixed with a wildcard label (`*.`). The wildcard + label must appear by itself as the first label. + + If a hostname is specified by both the Listener and HTTPRoute, there + must be at least one intersecting hostname for the HTTPRoute to be + attached to the Listener. For example: + + * A Listener with `test.example.com` as the hostname matches HTTPRoutes + that have either not specified any hostnames, or have specified at + least one of `test.example.com` or `*.example.com`. + * A Listener with `*.example.com` as the hostname matches HTTPRoutes + that have either not specified any hostnames or have specified at least + one hostname that matches the Listener hostname. For example, + `*.example.com`, `test.example.com`, and `foo.test.example.com` would + all match. On the other hand, `example.com` and `test.example.net` would + not match. + + Hostnames that are prefixed with a wildcard label (`*.`) are interpreted + as a suffix match. That means that a match for `*.example.com` would match + both `test.example.com`, and `foo.test.example.com`, but not `example.com`. + + If both the Listener and HTTPRoute have specified hostnames, any + HTTPRoute hostnames that do not match the Listener hostname MUST be + ignored. For example, if a Listener specified `*.example.com`, and the + HTTPRoute specified `test.example.com` and `test.example.net`, + `test.example.net` must not be considered for a match. + + If both the Listener and HTTPRoute have specified hostnames, and none + match with the criteria above, then the HTTPRoute is not accepted. The + implementation must raise an 'Accepted' Condition with a status of + `False` in the corresponding RouteParentStatus. + + In the event that multiple HTTPRoutes specify intersecting hostnames (e.g. + overlapping wildcard matching and exact matching hostnames), precedence must + be given to rules from the HTTPRoute with the largest number of: + + * Characters in a matching non-wildcard hostname. + * Characters in a matching hostname. + + If ties exist across multiple Routes, the matching precedence rules for + HTTPRouteMatches takes over. + + Support: Core + items: + description: |- + Hostname is the fully qualified domain name of a network host. This matches + the RFC 1123 definition of a hostname with 2 notable exceptions: + + 1. IPs are not allowed. + 2. A hostname may be prefixed with a wildcard label (`*.`). The wildcard + label must appear by itself as the first label. + + Hostname can be "precise" which is a domain name without the terminating + dot of a network host (e.g. "foo.example.com") or "wildcard", which is a + domain name prefixed with a single wildcard label (e.g. `*.example.com`). + + Note that as per RFC1035 and RFC1123, a *label* must consist of lower case + alphanumeric characters or '-', and must start and end with an alphanumeric + character. No other punctuation is allowed. + maxLength: 253 + minLength: 1 + pattern: ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + maxItems: 16 + type: array + parentRefs: + description: |+ + ParentRefs references the resources (usually Gateways) that a Route wants + to be attached to. Note that the referenced parent resource needs to + allow this for the attachment to be complete. For Gateways, that means + the Gateway needs to allow attachment from Routes of this kind and + namespace. For Services, that means the Service must either be in the same + namespace for a "producer" route, or the mesh implementation must support + and allow "consumer" routes for the referenced Service. ReferenceGrant is + not applicable for governing ParentRefs to Services - it is not possible to + create a "producer" route for a Service in a different namespace from the + Route. + + There are two kinds of parent resources with "Core" support: + + * Gateway (Gateway conformance profile) + * Service (Mesh conformance profile, ClusterIP Services only) + + This API may be extended in the future to support additional kinds of parent + resources. + + ParentRefs must be _distinct_. This means either that: + + * They select different objects. If this is the case, then parentRef + entries are distinct. In terms of fields, this means that the + multi-part key defined by `group`, `kind`, `namespace`, and `name` must + be unique across all parentRef entries in the Route. + * They do not select different objects, but for each optional field used, + each ParentRef that selects the same object must set the same set of + optional fields to different values. If one ParentRef sets a + combination of optional fields, all must set the same combination. + + Some examples: + + * If one ParentRef sets `sectionName`, all ParentRefs referencing the + same object must also set `sectionName`. + * If one ParentRef sets `port`, all ParentRefs referencing the same + object must also set `port`. + * If one ParentRef sets `sectionName` and `port`, all ParentRefs + referencing the same object must also set `sectionName` and `port`. + + It is possible to separately reference multiple distinct objects that may + be collapsed by an implementation. For example, some implementations may + choose to merge compatible Gateway Listeners together. If that is the + case, the list of routes attached to those resources should also be + merged. + + Note that for ParentRefs that cross namespace boundaries, there are specific + rules. Cross-namespace references are only valid if they are explicitly + allowed by something in the namespace they are referring to. For example, + Gateway has the AllowedRoutes field, and ReferenceGrant provides a + generic way to enable other kinds of cross-namespace reference. + + + + + + + items: + description: |- + ParentReference identifies an API object (usually a Gateway) that can be considered + a parent of this resource (usually a route). There are two kinds of parent resources + with "Core" support: + + * Gateway (Gateway conformance profile) + * Service (Mesh conformance profile, ClusterIP Services only) + + This API may be extended in the future to support additional kinds of parent + resources. + + The API object must be valid in the cluster; the Group and Kind must + be registered in the cluster for this reference to be valid. + properties: + group: + default: gateway.networking.k8s.io + description: |- + Group is the group of the referent. + When unspecified, "gateway.networking.k8s.io" is inferred. + To set the core API group (such as for a "Service" kind referent), + Group must be explicitly set to "" (empty string). + + Support: Core + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + default: Gateway + description: |- + Kind is kind of the referent. + + There are two kinds of parent resources with "Core" support: + + * Gateway (Gateway conformance profile) + * Service (Mesh conformance profile, ClusterIP Services only) + + Support for other resources is Implementation-Specific. + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: |- + Name is the name of the referent. + + Support: Core + maxLength: 253 + minLength: 1 + type: string + namespace: + description: |- + Namespace is the namespace of the referent. When unspecified, this refers + to the local namespace of the Route. + + Note that there are specific rules for ParentRefs which cross namespace + boundaries. Cross-namespace references are only valid if they are explicitly + allowed by something in the namespace they are referring to. For example: + Gateway has the AllowedRoutes field, and ReferenceGrant provides a + generic way to enable any other kind of cross-namespace reference. + + + + Support: Core + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + port: + description: |- + Port is the network port this Route targets. It can be interpreted + differently based on the type of parent resource. + + When the parent resource is a Gateway, this targets all listeners + listening on the specified port that also support this kind of Route(and + select this Route). It's not recommended to set `Port` unless the + networking behaviors specified in a Route must apply to a specific port + as opposed to a listener(s) whose port(s) may be changed. When both Port + and SectionName are specified, the name and port of the selected listener + must match both specified values. + + + + Implementations MAY choose to support other parent resources. + Implementations supporting other types of parent resources MUST clearly + document how/if Port is interpreted. + + For the purpose of status, an attachment is considered successful as + long as the parent resource accepts it partially. For example, Gateway + listeners can restrict which Routes can attach to them by Route kind, + namespace, or hostname. If 1 of 2 Gateway listeners accept attachment + from the referencing Route, the Route MUST be considered successfully + attached. If no Gateway listeners accept attachment from this Route, + the Route MUST be considered detached from the Gateway. + + Support: Extended + format: int32 + maximum: 65535 + minimum: 1 + type: integer + sectionName: + description: |- + SectionName is the name of a section within the target resource. In the + following resources, SectionName is interpreted as the following: + + * Gateway: Listener name. When both Port (experimental) and SectionName + are specified, the name and port of the selected listener must match + both specified values. + * Service: Port name. When both Port (experimental) and SectionName + are specified, the name and port of the selected listener must match + both specified values. + + Implementations MAY choose to support attaching Routes to other resources. + If that is the case, they MUST clearly document how SectionName is + interpreted. + + When unspecified (empty string), this will reference the entire resource. + For the purpose of status, an attachment is considered successful if at + least one section in the parent resource accepts it. For example, Gateway + listeners can restrict which Routes can attach to them by Route kind, + namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from + the referencing Route, the Route MUST be considered successfully + attached. If no Gateway listeners accept attachment from this Route, the + Route MUST be considered detached from the Gateway. + + Support: Core + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + required: + - name + type: object + maxItems: 32 + type: array + x-kubernetes-validations: + - message: sectionName must be specified when parentRefs includes + 2 or more references to the same parent + rule: 'self.all(p1, self.all(p2, p1.group == p2.group && p1.kind + == p2.kind && p1.name == p2.name && (((!has(p1.__namespace__) + || p1.__namespace__ == '''') && (!has(p2.__namespace__) || p2.__namespace__ + == '''')) || (has(p1.__namespace__) && has(p2.__namespace__) && + p1.__namespace__ == p2.__namespace__ )) ? ((!has(p1.sectionName) + || p1.sectionName == '''') == (!has(p2.sectionName) || p2.sectionName + == '''')) : true))' + - message: sectionName must be unique when parentRefs includes 2 or + more references to the same parent + rule: self.all(p1, self.exists_one(p2, p1.group == p2.group && p1.kind + == p2.kind && p1.name == p2.name && (((!has(p1.__namespace__) + || p1.__namespace__ == '') && (!has(p2.__namespace__) || p2.__namespace__ + == '')) || (has(p1.__namespace__) && has(p2.__namespace__) && + p1.__namespace__ == p2.__namespace__ )) && (((!has(p1.sectionName) + || p1.sectionName == '') && (!has(p2.sectionName) || p2.sectionName + == '')) || (has(p1.sectionName) && has(p2.sectionName) && p1.sectionName + == p2.sectionName)))) + rules: + default: + - matches: + - path: + type: PathPrefix + value: / + description: |+ + Rules are a list of HTTP matchers, filters and actions. + + items: + description: |- + HTTPRouteRule defines semantics for matching an HTTP request based on + conditions (matches), processing it (filters), and forwarding the request to + an API object (backendRefs). + properties: + backendRefs: + description: |- + BackendRefs defines the backend(s) where matching requests should be + sent. + + Failure behavior here depends on how many BackendRefs are specified and + how many are invalid. + + If *all* entries in BackendRefs are invalid, and there are also no filters + specified in this route rule, *all* traffic which matches this rule MUST + receive a 500 status code. + + See the HTTPBackendRef definition for the rules about what makes a single + HTTPBackendRef invalid. + + When a HTTPBackendRef is invalid, 500 status codes MUST be returned for + requests that would have otherwise been routed to an invalid backend. If + multiple backends are specified, and some are invalid, the proportion of + requests that would otherwise have been routed to an invalid backend + MUST receive a 500 status code. + + For example, if two backends are specified with equal weights, and one is + invalid, 50 percent of traffic must receive a 500. Implementations may + choose how that 50 percent is determined. + + When a HTTPBackendRef refers to a Service that has no ready endpoints, + implementations SHOULD return a 503 for requests to that backend instead. + If an implementation chooses to do this, all of the above rules for 500 responses + MUST also apply for responses that return a 503. + + Support: Core for Kubernetes Service + + Support: Extended for Kubernetes ServiceImport + + Support: Implementation-specific for any other resource + + Support for weight: Core + items: + description: |- + HTTPBackendRef defines how a HTTPRoute forwards a HTTP request. + + Note that when a namespace different than the local namespace is specified, a + ReferenceGrant object is required in the referent namespace to allow that + namespace's owner to accept the reference. See the ReferenceGrant + documentation for details. + + + + When the BackendRef points to a Kubernetes Service, implementations SHOULD + honor the appProtocol field if it is set for the target Service Port. + + Implementations supporting appProtocol SHOULD recognize the Kubernetes + Standard Application Protocols defined in KEP-3726. + + If a Service appProtocol isn't specified, an implementation MAY infer the + backend protocol through its own means. Implementations MAY infer the + protocol from the Route type referring to the backend Service. + + If a Route is not able to send traffic to the backend using the specified + protocol then the backend is considered invalid. Implementations MUST set the + "ResolvedRefs" condition to "False" with the "UnsupportedProtocol" reason. + + + properties: + filters: + description: |- + Filters defined at this level should be executed if and only if the + request is being forwarded to the backend defined here. + + Support: Implementation-specific (For broader support of filters, use the + Filters field in HTTPRouteRule.) + items: + description: |- + HTTPRouteFilter defines processing steps that must be completed during the + request or response lifecycle. HTTPRouteFilters are meant as an extension + point to express processing that may be done in Gateway implementations. Some + examples include request or response modification, implementing + authentication strategies, rate-limiting, and traffic shaping. API + guarantee/conformance is defined based on the type of the filter. + properties: + extensionRef: + description: |- + ExtensionRef is an optional, implementation-specific extension to the + "filter" behavior. For example, resource "myroutefilter" in group + "networking.example.net"). ExtensionRef MUST NOT be used for core and + extended filters. + + This filter can be used multiple times within the same rule. + + Support: Implementation-specific + properties: + group: + description: |- + Group is the group of the referent. For example, "gateway.networking.k8s.io". + When unspecified or empty string, core API group is inferred. + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + description: Kind is kind of the referent. For + example "HTTPRoute" or "Service". + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: Name is the name of the referent. + maxLength: 253 + minLength: 1 + type: string + required: + - group + - kind + - name + type: object + requestHeaderModifier: + description: |- + RequestHeaderModifier defines a schema for a filter that modifies request + headers. + + Support: Core + properties: + add: + description: |- + Add adds the given header(s) (name, value) to the request + before the action. It appends to any existing values associated + with the header name. + + Input: + GET /foo HTTP/1.1 + my-header: foo + + Config: + add: + - name: "my-header" + value: "bar,baz" + + Output: + GET /foo HTTP/1.1 + my-header: foo,bar,baz + items: + description: HTTPHeader represents an HTTP + Header name and value as defined by RFC + 7230. + properties: + name: + description: |- + Name is the name of the HTTP Header to be matched. Name matching MUST be + case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). + + If multiple entries specify equivalent header names, the first entry with + an equivalent name MUST be considered for a match. Subsequent entries + with an equivalent header name MUST be ignored. Due to the + case-insensitivity of header names, "foo" and "Foo" are considered + equivalent. + maxLength: 256 + minLength: 1 + pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ + type: string + value: + description: Value is the value of HTTP + Header to be matched. + maxLength: 4096 + minLength: 1 + type: string + required: + - name + - value + type: object + maxItems: 16 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + remove: + description: |- + Remove the given header(s) from the HTTP request before the action. The + value of Remove is a list of HTTP header names. Note that the header + names are case-insensitive (see + https://datatracker.ietf.org/doc/html/rfc2616#section-4.2). + + Input: + GET /foo HTTP/1.1 + my-header1: foo + my-header2: bar + my-header3: baz + + Config: + remove: ["my-header1", "my-header3"] + + Output: + GET /foo HTTP/1.1 + my-header2: bar + items: + type: string + maxItems: 16 + type: array + x-kubernetes-list-type: set + set: + description: |- + Set overwrites the request with the given header (name, value) + before the action. + + Input: + GET /foo HTTP/1.1 + my-header: foo + + Config: + set: + - name: "my-header" + value: "bar" + + Output: + GET /foo HTTP/1.1 + my-header: bar + items: + description: HTTPHeader represents an HTTP + Header name and value as defined by RFC + 7230. + properties: + name: + description: |- + Name is the name of the HTTP Header to be matched. Name matching MUST be + case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). + + If multiple entries specify equivalent header names, the first entry with + an equivalent name MUST be considered for a match. Subsequent entries + with an equivalent header name MUST be ignored. Due to the + case-insensitivity of header names, "foo" and "Foo" are considered + equivalent. + maxLength: 256 + minLength: 1 + pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ + type: string + value: + description: Value is the value of HTTP + Header to be matched. + maxLength: 4096 + minLength: 1 + type: string + required: + - name + - value + type: object + maxItems: 16 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + type: object + requestMirror: + description: |+ + RequestMirror defines a schema for a filter that mirrors requests. + Requests are sent to the specified destination, but responses from + that destination are ignored. + + This filter can be used multiple times within the same rule. Note that + not all implementations will be able to support mirroring to multiple + backends. + + Support: Extended + + properties: + backendRef: + description: |- + BackendRef references a resource where mirrored requests are sent. + + Mirrored requests must be sent only to a single destination endpoint + within this BackendRef, irrespective of how many endpoints are present + within this BackendRef. + + If the referent cannot be found, this BackendRef is invalid and must be + dropped from the Gateway. The controller must ensure the "ResolvedRefs" + condition on the Route status is set to `status: False` and not configure + this backend in the underlying implementation. + + If there is a cross-namespace reference to an *existing* object + that is not allowed by a ReferenceGrant, the controller must ensure the + "ResolvedRefs" condition on the Route is set to `status: False`, + with the "RefNotPermitted" reason and not configure this backend in the + underlying implementation. + + In either error case, the Message of the `ResolvedRefs` Condition + should be used to provide more detail about the problem. + + Support: Extended for Kubernetes Service + + Support: Implementation-specific for any other resource + properties: + group: + default: "" + description: |- + Group is the group of the referent. For example, "gateway.networking.k8s.io". + When unspecified or empty string, core API group is inferred. + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + default: Service + description: |- + Kind is the Kubernetes resource kind of the referent. For example + "Service". + + Defaults to "Service" when not specified. + + ExternalName services can refer to CNAME DNS records that may live + outside of the cluster and as such are difficult to reason about in + terms of conformance. They also may not be safe to forward to (see + CVE-2021-25740 for more information). Implementations SHOULD NOT + support ExternalName Services. + + Support: Core (Services with a type other than ExternalName) + + Support: Implementation-specific (Services with type ExternalName) + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: Name is the name of the referent. + maxLength: 253 + minLength: 1 + type: string + namespace: + description: |- + Namespace is the namespace of the backend. When unspecified, the local + namespace is inferred. + + Note that when a namespace different than the local namespace is specified, + a ReferenceGrant object is required in the referent namespace to allow that + namespace's owner to accept the reference. See the ReferenceGrant + documentation for details. + + Support: Core + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + port: + description: |- + Port specifies the destination port number to use for this resource. + Port is required when the referent is a Kubernetes Service. In this + case, the port number is the service port number, not the target port. + For other resources, destination port might be derived from the referent + resource or this field. + format: int32 + maximum: 65535 + minimum: 1 + type: integer + required: + - name + type: object + x-kubernetes-validations: + - message: Must have port for Service reference + rule: '(size(self.group) == 0 && self.kind + == ''Service'') ? has(self.port) : true' + required: + - backendRef + type: object + requestRedirect: + description: |- + RequestRedirect defines a schema for a filter that responds to the + request with an HTTP redirection. + + Support: Core + properties: + hostname: + description: |- + Hostname is the hostname to be used in the value of the `Location` + header in the response. + When empty, the hostname in the `Host` header of the request is used. + + Support: Core + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + path: + description: |- + Path defines parameters used to modify the path of the incoming request. + The modified path is then used to construct the `Location` header. When + empty, the request path is used as-is. + + Support: Extended + properties: + replaceFullPath: + description: |- + ReplaceFullPath specifies the value with which to replace the full path + of a request during a rewrite or redirect. + maxLength: 1024 + type: string + replacePrefixMatch: + description: |- + ReplacePrefixMatch specifies the value with which to replace the prefix + match of a request during a rewrite or redirect. For example, a request + to "/foo/bar" with a prefix match of "/foo" and a ReplacePrefixMatch + of "/xyz" would be modified to "/xyz/bar". + + Note that this matches the behavior of the PathPrefix match type. This + matches full path elements. A path element refers to the list of labels + in the path split by the `/` separator. When specified, a trailing `/` is + ignored. For example, the paths `/abc`, `/abc/`, and `/abc/def` would all + match the prefix `/abc`, but the path `/abcd` would not. + + ReplacePrefixMatch is only compatible with a `PathPrefix` HTTPRouteMatch. + Using any other HTTPRouteMatch type on the same HTTPRouteRule will result in + the implementation setting the Accepted Condition for the Route to `status: False`. + + Request Path | Prefix Match | Replace Prefix | Modified Path + maxLength: 1024 + type: string + type: + description: |- + Type defines the type of path modifier. Additional types may be + added in a future release of the API. + + Note that values may be added to this enum, implementations + must ensure that unknown values will not cause a crash. + + Unknown values here must result in the implementation setting the + Accepted Condition for the Route to `status: False`, with a + Reason of `UnsupportedValue`. + enum: + - ReplaceFullPath + - ReplacePrefixMatch + type: string + required: + - type + type: object + x-kubernetes-validations: + - message: replaceFullPath must be specified + when type is set to 'ReplaceFullPath' + rule: 'self.type == ''ReplaceFullPath'' ? + has(self.replaceFullPath) : true' + - message: type must be 'ReplaceFullPath' when + replaceFullPath is set + rule: 'has(self.replaceFullPath) ? self.type + == ''ReplaceFullPath'' : true' + - message: replacePrefixMatch must be specified + when type is set to 'ReplacePrefixMatch' + rule: 'self.type == ''ReplacePrefixMatch'' + ? has(self.replacePrefixMatch) : true' + - message: type must be 'ReplacePrefixMatch' + when replacePrefixMatch is set + rule: 'has(self.replacePrefixMatch) ? self.type + == ''ReplacePrefixMatch'' : true' + port: + description: |- + Port is the port to be used in the value of the `Location` + header in the response. + + If no port is specified, the redirect port MUST be derived using the + following rules: + + * If redirect scheme is not-empty, the redirect port MUST be the well-known + port associated with the redirect scheme. Specifically "http" to port 80 + and "https" to port 443. If the redirect scheme does not have a + well-known port, the listener port of the Gateway SHOULD be used. + * If redirect scheme is empty, the redirect port MUST be the Gateway + Listener port. + + Implementations SHOULD NOT add the port number in the 'Location' + header in the following cases: + + * A Location header that will use HTTP (whether that is determined via + the Listener protocol or the Scheme field) _and_ use port 80. + * A Location header that will use HTTPS (whether that is determined via + the Listener protocol or the Scheme field) _and_ use port 443. + + Support: Extended + format: int32 + maximum: 65535 + minimum: 1 + type: integer + scheme: + description: |- + Scheme is the scheme to be used in the value of the `Location` header in + the response. When empty, the scheme of the request is used. + + Scheme redirects can affect the port of the redirect, for more information, + refer to the documentation for the port field of this filter. + + Note that values may be added to this enum, implementations + must ensure that unknown values will not cause a crash. + + Unknown values here must result in the implementation setting the + Accepted Condition for the Route to `status: False`, with a + Reason of `UnsupportedValue`. + + Support: Extended + enum: + - http + - https + type: string + statusCode: + default: 302 + description: |- + StatusCode is the HTTP status code to be used in response. + + Note that values may be added to this enum, implementations + must ensure that unknown values will not cause a crash. + + Unknown values here must result in the implementation setting the + Accepted Condition for the Route to `status: False`, with a + Reason of `UnsupportedValue`. + + Support: Core + enum: + - 301 + - 302 + type: integer + type: object + responseHeaderModifier: + description: |- + ResponseHeaderModifier defines a schema for a filter that modifies response + headers. + + Support: Extended + properties: + add: + description: |- + Add adds the given header(s) (name, value) to the request + before the action. It appends to any existing values associated + with the header name. + + Input: + GET /foo HTTP/1.1 + my-header: foo + + Config: + add: + - name: "my-header" + value: "bar,baz" + + Output: + GET /foo HTTP/1.1 + my-header: foo,bar,baz + items: + description: HTTPHeader represents an HTTP + Header name and value as defined by RFC + 7230. + properties: + name: + description: |- + Name is the name of the HTTP Header to be matched. Name matching MUST be + case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). + + If multiple entries specify equivalent header names, the first entry with + an equivalent name MUST be considered for a match. Subsequent entries + with an equivalent header name MUST be ignored. Due to the + case-insensitivity of header names, "foo" and "Foo" are considered + equivalent. + maxLength: 256 + minLength: 1 + pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ + type: string + value: + description: Value is the value of HTTP + Header to be matched. + maxLength: 4096 + minLength: 1 + type: string + required: + - name + - value + type: object + maxItems: 16 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + remove: + description: |- + Remove the given header(s) from the HTTP request before the action. The + value of Remove is a list of HTTP header names. Note that the header + names are case-insensitive (see + https://datatracker.ietf.org/doc/html/rfc2616#section-4.2). + + Input: + GET /foo HTTP/1.1 + my-header1: foo + my-header2: bar + my-header3: baz + + Config: + remove: ["my-header1", "my-header3"] + + Output: + GET /foo HTTP/1.1 + my-header2: bar + items: + type: string + maxItems: 16 + type: array + x-kubernetes-list-type: set + set: + description: |- + Set overwrites the request with the given header (name, value) + before the action. + + Input: + GET /foo HTTP/1.1 + my-header: foo + + Config: + set: + - name: "my-header" + value: "bar" + + Output: + GET /foo HTTP/1.1 + my-header: bar + items: + description: HTTPHeader represents an HTTP + Header name and value as defined by RFC + 7230. + properties: + name: + description: |- + Name is the name of the HTTP Header to be matched. Name matching MUST be + case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). + + If multiple entries specify equivalent header names, the first entry with + an equivalent name MUST be considered for a match. Subsequent entries + with an equivalent header name MUST be ignored. Due to the + case-insensitivity of header names, "foo" and "Foo" are considered + equivalent. + maxLength: 256 + minLength: 1 + pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ + type: string + value: + description: Value is the value of HTTP + Header to be matched. + maxLength: 4096 + minLength: 1 + type: string + required: + - name + - value + type: object + maxItems: 16 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + type: object + type: + description: |- + Type identifies the type of filter to apply. As with other API fields, + types are classified into three conformance levels: + + - Core: Filter types and their corresponding configuration defined by + "Support: Core" in this package, e.g. "RequestHeaderModifier". All + implementations must support core filters. + + - Extended: Filter types and their corresponding configuration defined by + "Support: Extended" in this package, e.g. "RequestMirror". Implementers + are encouraged to support extended filters. + + - Implementation-specific: Filters that are defined and supported by + specific vendors. + In the future, filters showing convergence in behavior across multiple + implementations will be considered for inclusion in extended or core + conformance levels. Filter-specific configuration for such filters + is specified using the ExtensionRef field. `Type` should be set to + "ExtensionRef" for custom filters. + + Implementers are encouraged to define custom implementation types to + extend the core API with implementation-specific behavior. + + If a reference to a custom filter type cannot be resolved, the filter + MUST NOT be skipped. Instead, requests that would have been processed by + that filter MUST receive a HTTP error response. + + Note that values may be added to this enum, implementations + must ensure that unknown values will not cause a crash. + + Unknown values here must result in the implementation setting the + Accepted Condition for the Route to `status: False`, with a + Reason of `UnsupportedValue`. + enum: + - RequestHeaderModifier + - ResponseHeaderModifier + - RequestMirror + - RequestRedirect + - URLRewrite + - ExtensionRef + type: string + urlRewrite: + description: |- + URLRewrite defines a schema for a filter that modifies a request during forwarding. + + Support: Extended + properties: + hostname: + description: |- + Hostname is the value to be used to replace the Host header value during + forwarding. + + Support: Extended + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + path: + description: |- + Path defines a path rewrite. + + Support: Extended + properties: + replaceFullPath: + description: |- + ReplaceFullPath specifies the value with which to replace the full path + of a request during a rewrite or redirect. + maxLength: 1024 + type: string + replacePrefixMatch: + description: |- + ReplacePrefixMatch specifies the value with which to replace the prefix + match of a request during a rewrite or redirect. For example, a request + to "/foo/bar" with a prefix match of "/foo" and a ReplacePrefixMatch + of "/xyz" would be modified to "/xyz/bar". + + Note that this matches the behavior of the PathPrefix match type. This + matches full path elements. A path element refers to the list of labels + in the path split by the `/` separator. When specified, a trailing `/` is + ignored. For example, the paths `/abc`, `/abc/`, and `/abc/def` would all + match the prefix `/abc`, but the path `/abcd` would not. + + ReplacePrefixMatch is only compatible with a `PathPrefix` HTTPRouteMatch. + Using any other HTTPRouteMatch type on the same HTTPRouteRule will result in + the implementation setting the Accepted Condition for the Route to `status: False`. + + Request Path | Prefix Match | Replace Prefix | Modified Path + maxLength: 1024 + type: string + type: + description: |- + Type defines the type of path modifier. Additional types may be + added in a future release of the API. + + Note that values may be added to this enum, implementations + must ensure that unknown values will not cause a crash. + + Unknown values here must result in the implementation setting the + Accepted Condition for the Route to `status: False`, with a + Reason of `UnsupportedValue`. + enum: + - ReplaceFullPath + - ReplacePrefixMatch + type: string + required: + - type + type: object + x-kubernetes-validations: + - message: replaceFullPath must be specified + when type is set to 'ReplaceFullPath' + rule: 'self.type == ''ReplaceFullPath'' ? + has(self.replaceFullPath) : true' + - message: type must be 'ReplaceFullPath' when + replaceFullPath is set + rule: 'has(self.replaceFullPath) ? self.type + == ''ReplaceFullPath'' : true' + - message: replacePrefixMatch must be specified + when type is set to 'ReplacePrefixMatch' + rule: 'self.type == ''ReplacePrefixMatch'' + ? has(self.replacePrefixMatch) : true' + - message: type must be 'ReplacePrefixMatch' + when replacePrefixMatch is set + rule: 'has(self.replacePrefixMatch) ? self.type + == ''ReplacePrefixMatch'' : true' + type: object + required: + - type + type: object + x-kubernetes-validations: + - message: filter.requestHeaderModifier must be nil + if the filter.type is not RequestHeaderModifier + rule: '!(has(self.requestHeaderModifier) && self.type + != ''RequestHeaderModifier'')' + - message: filter.requestHeaderModifier must be specified + for RequestHeaderModifier filter.type + rule: '!(!has(self.requestHeaderModifier) && self.type + == ''RequestHeaderModifier'')' + - message: filter.responseHeaderModifier must be nil + if the filter.type is not ResponseHeaderModifier + rule: '!(has(self.responseHeaderModifier) && self.type + != ''ResponseHeaderModifier'')' + - message: filter.responseHeaderModifier must be specified + for ResponseHeaderModifier filter.type + rule: '!(!has(self.responseHeaderModifier) && self.type + == ''ResponseHeaderModifier'')' + - message: filter.requestMirror must be nil if the filter.type + is not RequestMirror + rule: '!(has(self.requestMirror) && self.type != ''RequestMirror'')' + - message: filter.requestMirror must be specified for + RequestMirror filter.type + rule: '!(!has(self.requestMirror) && self.type == + ''RequestMirror'')' + - message: filter.requestRedirect must be nil if the + filter.type is not RequestRedirect + rule: '!(has(self.requestRedirect) && self.type != + ''RequestRedirect'')' + - message: filter.requestRedirect must be specified + for RequestRedirect filter.type + rule: '!(!has(self.requestRedirect) && self.type == + ''RequestRedirect'')' + - message: filter.urlRewrite must be nil if the filter.type + is not URLRewrite + rule: '!(has(self.urlRewrite) && self.type != ''URLRewrite'')' + - message: filter.urlRewrite must be specified for URLRewrite + filter.type + rule: '!(!has(self.urlRewrite) && self.type == ''URLRewrite'')' + - message: filter.extensionRef must be nil if the filter.type + is not ExtensionRef + rule: '!(has(self.extensionRef) && self.type != ''ExtensionRef'')' + - message: filter.extensionRef must be specified for + ExtensionRef filter.type + rule: '!(!has(self.extensionRef) && self.type == ''ExtensionRef'')' + maxItems: 16 + type: array + x-kubernetes-validations: + - message: May specify either httpRouteFilterRequestRedirect + or httpRouteFilterRequestRewrite, but not both + rule: '!(self.exists(f, f.type == ''RequestRedirect'') + && self.exists(f, f.type == ''URLRewrite''))' + - message: May specify either httpRouteFilterRequestRedirect + or httpRouteFilterRequestRewrite, but not both + rule: '!(self.exists(f, f.type == ''RequestRedirect'') + && self.exists(f, f.type == ''URLRewrite''))' + - message: RequestHeaderModifier filter cannot be repeated + rule: self.filter(f, f.type == 'RequestHeaderModifier').size() + <= 1 + - message: ResponseHeaderModifier filter cannot be repeated + rule: self.filter(f, f.type == 'ResponseHeaderModifier').size() + <= 1 + - message: RequestRedirect filter cannot be repeated + rule: self.filter(f, f.type == 'RequestRedirect').size() + <= 1 + - message: URLRewrite filter cannot be repeated + rule: self.filter(f, f.type == 'URLRewrite').size() + <= 1 + group: + default: "" + description: |- + Group is the group of the referent. For example, "gateway.networking.k8s.io". + When unspecified or empty string, core API group is inferred. + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + default: Service + description: |- + Kind is the Kubernetes resource kind of the referent. For example + "Service". + + Defaults to "Service" when not specified. + + ExternalName services can refer to CNAME DNS records that may live + outside of the cluster and as such are difficult to reason about in + terms of conformance. They also may not be safe to forward to (see + CVE-2021-25740 for more information). Implementations SHOULD NOT + support ExternalName Services. + + Support: Core (Services with a type other than ExternalName) + + Support: Implementation-specific (Services with type ExternalName) + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: Name is the name of the referent. + maxLength: 253 + minLength: 1 + type: string + namespace: + description: |- + Namespace is the namespace of the backend. When unspecified, the local + namespace is inferred. + + Note that when a namespace different than the local namespace is specified, + a ReferenceGrant object is required in the referent namespace to allow that + namespace's owner to accept the reference. See the ReferenceGrant + documentation for details. + + Support: Core + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + port: + description: |- + Port specifies the destination port number to use for this resource. + Port is required when the referent is a Kubernetes Service. In this + case, the port number is the service port number, not the target port. + For other resources, destination port might be derived from the referent + resource or this field. + format: int32 + maximum: 65535 + minimum: 1 + type: integer + weight: + default: 1 + description: |- + Weight specifies the proportion of requests forwarded to the referenced + backend. This is computed as weight/(sum of all weights in this + BackendRefs list). For non-zero values, there may be some epsilon from + the exact proportion defined here depending on the precision an + implementation supports. Weight is not a percentage and the sum of + weights does not need to equal 100. + + If only one backend is specified and it has a weight greater than 0, 100% + of the traffic is forwarded to that backend. If weight is set to 0, no + traffic should be forwarded for this entry. If unspecified, weight + defaults to 1. + + Support for this field varies based on the context where used. + format: int32 + maximum: 1000000 + minimum: 0 + type: integer + required: + - name + type: object + x-kubernetes-validations: + - message: Must have port for Service reference + rule: '(size(self.group) == 0 && self.kind == ''Service'') + ? has(self.port) : true' + maxItems: 16 + type: array + filters: + description: |- + Filters define the filters that are applied to requests that match + this rule. + + Wherever possible, implementations SHOULD implement filters in the order + they are specified. + + Implementations MAY choose to implement this ordering strictly, rejecting + any combination or order of filters that can not be supported. If implementations + choose a strict interpretation of filter ordering, they MUST clearly document + that behavior. + + To reject an invalid combination or order of filters, implementations SHOULD + consider the Route Rules with this configuration invalid. If all Route Rules + in a Route are invalid, the entire Route would be considered invalid. If only + a portion of Route Rules are invalid, implementations MUST set the + "PartiallyInvalid" condition for the Route. + + Conformance-levels at this level are defined based on the type of filter: + + - ALL core filters MUST be supported by all implementations. + - Implementers are encouraged to support extended filters. + - Implementation-specific custom filters have no API guarantees across + implementations. + + Specifying the same filter multiple times is not supported unless explicitly + indicated in the filter. + + All filters are expected to be compatible with each other except for the + URLRewrite and RequestRedirect filters, which may not be combined. If an + implementation can not support other combinations of filters, they must clearly + document that limitation. In cases where incompatible or unsupported + filters are specified and cause the `Accepted` condition to be set to status + `False`, implementations may use the `IncompatibleFilters` reason to specify + this configuration error. + + Support: Core + items: + description: |- + HTTPRouteFilter defines processing steps that must be completed during the + request or response lifecycle. HTTPRouteFilters are meant as an extension + point to express processing that may be done in Gateway implementations. Some + examples include request or response modification, implementing + authentication strategies, rate-limiting, and traffic shaping. API + guarantee/conformance is defined based on the type of the filter. + properties: + extensionRef: + description: |- + ExtensionRef is an optional, implementation-specific extension to the + "filter" behavior. For example, resource "myroutefilter" in group + "networking.example.net"). ExtensionRef MUST NOT be used for core and + extended filters. + + This filter can be used multiple times within the same rule. + + Support: Implementation-specific + properties: + group: + description: |- + Group is the group of the referent. For example, "gateway.networking.k8s.io". + When unspecified or empty string, core API group is inferred. + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + description: Kind is kind of the referent. For example + "HTTPRoute" or "Service". + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: Name is the name of the referent. + maxLength: 253 + minLength: 1 + type: string + required: + - group + - kind + - name + type: object + requestHeaderModifier: + description: |- + RequestHeaderModifier defines a schema for a filter that modifies request + headers. + + Support: Core + properties: + add: + description: |- + Add adds the given header(s) (name, value) to the request + before the action. It appends to any existing values associated + with the header name. + + Input: + GET /foo HTTP/1.1 + my-header: foo + + Config: + add: + - name: "my-header" + value: "bar,baz" + + Output: + GET /foo HTTP/1.1 + my-header: foo,bar,baz + items: + description: HTTPHeader represents an HTTP Header + name and value as defined by RFC 7230. + properties: + name: + description: |- + Name is the name of the HTTP Header to be matched. Name matching MUST be + case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). + + If multiple entries specify equivalent header names, the first entry with + an equivalent name MUST be considered for a match. Subsequent entries + with an equivalent header name MUST be ignored. Due to the + case-insensitivity of header names, "foo" and "Foo" are considered + equivalent. + maxLength: 256 + minLength: 1 + pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ + type: string + value: + description: Value is the value of HTTP Header + to be matched. + maxLength: 4096 + minLength: 1 + type: string + required: + - name + - value + type: object + maxItems: 16 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + remove: + description: |- + Remove the given header(s) from the HTTP request before the action. The + value of Remove is a list of HTTP header names. Note that the header + names are case-insensitive (see + https://datatracker.ietf.org/doc/html/rfc2616#section-4.2). + + Input: + GET /foo HTTP/1.1 + my-header1: foo + my-header2: bar + my-header3: baz + + Config: + remove: ["my-header1", "my-header3"] + + Output: + GET /foo HTTP/1.1 + my-header2: bar + items: + type: string + maxItems: 16 + type: array + x-kubernetes-list-type: set + set: + description: |- + Set overwrites the request with the given header (name, value) + before the action. + + Input: + GET /foo HTTP/1.1 + my-header: foo + + Config: + set: + - name: "my-header" + value: "bar" + + Output: + GET /foo HTTP/1.1 + my-header: bar + items: + description: HTTPHeader represents an HTTP Header + name and value as defined by RFC 7230. + properties: + name: + description: |- + Name is the name of the HTTP Header to be matched. Name matching MUST be + case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). + + If multiple entries specify equivalent header names, the first entry with + an equivalent name MUST be considered for a match. Subsequent entries + with an equivalent header name MUST be ignored. Due to the + case-insensitivity of header names, "foo" and "Foo" are considered + equivalent. + maxLength: 256 + minLength: 1 + pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ + type: string + value: + description: Value is the value of HTTP Header + to be matched. + maxLength: 4096 + minLength: 1 + type: string + required: + - name + - value + type: object + maxItems: 16 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + type: object + requestMirror: + description: |+ + RequestMirror defines a schema for a filter that mirrors requests. + Requests are sent to the specified destination, but responses from + that destination are ignored. + + This filter can be used multiple times within the same rule. Note that + not all implementations will be able to support mirroring to multiple + backends. + + Support: Extended + + properties: + backendRef: + description: |- + BackendRef references a resource where mirrored requests are sent. + + Mirrored requests must be sent only to a single destination endpoint + within this BackendRef, irrespective of how many endpoints are present + within this BackendRef. + + If the referent cannot be found, this BackendRef is invalid and must be + dropped from the Gateway. The controller must ensure the "ResolvedRefs" + condition on the Route status is set to `status: False` and not configure + this backend in the underlying implementation. + + If there is a cross-namespace reference to an *existing* object + that is not allowed by a ReferenceGrant, the controller must ensure the + "ResolvedRefs" condition on the Route is set to `status: False`, + with the "RefNotPermitted" reason and not configure this backend in the + underlying implementation. + + In either error case, the Message of the `ResolvedRefs` Condition + should be used to provide more detail about the problem. + + Support: Extended for Kubernetes Service + + Support: Implementation-specific for any other resource + properties: + group: + default: "" + description: |- + Group is the group of the referent. For example, "gateway.networking.k8s.io". + When unspecified or empty string, core API group is inferred. + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + default: Service + description: |- + Kind is the Kubernetes resource kind of the referent. For example + "Service". + + Defaults to "Service" when not specified. + + ExternalName services can refer to CNAME DNS records that may live + outside of the cluster and as such are difficult to reason about in + terms of conformance. They also may not be safe to forward to (see + CVE-2021-25740 for more information). Implementations SHOULD NOT + support ExternalName Services. + + Support: Core (Services with a type other than ExternalName) + + Support: Implementation-specific (Services with type ExternalName) + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: Name is the name of the referent. + maxLength: 253 + minLength: 1 + type: string + namespace: + description: |- + Namespace is the namespace of the backend. When unspecified, the local + namespace is inferred. + + Note that when a namespace different than the local namespace is specified, + a ReferenceGrant object is required in the referent namespace to allow that + namespace's owner to accept the reference. See the ReferenceGrant + documentation for details. + + Support: Core + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + port: + description: |- + Port specifies the destination port number to use for this resource. + Port is required when the referent is a Kubernetes Service. In this + case, the port number is the service port number, not the target port. + For other resources, destination port might be derived from the referent + resource or this field. + format: int32 + maximum: 65535 + minimum: 1 + type: integer + required: + - name + type: object + x-kubernetes-validations: + - message: Must have port for Service reference + rule: '(size(self.group) == 0 && self.kind == ''Service'') + ? has(self.port) : true' + required: + - backendRef + type: object + requestRedirect: + description: |- + RequestRedirect defines a schema for a filter that responds to the + request with an HTTP redirection. + + Support: Core + properties: + hostname: + description: |- + Hostname is the hostname to be used in the value of the `Location` + header in the response. + When empty, the hostname in the `Host` header of the request is used. + + Support: Core + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + path: + description: |- + Path defines parameters used to modify the path of the incoming request. + The modified path is then used to construct the `Location` header. When + empty, the request path is used as-is. + + Support: Extended + properties: + replaceFullPath: + description: |- + ReplaceFullPath specifies the value with which to replace the full path + of a request during a rewrite or redirect. + maxLength: 1024 + type: string + replacePrefixMatch: + description: |- + ReplacePrefixMatch specifies the value with which to replace the prefix + match of a request during a rewrite or redirect. For example, a request + to "/foo/bar" with a prefix match of "/foo" and a ReplacePrefixMatch + of "/xyz" would be modified to "/xyz/bar". + + Note that this matches the behavior of the PathPrefix match type. This + matches full path elements. A path element refers to the list of labels + in the path split by the `/` separator. When specified, a trailing `/` is + ignored. For example, the paths `/abc`, `/abc/`, and `/abc/def` would all + match the prefix `/abc`, but the path `/abcd` would not. + + ReplacePrefixMatch is only compatible with a `PathPrefix` HTTPRouteMatch. + Using any other HTTPRouteMatch type on the same HTTPRouteRule will result in + the implementation setting the Accepted Condition for the Route to `status: False`. + + Request Path | Prefix Match | Replace Prefix | Modified Path + maxLength: 1024 + type: string + type: + description: |- + Type defines the type of path modifier. Additional types may be + added in a future release of the API. + + Note that values may be added to this enum, implementations + must ensure that unknown values will not cause a crash. + + Unknown values here must result in the implementation setting the + Accepted Condition for the Route to `status: False`, with a + Reason of `UnsupportedValue`. + enum: + - ReplaceFullPath + - ReplacePrefixMatch + type: string + required: + - type + type: object + x-kubernetes-validations: + - message: replaceFullPath must be specified when + type is set to 'ReplaceFullPath' + rule: 'self.type == ''ReplaceFullPath'' ? has(self.replaceFullPath) + : true' + - message: type must be 'ReplaceFullPath' when replaceFullPath + is set + rule: 'has(self.replaceFullPath) ? self.type == + ''ReplaceFullPath'' : true' + - message: replacePrefixMatch must be specified when + type is set to 'ReplacePrefixMatch' + rule: 'self.type == ''ReplacePrefixMatch'' ? has(self.replacePrefixMatch) + : true' + - message: type must be 'ReplacePrefixMatch' when + replacePrefixMatch is set + rule: 'has(self.replacePrefixMatch) ? self.type + == ''ReplacePrefixMatch'' : true' + port: + description: |- + Port is the port to be used in the value of the `Location` + header in the response. + + If no port is specified, the redirect port MUST be derived using the + following rules: + + * If redirect scheme is not-empty, the redirect port MUST be the well-known + port associated with the redirect scheme. Specifically "http" to port 80 + and "https" to port 443. If the redirect scheme does not have a + well-known port, the listener port of the Gateway SHOULD be used. + * If redirect scheme is empty, the redirect port MUST be the Gateway + Listener port. + + Implementations SHOULD NOT add the port number in the 'Location' + header in the following cases: + + * A Location header that will use HTTP (whether that is determined via + the Listener protocol or the Scheme field) _and_ use port 80. + * A Location header that will use HTTPS (whether that is determined via + the Listener protocol or the Scheme field) _and_ use port 443. + + Support: Extended + format: int32 + maximum: 65535 + minimum: 1 + type: integer + scheme: + description: |- + Scheme is the scheme to be used in the value of the `Location` header in + the response. When empty, the scheme of the request is used. + + Scheme redirects can affect the port of the redirect, for more information, + refer to the documentation for the port field of this filter. + + Note that values may be added to this enum, implementations + must ensure that unknown values will not cause a crash. + + Unknown values here must result in the implementation setting the + Accepted Condition for the Route to `status: False`, with a + Reason of `UnsupportedValue`. + + Support: Extended + enum: + - http + - https + type: string + statusCode: + default: 302 + description: |- + StatusCode is the HTTP status code to be used in response. + + Note that values may be added to this enum, implementations + must ensure that unknown values will not cause a crash. + + Unknown values here must result in the implementation setting the + Accepted Condition for the Route to `status: False`, with a + Reason of `UnsupportedValue`. + + Support: Core + enum: + - 301 + - 302 + type: integer + type: object + responseHeaderModifier: + description: |- + ResponseHeaderModifier defines a schema for a filter that modifies response + headers. + + Support: Extended + properties: + add: + description: |- + Add adds the given header(s) (name, value) to the request + before the action. It appends to any existing values associated + with the header name. + + Input: + GET /foo HTTP/1.1 + my-header: foo + + Config: + add: + - name: "my-header" + value: "bar,baz" + + Output: + GET /foo HTTP/1.1 + my-header: foo,bar,baz + items: + description: HTTPHeader represents an HTTP Header + name and value as defined by RFC 7230. + properties: + name: + description: |- + Name is the name of the HTTP Header to be matched. Name matching MUST be + case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). + + If multiple entries specify equivalent header names, the first entry with + an equivalent name MUST be considered for a match. Subsequent entries + with an equivalent header name MUST be ignored. Due to the + case-insensitivity of header names, "foo" and "Foo" are considered + equivalent. + maxLength: 256 + minLength: 1 + pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ + type: string + value: + description: Value is the value of HTTP Header + to be matched. + maxLength: 4096 + minLength: 1 + type: string + required: + - name + - value + type: object + maxItems: 16 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + remove: + description: |- + Remove the given header(s) from the HTTP request before the action. The + value of Remove is a list of HTTP header names. Note that the header + names are case-insensitive (see + https://datatracker.ietf.org/doc/html/rfc2616#section-4.2). + + Input: + GET /foo HTTP/1.1 + my-header1: foo + my-header2: bar + my-header3: baz + + Config: + remove: ["my-header1", "my-header3"] + + Output: + GET /foo HTTP/1.1 + my-header2: bar + items: + type: string + maxItems: 16 + type: array + x-kubernetes-list-type: set + set: + description: |- + Set overwrites the request with the given header (name, value) + before the action. + + Input: + GET /foo HTTP/1.1 + my-header: foo + + Config: + set: + - name: "my-header" + value: "bar" + + Output: + GET /foo HTTP/1.1 + my-header: bar + items: + description: HTTPHeader represents an HTTP Header + name and value as defined by RFC 7230. + properties: + name: + description: |- + Name is the name of the HTTP Header to be matched. Name matching MUST be + case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). + + If multiple entries specify equivalent header names, the first entry with + an equivalent name MUST be considered for a match. Subsequent entries + with an equivalent header name MUST be ignored. Due to the + case-insensitivity of header names, "foo" and "Foo" are considered + equivalent. + maxLength: 256 + minLength: 1 + pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ + type: string + value: + description: Value is the value of HTTP Header + to be matched. + maxLength: 4096 + minLength: 1 + type: string + required: + - name + - value + type: object + maxItems: 16 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + type: object + type: + description: |- + Type identifies the type of filter to apply. As with other API fields, + types are classified into three conformance levels: + + - Core: Filter types and their corresponding configuration defined by + "Support: Core" in this package, e.g. "RequestHeaderModifier". All + implementations must support core filters. + + - Extended: Filter types and their corresponding configuration defined by + "Support: Extended" in this package, e.g. "RequestMirror". Implementers + are encouraged to support extended filters. + + - Implementation-specific: Filters that are defined and supported by + specific vendors. + In the future, filters showing convergence in behavior across multiple + implementations will be considered for inclusion in extended or core + conformance levels. Filter-specific configuration for such filters + is specified using the ExtensionRef field. `Type` should be set to + "ExtensionRef" for custom filters. + + Implementers are encouraged to define custom implementation types to + extend the core API with implementation-specific behavior. + + If a reference to a custom filter type cannot be resolved, the filter + MUST NOT be skipped. Instead, requests that would have been processed by + that filter MUST receive a HTTP error response. + + Note that values may be added to this enum, implementations + must ensure that unknown values will not cause a crash. + + Unknown values here must result in the implementation setting the + Accepted Condition for the Route to `status: False`, with a + Reason of `UnsupportedValue`. + enum: + - RequestHeaderModifier + - ResponseHeaderModifier + - RequestMirror + - RequestRedirect + - URLRewrite + - ExtensionRef + type: string + urlRewrite: + description: |- + URLRewrite defines a schema for a filter that modifies a request during forwarding. + + Support: Extended + properties: + hostname: + description: |- + Hostname is the value to be used to replace the Host header value during + forwarding. + + Support: Extended + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + path: + description: |- + Path defines a path rewrite. + + Support: Extended + properties: + replaceFullPath: + description: |- + ReplaceFullPath specifies the value with which to replace the full path + of a request during a rewrite or redirect. + maxLength: 1024 + type: string + replacePrefixMatch: + description: |- + ReplacePrefixMatch specifies the value with which to replace the prefix + match of a request during a rewrite or redirect. For example, a request + to "/foo/bar" with a prefix match of "/foo" and a ReplacePrefixMatch + of "/xyz" would be modified to "/xyz/bar". + + Note that this matches the behavior of the PathPrefix match type. This + matches full path elements. A path element refers to the list of labels + in the path split by the `/` separator. When specified, a trailing `/` is + ignored. For example, the paths `/abc`, `/abc/`, and `/abc/def` would all + match the prefix `/abc`, but the path `/abcd` would not. + + ReplacePrefixMatch is only compatible with a `PathPrefix` HTTPRouteMatch. + Using any other HTTPRouteMatch type on the same HTTPRouteRule will result in + the implementation setting the Accepted Condition for the Route to `status: False`. + + Request Path | Prefix Match | Replace Prefix | Modified Path + maxLength: 1024 + type: string + type: + description: |- + Type defines the type of path modifier. Additional types may be + added in a future release of the API. + + Note that values may be added to this enum, implementations + must ensure that unknown values will not cause a crash. + + Unknown values here must result in the implementation setting the + Accepted Condition for the Route to `status: False`, with a + Reason of `UnsupportedValue`. + enum: + - ReplaceFullPath + - ReplacePrefixMatch + type: string + required: + - type + type: object + x-kubernetes-validations: + - message: replaceFullPath must be specified when + type is set to 'ReplaceFullPath' + rule: 'self.type == ''ReplaceFullPath'' ? has(self.replaceFullPath) + : true' + - message: type must be 'ReplaceFullPath' when replaceFullPath + is set + rule: 'has(self.replaceFullPath) ? self.type == + ''ReplaceFullPath'' : true' + - message: replacePrefixMatch must be specified when + type is set to 'ReplacePrefixMatch' + rule: 'self.type == ''ReplacePrefixMatch'' ? has(self.replacePrefixMatch) + : true' + - message: type must be 'ReplacePrefixMatch' when + replacePrefixMatch is set + rule: 'has(self.replacePrefixMatch) ? self.type + == ''ReplacePrefixMatch'' : true' + type: object + required: + - type + type: object + x-kubernetes-validations: + - message: filter.requestHeaderModifier must be nil if the + filter.type is not RequestHeaderModifier + rule: '!(has(self.requestHeaderModifier) && self.type != + ''RequestHeaderModifier'')' + - message: filter.requestHeaderModifier must be specified + for RequestHeaderModifier filter.type + rule: '!(!has(self.requestHeaderModifier) && self.type == + ''RequestHeaderModifier'')' + - message: filter.responseHeaderModifier must be nil if the + filter.type is not ResponseHeaderModifier + rule: '!(has(self.responseHeaderModifier) && self.type != + ''ResponseHeaderModifier'')' + - message: filter.responseHeaderModifier must be specified + for ResponseHeaderModifier filter.type + rule: '!(!has(self.responseHeaderModifier) && self.type + == ''ResponseHeaderModifier'')' + - message: filter.requestMirror must be nil if the filter.type + is not RequestMirror + rule: '!(has(self.requestMirror) && self.type != ''RequestMirror'')' + - message: filter.requestMirror must be specified for RequestMirror + filter.type + rule: '!(!has(self.requestMirror) && self.type == ''RequestMirror'')' + - message: filter.requestRedirect must be nil if the filter.type + is not RequestRedirect + rule: '!(has(self.requestRedirect) && self.type != ''RequestRedirect'')' + - message: filter.requestRedirect must be specified for RequestRedirect + filter.type + rule: '!(!has(self.requestRedirect) && self.type == ''RequestRedirect'')' + - message: filter.urlRewrite must be nil if the filter.type + is not URLRewrite + rule: '!(has(self.urlRewrite) && self.type != ''URLRewrite'')' + - message: filter.urlRewrite must be specified for URLRewrite + filter.type + rule: '!(!has(self.urlRewrite) && self.type == ''URLRewrite'')' + - message: filter.extensionRef must be nil if the filter.type + is not ExtensionRef + rule: '!(has(self.extensionRef) && self.type != ''ExtensionRef'')' + - message: filter.extensionRef must be specified for ExtensionRef + filter.type + rule: '!(!has(self.extensionRef) && self.type == ''ExtensionRef'')' + maxItems: 16 + type: array + x-kubernetes-validations: + - message: May specify either httpRouteFilterRequestRedirect + or httpRouteFilterRequestRewrite, but not both + rule: '!(self.exists(f, f.type == ''RequestRedirect'') && + self.exists(f, f.type == ''URLRewrite''))' + - message: RequestHeaderModifier filter cannot be repeated + rule: self.filter(f, f.type == 'RequestHeaderModifier').size() + <= 1 + - message: ResponseHeaderModifier filter cannot be repeated + rule: self.filter(f, f.type == 'ResponseHeaderModifier').size() + <= 1 + - message: RequestRedirect filter cannot be repeated + rule: self.filter(f, f.type == 'RequestRedirect').size() <= + 1 + - message: URLRewrite filter cannot be repeated + rule: self.filter(f, f.type == 'URLRewrite').size() <= 1 + matches: + default: + - path: + type: PathPrefix + value: / + description: |- + Matches define conditions used for matching the rule against incoming + HTTP requests. Each match is independent, i.e. this rule will be matched + if **any** one of the matches is satisfied. + + For example, take the following matches configuration: + + ``` + matches: + - path: + value: "/foo" + headers: + - name: "version" + value: "v2" + - path: + value: "/v2/foo" + ``` + + For a request to match against this rule, a request must satisfy + EITHER of the two conditions: + + - path prefixed with `/foo` AND contains the header `version: v2` + - path prefix of `/v2/foo` + + See the documentation for HTTPRouteMatch on how to specify multiple + match conditions that should be ANDed together. + + If no matches are specified, the default is a prefix + path match on "/", which has the effect of matching every + HTTP request. + + Proxy or Load Balancer routing configuration generated from HTTPRoutes + MUST prioritize matches based on the following criteria, continuing on + ties. Across all rules specified on applicable Routes, precedence must be + given to the match having: + + * "Exact" path match. + * "Prefix" path match with largest number of characters. + * Method match. + * Largest number of header matches. + * Largest number of query param matches. + + Note: The precedence of RegularExpression path matches are implementation-specific. + + If ties still exist across multiple Routes, matching precedence MUST be + determined in order of the following criteria, continuing on ties: + + * The oldest Route based on creation timestamp. + * The Route appearing first in alphabetical order by + "{namespace}/{name}". + + If ties still exist within an HTTPRoute, matching precedence MUST be granted + to the FIRST matching rule (in list order) with a match meeting the above + criteria. + + When no rules matching a request have been successfully attached to the + parent a request is coming from, a HTTP 404 status code MUST be returned. + items: + description: "HTTPRouteMatch defines the predicate used to + match requests to a given\naction. Multiple match types + are ANDed together, i.e. the match will\nevaluate to true + only if all conditions are satisfied.\n\nFor example, the + match below will match a HTTP request only if its path\nstarts + with `/foo` AND it contains the `version: v1` header:\n\n```\nmatch:\n\n\tpath:\n\t + \ value: \"/foo\"\n\theaders:\n\t- name: \"version\"\n\t + \ value \"v1\"\n\n```" + properties: + headers: + description: |- + Headers specifies HTTP request header matchers. Multiple match values are + ANDed together, meaning, a request must match all the specified headers + to select the route. + items: + description: |- + HTTPHeaderMatch describes how to select a HTTP route by matching HTTP request + headers. + properties: + name: + description: |- + Name is the name of the HTTP Header to be matched. Name matching MUST be + case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). + + If multiple entries specify equivalent header names, only the first + entry with an equivalent name MUST be considered for a match. Subsequent + entries with an equivalent header name MUST be ignored. Due to the + case-insensitivity of header names, "foo" and "Foo" are considered + equivalent. + + When a header is repeated in an HTTP request, it is + implementation-specific behavior as to how this is represented. + Generally, proxies should follow the guidance from the RFC: + https://www.rfc-editor.org/rfc/rfc7230.html#section-3.2.2 regarding + processing a repeated header, with special handling for "Set-Cookie". + maxLength: 256 + minLength: 1 + pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ + type: string + type: + default: Exact + description: |- + Type specifies how to match against the value of the header. + + Support: Core (Exact) + + Support: Implementation-specific (RegularExpression) + + Since RegularExpression HeaderMatchType has implementation-specific + conformance, implementations can support POSIX, PCRE or any other dialects + of regular expressions. Please read the implementation's documentation to + determine the supported dialect. + enum: + - Exact + - RegularExpression + type: string + value: + description: Value is the value of HTTP Header to + be matched. + maxLength: 4096 + minLength: 1 + type: string + required: + - name + - value + type: object + maxItems: 16 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + method: + description: |- + Method specifies HTTP method matcher. + When specified, this route will be matched only if the request has the + specified method. + + Support: Extended + enum: + - GET + - HEAD + - POST + - PUT + - DELETE + - CONNECT + - OPTIONS + - TRACE + - PATCH + type: string + path: + default: + type: PathPrefix + value: / + description: |- + Path specifies a HTTP request path matcher. If this field is not + specified, a default prefix match on the "/" path is provided. + properties: + type: + default: PathPrefix + description: |- + Type specifies how to match against the path Value. + + Support: Core (Exact, PathPrefix) + + Support: Implementation-specific (RegularExpression) + enum: + - Exact + - PathPrefix + - RegularExpression + type: string + value: + default: / + description: Value of the HTTP path to match against. + maxLength: 1024 + type: string + type: object + x-kubernetes-validations: + - message: value must be an absolute path and start with + '/' when type one of ['Exact', 'PathPrefix'] + rule: '(self.type in [''Exact'',''PathPrefix'']) ? self.value.startsWith(''/'') + : true' + - message: must not contain '//' when type one of ['Exact', + 'PathPrefix'] + rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.contains(''//'') + : true' + - message: must not contain '/./' when type one of ['Exact', + 'PathPrefix'] + rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.contains(''/./'') + : true' + - message: must not contain '/../' when type one of ['Exact', + 'PathPrefix'] + rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.contains(''/../'') + : true' + - message: must not contain '%2f' when type one of ['Exact', + 'PathPrefix'] + rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.contains(''%2f'') + : true' + - message: must not contain '%2F' when type one of ['Exact', + 'PathPrefix'] + rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.contains(''%2F'') + : true' + - message: must not contain '#' when type one of ['Exact', + 'PathPrefix'] + rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.contains(''#'') + : true' + - message: must not end with '/..' when type one of ['Exact', + 'PathPrefix'] + rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.endsWith(''/..'') + : true' + - message: must not end with '/.' when type one of ['Exact', + 'PathPrefix'] + rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.endsWith(''/.'') + : true' + - message: type must be one of ['Exact', 'PathPrefix', + 'RegularExpression'] + rule: self.type in ['Exact','PathPrefix'] || self.type + == 'RegularExpression' + - message: must only contain valid characters (matching + ^(?:[-A-Za-z0-9/._~!$&'()*+,;=:@]|[%][0-9a-fA-F]{2})+$) + for types ['Exact', 'PathPrefix'] + rule: '(self.type in [''Exact'',''PathPrefix'']) ? self.value.matches(r"""^(?:[-A-Za-z0-9/._~!$&''()*+,;=:@]|[%][0-9a-fA-F]{2})+$""") + : true' + queryParams: + description: |- + QueryParams specifies HTTP query parameter matchers. Multiple match + values are ANDed together, meaning, a request must match all the + specified query parameters to select the route. + + Support: Extended + items: + description: |- + HTTPQueryParamMatch describes how to select a HTTP route by matching HTTP + query parameters. + properties: + name: + description: |- + Name is the name of the HTTP query param to be matched. This must be an + exact string match. (See + https://tools.ietf.org/html/rfc7230#section-2.7.3). + + If multiple entries specify equivalent query param names, only the first + entry with an equivalent name MUST be considered for a match. Subsequent + entries with an equivalent query param name MUST be ignored. + + If a query param is repeated in an HTTP request, the behavior is + purposely left undefined, since different data planes have different + capabilities. However, it is *recommended* that implementations should + match against the first value of the param if the data plane supports it, + as this behavior is expected in other load balancing contexts outside of + the Gateway API. + + Users SHOULD NOT route traffic based on repeated query params to guard + themselves against potential differences in the implementations. + maxLength: 256 + minLength: 1 + pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ + type: string + type: + default: Exact + description: |- + Type specifies how to match against the value of the query parameter. + + Support: Extended (Exact) + + Support: Implementation-specific (RegularExpression) + + Since RegularExpression QueryParamMatchType has Implementation-specific + conformance, implementations can support POSIX, PCRE or any other + dialects of regular expressions. Please read the implementation's + documentation to determine the supported dialect. + enum: + - Exact + - RegularExpression + type: string + value: + description: Value is the value of HTTP query param + to be matched. + maxLength: 1024 + minLength: 1 + type: string + required: + - name + - value + type: object + maxItems: 16 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + type: object + maxItems: 64 + type: array + timeouts: + description: |- + Timeouts defines the timeouts that can be configured for an HTTP request. + + Support: Extended + properties: + backendRequest: + description: |- + BackendRequest specifies a timeout for an individual request from the gateway + to a backend. This covers the time from when the request first starts being + sent from the gateway to when the full response has been received from the backend. + + Setting a timeout to the zero duration (e.g. "0s") SHOULD disable the timeout + completely. Implementations that cannot completely disable the timeout MUST + instead interpret the zero duration as the longest possible value to which + the timeout can be set. + + An entire client HTTP transaction with a gateway, covered by the Request timeout, + may result in more than one call from the gateway to the destination backend, + for example, if automatic retries are supported. + + The value of BackendRequest must be a Gateway API Duration string as defined by + GEP-2257. When this field is unspecified, its behavior is implementation-specific; + when specified, the value of BackendRequest must be no more than the value of the + Request timeout (since the Request timeout encompasses the BackendRequest timeout). + + Support: Extended + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string + request: + description: |- + Request specifies the maximum duration for a gateway to respond to an HTTP request. + If the gateway has not been able to respond before this deadline is met, the gateway + MUST return a timeout error. + + For example, setting the `rules.timeouts.request` field to the value `10s` in an + `HTTPRoute` will cause a timeout if a client request is taking longer than 10 seconds + to complete. + + Setting a timeout to the zero duration (e.g. "0s") SHOULD disable the timeout + completely. Implementations that cannot completely disable the timeout MUST + instead interpret the zero duration as the longest possible value to which + the timeout can be set. + + This timeout is intended to cover as close to the whole request-response transaction + as possible although an implementation MAY choose to start the timeout after the entire + request stream has been received instead of immediately after the transaction is + initiated by the client. + + The value of Request is a Gateway API Duration string as defined by GEP-2257. When this + field is unspecified, request timeout behavior is implementation-specific. + + Support: Extended + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string + type: object + x-kubernetes-validations: + - message: backendRequest timeout cannot be longer than request + timeout + rule: '!(has(self.request) && has(self.backendRequest) && + duration(self.request) != duration(''0s'') && duration(self.backendRequest) + > duration(self.request))' + type: object + x-kubernetes-validations: + - message: RequestRedirect filter must not be used together with + backendRefs + rule: '(has(self.backendRefs) && size(self.backendRefs) > 0) ? + (!has(self.filters) || self.filters.all(f, !has(f.requestRedirect))): + true' + - message: When using RequestRedirect filter with path.replacePrefixMatch, + exactly one PathPrefix match must be specified + rule: '(has(self.filters) && self.filters.exists_one(f, has(f.requestRedirect) + && has(f.requestRedirect.path) && f.requestRedirect.path.type + == ''ReplacePrefixMatch'' && has(f.requestRedirect.path.replacePrefixMatch))) + ? ((size(self.matches) != 1 || !has(self.matches[0].path) || + self.matches[0].path.type != ''PathPrefix'') ? false : true) + : true' + - message: When using URLRewrite filter with path.replacePrefixMatch, + exactly one PathPrefix match must be specified + rule: '(has(self.filters) && self.filters.exists_one(f, has(f.urlRewrite) + && has(f.urlRewrite.path) && f.urlRewrite.path.type == ''ReplacePrefixMatch'' + && has(f.urlRewrite.path.replacePrefixMatch))) ? ((size(self.matches) + != 1 || !has(self.matches[0].path) || self.matches[0].path.type + != ''PathPrefix'') ? false : true) : true' + - message: Within backendRefs, when using RequestRedirect filter + with path.replacePrefixMatch, exactly one PathPrefix match must + be specified + rule: '(has(self.backendRefs) && self.backendRefs.exists_one(b, + (has(b.filters) && b.filters.exists_one(f, has(f.requestRedirect) + && has(f.requestRedirect.path) && f.requestRedirect.path.type + == ''ReplacePrefixMatch'' && has(f.requestRedirect.path.replacePrefixMatch))) + )) ? ((size(self.matches) != 1 || !has(self.matches[0].path) + || self.matches[0].path.type != ''PathPrefix'') ? false : true) + : true' + - message: Within backendRefs, When using URLRewrite filter with + path.replacePrefixMatch, exactly one PathPrefix match must be + specified + rule: '(has(self.backendRefs) && self.backendRefs.exists_one(b, + (has(b.filters) && b.filters.exists_one(f, has(f.urlRewrite) + && has(f.urlRewrite.path) && f.urlRewrite.path.type == ''ReplacePrefixMatch'' + && has(f.urlRewrite.path.replacePrefixMatch))) )) ? ((size(self.matches) + != 1 || !has(self.matches[0].path) || self.matches[0].path.type + != ''PathPrefix'') ? false : true) : true' + maxItems: 16 + type: array + x-kubernetes-validations: + - message: While 16 rules and 64 matches per rule are allowed, the + total number of matches across all rules in a route must be less + than 128 + rule: '(self.size() > 0 ? self[0].matches.size() : 0) + (self.size() + > 1 ? self[1].matches.size() : 0) + (self.size() > 2 ? self[2].matches.size() + : 0) + (self.size() > 3 ? self[3].matches.size() : 0) + (self.size() + > 4 ? self[4].matches.size() : 0) + (self.size() > 5 ? self[5].matches.size() + : 0) + (self.size() > 6 ? self[6].matches.size() : 0) + (self.size() + > 7 ? self[7].matches.size() : 0) + (self.size() > 8 ? self[8].matches.size() + : 0) + (self.size() > 9 ? self[9].matches.size() : 0) + (self.size() + > 10 ? self[10].matches.size() : 0) + (self.size() > 11 ? self[11].matches.size() + : 0) + (self.size() > 12 ? self[12].matches.size() : 0) + (self.size() + > 13 ? self[13].matches.size() : 0) + (self.size() > 14 ? self[14].matches.size() + : 0) + (self.size() > 15 ? self[15].matches.size() : 0) <= 128' + type: object + status: + description: Status defines the current state of HTTPRoute. + properties: + parents: + description: |- + Parents is a list of parent resources (usually Gateways) that are + associated with the route, and the status of the route with respect to + each parent. When this route attaches to a parent, the controller that + manages the parent must add an entry to this list when the controller + first sees the route and should update the entry as appropriate when the + route or gateway is modified. + + Note that parent references that cannot be resolved by an implementation + of this API will not be added to this list. Implementations of this API + can only populate Route status for the Gateways/parent resources they are + responsible for. + + A maximum of 32 Gateways will be represented in this list. An empty list + means the route has not been attached to any Gateway. + items: + description: |- + RouteParentStatus describes the status of a route with respect to an + associated Parent. + properties: + conditions: + description: |- + Conditions describes the status of the route with respect to the Gateway. + Note that the route's availability is also subject to the Gateway's own + status conditions and listener status. + + If the Route's ParentRef specifies an existing Gateway that supports + Routes of this kind AND that Gateway's controller has sufficient access, + then that Gateway's controller MUST set the "Accepted" condition on the + Route, to indicate whether the route has been accepted or rejected by the + Gateway, and why. + + A Route MUST be considered "Accepted" if at least one of the Route's + rules is implemented by the Gateway. + + There are a number of cases where the "Accepted" condition may not be set + due to lack of controller visibility, that includes when: + + * The Route refers to a non-existent parent. + * The Route is of a type that the controller does not support. + * The Route is in a namespace the controller does not have access to. + items: + description: Condition contains details for one aspect of + the current state of this API Resource. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, + Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + maxItems: 8 + minItems: 1 + type: array + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + controllerName: + description: |- + ControllerName is a domain/path string that indicates the name of the + controller that wrote this status. This corresponds with the + controllerName field on GatewayClass. + + Example: "example.net/gateway-controller". + + The format of this field is DOMAIN "/" PATH, where DOMAIN and PATH are + valid Kubernetes names + (https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names). + + Controllers MUST populate this field when writing status. Controllers should ensure that + entries to status populated with their ControllerName are cleaned up when they are no + longer necessary. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$ + type: string + parentRef: + description: |- + ParentRef corresponds with a ParentRef in the spec that this + RouteParentStatus struct describes the status of. + properties: + group: + default: gateway.networking.k8s.io + description: |- + Group is the group of the referent. + When unspecified, "gateway.networking.k8s.io" is inferred. + To set the core API group (such as for a "Service" kind referent), + Group must be explicitly set to "" (empty string). + + Support: Core + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + default: Gateway + description: |- + Kind is kind of the referent. + + There are two kinds of parent resources with "Core" support: + + * Gateway (Gateway conformance profile) + * Service (Mesh conformance profile, ClusterIP Services only) + + Support for other resources is Implementation-Specific. + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: |- + Name is the name of the referent. + + Support: Core + maxLength: 253 + minLength: 1 + type: string + namespace: + description: |- + Namespace is the namespace of the referent. When unspecified, this refers + to the local namespace of the Route. + + Note that there are specific rules for ParentRefs which cross namespace + boundaries. Cross-namespace references are only valid if they are explicitly + allowed by something in the namespace they are referring to. For example: + Gateway has the AllowedRoutes field, and ReferenceGrant provides a + generic way to enable any other kind of cross-namespace reference. + + + + Support: Core + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + port: + description: |- + Port is the network port this Route targets. It can be interpreted + differently based on the type of parent resource. + + When the parent resource is a Gateway, this targets all listeners + listening on the specified port that also support this kind of Route(and + select this Route). It's not recommended to set `Port` unless the + networking behaviors specified in a Route must apply to a specific port + as opposed to a listener(s) whose port(s) may be changed. When both Port + and SectionName are specified, the name and port of the selected listener + must match both specified values. + + + + Implementations MAY choose to support other parent resources. + Implementations supporting other types of parent resources MUST clearly + document how/if Port is interpreted. + + For the purpose of status, an attachment is considered successful as + long as the parent resource accepts it partially. For example, Gateway + listeners can restrict which Routes can attach to them by Route kind, + namespace, or hostname. If 1 of 2 Gateway listeners accept attachment + from the referencing Route, the Route MUST be considered successfully + attached. If no Gateway listeners accept attachment from this Route, + the Route MUST be considered detached from the Gateway. + + Support: Extended + format: int32 + maximum: 65535 + minimum: 1 + type: integer + sectionName: + description: |- + SectionName is the name of a section within the target resource. In the + following resources, SectionName is interpreted as the following: + + * Gateway: Listener name. When both Port (experimental) and SectionName + are specified, the name and port of the selected listener must match + both specified values. + * Service: Port name. When both Port (experimental) and SectionName + are specified, the name and port of the selected listener must match + both specified values. + + Implementations MAY choose to support attaching Routes to other resources. + If that is the case, they MUST clearly document how SectionName is + interpreted. + + When unspecified (empty string), this will reference the entire resource. + For the purpose of status, an attachment is considered successful if at + least one section in the parent resource accepts it. For example, Gateway + listeners can restrict which Routes can attach to them by Route kind, + namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from + the referencing Route, the Route MUST be considered successfully + attached. If no Gateway listeners accept attachment from this Route, the + Route MUST be considered detached from the Gateway. + + Support: Core + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + required: + - name + type: object + required: + - controllerName + - parentRef + type: object + maxItems: 32 + type: array + required: + - parents + type: object + required: + - spec + type: object + served: true + storage: true + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .spec.hostnames + name: Hostnames + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1beta1 + schema: + openAPIV3Schema: + description: |- + HTTPRoute provides a way to route HTTP requests. This includes the capability + to match requests by hostname, path, header, or query param. Filters can be + used to specify additional processing steps. Backends specify where matching + requests should be routed. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: Spec defines the desired state of HTTPRoute. + properties: + hostnames: + description: |- + Hostnames defines a set of hostnames that should match against the HTTP Host + header to select a HTTPRoute used to process the request. Implementations + MUST ignore any port value specified in the HTTP Host header while + performing a match and (absent of any applicable header modification + configuration) MUST forward this header unmodified to the backend. + + Valid values for Hostnames are determined by RFC 1123 definition of a + hostname with 2 notable exceptions: + + 1. IPs are not allowed. + 2. A hostname may be prefixed with a wildcard label (`*.`). The wildcard + label must appear by itself as the first label. + + If a hostname is specified by both the Listener and HTTPRoute, there + must be at least one intersecting hostname for the HTTPRoute to be + attached to the Listener. For example: + + * A Listener with `test.example.com` as the hostname matches HTTPRoutes + that have either not specified any hostnames, or have specified at + least one of `test.example.com` or `*.example.com`. + * A Listener with `*.example.com` as the hostname matches HTTPRoutes + that have either not specified any hostnames or have specified at least + one hostname that matches the Listener hostname. For example, + `*.example.com`, `test.example.com`, and `foo.test.example.com` would + all match. On the other hand, `example.com` and `test.example.net` would + not match. + + Hostnames that are prefixed with a wildcard label (`*.`) are interpreted + as a suffix match. That means that a match for `*.example.com` would match + both `test.example.com`, and `foo.test.example.com`, but not `example.com`. + + If both the Listener and HTTPRoute have specified hostnames, any + HTTPRoute hostnames that do not match the Listener hostname MUST be + ignored. For example, if a Listener specified `*.example.com`, and the + HTTPRoute specified `test.example.com` and `test.example.net`, + `test.example.net` must not be considered for a match. + + If both the Listener and HTTPRoute have specified hostnames, and none + match with the criteria above, then the HTTPRoute is not accepted. The + implementation must raise an 'Accepted' Condition with a status of + `False` in the corresponding RouteParentStatus. + + In the event that multiple HTTPRoutes specify intersecting hostnames (e.g. + overlapping wildcard matching and exact matching hostnames), precedence must + be given to rules from the HTTPRoute with the largest number of: + + * Characters in a matching non-wildcard hostname. + * Characters in a matching hostname. + + If ties exist across multiple Routes, the matching precedence rules for + HTTPRouteMatches takes over. + + Support: Core + items: + description: |- + Hostname is the fully qualified domain name of a network host. This matches + the RFC 1123 definition of a hostname with 2 notable exceptions: + + 1. IPs are not allowed. + 2. A hostname may be prefixed with a wildcard label (`*.`). The wildcard + label must appear by itself as the first label. + + Hostname can be "precise" which is a domain name without the terminating + dot of a network host (e.g. "foo.example.com") or "wildcard", which is a + domain name prefixed with a single wildcard label (e.g. `*.example.com`). + + Note that as per RFC1035 and RFC1123, a *label* must consist of lower case + alphanumeric characters or '-', and must start and end with an alphanumeric + character. No other punctuation is allowed. + maxLength: 253 + minLength: 1 + pattern: ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + maxItems: 16 + type: array + parentRefs: + description: |+ + ParentRefs references the resources (usually Gateways) that a Route wants + to be attached to. Note that the referenced parent resource needs to + allow this for the attachment to be complete. For Gateways, that means + the Gateway needs to allow attachment from Routes of this kind and + namespace. For Services, that means the Service must either be in the same + namespace for a "producer" route, or the mesh implementation must support + and allow "consumer" routes for the referenced Service. ReferenceGrant is + not applicable for governing ParentRefs to Services - it is not possible to + create a "producer" route for a Service in a different namespace from the + Route. + + There are two kinds of parent resources with "Core" support: + + * Gateway (Gateway conformance profile) + * Service (Mesh conformance profile, ClusterIP Services only) + + This API may be extended in the future to support additional kinds of parent + resources. + + ParentRefs must be _distinct_. This means either that: + + * They select different objects. If this is the case, then parentRef + entries are distinct. In terms of fields, this means that the + multi-part key defined by `group`, `kind`, `namespace`, and `name` must + be unique across all parentRef entries in the Route. + * They do not select different objects, but for each optional field used, + each ParentRef that selects the same object must set the same set of + optional fields to different values. If one ParentRef sets a + combination of optional fields, all must set the same combination. + + Some examples: + + * If one ParentRef sets `sectionName`, all ParentRefs referencing the + same object must also set `sectionName`. + * If one ParentRef sets `port`, all ParentRefs referencing the same + object must also set `port`. + * If one ParentRef sets `sectionName` and `port`, all ParentRefs + referencing the same object must also set `sectionName` and `port`. + + It is possible to separately reference multiple distinct objects that may + be collapsed by an implementation. For example, some implementations may + choose to merge compatible Gateway Listeners together. If that is the + case, the list of routes attached to those resources should also be + merged. + + Note that for ParentRefs that cross namespace boundaries, there are specific + rules. Cross-namespace references are only valid if they are explicitly + allowed by something in the namespace they are referring to. For example, + Gateway has the AllowedRoutes field, and ReferenceGrant provides a + generic way to enable other kinds of cross-namespace reference. + + + + + + + items: + description: |- + ParentReference identifies an API object (usually a Gateway) that can be considered + a parent of this resource (usually a route). There are two kinds of parent resources + with "Core" support: + + * Gateway (Gateway conformance profile) + * Service (Mesh conformance profile, ClusterIP Services only) + + This API may be extended in the future to support additional kinds of parent + resources. + + The API object must be valid in the cluster; the Group and Kind must + be registered in the cluster for this reference to be valid. + properties: + group: + default: gateway.networking.k8s.io + description: |- + Group is the group of the referent. + When unspecified, "gateway.networking.k8s.io" is inferred. + To set the core API group (such as for a "Service" kind referent), + Group must be explicitly set to "" (empty string). + + Support: Core + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + default: Gateway + description: |- + Kind is kind of the referent. + + There are two kinds of parent resources with "Core" support: + + * Gateway (Gateway conformance profile) + * Service (Mesh conformance profile, ClusterIP Services only) + + Support for other resources is Implementation-Specific. + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: |- + Name is the name of the referent. + + Support: Core + maxLength: 253 + minLength: 1 + type: string + namespace: + description: |- + Namespace is the namespace of the referent. When unspecified, this refers + to the local namespace of the Route. + + Note that there are specific rules for ParentRefs which cross namespace + boundaries. Cross-namespace references are only valid if they are explicitly + allowed by something in the namespace they are referring to. For example: + Gateway has the AllowedRoutes field, and ReferenceGrant provides a + generic way to enable any other kind of cross-namespace reference. + + + + Support: Core + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + port: + description: |- + Port is the network port this Route targets. It can be interpreted + differently based on the type of parent resource. + + When the parent resource is a Gateway, this targets all listeners + listening on the specified port that also support this kind of Route(and + select this Route). It's not recommended to set `Port` unless the + networking behaviors specified in a Route must apply to a specific port + as opposed to a listener(s) whose port(s) may be changed. When both Port + and SectionName are specified, the name and port of the selected listener + must match both specified values. + + + + Implementations MAY choose to support other parent resources. + Implementations supporting other types of parent resources MUST clearly + document how/if Port is interpreted. + + For the purpose of status, an attachment is considered successful as + long as the parent resource accepts it partially. For example, Gateway + listeners can restrict which Routes can attach to them by Route kind, + namespace, or hostname. If 1 of 2 Gateway listeners accept attachment + from the referencing Route, the Route MUST be considered successfully + attached. If no Gateway listeners accept attachment from this Route, + the Route MUST be considered detached from the Gateway. + + Support: Extended + format: int32 + maximum: 65535 + minimum: 1 + type: integer + sectionName: + description: |- + SectionName is the name of a section within the target resource. In the + following resources, SectionName is interpreted as the following: + + * Gateway: Listener name. When both Port (experimental) and SectionName + are specified, the name and port of the selected listener must match + both specified values. + * Service: Port name. When both Port (experimental) and SectionName + are specified, the name and port of the selected listener must match + both specified values. + + Implementations MAY choose to support attaching Routes to other resources. + If that is the case, they MUST clearly document how SectionName is + interpreted. + + When unspecified (empty string), this will reference the entire resource. + For the purpose of status, an attachment is considered successful if at + least one section in the parent resource accepts it. For example, Gateway + listeners can restrict which Routes can attach to them by Route kind, + namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from + the referencing Route, the Route MUST be considered successfully + attached. If no Gateway listeners accept attachment from this Route, the + Route MUST be considered detached from the Gateway. + + Support: Core + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + required: + - name + type: object + maxItems: 32 + type: array + x-kubernetes-validations: + - message: sectionName must be specified when parentRefs includes + 2 or more references to the same parent + rule: 'self.all(p1, self.all(p2, p1.group == p2.group && p1.kind + == p2.kind && p1.name == p2.name && (((!has(p1.__namespace__) + || p1.__namespace__ == '''') && (!has(p2.__namespace__) || p2.__namespace__ + == '''')) || (has(p1.__namespace__) && has(p2.__namespace__) && + p1.__namespace__ == p2.__namespace__ )) ? ((!has(p1.sectionName) + || p1.sectionName == '''') == (!has(p2.sectionName) || p2.sectionName + == '''')) : true))' + - message: sectionName must be unique when parentRefs includes 2 or + more references to the same parent + rule: self.all(p1, self.exists_one(p2, p1.group == p2.group && p1.kind + == p2.kind && p1.name == p2.name && (((!has(p1.__namespace__) + || p1.__namespace__ == '') && (!has(p2.__namespace__) || p2.__namespace__ + == '')) || (has(p1.__namespace__) && has(p2.__namespace__) && + p1.__namespace__ == p2.__namespace__ )) && (((!has(p1.sectionName) + || p1.sectionName == '') && (!has(p2.sectionName) || p2.sectionName + == '')) || (has(p1.sectionName) && has(p2.sectionName) && p1.sectionName + == p2.sectionName)))) + rules: + default: + - matches: + - path: + type: PathPrefix + value: / + description: |+ + Rules are a list of HTTP matchers, filters and actions. + + items: + description: |- + HTTPRouteRule defines semantics for matching an HTTP request based on + conditions (matches), processing it (filters), and forwarding the request to + an API object (backendRefs). + properties: + backendRefs: + description: |- + BackendRefs defines the backend(s) where matching requests should be + sent. + + Failure behavior here depends on how many BackendRefs are specified and + how many are invalid. + + If *all* entries in BackendRefs are invalid, and there are also no filters + specified in this route rule, *all* traffic which matches this rule MUST + receive a 500 status code. + + See the HTTPBackendRef definition for the rules about what makes a single + HTTPBackendRef invalid. + + When a HTTPBackendRef is invalid, 500 status codes MUST be returned for + requests that would have otherwise been routed to an invalid backend. If + multiple backends are specified, and some are invalid, the proportion of + requests that would otherwise have been routed to an invalid backend + MUST receive a 500 status code. + + For example, if two backends are specified with equal weights, and one is + invalid, 50 percent of traffic must receive a 500. Implementations may + choose how that 50 percent is determined. + + When a HTTPBackendRef refers to a Service that has no ready endpoints, + implementations SHOULD return a 503 for requests to that backend instead. + If an implementation chooses to do this, all of the above rules for 500 responses + MUST also apply for responses that return a 503. + + Support: Core for Kubernetes Service + + Support: Extended for Kubernetes ServiceImport + + Support: Implementation-specific for any other resource + + Support for weight: Core + items: + description: |- + HTTPBackendRef defines how a HTTPRoute forwards a HTTP request. + + Note that when a namespace different than the local namespace is specified, a + ReferenceGrant object is required in the referent namespace to allow that + namespace's owner to accept the reference. See the ReferenceGrant + documentation for details. + + + + When the BackendRef points to a Kubernetes Service, implementations SHOULD + honor the appProtocol field if it is set for the target Service Port. + + Implementations supporting appProtocol SHOULD recognize the Kubernetes + Standard Application Protocols defined in KEP-3726. + + If a Service appProtocol isn't specified, an implementation MAY infer the + backend protocol through its own means. Implementations MAY infer the + protocol from the Route type referring to the backend Service. + + If a Route is not able to send traffic to the backend using the specified + protocol then the backend is considered invalid. Implementations MUST set the + "ResolvedRefs" condition to "False" with the "UnsupportedProtocol" reason. + + + properties: + filters: + description: |- + Filters defined at this level should be executed if and only if the + request is being forwarded to the backend defined here. + + Support: Implementation-specific (For broader support of filters, use the + Filters field in HTTPRouteRule.) + items: + description: |- + HTTPRouteFilter defines processing steps that must be completed during the + request or response lifecycle. HTTPRouteFilters are meant as an extension + point to express processing that may be done in Gateway implementations. Some + examples include request or response modification, implementing + authentication strategies, rate-limiting, and traffic shaping. API + guarantee/conformance is defined based on the type of the filter. + properties: + extensionRef: + description: |- + ExtensionRef is an optional, implementation-specific extension to the + "filter" behavior. For example, resource "myroutefilter" in group + "networking.example.net"). ExtensionRef MUST NOT be used for core and + extended filters. + + This filter can be used multiple times within the same rule. + + Support: Implementation-specific + properties: + group: + description: |- + Group is the group of the referent. For example, "gateway.networking.k8s.io". + When unspecified or empty string, core API group is inferred. + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + description: Kind is kind of the referent. For + example "HTTPRoute" or "Service". + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: Name is the name of the referent. + maxLength: 253 + minLength: 1 + type: string + required: + - group + - kind + - name + type: object + requestHeaderModifier: + description: |- + RequestHeaderModifier defines a schema for a filter that modifies request + headers. + + Support: Core + properties: + add: + description: |- + Add adds the given header(s) (name, value) to the request + before the action. It appends to any existing values associated + with the header name. + + Input: + GET /foo HTTP/1.1 + my-header: foo + + Config: + add: + - name: "my-header" + value: "bar,baz" + + Output: + GET /foo HTTP/1.1 + my-header: foo,bar,baz + items: + description: HTTPHeader represents an HTTP + Header name and value as defined by RFC + 7230. + properties: + name: + description: |- + Name is the name of the HTTP Header to be matched. Name matching MUST be + case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). + + If multiple entries specify equivalent header names, the first entry with + an equivalent name MUST be considered for a match. Subsequent entries + with an equivalent header name MUST be ignored. Due to the + case-insensitivity of header names, "foo" and "Foo" are considered + equivalent. + maxLength: 256 + minLength: 1 + pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ + type: string + value: + description: Value is the value of HTTP + Header to be matched. + maxLength: 4096 + minLength: 1 + type: string + required: + - name + - value + type: object + maxItems: 16 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + remove: + description: |- + Remove the given header(s) from the HTTP request before the action. The + value of Remove is a list of HTTP header names. Note that the header + names are case-insensitive (see + https://datatracker.ietf.org/doc/html/rfc2616#section-4.2). + + Input: + GET /foo HTTP/1.1 + my-header1: foo + my-header2: bar + my-header3: baz + + Config: + remove: ["my-header1", "my-header3"] + + Output: + GET /foo HTTP/1.1 + my-header2: bar + items: + type: string + maxItems: 16 + type: array + x-kubernetes-list-type: set + set: + description: |- + Set overwrites the request with the given header (name, value) + before the action. + + Input: + GET /foo HTTP/1.1 + my-header: foo + + Config: + set: + - name: "my-header" + value: "bar" + + Output: + GET /foo HTTP/1.1 + my-header: bar + items: + description: HTTPHeader represents an HTTP + Header name and value as defined by RFC + 7230. + properties: + name: + description: |- + Name is the name of the HTTP Header to be matched. Name matching MUST be + case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). + + If multiple entries specify equivalent header names, the first entry with + an equivalent name MUST be considered for a match. Subsequent entries + with an equivalent header name MUST be ignored. Due to the + case-insensitivity of header names, "foo" and "Foo" are considered + equivalent. + maxLength: 256 + minLength: 1 + pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ + type: string + value: + description: Value is the value of HTTP + Header to be matched. + maxLength: 4096 + minLength: 1 + type: string + required: + - name + - value + type: object + maxItems: 16 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + type: object + requestMirror: + description: |+ + RequestMirror defines a schema for a filter that mirrors requests. + Requests are sent to the specified destination, but responses from + that destination are ignored. + + This filter can be used multiple times within the same rule. Note that + not all implementations will be able to support mirroring to multiple + backends. + + Support: Extended + + properties: + backendRef: + description: |- + BackendRef references a resource where mirrored requests are sent. + + Mirrored requests must be sent only to a single destination endpoint + within this BackendRef, irrespective of how many endpoints are present + within this BackendRef. + + If the referent cannot be found, this BackendRef is invalid and must be + dropped from the Gateway. The controller must ensure the "ResolvedRefs" + condition on the Route status is set to `status: False` and not configure + this backend in the underlying implementation. + + If there is a cross-namespace reference to an *existing* object + that is not allowed by a ReferenceGrant, the controller must ensure the + "ResolvedRefs" condition on the Route is set to `status: False`, + with the "RefNotPermitted" reason and not configure this backend in the + underlying implementation. + + In either error case, the Message of the `ResolvedRefs` Condition + should be used to provide more detail about the problem. + + Support: Extended for Kubernetes Service + + Support: Implementation-specific for any other resource + properties: + group: + default: "" + description: |- + Group is the group of the referent. For example, "gateway.networking.k8s.io". + When unspecified or empty string, core API group is inferred. + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + default: Service + description: |- + Kind is the Kubernetes resource kind of the referent. For example + "Service". + + Defaults to "Service" when not specified. + + ExternalName services can refer to CNAME DNS records that may live + outside of the cluster and as such are difficult to reason about in + terms of conformance. They also may not be safe to forward to (see + CVE-2021-25740 for more information). Implementations SHOULD NOT + support ExternalName Services. + + Support: Core (Services with a type other than ExternalName) + + Support: Implementation-specific (Services with type ExternalName) + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: Name is the name of the referent. + maxLength: 253 + minLength: 1 + type: string + namespace: + description: |- + Namespace is the namespace of the backend. When unspecified, the local + namespace is inferred. + + Note that when a namespace different than the local namespace is specified, + a ReferenceGrant object is required in the referent namespace to allow that + namespace's owner to accept the reference. See the ReferenceGrant + documentation for details. + + Support: Core + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + port: + description: |- + Port specifies the destination port number to use for this resource. + Port is required when the referent is a Kubernetes Service. In this + case, the port number is the service port number, not the target port. + For other resources, destination port might be derived from the referent + resource or this field. + format: int32 + maximum: 65535 + minimum: 1 + type: integer + required: + - name + type: object + x-kubernetes-validations: + - message: Must have port for Service reference + rule: '(size(self.group) == 0 && self.kind + == ''Service'') ? has(self.port) : true' + required: + - backendRef + type: object + requestRedirect: + description: |- + RequestRedirect defines a schema for a filter that responds to the + request with an HTTP redirection. + + Support: Core + properties: + hostname: + description: |- + Hostname is the hostname to be used in the value of the `Location` + header in the response. + When empty, the hostname in the `Host` header of the request is used. + + Support: Core + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + path: + description: |- + Path defines parameters used to modify the path of the incoming request. + The modified path is then used to construct the `Location` header. When + empty, the request path is used as-is. + + Support: Extended + properties: + replaceFullPath: + description: |- + ReplaceFullPath specifies the value with which to replace the full path + of a request during a rewrite or redirect. + maxLength: 1024 + type: string + replacePrefixMatch: + description: |- + ReplacePrefixMatch specifies the value with which to replace the prefix + match of a request during a rewrite or redirect. For example, a request + to "/foo/bar" with a prefix match of "/foo" and a ReplacePrefixMatch + of "/xyz" would be modified to "/xyz/bar". + + Note that this matches the behavior of the PathPrefix match type. This + matches full path elements. A path element refers to the list of labels + in the path split by the `/` separator. When specified, a trailing `/` is + ignored. For example, the paths `/abc`, `/abc/`, and `/abc/def` would all + match the prefix `/abc`, but the path `/abcd` would not. + + ReplacePrefixMatch is only compatible with a `PathPrefix` HTTPRouteMatch. + Using any other HTTPRouteMatch type on the same HTTPRouteRule will result in + the implementation setting the Accepted Condition for the Route to `status: False`. + + Request Path | Prefix Match | Replace Prefix | Modified Path + maxLength: 1024 + type: string + type: + description: |- + Type defines the type of path modifier. Additional types may be + added in a future release of the API. + + Note that values may be added to this enum, implementations + must ensure that unknown values will not cause a crash. + + Unknown values here must result in the implementation setting the + Accepted Condition for the Route to `status: False`, with a + Reason of `UnsupportedValue`. + enum: + - ReplaceFullPath + - ReplacePrefixMatch + type: string + required: + - type + type: object + x-kubernetes-validations: + - message: replaceFullPath must be specified + when type is set to 'ReplaceFullPath' + rule: 'self.type == ''ReplaceFullPath'' ? + has(self.replaceFullPath) : true' + - message: type must be 'ReplaceFullPath' when + replaceFullPath is set + rule: 'has(self.replaceFullPath) ? self.type + == ''ReplaceFullPath'' : true' + - message: replacePrefixMatch must be specified + when type is set to 'ReplacePrefixMatch' + rule: 'self.type == ''ReplacePrefixMatch'' + ? has(self.replacePrefixMatch) : true' + - message: type must be 'ReplacePrefixMatch' + when replacePrefixMatch is set + rule: 'has(self.replacePrefixMatch) ? self.type + == ''ReplacePrefixMatch'' : true' + port: + description: |- + Port is the port to be used in the value of the `Location` + header in the response. + + If no port is specified, the redirect port MUST be derived using the + following rules: + + * If redirect scheme is not-empty, the redirect port MUST be the well-known + port associated with the redirect scheme. Specifically "http" to port 80 + and "https" to port 443. If the redirect scheme does not have a + well-known port, the listener port of the Gateway SHOULD be used. + * If redirect scheme is empty, the redirect port MUST be the Gateway + Listener port. + + Implementations SHOULD NOT add the port number in the 'Location' + header in the following cases: + + * A Location header that will use HTTP (whether that is determined via + the Listener protocol or the Scheme field) _and_ use port 80. + * A Location header that will use HTTPS (whether that is determined via + the Listener protocol or the Scheme field) _and_ use port 443. + + Support: Extended + format: int32 + maximum: 65535 + minimum: 1 + type: integer + scheme: + description: |- + Scheme is the scheme to be used in the value of the `Location` header in + the response. When empty, the scheme of the request is used. + + Scheme redirects can affect the port of the redirect, for more information, + refer to the documentation for the port field of this filter. + + Note that values may be added to this enum, implementations + must ensure that unknown values will not cause a crash. + + Unknown values here must result in the implementation setting the + Accepted Condition for the Route to `status: False`, with a + Reason of `UnsupportedValue`. + + Support: Extended + enum: + - http + - https + type: string + statusCode: + default: 302 + description: |- + StatusCode is the HTTP status code to be used in response. + + Note that values may be added to this enum, implementations + must ensure that unknown values will not cause a crash. + + Unknown values here must result in the implementation setting the + Accepted Condition for the Route to `status: False`, with a + Reason of `UnsupportedValue`. + + Support: Core + enum: + - 301 + - 302 + type: integer + type: object + responseHeaderModifier: + description: |- + ResponseHeaderModifier defines a schema for a filter that modifies response + headers. + + Support: Extended + properties: + add: + description: |- + Add adds the given header(s) (name, value) to the request + before the action. It appends to any existing values associated + with the header name. + + Input: + GET /foo HTTP/1.1 + my-header: foo + + Config: + add: + - name: "my-header" + value: "bar,baz" + + Output: + GET /foo HTTP/1.1 + my-header: foo,bar,baz + items: + description: HTTPHeader represents an HTTP + Header name and value as defined by RFC + 7230. + properties: + name: + description: |- + Name is the name of the HTTP Header to be matched. Name matching MUST be + case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). + + If multiple entries specify equivalent header names, the first entry with + an equivalent name MUST be considered for a match. Subsequent entries + with an equivalent header name MUST be ignored. Due to the + case-insensitivity of header names, "foo" and "Foo" are considered + equivalent. + maxLength: 256 + minLength: 1 + pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ + type: string + value: + description: Value is the value of HTTP + Header to be matched. + maxLength: 4096 + minLength: 1 + type: string + required: + - name + - value + type: object + maxItems: 16 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + remove: + description: |- + Remove the given header(s) from the HTTP request before the action. The + value of Remove is a list of HTTP header names. Note that the header + names are case-insensitive (see + https://datatracker.ietf.org/doc/html/rfc2616#section-4.2). + + Input: + GET /foo HTTP/1.1 + my-header1: foo + my-header2: bar + my-header3: baz + + Config: + remove: ["my-header1", "my-header3"] + + Output: + GET /foo HTTP/1.1 + my-header2: bar + items: + type: string + maxItems: 16 + type: array + x-kubernetes-list-type: set + set: + description: |- + Set overwrites the request with the given header (name, value) + before the action. + + Input: + GET /foo HTTP/1.1 + my-header: foo + + Config: + set: + - name: "my-header" + value: "bar" + + Output: + GET /foo HTTP/1.1 + my-header: bar + items: + description: HTTPHeader represents an HTTP + Header name and value as defined by RFC + 7230. + properties: + name: + description: |- + Name is the name of the HTTP Header to be matched. Name matching MUST be + case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). + + If multiple entries specify equivalent header names, the first entry with + an equivalent name MUST be considered for a match. Subsequent entries + with an equivalent header name MUST be ignored. Due to the + case-insensitivity of header names, "foo" and "Foo" are considered + equivalent. + maxLength: 256 + minLength: 1 + pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ + type: string + value: + description: Value is the value of HTTP + Header to be matched. + maxLength: 4096 + minLength: 1 + type: string + required: + - name + - value + type: object + maxItems: 16 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + type: object + type: + description: |- + Type identifies the type of filter to apply. As with other API fields, + types are classified into three conformance levels: + + - Core: Filter types and their corresponding configuration defined by + "Support: Core" in this package, e.g. "RequestHeaderModifier". All + implementations must support core filters. + + - Extended: Filter types and their corresponding configuration defined by + "Support: Extended" in this package, e.g. "RequestMirror". Implementers + are encouraged to support extended filters. + + - Implementation-specific: Filters that are defined and supported by + specific vendors. + In the future, filters showing convergence in behavior across multiple + implementations will be considered for inclusion in extended or core + conformance levels. Filter-specific configuration for such filters + is specified using the ExtensionRef field. `Type` should be set to + "ExtensionRef" for custom filters. + + Implementers are encouraged to define custom implementation types to + extend the core API with implementation-specific behavior. + + If a reference to a custom filter type cannot be resolved, the filter + MUST NOT be skipped. Instead, requests that would have been processed by + that filter MUST receive a HTTP error response. + + Note that values may be added to this enum, implementations + must ensure that unknown values will not cause a crash. + + Unknown values here must result in the implementation setting the + Accepted Condition for the Route to `status: False`, with a + Reason of `UnsupportedValue`. + enum: + - RequestHeaderModifier + - ResponseHeaderModifier + - RequestMirror + - RequestRedirect + - URLRewrite + - ExtensionRef + type: string + urlRewrite: + description: |- + URLRewrite defines a schema for a filter that modifies a request during forwarding. + + Support: Extended + properties: + hostname: + description: |- + Hostname is the value to be used to replace the Host header value during + forwarding. + + Support: Extended + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + path: + description: |- + Path defines a path rewrite. + + Support: Extended + properties: + replaceFullPath: + description: |- + ReplaceFullPath specifies the value with which to replace the full path + of a request during a rewrite or redirect. + maxLength: 1024 + type: string + replacePrefixMatch: + description: |- + ReplacePrefixMatch specifies the value with which to replace the prefix + match of a request during a rewrite or redirect. For example, a request + to "/foo/bar" with a prefix match of "/foo" and a ReplacePrefixMatch + of "/xyz" would be modified to "/xyz/bar". + + Note that this matches the behavior of the PathPrefix match type. This + matches full path elements. A path element refers to the list of labels + in the path split by the `/` separator. When specified, a trailing `/` is + ignored. For example, the paths `/abc`, `/abc/`, and `/abc/def` would all + match the prefix `/abc`, but the path `/abcd` would not. + + ReplacePrefixMatch is only compatible with a `PathPrefix` HTTPRouteMatch. + Using any other HTTPRouteMatch type on the same HTTPRouteRule will result in + the implementation setting the Accepted Condition for the Route to `status: False`. + + Request Path | Prefix Match | Replace Prefix | Modified Path + maxLength: 1024 + type: string + type: + description: |- + Type defines the type of path modifier. Additional types may be + added in a future release of the API. + + Note that values may be added to this enum, implementations + must ensure that unknown values will not cause a crash. + + Unknown values here must result in the implementation setting the + Accepted Condition for the Route to `status: False`, with a + Reason of `UnsupportedValue`. + enum: + - ReplaceFullPath + - ReplacePrefixMatch + type: string + required: + - type + type: object + x-kubernetes-validations: + - message: replaceFullPath must be specified + when type is set to 'ReplaceFullPath' + rule: 'self.type == ''ReplaceFullPath'' ? + has(self.replaceFullPath) : true' + - message: type must be 'ReplaceFullPath' when + replaceFullPath is set + rule: 'has(self.replaceFullPath) ? self.type + == ''ReplaceFullPath'' : true' + - message: replacePrefixMatch must be specified + when type is set to 'ReplacePrefixMatch' + rule: 'self.type == ''ReplacePrefixMatch'' + ? has(self.replacePrefixMatch) : true' + - message: type must be 'ReplacePrefixMatch' + when replacePrefixMatch is set + rule: 'has(self.replacePrefixMatch) ? self.type + == ''ReplacePrefixMatch'' : true' + type: object + required: + - type + type: object + x-kubernetes-validations: + - message: filter.requestHeaderModifier must be nil + if the filter.type is not RequestHeaderModifier + rule: '!(has(self.requestHeaderModifier) && self.type + != ''RequestHeaderModifier'')' + - message: filter.requestHeaderModifier must be specified + for RequestHeaderModifier filter.type + rule: '!(!has(self.requestHeaderModifier) && self.type + == ''RequestHeaderModifier'')' + - message: filter.responseHeaderModifier must be nil + if the filter.type is not ResponseHeaderModifier + rule: '!(has(self.responseHeaderModifier) && self.type + != ''ResponseHeaderModifier'')' + - message: filter.responseHeaderModifier must be specified + for ResponseHeaderModifier filter.type + rule: '!(!has(self.responseHeaderModifier) && self.type + == ''ResponseHeaderModifier'')' + - message: filter.requestMirror must be nil if the filter.type + is not RequestMirror + rule: '!(has(self.requestMirror) && self.type != ''RequestMirror'')' + - message: filter.requestMirror must be specified for + RequestMirror filter.type + rule: '!(!has(self.requestMirror) && self.type == + ''RequestMirror'')' + - message: filter.requestRedirect must be nil if the + filter.type is not RequestRedirect + rule: '!(has(self.requestRedirect) && self.type != + ''RequestRedirect'')' + - message: filter.requestRedirect must be specified + for RequestRedirect filter.type + rule: '!(!has(self.requestRedirect) && self.type == + ''RequestRedirect'')' + - message: filter.urlRewrite must be nil if the filter.type + is not URLRewrite + rule: '!(has(self.urlRewrite) && self.type != ''URLRewrite'')' + - message: filter.urlRewrite must be specified for URLRewrite + filter.type + rule: '!(!has(self.urlRewrite) && self.type == ''URLRewrite'')' + - message: filter.extensionRef must be nil if the filter.type + is not ExtensionRef + rule: '!(has(self.extensionRef) && self.type != ''ExtensionRef'')' + - message: filter.extensionRef must be specified for + ExtensionRef filter.type + rule: '!(!has(self.extensionRef) && self.type == ''ExtensionRef'')' + maxItems: 16 + type: array + x-kubernetes-validations: + - message: May specify either httpRouteFilterRequestRedirect + or httpRouteFilterRequestRewrite, but not both + rule: '!(self.exists(f, f.type == ''RequestRedirect'') + && self.exists(f, f.type == ''URLRewrite''))' + - message: May specify either httpRouteFilterRequestRedirect + or httpRouteFilterRequestRewrite, but not both + rule: '!(self.exists(f, f.type == ''RequestRedirect'') + && self.exists(f, f.type == ''URLRewrite''))' + - message: RequestHeaderModifier filter cannot be repeated + rule: self.filter(f, f.type == 'RequestHeaderModifier').size() + <= 1 + - message: ResponseHeaderModifier filter cannot be repeated + rule: self.filter(f, f.type == 'ResponseHeaderModifier').size() + <= 1 + - message: RequestRedirect filter cannot be repeated + rule: self.filter(f, f.type == 'RequestRedirect').size() + <= 1 + - message: URLRewrite filter cannot be repeated + rule: self.filter(f, f.type == 'URLRewrite').size() + <= 1 + group: + default: "" + description: |- + Group is the group of the referent. For example, "gateway.networking.k8s.io". + When unspecified or empty string, core API group is inferred. + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + default: Service + description: |- + Kind is the Kubernetes resource kind of the referent. For example + "Service". + + Defaults to "Service" when not specified. + + ExternalName services can refer to CNAME DNS records that may live + outside of the cluster and as such are difficult to reason about in + terms of conformance. They also may not be safe to forward to (see + CVE-2021-25740 for more information). Implementations SHOULD NOT + support ExternalName Services. + + Support: Core (Services with a type other than ExternalName) + + Support: Implementation-specific (Services with type ExternalName) + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: Name is the name of the referent. + maxLength: 253 + minLength: 1 + type: string + namespace: + description: |- + Namespace is the namespace of the backend. When unspecified, the local + namespace is inferred. + + Note that when a namespace different than the local namespace is specified, + a ReferenceGrant object is required in the referent namespace to allow that + namespace's owner to accept the reference. See the ReferenceGrant + documentation for details. + + Support: Core + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + port: + description: |- + Port specifies the destination port number to use for this resource. + Port is required when the referent is a Kubernetes Service. In this + case, the port number is the service port number, not the target port. + For other resources, destination port might be derived from the referent + resource or this field. + format: int32 + maximum: 65535 + minimum: 1 + type: integer + weight: + default: 1 + description: |- + Weight specifies the proportion of requests forwarded to the referenced + backend. This is computed as weight/(sum of all weights in this + BackendRefs list). For non-zero values, there may be some epsilon from + the exact proportion defined here depending on the precision an + implementation supports. Weight is not a percentage and the sum of + weights does not need to equal 100. + + If only one backend is specified and it has a weight greater than 0, 100% + of the traffic is forwarded to that backend. If weight is set to 0, no + traffic should be forwarded for this entry. If unspecified, weight + defaults to 1. + + Support for this field varies based on the context where used. + format: int32 + maximum: 1000000 + minimum: 0 + type: integer + required: + - name + type: object + x-kubernetes-validations: + - message: Must have port for Service reference + rule: '(size(self.group) == 0 && self.kind == ''Service'') + ? has(self.port) : true' + maxItems: 16 + type: array + filters: + description: |- + Filters define the filters that are applied to requests that match + this rule. + + Wherever possible, implementations SHOULD implement filters in the order + they are specified. + + Implementations MAY choose to implement this ordering strictly, rejecting + any combination or order of filters that can not be supported. If implementations + choose a strict interpretation of filter ordering, they MUST clearly document + that behavior. + + To reject an invalid combination or order of filters, implementations SHOULD + consider the Route Rules with this configuration invalid. If all Route Rules + in a Route are invalid, the entire Route would be considered invalid. If only + a portion of Route Rules are invalid, implementations MUST set the + "PartiallyInvalid" condition for the Route. + + Conformance-levels at this level are defined based on the type of filter: + + - ALL core filters MUST be supported by all implementations. + - Implementers are encouraged to support extended filters. + - Implementation-specific custom filters have no API guarantees across + implementations. + + Specifying the same filter multiple times is not supported unless explicitly + indicated in the filter. + + All filters are expected to be compatible with each other except for the + URLRewrite and RequestRedirect filters, which may not be combined. If an + implementation can not support other combinations of filters, they must clearly + document that limitation. In cases where incompatible or unsupported + filters are specified and cause the `Accepted` condition to be set to status + `False`, implementations may use the `IncompatibleFilters` reason to specify + this configuration error. + + Support: Core + items: + description: |- + HTTPRouteFilter defines processing steps that must be completed during the + request or response lifecycle. HTTPRouteFilters are meant as an extension + point to express processing that may be done in Gateway implementations. Some + examples include request or response modification, implementing + authentication strategies, rate-limiting, and traffic shaping. API + guarantee/conformance is defined based on the type of the filter. + properties: + extensionRef: + description: |- + ExtensionRef is an optional, implementation-specific extension to the + "filter" behavior. For example, resource "myroutefilter" in group + "networking.example.net"). ExtensionRef MUST NOT be used for core and + extended filters. + + This filter can be used multiple times within the same rule. + + Support: Implementation-specific + properties: + group: + description: |- + Group is the group of the referent. For example, "gateway.networking.k8s.io". + When unspecified or empty string, core API group is inferred. + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + description: Kind is kind of the referent. For example + "HTTPRoute" or "Service". + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: Name is the name of the referent. + maxLength: 253 + minLength: 1 + type: string + required: + - group + - kind + - name + type: object + requestHeaderModifier: + description: |- + RequestHeaderModifier defines a schema for a filter that modifies request + headers. + + Support: Core + properties: + add: + description: |- + Add adds the given header(s) (name, value) to the request + before the action. It appends to any existing values associated + with the header name. + + Input: + GET /foo HTTP/1.1 + my-header: foo + + Config: + add: + - name: "my-header" + value: "bar,baz" + + Output: + GET /foo HTTP/1.1 + my-header: foo,bar,baz + items: + description: HTTPHeader represents an HTTP Header + name and value as defined by RFC 7230. + properties: + name: + description: |- + Name is the name of the HTTP Header to be matched. Name matching MUST be + case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). + + If multiple entries specify equivalent header names, the first entry with + an equivalent name MUST be considered for a match. Subsequent entries + with an equivalent header name MUST be ignored. Due to the + case-insensitivity of header names, "foo" and "Foo" are considered + equivalent. + maxLength: 256 + minLength: 1 + pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ + type: string + value: + description: Value is the value of HTTP Header + to be matched. + maxLength: 4096 + minLength: 1 + type: string + required: + - name + - value + type: object + maxItems: 16 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + remove: + description: |- + Remove the given header(s) from the HTTP request before the action. The + value of Remove is a list of HTTP header names. Note that the header + names are case-insensitive (see + https://datatracker.ietf.org/doc/html/rfc2616#section-4.2). + + Input: + GET /foo HTTP/1.1 + my-header1: foo + my-header2: bar + my-header3: baz + + Config: + remove: ["my-header1", "my-header3"] + + Output: + GET /foo HTTP/1.1 + my-header2: bar + items: + type: string + maxItems: 16 + type: array + x-kubernetes-list-type: set + set: + description: |- + Set overwrites the request with the given header (name, value) + before the action. + + Input: + GET /foo HTTP/1.1 + my-header: foo + + Config: + set: + - name: "my-header" + value: "bar" + + Output: + GET /foo HTTP/1.1 + my-header: bar + items: + description: HTTPHeader represents an HTTP Header + name and value as defined by RFC 7230. + properties: + name: + description: |- + Name is the name of the HTTP Header to be matched. Name matching MUST be + case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). + + If multiple entries specify equivalent header names, the first entry with + an equivalent name MUST be considered for a match. Subsequent entries + with an equivalent header name MUST be ignored. Due to the + case-insensitivity of header names, "foo" and "Foo" are considered + equivalent. + maxLength: 256 + minLength: 1 + pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ + type: string + value: + description: Value is the value of HTTP Header + to be matched. + maxLength: 4096 + minLength: 1 + type: string + required: + - name + - value + type: object + maxItems: 16 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + type: object + requestMirror: + description: |+ + RequestMirror defines a schema for a filter that mirrors requests. + Requests are sent to the specified destination, but responses from + that destination are ignored. + + This filter can be used multiple times within the same rule. Note that + not all implementations will be able to support mirroring to multiple + backends. + + Support: Extended + + properties: + backendRef: + description: |- + BackendRef references a resource where mirrored requests are sent. + + Mirrored requests must be sent only to a single destination endpoint + within this BackendRef, irrespective of how many endpoints are present + within this BackendRef. + + If the referent cannot be found, this BackendRef is invalid and must be + dropped from the Gateway. The controller must ensure the "ResolvedRefs" + condition on the Route status is set to `status: False` and not configure + this backend in the underlying implementation. + + If there is a cross-namespace reference to an *existing* object + that is not allowed by a ReferenceGrant, the controller must ensure the + "ResolvedRefs" condition on the Route is set to `status: False`, + with the "RefNotPermitted" reason and not configure this backend in the + underlying implementation. + + In either error case, the Message of the `ResolvedRefs` Condition + should be used to provide more detail about the problem. + + Support: Extended for Kubernetes Service + + Support: Implementation-specific for any other resource + properties: + group: + default: "" + description: |- + Group is the group of the referent. For example, "gateway.networking.k8s.io". + When unspecified or empty string, core API group is inferred. + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + default: Service + description: |- + Kind is the Kubernetes resource kind of the referent. For example + "Service". + + Defaults to "Service" when not specified. + + ExternalName services can refer to CNAME DNS records that may live + outside of the cluster and as such are difficult to reason about in + terms of conformance. They also may not be safe to forward to (see + CVE-2021-25740 for more information). Implementations SHOULD NOT + support ExternalName Services. + + Support: Core (Services with a type other than ExternalName) + + Support: Implementation-specific (Services with type ExternalName) + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: Name is the name of the referent. + maxLength: 253 + minLength: 1 + type: string + namespace: + description: |- + Namespace is the namespace of the backend. When unspecified, the local + namespace is inferred. + + Note that when a namespace different than the local namespace is specified, + a ReferenceGrant object is required in the referent namespace to allow that + namespace's owner to accept the reference. See the ReferenceGrant + documentation for details. + + Support: Core + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + port: + description: |- + Port specifies the destination port number to use for this resource. + Port is required when the referent is a Kubernetes Service. In this + case, the port number is the service port number, not the target port. + For other resources, destination port might be derived from the referent + resource or this field. + format: int32 + maximum: 65535 + minimum: 1 + type: integer + required: + - name + type: object + x-kubernetes-validations: + - message: Must have port for Service reference + rule: '(size(self.group) == 0 && self.kind == ''Service'') + ? has(self.port) : true' + required: + - backendRef + type: object + requestRedirect: + description: |- + RequestRedirect defines a schema for a filter that responds to the + request with an HTTP redirection. + + Support: Core + properties: + hostname: + description: |- + Hostname is the hostname to be used in the value of the `Location` + header in the response. + When empty, the hostname in the `Host` header of the request is used. + + Support: Core + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + path: + description: |- + Path defines parameters used to modify the path of the incoming request. + The modified path is then used to construct the `Location` header. When + empty, the request path is used as-is. + + Support: Extended + properties: + replaceFullPath: + description: |- + ReplaceFullPath specifies the value with which to replace the full path + of a request during a rewrite or redirect. + maxLength: 1024 + type: string + replacePrefixMatch: + description: |- + ReplacePrefixMatch specifies the value with which to replace the prefix + match of a request during a rewrite or redirect. For example, a request + to "/foo/bar" with a prefix match of "/foo" and a ReplacePrefixMatch + of "/xyz" would be modified to "/xyz/bar". + + Note that this matches the behavior of the PathPrefix match type. This + matches full path elements. A path element refers to the list of labels + in the path split by the `/` separator. When specified, a trailing `/` is + ignored. For example, the paths `/abc`, `/abc/`, and `/abc/def` would all + match the prefix `/abc`, but the path `/abcd` would not. + + ReplacePrefixMatch is only compatible with a `PathPrefix` HTTPRouteMatch. + Using any other HTTPRouteMatch type on the same HTTPRouteRule will result in + the implementation setting the Accepted Condition for the Route to `status: False`. + + Request Path | Prefix Match | Replace Prefix | Modified Path + maxLength: 1024 + type: string + type: + description: |- + Type defines the type of path modifier. Additional types may be + added in a future release of the API. + + Note that values may be added to this enum, implementations + must ensure that unknown values will not cause a crash. + + Unknown values here must result in the implementation setting the + Accepted Condition for the Route to `status: False`, with a + Reason of `UnsupportedValue`. + enum: + - ReplaceFullPath + - ReplacePrefixMatch + type: string + required: + - type + type: object + x-kubernetes-validations: + - message: replaceFullPath must be specified when + type is set to 'ReplaceFullPath' + rule: 'self.type == ''ReplaceFullPath'' ? has(self.replaceFullPath) + : true' + - message: type must be 'ReplaceFullPath' when replaceFullPath + is set + rule: 'has(self.replaceFullPath) ? self.type == + ''ReplaceFullPath'' : true' + - message: replacePrefixMatch must be specified when + type is set to 'ReplacePrefixMatch' + rule: 'self.type == ''ReplacePrefixMatch'' ? has(self.replacePrefixMatch) + : true' + - message: type must be 'ReplacePrefixMatch' when + replacePrefixMatch is set + rule: 'has(self.replacePrefixMatch) ? self.type + == ''ReplacePrefixMatch'' : true' + port: + description: |- + Port is the port to be used in the value of the `Location` + header in the response. + + If no port is specified, the redirect port MUST be derived using the + following rules: + + * If redirect scheme is not-empty, the redirect port MUST be the well-known + port associated with the redirect scheme. Specifically "http" to port 80 + and "https" to port 443. If the redirect scheme does not have a + well-known port, the listener port of the Gateway SHOULD be used. + * If redirect scheme is empty, the redirect port MUST be the Gateway + Listener port. + + Implementations SHOULD NOT add the port number in the 'Location' + header in the following cases: + + * A Location header that will use HTTP (whether that is determined via + the Listener protocol or the Scheme field) _and_ use port 80. + * A Location header that will use HTTPS (whether that is determined via + the Listener protocol or the Scheme field) _and_ use port 443. + + Support: Extended + format: int32 + maximum: 65535 + minimum: 1 + type: integer + scheme: + description: |- + Scheme is the scheme to be used in the value of the `Location` header in + the response. When empty, the scheme of the request is used. + + Scheme redirects can affect the port of the redirect, for more information, + refer to the documentation for the port field of this filter. + + Note that values may be added to this enum, implementations + must ensure that unknown values will not cause a crash. + + Unknown values here must result in the implementation setting the + Accepted Condition for the Route to `status: False`, with a + Reason of `UnsupportedValue`. + + Support: Extended + enum: + - http + - https + type: string + statusCode: + default: 302 + description: |- + StatusCode is the HTTP status code to be used in response. + + Note that values may be added to this enum, implementations + must ensure that unknown values will not cause a crash. + + Unknown values here must result in the implementation setting the + Accepted Condition for the Route to `status: False`, with a + Reason of `UnsupportedValue`. + + Support: Core + enum: + - 301 + - 302 + type: integer + type: object + responseHeaderModifier: + description: |- + ResponseHeaderModifier defines a schema for a filter that modifies response + headers. + + Support: Extended + properties: + add: + description: |- + Add adds the given header(s) (name, value) to the request + before the action. It appends to any existing values associated + with the header name. + + Input: + GET /foo HTTP/1.1 + my-header: foo + + Config: + add: + - name: "my-header" + value: "bar,baz" + + Output: + GET /foo HTTP/1.1 + my-header: foo,bar,baz + items: + description: HTTPHeader represents an HTTP Header + name and value as defined by RFC 7230. + properties: + name: + description: |- + Name is the name of the HTTP Header to be matched. Name matching MUST be + case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). + + If multiple entries specify equivalent header names, the first entry with + an equivalent name MUST be considered for a match. Subsequent entries + with an equivalent header name MUST be ignored. Due to the + case-insensitivity of header names, "foo" and "Foo" are considered + equivalent. + maxLength: 256 + minLength: 1 + pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ + type: string + value: + description: Value is the value of HTTP Header + to be matched. + maxLength: 4096 + minLength: 1 + type: string + required: + - name + - value + type: object + maxItems: 16 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + remove: + description: |- + Remove the given header(s) from the HTTP request before the action. The + value of Remove is a list of HTTP header names. Note that the header + names are case-insensitive (see + https://datatracker.ietf.org/doc/html/rfc2616#section-4.2). + + Input: + GET /foo HTTP/1.1 + my-header1: foo + my-header2: bar + my-header3: baz + + Config: + remove: ["my-header1", "my-header3"] + + Output: + GET /foo HTTP/1.1 + my-header2: bar + items: + type: string + maxItems: 16 + type: array + x-kubernetes-list-type: set + set: + description: |- + Set overwrites the request with the given header (name, value) + before the action. + + Input: + GET /foo HTTP/1.1 + my-header: foo + + Config: + set: + - name: "my-header" + value: "bar" + + Output: + GET /foo HTTP/1.1 + my-header: bar + items: + description: HTTPHeader represents an HTTP Header + name and value as defined by RFC 7230. + properties: + name: + description: |- + Name is the name of the HTTP Header to be matched. Name matching MUST be + case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). + + If multiple entries specify equivalent header names, the first entry with + an equivalent name MUST be considered for a match. Subsequent entries + with an equivalent header name MUST be ignored. Due to the + case-insensitivity of header names, "foo" and "Foo" are considered + equivalent. + maxLength: 256 + minLength: 1 + pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ + type: string + value: + description: Value is the value of HTTP Header + to be matched. + maxLength: 4096 + minLength: 1 + type: string + required: + - name + - value + type: object + maxItems: 16 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + type: object + type: + description: |- + Type identifies the type of filter to apply. As with other API fields, + types are classified into three conformance levels: + + - Core: Filter types and their corresponding configuration defined by + "Support: Core" in this package, e.g. "RequestHeaderModifier". All + implementations must support core filters. + + - Extended: Filter types and their corresponding configuration defined by + "Support: Extended" in this package, e.g. "RequestMirror". Implementers + are encouraged to support extended filters. + + - Implementation-specific: Filters that are defined and supported by + specific vendors. + In the future, filters showing convergence in behavior across multiple + implementations will be considered for inclusion in extended or core + conformance levels. Filter-specific configuration for such filters + is specified using the ExtensionRef field. `Type` should be set to + "ExtensionRef" for custom filters. + + Implementers are encouraged to define custom implementation types to + extend the core API with implementation-specific behavior. + + If a reference to a custom filter type cannot be resolved, the filter + MUST NOT be skipped. Instead, requests that would have been processed by + that filter MUST receive a HTTP error response. + + Note that values may be added to this enum, implementations + must ensure that unknown values will not cause a crash. + + Unknown values here must result in the implementation setting the + Accepted Condition for the Route to `status: False`, with a + Reason of `UnsupportedValue`. + enum: + - RequestHeaderModifier + - ResponseHeaderModifier + - RequestMirror + - RequestRedirect + - URLRewrite + - ExtensionRef + type: string + urlRewrite: + description: |- + URLRewrite defines a schema for a filter that modifies a request during forwarding. + + Support: Extended + properties: + hostname: + description: |- + Hostname is the value to be used to replace the Host header value during + forwarding. + + Support: Extended + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + path: + description: |- + Path defines a path rewrite. + + Support: Extended + properties: + replaceFullPath: + description: |- + ReplaceFullPath specifies the value with which to replace the full path + of a request during a rewrite or redirect. + maxLength: 1024 + type: string + replacePrefixMatch: + description: |- + ReplacePrefixMatch specifies the value with which to replace the prefix + match of a request during a rewrite or redirect. For example, a request + to "/foo/bar" with a prefix match of "/foo" and a ReplacePrefixMatch + of "/xyz" would be modified to "/xyz/bar". + + Note that this matches the behavior of the PathPrefix match type. This + matches full path elements. A path element refers to the list of labels + in the path split by the `/` separator. When specified, a trailing `/` is + ignored. For example, the paths `/abc`, `/abc/`, and `/abc/def` would all + match the prefix `/abc`, but the path `/abcd` would not. + + ReplacePrefixMatch is only compatible with a `PathPrefix` HTTPRouteMatch. + Using any other HTTPRouteMatch type on the same HTTPRouteRule will result in + the implementation setting the Accepted Condition for the Route to `status: False`. + + Request Path | Prefix Match | Replace Prefix | Modified Path + maxLength: 1024 + type: string + type: + description: |- + Type defines the type of path modifier. Additional types may be + added in a future release of the API. + + Note that values may be added to this enum, implementations + must ensure that unknown values will not cause a crash. + + Unknown values here must result in the implementation setting the + Accepted Condition for the Route to `status: False`, with a + Reason of `UnsupportedValue`. + enum: + - ReplaceFullPath + - ReplacePrefixMatch + type: string + required: + - type + type: object + x-kubernetes-validations: + - message: replaceFullPath must be specified when + type is set to 'ReplaceFullPath' + rule: 'self.type == ''ReplaceFullPath'' ? has(self.replaceFullPath) + : true' + - message: type must be 'ReplaceFullPath' when replaceFullPath + is set + rule: 'has(self.replaceFullPath) ? self.type == + ''ReplaceFullPath'' : true' + - message: replacePrefixMatch must be specified when + type is set to 'ReplacePrefixMatch' + rule: 'self.type == ''ReplacePrefixMatch'' ? has(self.replacePrefixMatch) + : true' + - message: type must be 'ReplacePrefixMatch' when + replacePrefixMatch is set + rule: 'has(self.replacePrefixMatch) ? self.type + == ''ReplacePrefixMatch'' : true' + type: object + required: + - type + type: object + x-kubernetes-validations: + - message: filter.requestHeaderModifier must be nil if the + filter.type is not RequestHeaderModifier + rule: '!(has(self.requestHeaderModifier) && self.type != + ''RequestHeaderModifier'')' + - message: filter.requestHeaderModifier must be specified + for RequestHeaderModifier filter.type + rule: '!(!has(self.requestHeaderModifier) && self.type == + ''RequestHeaderModifier'')' + - message: filter.responseHeaderModifier must be nil if the + filter.type is not ResponseHeaderModifier + rule: '!(has(self.responseHeaderModifier) && self.type != + ''ResponseHeaderModifier'')' + - message: filter.responseHeaderModifier must be specified + for ResponseHeaderModifier filter.type + rule: '!(!has(self.responseHeaderModifier) && self.type + == ''ResponseHeaderModifier'')' + - message: filter.requestMirror must be nil if the filter.type + is not RequestMirror + rule: '!(has(self.requestMirror) && self.type != ''RequestMirror'')' + - message: filter.requestMirror must be specified for RequestMirror + filter.type + rule: '!(!has(self.requestMirror) && self.type == ''RequestMirror'')' + - message: filter.requestRedirect must be nil if the filter.type + is not RequestRedirect + rule: '!(has(self.requestRedirect) && self.type != ''RequestRedirect'')' + - message: filter.requestRedirect must be specified for RequestRedirect + filter.type + rule: '!(!has(self.requestRedirect) && self.type == ''RequestRedirect'')' + - message: filter.urlRewrite must be nil if the filter.type + is not URLRewrite + rule: '!(has(self.urlRewrite) && self.type != ''URLRewrite'')' + - message: filter.urlRewrite must be specified for URLRewrite + filter.type + rule: '!(!has(self.urlRewrite) && self.type == ''URLRewrite'')' + - message: filter.extensionRef must be nil if the filter.type + is not ExtensionRef + rule: '!(has(self.extensionRef) && self.type != ''ExtensionRef'')' + - message: filter.extensionRef must be specified for ExtensionRef + filter.type + rule: '!(!has(self.extensionRef) && self.type == ''ExtensionRef'')' + maxItems: 16 + type: array + x-kubernetes-validations: + - message: May specify either httpRouteFilterRequestRedirect + or httpRouteFilterRequestRewrite, but not both + rule: '!(self.exists(f, f.type == ''RequestRedirect'') && + self.exists(f, f.type == ''URLRewrite''))' + - message: RequestHeaderModifier filter cannot be repeated + rule: self.filter(f, f.type == 'RequestHeaderModifier').size() + <= 1 + - message: ResponseHeaderModifier filter cannot be repeated + rule: self.filter(f, f.type == 'ResponseHeaderModifier').size() + <= 1 + - message: RequestRedirect filter cannot be repeated + rule: self.filter(f, f.type == 'RequestRedirect').size() <= + 1 + - message: URLRewrite filter cannot be repeated + rule: self.filter(f, f.type == 'URLRewrite').size() <= 1 + matches: + default: + - path: + type: PathPrefix + value: / + description: |- + Matches define conditions used for matching the rule against incoming + HTTP requests. Each match is independent, i.e. this rule will be matched + if **any** one of the matches is satisfied. + + For example, take the following matches configuration: + + ``` + matches: + - path: + value: "/foo" + headers: + - name: "version" + value: "v2" + - path: + value: "/v2/foo" + ``` + + For a request to match against this rule, a request must satisfy + EITHER of the two conditions: + + - path prefixed with `/foo` AND contains the header `version: v2` + - path prefix of `/v2/foo` + + See the documentation for HTTPRouteMatch on how to specify multiple + match conditions that should be ANDed together. + + If no matches are specified, the default is a prefix + path match on "/", which has the effect of matching every + HTTP request. + + Proxy or Load Balancer routing configuration generated from HTTPRoutes + MUST prioritize matches based on the following criteria, continuing on + ties. Across all rules specified on applicable Routes, precedence must be + given to the match having: + + * "Exact" path match. + * "Prefix" path match with largest number of characters. + * Method match. + * Largest number of header matches. + * Largest number of query param matches. + + Note: The precedence of RegularExpression path matches are implementation-specific. + + If ties still exist across multiple Routes, matching precedence MUST be + determined in order of the following criteria, continuing on ties: + + * The oldest Route based on creation timestamp. + * The Route appearing first in alphabetical order by + "{namespace}/{name}". + + If ties still exist within an HTTPRoute, matching precedence MUST be granted + to the FIRST matching rule (in list order) with a match meeting the above + criteria. + + When no rules matching a request have been successfully attached to the + parent a request is coming from, a HTTP 404 status code MUST be returned. + items: + description: "HTTPRouteMatch defines the predicate used to + match requests to a given\naction. Multiple match types + are ANDed together, i.e. the match will\nevaluate to true + only if all conditions are satisfied.\n\nFor example, the + match below will match a HTTP request only if its path\nstarts + with `/foo` AND it contains the `version: v1` header:\n\n```\nmatch:\n\n\tpath:\n\t + \ value: \"/foo\"\n\theaders:\n\t- name: \"version\"\n\t + \ value \"v1\"\n\n```" + properties: + headers: + description: |- + Headers specifies HTTP request header matchers. Multiple match values are + ANDed together, meaning, a request must match all the specified headers + to select the route. + items: + description: |- + HTTPHeaderMatch describes how to select a HTTP route by matching HTTP request + headers. + properties: + name: + description: |- + Name is the name of the HTTP Header to be matched. Name matching MUST be + case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). + + If multiple entries specify equivalent header names, only the first + entry with an equivalent name MUST be considered for a match. Subsequent + entries with an equivalent header name MUST be ignored. Due to the + case-insensitivity of header names, "foo" and "Foo" are considered + equivalent. + + When a header is repeated in an HTTP request, it is + implementation-specific behavior as to how this is represented. + Generally, proxies should follow the guidance from the RFC: + https://www.rfc-editor.org/rfc/rfc7230.html#section-3.2.2 regarding + processing a repeated header, with special handling for "Set-Cookie". + maxLength: 256 + minLength: 1 + pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ + type: string + type: + default: Exact + description: |- + Type specifies how to match against the value of the header. + + Support: Core (Exact) + + Support: Implementation-specific (RegularExpression) + + Since RegularExpression HeaderMatchType has implementation-specific + conformance, implementations can support POSIX, PCRE or any other dialects + of regular expressions. Please read the implementation's documentation to + determine the supported dialect. + enum: + - Exact + - RegularExpression + type: string + value: + description: Value is the value of HTTP Header to + be matched. + maxLength: 4096 + minLength: 1 + type: string + required: + - name + - value + type: object + maxItems: 16 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + method: + description: |- + Method specifies HTTP method matcher. + When specified, this route will be matched only if the request has the + specified method. + + Support: Extended + enum: + - GET + - HEAD + - POST + - PUT + - DELETE + - CONNECT + - OPTIONS + - TRACE + - PATCH + type: string + path: + default: + type: PathPrefix + value: / + description: |- + Path specifies a HTTP request path matcher. If this field is not + specified, a default prefix match on the "/" path is provided. + properties: + type: + default: PathPrefix + description: |- + Type specifies how to match against the path Value. + + Support: Core (Exact, PathPrefix) + + Support: Implementation-specific (RegularExpression) + enum: + - Exact + - PathPrefix + - RegularExpression + type: string + value: + default: / + description: Value of the HTTP path to match against. + maxLength: 1024 + type: string + type: object + x-kubernetes-validations: + - message: value must be an absolute path and start with + '/' when type one of ['Exact', 'PathPrefix'] + rule: '(self.type in [''Exact'',''PathPrefix'']) ? self.value.startsWith(''/'') + : true' + - message: must not contain '//' when type one of ['Exact', + 'PathPrefix'] + rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.contains(''//'') + : true' + - message: must not contain '/./' when type one of ['Exact', + 'PathPrefix'] + rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.contains(''/./'') + : true' + - message: must not contain '/../' when type one of ['Exact', + 'PathPrefix'] + rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.contains(''/../'') + : true' + - message: must not contain '%2f' when type one of ['Exact', + 'PathPrefix'] + rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.contains(''%2f'') + : true' + - message: must not contain '%2F' when type one of ['Exact', + 'PathPrefix'] + rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.contains(''%2F'') + : true' + - message: must not contain '#' when type one of ['Exact', + 'PathPrefix'] + rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.contains(''#'') + : true' + - message: must not end with '/..' when type one of ['Exact', + 'PathPrefix'] + rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.endsWith(''/..'') + : true' + - message: must not end with '/.' when type one of ['Exact', + 'PathPrefix'] + rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.endsWith(''/.'') + : true' + - message: type must be one of ['Exact', 'PathPrefix', + 'RegularExpression'] + rule: self.type in ['Exact','PathPrefix'] || self.type + == 'RegularExpression' + - message: must only contain valid characters (matching + ^(?:[-A-Za-z0-9/._~!$&'()*+,;=:@]|[%][0-9a-fA-F]{2})+$) + for types ['Exact', 'PathPrefix'] + rule: '(self.type in [''Exact'',''PathPrefix'']) ? self.value.matches(r"""^(?:[-A-Za-z0-9/._~!$&''()*+,;=:@]|[%][0-9a-fA-F]{2})+$""") + : true' + queryParams: + description: |- + QueryParams specifies HTTP query parameter matchers. Multiple match + values are ANDed together, meaning, a request must match all the + specified query parameters to select the route. + + Support: Extended + items: + description: |- + HTTPQueryParamMatch describes how to select a HTTP route by matching HTTP + query parameters. + properties: + name: + description: |- + Name is the name of the HTTP query param to be matched. This must be an + exact string match. (See + https://tools.ietf.org/html/rfc7230#section-2.7.3). + + If multiple entries specify equivalent query param names, only the first + entry with an equivalent name MUST be considered for a match. Subsequent + entries with an equivalent query param name MUST be ignored. + + If a query param is repeated in an HTTP request, the behavior is + purposely left undefined, since different data planes have different + capabilities. However, it is *recommended* that implementations should + match against the first value of the param if the data plane supports it, + as this behavior is expected in other load balancing contexts outside of + the Gateway API. + + Users SHOULD NOT route traffic based on repeated query params to guard + themselves against potential differences in the implementations. + maxLength: 256 + minLength: 1 + pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ + type: string + type: + default: Exact + description: |- + Type specifies how to match against the value of the query parameter. + + Support: Extended (Exact) + + Support: Implementation-specific (RegularExpression) + + Since RegularExpression QueryParamMatchType has Implementation-specific + conformance, implementations can support POSIX, PCRE or any other + dialects of regular expressions. Please read the implementation's + documentation to determine the supported dialect. + enum: + - Exact + - RegularExpression + type: string + value: + description: Value is the value of HTTP query param + to be matched. + maxLength: 1024 + minLength: 1 + type: string + required: + - name + - value + type: object + maxItems: 16 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + type: object + maxItems: 64 + type: array + timeouts: + description: |- + Timeouts defines the timeouts that can be configured for an HTTP request. + + Support: Extended + properties: + backendRequest: + description: |- + BackendRequest specifies a timeout for an individual request from the gateway + to a backend. This covers the time from when the request first starts being + sent from the gateway to when the full response has been received from the backend. + + Setting a timeout to the zero duration (e.g. "0s") SHOULD disable the timeout + completely. Implementations that cannot completely disable the timeout MUST + instead interpret the zero duration as the longest possible value to which + the timeout can be set. + + An entire client HTTP transaction with a gateway, covered by the Request timeout, + may result in more than one call from the gateway to the destination backend, + for example, if automatic retries are supported. + + The value of BackendRequest must be a Gateway API Duration string as defined by + GEP-2257. When this field is unspecified, its behavior is implementation-specific; + when specified, the value of BackendRequest must be no more than the value of the + Request timeout (since the Request timeout encompasses the BackendRequest timeout). + + Support: Extended + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string + request: + description: |- + Request specifies the maximum duration for a gateway to respond to an HTTP request. + If the gateway has not been able to respond before this deadline is met, the gateway + MUST return a timeout error. + + For example, setting the `rules.timeouts.request` field to the value `10s` in an + `HTTPRoute` will cause a timeout if a client request is taking longer than 10 seconds + to complete. + + Setting a timeout to the zero duration (e.g. "0s") SHOULD disable the timeout + completely. Implementations that cannot completely disable the timeout MUST + instead interpret the zero duration as the longest possible value to which + the timeout can be set. + + This timeout is intended to cover as close to the whole request-response transaction + as possible although an implementation MAY choose to start the timeout after the entire + request stream has been received instead of immediately after the transaction is + initiated by the client. + + The value of Request is a Gateway API Duration string as defined by GEP-2257. When this + field is unspecified, request timeout behavior is implementation-specific. + + Support: Extended + pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$ + type: string + type: object + x-kubernetes-validations: + - message: backendRequest timeout cannot be longer than request + timeout + rule: '!(has(self.request) && has(self.backendRequest) && + duration(self.request) != duration(''0s'') && duration(self.backendRequest) + > duration(self.request))' + type: object + x-kubernetes-validations: + - message: RequestRedirect filter must not be used together with + backendRefs + rule: '(has(self.backendRefs) && size(self.backendRefs) > 0) ? + (!has(self.filters) || self.filters.all(f, !has(f.requestRedirect))): + true' + - message: When using RequestRedirect filter with path.replacePrefixMatch, + exactly one PathPrefix match must be specified + rule: '(has(self.filters) && self.filters.exists_one(f, has(f.requestRedirect) + && has(f.requestRedirect.path) && f.requestRedirect.path.type + == ''ReplacePrefixMatch'' && has(f.requestRedirect.path.replacePrefixMatch))) + ? ((size(self.matches) != 1 || !has(self.matches[0].path) || + self.matches[0].path.type != ''PathPrefix'') ? false : true) + : true' + - message: When using URLRewrite filter with path.replacePrefixMatch, + exactly one PathPrefix match must be specified + rule: '(has(self.filters) && self.filters.exists_one(f, has(f.urlRewrite) + && has(f.urlRewrite.path) && f.urlRewrite.path.type == ''ReplacePrefixMatch'' + && has(f.urlRewrite.path.replacePrefixMatch))) ? ((size(self.matches) + != 1 || !has(self.matches[0].path) || self.matches[0].path.type + != ''PathPrefix'') ? false : true) : true' + - message: Within backendRefs, when using RequestRedirect filter + with path.replacePrefixMatch, exactly one PathPrefix match must + be specified + rule: '(has(self.backendRefs) && self.backendRefs.exists_one(b, + (has(b.filters) && b.filters.exists_one(f, has(f.requestRedirect) + && has(f.requestRedirect.path) && f.requestRedirect.path.type + == ''ReplacePrefixMatch'' && has(f.requestRedirect.path.replacePrefixMatch))) + )) ? ((size(self.matches) != 1 || !has(self.matches[0].path) + || self.matches[0].path.type != ''PathPrefix'') ? false : true) + : true' + - message: Within backendRefs, When using URLRewrite filter with + path.replacePrefixMatch, exactly one PathPrefix match must be + specified + rule: '(has(self.backendRefs) && self.backendRefs.exists_one(b, + (has(b.filters) && b.filters.exists_one(f, has(f.urlRewrite) + && has(f.urlRewrite.path) && f.urlRewrite.path.type == ''ReplacePrefixMatch'' + && has(f.urlRewrite.path.replacePrefixMatch))) )) ? ((size(self.matches) + != 1 || !has(self.matches[0].path) || self.matches[0].path.type + != ''PathPrefix'') ? false : true) : true' + maxItems: 16 + type: array + x-kubernetes-validations: + - message: While 16 rules and 64 matches per rule are allowed, the + total number of matches across all rules in a route must be less + than 128 + rule: '(self.size() > 0 ? self[0].matches.size() : 0) + (self.size() + > 1 ? self[1].matches.size() : 0) + (self.size() > 2 ? self[2].matches.size() + : 0) + (self.size() > 3 ? self[3].matches.size() : 0) + (self.size() + > 4 ? self[4].matches.size() : 0) + (self.size() > 5 ? self[5].matches.size() + : 0) + (self.size() > 6 ? self[6].matches.size() : 0) + (self.size() + > 7 ? self[7].matches.size() : 0) + (self.size() > 8 ? self[8].matches.size() + : 0) + (self.size() > 9 ? self[9].matches.size() : 0) + (self.size() + > 10 ? self[10].matches.size() : 0) + (self.size() > 11 ? self[11].matches.size() + : 0) + (self.size() > 12 ? self[12].matches.size() : 0) + (self.size() + > 13 ? self[13].matches.size() : 0) + (self.size() > 14 ? self[14].matches.size() + : 0) + (self.size() > 15 ? self[15].matches.size() : 0) <= 128' + type: object + status: + description: Status defines the current state of HTTPRoute. + properties: + parents: + description: |- + Parents is a list of parent resources (usually Gateways) that are + associated with the route, and the status of the route with respect to + each parent. When this route attaches to a parent, the controller that + manages the parent must add an entry to this list when the controller + first sees the route and should update the entry as appropriate when the + route or gateway is modified. + + Note that parent references that cannot be resolved by an implementation + of this API will not be added to this list. Implementations of this API + can only populate Route status for the Gateways/parent resources they are + responsible for. + + A maximum of 32 Gateways will be represented in this list. An empty list + means the route has not been attached to any Gateway. + items: + description: |- + RouteParentStatus describes the status of a route with respect to an + associated Parent. + properties: + conditions: + description: |- + Conditions describes the status of the route with respect to the Gateway. + Note that the route's availability is also subject to the Gateway's own + status conditions and listener status. + + If the Route's ParentRef specifies an existing Gateway that supports + Routes of this kind AND that Gateway's controller has sufficient access, + then that Gateway's controller MUST set the "Accepted" condition on the + Route, to indicate whether the route has been accepted or rejected by the + Gateway, and why. + + A Route MUST be considered "Accepted" if at least one of the Route's + rules is implemented by the Gateway. + + There are a number of cases where the "Accepted" condition may not be set + due to lack of controller visibility, that includes when: + + * The Route refers to a non-existent parent. + * The Route is of a type that the controller does not support. + * The Route is in a namespace the controller does not have access to. + items: + description: Condition contains details for one aspect of + the current state of this API Resource. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, + Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + maxItems: 8 + minItems: 1 + type: array + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + controllerName: + description: |- + ControllerName is a domain/path string that indicates the name of the + controller that wrote this status. This corresponds with the + controllerName field on GatewayClass. + + Example: "example.net/gateway-controller". + + The format of this field is DOMAIN "/" PATH, where DOMAIN and PATH are + valid Kubernetes names + (https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names). + + Controllers MUST populate this field when writing status. Controllers should ensure that + entries to status populated with their ControllerName are cleaned up when they are no + longer necessary. + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$ + type: string + parentRef: + description: |- + ParentRef corresponds with a ParentRef in the spec that this + RouteParentStatus struct describes the status of. + properties: + group: + default: gateway.networking.k8s.io + description: |- + Group is the group of the referent. + When unspecified, "gateway.networking.k8s.io" is inferred. + To set the core API group (such as for a "Service" kind referent), + Group must be explicitly set to "" (empty string). + + Support: Core + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + default: Gateway + description: |- + Kind is kind of the referent. + + There are two kinds of parent resources with "Core" support: + + * Gateway (Gateway conformance profile) + * Service (Mesh conformance profile, ClusterIP Services only) + + Support for other resources is Implementation-Specific. + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: |- + Name is the name of the referent. + + Support: Core + maxLength: 253 + minLength: 1 + type: string + namespace: + description: |- + Namespace is the namespace of the referent. When unspecified, this refers + to the local namespace of the Route. + + Note that there are specific rules for ParentRefs which cross namespace + boundaries. Cross-namespace references are only valid if they are explicitly + allowed by something in the namespace they are referring to. For example: + Gateway has the AllowedRoutes field, and ReferenceGrant provides a + generic way to enable any other kind of cross-namespace reference. + + + + Support: Core + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + port: + description: |- + Port is the network port this Route targets. It can be interpreted + differently based on the type of parent resource. + + When the parent resource is a Gateway, this targets all listeners + listening on the specified port that also support this kind of Route(and + select this Route). It's not recommended to set `Port` unless the + networking behaviors specified in a Route must apply to a specific port + as opposed to a listener(s) whose port(s) may be changed. When both Port + and SectionName are specified, the name and port of the selected listener + must match both specified values. + + + + Implementations MAY choose to support other parent resources. + Implementations supporting other types of parent resources MUST clearly + document how/if Port is interpreted. + + For the purpose of status, an attachment is considered successful as + long as the parent resource accepts it partially. For example, Gateway + listeners can restrict which Routes can attach to them by Route kind, + namespace, or hostname. If 1 of 2 Gateway listeners accept attachment + from the referencing Route, the Route MUST be considered successfully + attached. If no Gateway listeners accept attachment from this Route, + the Route MUST be considered detached from the Gateway. + + Support: Extended + format: int32 + maximum: 65535 + minimum: 1 + type: integer + sectionName: + description: |- + SectionName is the name of a section within the target resource. In the + following resources, SectionName is interpreted as the following: + + * Gateway: Listener name. When both Port (experimental) and SectionName + are specified, the name and port of the selected listener must match + both specified values. + * Service: Port name. When both Port (experimental) and SectionName + are specified, the name and port of the selected listener must match + both specified values. + + Implementations MAY choose to support attaching Routes to other resources. + If that is the case, they MUST clearly document how SectionName is + interpreted. + + When unspecified (empty string), this will reference the entire resource. + For the purpose of status, an attachment is considered successful if at + least one section in the parent resource accepts it. For example, Gateway + listeners can restrict which Routes can attach to them by Route kind, + namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from + the referencing Route, the Route MUST be considered successfully + attached. If no Gateway listeners accept attachment from this Route, the + Route MUST be considered detached from the Gateway. + + Support: Core + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + required: + - name + type: object + required: + - controllerName + - parentRef + type: object + maxItems: 32 + type: array + required: + - parents + type: object + required: + - spec + type: object + served: true + storage: false + subresources: + status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: null + storedVersions: null +--- +# +# config/crd/standard/gateway.networking.k8s.io_referencegrants.yaml +# +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328 + gateway.networking.k8s.io/bundle-version: v1.2.1 + gateway.networking.k8s.io/channel: standard + creationTimestamp: null + name: referencegrants.gateway.networking.k8s.io +spec: + group: gateway.networking.k8s.io + names: + categories: + - gateway-api + kind: ReferenceGrant + listKind: ReferenceGrantList + plural: referencegrants + shortNames: + - refgrant + singular: referencegrant + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1beta1 + schema: + openAPIV3Schema: + description: |- + ReferenceGrant identifies kinds of resources in other namespaces that are + trusted to reference the specified kinds of resources in the same namespace + as the policy. + + Each ReferenceGrant can be used to represent a unique trust relationship. + Additional Reference Grants can be used to add to the set of trusted + sources of inbound references for the namespace they are defined within. + + All cross-namespace references in Gateway API (with the exception of cross-namespace + Gateway-route attachment) require a ReferenceGrant. + + ReferenceGrant is a form of runtime verification allowing users to assert + which cross-namespace object references are permitted. Implementations that + support ReferenceGrant MUST NOT permit cross-namespace references which have + no grant, and MUST respond to the removal of a grant by revoking the access + that the grant allowed. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: Spec defines the desired state of ReferenceGrant. + properties: + from: + description: |- + From describes the trusted namespaces and kinds that can reference the + resources described in "To". Each entry in this list MUST be considered + to be an additional place that references can be valid from, or to put + this another way, entries MUST be combined using OR. + + Support: Core + items: + description: ReferenceGrantFrom describes trusted namespaces and + kinds. + properties: + group: + description: |- + Group is the group of the referent. + When empty, the Kubernetes core API group is inferred. + + Support: Core + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + description: |- + Kind is the kind of the referent. Although implementations may support + additional resources, the following types are part of the "Core" + support level for this field. + + When used to permit a SecretObjectReference: + + * Gateway + + When used to permit a BackendObjectReference: + + * GRPCRoute + * HTTPRoute + * TCPRoute + * TLSRoute + * UDPRoute + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + namespace: + description: |- + Namespace is the namespace of the referent. + + Support: Core + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - group + - kind + - namespace + type: object + maxItems: 16 + minItems: 1 + type: array + to: + description: |- + To describes the resources that may be referenced by the resources + described in "From". Each entry in this list MUST be considered to be an + additional place that references can be valid to, or to put this another + way, entries MUST be combined using OR. + + Support: Core + items: + description: |- + ReferenceGrantTo describes what Kinds are allowed as targets of the + references. + properties: + group: + description: |- + Group is the group of the referent. + When empty, the Kubernetes core API group is inferred. + + Support: Core + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + description: |- + Kind is the kind of the referent. Although implementations may support + additional resources, the following types are part of the "Core" + support level for this field: + + * Secret when used to permit a SecretObjectReference + * Service when used to permit a BackendObjectReference + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: |- + Name is the name of the referent. When unspecified, this policy + refers to all resources of the specified Group and Kind in the local + namespace. + maxLength: 253 + minLength: 1 + type: string + required: + - group + - kind + type: object + maxItems: 16 + minItems: 1 + type: array + required: + - from + - to + type: object + type: object + served: true + storage: true + subresources: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: null + storedVersions: null + +--- +# Source: traefik/crds/hub.traefik.io_accesscontrolpolicies.yaml +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.17.1 + name: accesscontrolpolicies.hub.traefik.io +spec: + group: hub.traefik.io + names: + kind: AccessControlPolicy + listKind: AccessControlPolicyList + plural: accesscontrolpolicies + singular: accesscontrolpolicy + scope: Cluster + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: AccessControlPolicy defines an access control policy. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: AccessControlPolicySpec configures an access control policy. + properties: + apiKey: + description: AccessControlPolicyAPIKey configure an APIKey control + policy. + properties: + forwardHeaders: + additionalProperties: + type: string + description: ForwardHeaders instructs the middleware to forward + key metadata as header values upon successful authentication. + type: object + keySource: + description: KeySource defines how to extract API keys from requests. + properties: + cookie: + description: Cookie is the name of a cookie. + type: string + header: + description: Header is the name of a header. + type: string + headerAuthScheme: + description: |- + HeaderAuthScheme sets an optional auth scheme when Header is set to "Authorization". + If set, this scheme is removed from the token, and all requests not including it are dropped. + type: string + query: + description: Query is the name of a query parameter. + type: string + type: object + keys: + description: Keys define the set of authorized keys to access + a protected resource. + items: + description: AccessControlPolicyAPIKeyKey defines an API key. + properties: + id: + description: ID is the unique identifier of the key. + type: string + metadata: + additionalProperties: + type: string + description: Metadata holds arbitrary metadata for this + key, can be used by ForwardHeaders. + type: object + value: + description: Value is the SHAKE-256 hash (using 64 bytes) + of the API key. + type: string + required: + - id + - value + type: object + type: array + required: + - keySource + type: object + basicAuth: + description: AccessControlPolicyBasicAuth holds the HTTP basic authentication + configuration. + properties: + forwardUsernameHeader: + type: string + realm: + type: string + stripAuthorizationHeader: + type: boolean + users: + items: + type: string + type: array + type: object + jwt: + description: AccessControlPolicyJWT configures a JWT access control + policy. + properties: + claims: + type: string + forwardHeaders: + additionalProperties: + type: string + type: object + jwksFile: + type: string + jwksUrl: + type: string + publicKey: + type: string + signingSecret: + type: string + signingSecretBase64Encoded: + type: boolean + stripAuthorizationHeader: + type: boolean + tokenQueryKey: + type: string + type: object + oAuthIntro: + description: AccessControlOAuthIntro configures an OAuth 2.0 Token + Introspection access control policy. + properties: + claims: + type: string + clientConfig: + description: AccessControlOAuthIntroClientConfig configures the + OAuth 2.0 client for issuing token introspection requests. + properties: + headers: + additionalProperties: + type: string + description: Headers to set when sending requests to the Authorization + Server. + type: object + maxRetries: + default: 3 + description: MaxRetries defines the number of retries for + introspection requests. + type: integer + timeoutSeconds: + default: 5 + description: TimeoutSeconds configures the maximum amount + of seconds to wait before giving up on requests. + type: integer + tls: + description: TLS configures TLS communication with the Authorization + Server. + properties: + ca: + description: CA sets the CA bundle used to sign the Authorization + Server certificate. + type: string + insecureSkipVerify: + description: |- + InsecureSkipVerify skips the Authorization Server certificate validation. + For testing purposes only, do not use in production. + type: boolean + type: object + tokenTypeHint: + description: |- + TokenTypeHint is a hint to pass to the Authorization Server. + See https://tools.ietf.org/html/rfc7662#section-2.1 for more information. + type: string + url: + description: URL of the Authorization Server. + type: string + required: + - url + type: object + forwardHeaders: + additionalProperties: + type: string + type: object + tokenSource: + description: |- + TokenSource describes how to extract tokens from HTTP requests. + If multiple sources are set, the order is the following: header > query > cookie. + properties: + cookie: + description: Cookie is the name of a cookie. + type: string + header: + description: Header is the name of a header. + type: string + headerAuthScheme: + description: |- + HeaderAuthScheme sets an optional auth scheme when Header is set to "Authorization". + If set, this scheme is removed from the token, and all requests not including it are dropped. + type: string + query: + description: Query is the name of a query parameter. + type: string + type: object + required: + - clientConfig + - tokenSource + type: object + oidc: + description: AccessControlPolicyOIDC holds the OIDC authentication + configuration. + properties: + authParams: + additionalProperties: + type: string + type: object + claims: + type: string + clientId: + type: string + disableAuthRedirectionPaths: + items: + type: string + type: array + forwardHeaders: + additionalProperties: + type: string + type: object + issuer: + type: string + logoutUrl: + type: string + redirectUrl: + type: string + scopes: + items: + type: string + type: array + secret: + description: |- + SecretReference represents a Secret Reference. It has enough information to retrieve secret + in any namespace + properties: + name: + description: name is unique within a namespace to reference + a secret resource. + type: string + namespace: + description: namespace defines the space within which the + secret name must be unique. + type: string + type: object + x-kubernetes-map-type: atomic + session: + description: Session holds session configuration. + properties: + domain: + type: string + path: + type: string + refresh: + type: boolean + sameSite: + type: string + secure: + type: boolean + type: object + stateCookie: + description: StateCookie holds state cookie configuration. + properties: + domain: + type: string + path: + type: string + sameSite: + type: string + secure: + type: boolean + type: object + type: object + oidcGoogle: + description: AccessControlPolicyOIDCGoogle holds the Google OIDC authentication + configuration. + properties: + authParams: + additionalProperties: + type: string + type: object + clientId: + type: string + emails: + description: Emails are the allowed emails to connect. + items: + type: string + minItems: 1 + type: array + forwardHeaders: + additionalProperties: + type: string + type: object + logoutUrl: + type: string + redirectUrl: + type: string + secret: + description: |- + SecretReference represents a Secret Reference. It has enough information to retrieve secret + in any namespace + properties: + name: + description: name is unique within a namespace to reference + a secret resource. + type: string + namespace: + description: namespace defines the space within which the + secret name must be unique. + type: string + type: object + x-kubernetes-map-type: atomic + session: + description: Session holds session configuration. + properties: + domain: + type: string + path: + type: string + refresh: + type: boolean + sameSite: + type: string + secure: + type: boolean + type: object + stateCookie: + description: StateCookie holds state cookie configuration. + properties: + domain: + type: string + path: + type: string + sameSite: + type: string + secure: + type: boolean + type: object + type: object + type: object + status: + description: The current status of this access control policy. + properties: + specHash: + type: string + syncedAt: + format: date-time + type: string + version: + type: string + type: object + type: object + served: true + storage: true + +--- +# Source: traefik/crds/hub.traefik.io_aiservices.yaml +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.17.1 + name: aiservices.hub.traefik.io +spec: + group: hub.traefik.io + names: + kind: AIService + listKind: AIServiceList + plural: aiservices + singular: aiservice + scope: Namespaced + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: AIService is a Kubernetes-like Service to interact with a text-based + LLM provider. It defines the parameters and credentials required to interact + with various LLM providers. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: The desired behavior of this AIService. + properties: + anthropic: + description: Anthropic configures Anthropic backend. + properties: + model: + type: string + params: + description: Params holds the LLM hyperparameters. + properties: + frequencyPenalty: + type: number + maxTokens: + type: integer + presencePenalty: + type: number + temperature: + type: number + topP: + type: number + type: object + token: + type: string + required: + - token + type: object + azureOpenai: + description: AzureOpenAI configures AzureOpenAI. + properties: + apiKey: + type: string + baseUrl: + type: string + deploymentName: + type: string + model: + type: string + params: + description: Params holds the LLM hyperparameters. + properties: + frequencyPenalty: + type: number + maxTokens: + type: integer + presencePenalty: + type: number + temperature: + type: number + topP: + type: number + type: object + required: + - apiKey + - baseUrl + - deploymentName + type: object + bedrock: + description: Bedrock configures Bedrock backend. + properties: + model: + type: string + params: + description: Params holds the LLM hyperparameters. + properties: + frequencyPenalty: + type: number + maxTokens: + type: integer + presencePenalty: + type: number + temperature: + type: number + topP: + type: number + type: object + region: + type: string + systemMessage: + type: boolean + type: object + cohere: + description: Cohere configures Cohere backend. + properties: + model: + type: string + params: + description: Params holds the LLM hyperparameters. + properties: + frequencyPenalty: + type: number + maxTokens: + type: integer + presencePenalty: + type: number + temperature: + type: number + topP: + type: number + type: object + token: + type: string + required: + - token + type: object + deepSeek: + description: DeepSeek configures DeepSeek. + properties: + baseUrl: + type: string + model: + type: string + params: + description: Params holds the LLM hyperparameters. + properties: + frequencyPenalty: + type: number + maxTokens: + type: integer + presencePenalty: + type: number + temperature: + type: number + topP: + type: number + type: object + token: + type: string + required: + - token + type: object + gemini: + description: Gemini configures Gemini backend. + properties: + apiKey: + type: string + model: + type: string + params: + description: Params holds the LLM hyperparameters. + properties: + frequencyPenalty: + type: number + maxTokens: + type: integer + presencePenalty: + type: number + temperature: + type: number + topP: + type: number + type: object + required: + - apiKey + type: object + mistral: + description: Mistral configures Mistral AI backend. + properties: + apiKey: + type: string + model: + type: string + params: + description: Params holds the LLM hyperparameters. + properties: + frequencyPenalty: + type: number + maxTokens: + type: integer + presencePenalty: + type: number + temperature: + type: number + topP: + type: number + type: object + required: + - apiKey + type: object + ollama: + description: Ollama configures Ollama backend. + properties: + baseUrl: + type: string + model: + type: string + params: + description: Params holds the LLM hyperparameters. + properties: + frequencyPenalty: + type: number + maxTokens: + type: integer + presencePenalty: + type: number + temperature: + type: number + topP: + type: number + type: object + required: + - baseUrl + type: object + openai: + description: OpenAI configures OpenAI. + properties: + baseUrl: + type: string + model: + type: string + params: + description: Params holds the LLM hyperparameters. + properties: + frequencyPenalty: + type: number + maxTokens: + type: integer + presencePenalty: + type: number + temperature: + type: number + topP: + type: number + type: object + token: + type: string + required: + - token + type: object + qWen: + description: QWen configures QWen. + properties: + baseUrl: + type: string + model: + type: string + params: + description: Params holds the LLM hyperparameters. + properties: + frequencyPenalty: + type: number + maxTokens: + type: integer + presencePenalty: + type: number + temperature: + type: number + topP: + type: number + type: object + token: + type: string + required: + - token + type: object + type: object + type: object + served: true + storage: true + +--- +# Source: traefik/crds/hub.traefik.io_apiaccesses.yaml +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.17.1 + name: apiaccesses.hub.traefik.io +spec: + group: hub.traefik.io + names: + kind: APIAccess + listKind: APIAccessList + plural: apiaccesses + singular: apiaccess + scope: Namespaced + versions: + - deprecated: true + deprecationWarning: APIAccess is deprecated in favor of APICatalogItems and ManagedSubscription + name: v1alpha1 + schema: + openAPIV3Schema: + description: APIAccess defines who can access to a set of APIs. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: The desired behavior of this APIAccess. + properties: + apiBundles: + description: |- + APIBundles defines a set of APIBundle that will be accessible to the configured audience. + Multiple APIAccesses can select the same APIBundles. + items: + description: APIBundleReference references an APIBundle. + properties: + name: + description: Name of the APIBundle. + maxLength: 253 + type: string + required: + - name + type: object + maxItems: 100 + type: array + x-kubernetes-validations: + - message: duplicated apiBundles + rule: self.all(x, self.exists_one(y, x.name == y.name)) + apiPlan: + description: APIPlan defines which APIPlan will be used. + properties: + name: + description: Name of the APIPlan. + maxLength: 253 + type: string + required: + - name + type: object + apiSelector: + description: |- + APISelector selects the APIs that will be accessible to the configured audience. + Multiple APIAccesses can select the same set of APIs. + This field is optional and follows standard label selector semantics. + An empty APISelector matches any API. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + apis: + description: |- + APIs defines a set of APIs that will be accessible to the configured audience. + Multiple APIAccesses can select the same APIs. + When combined with APISelector, this set of APIs is appended to the matching APIs. + items: + description: APIReference references an API. + properties: + name: + description: Name of the API. + maxLength: 253 + type: string + required: + - name + type: object + maxItems: 100 + type: array + x-kubernetes-validations: + - message: duplicated apis + rule: self.all(x, self.exists_one(y, x.name == y.name)) + everyone: + description: Everyone indicates that all users will have access to + the selected APIs. + type: boolean + groups: + description: Groups are the consumer groups that will gain access + to the selected APIs. + items: + type: string + type: array + operationFilter: + description: |- + OperationFilter specifies the allowed operations on APIs and APIVersions. + If not set, all operations are available. + An empty OperationFilter prohibits all operations. + properties: + include: + description: Include defines the names of OperationSets that will + be accessible. + items: + type: string + maxItems: 100 + type: array + type: object + weight: + description: Weight specifies the evaluation order of the plan. + type: integer + x-kubernetes-validations: + - message: must be a positive number + rule: self >= 0 + type: object + x-kubernetes-validations: + - message: groups and everyone are mutually exclusive + rule: '(has(self.everyone) && has(self.groups)) ? !(self.everyone && + self.groups.size() > 0) : true' + status: + description: The current status of this APIAccess. + properties: + hash: + description: Hash is a hash representing the APIAccess. + type: string + syncedAt: + format: date-time + type: string + version: + type: string + type: object + type: object + served: true + storage: true + +--- +# Source: traefik/crds/hub.traefik.io_apibundles.yaml +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.17.1 + name: apibundles.hub.traefik.io +spec: + group: hub.traefik.io + names: + kind: APIBundle + listKind: APIBundleList + plural: apibundles + singular: apibundle + scope: Namespaced + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: APIBundle defines a set of APIs. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: The desired behavior of this APIBundle. + properties: + apiSelector: + description: |- + APISelector selects the APIs that will be accessible to the configured audience. + Multiple APIBundles can select the same set of APIs. + This field is optional and follows standard label selector semantics. + An empty APISelector matches any API. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + apis: + description: |- + APIs defines a set of APIs that will be accessible to the configured audience. + Multiple APIBundles can select the same APIs. + When combined with APISelector, this set of APIs is appended to the matching APIs. + items: + description: APIReference references an API. + properties: + name: + description: Name of the API. + maxLength: 253 + type: string + required: + - name + type: object + maxItems: 100 + type: array + x-kubernetes-validations: + - message: duplicated apis + rule: self.all(x, self.exists_one(y, x.name == y.name)) + title: + description: Title is the human-readable name of the APIBundle that + will be used on the portal. + maxLength: 253 + type: string + type: object + status: + description: The current status of this APIBundle. + properties: + hash: + description: Hash is a hash representing the APIBundle. + type: string + syncedAt: + format: date-time + type: string + version: + type: string + type: object + type: object + served: true + storage: true + +--- +# Source: traefik/crds/hub.traefik.io_apicatalogitems.yaml +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.17.1 + name: apicatalogitems.hub.traefik.io +spec: + group: hub.traefik.io + names: + kind: APICatalogItem + listKind: APICatalogItemList + plural: apicatalogitems + singular: apicatalogitem + scope: Namespaced + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: APICatalogItem defines APIs that will be part of the API catalog + on the portal. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: The desired behavior of this APICatalogItem. + properties: + apiBundles: + description: |- + APIBundles defines a set of APIBundle that will be visible to the configured audience. + Multiple APICatalogItem can select the same APIBundles. + items: + description: APIBundleReference references an APIBundle. + properties: + name: + description: Name of the APIBundle. + maxLength: 253 + type: string + required: + - name + type: object + maxItems: 100 + type: array + x-kubernetes-validations: + - message: duplicated apiBundles + rule: self.all(x, self.exists_one(y, x.name == y.name)) + apiPlan: + description: |- + APIPlan defines which APIPlan will be available. + If multiple APICatalogItem specify the same API with different APIPlan, the API consumer will be able to pick + a plan from this list. + properties: + name: + description: Name of the APIPlan. + maxLength: 253 + type: string + required: + - name + type: object + apiSelector: + description: |- + APISelector selects the APIs that will be visible to the configured audience. + Multiple APICatalogItem can select the same set of APIs. + This field is optional and follows standard label selector semantics. + An empty APISelector matches any API. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + apis: + description: |- + APIs defines a set of APIs that will be visible to the configured audience. + Multiple APICatalogItem can select the same APIs. + When combined with APISelector, this set of APIs is appended to the matching APIs. + items: + description: APIReference references an API. + properties: + name: + description: Name of the API. + maxLength: 253 + type: string + required: + - name + type: object + maxItems: 100 + type: array + x-kubernetes-validations: + - message: duplicated apis + rule: self.all(x, self.exists_one(y, x.name == y.name)) + everyone: + description: Everyone indicates that all users will see these APIs. + type: boolean + groups: + description: Groups are the consumer groups that will see the APIs. + items: + type: string + type: array + operationFilter: + description: |- + OperationFilter specifies the visible operations on APIs and APIVersions. + If not set, all operations are available. + An empty OperationFilter prohibits all operations. + properties: + include: + description: Include defines the names of OperationSets that will + be accessible. + items: + type: string + maxItems: 100 + type: array + type: object + type: object + x-kubernetes-validations: + - message: groups and everyone are mutually exclusive + rule: '(has(self.everyone) && has(self.groups)) ? !(self.everyone && + self.groups.size() > 0) : true' + status: + description: The current status of this APICatalogItem. + properties: + hash: + description: Hash is a hash representing the APICatalogItem. + type: string + syncedAt: + format: date-time + type: string + version: + type: string + type: object + type: object + served: true + storage: true + +--- +# Source: traefik/crds/hub.traefik.io_apiplans.yaml +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.17.1 + name: apiplans.hub.traefik.io +spec: + group: hub.traefik.io + names: + kind: APIPlan + listKind: APIPlanList + plural: apiplans + singular: apiplan + scope: Namespaced + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: APIPlan defines API Plan policy. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: The desired behavior of this APIPlan. + properties: + description: + description: Description describes the plan. + type: string + quota: + description: Quota defines the quota policy. + properties: + limit: + description: Limit is the maximum number of token in the bucket. + type: integer + x-kubernetes-validations: + - message: must be a positive number + rule: self >= 0 + period: + description: Period is the unit of time for the Limit. + format: duration + type: string + x-kubernetes-validations: + - message: must be between 1s and 9999h + rule: self >= duration('1s') && self <= duration('9999h') + required: + - limit + type: object + rateLimit: + description: RateLimit defines the rate limit policy. + properties: + limit: + description: Limit is the maximum number of token in the bucket. + type: integer + x-kubernetes-validations: + - message: must be a positive number + rule: self >= 0 + period: + description: Period is the unit of time for the Limit. + format: duration + type: string + x-kubernetes-validations: + - message: must be between 1s and 1h + rule: self >= duration('1s') && self <= duration('1h') + required: + - limit + type: object + title: + description: Title is the human-readable name of the plan. + type: string + required: + - title + type: object + status: + description: The current status of this APIPlan. + properties: + hash: + description: Hash is a hash representing the APIPlan. + type: string + syncedAt: + format: date-time + type: string + version: + type: string + type: object + type: object + served: true + storage: true + +--- +# Source: traefik/crds/hub.traefik.io_apiportals.yaml +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.17.1 + name: apiportals.hub.traefik.io +spec: + group: hub.traefik.io + names: + kind: APIPortal + listKind: APIPortalList + plural: apiportals + singular: apiportal + scope: Namespaced + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: APIPortal defines a developer portal for accessing the documentation + of APIs. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: The desired behavior of this APIPortal. + properties: + description: + description: Description of the APIPortal. + type: string + title: + description: Title is the public facing name of the APIPortal. + type: string + trustedUrls: + description: TrustedURLs are the urls that are trusted by the OAuth + 2.0 authorization server. + items: + type: string + maxItems: 1 + minItems: 1 + type: array + x-kubernetes-validations: + - message: must be a valid URLs + rule: self.all(x, isURL(x)) + ui: + description: UI holds the UI customization options. + properties: + logoUrl: + description: LogoURL is the public URL of the logo. + type: string + type: object + required: + - trustedUrls + type: object + status: + description: The current status of this APIPortal. + properties: + hash: + description: Hash is a hash representing the APIPortal. + type: string + oidc: + description: OIDC is the OIDC configuration for accessing the exposed + APIPortal WebUI. + properties: + clientId: + description: ClientID is the OIDC ClientID for accessing the exposed + APIPortal WebUI. + type: string + companyClaim: + description: CompanyClaim is the name of the JWT claim containing + the user company. + type: string + emailClaim: + description: EmailClaim is the name of the JWT claim containing + the user email. + type: string + firstnameClaim: + description: FirstnameClaim is the name of the JWT claim containing + the user firstname. + type: string + generic: + description: Generic indicates whether or not the APIPortal authentication + relies on Generic OIDC. + type: boolean + groupsClaim: + description: GroupsClaim is the name of the JWT claim containing + the user groups. + type: string + issuer: + description: Issuer is the OIDC issuer for accessing the exposed + APIPortal WebUI. + type: string + lastnameClaim: + description: LastnameClaim is the name of the JWT claim containing + the user lastname. + type: string + scopes: + description: Scopes is the OIDC scopes for getting user attributes + during the authentication to the exposed APIPortal WebUI. + type: string + secretName: + description: SecretName is the name of the secret containing the + OIDC ClientSecret for accessing the exposed APIPortal WebUI. + type: string + syncedAttributes: + description: SyncedAttributes configure the user attributes to + sync. + items: + type: string + type: array + userIdClaim: + description: UserIDClaim is the name of the JWT claim containing + the user ID. + type: string + type: object + syncedAt: + format: date-time + type: string + version: + type: string + type: object + type: object + served: true + storage: true + +--- +# Source: traefik/crds/hub.traefik.io_apiratelimits.yaml +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.17.1 + name: apiratelimits.hub.traefik.io +spec: + group: hub.traefik.io + names: + kind: APIRateLimit + listKind: APIRateLimitList + plural: apiratelimits + singular: apiratelimit + scope: Namespaced + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: APIRateLimit defines how group of consumers are rate limited + on a set of APIs. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: The desired behavior of this APIRateLimit. + properties: + apiSelector: + description: |- + APISelector selects the APIs that will be rate limited. + Multiple APIRateLimits can select the same set of APIs. + This field is optional and follows standard label selector semantics. + An empty APISelector matches any API. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + apis: + description: |- + APIs defines a set of APIs that will be rate limited. + Multiple APIRateLimits can select the same APIs. + When combined with APISelector, this set of APIs is appended to the matching APIs. + items: + description: APIReference references an API. + properties: + name: + description: Name of the API. + maxLength: 253 + type: string + required: + - name + type: object + maxItems: 100 + type: array + x-kubernetes-validations: + - message: duplicated apis + rule: self.all(x, self.exists_one(y, x.name == y.name)) + everyone: + description: |- + Everyone indicates that all users will, by default, be rate limited with this configuration. + If an APIRateLimit explicitly target a group, the default rate limit will be ignored. + type: boolean + groups: + description: |- + Groups are the consumer groups that will be rate limited. + Multiple APIRateLimits can target the same set of consumer groups, the most restrictive one applies. + When a consumer belongs to multiple groups, the least restrictive APIRateLimit applies. + items: + type: string + type: array + limit: + description: Limit is the maximum number of token in the bucket. + type: integer + x-kubernetes-validations: + - message: must be a positive number + rule: self >= 0 + period: + description: Period is the unit of time for the Limit. + format: duration + type: string + x-kubernetes-validations: + - message: must be between 1s and 1h + rule: self >= duration('1s') && self <= duration('1h') + strategy: + description: |- + Strategy defines how the bucket state will be synchronized between the different Traefik Hub instances. + It can be, either "local" or "distributed". + enum: + - local + - distributed + type: string + required: + - limit + type: object + x-kubernetes-validations: + - message: groups and everyone are mutually exclusive + rule: '(has(self.everyone) && has(self.groups)) ? !(self.everyone && + self.groups.size() > 0) : true' + status: + description: The current status of this APIRateLimit. + properties: + hash: + description: Hash is a hash representing the APIRateLimit. + type: string + syncedAt: + format: date-time + type: string + version: + type: string + type: object + type: object + served: true + storage: true + +--- +# Source: traefik/crds/hub.traefik.io_apis.yaml +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.17.1 + name: apis.hub.traefik.io +spec: + group: hub.traefik.io + names: + kind: API + listKind: APIList + plural: apis + singular: api + scope: Namespaced + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: |- + API defines an HTTP interface that is exposed to external clients. It specifies the supported versions + and provides instructions for accessing its documentation. Once instantiated, an API object is associated + with an Ingress, IngressRoute, or HTTPRoute resource, enabling the exposure of the described API to the outside world. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: APISpec describes the API. + properties: + cors: + description: Cors defines the Cross-Origin Resource Sharing configuration. + properties: + addVaryHeader: + description: AddVaryHeader defines whether the Vary header is + automatically added/updated when the AllowOriginsList is set. + type: boolean + allowCredentials: + description: AllowCredentials defines whether the request can + include user credentials. + type: boolean + allowHeadersList: + description: AllowHeadersList defines the Access-Control-Request-Headers + values sent in preflight response. + items: + type: string + type: array + allowMethodsList: + description: AllowMethodsList defines the Access-Control-Request-Method + values sent in preflight response. + items: + type: string + type: array + allowOriginListRegex: + description: AllowOriginListRegex is a list of allowable origins + written following the Regular Expression syntax (https://golang.org/pkg/regexp/). + items: + type: string + type: array + allowOriginsList: + description: AllowOriginsList is a list of allowable origins. + Can also be a wildcard origin "*". + items: + type: string + type: array + exposeHeadersList: + description: ExposeHeadersList defines the Access-Control-Expose-Headers + values sent in preflight response. + items: + type: string + type: array + maxAge: + description: MaxAge defines the time that a preflight request + may be cached. + format: int64 + type: integer + type: object + description: + description: Description explains what the API does. + type: string + openApiSpec: + description: OpenAPISpec defines the API contract as an OpenAPI specification. + properties: + operationSets: + description: OperationSets defines the sets of operations to be + referenced for granular filtering in APIAccesses. + items: + description: |- + OperationSet gives a name to a set of matching OpenAPI operations. + This set of operations can then be referenced for granular filtering in APIAccesses. + properties: + matchers: + description: Matchers defines a list of alternative rules + for matching OpenAPI operations. + items: + description: OperationMatcher defines criteria for matching + an OpenAPI operation. + minProperties: 1 + properties: + methods: + description: Methods specifies the HTTP methods to + be included for selection. + items: + type: string + maxItems: 10 + type: array + path: + description: Path specifies the exact path of the + operations to select. + maxLength: 255 + type: string + x-kubernetes-validations: + - message: must start with a '/' + rule: self.startsWith('/') + - message: cannot contains '../' + rule: '!self.matches(r"""(\/\.\.\/)|(\/\.\.$)""")' + pathPrefix: + description: PathPrefix specifies the path prefix + of the operations to select. + maxLength: 255 + type: string + x-kubernetes-validations: + - message: must start with a '/' + rule: self.startsWith('/') + - message: cannot contains '../' + rule: '!self.matches(r"""(\/\.\.\/)|(\/\.\.$)""")' + pathRegex: + description: PathRegex specifies a regular expression + pattern for matching operations based on their paths. + type: string + type: object + x-kubernetes-validations: + - message: path, pathPrefix and pathRegex are mutually + exclusive + rule: '[has(self.path), has(self.pathPrefix), has(self.pathRegex)].filter(x, + x).size() <= 1' + maxItems: 100 + minItems: 1 + type: array + name: + description: Name is the name of the OperationSet to reference + in APIAccesses. + maxLength: 253 + type: string + required: + - matchers + - name + type: object + maxItems: 100 + type: array + override: + description: Override holds data used to override OpenAPI specification. + properties: + servers: + items: + properties: + url: + type: string + x-kubernetes-validations: + - message: must be a valid URL + rule: isURL(self) + required: + - url + type: object + maxItems: 100 + minItems: 1 + type: array + required: + - servers + type: object + path: + description: |- + Path specifies the endpoint path within the Kubernetes Service where the OpenAPI specification can be obtained. + The Service queried is determined by the associated Ingress, IngressRoute, or HTTPRoute resource to which the API is attached. + It's important to note that this option is incompatible if the Ingress or IngressRoute specifies multiple backend services. + The Path must be accessible via a GET request method and should serve a YAML or JSON document containing the OpenAPI specification. + maxLength: 255 + type: string + x-kubernetes-validations: + - message: must start with a '/' + rule: self.startsWith('/') + - message: cannot contains '../' + rule: '!self.matches(r"""(\/\.\.\/)|(\/\.\.$)""")' + url: + description: |- + URL is a Traefik Hub agent accessible URL for obtaining the OpenAPI specification. + The URL must be accessible via a GET request method and should serve a YAML or JSON document containing the OpenAPI specification. + type: string + x-kubernetes-validations: + - message: must be a valid URL + rule: isURL(self) + validateRequestMethodAndPath: + description: |- + ValidateRequestMethodAndPath validates that the path and method matches an operation defined in the OpenAPI specification. + This option overrides the default behavior configured in the static configuration. + type: boolean + type: object + x-kubernetes-validations: + - message: path or url must be defined + rule: has(self.path) || has(self.url) + title: + description: Title is the human-readable name of the API that will + be used on the portal. + maxLength: 253 + type: string + versions: + description: Versions are the different APIVersions available. + items: + description: APIVersionRef references an APIVersion. + properties: + name: + description: Name of the APIVersion. + maxLength: 253 + type: string + required: + - name + type: object + maxItems: 100 + minItems: 1 + type: array + type: object + status: + description: The current status of this API. + properties: + hash: + description: Hash is a hash representing the API. + type: string + syncedAt: + format: date-time + type: string + version: + type: string + type: object + type: object + served: true + storage: true + +--- +# Source: traefik/crds/hub.traefik.io_apiversions.yaml +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.17.1 + name: apiversions.hub.traefik.io +spec: + group: hub.traefik.io + names: + kind: APIVersion + listKind: APIVersionList + plural: apiversions + singular: apiversion + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .spec.title + name: Title + type: string + - jsonPath: .spec.release + name: Release + type: string + name: v1alpha1 + schema: + openAPIV3Schema: + description: APIVersion defines a version of an API. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: The desired behavior of this APIVersion. + properties: + cors: + description: Cors defines the Cross-Origin Resource Sharing configuration. + properties: + addVaryHeader: + description: AddVaryHeader defines whether the Vary header is + automatically added/updated when the AllowOriginsList is set. + type: boolean + allowCredentials: + description: AllowCredentials defines whether the request can + include user credentials. + type: boolean + allowHeadersList: + description: AllowHeadersList defines the Access-Control-Request-Headers + values sent in preflight response. + items: + type: string + type: array + allowMethodsList: + description: AllowMethodsList defines the Access-Control-Request-Method + values sent in preflight response. + items: + type: string + type: array + allowOriginListRegex: + description: AllowOriginListRegex is a list of allowable origins + written following the Regular Expression syntax (https://golang.org/pkg/regexp/). + items: + type: string + type: array + allowOriginsList: + description: AllowOriginsList is a list of allowable origins. + Can also be a wildcard origin "*". + items: + type: string + type: array + exposeHeadersList: + description: ExposeHeadersList defines the Access-Control-Expose-Headers + values sent in preflight response. + items: + type: string + type: array + maxAge: + description: MaxAge defines the time that a preflight request + may be cached. + format: int64 + type: integer + type: object + description: + description: Description explains what the APIVersion does. + type: string + openApiSpec: + description: OpenAPISpec defines the API contract as an OpenAPI specification. + properties: + operationSets: + description: OperationSets defines the sets of operations to be + referenced for granular filtering in APIAccesses. + items: + description: |- + OperationSet gives a name to a set of matching OpenAPI operations. + This set of operations can then be referenced for granular filtering in APIAccesses. + properties: + matchers: + description: Matchers defines a list of alternative rules + for matching OpenAPI operations. + items: + description: OperationMatcher defines criteria for matching + an OpenAPI operation. + minProperties: 1 + properties: + methods: + description: Methods specifies the HTTP methods to + be included for selection. + items: + type: string + maxItems: 10 + type: array + path: + description: Path specifies the exact path of the + operations to select. + maxLength: 255 + type: string + x-kubernetes-validations: + - message: must start with a '/' + rule: self.startsWith('/') + - message: cannot contains '../' + rule: '!self.matches(r"""(\/\.\.\/)|(\/\.\.$)""")' + pathPrefix: + description: PathPrefix specifies the path prefix + of the operations to select. + maxLength: 255 + type: string + x-kubernetes-validations: + - message: must start with a '/' + rule: self.startsWith('/') + - message: cannot contains '../' + rule: '!self.matches(r"""(\/\.\.\/)|(\/\.\.$)""")' + pathRegex: + description: PathRegex specifies a regular expression + pattern for matching operations based on their paths. + type: string + type: object + x-kubernetes-validations: + - message: path, pathPrefix and pathRegex are mutually + exclusive + rule: '[has(self.path), has(self.pathPrefix), has(self.pathRegex)].filter(x, + x).size() <= 1' + maxItems: 100 + minItems: 1 + type: array + name: + description: Name is the name of the OperationSet to reference + in APIAccesses. + maxLength: 253 + type: string + required: + - matchers + - name + type: object + maxItems: 100 + type: array + override: + description: Override holds data used to override OpenAPI specification. + properties: + servers: + items: + properties: + url: + type: string + x-kubernetes-validations: + - message: must be a valid URL + rule: isURL(self) + required: + - url + type: object + maxItems: 100 + minItems: 1 + type: array + required: + - servers + type: object + path: + description: |- + Path specifies the endpoint path within the Kubernetes Service where the OpenAPI specification can be obtained. + The Service queried is determined by the associated Ingress, IngressRoute, or HTTPRoute resource to which the API is attached. + It's important to note that this option is incompatible if the Ingress or IngressRoute specifies multiple backend services. + The Path must be accessible via a GET request method and should serve a YAML or JSON document containing the OpenAPI specification. + maxLength: 255 + type: string + x-kubernetes-validations: + - message: must start with a '/' + rule: self.startsWith('/') + - message: cannot contains '../' + rule: '!self.matches(r"""(\/\.\.\/)|(\/\.\.$)""")' + url: + description: |- + URL is a Traefik Hub agent accessible URL for obtaining the OpenAPI specification. + The URL must be accessible via a GET request method and should serve a YAML or JSON document containing the OpenAPI specification. + type: string + x-kubernetes-validations: + - message: must be a valid URL + rule: isURL(self) + validateRequestMethodAndPath: + description: |- + ValidateRequestMethodAndPath validates that the path and method matches an operation defined in the OpenAPI specification. + This option overrides the default behavior configured in the static configuration. + type: boolean + type: object + x-kubernetes-validations: + - message: path or url must be defined + rule: has(self.path) || has(self.url) + release: + description: |- + Release is the version number of the API. + This value must follow the SemVer format: https://semver.org/ + maxLength: 100 + type: string + x-kubernetes-validations: + - message: must be a valid semver version + rule: self.matches(r"""^v?(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?$""") + title: + description: Title is the public facing name of the APIVersion. + type: string + required: + - release + type: object + status: + description: The current status of this APIVersion. + properties: + hash: + description: Hash is a hash representing the APIVersion. + type: string + syncedAt: + format: date-time + type: string + version: + type: string + type: object + type: object + served: true + storage: true + subresources: {} + +--- +# Source: traefik/crds/hub.traefik.io_managedsubscriptions.yaml +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.17.1 + name: managedsubscriptions.hub.traefik.io +spec: + group: hub.traefik.io + names: + kind: ManagedSubscription + listKind: ManagedSubscriptionList + plural: managedsubscriptions + singular: managedsubscription + scope: Namespaced + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: |- + ManagedSubscription defines a Subscription managed by the API manager as the result of a pre-negotiation with its + API consumers. This subscription grant consuming access to a set of APIs to a set of Applications. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: The desired behavior of this ManagedSubscription. + properties: + apiBundles: + description: |- + APIBundles defines a set of APIBundle that will be accessible. + Multiple ManagedSubscriptions can select the same APIBundles. + items: + description: APIBundleReference references an APIBundle. + properties: + name: + description: Name of the APIBundle. + maxLength: 253 + type: string + required: + - name + type: object + maxItems: 100 + type: array + x-kubernetes-validations: + - message: duplicated apiBundles + rule: self.all(x, self.exists_one(y, x.name == y.name)) + apiPlan: + description: APIPlan defines which APIPlan will be used. + properties: + name: + description: Name of the APIPlan. + maxLength: 253 + type: string + required: + - name + type: object + apiSelector: + description: |- + APISelector selects the APIs that will be accessible. + Multiple ManagedSubscriptions can select the same set of APIs. + This field is optional and follows standard label selector semantics. + An empty APISelector matches any API. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + apis: + description: |- + APIs defines a set of APIs that will be accessible. + Multiple ManagedSubscriptions can select the same APIs. + When combined with APISelector, this set of APIs is appended to the matching APIs. + items: + description: APIReference references an API. + properties: + name: + description: Name of the API. + maxLength: 253 + type: string + required: + - name + type: object + maxItems: 100 + type: array + x-kubernetes-validations: + - message: duplicated apis + rule: self.all(x, self.exists_one(y, x.name == y.name)) + applications: + description: |- + Applications references the Applications that will gain access to the specified APIs. + Multiple ManagedSubscriptions can select the same AppID. + items: + description: ApplicationReference references an Application. + properties: + appId: + description: |- + AppID is the public identifier of the application. + In the case of OIDC, it corresponds to the clientId. + maxLength: 253 + type: string + required: + - appId + type: object + maxItems: 100 + minItems: 1 + type: array + claims: + description: Claims specifies an expression that validate claims in + order to authorize the request. + type: string + operationFilter: + description: |- + OperationFilter specifies the allowed operations on APIs and APIVersions. + If not set, all operations are available. + An empty OperationFilter prohibits all operations. + properties: + include: + description: Include defines the names of OperationSets that will + be accessible. + items: + type: string + maxItems: 100 + type: array + type: object + weight: + description: |- + Weight specifies the evaluation order of the APIPlan. + When multiple ManagedSubscriptions targets the same API and Application with different APIPlan, + the APIPlan with the highest weight will be enforced. If weights are equal, alphabetical order is used. + type: integer + x-kubernetes-validations: + - message: must be a positive number + rule: self >= 0 + required: + - apiPlan + - applications + type: object + status: + description: The current status of this ManagedSubscription. + properties: + hash: + description: Hash is a hash representing the ManagedSubscription. + type: string + syncedAt: + format: date-time + type: string + version: + type: string + type: object + type: object + served: true + storage: true + +--- +# Source: traefik/crds/traefik.io_ingressroutes.yaml +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.16.1 + name: ingressroutes.traefik.io +spec: + group: traefik.io + names: + kind: IngressRoute + listKind: IngressRouteList + plural: ingressroutes + singular: ingressroute + scope: Namespaced + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: IngressRoute is the CRD implementation of a Traefik HTTP Router. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: IngressRouteSpec defines the desired state of IngressRoute. + properties: + entryPoints: + description: |- + EntryPoints defines the list of entry point names to bind to. + Entry points have to be configured in the static configuration. + More info: https://doc.traefik.io/traefik/v3.3/routing/entrypoints/ + Default: all. + items: + type: string + type: array + routes: + description: Routes defines the list of routes. + items: + description: Route holds the HTTP route configuration. + properties: + kind: + description: |- + Kind defines the kind of the route. + Rule is the only supported kind. + If not defined, defaults to Rule. + enum: + - Rule + type: string + match: + description: |- + Match defines the router's rule. + More info: https://doc.traefik.io/traefik/v3.3/routing/routers/#rule + type: string + middlewares: + description: |- + Middlewares defines the list of references to Middleware resources. + More info: https://doc.traefik.io/traefik/v3.3/routing/providers/kubernetes-crd/#kind-middleware + items: + description: MiddlewareRef is a reference to a Middleware + resource. + properties: + name: + description: Name defines the name of the referenced Middleware + resource. + type: string + namespace: + description: Namespace defines the namespace of the referenced + Middleware resource. + type: string + required: + - name + type: object + type: array + observability: + description: |- + Observability defines the observability configuration for a router. + More info: https://doc.traefik.io/traefik/v3.2/routing/routers/#observability + properties: + accessLogs: + type: boolean + metrics: + type: boolean + tracing: + type: boolean + type: object + priority: + description: |- + Priority defines the router's priority. + More info: https://doc.traefik.io/traefik/v3.3/routing/routers/#priority + type: integer + services: + description: |- + Services defines the list of Service. + It can contain any combination of TraefikService and/or reference to a Kubernetes Service. + items: + description: Service defines an upstream HTTP service to proxy + traffic to. + properties: + healthCheck: + description: Healthcheck defines health checks for ExternalName + services. + properties: + followRedirects: + description: |- + FollowRedirects defines whether redirects should be followed during the health check calls. + Default: true + type: boolean + headers: + additionalProperties: + type: string + description: Headers defines custom headers to be + sent to the health check endpoint. + type: object + hostname: + description: Hostname defines the value of hostname + in the Host header of the health check request. + type: string + interval: + anyOf: + - type: integer + - type: string + description: |- + Interval defines the frequency of the health check calls. + Default: 30s + x-kubernetes-int-or-string: true + method: + description: Method defines the healthcheck method. + type: string + mode: + description: |- + Mode defines the health check mode. + If defined to grpc, will use the gRPC health check protocol to probe the server. + Default: http + type: string + path: + description: Path defines the server URL path for + the health check endpoint. + type: string + port: + description: Port defines the server URL port for + the health check endpoint. + type: integer + scheme: + description: Scheme replaces the server URL scheme + for the health check endpoint. + type: string + status: + description: Status defines the expected HTTP status + code of the response to the health check request. + type: integer + timeout: + anyOf: + - type: integer + - type: string + description: |- + Timeout defines the maximum duration Traefik will wait for a health check request before considering the server unhealthy. + Default: 5s + x-kubernetes-int-or-string: true + type: object + kind: + description: Kind defines the kind of the Service. + enum: + - Service + - TraefikService + type: string + name: + description: |- + Name defines the name of the referenced Kubernetes Service or TraefikService. + The differentiation between the two is specified in the Kind field. + type: string + namespace: + description: Namespace defines the namespace of the referenced + Kubernetes Service or TraefikService. + type: string + nativeLB: + description: |- + NativeLB controls, when creating the load-balancer, + whether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP. + The Kubernetes Service itself does load-balance to the pods. + By default, NativeLB is false. + type: boolean + nodePortLB: + description: |- + NodePortLB controls, when creating the load-balancer, + whether the LB's children are directly the nodes internal IPs using the nodePort when the service type is NodePort. + It allows services to be reachable when Traefik runs externally from the Kubernetes cluster but within the same network of the nodes. + By default, NodePortLB is false. + type: boolean + passHostHeader: + description: |- + PassHostHeader defines whether the client Host header is forwarded to the upstream Kubernetes Service. + By default, passHostHeader is true. + type: boolean + port: + anyOf: + - type: integer + - type: string + description: |- + Port defines the port of a Kubernetes Service. + This can be a reference to a named port. + x-kubernetes-int-or-string: true + responseForwarding: + description: ResponseForwarding defines how Traefik forwards + the response from the upstream Kubernetes Service to + the client. + properties: + flushInterval: + description: |- + FlushInterval defines the interval, in milliseconds, in between flushes to the client while copying the response body. + A negative value means to flush immediately after each write to the client. + This configuration is ignored when ReverseProxy recognizes a response as a streaming response; + for such responses, writes are flushed to the client immediately. + Default: 100ms + type: string + type: object + scheme: + description: |- + Scheme defines the scheme to use for the request to the upstream Kubernetes Service. + It defaults to https when Kubernetes Service port is 443, http otherwise. + type: string + serversTransport: + description: |- + ServersTransport defines the name of ServersTransport resource to use. + It allows to configure the transport between Traefik and your servers. + Can only be used on a Kubernetes Service. + type: string + sticky: + description: |- + Sticky defines the sticky sessions configuration. + More info: https://doc.traefik.io/traefik/v3.3/routing/services/#sticky-sessions + properties: + cookie: + description: Cookie defines the sticky cookie configuration. + properties: + httpOnly: + description: HTTPOnly defines whether the cookie + can be accessed by client-side APIs, such as + JavaScript. + type: boolean + maxAge: + description: |- + MaxAge defines the number of seconds until the cookie expires. + When set to a negative number, the cookie expires immediately. + When set to zero, the cookie never expires. + type: integer + name: + description: Name defines the Cookie name. + type: string + path: + description: |- + Path defines the path that must exist in the requested URL for the browser to send the Cookie header. + When not provided the cookie will be sent on every request to the domain. + More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#pathpath-value + type: string + sameSite: + description: |- + SameSite defines the same site policy. + More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite + type: string + secure: + description: Secure defines whether the cookie + can only be transmitted over an encrypted connection + (i.e. HTTPS). + type: boolean + type: object + type: object + strategy: + description: |- + Strategy defines the load balancing strategy between the servers. + RoundRobin is the only supported value at the moment. + type: string + weight: + description: |- + Weight defines the weight and should only be specified when Name references a TraefikService object + (and to be precise, one that embeds a Weighted Round Robin). + type: integer + required: + - name + type: object + type: array + syntax: + description: |- + Syntax defines the router's rule syntax. + More info: https://doc.traefik.io/traefik/v3.3/routing/routers/#rulesyntax + type: string + required: + - match + type: object + type: array + tls: + description: |- + TLS defines the TLS configuration. + More info: https://doc.traefik.io/traefik/v3.3/routing/routers/#tls + properties: + certResolver: + description: |- + CertResolver defines the name of the certificate resolver to use. + Cert resolvers have to be configured in the static configuration. + More info: https://doc.traefik.io/traefik/v3.3/https/acme/#certificate-resolvers + type: string + domains: + description: |- + Domains defines the list of domains that will be used to issue certificates. + More info: https://doc.traefik.io/traefik/v3.3/routing/routers/#domains + items: + description: Domain holds a domain name with SANs. + properties: + main: + description: Main defines the main domain name. + type: string + sans: + description: SANs defines the subject alternative domain + names. + items: + type: string + type: array + type: object + type: array + options: + description: |- + Options defines the reference to a TLSOption, that specifies the parameters of the TLS connection. + If not defined, the `default` TLSOption is used. + More info: https://doc.traefik.io/traefik/v3.3/https/tls/#tls-options + properties: + name: + description: |- + Name defines the name of the referenced TLSOption. + More info: https://doc.traefik.io/traefik/v3.3/routing/providers/kubernetes-crd/#kind-tlsoption + type: string + namespace: + description: |- + Namespace defines the namespace of the referenced TLSOption. + More info: https://doc.traefik.io/traefik/v3.3/routing/providers/kubernetes-crd/#kind-tlsoption + type: string + required: + - name + type: object + secretName: + description: SecretName is the name of the referenced Kubernetes + Secret to specify the certificate details. + type: string + store: + description: |- + Store defines the reference to the TLSStore, that will be used to store certificates. + Please note that only `default` TLSStore can be used. + properties: + name: + description: |- + Name defines the name of the referenced TLSStore. + More info: https://doc.traefik.io/traefik/v3.3/routing/providers/kubernetes-crd/#kind-tlsstore + type: string + namespace: + description: |- + Namespace defines the namespace of the referenced TLSStore. + More info: https://doc.traefik.io/traefik/v3.3/routing/providers/kubernetes-crd/#kind-tlsstore + type: string + required: + - name + type: object + type: object + required: + - routes + type: object + required: + - metadata + - spec + type: object + served: true + storage: true + +--- +# Source: traefik/crds/traefik.io_ingressroutetcps.yaml +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.16.1 + name: ingressroutetcps.traefik.io +spec: + group: traefik.io + names: + kind: IngressRouteTCP + listKind: IngressRouteTCPList + plural: ingressroutetcps + singular: ingressroutetcp + scope: Namespaced + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: IngressRouteTCP is the CRD implementation of a Traefik TCP Router. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: IngressRouteTCPSpec defines the desired state of IngressRouteTCP. + properties: + entryPoints: + description: |- + EntryPoints defines the list of entry point names to bind to. + Entry points have to be configured in the static configuration. + More info: https://doc.traefik.io/traefik/v3.3/routing/entrypoints/ + Default: all. + items: + type: string + type: array + routes: + description: Routes defines the list of routes. + items: + description: RouteTCP holds the TCP route configuration. + properties: + match: + description: |- + Match defines the router's rule. + More info: https://doc.traefik.io/traefik/v3.3/routing/routers/#rule_1 + type: string + middlewares: + description: Middlewares defines the list of references to MiddlewareTCP + resources. + items: + description: ObjectReference is a generic reference to a Traefik + resource. + properties: + name: + description: Name defines the name of the referenced Traefik + resource. + type: string + namespace: + description: Namespace defines the namespace of the referenced + Traefik resource. + type: string + required: + - name + type: object + type: array + priority: + description: |- + Priority defines the router's priority. + More info: https://doc.traefik.io/traefik/v3.3/routing/routers/#priority_1 + type: integer + services: + description: Services defines the list of TCP services. + items: + description: ServiceTCP defines an upstream TCP service to + proxy traffic to. + properties: + name: + description: Name defines the name of the referenced Kubernetes + Service. + type: string + namespace: + description: Namespace defines the namespace of the referenced + Kubernetes Service. + type: string + nativeLB: + description: |- + NativeLB controls, when creating the load-balancer, + whether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP. + The Kubernetes Service itself does load-balance to the pods. + By default, NativeLB is false. + type: boolean + nodePortLB: + description: |- + NodePortLB controls, when creating the load-balancer, + whether the LB's children are directly the nodes internal IPs using the nodePort when the service type is NodePort. + It allows services to be reachable when Traefik runs externally from the Kubernetes cluster but within the same network of the nodes. + By default, NodePortLB is false. + type: boolean + port: + anyOf: + - type: integer + - type: string + description: |- + Port defines the port of a Kubernetes Service. + This can be a reference to a named port. + x-kubernetes-int-or-string: true + proxyProtocol: + description: |- + ProxyProtocol defines the PROXY protocol configuration. + More info: https://doc.traefik.io/traefik/v3.3/routing/services/#proxy-protocol + properties: + version: + description: Version defines the PROXY Protocol version + to use. + type: integer + type: object + serversTransport: + description: |- + ServersTransport defines the name of ServersTransportTCP resource to use. + It allows to configure the transport between Traefik and your servers. + Can only be used on a Kubernetes Service. + type: string + terminationDelay: + description: |- + TerminationDelay defines the deadline that the proxy sets, after one of its connected peers indicates + it has closed the writing capability of its connection, to close the reading capability as well, + hence fully terminating the connection. + It is a duration in milliseconds, defaulting to 100. + A negative value means an infinite deadline (i.e. the reading capability is never closed). + Deprecated: TerminationDelay will not be supported in future APIVersions, please use ServersTransport to configure the TerminationDelay instead. + type: integer + tls: + description: TLS determines whether to use TLS when dialing + with the backend. + type: boolean + weight: + description: Weight defines the weight used when balancing + requests between multiple Kubernetes Service. + type: integer + required: + - name + - port + type: object + type: array + syntax: + description: |- + Syntax defines the router's rule syntax. + More info: https://doc.traefik.io/traefik/v3.3/routing/routers/#rulesyntax_1 + type: string + required: + - match + type: object + type: array + tls: + description: |- + TLS defines the TLS configuration on a layer 4 / TCP Route. + More info: https://doc.traefik.io/traefik/v3.3/routing/routers/#tls_1 + properties: + certResolver: + description: |- + CertResolver defines the name of the certificate resolver to use. + Cert resolvers have to be configured in the static configuration. + More info: https://doc.traefik.io/traefik/v3.3/https/acme/#certificate-resolvers + type: string + domains: + description: |- + Domains defines the list of domains that will be used to issue certificates. + More info: https://doc.traefik.io/traefik/v3.3/routing/routers/#domains + items: + description: Domain holds a domain name with SANs. + properties: + main: + description: Main defines the main domain name. + type: string + sans: + description: SANs defines the subject alternative domain + names. + items: + type: string + type: array + type: object + type: array + options: + description: |- + Options defines the reference to a TLSOption, that specifies the parameters of the TLS connection. + If not defined, the `default` TLSOption is used. + More info: https://doc.traefik.io/traefik/v3.3/https/tls/#tls-options + properties: + name: + description: Name defines the name of the referenced Traefik + resource. + type: string + namespace: + description: Namespace defines the namespace of the referenced + Traefik resource. + type: string + required: + - name + type: object + passthrough: + description: Passthrough defines whether a TLS router will terminate + the TLS connection. + type: boolean + secretName: + description: SecretName is the name of the referenced Kubernetes + Secret to specify the certificate details. + type: string + store: + description: |- + Store defines the reference to the TLSStore, that will be used to store certificates. + Please note that only `default` TLSStore can be used. + properties: + name: + description: Name defines the name of the referenced Traefik + resource. + type: string + namespace: + description: Namespace defines the namespace of the referenced + Traefik resource. + type: string + required: + - name + type: object + type: object + required: + - routes + type: object + required: + - metadata + - spec + type: object + served: true + storage: true + +--- +# Source: traefik/crds/traefik.io_ingressrouteudps.yaml +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.16.1 + name: ingressrouteudps.traefik.io +spec: + group: traefik.io + names: + kind: IngressRouteUDP + listKind: IngressRouteUDPList + plural: ingressrouteudps + singular: ingressrouteudp + scope: Namespaced + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: IngressRouteUDP is a CRD implementation of a Traefik UDP Router. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: IngressRouteUDPSpec defines the desired state of a IngressRouteUDP. + properties: + entryPoints: + description: |- + EntryPoints defines the list of entry point names to bind to. + Entry points have to be configured in the static configuration. + More info: https://doc.traefik.io/traefik/v3.3/routing/entrypoints/ + Default: all. + items: + type: string + type: array + routes: + description: Routes defines the list of routes. + items: + description: RouteUDP holds the UDP route configuration. + properties: + services: + description: Services defines the list of UDP services. + items: + description: ServiceUDP defines an upstream UDP service to + proxy traffic to. + properties: + name: + description: Name defines the name of the referenced Kubernetes + Service. + type: string + namespace: + description: Namespace defines the namespace of the referenced + Kubernetes Service. + type: string + nativeLB: + description: |- + NativeLB controls, when creating the load-balancer, + whether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP. + The Kubernetes Service itself does load-balance to the pods. + By default, NativeLB is false. + type: boolean + nodePortLB: + description: |- + NodePortLB controls, when creating the load-balancer, + whether the LB's children are directly the nodes internal IPs using the nodePort when the service type is NodePort. + It allows services to be reachable when Traefik runs externally from the Kubernetes cluster but within the same network of the nodes. + By default, NodePortLB is false. + type: boolean + port: + anyOf: + - type: integer + - type: string + description: |- + Port defines the port of a Kubernetes Service. + This can be a reference to a named port. + x-kubernetes-int-or-string: true + weight: + description: Weight defines the weight used when balancing + requests between multiple Kubernetes Service. + type: integer + required: + - name + - port + type: object + type: array + type: object + type: array + required: + - routes + type: object + required: + - metadata + - spec + type: object + served: true + storage: true + +--- +# Source: traefik/crds/traefik.io_middlewares.yaml +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.16.1 + name: middlewares.traefik.io +spec: + group: traefik.io + names: + kind: Middleware + listKind: MiddlewareList + plural: middlewares + singular: middleware + scope: Namespaced + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: |- + Middleware is the CRD implementation of a Traefik Middleware. + More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/overview/ + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: MiddlewareSpec defines the desired state of a Middleware. + properties: + addPrefix: + description: |- + AddPrefix holds the add prefix middleware configuration. + This middleware updates the path of a request before forwarding it. + More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/addprefix/ + properties: + prefix: + description: |- + Prefix is the string to add before the current path in the requested URL. + It should include a leading slash (/). + type: string + type: object + basicAuth: + description: |- + BasicAuth holds the basic auth middleware configuration. + This middleware restricts access to your services to known users. + More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/basicauth/ + properties: + headerField: + description: |- + HeaderField defines a header field to store the authenticated user. + More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/basicauth/#headerfield + type: string + realm: + description: |- + Realm allows the protected resources on a server to be partitioned into a set of protection spaces, each with its own authentication scheme. + Default: traefik. + type: string + removeHeader: + description: |- + RemoveHeader sets the removeHeader option to true to remove the authorization header before forwarding the request to your service. + Default: false. + type: boolean + secret: + description: Secret is the name of the referenced Kubernetes Secret + containing user credentials. + type: string + type: object + buffering: + description: |- + Buffering holds the buffering middleware configuration. + This middleware retries or limits the size of requests that can be forwarded to backends. + More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/buffering/#maxrequestbodybytes + properties: + maxRequestBodyBytes: + description: |- + MaxRequestBodyBytes defines the maximum allowed body size for the request (in bytes). + If the request exceeds the allowed size, it is not forwarded to the service, and the client gets a 413 (Request Entity Too Large) response. + Default: 0 (no maximum). + format: int64 + type: integer + maxResponseBodyBytes: + description: |- + MaxResponseBodyBytes defines the maximum allowed response size from the service (in bytes). + If the response exceeds the allowed size, it is not forwarded to the client. The client gets a 500 (Internal Server Error) response instead. + Default: 0 (no maximum). + format: int64 + type: integer + memRequestBodyBytes: + description: |- + MemRequestBodyBytes defines the threshold (in bytes) from which the request will be buffered on disk instead of in memory. + Default: 1048576 (1Mi). + format: int64 + type: integer + memResponseBodyBytes: + description: |- + MemResponseBodyBytes defines the threshold (in bytes) from which the response will be buffered on disk instead of in memory. + Default: 1048576 (1Mi). + format: int64 + type: integer + retryExpression: + description: |- + RetryExpression defines the retry conditions. + It is a logical combination of functions with operators AND (&&) and OR (||). + More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/buffering/#retryexpression + type: string + type: object + chain: + description: |- + Chain holds the configuration of the chain middleware. + This middleware enables to define reusable combinations of other pieces of middleware. + More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/chain/ + properties: + middlewares: + description: Middlewares is the list of MiddlewareRef which composes + the chain. + items: + description: MiddlewareRef is a reference to a Middleware resource. + properties: + name: + description: Name defines the name of the referenced Middleware + resource. + type: string + namespace: + description: Namespace defines the namespace of the referenced + Middleware resource. + type: string + required: + - name + type: object + type: array + type: object + circuitBreaker: + description: CircuitBreaker holds the circuit breaker configuration. + properties: + checkPeriod: + anyOf: + - type: integer + - type: string + description: CheckPeriod is the interval between successive checks + of the circuit breaker condition (when in standby state). + x-kubernetes-int-or-string: true + expression: + description: Expression is the condition that triggers the tripped + state. + type: string + fallbackDuration: + anyOf: + - type: integer + - type: string + description: FallbackDuration is the duration for which the circuit + breaker will wait before trying to recover (from a tripped state). + x-kubernetes-int-or-string: true + recoveryDuration: + anyOf: + - type: integer + - type: string + description: RecoveryDuration is the duration for which the circuit + breaker will try to recover (as soon as it is in recovering + state). + x-kubernetes-int-or-string: true + responseCode: + description: ResponseCode is the status code that the circuit + breaker will return while it is in the open state. + type: integer + type: object + compress: + description: |- + Compress holds the compress middleware configuration. + This middleware compresses responses before sending them to the client, using gzip, brotli, or zstd compression. + More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/compress/ + properties: + defaultEncoding: + description: DefaultEncoding specifies the default encoding if + the `Accept-Encoding` header is not in the request or contains + a wildcard (`*`). + type: string + encodings: + description: Encodings defines the list of supported compression + algorithms. + items: + type: string + type: array + excludedContentTypes: + description: |- + ExcludedContentTypes defines the list of content types to compare the Content-Type header of the incoming requests and responses before compressing. + `application/grpc` is always excluded. + items: + type: string + type: array + includedContentTypes: + description: IncludedContentTypes defines the list of content + types to compare the Content-Type header of the responses before + compressing. + items: + type: string + type: array + minResponseBodyBytes: + description: |- + MinResponseBodyBytes defines the minimum amount of bytes a response body must have to be compressed. + Default: 1024. + type: integer + type: object + contentType: + description: |- + ContentType holds the content-type middleware configuration. + This middleware exists to enable the correct behavior until at least the default one can be changed in a future version. + properties: + autoDetect: + description: |- + AutoDetect specifies whether to let the `Content-Type` header, if it has not been set by the backend, + be automatically set to a value derived from the contents of the response. + Deprecated: AutoDetect option is deprecated, Content-Type middleware is only meant to be used to enable the content-type detection, please remove any usage of this option. + type: boolean + type: object + digestAuth: + description: |- + DigestAuth holds the digest auth middleware configuration. + This middleware restricts access to your services to known users. + More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/digestauth/ + properties: + headerField: + description: |- + HeaderField defines a header field to store the authenticated user. + More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/basicauth/#headerfield + type: string + realm: + description: |- + Realm allows the protected resources on a server to be partitioned into a set of protection spaces, each with its own authentication scheme. + Default: traefik. + type: string + removeHeader: + description: RemoveHeader defines whether to remove the authorization + header before forwarding the request to the backend. + type: boolean + secret: + description: Secret is the name of the referenced Kubernetes Secret + containing user credentials. + type: string + type: object + errors: + description: |- + ErrorPage holds the custom error middleware configuration. + This middleware returns a custom page in lieu of the default, according to configured ranges of HTTP Status codes. + More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/errorpages/ + properties: + query: + description: |- + Query defines the URL for the error page (hosted by service). + The {status} variable can be used in order to insert the status code in the URL. + type: string + service: + description: |- + Service defines the reference to a Kubernetes Service that will serve the error page. + More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/errorpages/#service + properties: + healthCheck: + description: Healthcheck defines health checks for ExternalName + services. + properties: + followRedirects: + description: |- + FollowRedirects defines whether redirects should be followed during the health check calls. + Default: true + type: boolean + headers: + additionalProperties: + type: string + description: Headers defines custom headers to be sent + to the health check endpoint. + type: object + hostname: + description: Hostname defines the value of hostname in + the Host header of the health check request. + type: string + interval: + anyOf: + - type: integer + - type: string + description: |- + Interval defines the frequency of the health check calls. + Default: 30s + x-kubernetes-int-or-string: true + method: + description: Method defines the healthcheck method. + type: string + mode: + description: |- + Mode defines the health check mode. + If defined to grpc, will use the gRPC health check protocol to probe the server. + Default: http + type: string + path: + description: Path defines the server URL path for the + health check endpoint. + type: string + port: + description: Port defines the server URL port for the + health check endpoint. + type: integer + scheme: + description: Scheme replaces the server URL scheme for + the health check endpoint. + type: string + status: + description: Status defines the expected HTTP status code + of the response to the health check request. + type: integer + timeout: + anyOf: + - type: integer + - type: string + description: |- + Timeout defines the maximum duration Traefik will wait for a health check request before considering the server unhealthy. + Default: 5s + x-kubernetes-int-or-string: true + type: object + kind: + description: Kind defines the kind of the Service. + enum: + - Service + - TraefikService + type: string + name: + description: |- + Name defines the name of the referenced Kubernetes Service or TraefikService. + The differentiation between the two is specified in the Kind field. + type: string + namespace: + description: Namespace defines the namespace of the referenced + Kubernetes Service or TraefikService. + type: string + nativeLB: + description: |- + NativeLB controls, when creating the load-balancer, + whether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP. + The Kubernetes Service itself does load-balance to the pods. + By default, NativeLB is false. + type: boolean + nodePortLB: + description: |- + NodePortLB controls, when creating the load-balancer, + whether the LB's children are directly the nodes internal IPs using the nodePort when the service type is NodePort. + It allows services to be reachable when Traefik runs externally from the Kubernetes cluster but within the same network of the nodes. + By default, NodePortLB is false. + type: boolean + passHostHeader: + description: |- + PassHostHeader defines whether the client Host header is forwarded to the upstream Kubernetes Service. + By default, passHostHeader is true. + type: boolean + port: + anyOf: + - type: integer + - type: string + description: |- + Port defines the port of a Kubernetes Service. + This can be a reference to a named port. + x-kubernetes-int-or-string: true + responseForwarding: + description: ResponseForwarding defines how Traefik forwards + the response from the upstream Kubernetes Service to the + client. + properties: + flushInterval: + description: |- + FlushInterval defines the interval, in milliseconds, in between flushes to the client while copying the response body. + A negative value means to flush immediately after each write to the client. + This configuration is ignored when ReverseProxy recognizes a response as a streaming response; + for such responses, writes are flushed to the client immediately. + Default: 100ms + type: string + type: object + scheme: + description: |- + Scheme defines the scheme to use for the request to the upstream Kubernetes Service. + It defaults to https when Kubernetes Service port is 443, http otherwise. + type: string + serversTransport: + description: |- + ServersTransport defines the name of ServersTransport resource to use. + It allows to configure the transport between Traefik and your servers. + Can only be used on a Kubernetes Service. + type: string + sticky: + description: |- + Sticky defines the sticky sessions configuration. + More info: https://doc.traefik.io/traefik/v3.3/routing/services/#sticky-sessions + properties: + cookie: + description: Cookie defines the sticky cookie configuration. + properties: + httpOnly: + description: HTTPOnly defines whether the cookie can + be accessed by client-side APIs, such as JavaScript. + type: boolean + maxAge: + description: |- + MaxAge defines the number of seconds until the cookie expires. + When set to a negative number, the cookie expires immediately. + When set to zero, the cookie never expires. + type: integer + name: + description: Name defines the Cookie name. + type: string + path: + description: |- + Path defines the path that must exist in the requested URL for the browser to send the Cookie header. + When not provided the cookie will be sent on every request to the domain. + More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#pathpath-value + type: string + sameSite: + description: |- + SameSite defines the same site policy. + More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite + type: string + secure: + description: Secure defines whether the cookie can + only be transmitted over an encrypted connection + (i.e. HTTPS). + type: boolean + type: object + type: object + strategy: + description: |- + Strategy defines the load balancing strategy between the servers. + RoundRobin is the only supported value at the moment. + type: string + weight: + description: |- + Weight defines the weight and should only be specified when Name references a TraefikService object + (and to be precise, one that embeds a Weighted Round Robin). + type: integer + required: + - name + type: object + status: + description: |- + Status defines which status or range of statuses should result in an error page. + It can be either a status code as a number (500), + as multiple comma-separated numbers (500,502), + as ranges by separating two codes with a dash (500-599), + or a combination of the two (404,418,500-599). + items: + type: string + type: array + type: object + forwardAuth: + description: |- + ForwardAuth holds the forward auth middleware configuration. + This middleware delegates the request authentication to a Service. + More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/forwardauth/ + properties: + addAuthCookiesToResponse: + description: AddAuthCookiesToResponse defines the list of cookies + to copy from the authentication server response to the response. + items: + type: string + type: array + address: + description: Address defines the authentication server address. + type: string + authRequestHeaders: + description: |- + AuthRequestHeaders defines the list of the headers to copy from the request to the authentication server. + If not set or empty then all request headers are passed. + items: + type: string + type: array + authResponseHeaders: + description: AuthResponseHeaders defines the list of headers to + copy from the authentication server response and set on forwarded + request, replacing any existing conflicting headers. + items: + type: string + type: array + authResponseHeadersRegex: + description: |- + AuthResponseHeadersRegex defines the regex to match headers to copy from the authentication server response and set on forwarded request, after stripping all headers that match the regex. + More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/forwardauth/#authresponseheadersregex + type: string + forwardBody: + description: ForwardBody defines whether to send the request body + to the authentication server. + type: boolean + headerField: + description: |- + HeaderField defines a header field to store the authenticated user. + More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/forwardauth/#headerfield + type: string + maxBodySize: + description: MaxBodySize defines the maximum body size in bytes + allowed to be forwarded to the authentication server. + format: int64 + type: integer + preserveLocationHeader: + description: PreserveLocationHeader defines whether to forward + the Location header to the client as is or prefix it with the + domain name of the authentication server. + type: boolean + tls: + description: TLS defines the configuration used to secure the + connection to the authentication server. + properties: + caOptional: + description: 'Deprecated: TLS client authentication is a server + side option (see https://github.com/golang/go/blob/740a490f71d026bb7d2d13cb8fa2d6d6e0572b70/src/crypto/tls/common.go#L634).' + type: boolean + caSecret: + description: |- + CASecret is the name of the referenced Kubernetes Secret containing the CA to validate the server certificate. + The CA certificate is extracted from key `tls.ca` or `ca.crt`. + type: string + certSecret: + description: |- + CertSecret is the name of the referenced Kubernetes Secret containing the client certificate. + The client certificate is extracted from the keys `tls.crt` and `tls.key`. + type: string + insecureSkipVerify: + description: InsecureSkipVerify defines whether the server + certificates should be validated. + type: boolean + type: object + trustForwardHeader: + description: 'TrustForwardHeader defines whether to trust (ie: + forward) all X-Forwarded-* headers.' + type: boolean + type: object + grpcWeb: + description: |- + GrpcWeb holds the gRPC web middleware configuration. + This middleware converts a gRPC web request to an HTTP/2 gRPC request. + properties: + allowOrigins: + description: |- + AllowOrigins is a list of allowable origins. + Can also be a wildcard origin "*". + items: + type: string + type: array + type: object + headers: + description: |- + Headers holds the headers middleware configuration. + This middleware manages the requests and responses headers. + More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/headers/#customrequestheaders + properties: + accessControlAllowCredentials: + description: AccessControlAllowCredentials defines whether the + request can include user credentials. + type: boolean + accessControlAllowHeaders: + description: AccessControlAllowHeaders defines the Access-Control-Request-Headers + values sent in preflight response. + items: + type: string + type: array + accessControlAllowMethods: + description: AccessControlAllowMethods defines the Access-Control-Request-Method + values sent in preflight response. + items: + type: string + type: array + accessControlAllowOriginList: + description: AccessControlAllowOriginList is a list of allowable + origins. Can also be a wildcard origin "*". + items: + type: string + type: array + accessControlAllowOriginListRegex: + description: AccessControlAllowOriginListRegex is a list of allowable + origins written following the Regular Expression syntax (https://golang.org/pkg/regexp/). + items: + type: string + type: array + accessControlExposeHeaders: + description: AccessControlExposeHeaders defines the Access-Control-Expose-Headers + values sent in preflight response. + items: + type: string + type: array + accessControlMaxAge: + description: AccessControlMaxAge defines the time that a preflight + request may be cached. + format: int64 + type: integer + addVaryHeader: + description: AddVaryHeader defines whether the Vary header is + automatically added/updated when the AccessControlAllowOriginList + is set. + type: boolean + allowedHosts: + description: AllowedHosts defines the fully qualified list of + allowed domain names. + items: + type: string + type: array + browserXssFilter: + description: BrowserXSSFilter defines whether to add the X-XSS-Protection + header with the value 1; mode=block. + type: boolean + contentSecurityPolicy: + description: ContentSecurityPolicy defines the Content-Security-Policy + header value. + type: string + contentSecurityPolicyReportOnly: + description: ContentSecurityPolicyReportOnly defines the Content-Security-Policy-Report-Only + header value. + type: string + contentTypeNosniff: + description: ContentTypeNosniff defines whether to add the X-Content-Type-Options + header with the nosniff value. + type: boolean + customBrowserXSSValue: + description: |- + CustomBrowserXSSValue defines the X-XSS-Protection header value. + This overrides the BrowserXssFilter option. + type: string + customFrameOptionsValue: + description: |- + CustomFrameOptionsValue defines the X-Frame-Options header value. + This overrides the FrameDeny option. + type: string + customRequestHeaders: + additionalProperties: + type: string + description: CustomRequestHeaders defines the header names and + values to apply to the request. + type: object + customResponseHeaders: + additionalProperties: + type: string + description: CustomResponseHeaders defines the header names and + values to apply to the response. + type: object + featurePolicy: + description: 'Deprecated: FeaturePolicy option is deprecated, + please use PermissionsPolicy instead.' + type: string + forceSTSHeader: + description: ForceSTSHeader defines whether to add the STS header + even when the connection is HTTP. + type: boolean + frameDeny: + description: FrameDeny defines whether to add the X-Frame-Options + header with the DENY value. + type: boolean + hostsProxyHeaders: + description: HostsProxyHeaders defines the header keys that may + hold a proxied hostname value for the request. + items: + type: string + type: array + isDevelopment: + description: |- + IsDevelopment defines whether to mitigate the unwanted effects of the AllowedHosts, SSL, and STS options when developing. + Usually testing takes place using HTTP, not HTTPS, and on localhost, not your production domain. + If you would like your development environment to mimic production with complete Host blocking, SSL redirects, + and STS headers, leave this as false. + type: boolean + permissionsPolicy: + description: |- + PermissionsPolicy defines the Permissions-Policy header value. + This allows sites to control browser features. + type: string + publicKey: + description: PublicKey is the public key that implements HPKP + to prevent MITM attacks with forged certificates. + type: string + referrerPolicy: + description: |- + ReferrerPolicy defines the Referrer-Policy header value. + This allows sites to control whether browsers forward the Referer header to other sites. + type: string + sslForceHost: + description: 'Deprecated: SSLForceHost option is deprecated, please + use RedirectRegex instead.' + type: boolean + sslHost: + description: 'Deprecated: SSLHost option is deprecated, please + use RedirectRegex instead.' + type: string + sslProxyHeaders: + additionalProperties: + type: string + description: |- + SSLProxyHeaders defines the header keys with associated values that would indicate a valid HTTPS request. + It can be useful when using other proxies (example: "X-Forwarded-Proto": "https"). + type: object + sslRedirect: + description: 'Deprecated: SSLRedirect option is deprecated, please + use EntryPoint redirection or RedirectScheme instead.' + type: boolean + sslTemporaryRedirect: + description: 'Deprecated: SSLTemporaryRedirect option is deprecated, + please use EntryPoint redirection or RedirectScheme instead.' + type: boolean + stsIncludeSubdomains: + description: STSIncludeSubdomains defines whether the includeSubDomains + directive is appended to the Strict-Transport-Security header. + type: boolean + stsPreload: + description: STSPreload defines whether the preload flag is appended + to the Strict-Transport-Security header. + type: boolean + stsSeconds: + description: |- + STSSeconds defines the max-age of the Strict-Transport-Security header. + If set to 0, the header is not set. + format: int64 + type: integer + type: object + inFlightReq: + description: |- + InFlightReq holds the in-flight request middleware configuration. + This middleware limits the number of requests being processed and served concurrently. + More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/inflightreq/ + properties: + amount: + description: |- + Amount defines the maximum amount of allowed simultaneous in-flight request. + The middleware responds with HTTP 429 Too Many Requests if there are already amount requests in progress (based on the same sourceCriterion strategy). + format: int64 + type: integer + sourceCriterion: + description: |- + SourceCriterion defines what criterion is used to group requests as originating from a common source. + If several strategies are defined at the same time, an error will be raised. + If none are set, the default is to use the requestHost. + More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/inflightreq/#sourcecriterion + properties: + ipStrategy: + description: |- + IPStrategy holds the IP strategy configuration used by Traefik to determine the client IP. + More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/ipallowlist/#ipstrategy + properties: + depth: + description: Depth tells Traefik to use the X-Forwarded-For + header and take the IP located at the depth position + (starting from the right). + type: integer + excludedIPs: + description: ExcludedIPs configures Traefik to scan the + X-Forwarded-For header and select the first IP not in + the list. + items: + type: string + type: array + ipv6Subnet: + description: IPv6Subnet configures Traefik to consider + all IPv6 addresses from the defined subnet as originating + from the same IP. Applies to RemoteAddrStrategy and + DepthStrategy. + type: integer + type: object + requestHeaderName: + description: RequestHeaderName defines the name of the header + used to group incoming requests. + type: string + requestHost: + description: RequestHost defines whether to consider the request + Host as the source. + type: boolean + type: object + type: object + ipAllowList: + description: |- + IPAllowList holds the IP allowlist middleware configuration. + This middleware limits allowed requests based on the client IP. + More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/ipallowlist/ + properties: + ipStrategy: + description: |- + IPStrategy holds the IP strategy configuration used by Traefik to determine the client IP. + More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/ipallowlist/#ipstrategy + properties: + depth: + description: Depth tells Traefik to use the X-Forwarded-For + header and take the IP located at the depth position (starting + from the right). + type: integer + excludedIPs: + description: ExcludedIPs configures Traefik to scan the X-Forwarded-For + header and select the first IP not in the list. + items: + type: string + type: array + ipv6Subnet: + description: IPv6Subnet configures Traefik to consider all + IPv6 addresses from the defined subnet as originating from + the same IP. Applies to RemoteAddrStrategy and DepthStrategy. + type: integer + type: object + rejectStatusCode: + description: |- + RejectStatusCode defines the HTTP status code used for refused requests. + If not set, the default is 403 (Forbidden). + type: integer + sourceRange: + description: SourceRange defines the set of allowed IPs (or ranges + of allowed IPs by using CIDR notation). + items: + type: string + type: array + type: object + ipWhiteList: + description: 'Deprecated: please use IPAllowList instead.' + properties: + ipStrategy: + description: |- + IPStrategy holds the IP strategy configuration used by Traefik to determine the client IP. + More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/ipallowlist/#ipstrategy + properties: + depth: + description: Depth tells Traefik to use the X-Forwarded-For + header and take the IP located at the depth position (starting + from the right). + type: integer + excludedIPs: + description: ExcludedIPs configures Traefik to scan the X-Forwarded-For + header and select the first IP not in the list. + items: + type: string + type: array + ipv6Subnet: + description: IPv6Subnet configures Traefik to consider all + IPv6 addresses from the defined subnet as originating from + the same IP. Applies to RemoteAddrStrategy and DepthStrategy. + type: integer + type: object + sourceRange: + description: SourceRange defines the set of allowed IPs (or ranges + of allowed IPs by using CIDR notation). Required. + items: + type: string + type: array + type: object + passTLSClientCert: + description: |- + PassTLSClientCert holds the pass TLS client cert middleware configuration. + This middleware adds the selected data from the passed client TLS certificate to a header. + More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/passtlsclientcert/ + properties: + info: + description: Info selects the specific client certificate details + you want to add to the X-Forwarded-Tls-Client-Cert-Info header. + properties: + issuer: + description: Issuer defines the client certificate issuer + details to add to the X-Forwarded-Tls-Client-Cert-Info header. + properties: + commonName: + description: CommonName defines whether to add the organizationalUnit + information into the issuer. + type: boolean + country: + description: Country defines whether to add the country + information into the issuer. + type: boolean + domainComponent: + description: DomainComponent defines whether to add the + domainComponent information into the issuer. + type: boolean + locality: + description: Locality defines whether to add the locality + information into the issuer. + type: boolean + organization: + description: Organization defines whether to add the organization + information into the issuer. + type: boolean + province: + description: Province defines whether to add the province + information into the issuer. + type: boolean + serialNumber: + description: SerialNumber defines whether to add the serialNumber + information into the issuer. + type: boolean + type: object + notAfter: + description: NotAfter defines whether to add the Not After + information from the Validity part. + type: boolean + notBefore: + description: NotBefore defines whether to add the Not Before + information from the Validity part. + type: boolean + sans: + description: Sans defines whether to add the Subject Alternative + Name information from the Subject Alternative Name part. + type: boolean + serialNumber: + description: SerialNumber defines whether to add the client + serialNumber information. + type: boolean + subject: + description: Subject defines the client certificate subject + details to add to the X-Forwarded-Tls-Client-Cert-Info header. + properties: + commonName: + description: CommonName defines whether to add the organizationalUnit + information into the subject. + type: boolean + country: + description: Country defines whether to add the country + information into the subject. + type: boolean + domainComponent: + description: DomainComponent defines whether to add the + domainComponent information into the subject. + type: boolean + locality: + description: Locality defines whether to add the locality + information into the subject. + type: boolean + organization: + description: Organization defines whether to add the organization + information into the subject. + type: boolean + organizationalUnit: + description: OrganizationalUnit defines whether to add + the organizationalUnit information into the subject. + type: boolean + province: + description: Province defines whether to add the province + information into the subject. + type: boolean + serialNumber: + description: SerialNumber defines whether to add the serialNumber + information into the subject. + type: boolean + type: object + type: object + pem: + description: PEM sets the X-Forwarded-Tls-Client-Cert header with + the certificate. + type: boolean + type: object + plugin: + additionalProperties: + x-kubernetes-preserve-unknown-fields: true + description: |- + Plugin defines the middleware plugin configuration. + More info: https://doc.traefik.io/traefik/plugins/ + type: object + rateLimit: + description: |- + RateLimit holds the rate limit configuration. + This middleware ensures that services will receive a fair amount of requests, and allows one to define what fair is. + More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/ratelimit/ + properties: + average: + description: |- + Average is the maximum rate, by default in requests/s, allowed for the given source. + It defaults to 0, which means no rate limiting. + The rate is actually defined by dividing Average by Period. So for a rate below 1req/s, + one needs to define a Period larger than a second. + format: int64 + type: integer + burst: + description: |- + Burst is the maximum number of requests allowed to arrive in the same arbitrarily small period of time. + It defaults to 1. + format: int64 + type: integer + period: + anyOf: + - type: integer + - type: string + description: |- + Period, in combination with Average, defines the actual maximum rate, such as: + r = Average / Period. It defaults to a second. + x-kubernetes-int-or-string: true + sourceCriterion: + description: |- + SourceCriterion defines what criterion is used to group requests as originating from a common source. + If several strategies are defined at the same time, an error will be raised. + If none are set, the default is to use the request's remote address field (as an ipStrategy). + properties: + ipStrategy: + description: |- + IPStrategy holds the IP strategy configuration used by Traefik to determine the client IP. + More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/ipallowlist/#ipstrategy + properties: + depth: + description: Depth tells Traefik to use the X-Forwarded-For + header and take the IP located at the depth position + (starting from the right). + type: integer + excludedIPs: + description: ExcludedIPs configures Traefik to scan the + X-Forwarded-For header and select the first IP not in + the list. + items: + type: string + type: array + ipv6Subnet: + description: IPv6Subnet configures Traefik to consider + all IPv6 addresses from the defined subnet as originating + from the same IP. Applies to RemoteAddrStrategy and + DepthStrategy. + type: integer + type: object + requestHeaderName: + description: RequestHeaderName defines the name of the header + used to group incoming requests. + type: string + requestHost: + description: RequestHost defines whether to consider the request + Host as the source. + type: boolean + type: object + type: object + redirectRegex: + description: |- + RedirectRegex holds the redirect regex middleware configuration. + This middleware redirects a request using regex matching and replacement. + More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/redirectregex/#regex + properties: + permanent: + description: Permanent defines whether the redirection is permanent + (301). + type: boolean + regex: + description: Regex defines the regex used to match and capture + elements from the request URL. + type: string + replacement: + description: Replacement defines how to modify the URL to have + the new target URL. + type: string + type: object + redirectScheme: + description: |- + RedirectScheme holds the redirect scheme middleware configuration. + This middleware redirects requests from a scheme/port to another. + More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/redirectscheme/ + properties: + permanent: + description: Permanent defines whether the redirection is permanent + (301). + type: boolean + port: + description: Port defines the port of the new URL. + type: string + scheme: + description: Scheme defines the scheme of the new URL. + type: string + type: object + replacePath: + description: |- + ReplacePath holds the replace path middleware configuration. + This middleware replaces the path of the request URL and store the original path in an X-Replaced-Path header. + More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/replacepath/ + properties: + path: + description: Path defines the path to use as replacement in the + request URL. + type: string + type: object + replacePathRegex: + description: |- + ReplacePathRegex holds the replace path regex middleware configuration. + This middleware replaces the path of a URL using regex matching and replacement. + More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/replacepathregex/ + properties: + regex: + description: Regex defines the regular expression used to match + and capture the path from the request URL. + type: string + replacement: + description: Replacement defines the replacement path format, + which can include captured variables. + type: string + type: object + retry: + description: |- + Retry holds the retry middleware configuration. + This middleware reissues requests a given number of times to a backend server if that server does not reply. + As soon as the server answers, the middleware stops retrying, regardless of the response status. + More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/retry/ + properties: + attempts: + description: Attempts defines how many times the request should + be retried. + type: integer + initialInterval: + anyOf: + - type: integer + - type: string + description: |- + InitialInterval defines the first wait time in the exponential backoff series. + The maximum interval is calculated as twice the initialInterval. + If unspecified, requests will be retried immediately. + The value of initialInterval should be provided in seconds or as a valid duration format, + see https://pkg.go.dev/time#ParseDuration. + x-kubernetes-int-or-string: true + type: object + stripPrefix: + description: |- + StripPrefix holds the strip prefix middleware configuration. + This middleware removes the specified prefixes from the URL path. + More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/stripprefix/ + properties: + forceSlash: + description: |- + Deprecated: ForceSlash option is deprecated, please remove any usage of this option. + ForceSlash ensures that the resulting stripped path is not the empty string, by replacing it with / when necessary. + Default: true. + type: boolean + prefixes: + description: Prefixes defines the prefixes to strip from the request + URL. + items: + type: string + type: array + type: object + stripPrefixRegex: + description: |- + StripPrefixRegex holds the strip prefix regex middleware configuration. + This middleware removes the matching prefixes from the URL path. + More info: https://doc.traefik.io/traefik/v3.3/middlewares/http/stripprefixregex/ + properties: + regex: + description: Regex defines the regular expression to match the + path prefix from the request URL. + items: + type: string + type: array + type: object + type: object + required: + - metadata + - spec + type: object + served: true + storage: true + +--- +# Source: traefik/crds/traefik.io_middlewaretcps.yaml +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.16.1 + name: middlewaretcps.traefik.io +spec: + group: traefik.io + names: + kind: MiddlewareTCP + listKind: MiddlewareTCPList + plural: middlewaretcps + singular: middlewaretcp + scope: Namespaced + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: |- + MiddlewareTCP is the CRD implementation of a Traefik TCP middleware. + More info: https://doc.traefik.io/traefik/v3.3/middlewares/overview/ + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: MiddlewareTCPSpec defines the desired state of a MiddlewareTCP. + properties: + inFlightConn: + description: InFlightConn defines the InFlightConn middleware configuration. + properties: + amount: + description: |- + Amount defines the maximum amount of allowed simultaneous connections. + The middleware closes the connection if there are already amount connections opened. + format: int64 + type: integer + type: object + ipAllowList: + description: |- + IPAllowList defines the IPAllowList middleware configuration. + This middleware accepts/refuses connections based on the client IP. + More info: https://doc.traefik.io/traefik/v3.3/middlewares/tcp/ipallowlist/ + properties: + sourceRange: + description: SourceRange defines the allowed IPs (or ranges of + allowed IPs by using CIDR notation). + items: + type: string + type: array + type: object + ipWhiteList: + description: |- + IPWhiteList defines the IPWhiteList middleware configuration. + This middleware accepts/refuses connections based on the client IP. + Deprecated: please use IPAllowList instead. + More info: https://doc.traefik.io/traefik/v3.3/middlewares/tcp/ipwhitelist/ + properties: + sourceRange: + description: SourceRange defines the allowed IPs (or ranges of + allowed IPs by using CIDR notation). + items: + type: string + type: array + type: object + type: object + required: + - metadata + - spec + type: object + served: true + storage: true + +--- +# Source: traefik/crds/traefik.io_serverstransports.yaml +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.16.1 + name: serverstransports.traefik.io +spec: + group: traefik.io + names: + kind: ServersTransport + listKind: ServersTransportList + plural: serverstransports + singular: serverstransport + scope: Namespaced + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: |- + ServersTransport is the CRD implementation of a ServersTransport. + If no serversTransport is specified, the default@internal will be used. + The default@internal serversTransport is created from the static configuration. + More info: https://doc.traefik.io/traefik/v3.3/routing/services/#serverstransport_1 + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: ServersTransportSpec defines the desired state of a ServersTransport. + properties: + certificatesSecrets: + description: CertificatesSecrets defines a list of secret storing + client certificates for mTLS. + items: + type: string + type: array + disableHTTP2: + description: DisableHTTP2 disables HTTP/2 for connections with backend + servers. + type: boolean + forwardingTimeouts: + description: ForwardingTimeouts defines the timeouts for requests + forwarded to the backend servers. + properties: + dialTimeout: + anyOf: + - type: integer + - type: string + description: DialTimeout is the amount of time to wait until a + connection to a backend server can be established. + x-kubernetes-int-or-string: true + idleConnTimeout: + anyOf: + - type: integer + - type: string + description: IdleConnTimeout is the maximum period for which an + idle HTTP keep-alive connection will remain open before closing + itself. + x-kubernetes-int-or-string: true + pingTimeout: + anyOf: + - type: integer + - type: string + description: PingTimeout is the timeout after which the HTTP/2 + connection will be closed if a response to ping is not received. + x-kubernetes-int-or-string: true + readIdleTimeout: + anyOf: + - type: integer + - type: string + description: ReadIdleTimeout is the timeout after which a health + check using ping frame will be carried out if no frame is received + on the HTTP/2 connection. + x-kubernetes-int-or-string: true + responseHeaderTimeout: + anyOf: + - type: integer + - type: string + description: ResponseHeaderTimeout is the amount of time to wait + for a server's response headers after fully writing the request + (including its body, if any). + x-kubernetes-int-or-string: true + type: object + insecureSkipVerify: + description: InsecureSkipVerify disables SSL certificate verification. + type: boolean + maxIdleConnsPerHost: + description: MaxIdleConnsPerHost controls the maximum idle (keep-alive) + to keep per-host. + type: integer + peerCertURI: + description: PeerCertURI defines the peer cert URI used to match against + SAN URI during the peer certificate verification. + type: string + rootCAsSecrets: + description: RootCAsSecrets defines a list of CA secret used to validate + self-signed certificate. + items: + type: string + type: array + serverName: + description: ServerName defines the server name used to contact the + server. + type: string + spiffe: + description: Spiffe defines the SPIFFE configuration. + properties: + ids: + description: IDs defines the allowed SPIFFE IDs (takes precedence + over the SPIFFE TrustDomain). + items: + type: string + type: array + trustDomain: + description: TrustDomain defines the allowed SPIFFE trust domain. + type: string + type: object + type: object + required: + - metadata + - spec + type: object + served: true + storage: true + +--- +# Source: traefik/crds/traefik.io_serverstransporttcps.yaml +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.16.1 + name: serverstransporttcps.traefik.io +spec: + group: traefik.io + names: + kind: ServersTransportTCP + listKind: ServersTransportTCPList + plural: serverstransporttcps + singular: serverstransporttcp + scope: Namespaced + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: |- + ServersTransportTCP is the CRD implementation of a TCPServersTransport. + If no tcpServersTransport is specified, a default one named default@internal will be used. + The default@internal tcpServersTransport can be configured in the static configuration. + More info: https://doc.traefik.io/traefik/v3.3/routing/services/#serverstransport_3 + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: ServersTransportTCPSpec defines the desired state of a ServersTransportTCP. + properties: + dialKeepAlive: + anyOf: + - type: integer + - type: string + description: DialKeepAlive is the interval between keep-alive probes + for an active network connection. If zero, keep-alive probes are + sent with a default value (currently 15 seconds), if supported by + the protocol and operating system. Network protocols or operating + systems that do not support keep-alives ignore this field. If negative, + keep-alive probes are disabled. + x-kubernetes-int-or-string: true + dialTimeout: + anyOf: + - type: integer + - type: string + description: DialTimeout is the amount of time to wait until a connection + to a backend server can be established. + x-kubernetes-int-or-string: true + terminationDelay: + anyOf: + - type: integer + - type: string + description: TerminationDelay defines the delay to wait before fully + terminating the connection, after one connected peer has closed + its writing capability. + x-kubernetes-int-or-string: true + tls: + description: TLS defines the TLS configuration + properties: + certificatesSecrets: + description: CertificatesSecrets defines a list of secret storing + client certificates for mTLS. + items: + type: string + type: array + insecureSkipVerify: + description: InsecureSkipVerify disables TLS certificate verification. + type: boolean + peerCertURI: + description: |- + MaxIdleConnsPerHost controls the maximum idle (keep-alive) to keep per-host. + PeerCertURI defines the peer cert URI used to match against SAN URI during the peer certificate verification. + type: string + rootCAsSecrets: + description: RootCAsSecrets defines a list of CA secret used to + validate self-signed certificates. + items: + type: string + type: array + serverName: + description: ServerName defines the server name used to contact + the server. + type: string + spiffe: + description: Spiffe defines the SPIFFE configuration. + properties: + ids: + description: IDs defines the allowed SPIFFE IDs (takes precedence + over the SPIFFE TrustDomain). + items: + type: string + type: array + trustDomain: + description: TrustDomain defines the allowed SPIFFE trust + domain. + type: string + type: object + type: object + type: object + required: + - metadata + - spec + type: object + served: true + storage: true + +--- +# Source: traefik/crds/traefik.io_tlsoptions.yaml +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.16.1 + name: tlsoptions.traefik.io +spec: + group: traefik.io + names: + kind: TLSOption + listKind: TLSOptionList + plural: tlsoptions + singular: tlsoption + scope: Namespaced + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: |- + TLSOption is the CRD implementation of a Traefik TLS Option, allowing to configure some parameters of the TLS connection. + More info: https://doc.traefik.io/traefik/v3.3/https/tls/#tls-options + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: TLSOptionSpec defines the desired state of a TLSOption. + properties: + alpnProtocols: + description: |- + ALPNProtocols defines the list of supported application level protocols for the TLS handshake, in order of preference. + More info: https://doc.traefik.io/traefik/v3.3/https/tls/#alpn-protocols + items: + type: string + type: array + cipherSuites: + description: |- + CipherSuites defines the list of supported cipher suites for TLS versions up to TLS 1.2. + More info: https://doc.traefik.io/traefik/v3.3/https/tls/#cipher-suites + items: + type: string + type: array + clientAuth: + description: ClientAuth defines the server's policy for TLS Client + Authentication. + properties: + clientAuthType: + description: ClientAuthType defines the client authentication + type to apply. + enum: + - NoClientCert + - RequestClientCert + - RequireAnyClientCert + - VerifyClientCertIfGiven + - RequireAndVerifyClientCert + type: string + secretNames: + description: SecretNames defines the names of the referenced Kubernetes + Secret storing certificate details. + items: + type: string + type: array + type: object + curvePreferences: + description: |- + CurvePreferences defines the preferred elliptic curves in a specific order. + More info: https://doc.traefik.io/traefik/v3.3/https/tls/#curve-preferences + items: + type: string + type: array + maxVersion: + description: |- + MaxVersion defines the maximum TLS version that Traefik will accept. + Possible values: VersionTLS10, VersionTLS11, VersionTLS12, VersionTLS13. + Default: None. + type: string + minVersion: + description: |- + MinVersion defines the minimum TLS version that Traefik will accept. + Possible values: VersionTLS10, VersionTLS11, VersionTLS12, VersionTLS13. + Default: VersionTLS10. + type: string + preferServerCipherSuites: + description: |- + PreferServerCipherSuites defines whether the server chooses a cipher suite among his own instead of among the client's. + It is enabled automatically when minVersion or maxVersion is set. + Deprecated: https://github.com/golang/go/issues/45430 + type: boolean + sniStrict: + description: SniStrict defines whether Traefik allows connections + from clients connections that do not specify a server_name extension. + type: boolean + type: object + required: + - metadata + - spec + type: object + served: true + storage: true + +--- +# Source: traefik/crds/traefik.io_tlsstores.yaml +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.16.1 + name: tlsstores.traefik.io +spec: + group: traefik.io + names: + kind: TLSStore + listKind: TLSStoreList + plural: tlsstores + singular: tlsstore + scope: Namespaced + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: |- + TLSStore is the CRD implementation of a Traefik TLS Store. + For the time being, only the TLSStore named default is supported. + This means that you cannot have two stores that are named default in different Kubernetes namespaces. + More info: https://doc.traefik.io/traefik/v3.3/https/tls/#certificates-stores + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: TLSStoreSpec defines the desired state of a TLSStore. + properties: + certificates: + description: Certificates is a list of secret names, each secret holding + a key/certificate pair to add to the store. + items: + description: Certificate holds a secret name for the TLSStore resource. + properties: + secretName: + description: SecretName is the name of the referenced Kubernetes + Secret to specify the certificate details. + type: string + required: + - secretName + type: object + type: array + defaultCertificate: + description: DefaultCertificate defines the default certificate configuration. + properties: + secretName: + description: SecretName is the name of the referenced Kubernetes + Secret to specify the certificate details. + type: string + required: + - secretName + type: object + defaultGeneratedCert: + description: DefaultGeneratedCert defines the default generated certificate + configuration. + properties: + domain: + description: Domain is the domain definition for the DefaultCertificate. + properties: + main: + description: Main defines the main domain name. + type: string + sans: + description: SANs defines the subject alternative domain names. + items: + type: string + type: array + type: object + resolver: + description: Resolver is the name of the resolver that will be + used to issue the DefaultCertificate. + type: string + type: object + type: object + required: + - metadata + - spec + type: object + served: true + storage: true + +--- +# Source: traefik/crds/traefik.io_traefikservices.yaml +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.16.1 + name: traefikservices.traefik.io +spec: + group: traefik.io + names: + kind: TraefikService + listKind: TraefikServiceList + plural: traefikservices + singular: traefikservice + scope: Namespaced + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: |- + TraefikService is the CRD implementation of a Traefik Service. + TraefikService object allows to: + - Apply weight to Services on load-balancing + - Mirror traffic on services + More info: https://doc.traefik.io/traefik/v3.3/routing/providers/kubernetes-crd/#kind-traefikservice + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: TraefikServiceSpec defines the desired state of a TraefikService. + properties: + mirroring: + description: Mirroring defines the Mirroring service configuration. + properties: + healthCheck: + description: Healthcheck defines health checks for ExternalName + services. + properties: + followRedirects: + description: |- + FollowRedirects defines whether redirects should be followed during the health check calls. + Default: true + type: boolean + headers: + additionalProperties: + type: string + description: Headers defines custom headers to be sent to + the health check endpoint. + type: object + hostname: + description: Hostname defines the value of hostname in the + Host header of the health check request. + type: string + interval: + anyOf: + - type: integer + - type: string + description: |- + Interval defines the frequency of the health check calls. + Default: 30s + x-kubernetes-int-or-string: true + method: + description: Method defines the healthcheck method. + type: string + mode: + description: |- + Mode defines the health check mode. + If defined to grpc, will use the gRPC health check protocol to probe the server. + Default: http + type: string + path: + description: Path defines the server URL path for the health + check endpoint. + type: string + port: + description: Port defines the server URL port for the health + check endpoint. + type: integer + scheme: + description: Scheme replaces the server URL scheme for the + health check endpoint. + type: string + status: + description: Status defines the expected HTTP status code + of the response to the health check request. + type: integer + timeout: + anyOf: + - type: integer + - type: string + description: |- + Timeout defines the maximum duration Traefik will wait for a health check request before considering the server unhealthy. + Default: 5s + x-kubernetes-int-or-string: true + type: object + kind: + description: Kind defines the kind of the Service. + enum: + - Service + - TraefikService + type: string + maxBodySize: + description: |- + MaxBodySize defines the maximum size allowed for the body of the request. + If the body is larger, the request is not mirrored. + Default value is -1, which means unlimited size. + format: int64 + type: integer + mirrorBody: + description: |- + MirrorBody defines whether the body of the request should be mirrored. + Default value is true. + type: boolean + mirrors: + description: Mirrors defines the list of mirrors where Traefik + will duplicate the traffic. + items: + description: MirrorService holds the mirror configuration. + properties: + healthCheck: + description: Healthcheck defines health checks for ExternalName + services. + properties: + followRedirects: + description: |- + FollowRedirects defines whether redirects should be followed during the health check calls. + Default: true + type: boolean + headers: + additionalProperties: + type: string + description: Headers defines custom headers to be sent + to the health check endpoint. + type: object + hostname: + description: Hostname defines the value of hostname + in the Host header of the health check request. + type: string + interval: + anyOf: + - type: integer + - type: string + description: |- + Interval defines the frequency of the health check calls. + Default: 30s + x-kubernetes-int-or-string: true + method: + description: Method defines the healthcheck method. + type: string + mode: + description: |- + Mode defines the health check mode. + If defined to grpc, will use the gRPC health check protocol to probe the server. + Default: http + type: string + path: + description: Path defines the server URL path for the + health check endpoint. + type: string + port: + description: Port defines the server URL port for the + health check endpoint. + type: integer + scheme: + description: Scheme replaces the server URL scheme for + the health check endpoint. + type: string + status: + description: Status defines the expected HTTP status + code of the response to the health check request. + type: integer + timeout: + anyOf: + - type: integer + - type: string + description: |- + Timeout defines the maximum duration Traefik will wait for a health check request before considering the server unhealthy. + Default: 5s + x-kubernetes-int-or-string: true + type: object + kind: + description: Kind defines the kind of the Service. + enum: + - Service + - TraefikService + type: string + name: + description: |- + Name defines the name of the referenced Kubernetes Service or TraefikService. + The differentiation between the two is specified in the Kind field. + type: string + namespace: + description: Namespace defines the namespace of the referenced + Kubernetes Service or TraefikService. + type: string + nativeLB: + description: |- + NativeLB controls, when creating the load-balancer, + whether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP. + The Kubernetes Service itself does load-balance to the pods. + By default, NativeLB is false. + type: boolean + nodePortLB: + description: |- + NodePortLB controls, when creating the load-balancer, + whether the LB's children are directly the nodes internal IPs using the nodePort when the service type is NodePort. + It allows services to be reachable when Traefik runs externally from the Kubernetes cluster but within the same network of the nodes. + By default, NodePortLB is false. + type: boolean + passHostHeader: + description: |- + PassHostHeader defines whether the client Host header is forwarded to the upstream Kubernetes Service. + By default, passHostHeader is true. + type: boolean + percent: + description: |- + Percent defines the part of the traffic to mirror. + Supported values: 0 to 100. + type: integer + port: + anyOf: + - type: integer + - type: string + description: |- + Port defines the port of a Kubernetes Service. + This can be a reference to a named port. + x-kubernetes-int-or-string: true + responseForwarding: + description: ResponseForwarding defines how Traefik forwards + the response from the upstream Kubernetes Service to the + client. + properties: + flushInterval: + description: |- + FlushInterval defines the interval, in milliseconds, in between flushes to the client while copying the response body. + A negative value means to flush immediately after each write to the client. + This configuration is ignored when ReverseProxy recognizes a response as a streaming response; + for such responses, writes are flushed to the client immediately. + Default: 100ms + type: string + type: object + scheme: + description: |- + Scheme defines the scheme to use for the request to the upstream Kubernetes Service. + It defaults to https when Kubernetes Service port is 443, http otherwise. + type: string + serversTransport: + description: |- + ServersTransport defines the name of ServersTransport resource to use. + It allows to configure the transport between Traefik and your servers. + Can only be used on a Kubernetes Service. + type: string + sticky: + description: |- + Sticky defines the sticky sessions configuration. + More info: https://doc.traefik.io/traefik/v3.3/routing/services/#sticky-sessions + properties: + cookie: + description: Cookie defines the sticky cookie configuration. + properties: + httpOnly: + description: HTTPOnly defines whether the cookie + can be accessed by client-side APIs, such as JavaScript. + type: boolean + maxAge: + description: |- + MaxAge defines the number of seconds until the cookie expires. + When set to a negative number, the cookie expires immediately. + When set to zero, the cookie never expires. + type: integer + name: + description: Name defines the Cookie name. + type: string + path: + description: |- + Path defines the path that must exist in the requested URL for the browser to send the Cookie header. + When not provided the cookie will be sent on every request to the domain. + More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#pathpath-value + type: string + sameSite: + description: |- + SameSite defines the same site policy. + More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite + type: string + secure: + description: Secure defines whether the cookie can + only be transmitted over an encrypted connection + (i.e. HTTPS). + type: boolean + type: object + type: object + strategy: + description: |- + Strategy defines the load balancing strategy between the servers. + RoundRobin is the only supported value at the moment. + type: string + weight: + description: |- + Weight defines the weight and should only be specified when Name references a TraefikService object + (and to be precise, one that embeds a Weighted Round Robin). + type: integer + required: + - name + type: object + type: array + name: + description: |- + Name defines the name of the referenced Kubernetes Service or TraefikService. + The differentiation between the two is specified in the Kind field. + type: string + namespace: + description: Namespace defines the namespace of the referenced + Kubernetes Service or TraefikService. + type: string + nativeLB: + description: |- + NativeLB controls, when creating the load-balancer, + whether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP. + The Kubernetes Service itself does load-balance to the pods. + By default, NativeLB is false. + type: boolean + nodePortLB: + description: |- + NodePortLB controls, when creating the load-balancer, + whether the LB's children are directly the nodes internal IPs using the nodePort when the service type is NodePort. + It allows services to be reachable when Traefik runs externally from the Kubernetes cluster but within the same network of the nodes. + By default, NodePortLB is false. + type: boolean + passHostHeader: + description: |- + PassHostHeader defines whether the client Host header is forwarded to the upstream Kubernetes Service. + By default, passHostHeader is true. + type: boolean + port: + anyOf: + - type: integer + - type: string + description: |- + Port defines the port of a Kubernetes Service. + This can be a reference to a named port. + x-kubernetes-int-or-string: true + responseForwarding: + description: ResponseForwarding defines how Traefik forwards the + response from the upstream Kubernetes Service to the client. + properties: + flushInterval: + description: |- + FlushInterval defines the interval, in milliseconds, in between flushes to the client while copying the response body. + A negative value means to flush immediately after each write to the client. + This configuration is ignored when ReverseProxy recognizes a response as a streaming response; + for such responses, writes are flushed to the client immediately. + Default: 100ms + type: string + type: object + scheme: + description: |- + Scheme defines the scheme to use for the request to the upstream Kubernetes Service. + It defaults to https when Kubernetes Service port is 443, http otherwise. + type: string + serversTransport: + description: |- + ServersTransport defines the name of ServersTransport resource to use. + It allows to configure the transport between Traefik and your servers. + Can only be used on a Kubernetes Service. + type: string + sticky: + description: |- + Sticky defines the sticky sessions configuration. + More info: https://doc.traefik.io/traefik/v3.3/routing/services/#sticky-sessions + properties: + cookie: + description: Cookie defines the sticky cookie configuration. + properties: + httpOnly: + description: HTTPOnly defines whether the cookie can be + accessed by client-side APIs, such as JavaScript. + type: boolean + maxAge: + description: |- + MaxAge defines the number of seconds until the cookie expires. + When set to a negative number, the cookie expires immediately. + When set to zero, the cookie never expires. + type: integer + name: + description: Name defines the Cookie name. + type: string + path: + description: |- + Path defines the path that must exist in the requested URL for the browser to send the Cookie header. + When not provided the cookie will be sent on every request to the domain. + More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#pathpath-value + type: string + sameSite: + description: |- + SameSite defines the same site policy. + More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite + type: string + secure: + description: Secure defines whether the cookie can only + be transmitted over an encrypted connection (i.e. HTTPS). + type: boolean + type: object + type: object + strategy: + description: |- + Strategy defines the load balancing strategy between the servers. + RoundRobin is the only supported value at the moment. + type: string + weight: + description: |- + Weight defines the weight and should only be specified when Name references a TraefikService object + (and to be precise, one that embeds a Weighted Round Robin). + type: integer + required: + - name + type: object + weighted: + description: Weighted defines the Weighted Round Robin configuration. + properties: + services: + description: Services defines the list of Kubernetes Service and/or + TraefikService to load-balance, with weight. + items: + description: Service defines an upstream HTTP service to proxy + traffic to. + properties: + healthCheck: + description: Healthcheck defines health checks for ExternalName + services. + properties: + followRedirects: + description: |- + FollowRedirects defines whether redirects should be followed during the health check calls. + Default: true + type: boolean + headers: + additionalProperties: + type: string + description: Headers defines custom headers to be sent + to the health check endpoint. + type: object + hostname: + description: Hostname defines the value of hostname + in the Host header of the health check request. + type: string + interval: + anyOf: + - type: integer + - type: string + description: |- + Interval defines the frequency of the health check calls. + Default: 30s + x-kubernetes-int-or-string: true + method: + description: Method defines the healthcheck method. + type: string + mode: + description: |- + Mode defines the health check mode. + If defined to grpc, will use the gRPC health check protocol to probe the server. + Default: http + type: string + path: + description: Path defines the server URL path for the + health check endpoint. + type: string + port: + description: Port defines the server URL port for the + health check endpoint. + type: integer + scheme: + description: Scheme replaces the server URL scheme for + the health check endpoint. + type: string + status: + description: Status defines the expected HTTP status + code of the response to the health check request. + type: integer + timeout: + anyOf: + - type: integer + - type: string + description: |- + Timeout defines the maximum duration Traefik will wait for a health check request before considering the server unhealthy. + Default: 5s + x-kubernetes-int-or-string: true + type: object + kind: + description: Kind defines the kind of the Service. + enum: + - Service + - TraefikService + type: string + name: + description: |- + Name defines the name of the referenced Kubernetes Service or TraefikService. + The differentiation between the two is specified in the Kind field. + type: string + namespace: + description: Namespace defines the namespace of the referenced + Kubernetes Service or TraefikService. + type: string + nativeLB: + description: |- + NativeLB controls, when creating the load-balancer, + whether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP. + The Kubernetes Service itself does load-balance to the pods. + By default, NativeLB is false. + type: boolean + nodePortLB: + description: |- + NodePortLB controls, when creating the load-balancer, + whether the LB's children are directly the nodes internal IPs using the nodePort when the service type is NodePort. + It allows services to be reachable when Traefik runs externally from the Kubernetes cluster but within the same network of the nodes. + By default, NodePortLB is false. + type: boolean + passHostHeader: + description: |- + PassHostHeader defines whether the client Host header is forwarded to the upstream Kubernetes Service. + By default, passHostHeader is true. + type: boolean + port: + anyOf: + - type: integer + - type: string + description: |- + Port defines the port of a Kubernetes Service. + This can be a reference to a named port. + x-kubernetes-int-or-string: true + responseForwarding: + description: ResponseForwarding defines how Traefik forwards + the response from the upstream Kubernetes Service to the + client. + properties: + flushInterval: + description: |- + FlushInterval defines the interval, in milliseconds, in between flushes to the client while copying the response body. + A negative value means to flush immediately after each write to the client. + This configuration is ignored when ReverseProxy recognizes a response as a streaming response; + for such responses, writes are flushed to the client immediately. + Default: 100ms + type: string + type: object + scheme: + description: |- + Scheme defines the scheme to use for the request to the upstream Kubernetes Service. + It defaults to https when Kubernetes Service port is 443, http otherwise. + type: string + serversTransport: + description: |- + ServersTransport defines the name of ServersTransport resource to use. + It allows to configure the transport between Traefik and your servers. + Can only be used on a Kubernetes Service. + type: string + sticky: + description: |- + Sticky defines the sticky sessions configuration. + More info: https://doc.traefik.io/traefik/v3.3/routing/services/#sticky-sessions + properties: + cookie: + description: Cookie defines the sticky cookie configuration. + properties: + httpOnly: + description: HTTPOnly defines whether the cookie + can be accessed by client-side APIs, such as JavaScript. + type: boolean + maxAge: + description: |- + MaxAge defines the number of seconds until the cookie expires. + When set to a negative number, the cookie expires immediately. + When set to zero, the cookie never expires. + type: integer + name: + description: Name defines the Cookie name. + type: string + path: + description: |- + Path defines the path that must exist in the requested URL for the browser to send the Cookie header. + When not provided the cookie will be sent on every request to the domain. + More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#pathpath-value + type: string + sameSite: + description: |- + SameSite defines the same site policy. + More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite + type: string + secure: + description: Secure defines whether the cookie can + only be transmitted over an encrypted connection + (i.e. HTTPS). + type: boolean + type: object + type: object + strategy: + description: |- + Strategy defines the load balancing strategy between the servers. + RoundRobin is the only supported value at the moment. + type: string + weight: + description: |- + Weight defines the weight and should only be specified when Name references a TraefikService object + (and to be precise, one that embeds a Weighted Round Robin). + type: integer + required: + - name + type: object + type: array + sticky: + description: |- + Sticky defines whether sticky sessions are enabled. + More info: https://doc.traefik.io/traefik/v3.3/routing/providers/kubernetes-crd/#stickiness-and-load-balancing + properties: + cookie: + description: Cookie defines the sticky cookie configuration. + properties: + httpOnly: + description: HTTPOnly defines whether the cookie can be + accessed by client-side APIs, such as JavaScript. + type: boolean + maxAge: + description: |- + MaxAge defines the number of seconds until the cookie expires. + When set to a negative number, the cookie expires immediately. + When set to zero, the cookie never expires. + type: integer + name: + description: Name defines the Cookie name. + type: string + path: + description: |- + Path defines the path that must exist in the requested URL for the browser to send the Cookie header. + When not provided the cookie will be sent on every request to the domain. + More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#pathpath-value + type: string + sameSite: + description: |- + SameSite defines the same site policy. + More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite + type: string + secure: + description: Secure defines whether the cookie can only + be transmitted over an encrypted connection (i.e. HTTPS). + type: boolean + type: object + type: object + type: object + type: object + required: + - metadata + - spec + type: object + served: true + storage: true + +--- +# Source: traefik/templates/rbac/serviceaccount.yaml +kind: ServiceAccount +apiVersion: v1 +metadata: + name: traefik + namespace: traefik + labels: + app.kubernetes.io/name: traefik + app.kubernetes.io/instance: traefik-traefik + helm.sh/chart: traefik-34.4.1 + app.kubernetes.io/managed-by: Helm + annotations: +automountServiceAccountToken: false +--- +# Source: traefik/templates/rbac/clusterrole.yaml +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: traefik-traefik + labels: + app.kubernetes.io/name: traefik + app.kubernetes.io/instance: traefik-traefik + helm.sh/chart: traefik-34.4.1 + app.kubernetes.io/managed-by: Helm +rules: + - apiGroups: + - "" + resources: + - nodes + verbs: + - get + - list + - watch + - apiGroups: + - "" + resources: + - services + verbs: + - get + - list + - watch + - apiGroups: + - discovery.k8s.io + resources: + - endpointslices + verbs: + - list + - watch + - apiGroups: + - "" + resources: + - secrets + verbs: + - get + - list + - watch + - apiGroups: + - extensions + - networking.k8s.io + resources: + - ingressclasses + - ingresses + verbs: + - get + - list + - watch + - apiGroups: + - extensions + - networking.k8s.io + resources: + - ingresses/status + verbs: + - update + - apiGroups: + - traefik.io + resources: + - ingressroutes + - ingressroutetcps + - ingressrouteudps + - middlewares + - middlewaretcps + - serverstransports + - serverstransporttcps + - tlsoptions + - tlsstores + - traefikservices + verbs: + - get + - list + - watch + +--- +# Source: traefik/templates/rbac/clusterrolebinding.yaml +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: traefik-traefik + labels: + app.kubernetes.io/name: traefik + app.kubernetes.io/instance: traefik-traefik + helm.sh/chart: traefik-34.4.1 + app.kubernetes.io/managed-by: Helm +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: traefik-traefik +subjects: + - kind: ServiceAccount + name: traefik + namespace: traefik +--- +# Source: traefik/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + name: traefik + namespace: traefik + labels: + app.kubernetes.io/name: traefik + app.kubernetes.io/instance: traefik-traefik + helm.sh/chart: traefik-34.4.1 + app.kubernetes.io/managed-by: Helm + annotations: +spec: + type: LoadBalancer + selector: + app.kubernetes.io/name: traefik + app.kubernetes.io/instance: traefik-traefik + ports: + - port: 80 + name: "web" + targetPort: web + protocol: TCP + - port: 443 + name: "websecure" + targetPort: websecure + protocol: TCP +--- +# Source: traefik/templates/deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + name: traefik + namespace: traefik + labels: + app.kubernetes.io/name: traefik + app.kubernetes.io/instance: traefik-traefik + helm.sh/chart: traefik-34.4.1 + app.kubernetes.io/managed-by: Helm + annotations: +spec: + replicas: 1 + selector: + matchLabels: + app.kubernetes.io/name: traefik + app.kubernetes.io/instance: traefik-traefik + strategy: + type: RollingUpdate + rollingUpdate: + maxUnavailable: 0 + maxSurge: 1 + minReadySeconds: 0 + template: + metadata: + annotations: + prometheus.io/scrape: "true" + prometheus.io/path: "/metrics" + prometheus.io/port: "9100" + labels: + app.kubernetes.io/name: traefik + app.kubernetes.io/instance: traefik-traefik + helm.sh/chart: traefik-34.4.1 + app.kubernetes.io/managed-by: Helm + spec: + serviceAccountName: traefik + automountServiceAccountToken: true + terminationGracePeriodSeconds: 60 + hostNetwork: false + containers: + - image: docker.io/traefik:v3.3.4 + imagePullPolicy: IfNotPresent + name: traefik + resources: + readinessProbe: + httpGet: + path: /ping + port: 8080 + scheme: HTTP + failureThreshold: 1 + initialDelaySeconds: 2 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 2 + livenessProbe: + httpGet: + path: /ping + port: 8080 + scheme: HTTP + failureThreshold: 3 + initialDelaySeconds: 2 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 2 + lifecycle: + ports: + - name: "metrics" + containerPort: 9100 + protocol: "TCP" + - name: "traefik" + containerPort: 8080 + protocol: "TCP" + - name: "web" + containerPort: 8000 + protocol: "TCP" + - name: "websecure" + containerPort: 8443 + protocol: "TCP" + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + volumeMounts: + - name: data + mountPath: /data + - name: tmp + mountPath: /tmp + args: + - "--global.checknewversion" + - "--global.sendanonymoususage" + - "--entryPoints.metrics.address=:9100/tcp" + - "--entryPoints.traefik.address=:8080/tcp" + - "--entryPoints.web.address=:8000/tcp" + - "--entryPoints.websecure.address=:8443/tcp" + - "--api.dashboard=true" + - "--ping=true" + - "--metrics.prometheus=true" + - "--metrics.prometheus.entrypoint=metrics" + - "--providers.kubernetescrd" + - "--providers.kubernetescrd.allowEmptyServices=true" + - "--providers.kubernetesingress" + - "--providers.kubernetesingress.allowEmptyServices=true" + - "--providers.kubernetesingress.ingressendpoint.publishedservice=traefik/traefik" + - "--entryPoints.websecure.http.tls=true" + - "--log.level=INFO" + + env: + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + volumes: + - name: data + emptyDir: {} + - name: tmp + emptyDir: {} + securityContext: + runAsGroup: 65532 + runAsNonRoot: true + runAsUser: 65532 + +--- +# Source: traefik/templates/ingressclass.yaml +apiVersion: networking.k8s.io/v1 +kind: IngressClass +metadata: + annotations: + ingressclass.kubernetes.io/is-default-class: "true" + labels: + app.kubernetes.io/name: traefik + app.kubernetes.io/instance: traefik-traefik + helm.sh/chart: traefik-34.4.1 + app.kubernetes.io/managed-by: Helm + name: traefik +spec: + controller: traefik.io/ingress-controller + diff --git a/packages/manifests/scripts/pull-manifests.ts b/packages/manifests/scripts/pull-manifests.ts index f25c4b6..27836ac 100644 --- a/packages/manifests/scripts/pull-manifests.ts +++ b/packages/manifests/scripts/pull-manifests.ts @@ -69,8 +69,10 @@ const OPERATORS: OperatorConfig[] = [ type: 'urls', version: '1.25.2', urls: [ - // Matches scripts/01-install-operators.sh - 'https://raw.githubusercontent.com/cloudnative-pg/cloudnative-pg/release-1.25/releases/cnpg-1.25.2.yaml', + // Pinned to the tag rather than the release-1.25 branch: a branch can + // change under a fixed filename, so the same version could pull + // different content on two different days. + 'https://raw.githubusercontent.com/cloudnative-pg/cloudnative-pg/v1.25.2/releases/cnpg-1.25.2.yaml', ], }, ], @@ -80,11 +82,14 @@ const OPERATORS: OperatorConfig[] = [ sources: [ { type: 'urls', - version: 'v1.15.0', + version: 'v1.22.1', urls: [ - 'https://github.com/knative/serving/releases/download/knative-v1.15.0/serving-crds.yaml', - 'https://github.com/knative/serving/releases/download/knative-v1.15.0/serving-core.yaml', - 'https://github.com/knative/net-kourier/releases/download/knative-v1.15.0/kourier.yaml', + 'https://github.com/knative/serving/releases/download/knative-v1.22.1/serving-crds.yaml', + 'https://github.com/knative/serving/releases/download/knative-v1.22.1/serving-core.yaml', + // knative-extensions, not knative: the old path redirects, so both + // work and neither is obviously wrong — which is how two consumers + // came to name different repos for the same file. + 'https://github.com/knative-extensions/net-kourier/releases/download/knative-v1.22.1/kourier.yaml', ], }, ], @@ -94,7 +99,7 @@ const OPERATORS: OperatorConfig[] = [ sources: [ { type: 'helm', - version: 'v1.17.0', + version: 'v1.21.1', repo: 'https://charts.jetstack.io', repoName: 'jetstack', chart: 'cert-manager', @@ -103,26 +108,6 @@ const OPERATORS: OperatorConfig[] = [ }, ], }, - { - name: 'ingress-nginx', - sources: [ - { - type: 'helm', - // Chart 4.11.2 corresponds to controller 1.11.1 (matches existing yaml) - version: '4.11.2', - repo: 'https://kubernetes.github.io/ingress-nginx', - repoName: 'ingress-nginx', - chart: 'ingress-nginx', - namespace: 'ingress-nginx', - values: { - controller: { - metrics: { enabled: true }, - podAnnotations: { 'prometheus.io/scrape': 'true', 'prometheus.io/port': '10254' }, - }, - }, - }, - ], - }, { name: 'kube-prometheus-stack', sources: [ @@ -149,6 +134,49 @@ const OPERATORS: OperatorConfig[] = [ }, }, ], + }, + { + // Cilium's CRDs are what a NetworkPolicy-based isolation model is written + // against, so a client generated without them cannot describe that surface + // at all. + name: 'cilium', + sources: [ + { + type: 'helm', + version: '1.19.5', + repo: 'https://helm.cilium.io', + repoName: 'cilium', + chart: 'cilium', + namespace: 'kube-system', + }, + ], + }, + { + name: 'traefik', + sources: [ + { + type: 'helm', + version: '34.4.1', + repo: 'https://traefik.github.io/charts', + repoName: 'traefik', + chart: 'traefik', + namespace: 'traefik', + }, + ], + }, + { + name: 'tekton-pipelines', + sources: [ + { + type: 'urls', + version: 'v1.15.0', + urls: [ + // The GitHub release asset, not the GCS bucket: the bucket's + // `previous/` layout does not carry every version. + 'https://github.com/tektoncd/pipeline/releases/download/v1.15.0/release.yaml', + ], + }, + ], } ]; diff --git a/packages/manifests/src/generated/cert-manager.ts b/packages/manifests/src/generated/cert-manager.ts index a1ad5dd..746a862 100644 --- a/packages/manifests/src/generated/cert-manager.ts +++ b/packages/manifests/src/generated/cert-manager.ts @@ -1,6 +1,6 @@ /** Auto-generated typed resources for operator: cert-manager*/ -import type { KubernetesResource, AdmissionregistrationK8sIoV1MutatingWebhookConfiguration, AdmissionregistrationK8sIoV1ValidatingWebhookConfiguration, ApiextensionsK8sIoV1CustomResourceDefinition, AppsV1Deployment, BatchV1Job, Namespace, RbacAuthorizationK8sIoV1ClusterRole, RbacAuthorizationK8sIoV1ClusterRoleBinding, RbacAuthorizationK8sIoV1Role, RbacAuthorizationK8sIoV1RoleBinding, Service, ServiceAccount } from "@kubernetesjs/ops"; -export const Namespace_CertManager: Namespace = { +import type { KubernetesResource } from "@kubernetesjs/ops"; +export const Namespace_CertManager: KubernetesResource = { apiVersion: "v1", kind: "Namespace", metadata: { @@ -10,7 +10,7 @@ export const Namespace_CertManager: Namespace = { name: "cert-manager" } }; -export const ServiceAccount_CertManagerCainjector: ServiceAccount = { +export const ServiceAccount_CertManagerCainjector: KubernetesResource = { apiVersion: "v1", kind: "ServiceAccount", metadata: { @@ -20,15 +20,15 @@ export const ServiceAccount_CertManagerCainjector: ServiceAccount = { "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "cainjector", - "app.kubernetes.io/version": "v1.17.0", - "helm.sh/chart": "cert-manager-v1.17.0" + "app.kubernetes.io/version": "v1.21.1", + "helm.sh/chart": "cert-manager-v1.21.1" }, name: "cert-manager-cainjector", namespace: "cert-manager" }, automountServiceAccountToken: true }; -export const ServiceAccount_CertManager: ServiceAccount = { +export const ServiceAccount_CertManager: KubernetesResource = { apiVersion: "v1", kind: "ServiceAccount", metadata: { @@ -38,15 +38,15 @@ export const ServiceAccount_CertManager: ServiceAccount = { "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "cert-manager", - "app.kubernetes.io/version": "v1.17.0", - "helm.sh/chart": "cert-manager-v1.17.0" + "app.kubernetes.io/version": "v1.21.1", + "helm.sh/chart": "cert-manager-v1.21.1" }, name: "cert-manager", namespace: "cert-manager" }, automountServiceAccountToken: true }; -export const ServiceAccount_CertManagerWebhook: ServiceAccount = { +export const ServiceAccount_CertManagerWebhook: KubernetesResource = { apiVersion: "v1", kind: "ServiceAccount", metadata: { @@ -56,15 +56,15 @@ export const ServiceAccount_CertManagerWebhook: ServiceAccount = { "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "webhook", - "app.kubernetes.io/version": "v1.17.0", - "helm.sh/chart": "cert-manager-v1.17.0" + "app.kubernetes.io/version": "v1.21.1", + "helm.sh/chart": "cert-manager-v1.21.1" }, name: "cert-manager-webhook", namespace: "cert-manager" }, automountServiceAccountToken: true }; -export const CustomResourceDefinition_CertificaterequestsCertManagerIo: ApiextensionsK8sIoV1CustomResourceDefinition = { +export const CustomResourceDefinition_ChallengesAcmeCertManagerIo: KubernetesResource = { apiVersion: "apiextensions.k8s.io/v1", kind: "CustomResourceDefinition", metadata: { @@ -73,49 +73,37 @@ export const CustomResourceDefinition_CertificaterequestsCertManagerIo: Apiexten }, labels: { app: "cert-manager", + "app.kubernetes.io/component": "crds", "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "cert-manager", - "app.kubernetes.io/version": "v1.17.0", - "helm.sh/chart": "cert-manager-v1.17.0" + "app.kubernetes.io/version": "v1.21.1", + "helm.sh/chart": "cert-manager-v1.21.1" }, - name: "certificaterequests.cert-manager.io" + name: "challenges.acme.cert-manager.io" }, spec: { - group: "cert-manager.io", + group: "acme.cert-manager.io", names: { - categories: ["cert-manager"], - kind: "CertificateRequest", - listKind: "CertificateRequestList", - plural: "certificaterequests", - shortNames: ["cr", "crs"], - singular: "certificaterequest" + categories: ["cert-manager", "cert-manager-acme"], + kind: "Challenge", + listKind: "ChallengeList", + plural: "challenges", + singular: "challenge" }, scope: "Namespaced", versions: [{ additionalPrinterColumns: [{ - jsonPath: ".status.conditions[?(@.type==\"Approved\")].status", - name: "Approved", - type: "string" - }, { - jsonPath: ".status.conditions[?(@.type==\"Denied\")].status", - name: "Denied", - type: "string" - }, { - jsonPath: ".status.conditions[?(@.type==\"Ready\")].status", - name: "Ready", - type: "string" - }, { - jsonPath: ".spec.issuerRef.name", - name: "Issuer", + jsonPath: ".status.state", + name: "State", type: "string" }, { - jsonPath: ".spec.username", - name: "Requester", + jsonPath: ".spec.dnsName", + name: "Domain", type: "string" }, { - jsonPath: ".status.conditions[?(@.type==\"Ready\")].message", - name: "Status", + jsonPath: ".status.reason", + name: "Reason", priority: 1, type: "string" }, { @@ -127,7 +115,7 @@ export const CustomResourceDefinition_CertificaterequestsCertManagerIo: Apiexten name: "v1", schema: { openAPIV3Schema: { - description: "A CertificateRequest is used to request a signed certificate from one of the\nconfigured issuers.\n\nAll fields within the CertificateRequest's `spec` are immutable after creation.\nA CertificateRequest will either succeed or fail, as denoted by its `Ready` status\ncondition and its `status.failureTime` field.\n\nA CertificateRequest is a one-shot resource, meaning it represents a single\npoint in time request for a certificate and cannot be re-used.", + description: "Challenge is a type to represent a Challenge request with an ACME server", properties: { apiVersion: { description: "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", @@ -141,1182 +129,438 @@ export const CustomResourceDefinition_CertificaterequestsCertManagerIo: Apiexten type: "object" }, spec: { - description: "Specification of the desired state of the CertificateRequest resource.\nhttps://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status", properties: { - duration: { - description: "Requested 'duration' (i.e. lifetime) of the Certificate. Note that the\nissuer may choose to ignore the requested duration, just like any other\nrequested attribute.", + authorizationURL: { + description: "The URL to the ACME Authorization resource that this\nchallenge is a part of.", type: "string" }, - extra: { - additionalProperties: { - items: { - type: "string" - }, - type: "array" - }, - description: "Extra contains extra attributes of the user that created the CertificateRequest.\nPopulated by the cert-manager webhook on creation and immutable.", - type: "object" - }, - groups: { - description: "Groups contains group membership of the user that created the CertificateRequest.\nPopulated by the cert-manager webhook on creation and immutable.", - items: { - type: "string" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - }, - isCA: { - description: "Requested basic constraints isCA value. Note that the issuer may choose\nto ignore the requested isCA value, just like any other requested attribute.\n\nNOTE: If the CSR in the `Request` field has a BasicConstraints extension,\nit must have the same isCA value as specified here.\n\nIf true, this will automatically add the `cert sign` usage to the list\nof requested `usages`.", - type: "boolean" + dnsName: { + description: "dnsName is the identifier that this challenge is for, e.g., example.com.\nIf the requested DNSName is a 'wildcard', this field MUST be set to the\nnon-wildcard domain, e.g., for `*.example.com`, it must be `example.com`.", + type: "string" }, issuerRef: { - description: "Reference to the issuer responsible for issuing the certificate.\nIf the issuer is namespace-scoped, it must be in the same namespace\nas the Certificate. If the issuer is cluster-scoped, it can be used\nfrom any namespace.\n\nThe `name` field of the reference must always be specified.", + description: "References a properly configured ACME-type Issuer which should\nbe used to create this Challenge.\nIf the Issuer does not exist, processing will be retried.\nIf the Issuer is not an 'ACME' Issuer, an error will be returned and the\nChallenge will be marked as failed.", properties: { group: { - description: "Group of the resource being referred to.", + description: "Group of the issuer being referred to.\nDefaults to 'cert-manager.io'.", type: "string" }, kind: { - description: "Kind of the resource being referred to.", + description: "Kind of the issuer being referred to.\nDefaults to 'Issuer'.", type: "string" }, name: { - description: "Name of the resource being referred to.", + description: "Name of the issuer being referred to.", type: "string" } }, required: ["name"], type: "object" }, - request: { - description: "The PEM-encoded X.509 certificate signing request to be submitted to the\nissuer for signing.\n\nIf the CSR has a BasicConstraints extension, its isCA attribute must\nmatch the `isCA` value of this CertificateRequest.\nIf the CSR has a KeyUsage extension, its key usages must match the\nkey usages in the `usages` field of this CertificateRequest.\nIf the CSR has a ExtKeyUsage extension, its extended key usages\nmust match the extended key usages in the `usages` field of this\nCertificateRequest.", - format: "byte", - type: "string" - }, - uid: { - description: "UID contains the uid of the user that created the CertificateRequest.\nPopulated by the cert-manager webhook on creation and immutable.", - type: "string" - }, - usages: { - description: "Requested key usages and extended key usages.\n\nNOTE: If the CSR in the `Request` field has uses the KeyUsage or\nExtKeyUsage extension, these extensions must have the same values\nas specified here without any additional values.\n\nIf unset, defaults to `digital signature` and `key encipherment`.", - items: { - description: "KeyUsage specifies valid usage contexts for keys.\nSee:\nhttps://tools.ietf.org/html/rfc5280#section-4.2.1.3\nhttps://tools.ietf.org/html/rfc5280#section-4.2.1.12\n\nValid KeyUsage values are as follows:\n\"signing\",\n\"digital signature\",\n\"content commitment\",\n\"key encipherment\",\n\"key agreement\",\n\"data encipherment\",\n\"cert sign\",\n\"crl sign\",\n\"encipher only\",\n\"decipher only\",\n\"any\",\n\"server auth\",\n\"client auth\",\n\"code signing\",\n\"email protection\",\n\"s/mime\",\n\"ipsec end system\",\n\"ipsec tunnel\",\n\"ipsec user\",\n\"timestamping\",\n\"ocsp signing\",\n\"microsoft sgc\",\n\"netscape sgc\"", - enum: ["signing", "digital signature", "content commitment", "key encipherment", "key agreement", "data encipherment", "cert sign", "crl sign", "encipher only", "decipher only", "any", "server auth", "client auth", "code signing", "email protection", "s/mime", "ipsec end system", "ipsec tunnel", "ipsec user", "timestamping", "ocsp signing", "microsoft sgc", "netscape sgc"], - type: "string" - }, - type: "array" - }, - username: { - description: "Username contains the name of the user that created the CertificateRequest.\nPopulated by the cert-manager webhook on creation and immutable.", - type: "string" - } - }, - required: ["issuerRef", "request"], - type: "object" - }, - status: { - description: "Status of the CertificateRequest.\nThis is set and managed automatically.\nRead-only.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status", - properties: { - ca: { - description: "The PEM encoded X.509 certificate of the signer, also known as the CA\n(Certificate Authority).\nThis is set on a best-effort basis by different issuers.\nIf not set, the CA is assumed to be unknown/not available.", - format: "byte", - type: "string" - }, - certificate: { - description: "The PEM encoded X.509 certificate resulting from the certificate\nsigning request.\nIf not set, the CertificateRequest has either not been completed or has\nfailed. More information on failure can be found by checking the\n`conditions` field.", - format: "byte", - type: "string" - }, - conditions: { - description: "List of status conditions to indicate the status of a CertificateRequest.\nKnown condition types are `Ready`, `InvalidRequest`, `Approved` and `Denied`.", - items: { - description: "CertificateRequestCondition contains condition information for a CertificateRequest.", - properties: { - lastTransitionTime: { - description: "LastTransitionTime is the timestamp corresponding to the last status\nchange of this condition.", - format: "date-time", - type: "string" - }, - message: { - description: "Message is a human readable description of the details of the last\ntransition, complementing reason.", - type: "string" - }, - reason: { - description: "Reason is a brief machine readable explanation for the condition's last\ntransition.", - type: "string" - }, - status: { - description: "Status of the condition, one of (`True`, `False`, `Unknown`).", - enum: ["True", "False", "Unknown"], - type: "string" - }, - type: { - description: "Type of the condition, known values are (`Ready`, `InvalidRequest`,\n`Approved`, `Denied`).", - type: "string" - } - }, - required: ["status", "type"], - type: "object" - }, - type: "array", - "x-kubernetes-list-map-keys": ["type"], - "x-kubernetes-list-type": "map" - }, - failureTime: { - description: "FailureTime stores the time that this CertificateRequest failed. This is\nused to influence garbage collection and back-off.", - format: "date-time", - type: "string" - } - }, - type: "object" - } - }, - type: "object" - } - }, - served: true, - storage: true, - subresources: { - status: {} - } - }] - } -}; -export const CustomResourceDefinition_CertificatesCertManagerIo: ApiextensionsK8sIoV1CustomResourceDefinition = { - apiVersion: "apiextensions.k8s.io/v1", - kind: "CustomResourceDefinition", - metadata: { - annotations: { - "helm.sh/resource-policy": "keep" - }, - labels: { - app: "cert-manager", - "app.kubernetes.io/instance": "cert-manager", - "app.kubernetes.io/managed-by": "Helm", - "app.kubernetes.io/name": "cert-manager", - "app.kubernetes.io/version": "v1.17.0", - "helm.sh/chart": "cert-manager-v1.17.0" - }, - name: "certificates.cert-manager.io" - }, - spec: { - group: "cert-manager.io", - names: { - categories: ["cert-manager"], - kind: "Certificate", - listKind: "CertificateList", - plural: "certificates", - shortNames: ["cert", "certs"], - singular: "certificate" - }, - scope: "Namespaced", - versions: [{ - additionalPrinterColumns: [{ - jsonPath: ".status.conditions[?(@.type==\"Ready\")].status", - name: "Ready", - type: "string" - }, { - jsonPath: ".spec.secretName", - name: "Secret", - type: "string" - }, { - jsonPath: ".spec.issuerRef.name", - name: "Issuer", - priority: 1, - type: "string" - }, { - jsonPath: ".status.conditions[?(@.type==\"Ready\")].message", - name: "Status", - priority: 1, - type: "string" - }, { - description: "CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.", - jsonPath: ".metadata.creationTimestamp", - name: "Age", - type: "date" - }], - name: "v1", - schema: { - openAPIV3Schema: { - description: "A Certificate resource should be created to ensure an up to date and signed\nX.509 certificate is stored in the Kubernetes Secret resource named in `spec.secretName`.\n\nThe stored certificate will be renewed before it expires (as configured by `spec.renewBefore`).", - properties: { - apiVersion: { - description: "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", - type: "string" - }, - kind: { - description: "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", - type: "string" - }, - metadata: { - type: "object" - }, - spec: { - description: "Specification of the desired state of the Certificate resource.\nhttps://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status", - properties: { - additionalOutputFormats: { - description: "Defines extra output formats of the private key and signed certificate chain\nto be written to this Certificate's target Secret.\n\nThis is a Beta Feature enabled by default. It can be disabled with the\n`--feature-gates=AdditionalCertificateOutputFormats=false` option set on both\nthe controller and webhook components.", - items: { - description: "CertificateAdditionalOutputFormat defines an additional output format of a\nCertificate resource. These contain supplementary data formats of the signed\ncertificate chain and paired private key.", - properties: { - type: { - description: "Type is the name of the format type that should be written to the\nCertificate's target Secret.", - enum: ["DER", "CombinedPEM"], - type: "string" - } - }, - required: ["type"], - type: "object" - }, - type: "array" - }, - commonName: { - description: "Requested common name X509 certificate subject attribute.\nMore info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.6\nNOTE: TLS clients will ignore this value when any subject alternative name is\nset (see https://tools.ietf.org/html/rfc6125#section-6.4.4).\n\nShould have a length of 64 characters or fewer to avoid generating invalid CSRs.\nCannot be set if the `literalSubject` field is set.", - type: "string" - }, - dnsNames: { - description: "Requested DNS subject alternative names.", - items: { - type: "string" - }, - type: "array" - }, - duration: { - description: "Requested 'duration' (i.e. lifetime) of the Certificate. Note that the\nissuer may choose to ignore the requested duration, just like any other\nrequested attribute.\n\nIf unset, this defaults to 90 days.\nMinimum accepted duration is 1 hour.\nValue must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration.", + key: { + description: "The ACME challenge key for this challenge\nFor HTTP01 challenges, this is the value that must be responded with to\ncomplete the HTTP01 challenge in the format:\n`.`.\nFor DNS01 challenges, this is the base64 encoded SHA256 sum of the\n`.`\ntext that must be set as the TXT record content.", type: "string" }, - emailAddresses: { - description: "Requested email subject alternative names.", - items: { - type: "string" - }, - type: "array" - }, - encodeUsagesInRequest: { - description: "Whether the KeyUsage and ExtKeyUsage extensions should be set in the encoded CSR.\n\nThis option defaults to true, and should only be disabled if the target\nissuer does not support CSRs with these X509 KeyUsage/ ExtKeyUsage extensions.", - type: "boolean" - }, - ipAddresses: { - description: "Requested IP address subject alternative names.", - items: { - type: "string" - }, - type: "array" - }, - isCA: { - description: "Requested basic constraints isCA value.\nThe isCA value is used to set the `isCA` field on the created CertificateRequest\nresources. Note that the issuer may choose to ignore the requested isCA value, just\nlike any other requested attribute.\n\nIf true, this will automatically add the `cert sign` usage to the list\nof requested `usages`.", - type: "boolean" - }, - issuerRef: { - description: "Reference to the issuer responsible for issuing the certificate.\nIf the issuer is namespace-scoped, it must be in the same namespace\nas the Certificate. If the issuer is cluster-scoped, it can be used\nfrom any namespace.\n\nThe `name` field of the reference must always be specified.", - properties: { - group: { - description: "Group of the resource being referred to.", - type: "string" - }, - kind: { - description: "Kind of the resource being referred to.", - type: "string" - }, - name: { - description: "Name of the resource being referred to.", - type: "string" - } - }, - required: ["name"], - type: "object" - }, - keystores: { - description: "Additional keystore output formats to be stored in the Certificate's Secret.", + solver: { + description: "Contains the domain solving configuration that should be used to\nsolve this challenge resource.", properties: { - jks: { - description: "JKS configures options for storing a JKS keystore in the\n`spec.secretName` Secret resource.", + dns01: { + description: "Configures cert-manager to attempt to complete authorizations by\nperforming the DNS01 challenge flow.", properties: { - alias: { - description: "Alias specifies the alias of the key in the keystore, required by the JKS format.\nIf not provided, the default alias `certificate` will be used.", - type: "string" - }, - create: { - description: "Create enables JKS keystore creation for the Certificate.\nIf true, a file named `keystore.jks` will be created in the target\nSecret resource, encrypted using the password stored in\n`passwordSecretRef` or `password`.\nThe keystore file will be updated immediately.\nIf the issuer provided a CA certificate, a file named `truststore.jks`\nwill also be created in the target Secret resource, encrypted using the\npassword stored in `passwordSecretRef`\ncontaining the issuing Certificate Authority", - type: "boolean" + acmeDNS: { + description: "Use the 'ACME DNS' (https://github.com/joohoi/acme-dns) API to manage\nDNS01 challenge records.", + properties: { + accountSecretRef: { + description: "A reference to a specific 'key' within a Secret resource.\nIn some instances, `key` is a required field.", + properties: { + key: { + description: "The key of the entry in the Secret resource's `data` field to be used.\nSome instances of this field may be defaulted, in others it may be\nrequired.", + type: "string" + }, + name: { + description: "Name of the resource being referred to.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + } + }, + required: ["name"], + type: "object" + }, + host: { + type: "string" + } + }, + required: ["accountSecretRef", "host"], + type: "object" }, - password: { - description: "Password provides a literal password used to encrypt the JKS keystore.\nMutually exclusive with passwordSecretRef.\nOne of password or passwordSecretRef must provide a password with a non-zero length.", - type: "string" + akamai: { + description: "Use the Akamai DNS zone management API to manage DNS01 challenge records.", + properties: { + accessTokenSecretRef: { + description: "A reference to a specific 'key' within a Secret resource.\nIn some instances, `key` is a required field.", + properties: { + key: { + description: "The key of the entry in the Secret resource's `data` field to be used.\nSome instances of this field may be defaulted, in others it may be\nrequired.", + type: "string" + }, + name: { + description: "Name of the resource being referred to.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + } + }, + required: ["name"], + type: "object" + }, + clientSecretSecretRef: { + description: "A reference to a specific 'key' within a Secret resource.\nIn some instances, `key` is a required field.", + properties: { + key: { + description: "The key of the entry in the Secret resource's `data` field to be used.\nSome instances of this field may be defaulted, in others it may be\nrequired.", + type: "string" + }, + name: { + description: "Name of the resource being referred to.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + } + }, + required: ["name"], + type: "object" + }, + clientTokenSecretRef: { + description: "A reference to a specific 'key' within a Secret resource.\nIn some instances, `key` is a required field.", + properties: { + key: { + description: "The key of the entry in the Secret resource's `data` field to be used.\nSome instances of this field may be defaulted, in others it may be\nrequired.", + type: "string" + }, + name: { + description: "Name of the resource being referred to.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + } + }, + required: ["name"], + type: "object" + }, + serviceConsumerDomain: { + type: "string" + } + }, + required: ["accessTokenSecretRef", "clientSecretSecretRef", "clientTokenSecretRef", "serviceConsumerDomain"], + type: "object" }, - passwordSecretRef: { - description: "PasswordSecretRef is a reference to a non-empty key in a Secret resource\ncontaining the password used to encrypt the JKS keystore.\nMutually exclusive with password.\nOne of password or passwordSecretRef must provide a password with a non-zero length.", + azureDNS: { + description: "Use the Microsoft Azure DNS API to manage DNS01 challenge records.", properties: { - key: { - description: "The key of the entry in the Secret resource's `data` field to be used.\nSome instances of this field may be defaulted, in others it may be\nrequired.", + clientID: { + description: "Auth: Azure Service Principal:\nThe ClientID of the Azure Service Principal used to authenticate with Azure DNS.\nIf set, ClientSecret and TenantID must also be set.", type: "string" }, - name: { - description: "Name of the resource being referred to.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + clientSecretSecretRef: { + description: "Auth: Azure Service Principal:\nA reference to a Secret containing the password associated with the Service Principal.\nIf set, ClientID and TenantID must also be set.", + properties: { + key: { + description: "The key of the entry in the Secret resource's `data` field to be used.\nSome instances of this field may be defaulted, in others it may be\nrequired.", + type: "string" + }, + name: { + description: "Name of the resource being referred to.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + } + }, + required: ["name"], + type: "object" + }, + environment: { + description: "name of the Azure environment (default AzurePublicCloud)", + enum: ["AzurePublicCloud", "AzureChinaCloud", "AzureGermanCloud", "AzureUSGovernmentCloud"], + type: "string" + }, + hostedZoneName: { + description: "name of the DNS zone that should be used", + type: "string" + }, + managedIdentity: { + description: "Auth: Azure Workload Identity or Azure Managed Service Identity:\nSettings to enable Azure Workload Identity or Azure Managed Service Identity\nIf set, ClientID, ClientSecret and TenantID must not be set.", + properties: { + clientID: { + description: "client ID of the managed identity, cannot be used at the same time as resourceID", + type: "string" + }, + resourceID: { + description: "resource ID of the managed identity, cannot be used at the same time as clientID\nCannot be used for Azure Managed Service Identity", + type: "string" + }, + tenantID: { + description: "tenant ID of the managed identity, cannot be used at the same time as resourceID", + type: "string" + } + }, + type: "object" + }, + resourceGroupName: { + description: "resource group the DNS zone is located in", + type: "string" + }, + subscriptionID: { + description: "ID of the Azure subscription", + type: "string" + }, + tenantID: { + description: "Auth: Azure Service Principal:\nThe TenantID of the Azure Service Principal used to authenticate with Azure DNS.\nIf set, ClientID and ClientSecret must also be set.", + type: "string" + }, + zoneType: { + description: "ZoneType determines which type of Azure DNS zone to use.\n\nValid values are:\n - AzurePublicZone (default): Use a public Azure DNS zone.\n - AzurePrivateZone: Use an Azure Private DNS zone.\n\nIf not specified, AzurePublicZone is used.\n\nSupport for Azure Private DNS zones is currently\nexperimental and may change in future releases.", + enum: ["AzurePublicZone", "AzurePrivateZone"], type: "string" } }, - required: ["name"], + required: ["resourceGroupName", "subscriptionID"], type: "object" - } - }, - required: ["create"], - type: "object" - }, - pkcs12: { - description: "PKCS12 configures options for storing a PKCS12 keystore in the\n`spec.secretName` Secret resource.", - properties: { - create: { - description: "Create enables PKCS12 keystore creation for the Certificate.\nIf true, a file named `keystore.p12` will be created in the target\nSecret resource, encrypted using the password stored in\n`passwordSecretRef` or in `password`.\nThe keystore file will be updated immediately.\nIf the issuer provided a CA certificate, a file named `truststore.p12` will\nalso be created in the target Secret resource, encrypted using the\npassword stored in `passwordSecretRef` containing the issuing Certificate\nAuthority", - type: "boolean" - }, - password: { - description: "Password provides a literal password used to encrypt the PKCS#12 keystore.\nMutually exclusive with passwordSecretRef.\nOne of password or passwordSecretRef must provide a password with a non-zero length.", - type: "string" }, - passwordSecretRef: { - description: "PasswordSecretRef is a reference to a non-empty key in a Secret resource\ncontaining the password used to encrypt the PKCS#12 keystore.\nMutually exclusive with password.\nOne of password or passwordSecretRef must provide a password with a non-zero length.", + cloudDNS: { + description: "Use the Google Cloud DNS API to manage DNS01 challenge records.", properties: { - key: { - description: "The key of the entry in the Secret resource's `data` field to be used.\nSome instances of this field may be defaulted, in others it may be\nrequired.", + hostedZoneName: { + description: "HostedZoneName is an optional field that tells cert-manager in which\nCloud DNS zone the challenge record has to be created.\nIf left empty cert-manager will automatically choose a zone.", type: "string" }, - name: { - description: "Name of the resource being referred to.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + project: { type: "string" + }, + serviceAccountSecretRef: { + description: "A reference to a specific 'key' within a Secret resource.\nIn some instances, `key` is a required field.", + properties: { + key: { + description: "The key of the entry in the Secret resource's `data` field to be used.\nSome instances of this field may be defaulted, in others it may be\nrequired.", + type: "string" + }, + name: { + description: "Name of the resource being referred to.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + } + }, + required: ["name"], + type: "object" } }, - required: ["name"], + required: ["project"], type: "object" }, - profile: { - description: "Profile specifies the key and certificate encryption algorithms and the HMAC algorithm\nused to create the PKCS12 keystore. Default value is `LegacyRC2` for backward compatibility.\n\nIf provided, allowed values are:\n`LegacyRC2`: Deprecated. Not supported by default in OpenSSL 3 or Java 20.\n`LegacyDES`: Less secure algorithm. Use this option for maximal compatibility.\n`Modern2023`: Secure algorithm. Use this option in case you have to always use secure algorithms\n(eg. because of company policy). Please note that the security of the algorithm is not that important\nin reality, because the unencrypted certificate and private key are also stored in the Secret.", - enum: ["LegacyRC2", "LegacyDES", "Modern2023"], - type: "string" - } - }, - required: ["create"], - type: "object" - } - }, - type: "object" - }, - literalSubject: { - description: "Requested X.509 certificate subject, represented using the LDAP \"String\nRepresentation of a Distinguished Name\" [1].\nImportant: the LDAP string format also specifies the order of the attributes\nin the subject, this is important when issuing certs for LDAP authentication.\nExample: `CN=foo,DC=corp,DC=example,DC=com`\nMore info [1]: https://datatracker.ietf.org/doc/html/rfc4514\nMore info: https://github.com/cert-manager/cert-manager/issues/3203\nMore info: https://github.com/cert-manager/cert-manager/issues/4424\n\nCannot be set if the `subject` or `commonName` field is set.", - type: "string" - }, - nameConstraints: { - description: "x.509 certificate NameConstraint extension which MUST NOT be used in a non-CA certificate.\nMore Info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.10\n\nThis is an Alpha Feature and is only enabled with the\n`--feature-gates=NameConstraints=true` option set on both\nthe controller and webhook components.", - properties: { - critical: { - description: "if true then the name constraints are marked critical.", - type: "boolean" - }, - excluded: { - description: "Excluded contains the constraints which must be disallowed. Any name matching a\nrestriction in the excluded field is invalid regardless\nof information appearing in the permitted", - properties: { - dnsDomains: { - description: "DNSDomains is a list of DNS domains that are permitted or excluded.", - items: { - type: "string" - }, - type: "array" - }, - emailAddresses: { - description: "EmailAddresses is a list of Email Addresses that are permitted or excluded.", - items: { - type: "string" + cloudflare: { + description: "Use the Cloudflare API to manage DNS01 challenge records.", + properties: { + apiKeySecretRef: { + description: "API key to use to authenticate with Cloudflare.\nNote: using an API token to authenticate is now the recommended method\nas it allows greater control of permissions.", + properties: { + key: { + description: "The key of the entry in the Secret resource's `data` field to be used.\nSome instances of this field may be defaulted, in others it may be\nrequired.", + type: "string" + }, + name: { + description: "Name of the resource being referred to.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + } + }, + required: ["name"], + type: "object" + }, + apiTokenSecretRef: { + description: "API token used to authenticate with Cloudflare.", + properties: { + key: { + description: "The key of the entry in the Secret resource's `data` field to be used.\nSome instances of this field may be defaulted, in others it may be\nrequired.", + type: "string" + }, + name: { + description: "Name of the resource being referred to.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + } + }, + required: ["name"], + type: "object" + }, + email: { + description: "Email of the account, only required when using API key based authentication.", + type: "string" + } }, - type: "array" + type: "object" }, - ipRanges: { - description: "IPRanges is a list of IP Ranges that are permitted or excluded.\nThis should be a valid CIDR notation.", - items: { - type: "string" - }, - type: "array" + cnameStrategy: { + description: "CNAMEStrategy configures how the DNS01 provider should handle CNAME\nrecords when found in DNS zones.", + enum: ["None", "Follow"], + type: "string" }, - uriDomains: { - description: "URIDomains is a list of URI domains that are permitted or excluded.", - items: { - type: "string" - }, - type: "array" - } - }, - type: "object" - }, - permitted: { - description: "Permitted contains the constraints in which the names must be located.", - properties: { - dnsDomains: { - description: "DNSDomains is a list of DNS domains that are permitted or excluded.", - items: { - type: "string" + digitalocean: { + description: "Use the DigitalOcean DNS API to manage DNS01 challenge records.", + properties: { + tokenSecretRef: { + description: "A reference to a specific 'key' within a Secret resource.\nIn some instances, `key` is a required field.", + properties: { + key: { + description: "The key of the entry in the Secret resource's `data` field to be used.\nSome instances of this field may be defaulted, in others it may be\nrequired.", + type: "string" + }, + name: { + description: "Name of the resource being referred to.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + } + }, + required: ["name"], + type: "object" + } }, - type: "array" + required: ["tokenSecretRef"], + type: "object" }, - emailAddresses: { - description: "EmailAddresses is a list of Email Addresses that are permitted or excluded.", - items: { - type: "string" + rfc2136: { + description: "Use RFC2136 (\"Dynamic Updates in the Domain Name System\") (https://datatracker.ietf.org/doc/rfc2136/)\nto manage DNS01 challenge records.", + properties: { + nameserver: { + description: "The IP address or hostname of an authoritative DNS server supporting\nRFC2136 in the form host:port. If the host is an IPv6 address it must be\nenclosed in square brackets (e.g [2001:db8::1]); port is optional.\nThis field is required.", + type: "string" + }, + protocol: { + description: "Protocol to use for dynamic DNS update queries. Valid values are (case-sensitive) ``TCP`` and ``UDP``; ``UDP`` (default).", + enum: ["TCP", "UDP"], + type: "string" + }, + tsigAlgorithm: { + description: "The TSIG Algorithm configured in the DNS supporting RFC2136. Used only\nwhen ``tsigSecretSecretRef`` and ``tsigKeyName`` are defined.\nSupported values are (case-insensitive): ``HMACMD5`` (default),\n``HMACSHA1``, ``HMACSHA256`` or ``HMACSHA512``.", + type: "string" + }, + tsigKeyName: { + description: "The TSIG Key name configured in the DNS.\nIf ``tsigSecretSecretRef`` is defined, this field is required.", + type: "string" + }, + tsigSecretSecretRef: { + description: "The name of the secret containing the TSIG value.\nIf ``tsigKeyName`` is defined, this field is required.", + properties: { + key: { + description: "The key of the entry in the Secret resource's `data` field to be used.\nSome instances of this field may be defaulted, in others it may be\nrequired.", + type: "string" + }, + name: { + description: "Name of the resource being referred to.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + } + }, + required: ["name"], + type: "object" + } }, - type: "array" + required: ["nameserver"], + type: "object" }, - ipRanges: { - description: "IPRanges is a list of IP Ranges that are permitted or excluded.\nThis should be a valid CIDR notation.", - items: { - type: "string" + route53: { + description: "Use the AWS Route53 API to manage DNS01 challenge records.", + properties: { + accessKeyID: { + description: "The AccessKeyID is used for authentication.\nCannot be set when SecretAccessKeyID is set.\nIf neither the Access Key nor Key ID are set, we fall back to using env\nvars, shared credentials file, or AWS Instance metadata,\nsee: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials", + type: "string" + }, + accessKeyIDSecretRef: { + description: "The SecretAccessKey is used for authentication. If set, pull the AWS\naccess key ID from a key within a Kubernetes Secret.\nCannot be set when AccessKeyID is set.\nIf neither the Access Key nor Key ID are set, we fall back to using env\nvars, shared credentials file, or AWS Instance metadata,\nsee: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials", + properties: { + key: { + description: "The key of the entry in the Secret resource's `data` field to be used.\nSome instances of this field may be defaulted, in others it may be\nrequired.", + type: "string" + }, + name: { + description: "Name of the resource being referred to.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + } + }, + required: ["name"], + type: "object" + }, + auth: { + description: "Auth configures how cert-manager authenticates.", + properties: { + kubernetes: { + description: "Kubernetes authenticates with Route53 using AssumeRoleWithWebIdentity\nby passing a bound ServiceAccount token.", + properties: { + serviceAccountRef: { + description: "A reference to a service account that will be used to request a bound\ntoken (also known as \"projected token\"). To use this field, you must\nconfigure an RBAC rule to let cert-manager request a token.", + properties: { + audiences: { + description: "TokenAudiences is an optional list of audiences to include in the\ntoken passed to AWS. The default token consisting of the issuer's namespace\nand name is always included.\nIf unset the audience defaults to `sts.amazonaws.com`.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + name: { + description: "Name of the ServiceAccount used to request a token.", + type: "string" + } + }, + required: ["name"], + type: "object" + } + }, + required: ["serviceAccountRef"], + type: "object" + } + }, + required: ["kubernetes"], + type: "object" + }, + hostedZoneID: { + description: "If set, the provider will manage only this zone in Route53 and will not do a lookup using the route53:ListHostedZonesByName api call.", + type: "string" + }, + region: { + description: "Override the AWS region.\n\nRoute53 is a global service and does not have regional endpoints but the\nregion specified here (or via environment variables) is used as a hint to\nhelp compute the correct AWS credential scope and partition when it\nconnects to Route53. See:\n- [Amazon Route 53 endpoints and quotas](https://docs.aws.amazon.com/general/latest/gr/r53.html)\n- [Global services](https://docs.aws.amazon.com/whitepapers/latest/aws-fault-isolation-boundaries/global-services.html)\n\nIf you omit this region field, cert-manager will use the region from\nAWS_REGION and AWS_DEFAULT_REGION environment variables, if they are set\nin the cert-manager controller Pod.\n\nThe `region` field is not needed if you use [IAM Roles for Service Accounts (IRSA)](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html).\nInstead an AWS_REGION environment variable is added to the cert-manager controller Pod by:\n[Amazon EKS Pod Identity Webhook](https://github.com/aws/amazon-eks-pod-identity-webhook).\nIn this case this `region` field value is ignored.\n\nThe `region` field is not needed if you use [EKS Pod Identities](https://docs.aws.amazon.com/eks/latest/userguide/pod-identities.html).\nInstead an AWS_REGION environment variable is added to the cert-manager controller Pod by:\n[Amazon EKS Pod Identity Agent](https://github.com/aws/eks-pod-identity-agent),\nIn this case this `region` field value is ignored.", + type: "string" + }, + role: { + description: "Role is a Role ARN which the Route53 provider will assume using either the explicit credentials AccessKeyID/SecretAccessKey\nor the inferred credentials from environment variables, shared credentials file or AWS Instance metadata", + type: "string" + }, + secretAccessKeySecretRef: { + description: "The SecretAccessKey is used for authentication.\nIf neither the Access Key nor Key ID are set, we fall back to using env\nvars, shared credentials file, or AWS Instance metadata,\nsee: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials", + properties: { + key: { + description: "The key of the entry in the Secret resource's `data` field to be used.\nSome instances of this field may be defaulted, in others it may be\nrequired.", + type: "string" + }, + name: { + description: "Name of the resource being referred to.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + } + }, + required: ["name"], + type: "object" + } }, - type: "array" + type: "object" }, - uriDomains: { - description: "URIDomains is a list of URI domains that are permitted or excluded.", - items: { - type: "string" + webhook: { + description: "Configure an external webhook based DNS01 challenge solver to manage\nDNS01 challenge records.", + properties: { + config: { + description: "Additional configuration that should be passed to the webhook apiserver\nwhen challenges are processed.\nThis can contain arbitrary JSON data.\nSecret values should not be specified in this stanza.\nIf secret values are needed (e.g., credentials for a DNS service), you\nshould use a SecretKeySelector to reference a Secret resource.\nFor details on the schema of this field, consult the webhook provider\nimplementation's documentation.", + "x-kubernetes-preserve-unknown-fields": true + }, + groupName: { + description: "The API group name that should be used when POSTing ChallengePayload\nresources to the webhook apiserver.\nThis should be the same as the GroupName specified in the webhook\nprovider implementation.", + type: "string" + }, + solverName: { + description: "The name of the solver to use, as defined in the webhook provider\nimplementation.\nThis will typically be the name of the provider, e.g., 'cloudflare'.", + type: "string" + } }, - type: "array" - } - }, - type: "object" - } - }, - type: "object" - }, - otherNames: { - description: "`otherNames` is an escape hatch for SAN that allows any type. We currently restrict the support to string like otherNames, cf RFC 5280 p 37\nAny UTF8 String valued otherName can be passed with by setting the keys oid: x.x.x.x and UTF8Value: somevalue for `otherName`.\nMost commonly this would be UPN set with oid: 1.3.6.1.4.1.311.20.2.3\nYou should ensure that any OID passed is valid for the UTF8String type as we do not explicitly validate this.", - items: { - properties: { - oid: { - description: "OID is the object identifier for the otherName SAN.\nThe object identifier must be expressed as a dotted string, for\nexample, \"1.2.840.113556.1.4.221\".", - type: "string" - }, - utf8Value: { - description: "utf8Value is the string value of the otherName SAN.\nThe utf8Value accepts any valid UTF8 string to set as value for the otherName SAN.", - type: "string" - } - }, - type: "object" - }, - type: "array" - }, - privateKey: { - description: "Private key options. These include the key algorithm and size, the used\nencoding and the rotation policy.", - properties: { - algorithm: { - description: "Algorithm is the private key algorithm of the corresponding private key\nfor this certificate.\n\nIf provided, allowed values are either `RSA`, `ECDSA` or `Ed25519`.\nIf `algorithm` is specified and `size` is not provided,\nkey size of 2048 will be used for `RSA` key algorithm and\nkey size of 256 will be used for `ECDSA` key algorithm.\nkey size is ignored when using the `Ed25519` key algorithm.", - enum: ["RSA", "ECDSA", "Ed25519"], - type: "string" - }, - encoding: { - description: "The private key cryptography standards (PKCS) encoding for this\ncertificate's private key to be encoded in.\n\nIf provided, allowed values are `PKCS1` and `PKCS8` standing for PKCS#1\nand PKCS#8, respectively.\nDefaults to `PKCS1` if not specified.", - enum: ["PKCS1", "PKCS8"], - type: "string" - }, - rotationPolicy: { - description: "RotationPolicy controls how private keys should be regenerated when a\nre-issuance is being processed.\n\nIf set to `Never`, a private key will only be generated if one does not\nalready exist in the target `spec.secretName`. If one does exist but it\ndoes not have the correct algorithm or size, a warning will be raised\nto await user intervention.\nIf set to `Always`, a private key matching the specified requirements\nwill be generated whenever a re-issuance occurs.\nDefault is `Never` for backward compatibility.", - enum: ["Never", "Always"], - type: "string" - }, - size: { - description: "Size is the key bit size of the corresponding private key for this certificate.\n\nIf `algorithm` is set to `RSA`, valid values are `2048`, `4096` or `8192`,\nand will default to `2048` if not specified.\nIf `algorithm` is set to `ECDSA`, valid values are `256`, `384` or `521`,\nand will default to `256` if not specified.\nIf `algorithm` is set to `Ed25519`, Size is ignored.\nNo other values are allowed.", - type: "integer" - } - }, - type: "object" - }, - renewBefore: { - description: "How long before the currently issued certificate's expiry cert-manager should\nrenew the certificate. For example, if a certificate is valid for 60 minutes,\nand `renewBefore=10m`, cert-manager will begin to attempt to renew the certificate\n50 minutes after it was issued (i.e. when there are 10 minutes remaining until\nthe certificate is no longer valid).\n\nNOTE: The actual lifetime of the issued certificate is used to determine the\nrenewal time. If an issuer returns a certificate with a different lifetime than\nthe one requested, cert-manager will use the lifetime of the issued certificate.\n\nIf unset, this defaults to 1/3 of the issued certificate's lifetime.\nMinimum accepted value is 5 minutes.\nValue must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration.\nCannot be set if the `renewBeforePercentage` field is set.", - type: "string" - }, - renewBeforePercentage: { - description: "`renewBeforePercentage` is like `renewBefore`, except it is a relative percentage\nrather than an absolute duration. For example, if a certificate is valid for 60\nminutes, and `renewBeforePercentage=25`, cert-manager will begin to attempt to\nrenew the certificate 45 minutes after it was issued (i.e. when there are 15\nminutes (25%) remaining until the certificate is no longer valid).\n\nNOTE: The actual lifetime of the issued certificate is used to determine the\nrenewal time. If an issuer returns a certificate with a different lifetime than\nthe one requested, cert-manager will use the lifetime of the issued certificate.\n\nValue must be an integer in the range (0,100). The minimum effective\n`renewBefore` derived from the `renewBeforePercentage` and `duration` fields is 5\nminutes.\nCannot be set if the `renewBefore` field is set.", - format: "int32", - type: "integer" - }, - revisionHistoryLimit: { - description: "The maximum number of CertificateRequest revisions that are maintained in\nthe Certificate's history. Each revision represents a single `CertificateRequest`\ncreated by this Certificate, either when it was created, renewed, or Spec\nwas changed. Revisions will be removed by oldest first if the number of\nrevisions exceeds this number.\n\nIf set, revisionHistoryLimit must be a value of `1` or greater.\nIf unset (`nil`), revisions will not be garbage collected.\nDefault value is `nil`.", - format: "int32", - type: "integer" - }, - secretName: { - description: "Name of the Secret resource that will be automatically created and\nmanaged by this Certificate resource. It will be populated with a\nprivate key and certificate, signed by the denoted issuer. The Secret\nresource lives in the same namespace as the Certificate resource.", - type: "string" - }, - secretTemplate: { - description: "Defines annotations and labels to be copied to the Certificate's Secret.\nLabels and annotations on the Secret will be changed as they appear on the\nSecretTemplate when added or removed. SecretTemplate annotations are added\nin conjunction with, and cannot overwrite, the base set of annotations\ncert-manager sets on the Certificate's Secret.", - properties: { - annotations: { - additionalProperties: { - type: "string" - }, - description: "Annotations is a key value map to be copied to the target Kubernetes Secret.", - type: "object" - }, - labels: { - additionalProperties: { - type: "string" - }, - description: "Labels is a key value map to be copied to the target Kubernetes Secret.", - type: "object" - } - }, - type: "object" - }, - subject: { - description: "Requested set of X509 certificate subject attributes.\nMore info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.6\n\nThe common name attribute is specified separately in the `commonName` field.\nCannot be set if the `literalSubject` field is set.", - properties: { - countries: { - description: "Countries to be used on the Certificate.", - items: { - type: "string" - }, - type: "array" - }, - localities: { - description: "Cities to be used on the Certificate.", - items: { - type: "string" - }, - type: "array" - }, - organizationalUnits: { - description: "Organizational Units to be used on the Certificate.", - items: { - type: "string" - }, - type: "array" - }, - organizations: { - description: "Organizations to be used on the Certificate.", - items: { - type: "string" - }, - type: "array" - }, - postalCodes: { - description: "Postal codes to be used on the Certificate.", - items: { - type: "string" - }, - type: "array" - }, - provinces: { - description: "State/Provinces to be used on the Certificate.", - items: { - type: "string" - }, - type: "array" - }, - serialNumber: { - description: "Serial number to be used on the Certificate.", - type: "string" - }, - streetAddresses: { - description: "Street addresses to be used on the Certificate.", - items: { - type: "string" - }, - type: "array" - } - }, - type: "object" - }, - uris: { - description: "Requested URI subject alternative names.", - items: { - type: "string" - }, - type: "array" - }, - usages: { - description: "Requested key usages and extended key usages.\nThese usages are used to set the `usages` field on the created CertificateRequest\nresources. If `encodeUsagesInRequest` is unset or set to `true`, the usages\nwill additionally be encoded in the `request` field which contains the CSR blob.\n\nIf unset, defaults to `digital signature` and `key encipherment`.", - items: { - description: "KeyUsage specifies valid usage contexts for keys.\nSee:\nhttps://tools.ietf.org/html/rfc5280#section-4.2.1.3\nhttps://tools.ietf.org/html/rfc5280#section-4.2.1.12\n\nValid KeyUsage values are as follows:\n\"signing\",\n\"digital signature\",\n\"content commitment\",\n\"key encipherment\",\n\"key agreement\",\n\"data encipherment\",\n\"cert sign\",\n\"crl sign\",\n\"encipher only\",\n\"decipher only\",\n\"any\",\n\"server auth\",\n\"client auth\",\n\"code signing\",\n\"email protection\",\n\"s/mime\",\n\"ipsec end system\",\n\"ipsec tunnel\",\n\"ipsec user\",\n\"timestamping\",\n\"ocsp signing\",\n\"microsoft sgc\",\n\"netscape sgc\"", - enum: ["signing", "digital signature", "content commitment", "key encipherment", "key agreement", "data encipherment", "cert sign", "crl sign", "encipher only", "decipher only", "any", "server auth", "client auth", "code signing", "email protection", "s/mime", "ipsec end system", "ipsec tunnel", "ipsec user", "timestamping", "ocsp signing", "microsoft sgc", "netscape sgc"], - type: "string" - }, - type: "array" - } - }, - required: ["issuerRef", "secretName"], - type: "object" - }, - status: { - description: "Status of the Certificate.\nThis is set and managed automatically.\nRead-only.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status", - properties: { - conditions: { - description: "List of status conditions to indicate the status of certificates.\nKnown condition types are `Ready` and `Issuing`.", - items: { - description: "CertificateCondition contains condition information for a Certificate.", - properties: { - lastTransitionTime: { - description: "LastTransitionTime is the timestamp corresponding to the last status\nchange of this condition.", - format: "date-time", - type: "string" - }, - message: { - description: "Message is a human readable description of the details of the last\ntransition, complementing reason.", - type: "string" - }, - observedGeneration: { - description: "If set, this represents the .metadata.generation that the condition was\nset based upon.\nFor instance, if .metadata.generation is currently 12, but the\n.status.condition[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the Certificate.", - format: "int64", - type: "integer" - }, - reason: { - description: "Reason is a brief machine readable explanation for the condition's last\ntransition.", - type: "string" - }, - status: { - description: "Status of the condition, one of (`True`, `False`, `Unknown`).", - enum: ["True", "False", "Unknown"], - type: "string" - }, - type: { - description: "Type of the condition, known values are (`Ready`, `Issuing`).", - type: "string" - } - }, - required: ["status", "type"], - type: "object" - }, - type: "array", - "x-kubernetes-list-map-keys": ["type"], - "x-kubernetes-list-type": "map" - }, - failedIssuanceAttempts: { - description: "The number of continuous failed issuance attempts up till now. This\nfield gets removed (if set) on a successful issuance and gets set to\n1 if unset and an issuance has failed. If an issuance has failed, the\ndelay till the next issuance will be calculated using formula\ntime.Hour * 2 ^ (failedIssuanceAttempts - 1).", - type: "integer" - }, - lastFailureTime: { - description: "LastFailureTime is set only if the latest issuance for this\nCertificate failed and contains the time of the failure. If an\nissuance has failed, the delay till the next issuance will be\ncalculated using formula time.Hour * 2 ^ (failedIssuanceAttempts -\n1). If the latest issuance has succeeded this field will be unset.", - format: "date-time", - type: "string" - }, - nextPrivateKeySecretName: { - description: "The name of the Secret resource containing the private key to be used\nfor the next certificate iteration.\nThe keymanager controller will automatically set this field if the\n`Issuing` condition is set to `True`.\nIt will automatically unset this field when the Issuing condition is\nnot set or False.", - type: "string" - }, - notAfter: { - description: "The expiration time of the certificate stored in the secret named\nby this resource in `spec.secretName`.", - format: "date-time", - type: "string" - }, - notBefore: { - description: "The time after which the certificate stored in the secret named\nby this resource in `spec.secretName` is valid.", - format: "date-time", - type: "string" - }, - renewalTime: { - description: "RenewalTime is the time at which the certificate will be next\nrenewed.\nIf not set, no upcoming renewal is scheduled.", - format: "date-time", - type: "string" - }, - revision: { - description: "The current 'revision' of the certificate as issued.\n\nWhen a CertificateRequest resource is created, it will have the\n`cert-manager.io/certificate-revision` set to one greater than the\ncurrent value of this field.\n\nUpon issuance, this field will be set to the value of the annotation\non the CertificateRequest resource used to issue the certificate.\n\nPersisting the value on the CertificateRequest resource allows the\ncertificates controller to know whether a request is part of an old\nissuance or if it is part of the ongoing revision's issuance by\nchecking if the revision value in the annotation is greater than this\nfield.", - type: "integer" - } - }, - type: "object" - } - }, - type: "object" - } - }, - served: true, - storage: true, - subresources: { - status: {} - } - }] - } -}; -export const CustomResourceDefinition_ChallengesAcmeCertManagerIo: ApiextensionsK8sIoV1CustomResourceDefinition = { - apiVersion: "apiextensions.k8s.io/v1", - kind: "CustomResourceDefinition", - metadata: { - annotations: { - "helm.sh/resource-policy": "keep" - }, - labels: { - app: "cert-manager", - "app.kubernetes.io/instance": "cert-manager", - "app.kubernetes.io/managed-by": "Helm", - "app.kubernetes.io/name": "cert-manager", - "app.kubernetes.io/version": "v1.17.0", - "helm.sh/chart": "cert-manager-v1.17.0" - }, - name: "challenges.acme.cert-manager.io" - }, - spec: { - group: "acme.cert-manager.io", - names: { - categories: ["cert-manager", "cert-manager-acme"], - kind: "Challenge", - listKind: "ChallengeList", - plural: "challenges", - singular: "challenge" - }, - scope: "Namespaced", - versions: [{ - additionalPrinterColumns: [{ - jsonPath: ".status.state", - name: "State", - type: "string" - }, { - jsonPath: ".spec.dnsName", - name: "Domain", - type: "string" - }, { - jsonPath: ".status.reason", - name: "Reason", - priority: 1, - type: "string" - }, { - description: "CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.", - jsonPath: ".metadata.creationTimestamp", - name: "Age", - type: "date" - }], - name: "v1", - schema: { - openAPIV3Schema: { - description: "Challenge is a type to represent a Challenge request with an ACME server", - properties: { - apiVersion: { - description: "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", - type: "string" - }, - kind: { - description: "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", - type: "string" - }, - metadata: { - type: "object" - }, - spec: { - properties: { - authorizationURL: { - description: "The URL to the ACME Authorization resource that this\nchallenge is a part of.", - type: "string" - }, - dnsName: { - description: "dnsName is the identifier that this challenge is for, e.g. example.com.\nIf the requested DNSName is a 'wildcard', this field MUST be set to the\nnon-wildcard domain, e.g. for `*.example.com`, it must be `example.com`.", - type: "string" - }, - issuerRef: { - description: "References a properly configured ACME-type Issuer which should\nbe used to create this Challenge.\nIf the Issuer does not exist, processing will be retried.\nIf the Issuer is not an 'ACME' Issuer, an error will be returned and the\nChallenge will be marked as failed.", - properties: { - group: { - description: "Group of the resource being referred to.", - type: "string" - }, - kind: { - description: "Kind of the resource being referred to.", - type: "string" - }, - name: { - description: "Name of the resource being referred to.", - type: "string" - } - }, - required: ["name"], - type: "object" - }, - key: { - description: "The ACME challenge key for this challenge\nFor HTTP01 challenges, this is the value that must be responded with to\ncomplete the HTTP01 challenge in the format:\n`.`.\nFor DNS01 challenges, this is the base64 encoded SHA256 sum of the\n`.`\ntext that must be set as the TXT record content.", - type: "string" - }, - solver: { - description: "Contains the domain solving configuration that should be used to\nsolve this challenge resource.", - properties: { - dns01: { - description: "Configures cert-manager to attempt to complete authorizations by\nperforming the DNS01 challenge flow.", - properties: { - acmeDNS: { - description: "Use the 'ACME DNS' (https://github.com/joohoi/acme-dns) API to manage\nDNS01 challenge records.", - properties: { - accountSecretRef: { - description: "A reference to a specific 'key' within a Secret resource.\nIn some instances, `key` is a required field.", - properties: { - key: { - description: "The key of the entry in the Secret resource's `data` field to be used.\nSome instances of this field may be defaulted, in others it may be\nrequired.", - type: "string" - }, - name: { - description: "Name of the resource being referred to.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - type: "string" - } - }, - required: ["name"], - type: "object" - }, - host: { - type: "string" - } - }, - required: ["accountSecretRef", "host"], - type: "object" - }, - akamai: { - description: "Use the Akamai DNS zone management API to manage DNS01 challenge records.", - properties: { - accessTokenSecretRef: { - description: "A reference to a specific 'key' within a Secret resource.\nIn some instances, `key` is a required field.", - properties: { - key: { - description: "The key of the entry in the Secret resource's `data` field to be used.\nSome instances of this field may be defaulted, in others it may be\nrequired.", - type: "string" - }, - name: { - description: "Name of the resource being referred to.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - type: "string" - } - }, - required: ["name"], - type: "object" - }, - clientSecretSecretRef: { - description: "A reference to a specific 'key' within a Secret resource.\nIn some instances, `key` is a required field.", - properties: { - key: { - description: "The key of the entry in the Secret resource's `data` field to be used.\nSome instances of this field may be defaulted, in others it may be\nrequired.", - type: "string" - }, - name: { - description: "Name of the resource being referred to.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - type: "string" - } - }, - required: ["name"], - type: "object" - }, - clientTokenSecretRef: { - description: "A reference to a specific 'key' within a Secret resource.\nIn some instances, `key` is a required field.", - properties: { - key: { - description: "The key of the entry in the Secret resource's `data` field to be used.\nSome instances of this field may be defaulted, in others it may be\nrequired.", - type: "string" - }, - name: { - description: "Name of the resource being referred to.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - type: "string" - } - }, - required: ["name"], - type: "object" - }, - serviceConsumerDomain: { - type: "string" - } - }, - required: ["accessTokenSecretRef", "clientSecretSecretRef", "clientTokenSecretRef", "serviceConsumerDomain"], - type: "object" - }, - azureDNS: { - description: "Use the Microsoft Azure DNS API to manage DNS01 challenge records.", - properties: { - clientID: { - description: "Auth: Azure Service Principal:\nThe ClientID of the Azure Service Principal used to authenticate with Azure DNS.\nIf set, ClientSecret and TenantID must also be set.", - type: "string" - }, - clientSecretSecretRef: { - description: "Auth: Azure Service Principal:\nA reference to a Secret containing the password associated with the Service Principal.\nIf set, ClientID and TenantID must also be set.", - properties: { - key: { - description: "The key of the entry in the Secret resource's `data` field to be used.\nSome instances of this field may be defaulted, in others it may be\nrequired.", - type: "string" - }, - name: { - description: "Name of the resource being referred to.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - type: "string" - } - }, - required: ["name"], - type: "object" - }, - environment: { - description: "name of the Azure environment (default AzurePublicCloud)", - enum: ["AzurePublicCloud", "AzureChinaCloud", "AzureGermanCloud", "AzureUSGovernmentCloud"], - type: "string" - }, - hostedZoneName: { - description: "name of the DNS zone that should be used", - type: "string" - }, - managedIdentity: { - description: "Auth: Azure Workload Identity or Azure Managed Service Identity:\nSettings to enable Azure Workload Identity or Azure Managed Service Identity\nIf set, ClientID, ClientSecret and TenantID must not be set.", - properties: { - clientID: { - description: "client ID of the managed identity, can not be used at the same time as resourceID", - type: "string" - }, - resourceID: { - description: "resource ID of the managed identity, can not be used at the same time as clientID\nCannot be used for Azure Managed Service Identity", - type: "string" - }, - tenantID: { - description: "tenant ID of the managed identity, can not be used at the same time as resourceID", - type: "string" - } - }, - type: "object" - }, - resourceGroupName: { - description: "resource group the DNS zone is located in", - type: "string" - }, - subscriptionID: { - description: "ID of the Azure subscription", - type: "string" - }, - tenantID: { - description: "Auth: Azure Service Principal:\nThe TenantID of the Azure Service Principal used to authenticate with Azure DNS.\nIf set, ClientID and ClientSecret must also be set.", - type: "string" - } - }, - required: ["resourceGroupName", "subscriptionID"], - type: "object" - }, - cloudDNS: { - description: "Use the Google Cloud DNS API to manage DNS01 challenge records.", - properties: { - hostedZoneName: { - description: "HostedZoneName is an optional field that tells cert-manager in which\nCloud DNS zone the challenge record has to be created.\nIf left empty cert-manager will automatically choose a zone.", - type: "string" - }, - project: { - type: "string" - }, - serviceAccountSecretRef: { - description: "A reference to a specific 'key' within a Secret resource.\nIn some instances, `key` is a required field.", - properties: { - key: { - description: "The key of the entry in the Secret resource's `data` field to be used.\nSome instances of this field may be defaulted, in others it may be\nrequired.", - type: "string" - }, - name: { - description: "Name of the resource being referred to.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - type: "string" - } - }, - required: ["name"], - type: "object" - } - }, - required: ["project"], - type: "object" - }, - cloudflare: { - description: "Use the Cloudflare API to manage DNS01 challenge records.", - properties: { - apiKeySecretRef: { - description: "API key to use to authenticate with Cloudflare.\nNote: using an API token to authenticate is now the recommended method\nas it allows greater control of permissions.", - properties: { - key: { - description: "The key of the entry in the Secret resource's `data` field to be used.\nSome instances of this field may be defaulted, in others it may be\nrequired.", - type: "string" - }, - name: { - description: "Name of the resource being referred to.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - type: "string" - } - }, - required: ["name"], - type: "object" - }, - apiTokenSecretRef: { - description: "API token used to authenticate with Cloudflare.", - properties: { - key: { - description: "The key of the entry in the Secret resource's `data` field to be used.\nSome instances of this field may be defaulted, in others it may be\nrequired.", - type: "string" - }, - name: { - description: "Name of the resource being referred to.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - type: "string" - } - }, - required: ["name"], - type: "object" - }, - email: { - description: "Email of the account, only required when using API key based authentication.", - type: "string" - } - }, - type: "object" - }, - cnameStrategy: { - description: "CNAMEStrategy configures how the DNS01 provider should handle CNAME\nrecords when found in DNS zones.", - enum: ["None", "Follow"], - type: "string" - }, - digitalocean: { - description: "Use the DigitalOcean DNS API to manage DNS01 challenge records.", - properties: { - tokenSecretRef: { - description: "A reference to a specific 'key' within a Secret resource.\nIn some instances, `key` is a required field.", - properties: { - key: { - description: "The key of the entry in the Secret resource's `data` field to be used.\nSome instances of this field may be defaulted, in others it may be\nrequired.", - type: "string" - }, - name: { - description: "Name of the resource being referred to.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - type: "string" - } - }, - required: ["name"], - type: "object" - } - }, - required: ["tokenSecretRef"], - type: "object" - }, - rfc2136: { - description: "Use RFC2136 (\"Dynamic Updates in the Domain Name System\") (https://datatracker.ietf.org/doc/rfc2136/)\nto manage DNS01 challenge records.", - properties: { - nameserver: { - description: "The IP address or hostname of an authoritative DNS server supporting\nRFC2136 in the form host:port. If the host is an IPv6 address it must be\nenclosed in square brackets (e.g [2001:db8::1])\xA0; port is optional.\nThis field is required.", - type: "string" - }, - tsigAlgorithm: { - description: "The TSIG Algorithm configured in the DNS supporting RFC2136. Used only\nwhen ``tsigSecretSecretRef`` and ``tsigKeyName`` are defined.\nSupported values are (case-insensitive): ``HMACMD5`` (default),\n``HMACSHA1``, ``HMACSHA256`` or ``HMACSHA512``.", - type: "string" - }, - tsigKeyName: { - description: "The TSIG Key name configured in the DNS.\nIf ``tsigSecretSecretRef`` is defined, this field is required.", - type: "string" - }, - tsigSecretSecretRef: { - description: "The name of the secret containing the TSIG value.\nIf ``tsigKeyName`` is defined, this field is required.", - properties: { - key: { - description: "The key of the entry in the Secret resource's `data` field to be used.\nSome instances of this field may be defaulted, in others it may be\nrequired.", - type: "string" - }, - name: { - description: "Name of the resource being referred to.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - type: "string" - } - }, - required: ["name"], - type: "object" - } - }, - required: ["nameserver"], - type: "object" - }, - route53: { - description: "Use the AWS Route53 API to manage DNS01 challenge records.", - properties: { - accessKeyID: { - description: "The AccessKeyID is used for authentication.\nCannot be set when SecretAccessKeyID is set.\nIf neither the Access Key nor Key ID are set, we fall-back to using env\nvars, shared credentials file or AWS Instance metadata,\nsee: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials", - type: "string" - }, - accessKeyIDSecretRef: { - description: "The SecretAccessKey is used for authentication. If set, pull the AWS\naccess key ID from a key within a Kubernetes Secret.\nCannot be set when AccessKeyID is set.\nIf neither the Access Key nor Key ID are set, we fall-back to using env\nvars, shared credentials file or AWS Instance metadata,\nsee: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials", - properties: { - key: { - description: "The key of the entry in the Secret resource's `data` field to be used.\nSome instances of this field may be defaulted, in others it may be\nrequired.", - type: "string" - }, - name: { - description: "Name of the resource being referred to.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - type: "string" - } - }, - required: ["name"], - type: "object" - }, - auth: { - description: "Auth configures how cert-manager authenticates.", - properties: { - kubernetes: { - description: "Kubernetes authenticates with Route53 using AssumeRoleWithWebIdentity\nby passing a bound ServiceAccount token.", - properties: { - serviceAccountRef: { - description: "A reference to a service account that will be used to request a bound\ntoken (also known as \"projected token\"). To use this field, you must\nconfigure an RBAC rule to let cert-manager request a token.", - properties: { - audiences: { - description: "TokenAudiences is an optional list of audiences to include in the\ntoken passed to AWS. The default token consisting of the issuer's namespace\nand name is always included.\nIf unset the audience defaults to `sts.amazonaws.com`.", - items: { - type: "string" - }, - type: "array" - }, - name: { - description: "Name of the ServiceAccount used to request a token.", - type: "string" - } - }, - required: ["name"], - type: "object" - } - }, - required: ["serviceAccountRef"], - type: "object" - } - }, - required: ["kubernetes"], - type: "object" - }, - hostedZoneID: { - description: "If set, the provider will manage only this zone in Route53 and will not do a lookup using the route53:ListHostedZonesByName api call.", - type: "string" - }, - region: { - description: "Override the AWS region.\n\nRoute53 is a global service and does not have regional endpoints but the\nregion specified here (or via environment variables) is used as a hint to\nhelp compute the correct AWS credential scope and partition when it\nconnects to Route53. See:\n- [Amazon Route 53 endpoints and quotas](https://docs.aws.amazon.com/general/latest/gr/r53.html)\n- [Global services](https://docs.aws.amazon.com/whitepapers/latest/aws-fault-isolation-boundaries/global-services.html)\n\nIf you omit this region field, cert-manager will use the region from\nAWS_REGION and AWS_DEFAULT_REGION environment variables, if they are set\nin the cert-manager controller Pod.\n\nThe `region` field is not needed if you use [IAM Roles for Service Accounts (IRSA)](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html).\nInstead an AWS_REGION environment variable is added to the cert-manager controller Pod by:\n[Amazon EKS Pod Identity Webhook](https://github.com/aws/amazon-eks-pod-identity-webhook).\nIn this case this `region` field value is ignored.\n\nThe `region` field is not needed if you use [EKS Pod Identities](https://docs.aws.amazon.com/eks/latest/userguide/pod-identities.html).\nInstead an AWS_REGION environment variable is added to the cert-manager controller Pod by:\n[Amazon EKS Pod Identity Agent](https://github.com/aws/eks-pod-identity-agent),\nIn this case this `region` field value is ignored.", - type: "string" - }, - role: { - description: "Role is a Role ARN which the Route53 provider will assume using either the explicit credentials AccessKeyID/SecretAccessKey\nor the inferred credentials from environment variables, shared credentials file or AWS Instance metadata", - type: "string" - }, - secretAccessKeySecretRef: { - description: "The SecretAccessKey is used for authentication.\nIf neither the Access Key nor Key ID are set, we fall-back to using env\nvars, shared credentials file or AWS Instance metadata,\nsee: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials", - properties: { - key: { - description: "The key of the entry in the Secret resource's `data` field to be used.\nSome instances of this field may be defaulted, in others it may be\nrequired.", - type: "string" - }, - name: { - description: "Name of the resource being referred to.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - type: "string" - } - }, - required: ["name"], - type: "object" - } - }, - type: "object" - }, - webhook: { - description: "Configure an external webhook based DNS01 challenge solver to manage\nDNS01 challenge records.", - properties: { - config: { - description: "Additional configuration that should be passed to the webhook apiserver\nwhen challenges are processed.\nThis can contain arbitrary JSON data.\nSecret values should not be specified in this stanza.\nIf secret values are needed (e.g. credentials for a DNS service), you\nshould use a SecretKeySelector to reference a Secret resource.\nFor details on the schema of this field, consult the webhook provider\nimplementation's documentation.", - "x-kubernetes-preserve-unknown-fields": true - }, - groupName: { - description: "The API group name that should be used when POSTing ChallengePayload\nresources to the webhook apiserver.\nThis should be the same as the GroupName specified in the webhook\nprovider implementation.", - type: "string" - }, - solverName: { - description: "The name of the solver to use, as defined in the webhook provider\nimplementation.\nThis will typically be the name of the provider, e.g. 'cloudflare'.", - type: "string" - } - }, - required: ["groupName", "solverName"], - type: "object" + required: ["groupName", "solverName"], + type: "object" } }, type: "object" }, http01: { - description: "Configures cert-manager to attempt to complete authorizations by\nperforming the HTTP01 challenge flow.\nIt is not possible to obtain certificates for wildcard domain names\n(e.g. `*.example.com`) using the HTTP01 challenge mechanism.", + description: "Configures cert-manager to attempt to complete authorizations by\nperforming the HTTP01 challenge flow.\nIt is not possible to obtain certificates for wildcard domain names\n(e.g., `*.example.com`) using the HTTP01 challenge mechanism.", properties: { gatewayHTTPRoute: { description: "The Gateway API is a sig-network community API that models service networking\nin Kubernetes (https://gateway-api.sigs.k8s.io/). The Gateway solver will\ncreate HTTPRoutes with the specified labels in the same namespace as the challenge.\nThis solver is experimental, and fields / behaviour may change in the future.", @@ -1379,7 +623,8 @@ export const CustomResourceDefinition_ChallengesAcmeCertManagerIo: Apiextensions required: ["name"], type: "object" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" }, podTemplate: { description: "Optional pod template used to configure the ACME challenge solver pods\nused for HTTP01 challenges.", @@ -1626,7 +871,7 @@ export const CustomResourceDefinition_ChallengesAcmeCertManagerIo: Apiextensions "x-kubernetes-map-type": "atomic" }, matchLabelKeys: { - description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", + description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.", items: { type: "string" }, @@ -1634,7 +879,7 @@ export const CustomResourceDefinition_ChallengesAcmeCertManagerIo: Apiextensions "x-kubernetes-list-type": "atomic" }, mismatchLabelKeys: { - description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", + description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.", items: { type: "string" }, @@ -1759,7 +1004,7 @@ export const CustomResourceDefinition_ChallengesAcmeCertManagerIo: Apiextensions "x-kubernetes-map-type": "atomic" }, matchLabelKeys: { - description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", + description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.", items: { type: "string" }, @@ -1767,7 +1012,7 @@ export const CustomResourceDefinition_ChallengesAcmeCertManagerIo: Apiextensions "x-kubernetes-list-type": "atomic" }, mismatchLabelKeys: { - description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", + description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.", items: { type: "string" }, @@ -1842,7 +1087,7 @@ export const CustomResourceDefinition_ChallengesAcmeCertManagerIo: Apiextensions description: "Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).", properties: { preferredDuringSchedulingIgnoredDuringExecution: { - description: "The scheduler will prefer to schedule pods to nodes that satisfy\nthe anti-affinity expressions specified by this field, but it may choose\na node that violates one or more of the expressions. The node that is\nmost preferred is the one with the greatest sum of weights, i.e.\nfor each node that meets all of the scheduling requirements (resource\nrequest, requiredDuringScheduling anti-affinity expressions, etc.),\ncompute a sum by iterating through the elements of this field and adding\n\"weight\" to the sum if the node has pods which matches the corresponding podAffinityTerm; the\nnode(s) with the highest sum are the most preferred.", + description: "The scheduler will prefer to schedule pods to nodes that satisfy\nthe anti-affinity expressions specified by this field, but it may choose\na node that violates one or more of the expressions. The node that is\nmost preferred is the one with the greatest sum of weights, i.e.\nfor each node that meets all of the scheduling requirements (resource\nrequest, requiredDuringScheduling anti-affinity expressions, etc.),\ncompute a sum by iterating through the elements of this field and subtracting\n\"weight\" from the sum if the node has pods which matches the corresponding podAffinityTerm; the\nnode(s) with the highest sum are the most preferred.", items: { description: "The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)", properties: { @@ -1892,7 +1137,7 @@ export const CustomResourceDefinition_ChallengesAcmeCertManagerIo: Apiextensions "x-kubernetes-map-type": "atomic" }, matchLabelKeys: { - description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", + description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.", items: { type: "string" }, @@ -1900,7 +1145,7 @@ export const CustomResourceDefinition_ChallengesAcmeCertManagerIo: Apiextensions "x-kubernetes-list-type": "atomic" }, mismatchLabelKeys: { - description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", + description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.", items: { type: "string" }, @@ -2025,7 +1270,7 @@ export const CustomResourceDefinition_ChallengesAcmeCertManagerIo: Apiextensions "x-kubernetes-map-type": "atomic" }, matchLabelKeys: { - description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", + description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.", items: { type: "string" }, @@ -2033,7 +1278,7 @@ export const CustomResourceDefinition_ChallengesAcmeCertManagerIo: Apiextensions "x-kubernetes-list-type": "atomic" }, mismatchLabelKeys: { - description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", + description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.", items: { type: "string" }, @@ -2121,7 +1366,9 @@ export const CustomResourceDefinition_ChallengesAcmeCertManagerIo: Apiextensions type: "object", "x-kubernetes-map-type": "atomic" }, - type: "array" + type: "array", + "x-kubernetes-list-map-keys": ["name"], + "x-kubernetes-list-type": "map" }, nodeSelector: { additionalProperties: { @@ -2134,6 +1381,38 @@ export const CustomResourceDefinition_ChallengesAcmeCertManagerIo: Apiextensions description: "If specified, the pod's priorityClassName.", type: "string" }, + resources: { + description: "If specified, the pod's resource requirements.\nThese values override the global resource configuration flags.\nNote that when only specifying resource limits, ensure they are greater than or equal\nto the corresponding global resource requests configured via controller flags\n(--acme-http01-solver-resource-request-cpu, --acme-http01-solver-resource-request-memory).\nKubernetes will reject pod creation if limits are lower than requests, causing challenge failures.", + properties: { + limits: { + additionalProperties: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + }, + description: "Limits describes the maximum amount of compute resources allowed.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + type: "object" + }, + requests: { + additionalProperties: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + }, + description: "Requests describes the minimum amount of compute resources required.\nIf Requests is omitted for a container, it defaults to Limits if that is explicitly specified,\notherwise to the global values configured via controller flags. Requests cannot exceed Limits.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + type: "object" + } + }, + type: "object" + }, securityContext: { description: "If specified, the pod's security context", properties: { @@ -2203,7 +1482,8 @@ export const CustomResourceDefinition_ChallengesAcmeCertManagerIo: Apiextensions format: "int64", type: "integer" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" }, sysctls: { description: "Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported\nsysctls (by the container runtime) might fail to launch.\nNote that this field cannot be set when spec.os.name is windows.", @@ -2222,7 +1502,8 @@ export const CustomResourceDefinition_ChallengesAcmeCertManagerIo: Apiextensions required: ["name", "value"], type: "object" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" } }, type: "object" @@ -2245,7 +1526,7 @@ export const CustomResourceDefinition_ChallengesAcmeCertManagerIo: Apiextensions type: "string" }, operator: { - description: "Operator represents a key's relationship to the value.\nValid operators are Exists and Equal. Defaults to Equal.\nExists is equivalent to wildcard for value, so that a pod can\ntolerate all taints of a particular category.", + description: "Operator represents a key's relationship to the value.\nValid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.\nExists is equivalent to wildcard for value, so that a pod can\ntolerate all taints of a particular category.\nLt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).", type: "string" }, tolerationSeconds: { @@ -2260,7 +1541,8 @@ export const CustomResourceDefinition_ChallengesAcmeCertManagerIo: Apiextensions }, type: "object" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" } }, type: "object" @@ -2561,7 +1843,7 @@ export const CustomResourceDefinition_ChallengesAcmeCertManagerIo: Apiextensions "x-kubernetes-map-type": "atomic" }, matchLabelKeys: { - description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", + description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.", items: { type: "string" }, @@ -2569,7 +1851,7 @@ export const CustomResourceDefinition_ChallengesAcmeCertManagerIo: Apiextensions "x-kubernetes-list-type": "atomic" }, mismatchLabelKeys: { - description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", + description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.", items: { type: "string" }, @@ -2694,7 +1976,7 @@ export const CustomResourceDefinition_ChallengesAcmeCertManagerIo: Apiextensions "x-kubernetes-map-type": "atomic" }, matchLabelKeys: { - description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", + description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.", items: { type: "string" }, @@ -2702,7 +1984,7 @@ export const CustomResourceDefinition_ChallengesAcmeCertManagerIo: Apiextensions "x-kubernetes-list-type": "atomic" }, mismatchLabelKeys: { - description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", + description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.", items: { type: "string" }, @@ -2777,7 +2059,7 @@ export const CustomResourceDefinition_ChallengesAcmeCertManagerIo: Apiextensions description: "Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).", properties: { preferredDuringSchedulingIgnoredDuringExecution: { - description: "The scheduler will prefer to schedule pods to nodes that satisfy\nthe anti-affinity expressions specified by this field, but it may choose\na node that violates one or more of the expressions. The node that is\nmost preferred is the one with the greatest sum of weights, i.e.\nfor each node that meets all of the scheduling requirements (resource\nrequest, requiredDuringScheduling anti-affinity expressions, etc.),\ncompute a sum by iterating through the elements of this field and adding\n\"weight\" to the sum if the node has pods which matches the corresponding podAffinityTerm; the\nnode(s) with the highest sum are the most preferred.", + description: "The scheduler will prefer to schedule pods to nodes that satisfy\nthe anti-affinity expressions specified by this field, but it may choose\na node that violates one or more of the expressions. The node that is\nmost preferred is the one with the greatest sum of weights, i.e.\nfor each node that meets all of the scheduling requirements (resource\nrequest, requiredDuringScheduling anti-affinity expressions, etc.),\ncompute a sum by iterating through the elements of this field and subtracting\n\"weight\" from the sum if the node has pods which matches the corresponding podAffinityTerm; the\nnode(s) with the highest sum are the most preferred.", items: { description: "The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)", properties: { @@ -2827,7 +2109,7 @@ export const CustomResourceDefinition_ChallengesAcmeCertManagerIo: Apiextensions "x-kubernetes-map-type": "atomic" }, matchLabelKeys: { - description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", + description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.", items: { type: "string" }, @@ -2835,7 +2117,7 @@ export const CustomResourceDefinition_ChallengesAcmeCertManagerIo: Apiextensions "x-kubernetes-list-type": "atomic" }, mismatchLabelKeys: { - description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", + description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.", items: { type: "string" }, @@ -2960,7 +2242,7 @@ export const CustomResourceDefinition_ChallengesAcmeCertManagerIo: Apiextensions "x-kubernetes-map-type": "atomic" }, matchLabelKeys: { - description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", + description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.", items: { type: "string" }, @@ -2968,7 +2250,7 @@ export const CustomResourceDefinition_ChallengesAcmeCertManagerIo: Apiextensions "x-kubernetes-list-type": "atomic" }, mismatchLabelKeys: { - description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", + description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.", items: { type: "string" }, @@ -3056,7 +2338,9 @@ export const CustomResourceDefinition_ChallengesAcmeCertManagerIo: Apiextensions type: "object", "x-kubernetes-map-type": "atomic" }, - type: "array" + type: "array", + "x-kubernetes-list-map-keys": ["name"], + "x-kubernetes-list-type": "map" }, nodeSelector: { additionalProperties: { @@ -3069,6 +2353,38 @@ export const CustomResourceDefinition_ChallengesAcmeCertManagerIo: Apiextensions description: "If specified, the pod's priorityClassName.", type: "string" }, + resources: { + description: "If specified, the pod's resource requirements.\nThese values override the global resource configuration flags.\nNote that when only specifying resource limits, ensure they are greater than or equal\nto the corresponding global resource requests configured via controller flags\n(--acme-http01-solver-resource-request-cpu, --acme-http01-solver-resource-request-memory).\nKubernetes will reject pod creation if limits are lower than requests, causing challenge failures.", + properties: { + limits: { + additionalProperties: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + }, + description: "Limits describes the maximum amount of compute resources allowed.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + type: "object" + }, + requests: { + additionalProperties: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + }, + description: "Requests describes the minimum amount of compute resources required.\nIf Requests is omitted for a container, it defaults to Limits if that is explicitly specified,\notherwise to the global values configured via controller flags. Requests cannot exceed Limits.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + type: "object" + } + }, + type: "object" + }, securityContext: { description: "If specified, the pod's security context", properties: { @@ -3138,7 +2454,8 @@ export const CustomResourceDefinition_ChallengesAcmeCertManagerIo: Apiextensions format: "int64", type: "integer" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" }, sysctls: { description: "Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported\nsysctls (by the container runtime) might fail to launch.\nNote that this field cannot be set when spec.os.name is windows.", @@ -3157,7 +2474,8 @@ export const CustomResourceDefinition_ChallengesAcmeCertManagerIo: Apiextensions required: ["name", "value"], type: "object" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" } }, type: "object" @@ -3180,7 +2498,7 @@ export const CustomResourceDefinition_ChallengesAcmeCertManagerIo: Apiextensions type: "string" }, operator: { - description: "Operator represents a key's relationship to the value.\nValid operators are Exists and Equal. Defaults to Equal.\nExists is equivalent to wildcard for value, so that a pod can\ntolerate all taints of a particular category.", + description: "Operator represents a key's relationship to the value.\nValid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.\nExists is equivalent to wildcard for value, so that a pod can\ntolerate all taints of a particular category.\nLt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).", type: "string" }, tolerationSeconds: { @@ -3195,7 +2513,8 @@ export const CustomResourceDefinition_ChallengesAcmeCertManagerIo: Apiextensions }, type: "object" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" } }, type: "object" @@ -3203,94 +2522,1241 @@ export const CustomResourceDefinition_ChallengesAcmeCertManagerIo: Apiextensions }, type: "object" }, - serviceType: { - description: "Optional service type for Kubernetes solver service. Supported values\nare NodePort or ClusterIP. If unset, defaults to NodePort.", + serviceType: { + description: "Optional service type for Kubernetes solver service. Supported values\nare NodePort or ClusterIP. If unset, defaults to NodePort.", + type: "string" + } + }, + type: "object" + } + }, + type: "object" + }, + selector: { + description: "Selector selects a set of DNSNames on the Certificate resource that\nshould be solved using this challenge solver.\nIf not specified, the solver will be treated as the 'default' solver\nwith the lowest priority, i.e. if any other solver has a more specific\nmatch, it will be used instead.", + properties: { + dnsNames: { + description: "List of DNSNames that this solver will be used to solve.\nIf specified and a match is found, a dnsNames selector will take\nprecedence over a dnsZones selector.\nIf multiple solvers match with the same dnsNames value, the solver\nwith the most matching labels in matchLabels will be selected.\nIf neither has more matches, the solver defined earlier in the list\nwill be selected.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + dnsZones: { + description: "List of DNSZones that this solver will be used to solve.\nThe most specific DNS zone match specified here will take precedence\nover other DNS zone matches, so a solver specifying sys.example.com\nwill be selected over one specifying example.com for the domain\nwww.sys.example.com.\nIf multiple solvers match with the same dnsZones value, the solver\nwith the most matching labels in matchLabels will be selected.\nIf neither has more matches, the solver defined earlier in the list\nwill be selected.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + matchLabels: { + additionalProperties: { + type: "string" + }, + description: "A label selector that is used to refine the set of certificate's that\nthis challenge solver will apply to.", + type: "object" + } + }, + type: "object" + }, + waitInsteadOfSelfCheck: { + description: "WaitInsteadOfSelfCheck, if set, skips cert-manager's self-check and\ninstead waits this long after presentation before asking the ACME server\nto validate the challenge.\n\nThis is an advanced escape hatch for environments where cert-manager's\nself-check cannot succeed from its own network or DNS viewpoint even\nthough the ACME server can still validate successfully, for example due\nto split-horizon DNS or NAT hairpinning.\n\nA value of 0 skips the self-check and asks the ACME server to validate\nimmediately after presentation, relying on the ACME server's own\nvalidation retries (RFC 8555 section 8.2) to succeed once the challenge\nhas propagated. A negative duration is rejected.\nValue must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration,\nfor example `30s` or `2m`.", + type: "string" + } + }, + type: "object" + }, + token: { + description: "The ACME challenge token for this challenge.\nThis is the raw value returned from the ACME server.", + type: "string" + }, + type: { + description: "The type of ACME challenge this resource represents.\nOne of \"HTTP-01\" or \"DNS-01\".", + enum: ["HTTP-01", "DNS-01"], + type: "string" + }, + url: { + description: "The URL of the ACME Challenge resource for this challenge.\nThis can be used to lookup details about the status of this challenge.", + type: "string" + }, + wildcard: { + description: "wildcard will be true if this challenge is for a wildcard identifier,\nfor example '*.example.com'.", + type: "boolean" + } + }, + required: ["authorizationURL", "dnsName", "issuerRef", "key", "solver", "token", "type", "url"], + type: "object" + }, + status: { + properties: { + presented: { + description: "Presented is true once cert-manager has configured the solver resources\nneeded to expose this challenge's validation material.\nFor example, the DNS01 TXT record has been created, or the HTTP01 solver\nhas been configured to serve the challenge token.\nThis does not imply the self check is passing, that the ACME server has\nvalidated the challenge, or that cert-manager has already accepted the\nchallenge with the ACME server.", + type: "boolean" + }, + presentedAt: { + description: "PresentedAt records when cert-manager first configured the solver\nresources for this challenge. This is used by the optional delay-based\nreadiness logic.", + format: "date-time", + type: "string" + }, + processing: { + description: "Used to denote whether this challenge should be processed or not.\nThis field will only be set to true by the 'scheduling' component.\nIt will only be set to false by the 'challenges' controller, after the\nchallenge has reached a final state or timed out.\nIf this field is set to false, the challenge controller will not take\nany more action.", + type: "boolean" + }, + reason: { + description: "Contains human readable information on why the Challenge is in the\ncurrent state.", + type: "string" + }, + state: { + description: "Contains the current 'state' of the challenge.\nIf not set, the state of the challenge is unknown.", + enum: ["valid", "ready", "pending", "processing", "invalid", "expired", "errored"], + type: "string" + } + }, + type: "object" + } + }, + required: ["metadata", "spec"], + type: "object" + } + }, + selectableFields: [{ + jsonPath: ".spec.issuerRef.group" + }, { + jsonPath: ".spec.issuerRef.kind" + }, { + jsonPath: ".spec.issuerRef.name" + }], + served: true, + storage: true, + subresources: { + status: {} + } + }] + } +}; +export const CustomResourceDefinition_OrdersAcmeCertManagerIo: KubernetesResource = { + apiVersion: "apiextensions.k8s.io/v1", + kind: "CustomResourceDefinition", + metadata: { + annotations: { + "helm.sh/resource-policy": "keep" + }, + labels: { + app: "cert-manager", + "app.kubernetes.io/component": "crds", + "app.kubernetes.io/instance": "cert-manager", + "app.kubernetes.io/managed-by": "Helm", + "app.kubernetes.io/name": "cert-manager", + "app.kubernetes.io/version": "v1.21.1", + "helm.sh/chart": "cert-manager-v1.21.1" + }, + name: "orders.acme.cert-manager.io" + }, + spec: { + group: "acme.cert-manager.io", + names: { + categories: ["cert-manager", "cert-manager-acme"], + kind: "Order", + listKind: "OrderList", + plural: "orders", + singular: "order" + }, + scope: "Namespaced", + versions: [{ + additionalPrinterColumns: [{ + jsonPath: ".status.state", + name: "State", + type: "string" + }, { + jsonPath: ".spec.issuerRef.name", + name: "Issuer", + priority: 1, + type: "string" + }, { + jsonPath: ".status.reason", + name: "Reason", + priority: 1, + type: "string" + }, { + description: "CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.", + jsonPath: ".metadata.creationTimestamp", + name: "Age", + type: "date" + }], + name: "v1", + schema: { + openAPIV3Schema: { + description: "Order is a type to represent an Order with an ACME server", + properties: { + apiVersion: { + description: "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", + type: "string" + }, + kind: { + description: "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + type: "string" + }, + metadata: { + type: "object" + }, + spec: { + properties: { + commonName: { + description: "CommonName is the common name as specified on the DER encoded CSR.\nIf specified, this value must also be present in `dnsNames` or `ipAddresses`.\nThis field must match the corresponding field on the DER encoded CSR.", + type: "string" + }, + dnsNames: { + description: "DNSNames is a list of DNS names that should be included as part of the Order\nvalidation process.\nThis field must match the corresponding field on the DER encoded CSR.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + duration: { + description: "Duration is the duration for the not after date for the requested certificate.\nThis is set on order creation as per the ACME spec.", + type: "string" + }, + ipAddresses: { + description: "IPAddresses is a list of IP addresses that should be included as part of the Order\nvalidation process.\nThis field must match the corresponding field on the DER encoded CSR.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + issuerRef: { + description: "IssuerRef references a properly configured ACME-type Issuer which should\nbe used to create this Order.\nIf the Issuer does not exist, processing will be retried.\nIf the Issuer is not an 'ACME' Issuer, an error will be returned and the\nOrder will be marked as failed.", + properties: { + group: { + description: "Group of the issuer being referred to.\nDefaults to 'cert-manager.io'.", + type: "string" + }, + kind: { + description: "Kind of the issuer being referred to.\nDefaults to 'Issuer'.", + type: "string" + }, + name: { + description: "Name of the issuer being referred to.", + type: "string" + } + }, + required: ["name"], + type: "object" + }, + profile: { + description: "Profile allows requesting a certificate profile from the ACME server.\nSupported profiles are listed by the server's ACME directory URL.", + type: "string" + }, + replaces: { + description: "Replaces is the ARI CertID (RFC 9773 §4.1) of the certificate that this\nOrder is intended to replace. When set, cert-manager will include the\n\"replaces\" field on the newOrder request to the ACME server if and only\nif the server advertises ARI support in its directory. The CertID has\nthe form \"base64url(AKI).base64url(serial)\" and is derived locally from\nthe currently issued leaf certificate.", + type: "string" + }, + request: { + description: "Certificate signing request bytes in DER encoding.\nThis will be used when finalizing the order.\nThis field must be set on the order.", + format: "byte", + type: "string" + } + }, + required: ["issuerRef", "request"], + type: "object" + }, + status: { + properties: { + authorizations: { + description: "Authorizations contains data returned from the ACME server on what\nauthorizations must be completed in order to validate the DNS names\nspecified on the Order.", + items: { + description: "ACMEAuthorization contains data returned from the ACME server on an\nauthorization that must be completed in order validate a DNS name on an ACME\nOrder resource.", + properties: { + challenges: { + description: "Challenges specifies the challenge types offered by the ACME server.\nOne of these challenge types will be selected when validating the DNS\nname and an appropriate Challenge resource will be created to perform\nthe ACME challenge process.", + items: { + description: "Challenge specifies a challenge offered by the ACME server for an Order.\nAn appropriate Challenge resource can be created to perform the ACME\nchallenge process.", + properties: { + token: { + description: "Token is the token that must be presented for this challenge.\nThis is used to compute the 'key' that must also be presented.", + type: "string" + }, + type: { + description: "Type is the type of challenge being offered, e.g., 'http-01', 'dns-01',\n'tls-sni-01', etc.\nThis is the raw value retrieved from the ACME server.\nOnly 'http-01' and 'dns-01' are supported by cert-manager, other values\nwill be ignored.", + type: "string" + }, + url: { + description: "URL is the URL of this challenge. It can be used to retrieve additional\nmetadata about the Challenge from the ACME server.", + type: "string" + } + }, + required: ["token", "type", "url"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + identifier: { + description: "Identifier is the DNS name to be validated as part of this authorization", + type: "string" + }, + initialState: { + description: "InitialState is the initial state of the ACME authorization when first\nfetched from the ACME server.\nIf an Authorization is already 'valid', the Order controller will not\ncreate a Challenge resource for the authorization. This will occur when\nworking with an ACME server that enables 'authz reuse' (such as Let's\nEncrypt's production endpoint).\nIf not set and 'identifier' is set, the state is assumed to be pending\nand a Challenge will be created.", + enum: ["valid", "ready", "pending", "processing", "invalid", "expired", "errored"], + type: "string" + }, + url: { + description: "URL is the URL of the Authorization that must be completed", + type: "string" + }, + wildcard: { + description: "Wildcard will be true if this authorization is for a wildcard DNS name.\nIf this is true, the identifier will be the *non-wildcard* version of\nthe DNS name.\nFor example, if '*.example.com' is the DNS name being validated, this\nfield will be 'true' and the 'identifier' field will be 'example.com'.", + type: "boolean" + } + }, + required: ["url"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + certificate: { + description: "Certificate is a copy of the PEM encoded certificate for this Order.\nThis field will be populated after the order has been successfully\nfinalized with the ACME server, and the order has transitioned to the\n'valid' state.", + format: "byte", + type: "string" + }, + failureTime: { + description: "FailureTime stores the time that this order failed.\nThis is used to influence garbage collection and back-off.", + format: "date-time", + type: "string" + }, + finalizeURL: { + description: "FinalizeURL of the Order.\nThis is used to obtain certificates for this order once it has been completed.", + type: "string" + }, + reason: { + description: "Reason optionally provides more information about a why the order is in\nthe current state.", + type: "string" + }, + state: { + description: "State contains the current state of this Order resource.\nStates 'success' and 'expired' are 'final'", + enum: ["valid", "ready", "pending", "processing", "invalid", "expired", "errored"], + type: "string" + }, + url: { + description: "URL of the Order.\nThis will initially be empty when the resource is first created.\nThe Order controller will populate this field when the Order is first processed.\nThis field will be immutable after it is initially set.", + type: "string" + } + }, + type: "object" + } + }, + required: ["metadata", "spec"], + type: "object" + } + }, + selectableFields: [{ + jsonPath: ".spec.issuerRef.group" + }, { + jsonPath: ".spec.issuerRef.kind" + }, { + jsonPath: ".spec.issuerRef.name" + }], + served: true, + storage: true, + subresources: { + status: {} + } + }] + } +}; +export const CustomResourceDefinition_CertificaterequestsCertManagerIo: KubernetesResource = { + apiVersion: "apiextensions.k8s.io/v1", + kind: "CustomResourceDefinition", + metadata: { + annotations: { + "helm.sh/resource-policy": "keep" + }, + labels: { + app: "cert-manager", + "app.kubernetes.io/component": "crds", + "app.kubernetes.io/instance": "cert-manager", + "app.kubernetes.io/managed-by": "Helm", + "app.kubernetes.io/name": "cert-manager", + "app.kubernetes.io/version": "v1.21.1", + "helm.sh/chart": "cert-manager-v1.21.1" + }, + name: "certificaterequests.cert-manager.io" + }, + spec: { + group: "cert-manager.io", + names: { + categories: ["cert-manager"], + kind: "CertificateRequest", + listKind: "CertificateRequestList", + plural: "certificaterequests", + shortNames: ["cr", "crs"], + singular: "certificaterequest" + }, + scope: "Namespaced", + versions: [{ + additionalPrinterColumns: [{ + jsonPath: ".status.conditions[?(@.type == \"Approved\")].status", + name: "Approved", + type: "string" + }, { + jsonPath: ".status.conditions[?(@.type == \"Denied\")].status", + name: "Denied", + type: "string" + }, { + jsonPath: ".status.conditions[?(@.type == \"Ready\")].status", + name: "Ready", + type: "string" + }, { + jsonPath: ".spec.issuerRef.name", + name: "Issuer", + type: "string" + }, { + jsonPath: ".spec.username", + name: "Requester", + type: "string" + }, { + jsonPath: ".status.conditions[?(@.type == \"Ready\")].message", + name: "Status", + priority: 1, + type: "string" + }, { + description: "CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.", + jsonPath: ".metadata.creationTimestamp", + name: "Age", + type: "date" + }], + name: "v1", + schema: { + openAPIV3Schema: { + description: "A CertificateRequest is used to request a signed certificate from one of the\nconfigured issuers.\n\nAll fields within the CertificateRequest's `spec` are immutable after creation.\nA CertificateRequest will either succeed or fail, as denoted by its `Ready` status\ncondition and its `status.failureTime` field.\n\nA CertificateRequest is a one-shot resource, meaning it represents a single\npoint in time request for a certificate and cannot be re-used.", + properties: { + apiVersion: { + description: "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", + type: "string" + }, + kind: { + description: "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + type: "string" + }, + metadata: { + type: "object" + }, + spec: { + description: "Specification of the desired state of the CertificateRequest resource.\nhttps://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status", + properties: { + duration: { + description: "Requested 'duration' (i.e. lifetime) of the Certificate. Note that the\nissuer may choose to ignore the requested duration, just like any other\nrequested attribute.", + type: "string" + }, + extra: { + additionalProperties: { + items: { + type: "string" + }, + type: "array" + }, + description: "Extra contains extra attributes of the user that created the CertificateRequest.\nPopulated by the cert-manager webhook on creation and immutable.", + type: "object" + }, + groups: { + description: "Groups contains group membership of the user that created the CertificateRequest.\nPopulated by the cert-manager webhook on creation and immutable.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + isCA: { + description: "Requested basic constraints isCA value. Note that the issuer may choose\nto ignore the requested isCA value, just like any other requested attribute.\n\nNOTE: If the CSR in the `Request` field has a BasicConstraints extension,\nit must have the same isCA value as specified here.\n\nIf true, this will automatically add the `cert sign` usage to the list\nof requested `usages`.", + type: "boolean" + }, + issuerRef: { + description: "Reference to the issuer responsible for issuing the certificate.\nIf the issuer is namespace-scoped, it must be in the same namespace\nas the Certificate. If the issuer is cluster-scoped, it can be used\nfrom any namespace.\n\nThe `name` field of the reference must always be specified.", + properties: { + group: { + description: "Group of the issuer being referred to.\nDefaults to 'cert-manager.io'.", + type: "string" + }, + kind: { + description: "Kind of the issuer being referred to.\nDefaults to 'Issuer'.", + type: "string" + }, + name: { + description: "Name of the issuer being referred to.", + type: "string" + } + }, + required: ["name"], + type: "object" + }, + request: { + description: "The PEM-encoded X.509 certificate signing request to be submitted to the\nissuer for signing.\n\nIf the CSR has a BasicConstraints extension, its isCA attribute must\nmatch the `isCA` value of this CertificateRequest.\nIf the CSR has a KeyUsage extension, its key usages must match the\nkey usages in the `usages` field of this CertificateRequest.\nIf the CSR has a ExtKeyUsage extension, its extended key usages\nmust match the extended key usages in the `usages` field of this\nCertificateRequest.", + format: "byte", + type: "string" + }, + uid: { + description: "UID contains the uid of the user that created the CertificateRequest.\nPopulated by the cert-manager webhook on creation and immutable.", + type: "string" + }, + usages: { + description: "Requested key usages and extended key usages.\n\nNOTE: If the CSR in the `Request` field has uses the KeyUsage or\nExtKeyUsage extension, these extensions must have the same values\nas specified here without any additional values.\n\nIf unset, defaults to `digital signature` and `key encipherment`.", + items: { + description: "KeyUsage specifies valid usage contexts for keys.\nSee:\nhttps://tools.ietf.org/html/rfc5280#section-4.2.1.3\nhttps://tools.ietf.org/html/rfc5280#section-4.2.1.12\n\nValid KeyUsage values are as follows:\n\"signing\",\n\"digital signature\",\n\"content commitment\",\n\"key encipherment\",\n\"key agreement\",\n\"data encipherment\",\n\"cert sign\",\n\"crl sign\",\n\"encipher only\",\n\"decipher only\",\n\"any\",\n\"server auth\",\n\"client auth\",\n\"code signing\",\n\"email protection\",\n\"s/mime\",\n\"ipsec end system\",\n\"ipsec tunnel\",\n\"ipsec user\",\n\"timestamping\",\n\"ocsp signing\",\n\"microsoft sgc\",\n\"netscape sgc\"", + enum: ["signing", "digital signature", "content commitment", "key encipherment", "key agreement", "data encipherment", "cert sign", "crl sign", "encipher only", "decipher only", "any", "server auth", "client auth", "code signing", "email protection", "s/mime", "ipsec end system", "ipsec tunnel", "ipsec user", "timestamping", "ocsp signing", "microsoft sgc", "netscape sgc"], + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + username: { + description: "Username contains the name of the user that created the CertificateRequest.\nPopulated by the cert-manager webhook on creation and immutable.", + type: "string" + } + }, + required: ["issuerRef", "request"], + type: "object" + }, + status: { + description: "Status of the CertificateRequest.\nThis is set and managed automatically.\nRead-only.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status", + properties: { + ca: { + description: "The PEM encoded X.509 certificate of the signer, also known as the CA\n(Certificate Authority).\nThis is set on a best-effort basis by different issuers.\nIf not set, the CA is assumed to be unknown/not available.", + format: "byte", + type: "string" + }, + certificate: { + description: "The PEM encoded X.509 certificate resulting from the certificate\nsigning request.\nIf not set, the CertificateRequest has either not been completed or has\nfailed. More information on failure can be found by checking the\n`conditions` field.", + format: "byte", + type: "string" + }, + conditions: { + description: "List of status conditions to indicate the status of a CertificateRequest.\nKnown condition types are `Ready`, `InvalidRequest`, `Approved` and `Denied`.", + items: { + description: "CertificateRequestCondition contains condition information for a CertificateRequest.", + properties: { + lastTransitionTime: { + description: "LastTransitionTime is the timestamp corresponding to the last status\nchange of this condition.", + format: "date-time", + type: "string" + }, + message: { + description: "Message is a human readable description of the details of the last\ntransition, complementing reason.", + type: "string" + }, + reason: { + description: "Reason is a brief machine readable explanation for the condition's last\ntransition.", + type: "string" + }, + status: { + description: "Status of the condition, one of (`True`, `False`, `Unknown`).", + enum: ["True", "False", "Unknown"], + type: "string" + }, + type: { + description: "Type of the condition, known values are (`Ready`, `InvalidRequest`,\n`Approved`, `Denied`).", + type: "string" + } + }, + required: ["status", "type"], + type: "object" + }, + type: "array", + "x-kubernetes-list-map-keys": ["type"], + "x-kubernetes-list-type": "map" + }, + failureTime: { + description: "FailureTime stores the time that this CertificateRequest failed. This is\nused to influence garbage collection and back-off.", + format: "date-time", + type: "string" + } + }, + type: "object" + } + }, + type: "object" + } + }, + selectableFields: [{ + jsonPath: ".spec.issuerRef.group" + }, { + jsonPath: ".spec.issuerRef.kind" + }, { + jsonPath: ".spec.issuerRef.name" + }], + served: true, + storage: true, + subresources: { + status: {} + } + }] + } +}; +export const CustomResourceDefinition_CertificatesCertManagerIo: KubernetesResource = { + apiVersion: "apiextensions.k8s.io/v1", + kind: "CustomResourceDefinition", + metadata: { + annotations: { + "helm.sh/resource-policy": "keep" + }, + labels: { + app: "cert-manager", + "app.kubernetes.io/component": "crds", + "app.kubernetes.io/instance": "cert-manager", + "app.kubernetes.io/managed-by": "Helm", + "app.kubernetes.io/name": "cert-manager", + "app.kubernetes.io/version": "v1.21.1", + "helm.sh/chart": "cert-manager-v1.21.1" + }, + name: "certificates.cert-manager.io" + }, + spec: { + group: "cert-manager.io", + names: { + categories: ["cert-manager"], + kind: "Certificate", + listKind: "CertificateList", + plural: "certificates", + shortNames: ["cert", "certs"], + singular: "certificate" + }, + scope: "Namespaced", + versions: [{ + additionalPrinterColumns: [{ + jsonPath: ".status.conditions[?(@.type == \"Ready\")].status", + name: "Ready", + type: "string" + }, { + jsonPath: ".spec.secretName", + name: "Secret", + type: "string" + }, { + jsonPath: ".spec.issuerRef.name", + name: "Issuer", + priority: 1, + type: "string" + }, { + jsonPath: ".status.conditions[?(@.type == \"Ready\")].message", + name: "Status", + priority: 1, + type: "string" + }, { + description: "CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.", + jsonPath: ".metadata.creationTimestamp", + name: "Age", + type: "date" + }], + name: "v1", + schema: { + openAPIV3Schema: { + description: "A Certificate resource should be created to ensure an up to date and signed\nX.509 certificate is stored in the Kubernetes Secret resource named in `spec.secretName`.\n\nThe stored certificate will be renewed before it expires (as configured by `spec.renewBefore`).", + properties: { + apiVersion: { + description: "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", + type: "string" + }, + kind: { + description: "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + type: "string" + }, + metadata: { + type: "object" + }, + spec: { + description: "Specification of the desired state of the Certificate resource.\nhttps://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status", + properties: { + additionalOutputFormats: { + description: "Defines extra output formats of the private key and signed certificate chain\nto be written to this Certificate's target Secret.", + items: { + description: "CertificateAdditionalOutputFormat defines an additional output format of a\nCertificate resource. These contain supplementary data formats of the signed\ncertificate chain and paired private key.", + properties: { + type: { + description: "Type is the name of the format type that should be written to the\nCertificate's target Secret.", + enum: ["DER", "CombinedPEM"], + type: "string" + } + }, + required: ["type"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + commonName: { + description: "Requested common name X509 certificate subject attribute.\nMore info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.6\nNOTE: TLS clients will ignore this value when any subject alternative name is\nset (see https://tools.ietf.org/html/rfc6125#section-6.4.4).\n\nShould have a length of 64 characters or fewer to avoid generating invalid CSRs.\nCannot be set if the `literalSubject` field is set.", + type: "string" + }, + dnsNames: { + description: "Requested DNS subject alternative names.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + duration: { + description: "Requested 'duration' (i.e. lifetime) of the Certificate. Note that the\nissuer may choose to ignore the requested duration, just like any other\nrequested attribute.\n\nIf unset, this defaults to 90 days.\nMinimum accepted duration is 1 hour.\nValue must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration.", + type: "string" + }, + emailAddresses: { + description: "Requested email subject alternative names.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + encodeUsagesInRequest: { + description: "Whether the KeyUsage and ExtKeyUsage extensions should be set in the encoded CSR.\n\nThis option defaults to true, and should only be disabled if the target\nissuer does not support CSRs with these X509 KeyUsage/ ExtKeyUsage extensions.", + type: "boolean" + }, + ipAddresses: { + description: "Requested IP address subject alternative names.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + isCA: { + description: "Requested basic constraints isCA value.\nThe isCA value is used to set the `isCA` field on the created CertificateRequest\nresources. Note that the issuer may choose to ignore the requested isCA value, just\nlike any other requested attribute.\n\nIf true, this will automatically add the `cert sign` usage to the list\nof requested `usages`.", + type: "boolean" + }, + issuerRef: { + description: "Reference to the issuer responsible for issuing the certificate.\nIf the issuer is namespace-scoped, it must be in the same namespace\nas the Certificate. If the issuer is cluster-scoped, it can be used\nfrom any namespace.\n\nThe `name` field of the reference must always be specified.", + properties: { + group: { + description: "Group of the issuer being referred to.\nDefaults to 'cert-manager.io'.", + type: "string" + }, + kind: { + description: "Kind of the issuer being referred to.\nDefaults to 'Issuer'.", + type: "string" + }, + name: { + description: "Name of the issuer being referred to.", + type: "string" + } + }, + required: ["name"], + type: "object" + }, + keystores: { + description: "Additional keystore output formats to be stored in the Certificate's Secret.", + properties: { + jks: { + description: "JKS configures options for storing a JKS keystore in the\n`spec.secretName` Secret resource.", + properties: { + alias: { + description: "Alias specifies the alias of the key in the keystore, required by the JKS format.\nIf not provided, the default alias `certificate` will be used.", + type: "string" + }, + create: { + description: "Create enables JKS keystore creation for the Certificate.\nIf true, a file named `keystore.jks` will be created in the target\nSecret resource, encrypted using the password stored in\n`passwordSecretRef` or `password`.\nThe keystore file will be updated immediately.\nIf the issuer provided a CA certificate, a file named `truststore.jks`\nwill also be created in the target Secret resource, encrypted using the\npassword stored in `passwordSecretRef`\ncontaining the issuing Certificate Authority", + type: "boolean" + }, + password: { + description: "Password provides a literal password used to encrypt the JKS keystore.\nMutually exclusive with passwordSecretRef.\nOne of password or passwordSecretRef must provide a password with a non-zero length.", + type: "string" + }, + passwordSecretRef: { + description: "PasswordSecretRef is a reference to a non-empty key in a Secret resource\ncontaining the password used to encrypt the JKS keystore.\nMutually exclusive with password.\nOne of password or passwordSecretRef must provide a password with a non-zero length.", + properties: { + key: { + description: "The key of the entry in the Secret resource's `data` field to be used.\nSome instances of this field may be defaulted, in others it may be\nrequired.", + type: "string" + }, + name: { + description: "Name of the resource being referred to.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + } + }, + required: ["name"], + type: "object" + } + }, + required: ["create"], + type: "object" + }, + pkcs12: { + description: "PKCS12 configures options for storing a PKCS12 keystore in the\n`spec.secretName` Secret resource.", + properties: { + create: { + description: "Create enables PKCS12 keystore creation for the Certificate.\nIf true, a file named `keystore.p12` will be created in the target\nSecret resource, encrypted using the password stored in\n`passwordSecretRef` or in `password`.\nThe keystore file will be updated immediately.\nIf the issuer provided a CA certificate, a file named `truststore.p12` will\nalso be created in the target Secret resource, encrypted using the\npassword stored in `passwordSecretRef` containing the issuing Certificate\nAuthority", + type: "boolean" + }, + password: { + description: "Password provides a literal password used to encrypt the PKCS#12 keystore.\nMutually exclusive with passwordSecretRef.\nOne of password or passwordSecretRef must provide a password with a non-zero length.", + type: "string" + }, + passwordSecretRef: { + description: "PasswordSecretRef is a reference to a non-empty key in a Secret resource\ncontaining the password used to encrypt the PKCS#12 keystore.\nMutually exclusive with password.\nOne of password or passwordSecretRef must provide a password with a non-zero length.", + properties: { + key: { + description: "The key of the entry in the Secret resource's `data` field to be used.\nSome instances of this field may be defaulted, in others it may be\nrequired.", + type: "string" + }, + name: { + description: "Name of the resource being referred to.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", type: "string" } }, - type: "object" + required: ["name"], + type: "object" + }, + profile: { + description: "Profile specifies the key and certificate encryption algorithms and the HMAC algorithm\nused to create the PKCS12 keystore. Default value is `LegacyRC2` for backward compatibility.\n\nIf provided, allowed values are:\n`LegacyRC2`: Deprecated. Not supported by default in OpenSSL 3 or Java 20.\n`LegacyDES`: Less secure algorithm. Use this option for maximal compatibility.\n`Modern2023`: Secure algorithm. Use this option in case you have to always use secure algorithms\n(e.g., because of company policy). Please note that the security of the algorithm is not that important\nin reality, because the unencrypted certificate and private key are also stored in the Secret.\n`Modern2026`: Encodes PKCS#12 files using algorithms that are considered modern as of 2026.\nPrivate keys and certificates are encrypted using PBES2 with PBKDF2-HMAC-SHA-256 and AES-256-CBC.\nThe MAC algorithm is PBMAC1 with PBKDF2-HMAC-SHA-256 and HMAC-SHA256.\nFiles produced with this profile can be read by OpenSSL 3.4.0 and higher, Java 26 and higher,\nor with Java using compatible versions of Bouncy Castle. Meets FIPS 140-3 requirements.", + enum: ["LegacyRC2", "LegacyDES", "Modern2023", "Modern2026"], + type: "string" + } + }, + required: ["create"], + type: "object" + } + }, + type: "object" + }, + literalSubject: { + description: "Requested X.509 certificate subject, represented using the LDAP \"String\nRepresentation of a Distinguished Name\" [1].\nImportant: the LDAP string format also specifies the order of the attributes\nin the subject, this is important when issuing certs for LDAP authentication.\nExample: `CN=foo,DC=corp,DC=example,DC=com`\nMore info [1]: https://datatracker.ietf.org/doc/html/rfc4514\nMore info: https://github.com/cert-manager/cert-manager/issues/3203\nMore info: https://github.com/cert-manager/cert-manager/issues/4424\n\nCannot be set if the `subject` or `commonName` field is set.", + type: "string" + }, + nameConstraints: { + description: "x.509 certificate NameConstraint extension which MUST NOT be used in a non-CA certificate.\nMore Info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.10\n\nThis is an Alpha Feature and is only enabled with the\n`--feature-gates=NameConstraints=true` option set on both\nthe controller and webhook components.", + properties: { + critical: { + description: "if true then the name constraints are marked critical.", + type: "boolean" + }, + excluded: { + description: "Excluded contains the constraints which must be disallowed. Any name matching a\nrestriction in the excluded field is invalid regardless\nof information appearing in the permitted", + properties: { + dnsDomains: { + description: "DNSDomains is a list of DNS domains that are permitted or excluded.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + emailAddresses: { + description: "EmailAddresses is a list of Email Addresses that are permitted or excluded.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + ipRanges: { + description: "IPRanges is a list of IP Ranges that are permitted or excluded.\nThis should be a valid CIDR notation.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + uriDomains: { + description: "URIDomains is a list of URI domains that are permitted or excluded.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" } }, type: "object" }, - selector: { - description: "Selector selects a set of DNSNames on the Certificate resource that\nshould be solved using this challenge solver.\nIf not specified, the solver will be treated as the 'default' solver\nwith the lowest priority, i.e. if any other solver has a more specific\nmatch, it will be used instead.", + permitted: { + description: "Permitted contains the constraints in which the names must be located.", properties: { - dnsNames: { - description: "List of DNSNames that this solver will be used to solve.\nIf specified and a match is found, a dnsNames selector will take\nprecedence over a dnsZones selector.\nIf multiple solvers match with the same dnsNames value, the solver\nwith the most matching labels in matchLabels will be selected.\nIf neither has more matches, the solver defined earlier in the list\nwill be selected.", + dnsDomains: { + description: "DNSDomains is a list of DNS domains that are permitted or excluded.", items: { type: "string" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" }, - dnsZones: { - description: "List of DNSZones that this solver will be used to solve.\nThe most specific DNS zone match specified here will take precedence\nover other DNS zone matches, so a solver specifying sys.example.com\nwill be selected over one specifying example.com for the domain\nwww.sys.example.com.\nIf multiple solvers match with the same dnsZones value, the solver\nwith the most matching labels in matchLabels will be selected.\nIf neither has more matches, the solver defined earlier in the list\nwill be selected.", + emailAddresses: { + description: "EmailAddresses is a list of Email Addresses that are permitted or excluded.", items: { type: "string" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" }, - matchLabels: { - additionalProperties: { + ipRanges: { + description: "IPRanges is a list of IP Ranges that are permitted or excluded.\nThis should be a valid CIDR notation.", + items: { type: "string" }, - description: "A label selector that is used to refine the set of certificate's that\nthis challenge solver will apply to.", + type: "array", + "x-kubernetes-list-type": "atomic" + }, + uriDomains: { + description: "URIDomains is a list of URI domains that are permitted or excluded.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + } + }, + type: "object" + }, + otherNames: { + description: "`otherNames` is an escape hatch for SAN that allows any type. We currently restrict the support to string like otherNames, cf RFC 5280 p 37\nAny UTF8 String valued otherName can be passed with by setting the keys oid: x.x.x.x and UTF8Value: somevalue for `otherName`.\nMost commonly this would be UPN set with oid: 1.3.6.1.4.1.311.20.2.3\nYou should ensure that any OID passed is valid for the UTF8String type as we do not explicitly validate this.", + items: { + properties: { + oid: { + description: "OID is the object identifier for the otherName SAN.\nThe object identifier must be expressed as a dotted string, for\nexample, \"1.2.840.113556.1.4.221\".", + type: "string" + }, + utf8Value: { + description: "utf8Value is the string value of the otherName SAN.\nThe utf8Value accepts any valid UTF8 string to set as value for the otherName SAN.", + type: "string" + } + }, + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + privateKey: { + description: "Private key options. These include the key algorithm and size, the used\nencoding and the rotation policy.", + properties: { + algorithm: { + description: "Algorithm is the private key algorithm of the corresponding private key\nfor this certificate.\n\nIf provided, allowed values are either `RSA`, `ECDSA` or `Ed25519`.\nIf `algorithm` is specified and `size` is not provided,\nkey size of 2048 will be used for `RSA` key algorithm and\nkey size of 256 will be used for `ECDSA` key algorithm.\nkey size is ignored when using the `Ed25519` key algorithm.", + enum: ["RSA", "ECDSA", "Ed25519"], + type: "string" + }, + encoding: { + description: "The private key cryptography standards (PKCS) encoding for this\ncertificate's private key to be encoded in.\n\nIf provided, allowed values are `PKCS1` and `PKCS8` standing for PKCS#1\nand PKCS#8, respectively.\nDefaults to `PKCS1` if not specified.", + enum: ["PKCS1", "PKCS8"], + type: "string" + }, + rotationPolicy: { + description: "RotationPolicy controls how private keys should be regenerated when a\nre-issuance is being processed.\n\nIf set to `Never`, a private key will only be generated if one does not\nalready exist in the target `spec.secretName`. If one does exist but it\ndoes not have the correct algorithm or size, a warning will be raised\nto await user intervention.\nIf set to `Always`, a private key matching the specified requirements\nwill be generated whenever a re-issuance occurs.\nDefault is `Always`.\nThe default was changed from `Never` to `Always` in cert-manager >=v1.18.0.", + enum: ["Never", "Always"], + type: "string" + }, + size: { + description: "Size is the key bit size of the corresponding private key for this certificate.\n\nIf `algorithm` is set to `RSA`, valid values are `2048`, `4096` or `8192`,\nand will default to `2048` if not specified.\nIf `algorithm` is set to `ECDSA`, valid values are `256`, `384` or `521`,\nand will default to `256` if not specified.\nIf `algorithm` is set to `Ed25519`, Size is ignored.\nNo other values are allowed.", + type: "integer" + } + }, + type: "object" + }, + renewal: { + description: "`renewal` allows configuration of how your certificate is renewed. If the policy mentioned is\n`RenewBefore` then the controller respects `renewBefore` and `renewBeforePercentage`.", + properties: { + policy: { + description: "`policy` must be one of `Disabled`, `RenewBefore`.", + enum: ["RenewBefore", "Disabled"], + type: "string" + }, + windows: { + description: "`windows` mentions the behavior of when the renewal must happen.", + items: { + description: "CertificateRenewalWindows is the definition for renewal windows", + properties: { + cron: { + description: "`cron` is a cron compliant string to allow when the renewal should be allowed. Format is as shown below:\n* * * * *\n| | | | |\n| | | | day of the week (0–6) (Sunday to Saturday;\n| | | month (1–12) 7 is also Sunday on some systems)\n| | day of the month (1–31)\n| hour (0–23)\nminute (0–59)", + minLength: 1, + type: "string" + }, + timezone: { + description: "`timezone` is IANA compliant timezone. For example America/Denver.\nIf this field is not set, timezone is treated as UTC.", + minLength: 1, + type: "string" + }, + windowDuration: { + description: "`windowDuration` is how long the cron definition is active for.\nValue must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration.", + pattern: "^([0-9]+(\\.[0-9]+)?(s|m|h))+$", + type: "string" + } + }, + required: ["cron", "windowDuration"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + renewBefore: { + description: "How long before the currently issued certificate's expiry cert-manager should\nrenew the certificate. For example, if a certificate is valid for 60 minutes,\nand `renewBefore=10m`, cert-manager will begin to attempt to renew the certificate\n50 minutes after it was issued (i.e. when there are 10 minutes remaining until\nthe certificate is no longer valid).\n\nNOTE: The actual lifetime of the issued certificate is used to determine the\nrenewal time. If an issuer returns a certificate with a different lifetime than\nthe one requested, cert-manager will use the lifetime of the issued certificate.\n\nIf unset, this defaults to 1/3 of the issued certificate's lifetime.\nMinimum accepted value is 5 minutes.\nValue must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration.\nCannot be set if the `renewBeforePercentage` field is set.", + type: "string" + }, + renewBeforePercentage: { + description: "`renewBeforePercentage` is like `renewBefore`, except it is a relative percentage\nrather than an absolute duration. For example, if a certificate is valid for 60\nminutes, and `renewBeforePercentage=25`, cert-manager will begin to attempt to\nrenew the certificate 45 minutes after it was issued (i.e. when there are 15\nminutes (25%) remaining until the certificate is no longer valid).\n\nNOTE: The actual lifetime of the issued certificate is used to determine the\nrenewal time. If an issuer returns a certificate with a different lifetime than\nthe one requested, cert-manager will use the lifetime of the issued certificate.\n\nValue must be an integer in the range (0,100). The minimum effective\n`renewBefore` derived from the `renewBeforePercentage` and `duration` fields is 5\nminutes.\nCannot be set if the `renewBefore` field is set.", + format: "int32", + type: "integer" + }, + revisionHistoryLimit: { + description: "The maximum number of CertificateRequest revisions that are maintained in\nthe Certificate's history. Each revision represents a single `CertificateRequest`\ncreated by this Certificate, either when it was created, renewed, or Spec\nwas changed. Revisions will be removed by oldest first if the number of\nrevisions exceeds this number.\n\nIf set, revisionHistoryLimit must be a value of `1` or greater.\nDefault value is `1`.", + format: "int32", + type: "integer" + }, + secretName: { + description: "Name of the Secret resource that will be automatically created and\nmanaged by this Certificate resource. It will be populated with a\nprivate key and certificate, signed by the denoted issuer. The Secret\nresource lives in the same namespace as the Certificate resource.", + type: "string" + }, + secretTemplate: { + description: "Defines annotations and labels to be copied to the Certificate's Secret.\nLabels and annotations on the Secret will be changed as they appear on the\nSecretTemplate when added or removed. SecretTemplate annotations are added\nin conjunction with, and cannot overwrite, the base set of annotations\ncert-manager sets on the Certificate's Secret.", + properties: { + annotations: { + additionalProperties: { + type: "string" + }, + description: "Annotations is a key value map to be copied to the target Kubernetes Secret.", + type: "object" + }, + labels: { + additionalProperties: { + type: "string" + }, + description: "Labels is a key value map to be copied to the target Kubernetes Secret.", + type: "object" + } + }, + type: "object" + }, + signatureAlgorithm: { + description: "Signature algorithm to use.\nAllowed values for RSA keys: SHA256WithRSA, SHA384WithRSA, SHA512WithRSA.\nAllowed values for ECDSA keys: ECDSAWithSHA256, ECDSAWithSHA384, ECDSAWithSHA512.\nAllowed values for Ed25519 keys: PureEd25519.", + enum: ["SHA256WithRSA", "SHA384WithRSA", "SHA512WithRSA", "ECDSAWithSHA256", "ECDSAWithSHA384", "ECDSAWithSHA512", "PureEd25519"], + type: "string" + }, + subject: { + description: "Requested set of X509 certificate subject attributes.\nMore info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.6\n\nThe common name attribute is specified separately in the `commonName` field.\nCannot be set if the `literalSubject` field is set.", + properties: { + countries: { + description: "Countries to be used on the Certificate.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + localities: { + description: "Cities to be used on the Certificate.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + organizationalUnits: { + description: "Organizational Units to be used on the Certificate.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + organizations: { + description: "Organizations to be used on the Certificate.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + postalCodes: { + description: "Postal codes to be used on the Certificate.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + provinces: { + description: "State/Provinces to be used on the Certificate.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + serialNumber: { + description: "Serial number to be used on the Certificate.", + type: "string" + }, + streetAddresses: { + description: "Street addresses to be used on the Certificate.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + uris: { + description: "Requested URI subject alternative names.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + usages: { + description: "Requested key usages and extended key usages.\nThese usages are used to set the `usages` field on the created CertificateRequest\nresources. If `encodeUsagesInRequest` is unset or set to `true`, the usages\nwill additionally be encoded in the `request` field which contains the CSR blob.\n\nIf unset, defaults to `digital signature` and `key encipherment`.", + items: { + description: "KeyUsage specifies valid usage contexts for keys.\nSee:\nhttps://tools.ietf.org/html/rfc5280#section-4.2.1.3\nhttps://tools.ietf.org/html/rfc5280#section-4.2.1.12\n\nValid KeyUsage values are as follows:\n\"signing\",\n\"digital signature\",\n\"content commitment\",\n\"key encipherment\",\n\"key agreement\",\n\"data encipherment\",\n\"cert sign\",\n\"crl sign\",\n\"encipher only\",\n\"decipher only\",\n\"any\",\n\"server auth\",\n\"client auth\",\n\"code signing\",\n\"email protection\",\n\"s/mime\",\n\"ipsec end system\",\n\"ipsec tunnel\",\n\"ipsec user\",\n\"timestamping\",\n\"ocsp signing\",\n\"microsoft sgc\",\n\"netscape sgc\"", + enum: ["signing", "digital signature", "content commitment", "key encipherment", "key agreement", "data encipherment", "cert sign", "crl sign", "encipher only", "decipher only", "any", "server auth", "client auth", "code signing", "email protection", "s/mime", "ipsec end system", "ipsec tunnel", "ipsec user", "timestamping", "ocsp signing", "microsoft sgc", "netscape sgc"], + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + required: ["issuerRef", "secretName"], + type: "object" + }, + status: { + description: "Status of the Certificate.\nThis is set and managed automatically.\nRead-only.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status", + properties: { + acme: { + description: "ACME stores information that is fetched from the ACME CA server.", + properties: { + ari: { + description: "ARI stores the ACME Renewal Information that is fetched from the ACME server\nin accordance with RFC 9773. This is only populated if the ARI feature gate is enabled.", + properties: { + explanationURL: { + description: "ExplanationURL is a human-readable URL that may explain why the suggested window\nhas its current value.", + type: "string" + }, + lastChecked: { + description: "LastChecked is the time at which the ACME server was last checked for renewal information.", + format: "date-time", + type: "string" + }, + lastError: { + description: "LastError is the last error encountered when checking the ACME server for renewal information, if any.", + type: "string" + }, + nextCheck: { + description: "NextCheck is the time at which the ACME server will next be checked for renewal information.", + format: "date-time", + type: "string" + }, + suggestedWindow: { + description: "SuggestedWindow is the suggested renewal window as returned by the ACME server in accordance with RFC 9773.", + properties: { + end: { + description: "End is the end of the suggested renewal window.", + format: "date-time", + type: "string" + }, + start: { + description: "Start is the start of the suggested renewal window.", + format: "date-time", + type: "string" + } + }, + required: ["end", "start"], type: "object" } }, - type: "object" - } + type: "object" + } + }, + type: "object" + }, + conditions: { + description: "List of status conditions to indicate the status of certificates.\nKnown condition types are `Ready` and `Issuing`.", + items: { + description: "CertificateCondition contains condition information for a Certificate.", + properties: { + lastTransitionTime: { + description: "LastTransitionTime is the timestamp corresponding to the last status\nchange of this condition.", + format: "date-time", + type: "string" + }, + message: { + description: "Message is a human readable description of the details of the last\ntransition, complementing reason.", + type: "string" + }, + observedGeneration: { + description: "If set, this represents the .metadata.generation that the condition was\nset based upon.\nFor instance, if .metadata.generation is currently 12, but the\n.status.condition[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the Certificate.", + format: "int64", + type: "integer" + }, + reason: { + description: "Reason is a brief machine readable explanation for the condition's last\ntransition.", + type: "string" + }, + status: { + description: "Status of the condition, one of (`True`, `False`, `Unknown`).", + enum: ["True", "False", "Unknown"], + type: "string" + }, + type: { + description: "Type of the condition, known values are (`Ready`, `Issuing`).", + type: "string" + } + }, + required: ["status", "type"], + type: "object" }, - type: "object" + type: "array", + "x-kubernetes-list-map-keys": ["type"], + "x-kubernetes-list-type": "map" }, - token: { - description: "The ACME challenge token for this challenge.\nThis is the raw value returned from the ACME server.", - type: "string" + failedIssuanceAttempts: { + description: "The number of continuous failed issuance attempts up till now. This\nfield gets removed (if set) on a successful issuance and gets set to\n1 if unset and an issuance has failed. If an issuance has failed, the\ndelay till the next issuance will be calculated using formula\ntime.Hour * 2 ^ (failedIssuanceAttempts - 1).", + type: "integer" }, - type: { - description: "The type of ACME challenge this resource represents.\nOne of \"HTTP-01\" or \"DNS-01\".", - enum: ["HTTP-01", "DNS-01"], + lastFailureTime: { + description: "LastFailureTime is set only if the latest issuance for this\nCertificate failed and contains the time of the failure. If an\nissuance has failed, the delay till the next issuance will be\ncalculated using formula time.Hour * 2 ^ (failedIssuanceAttempts -\n1). If the latest issuance has succeeded this field will be unset.", + format: "date-time", type: "string" }, - url: { - description: "The URL of the ACME Challenge resource for this challenge.\nThis can be used to lookup details about the status of this challenge.", + nextPrivateKeySecretName: { + description: "The name of the Secret resource containing the private key to be used\nfor the next certificate iteration.\nThe keymanager controller will automatically set this field if the\n`Issuing` condition is set to `True`.\nIt will automatically unset this field when the Issuing condition is\nnot set or False.", type: "string" }, - wildcard: { - description: "wildcard will be true if this challenge is for a wildcard identifier,\nfor example '*.example.com'.", - type: "boolean" - } - }, - required: ["authorizationURL", "dnsName", "issuerRef", "key", "solver", "token", "type", "url"], - type: "object" - }, - status: { - properties: { - presented: { - description: "presented will be set to true if the challenge values for this challenge\nare currently 'presented'.\nThis *does not* imply the self check is passing. Only that the values\nhave been 'submitted' for the appropriate challenge mechanism (i.e. the\nDNS01 TXT record has been presented, or the HTTP01 configuration has been\nconfigured).", - type: "boolean" - }, - processing: { - description: "Used to denote whether this challenge should be processed or not.\nThis field will only be set to true by the 'scheduling' component.\nIt will only be set to false by the 'challenges' controller, after the\nchallenge has reached a final state or timed out.\nIf this field is set to false, the challenge controller will not take\nany more action.", - type: "boolean" + notAfter: { + description: "The expiration time of the certificate stored in the secret named\nby this resource in `spec.secretName`.", + format: "date-time", + type: "string" }, - reason: { - description: "Contains human readable information on why the Challenge is in the\ncurrent state.", + notBefore: { + description: "The time after which the certificate stored in the secret named\nby this resource in `spec.secretName` is valid.", + format: "date-time", type: "string" }, - state: { - description: "Contains the current 'state' of the challenge.\nIf not set, the state of the challenge is unknown.", - enum: ["valid", "ready", "pending", "processing", "invalid", "expired", "errored"], + renewalTime: { + description: "RenewalTime is the time at which the certificate will be next\nrenewed.\nIf not set, no upcoming renewal is scheduled.", + format: "date-time", type: "string" + }, + revision: { + description: "The current 'revision' of the certificate as issued.\n\nWhen a CertificateRequest resource is created, it will have the\n`cert-manager.io/certificate-revision` set to one greater than the\ncurrent value of this field.\n\nUpon issuance, this field will be set to the value of the annotation\non the CertificateRequest resource used to issue the certificate.\n\nPersisting the value on the CertificateRequest resource allows the\ncertificates controller to know whether a request is part of an old\nissuance or if it is part of the ongoing revision's issuance by\nchecking if the revision value in the annotation is greater than this\nfield.", + type: "integer" } }, type: "object" } }, - required: ["metadata", "spec"], type: "object" } }, + selectableFields: [{ + jsonPath: ".spec.issuerRef.group" + }, { + jsonPath: ".spec.issuerRef.kind" + }, { + jsonPath: ".spec.issuerRef.name" + }], served: true, storage: true, subresources: { @@ -3299,7 +3765,7 @@ export const CustomResourceDefinition_ChallengesAcmeCertManagerIo: Apiextensions }] } }; -export const CustomResourceDefinition_ClusterissuersCertManagerIo: ApiextensionsK8sIoV1CustomResourceDefinition = { +export const CustomResourceDefinition_ClusterissuersCertManagerIo: KubernetesResource = { apiVersion: "apiextensions.k8s.io/v1", kind: "CustomResourceDefinition", metadata: { @@ -3308,11 +3774,12 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: Apiextensions }, labels: { app: "cert-manager", + "app.kubernetes.io/component": "crds", "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "cert-manager", - "app.kubernetes.io/version": "v1.17.0", - "helm.sh/chart": "cert-manager-v1.17.0" + "app.kubernetes.io/version": "v1.21.1", + "helm.sh/chart": "cert-manager-v1.21.1" }, name: "clusterissuers.cert-manager.io" }, @@ -3323,16 +3790,17 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: Apiextensions kind: "ClusterIssuer", listKind: "ClusterIssuerList", plural: "clusterissuers", + shortNames: ["ciss"], singular: "clusterissuer" }, scope: "Cluster", versions: [{ additionalPrinterColumns: [{ - jsonPath: ".status.conditions[?(@.type==\"Ready\")].status", + jsonPath: ".status.conditions[?(@.type == \"Ready\")].status", name: "Ready", type: "string" }, { - jsonPath: ".status.conditions[?(@.type==\"Ready\")].message", + jsonPath: ".status.conditions[?(@.type == \"Ready\")].message", name: "Status", priority: 1, type: "string" @@ -3413,7 +3881,7 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: Apiextensions type: "object" }, preferredChain: { - description: "PreferredChain is the chain to use if the ACME server outputs multiple.\nPreferredChain is no guarantee that this one gets delivered by the ACME\nendpoint.\nFor example, for Let's Encrypt's DST crosssign you would use:\n\"DST Root CA X3\" or \"ISRG Root X1\" for the newer Let's Encrypt root CA.\nThis value picks the first certificate bundle in the combined set of\nACME default and alternative chains that has a root-most certificate with\nthis value as its issuer's commonname.", + description: "PreferredChain is the chain to use if the ACME server outputs multiple.\nPreferredChain is no guarantee that this one gets delivered by the ACME\nendpoint.\nFor example, for Let's Encrypt's DST cross-sign you would use:\n\"DST Root CA X3\" or \"ISRG Root X1\" for the newer Let's Encrypt root CA.\nThis value picks the first certificate bundle in the combined set of\nACME default and alternative chains that has a root-most certificate with\nthis value as its issuer's commonname.", maxLength: 64, type: "string" }, @@ -3432,6 +3900,10 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: Apiextensions required: ["name"], type: "object" }, + profile: { + description: "Profile allows requesting a certificate profile from the ACME server.\nSupported profiles are listed by the server's ACME directory URL.", + type: "string" + }, server: { description: "Server is the URL used to access the ACME server's 'directory' endpoint.\nFor example, for Let's Encrypt's staging endpoint, you would use:\n\"https://acme-staging-v02.api.letsencrypt.org/directory\".\nOnly ACME v2 endpoints (i.e. RFC 8555) are supported.", type: "string" @@ -3563,15 +4035,15 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: Apiextensions description: "Auth: Azure Workload Identity or Azure Managed Service Identity:\nSettings to enable Azure Workload Identity or Azure Managed Service Identity\nIf set, ClientID, ClientSecret and TenantID must not be set.", properties: { clientID: { - description: "client ID of the managed identity, can not be used at the same time as resourceID", + description: "client ID of the managed identity, cannot be used at the same time as resourceID", type: "string" }, resourceID: { - description: "resource ID of the managed identity, can not be used at the same time as clientID\nCannot be used for Azure Managed Service Identity", + description: "resource ID of the managed identity, cannot be used at the same time as clientID\nCannot be used for Azure Managed Service Identity", type: "string" }, tenantID: { - description: "tenant ID of the managed identity, can not be used at the same time as resourceID", + description: "tenant ID of the managed identity, cannot be used at the same time as resourceID", type: "string" } }, @@ -3588,6 +4060,11 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: Apiextensions tenantID: { description: "Auth: Azure Service Principal:\nThe TenantID of the Azure Service Principal used to authenticate with Azure DNS.\nIf set, ClientID and ClientSecret must also be set.", type: "string" + }, + zoneType: { + description: "ZoneType determines which type of Azure DNS zone to use.\n\nValid values are:\n - AzurePublicZone (default): Use a public Azure DNS zone.\n - AzurePrivateZone: Use an Azure Private DNS zone.\n\nIf not specified, AzurePublicZone is used.\n\nSupport for Azure Private DNS zones is currently\nexperimental and may change in future releases.", + enum: ["AzurePublicZone", "AzurePrivateZone"], + type: "string" } }, required: ["resourceGroupName", "subscriptionID"], @@ -3693,7 +4170,12 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: Apiextensions description: "Use RFC2136 (\"Dynamic Updates in the Domain Name System\") (https://datatracker.ietf.org/doc/rfc2136/)\nto manage DNS01 challenge records.", properties: { nameserver: { - description: "The IP address or hostname of an authoritative DNS server supporting\nRFC2136 in the form host:port. If the host is an IPv6 address it must be\nenclosed in square brackets (e.g [2001:db8::1])\xA0; port is optional.\nThis field is required.", + description: "The IP address or hostname of an authoritative DNS server supporting\nRFC2136 in the form host:port. If the host is an IPv6 address it must be\nenclosed in square brackets (e.g [2001:db8::1]); port is optional.\nThis field is required.", + type: "string" + }, + protocol: { + description: "Protocol to use for dynamic DNS update queries. Valid values are (case-sensitive) ``TCP`` and ``UDP``; ``UDP`` (default).", + enum: ["TCP", "UDP"], type: "string" }, tsigAlgorithm: { @@ -3727,11 +4209,11 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: Apiextensions description: "Use the AWS Route53 API to manage DNS01 challenge records.", properties: { accessKeyID: { - description: "The AccessKeyID is used for authentication.\nCannot be set when SecretAccessKeyID is set.\nIf neither the Access Key nor Key ID are set, we fall-back to using env\nvars, shared credentials file or AWS Instance metadata,\nsee: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials", + description: "The AccessKeyID is used for authentication.\nCannot be set when SecretAccessKeyID is set.\nIf neither the Access Key nor Key ID are set, we fall back to using env\nvars, shared credentials file, or AWS Instance metadata,\nsee: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials", type: "string" }, accessKeyIDSecretRef: { - description: "The SecretAccessKey is used for authentication. If set, pull the AWS\naccess key ID from a key within a Kubernetes Secret.\nCannot be set when AccessKeyID is set.\nIf neither the Access Key nor Key ID are set, we fall-back to using env\nvars, shared credentials file or AWS Instance metadata,\nsee: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials", + description: "The SecretAccessKey is used for authentication. If set, pull the AWS\naccess key ID from a key within a Kubernetes Secret.\nCannot be set when AccessKeyID is set.\nIf neither the Access Key nor Key ID are set, we fall back to using env\nvars, shared credentials file, or AWS Instance metadata,\nsee: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials", properties: { key: { description: "The key of the entry in the Secret resource's `data` field to be used.\nSome instances of this field may be defaulted, in others it may be\nrequired.", @@ -3759,7 +4241,8 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: Apiextensions items: { type: "string" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" }, name: { description: "Name of the ServiceAccount used to request a token.", @@ -3790,7 +4273,7 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: Apiextensions type: "string" }, secretAccessKeySecretRef: { - description: "The SecretAccessKey is used for authentication.\nIf neither the Access Key nor Key ID are set, we fall-back to using env\nvars, shared credentials file or AWS Instance metadata,\nsee: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials", + description: "The SecretAccessKey is used for authentication.\nIf neither the Access Key nor Key ID are set, we fall back to using env\nvars, shared credentials file, or AWS Instance metadata,\nsee: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials", properties: { key: { description: "The key of the entry in the Secret resource's `data` field to be used.\nSome instances of this field may be defaulted, in others it may be\nrequired.", @@ -3811,7 +4294,7 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: Apiextensions description: "Configure an external webhook based DNS01 challenge solver to manage\nDNS01 challenge records.", properties: { config: { - description: "Additional configuration that should be passed to the webhook apiserver\nwhen challenges are processed.\nThis can contain arbitrary JSON data.\nSecret values should not be specified in this stanza.\nIf secret values are needed (e.g. credentials for a DNS service), you\nshould use a SecretKeySelector to reference a Secret resource.\nFor details on the schema of this field, consult the webhook provider\nimplementation's documentation.", + description: "Additional configuration that should be passed to the webhook apiserver\nwhen challenges are processed.\nThis can contain arbitrary JSON data.\nSecret values should not be specified in this stanza.\nIf secret values are needed (e.g., credentials for a DNS service), you\nshould use a SecretKeySelector to reference a Secret resource.\nFor details on the schema of this field, consult the webhook provider\nimplementation's documentation.", "x-kubernetes-preserve-unknown-fields": true }, groupName: { @@ -3819,7 +4302,7 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: Apiextensions type: "string" }, solverName: { - description: "The name of the solver to use, as defined in the webhook provider\nimplementation.\nThis will typically be the name of the provider, e.g. 'cloudflare'.", + description: "The name of the solver to use, as defined in the webhook provider\nimplementation.\nThis will typically be the name of the provider, e.g., 'cloudflare'.", type: "string" } }, @@ -3830,7 +4313,7 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: Apiextensions type: "object" }, http01: { - description: "Configures cert-manager to attempt to complete authorizations by\nperforming the HTTP01 challenge flow.\nIt is not possible to obtain certificates for wildcard domain names\n(e.g. `*.example.com`) using the HTTP01 challenge mechanism.", + description: "Configures cert-manager to attempt to complete authorizations by\nperforming the HTTP01 challenge flow.\nIt is not possible to obtain certificates for wildcard domain names\n(e.g., `*.example.com`) using the HTTP01 challenge mechanism.", properties: { gatewayHTTPRoute: { description: "The Gateway API is a sig-network community API that models service networking\nin Kubernetes (https://gateway-api.sigs.k8s.io/). The Gateway solver will\ncreate HTTPRoutes with the specified labels in the same namespace as the challenge.\nThis solver is experimental, and fields / behaviour may change in the future.", @@ -3893,7 +4376,8 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: Apiextensions required: ["name"], type: "object" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" }, podTemplate: { description: "Optional pod template used to configure the ACME challenge solver pods\nused for HTTP01 challenges.", @@ -4140,7 +4624,7 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: Apiextensions "x-kubernetes-map-type": "atomic" }, matchLabelKeys: { - description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", + description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.", items: { type: "string" }, @@ -4148,7 +4632,7 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: Apiextensions "x-kubernetes-list-type": "atomic" }, mismatchLabelKeys: { - description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", + description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.", items: { type: "string" }, @@ -4273,7 +4757,7 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: Apiextensions "x-kubernetes-map-type": "atomic" }, matchLabelKeys: { - description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", + description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.", items: { type: "string" }, @@ -4281,7 +4765,7 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: Apiextensions "x-kubernetes-list-type": "atomic" }, mismatchLabelKeys: { - description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", + description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.", items: { type: "string" }, @@ -4356,7 +4840,7 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: Apiextensions description: "Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).", properties: { preferredDuringSchedulingIgnoredDuringExecution: { - description: "The scheduler will prefer to schedule pods to nodes that satisfy\nthe anti-affinity expressions specified by this field, but it may choose\na node that violates one or more of the expressions. The node that is\nmost preferred is the one with the greatest sum of weights, i.e.\nfor each node that meets all of the scheduling requirements (resource\nrequest, requiredDuringScheduling anti-affinity expressions, etc.),\ncompute a sum by iterating through the elements of this field and adding\n\"weight\" to the sum if the node has pods which matches the corresponding podAffinityTerm; the\nnode(s) with the highest sum are the most preferred.", + description: "The scheduler will prefer to schedule pods to nodes that satisfy\nthe anti-affinity expressions specified by this field, but it may choose\na node that violates one or more of the expressions. The node that is\nmost preferred is the one with the greatest sum of weights, i.e.\nfor each node that meets all of the scheduling requirements (resource\nrequest, requiredDuringScheduling anti-affinity expressions, etc.),\ncompute a sum by iterating through the elements of this field and subtracting\n\"weight\" from the sum if the node has pods which matches the corresponding podAffinityTerm; the\nnode(s) with the highest sum are the most preferred.", items: { description: "The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)", properties: { @@ -4406,7 +4890,7 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: Apiextensions "x-kubernetes-map-type": "atomic" }, matchLabelKeys: { - description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", + description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.", items: { type: "string" }, @@ -4414,7 +4898,7 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: Apiextensions "x-kubernetes-list-type": "atomic" }, mismatchLabelKeys: { - description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", + description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.", items: { type: "string" }, @@ -4539,7 +5023,7 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: Apiextensions "x-kubernetes-map-type": "atomic" }, matchLabelKeys: { - description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", + description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.", items: { type: "string" }, @@ -4547,7 +5031,7 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: Apiextensions "x-kubernetes-list-type": "atomic" }, mismatchLabelKeys: { - description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", + description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.", items: { type: "string" }, @@ -4635,7 +5119,9 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: Apiextensions type: "object", "x-kubernetes-map-type": "atomic" }, - type: "array" + type: "array", + "x-kubernetes-list-map-keys": ["name"], + "x-kubernetes-list-type": "map" }, nodeSelector: { additionalProperties: { @@ -4648,6 +5134,38 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: Apiextensions description: "If specified, the pod's priorityClassName.", type: "string" }, + resources: { + description: "If specified, the pod's resource requirements.\nThese values override the global resource configuration flags.\nNote that when only specifying resource limits, ensure they are greater than or equal\nto the corresponding global resource requests configured via controller flags\n(--acme-http01-solver-resource-request-cpu, --acme-http01-solver-resource-request-memory).\nKubernetes will reject pod creation if limits are lower than requests, causing challenge failures.", + properties: { + limits: { + additionalProperties: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + }, + description: "Limits describes the maximum amount of compute resources allowed.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + type: "object" + }, + requests: { + additionalProperties: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + }, + description: "Requests describes the minimum amount of compute resources required.\nIf Requests is omitted for a container, it defaults to Limits if that is explicitly specified,\notherwise to the global values configured via controller flags. Requests cannot exceed Limits.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + type: "object" + } + }, + type: "object" + }, securityContext: { description: "If specified, the pod's security context", properties: { @@ -4717,7 +5235,8 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: Apiextensions format: "int64", type: "integer" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" }, sysctls: { description: "Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported\nsysctls (by the container runtime) might fail to launch.\nNote that this field cannot be set when spec.os.name is windows.", @@ -4736,7 +5255,8 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: Apiextensions required: ["name", "value"], type: "object" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" } }, type: "object" @@ -4759,7 +5279,7 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: Apiextensions type: "string" }, operator: { - description: "Operator represents a key's relationship to the value.\nValid operators are Exists and Equal. Defaults to Equal.\nExists is equivalent to wildcard for value, so that a pod can\ntolerate all taints of a particular category.", + description: "Operator represents a key's relationship to the value.\nValid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.\nExists is equivalent to wildcard for value, so that a pod can\ntolerate all taints of a particular category.\nLt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).", type: "string" }, tolerationSeconds: { @@ -4774,7 +5294,8 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: Apiextensions }, type: "object" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" } }, type: "object" @@ -5075,7 +5596,7 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: Apiextensions "x-kubernetes-map-type": "atomic" }, matchLabelKeys: { - description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", + description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.", items: { type: "string" }, @@ -5083,7 +5604,7 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: Apiextensions "x-kubernetes-list-type": "atomic" }, mismatchLabelKeys: { - description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", + description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.", items: { type: "string" }, @@ -5208,7 +5729,7 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: Apiextensions "x-kubernetes-map-type": "atomic" }, matchLabelKeys: { - description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", + description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.", items: { type: "string" }, @@ -5216,7 +5737,7 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: Apiextensions "x-kubernetes-list-type": "atomic" }, mismatchLabelKeys: { - description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", + description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.", items: { type: "string" }, @@ -5291,7 +5812,7 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: Apiextensions description: "Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).", properties: { preferredDuringSchedulingIgnoredDuringExecution: { - description: "The scheduler will prefer to schedule pods to nodes that satisfy\nthe anti-affinity expressions specified by this field, but it may choose\na node that violates one or more of the expressions. The node that is\nmost preferred is the one with the greatest sum of weights, i.e.\nfor each node that meets all of the scheduling requirements (resource\nrequest, requiredDuringScheduling anti-affinity expressions, etc.),\ncompute a sum by iterating through the elements of this field and adding\n\"weight\" to the sum if the node has pods which matches the corresponding podAffinityTerm; the\nnode(s) with the highest sum are the most preferred.", + description: "The scheduler will prefer to schedule pods to nodes that satisfy\nthe anti-affinity expressions specified by this field, but it may choose\na node that violates one or more of the expressions. The node that is\nmost preferred is the one with the greatest sum of weights, i.e.\nfor each node that meets all of the scheduling requirements (resource\nrequest, requiredDuringScheduling anti-affinity expressions, etc.),\ncompute a sum by iterating through the elements of this field and subtracting\n\"weight\" from the sum if the node has pods which matches the corresponding podAffinityTerm; the\nnode(s) with the highest sum are the most preferred.", items: { description: "The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)", properties: { @@ -5341,7 +5862,7 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: Apiextensions "x-kubernetes-map-type": "atomic" }, matchLabelKeys: { - description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", + description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.", items: { type: "string" }, @@ -5349,7 +5870,7 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: Apiextensions "x-kubernetes-list-type": "atomic" }, mismatchLabelKeys: { - description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", + description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.", items: { type: "string" }, @@ -5474,7 +5995,7 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: Apiextensions "x-kubernetes-map-type": "atomic" }, matchLabelKeys: { - description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", + description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.", items: { type: "string" }, @@ -5482,7 +6003,7 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: Apiextensions "x-kubernetes-list-type": "atomic" }, mismatchLabelKeys: { - description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", + description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.", items: { type: "string" }, @@ -5570,7 +6091,9 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: Apiextensions type: "object", "x-kubernetes-map-type": "atomic" }, - type: "array" + type: "array", + "x-kubernetes-list-map-keys": ["name"], + "x-kubernetes-list-type": "map" }, nodeSelector: { additionalProperties: { @@ -5583,6 +6106,38 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: Apiextensions description: "If specified, the pod's priorityClassName.", type: "string" }, + resources: { + description: "If specified, the pod's resource requirements.\nThese values override the global resource configuration flags.\nNote that when only specifying resource limits, ensure they are greater than or equal\nto the corresponding global resource requests configured via controller flags\n(--acme-http01-solver-resource-request-cpu, --acme-http01-solver-resource-request-memory).\nKubernetes will reject pod creation if limits are lower than requests, causing challenge failures.", + properties: { + limits: { + additionalProperties: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + }, + description: "Limits describes the maximum amount of compute resources allowed.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + type: "object" + }, + requests: { + additionalProperties: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + }, + description: "Requests describes the minimum amount of compute resources required.\nIf Requests is omitted for a container, it defaults to Limits if that is explicitly specified,\notherwise to the global values configured via controller flags. Requests cannot exceed Limits.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + type: "object" + } + }, + type: "object" + }, securityContext: { description: "If specified, the pod's security context", properties: { @@ -5652,7 +6207,8 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: Apiextensions format: "int64", type: "integer" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" }, sysctls: { description: "Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported\nsysctls (by the container runtime) might fail to launch.\nNote that this field cannot be set when spec.os.name is windows.", @@ -5671,7 +6227,8 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: Apiextensions required: ["name", "value"], type: "object" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" } }, type: "object" @@ -5694,7 +6251,7 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: Apiextensions type: "string" }, operator: { - description: "Operator represents a key's relationship to the value.\nValid operators are Exists and Equal. Defaults to Equal.\nExists is equivalent to wildcard for value, so that a pod can\ntolerate all taints of a particular category.", + description: "Operator represents a key's relationship to the value.\nValid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.\nExists is equivalent to wildcard for value, so that a pod can\ntolerate all taints of a particular category.\nLt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).", type: "string" }, tolerationSeconds: { @@ -5709,7 +6266,8 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: Apiextensions }, type: "object" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" } }, type: "object" @@ -5735,14 +6293,16 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: Apiextensions items: { type: "string" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" }, dnsZones: { description: "List of DNSZones that this solver will be used to solve.\nThe most specific DNS zone match specified here will take precedence\nover other DNS zone matches, so a solver specifying sys.example.com\nwill be selected over one specifying example.com for the domain\nwww.sys.example.com.\nIf multiple solvers match with the same dnsZones value, the solver\nwith the most matching labels in matchLabels will be selected.\nIf neither has more matches, the solver defined earlier in the list\nwill be selected.", items: { type: "string" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" }, matchLabels: { additionalProperties: { @@ -5753,11 +6313,16 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: Apiextensions } }, type: "object" + }, + waitInsteadOfSelfCheck: { + description: "WaitInsteadOfSelfCheck, if set, skips cert-manager's self-check and\ninstead waits this long after presentation before asking the ACME server\nto validate the challenge.\n\nThis is an advanced escape hatch for environments where cert-manager's\nself-check cannot succeed from its own network or DNS viewpoint even\nthough the ACME server can still validate successfully, for example due\nto split-horizon DNS or NAT hairpinning.\n\nA value of 0 skips the self-check and asks the ACME server to validate\nimmediately after presentation, relying on the ACME server's own\nvalidation retries (RFC 8555 section 8.2) to succeed once the challenge\nhas propagated. A negative duration is rejected.\nValue must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration,\nfor example `30s` or `2m`.", + type: "string" } }, type: "object" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" } }, required: ["privateKeySecretRef", "server"], @@ -5771,21 +6336,24 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: Apiextensions items: { type: "string" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" }, issuingCertificateURLs: { description: "IssuingCertificateURLs is a list of URLs which this issuer should embed into certificates\nit creates. See https://www.rfc-editor.org/rfc/rfc5280#section-4.2.2.1 for more details.\nAs an example, such a URL might be \"http://ca.domain.com/ca.crt\".", items: { type: "string" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" }, ocspServers: { description: "The OCSP server list is an X.509 v3 extension that defines a list of\nURLs of OCSP responders. The OCSP responders can be queried for the\nrevocation status of an issued certificate. If not set, the\ncertificate will be issued with no OCSP servers set. For example, an\nOCSP server URL could be \"http://ocsp.int-x3.letsencrypt.org\".", items: { type: "string" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" }, secretName: { description: "SecretName is the name of the secret used to sign Certificates issued\nby this Issuer.", @@ -5803,7 +6371,8 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: Apiextensions items: { type: "string" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" } }, type: "object" @@ -5844,6 +6413,53 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: Apiextensions required: ["path", "roleId", "secretRef"], type: "object" }, + aws: { + description: "AWS authenticates with Vault using AWS IAM authentication.\nThis allows authentication using IAM roles for service accounts (IRSA),\nEKS Pod Identity (PIA), or ambient credentials (EC2 instance profiles, ECS task role).", + properties: { + iamRoleArn: { + description: "The ARN of the AWS IAM role to assume using the Kubernetes service account\ntoken. Required when using IRSA (serviceAccountRef is set).\nThis role must have a trust policy that allows the OIDC provider to assume it.", + type: "string" + }, + mountPath: { + description: "The Vault mountPath here is the mount path to use when authenticating with\nVault. For example, setting a value to `/v1/auth/foo`, will use the path\n`/v1/auth/foo/login` to authenticate with Vault. If unspecified, the\ndefault value \"/v1/auth/aws\" will be used.", + type: "string" + }, + region: { + description: "The AWS region to use for authentication. If not specified, the region\nwill be determined from AWS_REGION or AWS_DEFAULT_REGION environment\nvariables, falling back to \"us-east-1\" if not set.", + type: "string" + }, + role: { + description: "A required field containing the Vault Role to assume when authenticating.", + minLength: 1, + type: "string" + }, + serviceAccountRef: { + description: "A reference to a service account that will be used to request a web identity\ntoken for IRSA (IAM Roles for Service Accounts) authentication.", + properties: { + audiences: { + description: "TokenAudiences is an optional list of extra audiences to include in the token passed to Vault.\nThe default audiences are always included in the token.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + name: { + description: "Name of the ServiceAccount used to request a token.", + type: "string" + } + }, + required: ["name"], + type: "object" + }, + vaultHeaderValue: { + description: "The Vault header value to include in the STS signing request.\nThis is used to prevent replay attacks.", + type: "string" + } + }, + required: ["role"], + type: "object" + }, clientCertificate: { description: "ClientCertificate authenticates with Vault by presenting a client\ncertificate during the request's TLS handshake.\nWorks only when using HTTPS protocol.", properties: { @@ -5892,11 +6508,12 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: Apiextensions description: "A reference to a service account that will be used to request a bound\ntoken (also known as \"projected token\"). Compared to using \"secretRef\",\nusing this field means that you don't rely on statically bound tokens. To\nuse this field, you must configure an RBAC rule to let cert-manager\nrequest a token.", properties: { audiences: { - description: "TokenAudiences is an optional list of extra audiences to include in the token passed to Vault. The default token\nconsisting of the issuer's namespace and name is always included.", + description: "TokenAudiences is an optional list of extra audiences to include in the token passed to Vault.\nThe default audiences are always included in the token.", items: { type: "string" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" }, name: { description: "Name of the ServiceAccount used to request a token.", @@ -5989,19 +6606,23 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: Apiextensions server: { description: "Server is the connection address for the Vault server, e.g: \"https://vault.example.com:8200\".", type: "string" + }, + serverName: { + description: "ServerName is used to verify the hostname on the returned certificates\nby the Vault server.", + type: "string" } }, required: ["auth", "path", "server"], type: "object" }, venafi: { - description: "Venafi configures this issuer to sign certificates using a Venafi TPP\nor Venafi Cloud policy zone.", + description: "Venafi configures this issuer to sign certificates using a CyberArk Certificate Manager Self-Hosted\nor SaaS policy zone.", properties: { cloud: { - description: "Cloud specifies the Venafi cloud configuration settings.\nOnly one of TPP or Cloud may be specified.", + description: "Cloud specifies the CyberArk Certificate Manager SaaS configuration settings.\nOnly one of CyberArk Certificate Manager may be specified.", properties: { apiTokenSecretRef: { - description: "APITokenSecretRef is a secret key selector for the Venafi Cloud API token.", + description: "APITokenSecretRef is a secret key selector for the CyberArk Certificate Manager SaaS API token.", properties: { key: { description: "The key of the entry in the Secret resource's `data` field to be used.\nSome instances of this field may be defaulted, in others it may be\nrequired.", @@ -6016,23 +6637,53 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: Apiextensions type: "object" }, url: { - description: "URL is the base URL for Venafi Cloud.\nDefaults to \"https://api.venafi.cloud/v1\".", + description: "URL is the base URL for CyberArk Certificate Manager SaaS.\nDefaults to \"https://api.venafi.cloud/\".", type: "string" } }, required: ["apiTokenSecretRef"], type: "object" }, + ngts: { + description: "NGTS specifies Palo Alto Networks Next Generation Trust Services (NGTS) configuration\nusing OAuth 2.0 Client Credentials. Only one of tpp, cloud, or ngts may be specified.", + properties: { + credentialsRef: { + description: "CredentialsRef is a reference to a Kubernetes Secret containing the OAuth 2.0\nClient ID and Client Secret. The secret must contain the keys 'client-id' and\n'client-secret'.", + properties: { + name: { + description: "Name of the resource being referred to.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + } + }, + required: ["name"], + type: "object" + }, + tokenEndpoint: { + description: "TokenEndpoint is the OAuth 2.0 token endpoint URL used to obtain access tokens,\nfor example \"https://auth.apps.paloaltonetworks.com/oauth2/access_token\".\nDefaults to \"https://auth.apps.paloaltonetworks.com/oauth2/access_token\" if not set.", + type: "string" + }, + tsgID: { + description: "TSGID is the Tenant Service Group ID used to scope the OAuth 2.0 access token,\nfor example \"1234567890\". The tsg_id: prefix is added automatically.\nThis field is required.", + type: "string" + }, + url: { + description: "URL is the base URL for the NGTS API endpoint.\nDefaults to \"https://api.strata.paloaltonetworks.com/ngts\" if not set.", + type: "string" + } + }, + required: ["credentialsRef", "tsgID"], + type: "object" + }, tpp: { - description: "TPP specifies Trust Protection Platform configuration settings.\nOnly one of TPP or Cloud may be specified.", + description: "TPP specifies CyberArk Certificate Manager Self-Hosted configuration settings.\nOnly one of CyberArk Certificate Manager may be specified.", properties: { caBundle: { - description: "Base64-encoded bundle of PEM CAs which will be used to validate the certificate\nchain presented by the TPP server. Only used if using HTTPS; ignored for HTTP.\nIf undefined, the certificate bundle in the cert-manager controller container\nis used to validate the chain.", + description: "Base64-encoded bundle of PEM CAs which will be used to validate the certificate\nchain presented by the CyberArk Certificate Manager Self-Hosted server. Only used if using HTTPS; ignored for HTTP.\nIf undefined, the certificate bundle in the cert-manager controller container\nis used to validate the chain.", format: "byte", type: "string" }, caBundleSecretRef: { - description: "Reference to a Secret containing a base64-encoded bundle of PEM CAs\nwhich will be used to validate the certificate chain presented by the TPP server.\nOnly used if using HTTPS; ignored for HTTP. Mutually exclusive with CABundle.\nIf neither CABundle nor CABundleSecretRef is defined, the certificate bundle in\nthe cert-manager controller container is used to validate the TLS connection.", + description: "Reference to a Secret containing a base64-encoded bundle of PEM CAs\nwhich will be used to validate the certificate chain presented by the CyberArk Certificate Manager Self-Hosted server.\nOnly used if using HTTPS; ignored for HTTP. Mutually exclusive with CABundle.\nIf neither CABundle nor CABundleSecretRef is defined, the certificate bundle in\nthe cert-manager controller container is used to validate the TLS connection.", properties: { key: { description: "The key of the entry in the Secret resource's `data` field to be used.\nSome instances of this field may be defaulted, in others it may be\nrequired.", @@ -6047,7 +6698,7 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: Apiextensions type: "object" }, credentialsRef: { - description: "CredentialsRef is a reference to a Secret containing the Venafi TPP API credentials.\nThe secret must contain the key 'access-token' for the Access Token Authentication,\nor two keys, 'username' and 'password' for the API Keys Authentication.", + description: "CredentialsRef is a reference to a Secret containing the CyberArk Certificate Manager Self-Hosted API credentials.\nThe secret must contain the key 'access-token' for the Access Token Authentication,\nor two keys, 'username' and 'password' for the API Keys Authentication.", properties: { name: { description: "Name of the resource being referred to.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", @@ -6058,7 +6709,7 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: Apiextensions type: "object" }, url: { - description: "URL is the base URL for the vedsdk endpoint of the Venafi TPP instance,\nfor example: \"https://tpp.example.com/vedsdk\".", + description: "URL is the base URL for the vedsdk endpoint of the CyberArk Certificate Manager Self-Hosted instance,\nfor example: \"https://tpp.example.com/vedsdk\".", type: "string" } }, @@ -6066,12 +6717,16 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: Apiextensions type: "object" }, zone: { - description: "Zone is the Venafi Policy Zone to use for this issuer.\nAll requests made to the Venafi platform will be restricted by the named\nzone policy.\nThis field is required.", + description: "Zone is the Certificate Manager Policy Zone to use for this issuer.\nAll requests made to the Certificate Manager platform will be restricted by the named\nzone policy.\nThis field is required.", type: "string" } }, required: ["zone"], - type: "object" + type: "object", + "x-kubernetes-validations": [{ + message: "exactly one of tpp, cloud, or ngts must be configured", + rule: "(has(self.tpp) ? 1 : 0) + (has(self.cloud) ? 1 : 0) + (has(self.ngts) ? 1 : 0) == 1" + }] } }, type: "object" @@ -6153,7 +6808,7 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: Apiextensions }] } }; -export const CustomResourceDefinition_IssuersCertManagerIo: ApiextensionsK8sIoV1CustomResourceDefinition = { +export const CustomResourceDefinition_IssuersCertManagerIo: KubernetesResource = { apiVersion: "apiextensions.k8s.io/v1", kind: "CustomResourceDefinition", metadata: { @@ -6166,8 +6821,8 @@ export const CustomResourceDefinition_IssuersCertManagerIo: ApiextensionsK8sIoV1 "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "cert-manager", - "app.kubernetes.io/version": "v1.17.0", - "helm.sh/chart": "cert-manager-v1.17.0" + "app.kubernetes.io/version": "v1.21.1", + "helm.sh/chart": "cert-manager-v1.21.1" }, name: "issuers.cert-manager.io" }, @@ -6178,16 +6833,17 @@ export const CustomResourceDefinition_IssuersCertManagerIo: ApiextensionsK8sIoV1 kind: "Issuer", listKind: "IssuerList", plural: "issuers", + shortNames: ["iss"], singular: "issuer" }, scope: "Namespaced", versions: [{ additionalPrinterColumns: [{ - jsonPath: ".status.conditions[?(@.type==\"Ready\")].status", + jsonPath: ".status.conditions[?(@.type == \"Ready\")].status", name: "Ready", type: "string" }, { - jsonPath: ".status.conditions[?(@.type==\"Ready\")].message", + jsonPath: ".status.conditions[?(@.type == \"Ready\")].message", name: "Status", priority: 1, type: "string" @@ -6268,7 +6924,7 @@ export const CustomResourceDefinition_IssuersCertManagerIo: ApiextensionsK8sIoV1 type: "object" }, preferredChain: { - description: "PreferredChain is the chain to use if the ACME server outputs multiple.\nPreferredChain is no guarantee that this one gets delivered by the ACME\nendpoint.\nFor example, for Let's Encrypt's DST crosssign you would use:\n\"DST Root CA X3\" or \"ISRG Root X1\" for the newer Let's Encrypt root CA.\nThis value picks the first certificate bundle in the combined set of\nACME default and alternative chains that has a root-most certificate with\nthis value as its issuer's commonname.", + description: "PreferredChain is the chain to use if the ACME server outputs multiple.\nPreferredChain is no guarantee that this one gets delivered by the ACME\nendpoint.\nFor example, for Let's Encrypt's DST cross-sign you would use:\n\"DST Root CA X3\" or \"ISRG Root X1\" for the newer Let's Encrypt root CA.\nThis value picks the first certificate bundle in the combined set of\nACME default and alternative chains that has a root-most certificate with\nthis value as its issuer's commonname.", maxLength: 64, type: "string" }, @@ -6287,6 +6943,10 @@ export const CustomResourceDefinition_IssuersCertManagerIo: ApiextensionsK8sIoV1 required: ["name"], type: "object" }, + profile: { + description: "Profile allows requesting a certificate profile from the ACME server.\nSupported profiles are listed by the server's ACME directory URL.", + type: "string" + }, server: { description: "Server is the URL used to access the ACME server's 'directory' endpoint.\nFor example, for Let's Encrypt's staging endpoint, you would use:\n\"https://acme-staging-v02.api.letsencrypt.org/directory\".\nOnly ACME v2 endpoints (i.e. RFC 8555) are supported.", type: "string" @@ -6418,15 +7078,15 @@ export const CustomResourceDefinition_IssuersCertManagerIo: ApiextensionsK8sIoV1 description: "Auth: Azure Workload Identity or Azure Managed Service Identity:\nSettings to enable Azure Workload Identity or Azure Managed Service Identity\nIf set, ClientID, ClientSecret and TenantID must not be set.", properties: { clientID: { - description: "client ID of the managed identity, can not be used at the same time as resourceID", + description: "client ID of the managed identity, cannot be used at the same time as resourceID", type: "string" }, resourceID: { - description: "resource ID of the managed identity, can not be used at the same time as clientID\nCannot be used for Azure Managed Service Identity", + description: "resource ID of the managed identity, cannot be used at the same time as clientID\nCannot be used for Azure Managed Service Identity", type: "string" }, tenantID: { - description: "tenant ID of the managed identity, can not be used at the same time as resourceID", + description: "tenant ID of the managed identity, cannot be used at the same time as resourceID", type: "string" } }, @@ -6443,6 +7103,11 @@ export const CustomResourceDefinition_IssuersCertManagerIo: ApiextensionsK8sIoV1 tenantID: { description: "Auth: Azure Service Principal:\nThe TenantID of the Azure Service Principal used to authenticate with Azure DNS.\nIf set, ClientID and ClientSecret must also be set.", type: "string" + }, + zoneType: { + description: "ZoneType determines which type of Azure DNS zone to use.\n\nValid values are:\n - AzurePublicZone (default): Use a public Azure DNS zone.\n - AzurePrivateZone: Use an Azure Private DNS zone.\n\nIf not specified, AzurePublicZone is used.\n\nSupport for Azure Private DNS zones is currently\nexperimental and may change in future releases.", + enum: ["AzurePublicZone", "AzurePrivateZone"], + type: "string" } }, required: ["resourceGroupName", "subscriptionID"], @@ -6548,7 +7213,12 @@ export const CustomResourceDefinition_IssuersCertManagerIo: ApiextensionsK8sIoV1 description: "Use RFC2136 (\"Dynamic Updates in the Domain Name System\") (https://datatracker.ietf.org/doc/rfc2136/)\nto manage DNS01 challenge records.", properties: { nameserver: { - description: "The IP address or hostname of an authoritative DNS server supporting\nRFC2136 in the form host:port. If the host is an IPv6 address it must be\nenclosed in square brackets (e.g [2001:db8::1])\xA0; port is optional.\nThis field is required.", + description: "The IP address or hostname of an authoritative DNS server supporting\nRFC2136 in the form host:port. If the host is an IPv6 address it must be\nenclosed in square brackets (e.g [2001:db8::1]); port is optional.\nThis field is required.", + type: "string" + }, + protocol: { + description: "Protocol to use for dynamic DNS update queries. Valid values are (case-sensitive) ``TCP`` and ``UDP``; ``UDP`` (default).", + enum: ["TCP", "UDP"], type: "string" }, tsigAlgorithm: { @@ -6582,11 +7252,11 @@ export const CustomResourceDefinition_IssuersCertManagerIo: ApiextensionsK8sIoV1 description: "Use the AWS Route53 API to manage DNS01 challenge records.", properties: { accessKeyID: { - description: "The AccessKeyID is used for authentication.\nCannot be set when SecretAccessKeyID is set.\nIf neither the Access Key nor Key ID are set, we fall-back to using env\nvars, shared credentials file or AWS Instance metadata,\nsee: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials", + description: "The AccessKeyID is used for authentication.\nCannot be set when SecretAccessKeyID is set.\nIf neither the Access Key nor Key ID are set, we fall back to using env\nvars, shared credentials file, or AWS Instance metadata,\nsee: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials", type: "string" }, accessKeyIDSecretRef: { - description: "The SecretAccessKey is used for authentication. If set, pull the AWS\naccess key ID from a key within a Kubernetes Secret.\nCannot be set when AccessKeyID is set.\nIf neither the Access Key nor Key ID are set, we fall-back to using env\nvars, shared credentials file or AWS Instance metadata,\nsee: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials", + description: "The SecretAccessKey is used for authentication. If set, pull the AWS\naccess key ID from a key within a Kubernetes Secret.\nCannot be set when AccessKeyID is set.\nIf neither the Access Key nor Key ID are set, we fall back to using env\nvars, shared credentials file, or AWS Instance metadata,\nsee: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials", properties: { key: { description: "The key of the entry in the Secret resource's `data` field to be used.\nSome instances of this field may be defaulted, in others it may be\nrequired.", @@ -6614,7 +7284,8 @@ export const CustomResourceDefinition_IssuersCertManagerIo: ApiextensionsK8sIoV1 items: { type: "string" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" }, name: { description: "Name of the ServiceAccount used to request a token.", @@ -6645,7 +7316,7 @@ export const CustomResourceDefinition_IssuersCertManagerIo: ApiextensionsK8sIoV1 type: "string" }, secretAccessKeySecretRef: { - description: "The SecretAccessKey is used for authentication.\nIf neither the Access Key nor Key ID are set, we fall-back to using env\nvars, shared credentials file or AWS Instance metadata,\nsee: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials", + description: "The SecretAccessKey is used for authentication.\nIf neither the Access Key nor Key ID are set, we fall back to using env\nvars, shared credentials file, or AWS Instance metadata,\nsee: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials", properties: { key: { description: "The key of the entry in the Secret resource's `data` field to be used.\nSome instances of this field may be defaulted, in others it may be\nrequired.", @@ -6666,7 +7337,7 @@ export const CustomResourceDefinition_IssuersCertManagerIo: ApiextensionsK8sIoV1 description: "Configure an external webhook based DNS01 challenge solver to manage\nDNS01 challenge records.", properties: { config: { - description: "Additional configuration that should be passed to the webhook apiserver\nwhen challenges are processed.\nThis can contain arbitrary JSON data.\nSecret values should not be specified in this stanza.\nIf secret values are needed (e.g. credentials for a DNS service), you\nshould use a SecretKeySelector to reference a Secret resource.\nFor details on the schema of this field, consult the webhook provider\nimplementation's documentation.", + description: "Additional configuration that should be passed to the webhook apiserver\nwhen challenges are processed.\nThis can contain arbitrary JSON data.\nSecret values should not be specified in this stanza.\nIf secret values are needed (e.g., credentials for a DNS service), you\nshould use a SecretKeySelector to reference a Secret resource.\nFor details on the schema of this field, consult the webhook provider\nimplementation's documentation.", "x-kubernetes-preserve-unknown-fields": true }, groupName: { @@ -6674,7 +7345,7 @@ export const CustomResourceDefinition_IssuersCertManagerIo: ApiextensionsK8sIoV1 type: "string" }, solverName: { - description: "The name of the solver to use, as defined in the webhook provider\nimplementation.\nThis will typically be the name of the provider, e.g. 'cloudflare'.", + description: "The name of the solver to use, as defined in the webhook provider\nimplementation.\nThis will typically be the name of the provider, e.g., 'cloudflare'.", type: "string" } }, @@ -6685,7 +7356,7 @@ export const CustomResourceDefinition_IssuersCertManagerIo: ApiextensionsK8sIoV1 type: "object" }, http01: { - description: "Configures cert-manager to attempt to complete authorizations by\nperforming the HTTP01 challenge flow.\nIt is not possible to obtain certificates for wildcard domain names\n(e.g. `*.example.com`) using the HTTP01 challenge mechanism.", + description: "Configures cert-manager to attempt to complete authorizations by\nperforming the HTTP01 challenge flow.\nIt is not possible to obtain certificates for wildcard domain names\n(e.g., `*.example.com`) using the HTTP01 challenge mechanism.", properties: { gatewayHTTPRoute: { description: "The Gateway API is a sig-network community API that models service networking\nin Kubernetes (https://gateway-api.sigs.k8s.io/). The Gateway solver will\ncreate HTTPRoutes with the specified labels in the same namespace as the challenge.\nThis solver is experimental, and fields / behaviour may change in the future.", @@ -6748,7 +7419,8 @@ export const CustomResourceDefinition_IssuersCertManagerIo: ApiextensionsK8sIoV1 required: ["name"], type: "object" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" }, podTemplate: { description: "Optional pod template used to configure the ACME challenge solver pods\nused for HTTP01 challenges.", @@ -6995,7 +7667,7 @@ export const CustomResourceDefinition_IssuersCertManagerIo: ApiextensionsK8sIoV1 "x-kubernetes-map-type": "atomic" }, matchLabelKeys: { - description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", + description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.", items: { type: "string" }, @@ -7003,7 +7675,7 @@ export const CustomResourceDefinition_IssuersCertManagerIo: ApiextensionsK8sIoV1 "x-kubernetes-list-type": "atomic" }, mismatchLabelKeys: { - description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", + description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.", items: { type: "string" }, @@ -7128,7 +7800,7 @@ export const CustomResourceDefinition_IssuersCertManagerIo: ApiextensionsK8sIoV1 "x-kubernetes-map-type": "atomic" }, matchLabelKeys: { - description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", + description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.", items: { type: "string" }, @@ -7136,7 +7808,7 @@ export const CustomResourceDefinition_IssuersCertManagerIo: ApiextensionsK8sIoV1 "x-kubernetes-list-type": "atomic" }, mismatchLabelKeys: { - description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", + description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.", items: { type: "string" }, @@ -7211,7 +7883,7 @@ export const CustomResourceDefinition_IssuersCertManagerIo: ApiextensionsK8sIoV1 description: "Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).", properties: { preferredDuringSchedulingIgnoredDuringExecution: { - description: "The scheduler will prefer to schedule pods to nodes that satisfy\nthe anti-affinity expressions specified by this field, but it may choose\na node that violates one or more of the expressions. The node that is\nmost preferred is the one with the greatest sum of weights, i.e.\nfor each node that meets all of the scheduling requirements (resource\nrequest, requiredDuringScheduling anti-affinity expressions, etc.),\ncompute a sum by iterating through the elements of this field and adding\n\"weight\" to the sum if the node has pods which matches the corresponding podAffinityTerm; the\nnode(s) with the highest sum are the most preferred.", + description: "The scheduler will prefer to schedule pods to nodes that satisfy\nthe anti-affinity expressions specified by this field, but it may choose\na node that violates one or more of the expressions. The node that is\nmost preferred is the one with the greatest sum of weights, i.e.\nfor each node that meets all of the scheduling requirements (resource\nrequest, requiredDuringScheduling anti-affinity expressions, etc.),\ncompute a sum by iterating through the elements of this field and subtracting\n\"weight\" from the sum if the node has pods which matches the corresponding podAffinityTerm; the\nnode(s) with the highest sum are the most preferred.", items: { description: "The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)", properties: { @@ -7261,7 +7933,7 @@ export const CustomResourceDefinition_IssuersCertManagerIo: ApiextensionsK8sIoV1 "x-kubernetes-map-type": "atomic" }, matchLabelKeys: { - description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", + description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.", items: { type: "string" }, @@ -7269,7 +7941,7 @@ export const CustomResourceDefinition_IssuersCertManagerIo: ApiextensionsK8sIoV1 "x-kubernetes-list-type": "atomic" }, mismatchLabelKeys: { - description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", + description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.", items: { type: "string" }, @@ -7394,7 +8066,7 @@ export const CustomResourceDefinition_IssuersCertManagerIo: ApiextensionsK8sIoV1 "x-kubernetes-map-type": "atomic" }, matchLabelKeys: { - description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", + description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.", items: { type: "string" }, @@ -7402,7 +8074,7 @@ export const CustomResourceDefinition_IssuersCertManagerIo: ApiextensionsK8sIoV1 "x-kubernetes-list-type": "atomic" }, mismatchLabelKeys: { - description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", + description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.", items: { type: "string" }, @@ -7490,7 +8162,9 @@ export const CustomResourceDefinition_IssuersCertManagerIo: ApiextensionsK8sIoV1 type: "object", "x-kubernetes-map-type": "atomic" }, - type: "array" + type: "array", + "x-kubernetes-list-map-keys": ["name"], + "x-kubernetes-list-type": "map" }, nodeSelector: { additionalProperties: { @@ -7503,6 +8177,38 @@ export const CustomResourceDefinition_IssuersCertManagerIo: ApiextensionsK8sIoV1 description: "If specified, the pod's priorityClassName.", type: "string" }, + resources: { + description: "If specified, the pod's resource requirements.\nThese values override the global resource configuration flags.\nNote that when only specifying resource limits, ensure they are greater than or equal\nto the corresponding global resource requests configured via controller flags\n(--acme-http01-solver-resource-request-cpu, --acme-http01-solver-resource-request-memory).\nKubernetes will reject pod creation if limits are lower than requests, causing challenge failures.", + properties: { + limits: { + additionalProperties: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + }, + description: "Limits describes the maximum amount of compute resources allowed.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + type: "object" + }, + requests: { + additionalProperties: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + }, + description: "Requests describes the minimum amount of compute resources required.\nIf Requests is omitted for a container, it defaults to Limits if that is explicitly specified,\notherwise to the global values configured via controller flags. Requests cannot exceed Limits.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + type: "object" + } + }, + type: "object" + }, securityContext: { description: "If specified, the pod's security context", properties: { @@ -7572,7 +8278,8 @@ export const CustomResourceDefinition_IssuersCertManagerIo: ApiextensionsK8sIoV1 format: "int64", type: "integer" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" }, sysctls: { description: "Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported\nsysctls (by the container runtime) might fail to launch.\nNote that this field cannot be set when spec.os.name is windows.", @@ -7591,7 +8298,8 @@ export const CustomResourceDefinition_IssuersCertManagerIo: ApiextensionsK8sIoV1 required: ["name", "value"], type: "object" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" } }, type: "object" @@ -7614,7 +8322,7 @@ export const CustomResourceDefinition_IssuersCertManagerIo: ApiextensionsK8sIoV1 type: "string" }, operator: { - description: "Operator represents a key's relationship to the value.\nValid operators are Exists and Equal. Defaults to Equal.\nExists is equivalent to wildcard for value, so that a pod can\ntolerate all taints of a particular category.", + description: "Operator represents a key's relationship to the value.\nValid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.\nExists is equivalent to wildcard for value, so that a pod can\ntolerate all taints of a particular category.\nLt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).", type: "string" }, tolerationSeconds: { @@ -7629,7 +8337,8 @@ export const CustomResourceDefinition_IssuersCertManagerIo: ApiextensionsK8sIoV1 }, type: "object" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" } }, type: "object" @@ -7930,7 +8639,7 @@ export const CustomResourceDefinition_IssuersCertManagerIo: ApiextensionsK8sIoV1 "x-kubernetes-map-type": "atomic" }, matchLabelKeys: { - description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", + description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.", items: { type: "string" }, @@ -7938,7 +8647,7 @@ export const CustomResourceDefinition_IssuersCertManagerIo: ApiextensionsK8sIoV1 "x-kubernetes-list-type": "atomic" }, mismatchLabelKeys: { - description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", + description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.", items: { type: "string" }, @@ -8063,7 +8772,7 @@ export const CustomResourceDefinition_IssuersCertManagerIo: ApiextensionsK8sIoV1 "x-kubernetes-map-type": "atomic" }, matchLabelKeys: { - description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", + description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.", items: { type: "string" }, @@ -8071,7 +8780,7 @@ export const CustomResourceDefinition_IssuersCertManagerIo: ApiextensionsK8sIoV1 "x-kubernetes-list-type": "atomic" }, mismatchLabelKeys: { - description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", + description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.", items: { type: "string" }, @@ -8146,7 +8855,7 @@ export const CustomResourceDefinition_IssuersCertManagerIo: ApiextensionsK8sIoV1 description: "Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).", properties: { preferredDuringSchedulingIgnoredDuringExecution: { - description: "The scheduler will prefer to schedule pods to nodes that satisfy\nthe anti-affinity expressions specified by this field, but it may choose\na node that violates one or more of the expressions. The node that is\nmost preferred is the one with the greatest sum of weights, i.e.\nfor each node that meets all of the scheduling requirements (resource\nrequest, requiredDuringScheduling anti-affinity expressions, etc.),\ncompute a sum by iterating through the elements of this field and adding\n\"weight\" to the sum if the node has pods which matches the corresponding podAffinityTerm; the\nnode(s) with the highest sum are the most preferred.", + description: "The scheduler will prefer to schedule pods to nodes that satisfy\nthe anti-affinity expressions specified by this field, but it may choose\na node that violates one or more of the expressions. The node that is\nmost preferred is the one with the greatest sum of weights, i.e.\nfor each node that meets all of the scheduling requirements (resource\nrequest, requiredDuringScheduling anti-affinity expressions, etc.),\ncompute a sum by iterating through the elements of this field and subtracting\n\"weight\" from the sum if the node has pods which matches the corresponding podAffinityTerm; the\nnode(s) with the highest sum are the most preferred.", items: { description: "The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)", properties: { @@ -8196,7 +8905,7 @@ export const CustomResourceDefinition_IssuersCertManagerIo: ApiextensionsK8sIoV1 "x-kubernetes-map-type": "atomic" }, matchLabelKeys: { - description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", + description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.", items: { type: "string" }, @@ -8204,7 +8913,7 @@ export const CustomResourceDefinition_IssuersCertManagerIo: ApiextensionsK8sIoV1 "x-kubernetes-list-type": "atomic" }, mismatchLabelKeys: { - description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", + description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.", items: { type: "string" }, @@ -8329,7 +9038,7 @@ export const CustomResourceDefinition_IssuersCertManagerIo: ApiextensionsK8sIoV1 "x-kubernetes-map-type": "atomic" }, matchLabelKeys: { - description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", + description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.", items: { type: "string" }, @@ -8337,7 +9046,7 @@ export const CustomResourceDefinition_IssuersCertManagerIo: ApiextensionsK8sIoV1 "x-kubernetes-list-type": "atomic" }, mismatchLabelKeys: { - description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", + description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.", items: { type: "string" }, @@ -8425,7 +9134,9 @@ export const CustomResourceDefinition_IssuersCertManagerIo: ApiextensionsK8sIoV1 type: "object", "x-kubernetes-map-type": "atomic" }, - type: "array" + type: "array", + "x-kubernetes-list-map-keys": ["name"], + "x-kubernetes-list-type": "map" }, nodeSelector: { additionalProperties: { @@ -8438,6 +9149,38 @@ export const CustomResourceDefinition_IssuersCertManagerIo: ApiextensionsK8sIoV1 description: "If specified, the pod's priorityClassName.", type: "string" }, + resources: { + description: "If specified, the pod's resource requirements.\nThese values override the global resource configuration flags.\nNote that when only specifying resource limits, ensure they are greater than or equal\nto the corresponding global resource requests configured via controller flags\n(--acme-http01-solver-resource-request-cpu, --acme-http01-solver-resource-request-memory).\nKubernetes will reject pod creation if limits are lower than requests, causing challenge failures.", + properties: { + limits: { + additionalProperties: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + }, + description: "Limits describes the maximum amount of compute resources allowed.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + type: "object" + }, + requests: { + additionalProperties: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + }, + description: "Requests describes the minimum amount of compute resources required.\nIf Requests is omitted for a container, it defaults to Limits if that is explicitly specified,\notherwise to the global values configured via controller flags. Requests cannot exceed Limits.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + type: "object" + } + }, + type: "object" + }, securityContext: { description: "If specified, the pod's security context", properties: { @@ -8507,7 +9250,8 @@ export const CustomResourceDefinition_IssuersCertManagerIo: ApiextensionsK8sIoV1 format: "int64", type: "integer" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" }, sysctls: { description: "Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported\nsysctls (by the container runtime) might fail to launch.\nNote that this field cannot be set when spec.os.name is windows.", @@ -8526,7 +9270,8 @@ export const CustomResourceDefinition_IssuersCertManagerIo: ApiextensionsK8sIoV1 required: ["name", "value"], type: "object" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" } }, type: "object" @@ -8549,7 +9294,7 @@ export const CustomResourceDefinition_IssuersCertManagerIo: ApiextensionsK8sIoV1 type: "string" }, operator: { - description: "Operator represents a key's relationship to the value.\nValid operators are Exists and Equal. Defaults to Equal.\nExists is equivalent to wildcard for value, so that a pod can\ntolerate all taints of a particular category.", + description: "Operator represents a key's relationship to the value.\nValid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.\nExists is equivalent to wildcard for value, so that a pod can\ntolerate all taints of a particular category.\nLt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).", type: "string" }, tolerationSeconds: { @@ -8564,7 +9309,8 @@ export const CustomResourceDefinition_IssuersCertManagerIo: ApiextensionsK8sIoV1 }, type: "object" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" } }, type: "object" @@ -8590,14 +9336,16 @@ export const CustomResourceDefinition_IssuersCertManagerIo: ApiextensionsK8sIoV1 items: { type: "string" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" }, dnsZones: { description: "List of DNSZones that this solver will be used to solve.\nThe most specific DNS zone match specified here will take precedence\nover other DNS zone matches, so a solver specifying sys.example.com\nwill be selected over one specifying example.com for the domain\nwww.sys.example.com.\nIf multiple solvers match with the same dnsZones value, the solver\nwith the most matching labels in matchLabels will be selected.\nIf neither has more matches, the solver defined earlier in the list\nwill be selected.", items: { type: "string" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" }, matchLabels: { additionalProperties: { @@ -8608,11 +9356,16 @@ export const CustomResourceDefinition_IssuersCertManagerIo: ApiextensionsK8sIoV1 } }, type: "object" + }, + waitInsteadOfSelfCheck: { + description: "WaitInsteadOfSelfCheck, if set, skips cert-manager's self-check and\ninstead waits this long after presentation before asking the ACME server\nto validate the challenge.\n\nThis is an advanced escape hatch for environments where cert-manager's\nself-check cannot succeed from its own network or DNS viewpoint even\nthough the ACME server can still validate successfully, for example due\nto split-horizon DNS or NAT hairpinning.\n\nA value of 0 skips the self-check and asks the ACME server to validate\nimmediately after presentation, relying on the ACME server's own\nvalidation retries (RFC 8555 section 8.2) to succeed once the challenge\nhas propagated. A negative duration is rejected.\nValue must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration,\nfor example `30s` or `2m`.", + type: "string" } }, type: "object" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" } }, required: ["privateKeySecretRef", "server"], @@ -8626,21 +9379,24 @@ export const CustomResourceDefinition_IssuersCertManagerIo: ApiextensionsK8sIoV1 items: { type: "string" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" }, issuingCertificateURLs: { description: "IssuingCertificateURLs is a list of URLs which this issuer should embed into certificates\nit creates. See https://www.rfc-editor.org/rfc/rfc5280#section-4.2.2.1 for more details.\nAs an example, such a URL might be \"http://ca.domain.com/ca.crt\".", items: { type: "string" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" }, ocspServers: { description: "The OCSP server list is an X.509 v3 extension that defines a list of\nURLs of OCSP responders. The OCSP responders can be queried for the\nrevocation status of an issued certificate. If not set, the\ncertificate will be issued with no OCSP servers set. For example, an\nOCSP server URL could be \"http://ocsp.int-x3.letsencrypt.org\".", items: { type: "string" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" }, secretName: { description: "SecretName is the name of the secret used to sign Certificates issued\nby this Issuer.", @@ -8658,7 +9414,8 @@ export const CustomResourceDefinition_IssuersCertManagerIo: ApiextensionsK8sIoV1 items: { type: "string" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" } }, type: "object" @@ -8699,6 +9456,53 @@ export const CustomResourceDefinition_IssuersCertManagerIo: ApiextensionsK8sIoV1 required: ["path", "roleId", "secretRef"], type: "object" }, + aws: { + description: "AWS authenticates with Vault using AWS IAM authentication.\nThis allows authentication using IAM roles for service accounts (IRSA),\nEKS Pod Identity (PIA), or ambient credentials (EC2 instance profiles, ECS task role).", + properties: { + iamRoleArn: { + description: "The ARN of the AWS IAM role to assume using the Kubernetes service account\ntoken. Required when using IRSA (serviceAccountRef is set).\nThis role must have a trust policy that allows the OIDC provider to assume it.", + type: "string" + }, + mountPath: { + description: "The Vault mountPath here is the mount path to use when authenticating with\nVault. For example, setting a value to `/v1/auth/foo`, will use the path\n`/v1/auth/foo/login` to authenticate with Vault. If unspecified, the\ndefault value \"/v1/auth/aws\" will be used.", + type: "string" + }, + region: { + description: "The AWS region to use for authentication. If not specified, the region\nwill be determined from AWS_REGION or AWS_DEFAULT_REGION environment\nvariables, falling back to \"us-east-1\" if not set.", + type: "string" + }, + role: { + description: "A required field containing the Vault Role to assume when authenticating.", + minLength: 1, + type: "string" + }, + serviceAccountRef: { + description: "A reference to a service account that will be used to request a web identity\ntoken for IRSA (IAM Roles for Service Accounts) authentication.", + properties: { + audiences: { + description: "TokenAudiences is an optional list of extra audiences to include in the token passed to Vault.\nThe default audiences are always included in the token.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + name: { + description: "Name of the ServiceAccount used to request a token.", + type: "string" + } + }, + required: ["name"], + type: "object" + }, + vaultHeaderValue: { + description: "The Vault header value to include in the STS signing request.\nThis is used to prevent replay attacks.", + type: "string" + } + }, + required: ["role"], + type: "object" + }, clientCertificate: { description: "ClientCertificate authenticates with Vault by presenting a client\ncertificate during the request's TLS handshake.\nWorks only when using HTTPS protocol.", properties: { @@ -8747,11 +9551,12 @@ export const CustomResourceDefinition_IssuersCertManagerIo: ApiextensionsK8sIoV1 description: "A reference to a service account that will be used to request a bound\ntoken (also known as \"projected token\"). Compared to using \"secretRef\",\nusing this field means that you don't rely on statically bound tokens. To\nuse this field, you must configure an RBAC rule to let cert-manager\nrequest a token.", properties: { audiences: { - description: "TokenAudiences is an optional list of extra audiences to include in the token passed to Vault. The default token\nconsisting of the issuer's namespace and name is always included.", + description: "TokenAudiences is an optional list of extra audiences to include in the token passed to Vault.\nThe default audiences are always included in the token.", items: { type: "string" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" }, name: { description: "Name of the ServiceAccount used to request a token.", @@ -8844,19 +9649,23 @@ export const CustomResourceDefinition_IssuersCertManagerIo: ApiextensionsK8sIoV1 server: { description: "Server is the connection address for the Vault server, e.g: \"https://vault.example.com:8200\".", type: "string" + }, + serverName: { + description: "ServerName is used to verify the hostname on the returned certificates\nby the Vault server.", + type: "string" } }, required: ["auth", "path", "server"], type: "object" }, venafi: { - description: "Venafi configures this issuer to sign certificates using a Venafi TPP\nor Venafi Cloud policy zone.", + description: "Venafi configures this issuer to sign certificates using a CyberArk Certificate Manager Self-Hosted\nor SaaS policy zone.", properties: { cloud: { - description: "Cloud specifies the Venafi cloud configuration settings.\nOnly one of TPP or Cloud may be specified.", + description: "Cloud specifies the CyberArk Certificate Manager SaaS configuration settings.\nOnly one of CyberArk Certificate Manager may be specified.", properties: { apiTokenSecretRef: { - description: "APITokenSecretRef is a secret key selector for the Venafi Cloud API token.", + description: "APITokenSecretRef is a secret key selector for the CyberArk Certificate Manager SaaS API token.", properties: { key: { description: "The key of the entry in the Secret resource's `data` field to be used.\nSome instances of this field may be defaulted, in others it may be\nrequired.", @@ -8871,23 +9680,53 @@ export const CustomResourceDefinition_IssuersCertManagerIo: ApiextensionsK8sIoV1 type: "object" }, url: { - description: "URL is the base URL for Venafi Cloud.\nDefaults to \"https://api.venafi.cloud/v1\".", + description: "URL is the base URL for CyberArk Certificate Manager SaaS.\nDefaults to \"https://api.venafi.cloud/\".", + type: "string" + } + }, + required: ["apiTokenSecretRef"], + type: "object" + }, + ngts: { + description: "NGTS specifies Palo Alto Networks Next Generation Trust Services (NGTS) configuration\nusing OAuth 2.0 Client Credentials. Only one of tpp, cloud, or ngts may be specified.", + properties: { + credentialsRef: { + description: "CredentialsRef is a reference to a Kubernetes Secret containing the OAuth 2.0\nClient ID and Client Secret. The secret must contain the keys 'client-id' and\n'client-secret'.", + properties: { + name: { + description: "Name of the resource being referred to.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + } + }, + required: ["name"], + type: "object" + }, + tokenEndpoint: { + description: "TokenEndpoint is the OAuth 2.0 token endpoint URL used to obtain access tokens,\nfor example \"https://auth.apps.paloaltonetworks.com/oauth2/access_token\".\nDefaults to \"https://auth.apps.paloaltonetworks.com/oauth2/access_token\" if not set.", + type: "string" + }, + tsgID: { + description: "TSGID is the Tenant Service Group ID used to scope the OAuth 2.0 access token,\nfor example \"1234567890\". The tsg_id: prefix is added automatically.\nThis field is required.", + type: "string" + }, + url: { + description: "URL is the base URL for the NGTS API endpoint.\nDefaults to \"https://api.strata.paloaltonetworks.com/ngts\" if not set.", type: "string" } }, - required: ["apiTokenSecretRef"], + required: ["credentialsRef", "tsgID"], type: "object" }, tpp: { - description: "TPP specifies Trust Protection Platform configuration settings.\nOnly one of TPP or Cloud may be specified.", + description: "TPP specifies CyberArk Certificate Manager Self-Hosted configuration settings.\nOnly one of CyberArk Certificate Manager may be specified.", properties: { caBundle: { - description: "Base64-encoded bundle of PEM CAs which will be used to validate the certificate\nchain presented by the TPP server. Only used if using HTTPS; ignored for HTTP.\nIf undefined, the certificate bundle in the cert-manager controller container\nis used to validate the chain.", + description: "Base64-encoded bundle of PEM CAs which will be used to validate the certificate\nchain presented by the CyberArk Certificate Manager Self-Hosted server. Only used if using HTTPS; ignored for HTTP.\nIf undefined, the certificate bundle in the cert-manager controller container\nis used to validate the chain.", format: "byte", type: "string" }, caBundleSecretRef: { - description: "Reference to a Secret containing a base64-encoded bundle of PEM CAs\nwhich will be used to validate the certificate chain presented by the TPP server.\nOnly used if using HTTPS; ignored for HTTP. Mutually exclusive with CABundle.\nIf neither CABundle nor CABundleSecretRef is defined, the certificate bundle in\nthe cert-manager controller container is used to validate the TLS connection.", + description: "Reference to a Secret containing a base64-encoded bundle of PEM CAs\nwhich will be used to validate the certificate chain presented by the CyberArk Certificate Manager Self-Hosted server.\nOnly used if using HTTPS; ignored for HTTP. Mutually exclusive with CABundle.\nIf neither CABundle nor CABundleSecretRef is defined, the certificate bundle in\nthe cert-manager controller container is used to validate the TLS connection.", properties: { key: { description: "The key of the entry in the Secret resource's `data` field to be used.\nSome instances of this field may be defaulted, in others it may be\nrequired.", @@ -8902,7 +9741,7 @@ export const CustomResourceDefinition_IssuersCertManagerIo: ApiextensionsK8sIoV1 type: "object" }, credentialsRef: { - description: "CredentialsRef is a reference to a Secret containing the Venafi TPP API credentials.\nThe secret must contain the key 'access-token' for the Access Token Authentication,\nor two keys, 'username' and 'password' for the API Keys Authentication.", + description: "CredentialsRef is a reference to a Secret containing the CyberArk Certificate Manager Self-Hosted API credentials.\nThe secret must contain the key 'access-token' for the Access Token Authentication,\nor two keys, 'username' and 'password' for the API Keys Authentication.", properties: { name: { description: "Name of the resource being referred to.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", @@ -8913,7 +9752,7 @@ export const CustomResourceDefinition_IssuersCertManagerIo: ApiextensionsK8sIoV1 type: "object" }, url: { - description: "URL is the base URL for the vedsdk endpoint of the Venafi TPP instance,\nfor example: \"https://tpp.example.com/vedsdk\".", + description: "URL is the base URL for the vedsdk endpoint of the CyberArk Certificate Manager Self-Hosted instance,\nfor example: \"https://tpp.example.com/vedsdk\".", type: "string" } }, @@ -8921,12 +9760,16 @@ export const CustomResourceDefinition_IssuersCertManagerIo: ApiextensionsK8sIoV1 type: "object" }, zone: { - description: "Zone is the Venafi Policy Zone to use for this issuer.\nAll requests made to the Venafi platform will be restricted by the named\nzone policy.\nThis field is required.", + description: "Zone is the Certificate Manager Policy Zone to use for this issuer.\nAll requests made to the Certificate Manager platform will be restricted by the named\nzone policy.\nThis field is required.", type: "string" } }, required: ["zone"], - type: "object" + type: "object", + "x-kubernetes-validations": [{ + message: "exactly one of tpp, cloud, or ngts must be configured", + rule: "(has(self.tpp) ? 1 : 0) + (has(self.cloud) ? 1 : 0) + (has(self.ngts) ? 1 : 0) == 1" + }] } }, type: "object" @@ -9008,220 +9851,7 @@ export const CustomResourceDefinition_IssuersCertManagerIo: ApiextensionsK8sIoV1 }] } }; -export const CustomResourceDefinition_OrdersAcmeCertManagerIo: ApiextensionsK8sIoV1CustomResourceDefinition = { - apiVersion: "apiextensions.k8s.io/v1", - kind: "CustomResourceDefinition", - metadata: { - annotations: { - "helm.sh/resource-policy": "keep" - }, - labels: { - app: "cert-manager", - "app.kubernetes.io/component": "crds", - "app.kubernetes.io/instance": "cert-manager", - "app.kubernetes.io/managed-by": "Helm", - "app.kubernetes.io/name": "cert-manager", - "app.kubernetes.io/version": "v1.17.0", - "helm.sh/chart": "cert-manager-v1.17.0" - }, - name: "orders.acme.cert-manager.io" - }, - spec: { - group: "acme.cert-manager.io", - names: { - categories: ["cert-manager", "cert-manager-acme"], - kind: "Order", - listKind: "OrderList", - plural: "orders", - singular: "order" - }, - scope: "Namespaced", - versions: [{ - additionalPrinterColumns: [{ - jsonPath: ".status.state", - name: "State", - type: "string" - }, { - jsonPath: ".spec.issuerRef.name", - name: "Issuer", - priority: 1, - type: "string" - }, { - jsonPath: ".status.reason", - name: "Reason", - priority: 1, - type: "string" - }, { - description: "CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.", - jsonPath: ".metadata.creationTimestamp", - name: "Age", - type: "date" - }], - name: "v1", - schema: { - openAPIV3Schema: { - description: "Order is a type to represent an Order with an ACME server", - properties: { - apiVersion: { - description: "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", - type: "string" - }, - kind: { - description: "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", - type: "string" - }, - metadata: { - type: "object" - }, - spec: { - properties: { - commonName: { - description: "CommonName is the common name as specified on the DER encoded CSR.\nIf specified, this value must also be present in `dnsNames` or `ipAddresses`.\nThis field must match the corresponding field on the DER encoded CSR.", - type: "string" - }, - dnsNames: { - description: "DNSNames is a list of DNS names that should be included as part of the Order\nvalidation process.\nThis field must match the corresponding field on the DER encoded CSR.", - items: { - type: "string" - }, - type: "array" - }, - duration: { - description: "Duration is the duration for the not after date for the requested certificate.\nthis is set on order creation as pe the ACME spec.", - type: "string" - }, - ipAddresses: { - description: "IPAddresses is a list of IP addresses that should be included as part of the Order\nvalidation process.\nThis field must match the corresponding field on the DER encoded CSR.", - items: { - type: "string" - }, - type: "array" - }, - issuerRef: { - description: "IssuerRef references a properly configured ACME-type Issuer which should\nbe used to create this Order.\nIf the Issuer does not exist, processing will be retried.\nIf the Issuer is not an 'ACME' Issuer, an error will be returned and the\nOrder will be marked as failed.", - properties: { - group: { - description: "Group of the resource being referred to.", - type: "string" - }, - kind: { - description: "Kind of the resource being referred to.", - type: "string" - }, - name: { - description: "Name of the resource being referred to.", - type: "string" - } - }, - required: ["name"], - type: "object" - }, - request: { - description: "Certificate signing request bytes in DER encoding.\nThis will be used when finalizing the order.\nThis field must be set on the order.", - format: "byte", - type: "string" - } - }, - required: ["issuerRef", "request"], - type: "object" - }, - status: { - properties: { - authorizations: { - description: "Authorizations contains data returned from the ACME server on what\nauthorizations must be completed in order to validate the DNS names\nspecified on the Order.", - items: { - description: "ACMEAuthorization contains data returned from the ACME server on an\nauthorization that must be completed in order validate a DNS name on an ACME\nOrder resource.", - properties: { - challenges: { - description: "Challenges specifies the challenge types offered by the ACME server.\nOne of these challenge types will be selected when validating the DNS\nname and an appropriate Challenge resource will be created to perform\nthe ACME challenge process.", - items: { - description: "Challenge specifies a challenge offered by the ACME server for an Order.\nAn appropriate Challenge resource can be created to perform the ACME\nchallenge process.", - properties: { - token: { - description: "Token is the token that must be presented for this challenge.\nThis is used to compute the 'key' that must also be presented.", - type: "string" - }, - type: { - description: "Type is the type of challenge being offered, e.g. 'http-01', 'dns-01',\n'tls-sni-01', etc.\nThis is the raw value retrieved from the ACME server.\nOnly 'http-01' and 'dns-01' are supported by cert-manager, other values\nwill be ignored.", - type: "string" - }, - url: { - description: "URL is the URL of this challenge. It can be used to retrieve additional\nmetadata about the Challenge from the ACME server.", - type: "string" - } - }, - required: ["token", "type", "url"], - type: "object" - }, - type: "array" - }, - identifier: { - description: "Identifier is the DNS name to be validated as part of this authorization", - type: "string" - }, - initialState: { - description: "InitialState is the initial state of the ACME authorization when first\nfetched from the ACME server.\nIf an Authorization is already 'valid', the Order controller will not\ncreate a Challenge resource for the authorization. This will occur when\nworking with an ACME server that enables 'authz reuse' (such as Let's\nEncrypt's production endpoint).\nIf not set and 'identifier' is set, the state is assumed to be pending\nand a Challenge will be created.", - enum: ["valid", "ready", "pending", "processing", "invalid", "expired", "errored"], - type: "string" - }, - url: { - description: "URL is the URL of the Authorization that must be completed", - type: "string" - }, - wildcard: { - description: "Wildcard will be true if this authorization is for a wildcard DNS name.\nIf this is true, the identifier will be the *non-wildcard* version of\nthe DNS name.\nFor example, if '*.example.com' is the DNS name being validated, this\nfield will be 'true' and the 'identifier' field will be 'example.com'.", - type: "boolean" - } - }, - required: ["url"], - type: "object" - }, - type: "array" - }, - certificate: { - description: "Certificate is a copy of the PEM encoded certificate for this Order.\nThis field will be populated after the order has been successfully\nfinalized with the ACME server, and the order has transitioned to the\n'valid' state.", - format: "byte", - type: "string" - }, - failureTime: { - description: "FailureTime stores the time that this order failed.\nThis is used to influence garbage collection and back-off.", - format: "date-time", - type: "string" - }, - finalizeURL: { - description: "FinalizeURL of the Order.\nThis is used to obtain certificates for this order once it has been completed.", - type: "string" - }, - reason: { - description: "Reason optionally provides more information about a why the order is in\nthe current state.", - type: "string" - }, - state: { - description: "State contains the current state of this Order resource.\nStates 'success' and 'expired' are 'final'", - enum: ["valid", "ready", "pending", "processing", "invalid", "expired", "errored"], - type: "string" - }, - url: { - description: "URL of the Order.\nThis will initially be empty when the resource is first created.\nThe Order controller will populate this field when the Order is first processed.\nThis field will be immutable after it is initially set.", - type: "string" - } - }, - type: "object" - } - }, - required: ["metadata", "spec"], - type: "object" - } - }, - served: true, - storage: true, - subresources: { - status: {} - } - }] - } -}; -export const ClusterRole_CertManagerCainjector: RbacAuthorizationK8sIoV1ClusterRole = { +export const ClusterRole_CertManagerCainjector: KubernetesResource = { apiVersion: "rbac.authorization.k8s.io/v1", kind: "ClusterRole", metadata: { @@ -9231,8 +9861,8 @@ export const ClusterRole_CertManagerCainjector: RbacAuthorizationK8sIoV1ClusterR "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "cainjector", - "app.kubernetes.io/version": "v1.17.0", - "helm.sh/chart": "cert-manager-v1.17.0" + "app.kubernetes.io/version": "v1.21.1", + "helm.sh/chart": "cert-manager-v1.21.1" }, name: "cert-manager-cainjector" }, @@ -9262,7 +9892,7 @@ export const ClusterRole_CertManagerCainjector: RbacAuthorizationK8sIoV1ClusterR verbs: ["get", "list", "watch", "update", "patch"] }] }; -export const ClusterRole_CertManagerControllerIssuers: RbacAuthorizationK8sIoV1ClusterRole = { +export const ClusterRole_CertManagerControllerIssuers: KubernetesResource = { apiVersion: "rbac.authorization.k8s.io/v1", kind: "ClusterRole", metadata: { @@ -9272,8 +9902,8 @@ export const ClusterRole_CertManagerControllerIssuers: RbacAuthorizationK8sIoV1C "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "cert-manager", - "app.kubernetes.io/version": "v1.17.0", - "helm.sh/chart": "cert-manager-v1.17.0" + "app.kubernetes.io/version": "v1.21.1", + "helm.sh/chart": "cert-manager-v1.21.1" }, name: "cert-manager-controller-issuers" }, @@ -9295,7 +9925,7 @@ export const ClusterRole_CertManagerControllerIssuers: RbacAuthorizationK8sIoV1C verbs: ["create", "patch"] }] }; -export const ClusterRole_CertManagerControllerClusterissuers: RbacAuthorizationK8sIoV1ClusterRole = { +export const ClusterRole_CertManagerControllerClusterissuers: KubernetesResource = { apiVersion: "rbac.authorization.k8s.io/v1", kind: "ClusterRole", metadata: { @@ -9305,8 +9935,8 @@ export const ClusterRole_CertManagerControllerClusterissuers: RbacAuthorizationK "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "cert-manager", - "app.kubernetes.io/version": "v1.17.0", - "helm.sh/chart": "cert-manager-v1.17.0" + "app.kubernetes.io/version": "v1.21.1", + "helm.sh/chart": "cert-manager-v1.21.1" }, name: "cert-manager-controller-clusterissuers" }, @@ -9328,7 +9958,7 @@ export const ClusterRole_CertManagerControllerClusterissuers: RbacAuthorizationK verbs: ["create", "patch"] }] }; -export const ClusterRole_CertManagerControllerCertificates: RbacAuthorizationK8sIoV1ClusterRole = { +export const ClusterRole_CertManagerControllerCertificates: KubernetesResource = { apiVersion: "rbac.authorization.k8s.io/v1", kind: "ClusterRole", metadata: { @@ -9338,8 +9968,8 @@ export const ClusterRole_CertManagerControllerCertificates: RbacAuthorizationK8s "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "cert-manager", - "app.kubernetes.io/version": "v1.17.0", - "helm.sh/chart": "cert-manager-v1.17.0" + "app.kubernetes.io/version": "v1.21.1", + "helm.sh/chart": "cert-manager-v1.21.1" }, name: "cert-manager-controller-certificates" }, @@ -9369,7 +9999,7 @@ export const ClusterRole_CertManagerControllerCertificates: RbacAuthorizationK8s verbs: ["create", "patch"] }] }; -export const ClusterRole_CertManagerControllerOrders: RbacAuthorizationK8sIoV1ClusterRole = { +export const ClusterRole_CertManagerControllerOrders: KubernetesResource = { apiVersion: "rbac.authorization.k8s.io/v1", kind: "ClusterRole", metadata: { @@ -9379,8 +10009,8 @@ export const ClusterRole_CertManagerControllerOrders: RbacAuthorizationK8sIoV1Cl "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "cert-manager", - "app.kubernetes.io/version": "v1.17.0", - "helm.sh/chart": "cert-manager-v1.17.0" + "app.kubernetes.io/version": "v1.21.1", + "helm.sh/chart": "cert-manager-v1.21.1" }, name: "cert-manager-controller-orders" }, @@ -9404,6 +10034,10 @@ export const ClusterRole_CertManagerControllerOrders: RbacAuthorizationK8sIoV1Cl apiGroups: ["acme.cert-manager.io"], resources: ["orders/finalizers"], verbs: ["update"] + }, { + apiGroups: ["cert-manager.io"], + resources: ["clusterissuers/finalizers", "issuers/finalizers"], + verbs: ["update"] }, { apiGroups: [""], resources: ["secrets"], @@ -9414,7 +10048,7 @@ export const ClusterRole_CertManagerControllerOrders: RbacAuthorizationK8sIoV1Cl verbs: ["create", "patch"] }] }; -export const ClusterRole_CertManagerControllerChallenges: RbacAuthorizationK8sIoV1ClusterRole = { +export const ClusterRole_CertManagerControllerChallenges: KubernetesResource = { apiVersion: "rbac.authorization.k8s.io/v1", kind: "ClusterRole", metadata: { @@ -9424,8 +10058,8 @@ export const ClusterRole_CertManagerControllerChallenges: RbacAuthorizationK8sIo "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "cert-manager", - "app.kubernetes.io/version": "v1.17.0", - "helm.sh/chart": "cert-manager-v1.17.0" + "app.kubernetes.io/version": "v1.21.1", + "helm.sh/chart": "cert-manager-v1.21.1" }, name: "cert-manager-controller-challenges" }, @@ -9475,7 +10109,7 @@ export const ClusterRole_CertManagerControllerChallenges: RbacAuthorizationK8sIo verbs: ["get", "list", "watch"] }] }; -export const ClusterRole_CertManagerControllerIngressShim: RbacAuthorizationK8sIoV1ClusterRole = { +export const ClusterRole_CertManagerControllerIngressShim: KubernetesResource = { apiVersion: "rbac.authorization.k8s.io/v1", kind: "ClusterRole", metadata: { @@ -9485,8 +10119,8 @@ export const ClusterRole_CertManagerControllerIngressShim: RbacAuthorizationK8sI "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "cert-manager", - "app.kubernetes.io/version": "v1.17.0", - "helm.sh/chart": "cert-manager-v1.17.0" + "app.kubernetes.io/version": "v1.21.1", + "helm.sh/chart": "cert-manager-v1.21.1" }, name: "cert-manager-controller-ingress-shim" }, @@ -9508,11 +10142,11 @@ export const ClusterRole_CertManagerControllerIngressShim: RbacAuthorizationK8sI verbs: ["update"] }, { apiGroups: ["gateway.networking.k8s.io"], - resources: ["gateways", "httproutes"], + resources: ["gateways", "httproutes", "listenersets"], verbs: ["get", "list", "watch"] }, { apiGroups: ["gateway.networking.k8s.io"], - resources: ["gateways/finalizers", "httproutes/finalizers"], + resources: ["gateways/finalizers", "httproutes/finalizers", "listenersets/finalizers"], verbs: ["update"] }, { apiGroups: [""], @@ -9520,7 +10154,7 @@ export const ClusterRole_CertManagerControllerIngressShim: RbacAuthorizationK8sI verbs: ["create", "patch"] }] }; -export const ClusterRole_CertManagerClusterView: RbacAuthorizationK8sIoV1ClusterRole = { +export const ClusterRole_CertManagerClusterView: KubernetesResource = { apiVersion: "rbac.authorization.k8s.io/v1", kind: "ClusterRole", metadata: { @@ -9530,8 +10164,8 @@ export const ClusterRole_CertManagerClusterView: RbacAuthorizationK8sIoV1Cluster "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "cert-manager", - "app.kubernetes.io/version": "v1.17.0", - "helm.sh/chart": "cert-manager-v1.17.0", + "app.kubernetes.io/version": "v1.21.1", + "helm.sh/chart": "cert-manager-v1.21.1", "rbac.authorization.k8s.io/aggregate-to-cluster-reader": "true" }, name: "cert-manager-cluster-view" @@ -9542,7 +10176,7 @@ export const ClusterRole_CertManagerClusterView: RbacAuthorizationK8sIoV1Cluster verbs: ["get", "list", "watch"] }] }; -export const ClusterRole_CertManagerView: RbacAuthorizationK8sIoV1ClusterRole = { +export const ClusterRole_CertManagerView: KubernetesResource = { apiVersion: "rbac.authorization.k8s.io/v1", kind: "ClusterRole", metadata: { @@ -9552,8 +10186,8 @@ export const ClusterRole_CertManagerView: RbacAuthorizationK8sIoV1ClusterRole = "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "cert-manager", - "app.kubernetes.io/version": "v1.17.0", - "helm.sh/chart": "cert-manager-v1.17.0", + "app.kubernetes.io/version": "v1.21.1", + "helm.sh/chart": "cert-manager-v1.21.1", "rbac.authorization.k8s.io/aggregate-to-admin": "true", "rbac.authorization.k8s.io/aggregate-to-cluster-reader": "true", "rbac.authorization.k8s.io/aggregate-to-edit": "true", @@ -9571,7 +10205,7 @@ export const ClusterRole_CertManagerView: RbacAuthorizationK8sIoV1ClusterRole = verbs: ["get", "list", "watch"] }] }; -export const ClusterRole_CertManagerEdit: RbacAuthorizationK8sIoV1ClusterRole = { +export const ClusterRole_CertManagerEdit: KubernetesResource = { apiVersion: "rbac.authorization.k8s.io/v1", kind: "ClusterRole", metadata: { @@ -9581,8 +10215,8 @@ export const ClusterRole_CertManagerEdit: RbacAuthorizationK8sIoV1ClusterRole = "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "cert-manager", - "app.kubernetes.io/version": "v1.17.0", - "helm.sh/chart": "cert-manager-v1.17.0", + "app.kubernetes.io/version": "v1.21.1", + "helm.sh/chart": "cert-manager-v1.21.1", "rbac.authorization.k8s.io/aggregate-to-admin": "true", "rbac.authorization.k8s.io/aggregate-to-edit": "true" }, @@ -9598,11 +10232,15 @@ export const ClusterRole_CertManagerEdit: RbacAuthorizationK8sIoV1ClusterRole = verbs: ["update"] }, { apiGroups: ["acme.cert-manager.io"], - resources: ["challenges", "orders"], - verbs: ["create", "delete", "deletecollection", "patch", "update"] + resources: ["challenges"], + verbs: ["delete", "deletecollection", "patch", "update"] + }, { + apiGroups: ["acme.cert-manager.io"], + resources: ["orders"], + verbs: ["delete", "deletecollection"] }] }; -export const ClusterRole_CertManagerControllerApproveCertManagerIo: RbacAuthorizationK8sIoV1ClusterRole = { +export const ClusterRole_CertManagerControllerApproveCertManagerIo: KubernetesResource = { apiVersion: "rbac.authorization.k8s.io/v1", kind: "ClusterRole", metadata: { @@ -9612,8 +10250,8 @@ export const ClusterRole_CertManagerControllerApproveCertManagerIo: RbacAuthoriz "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "cert-manager", - "app.kubernetes.io/version": "v1.17.0", - "helm.sh/chart": "cert-manager-v1.17.0" + "app.kubernetes.io/version": "v1.21.1", + "helm.sh/chart": "cert-manager-v1.21.1" }, name: "cert-manager-controller-approve:cert-manager-io" }, @@ -9624,7 +10262,7 @@ export const ClusterRole_CertManagerControllerApproveCertManagerIo: RbacAuthoriz verbs: ["approve"] }] }; -export const ClusterRole_CertManagerControllerCertificatesigningrequests: RbacAuthorizationK8sIoV1ClusterRole = { +export const ClusterRole_CertManagerControllerCertificatesigningrequests: KubernetesResource = { apiVersion: "rbac.authorization.k8s.io/v1", kind: "ClusterRole", metadata: { @@ -9634,8 +10272,8 @@ export const ClusterRole_CertManagerControllerCertificatesigningrequests: RbacAu "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "cert-manager", - "app.kubernetes.io/version": "v1.17.0", - "helm.sh/chart": "cert-manager-v1.17.0" + "app.kubernetes.io/version": "v1.21.1", + "helm.sh/chart": "cert-manager-v1.21.1" }, name: "cert-manager-controller-certificatesigningrequests" }, @@ -9658,7 +10296,7 @@ export const ClusterRole_CertManagerControllerCertificatesigningrequests: RbacAu verbs: ["create"] }] }; -export const ClusterRole_CertManagerWebhookSubjectaccessreviews: RbacAuthorizationK8sIoV1ClusterRole = { +export const ClusterRole_CertManagerWebhookSubjectaccessreviews: KubernetesResource = { apiVersion: "rbac.authorization.k8s.io/v1", kind: "ClusterRole", metadata: { @@ -9668,8 +10306,8 @@ export const ClusterRole_CertManagerWebhookSubjectaccessreviews: RbacAuthorizati "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "webhook", - "app.kubernetes.io/version": "v1.17.0", - "helm.sh/chart": "cert-manager-v1.17.0" + "app.kubernetes.io/version": "v1.21.1", + "helm.sh/chart": "cert-manager-v1.21.1" }, name: "cert-manager-webhook:subjectaccessreviews" }, @@ -9679,7 +10317,7 @@ export const ClusterRole_CertManagerWebhookSubjectaccessreviews: RbacAuthorizati verbs: ["create"] }] }; -export const ClusterRoleBinding_CertManagerCainjector: RbacAuthorizationK8sIoV1ClusterRoleBinding = { +export const ClusterRoleBinding_CertManagerCainjector: KubernetesResource = { apiVersion: "rbac.authorization.k8s.io/v1", kind: "ClusterRoleBinding", metadata: { @@ -9689,8 +10327,8 @@ export const ClusterRoleBinding_CertManagerCainjector: RbacAuthorizationK8sIoV1C "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "cainjector", - "app.kubernetes.io/version": "v1.17.0", - "helm.sh/chart": "cert-manager-v1.17.0" + "app.kubernetes.io/version": "v1.21.1", + "helm.sh/chart": "cert-manager-v1.21.1" }, name: "cert-manager-cainjector" }, @@ -9705,7 +10343,7 @@ export const ClusterRoleBinding_CertManagerCainjector: RbacAuthorizationK8sIoV1C namespace: "cert-manager" }] }; -export const ClusterRoleBinding_CertManagerControllerIssuers: RbacAuthorizationK8sIoV1ClusterRoleBinding = { +export const ClusterRoleBinding_CertManagerControllerIssuers: KubernetesResource = { apiVersion: "rbac.authorization.k8s.io/v1", kind: "ClusterRoleBinding", metadata: { @@ -9715,8 +10353,8 @@ export const ClusterRoleBinding_CertManagerControllerIssuers: RbacAuthorizationK "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "cert-manager", - "app.kubernetes.io/version": "v1.17.0", - "helm.sh/chart": "cert-manager-v1.17.0" + "app.kubernetes.io/version": "v1.21.1", + "helm.sh/chart": "cert-manager-v1.21.1" }, name: "cert-manager-controller-issuers" }, @@ -9731,7 +10369,7 @@ export const ClusterRoleBinding_CertManagerControllerIssuers: RbacAuthorizationK namespace: "cert-manager" }] }; -export const ClusterRoleBinding_CertManagerControllerClusterissuers: RbacAuthorizationK8sIoV1ClusterRoleBinding = { +export const ClusterRoleBinding_CertManagerControllerClusterissuers: KubernetesResource = { apiVersion: "rbac.authorization.k8s.io/v1", kind: "ClusterRoleBinding", metadata: { @@ -9741,8 +10379,8 @@ export const ClusterRoleBinding_CertManagerControllerClusterissuers: RbacAuthori "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "cert-manager", - "app.kubernetes.io/version": "v1.17.0", - "helm.sh/chart": "cert-manager-v1.17.0" + "app.kubernetes.io/version": "v1.21.1", + "helm.sh/chart": "cert-manager-v1.21.1" }, name: "cert-manager-controller-clusterissuers" }, @@ -9757,7 +10395,7 @@ export const ClusterRoleBinding_CertManagerControllerClusterissuers: RbacAuthori namespace: "cert-manager" }] }; -export const ClusterRoleBinding_CertManagerControllerCertificates: RbacAuthorizationK8sIoV1ClusterRoleBinding = { +export const ClusterRoleBinding_CertManagerControllerCertificates: KubernetesResource = { apiVersion: "rbac.authorization.k8s.io/v1", kind: "ClusterRoleBinding", metadata: { @@ -9767,8 +10405,8 @@ export const ClusterRoleBinding_CertManagerControllerCertificates: RbacAuthoriza "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "cert-manager", - "app.kubernetes.io/version": "v1.17.0", - "helm.sh/chart": "cert-manager-v1.17.0" + "app.kubernetes.io/version": "v1.21.1", + "helm.sh/chart": "cert-manager-v1.21.1" }, name: "cert-manager-controller-certificates" }, @@ -9783,7 +10421,7 @@ export const ClusterRoleBinding_CertManagerControllerCertificates: RbacAuthoriza namespace: "cert-manager" }] }; -export const ClusterRoleBinding_CertManagerControllerOrders: RbacAuthorizationK8sIoV1ClusterRoleBinding = { +export const ClusterRoleBinding_CertManagerControllerOrders: KubernetesResource = { apiVersion: "rbac.authorization.k8s.io/v1", kind: "ClusterRoleBinding", metadata: { @@ -9793,8 +10431,8 @@ export const ClusterRoleBinding_CertManagerControllerOrders: RbacAuthorizationK8 "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "cert-manager", - "app.kubernetes.io/version": "v1.17.0", - "helm.sh/chart": "cert-manager-v1.17.0" + "app.kubernetes.io/version": "v1.21.1", + "helm.sh/chart": "cert-manager-v1.21.1" }, name: "cert-manager-controller-orders" }, @@ -9809,7 +10447,7 @@ export const ClusterRoleBinding_CertManagerControllerOrders: RbacAuthorizationK8 namespace: "cert-manager" }] }; -export const ClusterRoleBinding_CertManagerControllerChallenges: RbacAuthorizationK8sIoV1ClusterRoleBinding = { +export const ClusterRoleBinding_CertManagerControllerChallenges: KubernetesResource = { apiVersion: "rbac.authorization.k8s.io/v1", kind: "ClusterRoleBinding", metadata: { @@ -9819,8 +10457,8 @@ export const ClusterRoleBinding_CertManagerControllerChallenges: RbacAuthorizati "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "cert-manager", - "app.kubernetes.io/version": "v1.17.0", - "helm.sh/chart": "cert-manager-v1.17.0" + "app.kubernetes.io/version": "v1.21.1", + "helm.sh/chart": "cert-manager-v1.21.1" }, name: "cert-manager-controller-challenges" }, @@ -9835,7 +10473,7 @@ export const ClusterRoleBinding_CertManagerControllerChallenges: RbacAuthorizati namespace: "cert-manager" }] }; -export const ClusterRoleBinding_CertManagerControllerIngressShim: RbacAuthorizationK8sIoV1ClusterRoleBinding = { +export const ClusterRoleBinding_CertManagerControllerIngressShim: KubernetesResource = { apiVersion: "rbac.authorization.k8s.io/v1", kind: "ClusterRoleBinding", metadata: { @@ -9845,8 +10483,8 @@ export const ClusterRoleBinding_CertManagerControllerIngressShim: RbacAuthorizat "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "cert-manager", - "app.kubernetes.io/version": "v1.17.0", - "helm.sh/chart": "cert-manager-v1.17.0" + "app.kubernetes.io/version": "v1.21.1", + "helm.sh/chart": "cert-manager-v1.21.1" }, name: "cert-manager-controller-ingress-shim" }, @@ -9861,7 +10499,7 @@ export const ClusterRoleBinding_CertManagerControllerIngressShim: RbacAuthorizat namespace: "cert-manager" }] }; -export const ClusterRoleBinding_CertManagerControllerApproveCertManagerIo: RbacAuthorizationK8sIoV1ClusterRoleBinding = { +export const ClusterRoleBinding_CertManagerControllerApproveCertManagerIo: KubernetesResource = { apiVersion: "rbac.authorization.k8s.io/v1", kind: "ClusterRoleBinding", metadata: { @@ -9871,8 +10509,8 @@ export const ClusterRoleBinding_CertManagerControllerApproveCertManagerIo: RbacA "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "cert-manager", - "app.kubernetes.io/version": "v1.17.0", - "helm.sh/chart": "cert-manager-v1.17.0" + "app.kubernetes.io/version": "v1.21.1", + "helm.sh/chart": "cert-manager-v1.21.1" }, name: "cert-manager-controller-approve:cert-manager-io" }, @@ -9887,7 +10525,7 @@ export const ClusterRoleBinding_CertManagerControllerApproveCertManagerIo: RbacA namespace: "cert-manager" }] }; -export const ClusterRoleBinding_CertManagerControllerCertificatesigningrequests: RbacAuthorizationK8sIoV1ClusterRoleBinding = { +export const ClusterRoleBinding_CertManagerControllerCertificatesigningrequests: KubernetesResource = { apiVersion: "rbac.authorization.k8s.io/v1", kind: "ClusterRoleBinding", metadata: { @@ -9897,8 +10535,8 @@ export const ClusterRoleBinding_CertManagerControllerCertificatesigningrequests: "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "cert-manager", - "app.kubernetes.io/version": "v1.17.0", - "helm.sh/chart": "cert-manager-v1.17.0" + "app.kubernetes.io/version": "v1.21.1", + "helm.sh/chart": "cert-manager-v1.21.1" }, name: "cert-manager-controller-certificatesigningrequests" }, @@ -9913,7 +10551,7 @@ export const ClusterRoleBinding_CertManagerControllerCertificatesigningrequests: namespace: "cert-manager" }] }; -export const ClusterRoleBinding_CertManagerWebhookSubjectaccessreviews: RbacAuthorizationK8sIoV1ClusterRoleBinding = { +export const ClusterRoleBinding_CertManagerWebhookSubjectaccessreviews: KubernetesResource = { apiVersion: "rbac.authorization.k8s.io/v1", kind: "ClusterRoleBinding", metadata: { @@ -9923,8 +10561,8 @@ export const ClusterRoleBinding_CertManagerWebhookSubjectaccessreviews: RbacAuth "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "webhook", - "app.kubernetes.io/version": "v1.17.0", - "helm.sh/chart": "cert-manager-v1.17.0" + "app.kubernetes.io/version": "v1.21.1", + "helm.sh/chart": "cert-manager-v1.21.1" }, name: "cert-manager-webhook:subjectaccessreviews" }, @@ -9939,7 +10577,7 @@ export const ClusterRoleBinding_CertManagerWebhookSubjectaccessreviews: RbacAuth namespace: "cert-manager" }] }; -export const Role_CertManagerCainjectorLeaderelection: RbacAuthorizationK8sIoV1Role = { +export const Role_CertManagerCainjectorLeaderelection: KubernetesResource = { apiVersion: "rbac.authorization.k8s.io/v1", kind: "Role", metadata: { @@ -9949,8 +10587,8 @@ export const Role_CertManagerCainjectorLeaderelection: RbacAuthorizationK8sIoV1R "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "cainjector", - "app.kubernetes.io/version": "v1.17.0", - "helm.sh/chart": "cert-manager-v1.17.0" + "app.kubernetes.io/version": "v1.21.1", + "helm.sh/chart": "cert-manager-v1.21.1" }, name: "cert-manager-cainjector:leaderelection", namespace: "cert-manager" @@ -9966,7 +10604,7 @@ export const Role_CertManagerCainjectorLeaderelection: RbacAuthorizationK8sIoV1R verbs: ["create"] }] }; -export const Role_CertManagerLeaderelection: RbacAuthorizationK8sIoV1Role = { +export const Role_CertManagerLeaderelection: KubernetesResource = { apiVersion: "rbac.authorization.k8s.io/v1", kind: "Role", metadata: { @@ -9976,8 +10614,8 @@ export const Role_CertManagerLeaderelection: RbacAuthorizationK8sIoV1Role = { "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "cert-manager", - "app.kubernetes.io/version": "v1.17.0", - "helm.sh/chart": "cert-manager-v1.17.0" + "app.kubernetes.io/version": "v1.21.1", + "helm.sh/chart": "cert-manager-v1.21.1" }, name: "cert-manager:leaderelection", namespace: "cert-manager" @@ -9993,30 +10631,7 @@ export const Role_CertManagerLeaderelection: RbacAuthorizationK8sIoV1Role = { verbs: ["create"] }] }; -export const Role_CertManagerTokenrequest: RbacAuthorizationK8sIoV1Role = { - apiVersion: "rbac.authorization.k8s.io/v1", - kind: "Role", - metadata: { - labels: { - app: "cert-manager", - "app.kubernetes.io/component": "controller", - "app.kubernetes.io/instance": "cert-manager", - "app.kubernetes.io/managed-by": "Helm", - "app.kubernetes.io/name": "cert-manager", - "app.kubernetes.io/version": "v1.17.0", - "helm.sh/chart": "cert-manager-v1.17.0" - }, - name: "cert-manager-tokenrequest", - namespace: "cert-manager" - }, - rules: [{ - apiGroups: [""], - resourceNames: ["cert-manager"], - resources: ["serviceaccounts/token"], - verbs: ["create"] - }] -}; -export const Role_CertManagerWebhookDynamicServing: RbacAuthorizationK8sIoV1Role = { +export const Role_CertManagerWebhookDynamicServing: KubernetesResource = { apiVersion: "rbac.authorization.k8s.io/v1", kind: "Role", metadata: { @@ -10026,8 +10641,8 @@ export const Role_CertManagerWebhookDynamicServing: RbacAuthorizationK8sIoV1Role "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "webhook", - "app.kubernetes.io/version": "v1.17.0", - "helm.sh/chart": "cert-manager-v1.17.0" + "app.kubernetes.io/version": "v1.21.1", + "helm.sh/chart": "cert-manager-v1.21.1" }, name: "cert-manager-webhook:dynamic-serving", namespace: "cert-manager" @@ -10043,7 +10658,7 @@ export const Role_CertManagerWebhookDynamicServing: RbacAuthorizationK8sIoV1Role verbs: ["create"] }] }; -export const RoleBinding_CertManagerCainjectorLeaderelection: RbacAuthorizationK8sIoV1RoleBinding = { +export const RoleBinding_CertManagerCainjectorLeaderelection: KubernetesResource = { apiVersion: "rbac.authorization.k8s.io/v1", kind: "RoleBinding", metadata: { @@ -10053,8 +10668,8 @@ export const RoleBinding_CertManagerCainjectorLeaderelection: RbacAuthorizationK "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "cainjector", - "app.kubernetes.io/version": "v1.17.0", - "helm.sh/chart": "cert-manager-v1.17.0" + "app.kubernetes.io/version": "v1.21.1", + "helm.sh/chart": "cert-manager-v1.21.1" }, name: "cert-manager-cainjector:leaderelection", namespace: "cert-manager" @@ -10070,7 +10685,7 @@ export const RoleBinding_CertManagerCainjectorLeaderelection: RbacAuthorizationK namespace: "cert-manager" }] }; -export const RoleBinding_CertManagerLeaderelection: RbacAuthorizationK8sIoV1RoleBinding = { +export const RoleBinding_CertManagerLeaderelection: KubernetesResource = { apiVersion: "rbac.authorization.k8s.io/v1", kind: "RoleBinding", metadata: { @@ -10080,8 +10695,8 @@ export const RoleBinding_CertManagerLeaderelection: RbacAuthorizationK8sIoV1Role "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "cert-manager", - "app.kubernetes.io/version": "v1.17.0", - "helm.sh/chart": "cert-manager-v1.17.0" + "app.kubernetes.io/version": "v1.21.1", + "helm.sh/chart": "cert-manager-v1.21.1" }, name: "cert-manager:leaderelection", namespace: "cert-manager" @@ -10097,34 +10712,7 @@ export const RoleBinding_CertManagerLeaderelection: RbacAuthorizationK8sIoV1Role namespace: "cert-manager" }] }; -export const RoleBinding_CertManagerCertManagerTokenrequest: RbacAuthorizationK8sIoV1RoleBinding = { - apiVersion: "rbac.authorization.k8s.io/v1", - kind: "RoleBinding", - metadata: { - labels: { - app: "cert-manager", - "app.kubernetes.io/component": "controller", - "app.kubernetes.io/instance": "cert-manager", - "app.kubernetes.io/managed-by": "Helm", - "app.kubernetes.io/name": "cert-manager", - "app.kubernetes.io/version": "v1.17.0", - "helm.sh/chart": "cert-manager-v1.17.0" - }, - name: "cert-manager-cert-manager-tokenrequest", - namespace: "cert-manager" - }, - roleRef: { - apiGroup: "rbac.authorization.k8s.io", - kind: "Role", - name: "cert-manager-tokenrequest" - }, - subjects: [{ - kind: "ServiceAccount", - name: "cert-manager", - namespace: "cert-manager" - }] -}; -export const RoleBinding_CertManagerWebhookDynamicServing: RbacAuthorizationK8sIoV1RoleBinding = { +export const RoleBinding_CertManagerWebhookDynamicServing: KubernetesResource = { apiVersion: "rbac.authorization.k8s.io/v1", kind: "RoleBinding", metadata: { @@ -10134,8 +10722,8 @@ export const RoleBinding_CertManagerWebhookDynamicServing: RbacAuthorizationK8sI "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "webhook", - "app.kubernetes.io/version": "v1.17.0", - "helm.sh/chart": "cert-manager-v1.17.0" + "app.kubernetes.io/version": "v1.21.1", + "helm.sh/chart": "cert-manager-v1.21.1" }, name: "cert-manager-webhook:dynamic-serving", namespace: "cert-manager" @@ -10151,7 +10739,7 @@ export const RoleBinding_CertManagerWebhookDynamicServing: RbacAuthorizationK8sI namespace: "cert-manager" }] }; -export const Service_CertManagerCainjector: Service = { +export const Service_CertManagerCainjector: KubernetesResource = { apiVersion: "v1", kind: "Service", metadata: { @@ -10161,8 +10749,8 @@ export const Service_CertManagerCainjector: Service = { "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "cainjector", - "app.kubernetes.io/version": "v1.17.0", - "helm.sh/chart": "cert-manager-v1.17.0" + "app.kubernetes.io/version": "v1.21.1", + "helm.sh/chart": "cert-manager-v1.21.1" }, name: "cert-manager-cainjector", namespace: "cert-manager" @@ -10181,7 +10769,7 @@ export const Service_CertManagerCainjector: Service = { type: "ClusterIP" } }; -export const Service_CertManager: Service = { +export const Service_CertManager: KubernetesResource = { apiVersion: "v1", kind: "Service", metadata: { @@ -10191,18 +10779,17 @@ export const Service_CertManager: Service = { "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "cert-manager", - "app.kubernetes.io/version": "v1.17.0", - "helm.sh/chart": "cert-manager-v1.17.0" + "app.kubernetes.io/version": "v1.21.1", + "helm.sh/chart": "cert-manager-v1.21.1" }, name: "cert-manager", namespace: "cert-manager" }, spec: { ports: [{ - name: "tcp-prometheus-servicemonitor", + name: "http-metrics", port: 9402, - protocol: "TCP", - targetPort: 9402 + protocol: "TCP" }], selector: { "app.kubernetes.io/component": "controller", @@ -10212,7 +10799,7 @@ export const Service_CertManager: Service = { type: "ClusterIP" } }; -export const Service_CertManagerWebhook: Service = { +export const Service_CertManagerWebhook: KubernetesResource = { apiVersion: "v1", kind: "Service", metadata: { @@ -10222,8 +10809,8 @@ export const Service_CertManagerWebhook: Service = { "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "webhook", - "app.kubernetes.io/version": "v1.17.0", - "helm.sh/chart": "cert-manager-v1.17.0" + "app.kubernetes.io/version": "v1.21.1", + "helm.sh/chart": "cert-manager-v1.21.1" }, name: "cert-manager-webhook", namespace: "cert-manager" @@ -10248,7 +10835,7 @@ export const Service_CertManagerWebhook: Service = { type: "ClusterIP" } }; -export const Deployment_CertManagerCainjector: AppsV1Deployment = { +export const Deployment_CertManagerCainjector: KubernetesResource = { apiVersion: "apps/v1", kind: "Deployment", metadata: { @@ -10258,8 +10845,8 @@ export const Deployment_CertManagerCainjector: AppsV1Deployment = { "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "cainjector", - "app.kubernetes.io/version": "v1.17.0", - "helm.sh/chart": "cert-manager-v1.17.0" + "app.kubernetes.io/version": "v1.21.1", + "helm.sh/chart": "cert-manager-v1.21.1" }, name: "cert-manager-cainjector", namespace: "cert-manager" @@ -10286,8 +10873,8 @@ export const Deployment_CertManagerCainjector: AppsV1Deployment = { "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "cainjector", - "app.kubernetes.io/version": "v1.17.0", - "helm.sh/chart": "cert-manager-v1.17.0" + "app.kubernetes.io/version": "v1.21.1", + "helm.sh/chart": "cert-manager-v1.21.1" } }, spec: { @@ -10301,7 +10888,7 @@ export const Deployment_CertManagerCainjector: AppsV1Deployment = { } } }], - image: "quay.io/jetstack/cert-manager-cainjector:v1.17.0", + image: "quay.io/jetstack/cert-manager-cainjector:v1.21.1", imagePullPolicy: "IfNotPresent", name: "cert-manager-cainjector", ports: [{ @@ -10332,7 +10919,7 @@ export const Deployment_CertManagerCainjector: AppsV1Deployment = { } } }; -export const Deployment_CertManager: AppsV1Deployment = { +export const Deployment_CertManager: KubernetesResource = { apiVersion: "apps/v1", kind: "Deployment", metadata: { @@ -10342,8 +10929,8 @@ export const Deployment_CertManager: AppsV1Deployment = { "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "cert-manager", - "app.kubernetes.io/version": "v1.17.0", - "helm.sh/chart": "cert-manager-v1.17.0" + "app.kubernetes.io/version": "v1.21.1", + "helm.sh/chart": "cert-manager-v1.21.1" }, name: "cert-manager", namespace: "cert-manager" @@ -10370,13 +10957,13 @@ export const Deployment_CertManager: AppsV1Deployment = { "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "cert-manager", - "app.kubernetes.io/version": "v1.17.0", - "helm.sh/chart": "cert-manager-v1.17.0" + "app.kubernetes.io/version": "v1.21.1", + "helm.sh/chart": "cert-manager-v1.21.1" } }, spec: { containers: [{ - args: ["--v=2", "--cluster-resource-namespace=$(POD_NAMESPACE)", "--leader-election-namespace=cert-manager", "--acme-http01-solver-image=quay.io/jetstack/cert-manager-acmesolver:v1.17.0", "--max-concurrent-challenges=60"], + args: ["--v=2", "--cluster-resource-namespace=$(POD_NAMESPACE)", "--leader-election-namespace=cert-manager", "--acme-http01-solver-image=quay.io/jetstack/cert-manager-acmesolver:v1.21.1", "--max-concurrent-challenges=60"], env: [{ name: "POD_NAMESPACE", valueFrom: { @@ -10385,7 +10972,7 @@ export const Deployment_CertManager: AppsV1Deployment = { } } }], - image: "quay.io/jetstack/cert-manager-controller:v1.17.0", + image: "quay.io/jetstack/cert-manager-controller:v1.21.1", imagePullPolicy: "IfNotPresent", livenessProbe: { failureThreshold: 8, @@ -10432,7 +11019,7 @@ export const Deployment_CertManager: AppsV1Deployment = { } } }; -export const Deployment_CertManagerWebhook: AppsV1Deployment = { +export const Deployment_CertManagerWebhook: KubernetesResource = { apiVersion: "apps/v1", kind: "Deployment", metadata: { @@ -10442,8 +11029,8 @@ export const Deployment_CertManagerWebhook: AppsV1Deployment = { "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "webhook", - "app.kubernetes.io/version": "v1.17.0", - "helm.sh/chart": "cert-manager-v1.17.0" + "app.kubernetes.io/version": "v1.21.1", + "helm.sh/chart": "cert-manager-v1.21.1" }, name: "cert-manager-webhook", namespace: "cert-manager" @@ -10470,8 +11057,8 @@ export const Deployment_CertManagerWebhook: AppsV1Deployment = { "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "webhook", - "app.kubernetes.io/version": "v1.17.0", - "helm.sh/chart": "cert-manager-v1.17.0" + "app.kubernetes.io/version": "v1.21.1", + "helm.sh/chart": "cert-manager-v1.21.1" } }, spec: { @@ -10485,13 +11072,13 @@ export const Deployment_CertManagerWebhook: AppsV1Deployment = { } } }], - image: "quay.io/jetstack/cert-manager-webhook:v1.17.0", + image: "quay.io/jetstack/cert-manager-webhook:v1.21.1", imagePullPolicy: "IfNotPresent", livenessProbe: { failureThreshold: 3, httpGet: { path: "/livez", - port: 6080, + port: "healthcheck", scheme: "HTTP" }, initialDelaySeconds: 60, @@ -10517,7 +11104,7 @@ export const Deployment_CertManagerWebhook: AppsV1Deployment = { failureThreshold: 3, httpGet: { path: "/healthz", - port: 6080, + port: "healthcheck", scheme: "HTTP" }, initialDelaySeconds: 5, @@ -10548,7 +11135,7 @@ export const Deployment_CertManagerWebhook: AppsV1Deployment = { } } }; -export const MutatingWebhookConfiguration_CertManagerWebhook: AdmissionregistrationK8sIoV1MutatingWebhookConfiguration = { +export const MutatingWebhookConfiguration_CertManagerWebhook: KubernetesResource = { apiVersion: "admissionregistration.k8s.io/v1", kind: "MutatingWebhookConfiguration", metadata: { @@ -10561,8 +11148,8 @@ export const MutatingWebhookConfiguration_CertManagerWebhook: Admissionregistrat "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "webhook", - "app.kubernetes.io/version": "v1.17.0", - "helm.sh/chart": "cert-manager-v1.17.0" + "app.kubernetes.io/version": "v1.21.1", + "helm.sh/chart": "cert-manager-v1.21.1" }, name: "cert-manager-webhook" }, @@ -10588,7 +11175,7 @@ export const MutatingWebhookConfiguration_CertManagerWebhook: Admissionregistrat timeoutSeconds: 30 }] }; -export const ValidatingWebhookConfiguration_CertManagerWebhook: AdmissionregistrationK8sIoV1ValidatingWebhookConfiguration = { +export const ValidatingWebhookConfiguration_CertManagerWebhook: KubernetesResource = { apiVersion: "admissionregistration.k8s.io/v1", kind: "ValidatingWebhookConfiguration", metadata: { @@ -10601,8 +11188,8 @@ export const ValidatingWebhookConfiguration_CertManagerWebhook: Admissionregistr "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "webhook", - "app.kubernetes.io/version": "v1.17.0", - "helm.sh/chart": "cert-manager-v1.17.0" + "app.kubernetes.io/version": "v1.21.1", + "helm.sh/chart": "cert-manager-v1.21.1" }, name: "cert-manager-webhook" }, @@ -10635,7 +11222,7 @@ export const ValidatingWebhookConfiguration_CertManagerWebhook: Admissionregistr timeoutSeconds: 30 }] }; -export const ServiceAccount_CertManagerStartupapicheck: ServiceAccount = { +export const ServiceAccount_CertManagerStartupapicheck: KubernetesResource = { apiVersion: "v1", kind: "ServiceAccount", metadata: { @@ -10650,15 +11237,15 @@ export const ServiceAccount_CertManagerStartupapicheck: ServiceAccount = { "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "startupapicheck", - "app.kubernetes.io/version": "v1.17.0", - "helm.sh/chart": "cert-manager-v1.17.0" + "app.kubernetes.io/version": "v1.21.1", + "helm.sh/chart": "cert-manager-v1.21.1" }, name: "cert-manager-startupapicheck", namespace: "cert-manager" }, automountServiceAccountToken: true }; -export const Role_CertManagerStartupapicheckCreateCert: RbacAuthorizationK8sIoV1Role = { +export const Role_CertManagerStartupapicheckCreateCert: KubernetesResource = { apiVersion: "rbac.authorization.k8s.io/v1", kind: "Role", metadata: { @@ -10673,8 +11260,8 @@ export const Role_CertManagerStartupapicheckCreateCert: RbacAuthorizationK8sIoV1 "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "startupapicheck", - "app.kubernetes.io/version": "v1.17.0", - "helm.sh/chart": "cert-manager-v1.17.0" + "app.kubernetes.io/version": "v1.21.1", + "helm.sh/chart": "cert-manager-v1.21.1" }, name: "cert-manager-startupapicheck:create-cert", namespace: "cert-manager" @@ -10685,7 +11272,7 @@ export const Role_CertManagerStartupapicheckCreateCert: RbacAuthorizationK8sIoV1 verbs: ["create"] }] }; -export const RoleBinding_CertManagerStartupapicheckCreateCert: RbacAuthorizationK8sIoV1RoleBinding = { +export const RoleBinding_CertManagerStartupapicheckCreateCert: KubernetesResource = { apiVersion: "rbac.authorization.k8s.io/v1", kind: "RoleBinding", metadata: { @@ -10700,8 +11287,8 @@ export const RoleBinding_CertManagerStartupapicheckCreateCert: RbacAuthorization "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "startupapicheck", - "app.kubernetes.io/version": "v1.17.0", - "helm.sh/chart": "cert-manager-v1.17.0" + "app.kubernetes.io/version": "v1.21.1", + "helm.sh/chart": "cert-manager-v1.21.1" }, name: "cert-manager-startupapicheck:create-cert", namespace: "cert-manager" @@ -10717,7 +11304,7 @@ export const RoleBinding_CertManagerStartupapicheckCreateCert: RbacAuthorization namespace: "cert-manager" }] }; -export const Job_CertManagerStartupapicheck: BatchV1Job = { +export const Job_CertManagerStartupapicheck: KubernetesResource = { apiVersion: "batch/v1", kind: "Job", metadata: { @@ -10732,8 +11319,8 @@ export const Job_CertManagerStartupapicheck: BatchV1Job = { "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "startupapicheck", - "app.kubernetes.io/version": "v1.17.0", - "helm.sh/chart": "cert-manager-v1.17.0" + "app.kubernetes.io/version": "v1.21.1", + "helm.sh/chart": "cert-manager-v1.21.1" }, name: "cert-manager-startupapicheck", namespace: "cert-manager" @@ -10748,8 +11335,8 @@ export const Job_CertManagerStartupapicheck: BatchV1Job = { "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "startupapicheck", - "app.kubernetes.io/version": "v1.17.0", - "helm.sh/chart": "cert-manager-v1.17.0" + "app.kubernetes.io/version": "v1.21.1", + "helm.sh/chart": "cert-manager-v1.21.1" } }, spec: { @@ -10763,7 +11350,7 @@ export const Job_CertManagerStartupapicheck: BatchV1Job = { } } }], - image: "quay.io/jetstack/cert-manager-startupapicheck:v1.17.0", + image: "quay.io/jetstack/cert-manager-startupapicheck:v1.21.1", imagePullPolicy: "IfNotPresent", name: "cert-manager-startupapicheck", securityContext: { @@ -10790,7 +11377,7 @@ export const Job_CertManagerStartupapicheck: BatchV1Job = { } } }; -export const resources: ReadonlyArray = [Namespace_CertManager, ServiceAccount_CertManagerCainjector, ServiceAccount_CertManager, ServiceAccount_CertManagerWebhook, CustomResourceDefinition_CertificaterequestsCertManagerIo, CustomResourceDefinition_CertificatesCertManagerIo, CustomResourceDefinition_ChallengesAcmeCertManagerIo, CustomResourceDefinition_ClusterissuersCertManagerIo, CustomResourceDefinition_IssuersCertManagerIo, CustomResourceDefinition_OrdersAcmeCertManagerIo, ClusterRole_CertManagerCainjector, ClusterRole_CertManagerControllerIssuers, ClusterRole_CertManagerControllerClusterissuers, ClusterRole_CertManagerControllerCertificates, ClusterRole_CertManagerControllerOrders, ClusterRole_CertManagerControllerChallenges, ClusterRole_CertManagerControllerIngressShim, ClusterRole_CertManagerClusterView, ClusterRole_CertManagerView, ClusterRole_CertManagerEdit, ClusterRole_CertManagerControllerApproveCertManagerIo, ClusterRole_CertManagerControllerCertificatesigningrequests, ClusterRole_CertManagerWebhookSubjectaccessreviews, ClusterRoleBinding_CertManagerCainjector, ClusterRoleBinding_CertManagerControllerIssuers, ClusterRoleBinding_CertManagerControllerClusterissuers, ClusterRoleBinding_CertManagerControllerCertificates, ClusterRoleBinding_CertManagerControllerOrders, ClusterRoleBinding_CertManagerControllerChallenges, ClusterRoleBinding_CertManagerControllerIngressShim, ClusterRoleBinding_CertManagerControllerApproveCertManagerIo, ClusterRoleBinding_CertManagerControllerCertificatesigningrequests, ClusterRoleBinding_CertManagerWebhookSubjectaccessreviews, Role_CertManagerCainjectorLeaderelection, Role_CertManagerLeaderelection, Role_CertManagerTokenrequest, Role_CertManagerWebhookDynamicServing, RoleBinding_CertManagerCainjectorLeaderelection, RoleBinding_CertManagerLeaderelection, RoleBinding_CertManagerCertManagerTokenrequest, RoleBinding_CertManagerWebhookDynamicServing, Service_CertManagerCainjector, Service_CertManager, Service_CertManagerWebhook, Deployment_CertManagerCainjector, Deployment_CertManager, Deployment_CertManagerWebhook, MutatingWebhookConfiguration_CertManagerWebhook, ValidatingWebhookConfiguration_CertManagerWebhook, ServiceAccount_CertManagerStartupapicheck, Role_CertManagerStartupapicheckCreateCert, RoleBinding_CertManagerStartupapicheckCreateCert, Job_CertManagerStartupapicheck]; +export const resources: ReadonlyArray = [Namespace_CertManager, ServiceAccount_CertManagerCainjector, ServiceAccount_CertManager, ServiceAccount_CertManagerWebhook, CustomResourceDefinition_ChallengesAcmeCertManagerIo, CustomResourceDefinition_OrdersAcmeCertManagerIo, CustomResourceDefinition_CertificaterequestsCertManagerIo, CustomResourceDefinition_CertificatesCertManagerIo, CustomResourceDefinition_ClusterissuersCertManagerIo, CustomResourceDefinition_IssuersCertManagerIo, ClusterRole_CertManagerCainjector, ClusterRole_CertManagerControllerIssuers, ClusterRole_CertManagerControllerClusterissuers, ClusterRole_CertManagerControllerCertificates, ClusterRole_CertManagerControllerOrders, ClusterRole_CertManagerControllerChallenges, ClusterRole_CertManagerControllerIngressShim, ClusterRole_CertManagerClusterView, ClusterRole_CertManagerView, ClusterRole_CertManagerEdit, ClusterRole_CertManagerControllerApproveCertManagerIo, ClusterRole_CertManagerControllerCertificatesigningrequests, ClusterRole_CertManagerWebhookSubjectaccessreviews, ClusterRoleBinding_CertManagerCainjector, ClusterRoleBinding_CertManagerControllerIssuers, ClusterRoleBinding_CertManagerControllerClusterissuers, ClusterRoleBinding_CertManagerControllerCertificates, ClusterRoleBinding_CertManagerControllerOrders, ClusterRoleBinding_CertManagerControllerChallenges, ClusterRoleBinding_CertManagerControllerIngressShim, ClusterRoleBinding_CertManagerControllerApproveCertManagerIo, ClusterRoleBinding_CertManagerControllerCertificatesigningrequests, ClusterRoleBinding_CertManagerWebhookSubjectaccessreviews, Role_CertManagerCainjectorLeaderelection, Role_CertManagerLeaderelection, Role_CertManagerWebhookDynamicServing, RoleBinding_CertManagerCainjectorLeaderelection, RoleBinding_CertManagerLeaderelection, RoleBinding_CertManagerWebhookDynamicServing, Service_CertManagerCainjector, Service_CertManager, Service_CertManagerWebhook, Deployment_CertManagerCainjector, Deployment_CertManager, Deployment_CertManagerWebhook, MutatingWebhookConfiguration_CertManagerWebhook, ValidatingWebhookConfiguration_CertManagerWebhook, ServiceAccount_CertManagerStartupapicheck, Role_CertManagerStartupapicheckCreateCert, RoleBinding_CertManagerStartupapicheckCreateCert, Job_CertManagerStartupapicheck]; export default { resources: resources }; diff --git a/packages/manifests/src/generated/cilium.ts b/packages/manifests/src/generated/cilium.ts new file mode 100644 index 0000000..bf1affa --- /dev/null +++ b/packages/manifests/src/generated/cilium.ts @@ -0,0 +1,1608 @@ +/** Auto-generated typed resources for operator: cilium*/ +import type { KubernetesResource } from "@kubernetesjs/ops"; +export const Namespace_KubeSystem: KubernetesResource = { + apiVersion: "v1", + kind: "Namespace", + metadata: { + labels: { + "app.kubernetes.io/name": "kube-system" + }, + name: "kube-system" + } +}; +export const Namespace_CiliumSecrets: KubernetesResource = { + apiVersion: "v1", + kind: "Namespace", + metadata: { + annotations: null, + labels: { + "app.kubernetes.io/part-of": "cilium" + }, + name: "cilium-secrets" + } +}; +export const ServiceAccount_Cilium: KubernetesResource = { + apiVersion: "v1", + kind: "ServiceAccount", + metadata: { + name: "cilium", + namespace: "kube-system" + } +}; +export const ServiceAccount_CiliumEnvoy: KubernetesResource = { + apiVersion: "v1", + kind: "ServiceAccount", + metadata: { + name: "cilium-envoy", + namespace: "kube-system" + } +}; +export const ServiceAccount_CiliumOperator: KubernetesResource = { + apiVersion: "v1", + kind: "ServiceAccount", + metadata: { + name: "cilium-operator", + namespace: "kube-system" + } +}; +export const Secret_CiliumCa: KubernetesResource = { + apiVersion: "v1", + kind: "Secret", + metadata: { + labels: { + "cilium.io/helm-template-non-idempotent": "true" + }, + name: "cilium-ca", + namespace: "kube-system" + }, + data: { + "ca.crt": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURFekNDQWZ1Z0F3SUJBZ0lRVlpkb3h2NDVNSDh4WFVZQk9RME9MakFOQmdrcWhraUc5dzBCQVFzRkFEQVUKTVJJd0VBWURWUVFERXdsRGFXeHBkVzBnUTBFd0hoY05Nall3T0RFeU1qRXpOVFF5V2hjTk1qa3dPREV4TWpFegpOVFF5V2pBVU1SSXdFQVlEVlFRREV3bERhV3hwZFcwZ1EwRXdnZ0VpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElCCkR3QXdnZ0VLQW9JQkFRRE56RnYxUFZEaENUSlRFT01oaFZhR243YlB4M3hISnQ5bFIrRDhxck1qb1pleWZ5MmkKZkhOYXl4YUlSeVBkMzRselpCejJuRCtpMnhCM3VrcC9EYTU1aUNUSFdRdkJXVWhtRWgyaG5TM0ErUFVRdDVZRgpvZWV2a3Z0eEFLczB4YnBoR0hJNjlqTkRLZHFJYkxIOXl3UWdOdUZ1bGVZdWFMazIwd0F4dTJWVDFYZisvVklPClgrVlZTZkg0aEkveFUyT2F4OUtyYTlkQ1RkVDdWQ2M0SFVxRFF2SlMwQlJGeDNPaTFFVElUT2Vzd3kreklQNzYKL0dLamJsMWFobzB0VGJTWXJ5SWJqSzQweVF5cGcxNnAyb25Eeks4SkZFSHBnVG1VSy9FNE8zd1BIL05yVEdhTQpkV2lTVmZQbzduaE1OdFFsNXVHWFh3alJlVWhuQmdXU2l4a0xBZ01CQUFHallUQmZNQTRHQTFVZER3RUIvd1FFCkF3SUNwREFkQmdOVkhTVUVGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXcKQXdFQi96QWRCZ05WSFE0RUZnUVV3L0s4V1p4WU1YUGJLY2xRd1haZ3Y1LzZONTB3RFFZSktvWklodmNOQVFFTApCUUFEZ2dFQkFIRDNQNWt3SE1ycnQxSHM0TGlkS2UxbTJmQ2FmcVV3b1JiSC9BaWJZd1pTNVdXUzkwNXduNEplCkovejdmampOWnI5enRHZklCM0RZVDZqTWh0ejQ3ZkhQM0pzYVU3enNxL1RsME5HbDBSTXBLbnk4VFBYcHFvNUcKMWNNUTBxdFUvSGcrYWJuVUxJRDVUa25JWktDOWRZT1dVcGtGNHBBcEtXWTViUVMxZldPTGJ6ay8zbmVTVlNkRgp2MUIxZXpvNG9TZ0o4Q3RqOXdjOWtEVUMvTWdjNUNmdGgyNWVTZ1o3SytqaC9LUE1DK0VVRmJ5TEJTTGVsZi9rCmhjYzYwVUdNQ1FxNllPbWNiZjF6QitucTBHUDdXZUYrZHI5MnowS1BnWEZKQmVOU3U4WlN6dlgwbkRKdUM4QjEKSEdRS2hUWjlGWUJkN3V6bXFZZVBrT3huNytIbnB3QT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=", + "ca.key": "LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFcEFJQkFBS0NBUUVBemN4YjlUMVE0UWt5VXhEaklZVldocCsyejhkOFJ5YmZaVWZnL0txekk2R1hzbjh0Cm9ueHpXc3NXaUVjajNkK0pjMlFjOXB3L290c1FkN3BLZncydWVZZ2t4MWtMd1ZsSVpoSWRvWjB0d1BqMUVMZVcKQmFIbnI1TDdjUUNyTk1XNllSaHlPdll6UXluYWlHeXgvY3NFSURiaGJwWG1MbWk1TnRNQU1idGxVOVYzL3YxUwpEbC9sVlVueCtJU1A4Vk5qbXNmU3EydlhRazNVKzFRbk9CMUtnMEx5VXRBVVJjZHpvdFJFeUV6bnJNTXZzeUQrCit2eGlvMjVkV29hTkxVMjBtSzhpRzR5dU5Na01xWU5lcWRxSnc4eXZDUlJCNllFNWxDdnhPRHQ4RHgvemEweG0KakhWb2tsWHo2TzU0VERiVUplYmhsMThJMFhsSVp3WUZrb3NaQ3dJREFRQUJBb0lCQUNJRTZhQ1pBYkVwZFlXdwpzWE1kbVFlSkNFM0JrcVFxWTF4WkxQSm5mMVJoQm5RTnZPdnl1WmpsSUhUbm1hQzRMbjhDS2gyRUI2cnlubjdFCkwwTmdiaHFON0ZKOXdFazJhcGJnNE1BUi9QbTh6Ym4xTnhuNFFSWFBiTHdwMmFOUUdqYXB0VnhVelhXSlNpUXEKSDZRdDlxRWlvVkpIK2pScXdFODFRdjkxbEZMdWx6OUlJSGNEOE10STQ0QnFBQ0hHVEVhUzZ2ZFR2QWl6M1pMUApzVVAwZTQweXlYKzhDcmpjdytnSkcwYUVMNytqL3YrMmhLNmVJMzJUcGc4YStqNjlQMmxPNE10eUp1UWNmKzJUCjJCQXk3Z1R1KzVmazM3Q0hvVEIrN1NWekFDQTdObW92cFkyeDJXYTJVVXBLOEZkTEdQS255cE1SbTNSRklCVFcKaWo2SzFWRUNnWUVBOEcvYm1qWTFFQVVEejRSbHJYSzlpeCtiQTM1RXFBV21KM2lkVkJGMGxoazl6d0o1OGFyRgpoZTduTFJtOUxOMmwxSW9UV1lmVlFuWWRjZ3dicHhzR3RwZ2tZUDFtMGFXbWZvR0NSN0h3TW56ZThRUFNZVCtkCjJZUkhPc3VJUERZdmdRL1dtRjZ6enVhQXpKdHJ2SFlUUUpuQW4weGx0MmVGQlJROU9BNEpCUHNDZ1lFQTJ4NkcKSkR2VXJtbWdCSlBlT0JQS0ZGY0tJWGFtbEU1QURVclNiRjM0ejhraTRrdFRhekJFOENFeFhYNjQrMjR6V2tyOApkU2hxQWsyWGlSR1hrRS9BZ2d3cFROWXh6NEpJV2VoWmJieitQcEFacFp6OUs1TUVxbEZTd1l1d0lOL1J5Mnd6CmJBS000L0NzdGNTVU1ZV3cwa2U3MkliSE5ZNTVHdFZqQTB4b1h6RUNnWUVBbWJHWE9pT3VsYmZ1OEtjY2E5eHQKeDFJRHdCN2wrbFhxR1U4am1zcXhzUVVmbW9WbHVCTEd3cyt0WFFvWUFHY0xDeXJjSlo0THQ3bFRKMFVRSkNqRgppTkVHYUMxem5VMzdlT0NHakJmMWlBQ0VicUpYeUN4blZkVVZ4MEsxcW0ra3ZDYUlzY3ZQdXRGandlY1QzbHZJCkFNS0gvQXhVOVFFcWFjMi9PR2JZWXlNQ2dZQlJaSTAvZUZvUVQzdjVOMVFjVUgySUFLenFzVUEvWnJHMFBrN2IKb2l5Q1FweUtvcUJoK0pRaS9yRnZvVnJsU3BJWXdESDI4d1F0eHRTN1BhV25IWGpNMWVlaGV3OFZuYmR5YmpTSgo1dUlxS3l6YnIrejYrcW1JK3B4YStLQjhGYWZBZ0hpNWJsa1hjcGMxRGNoZWZPS3B1YXUxU3B0RThaOWFzRmtQCktKcThnUUtCZ1FDZ2xRZzFnQ09YMzhOa2dFNEc5ak9FdHFQMGxFMFNMbmtHckYwQVJiYkJ4aGlwOTdyVFhCeWMKMkpPRHJaWTA1Z0lPVWxWdVpieU8rdXpQaDNiZERxTUpYQ3pjWm9rVjRoU1piOFlwSVVVU0hQdGhOandmazcrdwovUXlickpLUndQNS91bnVPVzFMVEtYbUg3ZjVlVGpqeDBXc0FMZWtVc3J3VnppWWNVWEJmVVE9PQotLS0tLUVORCBSU0EgUFJJVkFURSBLRVktLS0tLQo=" + } +}; +export const Secret_HubbleServerCerts: KubernetesResource = { + apiVersion: "v1", + kind: "Secret", + metadata: { + annotations: null, + labels: { + "cilium.io/helm-template-non-idempotent": "true" + }, + name: "hubble-server-certs", + namespace: "kube-system" + }, + data: { + "ca.crt": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURFekNDQWZ1Z0F3SUJBZ0lRVlpkb3h2NDVNSDh4WFVZQk9RME9MakFOQmdrcWhraUc5dzBCQVFzRkFEQVUKTVJJd0VBWURWUVFERXdsRGFXeHBkVzBnUTBFd0hoY05Nall3T0RFeU1qRXpOVFF5V2hjTk1qa3dPREV4TWpFegpOVFF5V2pBVU1SSXdFQVlEVlFRREV3bERhV3hwZFcwZ1EwRXdnZ0VpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElCCkR3QXdnZ0VLQW9JQkFRRE56RnYxUFZEaENUSlRFT01oaFZhR243YlB4M3hISnQ5bFIrRDhxck1qb1pleWZ5MmkKZkhOYXl4YUlSeVBkMzRselpCejJuRCtpMnhCM3VrcC9EYTU1aUNUSFdRdkJXVWhtRWgyaG5TM0ErUFVRdDVZRgpvZWV2a3Z0eEFLczB4YnBoR0hJNjlqTkRLZHFJYkxIOXl3UWdOdUZ1bGVZdWFMazIwd0F4dTJWVDFYZisvVklPClgrVlZTZkg0aEkveFUyT2F4OUtyYTlkQ1RkVDdWQ2M0SFVxRFF2SlMwQlJGeDNPaTFFVElUT2Vzd3kreklQNzYKL0dLamJsMWFobzB0VGJTWXJ5SWJqSzQweVF5cGcxNnAyb25Eeks4SkZFSHBnVG1VSy9FNE8zd1BIL05yVEdhTQpkV2lTVmZQbzduaE1OdFFsNXVHWFh3alJlVWhuQmdXU2l4a0xBZ01CQUFHallUQmZNQTRHQTFVZER3RUIvd1FFCkF3SUNwREFkQmdOVkhTVUVGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXcKQXdFQi96QWRCZ05WSFE0RUZnUVV3L0s4V1p4WU1YUGJLY2xRd1haZ3Y1LzZONTB3RFFZSktvWklodmNOQVFFTApCUUFEZ2dFQkFIRDNQNWt3SE1ycnQxSHM0TGlkS2UxbTJmQ2FmcVV3b1JiSC9BaWJZd1pTNVdXUzkwNXduNEplCkovejdmampOWnI5enRHZklCM0RZVDZqTWh0ejQ3ZkhQM0pzYVU3enNxL1RsME5HbDBSTXBLbnk4VFBYcHFvNUcKMWNNUTBxdFUvSGcrYWJuVUxJRDVUa25JWktDOWRZT1dVcGtGNHBBcEtXWTViUVMxZldPTGJ6ay8zbmVTVlNkRgp2MUIxZXpvNG9TZ0o4Q3RqOXdjOWtEVUMvTWdjNUNmdGgyNWVTZ1o3SytqaC9LUE1DK0VVRmJ5TEJTTGVsZi9rCmhjYzYwVUdNQ1FxNllPbWNiZjF6QitucTBHUDdXZUYrZHI5MnowS1BnWEZKQmVOU3U4WlN6dlgwbkRKdUM4QjEKSEdRS2hUWjlGWUJkN3V6bXFZZVBrT3huNytIbnB3QT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=", + "tls.crt": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURWekNDQWorZ0F3SUJBZ0lSQU9FVnZPc0tSQTRpM0R1akJxNlFkdHN3RFFZSktvWklodmNOQVFFTEJRQXcKRkRFU01CQUdBMVVFQXhNSlEybHNhWFZ0SUVOQk1CNFhEVEkyTURneE1qSXhNelUwTWxvWERUSTNNRGd4TWpJeApNelUwTWxvd0tqRW9NQ1lHQTFVRUF3d2ZLaTVrWldaaGRXeDBMbWgxWW1Kc1pTMW5jbkJqTG1OcGJHbDFiUzVwCmJ6Q0NBU0l3RFFZSktvWklodmNOQVFFQkJRQURnZ0VQQURDQ0FRb0NnZ0VCQU5TVVlFS1VhajZQZEZlaHF1QWIKRWpQWmJ4UmIxbDVuUTNXYkZxdDFZdThHSGJSRU1TT1k5WGFJa3Q3TGF4NHVXQXdUMGV6bVY2Vk04cTExMnM0LwovRGI5UkY3R2xVYlgxK1BaQmFCcTlDUXQrUGFNZXlKelRpbFJaUzY5VkxOL0EyRU5sQWZmaDBJdkZkeFV6cVdqCjNnNWZrTlF5ZjVZV08rQUZUWkFBaXVTRjFUN09KaEJBZEtwSlAvZVc4dVYvMzRrTlovTDFDb0xpaFhFajgxTnAKMi91SG43aU4xWjdYSHk0RzBpb1JmY214d0Z5MTBCdU5CakFxejNwR3NsTFFaU1JFbW50QTl5THc0M3RsWHZ3UApTOEEyUmJoQUZVNEs0ZlljaDBtK0Y2bEdMUVcrNDYwa2toTFk3MkVWQjdGMEFLZHNWK3BYcTJaWnFVOWdBWC9xCkdWMENBd0VBQWFPQmpUQ0JpakFPQmdOVkhROEJBZjhFQkFNQ0JhQXdIUVlEVlIwbEJCWXdGQVlJS3dZQkJRVUgKQXdFR0NDc0dBUVVGQndNQ01Bd0dBMVVkRXdFQi93UUNNQUF3SHdZRFZSMGpCQmd3Rm9BVXcvSzhXWnhZTVhQYgpLY2xRd1haZ3Y1LzZONTB3S2dZRFZSMFJCQ013SVlJZktpNWtaV1poZFd4MExtaDFZbUpzWlMxbmNuQmpMbU5wCmJHbDFiUzVwYnpBTkJna3Foa2lHOXcwQkFRc0ZBQU9DQVFFQWZEQmw5OWxWNzg1UFVqQ2VkMS9ES0k5dVljSSsKdXZlenRQRVJhNGdWelc2cEg4SkNSSEcwS1A2QW1oaEgxV2N4US84N3NWWHRyRi9YZ3VDNm1FMmxXdzY4UjBieApaRHBiZE1jRTVoM013cDkwcEJucEdMWk9SWXcrVmlkQytTY1UxZlQyZHIyMHhxS1pROW5IaGxnVTY1akRKQUowCkNEemNMVHE2ZHJZUkNPNlJDeXJQcmJrcjZRNEh3aGVjb3U3a3kxenNyRFZyMmwwNlBTbkVQM2dLUUMzdHR4RlcKOEh3cG1VdjV6MmxFVmUvajZpRmY2RlBtcWZyYTMxcWYyWG9pVkZmVXM3R05jeWZVSFk4MkR6dEMxU015Vk5aaAp6eGxseUpuQU4wQVZGSmdnYUNCcjd4a1l0MWlHS1pSbEpNUjdycTVVK3hQQjFNcGduMXkzU290aTF3PT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=", + "tls.key": "LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb2dJQkFBS0NBUUVBMUpSZ1FwUnFQbzkwVjZHcTRCc1NNOWx2RkZ2V1htZERkWnNXcTNWaTd3WWR0RVF4Ckk1ajFkb2lTM3N0ckhpNVlEQlBSN09aWHBVenlyWFhhemovOE52MUVYc2FWUnRmWDQ5a0ZvR3IwSkMzNDlveDcKSW5OT0tWRmxMcjFVczM4RFlRMlVCOStIUWk4VjNGVE9wYVBlRGwrUTFESi9saFk3NEFWTmtBQ0s1SVhWUHM0bQpFRUIwcWtrLzk1Ynk1WC9maVExbjh2VUtndUtGY1NQelUybmIrNGVmdUkzVm50Y2ZMZ2JTS2hGOXliSEFYTFhRCkc0MEdNQ3JQZWtheVV0QmxKRVNhZTBEM0l2RGplMlZlL0E5THdEWkZ1RUFWVGdyaDloeUhTYjRYcVVZdEJiN2oKclNTU0V0anZZUlVIc1hRQXAyeFg2bGVyWmxtcFQyQUJmK29aWFFJREFRQUJBb0lCQUQwNEc3NmcwallCQng3RAplcHUrZ0EvNWdzRklyMlFSZGY1MDh1TGUwK2FGQ3VIaXI0b1NYMEpMRTR6ZzVSRFVoTnU1aTMrZldFZE04U2hlCkkreTR4WkFxZ05tUWMrWHFmQXhzYisvaVRUdnNGMklkVThxNGpSNWVCL2NkWkRxckRkU1IzZnNrZHVYcS9HOHUKNXpJUmpuM3lMSm5IanpHd1puN2QyQmZyNkJQbUpvTkxKbzZsVks1Tmx4VXhpRzdVak1nZlBwVmdUc3BQa1lEUQoxZEpaSmJQam55UGtqdXRPZVZLSnh0MUZyL21sdGVLYTk0d3dNdS9FQjlHSFVxVzlpZ2t1N2Z5MUhRLzJLSmRUCkVKYytZRlAvclhGeFBxcWlGN3FDWVNoQlRRZFVHemxYNENIVTVMeHAxR09xZmo0VFkvbGQyVFRZL24zUnBoay8KYU4vaGM5c0NnWUVBNi9xWmFKd0RTTzFaV3NNcEtnWTZrWUxrYmFZbTZnUnlIYmpVUWQzRUg0V3VHSHRJZnZLRgpnRkRCUm53anExR1NqRnloYnoybWZZYXBVbkZnT20waGRmSGs0aGFtNzJBL2EyVEZxMmhpYmlYTEljMVFwaVA3Ckptby9aVStNTi9Qeno0cy9EdmJCZDdLL3U2Z0lob3pvWUl3UDlGY1d3TkNFajI5Z1E0MXBqRThDZ1lFQTVwMk0Kd0lXMFFHRndBSU1WdWJyVXoyK1BCOG1yaENJbEVzRzJuV3FRNkhEcjdXeG82YVhJVGNJZk9vbjRXNmFoV3lETwpBMXJDc0hXWXpBZlkzamtjNkU5ZURtOHVJMzkwR3RtSGpVdUsybHMzanFheE9uRldNd3p1TlNDN0RtVFBrdHAvClJMR25KeFNubGdBMUJ6T1h4WE9yOHBQbEtIcjEwMGhZdjByKytKTUNnWUE3bVVjMWpIR244WW9ueWpLVFVvOW8KUU03QWdyNUJURzRsNDVCNE1qSmVZN3pjb2dabFNZcytKU2NyVGg4VUhiNE5oVGVnaU1tTDJuN1pPNWs2S0dYVApEQXpxclIzc1J6cTlQTzVQcEVWMzNFTzVmY2xvckoyNXpndkU0cHBmWjFXa2pWNlh3T3FMK0xGRUMrUmJWeXM1CmR5WndaNjV2ZERxR24zS0luU2FUTVFLQmdHVldDY2wzZHpOckhZbzhEOG5qWFN3aHUxb1N0am1EdjRLMGVJaEgKa1pGeVBWbkE3NERzQms2VTVLQVdqSG5KaU5IQVlvWjYxVjR3N29tSlVUU2xLQnkwODRHb1BULy8rNGJvMjNXdApJa0M5SUhhZ3JQUWZaVjlkYVRjVFFOOGNVVklZalNBa2FHejEySVpEWlFuYkUvQUIyaWJuOGlTTms0UGFJSlUrCllUZmRBb0dBU01EejBGb0dGNDBZbU1VRU9MVHRpVmMxQ1BQT21Zdks0c3ByRjQvWDh5eGYyL2luSy9UQk1sTC8KdzVhaWQ4Ym02dDhOUUErcVM5SWdNdnpTU3lFaUdmbjZsMmtDN1haWGI4UWI2SUF2SmF4ZzRLTElxN3ZIek5tegp1ZXd5YllTRWJVVjNYQVBPdlF2N0NkbGxqUWRDWHQwb3pmK2hnU0F2RjZCNTA4YkY4eUk9Ci0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg==" + }, + type: "kubernetes.io/tls" +}; +export const ConfigMap_CiliumConfig: KubernetesResource = { + apiVersion: "v1", + kind: "ConfigMap", + metadata: { + name: "cilium-config", + namespace: "kube-system" + }, + data: { + "agent-not-ready-taint-key": "node.cilium.io/agent-not-ready", + "auto-direct-node-routes": "false", + "bpf-distributed-lru": "false", + "bpf-events-drop-enabled": "true", + "bpf-events-policy-verdict-enabled": "true", + "bpf-events-trace-enabled": "true", + "bpf-lb-acceleration": "disabled", + "bpf-lb-algorithm-annotation": "false", + "bpf-lb-external-clusterip": "false", + "bpf-lb-map-max": "65536", + "bpf-lb-mode-annotation": "false", + "bpf-lb-sock": "false", + "bpf-lb-source-range-all-types": "false", + "bpf-map-dynamic-size-ratio": "0.0025", + "bpf-policy-map-max": "16384", + "bpf-policy-stats-map-max": "65536", + "bpf-root": "/sys/fs/bpf", + "cgroup-root": "/run/cilium/cgroupv2", + "cilium-endpoint-gc-interval": "5m0s", + "cluster-id": "0", + "cluster-name": "default", + "cluster-pool-ipv4-cidr": "10.0.0.0/8", + "cluster-pool-ipv4-mask-size": "24", + "clustermesh-cache-ttl": "0s", + "clustermesh-enable-endpoint-sync": "false", + "clustermesh-enable-mcs-api": "false", + "clustermesh-mcs-api-install-crds": "true", + "cni-exclusive": "true", + "cni-log-file": "/var/run/cilium/cilium-cni.log", + "custom-cni-conf": "false", + "datapath-mode": "veth", + debug: "false", + "default-lb-service-ipam": "lbipam", + "direct-routing-skip-unreachable": "false", + "dnsproxy-enable-transparent-mode": "true", + "dnsproxy-socket-linger-timeout": "10", + "egress-gateway-reconciliation-trigger-interval": "1s", + "enable-auto-protect-node-port-range": "true", + "enable-bpf-clock-probe": "false", + "enable-drift-checker": "true", + "enable-dynamic-config": "true", + "enable-endpoint-health-checking": "true", + "enable-endpoint-lockdown-on-policy-overflow": "false", + "enable-health-check-loadbalancer-ip": "false", + "enable-health-check-nodeport": "true", + "enable-health-checking": "true", + "enable-hubble": "true", + "enable-ipv4": "true", + "enable-ipv4-big-tcp": "false", + "enable-ipv4-masquerade": "true", + "enable-ipv6": "false", + "enable-ipv6-big-tcp": "false", + "enable-ipv6-masquerade": "true", + "enable-k8s-networkpolicy": "true", + "enable-l2-neigh-discovery": "false", + "enable-l7-proxy": "true", + "enable-lb-ipam": "true", + "enable-masquerade-to-route-source": "false", + "enable-metrics": "true", + "enable-no-service-endpoints-routable": "true", + "enable-node-selector-labels": "false", + "enable-non-default-deny-policies": "true", + "enable-policy": "default", + "enable-policy-secrets-sync": "true", + "enable-sctp": "false", + "enable-service-topology": "false", + "enable-source-ip-verification": "true", + "enable-tcx": "true", + "enable-vtep": "false", + "enable-well-known-identities": "false", + "enable-xt-socket-fallback": "true", + "envoy-access-log-buffer-size": "4096", + "envoy-base-id": "0", + "envoy-keep-cap-netbindservice": "false", + "external-envoy-proxy": "true", + "health-check-icmp-failure-threshold": "3", + "http-retry-count": "3", + "http-stream-idle-timeout": "300", + "hubble-disable-tls": "false", + "hubble-listen-address": ":4244", + "hubble-network-policy-correlation-enabled": "true", + "hubble-socket-path": "/var/run/cilium/hubble.sock", + "hubble-tls-cert-file": "/var/lib/cilium/tls/hubble/server.crt", + "hubble-tls-client-ca-files": "/var/lib/cilium/tls/hubble/client-ca.crt", + "hubble-tls-key-file": "/var/lib/cilium/tls/hubble/server.key", + "identity-allocation-mode": "crd", + "identity-gc-interval": "15m0s", + "identity-heartbeat-timeout": "30m0s", + "identity-management-mode": "agent", + "install-no-conntrack-iptables-rules": "false", + ipam: "cluster-pool", + "ipam-cilium-node-update-rate": "15s", + "iptables-random-fully": "false", + "k8s-require-ipv4-pod-cidr": "false", + "k8s-require-ipv6-pod-cidr": "false", + "kube-proxy-replacement": "false", + "max-connected-clusters": "255", + "mesh-auth-enabled": "false", + "mesh-auth-gc-interval": "5m0s", + "mesh-auth-queue-size": "1024", + "mesh-auth-rotated-identities-queue-size": "1024", + "metrics-sampling-interval": "5m", + "monitor-aggregation": "medium", + "monitor-aggregation-flags": "all", + "monitor-aggregation-interval": "5s", + "nat-map-stats-entries": "32", + "nat-map-stats-interval": "30s", + "node-port-bind-protection": "true", + "nodes-gc-interval": "5m0s", + "operator-api-serve-addr": "127.0.0.1:9234", + "operator-prometheus-serve-addr": ":9963", + "packetization-layer-pmtud-mode": "blackhole", + "policy-default-local-cluster": "true", + "policy-deny-response": "none", + "policy-secrets-namespace": "cilium-secrets", + "policy-secrets-only-from-secrets-namespace": "true", + "preallocate-bpf-maps": "false", + procfs: "/host/proc", + "proxy-cluster-max-connections": "1024", + "proxy-cluster-max-requests": "1024", + "proxy-connect-timeout": "2", + "proxy-idle-timeout-seconds": "60", + "proxy-initial-fetch-timeout": "30", + "proxy-max-active-downstream-connections": "50000", + "proxy-max-concurrent-retries": "128", + "proxy-max-connection-duration-seconds": "0", + "proxy-max-requests-per-connection": "0", + "proxy-use-original-source-address": "true", + "proxy-xff-num-trusted-hops-egress": "0", + "proxy-xff-num-trusted-hops-ingress": "0", + "remove-cilium-node-taints": "true", + "routing-mode": "tunnel", + "service-no-backend-response": "reject", + "set-cilium-is-up-condition": "true", + "set-cilium-node-taints": "true", + "synchronize-k8s-nodes": "true", + "tofqdns-dns-reject-response-code": "refused", + "tofqdns-enable-dns-compression": "true", + "tofqdns-endpoint-max-ip-per-hostname": "1000", + "tofqdns-idle-connection-grace-period": "0s", + "tofqdns-max-deferred-connection-deletes": "10000", + "tofqdns-preallocate-identities": "true", + "tofqdns-proxy-response-max-delay": "100ms", + "tunnel-protocol": "vxlan", + "tunnel-source-port-range": "0-0", + "unmanaged-pod-watcher-interval": "15s", + "vtep-cidr": "", + "vtep-endpoint": "", + "vtep-mac": "", + "vtep-mask": "", + "write-cni-conf-when-ready": "/host/etc/cni/net.d/05-cilium.conflist" + } +}; +export const ConfigMap_CiliumEnvoyConfig: KubernetesResource = { + apiVersion: "v1", + kind: "ConfigMap", + metadata: { + name: "cilium-envoy-config", + namespace: "kube-system" + }, + data: { + "bootstrap-config.json": "{\"admin\":{\"address\":{\"pipe\":{\"mode\":432,\"path\":\"/var/run/cilium/envoy/sockets/admin.sock\"}}},\"applicationLogConfig\":{\"logFormat\":{\"textFormat\":\"[%Y-%m-%d %T.%e][%t][%l][%n] [%g:%#] %v\"}},\"bootstrapExtensions\":[{\"name\":\"envoy.bootstrap.internal_listener\",\"typedConfig\":{\"@type\":\"type.googleapis.com/envoy.extensions.bootstrap.internal_listener.v3.InternalListener\"}}],\"dynamicResources\":{\"cdsConfig\":{\"apiConfigSource\":{\"apiType\":\"GRPC\",\"grpcServices\":[{\"envoyGrpc\":{\"clusterName\":\"xds-grpc-cilium\"}}],\"setNodeOnFirstMessageOnly\":true,\"transportApiVersion\":\"V3\"},\"initialFetchTimeout\":\"30s\",\"resourceApiVersion\":\"V3\"},\"ldsConfig\":{\"apiConfigSource\":{\"apiType\":\"GRPC\",\"grpcServices\":[{\"envoyGrpc\":{\"clusterName\":\"xds-grpc-cilium\"}}],\"setNodeOnFirstMessageOnly\":true,\"transportApiVersion\":\"V3\"},\"initialFetchTimeout\":\"30s\",\"resourceApiVersion\":\"V3\"}},\"node\":{\"cluster\":\"ingress-cluster\",\"id\":\"host~127.0.0.1~no-id~localdomain\"},\"overloadManager\":{\"resourceMonitors\":[{\"name\":\"envoy.resource_monitors.global_downstream_max_connections\",\"typedConfig\":{\"@type\":\"type.googleapis.com/envoy.extensions.resource_monitors.downstream_connections.v3.DownstreamConnectionsConfig\",\"max_active_downstream_connections\":\"50000\"}}]},\"staticResources\":{\"clusters\":[{\"circuitBreakers\":{\"thresholds\":[{\"maxConnections\":1024,\"maxRequests\":1024,\"maxRetries\":128}]},\"cleanupInterval\":\"2.500s\",\"connectTimeout\":\"2s\",\"lbPolicy\":\"CLUSTER_PROVIDED\",\"name\":\"ingress-cluster\",\"type\":\"ORIGINAL_DST\",\"typedExtensionProtocolOptions\":{\"envoy.extensions.upstreams.http.v3.HttpProtocolOptions\":{\"@type\":\"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\",\"commonHttpProtocolOptions\":{\"idleTimeout\":\"60s\",\"maxConnectionDuration\":\"0s\",\"maxRequestsPerConnection\":0},\"useDownstreamProtocolConfig\":{}}}},{\"circuitBreakers\":{\"thresholds\":[{\"maxConnections\":1024,\"maxRequests\":1024,\"maxRetries\":128}]},\"cleanupInterval\":\"2.500s\",\"connectTimeout\":\"2s\",\"lbPolicy\":\"CLUSTER_PROVIDED\",\"name\":\"egress-cluster-tls\",\"transportSocket\":{\"name\":\"cilium.tls_wrapper\",\"typedConfig\":{\"@type\":\"type.googleapis.com/cilium.UpstreamTlsWrapperContext\"}},\"type\":\"ORIGINAL_DST\",\"typedExtensionProtocolOptions\":{\"envoy.extensions.upstreams.http.v3.HttpProtocolOptions\":{\"@type\":\"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\",\"commonHttpProtocolOptions\":{\"idleTimeout\":\"60s\",\"maxConnectionDuration\":\"0s\",\"maxRequestsPerConnection\":0},\"upstreamHttpProtocolOptions\":{},\"useDownstreamProtocolConfig\":{}}}},{\"circuitBreakers\":{\"thresholds\":[{\"maxConnections\":1024,\"maxRequests\":1024,\"maxRetries\":128}]},\"cleanupInterval\":\"2.500s\",\"connectTimeout\":\"2s\",\"lbPolicy\":\"CLUSTER_PROVIDED\",\"name\":\"egress-cluster\",\"type\":\"ORIGINAL_DST\",\"typedExtensionProtocolOptions\":{\"envoy.extensions.upstreams.http.v3.HttpProtocolOptions\":{\"@type\":\"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\",\"commonHttpProtocolOptions\":{\"idleTimeout\":\"60s\",\"maxConnectionDuration\":\"0s\",\"maxRequestsPerConnection\":0},\"useDownstreamProtocolConfig\":{}}}},{\"circuitBreakers\":{\"thresholds\":[{\"maxConnections\":1024,\"maxRequests\":1024,\"maxRetries\":128}]},\"cleanupInterval\":\"2.500s\",\"connectTimeout\":\"2s\",\"lbPolicy\":\"CLUSTER_PROVIDED\",\"name\":\"ingress-cluster-tls\",\"transportSocket\":{\"name\":\"cilium.tls_wrapper\",\"typedConfig\":{\"@type\":\"type.googleapis.com/cilium.UpstreamTlsWrapperContext\"}},\"type\":\"ORIGINAL_DST\",\"typedExtensionProtocolOptions\":{\"envoy.extensions.upstreams.http.v3.HttpProtocolOptions\":{\"@type\":\"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\",\"commonHttpProtocolOptions\":{\"idleTimeout\":\"60s\",\"maxConnectionDuration\":\"0s\",\"maxRequestsPerConnection\":0},\"upstreamHttpProtocolOptions\":{},\"useDownstreamProtocolConfig\":{}}}},{\"connectTimeout\":\"2s\",\"loadAssignment\":{\"clusterName\":\"xds-grpc-cilium\",\"endpoints\":[{\"lbEndpoints\":[{\"endpoint\":{\"address\":{\"pipe\":{\"path\":\"/var/run/cilium/envoy/sockets/xds.sock\"}}}}]}]},\"name\":\"xds-grpc-cilium\",\"type\":\"STATIC\",\"typedExtensionProtocolOptions\":{\"envoy.extensions.upstreams.http.v3.HttpProtocolOptions\":{\"@type\":\"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\",\"explicitHttpConfig\":{\"http2ProtocolOptions\":{}}}}},{\"connectTimeout\":\"2s\",\"loadAssignment\":{\"clusterName\":\"/envoy-admin\",\"endpoints\":[{\"lbEndpoints\":[{\"endpoint\":{\"address\":{\"pipe\":{\"path\":\"/var/run/cilium/envoy/sockets/admin.sock\"}}}}]}]},\"name\":\"/envoy-admin\",\"type\":\"STATIC\"}],\"listeners\":[{\"address\":{\"socketAddress\":{\"address\":\"0.0.0.0\",\"portValue\":9964}},\"filterChains\":[{\"filters\":[{\"name\":\"envoy.filters.network.http_connection_manager\",\"typedConfig\":{\"@type\":\"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\",\"httpFilters\":[{\"name\":\"envoy.filters.http.router\",\"typedConfig\":{\"@type\":\"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\"}}],\"internalAddressConfig\":{\"cidrRanges\":[{\"addressPrefix\":\"10.0.0.0\",\"prefixLen\":8},{\"addressPrefix\":\"172.16.0.0\",\"prefixLen\":12},{\"addressPrefix\":\"192.168.0.0\",\"prefixLen\":16},{\"addressPrefix\":\"127.0.0.1\",\"prefixLen\":32}]},\"routeConfig\":{\"virtualHosts\":[{\"domains\":[\"*\"],\"name\":\"prometheus_metrics_route\",\"routes\":[{\"match\":{\"prefix\":\"/metrics\"},\"name\":\"prometheus_metrics_route\",\"route\":{\"cluster\":\"/envoy-admin\",\"prefixRewrite\":\"/stats/prometheus\"}}]}]},\"statPrefix\":\"envoy-prometheus-metrics-listener\",\"streamIdleTimeout\":\"300s\"}}]}],\"name\":\"envoy-prometheus-metrics-listener\"},{\"address\":{\"socketAddress\":{\"address\":\"127.0.0.1\",\"portValue\":9878}},\"filterChains\":[{\"filters\":[{\"name\":\"envoy.filters.network.http_connection_manager\",\"typedConfig\":{\"@type\":\"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\",\"httpFilters\":[{\"name\":\"envoy.filters.http.router\",\"typedConfig\":{\"@type\":\"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\"}}],\"internalAddressConfig\":{\"cidrRanges\":[{\"addressPrefix\":\"10.0.0.0\",\"prefixLen\":8},{\"addressPrefix\":\"172.16.0.0\",\"prefixLen\":12},{\"addressPrefix\":\"192.168.0.0\",\"prefixLen\":16},{\"addressPrefix\":\"127.0.0.1\",\"prefixLen\":32}]},\"routeConfig\":{\"virtual_hosts\":[{\"domains\":[\"*\"],\"name\":\"health\",\"routes\":[{\"match\":{\"prefix\":\"/healthz\"},\"name\":\"health\",\"route\":{\"cluster\":\"/envoy-admin\",\"prefixRewrite\":\"/ready\"}}]}]},\"statPrefix\":\"envoy-health-listener\",\"streamIdleTimeout\":\"300s\"}}]}],\"name\":\"envoy-health-listener\"}]}}\n" + } +}; +export const ClusterRole_Cilium: KubernetesResource = { + apiVersion: "rbac.authorization.k8s.io/v1", + kind: "ClusterRole", + metadata: { + labels: { + "app.kubernetes.io/part-of": "cilium" + }, + name: "cilium" + }, + rules: [{ + apiGroups: ["networking.k8s.io"], + resources: ["networkpolicies"], + verbs: ["get", "list", "watch"] + }, { + apiGroups: ["discovery.k8s.io"], + resources: ["endpointslices"], + verbs: ["get", "list", "watch"] + }, { + apiGroups: [""], + resources: ["namespaces", "services", "pods", "endpoints", "nodes"], + verbs: ["get", "list", "watch"] + }, { + apiGroups: ["apiextensions.k8s.io"], + resources: ["customresourcedefinitions"], + verbs: ["list", "watch", "get"] + }, { + apiGroups: ["cilium.io"], + resources: ["ciliumloadbalancerippools", "ciliumbgppeeringpolicies", "ciliumbgpnodeconfigs", "ciliumbgpadvertisements", "ciliumbgppeerconfigs", "ciliumclusterwideenvoyconfigs", "ciliumclusterwidenetworkpolicies", "ciliumegressgatewaypolicies", "ciliumendpoints", "ciliumendpointslices", "ciliumenvoyconfigs", "ciliumidentities", "ciliumlocalredirectpolicies", "ciliumnetworkpolicies", "ciliumnodes", "ciliumnodeconfigs", "ciliumcidrgroups", "ciliuml2announcementpolicies", "ciliumpodippools"], + verbs: ["list", "watch"] + }, { + apiGroups: ["cilium.io"], + resources: ["ciliumidentities", "ciliumendpoints", "ciliumnodes"], + verbs: ["create"] + }, { + apiGroups: ["cilium.io"], + resources: ["ciliumidentities"], + verbs: ["update"] + }, { + apiGroups: ["cilium.io"], + resources: ["ciliumendpoints"], + verbs: ["delete", "get"] + }, { + apiGroups: ["cilium.io"], + resources: ["ciliumnodes", "ciliumnodes/status"], + verbs: ["get", "update"] + }, { + apiGroups: ["cilium.io"], + resources: ["ciliumendpoints/status", "ciliumendpoints", "ciliuml2announcementpolicies/status", "ciliumbgpnodeconfigs/status"], + verbs: ["patch"] + }] +}; +export const ClusterRole_CiliumOperator: KubernetesResource = { + apiVersion: "rbac.authorization.k8s.io/v1", + kind: "ClusterRole", + metadata: { + labels: { + "app.kubernetes.io/part-of": "cilium" + }, + name: "cilium-operator" + }, + rules: [{ + apiGroups: [""], + resources: ["pods"], + verbs: ["get", "list", "watch", "delete"] + }, { + apiGroups: [""], + resourceNames: ["cilium-config"], + resources: ["configmaps"], + verbs: ["patch"] + }, { + apiGroups: [""], + resources: ["nodes"], + verbs: ["list", "watch"] + }, { + apiGroups: [""], + resources: ["nodes", "nodes/status"], + verbs: ["patch"] + }, { + apiGroups: ["discovery.k8s.io"], + resources: ["endpointslices"], + verbs: ["get", "list", "watch"] + }, { + apiGroups: [""], + resources: ["services/status"], + verbs: ["update", "patch"] + }, { + apiGroups: [""], + resources: ["namespaces", "secrets"], + verbs: ["get", "list", "watch"] + }, { + apiGroups: [""], + resources: ["services", "endpoints"], + verbs: ["get", "list", "watch"] + }, { + apiGroups: ["cilium.io"], + resources: ["ciliumnetworkpolicies", "ciliumclusterwidenetworkpolicies"], + verbs: ["create", "update", "deletecollection", "patch", "get", "list", "watch"] + }, { + apiGroups: ["cilium.io"], + resources: ["ciliumnetworkpolicies/status", "ciliumclusterwidenetworkpolicies/status"], + verbs: ["patch", "update"] + }, { + apiGroups: ["cilium.io"], + resources: ["ciliumendpoints", "ciliumidentities"], + verbs: ["delete", "list", "watch"] + }, { + apiGroups: ["cilium.io"], + resources: ["ciliumidentities"], + verbs: ["update"] + }, { + apiGroups: ["cilium.io"], + resources: ["ciliumnodes"], + verbs: ["create", "update", "get", "list", "watch", "delete"] + }, { + apiGroups: ["cilium.io"], + resources: ["ciliumnodes/status"], + verbs: ["update"] + }, { + apiGroups: ["cilium.io"], + resources: ["ciliumendpointslices", "ciliumenvoyconfigs", "ciliumbgppeerconfigs", "ciliumbgpadvertisements", "ciliumbgpnodeconfigs"], + verbs: ["create", "update", "get", "list", "watch", "delete", "patch"] + }, { + apiGroups: ["cilium.io"], + resources: ["ciliumbgpclusterconfigs/status", "ciliumbgppeerconfigs/status"], + verbs: ["update"] + }, { + apiGroups: ["apiextensions.k8s.io"], + resources: ["customresourcedefinitions"], + verbs: ["create", "get", "list", "watch"] + }, { + apiGroups: ["apiextensions.k8s.io"], + resourceNames: ["ciliumloadbalancerippools.cilium.io", "ciliumbgpclusterconfigs.cilium.io", "ciliumbgppeerconfigs.cilium.io", "ciliumbgpadvertisements.cilium.io", "ciliumbgpnodeconfigs.cilium.io", "ciliumbgpnodeconfigoverrides.cilium.io", "ciliumclusterwideenvoyconfigs.cilium.io", "ciliumclusterwidenetworkpolicies.cilium.io", "ciliumegressgatewaypolicies.cilium.io", "ciliumendpoints.cilium.io", "ciliumendpointslices.cilium.io", "ciliumenvoyconfigs.cilium.io", "ciliumidentities.cilium.io", "ciliumlocalredirectpolicies.cilium.io", "ciliumnetworkpolicies.cilium.io", "ciliumnodes.cilium.io", "ciliumnodeconfigs.cilium.io", "ciliumcidrgroups.cilium.io", "ciliuml2announcementpolicies.cilium.io", "ciliumpodippools.cilium.io", "ciliumgatewayclassconfigs.cilium.io"], + resources: ["customresourcedefinitions"], + verbs: ["update"] + }, { + apiGroups: ["cilium.io"], + resources: ["ciliumloadbalancerippools", "ciliumpodippools", "ciliumbgppeeringpolicies", "ciliumbgpclusterconfigs", "ciliumbgpnodeconfigoverrides", "ciliumbgppeerconfigs"], + verbs: ["get", "list", "watch"] + }, { + apiGroups: ["cilium.io"], + resources: ["ciliumpodippools"], + verbs: ["create"] + }, { + apiGroups: ["cilium.io"], + resources: ["ciliumloadbalancerippools/status"], + verbs: ["patch"] + }, { + apiGroups: ["coordination.k8s.io"], + resources: ["leases"], + verbs: ["create", "get", "update"] + }, { + apiGroups: ["cilium.io"], + resources: ["ciliumendpointslices"], + verbs: ["deletecollection"] + }] +}; +export const ClusterRoleBinding_Cilium: KubernetesResource = { + apiVersion: "rbac.authorization.k8s.io/v1", + kind: "ClusterRoleBinding", + metadata: { + labels: { + "app.kubernetes.io/part-of": "cilium" + }, + name: "cilium" + }, + roleRef: { + apiGroup: "rbac.authorization.k8s.io", + kind: "ClusterRole", + name: "cilium" + }, + subjects: [{ + kind: "ServiceAccount", + name: "cilium", + namespace: "kube-system" + }] +}; +export const ClusterRoleBinding_CiliumOperator: KubernetesResource = { + apiVersion: "rbac.authorization.k8s.io/v1", + kind: "ClusterRoleBinding", + metadata: { + labels: { + "app.kubernetes.io/part-of": "cilium" + }, + name: "cilium-operator" + }, + roleRef: { + apiGroup: "rbac.authorization.k8s.io", + kind: "ClusterRole", + name: "cilium-operator" + }, + subjects: [{ + kind: "ServiceAccount", + name: "cilium-operator", + namespace: "kube-system" + }] +}; +export const Role_CiliumConfigAgent: KubernetesResource = { + apiVersion: "rbac.authorization.k8s.io/v1", + kind: "Role", + metadata: { + labels: { + "app.kubernetes.io/part-of": "cilium" + }, + name: "cilium-config-agent", + namespace: "kube-system" + }, + rules: [{ + apiGroups: [""], + resources: ["configmaps"], + verbs: ["get", "list", "watch"] + }] +}; +export const Role_CiliumTlsinterceptionSecrets: KubernetesResource = { + apiVersion: "rbac.authorization.k8s.io/v1", + kind: "Role", + metadata: { + labels: { + "app.kubernetes.io/part-of": "cilium" + }, + name: "cilium-tlsinterception-secrets", + namespace: "cilium-secrets" + }, + rules: [{ + apiGroups: [""], + resources: ["secrets"], + verbs: ["get", "list", "watch"] + }] +}; +export const Role_CiliumOperatorTlsinterceptionSecrets: KubernetesResource = { + apiVersion: "rbac.authorization.k8s.io/v1", + kind: "Role", + metadata: { + labels: { + "app.kubernetes.io/part-of": "cilium" + }, + name: "cilium-operator-tlsinterception-secrets", + namespace: "cilium-secrets" + }, + rules: [{ + apiGroups: [""], + resources: ["secrets"], + verbs: ["create", "delete", "update", "patch"] + }] +}; +export const Role_CiliumOperatorZtunnel: KubernetesResource = { + apiVersion: "rbac.authorization.k8s.io/v1", + kind: "Role", + metadata: { + labels: { + "app.kubernetes.io/part-of": "cilium" + }, + name: "cilium-operator-ztunnel", + namespace: "kube-system" + }, + rules: [{ + apiGroups: ["apps"], + resources: ["daemonsets"], + verbs: ["create", "delete", "get", "list", "watch"] + }] +}; +export const RoleBinding_CiliumConfigAgent: KubernetesResource = { + apiVersion: "rbac.authorization.k8s.io/v1", + kind: "RoleBinding", + metadata: { + labels: { + "app.kubernetes.io/part-of": "cilium" + }, + name: "cilium-config-agent", + namespace: "kube-system" + }, + roleRef: { + apiGroup: "rbac.authorization.k8s.io", + kind: "Role", + name: "cilium-config-agent" + }, + subjects: [{ + kind: "ServiceAccount", + name: "cilium", + namespace: "kube-system" + }] +}; +export const RoleBinding_CiliumTlsinterceptionSecrets: KubernetesResource = { + apiVersion: "rbac.authorization.k8s.io/v1", + kind: "RoleBinding", + metadata: { + labels: { + "app.kubernetes.io/part-of": "cilium" + }, + name: "cilium-tlsinterception-secrets", + namespace: "cilium-secrets" + }, + roleRef: { + apiGroup: "rbac.authorization.k8s.io", + kind: "Role", + name: "cilium-tlsinterception-secrets" + }, + subjects: [{ + kind: "ServiceAccount", + name: "cilium", + namespace: "kube-system" + }] +}; +export const RoleBinding_CiliumOperatorTlsinterceptionSecrets: KubernetesResource = { + apiVersion: "rbac.authorization.k8s.io/v1", + kind: "RoleBinding", + metadata: { + labels: { + "app.kubernetes.io/part-of": "cilium" + }, + name: "cilium-operator-tlsinterception-secrets", + namespace: "cilium-secrets" + }, + roleRef: { + apiGroup: "rbac.authorization.k8s.io", + kind: "Role", + name: "cilium-operator-tlsinterception-secrets" + }, + subjects: [{ + kind: "ServiceAccount", + name: "cilium-operator", + namespace: "kube-system" + }] +}; +export const RoleBinding_CiliumOperatorZtunnel: KubernetesResource = { + apiVersion: "rbac.authorization.k8s.io/v1", + kind: "RoleBinding", + metadata: { + labels: { + "app.kubernetes.io/part-of": "cilium" + }, + name: "cilium-operator-ztunnel", + namespace: "kube-system" + }, + roleRef: { + apiGroup: "rbac.authorization.k8s.io", + kind: "Role", + name: "cilium-operator-ztunnel" + }, + subjects: [{ + kind: "ServiceAccount", + name: "cilium-operator", + namespace: "kube-system" + }] +}; +export const Service_CiliumEnvoy: KubernetesResource = { + apiVersion: "v1", + kind: "Service", + metadata: { + annotations: { + "prometheus.io/port": "9964", + "prometheus.io/scrape": "true" + }, + labels: { + "app.kubernetes.io/name": "cilium-envoy", + "app.kubernetes.io/part-of": "cilium", + "io.cilium/app": "proxy", + "k8s-app": "cilium-envoy" + }, + name: "cilium-envoy", + namespace: "kube-system" + }, + spec: { + clusterIP: "None", + ports: [{ + name: "envoy-metrics", + port: 9964, + protocol: "TCP", + targetPort: 9964 + }], + selector: { + "k8s-app": "cilium-envoy" + }, + type: "ClusterIP" + } +}; +export const Service_HubblePeer: KubernetesResource = { + apiVersion: "v1", + kind: "Service", + metadata: { + labels: { + "app.kubernetes.io/name": "hubble-peer", + "app.kubernetes.io/part-of": "cilium", + "k8s-app": "cilium" + }, + name: "hubble-peer", + namespace: "kube-system" + }, + spec: { + internalTrafficPolicy: "Local", + ports: [{ + name: "peer-service", + port: 443, + protocol: "TCP", + targetPort: 4244 + }], + selector: { + "k8s-app": "cilium" + } + } +}; +export const DaemonSet_Cilium: KubernetesResource = { + apiVersion: "apps/v1", + kind: "DaemonSet", + metadata: { + labels: { + "app.kubernetes.io/name": "cilium-agent", + "app.kubernetes.io/part-of": "cilium", + "k8s-app": "cilium" + }, + name: "cilium", + namespace: "kube-system" + }, + spec: { + selector: { + matchLabels: { + "k8s-app": "cilium" + } + }, + template: { + metadata: { + annotations: { + "kubectl.kubernetes.io/default-container": "cilium-agent" + }, + labels: { + "app.kubernetes.io/name": "cilium-agent", + "app.kubernetes.io/part-of": "cilium", + "k8s-app": "cilium" + } + }, + spec: { + affinity: { + podAntiAffinity: { + requiredDuringSchedulingIgnoredDuringExecution: [{ + labelSelector: { + matchLabels: { + "k8s-app": "cilium" + } + }, + topologyKey: "kubernetes.io/hostname" + }] + } + }, + automountServiceAccountToken: true, + containers: [{ + args: ["--config-dir=/tmp/cilium/config-map"], + command: ["cilium-agent"], + env: [{ + name: "K8S_NODE_NAME", + valueFrom: { + fieldRef: { + apiVersion: "v1", + fieldPath: "spec.nodeName" + } + } + }, { + name: "CILIUM_K8S_NAMESPACE", + valueFrom: { + fieldRef: { + apiVersion: "v1", + fieldPath: "metadata.namespace" + } + } + }, { + name: "CILIUM_CLUSTERMESH_CONFIG", + value: "/var/lib/cilium/clustermesh/" + }, { + name: "GOMEMLIMIT", + valueFrom: { + resourceFieldRef: { + divisor: "1", + resource: "limits.memory" + } + } + }, { + name: "KUBE_CLIENT_BACKOFF_BASE", + value: "1" + }, { + name: "KUBE_CLIENT_BACKOFF_DURATION", + value: "120" + }], + image: "quay.io/cilium/cilium:v1.19.5@sha256:20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732", + imagePullPolicy: "IfNotPresent", + lifecycle: { + postStart: { + exec: { + command: ["bash", "-c", "set -o errexit\nset -o pipefail\nset -o nounset\n\n# When running in AWS ENI mode, it's likely that 'aws-node' has\n# had a chance to install SNAT iptables rules. These can result\n# in dropped traffic, so we should attempt to remove them.\n# We do it using a 'postStart' hook since this may need to run\n# for nodes which might have already been init'ed but may still\n# have dangling rules. This is safe because there are no\n# dependencies on anything that is part of the startup script\n# itself, and can be safely run multiple times per node (e.g. in\n# case of a restart).\nif [[ \"$(iptables-save | grep -E -c 'AWS-SNAT-CHAIN|AWS-CONNMARK-CHAIN')\" != \"0\" ]];\nthen\n echo 'Deleting iptables rules created by the AWS CNI VPC plugin'\n iptables-save | grep -E -v 'AWS-SNAT-CHAIN|AWS-CONNMARK-CHAIN' | iptables-restore\nfi\necho 'Done!'\n"] + } + }, + preStop: { + exec: { + command: ["/cni-uninstall.sh"] + } + } + }, + livenessProbe: { + failureThreshold: 10, + httpGet: { + host: "127.0.0.1", + httpHeaders: [{ + name: "brief", + value: "true" + }, { + name: "require-k8s-connectivity", + value: "false" + }], + path: "/healthz", + port: "health", + scheme: "HTTP" + }, + periodSeconds: 30, + successThreshold: 1, + timeoutSeconds: 5 + }, + name: "cilium-agent", + ports: [{ + containerPort: 9879, + hostPort: 9879, + name: "health", + protocol: "TCP" + }, { + containerPort: 4244, + hostPort: 4244, + name: "peer-service", + protocol: "TCP" + }], + readinessProbe: { + failureThreshold: 3, + httpGet: { + host: "127.0.0.1", + httpHeaders: [{ + name: "brief", + value: "true" + }], + path: "/healthz", + port: "health", + scheme: "HTTP" + }, + periodSeconds: 30, + successThreshold: 1, + timeoutSeconds: 5 + }, + securityContext: { + capabilities: { + add: ["CHOWN", "KILL", "NET_ADMIN", "NET_RAW", "IPC_LOCK", "SYS_MODULE", "SYS_ADMIN", "SYS_RESOURCE", "DAC_OVERRIDE", "FOWNER", "SETGID", "SETUID", "SYSLOG"], + drop: ["ALL"] + }, + seLinuxOptions: { + level: "s0", + type: "spc_t" + } + }, + startupProbe: { + failureThreshold: 300, + httpGet: { + host: "127.0.0.1", + httpHeaders: [{ + name: "brief", + value: "true" + }], + path: "/healthz", + port: "health", + scheme: "HTTP" + }, + initialDelaySeconds: 5, + periodSeconds: 2, + successThreshold: 1 + }, + terminationMessagePolicy: "FallbackToLogsOnError", + volumeMounts: [{ + mountPath: "/var/run/cilium/envoy/sockets", + name: "envoy-sockets", + readOnly: false + }, { + mountPath: "/host/proc/sys/net", + name: "host-proc-sys-net" + }, { + mountPath: "/host/proc/sys/kernel", + name: "host-proc-sys-kernel" + }, { + mountPath: "/sys/fs/bpf", + mountPropagation: "HostToContainer", + name: "bpf-maps" + }, { + mountPath: "/var/run/cilium", + name: "cilium-run" + }, { + mountPath: "/var/run/cilium/netns", + mountPropagation: "HostToContainer", + name: "cilium-netns" + }, { + mountPath: "/host/etc/cni/net.d", + name: "etc-cni-netd" + }, { + mountPath: "/var/lib/cilium/clustermesh", + name: "clustermesh-secrets", + readOnly: true + }, { + mountPath: "/lib/modules", + name: "lib-modules", + readOnly: true + }, { + mountPath: "/run/xtables.lock", + name: "xtables-lock" + }, { + mountPath: "/var/lib/cilium/tls/hubble", + name: "hubble-tls", + readOnly: true + }, { + mountPath: "/tmp", + name: "tmp" + }] + }], + hostNetwork: true, + initContainers: [{ + command: ["cilium-dbg", "build-config"], + env: [{ + name: "K8S_NODE_NAME", + valueFrom: { + fieldRef: { + apiVersion: "v1", + fieldPath: "spec.nodeName" + } + } + }, { + name: "CILIUM_K8S_NAMESPACE", + valueFrom: { + fieldRef: { + apiVersion: "v1", + fieldPath: "metadata.namespace" + } + } + }], + image: "quay.io/cilium/cilium:v1.19.5@sha256:20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732", + imagePullPolicy: "IfNotPresent", + name: "config", + securityContext: { + capabilities: { + add: ["NET_ADMIN"], + drop: ["ALL"] + } + }, + terminationMessagePolicy: "FallbackToLogsOnError", + volumeMounts: [{ + mountPath: "/tmp", + name: "tmp" + }] + }, { + command: ["bash", "-ec", "cp /usr/bin/cilium-mount /hostbin/cilium-mount;\nnsenter --cgroup=/hostproc/1/ns/cgroup --mount=/hostproc/1/ns/mnt \"${BIN_PATH}/cilium-mount\" $CGROUP_ROOT;\nrm /hostbin/cilium-mount\n"], + env: [{ + name: "CGROUP_ROOT", + value: "/run/cilium/cgroupv2" + }, { + name: "BIN_PATH", + value: "/opt/cni/bin" + }], + image: "quay.io/cilium/cilium:v1.19.5@sha256:20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732", + imagePullPolicy: "IfNotPresent", + name: "mount-cgroup", + securityContext: { + capabilities: { + add: ["SYS_ADMIN", "SYS_CHROOT", "SYS_PTRACE"], + drop: ["ALL"] + }, + seLinuxOptions: { + level: "s0", + type: "spc_t" + } + }, + terminationMessagePolicy: "FallbackToLogsOnError", + volumeMounts: [{ + mountPath: "/hostproc", + name: "hostproc" + }, { + mountPath: "/hostbin", + name: "cni-path" + }] + }, { + command: ["bash", "-ec", "cp /usr/bin/cilium-sysctlfix /hostbin/cilium-sysctlfix;\nnsenter --mount=/hostproc/1/ns/mnt \"${BIN_PATH}/cilium-sysctlfix\";\nrm /hostbin/cilium-sysctlfix\n"], + env: [{ + name: "BIN_PATH", + value: "/opt/cni/bin" + }], + image: "quay.io/cilium/cilium:v1.19.5@sha256:20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732", + imagePullPolicy: "IfNotPresent", + name: "apply-sysctl-overwrites", + securityContext: { + capabilities: { + add: ["SYS_ADMIN", "SYS_CHROOT", "SYS_PTRACE"], + drop: ["ALL"] + }, + seLinuxOptions: { + level: "s0", + type: "spc_t" + } + }, + terminationMessagePolicy: "FallbackToLogsOnError", + volumeMounts: [{ + mountPath: "/hostproc", + name: "hostproc" + }, { + mountPath: "/hostbin", + name: "cni-path" + }] + }, { + args: ["mount | grep \"/sys/fs/bpf type bpf\" || mount -t bpf bpf /sys/fs/bpf"], + command: ["/bin/bash", "-c", "--"], + image: "quay.io/cilium/cilium:v1.19.5@sha256:20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732", + imagePullPolicy: "IfNotPresent", + name: "mount-bpf-fs", + securityContext: { + privileged: true + }, + terminationMessagePolicy: "FallbackToLogsOnError", + volumeMounts: [{ + mountPath: "/sys/fs/bpf", + mountPropagation: "Bidirectional", + name: "bpf-maps" + }] + }, { + command: ["/init-container.sh"], + env: [{ + name: "CILIUM_ALL_STATE", + valueFrom: { + configMapKeyRef: { + key: "clean-cilium-state", + name: "cilium-config", + optional: true + } + } + }, { + name: "CILIUM_BPF_STATE", + valueFrom: { + configMapKeyRef: { + key: "clean-cilium-bpf-state", + name: "cilium-config", + optional: true + } + } + }, { + name: "WRITE_CNI_CONF_WHEN_READY", + valueFrom: { + configMapKeyRef: { + key: "write-cni-conf-when-ready", + name: "cilium-config", + optional: true + } + } + }], + image: "quay.io/cilium/cilium:v1.19.5@sha256:20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732", + imagePullPolicy: "IfNotPresent", + name: "clean-cilium-state", + securityContext: { + capabilities: { + add: ["NET_ADMIN", "SYS_MODULE", "SYS_ADMIN", "SYS_RESOURCE"], + drop: ["ALL"] + }, + seLinuxOptions: { + level: "s0", + type: "spc_t" + } + }, + terminationMessagePolicy: "FallbackToLogsOnError", + volumeMounts: [{ + mountPath: "/sys/fs/bpf", + name: "bpf-maps" + }, { + mountPath: "/run/cilium/cgroupv2", + mountPropagation: "HostToContainer", + name: "cilium-cgroup" + }, { + mountPath: "/var/run/cilium", + name: "cilium-run" + }] + }, { + command: ["/install-plugin.sh"], + image: "quay.io/cilium/cilium:v1.19.5@sha256:20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732", + imagePullPolicy: "IfNotPresent", + name: "install-cni-binaries", + resources: { + limits: { + cpu: 1, + memory: "1Gi" + }, + requests: { + cpu: "100m", + memory: "10Mi" + } + }, + securityContext: { + capabilities: { + drop: ["ALL"] + }, + seLinuxOptions: { + level: "s0", + type: "spc_t" + } + }, + terminationMessagePolicy: "FallbackToLogsOnError", + volumeMounts: [{ + mountPath: "/host/opt/cni/bin", + name: "cni-path" + }] + }], + nodeSelector: { + "kubernetes.io/os": "linux" + }, + priorityClassName: "system-node-critical", + restartPolicy: "Always", + securityContext: { + appArmorProfile: { + type: "Unconfined" + }, + seccompProfile: { + type: "Unconfined" + } + }, + serviceAccountName: "cilium", + terminationGracePeriodSeconds: 1, + tolerations: [{ + operator: "Exists" + }], + volumes: [{ + emptyDir: {}, + name: "tmp" + }, { + hostPath: { + path: "/var/run/cilium", + type: "DirectoryOrCreate" + }, + name: "cilium-run" + }, { + hostPath: { + path: "/var/run/netns", + type: "DirectoryOrCreate" + }, + name: "cilium-netns" + }, { + hostPath: { + path: "/sys/fs/bpf", + type: "DirectoryOrCreate" + }, + name: "bpf-maps" + }, { + hostPath: { + path: "/proc", + type: "Directory" + }, + name: "hostproc" + }, { + hostPath: { + path: "/run/cilium/cgroupv2", + type: "DirectoryOrCreate" + }, + name: "cilium-cgroup" + }, { + hostPath: { + path: "/opt/cni/bin", + type: "DirectoryOrCreate" + }, + name: "cni-path" + }, { + hostPath: { + path: "/etc/cni/net.d", + type: "DirectoryOrCreate" + }, + name: "etc-cni-netd" + }, { + hostPath: { + path: "/lib/modules" + }, + name: "lib-modules" + }, { + hostPath: { + path: "/run/xtables.lock", + type: "FileOrCreate" + }, + name: "xtables-lock" + }, { + hostPath: { + path: "/var/run/cilium/envoy/sockets", + type: "DirectoryOrCreate" + }, + name: "envoy-sockets" + }, { + name: "clustermesh-secrets", + projected: { + defaultMode: 400, + sources: [{ + secret: { + name: "cilium-clustermesh", + optional: true + } + }, { + secret: { + items: [{ + key: "tls.key", + path: "common-etcd-client.key" + }, { + key: "tls.crt", + path: "common-etcd-client.crt" + }, { + key: "ca.crt", + path: "common-etcd-client-ca.crt" + }], + name: "clustermesh-apiserver-remote-cert", + optional: true + } + }, { + secret: { + items: [{ + key: "tls.key", + path: "local-etcd-client.key" + }, { + key: "tls.crt", + path: "local-etcd-client.crt" + }, { + key: "ca.crt", + path: "local-etcd-client-ca.crt" + }], + name: "clustermesh-apiserver-local-cert", + optional: true + } + }] + } + }, { + hostPath: { + path: "/proc/sys/net", + type: "Directory" + }, + name: "host-proc-sys-net" + }, { + hostPath: { + path: "/proc/sys/kernel", + type: "Directory" + }, + name: "host-proc-sys-kernel" + }, { + name: "hubble-tls", + projected: { + defaultMode: 400, + sources: [{ + secret: { + items: [{ + key: "tls.crt", + path: "server.crt" + }, { + key: "tls.key", + path: "server.key" + }, { + key: "ca.crt", + path: "client-ca.crt" + }], + name: "hubble-server-certs", + optional: true + } + }] + } + }] + } + }, + updateStrategy: { + rollingUpdate: { + maxUnavailable: 2 + }, + type: "RollingUpdate" + } + } +}; +export const DaemonSet_CiliumEnvoy: KubernetesResource = { + apiVersion: "apps/v1", + kind: "DaemonSet", + metadata: { + labels: { + "app.kubernetes.io/name": "cilium-envoy", + "app.kubernetes.io/part-of": "cilium", + "k8s-app": "cilium-envoy", + name: "cilium-envoy" + }, + name: "cilium-envoy", + namespace: "kube-system" + }, + spec: { + selector: { + matchLabels: { + "k8s-app": "cilium-envoy" + } + }, + template: { + metadata: { + annotations: null, + labels: { + "app.kubernetes.io/name": "cilium-envoy", + "app.kubernetes.io/part-of": "cilium", + "k8s-app": "cilium-envoy", + name: "cilium-envoy" + } + }, + spec: { + affinity: { + nodeAffinity: { + requiredDuringSchedulingIgnoredDuringExecution: { + nodeSelectorTerms: [{ + matchExpressions: [{ + key: "cilium.io/no-schedule", + operator: "NotIn", + values: ["true"] + }] + }] + } + }, + podAffinity: { + requiredDuringSchedulingIgnoredDuringExecution: [{ + labelSelector: { + matchLabels: { + "k8s-app": "cilium" + } + }, + topologyKey: "kubernetes.io/hostname" + }] + }, + podAntiAffinity: { + requiredDuringSchedulingIgnoredDuringExecution: [{ + labelSelector: { + matchLabels: { + "k8s-app": "cilium-envoy" + } + }, + topologyKey: "kubernetes.io/hostname" + }] + } + }, + automountServiceAccountToken: true, + containers: [{ + args: ["--", "-c /var/run/cilium/envoy/bootstrap-config.json", "--base-id 0", "--log-level info"], + command: ["/usr/bin/cilium-envoy-starter"], + env: [{ + name: "K8S_NODE_NAME", + valueFrom: { + fieldRef: { + apiVersion: "v1", + fieldPath: "spec.nodeName" + } + } + }, { + name: "CILIUM_K8S_NAMESPACE", + valueFrom: { + fieldRef: { + apiVersion: "v1", + fieldPath: "metadata.namespace" + } + } + }], + image: "quay.io/cilium/cilium-envoy:v1.36.8-1781157951-a7f42a3390781539911b5b9107881b35ecc4e752@sha256:326f872e19ce8aa45170efbf583b3f301586ba3feead14b864676d4baf3b45ed", + imagePullPolicy: "IfNotPresent", + livenessProbe: { + failureThreshold: 10, + httpGet: { + host: "127.0.0.1", + path: "/healthz", + port: 9878, + scheme: "HTTP" + }, + periodSeconds: 30, + successThreshold: 1, + timeoutSeconds: 5 + }, + name: "cilium-envoy", + ports: [{ + containerPort: 9964, + hostPort: 9964, + name: "envoy-metrics", + protocol: "TCP" + }], + readinessProbe: { + failureThreshold: 3, + httpGet: { + host: "127.0.0.1", + path: "/healthz", + port: 9878, + scheme: "HTTP" + }, + periodSeconds: 30, + successThreshold: 1, + timeoutSeconds: 5 + }, + securityContext: { + capabilities: { + add: ["NET_ADMIN", "SYS_ADMIN"], + drop: ["ALL"] + }, + seLinuxOptions: { + level: "s0", + type: "spc_t" + } + }, + startupProbe: { + failureThreshold: 105, + httpGet: { + host: "127.0.0.1", + path: "/healthz", + port: 9878, + scheme: "HTTP" + }, + initialDelaySeconds: 5, + periodSeconds: 2, + successThreshold: 1 + }, + terminationMessagePolicy: "FallbackToLogsOnError", + volumeMounts: [{ + mountPath: "/var/run/cilium/envoy/sockets", + name: "envoy-sockets", + readOnly: false + }, { + mountPath: "/var/run/cilium/envoy/artifacts", + name: "envoy-artifacts", + readOnly: true + }, { + mountPath: "/var/run/cilium/envoy/", + name: "envoy-config", + readOnly: true + }, { + mountPath: "/sys/fs/bpf", + mountPropagation: "HostToContainer", + name: "bpf-maps" + }] + }], + hostNetwork: true, + nodeSelector: { + "kubernetes.io/os": "linux" + }, + priorityClassName: "system-node-critical", + restartPolicy: "Always", + securityContext: { + appArmorProfile: { + type: "Unconfined" + } + }, + serviceAccountName: "cilium-envoy", + terminationGracePeriodSeconds: 1, + tolerations: [{ + operator: "Exists" + }], + volumes: [{ + hostPath: { + path: "/var/run/cilium/envoy/sockets", + type: "DirectoryOrCreate" + }, + name: "envoy-sockets" + }, { + hostPath: { + path: "/var/run/cilium/envoy/artifacts", + type: "DirectoryOrCreate" + }, + name: "envoy-artifacts" + }, { + configMap: { + defaultMode: 400, + items: [{ + key: "bootstrap-config.json", + path: "bootstrap-config.json" + }], + name: "cilium-envoy-config" + }, + name: "envoy-config" + }, { + hostPath: { + path: "/sys/fs/bpf", + type: "DirectoryOrCreate" + }, + name: "bpf-maps" + }] + } + }, + updateStrategy: { + rollingUpdate: { + maxUnavailable: 2 + }, + type: "RollingUpdate" + } + } +}; +export const Deployment_CiliumOperator: KubernetesResource = { + apiVersion: "apps/v1", + kind: "Deployment", + metadata: { + labels: { + "app.kubernetes.io/name": "cilium-operator", + "app.kubernetes.io/part-of": "cilium", + "io.cilium/app": "operator", + name: "cilium-operator" + }, + name: "cilium-operator", + namespace: "kube-system" + }, + spec: { + replicas: 2, + selector: { + matchLabels: { + "io.cilium/app": "operator", + name: "cilium-operator" + } + }, + strategy: { + rollingUpdate: { + maxSurge: "25%", + maxUnavailable: "50%" + }, + type: "RollingUpdate" + }, + template: { + metadata: { + annotations: { + "prometheus.io/port": "9963", + "prometheus.io/scrape": "true" + }, + labels: { + "app.kubernetes.io/name": "cilium-operator", + "app.kubernetes.io/part-of": "cilium", + "io.cilium/app": "operator", + name: "cilium-operator" + } + }, + spec: { + affinity: { + podAntiAffinity: { + requiredDuringSchedulingIgnoredDuringExecution: [{ + labelSelector: { + matchLabels: { + "io.cilium/app": "operator" + } + }, + topologyKey: "kubernetes.io/hostname" + }] + } + }, + automountServiceAccountToken: true, + containers: [{ + args: ["--config-dir=/tmp/cilium/config-map", "--debug=$(CILIUM_DEBUG)"], + command: ["cilium-operator-generic"], + env: [{ + name: "K8S_NODE_NAME", + valueFrom: { + fieldRef: { + apiVersion: "v1", + fieldPath: "spec.nodeName" + } + } + }, { + name: "CILIUM_K8S_NAMESPACE", + valueFrom: { + fieldRef: { + apiVersion: "v1", + fieldPath: "metadata.namespace" + } + } + }, { + name: "CILIUM_DEBUG", + valueFrom: { + configMapKeyRef: { + key: "debug", + name: "cilium-config", + optional: true + } + } + }], + image: "quay.io/cilium/operator-generic:v1.19.5@sha256:be848a365776e07d0c5a895eda7aec928ddc52a5a1fa2f432fd7a286609e1db4", + imagePullPolicy: "IfNotPresent", + livenessProbe: { + httpGet: { + host: "127.0.0.1", + path: "/healthz", + port: "health", + scheme: "HTTP" + }, + initialDelaySeconds: 60, + periodSeconds: 10, + timeoutSeconds: 3 + }, + name: "cilium-operator", + ports: [{ + containerPort: 9234, + hostPort: 9234, + name: "health" + }, { + containerPort: 9963, + hostPort: 9963, + name: "prometheus", + protocol: "TCP" + }], + readinessProbe: { + failureThreshold: 5, + httpGet: { + host: "127.0.0.1", + path: "/healthz", + port: "health", + scheme: "HTTP" + }, + initialDelaySeconds: 0, + periodSeconds: 5, + timeoutSeconds: 3 + }, + securityContext: { + allowPrivilegeEscalation: false, + capabilities: { + drop: ["ALL"] + } + }, + terminationMessagePolicy: "FallbackToLogsOnError", + volumeMounts: [{ + mountPath: "/tmp/cilium/config-map", + name: "cilium-config-path", + readOnly: true + }] + }], + hostNetwork: true, + nodeSelector: { + "kubernetes.io/os": "linux" + }, + priorityClassName: "system-cluster-critical", + restartPolicy: "Always", + securityContext: { + seccompProfile: { + type: "RuntimeDefault" + } + }, + serviceAccountName: "cilium-operator", + tolerations: [{ + key: "node-role.kubernetes.io/control-plane", + operator: "Exists" + }, { + key: "node-role.kubernetes.io/master", + operator: "Exists" + }, { + key: "node.kubernetes.io/not-ready", + operator: "Exists" + }, { + key: "node.cloudprovider.kubernetes.io/uninitialized", + operator: "Exists" + }, { + key: "node.cilium.io/agent-not-ready", + operator: "Exists" + }], + volumes: [{ + configMap: { + name: "cilium-config" + }, + name: "cilium-config-path" + }] + } + } + } +}; +export const resources: ReadonlyArray = [Namespace_KubeSystem, Namespace_CiliumSecrets, ServiceAccount_Cilium, ServiceAccount_CiliumEnvoy, ServiceAccount_CiliumOperator, Secret_CiliumCa, Secret_HubbleServerCerts, ConfigMap_CiliumConfig, ConfigMap_CiliumEnvoyConfig, ClusterRole_Cilium, ClusterRole_CiliumOperator, ClusterRoleBinding_Cilium, ClusterRoleBinding_CiliumOperator, Role_CiliumConfigAgent, Role_CiliumTlsinterceptionSecrets, Role_CiliumOperatorTlsinterceptionSecrets, Role_CiliumOperatorZtunnel, RoleBinding_CiliumConfigAgent, RoleBinding_CiliumTlsinterceptionSecrets, RoleBinding_CiliumOperatorTlsinterceptionSecrets, RoleBinding_CiliumOperatorZtunnel, Service_CiliumEnvoy, Service_HubblePeer, DaemonSet_Cilium, DaemonSet_CiliumEnvoy, Deployment_CiliumOperator]; +export default { + resources: resources +}; diff --git a/packages/manifests/src/generated/cloudnative-pg.ts b/packages/manifests/src/generated/cloudnative-pg.ts index 0d98282..20d323e 100644 --- a/packages/manifests/src/generated/cloudnative-pg.ts +++ b/packages/manifests/src/generated/cloudnative-pg.ts @@ -1,6 +1,6 @@ /** Auto-generated typed resources for operator: cloudnative-pg*/ -import type { KubernetesResource, AdmissionregistrationK8sIoV1MutatingWebhookConfiguration, AdmissionregistrationK8sIoV1ValidatingWebhookConfiguration, ApiextensionsK8sIoV1CustomResourceDefinition, AppsV1Deployment, ConfigMap, Namespace, RbacAuthorizationK8sIoV1ClusterRole, RbacAuthorizationK8sIoV1ClusterRoleBinding, Service, ServiceAccount } from "@kubernetesjs/ops"; -export const Namespace_CnpgSystem: Namespace = { +import type { KubernetesResource } from "@kubernetesjs/ops"; +export const Namespace_CnpgSystem: KubernetesResource = { apiVersion: "v1", kind: "Namespace", metadata: { @@ -10,7 +10,7 @@ export const Namespace_CnpgSystem: Namespace = { name: "cnpg-system" } }; -export const CustomResourceDefinition_BackupsPostgresqlCnpgIo: ApiextensionsK8sIoV1CustomResourceDefinition = { +export const CustomResourceDefinition_BackupsPostgresqlCnpgIo: KubernetesResource = { apiVersion: "apiextensions.k8s.io/v1", kind: "CustomResourceDefinition", metadata: { @@ -465,7 +465,7 @@ export const CustomResourceDefinition_BackupsPostgresqlCnpgIo: ApiextensionsK8sI }] } }; -export const CustomResourceDefinition_ClusterimagecatalogsPostgresqlCnpgIo: ApiextensionsK8sIoV1CustomResourceDefinition = { +export const CustomResourceDefinition_ClusterimagecatalogsPostgresqlCnpgIo: KubernetesResource = { apiVersion: "apiextensions.k8s.io/v1", kind: "CustomResourceDefinition", metadata: { @@ -549,7 +549,7 @@ export const CustomResourceDefinition_ClusterimagecatalogsPostgresqlCnpgIo: Apie }] } }; -export const CustomResourceDefinition_ClustersPostgresqlCnpgIo: ApiextensionsK8sIoV1CustomResourceDefinition = { +export const CustomResourceDefinition_ClustersPostgresqlCnpgIo: KubernetesResource = { apiVersion: "apiextensions.k8s.io/v1", kind: "CustomResourceDefinition", metadata: { @@ -5672,7 +5672,7 @@ export const CustomResourceDefinition_ClustersPostgresqlCnpgIo: ApiextensionsK8s }] } }; -export const CustomResourceDefinition_DatabasesPostgresqlCnpgIo: ApiextensionsK8sIoV1CustomResourceDefinition = { +export const CustomResourceDefinition_DatabasesPostgresqlCnpgIo: KubernetesResource = { apiVersion: "apiextensions.k8s.io/v1", kind: "CustomResourceDefinition", metadata: { @@ -5919,7 +5919,7 @@ export const CustomResourceDefinition_DatabasesPostgresqlCnpgIo: ApiextensionsK8 }] } }; -export const CustomResourceDefinition_ImagecatalogsPostgresqlCnpgIo: ApiextensionsK8sIoV1CustomResourceDefinition = { +export const CustomResourceDefinition_ImagecatalogsPostgresqlCnpgIo: KubernetesResource = { apiVersion: "apiextensions.k8s.io/v1", kind: "CustomResourceDefinition", metadata: { @@ -6003,7 +6003,7 @@ export const CustomResourceDefinition_ImagecatalogsPostgresqlCnpgIo: Apiextensio }] } }; -export const CustomResourceDefinition_PoolersPostgresqlCnpgIo: ApiextensionsK8sIoV1CustomResourceDefinition = { +export const CustomResourceDefinition_PoolersPostgresqlCnpgIo: KubernetesResource = { apiVersion: "apiextensions.k8s.io/v1", kind: "CustomResourceDefinition", metadata: { @@ -12622,7 +12622,7 @@ export const CustomResourceDefinition_PoolersPostgresqlCnpgIo: ApiextensionsK8sI }] } }; -export const CustomResourceDefinition_PublicationsPostgresqlCnpgIo: ApiextensionsK8sIoV1CustomResourceDefinition = { +export const CustomResourceDefinition_PublicationsPostgresqlCnpgIo: KubernetesResource = { apiVersion: "apiextensions.k8s.io/v1", kind: "CustomResourceDefinition", metadata: { @@ -12826,7 +12826,7 @@ export const CustomResourceDefinition_PublicationsPostgresqlCnpgIo: Apiextension }] } }; -export const CustomResourceDefinition_ScheduledbackupsPostgresqlCnpgIo: ApiextensionsK8sIoV1CustomResourceDefinition = { +export const CustomResourceDefinition_ScheduledbackupsPostgresqlCnpgIo: KubernetesResource = { apiVersion: "apiextensions.k8s.io/v1", kind: "CustomResourceDefinition", metadata: { @@ -12992,7 +12992,7 @@ export const CustomResourceDefinition_ScheduledbackupsPostgresqlCnpgIo: Apiexten }] } }; -export const CustomResourceDefinition_SubscriptionsPostgresqlCnpgIo: ApiextensionsK8sIoV1CustomResourceDefinition = { +export const CustomResourceDefinition_SubscriptionsPostgresqlCnpgIo: KubernetesResource = { apiVersion: "apiextensions.k8s.io/v1", kind: "CustomResourceDefinition", metadata: { @@ -13141,7 +13141,7 @@ export const CustomResourceDefinition_SubscriptionsPostgresqlCnpgIo: Apiextensio }] } }; -export const ServiceAccount_CnpgManager: ServiceAccount = { +export const ServiceAccount_CnpgManager: KubernetesResource = { apiVersion: "v1", kind: "ServiceAccount", metadata: { @@ -13149,7 +13149,7 @@ export const ServiceAccount_CnpgManager: ServiceAccount = { namespace: "cnpg-system" } }; -export const ClusterRole_CnpgDatabaseEditorRole: RbacAuthorizationK8sIoV1ClusterRole = { +export const ClusterRole_CnpgDatabaseEditorRole: KubernetesResource = { apiVersion: "rbac.authorization.k8s.io/v1", kind: "ClusterRole", metadata: { @@ -13169,7 +13169,7 @@ export const ClusterRole_CnpgDatabaseEditorRole: RbacAuthorizationK8sIoV1Cluster verbs: ["get"] }] }; -export const ClusterRole_CnpgDatabaseViewerRole: RbacAuthorizationK8sIoV1ClusterRole = { +export const ClusterRole_CnpgDatabaseViewerRole: KubernetesResource = { apiVersion: "rbac.authorization.k8s.io/v1", kind: "ClusterRole", metadata: { @@ -13189,7 +13189,7 @@ export const ClusterRole_CnpgDatabaseViewerRole: RbacAuthorizationK8sIoV1Cluster verbs: ["get"] }] }; -export const ClusterRole_CnpgManager: RbacAuthorizationK8sIoV1ClusterRole = { +export const ClusterRole_CnpgManager: KubernetesResource = { apiVersion: "rbac.authorization.k8s.io/v1", kind: "ClusterRole", metadata: { @@ -13277,7 +13277,7 @@ export const ClusterRole_CnpgManager: RbacAuthorizationK8sIoV1ClusterRole = { verbs: ["create", "get", "list", "patch", "watch"] }] }; -export const ClusterRole_CnpgPublicationEditorRole: RbacAuthorizationK8sIoV1ClusterRole = { +export const ClusterRole_CnpgPublicationEditorRole: KubernetesResource = { apiVersion: "rbac.authorization.k8s.io/v1", kind: "ClusterRole", metadata: { @@ -13297,7 +13297,7 @@ export const ClusterRole_CnpgPublicationEditorRole: RbacAuthorizationK8sIoV1Clus verbs: ["get"] }] }; -export const ClusterRole_CnpgPublicationViewerRole: RbacAuthorizationK8sIoV1ClusterRole = { +export const ClusterRole_CnpgPublicationViewerRole: KubernetesResource = { apiVersion: "rbac.authorization.k8s.io/v1", kind: "ClusterRole", metadata: { @@ -13317,7 +13317,7 @@ export const ClusterRole_CnpgPublicationViewerRole: RbacAuthorizationK8sIoV1Clus verbs: ["get"] }] }; -export const ClusterRole_CnpgSubscriptionEditorRole: RbacAuthorizationK8sIoV1ClusterRole = { +export const ClusterRole_CnpgSubscriptionEditorRole: KubernetesResource = { apiVersion: "rbac.authorization.k8s.io/v1", kind: "ClusterRole", metadata: { @@ -13337,7 +13337,7 @@ export const ClusterRole_CnpgSubscriptionEditorRole: RbacAuthorizationK8sIoV1Clu verbs: ["get"] }] }; -export const ClusterRole_CnpgSubscriptionViewerRole: RbacAuthorizationK8sIoV1ClusterRole = { +export const ClusterRole_CnpgSubscriptionViewerRole: KubernetesResource = { apiVersion: "rbac.authorization.k8s.io/v1", kind: "ClusterRole", metadata: { @@ -13357,7 +13357,7 @@ export const ClusterRole_CnpgSubscriptionViewerRole: RbacAuthorizationK8sIoV1Clu verbs: ["get"] }] }; -export const ClusterRoleBinding_CnpgManagerRolebinding: RbacAuthorizationK8sIoV1ClusterRoleBinding = { +export const ClusterRoleBinding_CnpgManagerRolebinding: KubernetesResource = { apiVersion: "rbac.authorization.k8s.io/v1", kind: "ClusterRoleBinding", metadata: { @@ -13374,7 +13374,7 @@ export const ClusterRoleBinding_CnpgManagerRolebinding: RbacAuthorizationK8sIoV1 namespace: "cnpg-system" }] }; -export const ConfigMap_CnpgDefaultMonitoring: ConfigMap = { +export const ConfigMap_CnpgDefaultMonitoring: KubernetesResource = { apiVersion: "v1", kind: "ConfigMap", metadata: { @@ -13388,7 +13388,7 @@ export const ConfigMap_CnpgDefaultMonitoring: ConfigMap = { queries: "backends:\n query: |\n SELECT sa.datname\n , sa.usename\n , sa.application_name\n , states.state\n , COALESCE(sa.count, 0) AS total\n , COALESCE(sa.max_tx_secs, 0) AS max_tx_duration_seconds\n FROM ( VALUES ('active')\n , ('idle')\n , ('idle in transaction')\n , ('idle in transaction (aborted)')\n , ('fastpath function call')\n , ('disabled')\n ) AS states(state)\n LEFT JOIN (\n SELECT datname\n , state\n , usename\n , COALESCE(application_name, '') AS application_name\n , COUNT(*)\n , COALESCE(EXTRACT (EPOCH FROM (max(now() - xact_start))), 0) AS max_tx_secs\n FROM pg_catalog.pg_stat_activity\n GROUP BY datname, state, usename, application_name\n ) sa ON states.state = sa.state\n WHERE sa.usename IS NOT NULL\n metrics:\n - datname:\n usage: \"LABEL\"\n description: \"Name of the database\"\n - usename:\n usage: \"LABEL\"\n description: \"Name of the user\"\n - application_name:\n usage: \"LABEL\"\n description: \"Name of the application\"\n - state:\n usage: \"LABEL\"\n description: \"State of the backend\"\n - total:\n usage: \"GAUGE\"\n description: \"Number of backends\"\n - max_tx_duration_seconds:\n usage: \"GAUGE\"\n description: \"Maximum duration of a transaction in seconds\"\n\nbackends_waiting:\n query: |\n SELECT count(*) AS total\n FROM pg_catalog.pg_locks blocked_locks\n JOIN pg_catalog.pg_locks blocking_locks\n ON blocking_locks.locktype = blocked_locks.locktype\n AND blocking_locks.database IS NOT DISTINCT FROM blocked_locks.database\n AND blocking_locks.relation IS NOT DISTINCT FROM blocked_locks.relation\n AND blocking_locks.page IS NOT DISTINCT FROM blocked_locks.page\n AND blocking_locks.tuple IS NOT DISTINCT FROM blocked_locks.tuple\n AND blocking_locks.virtualxid IS NOT DISTINCT FROM blocked_locks.virtualxid\n AND blocking_locks.transactionid IS NOT DISTINCT FROM blocked_locks.transactionid\n AND blocking_locks.classid IS NOT DISTINCT FROM blocked_locks.classid\n AND blocking_locks.objid IS NOT DISTINCT FROM blocked_locks.objid\n AND blocking_locks.objsubid IS NOT DISTINCT FROM blocked_locks.objsubid\n AND blocking_locks.pid != blocked_locks.pid\n JOIN pg_catalog.pg_stat_activity blocking_activity ON blocking_activity.pid = blocking_locks.pid\n WHERE NOT blocked_locks.granted\n metrics:\n - total:\n usage: \"GAUGE\"\n description: \"Total number of backends that are currently waiting on other queries\"\n\npg_database:\n query: |\n SELECT datname\n , pg_catalog.pg_database_size(datname) AS size_bytes\n , pg_catalog.age(datfrozenxid) AS xid_age\n , pg_catalog.mxid_age(datminmxid) AS mxid_age\n FROM pg_catalog.pg_database\n WHERE datallowconn\n metrics:\n - datname:\n usage: \"LABEL\"\n description: \"Name of the database\"\n - size_bytes:\n usage: \"GAUGE\"\n description: \"Disk space used by the database\"\n - xid_age:\n usage: \"GAUGE\"\n description: \"Number of transactions from the frozen XID to the current one\"\n - mxid_age:\n usage: \"GAUGE\"\n description: \"Number of multiple transactions (Multixact) from the frozen XID to the current one\"\n\npg_postmaster:\n query: |\n SELECT EXTRACT(EPOCH FROM pg_postmaster_start_time) AS start_time\n FROM pg_catalog.pg_postmaster_start_time()\n metrics:\n - start_time:\n usage: \"GAUGE\"\n description: \"Time at which postgres started (based on epoch)\"\n\npg_replication:\n query: \"SELECT CASE WHEN (\n NOT pg_catalog.pg_is_in_recovery()\n OR pg_catalog.pg_last_wal_receive_lsn() = pg_catalog.pg_last_wal_replay_lsn())\n THEN 0\n ELSE GREATEST (0,\n EXTRACT(EPOCH FROM (now() - pg_catalog.pg_last_xact_replay_timestamp())))\n END AS lag,\n pg_catalog.pg_is_in_recovery() AS in_recovery,\n EXISTS (TABLE pg_stat_wal_receiver) AS is_wal_receiver_up,\n (SELECT count(*) FROM pg_catalog.pg_stat_replication) AS streaming_replicas\"\n metrics:\n - lag:\n usage: \"GAUGE\"\n description: \"Replication lag behind primary in seconds\"\n - in_recovery:\n usage: \"GAUGE\"\n description: \"Whether the instance is in recovery\"\n - is_wal_receiver_up:\n usage: \"GAUGE\"\n description: \"Whether the instance wal_receiver is up\"\n - streaming_replicas:\n usage: \"GAUGE\"\n description: \"Number of streaming replicas connected to the instance\"\n\npg_replication_slots:\n query: |\n SELECT slot_name,\n slot_type,\n database,\n active,\n (CASE pg_catalog.pg_is_in_recovery()\n WHEN TRUE THEN pg_catalog.pg_wal_lsn_diff(pg_catalog.pg_last_wal_receive_lsn(), restart_lsn)\n ELSE pg_catalog.pg_wal_lsn_diff(pg_catalog.pg_current_wal_lsn(), restart_lsn)\n END) as pg_wal_lsn_diff\n FROM pg_catalog.pg_replication_slots\n WHERE NOT temporary\n metrics:\n - slot_name:\n usage: \"LABEL\"\n description: \"Name of the replication slot\"\n - slot_type:\n usage: \"LABEL\"\n description: \"Type of the replication slot\"\n - database:\n usage: \"LABEL\"\n description: \"Name of the database\"\n - active:\n usage: \"GAUGE\"\n description: \"Flag indicating whether the slot is active\"\n - pg_wal_lsn_diff:\n usage: \"GAUGE\"\n description: \"Replication lag in bytes\"\n\npg_stat_archiver:\n query: |\n SELECT archived_count\n , failed_count\n , COALESCE(EXTRACT(EPOCH FROM (now() - last_archived_time)), -1) AS seconds_since_last_archival\n , COALESCE(EXTRACT(EPOCH FROM (now() - last_failed_time)), -1) AS seconds_since_last_failure\n , COALESCE(EXTRACT(EPOCH FROM last_archived_time), -1) AS last_archived_time\n , COALESCE(EXTRACT(EPOCH FROM last_failed_time), -1) AS last_failed_time\n , COALESCE(CAST(CAST('x'||pg_catalog.right(pg_catalog.split_part(last_archived_wal, '.', 1), 16) AS pg_catalog.bit(64)) AS pg_catalog.int8), -1) AS last_archived_wal_start_lsn\n , COALESCE(CAST(CAST('x'||pg_catalog.right(pg_catalog.split_part(last_failed_wal, '.', 1), 16) AS pg_catalog.bit(64)) AS pg_catalog.int8), -1) AS last_failed_wal_start_lsn\n , EXTRACT(EPOCH FROM stats_reset) AS stats_reset_time\n FROM pg_catalog.pg_stat_archiver\n metrics:\n - archived_count:\n usage: \"COUNTER\"\n description: \"Number of WAL files that have been successfully archived\"\n - failed_count:\n usage: \"COUNTER\"\n description: \"Number of failed attempts for archiving WAL files\"\n - seconds_since_last_archival:\n usage: \"GAUGE\"\n description: \"Seconds since the last successful archival operation\"\n - seconds_since_last_failure:\n usage: \"GAUGE\"\n description: \"Seconds since the last failed archival operation\"\n - last_archived_time:\n usage: \"GAUGE\"\n description: \"Epoch of the last time WAL archiving succeeded\"\n - last_failed_time:\n usage: \"GAUGE\"\n description: \"Epoch of the last time WAL archiving failed\"\n - last_archived_wal_start_lsn:\n usage: \"GAUGE\"\n description: \"Archived WAL start LSN\"\n - last_failed_wal_start_lsn:\n usage: \"GAUGE\"\n description: \"Last failed WAL LSN\"\n - stats_reset_time:\n usage: \"GAUGE\"\n description: \"Time at which these statistics were last reset\"\n\npg_stat_bgwriter:\n runonserver: \"<17.0.0\"\n query: |\n SELECT checkpoints_timed\n , checkpoints_req\n , checkpoint_write_time\n , checkpoint_sync_time\n , buffers_checkpoint\n , buffers_clean\n , maxwritten_clean\n , buffers_backend\n , buffers_backend_fsync\n , buffers_alloc\n FROM pg_catalog.pg_stat_bgwriter\n metrics:\n - checkpoints_timed:\n usage: \"COUNTER\"\n description: \"Number of scheduled checkpoints that have been performed\"\n - checkpoints_req:\n usage: \"COUNTER\"\n description: \"Number of requested checkpoints that have been performed\"\n - checkpoint_write_time:\n usage: \"COUNTER\"\n description: \"Total amount of time that has been spent in the portion of checkpoint processing where files are written to disk, in milliseconds\"\n - checkpoint_sync_time:\n usage: \"COUNTER\"\n description: \"Total amount of time that has been spent in the portion of checkpoint processing where files are synchronized to disk, in milliseconds\"\n - buffers_checkpoint:\n usage: \"COUNTER\"\n description: \"Number of buffers written during checkpoints\"\n - buffers_clean:\n usage: \"COUNTER\"\n description: \"Number of buffers written by the background writer\"\n - maxwritten_clean:\n usage: \"COUNTER\"\n description: \"Number of times the background writer stopped a cleaning scan because it had written too many buffers\"\n - buffers_backend:\n usage: \"COUNTER\"\n description: \"Number of buffers written directly by a backend\"\n - buffers_backend_fsync:\n usage: \"COUNTER\"\n description: \"Number of times a backend had to execute its own fsync call (normally the background writer handles those even when the backend does its own write)\"\n - buffers_alloc:\n usage: \"COUNTER\"\n description: \"Number of buffers allocated\"\n\npg_stat_bgwriter_17:\n runonserver: \">=17.0.0\"\n name: pg_stat_bgwriter\n query: |\n SELECT buffers_clean\n , maxwritten_clean\n , buffers_alloc\n , EXTRACT(EPOCH FROM stats_reset) AS stats_reset_time\n FROM pg_catalog.pg_stat_bgwriter\n metrics:\n - buffers_clean:\n usage: \"COUNTER\"\n description: \"Number of buffers written by the background writer\"\n - maxwritten_clean:\n usage: \"COUNTER\"\n description: \"Number of times the background writer stopped a cleaning scan because it had written too many buffers\"\n - buffers_alloc:\n usage: \"COUNTER\"\n description: \"Number of buffers allocated\"\n - stats_reset_time:\n usage: \"GAUGE\"\n description: \"Time at which these statistics were last reset\"\n\npg_stat_checkpointer:\n runonserver: \">=17.0.0\"\n query: |\n SELECT num_timed AS checkpoints_timed\n , num_requested AS checkpoints_req\n , restartpoints_timed\n , restartpoints_req\n , restartpoints_done\n , write_time\n , sync_time\n , buffers_written\n , EXTRACT(EPOCH FROM stats_reset) AS stats_reset_time\n FROM pg_catalog.pg_stat_checkpointer\n metrics:\n - checkpoints_timed:\n usage: \"COUNTER\"\n description: \"Number of scheduled checkpoints that have been performed\"\n - checkpoints_req:\n usage: \"COUNTER\"\n description: \"Number of requested checkpoints that have been performed\"\n - restartpoints_timed:\n usage: \"COUNTER\"\n description: \"Number of scheduled restartpoints due to timeout or after a failed attempt to perform it\"\n - restartpoints_req:\n usage: \"COUNTER\"\n description: \"Number of requested restartpoints that have been performed\"\n - restartpoints_done:\n usage: \"COUNTER\"\n description: \"Number of restartpoints that have been performed\"\n - write_time:\n usage: \"COUNTER\"\n description: \"Total amount of time that has been spent in the portion of processing checkpoints and restartpoints where files are written to disk, in milliseconds\"\n - sync_time:\n usage: \"COUNTER\"\n description: \"Total amount of time that has been spent in the portion of processing checkpoints and restartpoints where files are synchronized to disk, in milliseconds\"\n - buffers_written:\n usage: \"COUNTER\"\n description: \"Number of buffers written during checkpoints and restartpoints\"\n - stats_reset_time:\n usage: \"GAUGE\"\n description: \"Time at which these statistics were last reset\"\n\npg_stat_database:\n query: |\n SELECT datname\n , xact_commit\n , xact_rollback\n , blks_read\n , blks_hit\n , tup_returned\n , tup_fetched\n , tup_inserted\n , tup_updated\n , tup_deleted\n , conflicts\n , temp_files\n , temp_bytes\n , deadlocks\n , blk_read_time\n , blk_write_time\n FROM pg_catalog.pg_stat_database\n metrics:\n - datname:\n usage: \"LABEL\"\n description: \"Name of this database\"\n - xact_commit:\n usage: \"COUNTER\"\n description: \"Number of transactions in this database that have been committed\"\n - xact_rollback:\n usage: \"COUNTER\"\n description: \"Number of transactions in this database that have been rolled back\"\n - blks_read:\n usage: \"COUNTER\"\n description: \"Number of disk blocks read in this database\"\n - blks_hit:\n usage: \"COUNTER\"\n description: \"Number of times disk blocks were found already in the buffer cache, so that a read was not necessary (this only includes hits in the PostgreSQL buffer cache, not the operating system's file system cache)\"\n - tup_returned:\n usage: \"COUNTER\"\n description: \"Number of rows returned by queries in this database\"\n - tup_fetched:\n usage: \"COUNTER\"\n description: \"Number of rows fetched by queries in this database\"\n - tup_inserted:\n usage: \"COUNTER\"\n description: \"Number of rows inserted by queries in this database\"\n - tup_updated:\n usage: \"COUNTER\"\n description: \"Number of rows updated by queries in this database\"\n - tup_deleted:\n usage: \"COUNTER\"\n description: \"Number of rows deleted by queries in this database\"\n - conflicts:\n usage: \"COUNTER\"\n description: \"Number of queries canceled due to conflicts with recovery in this database\"\n - temp_files:\n usage: \"COUNTER\"\n description: \"Number of temporary files created by queries in this database\"\n - temp_bytes:\n usage: \"COUNTER\"\n description: \"Total amount of data written to temporary files by queries in this database\"\n - deadlocks:\n usage: \"COUNTER\"\n description: \"Number of deadlocks detected in this database\"\n - blk_read_time:\n usage: \"COUNTER\"\n description: \"Time spent reading data file blocks by backends in this database, in milliseconds\"\n - blk_write_time:\n usage: \"COUNTER\"\n description: \"Time spent writing data file blocks by backends in this database, in milliseconds\"\n\npg_stat_replication:\n primary: true\n query: |\n SELECT usename\n , COALESCE(application_name, '') AS application_name\n , COALESCE(client_addr::text, '') AS client_addr\n , COALESCE(client_port::text, '') AS client_port\n , EXTRACT(EPOCH FROM backend_start) AS backend_start\n , COALESCE(pg_catalog.age(backend_xmin), 0) AS backend_xmin_age\n , pg_catalog.pg_wal_lsn_diff(pg_catalog.pg_current_wal_lsn(), sent_lsn) AS sent_diff_bytes\n , pg_catalog.pg_wal_lsn_diff(pg_catalog.pg_current_wal_lsn(), write_lsn) AS write_diff_bytes\n , pg_catalog.pg_wal_lsn_diff(pg_catalog.pg_current_wal_lsn(), flush_lsn) AS flush_diff_bytes\n , COALESCE(pg_catalog.pg_wal_lsn_diff(pg_catalog.pg_current_wal_lsn(), replay_lsn),0) AS replay_diff_bytes\n , COALESCE((EXTRACT(EPOCH FROM write_lag)),0)::float AS write_lag_seconds\n , COALESCE((EXTRACT(EPOCH FROM flush_lag)),0)::float AS flush_lag_seconds\n , COALESCE((EXTRACT(EPOCH FROM replay_lag)),0)::float AS replay_lag_seconds\n FROM pg_catalog.pg_stat_replication\n metrics:\n - usename:\n usage: \"LABEL\"\n description: \"Name of the replication user\"\n - application_name:\n usage: \"LABEL\"\n description: \"Name of the application\"\n - client_addr:\n usage: \"LABEL\"\n description: \"Client IP address\"\n - client_port:\n usage: \"LABEL\"\n description: \"Client TCP port\"\n - backend_start:\n usage: \"COUNTER\"\n description: \"Time when this process was started\"\n - backend_xmin_age:\n usage: \"COUNTER\"\n description: \"The age of this standby's xmin horizon\"\n - sent_diff_bytes:\n usage: \"GAUGE\"\n description: \"Difference in bytes from the last write-ahead log location sent on this connection\"\n - write_diff_bytes:\n usage: \"GAUGE\"\n description: \"Difference in bytes from the last write-ahead log location written to disk by this standby server\"\n - flush_diff_bytes:\n usage: \"GAUGE\"\n description: \"Difference in bytes from the last write-ahead log location flushed to disk by this standby server\"\n - replay_diff_bytes:\n usage: \"GAUGE\"\n description: \"Difference in bytes from the last write-ahead log location replayed into the database on this standby server\"\n - write_lag_seconds:\n usage: \"GAUGE\"\n description: \"Time elapsed between flushing recent WAL locally and receiving notification that this standby server has written it\"\n - flush_lag_seconds:\n usage: \"GAUGE\"\n description: \"Time elapsed between flushing recent WAL locally and receiving notification that this standby server has written and flushed it\"\n - replay_lag_seconds:\n usage: \"GAUGE\"\n description: \"Time elapsed between flushing recent WAL locally and receiving notification that this standby server has written, flushed and applied it\"\n\npg_settings:\n query: |\n SELECT name,\n CASE setting WHEN 'on' THEN '1' WHEN 'off' THEN '0' ELSE setting END AS setting\n FROM pg_catalog.pg_settings\n WHERE vartype IN ('integer', 'real', 'bool')\n ORDER BY 1\n metrics:\n - name:\n usage: \"LABEL\"\n description: \"Name of the setting\"\n - setting:\n usage: \"GAUGE\"\n description: \"Setting value\"\n" } }; -export const Service_CnpgWebhookService: Service = { +export const Service_CnpgWebhookService: KubernetesResource = { apiVersion: "v1", kind: "Service", metadata: { @@ -13405,7 +13405,7 @@ export const Service_CnpgWebhookService: Service = { } } }; -export const Deployment_CnpgControllerManager: AppsV1Deployment = { +export const Deployment_CnpgControllerManager: KubernetesResource = { apiVersion: "apps/v1", kind: "Deployment", metadata: { @@ -13534,7 +13534,7 @@ export const Deployment_CnpgControllerManager: AppsV1Deployment = { } } }; -export const MutatingWebhookConfiguration_CnpgMutatingWebhookConfiguration: AdmissionregistrationK8sIoV1MutatingWebhookConfiguration = { +export const MutatingWebhookConfiguration_CnpgMutatingWebhookConfiguration: KubernetesResource = { apiVersion: "admissionregistration.k8s.io/v1", kind: "MutatingWebhookConfiguration", metadata: { @@ -13596,7 +13596,7 @@ export const MutatingWebhookConfiguration_CnpgMutatingWebhookConfiguration: Admi sideEffects: "None" }] }; -export const ValidatingWebhookConfiguration_CnpgValidatingWebhookConfiguration: AdmissionregistrationK8sIoV1ValidatingWebhookConfiguration = { +export const ValidatingWebhookConfiguration_CnpgValidatingWebhookConfiguration: KubernetesResource = { apiVersion: "admissionregistration.k8s.io/v1", kind: "ValidatingWebhookConfiguration", metadata: { diff --git a/packages/manifests/src/generated/index.ts b/packages/manifests/src/generated/index.ts index a5635ff..9d95624 100644 --- a/packages/manifests/src/generated/index.ts +++ b/packages/manifests/src/generated/index.ts @@ -1,49 +1,55 @@ /** Auto-generated aggregator of operator objects*/ import type { KubernetesResource } from "@kubernetesjs/ops"; import CertManager from "./cert-manager"; +import Cilium from "./cilium"; import CloudnativePg from "./cloudnative-pg"; -import IngressNginx from "./ingress-nginx"; import KnativeServing from "./knative-serving"; import KubePrometheusStack from "./kube-prometheus-stack"; import MinioOperator from "./minio-operator"; +import TektonPipelines from "./tekton-pipelines"; +import Traefik from "./traefik"; export interface OperatorObjectModule { resources?: ReadonlyArray; } export const OPERATOR_OBJECTS: Record = { "cert-manager": CertManager, + "cilium": Cilium, "cloudnative-pg": CloudnativePg, - "ingress-nginx": IngressNginx, "knative-serving": KnativeServing, "kube-prometheus-stack": KubePrometheusStack, - "minio-operator": MinioOperator + "minio-operator": MinioOperator, + "tekton-pipelines": TektonPipelines, + "traefik": Traefik }; -export const OPERATOR_IDS: ReadonlyArray = ["cert-manager", "cloudnative-pg", "ingress-nginx", "knative-serving", "kube-prometheus-stack", "minio-operator"]; +export const OPERATOR_IDS: ReadonlyArray = ["cert-manager", "cilium", "cloudnative-pg", "knative-serving", "kube-prometheus-stack", "minio-operator", "tekton-pipelines", "traefik"]; export const OPERATOR_VERSIONS = { - "cert-manager": ["v1.17.0"], + "cert-manager": ["v1.17.0", "v1.21.1"], + cilium: ["1.19.5"], "cloudnative-pg": ["1.25.2"], - "ingress-nginx": ["4.11.2"], - "knative-serving": ["v1.15.0"], + "knative-serving": ["v1.15.0", "v1.22.1"], "kube-prometheus-stack": ["77.5.0"], - "minio-operator": ["7.1.1"] + "minio-operator": ["7.1.1"], + "tekton-pipelines": ["v1.15.0"], + traefik: ["34.4.1"] }; export const OPERATOR_MAP: Record; versions: ReadonlyArray; }> = { "cert-manager": { - versions: ["v1.17.0"], + versions: ["v1.17.0", "v1.21.1"], resources: CertManager.resources }, + "cilium": { + versions: ["1.19.5"], + resources: Cilium.resources + }, "cloudnative-pg": { versions: ["1.25.2"], resources: CloudnativePg.resources }, - "ingress-nginx": { - versions: ["4.11.2"], - resources: IngressNginx.resources - }, "knative-serving": { - versions: ["v1.15.0"], + versions: ["v1.15.0", "v1.22.1"], resources: KnativeServing.resources }, "kube-prometheus-stack": { @@ -53,5 +59,13 @@ export const OPERATOR_MAP: Record = [Namespace_IngressNginx, ServiceAccount_IngressNginx, ConfigMap_IngressNginxController, ClusterRole_IngressNginx, ClusterRoleBinding_IngressNginx, Role_IngressNginx, RoleBinding_IngressNginx, Service_IngressNginxControllerMetrics, Service_IngressNginxControllerAdmission, Service_IngressNginxController, Deployment_IngressNginxController, IngressClass_Nginx, ValidatingWebhookConfiguration_IngressNginxAdmission, ServiceAccount_IngressNginxAdmission, ClusterRole_IngressNginxAdmission, ClusterRoleBinding_IngressNginxAdmission, Role_IngressNginxAdmission, RoleBinding_IngressNginxAdmission, Job_IngressNginxAdmissionCreate, Job_IngressNginxAdmissionPatch]; -export default { - resources: resources -}; diff --git a/packages/manifests/src/generated/knative-serving.ts b/packages/manifests/src/generated/knative-serving.ts index 228743a..7347793 100644 --- a/packages/manifests/src/generated/knative-serving.ts +++ b/packages/manifests/src/generated/knative-serving.ts @@ -1,13 +1,13 @@ /** Auto-generated typed resources for operator: knative-serving*/ -import type { KubernetesResource, AdmissionregistrationK8sIoV1MutatingWebhookConfiguration, AdmissionregistrationK8sIoV1ValidatingWebhookConfiguration, ApiextensionsK8sIoV1CustomResourceDefinition, AppsV1Deployment, AutoscalingV2HorizontalPodAutoscaler, CachingInternalKnativeDevV1alpha1Image, ConfigMap, Namespace, NetworkingInternalKnativeDevV1alpha1Certificate, PolicyV1PodDisruptionBudget, RbacAuthorizationK8sIoV1ClusterRole, RbacAuthorizationK8sIoV1ClusterRoleBinding, RbacAuthorizationK8sIoV1Role, RbacAuthorizationK8sIoV1RoleBinding, Secret, Service, ServiceAccount } from "@kubernetesjs/ops"; -export const CustomResourceDefinition_CertificatesNetworkingInternalKnativeDev: ApiextensionsK8sIoV1CustomResourceDefinition = { +import type { KubernetesResource } from "@kubernetesjs/ops"; +export const CustomResourceDefinition_CertificatesNetworkingInternalKnativeDev: KubernetesResource = { apiVersion: "apiextensions.k8s.io/v1", kind: "CustomResourceDefinition", metadata: { labels: { "app.kubernetes.io/component": "networking", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.15.0", + "app.kubernetes.io/version": "1.22.1", "knative.dev/crd-install": "true" }, name: "certificates.networking.internal.knative.dev" @@ -171,13 +171,13 @@ export const CustomResourceDefinition_CertificatesNetworkingInternalKnativeDev: }] } }; -export const CustomResourceDefinition_ConfigurationsServingKnativeDev: ApiextensionsK8sIoV1CustomResourceDefinition = { +export const CustomResourceDefinition_ConfigurationsServingKnativeDev: KubernetesResource = { apiVersion: "apiextensions.k8s.io/v1", kind: "CustomResourceDefinition", metadata: { labels: { "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.15.0", + "app.kubernetes.io/version": "1.22.1", "duck.knative.dev/podspecable": "true", "knative.dev/crd-install": "true" }, @@ -290,14 +290,16 @@ export const CustomResourceDefinition_ConfigurationsServingKnativeDev: Apiextens items: { type: "string" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" }, command: { description: "Entrypoint array. Not executed within a shell.\nThe container image's ENTRYPOINT is used if this is not provided.\nVariable references $(VAR_NAME) are expanded using the container's environment. If a variable\ncannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced\nto a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. \"$$(VAR_NAME)\" will\nproduce the string literal \"$(VAR_NAME)\". Escaped references will never be expanded, regardless\nof whether the variable exists or not. Cannot be updated.\nMore info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell", items: { type: "string" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" }, env: { description: "List of environment variables to set in the container.\nCannot be updated.", @@ -305,7 +307,7 @@ export const CustomResourceDefinition_ConfigurationsServingKnativeDev: Apiextens description: "EnvVar represents an environment variable present in a Container.", properties: { name: { - description: "Name of the environment variable. Must be a C_IDENTIFIER.", + description: "Name of the environment variable.\nMay consist of any printable ASCII characters except '='.", type: "string" }, value: { @@ -323,7 +325,8 @@ export const CustomResourceDefinition_ConfigurationsServingKnativeDev: Apiextens type: "string" }, name: { - description: "Name of the referent.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names\nTODO: Add other useful fields. apiVersion, kind, uid?", + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", type: "string" }, optional: { @@ -355,7 +358,8 @@ export const CustomResourceDefinition_ConfigurationsServingKnativeDev: Apiextens type: "string" }, name: { - description: "Name of the referent.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names\nTODO: Add other useful fields. apiVersion, kind, uid?", + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", type: "string" }, optional: { @@ -374,18 +378,21 @@ export const CustomResourceDefinition_ConfigurationsServingKnativeDev: Apiextens required: ["name"], type: "object" }, - type: "array" + type: "array", + "x-kubernetes-list-map-keys": ["name"], + "x-kubernetes-list-type": "map" }, envFrom: { - description: "List of sources to populate environment variables in the container.\nThe keys defined within a source must be a C_IDENTIFIER. All invalid keys\nwill be reported as an event when the container is starting. When a key exists in multiple\nsources, the value associated with the last source will take precedence.\nValues defined by an Env with a duplicate key will take precedence.\nCannot be updated.", + description: "List of sources to populate environment variables in the container.\nThe keys defined within a source may consist of any printable ASCII characters except '='.\nWhen a key exists in multiple\nsources, the value associated with the last source will take precedence.\nValues defined by an Env with a duplicate key will take precedence.\nCannot be updated.", items: { - description: "EnvFromSource represents the source of a set of ConfigMaps", + description: "EnvFromSource represents the source of a set of ConfigMaps or Secrets", properties: { configMapRef: { description: "The ConfigMap to select from", properties: { name: { - description: "Name of the referent.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names\nTODO: Add other useful fields. apiVersion, kind, uid?", + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", type: "string" }, optional: { @@ -397,14 +404,15 @@ export const CustomResourceDefinition_ConfigurationsServingKnativeDev: Apiextens "x-kubernetes-map-type": "atomic" }, prefix: { - description: "An optional identifier to prepend to each key in the ConfigMap. Must be a C_IDENTIFIER.", + description: "Optional text to prepend to the name of each environment variable.\nMay consist of any printable ASCII characters except '='.", type: "string" }, secretRef: { description: "The Secret to select from", properties: { name: { - description: "Name of the referent.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names\nTODO: Add other useful fields. apiVersion, kind, uid?", + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", type: "string" }, optional: { @@ -418,7 +426,8 @@ export const CustomResourceDefinition_ConfigurationsServingKnativeDev: Apiextens }, type: "object" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" }, image: { description: "Container image name.\nMore info: https://kubernetes.io/docs/concepts/containers/images\nThis field is optional to allow higher level config management to default or override\ncontainer images in workload controllers like Deployments and StatefulSets.", @@ -432,14 +441,15 @@ export const CustomResourceDefinition_ConfigurationsServingKnativeDev: Apiextens description: "Periodic probe of container liveness.\nContainer will be restarted if the probe fails.\nCannot be updated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", properties: { exec: { - description: "Exec specifies the action to take.", + description: "Exec specifies a command to execute in the container.", properties: { command: { description: "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", items: { type: "string" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" } }, type: "object" @@ -450,7 +460,7 @@ export const CustomResourceDefinition_ConfigurationsServingKnativeDev: Apiextens type: "integer" }, grpc: { - description: "GRPC specifies an action involving a GRPC port.", + description: "GRPC specifies a GRPC HealthCheckRequest.", properties: { port: { description: "Port number of the gRPC service. Number must be in the range 1 to 65535.", @@ -458,15 +468,15 @@ export const CustomResourceDefinition_ConfigurationsServingKnativeDev: Apiextens type: "integer" }, service: { - description: "Service is the name of the service to place in the gRPC HealthCheckRequest\n(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).\n\n\nIf this is not specified, the default behavior is defined by gRPC.", + default: "", + description: "Service is the name of the service to place in the gRPC HealthCheckRequest\n(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).\n\nIf this is not specified, the default behavior is defined by gRPC.", type: "string" } }, - required: ["port"], type: "object" }, httpGet: { - description: "HTTPGet specifies the http request to perform.", + description: "HTTPGet specifies an HTTP GET request to perform.", properties: { host: { description: "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", @@ -489,7 +499,8 @@ export const CustomResourceDefinition_ConfigurationsServingKnativeDev: Apiextens required: ["name", "value"], type: "object" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" }, path: { description: "Path to access on the HTTP server.", @@ -527,7 +538,7 @@ export const CustomResourceDefinition_ConfigurationsServingKnativeDev: Apiextens type: "integer" }, tcpSocket: { - description: "TCPSocket specifies an action involving a TCP port.", + description: "TCPSocket specifies a connection to a TCP port.", properties: { host: { description: "Optional: Host name to connect to, defaults to the pod IP.", @@ -577,25 +588,23 @@ export const CustomResourceDefinition_ConfigurationsServingKnativeDev: Apiextens type: "string" } }, - required: ["containerPort"], type: "object" }, - type: "array", - "x-kubernetes-list-map-keys": ["containerPort", "protocol"], - "x-kubernetes-list-type": "map" + type: "array" }, readinessProbe: { description: "Periodic probe of container service readiness.\nContainer will be removed from service endpoints if the probe fails.\nCannot be updated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", properties: { exec: { - description: "Exec specifies the action to take.", + description: "Exec specifies a command to execute in the container.", properties: { command: { description: "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", items: { type: "string" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" } }, type: "object" @@ -606,7 +615,7 @@ export const CustomResourceDefinition_ConfigurationsServingKnativeDev: Apiextens type: "integer" }, grpc: { - description: "GRPC specifies an action involving a GRPC port.", + description: "GRPC specifies a GRPC HealthCheckRequest.", properties: { port: { description: "Port number of the gRPC service. Number must be in the range 1 to 65535.", @@ -614,15 +623,15 @@ export const CustomResourceDefinition_ConfigurationsServingKnativeDev: Apiextens type: "integer" }, service: { - description: "Service is the name of the service to place in the gRPC HealthCheckRequest\n(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).\n\n\nIf this is not specified, the default behavior is defined by gRPC.", + default: "", + description: "Service is the name of the service to place in the gRPC HealthCheckRequest\n(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).\n\nIf this is not specified, the default behavior is defined by gRPC.", type: "string" } }, - required: ["port"], type: "object" }, httpGet: { - description: "HTTPGet specifies the http request to perform.", + description: "HTTPGet specifies an HTTP GET request to perform.", properties: { host: { description: "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", @@ -645,7 +654,8 @@ export const CustomResourceDefinition_ConfigurationsServingKnativeDev: Apiextens required: ["name", "value"], type: "object" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" }, path: { description: "Path to access on the HTTP server.", @@ -683,7 +693,7 @@ export const CustomResourceDefinition_ConfigurationsServingKnativeDev: Apiextens type: "integer" }, tcpSocket: { - description: "TCPSocket specifies an action involving a TCP port.", + description: "TCPSocket specifies a connection to a TCP port.", properties: { host: { description: "Optional: Host name to connect to, defaults to the pod IP.", @@ -712,23 +722,6 @@ export const CustomResourceDefinition_ConfigurationsServingKnativeDev: Apiextens resources: { description: "Compute Resources required by this container.\nCannot be updated.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", properties: { - claims: { - description: "Claims lists the names of resources, defined in spec.resourceClaims,\nthat are used by this container.\n\n\nThis is an alpha field and requires enabling the\nDynamicResourceAllocation feature gate.\n\n\nThis field is immutable. It can only be set for containers.", - items: { - description: "ResourceClaim references one entry in PodSpec.ResourceClaims.", - properties: { - name: { - description: "Name must match the name of one entry in pod.spec.resourceClaims of\nthe Pod where this field is used. It makes that resource available\ninside a container.", - type: "string" - } - }, - required: ["name"], - type: "object" - }, - type: "array", - "x-kubernetes-list-map-keys": ["name"], - "x-kubernetes-list-type": "map" - }, limits: { additionalProperties: { anyOf: [{ @@ -774,7 +767,8 @@ export const CustomResourceDefinition_ConfigurationsServingKnativeDev: Apiextens description: "Capability represent POSIX capabilities type", type: "string" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" }, drop: { description: "Removed capabilities", @@ -782,11 +776,16 @@ export const CustomResourceDefinition_ConfigurationsServingKnativeDev: Apiextens description: "Capability represent POSIX capabilities type", type: "string" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" } }, type: "object" }, + privileged: { + description: "Run container in privileged mode. This can only be set to explicitly to 'false'", + type: "boolean" + }, readOnlyRootFilesystem: { description: "Whether this container has a read-only root filesystem.\nDefault is false.\nNote that this field cannot be set when spec.os.name is windows.", type: "boolean" @@ -813,7 +812,7 @@ export const CustomResourceDefinition_ConfigurationsServingKnativeDev: Apiextens type: "string" }, type: { - description: "type indicates which kind of seccomp profile will be applied.\nValid options are:\n\n\nLocalhost - a profile defined in a file on the node should be used.\nRuntimeDefault - the container runtime default profile should be used.\nUnconfined - no profile should be applied.", + description: "type indicates which kind of seccomp profile will be applied.\nValid options are:\n\nLocalhost - a profile defined in a file on the node should be used.\nRuntimeDefault - the container runtime default profile should be used.\nUnconfined - no profile should be applied.", type: "string" } }, @@ -827,14 +826,15 @@ export const CustomResourceDefinition_ConfigurationsServingKnativeDev: Apiextens description: "StartupProbe indicates that the Pod has successfully initialized.\nIf specified, no other probes are executed until this completes successfully.\nIf this probe fails, the Pod will be restarted, just as if the livenessProbe failed.\nThis can be used to provide different probe parameters at the beginning of a Pod's lifecycle,\nwhen it might take a long time to load data or warm a cache, than during steady-state operation.\nThis cannot be updated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", properties: { exec: { - description: "Exec specifies the action to take.", + description: "Exec specifies a command to execute in the container.", properties: { command: { description: "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", items: { type: "string" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" } }, type: "object" @@ -845,7 +845,7 @@ export const CustomResourceDefinition_ConfigurationsServingKnativeDev: Apiextens type: "integer" }, grpc: { - description: "GRPC specifies an action involving a GRPC port.", + description: "GRPC specifies a GRPC HealthCheckRequest.", properties: { port: { description: "Port number of the gRPC service. Number must be in the range 1 to 65535.", @@ -853,15 +853,15 @@ export const CustomResourceDefinition_ConfigurationsServingKnativeDev: Apiextens type: "integer" }, service: { - description: "Service is the name of the service to place in the gRPC HealthCheckRequest\n(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).\n\n\nIf this is not specified, the default behavior is defined by gRPC.", + default: "", + description: "Service is the name of the service to place in the gRPC HealthCheckRequest\n(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).\n\nIf this is not specified, the default behavior is defined by gRPC.", type: "string" } }, - required: ["port"], type: "object" }, httpGet: { - description: "HTTPGet specifies the http request to perform.", + description: "HTTPGet specifies an HTTP GET request to perform.", properties: { host: { description: "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", @@ -884,7 +884,8 @@ export const CustomResourceDefinition_ConfigurationsServingKnativeDev: Apiextens required: ["name", "value"], type: "object" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" }, path: { description: "Path to access on the HTTP server.", @@ -922,7 +923,7 @@ export const CustomResourceDefinition_ConfigurationsServingKnativeDev: Apiextens type: "integer" }, tcpSocket: { - description: "TCPSocket specifies an action involving a TCP port.", + description: "TCPSocket specifies a connection to a TCP port.", properties: { host: { description: "Optional: Host name to connect to, defaults to the pod IP.", @@ -965,6 +966,10 @@ export const CustomResourceDefinition_ConfigurationsServingKnativeDev: Apiextens description: "Path within the container at which the volume should be mounted. Must\nnot contain ':'.", type: "string" }, + mountPropagation: { + description: "This is accessible behind a feature flag - kubernetes.podspec-volumes-mount-propagation", + type: "string" + }, name: { description: "This must match the Name of a Volume.", type: "string" @@ -981,7 +986,9 @@ export const CustomResourceDefinition_ConfigurationsServingKnativeDev: Apiextens required: ["mountPath", "name"], type: "object" }, - type: "array" + type: "array", + "x-kubernetes-list-map-keys": ["mountPath"], + "x-kubernetes-list-type": "map" }, workingDir: { description: "Container's working directory.\nIf not specified, the container runtime's default will be used, which\nmight be configured in the container image.\nCannot be updated.", @@ -1002,7 +1009,7 @@ export const CustomResourceDefinition_ConfigurationsServingKnativeDev: Apiextens type: "string" }, enableServiceLinks: { - description: "EnableServiceLinks indicates whether information about services should be injected into pod's environment variables, matching the syntax of Docker links. Optional: Knative defaults this to false.", + description: "EnableServiceLinks indicates whether information aboutservices should be injected into pod's environment variables, matching the syntax of Docker links. Optional: Knative defaults this to false.", type: "boolean" }, hostAliases: { @@ -1014,6 +1021,18 @@ export const CustomResourceDefinition_ConfigurationsServingKnativeDev: Apiextens }, type: "array" }, + hostIPC: { + description: "This is accessible behind a feature flag - kubernetes.podspec-hostipc", + type: "boolean" + }, + hostNetwork: { + description: "This is accessible behind a feature flag - kubernetes.podspec-hostnetwork", + type: "boolean" + }, + hostPID: { + description: "This is accessible behind a feature flag - kubernetes.podspec-hostpid", + type: "boolean" + }, idleTimeoutSeconds: { description: "IdleTimeoutSeconds is the maximum duration in seconds a request will be allowed\nto stay open while not receiving any bytes from the user's application. If\nunspecified, a system default will be provided.", format: "int64", @@ -1025,17 +1044,20 @@ export const CustomResourceDefinition_ConfigurationsServingKnativeDev: Apiextens description: "LocalObjectReference contains enough information to let you locate the\nreferenced object inside the same namespace.", properties: { name: { - description: "Name of the referent.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names\nTODO: Add other useful fields. apiVersion, kind, uid?", + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", type: "string" } }, type: "object", "x-kubernetes-map-type": "atomic" }, - type: "array" + type: "array", + "x-kubernetes-list-map-keys": ["name"], + "x-kubernetes-list-type": "map" }, initContainers: { - description: "List of initialization containers belonging to the pod.\nInit containers are executed in order prior to containers being started. If any\ninit container fails, the pod is considered to have failed and is handled according\nto its restartPolicy. The name for an init container or normal container must be\nunique among all containers.\nInit containers may not have Lifecycle actions, Readiness probes, Liveness probes, or Startup probes.\nThe resourceRequirements of an init container are taken into account during scheduling\nby finding the highest request/limit for each resource type, and then using the max of\nof that value or the sum of the normal containers. Limits are applied to init containers\nin a similar fashion.\nInit containers cannot currently be added or removed.\nCannot be updated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/", + description: "This is accessible behind a feature flag - kubernetes.podspec-init-containers", items: { description: "This is accessible behind a feature flag - kubernetes.podspec-init-containers", type: "object", @@ -1044,15 +1066,16 @@ export const CustomResourceDefinition_ConfigurationsServingKnativeDev: Apiextens type: "array" }, nodeSelector: { + additionalProperties: { + type: "string" + }, description: "This is accessible behind a feature flag - kubernetes.podspec-nodeselector", type: "object", - "x-kubernetes-map-type": "atomic", - "x-kubernetes-preserve-unknown-fields": true + "x-kubernetes-map-type": "atomic" }, priorityClassName: { description: "This is accessible behind a feature flag - kubernetes.podspec-priorityclassname", - type: "string", - "x-kubernetes-preserve-unknown-fields": true + type: "string" }, responseStartTimeoutSeconds: { description: "ResponseStartTimeoutSeconds is the maximum duration in seconds that the request\nrouting layer will wait for a request delivered to a container to begin\nsending any network traffic.", @@ -1061,13 +1084,11 @@ export const CustomResourceDefinition_ConfigurationsServingKnativeDev: Apiextens }, runtimeClassName: { description: "This is accessible behind a feature flag - kubernetes.podspec-runtimeclassname", - type: "string", - "x-kubernetes-preserve-unknown-fields": true + type: "string" }, schedulerName: { description: "This is accessible behind a feature flag - kubernetes.podspec-schedulername", - type: "string", - "x-kubernetes-preserve-unknown-fields": true + type: "string" }, securityContext: { description: "This is accessible behind a feature flag - kubernetes.podspec-securitycontext", @@ -1079,9 +1100,8 @@ export const CustomResourceDefinition_ConfigurationsServingKnativeDev: Apiextens type: "string" }, shareProcessNamespace: { - description: "This is accessible behind a feature flag - kubernetes.podspec-shareproccessnamespace", - type: "boolean", - "x-kubernetes-preserve-unknown-fields": true + description: "This is accessible behind a feature flag - kubernetes.podspec-shareprocessnamespace", + type: "boolean" }, timeoutSeconds: { description: "TimeoutSeconds is the maximum duration in seconds that the request instance\nis allowed to respond to a request. If unspecified, a system default will\nbe provided.", @@ -1141,10 +1161,12 @@ export const CustomResourceDefinition_ConfigurationsServingKnativeDev: Apiextens required: ["key", "path"], type: "object" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" }, name: { - description: "Name of the referent.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names\nTODO: Add other useful fields. apiVersion, kind, uid?", + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", type: "string" }, optional: { @@ -1155,8 +1177,23 @@ export const CustomResourceDefinition_ConfigurationsServingKnativeDev: Apiextens type: "object", "x-kubernetes-map-type": "atomic" }, + csi: { + description: "This is accessible behind a feature flag - kubernetes.podspec-volumes-csi", + type: "object", + "x-kubernetes-preserve-unknown-fields": true + }, emptyDir: { - description: "This is accessible behind a feature flag - kubernetes.podspec-emptydir", + description: "This is accessible behind a feature flag - kubernetes.podspec-volumes-emptydir", + type: "object", + "x-kubernetes-preserve-unknown-fields": true + }, + hostPath: { + description: "This is accessible behind a feature flag - kubernetes.podspec-volumes-hostpath", + type: "object", + "x-kubernetes-preserve-unknown-fields": true + }, + image: { + description: "This is accessible behind a feature flag - kubernetes.podspec-volumes-image", type: "object", "x-kubernetes-preserve-unknown-fields": true }, @@ -1178,9 +1215,9 @@ export const CustomResourceDefinition_ConfigurationsServingKnativeDev: Apiextens type: "integer" }, sources: { - description: "sources is the list of volume projections", + description: "sources is the list of volume projections. Each entry in this list\nhandles one source.", items: { - description: "Projection that may be projected along with other supported volume types", + description: "Projection that may be projected along with other supported volume types.\nExactly one of these fields must be set.", properties: { configMap: { description: "configMap information about the configMap data to project", @@ -1207,10 +1244,12 @@ export const CustomResourceDefinition_ConfigurationsServingKnativeDev: Apiextens required: ["key", "path"], type: "object" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" }, name: { - description: "Name of the referent.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names\nTODO: Add other useful fields. apiVersion, kind, uid?", + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", type: "string" }, optional: { @@ -1230,7 +1269,7 @@ export const CustomResourceDefinition_ConfigurationsServingKnativeDev: Apiextens description: "DownwardAPIVolumeFile represents information to create the file containing the pod field", properties: { fieldRef: { - description: "Required: Selects a field of the pod: only annotations, labels, name and namespace are supported.", + description: "Required: Selects a field of the pod: only annotations, labels, name, namespace and uid are supported.", properties: { apiVersion: { description: "Version of the schema the FieldPath is written in terms of, defaults to \"v1\".", @@ -1284,7 +1323,8 @@ export const CustomResourceDefinition_ConfigurationsServingKnativeDev: Apiextens required: ["path"], type: "object" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" } }, type: "object" @@ -1314,10 +1354,12 @@ export const CustomResourceDefinition_ConfigurationsServingKnativeDev: Apiextens required: ["key", "path"], type: "object" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" }, name: { - description: "Name of the referent.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names\nTODO: Add other useful fields. apiVersion, kind, uid?", + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", type: "string" }, optional: { @@ -1351,7 +1393,8 @@ export const CustomResourceDefinition_ConfigurationsServingKnativeDev: Apiextens }, type: "object" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" } }, type: "object" @@ -1386,7 +1429,8 @@ export const CustomResourceDefinition_ConfigurationsServingKnativeDev: Apiextens required: ["key", "path"], type: "object" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" }, optional: { description: "optional field specify whether the Secret or its keys must be defined", @@ -1403,7 +1447,9 @@ export const CustomResourceDefinition_ConfigurationsServingKnativeDev: Apiextens required: ["name"], type: "object" }, - type: "array" + type: "array", + "x-kubernetes-list-map-keys": ["name"], + "x-kubernetes-list-type": "map" } }, required: ["containers"], @@ -1488,14 +1534,14 @@ export const CustomResourceDefinition_ConfigurationsServingKnativeDev: Apiextens }] } }; -export const CustomResourceDefinition_ClusterdomainclaimsNetworkingInternalKnativeDev: ApiextensionsK8sIoV1CustomResourceDefinition = { +export const CustomResourceDefinition_ClusterdomainclaimsNetworkingInternalKnativeDev: KubernetesResource = { apiVersion: "apiextensions.k8s.io/v1", kind: "CustomResourceDefinition", metadata: { labels: { "app.kubernetes.io/component": "networking", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.15.0", + "app.kubernetes.io/version": "1.22.1", "knative.dev/crd-install": "true" }, name: "clusterdomainclaims.networking.internal.knative.dev" @@ -1550,13 +1596,13 @@ export const CustomResourceDefinition_ClusterdomainclaimsNetworkingInternalKnati }] } }; -export const CustomResourceDefinition_DomainmappingsServingKnativeDev: ApiextensionsK8sIoV1CustomResourceDefinition = { +export const CustomResourceDefinition_DomainmappingsServingKnativeDev: KubernetesResource = { apiVersion: "apiextensions.k8s.io/v1", kind: "CustomResourceDefinition", metadata: { labels: { "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.15.0", + "app.kubernetes.io/version": "1.22.1", "knative.dev/crd-install": "true" }, name: "domainmappings.serving.knative.dev" @@ -1605,7 +1651,7 @@ export const CustomResourceDefinition_DomainmappingsServingKnativeDev: Apiextens description: "Spec is the desired state of the DomainMapping.\nMore info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status", properties: { ref: { - description: "Ref specifies the target of the Domain Mapping.\n\n\nThe object identified by the Ref must be an Addressable with a URL of the\nform `{name}.{namespace}.{domain}` where `{domain}` is the cluster domain,\nand `{name}` and `{namespace}` are the name and namespace of a Kubernetes\nService.\n\n\nThis contract is satisfied by Knative types such as Knative Services and\nKnative Routes, and by Kubernetes Services.", + description: "Ref specifies the target of the Domain Mapping.\n\nThe object identified by the Ref must be an Addressable with a URL of the\nform `{name}.{namespace}.{domain}` where `{domain}` is the cluster domain,\nand `{name}` and `{namespace}` are the name and namespace of a Kubernetes\nService.\n\nThis contract is satisfied by Knative types such as Knative Services and\nKnative Routes, and by Kubernetes Services.", properties: { address: { description: "Address points to a specific Address Name.", @@ -1740,14 +1786,14 @@ export const CustomResourceDefinition_DomainmappingsServingKnativeDev: Apiextens }] } }; -export const CustomResourceDefinition_IngressesNetworkingInternalKnativeDev: ApiextensionsK8sIoV1CustomResourceDefinition = { +export const CustomResourceDefinition_IngressesNetworkingInternalKnativeDev: KubernetesResource = { apiVersion: "apiextensions.k8s.io/v1", kind: "CustomResourceDefinition", metadata: { labels: { "app.kubernetes.io/component": "networking", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.15.0", + "app.kubernetes.io/version": "1.22.1", "knative.dev/crd-install": "true" }, name: "ingresses.networking.internal.knative.dev" @@ -1775,7 +1821,7 @@ export const CustomResourceDefinition_IngressesNetworkingInternalKnativeDev: Api name: "v1alpha1", schema: { openAPIV3Schema: { - description: "Ingress is a collection of rules that allow inbound connections to reach the endpoints defined\nby a backend. An Ingress can be configured to give services externally-reachable URLs, load\nbalance traffic, offer name based virtual hosting, etc.\n\n\nThis is heavily based on K8s Ingress https://godoc.org/k8s.io/api/networking/v1beta1#Ingress\nwhich some highlighted modifications.", + description: "Ingress is a collection of rules that allow inbound connections to reach the endpoints defined\nby a backend. An Ingress can be configured to give services externally-reachable URLs, load\nbalance traffic, offer name based virtual hosting, etc.\n\nThis is heavily based on K8s Ingress https://godoc.org/k8s.io/api/networking/v1beta1#Ingress\nwhich some highlighted modifications.", properties: { apiVersion: { description: "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", @@ -1811,7 +1857,7 @@ export const CustomResourceDefinition_IngressesNetworkingInternalKnativeDev: Api description: "HTTP represents a rule to apply against incoming requests. If the\nrule is satisfied, the request is routed to the specified backend.", properties: { paths: { - description: "A collection of paths that map requests to backends.\n\n\nIf they are multiple matching paths, the first match takes precedence.", + description: "A collection of paths that map requests to backends.\n\nIf they are multiple matching paths, the first match takes precedence.", items: { description: "HTTPIngressPath associates a path regex with a backend. Incoming URLs matching\nthe path are forwarded to the backend.", properties: { @@ -1819,7 +1865,7 @@ export const CustomResourceDefinition_IngressesNetworkingInternalKnativeDev: Api additionalProperties: { type: "string" }, - description: "AppendHeaders allow specifying additional HTTP headers to add\nbefore forwarding a request to the destination service.\n\n\nNOTE: This differs from K8s Ingress which doesn't allow header appending.", + description: "AppendHeaders allow specifying additional HTTP headers to add\nbefore forwarding a request to the destination service.\n\nNOTE: This differs from K8s Ingress which doesn't allow header appending.", type: "object" }, headers: { @@ -1841,7 +1887,7 @@ export const CustomResourceDefinition_IngressesNetworkingInternalKnativeDev: Api type: "string" }, rewriteHost: { - description: "RewriteHost rewrites the incoming request's host header.\n\n\nThis field is currently experimental and not supported by all Ingress\nimplementations.", + description: "RewriteHost rewrites the incoming request's host header.\n\nThis field is currently experimental and not supported by all Ingress\nimplementations.", type: "string" }, splits: { @@ -1853,11 +1899,11 @@ export const CustomResourceDefinition_IngressesNetworkingInternalKnativeDev: Api additionalProperties: { type: "string" }, - description: "AppendHeaders allow specifying additional HTTP headers to add\nbefore forwarding a request to the destination service.\n\n\nNOTE: This differs from K8s Ingress which doesn't allow header appending.", + description: "AppendHeaders allow specifying additional HTTP headers to add\nbefore forwarding a request to the destination service.\n\nNOTE: This differs from K8s Ingress which doesn't allow header appending.", type: "object" }, percent: { - description: "Specifies the split percentage, a number between 0 and 100. If\nonly one split is specified, we default to 100.\n\n\nNOTE: This differs from K8s Ingress to allow percentage split.", + description: "Specifies the split percentage, a number between 0 and 100. If\nonly one split is specified, we default to 100.\n\nNOTE: This differs from K8s Ingress to allow percentage split.", type: "integer" }, serviceName: { @@ -1865,7 +1911,7 @@ export const CustomResourceDefinition_IngressesNetworkingInternalKnativeDev: Api type: "string" }, serviceNamespace: { - description: "Specifies the namespace of the referenced service.\n\n\nNOTE: This differs from K8s Ingress to allow routing to different namespaces.", + description: "Specifies the namespace of the referenced service.\n\nNOTE: This differs from K8s Ingress to allow routing to different namespaces.", type: "string" }, servicePort: { @@ -1993,7 +2039,7 @@ export const CustomResourceDefinition_IngressesNetworkingInternalKnativeDev: Api type: "string" }, domainInternal: { - description: "DomainInternal is set if there is a cluster-local DNS name to access the Ingress.\n\n\nNOTE: This differs from K8s Ingress, since we also desire to have a cluster-local\n DNS name to allow routing in case of not having a mesh.", + description: "DomainInternal is set if there is a cluster-local DNS name to access the Ingress.\n\nNOTE: This differs from K8s Ingress, since we also desire to have a cluster-local\n DNS name to allow routing in case of not having a mesh.", type: "string" }, ip: { @@ -2025,7 +2071,7 @@ export const CustomResourceDefinition_IngressesNetworkingInternalKnativeDev: Api type: "string" }, domainInternal: { - description: "DomainInternal is set if there is a cluster-local DNS name to access the Ingress.\n\n\nNOTE: This differs from K8s Ingress, since we also desire to have a cluster-local\n DNS name to allow routing in case of not having a mesh.", + description: "DomainInternal is set if there is a cluster-local DNS name to access the Ingress.\n\nNOTE: This differs from K8s Ingress, since we also desire to have a cluster-local\n DNS name to allow routing in case of not having a mesh.", type: "string" }, ip: { @@ -2059,13 +2105,13 @@ export const CustomResourceDefinition_IngressesNetworkingInternalKnativeDev: Api }] } }; -export const CustomResourceDefinition_MetricsAutoscalingInternalKnativeDev: ApiextensionsK8sIoV1CustomResourceDefinition = { +export const CustomResourceDefinition_MetricsAutoscalingInternalKnativeDev: KubernetesResource = { apiVersion: "apiextensions.k8s.io/v1", kind: "CustomResourceDefinition", metadata: { labels: { "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.15.0", + "app.kubernetes.io/version": "1.22.1", "knative.dev/crd-install": "true" }, name: "metrics.autoscaling.internal.knative.dev" @@ -2191,13 +2237,13 @@ export const CustomResourceDefinition_MetricsAutoscalingInternalKnativeDev: Apie }] } }; -export const CustomResourceDefinition_PodautoscalersAutoscalingInternalKnativeDev: ApiextensionsK8sIoV1CustomResourceDefinition = { +export const CustomResourceDefinition_PodautoscalersAutoscalingInternalKnativeDev: KubernetesResource = { apiVersion: "apiextensions.k8s.io/v1", kind: "CustomResourceDefinition", metadata: { labels: { "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.15.0", + "app.kubernetes.io/version": "1.22.1", "knative.dev/crd-install": "true" }, name: "podautoscalers.autoscaling.internal.knative.dev" @@ -2369,13 +2415,13 @@ export const CustomResourceDefinition_PodautoscalersAutoscalingInternalKnativeDe }] } }; -export const CustomResourceDefinition_RevisionsServingKnativeDev: ApiextensionsK8sIoV1CustomResourceDefinition = { +export const CustomResourceDefinition_RevisionsServingKnativeDev: KubernetesResource = { apiVersion: "apiextensions.k8s.io/v1", kind: "CustomResourceDefinition", metadata: { labels: { "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.15.0", + "app.kubernetes.io/version": "1.22.1", "knative.dev/crd-install": "true" }, name: "revisions.serving.knative.dev" @@ -2419,7 +2465,7 @@ export const CustomResourceDefinition_RevisionsServingKnativeDev: ApiextensionsK name: "v1", schema: { openAPIV3Schema: { - description: "Revision is an immutable snapshot of code and configuration. A revision\nreferences a container image. Revisions are created by updates to a\nConfiguration.\n\n\nSee also: https://github.com/knative/serving/blob/main/docs/spec/overview.md#revision", + description: "Revision is an immutable snapshot of code and configuration. A revision\nreferences a container image. Revisions are created by updates to a\nConfiguration.\n\nSee also: https://github.com/knative/serving/blob/main/docs/spec/overview.md#revision", properties: { apiVersion: { description: "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", @@ -2459,14 +2505,16 @@ export const CustomResourceDefinition_RevisionsServingKnativeDev: ApiextensionsK items: { type: "string" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" }, command: { description: "Entrypoint array. Not executed within a shell.\nThe container image's ENTRYPOINT is used if this is not provided.\nVariable references $(VAR_NAME) are expanded using the container's environment. If a variable\ncannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced\nto a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. \"$$(VAR_NAME)\" will\nproduce the string literal \"$(VAR_NAME)\". Escaped references will never be expanded, regardless\nof whether the variable exists or not. Cannot be updated.\nMore info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell", items: { type: "string" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" }, env: { description: "List of environment variables to set in the container.\nCannot be updated.", @@ -2474,7 +2522,7 @@ export const CustomResourceDefinition_RevisionsServingKnativeDev: ApiextensionsK description: "EnvVar represents an environment variable present in a Container.", properties: { name: { - description: "Name of the environment variable. Must be a C_IDENTIFIER.", + description: "Name of the environment variable.\nMay consist of any printable ASCII characters except '='.", type: "string" }, value: { @@ -2492,7 +2540,8 @@ export const CustomResourceDefinition_RevisionsServingKnativeDev: ApiextensionsK type: "string" }, name: { - description: "Name of the referent.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names\nTODO: Add other useful fields. apiVersion, kind, uid?", + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", type: "string" }, optional: { @@ -2524,7 +2573,8 @@ export const CustomResourceDefinition_RevisionsServingKnativeDev: ApiextensionsK type: "string" }, name: { - description: "Name of the referent.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names\nTODO: Add other useful fields. apiVersion, kind, uid?", + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", type: "string" }, optional: { @@ -2543,18 +2593,21 @@ export const CustomResourceDefinition_RevisionsServingKnativeDev: ApiextensionsK required: ["name"], type: "object" }, - type: "array" + type: "array", + "x-kubernetes-list-map-keys": ["name"], + "x-kubernetes-list-type": "map" }, envFrom: { - description: "List of sources to populate environment variables in the container.\nThe keys defined within a source must be a C_IDENTIFIER. All invalid keys\nwill be reported as an event when the container is starting. When a key exists in multiple\nsources, the value associated with the last source will take precedence.\nValues defined by an Env with a duplicate key will take precedence.\nCannot be updated.", + description: "List of sources to populate environment variables in the container.\nThe keys defined within a source may consist of any printable ASCII characters except '='.\nWhen a key exists in multiple\nsources, the value associated with the last source will take precedence.\nValues defined by an Env with a duplicate key will take precedence.\nCannot be updated.", items: { - description: "EnvFromSource represents the source of a set of ConfigMaps", + description: "EnvFromSource represents the source of a set of ConfigMaps or Secrets", properties: { configMapRef: { description: "The ConfigMap to select from", properties: { name: { - description: "Name of the referent.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names\nTODO: Add other useful fields. apiVersion, kind, uid?", + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", type: "string" }, optional: { @@ -2566,14 +2619,15 @@ export const CustomResourceDefinition_RevisionsServingKnativeDev: ApiextensionsK "x-kubernetes-map-type": "atomic" }, prefix: { - description: "An optional identifier to prepend to each key in the ConfigMap. Must be a C_IDENTIFIER.", + description: "Optional text to prepend to the name of each environment variable.\nMay consist of any printable ASCII characters except '='.", type: "string" }, secretRef: { description: "The Secret to select from", properties: { name: { - description: "Name of the referent.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names\nTODO: Add other useful fields. apiVersion, kind, uid?", + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", type: "string" }, optional: { @@ -2587,7 +2641,8 @@ export const CustomResourceDefinition_RevisionsServingKnativeDev: ApiextensionsK }, type: "object" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" }, image: { description: "Container image name.\nMore info: https://kubernetes.io/docs/concepts/containers/images\nThis field is optional to allow higher level config management to default or override\ncontainer images in workload controllers like Deployments and StatefulSets.", @@ -2601,14 +2656,15 @@ export const CustomResourceDefinition_RevisionsServingKnativeDev: ApiextensionsK description: "Periodic probe of container liveness.\nContainer will be restarted if the probe fails.\nCannot be updated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", properties: { exec: { - description: "Exec specifies the action to take.", + description: "Exec specifies a command to execute in the container.", properties: { command: { description: "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", items: { type: "string" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" } }, type: "object" @@ -2619,7 +2675,7 @@ export const CustomResourceDefinition_RevisionsServingKnativeDev: ApiextensionsK type: "integer" }, grpc: { - description: "GRPC specifies an action involving a GRPC port.", + description: "GRPC specifies a GRPC HealthCheckRequest.", properties: { port: { description: "Port number of the gRPC service. Number must be in the range 1 to 65535.", @@ -2627,15 +2683,15 @@ export const CustomResourceDefinition_RevisionsServingKnativeDev: ApiextensionsK type: "integer" }, service: { - description: "Service is the name of the service to place in the gRPC HealthCheckRequest\n(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).\n\n\nIf this is not specified, the default behavior is defined by gRPC.", + default: "", + description: "Service is the name of the service to place in the gRPC HealthCheckRequest\n(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).\n\nIf this is not specified, the default behavior is defined by gRPC.", type: "string" } }, - required: ["port"], type: "object" }, httpGet: { - description: "HTTPGet specifies the http request to perform.", + description: "HTTPGet specifies an HTTP GET request to perform.", properties: { host: { description: "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", @@ -2658,7 +2714,8 @@ export const CustomResourceDefinition_RevisionsServingKnativeDev: ApiextensionsK required: ["name", "value"], type: "object" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" }, path: { description: "Path to access on the HTTP server.", @@ -2696,7 +2753,7 @@ export const CustomResourceDefinition_RevisionsServingKnativeDev: ApiextensionsK type: "integer" }, tcpSocket: { - description: "TCPSocket specifies an action involving a TCP port.", + description: "TCPSocket specifies a connection to a TCP port.", properties: { host: { description: "Optional: Host name to connect to, defaults to the pod IP.", @@ -2746,25 +2803,23 @@ export const CustomResourceDefinition_RevisionsServingKnativeDev: ApiextensionsK type: "string" } }, - required: ["containerPort"], type: "object" }, - type: "array", - "x-kubernetes-list-map-keys": ["containerPort", "protocol"], - "x-kubernetes-list-type": "map" + type: "array" }, readinessProbe: { description: "Periodic probe of container service readiness.\nContainer will be removed from service endpoints if the probe fails.\nCannot be updated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", properties: { exec: { - description: "Exec specifies the action to take.", + description: "Exec specifies a command to execute in the container.", properties: { command: { description: "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", items: { type: "string" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" } }, type: "object" @@ -2775,7 +2830,7 @@ export const CustomResourceDefinition_RevisionsServingKnativeDev: ApiextensionsK type: "integer" }, grpc: { - description: "GRPC specifies an action involving a GRPC port.", + description: "GRPC specifies a GRPC HealthCheckRequest.", properties: { port: { description: "Port number of the gRPC service. Number must be in the range 1 to 65535.", @@ -2783,15 +2838,15 @@ export const CustomResourceDefinition_RevisionsServingKnativeDev: ApiextensionsK type: "integer" }, service: { - description: "Service is the name of the service to place in the gRPC HealthCheckRequest\n(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).\n\n\nIf this is not specified, the default behavior is defined by gRPC.", + default: "", + description: "Service is the name of the service to place in the gRPC HealthCheckRequest\n(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).\n\nIf this is not specified, the default behavior is defined by gRPC.", type: "string" } }, - required: ["port"], type: "object" }, httpGet: { - description: "HTTPGet specifies the http request to perform.", + description: "HTTPGet specifies an HTTP GET request to perform.", properties: { host: { description: "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", @@ -2814,7 +2869,8 @@ export const CustomResourceDefinition_RevisionsServingKnativeDev: ApiextensionsK required: ["name", "value"], type: "object" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" }, path: { description: "Path to access on the HTTP server.", @@ -2852,7 +2908,7 @@ export const CustomResourceDefinition_RevisionsServingKnativeDev: ApiextensionsK type: "integer" }, tcpSocket: { - description: "TCPSocket specifies an action involving a TCP port.", + description: "TCPSocket specifies a connection to a TCP port.", properties: { host: { description: "Optional: Host name to connect to, defaults to the pod IP.", @@ -2881,23 +2937,6 @@ export const CustomResourceDefinition_RevisionsServingKnativeDev: ApiextensionsK resources: { description: "Compute Resources required by this container.\nCannot be updated.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", properties: { - claims: { - description: "Claims lists the names of resources, defined in spec.resourceClaims,\nthat are used by this container.\n\n\nThis is an alpha field and requires enabling the\nDynamicResourceAllocation feature gate.\n\n\nThis field is immutable. It can only be set for containers.", - items: { - description: "ResourceClaim references one entry in PodSpec.ResourceClaims.", - properties: { - name: { - description: "Name must match the name of one entry in pod.spec.resourceClaims of\nthe Pod where this field is used. It makes that resource available\ninside a container.", - type: "string" - } - }, - required: ["name"], - type: "object" - }, - type: "array", - "x-kubernetes-list-map-keys": ["name"], - "x-kubernetes-list-type": "map" - }, limits: { additionalProperties: { anyOf: [{ @@ -2943,7 +2982,8 @@ export const CustomResourceDefinition_RevisionsServingKnativeDev: ApiextensionsK description: "Capability represent POSIX capabilities type", type: "string" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" }, drop: { description: "Removed capabilities", @@ -2951,11 +2991,16 @@ export const CustomResourceDefinition_RevisionsServingKnativeDev: ApiextensionsK description: "Capability represent POSIX capabilities type", type: "string" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" } }, type: "object" }, + privileged: { + description: "Run container in privileged mode. This can only be set to explicitly to 'false'", + type: "boolean" + }, readOnlyRootFilesystem: { description: "Whether this container has a read-only root filesystem.\nDefault is false.\nNote that this field cannot be set when spec.os.name is windows.", type: "boolean" @@ -2982,7 +3027,7 @@ export const CustomResourceDefinition_RevisionsServingKnativeDev: ApiextensionsK type: "string" }, type: { - description: "type indicates which kind of seccomp profile will be applied.\nValid options are:\n\n\nLocalhost - a profile defined in a file on the node should be used.\nRuntimeDefault - the container runtime default profile should be used.\nUnconfined - no profile should be applied.", + description: "type indicates which kind of seccomp profile will be applied.\nValid options are:\n\nLocalhost - a profile defined in a file on the node should be used.\nRuntimeDefault - the container runtime default profile should be used.\nUnconfined - no profile should be applied.", type: "string" } }, @@ -2996,14 +3041,15 @@ export const CustomResourceDefinition_RevisionsServingKnativeDev: ApiextensionsK description: "StartupProbe indicates that the Pod has successfully initialized.\nIf specified, no other probes are executed until this completes successfully.\nIf this probe fails, the Pod will be restarted, just as if the livenessProbe failed.\nThis can be used to provide different probe parameters at the beginning of a Pod's lifecycle,\nwhen it might take a long time to load data or warm a cache, than during steady-state operation.\nThis cannot be updated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", properties: { exec: { - description: "Exec specifies the action to take.", + description: "Exec specifies a command to execute in the container.", properties: { command: { description: "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", items: { type: "string" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" } }, type: "object" @@ -3014,7 +3060,7 @@ export const CustomResourceDefinition_RevisionsServingKnativeDev: ApiextensionsK type: "integer" }, grpc: { - description: "GRPC specifies an action involving a GRPC port.", + description: "GRPC specifies a GRPC HealthCheckRequest.", properties: { port: { description: "Port number of the gRPC service. Number must be in the range 1 to 65535.", @@ -3022,15 +3068,15 @@ export const CustomResourceDefinition_RevisionsServingKnativeDev: ApiextensionsK type: "integer" }, service: { - description: "Service is the name of the service to place in the gRPC HealthCheckRequest\n(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).\n\n\nIf this is not specified, the default behavior is defined by gRPC.", + default: "", + description: "Service is the name of the service to place in the gRPC HealthCheckRequest\n(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).\n\nIf this is not specified, the default behavior is defined by gRPC.", type: "string" } }, - required: ["port"], type: "object" }, httpGet: { - description: "HTTPGet specifies the http request to perform.", + description: "HTTPGet specifies an HTTP GET request to perform.", properties: { host: { description: "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", @@ -3053,7 +3099,8 @@ export const CustomResourceDefinition_RevisionsServingKnativeDev: ApiextensionsK required: ["name", "value"], type: "object" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" }, path: { description: "Path to access on the HTTP server.", @@ -3091,7 +3138,7 @@ export const CustomResourceDefinition_RevisionsServingKnativeDev: ApiextensionsK type: "integer" }, tcpSocket: { - description: "TCPSocket specifies an action involving a TCP port.", + description: "TCPSocket specifies a connection to a TCP port.", properties: { host: { description: "Optional: Host name to connect to, defaults to the pod IP.", @@ -3134,6 +3181,10 @@ export const CustomResourceDefinition_RevisionsServingKnativeDev: ApiextensionsK description: "Path within the container at which the volume should be mounted. Must\nnot contain ':'.", type: "string" }, + mountPropagation: { + description: "This is accessible behind a feature flag - kubernetes.podspec-volumes-mount-propagation", + type: "string" + }, name: { description: "This must match the Name of a Volume.", type: "string" @@ -3150,7 +3201,9 @@ export const CustomResourceDefinition_RevisionsServingKnativeDev: ApiextensionsK required: ["mountPath", "name"], type: "object" }, - type: "array" + type: "array", + "x-kubernetes-list-map-keys": ["mountPath"], + "x-kubernetes-list-type": "map" }, workingDir: { description: "Container's working directory.\nIf not specified, the container runtime's default will be used, which\nmight be configured in the container image.\nCannot be updated.", @@ -3171,7 +3224,7 @@ export const CustomResourceDefinition_RevisionsServingKnativeDev: ApiextensionsK type: "string" }, enableServiceLinks: { - description: "EnableServiceLinks indicates whether information about services should be injected into pod's environment variables, matching the syntax of Docker links. Optional: Knative defaults this to false.", + description: "EnableServiceLinks indicates whether information aboutservices should be injected into pod's environment variables, matching the syntax of Docker links. Optional: Knative defaults this to false.", type: "boolean" }, hostAliases: { @@ -3183,6 +3236,18 @@ export const CustomResourceDefinition_RevisionsServingKnativeDev: ApiextensionsK }, type: "array" }, + hostIPC: { + description: "This is accessible behind a feature flag - kubernetes.podspec-hostipc", + type: "boolean" + }, + hostNetwork: { + description: "This is accessible behind a feature flag - kubernetes.podspec-hostnetwork", + type: "boolean" + }, + hostPID: { + description: "This is accessible behind a feature flag - kubernetes.podspec-hostpid", + type: "boolean" + }, idleTimeoutSeconds: { description: "IdleTimeoutSeconds is the maximum duration in seconds a request will be allowed\nto stay open while not receiving any bytes from the user's application. If\nunspecified, a system default will be provided.", format: "int64", @@ -3194,17 +3259,20 @@ export const CustomResourceDefinition_RevisionsServingKnativeDev: ApiextensionsK description: "LocalObjectReference contains enough information to let you locate the\nreferenced object inside the same namespace.", properties: { name: { - description: "Name of the referent.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names\nTODO: Add other useful fields. apiVersion, kind, uid?", + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", type: "string" } }, type: "object", "x-kubernetes-map-type": "atomic" }, - type: "array" + type: "array", + "x-kubernetes-list-map-keys": ["name"], + "x-kubernetes-list-type": "map" }, initContainers: { - description: "List of initialization containers belonging to the pod.\nInit containers are executed in order prior to containers being started. If any\ninit container fails, the pod is considered to have failed and is handled according\nto its restartPolicy. The name for an init container or normal container must be\nunique among all containers.\nInit containers may not have Lifecycle actions, Readiness probes, Liveness probes, or Startup probes.\nThe resourceRequirements of an init container are taken into account during scheduling\nby finding the highest request/limit for each resource type, and then using the max of\nof that value or the sum of the normal containers. Limits are applied to init containers\nin a similar fashion.\nInit containers cannot currently be added or removed.\nCannot be updated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/", + description: "This is accessible behind a feature flag - kubernetes.podspec-init-containers", items: { description: "This is accessible behind a feature flag - kubernetes.podspec-init-containers", type: "object", @@ -3213,15 +3281,16 @@ export const CustomResourceDefinition_RevisionsServingKnativeDev: ApiextensionsK type: "array" }, nodeSelector: { + additionalProperties: { + type: "string" + }, description: "This is accessible behind a feature flag - kubernetes.podspec-nodeselector", type: "object", - "x-kubernetes-map-type": "atomic", - "x-kubernetes-preserve-unknown-fields": true + "x-kubernetes-map-type": "atomic" }, priorityClassName: { description: "This is accessible behind a feature flag - kubernetes.podspec-priorityclassname", - type: "string", - "x-kubernetes-preserve-unknown-fields": true + type: "string" }, responseStartTimeoutSeconds: { description: "ResponseStartTimeoutSeconds is the maximum duration in seconds that the request\nrouting layer will wait for a request delivered to a container to begin\nsending any network traffic.", @@ -3230,13 +3299,11 @@ export const CustomResourceDefinition_RevisionsServingKnativeDev: ApiextensionsK }, runtimeClassName: { description: "This is accessible behind a feature flag - kubernetes.podspec-runtimeclassname", - type: "string", - "x-kubernetes-preserve-unknown-fields": true + type: "string" }, schedulerName: { description: "This is accessible behind a feature flag - kubernetes.podspec-schedulername", - type: "string", - "x-kubernetes-preserve-unknown-fields": true + type: "string" }, securityContext: { description: "This is accessible behind a feature flag - kubernetes.podspec-securitycontext", @@ -3248,9 +3315,8 @@ export const CustomResourceDefinition_RevisionsServingKnativeDev: ApiextensionsK type: "string" }, shareProcessNamespace: { - description: "This is accessible behind a feature flag - kubernetes.podspec-shareproccessnamespace", - type: "boolean", - "x-kubernetes-preserve-unknown-fields": true + description: "This is accessible behind a feature flag - kubernetes.podspec-shareprocessnamespace", + type: "boolean" }, timeoutSeconds: { description: "TimeoutSeconds is the maximum duration in seconds that the request instance\nis allowed to respond to a request. If unspecified, a system default will\nbe provided.", @@ -3310,10 +3376,12 @@ export const CustomResourceDefinition_RevisionsServingKnativeDev: ApiextensionsK required: ["key", "path"], type: "object" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" }, name: { - description: "Name of the referent.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names\nTODO: Add other useful fields. apiVersion, kind, uid?", + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", type: "string" }, optional: { @@ -3324,8 +3392,23 @@ export const CustomResourceDefinition_RevisionsServingKnativeDev: ApiextensionsK type: "object", "x-kubernetes-map-type": "atomic" }, + csi: { + description: "This is accessible behind a feature flag - kubernetes.podspec-volumes-csi", + type: "object", + "x-kubernetes-preserve-unknown-fields": true + }, emptyDir: { - description: "This is accessible behind a feature flag - kubernetes.podspec-emptydir", + description: "This is accessible behind a feature flag - kubernetes.podspec-volumes-emptydir", + type: "object", + "x-kubernetes-preserve-unknown-fields": true + }, + hostPath: { + description: "This is accessible behind a feature flag - kubernetes.podspec-volumes-hostpath", + type: "object", + "x-kubernetes-preserve-unknown-fields": true + }, + image: { + description: "This is accessible behind a feature flag - kubernetes.podspec-volumes-image", type: "object", "x-kubernetes-preserve-unknown-fields": true }, @@ -3347,9 +3430,9 @@ export const CustomResourceDefinition_RevisionsServingKnativeDev: ApiextensionsK type: "integer" }, sources: { - description: "sources is the list of volume projections", + description: "sources is the list of volume projections. Each entry in this list\nhandles one source.", items: { - description: "Projection that may be projected along with other supported volume types", + description: "Projection that may be projected along with other supported volume types.\nExactly one of these fields must be set.", properties: { configMap: { description: "configMap information about the configMap data to project", @@ -3376,10 +3459,12 @@ export const CustomResourceDefinition_RevisionsServingKnativeDev: ApiextensionsK required: ["key", "path"], type: "object" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" }, name: { - description: "Name of the referent.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names\nTODO: Add other useful fields. apiVersion, kind, uid?", + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", type: "string" }, optional: { @@ -3399,7 +3484,7 @@ export const CustomResourceDefinition_RevisionsServingKnativeDev: ApiextensionsK description: "DownwardAPIVolumeFile represents information to create the file containing the pod field", properties: { fieldRef: { - description: "Required: Selects a field of the pod: only annotations, labels, name and namespace are supported.", + description: "Required: Selects a field of the pod: only annotations, labels, name, namespace and uid are supported.", properties: { apiVersion: { description: "Version of the schema the FieldPath is written in terms of, defaults to \"v1\".", @@ -3453,7 +3538,8 @@ export const CustomResourceDefinition_RevisionsServingKnativeDev: ApiextensionsK required: ["path"], type: "object" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" } }, type: "object" @@ -3483,10 +3569,12 @@ export const CustomResourceDefinition_RevisionsServingKnativeDev: ApiextensionsK required: ["key", "path"], type: "object" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" }, name: { - description: "Name of the referent.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names\nTODO: Add other useful fields. apiVersion, kind, uid?", + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", type: "string" }, optional: { @@ -3520,7 +3608,8 @@ export const CustomResourceDefinition_RevisionsServingKnativeDev: ApiextensionsK }, type: "object" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" } }, type: "object" @@ -3555,7 +3644,8 @@ export const CustomResourceDefinition_RevisionsServingKnativeDev: ApiextensionsK required: ["key", "path"], type: "object" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" }, optional: { description: "optional field specify whether the Secret or its keys must be defined", @@ -3572,7 +3662,9 @@ export const CustomResourceDefinition_RevisionsServingKnativeDev: ApiextensionsK required: ["name"], type: "object" }, - type: "array" + type: "array", + "x-kubernetes-list-map-keys": ["name"], + "x-kubernetes-list-type": "map" } }, required: ["containers"], @@ -3629,7 +3721,7 @@ export const CustomResourceDefinition_RevisionsServingKnativeDev: ApiextensionsK type: "array" }, containerStatuses: { - description: "ContainerStatuses is a slice of images present in .Spec.Container[*].Image\nto their respective digests and their container name.\nThe digests are resolved during the creation of Revision.\nContainerStatuses holds the container name and image digests\nfor both serving and non serving containers.\nref: http://bit.ly/image-digests", + description: "ContainerStatuses is a slice of images present in .Spec.Container[*].Image\nto their respective digests and their container name.\nThe digests are resolved during the creation of Revision.\nContainerStatuses holds the container name and image digests\nfor both serving and non serving containers.\nref: https://bit.ly/image-digests", items: { description: "ContainerStatus holds the information of container name and image digest value", properties: { @@ -3650,7 +3742,7 @@ export const CustomResourceDefinition_RevisionsServingKnativeDev: ApiextensionsK type: "integer" }, initContainerStatuses: { - description: "InitContainerStatuses is a slice of images present in .Spec.InitContainer[*].Image\nto their respective digests and their container name.\nThe digests are resolved during the creation of Revision.\nContainerStatuses holds the container name and image digests\nfor both serving and non serving containers.\nref: http://bit.ly/image-digests", + description: "InitContainerStatuses is a slice of images present in .Spec.InitContainer[*].Image\nto their respective digests and their container name.\nThe digests are resolved during the creation of Revision.\nContainerStatuses holds the container name and image digests\nfor both serving and non serving containers.\nref: https://bit.ly/image-digests", items: { description: "ContainerStatus holds the information of container name and image digest value", properties: { @@ -3689,13 +3781,13 @@ export const CustomResourceDefinition_RevisionsServingKnativeDev: ApiextensionsK }] } }; -export const CustomResourceDefinition_RoutesServingKnativeDev: ApiextensionsK8sIoV1CustomResourceDefinition = { +export const CustomResourceDefinition_RoutesServingKnativeDev: KubernetesResource = { apiVersion: "apiextensions.k8s.io/v1", kind: "CustomResourceDefinition", metadata: { labels: { "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.15.0", + "app.kubernetes.io/version": "1.22.1", "duck.knative.dev/addressable": "true", "knative.dev/crd-install": "true" }, @@ -3907,14 +3999,14 @@ export const CustomResourceDefinition_RoutesServingKnativeDev: ApiextensionsK8sI }] } }; -export const CustomResourceDefinition_ServerlessservicesNetworkingInternalKnativeDev: ApiextensionsK8sIoV1CustomResourceDefinition = { +export const CustomResourceDefinition_ServerlessservicesNetworkingInternalKnativeDev: KubernetesResource = { apiVersion: "apiextensions.k8s.io/v1", kind: "CustomResourceDefinition", metadata: { labels: { "app.kubernetes.io/component": "networking", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.15.0", + "app.kubernetes.io/version": "1.22.1", "knative.dev/crd-install": "true" }, name: "serverlessservices.networking.internal.knative.dev" @@ -3991,7 +4083,7 @@ export const CustomResourceDefinition_ServerlessservicesNetworkingInternalKnativ type: "string" }, fieldPath: { - description: "If referring to a piece of an object instead of an entire object, this string\nshould contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2].\nFor example, if the object reference is to a container within a pod, this would take on a value like:\n\"spec.containers{name}\" (where \"name\" refers to the name of the container that triggered\nthe event) or if no container name is specified \"spec.containers[2]\" (container with\nindex 2 in this pod). This syntax is chosen only to have some well-defined way of\nreferencing a part of an object.\nTODO: this design is not final and this field is subject to change in the future.", + description: "If referring to a piece of an object instead of an entire object, this string\nshould contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2].\nFor example, if the object reference is to a container within a pod, this would take on a value like:\n\"spec.containers{name}\" (where \"name\" refers to the name of the container that triggered\nthe event) or if no container name is specified \"spec.containers[2]\" (container with\nindex 2 in this pod). This syntax is chosen only to have some well-defined way of\nreferencing a part of an object.", type: "string" }, kind: { @@ -4099,13 +4191,13 @@ export const CustomResourceDefinition_ServerlessservicesNetworkingInternalKnativ }] } }; -export const CustomResourceDefinition_ServicesServingKnativeDev: ApiextensionsK8sIoV1CustomResourceDefinition = { +export const CustomResourceDefinition_ServicesServingKnativeDev: KubernetesResource = { apiVersion: "apiextensions.k8s.io/v1", kind: "CustomResourceDefinition", metadata: { labels: { "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.15.0", + "app.kubernetes.io/version": "1.22.1", "duck.knative.dev/addressable": "true", "duck.knative.dev/podspecable": "true", "knative.dev/crd-install": "true" @@ -4147,7 +4239,7 @@ export const CustomResourceDefinition_ServicesServingKnativeDev: ApiextensionsK8 name: "v1", schema: { openAPIV3Schema: { - description: "Service acts as a top-level container that manages a Route and Configuration\nwhich implement a network service. Service exists to provide a singular\nabstraction which can be access controlled, reasoned about, and which\nencapsulates software lifecycle decisions such as rollout policy and\nteam resource ownership. Service acts only as an orchestrator of the\nunderlying Routes and Configurations (much as a kubernetes Deployment\norchestrates ReplicaSets), and its usage is optional but recommended.\n\n\nThe Service's controller will track the statuses of its owned Configuration\nand Route, reflecting their statuses and conditions as its own.\n\n\nSee also: https://github.com/knative/serving/blob/main/docs/spec/overview.md#service", + description: "Service acts as a top-level container that manages a Route and Configuration\nwhich implement a network service. Service exists to provide a singular\nabstraction which can be access controlled, reasoned about, and which\nencapsulates software lifecycle decisions such as rollout policy and\nteam resource ownership. Service acts only as an orchestrator of the\nunderlying Routes and Configurations (much as a kubernetes Deployment\norchestrates ReplicaSets), and its usage is optional but recommended.\n\nThe Service's controller will track the statuses of its owned Configuration\nand Route, reflecting their statuses and conditions as its own.\n\nSee also: https://github.com/knative/serving/blob/main/docs/spec/overview.md#service", properties: { apiVersion: { description: "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", @@ -4223,14 +4315,16 @@ export const CustomResourceDefinition_ServicesServingKnativeDev: ApiextensionsK8 items: { type: "string" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" }, command: { description: "Entrypoint array. Not executed within a shell.\nThe container image's ENTRYPOINT is used if this is not provided.\nVariable references $(VAR_NAME) are expanded using the container's environment. If a variable\ncannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced\nto a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. \"$$(VAR_NAME)\" will\nproduce the string literal \"$(VAR_NAME)\". Escaped references will never be expanded, regardless\nof whether the variable exists or not. Cannot be updated.\nMore info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell", items: { type: "string" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" }, env: { description: "List of environment variables to set in the container.\nCannot be updated.", @@ -4238,7 +4332,7 @@ export const CustomResourceDefinition_ServicesServingKnativeDev: ApiextensionsK8 description: "EnvVar represents an environment variable present in a Container.", properties: { name: { - description: "Name of the environment variable. Must be a C_IDENTIFIER.", + description: "Name of the environment variable.\nMay consist of any printable ASCII characters except '='.", type: "string" }, value: { @@ -4256,7 +4350,8 @@ export const CustomResourceDefinition_ServicesServingKnativeDev: ApiextensionsK8 type: "string" }, name: { - description: "Name of the referent.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names\nTODO: Add other useful fields. apiVersion, kind, uid?", + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", type: "string" }, optional: { @@ -4288,7 +4383,8 @@ export const CustomResourceDefinition_ServicesServingKnativeDev: ApiextensionsK8 type: "string" }, name: { - description: "Name of the referent.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names\nTODO: Add other useful fields. apiVersion, kind, uid?", + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", type: "string" }, optional: { @@ -4307,18 +4403,21 @@ export const CustomResourceDefinition_ServicesServingKnativeDev: ApiextensionsK8 required: ["name"], type: "object" }, - type: "array" + type: "array", + "x-kubernetes-list-map-keys": ["name"], + "x-kubernetes-list-type": "map" }, envFrom: { - description: "List of sources to populate environment variables in the container.\nThe keys defined within a source must be a C_IDENTIFIER. All invalid keys\nwill be reported as an event when the container is starting. When a key exists in multiple\nsources, the value associated with the last source will take precedence.\nValues defined by an Env with a duplicate key will take precedence.\nCannot be updated.", + description: "List of sources to populate environment variables in the container.\nThe keys defined within a source may consist of any printable ASCII characters except '='.\nWhen a key exists in multiple\nsources, the value associated with the last source will take precedence.\nValues defined by an Env with a duplicate key will take precedence.\nCannot be updated.", items: { - description: "EnvFromSource represents the source of a set of ConfigMaps", + description: "EnvFromSource represents the source of a set of ConfigMaps or Secrets", properties: { configMapRef: { description: "The ConfigMap to select from", properties: { name: { - description: "Name of the referent.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names\nTODO: Add other useful fields. apiVersion, kind, uid?", + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", type: "string" }, optional: { @@ -4330,14 +4429,15 @@ export const CustomResourceDefinition_ServicesServingKnativeDev: ApiextensionsK8 "x-kubernetes-map-type": "atomic" }, prefix: { - description: "An optional identifier to prepend to each key in the ConfigMap. Must be a C_IDENTIFIER.", + description: "Optional text to prepend to the name of each environment variable.\nMay consist of any printable ASCII characters except '='.", type: "string" }, secretRef: { description: "The Secret to select from", properties: { name: { - description: "Name of the referent.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names\nTODO: Add other useful fields. apiVersion, kind, uid?", + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", type: "string" }, optional: { @@ -4351,7 +4451,8 @@ export const CustomResourceDefinition_ServicesServingKnativeDev: ApiextensionsK8 }, type: "object" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" }, image: { description: "Container image name.\nMore info: https://kubernetes.io/docs/concepts/containers/images\nThis field is optional to allow higher level config management to default or override\ncontainer images in workload controllers like Deployments and StatefulSets.", @@ -4365,14 +4466,15 @@ export const CustomResourceDefinition_ServicesServingKnativeDev: ApiextensionsK8 description: "Periodic probe of container liveness.\nContainer will be restarted if the probe fails.\nCannot be updated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", properties: { exec: { - description: "Exec specifies the action to take.", + description: "Exec specifies a command to execute in the container.", properties: { command: { description: "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", items: { type: "string" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" } }, type: "object" @@ -4383,7 +4485,7 @@ export const CustomResourceDefinition_ServicesServingKnativeDev: ApiextensionsK8 type: "integer" }, grpc: { - description: "GRPC specifies an action involving a GRPC port.", + description: "GRPC specifies a GRPC HealthCheckRequest.", properties: { port: { description: "Port number of the gRPC service. Number must be in the range 1 to 65535.", @@ -4391,15 +4493,15 @@ export const CustomResourceDefinition_ServicesServingKnativeDev: ApiextensionsK8 type: "integer" }, service: { - description: "Service is the name of the service to place in the gRPC HealthCheckRequest\n(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).\n\n\nIf this is not specified, the default behavior is defined by gRPC.", + default: "", + description: "Service is the name of the service to place in the gRPC HealthCheckRequest\n(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).\n\nIf this is not specified, the default behavior is defined by gRPC.", type: "string" } }, - required: ["port"], type: "object" }, httpGet: { - description: "HTTPGet specifies the http request to perform.", + description: "HTTPGet specifies an HTTP GET request to perform.", properties: { host: { description: "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", @@ -4422,7 +4524,8 @@ export const CustomResourceDefinition_ServicesServingKnativeDev: ApiextensionsK8 required: ["name", "value"], type: "object" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" }, path: { description: "Path to access on the HTTP server.", @@ -4460,7 +4563,7 @@ export const CustomResourceDefinition_ServicesServingKnativeDev: ApiextensionsK8 type: "integer" }, tcpSocket: { - description: "TCPSocket specifies an action involving a TCP port.", + description: "TCPSocket specifies a connection to a TCP port.", properties: { host: { description: "Optional: Host name to connect to, defaults to the pod IP.", @@ -4510,25 +4613,23 @@ export const CustomResourceDefinition_ServicesServingKnativeDev: ApiextensionsK8 type: "string" } }, - required: ["containerPort"], type: "object" }, - type: "array", - "x-kubernetes-list-map-keys": ["containerPort", "protocol"], - "x-kubernetes-list-type": "map" + type: "array" }, readinessProbe: { description: "Periodic probe of container service readiness.\nContainer will be removed from service endpoints if the probe fails.\nCannot be updated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", properties: { exec: { - description: "Exec specifies the action to take.", + description: "Exec specifies a command to execute in the container.", properties: { command: { description: "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", items: { type: "string" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" } }, type: "object" @@ -4539,7 +4640,7 @@ export const CustomResourceDefinition_ServicesServingKnativeDev: ApiextensionsK8 type: "integer" }, grpc: { - description: "GRPC specifies an action involving a GRPC port.", + description: "GRPC specifies a GRPC HealthCheckRequest.", properties: { port: { description: "Port number of the gRPC service. Number must be in the range 1 to 65535.", @@ -4547,15 +4648,15 @@ export const CustomResourceDefinition_ServicesServingKnativeDev: ApiextensionsK8 type: "integer" }, service: { - description: "Service is the name of the service to place in the gRPC HealthCheckRequest\n(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).\n\n\nIf this is not specified, the default behavior is defined by gRPC.", + default: "", + description: "Service is the name of the service to place in the gRPC HealthCheckRequest\n(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).\n\nIf this is not specified, the default behavior is defined by gRPC.", type: "string" } }, - required: ["port"], type: "object" }, httpGet: { - description: "HTTPGet specifies the http request to perform.", + description: "HTTPGet specifies an HTTP GET request to perform.", properties: { host: { description: "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", @@ -4578,7 +4679,8 @@ export const CustomResourceDefinition_ServicesServingKnativeDev: ApiextensionsK8 required: ["name", "value"], type: "object" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" }, path: { description: "Path to access on the HTTP server.", @@ -4616,7 +4718,7 @@ export const CustomResourceDefinition_ServicesServingKnativeDev: ApiextensionsK8 type: "integer" }, tcpSocket: { - description: "TCPSocket specifies an action involving a TCP port.", + description: "TCPSocket specifies a connection to a TCP port.", properties: { host: { description: "Optional: Host name to connect to, defaults to the pod IP.", @@ -4645,23 +4747,6 @@ export const CustomResourceDefinition_ServicesServingKnativeDev: ApiextensionsK8 resources: { description: "Compute Resources required by this container.\nCannot be updated.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", properties: { - claims: { - description: "Claims lists the names of resources, defined in spec.resourceClaims,\nthat are used by this container.\n\n\nThis is an alpha field and requires enabling the\nDynamicResourceAllocation feature gate.\n\n\nThis field is immutable. It can only be set for containers.", - items: { - description: "ResourceClaim references one entry in PodSpec.ResourceClaims.", - properties: { - name: { - description: "Name must match the name of one entry in pod.spec.resourceClaims of\nthe Pod where this field is used. It makes that resource available\ninside a container.", - type: "string" - } - }, - required: ["name"], - type: "object" - }, - type: "array", - "x-kubernetes-list-map-keys": ["name"], - "x-kubernetes-list-type": "map" - }, limits: { additionalProperties: { anyOf: [{ @@ -4707,7 +4792,8 @@ export const CustomResourceDefinition_ServicesServingKnativeDev: ApiextensionsK8 description: "Capability represent POSIX capabilities type", type: "string" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" }, drop: { description: "Removed capabilities", @@ -4715,11 +4801,16 @@ export const CustomResourceDefinition_ServicesServingKnativeDev: ApiextensionsK8 description: "Capability represent POSIX capabilities type", type: "string" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" } }, type: "object" }, + privileged: { + description: "Run container in privileged mode. This can only be set to explicitly to 'false'", + type: "boolean" + }, readOnlyRootFilesystem: { description: "Whether this container has a read-only root filesystem.\nDefault is false.\nNote that this field cannot be set when spec.os.name is windows.", type: "boolean" @@ -4746,7 +4837,7 @@ export const CustomResourceDefinition_ServicesServingKnativeDev: ApiextensionsK8 type: "string" }, type: { - description: "type indicates which kind of seccomp profile will be applied.\nValid options are:\n\n\nLocalhost - a profile defined in a file on the node should be used.\nRuntimeDefault - the container runtime default profile should be used.\nUnconfined - no profile should be applied.", + description: "type indicates which kind of seccomp profile will be applied.\nValid options are:\n\nLocalhost - a profile defined in a file on the node should be used.\nRuntimeDefault - the container runtime default profile should be used.\nUnconfined - no profile should be applied.", type: "string" } }, @@ -4760,14 +4851,15 @@ export const CustomResourceDefinition_ServicesServingKnativeDev: ApiextensionsK8 description: "StartupProbe indicates that the Pod has successfully initialized.\nIf specified, no other probes are executed until this completes successfully.\nIf this probe fails, the Pod will be restarted, just as if the livenessProbe failed.\nThis can be used to provide different probe parameters at the beginning of a Pod's lifecycle,\nwhen it might take a long time to load data or warm a cache, than during steady-state operation.\nThis cannot be updated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", properties: { exec: { - description: "Exec specifies the action to take.", + description: "Exec specifies a command to execute in the container.", properties: { command: { description: "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", items: { type: "string" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" } }, type: "object" @@ -4778,7 +4870,7 @@ export const CustomResourceDefinition_ServicesServingKnativeDev: ApiextensionsK8 type: "integer" }, grpc: { - description: "GRPC specifies an action involving a GRPC port.", + description: "GRPC specifies a GRPC HealthCheckRequest.", properties: { port: { description: "Port number of the gRPC service. Number must be in the range 1 to 65535.", @@ -4786,15 +4878,15 @@ export const CustomResourceDefinition_ServicesServingKnativeDev: ApiextensionsK8 type: "integer" }, service: { - description: "Service is the name of the service to place in the gRPC HealthCheckRequest\n(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).\n\n\nIf this is not specified, the default behavior is defined by gRPC.", + default: "", + description: "Service is the name of the service to place in the gRPC HealthCheckRequest\n(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).\n\nIf this is not specified, the default behavior is defined by gRPC.", type: "string" } }, - required: ["port"], type: "object" }, httpGet: { - description: "HTTPGet specifies the http request to perform.", + description: "HTTPGet specifies an HTTP GET request to perform.", properties: { host: { description: "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", @@ -4817,7 +4909,8 @@ export const CustomResourceDefinition_ServicesServingKnativeDev: ApiextensionsK8 required: ["name", "value"], type: "object" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" }, path: { description: "Path to access on the HTTP server.", @@ -4855,7 +4948,7 @@ export const CustomResourceDefinition_ServicesServingKnativeDev: ApiextensionsK8 type: "integer" }, tcpSocket: { - description: "TCPSocket specifies an action involving a TCP port.", + description: "TCPSocket specifies a connection to a TCP port.", properties: { host: { description: "Optional: Host name to connect to, defaults to the pod IP.", @@ -4898,6 +4991,10 @@ export const CustomResourceDefinition_ServicesServingKnativeDev: ApiextensionsK8 description: "Path within the container at which the volume should be mounted. Must\nnot contain ':'.", type: "string" }, + mountPropagation: { + description: "This is accessible behind a feature flag - kubernetes.podspec-volumes-mount-propagation", + type: "string" + }, name: { description: "This must match the Name of a Volume.", type: "string" @@ -4914,7 +5011,9 @@ export const CustomResourceDefinition_ServicesServingKnativeDev: ApiextensionsK8 required: ["mountPath", "name"], type: "object" }, - type: "array" + type: "array", + "x-kubernetes-list-map-keys": ["mountPath"], + "x-kubernetes-list-type": "map" }, workingDir: { description: "Container's working directory.\nIf not specified, the container runtime's default will be used, which\nmight be configured in the container image.\nCannot be updated.", @@ -4935,7 +5034,7 @@ export const CustomResourceDefinition_ServicesServingKnativeDev: ApiextensionsK8 type: "string" }, enableServiceLinks: { - description: "EnableServiceLinks indicates whether information about services should be injected into pod's environment variables, matching the syntax of Docker links. Optional: Knative defaults this to false.", + description: "EnableServiceLinks indicates whether information aboutservices should be injected into pod's environment variables, matching the syntax of Docker links. Optional: Knative defaults this to false.", type: "boolean" }, hostAliases: { @@ -4947,6 +5046,18 @@ export const CustomResourceDefinition_ServicesServingKnativeDev: ApiextensionsK8 }, type: "array" }, + hostIPC: { + description: "This is accessible behind a feature flag - kubernetes.podspec-hostipc", + type: "boolean" + }, + hostNetwork: { + description: "This is accessible behind a feature flag - kubernetes.podspec-hostnetwork", + type: "boolean" + }, + hostPID: { + description: "This is accessible behind a feature flag - kubernetes.podspec-hostpid", + type: "boolean" + }, idleTimeoutSeconds: { description: "IdleTimeoutSeconds is the maximum duration in seconds a request will be allowed\nto stay open while not receiving any bytes from the user's application. If\nunspecified, a system default will be provided.", format: "int64", @@ -4958,17 +5069,20 @@ export const CustomResourceDefinition_ServicesServingKnativeDev: ApiextensionsK8 description: "LocalObjectReference contains enough information to let you locate the\nreferenced object inside the same namespace.", properties: { name: { - description: "Name of the referent.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names\nTODO: Add other useful fields. apiVersion, kind, uid?", + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", type: "string" } }, type: "object", "x-kubernetes-map-type": "atomic" }, - type: "array" + type: "array", + "x-kubernetes-list-map-keys": ["name"], + "x-kubernetes-list-type": "map" }, initContainers: { - description: "List of initialization containers belonging to the pod.\nInit containers are executed in order prior to containers being started. If any\ninit container fails, the pod is considered to have failed and is handled according\nto its restartPolicy. The name for an init container or normal container must be\nunique among all containers.\nInit containers may not have Lifecycle actions, Readiness probes, Liveness probes, or Startup probes.\nThe resourceRequirements of an init container are taken into account during scheduling\nby finding the highest request/limit for each resource type, and then using the max of\nof that value or the sum of the normal containers. Limits are applied to init containers\nin a similar fashion.\nInit containers cannot currently be added or removed.\nCannot be updated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/", + description: "This is accessible behind a feature flag - kubernetes.podspec-init-containers", items: { description: "This is accessible behind a feature flag - kubernetes.podspec-init-containers", type: "object", @@ -4977,15 +5091,16 @@ export const CustomResourceDefinition_ServicesServingKnativeDev: ApiextensionsK8 type: "array" }, nodeSelector: { + additionalProperties: { + type: "string" + }, description: "This is accessible behind a feature flag - kubernetes.podspec-nodeselector", type: "object", - "x-kubernetes-map-type": "atomic", - "x-kubernetes-preserve-unknown-fields": true + "x-kubernetes-map-type": "atomic" }, priorityClassName: { description: "This is accessible behind a feature flag - kubernetes.podspec-priorityclassname", - type: "string", - "x-kubernetes-preserve-unknown-fields": true + type: "string" }, responseStartTimeoutSeconds: { description: "ResponseStartTimeoutSeconds is the maximum duration in seconds that the request\nrouting layer will wait for a request delivered to a container to begin\nsending any network traffic.", @@ -4994,13 +5109,11 @@ export const CustomResourceDefinition_ServicesServingKnativeDev: ApiextensionsK8 }, runtimeClassName: { description: "This is accessible behind a feature flag - kubernetes.podspec-runtimeclassname", - type: "string", - "x-kubernetes-preserve-unknown-fields": true + type: "string" }, schedulerName: { description: "This is accessible behind a feature flag - kubernetes.podspec-schedulername", - type: "string", - "x-kubernetes-preserve-unknown-fields": true + type: "string" }, securityContext: { description: "This is accessible behind a feature flag - kubernetes.podspec-securitycontext", @@ -5012,9 +5125,8 @@ export const CustomResourceDefinition_ServicesServingKnativeDev: ApiextensionsK8 type: "string" }, shareProcessNamespace: { - description: "This is accessible behind a feature flag - kubernetes.podspec-shareproccessnamespace", - type: "boolean", - "x-kubernetes-preserve-unknown-fields": true + description: "This is accessible behind a feature flag - kubernetes.podspec-shareprocessnamespace", + type: "boolean" }, timeoutSeconds: { description: "TimeoutSeconds is the maximum duration in seconds that the request instance\nis allowed to respond to a request. If unspecified, a system default will\nbe provided.", @@ -5074,10 +5186,12 @@ export const CustomResourceDefinition_ServicesServingKnativeDev: ApiextensionsK8 required: ["key", "path"], type: "object" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" }, name: { - description: "Name of the referent.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names\nTODO: Add other useful fields. apiVersion, kind, uid?", + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", type: "string" }, optional: { @@ -5088,8 +5202,23 @@ export const CustomResourceDefinition_ServicesServingKnativeDev: ApiextensionsK8 type: "object", "x-kubernetes-map-type": "atomic" }, + csi: { + description: "This is accessible behind a feature flag - kubernetes.podspec-volumes-csi", + type: "object", + "x-kubernetes-preserve-unknown-fields": true + }, emptyDir: { - description: "This is accessible behind a feature flag - kubernetes.podspec-emptydir", + description: "This is accessible behind a feature flag - kubernetes.podspec-volumes-emptydir", + type: "object", + "x-kubernetes-preserve-unknown-fields": true + }, + hostPath: { + description: "This is accessible behind a feature flag - kubernetes.podspec-volumes-hostpath", + type: "object", + "x-kubernetes-preserve-unknown-fields": true + }, + image: { + description: "This is accessible behind a feature flag - kubernetes.podspec-volumes-image", type: "object", "x-kubernetes-preserve-unknown-fields": true }, @@ -5111,9 +5240,9 @@ export const CustomResourceDefinition_ServicesServingKnativeDev: ApiextensionsK8 type: "integer" }, sources: { - description: "sources is the list of volume projections", + description: "sources is the list of volume projections. Each entry in this list\nhandles one source.", items: { - description: "Projection that may be projected along with other supported volume types", + description: "Projection that may be projected along with other supported volume types.\nExactly one of these fields must be set.", properties: { configMap: { description: "configMap information about the configMap data to project", @@ -5140,10 +5269,12 @@ export const CustomResourceDefinition_ServicesServingKnativeDev: ApiextensionsK8 required: ["key", "path"], type: "object" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" }, name: { - description: "Name of the referent.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names\nTODO: Add other useful fields. apiVersion, kind, uid?", + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", type: "string" }, optional: { @@ -5163,7 +5294,7 @@ export const CustomResourceDefinition_ServicesServingKnativeDev: ApiextensionsK8 description: "DownwardAPIVolumeFile represents information to create the file containing the pod field", properties: { fieldRef: { - description: "Required: Selects a field of the pod: only annotations, labels, name and namespace are supported.", + description: "Required: Selects a field of the pod: only annotations, labels, name, namespace and uid are supported.", properties: { apiVersion: { description: "Version of the schema the FieldPath is written in terms of, defaults to \"v1\".", @@ -5217,7 +5348,8 @@ export const CustomResourceDefinition_ServicesServingKnativeDev: ApiextensionsK8 required: ["path"], type: "object" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" } }, type: "object" @@ -5247,10 +5379,12 @@ export const CustomResourceDefinition_ServicesServingKnativeDev: ApiextensionsK8 required: ["key", "path"], type: "object" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" }, name: { - description: "Name of the referent.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names\nTODO: Add other useful fields. apiVersion, kind, uid?", + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", type: "string" }, optional: { @@ -5284,7 +5418,8 @@ export const CustomResourceDefinition_ServicesServingKnativeDev: ApiextensionsK8 }, type: "object" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" } }, type: "object" @@ -5319,7 +5454,8 @@ export const CustomResourceDefinition_ServicesServingKnativeDev: ApiextensionsK8 required: ["key", "path"], type: "object" }, - type: "array" + type: "array", + "x-kubernetes-list-type": "atomic" }, optional: { description: "optional field specify whether the Secret or its keys must be defined", @@ -5336,7 +5472,9 @@ export const CustomResourceDefinition_ServicesServingKnativeDev: ApiextensionsK8 required: ["name"], type: "object" }, - type: "array" + type: "array", + "x-kubernetes-list-map-keys": ["name"], + "x-kubernetes-list-type": "map" } }, required: ["containers"], @@ -5516,13 +5654,13 @@ export const CustomResourceDefinition_ServicesServingKnativeDev: ApiextensionsK8 }] } }; -export const CustomResourceDefinition_ImagesCachingInternalKnativeDev: ApiextensionsK8sIoV1CustomResourceDefinition = { +export const CustomResourceDefinition_ImagesCachingInternalKnativeDev: KubernetesResource = { apiVersion: "apiextensions.k8s.io/v1", kind: "CustomResourceDefinition", metadata: { labels: { "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.15.0", + "app.kubernetes.io/version": "1.22.1", "knative.dev/crd-install": "true" }, name: "images.caching.internal.knative.dev" @@ -5571,7 +5709,8 @@ export const CustomResourceDefinition_ImagesCachingInternalKnativeDev: Apiextens description: "LocalObjectReference contains enough information to let you locate the\nreferenced object inside the same namespace.", properties: { name: { - description: "Name of the referent.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names\nTODO: Add other useful fields. apiVersion, kind, uid?", + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", type: "string" } }, @@ -5653,24 +5792,24 @@ export const CustomResourceDefinition_ImagesCachingInternalKnativeDev: Apiextens }] } }; -export const Namespace_KnativeServing: Namespace = { +export const Namespace_KnativeServing: KubernetesResource = { apiVersion: "v1", kind: "Namespace", metadata: { labels: { "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.15.0" + "app.kubernetes.io/version": "1.22.1" }, name: "knative-serving" } }; -export const Role_KnativeServingActivator: RbacAuthorizationK8sIoV1Role = { +export const Role_KnativeServingActivator: KubernetesResource = { apiVersion: "rbac.authorization.k8s.io/v1", kind: "Role", metadata: { labels: { "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.15.0", + "app.kubernetes.io/version": "1.22.1", "serving.knative.dev/controller": "true" }, name: "knative-serving-activator", @@ -5687,13 +5826,13 @@ export const Role_KnativeServingActivator: RbacAuthorizationK8sIoV1Role = { verbs: ["get", "list", "watch"] }] }; -export const ClusterRole_KnativeServingActivatorCluster: RbacAuthorizationK8sIoV1ClusterRole = { +export const ClusterRole_KnativeServingActivatorCluster: KubernetesResource = { apiVersion: "rbac.authorization.k8s.io/v1", kind: "ClusterRole", metadata: { labels: { "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.15.0", + "app.kubernetes.io/version": "1.22.1", "serving.knative.dev/controller": "true" }, name: "knative-serving-activator-cluster" @@ -5708,13 +5847,13 @@ export const ClusterRole_KnativeServingActivatorCluster: RbacAuthorizationK8sIoV verbs: ["get", "list", "watch"] }] }; -export const ClusterRole_KnativeServingAggregatedAddressableResolver: RbacAuthorizationK8sIoV1ClusterRole = { +export const ClusterRole_KnativeServingAggregatedAddressableResolver: KubernetesResource = { apiVersion: "rbac.authorization.k8s.io/v1", kind: "ClusterRole", metadata: { labels: { "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.15.0" + "app.kubernetes.io/version": "1.22.1" }, name: "knative-serving-aggregated-addressable-resolver" }, @@ -5726,13 +5865,13 @@ export const ClusterRole_KnativeServingAggregatedAddressableResolver: RbacAuthor }] } }; -export const ClusterRole_KnativeServingAddressableResolver: RbacAuthorizationK8sIoV1ClusterRole = { +export const ClusterRole_KnativeServingAddressableResolver: KubernetesResource = { apiVersion: "rbac.authorization.k8s.io/v1", kind: "ClusterRole", metadata: { labels: { "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.15.0", + "app.kubernetes.io/version": "1.22.1", "duck.knative.dev/addressable": "true" }, name: "knative-serving-addressable-resolver" @@ -5743,13 +5882,13 @@ export const ClusterRole_KnativeServingAddressableResolver: RbacAuthorizationK8s verbs: ["get", "list", "watch"] }] }; -export const ClusterRole_KnativeServingNamespacedAdmin: RbacAuthorizationK8sIoV1ClusterRole = { +export const ClusterRole_KnativeServingNamespacedAdmin: KubernetesResource = { apiVersion: "rbac.authorization.k8s.io/v1", kind: "ClusterRole", metadata: { labels: { "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.15.0", + "app.kubernetes.io/version": "1.22.1", "rbac.authorization.k8s.io/aggregate-to-admin": "true" }, name: "knative-serving-namespaced-admin" @@ -5764,13 +5903,13 @@ export const ClusterRole_KnativeServingNamespacedAdmin: RbacAuthorizationK8sIoV1 verbs: ["get", "list", "watch"] }] }; -export const ClusterRole_KnativeServingNamespacedEdit: RbacAuthorizationK8sIoV1ClusterRole = { +export const ClusterRole_KnativeServingNamespacedEdit: KubernetesResource = { apiVersion: "rbac.authorization.k8s.io/v1", kind: "ClusterRole", metadata: { labels: { "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.15.0", + "app.kubernetes.io/version": "1.22.1", "rbac.authorization.k8s.io/aggregate-to-edit": "true" }, name: "knative-serving-namespaced-edit" @@ -5785,13 +5924,13 @@ export const ClusterRole_KnativeServingNamespacedEdit: RbacAuthorizationK8sIoV1C verbs: ["get", "list", "watch"] }] }; -export const ClusterRole_KnativeServingNamespacedView: RbacAuthorizationK8sIoV1ClusterRole = { +export const ClusterRole_KnativeServingNamespacedView: KubernetesResource = { apiVersion: "rbac.authorization.k8s.io/v1", kind: "ClusterRole", metadata: { labels: { "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.15.0", + "app.kubernetes.io/version": "1.22.1", "rbac.authorization.k8s.io/aggregate-to-view": "true" }, name: "knative-serving-namespaced-view" @@ -5802,13 +5941,13 @@ export const ClusterRole_KnativeServingNamespacedView: RbacAuthorizationK8sIoV1C verbs: ["get", "list", "watch"] }] }; -export const ClusterRole_KnativeServingCore: RbacAuthorizationK8sIoV1ClusterRole = { +export const ClusterRole_KnativeServingCore: KubernetesResource = { apiVersion: "rbac.authorization.k8s.io/v1", kind: "ClusterRole", metadata: { labels: { "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.15.0", + "app.kubernetes.io/version": "1.22.1", "serving.knative.dev/controller": "true" }, name: "knative-serving-core" @@ -5821,10 +5960,18 @@ export const ClusterRole_KnativeServingCore: RbacAuthorizationK8sIoV1ClusterRole apiGroups: [""], resources: ["endpoints/restricted"], verbs: ["create"] + }, { + apiGroups: ["discovery.k8s.io"], + resources: ["endpointslices/restricted"], + verbs: ["create"] }, { apiGroups: [""], resources: ["namespaces/finalizers"], verbs: ["update"] + }, { + apiGroups: ["discovery.k8s.io"], + resources: ["endpointslices"], + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] }, { apiGroups: ["apps"], resources: ["deployments", "deployments/finalizers"], @@ -5866,15 +6013,19 @@ export const ClusterRole_KnativeServingCore: RbacAuthorizationK8sIoV1ClusterRole resourceNames: ["knative-serving-certmanager"], resources: ["clusterroles"], verbs: ["delete"] + }, { + apiGroups: ["*"], + resources: ["*/scale"], + verbs: ["patch"] }] }; -export const ClusterRole_KnativeServingPodspecableBinding: RbacAuthorizationK8sIoV1ClusterRole = { +export const ClusterRole_KnativeServingPodspecableBinding: KubernetesResource = { apiVersion: "rbac.authorization.k8s.io/v1", kind: "ClusterRole", metadata: { labels: { "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.15.0", + "app.kubernetes.io/version": "1.22.1", "duck.knative.dev/podspecable": "true" }, name: "knative-serving-podspecable-binding" @@ -5885,26 +6036,26 @@ export const ClusterRole_KnativeServingPodspecableBinding: RbacAuthorizationK8sI verbs: ["list", "watch", "patch"] }] }; -export const ServiceAccount_Controller: ServiceAccount = { +export const ServiceAccount_Controller: KubernetesResource = { apiVersion: "v1", kind: "ServiceAccount", metadata: { labels: { "app.kubernetes.io/component": "controller", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.15.0" + "app.kubernetes.io/version": "1.22.1" }, name: "controller", namespace: "knative-serving" } }; -export const ClusterRole_KnativeServingAdmin: RbacAuthorizationK8sIoV1ClusterRole = { +export const ClusterRole_KnativeServingAdmin: KubernetesResource = { apiVersion: "rbac.authorization.k8s.io/v1", kind: "ClusterRole", metadata: { labels: { "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.15.0" + "app.kubernetes.io/version": "1.22.1" }, name: "knative-serving-admin" }, @@ -5916,14 +6067,14 @@ export const ClusterRole_KnativeServingAdmin: RbacAuthorizationK8sIoV1ClusterRol }] } }; -export const ClusterRoleBinding_KnativeServingControllerAdmin: RbacAuthorizationK8sIoV1ClusterRoleBinding = { +export const ClusterRoleBinding_KnativeServingControllerAdmin: KubernetesResource = { apiVersion: "rbac.authorization.k8s.io/v1", kind: "ClusterRoleBinding", metadata: { labels: { "app.kubernetes.io/component": "controller", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.15.0" + "app.kubernetes.io/version": "1.22.1" }, name: "knative-serving-controller-admin" }, @@ -5938,14 +6089,14 @@ export const ClusterRoleBinding_KnativeServingControllerAdmin: RbacAuthorization namespace: "knative-serving" }] }; -export const ClusterRoleBinding_KnativeServingControllerAddressableResolver: RbacAuthorizationK8sIoV1ClusterRoleBinding = { +export const ClusterRoleBinding_KnativeServingControllerAddressableResolver: KubernetesResource = { apiVersion: "rbac.authorization.k8s.io/v1", kind: "ClusterRoleBinding", metadata: { labels: { "app.kubernetes.io/component": "controller", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.15.0" + "app.kubernetes.io/version": "1.22.1" }, name: "knative-serving-controller-addressable-resolver" }, @@ -5960,27 +6111,27 @@ export const ClusterRoleBinding_KnativeServingControllerAddressableResolver: Rba namespace: "knative-serving" }] }; -export const ServiceAccount_Activator: ServiceAccount = { +export const ServiceAccount_Activator: KubernetesResource = { apiVersion: "v1", kind: "ServiceAccount", metadata: { labels: { "app.kubernetes.io/component": "activator", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.15.0" + "app.kubernetes.io/version": "1.22.1" }, name: "activator", namespace: "knative-serving" } }; -export const RoleBinding_KnativeServingActivator: RbacAuthorizationK8sIoV1RoleBinding = { +export const RoleBinding_KnativeServingActivator: KubernetesResource = { apiVersion: "rbac.authorization.k8s.io/v1", kind: "RoleBinding", metadata: { labels: { "app.kubernetes.io/component": "activator", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.15.0" + "app.kubernetes.io/version": "1.22.1" }, name: "knative-serving-activator", namespace: "knative-serving" @@ -5996,14 +6147,14 @@ export const RoleBinding_KnativeServingActivator: RbacAuthorizationK8sIoV1RoleBi namespace: "knative-serving" }] }; -export const ClusterRoleBinding_KnativeServingActivatorCluster: RbacAuthorizationK8sIoV1ClusterRoleBinding = { +export const ClusterRoleBinding_KnativeServingActivatorCluster: KubernetesResource = { apiVersion: "rbac.authorization.k8s.io/v1", kind: "ClusterRoleBinding", metadata: { labels: { "app.kubernetes.io/component": "activator", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.15.0" + "app.kubernetes.io/version": "1.22.1" }, name: "knative-serving-activator-cluster" }, @@ -6018,7 +6169,7 @@ export const ClusterRoleBinding_KnativeServingActivatorCluster: RbacAuthorizatio namespace: "knative-serving" }] }; -export const Certificate_RoutingServingCerts: NetworkingInternalKnativeDevV1alpha1Certificate = { +export const Certificate_RoutingServingCerts: KubernetesResource = { apiVersion: "networking.internal.knative.dev/v1alpha1", kind: "Certificate", metadata: { @@ -6036,42 +6187,42 @@ export const Certificate_RoutingServingCerts: NetworkingInternalKnativeDevV1alph secretName: "routing-serving-certs" } }; -export const Image_QueueProxy: CachingInternalKnativeDevV1alpha1Image = { +export const Image_QueueProxy: KubernetesResource = { apiVersion: "caching.internal.knative.dev/v1alpha1", kind: "Image", metadata: { labels: { "app.kubernetes.io/component": "queue-proxy", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.15.0" + "app.kubernetes.io/version": "1.22.1" }, name: "queue-proxy", namespace: "knative-serving" }, spec: { - image: "gcr.io/knative-releases/knative.dev/serving/cmd/queue@sha256:d313c823f25a09326a7c3c2ec9833c5e005791bc3acb4036ebf33735cbb62bee" + image: "gcr.io/knative-releases/knative.dev/serving/cmd/queue@sha256:b1af8bda6c1d32b1cf5fbf8f1f6068c5007a5cebf091039fdea83b88b1fd87f4" } }; -export const ConfigMap_ConfigAutoscaler: ConfigMap = { +export const ConfigMap_ConfigAutoscaler: KubernetesResource = { apiVersion: "v1", kind: "ConfigMap", metadata: { annotations: { - "knative.dev/example-checksum": "47c2487f" + "knative.dev/example-checksum": "c727b3e8" }, labels: { "app.kubernetes.io/component": "autoscaler", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.15.0" + "app.kubernetes.io/version": "1.22.1" }, name: "config-autoscaler", namespace: "knative-serving" }, data: { - _example: "################################\n# #\n# EXAMPLE CONFIGURATION #\n# #\n################################\n\n# This block is not actually functional configuration,\n# but serves to illustrate the available configuration\n# options and document them in a way that is accessible\n# to users that `kubectl edit` this config map.\n#\n# These sample configuration options may be copied out of\n# this example block and unindented to be in the data block\n# to actually change the configuration.\n\n# The Revision ContainerConcurrency field specifies the maximum number\n# of requests the Container can handle at once. Container concurrency\n# target percentage is how much of that maximum to use in a stable\n# state. E.g. if a Revision specifies ContainerConcurrency of 10, then\n# the Autoscaler will try to maintain 7 concurrent connections per pod\n# on average.\n# Note: this limit will be applied to container concurrency set at every\n# level (ConfigMap, Revision Spec or Annotation).\n# For legacy and backwards compatibility reasons, this value also accepts\n# fractional values in (0, 1] interval (i.e. 0.7 ⇒ 70%).\n# Thus minimal percentage value must be greater than 1.0, or it will be\n# treated as a fraction.\n# NOTE: that this value does not affect actual number of concurrent requests\n# the user container may receive, but only the average number of requests\n# that the revision pods will receive.\ncontainer-concurrency-target-percentage: \"70\"\n\n# The container concurrency target default is what the Autoscaler will\n# try to maintain when concurrency is used as the scaling metric for the\n# Revision and the Revision specifies unlimited concurrency.\n# When revision explicitly specifies container concurrency, that value\n# will be used as a scaling target for autoscaler.\n# When specifying unlimited concurrency, the autoscaler will\n# horizontally scale the application based on this target concurrency.\n# This is what we call \"soft limit\" in the documentation, i.e. it only\n# affects number of pods and does not affect the number of requests\n# individual pod processes.\n# The value must be a positive number such that the value multiplied\n# by container-concurrency-target-percentage is greater than 0.01.\n# NOTE: that this value will be adjusted by application of\n# container-concurrency-target-percentage, i.e. by default\n# the system will target on average 70 concurrent requests\n# per revision pod.\n# NOTE: Only one metric can be used for autoscaling a Revision.\ncontainer-concurrency-target-default: \"100\"\n\n# The requests per second (RPS) target default is what the Autoscaler will\n# try to maintain when RPS is used as the scaling metric for a Revision and\n# the Revision specifies unlimited RPS. Even when specifying unlimited RPS,\n# the autoscaler will horizontally scale the application based on this\n# target RPS.\n# Must be greater than 1.0.\n# NOTE: Only one metric can be used for autoscaling a Revision.\nrequests-per-second-target-default: \"200\"\n\n# The target burst capacity specifies the size of burst in concurrent\n# requests that the system operator expects the system will receive.\n# Autoscaler will try to protect the system from queueing by introducing\n# Activator in the request path if the current spare capacity of the\n# service is less than this setting.\n# If this setting is 0, then Activator will be in the request path only\n# when the revision is scaled to 0.\n# If this setting is > 0 and container-concurrency-target-percentage is\n# 100% or 1.0, then activator will always be in the request path.\n# -1 denotes unlimited target-burst-capacity and activator will always\n# be in the request path.\n# Other negative values are invalid.\ntarget-burst-capacity: \"211\"\n\n# When operating in a stable mode, the autoscaler operates on the\n# average concurrency over the stable window.\n# Stable window must be in whole seconds.\nstable-window: \"60s\"\n\n# When observed average concurrency during the panic window reaches\n# panic-threshold-percentage the target concurrency, the autoscaler\n# enters panic mode. When operating in panic mode, the autoscaler\n# scales on the average concurrency over the panic window which is\n# panic-window-percentage of the stable-window.\n# Must be in the [1, 100] range.\n# When computing the panic window it will be rounded to the closest\n# whole second, at least 1s.\npanic-window-percentage: \"10.0\"\n\n# The percentage of the container concurrency target at which to\n# enter panic mode when reached within the panic window.\npanic-threshold-percentage: \"200.0\"\n\n# Max scale up rate limits the rate at which the autoscaler will\n# increase pod count. It is the maximum ratio of desired pods versus\n# observed pods.\n# Cannot be less or equal to 1.\n# I.e with value of 2.0 the number of pods can at most go N to 2N\n# over single Autoscaler period (2s), but at least N to\n# N+1, if Autoscaler needs to scale up.\nmax-scale-up-rate: \"1000.0\"\n\n# Max scale down rate limits the rate at which the autoscaler will\n# decrease pod count. It is the maximum ratio of observed pods versus\n# desired pods.\n# Cannot be less or equal to 1.\n# I.e. with value of 2.0 the number of pods can at most go N to N/2\n# over single Autoscaler evaluation period (2s), but at\n# least N to N-1, if Autoscaler needs to scale down.\nmax-scale-down-rate: \"2.0\"\n\n# Scale to zero feature flag.\nenable-scale-to-zero: \"true\"\n\n# Scale to zero grace period is the time an inactive revision is left\n# running before it is scaled to zero (must be positive, but recommended\n# at least a few seconds if running with mesh networking).\n# This is the upper limit and is provided not to enforce timeout after\n# the revision stopped receiving requests for stable window, but to\n# ensure network reprogramming to put activator in the path has completed.\n# If the system determines that a shorter period is satisfactory,\n# then the system will only wait that amount of time before scaling to 0.\n# NOTE: this period might actually be 0, if activator has been\n# in the request path sufficiently long.\n# If there is necessity for the last pod to linger longer use\n# scale-to-zero-pod-retention-period flag.\nscale-to-zero-grace-period: \"30s\"\n\n# Scale to zero pod retention period defines the minimum amount\n# of time the last pod will remain after Autoscaler has decided to\n# scale to zero.\n# This flag is for the situations where the pod startup is very expensive\n# and the traffic is bursty (requiring smaller windows for fast action),\n# but patchy.\n# The larger of this flag and `scale-to-zero-grace-period` will effectively\n# determine how the last pod will hang around.\nscale-to-zero-pod-retention-period: \"0s\"\n\n# pod-autoscaler-class specifies the default pod autoscaler class\n# that should be used if none is specified. If omitted,\n# the Knative Pod Autoscaler (KPA) is used by default.\npod-autoscaler-class: \"kpa.autoscaling.knative.dev\"\n\n# The capacity of a single activator task.\n# The `unit` is one concurrent request proxied by the activator.\n# activator-capacity must be at least 1.\n# This value is used for computation of the Activator subset size.\n# See the algorithm here: http://bit.ly/38XiCZ3.\n# TODO(vagababov): tune after actual benchmarking.\nactivator-capacity: \"100.0\"\n\n# initial-scale is the cluster-wide default value for the initial target\n# scale of a revision after creation, unless overridden by the\n# \"autoscaling.knative.dev/initialScale\" annotation.\n# This value must be greater than 0 unless allow-zero-initial-scale is true.\ninitial-scale: \"1\"\n\n# allow-zero-initial-scale controls whether either the cluster-wide initial-scale flag,\n# or the \"autoscaling.knative.dev/initialScale\" annotation, can be set to 0.\nallow-zero-initial-scale: \"false\"\n\n# min-scale is the cluster-wide default value for the min scale of a revision,\n# unless overridden by the \"autoscaling.knative.dev/minScale\" annotation.\nmin-scale: \"0\"\n\n# max-scale is the cluster-wide default value for the max scale of a revision,\n# unless overridden by the \"autoscaling.knative.dev/maxScale\" annotation.\n# If set to 0, the revision has no maximum scale.\nmax-scale: \"0\"\n\n# scale-down-delay is the amount of time that must pass at reduced\n# concurrency before a scale down decision is applied. This can be useful,\n# for example, to maintain replica count and avoid a cold start penalty if\n# more requests come in within the scale down delay period.\n# The default, 0s, imposes no delay at all.\nscale-down-delay: \"0s\"\n\n# max-scale-limit sets the maximum permitted value for the max scale of a revision.\n# When this is set to a positive value, a revision with a maxScale above that value\n# (including a maxScale of \"0\" = unlimited) is disallowed.\n# A value of zero (the default) allows any limit, including unlimited.\nmax-scale-limit: \"0\"\n" + _example: "################################\n# #\n# EXAMPLE CONFIGURATION #\n# #\n################################\n\n# This block is not actually functional configuration,\n# but serves to illustrate the available configuration\n# options and document them in a way that is accessible\n# to users that `kubectl edit` this config map.\n#\n# These sample configuration options may be copied out of\n# this example block and unindented to be in the data block\n# to actually change the configuration.\n\n# The Revision ContainerConcurrency field specifies the maximum number\n# of requests the Container can handle at once. Container concurrency\n# target percentage is how much of that maximum to use in a stable\n# state. E.g. if a Revision specifies ContainerConcurrency of 10, then\n# the Autoscaler will try to maintain 7 concurrent connections per pod\n# on average.\n# Note: this limit will be applied to container concurrency set at every\n# level (ConfigMap, Revision Spec or Annotation).\n# For legacy and backwards compatibility reasons, this value also accepts\n# fractional values in (0, 1] interval (i.e. 0.7 ⇒ 70%).\n# Thus minimal percentage value must be greater than 1.0, or it will be\n# treated as a fraction.\n# NOTE: that this value does not affect actual number of concurrent requests\n# the user container may receive, but only the average number of requests\n# that the revision pods will receive.\ncontainer-concurrency-target-percentage: \"70\"\n\n# The container concurrency target default is what the Autoscaler will\n# try to maintain when concurrency is used as the scaling metric for the\n# Revision and the Revision specifies unlimited concurrency.\n# When revision explicitly specifies container concurrency, that value\n# will be used as a scaling target for autoscaler.\n# When specifying unlimited concurrency, the autoscaler will\n# horizontally scale the application based on this target concurrency.\n# This is what we call \"soft limit\" in the documentation, i.e. it only\n# affects number of pods and does not affect the number of requests\n# individual pod processes.\n# The value must be a positive number such that the value multiplied\n# by container-concurrency-target-percentage is greater than 0.01.\n# NOTE: that this value will be adjusted by application of\n# container-concurrency-target-percentage, i.e. by default\n# the system will target on average 70 concurrent requests\n# per revision pod.\n# NOTE: Only one metric can be used for autoscaling a Revision.\ncontainer-concurrency-target-default: \"100\"\n\n# The requests per second (RPS) target default is what the Autoscaler will\n# try to maintain when RPS is used as the scaling metric for a Revision and\n# the Revision specifies unlimited RPS. Even when specifying unlimited RPS,\n# the autoscaler will horizontally scale the application based on this\n# target RPS.\n# Must be greater than 1.0.\n# NOTE: Only one metric can be used for autoscaling a Revision.\nrequests-per-second-target-default: \"200\"\n\n# The target burst capacity specifies the size of burst in concurrent\n# requests that the system operator expects the system will receive.\n# Autoscaler will try to protect the system from queueing by introducing\n# Activator in the request path if the current spare capacity of the\n# service is less than this setting.\n# If this setting is 0, then Activator will be in the request path only\n# when the revision is scaled to 0.\n# If this setting is > 0 and container-concurrency-target-percentage is\n# 100% or 1.0, then activator will always be in the request path.\n# -1 denotes unlimited target-burst-capacity and activator will always\n# be in the request path.\n# Other negative values are invalid.\ntarget-burst-capacity: \"211\"\n\n# When operating in a stable mode, the autoscaler operates on the\n# average concurrency over the stable window.\n# Stable window must be in whole seconds.\nstable-window: \"60s\"\n\n# When observed average concurrency during the panic window reaches\n# panic-threshold-percentage the target concurrency, the autoscaler\n# enters panic mode. When operating in panic mode, the autoscaler\n# scales on the average concurrency over the panic window which is\n# panic-window-percentage of the stable-window.\n# Must be in the [1, 100] range.\n# When computing the panic window it will be rounded to the closest\n# whole second, at least 1s.\npanic-window-percentage: \"10.0\"\n\n# The percentage of the container concurrency target at which to\n# enter panic mode when reached within the panic window.\npanic-threshold-percentage: \"200.0\"\n\n# Max scale up rate limits the rate at which the autoscaler will\n# increase pod count. It is the maximum ratio of desired pods versus\n# observed pods.\n# Cannot be less or equal to 1.\n# I.e with value of 2.0 the number of pods can at most go N to 2N\n# over single Autoscaler period (2s), but at least N to\n# N+1, if Autoscaler needs to scale up.\nmax-scale-up-rate: \"1000.0\"\n\n# Max scale down rate limits the rate at which the autoscaler will\n# decrease pod count. It is the maximum ratio of observed pods versus\n# desired pods.\n# Cannot be less or equal to 1.\n# I.e. with value of 2.0 the number of pods can at most go N to N/2\n# over single Autoscaler evaluation period (2s), but at\n# least N to N-1, if Autoscaler needs to scale down.\nmax-scale-down-rate: \"2.0\"\n\n# Scale to zero feature flag.\nenable-scale-to-zero: \"true\"\n\n# Scale to zero grace period is the time an inactive revision is left\n# running before it is scaled to zero (must be positive, but recommended\n# at least a few seconds if running with mesh networking).\n# This is the upper limit and is provided not to enforce timeout after\n# the revision stopped receiving requests for stable window, but to\n# ensure network reprogramming to put activator in the path has completed.\n# If the system determines that a shorter period is satisfactory,\n# then the system will only wait that amount of time before scaling to 0.\n# NOTE: this period might actually be 0, if activator has been\n# in the request path sufficiently long.\n# If there is necessity for the last pod to linger longer use\n# scale-to-zero-pod-retention-period flag.\nscale-to-zero-grace-period: \"30s\"\n\n# Scale to zero pod retention period defines the minimum amount\n# of time the last pod will remain after Autoscaler has decided to\n# scale to zero.\n# This flag is for the situations where the pod startup is very expensive\n# and the traffic is bursty (requiring smaller windows for fast action),\n# but patchy.\n# The larger of this flag and `scale-to-zero-grace-period` will effectively\n# determine how the last pod will hang around.\nscale-to-zero-pod-retention-period: \"0s\"\n\n# pod-autoscaler-class specifies the default pod autoscaler class\n# that should be used if none is specified. If omitted,\n# the Knative Pod Autoscaler (KPA) is used by default.\npod-autoscaler-class: \"kpa.autoscaling.knative.dev\"\n\n# The capacity of a single activator task.\n# The `unit` is one concurrent request proxied by the activator.\n# activator-capacity must be at least 1.\n# This value is used for computation of the Activator subset size.\n# See the algorithm here: https://bit.ly/38XiCZ3.\n# TODO(vagababov): tune after actual benchmarking.\nactivator-capacity: \"100.0\"\n\n# initial-scale is the cluster-wide default value for the initial target\n# scale of a revision after creation, unless overridden by the\n# \"autoscaling.knative.dev/initialScale\" annotation.\n# This value must be greater than 0 unless allow-zero-initial-scale is true.\ninitial-scale: \"1\"\n\n# allow-zero-initial-scale controls whether either the cluster-wide initial-scale flag,\n# or the \"autoscaling.knative.dev/initialScale\" annotation, can be set to 0.\nallow-zero-initial-scale: \"false\"\n\n# min-scale is the cluster-wide default value for the min scale of a revision,\n# unless overridden by the \"autoscaling.knative.dev/minScale\" annotation.\nmin-scale: \"0\"\n\n# max-scale is the cluster-wide default value for the max scale of a revision,\n# unless overridden by the \"autoscaling.knative.dev/maxScale\" annotation.\n# If set to 0, the revision has no maximum scale.\nmax-scale: \"0\"\n\n# scale-down-delay is the amount of time that must pass at reduced\n# concurrency before a scale down decision is applied. This can be useful,\n# for example, to maintain replica count and avoid a cold start penalty if\n# more requests come in within the scale down delay period.\n# The default, 0s, imposes no delay at all.\nscale-down-delay: \"0s\"\n\n# max-scale-limit sets the maximum permitted value for the max scale of a revision.\n# When this is set to a positive value, a revision with a maxScale above that value\n# (including a maxScale of \"0\" = unlimited) is disallowed.\n# A value of zero (the default) allows any limit, including unlimited.\nmax-scale-limit: \"0\"\n" } }; -export const ConfigMap_ConfigCertmanager: ConfigMap = { +export const ConfigMap_ConfigCertmanager: KubernetesResource = { apiVersion: "v1", kind: "ConfigMap", metadata: { @@ -6081,7 +6232,7 @@ export const ConfigMap_ConfigCertmanager: ConfigMap = { labels: { "app.kubernetes.io/component": "controller", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.15.0", + "app.kubernetes.io/version": "1.22.1", "networking.knative.dev/certificate-provider": "cert-manager" }, name: "config-certmanager", @@ -6091,7 +6242,7 @@ export const ConfigMap_ConfigCertmanager: ConfigMap = { _example: "################################\n# #\n# EXAMPLE CONFIGURATION #\n# #\n################################\n\n# This block is not actually functional configuration,\n# but serves to illustrate the available configuration\n# options and document them in a way that is accessible\n# to users that `kubectl edit` this config map.\n#\n# These sample configuration options may be copied out of\n# this block and unindented to actually change the configuration.\n\n# issuerRef is a reference to the issuer for external-domain certificates used for ingress.\n# IssuerRef should be either `ClusterIssuer` or `Issuer`.\n# Please refer `IssuerRef` in https://cert-manager.io/docs/concepts/issuer/\n# for more details about IssuerRef configuration.\n# If the issuerRef is not specified, the self-signed `knative-selfsigned-issuer` ClusterIssuer is used.\nissuerRef: |\n kind: ClusterIssuer\n name: letsencrypt-issuer\n\n# clusterLocalIssuerRef is a reference to the issuer for cluster-local-domain certificates used for ingress.\n# clusterLocalIssuerRef should be either `ClusterIssuer` or `Issuer`.\n# Please refer `IssuerRef` in https://cert-manager.io/docs/concepts/issuer/\n# for more details about ClusterInternalIssuerRef configuration.\n# If the clusterLocalIssuerRef is not specified, the self-signed `knative-selfsigned-issuer` ClusterIssuer is used.\nclusterLocalIssuerRef: |\n kind: ClusterIssuer\n name: your-company-issuer\n\n# systemInternalIssuerRef is a reference to the issuer for certificates for system-internal-tls certificates used by Knative internal components.\n# systemInternalIssuerRef should be either `ClusterIssuer` or `Issuer`.\n# Please refer `IssuerRef` in https://cert-manager.io/docs/concepts/issuer/\n# for more details about ClusterInternalIssuerRef configuration.\n# If the systemInternalIssuerRef is not specified, the self-signed `knative-selfsigned-issuer` ClusterIssuer is used.\nsystemInternalIssuerRef: |\n kind: ClusterIssuer\n name: knative-selfsigned-issuer\n" } }; -export const ConfigMap_ConfigDefaults: ConfigMap = { +export const ConfigMap_ConfigDefaults: KubernetesResource = { apiVersion: "v1", kind: "ConfigMap", metadata: { @@ -6101,7 +6252,7 @@ export const ConfigMap_ConfigDefaults: ConfigMap = { labels: { "app.kubernetes.io/component": "controller", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.15.0" + "app.kubernetes.io/version": "1.22.1" }, name: "config-defaults", namespace: "knative-serving" @@ -6110,27 +6261,27 @@ export const ConfigMap_ConfigDefaults: ConfigMap = { _example: "################################\n# #\n# EXAMPLE CONFIGURATION #\n# #\n################################\n\n# This block is not actually functional configuration,\n# but serves to illustrate the available configuration\n# options and document them in a way that is accessible\n# to users that `kubectl edit` this config map.\n#\n# These sample configuration options may be copied out of\n# this example block and unindented to be in the data block\n# to actually change the configuration.\n\n# revision-timeout-seconds contains the default number of\n# seconds to use for the revision's per-request timeout, if\n# none is specified.\nrevision-timeout-seconds: \"300\" # 5 minutes\n\n# max-revision-timeout-seconds contains the maximum number of\n# seconds that can be used for revision-timeout-seconds.\n# This value must be greater than or equal to revision-timeout-seconds.\n# If omitted, the system default is used (600 seconds).\n#\n# If this value is increased, the activator's terminationGracePeriodSeconds\n# should also be increased to prevent in-flight requests being disrupted.\nmax-revision-timeout-seconds: \"600\" # 10 minutes\n\n# revision-response-start-timeout-seconds contains the default number of\n# seconds a request will be allowed to stay open while waiting to\n# receive any bytes from the user's application, if none is specified.\n#\n# This defaults to 'revision-timeout-seconds'\nrevision-response-start-timeout-seconds: \"300\"\n\n# revision-idle-timeout-seconds contains the default number of\n# seconds a request will be allowed to stay open while not receiving any\n# bytes from the user's application, if none is specified.\nrevision-idle-timeout-seconds: \"0\" # infinite\n\n# revision-cpu-request contains the cpu allocation to assign\n# to revisions by default. If omitted, no value is specified\n# and the system default is used.\n# Below is an example of setting revision-cpu-request.\n# By default, it is not set by Knative.\nrevision-cpu-request: \"400m\" # 0.4 of a CPU (aka 400 milli-CPU)\n\n# revision-memory-request contains the memory allocation to assign\n# to revisions by default. If omitted, no value is specified\n# and the system default is used.\n# Below is an example of setting revision-memory-request.\n# By default, it is not set by Knative.\nrevision-memory-request: \"100M\" # 100 megabytes of memory\n\n# revision-ephemeral-storage-request contains the ephemeral storage\n# allocation to assign to revisions by default. If omitted, no value is\n# specified and the system default is used.\nrevision-ephemeral-storage-request: \"500M\" # 500 megabytes of storage\n\n# revision-cpu-limit contains the cpu allocation to limit\n# revisions to by default. If omitted, no value is specified\n# and the system default is used.\n# Below is an example of setting revision-cpu-limit.\n# By default, it is not set by Knative.\nrevision-cpu-limit: \"1000m\" # 1 CPU (aka 1000 milli-CPU)\n\n# revision-memory-limit contains the memory allocation to limit\n# revisions to by default. If omitted, no value is specified\n# and the system default is used.\n# Below is an example of setting revision-memory-limit.\n# By default, it is not set by Knative.\nrevision-memory-limit: \"200M\" # 200 megabytes of memory\n\n# revision-ephemeral-storage-limit contains the ephemeral storage\n# allocation to limit revisions to by default. If omitted, no value is\n# specified and the system default is used.\nrevision-ephemeral-storage-limit: \"750M\" # 750 megabytes of storage\n\n# container-name-template contains a template for the default\n# container name, if none is specified. This field supports\n# Go templating and is supplied with the ObjectMeta of the\n# enclosing Service or Configuration, so values such as\n# {{.Name}} are also valid.\ncontainer-name-template: \"user-container\"\n\n# init-container-name-template contains a template for the default\n# init container name, if none is specified. This field supports\n# Go templating and is supplied with the ObjectMeta of the\n# enclosing Service or Configuration, so values such as\n# {{.Name}} are also valid.\ninit-container-name-template: \"init-container\"\n\n# container-concurrency specifies the maximum number\n# of requests the Container can handle at once, and requests\n# above this threshold are queued. Setting a value of zero\n# disables this throttling and lets through as many requests as\n# the pod receives.\ncontainer-concurrency: \"0\"\n\n# The container concurrency max limit is an operator setting ensuring that\n# the individual revisions cannot have arbitrary large concurrency\n# values, or autoscaling targets. `container-concurrency` default setting\n# must be at or below this value.\n#\n# Must be greater than 1.\n#\n# Note: even with this set, a user can choose a containerConcurrency\n# of 0 (i.e. unbounded) unless allow-container-concurrency-zero is\n# set to \"false\".\ncontainer-concurrency-max-limit: \"1000\"\n\n# allow-container-concurrency-zero controls whether users can\n# specify 0 (i.e. unbounded) for containerConcurrency.\nallow-container-concurrency-zero: \"true\"\n\n# enable-service-links specifies the default value used for the\n# enableServiceLinks field of the PodSpec, when it is omitted by the user.\n# See: https://kubernetes.io/docs/concepts/services-networking/connect-applications-service/#accessing-the-service\n#\n# This is a tri-state flag with possible values of (true|false|default).\n#\n# In environments with large number of services it is suggested\n# to set this value to `false`.\n# See https://github.com/knative/serving/issues/8498.\nenable-service-links: \"false\"\n" } }; -export const ConfigMap_ConfigDeployment: ConfigMap = { +export const ConfigMap_ConfigDeployment: KubernetesResource = { apiVersion: "v1", kind: "ConfigMap", metadata: { annotations: { - "knative.dev/example-checksum": "720ddb97" + "knative.dev/example-checksum": "555b4826" }, labels: { "app.kubernetes.io/component": "controller", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.15.0" + "app.kubernetes.io/version": "1.22.1" }, name: "config-deployment", namespace: "knative-serving" }, data: { - _example: "################################\n# #\n# EXAMPLE CONFIGURATION #\n# #\n################################\n\n# This block is not actually functional configuration,\n# but serves to illustrate the available configuration\n# options and document them in a way that is accessible\n# to users that `kubectl edit` this config map.\n#\n# These sample configuration options may be copied out of\n# this example block and unindented to be in the data block\n# to actually change the configuration.\n\n# List of repositories for which tag to digest resolving should be skipped\nregistries-skipping-tag-resolving: \"kind.local,ko.local,dev.local\"\n\n# Maximum time allowed for an image's digests to be resolved.\ndigest-resolution-timeout: \"10s\"\n\n# Duration we wait for the deployment to be ready before considering it failed.\nprogress-deadline: \"600s\"\n\n# Sets the queue proxy's CPU request.\n# If omitted, a default value (currently \"25m\"), is used.\nqueue-sidecar-cpu-request: \"25m\"\n\n# Sets the queue proxy's CPU limit.\n# If omitted, a default value (currently \"1000m\"), is used when\n# `queueproxy.resource-defaults` is set to `Enabled`.\nqueue-sidecar-cpu-limit: \"1000m\"\n\n# Sets the queue proxy's memory request.\n# If omitted, a default value (currently \"400Mi\"), is used when\n# `queueproxy.resource-defaults` is set to `Enabled`.\nqueue-sidecar-memory-request: \"400Mi\"\n\n# Sets the queue proxy's memory limit.\n# If omitted, a default value (currently \"800Mi\"), is used when\n# `queueproxy.resource-defaults` is set to `Enabled`.\nqueue-sidecar-memory-limit: \"800Mi\"\n\n# Sets the queue proxy's ephemeral storage request.\n# If omitted, no value is specified and the system default is used.\nqueue-sidecar-ephemeral-storage-request: \"512Mi\"\n\n# Sets the queue proxy's ephemeral storage limit.\n# If omitted, no value is specified and the system default is used.\nqueue-sidecar-ephemeral-storage-limit: \"1024Mi\"\n\n# Sets tokens associated with specific audiences for queue proxy - used by QPOptions\n#\n# For example, to add the `service-x` audience:\n# queue-sidecar-token-audiences: \"service-x\"\n# Also supports a list of audiences, for example:\n# queue-sidecar-token-audiences: \"service-x,service-y\"\n# If omitted, or empty, no tokens are created\nqueue-sidecar-token-audiences: \"\"\n\n# Sets rootCA for the queue proxy - used by QPOptions\n# If omitted, or empty, no rootCA is added to the golang rootCAs\nqueue-sidecar-rootca: \"\"\n\n# If set, it automatically configures pod anti-affinity requirements for all Knative services.\n# It employs the `preferredDuringSchedulingIgnoredDuringExecution` weighted pod affinity term,\n# aligning with the Knative revision label. It yields the configuration below in all workloads' deployments:\n# `\n# affinity:\n# podAntiAffinity:\n# preferredDuringSchedulingIgnoredDuringExecution:\n# - podAffinityTerm:\n# topologyKey: kubernetes.io/hostname\n# labelSelector:\n# matchLabels:\n# serving.knative.dev/revision: {{revision-name}}\n# weight: 100\n# `\n# This may be \"none\" or \"prefer-spread-revision-over-nodes\" (default)\n# default-affinity-type: \"prefer-spread-revision-over-nodes\"\n\n# runtime-class-name contains the selector for which runtimeClassName\n# is selected to put in a revision.\n# By default, it is not set by Knative.\n#\n# Example:\n# runtime-class-name: |\n# \"\":\n# selector:\n# use-default-runc: \"yes\"\n# kata: {}\n# gvisor:\n# selector:\n# use-gvisor: \"please\"\nruntime-class-name: \"\"", - "queue-sidecar-image": "gcr.io/knative-releases/knative.dev/serving/cmd/queue@sha256:d313c823f25a09326a7c3c2ec9833c5e005791bc3acb4036ebf33735cbb62bee" + _example: "################################\n# #\n# EXAMPLE CONFIGURATION #\n# #\n################################\n\n# This block is not actually functional configuration,\n# but serves to illustrate the available configuration\n# options and document them in a way that is accessible\n# to users that `kubectl edit` this config map.\n#\n# These sample configuration options may be copied out of\n# this example block and unindented to be in the data block\n# to actually change the configuration.\n\n# List of repositories for which tag to digest resolving should be skipped\nregistries-skipping-tag-resolving: \"kind.local,ko.local,dev.local\"\n\n# Maximum time allowed for an image's digests to be resolved.\ndigest-resolution-timeout: \"10s\"\n\n# Duration we wait for the deployment to be ready before considering it failed.\nprogress-deadline: \"600s\"\n\n# Sets the queue proxy's CPU request.\n# If omitted, a default value (currently \"25m\"), is used.\nqueue-sidecar-cpu-request: \"25m\"\n\n# Sets the queue proxy's CPU limit.\n# If omitted, a default value (currently \"1000m\"), is used when\n# `queueproxy.resource-defaults` is set to `Enabled`.\nqueue-sidecar-cpu-limit: \"1000m\"\n\n# Sets the queue proxy's memory request.\n# If omitted, a default value (currently \"400Mi\"), is used when\n# `queueproxy.resource-defaults` is set to `Enabled`.\nqueue-sidecar-memory-request: \"400Mi\"\n\n# Sets the queue proxy's memory limit.\n# If omitted, a default value (currently \"800Mi\"), is used when\n# `queueproxy.resource-defaults` is set to `Enabled`.\nqueue-sidecar-memory-limit: \"800Mi\"\n\n# Sets the queue proxy's ephemeral storage request.\n# If omitted, no value is specified and the system default is used.\nqueue-sidecar-ephemeral-storage-request: \"512Mi\"\n\n# Sets the queue proxy's ephemeral storage limit.\n# If omitted, no value is specified and the system default is used.\nqueue-sidecar-ephemeral-storage-limit: \"1024Mi\"\n\n# Sets tokens associated with specific audiences for queue proxy - used by QPOptions\n#\n# For example, to add the `service-x` audience:\n# queue-sidecar-token-audiences: \"service-x\"\n# Also supports a list of audiences, for example:\n# queue-sidecar-token-audiences: \"service-x,service-y\"\n# If omitted, or empty, no tokens are created\nqueue-sidecar-token-audiences: \"\"\n\n# Sets rootCA for the queue proxy - used by QPOptions\n# If omitted, or empty, no rootCA is added to the golang rootCAs\nqueue-sidecar-rootca: \"\"\n\n# Sets the minimum TLS version for the queue proxy sidecar's TLS server.\n# Accepted values: \"1.2\", \"1.3\". Default is \"1.3\" if not specified.\nqueue-sidecar-tls-min-version: \"\"\n\n# Sets the maximum TLS version for the queue proxy sidecar's TLS server.\n# Accepted values: \"1.2\", \"1.3\". If omitted, the Go default is used.\nqueue-sidecar-tls-max-version: \"\"\n\n# Sets the cipher suites for the queue proxy sidecar's TLS server.\n# Comma-separated list of cipher suite names (e.g. \"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256\").\n# If omitted, the Go default cipher suites are used.\n# Note: cipher suites are not configurable in TLS 1.3.\nqueue-sidecar-tls-cipher-suites: \"\"\n\n# Sets the elliptic curve preferences for the queue proxy sidecar's TLS server.\n# Comma-separated list of curve names (e.g. \"X25519,CurveP256\").\n# If omitted, the Go default curves are used.\nqueue-sidecar-tls-curve-preferences: \"\"\n\n# If set, it automatically configures pod anti-affinity requirements for all Knative services.\n# It employs the `preferredDuringSchedulingIgnoredDuringExecution` weighted pod affinity term,\n# aligning with the Knative revision label. It yields the configuration below in all workloads' deployments:\n# `\n# affinity:\n# podAntiAffinity:\n# preferredDuringSchedulingIgnoredDuringExecution:\n# - podAffinityTerm:\n# topologyKey: kubernetes.io/hostname\n# labelSelector:\n# matchLabels:\n# serving.knative.dev/revision: {{revision-name}}\n# weight: 100\n# `\n# This may be \"none\" or \"prefer-spread-revision-over-nodes\" (default)\n# default-affinity-type: \"prefer-spread-revision-over-nodes\"\n\n# runtime-class-name contains the selector for which runtimeClassName\n# is selected to put in a revision.\n# By default, it is not set by Knative.\n#\n# Example:\n# runtime-class-name: |\n# \"\":\n# selector:\n# use-default-runc: \"yes\"\n# kata: {}\n# gvisor:\n# selector:\n# use-gvisor: \"please\"\nruntime-class-name: \"\"\n\n# pod-is-always-schedulable can be used to define that Pods in the system will always be\n# scheduled, and a Revision should not be marked unschedulable.\n# Setting this to `true` makes sense if you have cluster-autoscaling set up for your cluster\n# where unschedulable Pods trigger the addition of a new Node and are therefore a short and\n# transient state.\n#\n# See https://github.com/knative/serving/issues/14862\npod-is-always-schedulable: \"false\"", + "queue-sidecar-image": "gcr.io/knative-releases/knative.dev/serving/cmd/queue@sha256:b1af8bda6c1d32b1cf5fbf8f1f6068c5007a5cebf091039fdea83b88b1fd87f4" } }; -export const ConfigMap_ConfigDomain: ConfigMap = { +export const ConfigMap_ConfigDomain: KubernetesResource = { apiVersion: "v1", kind: "ConfigMap", metadata: { @@ -6140,7 +6291,7 @@ export const ConfigMap_ConfigDomain: ConfigMap = { labels: { "app.kubernetes.io/component": "controller", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.15.0" + "app.kubernetes.io/version": "1.22.1" }, name: "config-domain", namespace: "knative-serving" @@ -6149,26 +6300,26 @@ export const ConfigMap_ConfigDomain: ConfigMap = { _example: "################################\n# #\n# EXAMPLE CONFIGURATION #\n# #\n################################\n\n# This block is not actually functional configuration,\n# but serves to illustrate the available configuration\n# options and document them in a way that is accessible\n# to users that `kubectl edit` this config map.\n#\n# These sample configuration options may be copied out of\n# this example block and unindented to be in the data block\n# to actually change the configuration.\n\n# Default value for domain.\n# Routes having the cluster domain suffix (by default 'svc.cluster.local')\n# will not be exposed through Ingress. You can define your own label\n# selector to assign that domain suffix to your Route here, or you can set\n# the label\n# \"networking.knative.dev/visibility=cluster-local\"\n# to achieve the same effect. This shows how to make routes having\n# the label app=secret only exposed to the local cluster.\nsvc.cluster.local: |\n selector:\n app: secret\n\n# These are example settings of domain.\n# example.com will be used for all routes, but it is the least-specific rule so it\n# will only be used if no other domain matches.\nexample.com: |\n\n# example.org will be used for routes having app=nonprofit.\nexample.org: |\n selector:\n app: nonprofit\n" } }; -export const ConfigMap_ConfigFeatures: ConfigMap = { +export const ConfigMap_ConfigFeatures: KubernetesResource = { apiVersion: "v1", kind: "ConfigMap", metadata: { annotations: { - "knative.dev/example-checksum": "632d47dd" + "knative.dev/example-checksum": "bee75b26" }, labels: { "app.kubernetes.io/component": "controller", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.15.0" + "app.kubernetes.io/version": "1.22.1" }, name: "config-features", namespace: "knative-serving" }, data: { - _example: "################################\n# #\n# EXAMPLE CONFIGURATION #\n# #\n################################\n\n# This block is not actually functional configuration,\n# but serves to illustrate the available configuration\n# options and document them in a way that is accessible\n# to users that `kubectl edit` this config map.\n#\n# These sample configuration options may be copied out of\n# this example block and unindented to be in the data block\n# to actually change the configuration.\n\n# Default SecurityContext settings to secure-by-default values\n# if unset.\n#\n# This value will default to \"enabled\" in a future release,\n# probably Knative 1.10\nsecure-pod-defaults: \"disabled\"\n\n# Indicates whether multi container support is enabled\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See: https://knative.dev/docs/serving/configuration/feature-flags/#multiple-containers\nmulti-container: \"enabled\"\n\n# Indicates whether multi container probing is enabled\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See: https://knative.dev/docs/serving/configuration/feature-flags/#multiple-container-probing\nmulti-container-probing: \"disabled\"\n\n# Indicates whether Kubernetes affinity support is enabled\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See: https://knative.dev/docs/serving/feature-flags/#kubernetes-node-affinity\nkubernetes.podspec-affinity: \"disabled\"\n\n# Indicates whether Kubernetes topologySpreadConstraints support is enabled\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See: https://knative.dev/docs/serving/feature-flags/#kubernetes-topology-spread-constraints\nkubernetes.podspec-topologyspreadconstraints: \"disabled\"\n\n# Indicates whether Kubernetes hostAliases support is enabled\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See: https://knative.dev/docs/serving/feature-flags/#kubernetes-host-aliases\nkubernetes.podspec-hostaliases: \"disabled\"\n\n# Indicates whether Kubernetes nodeSelector support is enabled\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See: https://knative.dev/docs/serving/feature-flags/#kubernetes-node-selector\nkubernetes.podspec-nodeselector: \"disabled\"\n\n# Indicates whether Kubernetes tolerations support is enabled\n#\n# WARNING: Cannot safely be disabled once enabled\n# See: https://knative.dev/docs/serving/feature-flags/#kubernetes-toleration\nkubernetes.podspec-tolerations: \"disabled\"\n\n# Indicates whether Kubernetes FieldRef support is enabled\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See: https://knative.dev/docs/serving/feature-flags/#kubernetes-fieldref\nkubernetes.podspec-fieldref: \"disabled\"\n\n# Indicates whether Kubernetes RuntimeClassName support is enabled\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See: https://knative.dev/docs/serving/feature-flags/#kubernetes-runtime-class\nkubernetes.podspec-runtimeclassname: \"disabled\"\n\n# Indicates whether Kubernetes DNSPolicy support is enabled\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See: https://knative.dev/docs/serving/feature-flags/#kubernetes-dnspolicy\nkubernetes.podspec-dnspolicy: \"disabled\"\n\n# Indicates whether Kubernetes DNSConfig support is enabled\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See: https://knative.dev/docs/serving/feature-flags/#kubernetes-dnsconfig\nkubernetes.podspec-dnsconfig: \"disabled\"\n\n# This feature allows end-users to set a subset of fields on the Pod's SecurityContext\n#\n# When set to \"enabled\" or \"allowed\" it allows the following\n# PodSecurityContext properties:\n# - FSGroup\n# - RunAsGroup\n# - RunAsNonRoot\n# - SupplementalGroups\n# - RunAsUser\n# - SeccompProfile\n#\n# This feature flag should be used with caution as the PodSecurityContext\n# properties may have a side-effect on non-user sidecar containers that come\n# from Knative or your service mesh\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See: https://knative.dev/docs/serving/feature-flags/#kubernetes-security-context\nkubernetes.podspec-securitycontext: \"disabled\"\n\n# Indicated whether sharing the process namespace via ShareProcessNamespace pod spec is allowed.\n# This can be especially useful for sharing data from images directly between sidecars\n#\n# See: https://knative.dev/docs/serving/configuration/feature-flags/#kubernetes-share-process-namespace\nkubernetes.podspec-shareprocessnamespace: \"disabled\"\n\n# Indicates whether Kubernetes PriorityClassName support is enabled\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See: https://knative.dev/docs/serving/feature-flags/#kubernetes-priority-class-name\nkubernetes.podspec-priorityclassname: \"disabled\"\n\n# Indicates whether Kubernetes SchedulerName support is enabled\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See: https://knative.dev/docs/serving/feature-flags/#kubernetes-scheduler-name\nkubernetes.podspec-schedulername: \"disabled\"\n\n# This feature flag allows end-users to add a subset of capabilities on the Pod's SecurityContext.\n#\n# When set to \"enabled\" or \"allowed\" it allows capabilities to be added to the container.\n# For a list of possible capabilities, see https://man7.org/linux/man-pages/man7/capabilities.7.html\nkubernetes.containerspec-addcapabilities: \"disabled\"\n\n# This feature validates PodSpecs from the validating webhook\n# against the K8s API Server.\n#\n# When \"enabled\", the server will always run the extra validation.\n# When \"allowed\", the server will not run the dry-run validation by default.\n# However, clients may enable the behavior on an individual Service by\n# attaching the following metadata annotation: \"features.knative.dev/podspec-dryrun\":\"enabled\".\n# See: https://knative.dev/docs/serving/feature-flags/#kubernetes-dry-run\nkubernetes.podspec-dryrun: \"allowed\"\n\n# Controls whether tag header based routing feature are enabled or not.\n# 1. Enabled: enabling tag header based routing\n# 2. Disabled: disabling tag header based routing\n# See: https://knative.dev/docs/serving/feature-flags/#tag-header-based-routing\ntag-header-based-routing: \"disabled\"\n\n# Controls whether http2 auto-detection should be enabled or not.\n# 1. Enabled: http2 connection will be attempted via upgrade.\n# 2. Disabled: http2 connection will only be attempted when port name is set to \"h2c\".\nautodetect-http2: \"disabled\"\n\n# Controls whether volume support for EmptyDir is enabled or not.\n# 1. Enabled: enabling EmptyDir volume support\n# 2. Disabled: disabling EmptyDir volume support\nkubernetes.podspec-volumes-emptydir: \"enabled\"\n\n# Controls whether init containers support is enabled or not.\n# 1. Enabled: enabling init containers support\n# 2. Disabled: disabling init containers support\nkubernetes.podspec-init-containers: \"disabled\"\n\n# Controls whether persistent volume claim support is enabled or not.\n# 1. Enabled: enabling persistent volume claim support\n# 2. Disabled: disabling persistent volume claim support\nkubernetes.podspec-persistent-volume-claim: \"disabled\"\n\n# Controls whether write access for persistent volumes is enabled or not.\n# 1. Enabled: enabling write access for persistent volumes\n# 2. Disabled: disabling write access for persistent volumes\nkubernetes.podspec-persistent-volume-write: \"disabled\"\n\n# Controls if the queue proxy podInfo feature is enabled, allowed or disabled\n#\n# This feature should be enabled/allowed when using queue proxy Options (Extensions)\n# Enabling will mount a podInfo volume to the queue proxy container.\n# The volume will contains an 'annotations' file (from the pod's annotation field).\n# The annotations in this file include the Service annotations set by the client creating the service.\n# If mounted, the annotations can be accessed by queue proxy extensions at /etc/podinfo/annnotations\n#\n# 1. \"enabled\": always mount a podInfo volume\n# 2. \"disabled\": never mount a podInfo volume\n# 3. \"allowed\": by default, do not mount a podInfo volume\n# However, a client may mount the podInfo volume on an individual Service by attaching\n# the following metadata annotation to the Service: \"features.knative.dev/queueproxy-podinfo\":\"enabled\".\n#\n# NOTE THAT THIS IS AN EXPERIMENTAL / ALPHA FEATURE\nqueueproxy.mount-podinfo: \"disabled\"\n\n# Default queue proxy resource requests and limits to good values for most cases if set.\nqueueproxy.resource-defaults: \"disabled\"" + _example: "################################\n# #\n# EXAMPLE CONFIGURATION #\n# #\n################################\n\n# This block is not actually functional configuration,\n# but serves to illustrate the available configuration\n# options and document them in a way that is accessible\n# to users that `kubectl edit` this config map.\n#\n# These sample configuration options may be copied out of\n# this example block and unindented to be in the data block\n# to actually change the configuration.\n\n# Default SecurityContext settings to secure-by-default values\n# if unset.\n#\n# Disabled - do nothing; no security options are applied\n# AllowRootBounded - Applies secure defaults without enforcing strict policies; sets seccompProfile\n# to RuntimeDefault and drops all capabilities\n# Enabled - Enforces security defaults; sets seccompProfile to RuntimeDefault, drops all capabilities,\n# and sets runAsNonRoot to true if not already specified.\nsecure-pod-defaults: \"disabled\"\n\n# Indicates whether multi container support is enabled\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See: https://knative.dev/docs/serving/configuration/feature-flags/#multiple-containers\nmulti-container: \"enabled\"\n\n# Indicates whether multi container probing is enabled\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See: https://knative.dev/docs/serving/configuration/feature-flags/#multiple-container-probing\nmulti-container-probing: \"disabled\"\n\n# Indicates whether Kubernetes affinity support is enabled\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See: https://knative.dev/docs/serving/feature-flags/#kubernetes-node-affinity\nkubernetes.podspec-affinity: \"disabled\"\n\n# Indicates whether Kubernetes topologySpreadConstraints support is enabled\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See: https://knative.dev/docs/serving/feature-flags/#kubernetes-topology-spread-constraints\nkubernetes.podspec-topologyspreadconstraints: \"disabled\"\n\n# Indicates whether Kubernetes hostAliases support is enabled\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See: https://knative.dev/docs/serving/feature-flags/#kubernetes-host-aliases\nkubernetes.podspec-hostaliases: \"disabled\"\n\n# Indicates whether Kubernetes nodeSelector support is enabled\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See: https://knative.dev/docs/serving/feature-flags/#kubernetes-node-selector\nkubernetes.podspec-nodeselector: \"disabled\"\n\n# Indicates whether Kubernetes tolerations support is enabled\n#\n# WARNING: Cannot safely be disabled once enabled\n# See: https://knative.dev/docs/serving/feature-flags/#kubernetes-toleration\nkubernetes.podspec-tolerations: \"disabled\"\n\n# Indicates whether Kubernetes FieldRef support is enabled\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See: https://knative.dev/docs/serving/feature-flags/#kubernetes-fieldref\nkubernetes.podspec-fieldref: \"disabled\"\n\n# Indicates whether Kubernetes RuntimeClassName support is enabled\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See: https://knative.dev/docs/serving/feature-flags/#kubernetes-runtime-class\nkubernetes.podspec-runtimeclassname: \"disabled\"\n\n# Indicates whether Kubernetes DNSPolicy support is enabled\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See: https://knative.dev/docs/serving/feature-flags/#kubernetes-dnspolicy\nkubernetes.podspec-dnspolicy: \"disabled\"\n\n# Indicates whether Kubernetes DNSConfig support is enabled\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See: https://knative.dev/docs/serving/feature-flags/#kubernetes-dnsconfig\nkubernetes.podspec-dnsconfig: \"disabled\"\n\n# This feature allows end-users to set a subset of fields on the Pod's SecurityContext\n#\n# When set to \"enabled\" or \"allowed\" it allows the following\n# PodSecurityContext properties:\n# - FSGroup\n# - RunAsGroup\n# - RunAsNonRoot\n# - SupplementalGroups\n# - RunAsUser\n# - SeccompProfile\n#\n# This feature flag should be used with caution as the PodSecurityContext\n# properties may have a side-effect on non-user sidecar containers that come\n# from Knative or your service mesh\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See: https://knative.dev/docs/serving/feature-flags/#kubernetes-security-context\nkubernetes.podspec-securitycontext: \"disabled\"\n\n# Indicated whether sharing the process namespace via ShareProcessNamespace pod spec is allowed.\n# This can be especially useful for sharing data from images directly between sidecars\n#\n# See: https://knative.dev/docs/serving/configuration/feature-flags/#kubernetes-share-process-namespace\nkubernetes.podspec-shareprocessnamespace: \"disabled\"\n\n# Indicates whether hostIPC support is enabled\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See https://knative.dev/docs/serving/configuration/feature-flags/#kubernetes-host-ipc\nkubernetes.podspec-hostipc: \"disabled\"\n\n# Indicates whether hostPID support is enabled\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See https://knative.dev/docs/serving/configuration/feature-flags/#kubernetes-host-pid\nkubernetes.podspec-hostpid: \"disabled\"\n\n# Indicates whether hostNetwork support is enabled\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See See https://knative.dev/docs/serving/configuration/feature-flags/#kubernetes-host-network\nkubernetes.podspec-hostnetwork: \"disabled\"\n\n# Indicates whether Kubernetes PriorityClassName support is enabled\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See: https://knative.dev/docs/serving/feature-flags/#kubernetes-priority-class-name\nkubernetes.podspec-priorityclassname: \"disabled\"\n\n# Indicates whether Kubernetes SchedulerName support is enabled\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See: https://knative.dev/docs/serving/feature-flags/#kubernetes-scheduler-name\nkubernetes.podspec-schedulername: \"disabled\"\n\n# This feature flag allows end-users to add a subset of capabilities on the Pod's SecurityContext.\n#\n# When set to \"enabled\" or \"allowed\" it allows capabilities to be added to the container.\n# For a list of possible capabilities, see https://man7.org/linux/man-pages/man7/capabilities.7.html\nkubernetes.containerspec-addcapabilities: \"disabled\"\n\n\n# Controls whether tag header based routing feature are enabled or not.\n# 1. Enabled: enabling tag header based routing\n# 2. Disabled: disabling tag header based routing\n# See: https://knative.dev/docs/serving/feature-flags/#tag-header-based-routing\ntag-header-based-routing: \"disabled\"\n\n# Controls whether http2 auto-detection should be enabled or not.\n# 1. Enabled: http2 connection will be attempted via upgrade.\n# 2. Disabled: http2 connection will only be attempted when port name is set to \"h2c\".\nautodetect-http2: \"disabled\"\n\n# Controls whether volume support for EmptyDir is enabled or not.\n# 1. Enabled: enabling EmptyDir volume support\n# 2. Disabled: disabling EmptyDir volume support\nkubernetes.podspec-volumes-emptydir: \"enabled\"\n\n# Controls whether volume support for image is enabled or not.\n# 1. Enabled: enabling image volume support\n# 2. Disabled: disabling image volume support\nkubernetes.podspec-volumes-image: \"disabled\"\n\n# Controls whether volume support for HostPath is enabled or not.\n# WARNING: Cannot safely be disabled once enabled.\n# WARNING: If you can avoid using a hostPath volume, you should.\n# Please read https://kubernetes.io/docs/concepts/storage/volumes/#hostpath before enabling this feature.\n# 1. Enabled: enabling HostPath volume support\n# 2. Disabled: disabling HostPath volume support\nkubernetes.podspec-volumes-hostpath: \"disabled\"\n\n# Controls whether volume support for CSI is enabled or not.\n# 1. Enabled: enabling CSI volume support\n# 2. Disabled: disabling CSI volume support\nkubernetes.podspec-volumes-csi: \"disabled\"\n\n# Controls whether init containers support is enabled or not.\n# 1. Enabled: enabling init containers support\n# 2. Disabled: disabling init containers support\nkubernetes.podspec-init-containers: \"disabled\"\n\n# Controls whether persistent volume claim support is enabled or not.\n# 1. Enabled: enabling persistent volume claim support\n# 2. Disabled: disabling persistent volume claim support\nkubernetes.podspec-persistent-volume-claim: \"disabled\"\n\n# Controls whether write access for persistent volumes is enabled or not.\n# 1. Enabled: enabling write access for persistent volumes\n# 2. Disabled: disabling write access for persistent volumes\nkubernetes.podspec-persistent-volume-write: \"disabled\"\n\n# Controls whether volume mount propagation support is enabled or not.\n# 1. Enabled: enabling volume mount propagation support\n# 2. Disabled: disabling volume mount propagation support\nkubernetes.podspec-volumes-mount-propagation: \"disabled\"\n\n# Controls if the queue proxy podInfo feature is enabled, allowed or disabled\n#\n# This feature should be enabled/allowed when using queue proxy Options (Extensions)\n# Enabling will mount a podInfo volume to the queue proxy container.\n# The volume will contains an 'annotations' file (from the pod's annotation field).\n# The annotations in this file include the Service annotations set by the client creating the service.\n# If mounted, the annotations can be accessed by queue proxy extensions at /etc/podinfo/annotations\n#\n# 1. \"enabled\": always mount a podInfo volume\n# 2. \"disabled\": never mount a podInfo volume\n# 3. \"allowed\": by default, do not mount a podInfo volume\n# However, a client may mount the podInfo volume on an individual Service by attaching\n# the following metadata annotation to the Service: \"features.knative.dev/queueproxy-podinfo\":\"enabled\".\n#\n# NOTE THAT THIS IS AN EXPERIMENTAL / ALPHA FEATURE\nqueueproxy.mount-podinfo: \"disabled\"\n\n# Default queue proxy resource requests and limits to good values for most cases if set.\nqueueproxy.resource-defaults: \"disabled\"" } }; -export const ConfigMap_ConfigGc: ConfigMap = { +export const ConfigMap_ConfigGc: KubernetesResource = { apiVersion: "v1", kind: "ConfigMap", metadata: { @@ -6178,7 +6329,7 @@ export const ConfigMap_ConfigGc: ConfigMap = { labels: { "app.kubernetes.io/component": "controller", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.15.0" + "app.kubernetes.io/version": "1.22.1" }, name: "config-gc", namespace: "knative-serving" @@ -6187,7 +6338,7 @@ export const ConfigMap_ConfigGc: ConfigMap = { _example: "################################\n# #\n# EXAMPLE CONFIGURATION #\n# #\n################################\n\n# This block is not actually functional configuration,\n# but serves to illustrate the available configuration\n# options and document them in a way that is accessible\n# to users that `kubectl edit` this config map.\n#\n# These sample configuration options may be copied out of\n# this example block and unindented to be in the data block\n# to actually change the configuration.\n\n# ---------------------------------------\n# Garbage Collector Settings\n# ---------------------------------------\n#\n# Active\n# * Revisions which are referenced by a Route are considered active.\n# * Individual revisions may be marked with the annotation\n# \"serving.knative.dev/no-gc\":\"true\" to be permanently considered active.\n# * Active revisions are not considered for GC.\n# Retention\n# * Revisions are retained if they are any of the following:\n# 1. Active\n# 2. Were created within \"retain-since-create-time\"\n# 3. Were last referenced by a route within\n# \"retain-since-last-active-time\"\n# 4. There are fewer than \"min-non-active-revisions\"\n# If none of these conditions are met, or if the count of revisions exceed\n# \"max-non-active-revisions\", they will be deleted by GC.\n# The special value \"disabled\" may be used to turn off these limits.\n#\n# Example config to immediately collect any inactive revision:\n# min-non-active-revisions: \"0\"\n# max-non-active-revisions: \"0\"\n# retain-since-create-time: \"disabled\"\n# retain-since-last-active-time: \"disabled\"\n#\n# Example config to always keep around the last ten non-active revisions:\n# retain-since-create-time: \"disabled\"\n# retain-since-last-active-time: \"disabled\"\n# max-non-active-revisions: \"10\"\n#\n# Example config to disable all garbage collection:\n# retain-since-create-time: \"disabled\"\n# retain-since-last-active-time: \"disabled\"\n# max-non-active-revisions: \"disabled\"\n#\n# Example config to keep recently deployed or active revisions,\n# always maintain the last two in case of rollback, and prevent\n# burst activity from exploding the count of old revisions:\n# retain-since-create-time: \"48h\"\n# retain-since-last-active-time: \"15h\"\n# min-non-active-revisions: \"2\"\n# max-non-active-revisions: \"1000\"\n\n# Duration since creation before considering a revision for GC or \"disabled\".\nretain-since-create-time: \"48h\"\n\n# Duration since active before considering a revision for GC or \"disabled\".\nretain-since-last-active-time: \"15h\"\n\n# Minimum number of non-active revisions to retain.\nmin-non-active-revisions: \"20\"\n\n# Maximum number of non-active revisions to retain\n# or \"disabled\" to disable any maximum limit.\nmax-non-active-revisions: \"1000\"\n" } }; -export const ConfigMap_ConfigLeaderElection: ConfigMap = { +export const ConfigMap_ConfigLeaderElection: KubernetesResource = { apiVersion: "v1", kind: "ConfigMap", metadata: { @@ -6197,7 +6348,7 @@ export const ConfigMap_ConfigLeaderElection: ConfigMap = { labels: { "app.kubernetes.io/component": "controller", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.15.0" + "app.kubernetes.io/version": "1.22.1" }, name: "config-leader-election", namespace: "knative-serving" @@ -6206,7 +6357,7 @@ export const ConfigMap_ConfigLeaderElection: ConfigMap = { _example: "################################\n# #\n# EXAMPLE CONFIGURATION #\n# #\n################################\n\n# This block is not actually functional configuration,\n# but serves to illustrate the available configuration\n# options and document them in a way that is accessible\n# to users that `kubectl edit` this config map.\n#\n# These sample configuration options may be copied out of\n# this example block and unindented to be in the data block\n# to actually change the configuration.\n\n# lease-duration is how long non-leaders will wait to try to acquire the\n# lock; 15 seconds is the value used by core kubernetes controllers.\nlease-duration: \"60s\"\n\n# renew-deadline is how long a leader will try to renew the lease before\n# giving up; 10 seconds is the value used by core kubernetes controllers.\nrenew-deadline: \"40s\"\n\n# retry-period is how long the leader election client waits between tries of\n# actions; 2 seconds is the value used by core kubernetes controllers.\nretry-period: \"10s\"\n\n# buckets is the number of buckets used to partition key space of each\n# Reconciler. If this number is M and the replica number of the controller\n# is N, the N replicas will compete for the M buckets. The owner of a\n# bucket will take care of the reconciling for the keys partitioned into\n# that bucket.\nbuckets: \"1\"\n" } }; -export const ConfigMap_ConfigLogging: ConfigMap = { +export const ConfigMap_ConfigLogging: KubernetesResource = { apiVersion: "v1", kind: "ConfigMap", metadata: { @@ -6216,7 +6367,7 @@ export const ConfigMap_ConfigLogging: ConfigMap = { labels: { "app.kubernetes.io/component": "logging", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.15.0" + "app.kubernetes.io/version": "1.22.1" }, name: "config-logging", namespace: "knative-serving" @@ -6225,7 +6376,7 @@ export const ConfigMap_ConfigLogging: ConfigMap = { _example: "################################\n# #\n# EXAMPLE CONFIGURATION #\n# #\n################################\n\n# This block is not actually functional configuration,\n# but serves to illustrate the available configuration\n# options and document them in a way that is accessible\n# to users that `kubectl edit` this config map.\n#\n# These sample configuration options may be copied out of\n# this example block and unindented to be in the data block\n# to actually change the configuration.\n\n# Common configuration for all Knative codebase\nzap-logger-config: |\n {\n \"level\": \"info\",\n \"development\": false,\n \"outputPaths\": [\"stdout\"],\n \"errorOutputPaths\": [\"stderr\"],\n \"encoding\": \"json\",\n \"encoderConfig\": {\n \"timeKey\": \"timestamp\",\n \"levelKey\": \"severity\",\n \"nameKey\": \"logger\",\n \"callerKey\": \"caller\",\n \"messageKey\": \"message\",\n \"stacktraceKey\": \"stacktrace\",\n \"lineEnding\": \"\",\n \"levelEncoder\": \"\",\n \"timeEncoder\": \"iso8601\",\n \"durationEncoder\": \"\",\n \"callerEncoder\": \"\"\n }\n }\n\n# Log level overrides\n# For all components except the queue proxy,\n# changes are picked up immediately.\n# For queue proxy, changes require recreation of the pods.\nloglevel.controller: \"info\"\nloglevel.autoscaler: \"info\"\nloglevel.queueproxy: \"info\"\nloglevel.webhook: \"info\"\nloglevel.activator: \"info\"\nloglevel.hpaautoscaler: \"info\"\nloglevel.net-istio-controller: \"info\"\nloglevel.net-contour-controller: \"info\"\nloglevel.net-kourier-controller: \"info\"\nloglevel.net-gateway-api-controller: \"info\"\n" } }; -export const ConfigMap_ConfigNetwork: ConfigMap = { +export const ConfigMap_ConfigNetwork: KubernetesResource = { apiVersion: "v1", kind: "ConfigMap", metadata: { @@ -6235,7 +6386,7 @@ export const ConfigMap_ConfigNetwork: ConfigMap = { labels: { "app.kubernetes.io/component": "networking", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.15.0" + "app.kubernetes.io/version": "1.22.1" }, name: "config-network", namespace: "knative-serving" @@ -6244,52 +6395,52 @@ export const ConfigMap_ConfigNetwork: ConfigMap = { _example: "################################\n# #\n# EXAMPLE CONFIGURATION #\n# #\n################################\n\n# This block is not actually functional configuration,\n# but serves to illustrate the available configuration\n# options and document them in a way that is accessible\n# to users that `kubectl edit` this config map.\n#\n# These sample configuration options may be copied out of\n# this example block and unindented to be in the data block\n# to actually change the configuration.\n\n# ingress-class specifies the default ingress class\n# to use when not dictated by Route annotation.\n#\n# If not specified, will use the Istio ingress.\n#\n# Note that changing the Ingress class of an existing Route\n# will result in undefined behavior. Therefore it is best to only\n# update this value during the setup of Knative, to avoid getting\n# undefined behavior.\ningress-class: \"istio.ingress.networking.knative.dev\"\n\n# certificate-class specifies the default Certificate class\n# to use when not dictated by Route annotation.\n#\n# If not specified, will use the Cert-Manager Certificate.\n#\n# Note that changing the Certificate class of an existing Route\n# will result in undefined behavior. Therefore it is best to only\n# update this value during the setup of Knative, to avoid getting\n# undefined behavior.\ncertificate-class: \"cert-manager.certificate.networking.knative.dev\"\n\n# namespace-wildcard-cert-selector specifies a LabelSelector which\n# determines which namespaces should have a wildcard certificate\n# provisioned.\n#\n# Use an empty value to disable the feature (this is the default):\n# namespace-wildcard-cert-selector: \"\"\n#\n# Use an empty object to enable for all namespaces\n# namespace-wildcard-cert-selector: {}\n#\n# Useful labels include the \"kubernetes.io/metadata.name\" label to\n# avoid provisioning a certificate for the \"kube-system\" namespaces.\n# Use the following selector to match pre-1.0 behavior of using\n# \"networking.knative.dev/disableWildcardCert\" to exclude namespaces:\n#\n# matchExpressions:\n# - key: \"networking.knative.dev/disableWildcardCert\"\n# operator: \"NotIn\"\n# values: [\"true\"]\nnamespace-wildcard-cert-selector: \"\"\n\n# domain-template specifies the golang text template string to use\n# when constructing the Knative service's DNS name. The default\n# value is \"{{.Name}}.{{.Namespace}}.{{.Domain}}\".\n#\n# Valid variables defined in the template include Name, Namespace, Domain,\n# Labels, and Annotations. Name will be the result of the tag-template\n# below, if a tag is specified for the route.\n#\n# Changing this value might be necessary when the extra levels in\n# the domain name generated is problematic for wildcard certificates\n# that only support a single level of domain name added to the\n# certificate's domain. In those cases you might consider using a value\n# of \"{{.Name}}-{{.Namespace}}.{{.Domain}}\", or removing the Namespace\n# entirely from the template. When choosing a new value be thoughtful\n# of the potential for conflicts - for example, when users choose to use\n# characters such as `-` in their service, or namespace, names.\n# {{.Annotations}} or {{.Labels}} can be used for any customization in the\n# go template if needed.\n# We strongly recommend keeping namespace part of the template to avoid\n# domain name clashes:\n# eg. '{{.Name}}-{{.Namespace}}.{{ index .Annotations \"sub\"}}.{{.Domain}}'\n# and you have an annotation {\"sub\":\"foo\"}, then the generated template\n# would be {Name}-{Namespace}.foo.{Domain}\ndomain-template: \"{{.Name}}.{{.Namespace}}.{{.Domain}}\"\n\n# tag-template specifies the golang text template string to use\n# when constructing the DNS name for \"tags\" within the traffic blocks\n# of Routes and Configuration. This is used in conjunction with the\n# domain-template above to determine the full URL for the tag.\ntag-template: \"{{.Tag}}-{{.Name}}\"\n\n# auto-tls is deprecated and replaced by external-domain-tls\nauto-tls: \"Disabled\"\n\n# Controls whether TLS certificates are automatically provisioned and\n# installed in the Knative ingress to terminate TLS connections\n# for cluster external domains (like: app.example.com)\n# - Enabled: enables the TLS certificate provisioning feature for cluster external domains.\n# - Disabled: disables the TLS certificate provisioning feature for cluster external domains.\nexternal-domain-tls: \"Disabled\"\n\n# Controls weather TLS certificates are automatically provisioned and\n# installed in the Knative ingress to terminate TLS connections\n# for cluster local domains (like: app.namespace.svc.)\n# - Enabled: enables the TLS certificate provisioning feature for cluster cluster-local domains.\n# - Disabled: disables the TLS certificate provisioning feature for cluster cluster local domains.\n# NOTE: This flag is in an alpha state and is mostly here to enable internal testing\n# for now. Use with caution.\ncluster-local-domain-tls: \"Disabled\"\n\n# internal-encryption is deprecated and replaced by system-internal-tls\ninternal-encryption: \"false\"\n\n# system-internal-tls controls weather TLS encryption is used for connections between\n# the internal components of Knative:\n# - ingress to activator\n# - ingress to queue-proxy\n# - activator to queue-proxy\n#\n# Possible values for this flag are:\n# - Enabled: enables the TLS certificate provisioning feature for cluster cluster-local domains.\n# - Disabled: disables the TLS certificate provisioning feature for cluster cluster local domains.\n# NOTE: This flag is in an alpha state and is mostly here to enable internal testing\n# for now. Use with caution.\nsystem-internal-tls: \"Disabled\"\n\n# Controls the behavior of the HTTP endpoint for the Knative ingress.\n# It requires auto-tls to be enabled.\n# - Enabled: The Knative ingress will be able to serve HTTP connection.\n# - Redirected: The Knative ingress will send a 301 redirect for all\n# http connections, asking the clients to use HTTPS.\n#\n# \"Disabled\" option is deprecated.\nhttp-protocol: \"Enabled\"\n\n# rollout-duration contains the minimal duration in seconds over which the\n# Configuration traffic targets are rolled out to the newest revision.\nrollout-duration: \"0\"\n\n# autocreate-cluster-domain-claims controls whether ClusterDomainClaims should\n# be automatically created (and deleted) as needed when DomainMappings are\n# reconciled.\n#\n# If this is \"false\" (the default), the cluster administrator is\n# responsible for creating ClusterDomainClaims and delegating them to\n# namespaces via their spec.Namespace field. This setting should be used in\n# multitenant environments which need to control which namespace can use a\n# particular domain name in a domain mapping.\n#\n# If this is \"true\", users are able to associate arbitrary names with their\n# services via the DomainMapping feature.\nautocreate-cluster-domain-claims: \"false\"\n\n# If true, networking plugins can add additional information to deployed\n# applications to make their pods directly accessible via their IPs even if mesh is\n# enabled and thus direct-addressability is usually not possible.\n# Consumers like Knative Serving can use this setting to adjust their behavior\n# accordingly, i.e. to drop fallback solutions for non-pod-addressable systems.\n#\n# NOTE: This flag is in an alpha state and is mostly here to enable internal testing\n# for now. Use with caution.\nenable-mesh-pod-addressability: \"false\"\n\n# mesh-compatibility-mode indicates whether consumers of network plugins\n# should directly contact Pod IPs (most efficient), or should use the\n# Cluster IP (less efficient, needed when mesh is enabled unless\n# `enable-mesh-pod-addressability`, above, is set).\n# Permitted values are:\n# - \"auto\" (default): automatically determine which mesh mode to use by trying Pod IP and falling back to Cluster IP as needed.\n# - \"enabled\": always use Cluster IP and do not attempt to use Pod IPs.\n# - \"disabled\": always use Pod IPs and do not fall back to Cluster IP on failure.\nmesh-compatibility-mode: \"auto\"\n\n# Defines the scheme used for external URLs if auto-tls is not enabled.\n# This can be used for making Knative report all URLs as \"HTTPS\" for example, if you're\n# fronting Knative with an external loadbalancer that deals with TLS termination and\n# Knative doesn't know about that otherwise.\ndefault-external-scheme: \"http\"\n" } }; -export const ConfigMap_ConfigObservability: ConfigMap = { +export const ConfigMap_ConfigObservability: KubernetesResource = { apiVersion: "v1", kind: "ConfigMap", metadata: { annotations: { - "knative.dev/example-checksum": "54abd711" + "knative.dev/example-checksum": "59abacb5" }, labels: { "app.kubernetes.io/component": "observability", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.15.0" + "app.kubernetes.io/version": "1.22.1" }, name: "config-observability", namespace: "knative-serving" }, data: { - _example: "################################\n# #\n# EXAMPLE CONFIGURATION #\n# #\n################################\n\n# This block is not actually functional configuration,\n# but serves to illustrate the available configuration\n# options and document them in a way that is accessible\n# to users that `kubectl edit` this config map.\n#\n# These sample configuration options may be copied out of\n# this example block and unindented to be in the data block\n# to actually change the configuration.\n\n# logging.enable-var-log-collection defaults to false.\n# The fluentd daemon set will be set up to collect /var/log if\n# this flag is true.\nlogging.enable-var-log-collection: \"false\"\n\n# logging.revision-url-template provides a template to use for producing the\n# logging URL that is injected into the status of each Revision.\nlogging.revision-url-template: \"http://logging.example.com/?revisionUID=${REVISION_UID}\"\n\n# If non-empty, this enables queue proxy writing user request logs to stdout, excluding probe\n# requests.\n# NB: after 0.18 release logging.enable-request-log must be explicitly set to true\n# in order for request logging to be enabled.\n#\n# The value determines the shape of the request logs and it must be a valid go text/template.\n# It is important to keep this as a single line. Multiple lines are parsed as separate entities\n# by most collection agents and will split the request logs into multiple records.\n#\n# The following fields and functions are available to the template:\n#\n# Request: An http.Request (see https://golang.org/pkg/net/http/#Request)\n# representing an HTTP request received by the server.\n#\n# Response:\n# struct {\n# Code int // HTTP status code (see https://www.iana.org/assignments/http-status-codes/http-status-codes.xhtml)\n# Size int // An int representing the size of the response.\n# Latency float64 // A float64 representing the latency of the response in seconds.\n# }\n#\n# Revision:\n# struct {\n# Name string // Knative revision name\n# Namespace string // Knative revision namespace\n# Service string // Knative service name\n# Configuration string // Knative configuration name\n# PodName string // Name of the pod hosting the revision\n# PodIP string // IP of the pod hosting the revision\n# }\n#\nlogging.request-log-template: '{\"httpRequest\": {\"requestMethod\": \"{{.Request.Method}}\", \"requestUrl\": \"{{js .Request.RequestURI}}\", \"requestSize\": \"{{.Request.ContentLength}}\", \"status\": {{.Response.Code}}, \"responseSize\": \"{{.Response.Size}}\", \"userAgent\": \"{{js .Request.UserAgent}}\", \"remoteIp\": \"{{js .Request.RemoteAddr}}\", \"serverIp\": \"{{.Revision.PodIP}}\", \"referer\": \"{{js .Request.Referer}}\", \"latency\": \"{{.Response.Latency}}s\", \"protocol\": \"{{.Request.Proto}}\"}, \"traceId\": \"{{index .Request.Header \"X-B3-Traceid\"}}\"}'\n\n# If true, the request logging will be enabled.\n# NB: up to and including Knative version 0.18 if logging.request-log-template is non-empty, this value\n# will be ignored.\nlogging.enable-request-log: \"false\"\n\n# If true, this enables queue proxy writing request logs for probe requests to stdout.\n# It uses the same template for user requests, i.e. logging.request-log-template.\nlogging.enable-probe-request-log: \"false\"\n\n# metrics.backend-destination field specifies the system metrics destination.\n# It supports either prometheus (the default) or opencensus.\nmetrics.backend-destination: prometheus\n\n# metrics.reporting-period-seconds specifies the global metrics reporting period for control and data plane components.\n# If a zero or negative value is passed the default reporting period is used (10 secs).\n# If the attribute is not specified a default value is used per metrics backend.\n# For the prometheus backend the default reporting period is 5s while for opencensus it is 60s.\nmetrics.reporting-period-seconds: \"5\"\n\n# metrics.request-metrics-backend-destination specifies the request metrics\n# destination. It enables queue proxy to send request metrics.\n# Currently supported values: prometheus (the default), opencensus.\nmetrics.request-metrics-backend-destination: prometheus\n\n# metrics.request-metrics-reporting-period-seconds specifies the request metrics reporting period in sec at queue proxy.\n# If a zero or negative value is passed the default reporting period is used (10 secs).\n# If the attribute is not specified, it is overridden by the value of metrics.reporting-period-seconds.\nmetrics.request-metrics-reporting-period-seconds: \"5\"\n\n# profiling.enable indicates whether it is allowed to retrieve runtime profiling data from\n# the pods via an HTTP server in the format expected by the pprof visualization tool. When\n# enabled, the Knative Serving pods expose the profiling data on an alternate HTTP port 8008.\n# The HTTP context root for profiling is then /debug/pprof/.\nprofiling.enable: \"false\"\n" + _example: "################################\n# #\n# EXAMPLE CONFIGURATION #\n# #\n################################\n\n# This block is not actually functional configuration,\n# but serves to illustrate the available configuration\n# options and document them in a way that is accessible\n# to users that `kubectl edit` this config map.\n#\n# These sample configuration options may be copied out of\n# this example block and unindented to be in the data block\n# to actually change the configuration.\n\n# logging.enable-var-log-collection defaults to false.\n# The fluentd daemon set will be set up to collect /var/log if\n# this flag is true.\nlogging.enable-var-log-collection: \"false\"\n\n# logging.revision-url-template provides a template to use for producing the\n# logging URL that is injected into the status of each Revision.\nlogging.revision-url-template: \"http://logging.example.com/?revisionUID=${REVISION_UID}\"\n\n# If non-empty, this enables queue proxy writing user request logs to stdout, excluding probe\n# requests.\n# NB: after 0.18 release logging.enable-request-log must be explicitly set to true\n# in order for request logging to be enabled.\n#\n# The value determines the shape of the request logs and it must be a valid go text/template.\n# It is important to keep this as a single line. Multiple lines are parsed as separate entities\n# by most collection agents and will split the request logs into multiple records.\n#\n# The following fields and functions are available to the template:\n#\n# Request: An http.Request (see https://golang.org/pkg/net/http/#Request)\n# representing an HTTP request received by the server.\n#\n# Response:\n# struct {\n# Code int // HTTP status code (see https://www.iana.org/assignments/http-status-codes/http-status-codes.xhtml)\n# Size int // An int representing the size of the response.\n# Latency float64 // A float64 representing the latency of the response in seconds.\n# }\n#\n# Revision:\n# struct {\n# Name string // Knative revision name\n# Namespace string // Knative revision namespace\n# Service string // Knative service name\n# Configuration string // Knative configuration name\n# PodName string // Name of the pod hosting the revision\n# PodIP string // IP of the pod hosting the revision\n# }\n#\nlogging.request-log-template: '{\"httpRequest\": {\"requestMethod\": \"{{.Request.Method}}\", \"requestUrl\": \"{{js .Request.RequestURI}}\", \"requestSize\": \"{{.Request.ContentLength}}\", \"status\": {{.Response.Code}}, \"responseSize\": \"{{.Response.Size}}\", \"userAgent\": \"{{js .Request.UserAgent}}\", \"remoteIp\": \"{{js .Request.RemoteAddr}}\", \"serverIp\": \"{{.Revision.PodIP}}\", \"referer\": \"{{js .Request.Referer}}\", \"latency\": \"{{.Response.Latency}}s\", \"protocol\": \"{{.Request.Proto}}\"}, \"traceId\": \"{{.TraceID}}\"}'\n\n# If true, the request logging will be enabled.\nlogging.enable-request-log: \"false\"\n\n# If true, this enables queue proxy writing request logs for probe requests to stdout.\n# It uses the same template for user requests, i.e. logging.request-log-template.\nlogging.enable-probe-request-log: \"false\"\n\n# metrics-protocol field specifies the protocol used when exporting metrics\n# It supports either 'none' (the default), 'prometheus', 'http/protobuf' (OTLP HTTP), 'grpc' (OTLP gRPC)\nmetrics-protocol: http/protobuf\n\n# metrics-endpoint field specifies the destination metrics should be exporter to.\n#\n# The endpoint MUST be set when the protocol is http/protobuf or grpc.\n# The endpoint MUST NOT be set when the protocol is none.\n#\n# When the protocol is prometheus the endpoint can accept a 'host:port' string to customize the\n# listening host interface and port.\nmetrics-endpoint: http://example.com/v1/traces\n\n# metrics-export-interval specifies the global metrics reporting period for control and data plane components.\n# If a zero or negative value is passed the default reporting OTel period is used (60 secs).\nmetrics-export-interval: 60s\n\n# request-metrics-protocol field specifies the protocol used when exporting queue-proxy metrics\n# It supports either 'none' (the default), 'prometheus', 'http/protobuf' (OTLP HTTP), 'grpc' (OTLP gRPC)\nrequest-metrics-protocol: http/protobuf\n\n# request-metrics-endpoint field specifies the destination metrics from the queue proxy should be exporter to.\n#\n# The endpoint MUST be set when the protocol is http/protobuf or grpc.\n# The endpoint MUST NOT be set when the protocol is none.\n#\n# When the protocol is prometheus the endpoint can accept a 'host:port' string to customize the\n# listening host interface and port.\nrequest-metrics-endpoint: http://promstack-kube-prometheus-prometheus.observability:9090/api/v1/otlp/v1/metrics\n\n# request-metrics-export-interval specifies the global metrics reporting period for the queue-proxy.\n#\n# If a zero or negative value is passed the default reporting OTel period is used (60 secs).\nrequest-metrics-export-interval: 60s\n\n# runtime-profiling indicates whether it is allowed to retrieve runtime profiling data from\n# the pods via an HTTP server in the format expected by the pprof visualization tool. When\n# enabled, the Knative Serving pods expose the profiling data on an alternate HTTP port 8008.\n# The HTTP context root for profiling is then /debug/pprof/.\nruntime-profiling: enabled\n\n# tracing-protocol field specifies the protocol used when exporting traces\n# It supports either 'none' (the default), 'http/protobuf' (OTLP HTTP), 'grpc' (OTLP gRPC)\n# or `stdout` for debugging purposes\ntracing-protocol: http/protobuf\n\n# tracing-endpoint field specifies the destination traces should be exporter to.\n#\n# The endpoint MUST be set when the protocol is http/protobuf or grpc.\n# The endpoint MUST NOT be set when the protocol is none.\ntracing-endpoint: http://jaeger-collector.observability:4318/v1/traces\n\n# tracing-sampling-rate allows the user to specify what percentage of all traces should be exported\n# The value should be between 0 (never sample) to 1 (always sample)\ntracing-sampling-rate: \"1\"\n" } }; -export const ConfigMap_ConfigTracing: ConfigMap = { +export const ConfigMap_ConfigTracing: KubernetesResource = { apiVersion: "v1", kind: "ConfigMap", metadata: { annotations: { - "knative.dev/example-checksum": "26614636" + "knative.dev/example-checksum": "04c7e9a3" }, labels: { "app.kubernetes.io/component": "tracing", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.15.0" + "app.kubernetes.io/version": "1.22.1" }, name: "config-tracing", namespace: "knative-serving" }, data: { - _example: "################################\n# #\n# EXAMPLE CONFIGURATION #\n# #\n################################\n\n# This block is not actually functional configuration,\n# but serves to illustrate the available configuration\n# options and document them in a way that is accessible\n# to users that `kubectl edit` this config map.\n#\n# These sample configuration options may be copied out of\n# this example block and unindented to be in the data block\n# to actually change the configuration.\n#\n# This may be \"zipkin\" or \"none\" (default)\nbackend: \"none\"\n\n# URL to zipkin collector where traces are sent.\n# This must be specified when backend is \"zipkin\"\nzipkin-endpoint: \"http://zipkin.istio-system.svc.cluster.local:9411/api/v2/spans\"\n\n# Enable zipkin debug mode. This allows all spans to be sent to the server\n# bypassing sampling.\ndebug: \"false\"\n\n# Percentage (0-1) of requests to trace\nsample-rate: \"0.1\"\n" + _example: "###########################################################\n# #\n# This config is deprecated - use config-observability #\n# #\n###########################################################\n" } }; -export const HorizontalPodAutoscaler_Activator: AutoscalingV2HorizontalPodAutoscaler = { +export const HorizontalPodAutoscaler_Activator: KubernetesResource = { apiVersion: "autoscaling/v2", kind: "HorizontalPodAutoscaler", metadata: { labels: { "app.kubernetes.io/component": "activator", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.15.0" + "app.kubernetes.io/version": "1.22.1" }, name: "activator", namespace: "knative-serving" @@ -6314,14 +6465,14 @@ export const HorizontalPodAutoscaler_Activator: AutoscalingV2HorizontalPodAutosc } } }; -export const PodDisruptionBudget_ActivatorPdb: PolicyV1PodDisruptionBudget = { +export const PodDisruptionBudget_ActivatorPdb: KubernetesResource = { apiVersion: "policy/v1", kind: "PodDisruptionBudget", metadata: { labels: { "app.kubernetes.io/component": "activator", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.15.0" + "app.kubernetes.io/version": "1.22.1" }, name: "activator-pdb", namespace: "knative-serving" @@ -6335,14 +6486,14 @@ export const PodDisruptionBudget_ActivatorPdb: PolicyV1PodDisruptionBudget = { } } }; -export const Deployment_Activator: AppsV1Deployment = { +export const Deployment_Activator: KubernetesResource = { apiVersion: "apps/v1", kind: "Deployment", metadata: { labels: { "app.kubernetes.io/component": "activator", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.15.0" + "app.kubernetes.io/version": "1.22.1" }, name: "activator", namespace: "knative-serving" @@ -6360,7 +6511,7 @@ export const Deployment_Activator: AppsV1Deployment = { app: "activator", "app.kubernetes.io/component": "activator", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.15.0", + "app.kubernetes.io/version": "1.22.1", role: "activator" } }, @@ -6411,11 +6562,8 @@ export const Deployment_Activator: AppsV1Deployment = { }, { name: "CONFIG_OBSERVABILITY_NAME", value: "config-observability" - }, { - name: "METRICS_DOMAIN", - value: "knative.dev/internal/serving" }], - image: "gcr.io/knative-releases/knative.dev/serving/cmd/activator@sha256:b6d7d96edd8942d679757249f6aa07373461411104ce7c93309f23fba2884f8f", + image: "gcr.io/knative-releases/knative.dev/serving/cmd/activator@sha256:5deaef961fef8d1417f6d4a4dfae2fc338f2d30d72c4ad58c3ab392b2c04705b", livenessProbe: { failureThreshold: 12, httpGet: { @@ -6473,7 +6621,7 @@ export const Deployment_Activator: AppsV1Deployment = { } } }; -export const Service_ActivatorService: Service = { +export const Service_ActivatorService: KubernetesResource = { apiVersion: "v1", kind: "Service", metadata: { @@ -6481,7 +6629,7 @@ export const Service_ActivatorService: Service = { app: "activator", "app.kubernetes.io/component": "activator", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.15.0" + "app.kubernetes.io/version": "1.22.1" }, name: "activator-service", namespace: "knative-serving" @@ -6514,14 +6662,14 @@ export const Service_ActivatorService: Service = { type: "ClusterIP" } }; -export const Deployment_Autoscaler: AppsV1Deployment = { +export const Deployment_Autoscaler: KubernetesResource = { apiVersion: "apps/v1", kind: "Deployment", metadata: { labels: { "app.kubernetes.io/component": "autoscaler", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.15.0" + "app.kubernetes.io/version": "1.22.1" }, name: "autoscaler", namespace: "knative-serving" @@ -6545,7 +6693,7 @@ export const Deployment_Autoscaler: AppsV1Deployment = { app: "autoscaler", "app.kubernetes.io/component": "autoscaler", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.15.0" + "app.kubernetes.io/version": "1.22.1" } }, spec: { @@ -6592,11 +6740,8 @@ export const Deployment_Autoscaler: AppsV1Deployment = { }, { name: "CONFIG_OBSERVABILITY_NAME", value: "config-observability" - }, { - name: "METRICS_DOMAIN", - value: "knative.dev/serving" }], - image: "gcr.io/knative-releases/knative.dev/serving/cmd/autoscaler@sha256:119157d871eb3db5a54944464d9920ad378d35292d4c12fd4a765cd016e24f0f", + image: "gcr.io/knative-releases/knative.dev/serving/cmd/autoscaler@sha256:5bae38655d87df86b041083fbe51791816473245f752432ba9b85a7b12f73cd5", livenessProbe: { failureThreshold: 6, httpGet: { @@ -6646,7 +6791,7 @@ export const Deployment_Autoscaler: AppsV1Deployment = { } } }; -export const Service_Autoscaler: Service = { +export const Service_Autoscaler: KubernetesResource = { apiVersion: "v1", kind: "Service", metadata: { @@ -6654,7 +6799,7 @@ export const Service_Autoscaler: Service = { app: "autoscaler", "app.kubernetes.io/component": "autoscaler", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.15.0" + "app.kubernetes.io/version": "1.22.1" }, name: "autoscaler", namespace: "knative-serving" @@ -6678,14 +6823,14 @@ export const Service_Autoscaler: Service = { } } }; -export const Deployment_Controller: AppsV1Deployment = { +export const Deployment_Controller: KubernetesResource = { apiVersion: "apps/v1", kind: "Deployment", metadata: { labels: { "app.kubernetes.io/component": "controller", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.15.0" + "app.kubernetes.io/version": "1.22.1" }, name: "controller", namespace: "knative-serving" @@ -6702,7 +6847,7 @@ export const Deployment_Controller: AppsV1Deployment = { app: "controller", "app.kubernetes.io/component": "controller", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.15.0" + "app.kubernetes.io/version": "1.22.1" } }, spec: { @@ -6742,11 +6887,8 @@ export const Deployment_Controller: AppsV1Deployment = { }, { name: "CONFIG_OBSERVABILITY_NAME", value: "config-observability" - }, { - name: "METRICS_DOMAIN", - value: "knative.dev/internal/serving" }], - image: "gcr.io/knative-releases/knative.dev/serving/cmd/controller@sha256:80b9865a585900af6cecead24babe03aa79487e9e6306da1444b04148c21c96f", + image: "gcr.io/knative-releases/knative.dev/serving/cmd/controller@sha256:94329d85200c2fc31ed1166a26568ca1357376c149c147e71f400cf28be3c816", livenessProbe: { failureThreshold: 6, httpGet: { @@ -6803,7 +6945,7 @@ export const Deployment_Controller: AppsV1Deployment = { } } }; -export const Service_Controller: Service = { +export const Service_Controller: KubernetesResource = { apiVersion: "v1", kind: "Service", metadata: { @@ -6811,7 +6953,7 @@ export const Service_Controller: Service = { app: "controller", "app.kubernetes.io/component": "controller", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.15.0" + "app.kubernetes.io/version": "1.22.1" }, name: "controller", namespace: "knative-serving" @@ -6831,14 +6973,14 @@ export const Service_Controller: Service = { } } }; -export const HorizontalPodAutoscaler_Webhook: AutoscalingV2HorizontalPodAutoscaler = { +export const HorizontalPodAutoscaler_Webhook: KubernetesResource = { apiVersion: "autoscaling/v2", kind: "HorizontalPodAutoscaler", metadata: { labels: { "app.kubernetes.io/component": "webhook", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.15.0" + "app.kubernetes.io/version": "1.22.1" }, name: "webhook", namespace: "knative-serving" @@ -6863,14 +7005,14 @@ export const HorizontalPodAutoscaler_Webhook: AutoscalingV2HorizontalPodAutoscal } } }; -export const PodDisruptionBudget_WebhookPdb: PolicyV1PodDisruptionBudget = { +export const PodDisruptionBudget_WebhookPdb: KubernetesResource = { apiVersion: "policy/v1", kind: "PodDisruptionBudget", metadata: { labels: { "app.kubernetes.io/component": "webhook", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.15.0" + "app.kubernetes.io/version": "1.22.1" }, name: "webhook-pdb", namespace: "knative-serving" @@ -6884,14 +7026,14 @@ export const PodDisruptionBudget_WebhookPdb: PolicyV1PodDisruptionBudget = { } } }; -export const Deployment_Webhook: AppsV1Deployment = { +export const Deployment_Webhook: KubernetesResource = { apiVersion: "apps/v1", kind: "Deployment", metadata: { labels: { "app.kubernetes.io/component": "webhook", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.15.0" + "app.kubernetes.io/version": "1.22.1" }, name: "webhook", namespace: "knative-serving" @@ -6909,7 +7051,7 @@ export const Deployment_Webhook: AppsV1Deployment = { app: "webhook", "app.kubernetes.io/component": "webhook", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.15.0", + "app.kubernetes.io/version": "1.22.1", role: "webhook" } }, @@ -6956,11 +7098,8 @@ export const Deployment_Webhook: AppsV1Deployment = { }, { name: "WEBHOOK_PORT", value: "8443" - }, { - name: "METRICS_DOMAIN", - value: "knative.dev/internal/serving" }], - image: "gcr.io/knative-releases/knative.dev/serving/cmd/webhook@sha256:732d9cdf7f5fa5c6055d26b1aa5aad40e3d74ba9f2cb76a1db0f0e4d072b7cd0", + image: "gcr.io/knative-releases/knative.dev/serving/cmd/webhook@sha256:8470456be214e93a84e3c7b79a632aa9978bd8ecda553feaa47878a2c24ab84d", livenessProbe: { failureThreshold: 6, httpGet: { @@ -7016,7 +7155,7 @@ export const Deployment_Webhook: AppsV1Deployment = { } } }; -export const Service_Webhook: Service = { +export const Service_Webhook: KubernetesResource = { apiVersion: "v1", kind: "Service", metadata: { @@ -7024,7 +7163,7 @@ export const Service_Webhook: Service = { app: "webhook", "app.kubernetes.io/component": "webhook", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.15.0", + "app.kubernetes.io/version": "1.22.1", role: "webhook" }, name: "webhook", @@ -7050,14 +7189,14 @@ export const Service_Webhook: Service = { } } }; -export const ValidatingWebhookConfiguration_ConfigWebhookServingKnativeDev: AdmissionregistrationK8sIoV1ValidatingWebhookConfiguration = { +export const ValidatingWebhookConfiguration_ConfigWebhookServingKnativeDev: KubernetesResource = { apiVersion: "admissionregistration.k8s.io/v1", kind: "ValidatingWebhookConfiguration", metadata: { labels: { "app.kubernetes.io/component": "webhook", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.15.0" + "app.kubernetes.io/version": "1.22.1" }, name: "config.webhook.serving.knative.dev" }, @@ -7086,14 +7225,14 @@ export const ValidatingWebhookConfiguration_ConfigWebhookServingKnativeDev: Admi timeoutSeconds: 10 }] }; -export const MutatingWebhookConfiguration_WebhookServingKnativeDev: AdmissionregistrationK8sIoV1MutatingWebhookConfiguration = { +export const MutatingWebhookConfiguration_WebhookServingKnativeDev: KubernetesResource = { apiVersion: "admissionregistration.k8s.io/v1", kind: "MutatingWebhookConfiguration", metadata: { labels: { "app.kubernetes.io/component": "webhook", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.15.0" + "app.kubernetes.io/version": "1.22.1" }, name: "webhook.serving.knative.dev" }, @@ -7118,14 +7257,14 @@ export const MutatingWebhookConfiguration_WebhookServingKnativeDev: Admissionreg timeoutSeconds: 10 }] }; -export const ValidatingWebhookConfiguration_ValidationWebhookServingKnativeDev: AdmissionregistrationK8sIoV1ValidatingWebhookConfiguration = { +export const ValidatingWebhookConfiguration_ValidationWebhookServingKnativeDev: KubernetesResource = { apiVersion: "admissionregistration.k8s.io/v1", kind: "ValidatingWebhookConfiguration", metadata: { labels: { "app.kubernetes.io/component": "webhook", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.15.0" + "app.kubernetes.io/version": "1.22.1" }, name: "validation.webhook.serving.knative.dev" }, @@ -7150,40 +7289,40 @@ export const ValidatingWebhookConfiguration_ValidationWebhookServingKnativeDev: timeoutSeconds: 10 }] }; -export const Secret_WebhookCerts: Secret = { +export const Secret_WebhookCerts: KubernetesResource = { apiVersion: "v1", kind: "Secret", metadata: { labels: { "app.kubernetes.io/component": "webhook", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.15.0" + "app.kubernetes.io/version": "1.22.1" }, name: "webhook-certs", namespace: "knative-serving" } }; -export const Namespace_KourierSystem: Namespace = { +export const Namespace_KourierSystem: KubernetesResource = { apiVersion: "v1", kind: "Namespace", metadata: { labels: { "app.kubernetes.io/component": "net-kourier", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.15.0", + "app.kubernetes.io/version": "1.22.1", "networking.knative.dev/ingress-provider": "kourier" }, name: "kourier-system" } }; -export const ConfigMap_KourierBootstrap: ConfigMap = { +export const ConfigMap_KourierBootstrap: KubernetesResource = { apiVersion: "v1", kind: "ConfigMap", metadata: { labels: { "app.kubernetes.io/component": "net-kourier", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.15.0", + "app.kubernetes.io/version": "1.22.1", "networking.knative.dev/ingress-provider": "kourier" }, name: "kourier-bootstrap", @@ -7193,45 +7332,45 @@ export const ConfigMap_KourierBootstrap: ConfigMap = { "envoy-bootstrap.yaml": "dynamic_resources:\n ads_config:\n transport_api_version: V3\n api_type: GRPC\n rate_limit_settings: {}\n grpc_services:\n - envoy_grpc: {cluster_name: xds_cluster}\n cds_config:\n resource_api_version: V3\n ads: {}\n lds_config:\n resource_api_version: V3\n ads: {}\nnode:\n cluster: kourier-knative\n id: 3scale-kourier-gateway\nstatic_resources:\n listeners:\n - name: stats_listener\n address:\n socket_address:\n address: 0.0.0.0\n port_value: 9000\n filter_chains:\n - filters:\n - name: envoy.filters.network.http_connection_manager\n typed_config:\n \"@type\": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\n stat_prefix: stats_server\n http_filters:\n - name: envoy.filters.http.router\n typed_config:\n \"@type\": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\n route_config:\n virtual_hosts:\n - name: admin_interface\n domains:\n - \"*\"\n routes:\n - match:\n safe_regex:\n regex: '/(certs|stats(/prometheus)?|server_info|clusters|listeners|ready)?'\n headers:\n - name: ':method'\n string_match:\n exact: GET\n route:\n cluster: service_stats\n - match:\n safe_regex:\n regex: '/drain_listeners'\n headers:\n - name: ':method'\n string_match:\n exact: POST\n route:\n cluster: service_stats\n clusters:\n - name: service_stats\n connect_timeout: 0.250s\n type: static\n load_assignment:\n cluster_name: service_stats\n endpoints:\n lb_endpoints:\n endpoint:\n address:\n socket_address:\n address: 127.0.0.1\n port_value: 9901\n - name: xds_cluster\n # This keepalive is recommended by envoy docs.\n # https://www.envoyproxy.io/docs/envoy/latest/api-docs/xds_protocol\n typed_extension_protocol_options:\n envoy.extensions.upstreams.http.v3.HttpProtocolOptions:\n \"@type\": type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\n explicit_http_config:\n http2_protocol_options:\n connection_keepalive:\n interval: 30s\n timeout: 5s\n connect_timeout: 1s\n load_assignment:\n cluster_name: xds_cluster\n endpoints:\n lb_endpoints:\n endpoint:\n address:\n socket_address:\n address: \"net-kourier-controller.knative-serving\"\n port_value: 18000\n type: STRICT_DNS\nadmin:\n access_log:\n - name: envoy.access_loggers.stdout\n typed_config:\n \"@type\": type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog\n address:\n socket_address:\n address: 127.0.0.1\n port_value: 9901\n" } }; -export const ConfigMap_ConfigKourier: ConfigMap = { +export const ConfigMap_ConfigKourier: KubernetesResource = { apiVersion: "v1", kind: "ConfigMap", metadata: { labels: { "app.kubernetes.io/component": "net-kourier", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.15.0", + "app.kubernetes.io/version": "1.22.1", "networking.knative.dev/ingress-provider": "kourier" }, name: "config-kourier", namespace: "knative-serving" }, data: { - _example: "################################\n# #\n# EXAMPLE CONFIGURATION #\n# #\n################################\n\n# This block is not actually functional configuration,\n# but serves to illustrate the available configuration\n# options and document them in a way that is accessible\n# to users that `kubectl edit` this config map.\n#\n# These sample configuration options may be copied out of\n# this example block and unindented to be in the data block\n# to actually change the configuration.\n\n# Specifies whether requests reaching the Kourier gateway\n# in the context of services should be logged. Readiness\n# probes etc. must be configured via the bootstrap config.\nenable-service-access-logging: \"true\"\n\n# Specifies whether to use proxy-protocol in order to safely\n# transport connection information such as a client's address\n# across multiple layers of TCP proxies.\n# NOTE THAT THIS IS AN EXPERIMENTAL / ALPHA FEATURE\nenable-proxy-protocol: \"false\"\n\n# The server certificates to serve the internal TLS traffic for Kourier Gateway.\n# It is specified by the secret name in controller namespace, which has\n# the \"tls.crt\" and \"tls.key\" data field.\n# Use an empty value to disable the feature (default).\n#\n# NOTE: This flag is in an alpha state and is mostly here to enable internal testing\n# for now. Use with caution.\ncluster-cert-secret: \"\"\n\n# Specifies the amount of time that Kourier waits for the incoming requests.\n# The default, 0s, imposes no timeout at all.\nstream-idle-timeout: \"0s\"\n\n# Specifies whether to use CryptoMB private key provider in order to\n# acclerate the TLS handshake.\n# NOTE THAT THIS IS AN EXPERIMENTAL / ALPHA FEATURE.\nenable-cryptomb: \"false\"\n\n# Configures the number of additional ingress proxy hops from the\n# right side of the x-forwarded-for HTTP header to trust.\ntrusted-hops-count: \"0\"\n\n# Specifies the cipher suites for TLS external listener.\n# Use ',' separated values like \"ECDHE-ECDSA-AES128-GCM-SHA256,ECDHE-ECDSA-CHACHA20-POLY1305\"\n# The default uses the default cipher suites of the envoy version.\ncipher-suites: \"\"\n" + _example: "################################\n# #\n# EXAMPLE CONFIGURATION #\n# #\n################################\n\n# This block is not actually functional configuration,\n# but serves to illustrate the available configuration\n# options and document them in a way that is accessible\n# to users that `kubectl edit` this config map.\n#\n# These sample configuration options may be copied out of\n# this example block and unindented to be in the data block\n# to actually change the configuration.\n\n# Specifies whether requests reaching the Kourier gateway\n# in the context of services should be logged. Readiness\n# probes etc. must be configured via the bootstrap config.\nenable-service-access-logging: \"true\"\n\n# Specifies the format of the access log used by the Kourier gateway.\n# This template follows the envoy format.\n# see: https://www.envoyproxy.io/docs/envoy/latest/configuration/observability/access_log/usage#access-logging\nservice-access-log-template: \"\"\n\n# Specifies whether to use proxy-protocol in order to safely\n# transport connection information such as a client's address\n# across multiple layers of TCP proxies.\n# NOTE THAT THIS IS AN EXPERIMENTAL / ALPHA FEATURE\nenable-proxy-protocol: \"false\"\n\n# The server certificates to serve the internal TLS traffic for Kourier Gateway.\n# It is specified by the secret name in controller namespace, which has\n# the \"tls.crt\" and \"tls.key\" data field.\n# Use an empty value to disable the feature (default).\n#\n# NOTE: This flag is in an alpha state and is mostly here to enable internal testing\n# for now. Use with caution.\ncluster-cert-secret: \"\"\n\n# Specifies the amount of time that Kourier waits for the incoming requests.\n# The default, 0s, imposes no timeout at all.\nstream-idle-timeout: \"0s\"\n\n# Specifies whether to use CryptoMB private key provider in order to\n# acclerate the TLS handshake.\n# NOTE THAT THIS IS AN EXPERIMENTAL / ALPHA FEATURE.\nenable-cryptomb: \"false\"\n\n# Configures the number of additional ingress proxy hops from the\n# right side of the x-forwarded-for HTTP header to trust.\ntrusted-hops-count: \"0\"\n\n# Configures the connection manager to use the real remote address\n# of the client connection when determining internal versus external origin and manipulating various headers.\nuse-remote-address: \"false\"\n\n# Specifies the cipher suites for TLS external listener.\n# Use ',' separated values like \"ECDHE-ECDSA-AES128-GCM-SHA256,ECDHE-ECDSA-CHACHA20-POLY1305\"\n# The default uses the default cipher suites of the envoy version.\ncipher-suites: \"\"\n\n# Disable the Envoy server header injection in the response when response has no such header.\ndisable-envoy-server-header: \"false\"\n\n# The external authorization service and port, my-auth:2222.\n# This value overrides environment variable if defined.\nextauthz-host: \"\"\n\n# The protocol used to query the ext auth service. Can be one of : grpc, http, https. Defaults to grpc\n# This value overrides environment variable if defined.\nextauthz-protocol: \"grpc\"\n\n# Allow traffic to go through if the ext auth service is down. Accepts true/false.\n# This value overrides environment variable if defined.\nextauthz-failure-mode-allow: \"\"\n\n# Max request bytes, if not set, defaults to 8192 Bytes. More info Envoy Docs\n# see: https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/http/ext_authz/v3/ext_authz.proto.html#extensions-filters-http-ext-authz-v3-buffersettings\n# This value overrides environment variable if defined.\nextauthz-max-request-body-bytes: 8192\n\n# Max time in ms to wait for the ext authz service. Defaults to 2000 ms\n# This value overrides environment variable if defined.\nextauthz-timeout: 2000\n\n# If extauthz-protocol is equal to http or https, path to query the ext auth service.\n# Example : if set to /verify, it will query /verify/ (notice the trailing /). If not set, it will query /\n# This value overrides environment variable if defined.\nextauthz-path-prefix: \"\"\n\n# If extauthz-protocol is equal to grpc, sends the body as raw bytes instead of a UTF-8 string.\n# Accepts only true/false, t/f or 1/0. Attempting to set another value will throw an error.\n# Defaults to false. More info Envoy Docs.\n# see: https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/http/ext_authz/v3/ext_authz.proto.html#extensions-filters-http-ext-authz-v3-buffersettings\n# This value overrides environment variable if defined.\nextauthz-pack-as-byte: \"false\"\n\n# Specifies the secret that contains the TLS certificate and key pair when using HTTPS communication with Kourier Ingress.\n# This value overrides environment variable if defined.\ncerts-secret-name: \"\"\ncerts-secret-namespace: \"\"\n\n# Specifies the OTLP collector endpoint for distributed tracing.\n# The endpoint format depends on the protocol (see tracing-protocol).\n# Examples:\n# - For HTTP: \"http://otel-collector.observability.svc:4318/v1/traces\"\n# - For gRPC: \"http://otel-collector.observability.svc:4317\"\n# Use an empty value to disable distributed tracing (default).\ntracing-endpoint: \"\"\n\n# Protocol for tracing collector communication.\n# Valid values: http/protobuf, grpc\ntracing-protocol: \"grpc\"\n\n# Tracing sampling rate (0.0 to 1.0)\n# Controls the percentage of requests that are traced.\n# Example: \"1.0\" traces 100% of requests.\ntracing-sampling-rate: \"1.0\"\n\n# Service name for traces\n# This identifies the Kourier gateway in your tracing system.\ntracing-service-name: \"kourier-knative\"\n" } }; -export const ServiceAccount_NetKourier: ServiceAccount = { +export const ServiceAccount_NetKourier: KubernetesResource = { apiVersion: "v1", kind: "ServiceAccount", metadata: { labels: { "app.kubernetes.io/component": "net-kourier", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.15.0", + "app.kubernetes.io/version": "1.22.1", "networking.knative.dev/ingress-provider": "kourier" }, name: "net-kourier", namespace: "knative-serving" } }; -export const ClusterRole_NetKourier: RbacAuthorizationK8sIoV1ClusterRole = { +export const ClusterRole_NetKourier: KubernetesResource = { apiVersion: "rbac.authorization.k8s.io/v1", kind: "ClusterRole", metadata: { labels: { "app.kubernetes.io/component": "net-kourier", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.15.0", + "app.kubernetes.io/version": "1.22.1", "networking.knative.dev/ingress-provider": "kourier" }, name: "net-kourier" @@ -7242,12 +7381,16 @@ export const ClusterRole_NetKourier: RbacAuthorizationK8sIoV1ClusterRole = { verbs: ["create", "update", "patch"] }, { apiGroups: [""], - resources: ["pods", "endpoints", "services", "secrets"], + resources: ["pods", "services", "secrets"], verbs: ["get", "list", "watch"] }, { apiGroups: [""], resources: ["configmaps"], verbs: ["get", "list", "watch"] + }, { + apiGroups: ["discovery.k8s.io"], + resources: ["endpointslices"], + verbs: ["get", "list", "watch"] }, { apiGroups: ["coordination.k8s.io"], resources: ["leases"], @@ -7262,14 +7405,14 @@ export const ClusterRole_NetKourier: RbacAuthorizationK8sIoV1ClusterRole = { verbs: ["update"] }] }; -export const ClusterRoleBinding_NetKourier: RbacAuthorizationK8sIoV1ClusterRoleBinding = { +export const ClusterRoleBinding_NetKourier: KubernetesResource = { apiVersion: "rbac.authorization.k8s.io/v1", kind: "ClusterRoleBinding", metadata: { labels: { "app.kubernetes.io/component": "net-kourier", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.15.0", + "app.kubernetes.io/version": "1.22.1", "networking.knative.dev/ingress-provider": "kourier" }, name: "net-kourier" @@ -7285,14 +7428,14 @@ export const ClusterRoleBinding_NetKourier: RbacAuthorizationK8sIoV1ClusterRoleB namespace: "knative-serving" }] }; -export const Deployment_NetKourierController: AppsV1Deployment = { +export const Deployment_NetKourierController: KubernetesResource = { apiVersion: "apps/v1", kind: "Deployment", metadata: { labels: { "app.kubernetes.io/component": "net-kourier", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.15.0", + "app.kubernetes.io/version": "1.22.1", "networking.knative.dev/ingress-provider": "kourier" }, name: "net-kourier-controller", @@ -7354,7 +7497,7 @@ export const Deployment_NetKourierController: AppsV1Deployment = { name: "KUBE_API_QPS", value: "200" }], - image: "gcr.io/knative-releases/knative.dev/net-kourier/cmd/kourier@sha256:c9016f34165c5118373c75dcc373d1cd802fe37ffa9e1bce65960942a59bc5f1", + image: "gcr.io/knative-releases/knative.dev/net-kourier/cmd/kourier@sha256:01abd2070ccf8680885c47990e42c05c09e30bc8595d9246f4dcd37f2220a2a2", livenessProbe: { failureThreshold: 6, grpc: { @@ -7407,14 +7550,14 @@ export const Deployment_NetKourierController: AppsV1Deployment = { } } }; -export const Service_NetKourierController: Service = { +export const Service_NetKourierController: KubernetesResource = { apiVersion: "v1", kind: "Service", metadata: { labels: { "app.kubernetes.io/component": "net-kourier", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.15.0", + "app.kubernetes.io/version": "1.22.1", "networking.knative.dev/ingress-provider": "kourier" }, name: "net-kourier-controller", @@ -7438,14 +7581,14 @@ export const Service_NetKourierController: Service = { type: "ClusterIP" } }; -export const Deployment_3scaleKourierGateway: AppsV1Deployment = { +export const Deployment_3scaleKourierGateway: KubernetesResource = { apiVersion: "apps/v1", kind: "Deployment", metadata: { labels: { "app.kubernetes.io/component": "net-kourier", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.15.0", + "app.kubernetes.io/version": "1.22.1", "networking.knative.dev/ingress-provider": "kourier" }, name: "3scale-kourier-gateway", @@ -7484,7 +7627,7 @@ export const Deployment_3scaleKourierGateway: AppsV1Deployment = { name: "DRAIN_TIME_SECONDS", value: "15" }], - image: "docker.io/envoyproxy/envoy:v1.26-latest", + image: "docker.io/envoyproxy/envoy:v1.37-latest", lifecycle: { preStop: { exec: { @@ -7504,7 +7647,8 @@ export const Deployment_3scaleKourierGateway: AppsV1Deployment = { scheme: "HTTP" }, initialDelaySeconds: 10, - periodSeconds: 5 + periodSeconds: 5, + timeoutSeconds: 3 }, name: "kourier-gateway", ports: [{ @@ -7544,7 +7688,8 @@ export const Deployment_3scaleKourierGateway: AppsV1Deployment = { scheme: "HTTP" }, initialDelaySeconds: 10, - periodSeconds: 5 + periodSeconds: 5, + timeoutSeconds: 3 }, resources: { limits: { @@ -7586,14 +7731,14 @@ export const Deployment_3scaleKourierGateway: AppsV1Deployment = { } } }; -export const Service_Kourier: Service = { +export const Service_Kourier: KubernetesResource = { apiVersion: "v1", kind: "Service", metadata: { labels: { "app.kubernetes.io/component": "net-kourier", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.15.0", + "app.kubernetes.io/version": "1.22.1", "networking.knative.dev/ingress-provider": "kourier" }, name: "kourier", @@ -7617,14 +7762,14 @@ export const Service_Kourier: Service = { type: "LoadBalancer" } }; -export const Service_KourierInternal: Service = { +export const Service_KourierInternal: KubernetesResource = { apiVersion: "v1", kind: "Service", metadata: { labels: { "app.kubernetes.io/component": "net-kourier", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.15.0", + "app.kubernetes.io/version": "1.22.1", "networking.knative.dev/ingress-provider": "kourier" }, name: "kourier-internal", @@ -7648,14 +7793,14 @@ export const Service_KourierInternal: Service = { type: "ClusterIP" } }; -export const HorizontalPodAutoscaler_3scaleKourierGateway: AutoscalingV2HorizontalPodAutoscaler = { +export const HorizontalPodAutoscaler_3scaleKourierGateway: KubernetesResource = { apiVersion: "autoscaling/v2", kind: "HorizontalPodAutoscaler", metadata: { labels: { "app.kubernetes.io/component": "net-kourier", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.15.0", + "app.kubernetes.io/version": "1.22.1", "networking.knative.dev/ingress-provider": "kourier" }, name: "3scale-kourier-gateway", @@ -7681,14 +7826,14 @@ export const HorizontalPodAutoscaler_3scaleKourierGateway: AutoscalingV2Horizont } } }; -export const PodDisruptionBudget_3scaleKourierGatewayPdb: PolicyV1PodDisruptionBudget = { +export const PodDisruptionBudget_3scaleKourierGatewayPdb: KubernetesResource = { apiVersion: "policy/v1", kind: "PodDisruptionBudget", metadata: { labels: { "app.kubernetes.io/component": "net-kourier", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.15.0", + "app.kubernetes.io/version": "1.22.1", "networking.knative.dev/ingress-provider": "kourier" }, name: "3scale-kourier-gateway-pdb", diff --git a/packages/manifests/src/generated/kube-prometheus-stack.ts b/packages/manifests/src/generated/kube-prometheus-stack.ts index d5cc9ae..a72c427 100644 --- a/packages/manifests/src/generated/kube-prometheus-stack.ts +++ b/packages/manifests/src/generated/kube-prometheus-stack.ts @@ -1,6 +1,6 @@ /** Auto-generated typed resources for operator: kube-prometheus-stack*/ -import type { KubernetesResource, AdmissionregistrationK8sIoV1MutatingWebhookConfiguration, AdmissionregistrationK8sIoV1ValidatingWebhookConfiguration, ApiextensionsK8sIoV1CustomResourceDefinition, AppsV1DaemonSet, AppsV1Deployment, BatchV1Job, ConfigMap, MonitoringCoreosComV1Alertmanager, MonitoringCoreosComV1Prometheus, MonitoringCoreosComV1PrometheusRule, MonitoringCoreosComV1ServiceMonitor, Namespace, PersistentVolumeClaim, Pod, RbacAuthorizationK8sIoV1ClusterRole, RbacAuthorizationK8sIoV1ClusterRoleBinding, RbacAuthorizationK8sIoV1Role, RbacAuthorizationK8sIoV1RoleBinding, Secret, Service, ServiceAccount } from "@kubernetesjs/ops"; -export const Namespace_Monitoring: Namespace = { +import type { KubernetesResource } from "@kubernetesjs/ops"; +export const Namespace_Monitoring: KubernetesResource = { apiVersion: "v1", kind: "Namespace", metadata: { @@ -10,7 +10,7 @@ export const Namespace_Monitoring: Namespace = { name: "monitoring" } }; -export const CustomResourceDefinition_AlertmanagerconfigsMonitoringCoreosCom: ApiextensionsK8sIoV1CustomResourceDefinition = { +export const CustomResourceDefinition_AlertmanagerconfigsMonitoringCoreosCom: KubernetesResource = { apiVersion: "apiextensions.k8s.io/v1", kind: "CustomResourceDefinition", metadata: { @@ -9894,7 +9894,7 @@ export const CustomResourceDefinition_AlertmanagerconfigsMonitoringCoreosCom: Ap }] } }; -export const CustomResourceDefinition_AlertmanagersMonitoringCoreosCom: ApiextensionsK8sIoV1CustomResourceDefinition = { +export const CustomResourceDefinition_AlertmanagersMonitoringCoreosCom: KubernetesResource = { apiVersion: "apiextensions.k8s.io/v1", kind: "CustomResourceDefinition", metadata: { @@ -17272,7 +17272,7 @@ export const CustomResourceDefinition_AlertmanagersMonitoringCoreosCom: Apiexten }] } }; -export const CustomResourceDefinition_PodmonitorsMonitoringCoreosCom: ApiextensionsK8sIoV1CustomResourceDefinition = { +export const CustomResourceDefinition_PodmonitorsMonitoringCoreosCom: KubernetesResource = { apiVersion: "apiextensions.k8s.io/v1", kind: "CustomResourceDefinition", metadata: { @@ -18226,7 +18226,7 @@ export const CustomResourceDefinition_PodmonitorsMonitoringCoreosCom: Apiextensi }] } }; -export const CustomResourceDefinition_ProbesMonitoringCoreosCom: ApiextensionsK8sIoV1CustomResourceDefinition = { +export const CustomResourceDefinition_ProbesMonitoringCoreosCom: KubernetesResource = { apiVersion: "apiextensions.k8s.io/v1", kind: "CustomResourceDefinition", metadata: { @@ -19210,7 +19210,7 @@ export const CustomResourceDefinition_ProbesMonitoringCoreosCom: ApiextensionsK8 }] } }; -export const CustomResourceDefinition_PrometheusagentsMonitoringCoreosCom: ApiextensionsK8sIoV1CustomResourceDefinition = { +export const CustomResourceDefinition_PrometheusagentsMonitoringCoreosCom: KubernetesResource = { apiVersion: "apiextensions.k8s.io/v1", kind: "CustomResourceDefinition", metadata: { @@ -27431,7 +27431,7 @@ export const CustomResourceDefinition_PrometheusagentsMonitoringCoreosCom: Apiex }] } }; -export const CustomResourceDefinition_PrometheusesMonitoringCoreosCom: ApiextensionsK8sIoV1CustomResourceDefinition = { +export const CustomResourceDefinition_PrometheusesMonitoringCoreosCom: KubernetesResource = { apiVersion: "apiextensions.k8s.io/v1", kind: "CustomResourceDefinition", metadata: { @@ -37397,7 +37397,7 @@ export const CustomResourceDefinition_PrometheusesMonitoringCoreosCom: Apiextens }] } }; -export const CustomResourceDefinition_PrometheusrulesMonitoringCoreosCom: ApiextensionsK8sIoV1CustomResourceDefinition = { +export const CustomResourceDefinition_PrometheusrulesMonitoringCoreosCom: KubernetesResource = { apiVersion: "apiextensions.k8s.io/v1", kind: "CustomResourceDefinition", metadata: { @@ -37548,7 +37548,7 @@ export const CustomResourceDefinition_PrometheusrulesMonitoringCoreosCom: Apiext }] } }; -export const CustomResourceDefinition_ScrapeconfigsMonitoringCoreosCom: ApiextensionsK8sIoV1CustomResourceDefinition = { +export const CustomResourceDefinition_ScrapeconfigsMonitoringCoreosCom: KubernetesResource = { apiVersion: "apiextensions.k8s.io/v1", kind: "CustomResourceDefinition", metadata: { @@ -48215,7 +48215,7 @@ export const CustomResourceDefinition_ScrapeconfigsMonitoringCoreosCom: Apiexten }] } }; -export const CustomResourceDefinition_ServicemonitorsMonitoringCoreosCom: ApiextensionsK8sIoV1CustomResourceDefinition = { +export const CustomResourceDefinition_ServicemonitorsMonitoringCoreosCom: KubernetesResource = { apiVersion: "apiextensions.k8s.io/v1", kind: "CustomResourceDefinition", metadata: { @@ -49267,7 +49267,7 @@ export const CustomResourceDefinition_ServicemonitorsMonitoringCoreosCom: Apiext }] } }; -export const CustomResourceDefinition_ThanosrulersMonitoringCoreosCom: ApiextensionsK8sIoV1CustomResourceDefinition = { +export const CustomResourceDefinition_ThanosrulersMonitoringCoreosCom: KubernetesResource = { apiVersion: "apiextensions.k8s.io/v1", kind: "CustomResourceDefinition", metadata: { @@ -56369,7 +56369,7 @@ export const CustomResourceDefinition_ThanosrulersMonitoringCoreosCom: Apiextens }] } }; -export const ServiceAccount_KubePrometheusStackGrafana: ServiceAccount = { +export const ServiceAccount_KubePrometheusStackGrafana: KubernetesResource = { apiVersion: "v1", kind: "ServiceAccount", metadata: { @@ -56384,7 +56384,7 @@ export const ServiceAccount_KubePrometheusStackGrafana: ServiceAccount = { }, automountServiceAccountToken: true }; -export const ServiceAccount_KubePrometheusStackKubeStateMetrics: ServiceAccount = { +export const ServiceAccount_KubePrometheusStackKubeStateMetrics: KubernetesResource = { apiVersion: "v1", kind: "ServiceAccount", metadata: { @@ -56403,7 +56403,7 @@ export const ServiceAccount_KubePrometheusStackKubeStateMetrics: ServiceAccount }, automountServiceAccountToken: true }; -export const ServiceAccount_KubePrometheusStackPrometheusNodeExporter: ServiceAccount = { +export const ServiceAccount_KubePrometheusStackPrometheusNodeExporter: KubernetesResource = { apiVersion: "v1", kind: "ServiceAccount", metadata: { @@ -56422,7 +56422,7 @@ export const ServiceAccount_KubePrometheusStackPrometheusNodeExporter: ServiceAc }, automountServiceAccountToken: false }; -export const ServiceAccount_KubePrometheusStackAlertmanager: ServiceAccount = { +export const ServiceAccount_KubePrometheusStackAlertmanager: KubernetesResource = { apiVersion: "v1", kind: "ServiceAccount", metadata: { @@ -56443,7 +56443,7 @@ export const ServiceAccount_KubePrometheusStackAlertmanager: ServiceAccount = { }, automountServiceAccountToken: true }; -export const ServiceAccount_KubePrometheusStackOperator: ServiceAccount = { +export const ServiceAccount_KubePrometheusStackOperator: KubernetesResource = { apiVersion: "v1", kind: "ServiceAccount", metadata: { @@ -56464,7 +56464,7 @@ export const ServiceAccount_KubePrometheusStackOperator: ServiceAccount = { }, automountServiceAccountToken: true }; -export const ServiceAccount_KubePrometheusStackPrometheus: ServiceAccount = { +export const ServiceAccount_KubePrometheusStackPrometheus: KubernetesResource = { apiVersion: "v1", kind: "ServiceAccount", metadata: { @@ -56485,7 +56485,7 @@ export const ServiceAccount_KubePrometheusStackPrometheus: ServiceAccount = { }, automountServiceAccountToken: true }; -export const Secret_KubePrometheusStackGrafana: Secret = { +export const Secret_KubePrometheusStackGrafana: KubernetesResource = { apiVersion: "v1", kind: "Secret", metadata: { @@ -56505,7 +56505,7 @@ export const Secret_KubePrometheusStackGrafana: Secret = { }, type: "Opaque" }; -export const Secret_AlertmanagerKubePrometheusStackAlertmanager: Secret = { +export const Secret_AlertmanagerKubePrometheusStackAlertmanager: KubernetesResource = { apiVersion: "v1", kind: "Secret", metadata: { @@ -56526,7 +56526,7 @@ export const Secret_AlertmanagerKubePrometheusStackAlertmanager: Secret = { "alertmanager.yaml": "Z2xvYmFsOgogIHJlc29sdmVfdGltZW91dDogNW0KaW5oaWJpdF9ydWxlczoKLSBlcXVhbDoKICAtIG5hbWVzcGFjZQogIC0gYWxlcnRuYW1lCiAgc291cmNlX21hdGNoZXJzOgogIC0gc2V2ZXJpdHkgPSBjcml0aWNhbAogIHRhcmdldF9tYXRjaGVyczoKICAtIHNldmVyaXR5ID1+IHdhcm5pbmd8aW5mbwotIGVxdWFsOgogIC0gbmFtZXNwYWNlCiAgLSBhbGVydG5hbWUKICBzb3VyY2VfbWF0Y2hlcnM6CiAgLSBzZXZlcml0eSA9IHdhcm5pbmcKICB0YXJnZXRfbWF0Y2hlcnM6CiAgLSBzZXZlcml0eSA9IGluZm8KLSBlcXVhbDoKICAtIG5hbWVzcGFjZQogIHNvdXJjZV9tYXRjaGVyczoKICAtIGFsZXJ0bmFtZSA9IEluZm9JbmhpYml0b3IKICB0YXJnZXRfbWF0Y2hlcnM6CiAgLSBzZXZlcml0eSA9IGluZm8KLSB0YXJnZXRfbWF0Y2hlcnM6CiAgLSBhbGVydG5hbWUgPSBJbmZvSW5oaWJpdG9yCnJlY2VpdmVyczoKLSBuYW1lOiAibnVsbCIKcm91dGU6CiAgZ3JvdXBfYnk6CiAgLSBuYW1lc3BhY2UKICBncm91cF9pbnRlcnZhbDogNW0KICBncm91cF93YWl0OiAzMHMKICByZWNlaXZlcjogIm51bGwiCiAgcmVwZWF0X2ludGVydmFsOiAxMmgKICByb3V0ZXM6CiAgLSBtYXRjaGVyczoKICAgIC0gYWxlcnRuYW1lID0gIldhdGNoZG9nIgogICAgcmVjZWl2ZXI6ICJudWxsIgp0ZW1wbGF0ZXM6Ci0gL2V0Yy9hbGVydG1hbmFnZXIvY29uZmlnLyoudG1wbA==" } }; -export const ConfigMap_KubePrometheusStackGrafanaConfigDashboards: ConfigMap = { +export const ConfigMap_KubePrometheusStackGrafanaConfigDashboards: KubernetesResource = { apiVersion: "v1", kind: "ConfigMap", metadata: { @@ -56543,7 +56543,7 @@ export const ConfigMap_KubePrometheusStackGrafanaConfigDashboards: ConfigMap = { "provider.yaml": "apiVersion: 1\nproviders:\n - name: 'sidecarProvider'\n orgId: 1\n folder: ''\n folderUid: ''\n type: file\n disableDeletion: false\n allowUiUpdates: false\n updateIntervalSeconds: 30\n options:\n foldersFromFilesStructure: false\n path: /tmp/dashboards" } }; -export const ConfigMap_KubePrometheusStackGrafana: ConfigMap = { +export const ConfigMap_KubePrometheusStackGrafana: KubernetesResource = { apiVersion: "v1", kind: "ConfigMap", metadata: { @@ -56560,7 +56560,7 @@ export const ConfigMap_KubePrometheusStackGrafana: ConfigMap = { "grafana.ini": "[analytics]\ncheck_for_updates = true\n[grafana_net]\nurl = https://grafana.net\n[log]\nmode = console\n[paths]\ndata = /var/lib/grafana/\nlogs = /var/log/grafana\nplugins = /var/lib/grafana/plugins\nprovisioning = /etc/grafana/provisioning\n[server]\ndomain = ''\n" } }; -export const ConfigMap_KubePrometheusStackGrafanaDatasource: ConfigMap = { +export const ConfigMap_KubePrometheusStackGrafanaDatasource: KubernetesResource = { apiVersion: "v1", kind: "ConfigMap", metadata: { @@ -56582,7 +56582,7 @@ export const ConfigMap_KubePrometheusStackGrafanaDatasource: ConfigMap = { "datasource.yaml": "apiVersion: 1\ndatasources:\n- name: \"Prometheus\"\n type: prometheus\n uid: prometheus\n url: http://kube-prometheus-stack-prometheus.monitoring:9090/\n access: proxy\n isDefault: true\n jsonData:\n httpMethod: POST\n timeInterval: 30s\n- name: \"Alertmanager\"\n type: alertmanager\n uid: alertmanager\n url: http://kube-prometheus-stack-alertmanager.monitoring:9093/\n access: proxy\n jsonData:\n handleGrafanaManagedAlerts: false\n implementation: prometheus" } }; -export const ConfigMap_KubePrometheusStackAlertmanagerOverview: ConfigMap = { +export const ConfigMap_KubePrometheusStackAlertmanagerOverview: KubernetesResource = { apiVersion: "v1", kind: "ConfigMap", metadata: { @@ -56605,7 +56605,7 @@ export const ConfigMap_KubePrometheusStackAlertmanagerOverview: ConfigMap = { "alertmanager-overview.json": "{\"graphTooltip\":1,\"panels\":[{\"collapsed\":false,\"gridPos\":{\"h\":1,\"w\":24,\"x\":0,\"y\":0},\"id\":1,\"panels\":[],\"title\":\"Alerts\",\"type\":\"row\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"description\":\"current set of alerts stored in the Alertmanager\",\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"stacking\":{\"mode\":\"normal\"}},\"unit\":\"none\"}},\"gridPos\":{\"h\":7,\"w\":12,\"x\":0,\"y\":1},\"id\":2,\"options\":{\"legend\":{\"showLegend\":false},\"tooltip\":{\"mode\":\"multi\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"sum(alertmanager_alerts{namespace=~\\\"$namespace\\\",service=~\\\"$service\\\"}) by (namespace,service,instance)\",\"intervalFactor\":2,\"legendFormat\":\"{{instance}}\"}],\"title\":\"Alerts\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"description\":\"rate of successful and invalid alerts received by the Alertmanager\",\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"stacking\":{\"mode\":\"normal\"}},\"unit\":\"ops\"}},\"gridPos\":{\"h\":7,\"w\":12,\"x\":12,\"y\":1},\"id\":3,\"options\":{\"legend\":{\"showLegend\":false},\"tooltip\":{\"mode\":\"multi\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"sum(rate(alertmanager_alerts_received_total{namespace=~\\\"$namespace\\\",service=~\\\"$service\\\"}[$__rate_interval])) by (namespace,service,instance)\",\"intervalFactor\":2,\"legendFormat\":\"{{instance}} Received\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"sum(rate(alertmanager_alerts_invalid_total{namespace=~\\\"$namespace\\\",service=~\\\"$service\\\"}[$__rate_interval])) by (namespace,service,instance)\",\"intervalFactor\":2,\"legendFormat\":\"{{instance}} Invalid\"}],\"title\":\"Alerts receive rate\",\"type\":\"timeseries\"},{\"collapsed\":false,\"gridPos\":{\"h\":1,\"w\":24,\"x\":0,\"y\":8},\"id\":4,\"panels\":[],\"title\":\"Notifications\",\"type\":\"row\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"description\":\"rate of successful and invalid notifications sent by the Alertmanager\",\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"stacking\":{\"mode\":\"normal\"}},\"unit\":\"ops\"}},\"gridPos\":{\"h\":7,\"w\":12,\"x\":0,\"y\":9},\"id\":5,\"options\":{\"legend\":{\"showLegend\":false},\"tooltip\":{\"mode\":\"multi\"}},\"pluginVersion\":\"v11.4.0\",\"repeat\":\"integration\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"sum(rate(alertmanager_notifications_total{namespace=~\\\"$namespace\\\",service=~\\\"$service\\\", integration=\\\"$integration\\\"}[$__rate_interval])) by (integration,namespace,service,instance)\",\"intervalFactor\":2,\"legendFormat\":\"{{instance}} Total\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"sum(rate(alertmanager_notifications_failed_total{namespace=~\\\"$namespace\\\",service=~\\\"$service\\\", integration=\\\"$integration\\\"}[$__rate_interval])) by (integration,namespace,service,instance)\",\"intervalFactor\":2,\"legendFormat\":\"{{instance}} Failed\"}],\"title\":\"$integration: Notifications Send Rate\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"description\":\"latency of notifications sent by the Alertmanager\",\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"stacking\":{\"mode\":\"normal\"}},\"unit\":\"s\"}},\"gridPos\":{\"h\":7,\"w\":12,\"x\":12,\"y\":9},\"id\":6,\"options\":{\"legend\":{\"showLegend\":false},\"tooltip\":{\"mode\":\"multi\"}},\"pluginVersion\":\"v11.4.0\",\"repeat\":\"integration\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"histogram_quantile(0.99,\\n sum(rate(alertmanager_notification_latency_seconds_bucket{namespace=~\\\"$namespace\\\",service=~\\\"$service\\\", integration=\\\"$integration\\\"}[$__rate_interval])) by (le,namespace,service,instance)\\n)\\n\",\"intervalFactor\":2,\"legendFormat\":\"{{instance}} 99th Percentile\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"histogram_quantile(0.50,\\n sum(rate(alertmanager_notification_latency_seconds_bucket{namespace=~\\\"$namespace\\\",service=~\\\"$service\\\", integration=\\\"$integration\\\"}[$__rate_interval])) by (le,namespace,service,instance)\\n)\\n\",\"intervalFactor\":2,\"legendFormat\":\"{{instance}} Median\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"sum(rate(alertmanager_notification_latency_seconds_sum{namespace=~\\\"$namespace\\\",service=~\\\"$service\\\", integration=\\\"$integration\\\"}[$__rate_interval])) by (namespace,service,instance)\\n/\\nsum(rate(alertmanager_notification_latency_seconds_count{namespace=~\\\"$namespace\\\",service=~\\\"$service\\\", integration=\\\"$integration\\\"}[$__rate_interval])) by (namespace,service,instance)\\n\",\"intervalFactor\":2,\"legendFormat\":\"{{instance}} Average\"}],\"title\":\"$integration: Notification Duration\",\"type\":\"timeseries\"}],\"schemaVersion\":39,\"tags\":[\"alertmanager-mixin\"],\"templating\":{\"list\":[{\"current\":{\"selected\":false,\"text\":\"Prometheus\",\"value\":\"Prometheus\"},\"hide\":0,\"label\":\"Data Source\",\"name\":\"datasource\",\"query\":\"prometheus\",\"type\":\"datasource\"},{\"current\":{\"selected\":false,\"text\":\"\",\"value\":\"\"},\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"includeAll\":false,\"label\":\"namespace\",\"name\":\"namespace\",\"query\":\"label_values(alertmanager_alerts, namespace)\",\"refresh\":2,\"sort\":1,\"type\":\"query\"},{\"current\":{\"selected\":false,\"text\":\"\",\"value\":\"\"},\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"includeAll\":false,\"label\":\"service\",\"name\":\"service\",\"query\":\"label_values(alertmanager_alerts, service)\",\"refresh\":2,\"sort\":1,\"type\":\"query\"},{\"current\":{\"selected\":false,\"text\":\"$__all\",\"value\":\"$__all\"},\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"hide\":2,\"includeAll\":true,\"name\":\"integration\",\"query\":\"label_values(alertmanager_notifications_total{integration=~\\\".*\\\"}, integration)\",\"refresh\":2,\"sort\":1,\"type\":\"query\"}]},\"time\":{\"from\":\"now-1h\",\"to\":\"now\"},\"timepicker\":{\"refresh_intervals\":[\"30s\"]},\"timezone\": \"utc\",\"title\":\"Alertmanager / Overview\",\"uid\":\"alertmanager-overview\"}" } }; -export const ConfigMap_KubePrometheusStackApiserver: ConfigMap = { +export const ConfigMap_KubePrometheusStackApiserver: KubernetesResource = { apiVersion: "v1", kind: "ConfigMap", metadata: { @@ -56628,7 +56628,7 @@ export const ConfigMap_KubePrometheusStackApiserver: ConfigMap = { "apiserver.json": "{\"editable\":true,\"links\":[{\"asDropdown\":true,\"includeVars\":true,\"keepTime\":true,\"tags\":[\"kubernetes-mixin\"],\"targetBlank\":false,\"title\":\"Kubernetes\",\"type\":\"dashboards\"}],\"panels\":[{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"description\":\"The SLO (service level objective) and other metrics displayed on this dashboard are for informational purposes only.\",\"gridPos\":{\"h\":2,\"w\":24,\"x\":0,\"y\":0},\"id\":1,\"options\":{\"content\":\"The SLO (service level objective) and other metrics displayed on this dashboard are for informational purposes only.\"},\"pluginVersion\":\"v11.4.0\",\"title\":\"Notice\",\"type\":\"text\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"description\":\"How many percent of requests (both read and write) in 30 days have been answered successfully and fast enough?\",\"fieldConfig\":{\"defaults\":{\"decimals\":3,\"unit\":\"percentunit\"}},\"gridPos\":{\"h\":7,\"w\":8,\"x\":0,\"y\":2},\"id\":2,\"interval\":\"1m\",\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"apiserver_request:availability30d{verb=\\\"all\\\", cluster=\\\"$cluster\\\"}\"}],\"title\":\"Availability (30d) > 99.000%\",\"type\":\"stat\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"description\":\"How much error budget is left looking at our 0.990% availability guarantees?\",\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":100},\"decimals\":3,\"unit\":\"percentunit\"}},\"gridPos\":{\"h\":7,\"w\":16,\"x\":8,\"y\":2},\"id\":3,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"100 * (apiserver_request:availability30d{verb=\\\"all\\\", cluster=\\\"$cluster\\\"} - 0.990000)\",\"legendFormat\":\"errorbudget\"}],\"title\":\"ErrorBudget (30d) > 99.000%\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"description\":\"How many percent of read requests (LIST,GET) in 30 days have been answered successfully and fast enough?\",\"fieldConfig\":{\"defaults\":{\"decimals\":3,\"unit\":\"percentunit\"}},\"gridPos\":{\"h\":7,\"w\":6,\"x\":0,\"y\":9},\"id\":4,\"interval\":\"1m\",\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"apiserver_request:availability30d{verb=\\\"read\\\", cluster=\\\"$cluster\\\"}\"}],\"title\":\"Read Availability (30d)\",\"type\":\"stat\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"description\":\"How many read requests (LIST,GET) per second do the apiservers get by code?\",\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":100,\"stacking\":{\"mode\":\"normal\"}},\"unit\":\"reqps\"},\"overrides\":[{\"matcher\":{\"id\":\"byRegexp\",\"options\":\"/2../i\"},\"properties\":[{\"id\":\"color\",\"value\":\"#56A64B\"}]},{\"matcher\":{\"id\":\"byRegexp\",\"options\":\"/3../i\"},\"properties\":[{\"id\":\"color\",\"value\":\"#F2CC0C\"}]},{\"matcher\":{\"id\":\"byRegexp\",\"options\":\"/4../i\"},\"properties\":[{\"id\":\"color\",\"value\":\"#3274D9\"}]},{\"matcher\":{\"id\":\"byRegexp\",\"options\":\"/5../i\"},\"properties\":[{\"id\":\"color\",\"value\":\"#E02F44\"}]}]},\"gridPos\":{\"h\":7,\"w\":6,\"x\":6,\"y\":9},\"id\":5,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum by (code) (code_resource:apiserver_request_total:rate5m{verb=\\\"read\\\", cluster=\\\"$cluster\\\"})\",\"legendFormat\":\"{{ code }}\"}],\"title\":\"Read SLI - Requests\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"description\":\"How many percent of read requests (LIST,GET) per second are returned with errors (5xx)?\",\"fieldConfig\":{\"defaults\":{\"min\":0,\"unit\":\"percentunit\"}},\"gridPos\":{\"h\":7,\"w\":6,\"x\":12,\"y\":9},\"id\":6,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum by (resource) (code_resource:apiserver_request_total:rate5m{verb=\\\"read\\\",code=~\\\"5..\\\", cluster=\\\"$cluster\\\"}) / sum by (resource) (code_resource:apiserver_request_total:rate5m{verb=\\\"read\\\", cluster=\\\"$cluster\\\"})\",\"legendFormat\":\"{{ resource }}\"}],\"title\":\"Read SLI - Errors\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"description\":\"How many seconds is the 99th percentile for reading (LIST|GET) a given resource?\",\"fieldConfig\":{\"defaults\":{\"unit\":\"s\"}},\"gridPos\":{\"h\":7,\"w\":6,\"x\":18,\"y\":9},\"id\":7,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"cluster_quantile:apiserver_request_sli_duration_seconds:histogram_quantile{verb=\\\"read\\\", cluster=\\\"$cluster\\\"}\",\"legendFormat\":\"{{ resource }}\"}],\"title\":\"Read SLI - Duration\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"description\":\"How many percent of write requests (POST|PUT|PATCH|DELETE) in 30 days have been answered successfully and fast enough?\",\"fieldConfig\":{\"defaults\":{\"decimals\":3,\"unit\":\"percentunit\"}},\"gridPos\":{\"h\":7,\"w\":6,\"x\":0,\"y\":16},\"id\":8,\"interval\":\"1m\",\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"apiserver_request:availability30d{verb=\\\"write\\\", cluster=\\\"$cluster\\\"}\"}],\"title\":\"Write Availability (30d)\",\"type\":\"stat\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"description\":\"How many write requests (POST|PUT|PATCH|DELETE) per second do the apiservers get by code?\",\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":100,\"stacking\":{\"mode\":\"normal\"}},\"unit\":\"reqps\"},\"overrides\":[{\"matcher\":{\"id\":\"byRegexp\",\"options\":\"/2../i\"},\"properties\":[{\"id\":\"color\",\"value\":\"#56A64B\"}]},{\"matcher\":{\"id\":\"byRegexp\",\"options\":\"/3../i\"},\"properties\":[{\"id\":\"color\",\"value\":\"#F2CC0C\"}]},{\"matcher\":{\"id\":\"byRegexp\",\"options\":\"/4../i\"},\"properties\":[{\"id\":\"color\",\"value\":\"#3274D9\"}]},{\"matcher\":{\"id\":\"byRegexp\",\"options\":\"/5../i\"},\"properties\":[{\"id\":\"color\",\"value\":\"#E02F44\"}]}]},\"gridPos\":{\"h\":7,\"w\":6,\"x\":6,\"y\":16},\"id\":9,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum by (code) (code_resource:apiserver_request_total:rate5m{verb=\\\"write\\\", cluster=\\\"$cluster\\\"})\",\"legendFormat\":\"{{ code }}\"}],\"title\":\"Write SLI - Requests\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"description\":\"How many percent of write requests (POST|PUT|PATCH|DELETE) per second are returned with errors (5xx)?\",\"fieldConfig\":{\"defaults\":{\"min\":0,\"unit\":\"percentunit\"}},\"gridPos\":{\"h\":7,\"w\":6,\"x\":12,\"y\":16},\"id\":10,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum by (resource) (code_resource:apiserver_request_total:rate5m{verb=\\\"write\\\",code=~\\\"5..\\\", cluster=\\\"$cluster\\\"}) / sum by (resource) (code_resource:apiserver_request_total:rate5m{verb=\\\"write\\\", cluster=\\\"$cluster\\\"})\",\"legendFormat\":\"{{ resource }}\"}],\"title\":\"Write SLI - Errors\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"description\":\"How many seconds is the 99th percentile for writing (POST|PUT|PATCH|DELETE) a given resource?\",\"fieldConfig\":{\"defaults\":{\"unit\":\"s\"}},\"gridPos\":{\"h\":7,\"w\":6,\"x\":18,\"y\":16},\"id\":11,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"cluster_quantile:apiserver_request_sli_duration_seconds:histogram_quantile{verb=\\\"write\\\", cluster=\\\"$cluster\\\"}\",\"legendFormat\":\"{{ resource }}\"}],\"title\":\"Write SLI - Duration\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"min\":0,\"unit\":\"ops\"}},\"gridPos\":{\"h\":7,\"w\":12,\"x\":0,\"y\":23},\"id\":12,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"placement\":\"right\",\"showLegend\":false},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(rate(workqueue_adds_total{job=\\\"apiserver\\\", instance=~\\\"$instance\\\", cluster=\\\"$cluster\\\"}[$__rate_interval])) by (instance, name)\",\"legendFormat\":\"{{instance}} {{name}}\"}],\"title\":\"Work Queue Add Rate\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"min\":0,\"unit\":\"short\"}},\"gridPos\":{\"h\":7,\"w\":12,\"x\":12,\"y\":23},\"id\":13,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"placement\":\"right\",\"showLegend\":false},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(rate(workqueue_depth{job=\\\"apiserver\\\", instance=~\\\"$instance\\\", cluster=\\\"$cluster\\\"}[$__rate_interval])) by (instance, name)\",\"legendFormat\":\"{{instance}} {{name}}\"}],\"title\":\"Work Queue Depth\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"min\":0,\"unit\":\"s\"}},\"gridPos\":{\"h\":7,\"w\":24,\"x\":0,\"y\":30},\"id\":14,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"histogram_quantile(0.99, sum(rate(workqueue_queue_duration_seconds_bucket{job=\\\"apiserver\\\", instance=~\\\"$instance\\\", cluster=\\\"$cluster\\\"}[$__rate_interval])) by (instance, name, le))\",\"legendFormat\":\"{{instance}} {{name}}\"}],\"title\":\"Work Queue Latency\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"unit\":\"bytes\"}},\"gridPos\":{\"h\":7,\"w\":8,\"x\":0,\"y\":37},\"id\":15,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"process_resident_memory_bytes{job=\\\"apiserver\\\",instance=~\\\"$instance\\\", cluster=\\\"$cluster\\\"}\",\"legendFormat\":\"{{instance}}\"}],\"title\":\"Memory\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"min\":0,\"unit\":\"short\"}},\"gridPos\":{\"h\":7,\"w\":8,\"x\":8,\"y\":37},\"id\":16,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"rate(process_cpu_seconds_total{job=\\\"apiserver\\\",instance=~\\\"$instance\\\", cluster=\\\"$cluster\\\"}[$__rate_interval])\",\"legendFormat\":\"{{instance}}\"}],\"title\":\"CPU usage\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"unit\":\"short\"}},\"gridPos\":{\"h\":7,\"w\":8,\"x\":16,\"y\":37},\"id\":17,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"go_goroutines{job=\\\"apiserver\\\",instance=~\\\"$instance\\\", cluster=\\\"$cluster\\\"}\",\"legendFormat\":\"{{instance}}\"}],\"title\":\"Goroutines\",\"type\":\"timeseries\"}],\"refresh\":\"10s\",\"schemaVersion\":39,\"tags\":[\"kubernetes-mixin\"],\"templating\":{\"list\":[{\"current\":{\"selected\":true,\"text\":\"default\",\"value\":\"default\"},\"hide\":0,\"label\":\"Data source\",\"name\":\"datasource\",\"query\":\"prometheus\",\"regex\":\"\",\"type\":\"datasource\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"hide\":2,\"label\":\"cluster\",\"name\":\"cluster\",\"query\":\"label_values(up{job=\\\"apiserver\\\"}, cluster)\",\"refresh\":2,\"sort\":1,\"type\":\"query\",\"allValue\":\".*\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"hide\":0,\"includeAll\":true,\"name\":\"instance\",\"query\":\"label_values(up{job=\\\"apiserver\\\", cluster=\\\"$cluster\\\"}, instance)\",\"refresh\":2,\"sort\":1,\"type\":\"query\"}]},\"time\":{\"from\":\"now-1h\",\"to\":\"now\"},\"timezone\": \"utc\",\"title\":\"Kubernetes / API server\",\"uid\":\"09ec8aa1e996d6ffcd6817bbaff4db1b\"}" } }; -export const ConfigMap_KubePrometheusStackClusterTotal: ConfigMap = { +export const ConfigMap_KubePrometheusStackClusterTotal: KubernetesResource = { apiVersion: "v1", kind: "ConfigMap", metadata: { @@ -56651,7 +56651,7 @@ export const ConfigMap_KubePrometheusStackClusterTotal: ConfigMap = { "cluster-total.json": "{\"editable\":true,\"links\":[{\"asDropdown\":true,\"includeVars\":true,\"keepTime\":true,\"tags\":[\"kubernetes-mixin\"],\"targetBlank\":false,\"title\":\"Kubernetes\",\"type\":\"dashboards\"}],\"panels\":[{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"showPoints\":\"never\"},\"unit\":\"binBps\"}},\"gridPos\":{\"h\":9,\"w\":12,\"x\":0,\"y\":0},\"id\":1,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum by (namespace) (\\n rate(container_network_receive_bytes_total{cluster=\\\"$cluster\\\",namespace!=\\\"\\\"}[$__rate_interval])\\n * on (cluster,namespace,pod) group_left ()\\n topk by (cluster,namespace,pod) (\\n 1,\\n max by (cluster,namespace,pod) (kube_pod_info{host_network=\\\"false\\\"})\\n )\\n)\\n\",\"legendFormat\":\"__auto\"}],\"title\":\"Current Rate of Bytes Received\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"showPoints\":\"never\"},\"unit\":\"binBps\"}},\"gridPos\":{\"h\":9,\"w\":12,\"x\":12,\"y\":0},\"id\":2,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum by (namespace) (\\n rate(container_network_transmit_bytes_total{cluster=\\\"$cluster\\\",namespace!=\\\"\\\"}[$__rate_interval])\\n * on (cluster,namespace,pod) group_left ()\\n topk by (cluster,namespace,pod) (\\n 1,\\n max by (cluster,namespace,pod) (kube_pod_info{host_network=\\\"false\\\"})\\n )\\n)\\n\",\"legendFormat\":\"__auto\"}],\"title\":\"Current Rate of Bytes Transmitted\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"overrides\":[{\"matcher\":{\"id\":\"byRegexp\",\"options\":\"/Bytes/\"},\"properties\":[{\"id\":\"unit\",\"value\":\"binBps\"}]},{\"matcher\":{\"id\":\"byRegexp\",\"options\":\"/Packets/\"},\"properties\":[{\"id\":\"unit\",\"value\":\"pps\"}]},{\"matcher\":{\"id\":\"byName\",\"options\":\"Namespace\"},\"properties\":[{\"id\":\"links\",\"value\":[{\"title\":\"Drill down\",\"url\":\"/d/8b7a8b326d7a6f1f04244066368c67af/kubernetes-networking-namespace-pods?${datasource:queryparam}&var-cluster=${cluster}&var-namespace=${__data.fields.Namespace}\"}]}]}]},\"gridPos\":{\"h\":9,\"w\":24,\"x\":0,\"y\":9},\"id\":3,\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum by (namespace) (\\n rate(container_network_receive_bytes_total{cluster=\\\"$cluster\\\",namespace!=\\\"\\\"}[$__rate_interval])\\n * on (cluster,namespace,pod) group_left ()\\n topk by (cluster,namespace,pod) (\\n 1,\\n max by (cluster,namespace,pod) (kube_pod_info{host_network=\\\"false\\\"})\\n )\\n)\\n\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum by (namespace) (\\n rate(container_network_transmit_bytes_total{cluster=\\\"$cluster\\\",namespace!=\\\"\\\"}[$__rate_interval])\\n * on (cluster,namespace,pod) group_left ()\\n topk by (cluster,namespace,pod) (\\n 1,\\n max by (cluster,namespace,pod) (kube_pod_info{host_network=\\\"false\\\"})\\n )\\n)\\n\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"avg by (namespace) (\\n rate(container_network_receive_bytes_total{cluster=\\\"$cluster\\\",namespace!=\\\"\\\"}[$__rate_interval])\\n * on (cluster,namespace,pod) group_left ()\\n topk by (cluster,namespace,pod) (\\n 1,\\n max by (cluster,namespace,pod) (kube_pod_info{host_network=\\\"false\\\"})\\n )\\n)\\n\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"avg by (namespace) (\\n rate(container_network_transmit_bytes_total{cluster=\\\"$cluster\\\",namespace!=\\\"\\\"}[$__rate_interval])\\n * on (cluster,namespace,pod) group_left ()\\n topk by (cluster,namespace,pod) (\\n 1,\\n max by (cluster,namespace,pod) (kube_pod_info{host_network=\\\"false\\\"})\\n )\\n)\\n\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum by (namespace) (\\n rate(container_network_receive_packets_total{cluster=\\\"$cluster\\\",namespace!=\\\"\\\"}[$__rate_interval])\\n * on (cluster,namespace,pod) group_left ()\\n topk by (cluster,namespace,pod) (\\n 1,\\n max by (cluster,namespace,pod) (kube_pod_info{host_network=\\\"false\\\"})\\n )\\n)\\n\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum by (namespace) (\\n rate(container_network_transmit_packets_total{cluster=\\\"$cluster\\\",namespace!=\\\"\\\"}[$__rate_interval])\\n * on (cluster,namespace,pod) group_left ()\\n topk by (cluster,namespace,pod) (\\n 1,\\n max by (cluster,namespace,pod) (kube_pod_info{host_network=\\\"false\\\"})\\n )\\n)\\n\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum by (namespace) (\\n rate(container_network_receive_packets_dropped_total{cluster=\\\"$cluster\\\",namespace!=\\\"\\\"}[$__rate_interval])\\n * on (cluster,namespace,pod) group_left ()\\n topk by (cluster,namespace,pod) (\\n 1,\\n max by (cluster,namespace,pod) (kube_pod_info{host_network=\\\"false\\\"})\\n )\\n)\\n\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum by (namespace) (\\n rate(container_network_transmit_packets_dropped_total{cluster=\\\"$cluster\\\",namespace!=\\\"\\\"}[$__rate_interval])\\n * on (cluster,namespace,pod) group_left ()\\n topk by (cluster,namespace,pod) (\\n 1,\\n max by (cluster,namespace,pod) (kube_pod_info{host_network=\\\"false\\\"})\\n )\\n)\\n\",\"format\":\"table\",\"instant\":true}],\"title\":\"Current Status\",\"transformations\":[{\"id\":\"joinByField\",\"options\":{\"byField\":\"namespace\",\"mode\":\"outer\"}},{\"id\":\"organize\",\"options\":{\"excludeByName\":{\"Time\":true,\"Time 1\":true,\"Time 2\":true,\"Time 3\":true,\"Time 4\":true,\"Time 5\":true,\"Time 6\":true,\"Time 7\":true,\"Time 8\":true},\"indexByName\":{\"Time 1\":0,\"Time 2\":1,\"Time 3\":2,\"Time 4\":3,\"Time 5\":4,\"Time 6\":5,\"Time 7\":6,\"Time 8\":7,\"Value #A\":9,\"Value #B\":10,\"Value #C\":11,\"Value #D\":12,\"Value #E\":13,\"Value #F\":14,\"Value #G\":15,\"Value #H\":16,\"namespace\":8},\"renameByName\":{\"Value #A\":\"Rx Bytes\",\"Value #B\":\"Tx Bytes\",\"Value #C\":\"Rx Bytes (Avg)\",\"Value #D\":\"Tx Bytes (Avg)\",\"Value #E\":\"Rx Packets\",\"Value #F\":\"Tx Packets\",\"Value #G\":\"Rx Packets Dropped\",\"Value #H\":\"Tx Packets Dropped\",\"namespace\":\"Namespace\"}}}],\"type\":\"table\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"showPoints\":\"never\"},\"unit\":\"binBps\"}},\"gridPos\":{\"h\":9,\"w\":12,\"x\":0,\"y\":18},\"id\":4,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"avg by (namespace) (\\n rate(container_network_receive_bytes_total{cluster=\\\"$cluster\\\",namespace!=\\\"\\\"}[$__rate_interval])\\n * on (cluster,namespace,pod) group_left ()\\n topk by (cluster,namespace,pod) (\\n 1,\\n max by (cluster,namespace,pod) (kube_pod_info{host_network=\\\"false\\\"})\\n )\\n)\\n\",\"legendFormat\":\"__auto\"}],\"title\":\"Average Rate of Bytes Received\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"showPoints\":\"never\"},\"unit\":\"binBps\"}},\"gridPos\":{\"h\":9,\"w\":12,\"x\":12,\"y\":18},\"id\":5,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"avg by (namespace) (\\n rate(container_network_transmit_bytes_total{cluster=\\\"$cluster\\\",namespace!=\\\"\\\"}[$__rate_interval])\\n * on (cluster,namespace,pod) group_left ()\\n topk by (cluster,namespace,pod) (\\n 1,\\n max by (cluster,namespace,pod) (kube_pod_info{host_network=\\\"false\\\"})\\n )\\n)\\n\",\"legendFormat\":\"__auto\"}],\"title\":\"Average Rate of Bytes Transmitted\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"showPoints\":\"never\"},\"unit\":\"binBps\"}},\"gridPos\":{\"h\":9,\"w\":12,\"x\":0,\"y\":27},\"id\":6,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum by (namespace) (\\n rate(container_network_receive_bytes_total{cluster=\\\"$cluster\\\",namespace!=\\\"\\\"}[$__rate_interval])\\n * on (cluster,namespace,pod) group_left ()\\n topk by (cluster,namespace,pod) (\\n 1,\\n max by (cluster,namespace,pod) (kube_pod_info{host_network=\\\"false\\\"})\\n )\\n)\\n\",\"legendFormat\":\"__auto\"}],\"title\":\"Receive Bandwidth\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"showPoints\":\"never\"},\"unit\":\"binBps\"}},\"gridPos\":{\"h\":9,\"w\":12,\"x\":12,\"y\":27},\"id\":7,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum by (namespace) (\\n rate(container_network_transmit_bytes_total{cluster=\\\"$cluster\\\",namespace!=\\\"\\\"}[$__rate_interval])\\n * on (cluster,namespace,pod) group_left ()\\n topk by (cluster,namespace,pod) (\\n 1,\\n max by (cluster,namespace,pod) (kube_pod_info{host_network=\\\"false\\\"})\\n )\\n)\\n\",\"legendFormat\":\"__auto\"}],\"title\":\"Transmit Bandwidth\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"showPoints\":\"never\"},\"unit\":\"pps\"}},\"gridPos\":{\"h\":9,\"w\":12,\"x\":0,\"y\":36},\"id\":8,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum by (namespace) (\\n rate(container_network_receive_packets_total{cluster=\\\"$cluster\\\",namespace!=\\\"\\\"}[$__rate_interval])\\n * on (cluster,namespace,pod) group_left ()\\n topk by (cluster,namespace,pod) (\\n 1,\\n max by (cluster,namespace,pod) (kube_pod_info{host_network=\\\"false\\\"})\\n )\\n)\\n\",\"legendFormat\":\"__auto\"}],\"title\":\"Rate of Received Packets\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"showPoints\":\"never\"},\"unit\":\"pps\"}},\"gridPos\":{\"h\":9,\"w\":12,\"x\":12,\"y\":36},\"id\":9,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum by (namespace) (\\n rate(container_network_transmit_packets_total{cluster=\\\"$cluster\\\",namespace!=\\\"\\\"}[$__rate_interval])\\n * on (cluster,namespace,pod) group_left ()\\n topk by (cluster,namespace,pod) (\\n 1,\\n max by (cluster,namespace,pod) (kube_pod_info{host_network=\\\"false\\\"})\\n )\\n)\\n\",\"legendFormat\":\"__auto\"}],\"title\":\"Rate of Transmitted Packets\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"showPoints\":\"never\"},\"unit\":\"pps\"}},\"gridPos\":{\"h\":9,\"w\":12,\"x\":0,\"y\":45},\"id\":10,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum by (namespace) (\\n rate(container_network_receive_packets_dropped_total{cluster=\\\"$cluster\\\",namespace!=\\\"\\\"}[$__rate_interval])\\n * on (cluster,namespace,pod) group_left ()\\n topk by (cluster,namespace,pod) (\\n 1,\\n max by (cluster,namespace,pod) (kube_pod_info{host_network=\\\"false\\\"})\\n )\\n)\\n\",\"legendFormat\":\"__auto\"}],\"title\":\"Rate of Received Packets Dropped\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"showPoints\":\"never\"},\"unit\":\"pps\"}},\"gridPos\":{\"h\":9,\"w\":12,\"x\":12,\"y\":45},\"id\":11,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum by (namespace) (\\n rate(container_network_transmit_packets_dropped_total{cluster=\\\"$cluster\\\",namespace!=\\\"\\\"}[$__rate_interval])\\n * on (cluster,namespace,pod) group_left ()\\n topk by (cluster,namespace,pod) (\\n 1,\\n max by (cluster,namespace,pod) (kube_pod_info{host_network=\\\"false\\\"})\\n )\\n)\\n\",\"legendFormat\":\"__auto\"}],\"title\":\"Rate of Transmitted Packets Dropped\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"showPoints\":\"never\"},\"unit\":\"percentunit\"}},\"gridPos\":{\"h\":9,\"w\":12,\"x\":0,\"y\":54},\"id\":12,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum by (instance) (\\n rate(node_netstat_Tcp_RetransSegs{cluster=\\\"$cluster\\\"}[$__rate_interval]) / rate(node_netstat_Tcp_OutSegs{cluster=\\\"$cluster\\\"}[$__rate_interval])\\n * on (cluster,namespace,pod) group_left ()\\n topk by (cluster,namespace,pod) (\\n 1,\\n max by (cluster,namespace,pod) (kube_pod_info{host_network=\\\"false\\\"})\\n )\\n)\\n\",\"legendFormat\":\"__auto\"}],\"title\":\"Rate of TCP Retransmits out of all sent segments\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"showPoints\":\"never\"},\"unit\":\"percentunit\"}},\"gridPos\":{\"h\":9,\"w\":12,\"x\":12,\"y\":54},\"id\":13,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum by (instance) (\\n rate(node_netstat_TcpExt_TCPSynRetrans{cluster=\\\"$cluster\\\"}[$__rate_interval]) / rate(node_netstat_Tcp_RetransSegs{cluster=\\\"$cluster\\\"}[$__rate_interval])\\n * on (cluster,namespace,pod) group_left ()\\n topk by (cluster,namespace,pod) (\\n 1,\\n max by (cluster,namespace,pod) (kube_pod_info{host_network=\\\"false\\\"})\\n )\\n)\\n\",\"legendFormat\":\"__auto\"}],\"title\":\"Rate of TCP SYN Retransmits out of all retransmits\",\"type\":\"timeseries\"}],\"refresh\":\"10s\",\"schemaVersion\":39,\"tags\":[\"kubernetes-mixin\"],\"templating\":{\"list\":[{\"current\":{\"selected\":true,\"text\":\"default\",\"value\":\"default\"},\"hide\":0,\"label\":\"Data source\",\"name\":\"datasource\",\"query\":\"prometheus\",\"regex\":\"\",\"type\":\"datasource\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"hide\":2,\"label\":\"cluster\",\"name\":\"cluster\",\"query\":\"label_values(up{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\"}, cluster)\",\"refresh\":2,\"sort\":1,\"type\":\"query\",\"allValue\":\".*\"}]},\"time\":{\"from\":\"now-1h\",\"to\":\"now\"},\"timezone\": \"utc\",\"title\":\"Kubernetes / Networking / Cluster\",\"uid\":\"ff635a025bcfea7bc3dd4f508990a3e9\"}" } }; -export const ConfigMap_KubePrometheusStackControllerManager: ConfigMap = { +export const ConfigMap_KubePrometheusStackControllerManager: KubernetesResource = { apiVersion: "v1", kind: "ConfigMap", metadata: { @@ -56674,7 +56674,7 @@ export const ConfigMap_KubePrometheusStackControllerManager: ConfigMap = { "controller-manager.json": "{\"editable\":true,\"links\":[{\"asDropdown\":true,\"includeVars\":true,\"keepTime\":true,\"tags\":[\"kubernetes-mixin\"],\"targetBlank\":false,\"title\":\"Kubernetes\",\"type\":\"dashboards\"}],\"panels\":[{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"unit\":\"none\"}},\"gridPos\":{\"h\":7,\"w\":4,\"x\":0,\"y\":0},\"id\":1,\"interval\":\"1m\",\"options\":{\"colorMode\":\"none\"},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(up{cluster=\\\"$cluster\\\", job=\\\"kube-controller-manager\\\"})\",\"instant\":true}],\"title\":\"Up\",\"type\":\"stat\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"ops\"}},\"gridPos\":{\"h\":7,\"w\":20,\"x\":4,\"y\":0},\"id\":2,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(rate(workqueue_adds_total{cluster=\\\"$cluster\\\", job=\\\"kube-controller-manager\\\", instance=~\\\"$instance\\\"}[$__rate_interval])) by (cluster, instance, name)\",\"legendFormat\":\"{{cluster}} {{instance}} {{name}}\"}],\"title\":\"Work Queue Add Rate\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"short\"}},\"gridPos\":{\"h\":7,\"w\":24,\"x\":0,\"y\":7},\"id\":3,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(rate(workqueue_depth{cluster=\\\"$cluster\\\", job=\\\"kube-controller-manager\\\", instance=~\\\"$instance\\\"}[$__rate_interval])) by (cluster, instance, name)\",\"legendFormat\":\"{{cluster}} {{instance}} {{name}}\"}],\"title\":\"Work Queue Depth\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"s\"}},\"gridPos\":{\"h\":7,\"w\":24,\"x\":0,\"y\":14},\"id\":4,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"histogram_quantile(0.99, sum(rate(workqueue_queue_duration_seconds_bucket{cluster=\\\"$cluster\\\", job=\\\"kube-controller-manager\\\", instance=~\\\"$instance\\\"}[$__rate_interval])) by (cluster, instance, name, le))\",\"legendFormat\":\"{{cluster}} {{instance}} {{name}}\"}],\"title\":\"Work Queue Latency\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"ops\"}},\"gridPos\":{\"h\":7,\"w\":8,\"x\":0,\"y\":21},\"id\":5,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(rate(rest_client_requests_total{job=\\\"kube-controller-manager\\\", instance=~\\\"$instance\\\",code=~\\\"2..\\\"}[$__rate_interval]))\",\"legendFormat\":\"2xx\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(rate(rest_client_requests_total{job=\\\"kube-controller-manager\\\", instance=~\\\"$instance\\\",code=~\\\"3..\\\"}[$__rate_interval]))\",\"legendFormat\":\"3xx\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(rate(rest_client_requests_total{job=\\\"kube-controller-manager\\\", instance=~\\\"$instance\\\",code=~\\\"4..\\\"}[$__rate_interval]))\",\"legendFormat\":\"4xx\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(rate(rest_client_requests_total{job=\\\"kube-controller-manager\\\", instance=~\\\"$instance\\\",code=~\\\"5..\\\"}[$__rate_interval]))\",\"legendFormat\":\"5xx\"}],\"title\":\"Kube API Request Rate\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"s\"}},\"gridPos\":{\"h\":7,\"w\":16,\"x\":8,\"y\":21},\"id\":6,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"histogram_quantile(0.99, sum(rate(rest_client_request_duration_seconds_bucket{cluster=\\\"$cluster\\\", job=\\\"kube-controller-manager\\\", instance=~\\\"$instance\\\", verb=\\\"POST\\\"}[$__rate_interval])) by (verb, le))\",\"legendFormat\":\"{{verb}}\"}],\"title\":\"Post Request Latency 99th Quantile\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"s\"}},\"gridPos\":{\"h\":7,\"w\":24,\"x\":0,\"y\":28},\"id\":7,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"histogram_quantile(0.99, sum(rate(rest_client_request_duration_seconds_bucket{cluster=\\\"$cluster\\\", job=\\\"kube-controller-manager\\\", instance=~\\\"$instance\\\", verb=\\\"GET\\\"}[$__rate_interval])) by (verb, le))\",\"legendFormat\":\"{{verb}}\"}],\"title\":\"Get Request Latency 99th Quantile\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"bytes\"}},\"gridPos\":{\"h\":7,\"w\":8,\"x\":0,\"y\":35},\"id\":8,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"process_resident_memory_bytes{cluster=\\\"$cluster\\\", job=\\\"kube-controller-manager\\\",instance=~\\\"$instance\\\"}\",\"legendFormat\":\"{{instance}}\"}],\"title\":\"Memory\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"short\"}},\"gridPos\":{\"h\":7,\"w\":8,\"x\":8,\"y\":35},\"id\":9,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"rate(process_cpu_seconds_total{cluster=\\\"$cluster\\\", job=\\\"kube-controller-manager\\\",instance=~\\\"$instance\\\"}[$__rate_interval])\",\"legendFormat\":\"{{instance}}\"}],\"title\":\"CPU usage\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"short\"}},\"gridPos\":{\"h\":7,\"w\":8,\"x\":16,\"y\":35},\"id\":10,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"go_goroutines{cluster=\\\"$cluster\\\", job=\\\"kube-controller-manager\\\",instance=~\\\"$instance\\\"}\",\"legendFormat\":\"{{instance}}\"}],\"title\":\"Goroutines\",\"type\":\"timeseries\"}],\"refresh\":\"10s\",\"schemaVersion\":39,\"tags\":[\"kubernetes-mixin\"],\"templating\":{\"list\":[{\"current\":{\"selected\":true,\"text\":\"default\",\"value\":\"default\"},\"hide\":0,\"label\":\"Data source\",\"name\":\"datasource\",\"query\":\"prometheus\",\"regex\":\"\",\"type\":\"datasource\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"hide\":2,\"label\":\"cluster\",\"name\":\"cluster\",\"query\":\"label_values(up{job=\\\"kube-controller-manager\\\"}, cluster)\",\"refresh\":2,\"sort\":1,\"type\":\"query\",\"allValue\":\".*\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"hide\":0,\"includeAll\":true,\"label\":\"instance\",\"name\":\"instance\",\"query\":\"label_values(up{cluster=\\\"$cluster\\\", job=\\\"kube-controller-manager\\\"}, instance)\",\"refresh\":2,\"sort\":1,\"type\":\"query\"}]},\"time\":{\"from\":\"now-1h\",\"to\":\"now\"},\"timezone\": \"utc\",\"title\":\"Kubernetes / Controller Manager\",\"uid\":\"72e0e05bef5099e5f049b05fdc429ed4\"}" } }; -export const ConfigMap_KubePrometheusStackEtcd: ConfigMap = { +export const ConfigMap_KubePrometheusStackEtcd: KubernetesResource = { apiVersion: "v1", kind: "ConfigMap", metadata: { @@ -56697,7 +56697,7 @@ export const ConfigMap_KubePrometheusStackEtcd: ConfigMap = { "etcd.json": "{\"description\":\"etcd sample Grafana dashboard with Prometheus\",\"panels\":[{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"gridPos\":{\"h\":7,\"w\":6,\"x\":0,\"y\":0},\"id\":1,\"interval\":\"1m\",\"options\":{\"colorMode\":\"none\",\"graphMode\":\"none\",\"reduceOptions\":{\"calcs\":[\"lastNotNull\"]}},\"pluginVersion\":\"v10.0.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"sum(etcd_server_has_leader{job=~\\\".*etcd.*\\\", job=\\\"$cluster\\\"})\",\"legendFormat\":\"{{cluster}} - {{namespace}}\\n\"}],\"title\":\"Up\",\"type\":\"stat\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":0,\"lineWidth\":2,\"showPoints\":\"never\"},\"unit\":\"ops\"}},\"gridPos\":{\"h\":7,\"w\":10,\"x\":6,\"y\":0},\"id\":2,\"interval\":\"1m\",\"pluginVersion\":\"v10.0.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"sum(rate(grpc_server_started_total{job=~\\\".*etcd.*\\\", job=\\\"$cluster\\\",grpc_type=\\\"unary\\\"}[$__rate_interval]))\",\"legendFormat\":\"RPC rate\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"sum(rate(grpc_server_handled_total{job=~\\\".*etcd.*\\\", job=\\\"$cluster\\\",grpc_type=\\\"unary\\\",grpc_code=~\\\"Unknown|FailedPrecondition|ResourceExhausted|Internal|Unavailable|DataLoss|DeadlineExceeded\\\"}[$__rate_interval]))\",\"legendFormat\":\"RPC failed rate\"}],\"title\":\"RPC rate\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":0,\"lineWidth\":2,\"showPoints\":\"never\"}}},\"gridPos\":{\"h\":7,\"w\":8,\"x\":16,\"y\":0},\"id\":3,\"interval\":\"1m\",\"pluginVersion\":\"v10.0.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"sum(grpc_server_started_total{job=~\\\".*etcd.*\\\",job=\\\"$cluster\\\",grpc_service=\\\"etcdserverpb.Watch\\\",grpc_type=\\\"bidi_stream\\\"}) - sum(grpc_server_handled_total{job=\\\"$cluster\\\",grpc_service=\\\"etcdserverpb.Watch\\\",grpc_type=\\\"bidi_stream\\\"})\",\"legendFormat\":\"Watch streams\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"sum(grpc_server_started_total{job=~\\\".*etcd.*\\\",job=\\\"$cluster\\\",grpc_service=\\\"etcdserverpb.Lease\\\",grpc_type=\\\"bidi_stream\\\"}) - sum(grpc_server_handled_total{job=\\\"$cluster\\\",grpc_service=\\\"etcdserverpb.Lease\\\",grpc_type=\\\"bidi_stream\\\"})\",\"legendFormat\":\"Lease streams\"}],\"title\":\"Active streams\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":0,\"lineWidth\":2,\"showPoints\":\"never\"},\"unit\":\"bytes\"}},\"gridPos\":{\"h\":7,\"w\":8,\"x\":0,\"y\":25},\"id\":4,\"interval\":\"1m\",\"pluginVersion\":\"v10.0.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"etcd_mvcc_db_total_size_in_bytes{job=~\\\".*etcd.*\\\", job=\\\"$cluster\\\"}\",\"legendFormat\":\"{{instance}} DB size\"}],\"title\":\"DB size\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":0,\"lineWidth\":2,\"showPoints\":\"never\"},\"unit\":\"s\"}},\"gridPos\":{\"h\":7,\"w\":8,\"x\":8,\"y\":25},\"id\":5,\"interval\":\"1m\",\"pluginVersion\":\"v10.0.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"histogram_quantile(0.99, sum(rate(etcd_disk_wal_fsync_duration_seconds_bucket{job=~\\\".*etcd.*\\\", job=\\\"$cluster\\\"}[$__rate_interval])) by (instance, le))\",\"legendFormat\":\"{{instance}} WAL fsync\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"histogram_quantile(0.99, sum(rate(etcd_disk_backend_commit_duration_seconds_bucket{job=~\\\".*etcd.*\\\", job=\\\"$cluster\\\"}[$__rate_interval])) by (instance, le))\",\"legendFormat\":\"{{instance}} DB fsync\"}],\"title\":\"Disk sync duration\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":0,\"lineWidth\":2,\"showPoints\":\"never\"},\"unit\":\"bytes\"}},\"gridPos\":{\"h\":7,\"w\":8,\"x\":16,\"y\":25},\"id\":6,\"interval\":\"1m\",\"pluginVersion\":\"v10.0.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"process_resident_memory_bytes{job=~\\\".*etcd.*\\\", job=\\\"$cluster\\\"}\",\"legendFormat\":\"{{instance}} resident memory\"}],\"title\":\"Memory\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":0,\"lineWidth\":2,\"showPoints\":\"never\"},\"unit\":\"Bps\"}},\"gridPos\":{\"h\":7,\"w\":6,\"x\":0,\"y\":50},\"id\":7,\"interval\":\"1m\",\"pluginVersion\":\"v10.0.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"rate(etcd_network_client_grpc_received_bytes_total{job=~\\\".*etcd.*\\\", job=\\\"$cluster\\\"}[$__rate_interval])\",\"legendFormat\":\"{{instance}} client traffic in\"}],\"title\":\"Client traffic in\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":0,\"lineWidth\":2,\"showPoints\":\"never\"},\"unit\":\"Bps\"}},\"gridPos\":{\"h\":7,\"w\":6,\"x\":6,\"y\":50},\"id\":8,\"interval\":\"1m\",\"pluginVersion\":\"v10.0.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"rate(etcd_network_client_grpc_sent_bytes_total{job=~\\\".*etcd.*\\\", job=\\\"$cluster\\\"}[$__rate_interval])\",\"legendFormat\":\"{{instance}} client traffic out\"}],\"title\":\"Client traffic out\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":0,\"lineWidth\":2,\"showPoints\":\"never\"},\"unit\":\"Bps\"}},\"gridPos\":{\"h\":7,\"w\":6,\"x\":12,\"y\":50},\"id\":9,\"interval\":\"1m\",\"pluginVersion\":\"v10.0.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"sum(rate(etcd_network_peer_received_bytes_total{job=~\\\".*etcd.*\\\", job=\\\"$cluster\\\"}[$__rate_interval])) by (instance)\",\"legendFormat\":\"{{instance}} peer traffic in\"}],\"title\":\"Peer traffic in\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":0,\"lineWidth\":2,\"showPoints\":\"never\"},\"unit\":\"Bps\"}},\"gridPos\":{\"h\":7,\"w\":6,\"x\":18,\"y\":50},\"id\":10,\"interval\":\"1m\",\"pluginVersion\":\"v10.0.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"sum(rate(etcd_network_peer_sent_bytes_total{job=~\\\".*etcd.*\\\", job=\\\"$cluster\\\"}[$__rate_interval])) by (instance)\",\"legendFormat\":\"{{instance}} peer traffic out\"}],\"title\":\"Peer traffic out\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":0,\"lineWidth\":2,\"showPoints\":\"never\"}}},\"gridPos\":{\"h\":7,\"w\":8,\"x\":0,\"y\":75},\"id\":11,\"interval\":\"1m\",\"pluginVersion\":\"v10.0.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"changes(etcd_server_leader_changes_seen_total{job=~\\\".*etcd.*\\\", job=\\\"$cluster\\\"}[1d])\",\"legendFormat\":\"{{instance}} total leader elections per day\"}],\"title\":\"Raft proposals\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":0,\"lineWidth\":2,\"showPoints\":\"never\"}}},\"gridPos\":{\"h\":7,\"w\":8,\"x\":8,\"y\":75},\"id\":12,\"interval\":\"1m\",\"pluginVersion\":\"v10.0.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"changes(etcd_server_leader_changes_seen_total{job=~\\\".*etcd.*\\\", job=\\\"$cluster\\\"}[1d])\",\"legendFormat\":\"{{instance}} total leader elections per day\"}],\"title\":\"Total leader elections per day\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":0,\"lineWidth\":2,\"showPoints\":\"never\"},\"unit\":\"s\"}},\"gridPos\":{\"h\":7,\"w\":8,\"x\":16,\"y\":75},\"id\":13,\"interval\":\"1m\",\"pluginVersion\":\"v10.0.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"histogram_quantile(0.99, sum by (instance, le) (rate(etcd_network_peer_round_trip_time_seconds_bucket{job=~\\\".*etcd.*\\\", job=\\\"$cluster\\\"}[$__rate_interval])))\",\"legendFormat\":\"{{instance}} peer round trip time\"}],\"title\":\"Peer round trip time\",\"type\":\"timeseries\"}],\"refresh\":\"10s\",\"schemaVersion\":36,\"tags\":[\"etcd-mixin\"],\"templating\":{\"list\":[{\"label\":\"Data Source\",\"name\":\"datasource\",\"query\":\"prometheus\",\"type\":\"datasource\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"label\":\"cluster\",\"name\":\"cluster\",\"query\":\"label_values(etcd_server_has_leader{job=~\\\".*etcd.*\\\"}, job)\",\"refresh\":2,\"type\":\"query\",\"allValue\":\".*\",\"hide\":2}]},\"time\":{\"from\":\"now-15m\",\"to\":\"now\"},\"timezone\": \"utc\",\"title\":\"etcd\",\"uid\":\"c2f4e12cdf69feb95caa41a5a1b423d9\"}" } }; -export const ConfigMap_KubePrometheusStackGrafanaOverview: ConfigMap = { +export const ConfigMap_KubePrometheusStackGrafanaOverview: KubernetesResource = { apiVersion: "v1", kind: "ConfigMap", metadata: { @@ -56720,7 +56720,7 @@ export const ConfigMap_KubePrometheusStackGrafanaOverview: ConfigMap = { "grafana-overview.json": "{\"annotations\":{\"list\":[{\"builtIn\":1,\"datasource\":\"-- Grafana --\",\"enable\":true,\"hide\":true,\"iconColor\":\"rgba(0, 211, 255, 1)\",\"name\":\"Annotations & Alerts\",\"target\":{\"limit\":100,\"matchAny\":false,\"tags\":[],\"type\":\"dashboard\"},\"type\":\"dashboard\"}]},\"editable\":true,\"gnetId\":null,\"graphTooltip\":0,\"id\":3085,\"iteration\":1631554945276,\"links\":[],\"panels\":[{\"datasource\":\"$datasource\",\"fieldConfig\":{\"defaults\":{\"mappings\":[],\"noValue\":\"0\",\"thresholds\":{\"mode\":\"absolute\",\"steps\":[{\"color\":\"green\",\"value\":null},{\"color\":\"red\",\"value\":80}]}},\"overrides\":[]},\"gridPos\":{\"h\":5,\"w\":6,\"x\":0,\"y\":0},\"id\":6,\"options\":{\"colorMode\":\"value\",\"graphMode\":\"area\",\"justifyMode\":\"auto\",\"orientation\":\"auto\",\"reduceOptions\":{\"calcs\":[\"mean\"],\"fields\":\"\",\"values\":false},\"text\":{},\"textMode\":\"auto\"},\"pluginVersion\":\"8.1.3\",\"targets\":[{\"expr\":\"grafana_alerting_result_total{job=~\\\"$job\\\", instance=~\\\"$instance\\\", state=\\\"alerting\\\"}\",\"instant\":true,\"interval\":\"1m\",\"legendFormat\":\"\",\"refId\":\"A\"}],\"timeFrom\":null,\"timeShift\":null,\"title\":\"Firing Alerts\",\"type\":\"stat\"},{\"datasource\":\"$datasource\",\"fieldConfig\":{\"defaults\":{\"mappings\":[],\"thresholds\":{\"mode\":\"absolute\",\"steps\":[{\"color\":\"green\",\"value\":null},{\"color\":\"red\",\"value\":80}]}},\"overrides\":[]},\"gridPos\":{\"h\":5,\"w\":6,\"x\":6,\"y\":0},\"id\":8,\"options\":{\"colorMode\":\"value\",\"graphMode\":\"area\",\"justifyMode\":\"auto\",\"orientation\":\"auto\",\"reduceOptions\":{\"calcs\":[\"mean\"],\"fields\":\"\",\"values\":false},\"text\":{},\"textMode\":\"auto\"},\"pluginVersion\":\"8.1.3\",\"targets\":[{\"expr\":\"sum(grafana_stat_totals_dashboard{job=~\\\"$job\\\", instance=~\\\"$instance\\\"})\",\"interval\":\"1m\",\"legendFormat\":\"\",\"refId\":\"A\"}],\"timeFrom\":null,\"timeShift\":null,\"title\":\"Dashboards\",\"type\":\"stat\"},{\"datasource\":\"$datasource\",\"fieldConfig\":{\"defaults\":{\"custom\":{\"align\":null,\"displayMode\":\"auto\"},\"mappings\":[],\"thresholds\":{\"mode\":\"absolute\",\"steps\":[{\"color\":\"green\",\"value\":null},{\"color\":\"red\",\"value\":80}]}},\"overrides\":[]},\"gridPos\":{\"h\":5,\"w\":12,\"x\":12,\"y\":0},\"id\":10,\"options\":{\"showHeader\":true},\"pluginVersion\":\"8.1.3\",\"targets\":[{\"expr\":\"grafana_build_info{job=~\\\"$job\\\", instance=~\\\"$instance\\\"}\",\"instant\":true,\"interval\":\"1m\",\"legendFormat\":\"\",\"refId\":\"A\"}],\"timeFrom\":null,\"timeShift\":null,\"title\":\"Build Info\",\"transformations\":[{\"id\":\"labelsToFields\",\"options\":{}},{\"id\":\"organize\",\"options\":{\"excludeByName\":{\"Time\":true,\"Value\":true,\"branch\":true,\"container\":true,\"goversion\":true,\"namespace\":true,\"pod\":true,\"revision\":true},\"indexByName\":{\"Time\":7,\"Value\":11,\"branch\":4,\"container\":8,\"edition\":2,\"goversion\":6,\"instance\":1,\"job\":0,\"namespace\":9,\"pod\":10,\"revision\":5,\"version\":3},\"renameByName\":{}}}],\"type\":\"table\"},{\"aliasColors\":{},\"bars\":false,\"dashLength\":10,\"dashes\":false,\"datasource\":\"$datasource\",\"fieldConfig\":{\"defaults\":{\"links\":[]},\"overrides\":[]},\"fill\":1,\"fillGradient\":0,\"gridPos\":{\"h\":8,\"w\":12,\"x\":0,\"y\":5},\"hiddenSeries\":false,\"id\":2,\"legend\":{\"avg\":false,\"current\":false,\"max\":false,\"min\":false,\"show\":true,\"total\":false,\"values\":false},\"lines\":true,\"linewidth\":1,\"nullPointMode\":\"null\",\"options\":{\"alertThreshold\":true},\"percentage\":false,\"pluginVersion\":\"8.1.3\",\"pointradius\":2,\"points\":false,\"renderer\":\"flot\",\"seriesOverrides\":[],\"spaceLength\":10,\"stack\":true,\"steppedLine\":false,\"targets\":[{\"expr\":\"sum by (status_code) (irate(grafana_http_request_duration_seconds_count{job=~\\\"$job\\\", instance=~\\\"$instance\\\"}[1m])) \",\"interval\":\"1m\",\"legendFormat\":\"{{status_code}}\",\"refId\":\"A\"}],\"thresholds\":[],\"timeFrom\":null,\"timeRegions\":[],\"timeShift\":null,\"title\":\"RPS\",\"tooltip\":{\"shared\":true,\"sort\":0,\"value_type\":\"individual\"},\"type\":\"graph\",\"xaxis\":{\"buckets\":null,\"mode\":\"time\",\"name\":null,\"show\":true,\"values\":[]},\"yaxes\":[{\"$$hashKey\":\"object:157\",\"format\":\"reqps\",\"label\":null,\"logBase\":1,\"max\":null,\"min\":null,\"show\":true},{\"$$hashKey\":\"object:158\",\"format\":\"short\",\"label\":null,\"logBase\":1,\"max\":null,\"min\":null,\"show\":false}],\"yaxis\":{\"align\":false,\"alignLevel\":null}},{\"aliasColors\":{},\"bars\":false,\"dashLength\":10,\"dashes\":false,\"datasource\":\"$datasource\",\"fieldConfig\":{\"defaults\":{\"links\":[]},\"overrides\":[]},\"fill\":1,\"fillGradient\":0,\"gridPos\":{\"h\":8,\"w\":12,\"x\":12,\"y\":5},\"hiddenSeries\":false,\"id\":4,\"legend\":{\"avg\":false,\"current\":false,\"max\":false,\"min\":false,\"show\":true,\"total\":false,\"values\":false},\"lines\":true,\"linewidth\":1,\"nullPointMode\":\"null\",\"options\":{\"alertThreshold\":true},\"percentage\":false,\"pluginVersion\":\"8.1.3\",\"pointradius\":2,\"points\":false,\"renderer\":\"flot\",\"seriesOverrides\":[],\"spaceLength\":10,\"stack\":false,\"steppedLine\":false,\"targets\":[{\"exemplar\":true,\"expr\":\"histogram_quantile(0.99, sum(irate(grafana_http_request_duration_seconds_bucket{instance=~\\\"$instance\\\", job=~\\\"$job\\\"}[$__rate_interval])) by (le)) * 1\",\"interval\":\"1m\",\"legendFormat\":\"99th Percentile\",\"refId\":\"A\"},{\"exemplar\":true,\"expr\":\"histogram_quantile(0.50, sum(irate(grafana_http_request_duration_seconds_bucket{instance=~\\\"$instance\\\", job=~\\\"$job\\\"}[$__rate_interval])) by (le)) * 1\",\"interval\":\"1m\",\"legendFormat\":\"50th Percentile\",\"refId\":\"B\"},{\"exemplar\":true,\"expr\":\"sum(irate(grafana_http_request_duration_seconds_sum{instance=~\\\"$instance\\\", job=~\\\"$job\\\"}[$__rate_interval])) * 1 / sum(irate(grafana_http_request_duration_seconds_count{instance=~\\\"$instance\\\", job=~\\\"$job\\\"}[$__rate_interval]))\",\"interval\":\"1m\",\"legendFormat\":\"Average\",\"refId\":\"C\"}],\"thresholds\":[],\"timeFrom\":null,\"timeRegions\":[],\"timeShift\":null,\"title\":\"Request Latency\",\"tooltip\":{\"shared\":true,\"sort\":0,\"value_type\":\"individual\"},\"type\":\"graph\",\"xaxis\":{\"buckets\":null,\"mode\":\"time\",\"name\":null,\"show\":true,\"values\":[]},\"yaxes\":[{\"$$hashKey\":\"object:210\",\"format\":\"ms\",\"label\":null,\"logBase\":1,\"max\":null,\"min\":null,\"show\":true},{\"$$hashKey\":\"object:211\",\"format\":\"short\",\"label\":null,\"logBase\":1,\"max\":null,\"min\":null,\"show\":true}],\"yaxis\":{\"align\":false,\"alignLevel\":null}}],\"schemaVersion\":30,\"tags\":[],\"templating\":{\"list\":[{\"current\":{\"selected\":true,\"text\":\"dev-cortex\",\"value\":\"dev-cortex\"},\"description\":null,\"error\":null,\"hide\":0,\"includeAll\":false,\"label\":null,\"multi\":false,\"name\":\"datasource\",\"options\":[],\"query\":\"prometheus\",\"queryValue\":\"\",\"refresh\":1,\"regex\":\"\",\"skipUrlSync\":false,\"type\":\"datasource\"},{\"allValue\":\".*\",\"current\":{\"selected\":false,\"text\":[\"default/grafana\"],\"value\":[\"default/grafana\"]},\"datasource\":\"$datasource\",\"definition\":\"label_values(grafana_build_info, job)\",\"description\":null,\"error\":null,\"hide\":0,\"includeAll\":true,\"label\":null,\"multi\":true,\"name\":\"job\",\"options\":[],\"query\":{\"query\":\"label_values(grafana_build_info, job)\",\"refId\":\"Billing Admin-job-Variable-Query\"},\"refresh\":1,\"regex\":\"\",\"skipUrlSync\":false,\"sort\":0,\"tagValuesQuery\":\"\",\"tagsQuery\":\"\",\"type\":\"query\",\"useTags\":false},{\"allValue\":\".*\",\"current\":{\"selected\":false,\"text\":\"All\",\"value\":\"$__all\"},\"datasource\":\"$datasource\",\"definition\":\"label_values(grafana_build_info, instance)\",\"description\":null,\"error\":null,\"hide\":0,\"includeAll\":true,\"label\":null,\"multi\":true,\"name\":\"instance\",\"options\":[],\"query\":{\"query\":\"label_values(grafana_build_info, instance)\",\"refId\":\"Billing Admin-instance-Variable-Query\"},\"refresh\":1,\"regex\":\"\",\"skipUrlSync\":false,\"sort\":0,\"tagValuesQuery\":\"\",\"tagsQuery\":\"\",\"type\":\"query\",\"useTags\":false}]},\"time\":{\"from\":\"now-6h\",\"to\":\"now\"},\"timepicker\":{\"refresh_intervals\":[\"10s\",\"30s\",\"1m\",\"5m\",\"15m\",\"30m\",\"1h\",\"2h\",\"1d\"]},\"timezone\": \"utc\",\"title\":\"Grafana Overview\",\"uid\":\"6be0s85Mk\",\"version\":2}" } }; -export const ConfigMap_KubePrometheusStackK8sCoredns: ConfigMap = { +export const ConfigMap_KubePrometheusStackK8sCoredns: KubernetesResource = { apiVersion: "v1", kind: "ConfigMap", metadata: { @@ -56743,7 +56743,7 @@ export const ConfigMap_KubePrometheusStackK8sCoredns: ConfigMap = { "k8s-coredns.json": "{\"annotations\":{\"list\":[{\"builtIn\":1,\"datasource\":{\"type\":\"datasource\",\"uid\":\"grafana\"},\"enable\":true,\"hide\":true,\"iconColor\":\"rgba(0, 211, 255, 1)\",\"name\":\"Annotations & Alerts\",\"type\":\"dashboard\"}]},\"description\":\"A dashboard for the CoreDNS DNS server with updated metrics for version 1.7.0+. Based on the CoreDNS dashboard by buhay.\",\"editable\":true,\"fiscalYearStartMonth\":0,\"gnetId\":12539,\"graphTooltip\":0,\"id\":7,\"links\":[{\"icon\":\"external link\",\"tags\":[],\"targetBlank\":true,\"title\":\"CoreDNS.io\",\"type\":\"link\",\"url\":\"https://coredns.io\"}],\"liveNow\":false,\"panels\":[{\"datasource\":{\"uid\":\"$datasource\"},\"fieldConfig\":{\"defaults\":{\"color\":{\"mode\":\"palette-classic\"},\"custom\":{\"axisBorderShow\":false,\"axisCenteredZero\":false,\"axisColorMode\":\"text\",\"axisLabel\":\"\",\"axisPlacement\":\"auto\",\"barAlignment\":0,\"drawStyle\":\"line\",\"fillOpacity\":10,\"gradientMode\":\"none\",\"hideFrom\":{\"legend\":false,\"tooltip\":false,\"viz\":false},\"insertNulls\":false,\"lineInterpolation\":\"linear\",\"lineWidth\":2,\"pointSize\":5,\"scaleDistribution\":{\"type\":\"linear\"},\"showPoints\":\"never\",\"spanNulls\":true,\"stacking\":{\"group\":\"A\",\"mode\":\"normal\"},\"thresholdsStyle\":{\"mode\":\"off\"}},\"links\":[],\"mappings\":[],\"min\":0,\"thresholds\":{\"mode\":\"absolute\",\"steps\":[{\"color\":\"green\",\"value\":null},{\"color\":\"red\",\"value\":80}]},\"unit\":\"pps\",\"unitScale\":true},\"overrides\":[]},\"gridPos\":{\"h\":7,\"w\":8,\"x\":0,\"y\":0},\"id\":2,\"links\":[],\"options\":{\"legend\":{\"calcs\":[],\"displayMode\":\"list\",\"placement\":\"bottom\",\"showLegend\":true},\"tooltip\":{\"mode\":\"multi\",\"sort\":\"desc\"}},\"pluginVersion\":\"10.3.3\",\"targets\":[{\"datasource\":{\"uid\":\"$datasource\"},\"expr\":\"sum(rate(coredns_dns_request_count_total{job=~\\\"$job\\\",cluster=~\\\"$cluster\\\",instance=~\\\"$instance\\\"}[5m])) by (proto) or\\nsum(rate(coredns_dns_requests_total{job=~\\\"$job\\\",cluster=~\\\"$cluster\\\",instance=~\\\"$instance\\\"}[5m])) by (proto)\",\"format\":\"time_series\",\"interval\":\"1m\",\"intervalFactor\":2,\"legendFormat\":\"{{ proto }}\",\"refId\":\"A\",\"step\":60}],\"title\":\"Requests (total)\",\"type\":\"timeseries\"},{\"datasource\":{\"uid\":\"$datasource\"},\"fieldConfig\":{\"defaults\":{\"color\":{\"mode\":\"palette-classic\"},\"custom\":{\"axisBorderShow\":false,\"axisCenteredZero\":false,\"axisColorMode\":\"text\",\"axisLabel\":\"\",\"axisPlacement\":\"auto\",\"barAlignment\":0,\"drawStyle\":\"line\",\"fillOpacity\":10,\"gradientMode\":\"none\",\"hideFrom\":{\"legend\":false,\"tooltip\":false,\"viz\":false},\"insertNulls\":false,\"lineInterpolation\":\"linear\",\"lineWidth\":2,\"pointSize\":5,\"scaleDistribution\":{\"type\":\"linear\"},\"showPoints\":\"never\",\"spanNulls\":true,\"stacking\":{\"group\":\"A\",\"mode\":\"normal\"},\"thresholdsStyle\":{\"mode\":\"off\"}},\"links\":[],\"mappings\":[],\"min\":0,\"thresholds\":{\"mode\":\"absolute\",\"steps\":[{\"color\":\"green\",\"value\":null},{\"color\":\"red\",\"value\":80}]},\"unit\":\"pps\",\"unitScale\":true},\"overrides\":[]},\"gridPos\":{\"h\":7,\"w\":8,\"x\":8,\"y\":0},\"id\":4,\"links\":[],\"options\":{\"legend\":{\"calcs\":[],\"displayMode\":\"list\",\"placement\":\"bottom\",\"showLegend\":true},\"tooltip\":{\"mode\":\"multi\",\"sort\":\"desc\"}},\"pluginVersion\":\"10.3.3\",\"targets\":[{\"datasource\":{\"uid\":\"$datasource\"},\"expr\":\"sum(rate(coredns_dns_request_type_count_total{job=~\\\"$job\\\",cluster=~\\\"$cluster\\\",instance=~\\\"$instance\\\"}[5m])) by (type) or \\nsum(rate(coredns_dns_requests_total{job=~\\\"$job\\\",cluster=~\\\"$cluster\\\",instance=~\\\"$instance\\\"}[5m])) by (type)\",\"interval\":\"1m\",\"intervalFactor\":2,\"legendFormat\":\"{{ type }}\",\"refId\":\"A\",\"step\":60}],\"title\":\"Requests (by qtype)\",\"type\":\"timeseries\"},{\"datasource\":{\"uid\":\"$datasource\"},\"fieldConfig\":{\"defaults\":{\"color\":{\"mode\":\"palette-classic\"},\"custom\":{\"axisBorderShow\":false,\"axisCenteredZero\":false,\"axisColorMode\":\"text\",\"axisLabel\":\"\",\"axisPlacement\":\"auto\",\"barAlignment\":0,\"drawStyle\":\"line\",\"fillOpacity\":10,\"gradientMode\":\"none\",\"hideFrom\":{\"legend\":false,\"tooltip\":false,\"viz\":false},\"insertNulls\":false,\"lineInterpolation\":\"linear\",\"lineWidth\":2,\"pointSize\":5,\"scaleDistribution\":{\"type\":\"linear\"},\"showPoints\":\"never\",\"spanNulls\":true,\"stacking\":{\"group\":\"A\",\"mode\":\"normal\"},\"thresholdsStyle\":{\"mode\":\"off\"}},\"links\":[],\"mappings\":[],\"min\":0,\"thresholds\":{\"mode\":\"absolute\",\"steps\":[{\"color\":\"green\",\"value\":null},{\"color\":\"red\",\"value\":80}]},\"unit\":\"pps\",\"unitScale\":true},\"overrides\":[]},\"gridPos\":{\"h\":7,\"w\":8,\"x\":16,\"y\":0},\"id\":6,\"links\":[],\"options\":{\"legend\":{\"calcs\":[],\"displayMode\":\"list\",\"placement\":\"bottom\",\"showLegend\":true},\"tooltip\":{\"mode\":\"multi\",\"sort\":\"desc\"}},\"pluginVersion\":\"10.3.3\",\"targets\":[{\"datasource\":{\"uid\":\"$datasource\"},\"expr\":\"sum(rate(coredns_dns_request_count_total{job=~\\\"$job\\\",cluster=~\\\"$cluster\\\",instance=~\\\"$instance\\\"}[5m])) by (zone) or\\nsum(rate(coredns_dns_requests_total{job=~\\\"$job\\\",cluster=~\\\"$cluster\\\",instance=~\\\"$instance\\\"}[5m])) by (zone)\",\"interval\":\"1m\",\"intervalFactor\":2,\"legendFormat\":\"{{ zone }}\",\"refId\":\"A\",\"step\":60}],\"title\":\"Requests (by zone)\",\"type\":\"timeseries\"},{\"datasource\":{\"uid\":\"$datasource\"},\"fieldConfig\":{\"defaults\":{\"color\":{\"mode\":\"palette-classic\"},\"custom\":{\"axisBorderShow\":false,\"axisCenteredZero\":false,\"axisColorMode\":\"text\",\"axisLabel\":\"\",\"axisPlacement\":\"auto\",\"barAlignment\":0,\"drawStyle\":\"line\",\"fillOpacity\":10,\"gradientMode\":\"none\",\"hideFrom\":{\"legend\":false,\"tooltip\":false,\"viz\":false},\"insertNulls\":false,\"lineInterpolation\":\"linear\",\"lineWidth\":2,\"pointSize\":5,\"scaleDistribution\":{\"type\":\"linear\"},\"showPoints\":\"never\",\"spanNulls\":true,\"stacking\":{\"group\":\"A\",\"mode\":\"none\"},\"thresholdsStyle\":{\"mode\":\"off\"}},\"links\":[],\"mappings\":[],\"min\":0,\"thresholds\":{\"mode\":\"absolute\",\"steps\":[{\"color\":\"green\",\"value\":null},{\"color\":\"red\",\"value\":80}]},\"unit\":\"pps\",\"unitScale\":true},\"overrides\":[]},\"gridPos\":{\"h\":7,\"w\":12,\"x\":0,\"y\":7},\"id\":8,\"links\":[],\"options\":{\"legend\":{\"calcs\":[],\"displayMode\":\"list\",\"placement\":\"bottom\",\"showLegend\":true},\"tooltip\":{\"mode\":\"multi\",\"sort\":\"desc\"}},\"pluginVersion\":\"10.3.3\",\"targets\":[{\"datasource\":{\"uid\":\"$datasource\"},\"expr\":\"sum(rate(coredns_dns_request_do_count_total{job=~\\\"$job\\\",cluster=~\\\"$cluster\\\",instance=~\\\"$instance\\\"}[5m])) or\\nsum(rate(coredns_dns_do_requests_total{job=~\\\"$job\\\",cluster=~\\\"$cluster\\\",instance=~\\\"$instance\\\"}[5m]))\",\"interval\":\"1m\",\"intervalFactor\":2,\"legendFormat\":\"DO\",\"refId\":\"A\",\"step\":40},{\"datasource\":{\"uid\":\"$datasource\"},\"expr\":\"sum(rate(coredns_dns_request_count_total{job=~\\\"$job\\\",cluster=~\\\"$cluster\\\",instance=~\\\"$instance\\\"}[5m])) or\\nsum(rate(coredns_dns_requests_total{job=~\\\"$job\\\",cluster=~\\\"$cluster\\\",instance=~\\\"$instance\\\"}[5m]))\",\"interval\":\"1m\",\"intervalFactor\":2,\"legendFormat\":\"total\",\"refId\":\"B\",\"step\":40}],\"title\":\"Requests (DO bit)\",\"type\":\"timeseries\"},{\"datasource\":{\"uid\":\"$datasource\"},\"fieldConfig\":{\"defaults\":{\"color\":{\"mode\":\"palette-classic\"},\"custom\":{\"axisBorderShow\":false,\"axisCenteredZero\":false,\"axisColorMode\":\"text\",\"axisLabel\":\"\",\"axisPlacement\":\"auto\",\"barAlignment\":0,\"drawStyle\":\"line\",\"fillOpacity\":10,\"gradientMode\":\"none\",\"hideFrom\":{\"legend\":false,\"tooltip\":false,\"viz\":false},\"insertNulls\":false,\"lineInterpolation\":\"linear\",\"lineWidth\":2,\"pointSize\":5,\"scaleDistribution\":{\"type\":\"linear\"},\"showPoints\":\"never\",\"spanNulls\":true,\"stacking\":{\"group\":\"A\",\"mode\":\"none\"},\"thresholdsStyle\":{\"mode\":\"off\"}},\"links\":[],\"mappings\":[],\"min\":0,\"thresholds\":{\"mode\":\"absolute\",\"steps\":[{\"color\":\"green\",\"value\":null},{\"color\":\"red\",\"value\":80}]},\"unit\":\"bytes\",\"unitScale\":true},\"overrides\":[{\"matcher\":{\"id\":\"byName\",\"options\":\"tcp:90\"},\"properties\":[{\"id\":\"unit\",\"value\":\"short\"}]},{\"matcher\":{\"id\":\"byName\",\"options\":\"tcp:99 \"},\"properties\":[{\"id\":\"unit\",\"value\":\"short\"}]},{\"matcher\":{\"id\":\"byName\",\"options\":\"tcp:50\"},\"properties\":[{\"id\":\"unit\",\"value\":\"short\"}]}]},\"gridPos\":{\"h\":7,\"w\":6,\"x\":12,\"y\":7},\"id\":10,\"links\":[],\"options\":{\"legend\":{\"calcs\":[],\"displayMode\":\"list\",\"placement\":\"bottom\",\"showLegend\":true},\"tooltip\":{\"mode\":\"multi\",\"sort\":\"none\"}},\"pluginVersion\":\"10.3.3\",\"targets\":[{\"datasource\":{\"uid\":\"$datasource\"},\"expr\":\"histogram_quantile(0.99, (sum(rate(coredns_dns_request_size_bytes{job=~\\\"$job\\\",cluster=~\\\"$cluster\\\",instance=~\\\"$instance\\\",proto=\\\"udp\\\"}[5m])) by (proto)) or (sum(rate(coredns_dns_request_size_bytes_bucket{job=~\\\"$job\\\",cluster=~\\\"$cluster\\\",instance=~\\\"$instance\\\",proto=\\\"udp\\\"}[5m])) by (le,proto)))\",\"interval\":\"1m\",\"intervalFactor\":2,\"legendFormat\":\"{{ proto }}:99 \",\"refId\":\"A\",\"step\":60},{\"datasource\":{\"uid\":\"$datasource\"},\"expr\":\"histogram_quantile(0.90, (sum(rate(coredns_dns_request_size_bytes{job=~\\\"$job\\\",cluster=~\\\"$cluster\\\",instance=~\\\"$instance\\\",proto=\\\"udp\\\"}[5m])) by (proto)) or (sum(rate(coredns_dns_request_size_bytes_bucket{job=~\\\"$job\\\",cluster=~\\\"$cluster\\\",instance=~\\\"$instance\\\",proto=\\\"udp\\\"}[5m])) by (le,proto)))\",\"intervalFactor\":2,\"legendFormat\":\"{{ proto }}:90\",\"refId\":\"B\",\"step\":60},{\"datasource\":{\"uid\":\"$datasource\"},\"expr\":\"histogram_quantile(0.50, (sum(rate(coredns_dns_request_size_bytes{job=~\\\"$job\\\",cluster=~\\\"$cluster\\\",instance=~\\\"$instance\\\",proto=\\\"udp\\\"}[5m])) by (proto)) or (sum(rate(coredns_dns_request_size_bytes_bucket{job=~\\\"$job\\\",cluster=~\\\"$cluster\\\",instance=~\\\"$instance\\\",proto=\\\"udp\\\"}[5m])) by (le,proto)))\",\"intervalFactor\":2,\"legendFormat\":\"{{ proto }}:50\",\"refId\":\"C\",\"step\":60}],\"title\":\"Requests (size, udp)\",\"type\":\"timeseries\"},{\"datasource\":{\"uid\":\"$datasource\"},\"fieldConfig\":{\"defaults\":{\"color\":{\"mode\":\"palette-classic\"},\"custom\":{\"axisBorderShow\":false,\"axisCenteredZero\":false,\"axisColorMode\":\"text\",\"axisLabel\":\"\",\"axisPlacement\":\"auto\",\"barAlignment\":0,\"drawStyle\":\"line\",\"fillOpacity\":10,\"gradientMode\":\"none\",\"hideFrom\":{\"legend\":false,\"tooltip\":false,\"viz\":false},\"insertNulls\":false,\"lineInterpolation\":\"linear\",\"lineWidth\":2,\"pointSize\":5,\"scaleDistribution\":{\"type\":\"linear\"},\"showPoints\":\"never\",\"spanNulls\":true,\"stacking\":{\"group\":\"A\",\"mode\":\"none\"},\"thresholdsStyle\":{\"mode\":\"off\"}},\"links\":[],\"mappings\":[],\"min\":0,\"thresholds\":{\"mode\":\"absolute\",\"steps\":[{\"color\":\"green\",\"value\":null},{\"color\":\"red\",\"value\":80}]},\"unit\":\"bytes\",\"unitScale\":true},\"overrides\":[]},\"gridPos\":{\"h\":7,\"w\":6,\"x\":18,\"y\":7},\"id\":12,\"links\":[],\"options\":{\"legend\":{\"calcs\":[],\"displayMode\":\"list\",\"placement\":\"bottom\",\"showLegend\":true},\"tooltip\":{\"mode\":\"multi\",\"sort\":\"none\"}},\"pluginVersion\":\"10.3.3\",\"targets\":[{\"datasource\":{\"uid\":\"$datasource\"},\"expr\":\"histogram_quantile(0.99, (sum(rate(coredns_dns_request_size_bytes{job=~\\\"$job\\\",cluster=~\\\"$cluster\\\",instance=~\\\"$instance\\\",proto=\\\"tcp\\\"}[5m])) by (proto)) or (sum(rate(coredns_dns_request_size_bytes_bucket{job=~\\\"$job\\\",cluster=~\\\"$cluster\\\",instance=~\\\"$instance\\\",proto=\\\"tcp\\\"}[5m])) by (le,proto)))\",\"format\":\"time_series\",\"interval\":\"1m\",\"intervalFactor\":2,\"legendFormat\":\"{{ proto }}:99 \",\"refId\":\"A\",\"step\":60},{\"datasource\":{\"uid\":\"$datasource\"},\"expr\":\"histogram_quantile(0.90, (sum(rate(coredns_dns_request_size_bytes{job=~\\\"$job\\\",cluster=~\\\"$cluster\\\",instance=~\\\"$instance\\\",proto=\\\"tcp\\\"}[5m])) by (proto)) or (sum(rate(coredns_dns_request_size_bytes_bucket{job=~\\\"$job\\\",cluster=~\\\"$cluster\\\",instance=~\\\"$instance\\\",proto=\\\"tcp\\\"}[5m])) by (le,proto)))\",\"format\":\"time_series\",\"interval\":\"1m\",\"intervalFactor\":2,\"legendFormat\":\"{{ proto }}:90\",\"refId\":\"B\",\"step\":60},{\"datasource\":{\"uid\":\"$datasource\"},\"expr\":\"histogram_quantile(0.50, (sum(rate(coredns_dns_request_size_bytes{job=~\\\"$job\\\",cluster=~\\\"$cluster\\\",instance=~\\\"$instance\\\",proto=\\\"tcp\\\"}[5m])) by (proto)) or (sum(rate(coredns_dns_request_size_bytes_bucket{job=~\\\"$job\\\",cluster=~\\\"$cluster\\\",instance=~\\\"$instance\\\",proto=\\\"tcp\\\"}[5m])) by (le,proto)))\",\"format\":\"time_series\",\"interval\":\"1m\",\"intervalFactor\":2,\"legendFormat\":\"{{ proto }}:50\",\"refId\":\"C\",\"step\":60}],\"title\":\"Requests (size,tcp)\",\"type\":\"timeseries\"},{\"datasource\":{\"uid\":\"$datasource\"},\"fieldConfig\":{\"defaults\":{\"color\":{\"mode\":\"palette-classic\"},\"custom\":{\"axisBorderShow\":false,\"axisCenteredZero\":false,\"axisColorMode\":\"text\",\"axisLabel\":\"\",\"axisPlacement\":\"auto\",\"barAlignment\":0,\"drawStyle\":\"line\",\"fillOpacity\":10,\"gradientMode\":\"none\",\"hideFrom\":{\"legend\":false,\"tooltip\":false,\"viz\":false},\"insertNulls\":false,\"lineInterpolation\":\"linear\",\"lineWidth\":2,\"pointSize\":5,\"scaleDistribution\":{\"type\":\"linear\"},\"showPoints\":\"never\",\"spanNulls\":true,\"stacking\":{\"group\":\"A\",\"mode\":\"normal\"},\"thresholdsStyle\":{\"mode\":\"off\"}},\"links\":[],\"mappings\":[],\"min\":0,\"thresholds\":{\"mode\":\"absolute\",\"steps\":[{\"color\":\"green\",\"value\":null},{\"color\":\"red\",\"value\":80}]},\"unit\":\"pps\",\"unitScale\":true},\"overrides\":[]},\"gridPos\":{\"h\":7,\"w\":12,\"x\":0,\"y\":14},\"id\":14,\"links\":[],\"options\":{\"legend\":{\"calcs\":[],\"displayMode\":\"list\",\"placement\":\"bottom\",\"showLegend\":true},\"tooltip\":{\"mode\":\"multi\",\"sort\":\"desc\"}},\"pluginVersion\":\"10.3.3\",\"targets\":[{\"datasource\":{\"uid\":\"$datasource\"},\"expr\":\"sum(rate(coredns_dns_response_rcode_count_total{job=~\\\"$job\\\",cluster=~\\\"$cluster\\\",instance=~\\\"$instance\\\"}[5m])) by (rcode) or\\nsum(rate(coredns_dns_responses_total{job=~\\\"$job\\\",cluster=~\\\"$cluster\\\",instance=~\\\"$instance\\\"}[5m])) by (rcode)\",\"interval\":\"1m\",\"intervalFactor\":2,\"legendFormat\":\"{{ rcode }}\",\"refId\":\"A\",\"step\":40}],\"title\":\"Responses (by rcode)\",\"type\":\"timeseries\"},{\"datasource\":{\"uid\":\"$datasource\"},\"fieldConfig\":{\"defaults\":{\"color\":{\"mode\":\"palette-classic\"},\"custom\":{\"axisBorderShow\":false,\"axisCenteredZero\":false,\"axisColorMode\":\"text\",\"axisLabel\":\"\",\"axisPlacement\":\"auto\",\"barAlignment\":0,\"drawStyle\":\"line\",\"fillOpacity\":10,\"gradientMode\":\"none\",\"hideFrom\":{\"legend\":false,\"tooltip\":false,\"viz\":false},\"insertNulls\":false,\"lineInterpolation\":\"linear\",\"lineWidth\":2,\"pointSize\":5,\"scaleDistribution\":{\"type\":\"linear\"},\"showPoints\":\"never\",\"spanNulls\":true,\"stacking\":{\"group\":\"A\",\"mode\":\"none\"},\"thresholdsStyle\":{\"mode\":\"off\"}},\"links\":[],\"mappings\":[],\"min\":0,\"thresholds\":{\"mode\":\"absolute\",\"steps\":[{\"color\":\"green\",\"value\":null},{\"color\":\"red\",\"value\":80}]},\"unit\":\"s\",\"unitScale\":true},\"overrides\":[]},\"gridPos\":{\"h\":7,\"w\":12,\"x\":12,\"y\":14},\"id\":32,\"links\":[],\"options\":{\"legend\":{\"calcs\":[],\"displayMode\":\"list\",\"placement\":\"bottom\",\"showLegend\":true},\"tooltip\":{\"mode\":\"multi\",\"sort\":\"none\"}},\"pluginVersion\":\"10.3.3\",\"targets\":[{\"datasource\":{\"uid\":\"$datasource\"},\"expr\":\"histogram_quantile(0.99, (sum(rate(coredns_dns_request_duration_seconds{job=~\\\"$job\\\",cluster=~\\\"$cluster\\\",instance=~\\\"$instance\\\"}[5m])) by (job)) or (sum(rate(coredns_dns_request_duration_seconds_bucket{job=~\\\"$job\\\",cluster=~\\\"$cluster\\\",instance=~\\\"$instance\\\"}[5m])) by (le, job)))\",\"format\":\"time_series\",\"intervalFactor\":2,\"legendFormat\":\"99%\",\"refId\":\"A\",\"step\":40},{\"datasource\":{\"uid\":\"$datasource\"},\"expr\":\"histogram_quantile(0.90, (sum(rate(coredns_dns_request_duration_seconds{job=~\\\"$job\\\",cluster=~\\\"$cluster\\\",instance=~\\\"$instance\\\"}[5m])) by ()) or (sum(rate(coredns_dns_request_duration_seconds_bucket{job=~\\\"$job\\\",cluster=~\\\"$cluster\\\",instance=~\\\"$instance\\\"}[5m])) by (le)))\",\"format\":\"time_series\",\"intervalFactor\":2,\"legendFormat\":\"90%\",\"refId\":\"B\",\"step\":40},{\"datasource\":{\"uid\":\"$datasource\"},\"expr\":\"histogram_quantile(0.50, (sum(rate(coredns_dns_request_duration_seconds{job=~\\\"$job\\\",cluster=~\\\"$cluster\\\",instance=~\\\"$instance\\\"}[5m])) by ()) or (sum(rate(coredns_dns_request_duration_seconds_bucket{job=~\\\"$job\\\",cluster=~\\\"$cluster\\\",instance=~\\\"$instance\\\"}[5m])) by (le)))\",\"format\":\"time_series\",\"intervalFactor\":2,\"legendFormat\":\"50%\",\"refId\":\"C\",\"step\":40}],\"title\":\"Responses (duration)\",\"type\":\"timeseries\"},{\"datasource\":{\"uid\":\"$datasource\"},\"fieldConfig\":{\"defaults\":{\"color\":{\"mode\":\"palette-classic\"},\"custom\":{\"axisBorderShow\":false,\"axisCenteredZero\":false,\"axisColorMode\":\"text\",\"axisLabel\":\"\",\"axisPlacement\":\"auto\",\"barAlignment\":0,\"drawStyle\":\"line\",\"fillOpacity\":10,\"gradientMode\":\"none\",\"hideFrom\":{\"legend\":false,\"tooltip\":false,\"viz\":false},\"insertNulls\":false,\"lineInterpolation\":\"linear\",\"lineWidth\":2,\"pointSize\":5,\"scaleDistribution\":{\"type\":\"linear\"},\"showPoints\":\"never\",\"spanNulls\":true,\"stacking\":{\"group\":\"A\",\"mode\":\"none\"},\"thresholdsStyle\":{\"mode\":\"off\"}},\"links\":[],\"mappings\":[],\"min\":0,\"thresholds\":{\"mode\":\"absolute\",\"steps\":[{\"color\":\"green\",\"value\":null},{\"color\":\"red\",\"value\":80}]},\"unit\":\"bytes\",\"unitScale\":true},\"overrides\":[{\"matcher\":{\"id\":\"byName\",\"options\":\"tcp:50%\"},\"properties\":[{\"id\":\"unit\",\"value\":\"short\"}]},{\"matcher\":{\"id\":\"byName\",\"options\":\"tcp:90%\"},\"properties\":[{\"id\":\"unit\",\"value\":\"short\"}]},{\"matcher\":{\"id\":\"byName\",\"options\":\"tcp:99%\"},\"properties\":[{\"id\":\"unit\",\"value\":\"short\"}]}]},\"gridPos\":{\"h\":7,\"w\":12,\"x\":0,\"y\":21},\"id\":18,\"links\":[],\"options\":{\"legend\":{\"calcs\":[],\"displayMode\":\"list\",\"placement\":\"bottom\",\"showLegend\":true},\"tooltip\":{\"mode\":\"multi\",\"sort\":\"none\"}},\"pluginVersion\":\"10.3.3\",\"targets\":[{\"datasource\":{\"uid\":\"$datasource\"},\"expr\":\"histogram_quantile(0.99, (sum(rate(coredns_dns_response_size_bytes{job=~\\\"$job\\\",cluster=~\\\"$cluster\\\",instance=~\\\"$instance\\\",proto=\\\"udp\\\"}[5m])) by (proto)) or (sum(rate(coredns_dns_response_size_bytes_bucket{job=~\\\"$job\\\",cluster=~\\\"$cluster\\\",instance=~\\\"$instance\\\",proto=\\\"udp\\\"}[5m])) by (le,proto))) \",\"interval\":\"1m\",\"intervalFactor\":2,\"legendFormat\":\"{{ proto }}:99%\",\"refId\":\"A\",\"step\":40},{\"datasource\":{\"uid\":\"$datasource\"},\"expr\":\"histogram_quantile(0.90, (sum(rate(coredns_dns_response_size_bytes{job=~\\\"$job\\\",cluster=~\\\"$cluster\\\",instance=~\\\"$instance\\\",proto=\\\"udp\\\"}[5m])) by (proto)) or (sum(rate(coredns_dns_response_size_bytes_bucket{job=~\\\"$job\\\",cluster=~\\\"$cluster\\\",instance=~\\\"$instance\\\",proto=\\\"udp\\\"}[5m])) by (le,proto))) \",\"interval\":\"1m\",\"intervalFactor\":2,\"legendFormat\":\"{{ proto }}:90%\",\"refId\":\"B\",\"step\":40},{\"datasource\":{\"uid\":\"$datasource\"},\"expr\":\"histogram_quantile(0.50, (sum(rate(coredns_dns_response_size_bytes{job=~\\\"$job\\\",cluster=~\\\"$cluster\\\",instance=~\\\"$instance\\\",proto=\\\"udp\\\"}[5m])) by (proto)) or (sum(rate(coredns_dns_response_size_bytes_bucket{job=~\\\"$job\\\",cluster=~\\\"$cluster\\\",instance=~\\\"$instance\\\",proto=\\\"udp\\\"}[5m])) by (le,proto))) \",\"hide\":false,\"intervalFactor\":2,\"legendFormat\":\"{{ proto }}:50%\",\"metric\":\"\",\"refId\":\"C\",\"step\":40}],\"title\":\"Responses (size, udp)\",\"type\":\"timeseries\"},{\"datasource\":{\"uid\":\"$datasource\"},\"fieldConfig\":{\"defaults\":{\"color\":{\"mode\":\"palette-classic\"},\"custom\":{\"axisBorderShow\":false,\"axisCenteredZero\":false,\"axisColorMode\":\"text\",\"axisLabel\":\"\",\"axisPlacement\":\"auto\",\"barAlignment\":0,\"drawStyle\":\"line\",\"fillOpacity\":10,\"gradientMode\":\"none\",\"hideFrom\":{\"legend\":false,\"tooltip\":false,\"viz\":false},\"insertNulls\":false,\"lineInterpolation\":\"linear\",\"lineWidth\":2,\"pointSize\":5,\"scaleDistribution\":{\"type\":\"linear\"},\"showPoints\":\"never\",\"spanNulls\":true,\"stacking\":{\"group\":\"A\",\"mode\":\"none\"},\"thresholdsStyle\":{\"mode\":\"off\"}},\"links\":[],\"mappings\":[],\"min\":0,\"thresholds\":{\"mode\":\"absolute\",\"steps\":[{\"color\":\"green\",\"value\":null},{\"color\":\"red\",\"value\":80}]},\"unit\":\"bytes\",\"unitScale\":true},\"overrides\":[]},\"gridPos\":{\"h\":7,\"w\":12,\"x\":12,\"y\":21},\"id\":20,\"links\":[],\"options\":{\"legend\":{\"calcs\":[],\"displayMode\":\"list\",\"placement\":\"bottom\",\"showLegend\":true},\"tooltip\":{\"mode\":\"multi\",\"sort\":\"none\"}},\"pluginVersion\":\"10.3.3\",\"targets\":[{\"datasource\":{\"uid\":\"$datasource\"},\"expr\":\"histogram_quantile(0.99, (sum(rate(coredns_dns_response_size_bytes{job=~\\\"$job\\\",cluster=~\\\"$cluster\\\",instance=~\\\"$instance\\\",proto=\\\"tcp\\\"}[5m])) by (proto)) or (sum(rate(coredns_dns_response_size_bytes_bucket{job=~\\\"$job\\\",cluster=~\\\"$cluster\\\",instance=~\\\"$instance\\\",proto=\\\"tcp\\\"}[5m])) by (le,proto))) \",\"format\":\"time_series\",\"intervalFactor\":2,\"legendFormat\":\"{{ proto }}:99%\",\"refId\":\"A\",\"step\":40},{\"datasource\":{\"uid\":\"$datasource\"},\"expr\":\"histogram_quantile(0.90, (sum(rate(coredns_dns_response_size_bytes{job=~\\\"$job\\\",cluster=~\\\"$cluster\\\",instance=~\\\"$instance\\\",proto=\\\"tcp\\\"}[5m])) by (proto)) or (sum(rate(coredns_dns_response_size_bytes_bucket{job=~\\\"$job\\\",cluster=~\\\"$cluster\\\",instance=~\\\"$instance\\\",proto=\\\"tcp\\\"}[5m])) by (le,proto))) \",\"format\":\"time_series\",\"intervalFactor\":2,\"legendFormat\":\"{{ proto }}:90%\",\"refId\":\"B\",\"step\":40},{\"datasource\":{\"uid\":\"$datasource\"},\"expr\":\"histogram_quantile(0.50, (sum(rate(coredns_dns_response_size_bytes{job=~\\\"$job\\\",cluster=~\\\"$cluster\\\",instance=~\\\"$instance\\\",proto=\\\"tcp\\\"}[5m])) by (proto)) or (sum(rate(coredns_dns_response_size_bytes_bucket{job=~\\\"$job\\\",cluster=~\\\"$cluster\\\",instance=~\\\"$instance\\\",proto=\\\"tcp\\\"}[5m])) by (le,proto))) \",\"format\":\"time_series\",\"intervalFactor\":2,\"legendFormat\":\"{{ proto }}:50%\",\"metric\":\"\",\"refId\":\"C\",\"step\":40}],\"title\":\"Responses (size, tcp)\",\"type\":\"timeseries\"},{\"datasource\":{\"uid\":\"$datasource\"},\"fieldConfig\":{\"defaults\":{\"color\":{\"mode\":\"palette-classic\"},\"custom\":{\"axisBorderShow\":false,\"axisCenteredZero\":false,\"axisColorMode\":\"text\",\"axisLabel\":\"\",\"axisPlacement\":\"auto\",\"barAlignment\":0,\"drawStyle\":\"line\",\"fillOpacity\":10,\"gradientMode\":\"none\",\"hideFrom\":{\"legend\":false,\"tooltip\":false,\"viz\":false},\"insertNulls\":false,\"lineInterpolation\":\"linear\",\"lineWidth\":2,\"pointSize\":5,\"scaleDistribution\":{\"type\":\"linear\"},\"showPoints\":\"never\",\"spanNulls\":true,\"stacking\":{\"group\":\"A\",\"mode\":\"normal\"},\"thresholdsStyle\":{\"mode\":\"off\"}},\"links\":[],\"mappings\":[],\"min\":0,\"thresholds\":{\"mode\":\"absolute\",\"steps\":[{\"color\":\"green\",\"value\":null},{\"color\":\"red\",\"value\":80}]},\"unit\":\"decbytes\",\"unitScale\":true},\"overrides\":[]},\"gridPos\":{\"h\":7,\"w\":12,\"x\":0,\"y\":28},\"id\":22,\"links\":[],\"options\":{\"legend\":{\"calcs\":[],\"displayMode\":\"list\",\"placement\":\"bottom\",\"showLegend\":true},\"tooltip\":{\"mode\":\"multi\",\"sort\":\"desc\"}},\"pluginVersion\":\"10.3.3\",\"targets\":[{\"datasource\":{\"uid\":\"$datasource\"},\"expr\":\"sum(coredns_cache_size{job=~\\\"$job\\\",cluster=~\\\"$cluster\\\",instance=~\\\"$instance\\\"}) by (type) or\\nsum(coredns_cache_entries{job=~\\\"$job\\\",cluster=~\\\"$cluster\\\",instance=~\\\"$instance\\\"}) by (type)\",\"interval\":\"1m\",\"intervalFactor\":2,\"legendFormat\":\"{{ type }}\",\"refId\":\"A\",\"step\":40}],\"title\":\"Cache (size)\",\"type\":\"timeseries\"},{\"datasource\":{\"uid\":\"$datasource\"},\"fieldConfig\":{\"defaults\":{\"color\":{\"mode\":\"palette-classic\"},\"custom\":{\"axisBorderShow\":false,\"axisCenteredZero\":false,\"axisColorMode\":\"text\",\"axisLabel\":\"\",\"axisPlacement\":\"auto\",\"barAlignment\":0,\"drawStyle\":\"line\",\"fillOpacity\":10,\"gradientMode\":\"none\",\"hideFrom\":{\"legend\":false,\"tooltip\":false,\"viz\":false},\"insertNulls\":false,\"lineInterpolation\":\"linear\",\"lineWidth\":2,\"pointSize\":5,\"scaleDistribution\":{\"type\":\"linear\"},\"showPoints\":\"never\",\"spanNulls\":true,\"stacking\":{\"group\":\"A\",\"mode\":\"normal\"},\"thresholdsStyle\":{\"mode\":\"off\"}},\"links\":[],\"mappings\":[],\"min\":0,\"thresholds\":{\"mode\":\"absolute\",\"steps\":[{\"color\":\"green\",\"value\":null},{\"color\":\"red\",\"value\":80}]},\"unit\":\"pps\",\"unitScale\":true},\"overrides\":[]},\"gridPos\":{\"h\":7,\"w\":12,\"x\":12,\"y\":28},\"id\":24,\"links\":[],\"options\":{\"legend\":{\"calcs\":[],\"displayMode\":\"list\",\"placement\":\"bottom\",\"showLegend\":true},\"tooltip\":{\"mode\":\"multi\",\"sort\":\"desc\"}},\"pluginVersion\":\"10.3.3\",\"targets\":[{\"datasource\":{\"uid\":\"$datasource\"},\"expr\":\"sum(rate(coredns_cache_hits_total{job=~\\\"$job\\\",cluster=~\\\"$cluster\\\",instance=~\\\"$instance\\\"}[5m])) by (type)\",\"hide\":false,\"intervalFactor\":2,\"legendFormat\":\"hits:{{ type }}\",\"refId\":\"A\",\"step\":40},{\"datasource\":{\"uid\":\"$datasource\"},\"expr\":\"sum(rate(coredns_cache_misses_total{job=~\\\"$job\\\",cluster=~\\\"$cluster\\\",instance=~\\\"$instance\\\"}[5m])) by (type)\",\"hide\":false,\"intervalFactor\":2,\"legendFormat\":\"misses\",\"refId\":\"B\",\"step\":40}],\"title\":\"Cache (hitrate)\",\"type\":\"timeseries\"}],\"refresh\":\"10s\",\"schemaVersion\":39,\"tags\":[\"dns\",\"coredns\"],\"templating\":{\"list\":[{\"current\":{},\"hide\":0,\"includeAll\":false,\"multi\":false,\"name\":\"datasource\",\"options\":[],\"query\":\"prometheus\",\"queryValue\":\"\",\"refresh\":1,\"regex\":\"\",\"skipUrlSync\":false,\"type\":\"datasource\"},{\"allValue\":\".*\",\"current\":{\"selected\":false,\"text\":\"All\",\"value\":\"$__all\"},\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"definition\":\"label_values(coredns_dns_requests_total, cluster)\",\"hide\":2,\"includeAll\":true,\"label\":\"Cluster\",\"multi\":false,\"name\":\"cluster\",\"options\":[],\"query\":\"label_values(coredns_dns_requests_total, cluster)\",\"refresh\":2,\"regex\":\"\",\"skipUrlSync\":false,\"sort\":1,\"tagValuesQuery\":\"\",\"tagsQuery\":\"\",\"type\":\"query\",\"useTags\":false},{\"allValue\":\".*\",\"current\":{\"selected\":false,\"text\":\"All\",\"value\":\"$__all\"},\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"definition\":\"label_values(coredns_dns_requests_total{cluster=~\\\"$cluster\\\"},job)\",\"hide\":0,\"includeAll\":true,\"label\":\"Job\",\"multi\":false,\"name\":\"job\",\"options\":[],\"query\":{\"qryType\":1,\"query\":\"label_values(coredns_dns_requests_total{cluster=~\\\"$cluster\\\"},job)\",\"refId\":\"PrometheusVariableQueryEditor-VariableQuery\"},\"refresh\":2,\"regex\":\"\",\"skipUrlSync\":false,\"sort\":1,\"type\":\"query\"},{\"allValue\":\".*\",\"current\":{\"selected\":false,\"text\":\"All\",\"value\":\"$__all\"},\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"definition\":\"label_values(coredns_dns_requests_total{job=~\\\"$job\\\",cluster=~\\\"$cluster\\\"}, instance)\",\"hide\":0,\"includeAll\":true,\"label\":\"Instance\",\"multi\":false,\"name\":\"instance\",\"options\":[],\"query\":\"label_values(coredns_dns_requests_total{job=~\\\"$job\\\",cluster=~\\\"$cluster\\\"}, instance)\",\"refresh\":2,\"regex\":\"\",\"skipUrlSync\":false,\"sort\":3,\"tagValuesQuery\":\"\",\"tagsQuery\":\"\",\"type\":\"query\",\"useTags\":false}]},\"time\":{\"from\":\"now-3h\",\"to\":\"now\"},\"timepicker\":{\"refresh_intervals\":[\"10s\",\"30s\",\"1m\",\"5m\",\"15m\",\"30m\",\"1h\",\"2h\",\"1d\"]},\"timezone\": \"utc\",\"title\":\"CoreDNS\",\"uid\":\"vkQ0UHxik\",\"version\":3,\"weekStart\":\"\"}" } }; -export const ConfigMap_KubePrometheusStackK8sResourcesCluster: ConfigMap = { +export const ConfigMap_KubePrometheusStackK8sResourcesCluster: KubernetesResource = { apiVersion: "v1", kind: "ConfigMap", metadata: { @@ -56766,7 +56766,7 @@ export const ConfigMap_KubePrometheusStackK8sResourcesCluster: ConfigMap = { "k8s-resources-cluster.json": "{\"editable\":true,\"links\":[{\"asDropdown\":true,\"includeVars\":true,\"keepTime\":true,\"tags\":[\"kubernetes-mixin\"],\"targetBlank\":false,\"title\":\"Kubernetes\",\"type\":\"dashboards\"}],\"panels\":[{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"unit\":\"percentunit\"}},\"gridPos\":{\"h\":3,\"w\":4,\"x\":0,\"y\":0},\"id\":1,\"interval\":\"1m\",\"options\":{\"colorMode\":\"none\"},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"cluster:node_cpu:ratio_rate5m{cluster=\\\"$cluster\\\"}\",\"instant\":true}],\"title\":\"CPU Utilisation\",\"type\":\"stat\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"unit\":\"percentunit\"}},\"gridPos\":{\"h\":3,\"w\":4,\"x\":4,\"y\":0},\"id\":2,\"interval\":\"1m\",\"options\":{\"colorMode\":\"none\"},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(namespace_cpu:kube_pod_container_resource_requests:sum{cluster=\\\"$cluster\\\"}) / sum(kube_node_status_allocatable{job=\\\"kube-state-metrics\\\",resource=\\\"cpu\\\",cluster=\\\"$cluster\\\"})\",\"instant\":true}],\"title\":\"CPU Requests Commitment\",\"type\":\"stat\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"unit\":\"percentunit\"}},\"gridPos\":{\"h\":3,\"w\":4,\"x\":8,\"y\":0},\"id\":3,\"interval\":\"1m\",\"options\":{\"colorMode\":\"none\"},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(namespace_cpu:kube_pod_container_resource_limits:sum{cluster=\\\"$cluster\\\"}) / sum(kube_node_status_allocatable{job=\\\"kube-state-metrics\\\",resource=\\\"cpu\\\",cluster=\\\"$cluster\\\"})\",\"instant\":true}],\"title\":\"CPU Limits Commitment\",\"type\":\"stat\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"unit\":\"percentunit\"}},\"gridPos\":{\"h\":3,\"w\":4,\"x\":12,\"y\":0},\"id\":4,\"interval\":\"1m\",\"options\":{\"colorMode\":\"none\"},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"1 - sum(:node_memory_MemAvailable_bytes:sum{cluster=\\\"$cluster\\\"}) / sum(node_memory_MemTotal_bytes{job=\\\"node-exporter\\\",cluster=\\\"$cluster\\\"})\",\"instant\":true}],\"title\":\"Memory Utilisation\",\"type\":\"stat\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"unit\":\"percentunit\"}},\"gridPos\":{\"h\":3,\"w\":4,\"x\":16,\"y\":0},\"id\":5,\"interval\":\"1m\",\"options\":{\"colorMode\":\"none\"},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(namespace_memory:kube_pod_container_resource_requests:sum{cluster=\\\"$cluster\\\"}) / sum(kube_node_status_allocatable{job=\\\"kube-state-metrics\\\",resource=\\\"memory\\\",cluster=\\\"$cluster\\\"})\",\"instant\":true}],\"title\":\"Memory Requests Commitment\",\"type\":\"stat\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"unit\":\"percentunit\"}},\"gridPos\":{\"h\":3,\"w\":4,\"x\":20,\"y\":0},\"id\":6,\"interval\":\"1m\",\"options\":{\"colorMode\":\"none\"},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(namespace_memory:kube_pod_container_resource_limits:sum{cluster=\\\"$cluster\\\"}) / sum(kube_node_status_allocatable{job=\\\"kube-state-metrics\\\",resource=\\\"memory\\\",cluster=\\\"$cluster\\\"})\",\"instant\":true}],\"title\":\"Memory Limits Commitment\",\"type\":\"stat\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true}}},\"gridPos\":{\"h\":6,\"w\":24,\"x\":0,\"y\":6},\"id\":7,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(node_namespace_pod_container:container_cpu_usage_seconds_total:sum_rate5m{cluster=\\\"$cluster\\\"}) by (namespace)\",\"legendFormat\":\"__auto\"}],\"title\":\"CPU Usage\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"overrides\":[{\"matcher\":{\"id\":\"byRegexp\",\"options\":\"/%/\"},\"properties\":[{\"id\":\"unit\",\"value\":\"percentunit\"}]},{\"matcher\":{\"id\":\"byName\",\"options\":\"Namespace\"},\"properties\":[{\"id\":\"links\",\"value\":[{\"title\":\"Drill down to pods\",\"url\":\"/d/85a562078cdf77779eaa1add43ccec1e/k8s-resources-namespace?${datasource:queryparam}&var-cluster=$cluster&var-namespace=${__data.fields.Namespace}\"}]}]}]},\"gridPos\":{\"h\":6,\"w\":24,\"x\":0,\"y\":12},\"id\":8,\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(kube_pod_owner{job=\\\"kube-state-metrics\\\", cluster=\\\"$cluster\\\"}) by (namespace)\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"count(avg(namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\"}) by (workload, namespace)) by (namespace)\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(node_namespace_pod_container:container_cpu_usage_seconds_total:sum_rate5m{cluster=\\\"$cluster\\\"}) by (namespace)\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(namespace_cpu:kube_pod_container_resource_requests:sum{cluster=\\\"$cluster\\\"}) by (namespace)\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(node_namespace_pod_container:container_cpu_usage_seconds_total:sum_rate5m{cluster=\\\"$cluster\\\"}) by (namespace) / sum(namespace_cpu:kube_pod_container_resource_requests:sum{cluster=\\\"$cluster\\\"}) by (namespace)\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(namespace_cpu:kube_pod_container_resource_limits:sum{cluster=\\\"$cluster\\\"}) by (namespace)\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(node_namespace_pod_container:container_cpu_usage_seconds_total:sum_rate5m{cluster=\\\"$cluster\\\"}) by (namespace) / sum(namespace_cpu:kube_pod_container_resource_limits:sum{cluster=\\\"$cluster\\\"}) by (namespace)\",\"format\":\"table\",\"instant\":true}],\"title\":\"CPU Quota\",\"transformations\":[{\"id\":\"joinByField\",\"options\":{\"byField\":\"namespace\",\"mode\":\"outer\"}},{\"id\":\"organize\",\"options\":{\"excludeByName\":{\"Time\":true,\"Time 1\":true,\"Time 2\":true,\"Time 3\":true,\"Time 4\":true,\"Time 5\":true,\"Time 6\":true,\"Time 7\":true},\"indexByName\":{\"Time 1\":0,\"Time 2\":1,\"Time 3\":2,\"Time 4\":3,\"Time 5\":4,\"Time 6\":5,\"Time 7\":6,\"Value #A\":8,\"Value #B\":9,\"Value #C\":10,\"Value #D\":11,\"Value #E\":12,\"Value #F\":13,\"Value #G\":14,\"namespace\":7},\"renameByName\":{\"Value #A\":\"Pods\",\"Value #B\":\"Workloads\",\"Value #C\":\"CPU Usage\",\"Value #D\":\"CPU Requests\",\"Value #E\":\"CPU Requests %\",\"Value #F\":\"CPU Limits\",\"Value #G\":\"CPU Limits %\",\"namespace\":\"Namespace\"}}}],\"type\":\"table\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"bytes\"}},\"gridPos\":{\"h\":6,\"w\":24,\"x\":0,\"y\":18},\"id\":9,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(container_memory_rss{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\", container!=\\\"\\\"}) by (namespace)\",\"legendFormat\":\"__auto\"}],\"title\":\"Memory\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"overrides\":[{\"matcher\":{\"id\":\"byRegexp\",\"options\":\"/%/\"},\"properties\":[{\"id\":\"unit\",\"value\":\"percentunit\"}]},{\"matcher\":{\"id\":\"byName\",\"options\":\"Memory Usage\"},\"properties\":[{\"id\":\"unit\",\"value\":\"bytes\"}]},{\"matcher\":{\"id\":\"byName\",\"options\":\"Memory Requests\"},\"properties\":[{\"id\":\"unit\",\"value\":\"bytes\"}]},{\"matcher\":{\"id\":\"byName\",\"options\":\"Memory Limits\"},\"properties\":[{\"id\":\"unit\",\"value\":\"bytes\"}]},{\"matcher\":{\"id\":\"byName\",\"options\":\"Namespace\"},\"properties\":[{\"id\":\"links\",\"value\":[{\"title\":\"Drill down to pods\",\"url\":\"/d/85a562078cdf77779eaa1add43ccec1e/k8s-resources-namespace?${datasource:queryparam}&var-cluster=$cluster&var-namespace=${__data.fields.Namespace}\"}]}]}]},\"gridPos\":{\"h\":6,\"w\":24,\"x\":0,\"y\":24},\"id\":10,\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(kube_pod_owner{job=\\\"kube-state-metrics\\\", cluster=\\\"$cluster\\\"}) by (namespace)\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"count(avg(namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\"}) by (workload, namespace)) by (namespace)\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(container_memory_rss{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\", container!=\\\"\\\"}) by (namespace)\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(namespace_memory:kube_pod_container_resource_requests:sum{cluster=\\\"$cluster\\\"}) by (namespace)\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(container_memory_rss{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\", container!=\\\"\\\"}) by (namespace) / sum(namespace_memory:kube_pod_container_resource_requests:sum{cluster=\\\"$cluster\\\"}) by (namespace)\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(namespace_memory:kube_pod_container_resource_limits:sum{cluster=\\\"$cluster\\\"}) by (namespace)\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(container_memory_rss{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\", container!=\\\"\\\"}) by (namespace) / sum(namespace_memory:kube_pod_container_resource_limits:sum{cluster=\\\"$cluster\\\"}) by (namespace)\",\"format\":\"table\",\"instant\":true}],\"title\":\"Memory Requests by Namespace\",\"transformations\":[{\"id\":\"joinByField\",\"options\":{\"byField\":\"namespace\",\"mode\":\"outer\"}},{\"id\":\"organize\",\"options\":{\"excludeByName\":{\"Time\":true,\"Time 1\":true,\"Time 2\":true,\"Time 3\":true,\"Time 4\":true,\"Time 5\":true,\"Time 6\":true,\"Time 7\":true},\"indexByName\":{\"Time 1\":0,\"Time 2\":1,\"Time 3\":2,\"Time 4\":3,\"Time 5\":4,\"Time 6\":5,\"Time 7\":6,\"Value #A\":8,\"Value #B\":9,\"Value #C\":10,\"Value #D\":11,\"Value #E\":12,\"Value #F\":13,\"Value #G\":14,\"namespace\":7},\"renameByName\":{\"Value #A\":\"Pods\",\"Value #B\":\"Workloads\",\"Value #C\":\"Memory Usage\",\"Value #D\":\"Memory Requests\",\"Value #E\":\"Memory Requests %\",\"Value #F\":\"Memory Limits\",\"Value #G\":\"Memory Limits %\",\"namespace\":\"Namespace\"}}}],\"type\":\"table\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"overrides\":[{\"matcher\":{\"id\":\"byRegexp\",\"options\":\"/Bandwidth/\"},\"properties\":[{\"id\":\"unit\",\"value\":\"Bps\"}]},{\"matcher\":{\"id\":\"byRegexp\",\"options\":\"/Packets/\"},\"properties\":[{\"id\":\"unit\",\"value\":\"pps\"}]},{\"matcher\":{\"id\":\"byName\",\"options\":\"Namespace\"},\"properties\":[{\"id\":\"links\",\"value\":[{\"title\":\"Drill down to pods\",\"url\":\"/d/85a562078cdf77779eaa1add43ccec1e/k8s-resources-namespace?${datasource:queryparam}&var-cluster=$cluster&var-namespace=${__data.fields.Namespace}\"}]}]}]},\"gridPos\":{\"h\":6,\"w\":24,\"x\":0,\"y\":30},\"id\":11,\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(rate(container_network_receive_bytes_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\", namespace=~\\\".+\\\"}[$__rate_interval])) by (namespace)\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(rate(container_network_transmit_bytes_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\", namespace=~\\\".+\\\"}[$__rate_interval])) by (namespace)\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(rate(container_network_receive_packets_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\", namespace=~\\\".+\\\"}[$__rate_interval])) by (namespace)\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(rate(container_network_transmit_packets_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\", namespace=~\\\".+\\\"}[$__rate_interval])) by (namespace)\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(rate(container_network_receive_packets_dropped_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\", namespace=~\\\".+\\\"}[$__rate_interval])) by (namespace)\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(rate(container_network_transmit_packets_dropped_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\", namespace=~\\\".+\\\"}[$__rate_interval])) by (namespace)\",\"format\":\"table\",\"instant\":true}],\"title\":\"Current Network Usage\",\"transformations\":[{\"id\":\"joinByField\",\"options\":{\"byField\":\"namespace\",\"mode\":\"outer\"}},{\"id\":\"organize\",\"options\":{\"excludeByName\":{\"Time\":true,\"Time 1\":true,\"Time 2\":true,\"Time 3\":true,\"Time 4\":true,\"Time 5\":true,\"Time 6\":true},\"indexByName\":{\"Time 1\":0,\"Time 2\":1,\"Time 3\":2,\"Time 4\":3,\"Time 5\":4,\"Time 6\":5,\"Value #A\":7,\"Value #B\":8,\"Value #C\":9,\"Value #D\":10,\"Value #E\":11,\"Value #F\":12,\"namespace\":6},\"renameByName\":{\"Value #A\":\"Current Receive Bandwidth\",\"Value #B\":\"Current Transmit Bandwidth\",\"Value #C\":\"Rate of Received Packets\",\"Value #D\":\"Rate of Transmitted Packets\",\"Value #E\":\"Rate of Received Packets Dropped\",\"Value #F\":\"Rate of Transmitted Packets Dropped\",\"namespace\":\"Namespace\"}}}],\"type\":\"table\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"Bps\"}},\"gridPos\":{\"h\":6,\"w\":24,\"x\":0,\"y\":36},\"id\":12,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(rate(container_network_receive_bytes_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\", namespace=~\\\".+\\\"}[$__rate_interval])) by (namespace)\",\"legendFormat\":\"__auto\"}],\"title\":\"Receive Bandwidth\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"Bps\"}},\"gridPos\":{\"h\":6,\"w\":24,\"x\":0,\"y\":42},\"id\":13,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(rate(container_network_transmit_bytes_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\", namespace=~\\\".+\\\"}[$__rate_interval])) by (namespace)\",\"legendFormat\":\"__auto\"}],\"title\":\"Transmit Bandwidth\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"Bps\"}},\"gridPos\":{\"h\":6,\"w\":24,\"x\":0,\"y\":48},\"id\":14,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"avg(irate(container_network_receive_bytes_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\", namespace=~\\\".+\\\"}[$__rate_interval])) by (namespace)\",\"legendFormat\":\"__auto\"}],\"title\":\"Average Container Bandwidth by Namespace: Received\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"Bps\"}},\"gridPos\":{\"h\":6,\"w\":24,\"x\":0,\"y\":54},\"id\":15,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"avg(irate(container_network_transmit_bytes_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\", namespace=~\\\".+\\\"}[$__rate_interval])) by (namespace)\",\"legendFormat\":\"__auto\"}],\"title\":\"Average Container Bandwidth by Namespace: Transmitted\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"pps\"}},\"gridPos\":{\"h\":6,\"w\":24,\"x\":0,\"y\":60},\"id\":16,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(irate(container_network_receive_packets_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\", namespace=~\\\".+\\\"}[$__rate_interval])) by (namespace)\",\"legendFormat\":\"__auto\"}],\"title\":\"Rate of Received Packets\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"pps\"}},\"gridPos\":{\"h\":6,\"w\":24,\"x\":0,\"y\":66},\"id\":17,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(irate(container_network_transmit_packets_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\", namespace=~\\\".+\\\"}[$__rate_interval])) by (namespace)\",\"legendFormat\":\"__auto\"}],\"title\":\"Rate of Transmitted Packets\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"pps\"}},\"gridPos\":{\"h\":6,\"w\":24,\"x\":0,\"y\":72},\"id\":18,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(irate(container_network_receive_packets_dropped_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\", namespace=~\\\".+\\\"}[$__rate_interval])) by (namespace)\",\"legendFormat\":\"__auto\"}],\"title\":\"Rate of Received Packets Dropped\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"pps\"}},\"gridPos\":{\"h\":6,\"w\":24,\"x\":0,\"y\":78},\"id\":19,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(irate(container_network_transmit_packets_dropped_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\", namespace=~\\\".+\\\"}[$__rate_interval])) by (namespace)\",\"legendFormat\":\"__auto\"}],\"title\":\"Rate of Transmitted Packets Dropped\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"iops\"}},\"gridPos\":{\"h\":6,\"w\":24,\"x\":0,\"y\":84},\"id\":20,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"ceil(sum by(namespace) (rate(container_fs_reads_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", container!=\\\"\\\", device=~\\\"(/dev/)?(mmcblk.p.+|nvme.+|rbd.+|sd.+|vd.+|xvd.+|dm-.+|md.+|dasd.+)\\\", cluster=\\\"$cluster\\\", namespace!=\\\"\\\"}[$__rate_interval]) + rate(container_fs_writes_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", container!=\\\"\\\", cluster=\\\"$cluster\\\", namespace!=\\\"\\\"}[$__rate_interval])))\",\"legendFormat\":\"__auto\"}],\"title\":\"IOPS(Reads+Writes)\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"Bps\"}},\"gridPos\":{\"h\":6,\"w\":24,\"x\":0,\"y\":90},\"id\":21,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum by(namespace) (rate(container_fs_reads_bytes_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", container!=\\\"\\\", device=~\\\"(/dev/)?(mmcblk.p.+|nvme.+|rbd.+|sd.+|vd.+|xvd.+|dm-.+|md.+|dasd.+)\\\", cluster=\\\"$cluster\\\", namespace!=\\\"\\\"}[$__rate_interval]) + rate(container_fs_writes_bytes_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", container!=\\\"\\\", cluster=\\\"$cluster\\\", namespace!=\\\"\\\"}[$__rate_interval]))\",\"legendFormat\":\"__auto\"}],\"title\":\"ThroughPut(Read+Write)\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"overrides\":[{\"matcher\":{\"id\":\"byRegexp\",\"options\":\"/IOPS/\"},\"properties\":[{\"id\":\"unit\",\"value\":\"iops\"}]},{\"matcher\":{\"id\":\"byRegexp\",\"options\":\"/Throughput/\"},\"properties\":[{\"id\":\"unit\",\"value\":\"Bps\"}]},{\"matcher\":{\"id\":\"byName\",\"options\":\"Namespace\"},\"properties\":[{\"id\":\"links\",\"value\":[{\"title\":\"Drill down to pods\",\"url\":\"/d/85a562078cdf77779eaa1add43ccec1e/k8s-resources-namespace?${datasource:queryparam}&var-cluster=$cluster&var-namespace=${__data.fields.Namespace}\"}]}]}]},\"gridPos\":{\"h\":6,\"w\":24,\"x\":0,\"y\":96},\"id\":22,\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum by(namespace) (rate(container_fs_reads_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", device=~\\\"(/dev/)?(mmcblk.p.+|nvme.+|rbd.+|sd.+|vd.+|xvd.+|dm-.+|md.+|dasd.+)\\\", container!=\\\"\\\", cluster=\\\"$cluster\\\", namespace!=\\\"\\\"}[$__rate_interval]))\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum by(namespace) (rate(container_fs_writes_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", device=~\\\"(/dev/)?(mmcblk.p.+|nvme.+|rbd.+|sd.+|vd.+|xvd.+|dm-.+|md.+|dasd.+)\\\", container!=\\\"\\\", cluster=\\\"$cluster\\\", namespace!=\\\"\\\"}[$__rate_interval]))\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum by(namespace) (rate(container_fs_reads_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", device=~\\\"(/dev/)?(mmcblk.p.+|nvme.+|rbd.+|sd.+|vd.+|xvd.+|dm-.+|md.+|dasd.+)\\\", container!=\\\"\\\", cluster=\\\"$cluster\\\", namespace!=\\\"\\\"}[$__rate_interval]) + rate(container_fs_writes_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", device=~\\\"(/dev/)?(mmcblk.p.+|nvme.+|rbd.+|sd.+|vd.+|xvd.+|dm-.+|md.+|dasd.+)\\\", container!=\\\"\\\", cluster=\\\"$cluster\\\", namespace!=\\\"\\\"}[$__rate_interval]))\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum by(namespace) (rate(container_fs_reads_bytes_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", device=~\\\"(/dev/)?(mmcblk.p.+|nvme.+|rbd.+|sd.+|vd.+|xvd.+|dm-.+|md.+|dasd.+)\\\", container!=\\\"\\\", cluster=\\\"$cluster\\\", namespace!=\\\"\\\"}[$__rate_interval]))\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum by(namespace) (rate(container_fs_writes_bytes_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", device=~\\\"(/dev/)?(mmcblk.p.+|nvme.+|rbd.+|sd.+|vd.+|xvd.+|dm-.+|md.+|dasd.+)\\\", container!=\\\"\\\", cluster=\\\"$cluster\\\", namespace!=\\\"\\\"}[$__rate_interval]))\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum by(namespace) (rate(container_fs_reads_bytes_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", device=~\\\"(/dev/)?(mmcblk.p.+|nvme.+|rbd.+|sd.+|vd.+|xvd.+|dm-.+|md.+|dasd.+)\\\", container!=\\\"\\\", cluster=\\\"$cluster\\\", namespace!=\\\"\\\"}[$__rate_interval]) + rate(container_fs_writes_bytes_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", device=~\\\"(/dev/)?(mmcblk.p.+|nvme.+|rbd.+|sd.+|vd.+|xvd.+|dm-.+|md.+|dasd.+)\\\", container!=\\\"\\\", cluster=\\\"$cluster\\\", namespace!=\\\"\\\"}[$__rate_interval]))\",\"format\":\"table\",\"instant\":true}],\"title\":\"Current Storage IO\",\"transformations\":[{\"id\":\"joinByField\",\"options\":{\"byField\":\"namespace\",\"mode\":\"outer\"}},{\"id\":\"organize\",\"options\":{\"excludeByName\":{\"Time\":true,\"Time 1\":true,\"Time 2\":true,\"Time 3\":true,\"Time 4\":true,\"Time 5\":true,\"Time 6\":true},\"indexByName\":{\"Time 1\":0,\"Time 2\":1,\"Time 3\":2,\"Time 4\":3,\"Time 5\":4,\"Time 6\":5,\"Value #A\":7,\"Value #B\":8,\"Value #C\":9,\"Value #D\":10,\"Value #E\":11,\"Value #F\":12,\"namespace\":6},\"renameByName\":{\"Value #A\":\"IOPS(Reads)\",\"Value #B\":\"IOPS(Writes)\",\"Value #C\":\"IOPS(Reads + Writes)\",\"Value #D\":\"Throughput(Read)\",\"Value #E\":\"Throughput(Write)\",\"Value #F\":\"Throughput(Read + Write)\",\"namespace\":\"Namespace\"}}}],\"type\":\"table\"}],\"refresh\":\"10s\",\"schemaVersion\":39,\"tags\":[\"kubernetes-mixin\"],\"templating\":{\"list\":[{\"current\":{\"selected\":true,\"text\":\"default\",\"value\":\"default\"},\"hide\":0,\"label\":\"Data source\",\"name\":\"datasource\",\"query\":\"prometheus\",\"regex\":\"\",\"type\":\"datasource\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"hide\":2,\"label\":\"cluster\",\"name\":\"cluster\",\"query\":\"label_values(up{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\"}, cluster)\",\"refresh\":2,\"sort\":1,\"type\":\"query\",\"allValue\":\".*\"}]},\"time\":{\"from\":\"now-1h\",\"to\":\"now\"},\"timezone\": \"utc\",\"title\":\"Kubernetes / Compute Resources / Cluster\",\"uid\":\"efa86fd1d0c121a26444b636a3f509a8\"}" } }; -export const ConfigMap_KubePrometheusStackK8sResourcesMulticluster: ConfigMap = { +export const ConfigMap_KubePrometheusStackK8sResourcesMulticluster: KubernetesResource = { apiVersion: "v1", kind: "ConfigMap", metadata: { @@ -56789,7 +56789,7 @@ export const ConfigMap_KubePrometheusStackK8sResourcesMulticluster: ConfigMap = "k8s-resources-multicluster.json": "{\"editable\":true,\"links\":[{\"asDropdown\":true,\"includeVars\":true,\"keepTime\":true,\"tags\":[\"kubernetes-mixin\"],\"targetBlank\":false,\"title\":\"Kubernetes\",\"type\":\"dashboards\"}],\"panels\":[{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"unit\":\"none\"}},\"gridPos\":{\"h\":3,\"w\":4,\"x\":0,\"y\":0},\"id\":1,\"interval\":\"1m\",\"options\":{\"colorMode\":\"none\"},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(cluster:node_cpu:ratio_rate5m) / count(cluster:node_cpu:ratio_rate5m)\",\"instant\":true}],\"title\":\"CPU Utilisation\",\"type\":\"stat\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"unit\":\"percentunit\"}},\"gridPos\":{\"h\":3,\"w\":4,\"x\":4,\"y\":0},\"id\":2,\"interval\":\"1m\",\"options\":{\"colorMode\":\"none\"},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(kube_pod_container_resource_requests{job=\\\"kube-state-metrics\\\", resource=\\\"cpu\\\"}) / sum(kube_node_status_allocatable{job=\\\"kube-state-metrics\\\", resource=\\\"cpu\\\"})\",\"instant\":true}],\"title\":\"CPU Requests Commitment\",\"type\":\"stat\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"unit\":\"percentunit\"}},\"gridPos\":{\"h\":3,\"w\":4,\"x\":8,\"y\":0},\"id\":3,\"interval\":\"1m\",\"options\":{\"colorMode\":\"none\"},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(kube_pod_container_resource_limits{job=\\\"kube-state-metrics\\\", resource=\\\"cpu\\\"}) / sum(kube_node_status_allocatable{job=\\\"kube-state-metrics\\\", resource=\\\"cpu\\\"})\",\"instant\":true}],\"title\":\"CPU Limits Commitment\",\"type\":\"stat\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"unit\":\"percentunit\"}},\"gridPos\":{\"h\":3,\"w\":4,\"x\":12,\"y\":0},\"id\":4,\"interval\":\"1m\",\"options\":{\"colorMode\":\"none\"},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"1 - sum(:node_memory_MemAvailable_bytes:sum) / sum(node_memory_MemTotal_bytes{job=\\\"node-exporter\\\"})\",\"instant\":true}],\"title\":\"Memory Utilisation\",\"type\":\"stat\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"unit\":\"percentunit\"}},\"gridPos\":{\"h\":3,\"w\":4,\"x\":16,\"y\":0},\"id\":5,\"interval\":\"1m\",\"options\":{\"colorMode\":\"none\"},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(kube_pod_container_resource_requests{job=\\\"kube-state-metrics\\\", resource=\\\"memory\\\"}) / sum(kube_node_status_allocatable{job=\\\"kube-state-metrics\\\", resource=\\\"memory\\\"})\",\"instant\":true}],\"title\":\"Memory Requests Commitment\",\"type\":\"stat\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"unit\":\"percentunit\"}},\"gridPos\":{\"h\":3,\"w\":4,\"x\":20,\"y\":0},\"id\":6,\"interval\":\"1m\",\"options\":{\"colorMode\":\"none\"},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(kube_pod_container_resource_limits{job=\\\"kube-state-metrics\\\", resource=\\\"memory\\\"}) / sum(kube_node_status_allocatable{job=\\\"kube-state-metrics\\\", resource=\\\"memory\\\"})\",\"instant\":true}],\"title\":\"Memory Limits Commitment\",\"type\":\"stat\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"showPoints\":\"never\"}}},\"gridPos\":{\"h\":7,\"w\":24,\"x\":0,\"y\":1},\"id\":7,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(node_namespace_pod_container:container_cpu_usage_seconds_total:sum_rate5m) by (cluster)\",\"legendFormat\":\"__auto\"}],\"title\":\"CPU Usage\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"overrides\":[{\"matcher\":{\"id\":\"byRegexp\",\"options\":\"/%/\"},\"properties\":[{\"id\":\"unit\",\"value\":\"percentunit\"}]},{\"matcher\":{\"id\":\"byName\",\"options\":\"Cluster\"},\"properties\":[{\"id\":\"links\",\"value\":[{\"title\":\"Drill down\",\"url\":\"/d/efa86fd1d0c121a26444b636a3f509a8/kubernetes-compute-resources-cluster?${datasource:queryparam}&var-cluster=${__data.fields.Cluster}\"}]}]}]},\"gridPos\":{\"h\":7,\"w\":24,\"x\":0,\"y\":2},\"id\":8,\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(node_namespace_pod_container:container_cpu_usage_seconds_total:sum_rate5m) by (cluster)\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(kube_pod_container_resource_requests{job=\\\"kube-state-metrics\\\", resource=\\\"cpu\\\"}) by (cluster)\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(node_namespace_pod_container:container_cpu_usage_seconds_total:sum_rate5m) by (cluster) / sum(kube_pod_container_resource_requests{job=\\\"kube-state-metrics\\\", resource=\\\"cpu\\\"}) by (cluster)\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(kube_pod_container_resource_limits{job=\\\"kube-state-metrics\\\", resource=\\\"cpu\\\"}) by (cluster)\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(node_namespace_pod_container:container_cpu_usage_seconds_total:sum_rate5m) by (cluster) / sum(kube_pod_container_resource_limits{job=\\\"kube-state-metrics\\\", resource=\\\"cpu\\\"}) by (cluster)\",\"format\":\"table\",\"instant\":true}],\"title\":\"CPU Quota\",\"transformations\":[{\"id\":\"joinByField\",\"options\":{\"byField\":\"cluster\",\"mode\":\"outer\"}},{\"id\":\"organize\",\"options\":{\"excludeByName\":{\"Time\":true,\"Time 1\":true,\"Time 2\":true,\"Time 3\":true,\"Time 4\":true,\"Time 5\":true},\"indexByName\":{\"Time 1\":0,\"Time 2\":1,\"Time 3\":2,\"Time 4\":3,\"Time 5\":4,\"Value #A\":6,\"Value #B\":7,\"Value #C\":8,\"Value #D\":9,\"Value #E\":10,\"cluster\":5},\"renameByName\":{\"Value #A\":\"CPU Usage\",\"Value #B\":\"CPU Requests\",\"Value #C\":\"CPU Requests %\",\"Value #D\":\"CPU Limits\",\"Value #E\":\"CPU Limits %\",\"cluster\":\"Cluster\"}}}],\"type\":\"table\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"showPoints\":\"never\"},\"unit\":\"bytes\"}},\"gridPos\":{\"h\":7,\"w\":24,\"x\":0,\"y\":3},\"id\":9,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(container_memory_rss{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", container!=\\\"\\\"}) by (cluster)\",\"legendFormat\":\"__auto\"}],\"title\":\"Memory Usage (w/o cache)\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"unit\":\"bytes\"},\"overrides\":[{\"matcher\":{\"id\":\"byRegexp\",\"options\":\"/%/\"},\"properties\":[{\"id\":\"unit\",\"value\":\"percentunit\"}]},{\"matcher\":{\"id\":\"byName\",\"options\":\"Cluster\"},\"properties\":[{\"id\":\"links\",\"value\":[{\"title\":\"Drill down\",\"url\":\"/d/efa86fd1d0c121a26444b636a3f509a8/kubernetes-compute-resources-cluster?${datasource:queryparam}&var-cluster=${__data.fields.Cluster}\"}]}]}]},\"gridPos\":{\"h\":7,\"w\":24,\"x\":0,\"y\":4},\"id\":10,\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(container_memory_rss{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", container!=\\\"\\\"}) by (cluster)\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(kube_pod_container_resource_requests{job=\\\"kube-state-metrics\\\", resource=\\\"memory\\\"}) by (cluster)\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(container_memory_rss{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", container!=\\\"\\\"}) by (cluster) / sum(kube_pod_container_resource_requests{job=\\\"kube-state-metrics\\\", resource=\\\"memory\\\"}) by (cluster)\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(kube_pod_container_resource_limits{job=\\\"kube-state-metrics\\\", resource=\\\"memory\\\"}) by (cluster)\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(container_memory_rss{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", container!=\\\"\\\"}) by (cluster) / sum(kube_pod_container_resource_limits{job=\\\"kube-state-metrics\\\", resource=\\\"memory\\\"}) by (cluster)\",\"format\":\"table\",\"instant\":true}],\"title\":\"Memory Requests by Cluster\",\"transformations\":[{\"id\":\"joinByField\",\"options\":{\"byField\":\"cluster\",\"mode\":\"outer\"}},{\"id\":\"organize\",\"options\":{\"excludeByName\":{\"Time\":true,\"Time 1\":true,\"Time 2\":true,\"Time 3\":true,\"Time 4\":true,\"Time 5\":true},\"indexByName\":{\"Time 1\":0,\"Time 2\":1,\"Time 3\":2,\"Time 4\":3,\"Time 5\":4,\"Value #A\":6,\"Value #B\":7,\"Value #C\":8,\"Value #D\":9,\"Value #E\":10,\"cluster\":5},\"renameByName\":{\"Value #A\":\"Memory Usage\",\"Value #B\":\"Memory Requests\",\"Value #C\":\"Memory Requests %\",\"Value #D\":\"Memory Limits\",\"Value #E\":\"Memory Limits %\",\"cluster\":\"Cluster\"}}}],\"type\":\"table\"}],\"refresh\":\"10s\",\"schemaVersion\":39,\"tags\":[\"kubernetes-mixin\"],\"templating\":{\"list\":[{\"current\":{\"selected\":true,\"text\":\"default\",\"value\":\"default\"},\"hide\":0,\"label\":\"Data source\",\"name\":\"datasource\",\"query\":\"prometheus\",\"regex\":\"\",\"type\":\"datasource\"}]},\"time\":{\"from\":\"now-1h\",\"to\":\"now\"},\"timezone\": \"utc\",\"title\":\"Kubernetes / Compute Resources / Multi-Cluster\",\"uid\":\"b59e6c9f2fcbe2e16d77fc492374cc4f\"}" } }; -export const ConfigMap_KubePrometheusStackK8sResourcesNamespace: ConfigMap = { +export const ConfigMap_KubePrometheusStackK8sResourcesNamespace: KubernetesResource = { apiVersion: "v1", kind: "ConfigMap", metadata: { @@ -56812,7 +56812,7 @@ export const ConfigMap_KubePrometheusStackK8sResourcesNamespace: ConfigMap = { "k8s-resources-namespace.json": "{\"editable\":true,\"links\":[{\"asDropdown\":true,\"includeVars\":true,\"keepTime\":true,\"tags\":[\"kubernetes-mixin\"],\"targetBlank\":false,\"title\":\"Kubernetes\",\"type\":\"dashboards\"}],\"panels\":[{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"unit\":\"percentunit\"}},\"gridPos\":{\"h\":3,\"w\":6,\"x\":0,\"y\":0},\"id\":1,\"interval\":\"1m\",\"options\":{\"colorMode\":\"none\"},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(node_namespace_pod_container:container_cpu_usage_seconds_total:sum_rate5m{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\"}) / sum(kube_pod_container_resource_requests{job=\\\"kube-state-metrics\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", resource=\\\"cpu\\\"})\",\"instant\":true}],\"title\":\"CPU Utilisation (from requests)\",\"type\":\"stat\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"unit\":\"percentunit\"}},\"gridPos\":{\"h\":3,\"w\":6,\"x\":6,\"y\":0},\"id\":2,\"interval\":\"1m\",\"options\":{\"colorMode\":\"none\"},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(node_namespace_pod_container:container_cpu_usage_seconds_total:sum_rate5m{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\"}) / sum(kube_pod_container_resource_limits{job=\\\"kube-state-metrics\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", resource=\\\"cpu\\\"})\",\"instant\":true}],\"title\":\"CPU Utilisation (from limits)\",\"type\":\"stat\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"unit\":\"percentunit\"}},\"gridPos\":{\"h\":3,\"w\":6,\"x\":12,\"y\":0},\"id\":3,\"interval\":\"1m\",\"options\":{\"colorMode\":\"none\"},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(container_memory_working_set_bytes{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\",container!=\\\"\\\", image!=\\\"\\\"}) / sum(kube_pod_container_resource_requests{job=\\\"kube-state-metrics\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", resource=\\\"memory\\\"})\",\"instant\":true}],\"title\":\"Memory Utilisation (from requests)\",\"type\":\"stat\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"unit\":\"percentunit\"}},\"gridPos\":{\"h\":3,\"w\":6,\"x\":18,\"y\":0},\"id\":4,\"interval\":\"1m\",\"options\":{\"colorMode\":\"none\"},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(container_memory_working_set_bytes{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\",container!=\\\"\\\", image!=\\\"\\\"}) / sum(kube_pod_container_resource_limits{job=\\\"kube-state-metrics\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", resource=\\\"memory\\\"})\",\"instant\":true}],\"title\":\"Memory Utilisation (from limits)\",\"type\":\"stat\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true}},\"overrides\":[{\"matcher\":{\"id\":\"byFrameRefID\",\"options\":\"B\"},\"properties\":[{\"id\":\"custom.lineStyle\",\"value\":{\"fill\":\"dash\"}},{\"id\":\"custom.lineWidth\",\"value\":2},{\"id\":\"color\",\"value\":{\"fixedColor\":\"red\",\"mode\":\"fixed\"}}]},{\"matcher\":{\"id\":\"byFrameRefID\",\"options\":\"C\"},\"properties\":[{\"id\":\"custom.lineStyle\",\"value\":{\"fill\":\"dash\"}},{\"id\":\"custom.lineWidth\",\"value\":2},{\"id\":\"color\",\"value\":{\"fixedColor\":\"orange\",\"mode\":\"fixed\"}}]}]},\"gridPos\":{\"h\":7,\"w\":24,\"x\":0,\"y\":7},\"id\":5,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(node_namespace_pod_container:container_cpu_usage_seconds_total:sum_rate5m{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\"}) by (pod)\",\"legendFormat\":\"__auto\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"scalar(max(kube_resourcequota{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", type=\\\"hard\\\",resource=\\\"requests.cpu\\\"}))\",\"legendFormat\":\"quota - requests\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"scalar(max(kube_resourcequota{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", type=\\\"hard\\\",resource=\\\"limits.cpu\\\"}))\",\"legendFormat\":\"quota - limits\"}],\"title\":\"CPU Usage\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"overrides\":[{\"matcher\":{\"id\":\"byRegexp\",\"options\":\"/%/\"},\"properties\":[{\"id\":\"unit\",\"value\":\"percentunit\"}]},{\"matcher\":{\"id\":\"byName\",\"options\":\"Pod\"},\"properties\":[{\"id\":\"links\",\"value\":[{\"title\":\"Drill down to pods\",\"url\":\"/d/6581e46e4e5c7ba40a07646395ef7b23/k8s-resources-pod?${datasource:queryparam}&var-cluster=$cluster&var-namespace=$namespace&var-pod=${__data.fields.Pod}\"}]}]}]},\"gridPos\":{\"h\":7,\"w\":24,\"x\":0,\"y\":14},\"id\":6,\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(node_namespace_pod_container:container_cpu_usage_seconds_total:sum_rate5m{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\"}) by (pod)\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(cluster:namespace:pod_cpu:active:kube_pod_container_resource_requests{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\"}) by (pod)\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(node_namespace_pod_container:container_cpu_usage_seconds_total:sum_rate5m{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\"}) by (pod) / sum(cluster:namespace:pod_cpu:active:kube_pod_container_resource_requests{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\"}) by (pod)\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(cluster:namespace:pod_cpu:active:kube_pod_container_resource_limits{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\"}) by (pod)\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(node_namespace_pod_container:container_cpu_usage_seconds_total:sum_rate5m{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\"}) by (pod) / sum(cluster:namespace:pod_cpu:active:kube_pod_container_resource_limits{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\"}) by (pod)\",\"format\":\"table\",\"instant\":true}],\"title\":\"CPU Quota\",\"transformations\":[{\"id\":\"joinByField\",\"options\":{\"byField\":\"pod\",\"mode\":\"outer\"}},{\"id\":\"organize\",\"options\":{\"excludeByName\":{\"Time\":true,\"Time 1\":true,\"Time 2\":true,\"Time 3\":true,\"Time 4\":true,\"Time 5\":true},\"indexByName\":{\"Time 1\":0,\"Time 2\":1,\"Time 3\":2,\"Time 4\":3,\"Time 5\":4,\"Value #A\":6,\"Value #B\":7,\"Value #C\":8,\"Value #D\":9,\"Value #E\":10,\"pod\":5},\"renameByName\":{\"Value #A\":\"CPU Usage\",\"Value #B\":\"CPU Requests\",\"Value #C\":\"CPU Requests %\",\"Value #D\":\"CPU Limits\",\"Value #E\":\"CPU Limits %\",\"pod\":\"Pod\"}}}],\"type\":\"table\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"bytes\"},\"overrides\":[{\"matcher\":{\"id\":\"byFrameRefID\",\"options\":\"B\"},\"properties\":[{\"id\":\"custom.lineStyle\",\"value\":{\"fill\":\"dash\"}},{\"id\":\"custom.lineWidth\",\"value\":2},{\"id\":\"color\",\"value\":{\"fixedColor\":\"red\",\"mode\":\"fixed\"}}]},{\"matcher\":{\"id\":\"byFrameRefID\",\"options\":\"C\"},\"properties\":[{\"id\":\"custom.lineStyle\",\"value\":{\"fill\":\"dash\"}},{\"id\":\"custom.lineWidth\",\"value\":2},{\"id\":\"color\",\"value\":{\"fixedColor\":\"orange\",\"mode\":\"fixed\"}}]}]},\"gridPos\":{\"h\":7,\"w\":24,\"x\":0,\"y\":21},\"id\":7,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(container_memory_working_set_bytes{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", container!=\\\"\\\", image!=\\\"\\\"}) by (pod)\",\"legendFormat\":\"__auto\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"scalar(max(kube_resourcequota{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", type=\\\"hard\\\",resource=\\\"requests.memory\\\"}))\",\"legendFormat\":\"quota - requests\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"scalar(max(kube_resourcequota{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", type=\\\"hard\\\",resource=\\\"limits.memory\\\"}))\",\"legendFormat\":\"quota - limits\"}],\"title\":\"Memory Usage (w/o cache)\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"unit\":\"bytes\"},\"overrides\":[{\"matcher\":{\"id\":\"byRegexp\",\"options\":\"/%/\"},\"properties\":[{\"id\":\"unit\",\"value\":\"percentunit\"}]},{\"matcher\":{\"id\":\"byName\",\"options\":\"Pod\"},\"properties\":[{\"id\":\"links\",\"value\":[{\"title\":\"Drill down to pods\",\"url\":\"/d/6581e46e4e5c7ba40a07646395ef7b23/k8s-resources-pod?${datasource:queryparam}&var-cluster=$cluster&var-namespace=$namespace&var-pod=${__data.fields.Pod}\"}]}]}]},\"gridPos\":{\"h\":7,\"w\":24,\"x\":0,\"y\":28},\"id\":8,\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(container_memory_working_set_bytes{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\",container!=\\\"\\\", image!=\\\"\\\"}) by (pod)\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(cluster:namespace:pod_memory:active:kube_pod_container_resource_requests{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\"}) by (pod)\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(container_memory_working_set_bytes{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\",container!=\\\"\\\", image!=\\\"\\\"}) by (pod) / sum(cluster:namespace:pod_memory:active:kube_pod_container_resource_requests{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\"}) by (pod)\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(cluster:namespace:pod_memory:active:kube_pod_container_resource_limits{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\"}) by (pod)\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(container_memory_working_set_bytes{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\",container!=\\\"\\\", image!=\\\"\\\"}) by (pod) / sum(cluster:namespace:pod_memory:active:kube_pod_container_resource_limits{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\"}) by (pod)\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(container_memory_rss{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\",container!=\\\"\\\"}) by (pod)\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(container_memory_cache{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\",container!=\\\"\\\"}) by (pod)\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(container_memory_swap{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\",container!=\\\"\\\"}) by (pod)\",\"format\":\"table\",\"instant\":true}],\"title\":\"Memory Quota\",\"transformations\":[{\"id\":\"joinByField\",\"options\":{\"byField\":\"pod\",\"mode\":\"outer\"}},{\"id\":\"organize\",\"options\":{\"excludeByName\":{\"Time\":true,\"Time 1\":true,\"Time 2\":true,\"Time 3\":true,\"Time 4\":true,\"Time 5\":true,\"Time 6\":true,\"Time 7\":true,\"Time 8\":true},\"indexByName\":{\"Time 1\":0,\"Time 2\":1,\"Time 3\":2,\"Time 4\":3,\"Time 5\":4,\"Time 6\":5,\"Time 7\":6,\"Time 8\":7,\"Value #A\":9,\"Value #B\":10,\"Value #C\":11,\"Value #D\":12,\"Value #E\":13,\"Value #F\":14,\"Value #G\":15,\"Value #H\":16,\"pod\":8},\"renameByName\":{\"Value #A\":\"Memory Usage\",\"Value #B\":\"Memory Requests\",\"Value #C\":\"Memory Requests %\",\"Value #D\":\"Memory Limits\",\"Value #E\":\"Memory Limits %\",\"Value #F\":\"Memory Usage (RSS)\",\"Value #G\":\"Memory Usage (Cache)\",\"Value #H\":\"Memory Usage (Swap)\",\"pod\":\"Pod\"}}}],\"type\":\"table\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"overrides\":[{\"matcher\":{\"id\":\"byRegexp\",\"options\":\"/Bandwidth/\"},\"properties\":[{\"id\":\"unit\",\"value\":\"Bps\"}]},{\"matcher\":{\"id\":\"byRegexp\",\"options\":\"/Packets/\"},\"properties\":[{\"id\":\"unit\",\"value\":\"pps\"}]},{\"matcher\":{\"id\":\"byName\",\"options\":\"Pod\"},\"properties\":[{\"id\":\"links\",\"value\":[{\"title\":\"Drill down to pods\",\"url\":\"/d/6581e46e4e5c7ba40a07646395ef7b23/k8s-resources-pod?${datasource:queryparam}&var-cluster=$cluster&var-namespace=$namespace&var-pod=${__data.fields.Pod}\"}]}]}]},\"gridPos\":{\"h\":7,\"w\":24,\"x\":0,\"y\":35},\"id\":9,\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(rate(container_network_receive_bytes_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\"}[$__rate_interval])) by (pod)\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(rate(container_network_transmit_bytes_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\"}[$__rate_interval])) by (pod)\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(rate(container_network_receive_packets_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\"}[$__rate_interval])) by (pod)\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(rate(container_network_transmit_packets_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\"}[$__rate_interval])) by (pod)\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(rate(container_network_receive_packets_dropped_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\"}[$__rate_interval])) by (pod)\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(rate(container_network_transmit_packets_dropped_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\"}[$__rate_interval])) by (pod)\",\"format\":\"table\",\"instant\":true}],\"title\":\"Current Network Usage\",\"transformations\":[{\"id\":\"joinByField\",\"options\":{\"byField\":\"pod\",\"mode\":\"outer\"}},{\"id\":\"organize\",\"options\":{\"excludeByName\":{\"Time\":true,\"Time 1\":true,\"Time 2\":true,\"Time 3\":true,\"Time 4\":true,\"Time 5\":true,\"Time 6\":true},\"indexByName\":{\"Time 1\":0,\"Time 2\":1,\"Time 3\":2,\"Time 4\":3,\"Time 5\":4,\"Time 6\":5,\"Value #A\":7,\"Value #B\":8,\"Value #C\":9,\"Value #D\":10,\"Value #E\":11,\"Value #F\":12,\"pod\":6},\"renameByName\":{\"Value #A\":\"Current Receive Bandwidth\",\"Value #B\":\"Current Transmit Bandwidth\",\"Value #C\":\"Rate of Received Packets\",\"Value #D\":\"Rate of Transmitted Packets\",\"Value #E\":\"Rate of Received Packets Dropped\",\"Value #F\":\"Rate of Transmitted Packets Dropped\",\"pod\":\"Pod\"}}}],\"type\":\"table\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"Bps\"}},\"gridPos\":{\"h\":7,\"w\":12,\"x\":0,\"y\":42},\"id\":10,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(rate(container_network_receive_bytes_total{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\"}[$__rate_interval])) by (pod)\",\"legendFormat\":\"__auto\"}],\"title\":\"Receive Bandwidth\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"Bps\"}},\"gridPos\":{\"h\":7,\"w\":12,\"x\":12,\"y\":42},\"id\":11,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(rate(container_network_transmit_bytes_total{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\"}[$__rate_interval])) by (pod)\",\"legendFormat\":\"__auto\"}],\"title\":\"Transmit Bandwidth\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"pps\"}},\"gridPos\":{\"h\":7,\"w\":12,\"x\":0,\"y\":49},\"id\":12,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(irate(container_network_receive_packets_total{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\"}[$__rate_interval])) by (pod)\",\"legendFormat\":\"__auto\"}],\"title\":\"Rate of Received Packets\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"pps\"}},\"gridPos\":{\"h\":7,\"w\":12,\"x\":12,\"y\":49},\"id\":13,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(irate(container_network_transmit_packets_total{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\"}[$__rate_interval])) by (pod)\",\"legendFormat\":\"__auto\"}],\"title\":\"Rate of Transmitted Packets\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"pps\"}},\"gridPos\":{\"h\":7,\"w\":12,\"x\":0,\"y\":56},\"id\":14,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(irate(container_network_receive_packets_dropped_total{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\"}[$__rate_interval])) by (pod)\",\"legendFormat\":\"__auto\"}],\"title\":\"Rate of Received Packets Dropped\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"pps\"}},\"gridPos\":{\"h\":7,\"w\":12,\"x\":12,\"y\":56},\"id\":15,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(irate(container_network_transmit_packets_dropped_total{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\"}[$__rate_interval])) by (pod)\",\"legendFormat\":\"__auto\"}],\"title\":\"Rate of Transmitted Packets Dropped\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"iops\"}},\"gridPos\":{\"h\":7,\"w\":12,\"x\":0,\"y\":63},\"id\":16,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"ceil(sum by(pod) (rate(container_fs_reads_total{container!=\\\"\\\", device=~\\\"(/dev/)?(mmcblk.p.+|nvme.+|rbd.+|sd.+|vd.+|xvd.+|dm-.+|md.+|dasd.+)\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\"}[$__rate_interval]) + rate(container_fs_writes_total{container!=\\\"\\\", device=~\\\"(/dev/)?(mmcblk.p.+|nvme.+|rbd.+|sd.+|vd.+|xvd.+|dm-.+|md.+|dasd.+)\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\"}[$__rate_interval])))\",\"legendFormat\":\"__auto\"}],\"title\":\"IOPS(Reads+Writes)\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"Bps\"}},\"gridPos\":{\"h\":7,\"w\":12,\"x\":12,\"y\":63},\"id\":17,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum by(pod) (rate(container_fs_reads_bytes_total{container!=\\\"\\\", device=~\\\"(/dev/)?(mmcblk.p.+|nvme.+|rbd.+|sd.+|vd.+|xvd.+|dm-.+|md.+|dasd.+)\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\"}[$__rate_interval]) + rate(container_fs_writes_bytes_total{container!=\\\"\\\", device=~\\\"(/dev/)?(mmcblk.p.+|nvme.+|rbd.+|sd.+|vd.+|xvd.+|dm-.+|md.+|dasd.+)\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\"}[$__rate_interval]))\",\"legendFormat\":\"__auto\"}],\"title\":\"ThroughPut(Read+Write)\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"overrides\":[{\"matcher\":{\"id\":\"byRegexp\",\"options\":\"/IOPS/\"},\"properties\":[{\"id\":\"unit\",\"value\":\"iops\"}]},{\"matcher\":{\"id\":\"byRegexp\",\"options\":\"/Throughput/\"},\"properties\":[{\"id\":\"unit\",\"value\":\"Bps\"}]},{\"matcher\":{\"id\":\"byName\",\"options\":\"Pod\"},\"properties\":[{\"id\":\"links\",\"value\":[{\"title\":\"Drill down to pods\",\"url\":\"/d/6581e46e4e5c7ba40a07646395ef7b23/k8s-resources-pod?${datasource:queryparam}&var-cluster=$cluster&var-namespace=$namespace&var-pod=${__data.fields.Pod}\"}]}]}]},\"gridPos\":{\"h\":7,\"w\":24,\"x\":0,\"y\":70},\"id\":18,\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum by(pod) (rate(container_fs_reads_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", device=~\\\"(/dev/)?(mmcblk.p.+|nvme.+|rbd.+|sd.+|vd.+|xvd.+|dm-.+|md.+|dasd.+)\\\", container!=\\\"\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\"}[$__rate_interval]))\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum by(pod) (rate(container_fs_writes_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", device=~\\\"(/dev/)?(mmcblk.p.+|nvme.+|rbd.+|sd.+|vd.+|xvd.+|dm-.+|md.+|dasd.+)\\\", container!=\\\"\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\"}[$__rate_interval]))\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum by(pod) (rate(container_fs_reads_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", device=~\\\"(/dev/)?(mmcblk.p.+|nvme.+|rbd.+|sd.+|vd.+|xvd.+|dm-.+|md.+|dasd.+)\\\", container!=\\\"\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\"}[$__rate_interval]) + rate(container_fs_writes_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", device=~\\\"(/dev/)?(mmcblk.p.+|nvme.+|rbd.+|sd.+|vd.+|xvd.+|dm-.+|md.+|dasd.+)\\\", container!=\\\"\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\"}[$__rate_interval]))\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum by(pod) (rate(container_fs_reads_bytes_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", device=~\\\"(/dev/)?(mmcblk.p.+|nvme.+|rbd.+|sd.+|vd.+|xvd.+|dm-.+|md.+|dasd.+)\\\", container!=\\\"\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\"}[$__rate_interval]))\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum by(pod) (rate(container_fs_writes_bytes_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", device=~\\\"(/dev/)?(mmcblk.p.+|nvme.+|rbd.+|sd.+|vd.+|xvd.+|dm-.+|md.+|dasd.+)\\\", container!=\\\"\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\"}[$__rate_interval]))\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum by(pod) (rate(container_fs_reads_bytes_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", device=~\\\"(/dev/)?(mmcblk.p.+|nvme.+|rbd.+|sd.+|vd.+|xvd.+|dm-.+|md.+|dasd.+)\\\", container!=\\\"\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\"}[$__rate_interval]) + rate(container_fs_writes_bytes_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", device=~\\\"(/dev/)?(mmcblk.p.+|nvme.+|rbd.+|sd.+|vd.+|xvd.+|dm-.+|md.+|dasd.+)\\\", container!=\\\"\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\"}[$__rate_interval]))\",\"format\":\"table\",\"instant\":true}],\"title\":\"Current Storage IO\",\"transformations\":[{\"id\":\"joinByField\",\"options\":{\"byField\":\"pod\",\"mode\":\"outer\"}},{\"id\":\"organize\",\"options\":{\"excludeByName\":{\"Time\":true,\"Time 1\":true,\"Time 2\":true,\"Time 3\":true,\"Time 4\":true,\"Time 5\":true,\"Time 6\":true},\"indexByName\":{\"Time 1\":0,\"Time 2\":1,\"Time 3\":2,\"Time 4\":3,\"Time 5\":4,\"Time 6\":5,\"Value #A\":7,\"Value #B\":8,\"Value #C\":9,\"Value #D\":10,\"Value #E\":11,\"Value #F\":12,\"pod\":6},\"renameByName\":{\"Value #A\":\"IOPS(Reads)\",\"Value #B\":\"IOPS(Writes)\",\"Value #C\":\"IOPS(Reads + Writes)\",\"Value #D\":\"Throughput(Read)\",\"Value #E\":\"Throughput(Write)\",\"Value #F\":\"Throughput(Read + Write)\",\"pod\":\"Pod\"}}}],\"type\":\"table\"}],\"refresh\":\"10s\",\"schemaVersion\":39,\"tags\":[\"kubernetes-mixin\"],\"templating\":{\"list\":[{\"current\":{\"selected\":true,\"text\":\"default\",\"value\":\"default\"},\"hide\":0,\"label\":\"Data source\",\"name\":\"datasource\",\"query\":\"prometheus\",\"regex\":\"\",\"type\":\"datasource\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"hide\":2,\"label\":\"cluster\",\"name\":\"cluster\",\"query\":\"label_values(up{job=\\\"kube-state-metrics\\\"}, cluster)\",\"refresh\":2,\"sort\":1,\"type\":\"query\",\"allValue\":\".*\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"hide\":0,\"label\":\"namespace\",\"name\":\"namespace\",\"query\":\"label_values(kube_namespace_status_phase{job=\\\"kube-state-metrics\\\", cluster=\\\"$cluster\\\"}, namespace)\",\"refresh\":2,\"sort\":1,\"type\":\"query\"}]},\"time\":{\"from\":\"now-1h\",\"to\":\"now\"},\"timezone\": \"utc\",\"title\":\"Kubernetes / Compute Resources / Namespace (Pods)\",\"uid\":\"85a562078cdf77779eaa1add43ccec1e\"}" } }; -export const ConfigMap_KubePrometheusStackK8sResourcesNode: ConfigMap = { +export const ConfigMap_KubePrometheusStackK8sResourcesNode: KubernetesResource = { apiVersion: "v1", kind: "ConfigMap", metadata: { @@ -56835,7 +56835,7 @@ export const ConfigMap_KubePrometheusStackK8sResourcesNode: ConfigMap = { "k8s-resources-node.json": "{\"editable\":true,\"links\":[{\"asDropdown\":true,\"includeVars\":true,\"keepTime\":true,\"tags\":[\"kubernetes-mixin\"],\"targetBlank\":false,\"title\":\"Kubernetes\",\"type\":\"dashboards\"}],\"panels\":[{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true,\"stacking\":{\"mode\":\"normal\"}}},\"overrides\":[{\"matcher\":{\"id\":\"byName\",\"options\":\"max capacity\"},\"properties\":[{\"id\":\"color\",\"value\":{\"fixedColor\":\"red\",\"mode\":\"fixed\"}},{\"id\":\"custom.stacking\",\"value\":{\"mode\":\"none\"}},{\"id\":\"custom.hideFrom\",\"value\":{\"legend\":false,\"tooltip\":true,\"viz\":false}},{\"id\":\"custom.lineStyle\",\"value\":{\"dash\":[10,10],\"fill\":\"dash\"}}]}]},\"gridPos\":{\"h\":6,\"w\":24,\"x\":0,\"y\":0},\"id\":1,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(kube_node_status_capacity{cluster=\\\"$cluster\\\", job=\\\"kube-state-metrics\\\", node=~\\\"$node\\\", resource=\\\"cpu\\\"})\",\"legendFormat\":\"max capacity\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(node_namespace_pod_container:container_cpu_usage_seconds_total:sum_rate5m{cluster=\\\"$cluster\\\", node=~\\\"$node\\\"}) by (pod)\",\"legendFormat\":\"{{pod}}\"}],\"title\":\"CPU Usage\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"overrides\":[{\"matcher\":{\"id\":\"byRegexp\",\"options\":\"/%/\"},\"properties\":[{\"id\":\"unit\",\"value\":\"percentunit\"}]},{\"matcher\":{\"id\":\"byName\",\"options\":\"Pod\"},\"properties\":[{\"id\":\"links\",\"value\":[{\"title\":\"Drill down to pods\",\"url\":\"/d/6581e46e4e5c7ba40a07646395ef7b23/k8s-resources-pod?${datasource:queryparam}&var-cluster=$cluster&var-namespace=$namespace&var-pod=${__data.fields.Pod}\"}]}]}]},\"gridPos\":{\"h\":6,\"w\":24,\"x\":0,\"y\":6},\"id\":2,\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(node_namespace_pod_container:container_cpu_usage_seconds_total:sum_rate5m{cluster=\\\"$cluster\\\", node=~\\\"$node\\\"}) by (pod)\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(cluster:namespace:pod_cpu:active:kube_pod_container_resource_requests{cluster=\\\"$cluster\\\", node=~\\\"$node\\\"}) by (pod)\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(node_namespace_pod_container:container_cpu_usage_seconds_total:sum_rate5m{cluster=\\\"$cluster\\\", node=~\\\"$node\\\"}) by (pod) / sum(cluster:namespace:pod_cpu:active:kube_pod_container_resource_requests{cluster=\\\"$cluster\\\", node=~\\\"$node\\\"}) by (pod)\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(cluster:namespace:pod_cpu:active:kube_pod_container_resource_limits{cluster=\\\"$cluster\\\", node=~\\\"$node\\\"}) by (pod)\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(node_namespace_pod_container:container_cpu_usage_seconds_total:sum_rate5m{cluster=\\\"$cluster\\\", node=~\\\"$node\\\"}) by (pod) / sum(cluster:namespace:pod_cpu:active:kube_pod_container_resource_limits{cluster=\\\"$cluster\\\", node=~\\\"$node\\\"}) by (pod)\",\"format\":\"table\",\"instant\":true}],\"title\":\"CPU Quota\",\"transformations\":[{\"id\":\"joinByField\",\"options\":{\"byField\":\"pod\",\"mode\":\"outer\"}},{\"id\":\"organize\",\"options\":{\"excludeByName\":{\"Time\":true,\"Time 1\":true,\"Time 2\":true,\"Time 3\":true,\"Time 4\":true,\"Time 5\":true},\"renameByName\":{\"Value #A\":\"CPU Usage\",\"Value #B\":\"CPU Requests\",\"Value #C\":\"CPU Requests %\",\"Value #D\":\"CPU Limits\",\"Value #E\":\"CPU Limits %\",\"pod\":\"Pod\"}}}],\"type\":\"table\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true,\"stacking\":{\"mode\":\"normal\"}},\"unit\":\"bytes\"},\"overrides\":[{\"matcher\":{\"id\":\"byName\",\"options\":\"max capacity\"},\"properties\":[{\"id\":\"color\",\"value\":{\"fixedColor\":\"red\",\"mode\":\"fixed\"}},{\"id\":\"custom.stacking\",\"value\":{\"mode\":\"none\"}},{\"id\":\"custom.hideFrom\",\"value\":{\"legend\":false,\"tooltip\":true,\"viz\":false}},{\"id\":\"custom.lineStyle\",\"value\":{\"dash\":[10,10],\"fill\":\"dash\"}}]}]},\"gridPos\":{\"h\":6,\"w\":24,\"x\":0,\"y\":12},\"id\":3,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(kube_node_status_capacity{cluster=\\\"$cluster\\\", job=\\\"kube-state-metrics\\\", node=~\\\"$node\\\", resource=\\\"memory\\\"})\",\"legendFormat\":\"max capacity\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(node_namespace_pod_container:container_memory_working_set_bytes{cluster=\\\"$cluster\\\", node=~\\\"$node\\\", container!=\\\"\\\"}) by (pod)\",\"legendFormat\":\"{{pod}}\"}],\"title\":\"Memory Usage (w/cache)\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true,\"stacking\":{\"mode\":\"normal\"}},\"unit\":\"bytes\"},\"overrides\":[{\"matcher\":{\"id\":\"byName\",\"options\":\"max capacity\"},\"properties\":[{\"id\":\"color\",\"value\":{\"fixedColor\":\"red\",\"mode\":\"fixed\"}},{\"id\":\"custom.stacking\",\"value\":{\"mode\":\"none\"}},{\"id\":\"custom.hideFrom\",\"value\":{\"legend\":false,\"tooltip\":true,\"viz\":false}},{\"id\":\"custom.lineStyle\",\"value\":{\"dash\":[10,10],\"fill\":\"dash\"}}]}]},\"gridPos\":{\"h\":6,\"w\":24,\"x\":0,\"y\":18},\"id\":4,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(kube_node_status_capacity{cluster=\\\"$cluster\\\", job=\\\"kube-state-metrics\\\", node=~\\\"$node\\\", resource=\\\"memory\\\"})\",\"legendFormat\":\"max capacity\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(node_namespace_pod_container:container_memory_rss{cluster=\\\"$cluster\\\", node=~\\\"$node\\\", container!=\\\"\\\"}) by (pod)\",\"legendFormat\":\"{{pod}}\"}],\"title\":\"Memory Usage (w/o cache)\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"unit\":\"bytes\"},\"overrides\":[{\"matcher\":{\"id\":\"byRegexp\",\"options\":\"/%/\"},\"properties\":[{\"id\":\"unit\",\"value\":\"percentunit\"}]},{\"matcher\":{\"id\":\"byName\",\"options\":\"Pod\"},\"properties\":[{\"id\":\"links\",\"value\":[{\"title\":\"Drill down to pods\",\"url\":\"/d/6581e46e4e5c7ba40a07646395ef7b23/k8s-resources-pod?${datasource:queryparam}&var-cluster=$cluster&var-namespace=$namespace&var-pod=${__data.fields.Pod}\"}]}]}]},\"gridPos\":{\"h\":6,\"w\":24,\"x\":0,\"y\":24},\"id\":5,\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(node_namespace_pod_container:container_memory_working_set_bytes{cluster=\\\"$cluster\\\", node=~\\\"$node\\\",container!=\\\"\\\"}) by (pod)\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(cluster:namespace:pod_memory:active:kube_pod_container_resource_requests{cluster=\\\"$cluster\\\", node=~\\\"$node\\\"}) by (pod)\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(node_namespace_pod_container:container_memory_working_set_bytes{cluster=\\\"$cluster\\\", node=~\\\"$node\\\",container!=\\\"\\\"}) by (pod) / sum(cluster:namespace:pod_memory:active:kube_pod_container_resource_requests{cluster=\\\"$cluster\\\", node=~\\\"$node\\\"}) by (pod)\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(cluster:namespace:pod_memory:active:kube_pod_container_resource_limits{cluster=\\\"$cluster\\\", node=~\\\"$node\\\"}) by (pod)\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(node_namespace_pod_container:container_memory_working_set_bytes{cluster=\\\"$cluster\\\", node=~\\\"$node\\\",container!=\\\"\\\"}) by (pod) / sum(cluster:namespace:pod_memory:active:kube_pod_container_resource_limits{cluster=\\\"$cluster\\\", node=~\\\"$node\\\"}) by (pod)\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(node_namespace_pod_container:container_memory_rss{cluster=\\\"$cluster\\\", node=~\\\"$node\\\",container!=\\\"\\\"}) by (pod)\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(node_namespace_pod_container:container_memory_cache{cluster=\\\"$cluster\\\", node=~\\\"$node\\\",container!=\\\"\\\"}) by (pod)\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(node_namespace_pod_container:container_memory_swap{cluster=\\\"$cluster\\\", node=~\\\"$node\\\",container!=\\\"\\\"}) by (pod)\",\"format\":\"table\",\"instant\":true}],\"title\":\"Memory Quota\",\"transformations\":[{\"id\":\"joinByField\",\"options\":{\"byField\":\"pod\",\"mode\":\"outer\"}},{\"id\":\"organize\",\"options\":{\"excludeByName\":{\"Time\":true,\"Time 1\":true,\"Time 2\":true,\"Time 3\":true,\"Time 4\":true,\"Time 5\":true,\"Time 6\":true,\"Time 7\":true,\"Time 8\":true},\"renameByName\":{\"Value #A\":\"Memory Usage\",\"Value #B\":\"Memory Requests\",\"Value #C\":\"Memory Requests %\",\"Value #D\":\"Memory Limits\",\"Value #E\":\"Memory Limits %\",\"Value #F\":\"Memory Usage (RSS)\",\"Value #G\":\"Memory Usage (Cache)\",\"Value #H\":\"Memory Usage (Swap)\",\"pod\":\"Pod\"}}}],\"type\":\"table\"}],\"refresh\":\"10s\",\"schemaVersion\":39,\"tags\":[\"kubernetes-mixin\"],\"templating\":{\"list\":[{\"current\":{\"selected\":true,\"text\":\"default\",\"value\":\"default\"},\"hide\":0,\"label\":\"Data source\",\"name\":\"datasource\",\"query\":\"prometheus\",\"regex\":\"\",\"type\":\"datasource\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"hide\":2,\"label\":\"cluster\",\"name\":\"cluster\",\"query\":\"label_values(up{job=\\\"kube-state-metrics\\\"}, cluster)\",\"refresh\":2,\"sort\":1,\"type\":\"query\",\"allValue\":\".*\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"hide\":0,\"label\":\"node\",\"multi\":true,\"name\":\"node\",\"query\":\"label_values(kube_node_info{cluster=\\\"$cluster\\\"}, node)\",\"refresh\":2,\"type\":\"query\"}]},\"time\":{\"from\":\"now-1h\",\"to\":\"now\"},\"timezone\": \"utc\",\"title\":\"Kubernetes / Compute Resources / Node (Pods)\",\"uid\":\"200ac8fdbfbb74b39aff88118e4d1c2c\"}" } }; -export const ConfigMap_KubePrometheusStackK8sResourcesPod: ConfigMap = { +export const ConfigMap_KubePrometheusStackK8sResourcesPod: KubernetesResource = { apiVersion: "v1", kind: "ConfigMap", metadata: { @@ -56858,7 +56858,7 @@ export const ConfigMap_KubePrometheusStackK8sResourcesPod: ConfigMap = { "k8s-resources-pod.json": "{\"editable\":true,\"links\":[{\"asDropdown\":true,\"includeVars\":true,\"keepTime\":true,\"tags\":[\"kubernetes-mixin\"],\"targetBlank\":false,\"title\":\"Kubernetes\",\"type\":\"dashboards\"}],\"panels\":[{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true}},\"overrides\":[{\"matcher\":{\"id\":\"byFrameRefID\",\"options\":\"B\"},\"properties\":[{\"id\":\"custom.lineStyle\",\"value\":{\"fill\":\"dash\"}},{\"id\":\"custom.lineWidth\",\"value\":2},{\"id\":\"color\",\"value\":{\"fixedColor\":\"red\",\"mode\":\"fixed\"}}]},{\"matcher\":{\"id\":\"byFrameRefID\",\"options\":\"C\"},\"properties\":[{\"id\":\"custom.lineStyle\",\"value\":{\"fill\":\"dash\"}},{\"id\":\"custom.lineWidth\",\"value\":2},{\"id\":\"color\",\"value\":{\"fixedColor\":\"orange\",\"mode\":\"fixed\"}}]}]},\"gridPos\":{\"h\":7,\"w\":24,\"x\":0,\"y\":0},\"id\":1,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(node_namespace_pod_container:container_cpu_usage_seconds_total:sum_rate5m{namespace=\\\"$namespace\\\", pod=\\\"$pod\\\", cluster=\\\"$cluster\\\", container!=\\\"\\\"}) by (container)\",\"legendFormat\":\"__auto\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(\\n kube_pod_container_resource_requests{job=\\\"kube-state-metrics\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", pod=\\\"$pod\\\", resource=\\\"cpu\\\"}\\n)\\n\",\"legendFormat\":\"requests\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(\\n kube_pod_container_resource_limits{job=\\\"kube-state-metrics\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", pod=\\\"$pod\\\", resource=\\\"cpu\\\"}\\n)\\n\",\"legendFormat\":\"limits\"}],\"title\":\"CPU Usage\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"axisColorMode\":\"thresholds\",\"axisSoftMax\":1,\"axisSoftMin\":0,\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true,\"thresholdsStyle\":{\"mode\":\"dashed+area\"}},\"unit\":\"percentunit\"},\"overrides\":[{\"matcher\":{\"id\":\"byFrameRefID\",\"options\":\"A\"},\"properties\":[{\"id\":\"thresholds\",\"value\":{\"mode\":\"absolute\",\"steps\":[{\"color\":\"green\",\"value\":null},{\"color\":\"red\",\"value\":0.25}]}},{\"id\":\"color\",\"value\":{\"mode\":\"thresholds\",\"seriesBy\":\"lastNotNull\"}}]}]},\"gridPos\":{\"h\":7,\"w\":24,\"x\":0,\"y\":7},\"id\":2,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(increase(container_cpu_cfs_throttled_periods_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", namespace=\\\"$namespace\\\", pod=\\\"$pod\\\", container!=\\\"\\\", cluster=\\\"$cluster\\\"}[$__rate_interval])) by (container) /sum(increase(container_cpu_cfs_periods_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", namespace=\\\"$namespace\\\", pod=\\\"$pod\\\", container!=\\\"\\\", cluster=\\\"$cluster\\\"}[$__rate_interval])) by (container)\",\"legendFormat\":\"__auto\"}],\"title\":\"CPU Throttling\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"overrides\":[{\"matcher\":{\"id\":\"byRegexp\",\"options\":\"/%/\"},\"properties\":[{\"id\":\"unit\",\"value\":\"percentunit\"}]}]},\"gridPos\":{\"h\":7,\"w\":24,\"x\":0,\"y\":14},\"id\":3,\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(node_namespace_pod_container:container_cpu_usage_seconds_total:sum_rate5m{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", pod=\\\"$pod\\\", container!=\\\"\\\"}) by (container)\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(cluster:namespace:pod_cpu:active:kube_pod_container_resource_requests{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", pod=\\\"$pod\\\", container!=\\\"\\\"}) by (container)\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(node_namespace_pod_container:container_cpu_usage_seconds_total:sum_rate5m{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", pod=\\\"$pod\\\", container!=\\\"\\\"}) by (container) / sum(cluster:namespace:pod_cpu:active:kube_pod_container_resource_requests{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", pod=\\\"$pod\\\", container!=\\\"\\\"}) by (container)\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(cluster:namespace:pod_cpu:active:kube_pod_container_resource_limits{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", pod=\\\"$pod\\\", container!=\\\"\\\"}) by (container)\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(node_namespace_pod_container:container_cpu_usage_seconds_total:sum_rate5m{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", pod=\\\"$pod\\\", container!=\\\"\\\"}) by (container) / sum(cluster:namespace:pod_cpu:active:kube_pod_container_resource_limits{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", pod=\\\"$pod\\\", container!=\\\"\\\"}) by (container)\",\"format\":\"table\",\"instant\":true}],\"title\":\"CPU Quota\",\"transformations\":[{\"id\":\"joinByField\",\"options\":{\"byField\":\"container\",\"mode\":\"outer\"}},{\"id\":\"organize\",\"options\":{\"excludeByName\":{\"Time\":true,\"Time 1\":true,\"Time 2\":true,\"Time 3\":true,\"Time 4\":true,\"Time 5\":true},\"indexByName\":{\"Time 1\":0,\"Time 2\":1,\"Time 3\":2,\"Time 4\":3,\"Time 5\":4,\"Value #A\":6,\"Value #B\":7,\"Value #C\":8,\"Value #D\":9,\"Value #E\":10,\"container\":5},\"renameByName\":{\"Value #A\":\"CPU Usage\",\"Value #B\":\"CPU Requests\",\"Value #C\":\"CPU Requests %\",\"Value #D\":\"CPU Limits\",\"Value #E\":\"CPU Limits %\",\"container\":\"Container\"}}}],\"type\":\"table\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"bytes\"},\"overrides\":[{\"matcher\":{\"id\":\"byFrameRefID\",\"options\":\"B\"},\"properties\":[{\"id\":\"custom.lineStyle\",\"value\":{\"fill\":\"dash\"}},{\"id\":\"custom.lineWidth\",\"value\":2},{\"id\":\"color\",\"value\":{\"fixedColor\":\"red\",\"mode\":\"fixed\"}}]},{\"matcher\":{\"id\":\"byFrameRefID\",\"options\":\"C\"},\"properties\":[{\"id\":\"custom.lineStyle\",\"value\":{\"fill\":\"dash\"}},{\"id\":\"custom.lineWidth\",\"value\":2},{\"id\":\"color\",\"value\":{\"fixedColor\":\"orange\",\"mode\":\"fixed\"}}]}]},\"gridPos\":{\"h\":7,\"w\":24,\"x\":0,\"y\":21},\"id\":4,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(container_memory_working_set_bytes{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", pod=\\\"$pod\\\", container!=\\\"\\\", image!=\\\"\\\"}) by (container)\",\"legendFormat\":\"__auto\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(\\n kube_pod_container_resource_requests{job=\\\"kube-state-metrics\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", pod=\\\"$pod\\\", resource=\\\"memory\\\"}\\n)\\n\",\"legendFormat\":\"requests\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(\\n kube_pod_container_resource_limits{job=\\\"kube-state-metrics\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", pod=\\\"$pod\\\", resource=\\\"memory\\\"}\\n)\\n\",\"legendFormat\":\"limits\"}],\"title\":\"Memory Usage (WSS)\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"unit\":\"bytes\"},\"overrides\":[{\"matcher\":{\"id\":\"byRegexp\",\"options\":\"/%/\"},\"properties\":[{\"id\":\"unit\",\"value\":\"percentunit\"}]}]},\"gridPos\":{\"h\":7,\"w\":24,\"x\":0,\"y\":28},\"id\":5,\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(container_memory_working_set_bytes{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", pod=\\\"$pod\\\", container!=\\\"\\\", image!=\\\"\\\"}) by (container)\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(cluster:namespace:pod_memory:active:kube_pod_container_resource_requests{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", pod=\\\"$pod\\\"}) by (container)\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(container_memory_working_set_bytes{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", pod=\\\"$pod\\\", image!=\\\"\\\"}) by (container) / sum(cluster:namespace:pod_memory:active:kube_pod_container_resource_requests{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", pod=\\\"$pod\\\"}) by (container)\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(cluster:namespace:pod_memory:active:kube_pod_container_resource_limits{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", pod=\\\"$pod\\\"}) by (container)\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(container_memory_working_set_bytes{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", pod=\\\"$pod\\\", container!=\\\"\\\", image!=\\\"\\\"}) by (container) / sum(cluster:namespace:pod_memory:active:kube_pod_container_resource_limits{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", pod=\\\"$pod\\\"}) by (container)\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(container_memory_rss{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", pod=\\\"$pod\\\", container != \\\"\\\", container != \\\"POD\\\"}) by (container)\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(container_memory_cache{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", pod=\\\"$pod\\\", container != \\\"\\\", container != \\\"POD\\\"}) by (container)\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(container_memory_swap{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", pod=\\\"$pod\\\", container != \\\"\\\", container != \\\"POD\\\"}) by (container)\",\"format\":\"table\",\"instant\":true}],\"title\":\"Memory Quota\",\"transformations\":[{\"id\":\"joinByField\",\"options\":{\"byField\":\"container\",\"mode\":\"outer\"}},{\"id\":\"organize\",\"options\":{\"excludeByName\":{\"Time\":true,\"Time 1\":true,\"Time 2\":true,\"Time 3\":true,\"Time 4\":true,\"Time 5\":true,\"Time 6\":true,\"Time 7\":true,\"Time 8\":true},\"indexByName\":{\"Time 1\":0,\"Time 2\":1,\"Time 3\":2,\"Time 4\":3,\"Time 5\":4,\"Time 6\":5,\"Time 7\":6,\"Time 8\":7,\"Value #A\":9,\"Value #B\":10,\"Value #C\":11,\"Value #D\":12,\"Value #E\":13,\"Value #F\":14,\"Value #G\":15,\"Value #H\":16,\"container\":8},\"renameByName\":{\"Value #A\":\"Memory Usage\",\"Value #B\":\"Memory Requests\",\"Value #C\":\"Memory Requests %\",\"Value #D\":\"Memory Limits\",\"Value #E\":\"Memory Limits %\",\"Value #F\":\"Memory Usage (RSS)\",\"Value #G\":\"Memory Usage (Cache)\",\"Value #H\":\"Memory Usage (Swap)\",\"container\":\"Container\"}}}],\"type\":\"table\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"Bps\"}},\"gridPos\":{\"h\":7,\"w\":12,\"x\":0,\"y\":35},\"id\":6,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(irate(container_network_receive_bytes_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", pod=~\\\"$pod\\\"}[$__rate_interval])) by (pod)\",\"legendFormat\":\"__auto\"}],\"title\":\"Receive Bandwidth\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"Bps\"}},\"gridPos\":{\"h\":7,\"w\":12,\"x\":12,\"y\":35},\"id\":7,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(rate(container_network_transmit_bytes_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", pod=~\\\"$pod\\\"}[$__rate_interval])) by (pod)\",\"legendFormat\":\"__auto\"}],\"title\":\"Transmit Bandwidth\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"pps\"}},\"gridPos\":{\"h\":7,\"w\":12,\"x\":0,\"y\":42},\"id\":8,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(rate(container_network_receive_packets_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", pod=~\\\"$pod\\\"}[$__rate_interval])) by (pod)\",\"legendFormat\":\"__auto\"}],\"title\":\"Rate of Received Packets\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"pps\"}},\"gridPos\":{\"h\":7,\"w\":12,\"x\":12,\"y\":42},\"id\":9,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(rate(container_network_transmit_packets_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", pod=~\\\"$pod\\\"}[$__rate_interval])) by (pod)\",\"legendFormat\":\"__auto\"}],\"title\":\"Rate of Transmitted Packets\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"pps\"}},\"gridPos\":{\"h\":7,\"w\":12,\"x\":0,\"y\":49},\"id\":10,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(rate(container_network_receive_packets_dropped_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", pod=~\\\"$pod\\\"}[$__rate_interval])) by (pod)\",\"legendFormat\":\"__auto\"}],\"title\":\"Rate of Received Packets Dropped\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"pps\"}},\"gridPos\":{\"h\":7,\"w\":12,\"x\":12,\"y\":49},\"id\":11,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(rate(container_network_transmit_packets_dropped_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", pod=~\\\"$pod\\\"}[$__rate_interval])) by (pod)\",\"legendFormat\":\"__auto\"}],\"title\":\"Rate of Transmitted Packets Dropped\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"iops\"}},\"gridPos\":{\"h\":7,\"w\":12,\"x\":0,\"y\":56},\"id\":12,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"ceil(sum by(pod) (rate(container_fs_reads_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", device=~\\\"(/dev/)?(mmcblk.p.+|nvme.+|rbd.+|sd.+|vd.+|xvd.+|dm-.+|md.+|dasd.+)\\\", container!=\\\"\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", pod=~\\\"$pod\\\"}[$__rate_interval])))\",\"legendFormat\":\"Reads\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"ceil(sum by(pod) (rate(container_fs_writes_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", device=~\\\"(/dev/)?(mmcblk.p.+|nvme.+|rbd.+|sd.+|vd.+|xvd.+|dm-.+|md.+|dasd.+)\\\", container!=\\\"\\\", cluster=\\\"$cluster\\\",namespace=\\\"$namespace\\\", pod=~\\\"$pod\\\"}[$__rate_interval])))\",\"legendFormat\":\"Writes\"}],\"title\":\"IOPS (Pod)\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"Bps\"}},\"gridPos\":{\"h\":7,\"w\":12,\"x\":12,\"y\":56},\"id\":13,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum by(pod) (rate(container_fs_reads_bytes_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", device=~\\\"(/dev/)?(mmcblk.p.+|nvme.+|rbd.+|sd.+|vd.+|xvd.+|dm-.+|md.+|dasd.+)\\\", container!=\\\"\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", pod=~\\\"$pod\\\"}[$__rate_interval]))\",\"legendFormat\":\"Reads\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum by(pod) (rate(container_fs_writes_bytes_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", device=~\\\"(/dev/)?(mmcblk.p.+|nvme.+|rbd.+|sd.+|vd.+|xvd.+|dm-.+|md.+|dasd.+)\\\", container!=\\\"\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", pod=~\\\"$pod\\\"}[$__rate_interval]))\",\"legendFormat\":\"Writes\"}],\"title\":\"ThroughPut (Pod)\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"iops\"}},\"gridPos\":{\"h\":7,\"w\":12,\"x\":0,\"y\":63},\"id\":14,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"ceil(sum by(container) (rate(container_fs_reads_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", container!=\\\"\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", pod=\\\"$pod\\\"}[$__rate_interval]) + rate(container_fs_writes_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", container!=\\\"\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", pod=\\\"$pod\\\"}[$__rate_interval])))\",\"legendFormat\":\"__auto\"}],\"title\":\"IOPS (Containers)\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"Bps\"}},\"gridPos\":{\"h\":7,\"w\":12,\"x\":12,\"y\":63},\"id\":15,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum by(container) (rate(container_fs_reads_bytes_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", container!=\\\"\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", pod=\\\"$pod\\\"}[$__rate_interval]) + rate(container_fs_writes_bytes_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", container!=\\\"\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", pod=\\\"$pod\\\"}[$__rate_interval]))\",\"legendFormat\":\"__auto\"}],\"title\":\"ThroughPut (Containers)\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"overrides\":[{\"matcher\":{\"id\":\"byRegexp\",\"options\":\"/IOPS/\"},\"properties\":[{\"id\":\"unit\",\"value\":\"iops\"}]},{\"matcher\":{\"id\":\"byRegexp\",\"options\":\"/Throughput/\"},\"properties\":[{\"id\":\"unit\",\"value\":\"Bps\"}]}]},\"gridPos\":{\"h\":7,\"w\":24,\"x\":0,\"y\":70},\"id\":16,\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum by(container) (rate(container_fs_reads_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", device=~\\\"(/dev/)?(mmcblk.p.+|nvme.+|rbd.+|sd.+|vd.+|xvd.+|dm-.+|md.+|dasd.+)\\\", container!=\\\"\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", pod=\\\"$pod\\\"}[$__rate_interval]))\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum by(container) (rate(container_fs_writes_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\",device=~\\\"(/dev/)?(mmcblk.p.+|nvme.+|rbd.+|sd.+|vd.+|xvd.+|dm-.+|md.+|dasd.+)\\\", container!=\\\"\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", pod=\\\"$pod\\\"}[$__rate_interval]))\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum by(container) (rate(container_fs_reads_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", device=~\\\"(/dev/)?(mmcblk.p.+|nvme.+|rbd.+|sd.+|vd.+|xvd.+|dm-.+|md.+|dasd.+)\\\", container!=\\\"\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", pod=\\\"$pod\\\"}[$__rate_interval]) + rate(container_fs_writes_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", device=~\\\"(/dev/)?(mmcblk.p.+|nvme.+|rbd.+|sd.+|vd.+|xvd.+|dm-.+|md.+|dasd.+)\\\", container!=\\\"\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", pod=\\\"$pod\\\"}[$__rate_interval]))\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum by(container) (rate(container_fs_reads_bytes_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", device=~\\\"(/dev/)?(mmcblk.p.+|nvme.+|rbd.+|sd.+|vd.+|xvd.+|dm-.+|md.+|dasd.+)\\\", container!=\\\"\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", pod=\\\"$pod\\\"}[$__rate_interval]))\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum by(container) (rate(container_fs_writes_bytes_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", device=~\\\"(/dev/)?(mmcblk.p.+|nvme.+|rbd.+|sd.+|vd.+|xvd.+|dm-.+|md.+|dasd.+)\\\", container!=\\\"\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", pod=\\\"$pod\\\"}[$__rate_interval]))\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum by(container) (rate(container_fs_reads_bytes_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", device=~\\\"(/dev/)?(mmcblk.p.+|nvme.+|rbd.+|sd.+|vd.+|xvd.+|dm-.+|md.+|dasd.+)\\\", container!=\\\"\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", pod=\\\"$pod\\\"}[$__rate_interval]) + rate(container_fs_writes_bytes_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", device=~\\\"(/dev/)?(mmcblk.p.+|nvme.+|rbd.+|sd.+|vd.+|xvd.+|dm-.+|md.+|dasd.+)\\\", container!=\\\"\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", pod=\\\"$pod\\\"}[$__rate_interval]))\",\"format\":\"table\",\"instant\":true}],\"title\":\"Current Storage IO\",\"transformations\":[{\"id\":\"joinByField\",\"options\":{\"byField\":\"container\",\"mode\":\"outer\"}},{\"id\":\"organize\",\"options\":{\"excludeByName\":{\"Time\":true,\"Time 1\":true,\"Time 2\":true,\"Time 3\":true,\"Time 4\":true,\"Time 5\":true,\"Time 6\":true},\"indexByName\":{\"Time 1\":0,\"Time 2\":1,\"Time 3\":2,\"Time 4\":3,\"Time 5\":4,\"Time 6\":5,\"Value #A\":7,\"Value #B\":8,\"Value #C\":9,\"Value #D\":10,\"Value #E\":11,\"Value #F\":12,\"container\":6},\"renameByName\":{\"Value #A\":\"IOPS(Reads)\",\"Value #B\":\"IOPS(Writes)\",\"Value #C\":\"IOPS(Reads + Writes)\",\"Value #D\":\"Throughput(Read)\",\"Value #E\":\"Throughput(Write)\",\"Value #F\":\"Throughput(Read + Write)\",\"container\":\"Container\"}}}],\"type\":\"table\"}],\"refresh\":\"10s\",\"schemaVersion\":39,\"tags\":[\"kubernetes-mixin\"],\"templating\":{\"list\":[{\"current\":{\"selected\":true,\"text\":\"default\",\"value\":\"default\"},\"hide\":0,\"label\":\"Data source\",\"name\":\"datasource\",\"query\":\"prometheus\",\"regex\":\"\",\"type\":\"datasource\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"hide\":2,\"label\":\"cluster\",\"name\":\"cluster\",\"query\":\"label_values(up{job=\\\"kube-state-metrics\\\"}, cluster)\",\"refresh\":2,\"sort\":1,\"type\":\"query\",\"allValue\":\".*\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"hide\":0,\"label\":\"namespace\",\"name\":\"namespace\",\"query\":\"label_values(kube_namespace_status_phase{job=\\\"kube-state-metrics\\\", cluster=\\\"$cluster\\\"}, namespace)\",\"refresh\":2,\"sort\":1,\"type\":\"query\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"hide\":0,\"label\":\"pod\",\"name\":\"pod\",\"query\":\"label_values(kube_pod_info{job=\\\"kube-state-metrics\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\"}, pod)\",\"refresh\":2,\"sort\":1,\"type\":\"query\"}]},\"time\":{\"from\":\"now-1h\",\"to\":\"now\"},\"timezone\": \"utc\",\"title\":\"Kubernetes / Compute Resources / Pod\",\"uid\":\"6581e46e4e5c7ba40a07646395ef7b23\"}" } }; -export const ConfigMap_KubePrometheusStackK8sResourcesWorkload: ConfigMap = { +export const ConfigMap_KubePrometheusStackK8sResourcesWorkload: KubernetesResource = { apiVersion: "v1", kind: "ConfigMap", metadata: { @@ -56881,7 +56881,7 @@ export const ConfigMap_KubePrometheusStackK8sResourcesWorkload: ConfigMap = { "k8s-resources-workload.json": "{\"editable\":true,\"links\":[{\"asDropdown\":true,\"includeVars\":true,\"keepTime\":true,\"tags\":[\"kubernetes-mixin\"],\"targetBlank\":false,\"title\":\"Kubernetes\",\"type\":\"dashboards\"}],\"panels\":[{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true}}},\"gridPos\":{\"h\":7,\"w\":24,\"x\":0,\"y\":0},\"id\":1,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(\\n node_namespace_pod_container:container_cpu_usage_seconds_total:sum_rate5m{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\"}\\n * on(namespace,pod)\\n group_left(workload, workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", workload=\\\"$workload\\\", workload_type=~\\\"$type\\\"}\\n) by (pod)\\n\",\"legendFormat\":\"__auto\"}],\"title\":\"CPU Usage\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"overrides\":[{\"matcher\":{\"id\":\"byRegexp\",\"options\":\"/%/\"},\"properties\":[{\"id\":\"unit\",\"value\":\"percentunit\"}]},{\"matcher\":{\"id\":\"byName\",\"options\":\"Pod\"},\"properties\":[{\"id\":\"links\",\"value\":[{\"title\":\"Drill down to pods\",\"url\":\"/d/6581e46e4e5c7ba40a07646395ef7b23/k8s-resources-pod?${datasource:queryparam}&var-cluster=$cluster&var-namespace=$namespace&var-pod=${__data.fields.Pod}\"}]}]}]},\"gridPos\":{\"h\":7,\"w\":24,\"x\":0,\"y\":7},\"id\":2,\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(\\n node_namespace_pod_container:container_cpu_usage_seconds_total:sum_rate5m{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\"}\\n * on(namespace,pod)\\n group_left(workload, workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", workload=\\\"$workload\\\", workload_type=~\\\"$type\\\"}\\n) by (pod)\\n\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(\\n kube_pod_container_resource_requests{job=\\\"kube-state-metrics\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", resource=\\\"cpu\\\"}\\n * on(namespace,pod)\\n group_left(workload, workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", workload=\\\"$workload\\\", workload_type=~\\\"$type\\\"}\\n) by (pod)\\n\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(\\n node_namespace_pod_container:container_cpu_usage_seconds_total:sum_rate5m{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\"}\\n * on(namespace,pod)\\n group_left(workload, workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", workload=\\\"$workload\\\", workload_type=~\\\"$type\\\"}\\n) by (pod)\\n/sum(\\n kube_pod_container_resource_requests{job=\\\"kube-state-metrics\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", resource=\\\"cpu\\\"}\\n * on(namespace,pod)\\n group_left(workload, workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", workload=\\\"$workload\\\", workload_type=~\\\"$type\\\"}\\n) by (pod)\\n\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(\\n kube_pod_container_resource_limits{job=\\\"kube-state-metrics\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", resource=\\\"cpu\\\"}\\n * on(namespace,pod)\\n group_left(workload, workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", workload=\\\"$workload\\\", workload_type=~\\\"$type\\\"}\\n) by (pod)\\n\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(\\n node_namespace_pod_container:container_cpu_usage_seconds_total:sum_rate5m{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\"}\\n * on(namespace,pod)\\n group_left(workload, workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", workload=\\\"$workload\\\", workload_type=~\\\"$type\\\"}\\n) by (pod)\\n/sum(\\n kube_pod_container_resource_limits{job=\\\"kube-state-metrics\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", resource=\\\"cpu\\\"}\\n * on(namespace,pod)\\n group_left(workload, workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", workload=\\\"$workload\\\", workload_type=~\\\"$type\\\"}\\n) by (pod)\\n\",\"format\":\"table\",\"instant\":true}],\"title\":\"CPU Quota\",\"transformations\":[{\"id\":\"joinByField\",\"options\":{\"byField\":\"pod\",\"mode\":\"outer\"}},{\"id\":\"organize\",\"options\":{\"excludeByName\":{\"Time\":true,\"Time 1\":true,\"Time 2\":true,\"Time 3\":true,\"Time 4\":true,\"Time 5\":true},\"indexByName\":{\"Time 1\":0,\"Time 2\":1,\"Time 3\":2,\"Time 4\":3,\"Time 5\":4,\"Value #A\":6,\"Value #B\":7,\"Value #C\":8,\"Value #D\":9,\"Value #E\":10,\"pod\":5},\"renameByName\":{\"Value #A\":\"CPU Usage\",\"Value #B\":\"CPU Requests\",\"Value #C\":\"CPU Requests %\",\"Value #D\":\"CPU Limits\",\"Value #E\":\"CPU Limits %\",\"pod\":\"Pod\"}}}],\"type\":\"table\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"bytes\"}},\"gridPos\":{\"h\":7,\"w\":24,\"x\":0,\"y\":14},\"id\":3,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(\\n container_memory_working_set_bytes{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", container!=\\\"\\\", image!=\\\"\\\"}\\n * on(namespace,pod)\\n group_left(workload, workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", workload=\\\"$workload\\\", workload_type=~\\\"$type\\\"}\\n) by (pod)\\n\",\"legendFormat\":\"__auto\"}],\"title\":\"Memory Usage\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"unit\":\"bytes\"},\"overrides\":[{\"matcher\":{\"id\":\"byRegexp\",\"options\":\"/%/\"},\"properties\":[{\"id\":\"unit\",\"value\":\"percentunit\"}]},{\"matcher\":{\"id\":\"byName\",\"options\":\"Pod\"},\"properties\":[{\"id\":\"links\",\"value\":[{\"title\":\"Drill down to pods\",\"url\":\"/d/6581e46e4e5c7ba40a07646395ef7b23/k8s-resources-pod?${datasource:queryparam}&var-cluster=$cluster&var-namespace=$namespace&var-pod=${__data.fields.Pod}\"}]}]}]},\"gridPos\":{\"h\":7,\"w\":24,\"x\":0,\"y\":21},\"id\":4,\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(\\n container_memory_working_set_bytes{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", container!=\\\"\\\", image!=\\\"\\\"}\\n * on(namespace,pod)\\n group_left(workload, workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", workload=\\\"$workload\\\", workload_type=~\\\"$type\\\"}\\n) by (pod)\\n\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(\\n kube_pod_container_resource_requests{job=\\\"kube-state-metrics\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", resource=\\\"memory\\\"}\\n * on(namespace,pod)\\n group_left(workload, workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", workload=\\\"$workload\\\", workload_type=~\\\"$type\\\"}\\n) by (pod)\\n\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(\\n container_memory_working_set_bytes{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", container!=\\\"\\\", image!=\\\"\\\"}\\n * on(namespace,pod)\\n group_left(workload, workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", workload=\\\"$workload\\\", workload_type=~\\\"$type\\\"}\\n) by (pod)\\n/sum(\\n kube_pod_container_resource_requests{job=\\\"kube-state-metrics\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", resource=\\\"memory\\\"}\\n * on(namespace,pod)\\n group_left(workload, workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", workload=\\\"$workload\\\", workload_type=~\\\"$type\\\"}\\n) by (pod)\\n\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(\\n kube_pod_container_resource_limits{job=\\\"kube-state-metrics\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", resource=\\\"memory\\\"}\\n * on(namespace,pod)\\n group_left(workload, workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", workload=\\\"$workload\\\", workload_type=~\\\"$type\\\"}\\n) by (pod)\\n\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(\\n container_memory_working_set_bytes{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", container!=\\\"\\\", image!=\\\"\\\"}\\n * on(namespace,pod)\\n group_left(workload, workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", workload=\\\"$workload\\\", workload_type=~\\\"$type\\\"}\\n) by (pod)\\n/sum(\\n kube_pod_container_resource_limits{job=\\\"kube-state-metrics\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", resource=\\\"memory\\\"}\\n * on(namespace,pod)\\n group_left(workload, workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", workload=\\\"$workload\\\", workload_type=~\\\"$type\\\"}\\n) by (pod)\\n\",\"format\":\"table\",\"instant\":true}],\"title\":\"Memory Quota\",\"transformations\":[{\"id\":\"joinByField\",\"options\":{\"byField\":\"pod\",\"mode\":\"outer\"}},{\"id\":\"organize\",\"options\":{\"excludeByName\":{\"Time\":true,\"Time 1\":true,\"Time 2\":true,\"Time 3\":true,\"Time 4\":true,\"Time 5\":true},\"indexByName\":{\"Time 1\":0,\"Time 2\":1,\"Time 3\":2,\"Time 4\":3,\"Time 5\":4,\"Value #A\":9,\"Value #B\":10,\"Value #C\":11,\"Value #D\":12,\"Value #E\":13,\"pod\":8},\"renameByName\":{\"Value #A\":\"Memory Usage\",\"Value #B\":\"Memory Requests\",\"Value #C\":\"Memory Requests %\",\"Value #D\":\"Memory Limits\",\"Value #E\":\"Memory Limits %\",\"pod\":\"Pod\"}}}],\"type\":\"table\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"overrides\":[{\"matcher\":{\"id\":\"byRegexp\",\"options\":\"/Bandwidth/\"},\"properties\":[{\"id\":\"unit\",\"value\":\"Bps\"}]},{\"matcher\":{\"id\":\"byRegexp\",\"options\":\"/Packets/\"},\"properties\":[{\"id\":\"unit\",\"value\":\"pps\"}]},{\"matcher\":{\"id\":\"byName\",\"options\":\"Pod\"},\"properties\":[{\"id\":\"links\",\"value\":[{\"title\":\"Drill down to pods\",\"url\":\"/d/6581e46e4e5c7ba40a07646395ef7b23/k8s-resources-pod?${datasource:queryparam}&var-cluster=$cluster&var-namespace=$namespace&var-pod=${__data.fields.Pod}\"}]}]}]},\"gridPos\":{\"h\":7,\"w\":24,\"x\":0,\"y\":28},\"id\":5,\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"(sum(rate(container_network_receive_bytes_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\"}[$__rate_interval])\\n* on (namespace,pod)\\ngroup_left(workload,workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", workload=~\\\"$workload\\\", workload_type=~\\\"$type\\\"}) by (pod))\\n\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"(sum(rate(container_network_transmit_bytes_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\"}[$__rate_interval])\\n* on (namespace,pod)\\ngroup_left(workload,workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", workload=~\\\"$workload\\\", workload_type=~\\\"$type\\\"}) by (pod))\\n\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"(sum(rate(container_network_receive_packets_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\"}[$__rate_interval])\\n* on (namespace,pod)\\ngroup_left(workload,workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", workload=~\\\"$workload\\\", workload_type=~\\\"$type\\\"}) by (pod))\\n\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"(sum(rate(container_network_transmit_packets_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\"}[$__rate_interval])\\n* on (namespace,pod)\\ngroup_left(workload,workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", workload=~\\\"$workload\\\", workload_type=~\\\"$type\\\"}) by (pod))\\n\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"(sum(rate(container_network_receive_packets_dropped_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\"}[$__rate_interval])\\n* on (namespace,pod)\\ngroup_left(workload,workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", workload=~\\\"$workload\\\", workload_type=~\\\"$type\\\"}) by (pod))\\n\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"(sum(rate(container_network_transmit_packets_dropped_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\"}[$__rate_interval])\\n* on (namespace,pod)\\ngroup_left(workload,workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", workload=~\\\"$workload\\\", workload_type=~\\\"$type\\\"}) by (pod))\\n\",\"format\":\"table\",\"instant\":true}],\"title\":\"Current Network Usage\",\"transformations\":[{\"id\":\"joinByField\",\"options\":{\"byField\":\"pod\",\"mode\":\"outer\"}},{\"id\":\"organize\",\"options\":{\"excludeByName\":{\"Time\":true,\"Time 1\":true,\"Time 2\":true,\"Time 3\":true,\"Time 4\":true,\"Time 5\":true,\"Time 6\":true},\"indexByName\":{\"Time 1\":0,\"Time 2\":1,\"Time 3\":2,\"Time 4\":3,\"Time 5\":4,\"Time 6\":5,\"Value #A\":7,\"Value #B\":8,\"Value #C\":9,\"Value #D\":10,\"Value #E\":11,\"Value #F\":12,\"pod\":6},\"renameByName\":{\"Value #A\":\"Current Receive Bandwidth\",\"Value #B\":\"Current Transmit Bandwidth\",\"Value #C\":\"Rate of Received Packets\",\"Value #D\":\"Rate of Transmitted Packets\",\"Value #E\":\"Rate of Received Packets Dropped\",\"Value #F\":\"Rate of Transmitted Packets Dropped\",\"pod\":\"Pod\"}}}],\"type\":\"table\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"Bps\"}},\"gridPos\":{\"h\":7,\"w\":12,\"x\":0,\"y\":35},\"id\":6,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"(sum(rate(container_network_receive_bytes_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\"}[$__rate_interval])\\n* on (namespace,pod)\\ngroup_left(workload,workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", workload=~\\\"$workload\\\", workload_type=~\\\"$type\\\"}) by (pod))\\n\",\"legendFormat\":\"__auto\"}],\"title\":\"Receive Bandwidth\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"Bps\"}},\"gridPos\":{\"h\":7,\"w\":12,\"x\":12,\"y\":35},\"id\":7,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"(sum(rate(container_network_transmit_bytes_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\"}[$__rate_interval])\\n* on (namespace,pod)\\ngroup_left(workload,workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", workload=~\\\"$workload\\\", workload_type=~\\\"$type\\\"}) by (pod))\\n\",\"legendFormat\":\"__auto\"}],\"title\":\"Transmit Bandwidth\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"Bps\"}},\"gridPos\":{\"h\":7,\"w\":12,\"x\":0,\"y\":42},\"id\":8,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"(avg(rate(container_network_receive_bytes_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\"}[$__rate_interval])\\n* on (namespace,pod)\\ngroup_left(workload,workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", workload=~\\\"$workload\\\", workload_type=~\\\"$type\\\"}) by (pod))\\n\",\"legendFormat\":\"__auto\"}],\"title\":\"Average Container Bandwidth by Pod: Received\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"Bps\"}},\"gridPos\":{\"h\":7,\"w\":12,\"x\":12,\"y\":42},\"id\":9,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"(avg(rate(container_network_transmit_bytes_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\"}[$__rate_interval])\\n* on (namespace,pod)\\ngroup_left(workload,workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", workload=~\\\"$workload\\\", workload_type=~\\\"$type\\\"}) by (pod))\\n\",\"legendFormat\":\"__auto\"}],\"title\":\"Average Container Bandwidth by Pod: Transmitted\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"pps\"}},\"gridPos\":{\"h\":7,\"w\":12,\"x\":0,\"y\":49},\"id\":10,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"(sum(rate(container_network_receive_packets_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\"}[$__rate_interval])\\n* on (namespace,pod)\\ngroup_left(workload,workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", workload=~\\\"$workload\\\", workload_type=~\\\"$type\\\"}) by (pod))\\n\",\"legendFormat\":\"__auto\"}],\"title\":\"Rate of Received Packets\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"pps\"}},\"gridPos\":{\"h\":7,\"w\":12,\"x\":12,\"y\":49},\"id\":11,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"(sum(rate(container_network_transmit_packets_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\"}[$__rate_interval])\\n* on (namespace,pod)\\ngroup_left(workload,workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", workload=~\\\"$workload\\\", workload_type=~\\\"$type\\\"}) by (pod))\\n\",\"legendFormat\":\"__auto\"}],\"title\":\"Rate of Transmitted Packets\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"pps\"}},\"gridPos\":{\"h\":7,\"w\":12,\"x\":0,\"y\":56},\"id\":12,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"(sum(rate(container_network_receive_packets_dropped_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\"}[$__rate_interval])\\n* on (namespace,pod)\\ngroup_left(workload,workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", workload=~\\\"$workload\\\", workload_type=~\\\"$type\\\"}) by (pod))\\n\",\"legendFormat\":\"__auto\"}],\"title\":\"Rate of Received Packets Dropped\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"pps\"}},\"gridPos\":{\"h\":7,\"w\":12,\"x\":12,\"y\":56},\"id\":13,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"(sum(rate(container_network_transmit_packets_dropped_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\"}[$__rate_interval])\\n* on (namespace,pod)\\ngroup_left(workload,workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", workload=~\\\"$workload\\\", workload_type=~\\\"$type\\\"}) by (pod))\\n\",\"legendFormat\":\"__auto\"}],\"title\":\"Rate of Transmitted Packets Dropped\",\"type\":\"timeseries\"}],\"refresh\":\"10s\",\"schemaVersion\":39,\"tags\":[\"kubernetes-mixin\"],\"templating\":{\"list\":[{\"current\":{\"selected\":true,\"text\":\"default\",\"value\":\"default\"},\"hide\":0,\"label\":\"Data source\",\"name\":\"datasource\",\"query\":\"prometheus\",\"regex\":\"\",\"type\":\"datasource\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"hide\":2,\"label\":\"cluster\",\"name\":\"cluster\",\"query\":\"label_values(up{job=\\\"kube-state-metrics\\\"}, cluster)\",\"refresh\":2,\"sort\":1,\"type\":\"query\",\"allValue\":\".*\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"hide\":0,\"label\":\"namespace\",\"name\":\"namespace\",\"query\":\"label_values(kube_namespace_status_phase{job=\\\"kube-state-metrics\\\", cluster=\\\"$cluster\\\"}, namespace)\",\"refresh\":2,\"sort\":1,\"type\":\"query\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"hide\":0,\"includeAll\":true,\"label\":\"workload_type\",\"name\":\"type\",\"query\":\"label_values(namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\"}, workload_type)\",\"refresh\":2,\"sort\":1,\"type\":\"query\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"hide\":0,\"label\":\"workload\",\"name\":\"workload\",\"query\":\"label_values(namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", workload_type=~\\\"$type\\\"}, workload)\",\"refresh\":2,\"sort\":1,\"type\":\"query\"}]},\"time\":{\"from\":\"now-1h\",\"to\":\"now\"},\"timezone\": \"utc\",\"title\":\"Kubernetes / Compute Resources / Workload\",\"uid\":\"a164a7f0339f99e89cea5cb47e9be617\"}" } }; -export const ConfigMap_KubePrometheusStackK8sResourcesWorkloadsNamespace: ConfigMap = { +export const ConfigMap_KubePrometheusStackK8sResourcesWorkloadsNamespace: KubernetesResource = { apiVersion: "v1", kind: "ConfigMap", metadata: { @@ -56904,7 +56904,7 @@ export const ConfigMap_KubePrometheusStackK8sResourcesWorkloadsNamespace: Config "k8s-resources-workloads-namespace.json": "{\"editable\":true,\"links\":[{\"asDropdown\":true,\"includeVars\":true,\"keepTime\":true,\"tags\":[\"kubernetes-mixin\"],\"targetBlank\":false,\"title\":\"Kubernetes\",\"type\":\"dashboards\"}],\"panels\":[{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true}},\"overrides\":[{\"matcher\":{\"id\":\"byFrameRefID\",\"options\":\"B\"},\"properties\":[{\"id\":\"custom.lineStyle\",\"value\":{\"fill\":\"dash\"}},{\"id\":\"custom.lineWidth\",\"value\":2},{\"id\":\"color\",\"value\":{\"fixedColor\":\"red\",\"mode\":\"fixed\"}}]},{\"matcher\":{\"id\":\"byFrameRefID\",\"options\":\"C\"},\"properties\":[{\"id\":\"custom.lineStyle\",\"value\":{\"fill\":\"dash\"}},{\"id\":\"custom.lineWidth\",\"value\":2},{\"id\":\"color\",\"value\":{\"fixedColor\":\"orange\",\"mode\":\"fixed\"}}]}]},\"gridPos\":{\"h\":7,\"w\":24,\"x\":0,\"y\":0},\"id\":1,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(\\n node_namespace_pod_container:container_cpu_usage_seconds_total:sum_rate5m{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\"}\\n* on(namespace,pod)\\n group_left(workload, workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", workload_type=~\\\"$type\\\"}\\n) by (workload, workload_type)\\n\",\"legendFormat\":\"{{workload}} - {{workload_type}}\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"scalar(max(kube_resourcequota{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", type=\\\"hard\\\",resource=~\\\"requests.cpu|cpu\\\"}))\",\"legendFormat\":\"quota - requests\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"scalar(max(kube_resourcequota{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", type=\\\"hard\\\",resource=~\\\"limits.cpu\\\"}))\",\"legendFormat\":\"quota - limits\"}],\"title\":\"CPU Usage\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"overrides\":[{\"matcher\":{\"id\":\"byRegexp\",\"options\":\"/%/\"},\"properties\":[{\"id\":\"unit\",\"value\":\"percentunit\"}]},{\"matcher\":{\"id\":\"byName\",\"options\":\"Workload\"},\"properties\":[{\"id\":\"links\",\"value\":[{\"title\":\"Drill down to workloads\",\"url\":\"/d/a164a7f0339f99e89cea5cb47e9be617/k8s-resources-workload?${datasource:queryparam}&var-cluster=$cluster&var-namespace=$namespace&var-type=${__data.fields.Type}&var-workload=${__data.fields.Workload}\"}]}]},{\"matcher\":{\"id\":\"byName\",\"options\":\"Running Pods\"},\"properties\":[{\"id\":\"unit\",\"value\":\"none\"}]}]},\"gridPos\":{\"h\":7,\"w\":24,\"x\":0,\"y\":7},\"id\":2,\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"count(namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", workload_type=~\\\"$type\\\"}) by (workload, workload_type)\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(\\n node_namespace_pod_container:container_cpu_usage_seconds_total:sum_rate5m{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\"}\\n* on(namespace,pod)\\n group_left(workload, workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", workload_type=~\\\"$type\\\"}\\n) by (workload, workload_type)\\n\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(\\n kube_pod_container_resource_requests{job=\\\"kube-state-metrics\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", resource=\\\"cpu\\\"}\\n* on(namespace,pod)\\n group_left(workload, workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", workload_type=~\\\"$type\\\"}\\n) by (workload, workload_type)\\n\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(\\n node_namespace_pod_container:container_cpu_usage_seconds_total:sum_rate5m{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\"}\\n* on(namespace,pod)\\n group_left(workload, workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", workload_type=~\\\"$type\\\"}\\n) by (workload, workload_type)\\n/sum(\\n kube_pod_container_resource_requests{job=\\\"kube-state-metrics\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", resource=\\\"cpu\\\"}\\n* on(namespace,pod)\\n group_left(workload, workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", workload_type=~\\\"$type\\\"}\\n) by (workload, workload_type)\\n\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(\\n kube_pod_container_resource_limits{job=\\\"kube-state-metrics\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", resource=\\\"cpu\\\"}\\n* on(namespace,pod)\\n group_left(workload, workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", workload_type=~\\\"$type\\\"}\\n) by (workload, workload_type)\\n\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(\\n node_namespace_pod_container:container_cpu_usage_seconds_total:sum_rate5m{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\"}\\n* on(namespace,pod)\\n group_left(workload, workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", workload_type=~\\\"$type\\\"}\\n) by (workload, workload_type)\\n/sum(\\n kube_pod_container_resource_limits{job=\\\"kube-state-metrics\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", resource=\\\"cpu\\\"}\\n* on(namespace,pod)\\n group_left(workload, workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", workload_type=~\\\"$type\\\"}\\n) by (workload, workload_type)\\n\",\"format\":\"table\",\"instant\":true}],\"title\":\"CPU Quota\",\"transformations\":[{\"id\":\"joinByField\",\"options\":{\"byField\":\"workload\",\"mode\":\"outer\"}},{\"id\":\"organize\",\"options\":{\"excludeByName\":{\"Time\":true,\"Time 1\":true,\"Time 2\":true,\"Time 3\":true,\"Time 4\":true,\"Time 5\":true,\"Time 6\":true,\"workload_type 2\":true,\"workload_type 3\":true,\"workload_type 4\":true,\"workload_type 5\":true,\"workload_type 6\":true},\"indexByName\":{\"Time 1\":0,\"Time 2\":1,\"Time 3\":2,\"Time 4\":3,\"Time 5\":4,\"Time 6\":5,\"Value #A\":8,\"Value #B\":9,\"Value #C\":10,\"Value #D\":11,\"Value #E\":12,\"Value #F\":13,\"workload\":6,\"workload_type 1\":7,\"workload_type 2\":14,\"workload_type 3\":15,\"workload_type 4\":16,\"workload_type 5\":17,\"workload_type 6\":18},\"renameByName\":{\"Value #A\":\"Running Pods\",\"Value #B\":\"CPU Usage\",\"Value #C\":\"CPU Requests\",\"Value #D\":\"CPU Requests %\",\"Value #E\":\"CPU Limits\",\"Value #F\":\"CPU Limits %\",\"workload\":\"Workload\",\"workload_type 1\":\"Type\"}}}],\"type\":\"table\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"bytes\"},\"overrides\":[{\"matcher\":{\"id\":\"byFrameRefID\",\"options\":\"B\"},\"properties\":[{\"id\":\"custom.lineStyle\",\"value\":{\"fill\":\"dash\"}},{\"id\":\"custom.lineWidth\",\"value\":2},{\"id\":\"color\",\"value\":{\"fixedColor\":\"red\",\"mode\":\"fixed\"}}]},{\"matcher\":{\"id\":\"byFrameRefID\",\"options\":\"C\"},\"properties\":[{\"id\":\"custom.lineStyle\",\"value\":{\"fill\":\"dash\"}},{\"id\":\"custom.lineWidth\",\"value\":2},{\"id\":\"color\",\"value\":{\"fixedColor\":\"orange\",\"mode\":\"fixed\"}}]}]},\"gridPos\":{\"h\":7,\"w\":24,\"x\":0,\"y\":14},\"id\":3,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(\\n container_memory_working_set_bytes{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", container!=\\\"\\\", image!=\\\"\\\"}\\n * on(namespace,pod)\\n group_left(workload, workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", workload_type=~\\\"$type\\\"}\\n) by (workload, workload_type)\\n\",\"legendFormat\":\"{{workload}} - {{workload_type}}\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"scalar(max(kube_resourcequota{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", type=\\\"hard\\\",resource=~\\\"requests.memory|memory\\\"}))\",\"legendFormat\":\"quota - requests\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"scalar(max(kube_resourcequota{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", type=\\\"hard\\\",resource=~\\\"limits.memory\\\"}))\",\"legendFormat\":\"quota - limits\"}],\"title\":\"Memory Usage\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"unit\":\"bytes\"},\"overrides\":[{\"matcher\":{\"id\":\"byRegexp\",\"options\":\"/%/\"},\"properties\":[{\"id\":\"unit\",\"value\":\"percentunit\"}]},{\"matcher\":{\"id\":\"byName\",\"options\":\"Workload\"},\"properties\":[{\"id\":\"links\",\"value\":[{\"title\":\"Drill down to workloads\",\"url\":\"/d/a164a7f0339f99e89cea5cb47e9be617/k8s-resources-workload?${datasource:queryparam}&var-cluster=$cluster&var-namespace=$namespace&var-type=${__data.fields.Type}&var-workload=${__data.fields.Workload}\"}]}]},{\"matcher\":{\"id\":\"byName\",\"options\":\"Running Pods\"},\"properties\":[{\"id\":\"unit\",\"value\":\"none\"}]}]},\"gridPos\":{\"h\":7,\"w\":24,\"x\":0,\"y\":21},\"id\":4,\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"count(namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", workload_type=~\\\"$type\\\"}) by (workload, workload_type)\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(\\n container_memory_working_set_bytes{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", container!=\\\"\\\", image!=\\\"\\\"}\\n * on(namespace,pod)\\n group_left(workload, workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", workload_type=~\\\"$type\\\"}\\n) by (workload, workload_type)\\n\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(\\n kube_pod_container_resource_requests{job=\\\"kube-state-metrics\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", resource=\\\"memory\\\"}\\n* on(namespace,pod)\\n group_left(workload, workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", workload_type=~\\\"$type\\\"}\\n) by (workload, workload_type)\\n\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(\\n container_memory_working_set_bytes{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", container!=\\\"\\\", image!=\\\"\\\"}\\n * on(namespace,pod)\\n group_left(workload, workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", workload_type=~\\\"$type\\\"}\\n) by (workload, workload_type)\\n/sum(\\n kube_pod_container_resource_requests{job=\\\"kube-state-metrics\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", resource=\\\"memory\\\"}\\n* on(namespace,pod)\\n group_left(workload, workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", workload_type=~\\\"$type\\\"}\\n) by (workload, workload_type)\\n\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(\\n kube_pod_container_resource_limits{job=\\\"kube-state-metrics\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", resource=\\\"memory\\\"}\\n* on(namespace,pod)\\n group_left(workload, workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", workload_type=~\\\"$type\\\"}\\n) by (workload, workload_type)\\n\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(\\n container_memory_working_set_bytes{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", container!=\\\"\\\", image!=\\\"\\\"}\\n * on(namespace,pod)\\n group_left(workload, workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", workload_type=~\\\"$type\\\"}\\n) by (workload, workload_type)\\n/sum(\\n kube_pod_container_resource_limits{job=\\\"kube-state-metrics\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", resource=\\\"memory\\\"}\\n* on(namespace,pod)\\n group_left(workload, workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", workload_type=~\\\"$type\\\"}\\n) by (workload, workload_type)\\n\",\"format\":\"table\",\"instant\":true}],\"title\":\"Memory Quota\",\"transformations\":[{\"id\":\"joinByField\",\"options\":{\"byField\":\"workload\",\"mode\":\"outer\"}},{\"id\":\"organize\",\"options\":{\"excludeByName\":{\"Time\":true,\"Time 1\":true,\"Time 2\":true,\"Time 3\":true,\"Time 4\":true,\"Time 5\":true,\"Time 6\":true,\"workload_type 2\":true,\"workload_type 3\":true,\"workload_type 4\":true,\"workload_type 5\":true,\"workload_type 6\":true},\"indexByName\":{\"Time 1\":0,\"Time 2\":1,\"Time 3\":2,\"Time 4\":3,\"Time 5\":4,\"Time 6\":5,\"Value #A\":8,\"Value #B\":9,\"Value #C\":10,\"Value #D\":11,\"Value #E\":12,\"Value #F\":13,\"workload\":6,\"workload_type 1\":7,\"workload_type 2\":14,\"workload_type 3\":15,\"workload_type 4\":16,\"workload_type 5\":17,\"workload_type 6\":18},\"renameByName\":{\"Value #A\":\"Running Pods\",\"Value #B\":\"Memory Usage\",\"Value #C\":\"Memory Requests\",\"Value #D\":\"Memory Requests %\",\"Value #E\":\"Memory Limits\",\"Value #F\":\"Memory Limits %\",\"workload\":\"Workload\",\"workload_type 1\":\"Type\"}}}],\"type\":\"table\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"overrides\":[{\"matcher\":{\"id\":\"byRegexp\",\"options\":\"/Bandwidth/\"},\"properties\":[{\"id\":\"unit\",\"value\":\"Bps\"}]},{\"matcher\":{\"id\":\"byRegexp\",\"options\":\"/Packets/\"},\"properties\":[{\"id\":\"unit\",\"value\":\"pps\"}]},{\"matcher\":{\"id\":\"byName\",\"options\":\"Workload\"},\"properties\":[{\"id\":\"links\",\"value\":[{\"title\":\"Drill down to workloads\",\"url\":\"/d/a164a7f0339f99e89cea5cb47e9be617/k8s-resources-workload?${datasource:queryparam}&var-cluster=$cluster&var-namespace=$namespace&var-type=${__data.fields.Type}&var-workload=${__data.fields.Workload}\"}]}]}]},\"gridPos\":{\"h\":7,\"w\":24,\"x\":0,\"y\":28},\"id\":5,\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"(sum(rate(container_network_receive_bytes_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\"}[$__rate_interval])\\n* on (namespace,pod)\\ngroup_left(workload,workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", workload_type=~\\\"$type\\\"}) by (workload))\\n\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"(sum(rate(container_network_transmit_bytes_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\"}[$__rate_interval])\\n* on (namespace,pod)\\ngroup_left(workload,workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", workload_type=~\\\"$type\\\"}) by (workload))\\n\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"(sum(rate(container_network_receive_packets_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\"}[$__rate_interval])\\n* on (namespace,pod)\\ngroup_left(workload,workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", workload_type=~\\\"$type\\\"}) by (workload))\\n\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"(sum(rate(container_network_transmit_packets_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\"}[$__rate_interval])\\n* on (namespace,pod)\\ngroup_left(workload,workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", workload_type=~\\\"$type\\\"}) by (workload))\\n\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"(sum(rate(container_network_receive_packets_dropped_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\"}[$__rate_interval])\\n* on (namespace,pod)\\ngroup_left(workload,workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", workload_type=~\\\"$type\\\"}) by (workload))\\n\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"(sum(rate(container_network_transmit_packets_dropped_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\"}[$__rate_interval])\\n* on (namespace,pod)\\ngroup_left(workload,workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", workload_type=~\\\"$type\\\"}) by (workload))\\n\",\"format\":\"table\",\"instant\":true}],\"title\":\"Current Network Usage\",\"transformations\":[{\"id\":\"joinByField\",\"options\":{\"byField\":\"workload\",\"mode\":\"outer\"}},{\"id\":\"organize\",\"options\":{\"excludeByName\":{\"Time\":true,\"Time 1\":true,\"Time 2\":true,\"Time 3\":true,\"Time 4\":true,\"Time 5\":true,\"Time 6\":true},\"indexByName\":{\"Time 1\":0,\"Time 2\":1,\"Time 3\":2,\"Time 4\":3,\"Time 5\":4,\"Time 6\":5,\"Value #A\":7,\"Value #B\":8,\"Value #C\":9,\"Value #D\":10,\"Value #E\":11,\"Value #F\":12,\"workload\":6},\"renameByName\":{\"Value #A\":\"Current Receive Bandwidth\",\"Value #B\":\"Current Transmit Bandwidth\",\"Value #C\":\"Rate of Received Packets\",\"Value #D\":\"Rate of Transmitted Packets\",\"Value #E\":\"Rate of Received Packets Dropped\",\"Value #F\":\"Rate of Transmitted Packets Dropped\",\"workload\":\"Workload\"}}}],\"type\":\"table\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"Bps\"}},\"gridPos\":{\"h\":7,\"w\":12,\"x\":0,\"y\":35},\"id\":6,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"(sum(rate(container_network_receive_bytes_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\"}[$__rate_interval])\\n* on (namespace,pod)\\ngroup_left(workload,workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", workload=~\\\".+\\\", workload_type=~\\\"$type\\\"}) by (workload))\\n\",\"legendFormat\":\"__auto\"}],\"title\":\"Receive Bandwidth\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"Bps\"}},\"gridPos\":{\"h\":7,\"w\":12,\"x\":12,\"y\":35},\"id\":7,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"(sum(rate(container_network_transmit_bytes_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\"}[$__rate_interval])\\n* on (namespace,pod)\\ngroup_left(workload,workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", workload=~\\\".+\\\", workload_type=~\\\"$type\\\"}) by (workload))\\n\",\"legendFormat\":\"__auto\"}],\"title\":\"Transmit Bandwidth\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"Bps\"}},\"gridPos\":{\"h\":7,\"w\":12,\"x\":0,\"y\":42},\"id\":8,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"(avg(rate(container_network_receive_bytes_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\"}[$__rate_interval])\\n* on (namespace,pod)\\ngroup_left(workload,workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", workload=~\\\".+\\\", workload_type=~\\\"$type\\\"}) by (workload))\\n\",\"legendFormat\":\"__auto\"}],\"title\":\"Average Container Bandwidth by Workload: Received\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"Bps\"}},\"gridPos\":{\"h\":7,\"w\":12,\"x\":12,\"y\":42},\"id\":9,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"(avg(rate(container_network_transmit_bytes_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\"}[$__rate_interval])\\n* on (namespace,pod)\\ngroup_left(workload,workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", workload=~\\\".+\\\", workload_type=~\\\"$type\\\"}) by (workload))\\n\",\"legendFormat\":\"__auto\"}],\"title\":\"Average Container Bandwidth by Workload: Transmitted\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"pps\"}},\"gridPos\":{\"h\":7,\"w\":12,\"x\":0,\"y\":49},\"id\":10,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"(sum(rate(container_network_receive_packets_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\"}[$__rate_interval])\\n* on (namespace,pod)\\ngroup_left(workload,workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", workload=~\\\".+\\\", workload_type=~\\\"$type\\\"}) by (workload))\\n\",\"legendFormat\":\"__auto\"}],\"title\":\"Rate of Received Packets\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"pps\"}},\"gridPos\":{\"h\":7,\"w\":12,\"x\":12,\"y\":49},\"id\":11,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"(sum(rate(container_network_transmit_packets_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\"}[$__rate_interval])\\n* on (namespace,pod)\\ngroup_left(workload,workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", workload=~\\\".+\\\", workload_type=~\\\"$type\\\"}) by (workload))\\n\",\"legendFormat\":\"__auto\"}],\"title\":\"Rate of Transmitted Packets\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"pps\"}},\"gridPos\":{\"h\":7,\"w\":12,\"x\":0,\"y\":56},\"id\":12,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"(sum(rate(container_network_receive_packets_dropped_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\"}[$__rate_interval])\\n* on (namespace,pod)\\ngroup_left(workload,workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", workload=~\\\".+\\\", workload_type=~\\\"$type\\\"}) by (workload))\\n\",\"legendFormat\":\"__auto\"}],\"title\":\"Rate of Received Packets Dropped\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"pps\"}},\"gridPos\":{\"h\":7,\"w\":12,\"x\":12,\"y\":56},\"id\":13,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"(sum(rate(container_network_transmit_packets_dropped_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\"}[$__rate_interval])\\n* on (namespace,pod)\\ngroup_left(workload,workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", workload=~\\\".+\\\", workload_type=~\\\"$type\\\"}) by (workload))\\n\",\"legendFormat\":\"__auto\"}],\"title\":\"Rate of Transmitted Packets Dropped\",\"type\":\"timeseries\"}],\"refresh\":\"10s\",\"schemaVersion\":39,\"tags\":[\"kubernetes-mixin\"],\"templating\":{\"list\":[{\"current\":{\"selected\":true,\"text\":\"default\",\"value\":\"default\"},\"hide\":0,\"label\":\"Data source\",\"name\":\"datasource\",\"query\":\"prometheus\",\"regex\":\"\",\"type\":\"datasource\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"hide\":2,\"label\":\"cluster\",\"name\":\"cluster\",\"query\":\"label_values(up{job=\\\"kube-state-metrics\\\"}, cluster)\",\"refresh\":2,\"sort\":1,\"type\":\"query\",\"allValue\":\".*\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"hide\":0,\"label\":\"namespace\",\"name\":\"namespace\",\"query\":\"label_values(kube_namespace_status_phase{job=\\\"kube-state-metrics\\\", cluster=\\\"$cluster\\\"}, namespace)\",\"refresh\":2,\"sort\":1,\"type\":\"query\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"hide\":0,\"includeAll\":true,\"label\":\"workload_type\",\"name\":\"type\",\"query\":\"label_values(namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", workload=~\\\".+\\\"}, workload_type)\",\"refresh\":2,\"sort\":1,\"type\":\"query\"}]},\"time\":{\"from\":\"now-1h\",\"to\":\"now\"},\"timezone\": \"utc\",\"title\":\"Kubernetes / Compute Resources / Namespace (Workloads)\",\"uid\":\"a87fb0d919ec0ea5f6543124e16c42a5\"}" } }; -export const ConfigMap_KubePrometheusStackKubelet: ConfigMap = { +export const ConfigMap_KubePrometheusStackKubelet: KubernetesResource = { apiVersion: "v1", kind: "ConfigMap", metadata: { @@ -56927,7 +56927,7 @@ export const ConfigMap_KubePrometheusStackKubelet: ConfigMap = { "kubelet.json": "{\"editable\":true,\"links\":[{\"asDropdown\":true,\"includeVars\":true,\"keepTime\":true,\"tags\":[\"kubernetes-mixin\"],\"targetBlank\":false,\"title\":\"Kubernetes\",\"type\":\"dashboards\"}],\"panels\":[{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"unit\":\"none\"}},\"gridPos\":{\"h\":7,\"w\":4,\"x\":0,\"y\":0},\"id\":1,\"interval\":\"1m\",\"options\":{\"colorMode\":\"none\"},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(kubelet_node_name{cluster=\\\"$cluster\\\", job=\\\"kubelet\\\", metrics_path=\\\"/metrics\\\"})\",\"instant\":true}],\"title\":\"Running Kubelets\",\"type\":\"stat\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"unit\":\"none\"}},\"gridPos\":{\"h\":7,\"w\":4,\"x\":4,\"y\":0},\"id\":2,\"interval\":\"1m\",\"options\":{\"colorMode\":\"none\"},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(kubelet_running_pods{cluster=\\\"$cluster\\\", job=\\\"kubelet\\\", metrics_path=\\\"/metrics\\\", instance=~\\\"$instance\\\"})\",\"instant\":true}],\"title\":\"Running Pods\",\"type\":\"stat\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"unit\":\"none\"}},\"gridPos\":{\"h\":7,\"w\":4,\"x\":8,\"y\":0},\"id\":3,\"interval\":\"1m\",\"options\":{\"colorMode\":\"none\"},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(kubelet_running_containers{cluster=\\\"$cluster\\\", job=\\\"kubelet\\\", metrics_path=\\\"/metrics\\\", instance=~\\\"$instance\\\"})\",\"instant\":true}],\"title\":\"Running Containers\",\"type\":\"stat\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"unit\":\"none\"}},\"gridPos\":{\"h\":7,\"w\":4,\"x\":12,\"y\":0},\"id\":4,\"interval\":\"1m\",\"options\":{\"colorMode\":\"none\"},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(volume_manager_total_volumes{cluster=\\\"$cluster\\\", job=\\\"kubelet\\\", metrics_path=\\\"/metrics\\\", instance=~\\\"$instance\\\", state=\\\"actual_state_of_world\\\"})\",\"instant\":true}],\"title\":\"Actual Volume Count\",\"type\":\"stat\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"unit\":\"none\"}},\"gridPos\":{\"h\":7,\"w\":4,\"x\":16,\"y\":0},\"id\":5,\"interval\":\"1m\",\"options\":{\"colorMode\":\"none\"},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(volume_manager_total_volumes{cluster=\\\"$cluster\\\", job=\\\"kubelet\\\", metrics_path=\\\"/metrics\\\", instance=~\\\"$instance\\\",state=\\\"desired_state_of_world\\\"})\",\"instant\":true}],\"title\":\"Desired Volume Count\",\"type\":\"stat\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"unit\":\"none\"}},\"gridPos\":{\"h\":7,\"w\":4,\"x\":20,\"y\":0},\"id\":6,\"interval\":\"1m\",\"options\":{\"colorMode\":\"none\"},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(rate(kubelet_node_config_error{cluster=\\\"$cluster\\\", job=\\\"kubelet\\\", metrics_path=\\\"/metrics\\\", instance=~\\\"$instance\\\"}[$__rate_interval]))\",\"instant\":true}],\"title\":\"Config Error Count\",\"type\":\"stat\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"ops\"}},\"gridPos\":{\"h\":7,\"w\":12,\"x\":0,\"y\":7},\"id\":7,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(rate(kubelet_runtime_operations_total{cluster=\\\"$cluster\\\",job=\\\"kubelet\\\", metrics_path=\\\"/metrics\\\",instance=~\\\"$instance\\\"}[$__rate_interval])) by (operation_type, instance)\",\"legendFormat\":\"{{instance}} {{operation_type}}\"}],\"title\":\"Operation Rate\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"ops\"}},\"gridPos\":{\"h\":7,\"w\":12,\"x\":12,\"y\":7},\"id\":8,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(rate(kubelet_runtime_operations_errors_total{cluster=\\\"$cluster\\\",job=\\\"kubelet\\\", metrics_path=\\\"/metrics\\\",instance=~\\\"$instance\\\"}[$__rate_interval])) by (instance, operation_type)\",\"legendFormat\":\"{{instance}} {{operation_type}}\"}],\"title\":\"Operation Error Rate\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"s\"}},\"gridPos\":{\"h\":7,\"w\":24,\"x\":0,\"y\":14},\"id\":9,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"histogram_quantile(0.99, sum(rate(kubelet_runtime_operations_duration_seconds_bucket{cluster=\\\"$cluster\\\",job=\\\"kubelet\\\", metrics_path=\\\"/metrics\\\",instance=~\\\"$instance\\\"}[$__rate_interval])) by (instance, operation_type, le))\",\"legendFormat\":\"{{instance}} {{operation_type}}\"}],\"title\":\"Operation Duration 99th quantile\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"ops\"}},\"gridPos\":{\"h\":7,\"w\":12,\"x\":0,\"y\":21},\"id\":10,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(rate(kubelet_pod_start_duration_seconds_count{cluster=\\\"$cluster\\\",job=\\\"kubelet\\\", metrics_path=\\\"/metrics\\\",instance=~\\\"$instance\\\"}[$__rate_interval])) by (instance)\",\"legendFormat\":\"{{instance}} pod\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(rate(kubelet_pod_worker_duration_seconds_count{cluster=\\\"$cluster\\\",job=\\\"kubelet\\\", metrics_path=\\\"/metrics\\\",instance=~\\\"$instance\\\"}[$__rate_interval])) by (instance)\",\"legendFormat\":\"{{instance}} worker\"}],\"title\":\"Pod Start Rate\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"s\"}},\"gridPos\":{\"h\":7,\"w\":12,\"x\":12,\"y\":21},\"id\":11,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"histogram_quantile(0.99, sum(rate(kubelet_pod_start_duration_seconds_bucket{cluster=\\\"$cluster\\\",job=\\\"kubelet\\\", metrics_path=\\\"/metrics\\\",instance=~\\\"$instance\\\"}[$__rate_interval])) by (instance, le))\",\"legendFormat\":\"{{instance}} pod\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"histogram_quantile(0.99, sum(rate(kubelet_pod_worker_duration_seconds_bucket{cluster=\\\"$cluster\\\",job=\\\"kubelet\\\", metrics_path=\\\"/metrics\\\",instance=~\\\"$instance\\\"}[$__rate_interval])) by (instance, le))\",\"legendFormat\":\"{{instance}} worker\"}],\"title\":\"Pod Start Duration\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"ops\"}},\"gridPos\":{\"h\":7,\"w\":12,\"x\":0,\"y\":28},\"id\":12,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(rate(storage_operation_duration_seconds_count{cluster=\\\"$cluster\\\",job=\\\"kubelet\\\", metrics_path=\\\"/metrics\\\",instance=~\\\"$instance\\\"}[$__rate_interval])) by (instance, operation_name, volume_plugin)\",\"legendFormat\":\"{{instance}} {{operation_name}} {{volume_plugin}}\"}],\"title\":\"Storage Operation Rate\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"ops\"}},\"gridPos\":{\"h\":7,\"w\":12,\"x\":12,\"y\":28},\"id\":13,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(rate(storage_operation_errors_total{cluster=\\\"$cluster\\\",job=\\\"kubelet\\\", metrics_path=\\\"/metrics\\\",instance=~\\\"$instance\\\"}[$__rate_interval])) by (instance, operation_name, volume_plugin)\",\"legendFormat\":\"{{instance}} {{operation_name}} {{volume_plugin}}\"}],\"title\":\"Storage Operation Error Rate\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"s\"}},\"gridPos\":{\"h\":7,\"w\":24,\"x\":0,\"y\":35},\"id\":14,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"histogram_quantile(0.99, sum(rate(storage_operation_duration_seconds_bucket{cluster=\\\"$cluster\\\", job=\\\"kubelet\\\", metrics_path=\\\"/metrics\\\", instance=~\\\"$instance\\\"}[$__rate_interval])) by (instance, operation_name, volume_plugin, le))\",\"legendFormat\":\"{{instance}} {{operation_name}} {{volume_plugin}}\"}],\"title\":\"Storage Operation Duration 99th quantile\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"ops\"}},\"gridPos\":{\"h\":7,\"w\":12,\"x\":0,\"y\":42},\"id\":15,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(rate(kubelet_cgroup_manager_duration_seconds_count{cluster=\\\"$cluster\\\", job=\\\"kubelet\\\", metrics_path=\\\"/metrics\\\", instance=~\\\"$instance\\\"}[$__rate_interval])) by (instance, operation_type)\",\"legendFormat\":\"{{operation_type}}\"}],\"title\":\"Cgroup manager operation rate\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"s\"}},\"gridPos\":{\"h\":7,\"w\":12,\"x\":12,\"y\":42},\"id\":16,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"histogram_quantile(0.99, sum(rate(kubelet_cgroup_manager_duration_seconds_bucket{cluster=\\\"$cluster\\\", job=\\\"kubelet\\\", metrics_path=\\\"/metrics\\\", instance=~\\\"$instance\\\"}[$__rate_interval])) by (instance, operation_type, le))\",\"legendFormat\":\"{{instance}} {{operation_type}}\"}],\"title\":\"Cgroup manager 99th quantile\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"ops\"}},\"gridPos\":{\"h\":7,\"w\":12,\"x\":0,\"y\":49},\"id\":17,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(rate(kubelet_pleg_relist_duration_seconds_count{cluster=\\\"$cluster\\\", job=\\\"kubelet\\\", metrics_path=\\\"/metrics\\\", instance=~\\\"$instance\\\"}[$__rate_interval])) by (instance)\",\"legendFormat\":\"{{instance}}\"}],\"title\":\"PLEG relist rate\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"s\"}},\"gridPos\":{\"h\":7,\"w\":12,\"x\":12,\"y\":49},\"id\":18,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"histogram_quantile(0.99, sum(rate(kubelet_pleg_relist_interval_seconds_bucket{cluster=\\\"$cluster\\\",job=\\\"kubelet\\\", metrics_path=\\\"/metrics\\\",instance=~\\\"$instance\\\"}[$__rate_interval])) by (instance, le))\",\"legendFormat\":\"{{instance}}\"}],\"title\":\"PLEG relist interval\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"s\"}},\"gridPos\":{\"h\":7,\"w\":24,\"x\":0,\"y\":56},\"id\":19,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"histogram_quantile(0.99, sum(rate(kubelet_pleg_relist_duration_seconds_bucket{cluster=\\\"$cluster\\\",job=\\\"kubelet\\\", metrics_path=\\\"/metrics\\\",instance=~\\\"$instance\\\"}[$__rate_interval])) by (instance, le))\",\"legendFormat\":\"{{instance}}\"}],\"title\":\"PLEG relist duration\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"ops\"}},\"gridPos\":{\"h\":7,\"w\":24,\"x\":0,\"y\":63},\"id\":20,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(rate(rest_client_requests_total{cluster=\\\"$cluster\\\",job=\\\"kubelet\\\", metrics_path=\\\"/metrics\\\", instance=~\\\"$instance\\\",code=~\\\"2..\\\"}[$__rate_interval]))\",\"legendFormat\":\"2xx\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(rate(rest_client_requests_total{cluster=\\\"$cluster\\\",job=\\\"kubelet\\\", metrics_path=\\\"/metrics\\\", instance=~\\\"$instance\\\",code=~\\\"3..\\\"}[$__rate_interval]))\",\"legendFormat\":\"3xx\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(rate(rest_client_requests_total{cluster=\\\"$cluster\\\",job=\\\"kubelet\\\", metrics_path=\\\"/metrics\\\", instance=~\\\"$instance\\\",code=~\\\"4..\\\"}[$__rate_interval]))\",\"legendFormat\":\"4xx\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(rate(rest_client_requests_total{cluster=\\\"$cluster\\\",job=\\\"kubelet\\\", metrics_path=\\\"/metrics\\\", instance=~\\\"$instance\\\",code=~\\\"5..\\\"}[$__rate_interval]))\",\"legendFormat\":\"5xx\"}],\"title\":\"RPC rate\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"s\"}},\"gridPos\":{\"h\":7,\"w\":24,\"x\":0,\"y\":70},\"id\":21,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"histogram_quantile(0.99, sum(rate(rest_client_request_duration_seconds_bucket{cluster=\\\"$cluster\\\",job=\\\"kubelet\\\", metrics_path=\\\"/metrics\\\", instance=~\\\"$instance\\\"}[$__rate_interval])) by (instance, verb, le))\",\"legendFormat\":\"{{instance}} {{verb}}\"}],\"title\":\"Request duration 99th quantile\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"bytes\"}},\"gridPos\":{\"h\":7,\"w\":8,\"x\":0,\"y\":77},\"id\":22,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"process_resident_memory_bytes{cluster=\\\"$cluster\\\",job=\\\"kubelet\\\", metrics_path=\\\"/metrics\\\",instance=~\\\"$instance\\\"}\",\"legendFormat\":\"{{instance}}\"}],\"title\":\"Memory\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"short\"}},\"gridPos\":{\"h\":7,\"w\":8,\"x\":8,\"y\":77},\"id\":23,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"rate(process_cpu_seconds_total{cluster=\\\"$cluster\\\",job=\\\"kubelet\\\", metrics_path=\\\"/metrics\\\",instance=~\\\"$instance\\\"}[$__rate_interval])\",\"legendFormat\":\"{{instance}}\"}],\"title\":\"CPU usage\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"short\"}},\"gridPos\":{\"h\":7,\"w\":8,\"x\":16,\"y\":77},\"id\":24,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"go_goroutines{cluster=\\\"$cluster\\\",job=\\\"kubelet\\\", metrics_path=\\\"/metrics\\\",instance=~\\\"$instance\\\"}\",\"legendFormat\":\"{{instance}}\"}],\"title\":\"Goroutines\",\"type\":\"timeseries\"}],\"refresh\":\"10s\",\"schemaVersion\":39,\"tags\":[\"kubernetes-mixin\"],\"templating\":{\"list\":[{\"current\":{\"selected\":true,\"text\":\"default\",\"value\":\"default\"},\"hide\":0,\"label\":\"Data source\",\"name\":\"datasource\",\"query\":\"prometheus\",\"regex\":\"\",\"type\":\"datasource\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"hide\":2,\"label\":\"cluster\",\"name\":\"cluster\",\"query\":\"label_values(up{job=\\\"kubelet\\\", metrics_path=\\\"/metrics\\\"}, cluster)\",\"refresh\":2,\"sort\":1,\"type\":\"query\",\"allValue\":\".*\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"hide\":0,\"includeAll\":true,\"label\":\"instance\",\"name\":\"instance\",\"query\":\"label_values(up{job=\\\"kubelet\\\", metrics_path=\\\"/metrics\\\",cluster=\\\"$cluster\\\"}, instance)\",\"refresh\":2,\"type\":\"query\"}]},\"time\":{\"from\":\"now-1h\",\"to\":\"now\"},\"timezone\": \"utc\",\"title\":\"Kubernetes / Kubelet\",\"uid\":\"3138fa155d5915769fbded898ac09fd9\"}" } }; -export const ConfigMap_KubePrometheusStackNamespaceByPod: ConfigMap = { +export const ConfigMap_KubePrometheusStackNamespaceByPod: KubernetesResource = { apiVersion: "v1", kind: "ConfigMap", metadata: { @@ -56950,7 +56950,7 @@ export const ConfigMap_KubePrometheusStackNamespaceByPod: ConfigMap = { "namespace-by-pod.json": "{\"editable\":true,\"links\":[{\"asDropdown\":true,\"includeVars\":true,\"keepTime\":true,\"tags\":[\"kubernetes-mixin\"],\"targetBlank\":false,\"title\":\"Kubernetes\",\"type\":\"dashboards\"}],\"panels\":[{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"displayName\":\"$namespace\",\"max\":10000000000,\"min\":0,\"thresholds\":{\"steps\":[{\"color\":\"dark-green\",\"index\":0,\"value\":null},{\"color\":\"dark-yellow\",\"index\":1,\"value\":5000000000},{\"color\":\"dark-red\",\"index\":2,\"value\":7000000000}]},\"unit\":\"Bps\"}},\"gridPos\":{\"h\":9,\"w\":12,\"x\":0,\"y\":0},\"id\":1,\"interval\":\"1m\",\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum (\\n rate(container_network_receive_bytes_total{cluster=\\\"$cluster\\\",namespace=~\\\"$namespace\\\"}[$__rate_interval])\\n * on (cluster,namespace,pod) group_left ()\\n topk by (cluster,namespace,pod) (\\n 1,\\n max by (cluster,namespace,pod) (kube_pod_info{host_network=\\\"false\\\"})\\n )\\n)\\n\",\"legendFormat\":\"__auto\"}],\"title\":\"Current Rate of Bytes Received\",\"type\":\"gauge\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"displayName\":\"$namespace\",\"max\":10000000000,\"min\":0,\"thresholds\":{\"steps\":[{\"color\":\"dark-green\",\"index\":0,\"value\":null},{\"color\":\"dark-yellow\",\"index\":1,\"value\":5000000000},{\"color\":\"dark-red\",\"index\":2,\"value\":7000000000}]},\"unit\":\"Bps\"}},\"gridPos\":{\"h\":9,\"w\":12,\"x\":12,\"y\":0},\"id\":2,\"interval\":\"1m\",\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum (\\n rate(container_network_transmit_bytes_total{cluster=\\\"$cluster\\\",namespace=~\\\"$namespace\\\"}[$__rate_interval])\\n * on (cluster,namespace,pod) group_left ()\\n topk by (cluster,namespace,pod) (\\n 1,\\n max by (cluster,namespace,pod) (kube_pod_info{host_network=\\\"false\\\"})\\n )\\n)\\n\",\"legendFormat\":\"__auto\"}],\"title\":\"Current Rate of Bytes Transmitted\",\"type\":\"gauge\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"overrides\":[{\"matcher\":{\"id\":\"byRegexp\",\"options\":\"/Bandwidth/\"},\"properties\":[{\"id\":\"unit\",\"value\":\"Bps\"}]},{\"matcher\":{\"id\":\"byRegexp\",\"options\":\"/Packets/\"},\"properties\":[{\"id\":\"unit\",\"value\":\"pps\"}]},{\"matcher\":{\"id\":\"byName\",\"options\":\"Pod\"},\"properties\":[{\"id\":\"links\",\"value\":[{\"title\":\"Drill down\",\"url\":\"/d/7a18067ce943a40ae25454675c19ff5c/kubernetes-networking-pod?${datasource:queryparam}&var-cluster=${cluster}&var-namespace=${namespace}&var-pod=${__data.fields.Pod}\"}]}]}]},\"gridPos\":{\"h\":9,\"w\":24,\"x\":0,\"y\":9},\"id\":3,\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum by (pod) (\\n rate(container_network_receive_bytes_total{cluster=\\\"$cluster\\\",namespace=~\\\"$namespace\\\"}[$__rate_interval])\\n * on (cluster,namespace,pod) group_left ()\\n topk by (cluster,namespace,pod) (\\n 1,\\n max by (cluster,namespace,pod) (kube_pod_info{host_network=\\\"false\\\"})\\n )\\n)\\n\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum by (pod) (\\n rate(container_network_transmit_bytes_total{cluster=\\\"$cluster\\\",namespace=~\\\"$namespace\\\"}[$__rate_interval])\\n * on (cluster,namespace,pod) group_left ()\\n topk by (cluster,namespace,pod) (\\n 1,\\n max by (cluster,namespace,pod) (kube_pod_info{host_network=\\\"false\\\"})\\n )\\n)\\n\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum by (pod) (\\n rate(container_network_receive_packets_total{cluster=\\\"$cluster\\\",namespace=~\\\"$namespace\\\"}[$__rate_interval])\\n * on (cluster,namespace,pod) group_left ()\\n topk by (cluster,namespace,pod) (\\n 1,\\n max by (cluster,namespace,pod) (kube_pod_info{host_network=\\\"false\\\"})\\n )\\n)\\n\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum by (pod) (\\n rate(container_network_transmit_packets_total{cluster=\\\"$cluster\\\",namespace=~\\\"$namespace\\\"}[$__rate_interval])\\n * on (cluster,namespace,pod) group_left ()\\n topk by (cluster,namespace,pod) (\\n 1,\\n max by (cluster,namespace,pod) (kube_pod_info{host_network=\\\"false\\\"})\\n )\\n)\\n\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum by (pod) (\\n rate(container_network_receive_packets_dropped_total{cluster=\\\"$cluster\\\",namespace=~\\\"$namespace\\\"}[$__rate_interval])\\n * on (cluster,namespace,pod) group_left ()\\n topk by (cluster,namespace,pod) (\\n 1,\\n max by (cluster,namespace,pod) (kube_pod_info{host_network=\\\"false\\\"})\\n )\\n)\\n\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum by (pod) (\\n rate(container_network_transmit_packets_dropped_total{cluster=\\\"$cluster\\\",namespace=~\\\"$namespace\\\"}[$__rate_interval])\\n * on (cluster,namespace,pod) group_left ()\\n topk by (cluster,namespace,pod) (\\n 1,\\n max by (cluster,namespace,pod) (kube_pod_info{host_network=\\\"false\\\"})\\n )\\n)\\n\",\"format\":\"table\",\"instant\":true}],\"title\":\"Current Network Usage\",\"transformations\":[{\"id\":\"joinByField\",\"options\":{\"byField\":\"pod\",\"mode\":\"outer\"}},{\"id\":\"organize\",\"options\":{\"excludeByName\":{\"Time\":true,\"Time 1\":true,\"Time 2\":true,\"Time 3\":true,\"Time 4\":true,\"Time 5\":true,\"Time 6\":true},\"indexByName\":{\"Time 1\":0,\"Time 2\":1,\"Time 3\":2,\"Time 4\":3,\"Time 5\":4,\"Time 6\":5,\"Value #A\":7,\"Value #B\":8,\"Value #C\":9,\"Value #D\":10,\"Value #E\":11,\"Value #F\":12,\"pod\":6},\"renameByName\":{\"Value #A\":\"Current Receive Bandwidth\",\"Value #B\":\"Current Transmit Bandwidth\",\"Value #C\":\"Rate of Received Packets\",\"Value #D\":\"Rate of Transmitted Packets\",\"Value #E\":\"Rate of Received Packets Dropped\",\"Value #F\":\"Rate of Transmitted Packets Dropped\",\"pod\":\"Pod\"}}}],\"type\":\"table\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"showPoints\":\"never\"},\"unit\":\"binBps\"}},\"gridPos\":{\"h\":9,\"w\":12,\"x\":0,\"y\":18},\"id\":4,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum by (pod) (\\n rate(container_network_receive_bytes_total{cluster=\\\"$cluster\\\",namespace=~\\\"$namespace\\\"}[$__rate_interval])\\n * on (cluster,namespace,pod) group_left ()\\n topk by (cluster,namespace,pod) (\\n 1,\\n max by (cluster,namespace,pod) (kube_pod_info{host_network=\\\"false\\\"})\\n )\\n)\\n\",\"legendFormat\":\"__auto\"}],\"title\":\"Receive Bandwidth\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"showPoints\":\"never\"},\"unit\":\"binBps\"}},\"gridPos\":{\"h\":9,\"w\":12,\"x\":12,\"y\":18},\"id\":5,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum by (pod) (\\n rate(container_network_transmit_bytes_total{cluster=\\\"$cluster\\\",namespace=~\\\"$namespace\\\"}[$__rate_interval])\\n * on (cluster,namespace,pod) group_left ()\\n topk by (cluster,namespace,pod) (\\n 1,\\n max by (cluster,namespace,pod) (kube_pod_info{host_network=\\\"false\\\"})\\n )\\n)\\n\",\"legendFormat\":\"__auto\"}],\"title\":\"Transmit Bandwidth\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"showPoints\":\"never\"},\"unit\":\"pps\"}},\"gridPos\":{\"h\":9,\"w\":12,\"x\":0,\"y\":27},\"id\":6,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum by (pod) (\\n rate(container_network_receive_packets_total{cluster=\\\"$cluster\\\",namespace=~\\\"$namespace\\\"}[$__rate_interval])\\n * on (cluster,namespace,pod) group_left ()\\n topk by (cluster,namespace,pod) (\\n 1,\\n max by (cluster,namespace,pod) (kube_pod_info{host_network=\\\"false\\\"})\\n )\\n)\\n\",\"legendFormat\":\"__auto\"}],\"title\":\"Rate of Received Packets\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"showPoints\":\"never\"},\"unit\":\"pps\"}},\"gridPos\":{\"h\":9,\"w\":12,\"x\":12,\"y\":27},\"id\":7,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum by (pod) (\\n rate(container_network_transmit_packets_total{cluster=\\\"$cluster\\\",namespace=~\\\"$namespace\\\"}[$__rate_interval])\\n * on (cluster,namespace,pod) group_left ()\\n topk by (cluster,namespace,pod) (\\n 1,\\n max by (cluster,namespace,pod) (kube_pod_info{host_network=\\\"false\\\"})\\n )\\n)\\n\",\"legendFormat\":\"__auto\"}],\"title\":\"Rate of Transmitted Packets\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"showPoints\":\"never\"},\"unit\":\"pps\"}},\"gridPos\":{\"h\":9,\"w\":12,\"x\":0,\"y\":36},\"id\":8,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum by (pod) (\\n rate(container_network_receive_packets_dropped_total{cluster=\\\"$cluster\\\",namespace!=\\\"\\\"}[$__rate_interval])\\n * on (cluster,namespace,pod) group_left ()\\n topk by (cluster,namespace,pod) (\\n 1,\\n max by (cluster,namespace,pod) (kube_pod_info{host_network=\\\"false\\\"})\\n )\\n)\\n\",\"legendFormat\":\"__auto\"}],\"title\":\"Rate of Received Packets Dropped\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"showPoints\":\"never\"},\"unit\":\"pps\"}},\"gridPos\":{\"h\":9,\"w\":12,\"x\":12,\"y\":36},\"id\":9,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum by (pod) (\\n rate(container_network_transmit_packets_dropped_total{cluster=\\\"$cluster\\\",namespace=~\\\"$namespace\\\"}[$__rate_interval])\\n * on (cluster,namespace,pod) group_left ()\\n topk by (cluster,namespace,pod) (\\n 1,\\n max by (cluster,namespace,pod) (kube_pod_info{host_network=\\\"false\\\"})\\n )\\n)\\n\",\"legendFormat\":\"__auto\"}],\"title\":\"Rate of Transmitted Packets Dropped\",\"type\":\"timeseries\"}],\"refresh\":\"10s\",\"schemaVersion\":39,\"tags\":[\"kubernetes-mixin\"],\"templating\":{\"list\":[{\"current\":{\"selected\":true,\"text\":\"default\",\"value\":\"default\"},\"hide\":0,\"label\":\"Data source\",\"name\":\"datasource\",\"query\":\"prometheus\",\"regex\":\"\",\"type\":\"datasource\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"hide\":2,\"label\":\"cluster\",\"name\":\"cluster\",\"query\":\"label_values(up{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\"}, cluster)\",\"refresh\":2,\"sort\":1,\"type\":\"query\",\"allValue\":\".*\"},{\"allValue\":\".+\",\"current\":{\"selected\":false,\"text\":\"kube-system\",\"value\":\"kube-system\"},\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"hide\":0,\"includeAll\":true,\"label\":\"namespace\",\"name\":\"namespace\",\"query\":\"label_values(container_network_receive_packets_total{cluster=\\\"$cluster\\\"}, namespace)\",\"refresh\":2,\"sort\":1,\"type\":\"query\"}]},\"time\":{\"from\":\"now-1h\",\"to\":\"now\"},\"timezone\": \"utc\",\"title\":\"Kubernetes / Networking / Namespace (Pods)\",\"uid\":\"8b7a8b326d7a6f1f04244066368c67af\"}" } }; -export const ConfigMap_KubePrometheusStackNamespaceByWorkload: ConfigMap = { +export const ConfigMap_KubePrometheusStackNamespaceByWorkload: KubernetesResource = { apiVersion: "v1", kind: "ConfigMap", metadata: { @@ -56973,7 +56973,7 @@ export const ConfigMap_KubePrometheusStackNamespaceByWorkload: ConfigMap = { "namespace-by-workload.json": "{\"editable\":true,\"links\":[{\"asDropdown\":true,\"includeVars\":true,\"keepTime\":true,\"tags\":[\"kubernetes-mixin\"],\"targetBlank\":false,\"title\":\"Kubernetes\",\"type\":\"dashboards\"}],\"panels\":[{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"color\":{\"fixedColor\":\"green\",\"mode\":\"fixed\"},\"unit\":\"Bps\"}},\"gridPos\":{\"h\":9,\"w\":12,\"x\":0,\"y\":0},\"id\":1,\"interval\":\"1m\",\"options\":{\"displayMode\":\"basic\",\"showUnfilled\":false},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sort_desc(sum(rate(container_network_receive_bytes_total{cluster=\\\"$cluster\\\",namespace=\\\"$namespace\\\"}[$__rate_interval])\\n* on (cluster,namespace,pod) group_left ()\\n topk by (cluster,namespace,pod) (\\n 1,\\n max by (cluster,namespace,pod) (kube_pod_info{host_network=\\\"false\\\"})\\n )\\n* on (cluster,namespace,pod)\\ngroup_left(workload,workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\",namespace=\\\"$namespace\\\", workload=~\\\".+\\\", workload_type=~\\\"$type\\\"}) by (workload))\\n\",\"legendFormat\":\"__auto\"}],\"title\":\"Current Rate of Bytes Received\",\"type\":\"bargauge\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"color\":{\"fixedColor\":\"green\",\"mode\":\"fixed\"},\"unit\":\"Bps\"}},\"gridPos\":{\"h\":9,\"w\":12,\"x\":12,\"y\":0},\"id\":2,\"interval\":\"1m\",\"options\":{\"displayMode\":\"basic\",\"showUnfilled\":false},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sort_desc(sum(rate(container_network_transmit_bytes_total{cluster=\\\"$cluster\\\",namespace=\\\"$namespace\\\"}[$__rate_interval])\\n* on (cluster,namespace,pod) group_left ()\\n topk by (cluster,namespace,pod) (\\n 1,\\n max by (cluster,namespace,pod) (kube_pod_info{host_network=\\\"false\\\"})\\n )\\n* on (cluster,namespace,pod)\\ngroup_left(workload,workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\",namespace=\\\"$namespace\\\", workload=~\\\".+\\\", workload_type=~\\\"$type\\\"}) by (workload))\\n\",\"legendFormat\":\"__auto\"}],\"title\":\"Current Rate of Bytes Transmitted\",\"type\":\"bargauge\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"overrides\":[{\"matcher\":{\"id\":\"byRegexp\",\"options\":\"/Bytes/\"},\"properties\":[{\"id\":\"unit\",\"value\":\"binBps\"}]},{\"matcher\":{\"id\":\"byRegexp\",\"options\":\"/Packets/\"},\"properties\":[{\"id\":\"unit\",\"value\":\"pps\"}]},{\"matcher\":{\"id\":\"byName\",\"options\":\"Workload\"},\"properties\":[{\"id\":\"links\",\"value\":[{\"title\":\"Drill down\",\"url\":\"/d/728bf77cc1166d2f3133bf25846876cc/kubernetes-networking-workload?${datasource:queryparam}&var-cluster=${cluster}&var-namespace=${namespace}&var-type=${__data.fields.Type}&var-workload=${__data.fields.Workload}\"}]}]}]},\"gridPos\":{\"h\":9,\"w\":24,\"x\":0,\"y\":9},\"id\":3,\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sort_desc(sum(rate(container_network_receive_bytes_total{cluster=\\\"$cluster\\\",namespace=\\\"$namespace\\\"}[$__rate_interval])\\n* on (namespace,pod) kube_pod_info{cluster=\\\"$cluster\\\",namespace=\\\"$namespace\\\",host_network=\\\"false\\\"}\\n* on (namespace,pod)\\ngroup_left(workload,workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\",namespace=\\\"$namespace\\\", workload=~\\\".+\\\", workload_type=~\\\"$type\\\"}) by (workload, workload_type))\\n\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sort_desc(sum(rate(container_network_transmit_bytes_total{cluster=\\\"$cluster\\\",namespace=\\\"$namespace\\\"}[$__rate_interval])\\n* on (namespace,pod) kube_pod_info{cluster=\\\"$cluster\\\",namespace=\\\"$namespace\\\",host_network=\\\"false\\\"}\\n* on (namespace,pod)\\ngroup_left(workload,workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\",namespace=\\\"$namespace\\\", workload=~\\\".+\\\", workload_type=~\\\"$type\\\"}) by (workload, workload_type))\\n\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sort_desc(avg(rate(container_network_receive_bytes_total{cluster=\\\"$cluster\\\",namespace=\\\"$namespace\\\"}[$__rate_interval])\\n* on (namespace,pod) kube_pod_info{cluster=\\\"$cluster\\\",namespace=\\\"$namespace\\\",host_network=\\\"false\\\"}\\n* on (namespace,pod)\\ngroup_left(workload,workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\",namespace=\\\"$namespace\\\", workload=~\\\".+\\\", workload_type=~\\\"$type\\\"}) by (workload, workload_type))\\n\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sort_desc(avg(rate(container_network_transmit_bytes_total{cluster=\\\"$cluster\\\",namespace=\\\"$namespace\\\"}[$__rate_interval])\\n* on (namespace,pod) kube_pod_info{cluster=\\\"$cluster\\\",namespace=\\\"$namespace\\\",host_network=\\\"false\\\"}\\n* on (namespace,pod)\\ngroup_left(workload,workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\",namespace=\\\"$namespace\\\", workload=~\\\".+\\\", workload_type=~\\\"$type\\\"}) by (workload, workload_type))\\n\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sort_desc(sum(rate(container_network_receive_packets_total{cluster=\\\"$cluster\\\",namespace=\\\"$namespace\\\"}[$__rate_interval])\\n* on (namespace,pod) kube_pod_info{cluster=\\\"$cluster\\\",namespace=\\\"$namespace\\\",host_network=\\\"false\\\"}\\n* on (namespace,pod)\\ngroup_left(workload,workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\",namespace=\\\"$namespace\\\", workload=~\\\".+\\\", workload_type=~\\\"$type\\\"}) by (workload, workload_type))\\n\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sort_desc(sum(rate(container_network_transmit_packets_total{cluster=\\\"$cluster\\\",namespace=\\\"$namespace\\\"}[$__rate_interval])\\n* on (namespace,pod) kube_pod_info{cluster=\\\"$cluster\\\",namespace=\\\"$namespace\\\",host_network=\\\"false\\\"}\\n* on (namespace,pod)\\ngroup_left(workload,workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\",namespace=\\\"$namespace\\\", workload=~\\\".+\\\", workload_type=~\\\"$type\\\"}) by (workload, workload_type))\\n\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sort_desc(sum(rate(container_network_receive_packets_dropped_total{cluster=\\\"$cluster\\\",namespace=\\\"$namespace\\\"}[$__rate_interval])\\n* on (namespace,pod) kube_pod_info{cluster=\\\"$cluster\\\",namespace=\\\"$namespace\\\",host_network=\\\"false\\\"}\\n* on (namespace,pod)\\ngroup_left(workload,workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\",namespace=\\\"$namespace\\\", workload=~\\\".+\\\", workload_type=~\\\"$type\\\"}) by (workload, workload_type))\\n\",\"format\":\"table\",\"instant\":true},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sort_desc(sum(rate(container_network_transmit_packets_dropped_total{cluster=\\\"$cluster\\\",namespace=\\\"$namespace\\\"}[$__rate_interval])\\n* on (namespace,pod) kube_pod_info{cluster=\\\"$cluster\\\",namespace=\\\"$namespace\\\",host_network=\\\"false\\\"}\\n* on (namespace,pod)\\ngroup_left(workload,workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\",namespace=\\\"$namespace\\\", workload=~\\\".+\\\", workload_type=~\\\"$type\\\"}) by (workload, workload_type))\\n\",\"format\":\"table\",\"instant\":true}],\"title\":\"Current Status\",\"transformations\":[{\"id\":\"joinByField\",\"options\":{\"byField\":\"workload\",\"mode\":\"outer\"}},{\"id\":\"organize\",\"options\":{\"excludeByName\":{\"Time\":true,\"Time 1\":true,\"Time 2\":true,\"Time 3\":true,\"Time 4\":true,\"Time 5\":true,\"Time 6\":true,\"Time 7\":true,\"Time 8\":true,\"workload_type 2\":true,\"workload_type 3\":true,\"workload_type 4\":true,\"workload_type 5\":true,\"workload_type 6\":true,\"workload_type 7\":true,\"workload_type 8\":true},\"indexByName\":{\"Time 1\":0,\"Time 2\":1,\"Time 3\":2,\"Time 4\":3,\"Time 5\":4,\"Time 6\":5,\"Time 7\":6,\"Time 8\":7,\"Value #A\":10,\"Value #B\":11,\"Value #C\":12,\"Value #D\":13,\"Value #E\":14,\"Value #F\":15,\"Value #G\":16,\"Value #H\":17,\"workload\":8,\"workload_type 1\":9,\"workload_type 2\":18,\"workload_type 3\":19,\"workload_type 4\":20,\"workload_type 5\":21,\"workload_type 6\":22,\"workload_type 7\":23,\"workload_type 8\":24},\"renameByName\":{\"Value #A\":\"Rx Bytes\",\"Value #B\":\"Tx Bytes\",\"Value #C\":\"Rx Bytes (Avg)\",\"Value #D\":\"Tx Bytes (Avg)\",\"Value #E\":\"Rx Packets\",\"Value #F\":\"Tx Packets\",\"Value #G\":\"Rx Packets Dropped\",\"Value #H\":\"Tx Packets Dropped\",\"workload\":\"Workload\",\"workload_type 1\":\"Type\"}}}],\"type\":\"table\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"Bps\"}},\"gridPos\":{\"h\":9,\"w\":12,\"x\":0,\"y\":18},\"id\":4,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sort_desc(sum(rate(container_network_receive_bytes_total{cluster=\\\"$cluster\\\",namespace=\\\"$namespace\\\"}[$__rate_interval])\\n* on (cluster,namespace,pod) group_left ()\\n topk by (cluster,namespace,pod) (\\n 1,\\n max by (cluster,namespace,pod) (kube_pod_info{host_network=\\\"false\\\"})\\n )\\n* on (cluster,namespace,pod)\\ngroup_left(workload,workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\",namespace=\\\"$namespace\\\", workload=~\\\".+\\\", workload_type=~\\\"$type\\\"}) by (workload))\\n\",\"legendFormat\":\"__auto\"}],\"title\":\"Receive Bandwidth\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"Bps\"}},\"gridPos\":{\"h\":9,\"w\":12,\"x\":12,\"y\":18},\"id\":5,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sort_desc(sum(rate(container_network_transmit_bytes_total{cluster=\\\"$cluster\\\",namespace=\\\"$namespace\\\"}[$__rate_interval])\\n* on (cluster,namespace,pod) group_left ()\\n topk by (cluster,namespace,pod) (\\n 1,\\n max by (cluster,namespace,pod) (kube_pod_info{host_network=\\\"false\\\"})\\n )\\n* on (cluster,namespace,pod)\\ngroup_left(workload,workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\",namespace=\\\"$namespace\\\", workload=~\\\".+\\\", workload_type=~\\\"$type\\\"}) by (workload))\\n\",\"legendFormat\":\"__auto\"}],\"title\":\"Transmit Bandwidth\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"Bps\"}},\"gridPos\":{\"h\":9,\"w\":12,\"x\":0,\"y\":27},\"id\":6,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sort_desc(avg(rate(container_network_receive_bytes_total{cluster=\\\"$cluster\\\",namespace=\\\"$namespace\\\"}[$__rate_interval])\\n* on (cluster,namespace,pod) group_left ()\\n topk by (cluster,namespace,pod) (\\n 1,\\n max by (cluster,namespace,pod) (kube_pod_info{host_network=\\\"false\\\"})\\n )\\n* on (cluster,namespace,pod)\\ngroup_left(workload,workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\",namespace=\\\"$namespace\\\", workload=~\\\".+\\\", workload_type=~\\\"$type\\\"}) by (workload))\\n\",\"legendFormat\":\"__auto\"}],\"title\":\"Average Container Bandwidth by Workload: Received\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"Bps\"}},\"gridPos\":{\"h\":9,\"w\":12,\"x\":12,\"y\":27},\"id\":7,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sort_desc(avg(rate(container_network_transmit_bytes_total{cluster=\\\"$cluster\\\",namespace=\\\"$namespace\\\"}[$__rate_interval])\\n* on (cluster,namespace,pod) group_left ()\\n topk by (cluster,namespace,pod) (\\n 1,\\n max by (cluster,namespace,pod) (kube_pod_info{host_network=\\\"false\\\"})\\n )\\n* on (cluster,namespace,pod)\\ngroup_left(workload,workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\",namespace=\\\"$namespace\\\", workload=~\\\".+\\\", workload_type=~\\\"$type\\\"}) by (workload))\\n\",\"legendFormat\":\"__auto\"}],\"title\":\"Average Container Bandwidth by Workload: Transmitted\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"pps\"}},\"gridPos\":{\"h\":9,\"w\":12,\"x\":0,\"y\":36},\"id\":8,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sort_desc(sum(rate(container_network_receive_packets_total{cluster=\\\"$cluster\\\",namespace=\\\"$namespace\\\"}[$__rate_interval])\\n* on (cluster,namespace,pod) group_left ()\\n topk by (cluster,namespace,pod) (\\n 1,\\n max by (cluster,namespace,pod) (kube_pod_info{host_network=\\\"false\\\"})\\n )\\n* on (cluster,namespace,pod)\\ngroup_left(workload,workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\",namespace=\\\"$namespace\\\", workload=~\\\".+\\\", workload_type=~\\\"$type\\\"}) by (workload))\\n\",\"legendFormat\":\"__auto\"}],\"title\":\"Rate of Received Packets\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"pps\"}},\"gridPos\":{\"h\":9,\"w\":12,\"x\":12,\"y\":36},\"id\":9,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sort_desc(sum(rate(container_network_transmit_packets_total{cluster=\\\"$cluster\\\",namespace=\\\"$namespace\\\"}[$__rate_interval])\\n* on (cluster,namespace,pod) group_left ()\\n topk by (cluster,namespace,pod) (\\n 1,\\n max by (cluster,namespace,pod) (kube_pod_info{host_network=\\\"false\\\"})\\n )\\n* on (cluster,namespace,pod)\\ngroup_left(workload,workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\",namespace=\\\"$namespace\\\", workload=~\\\".+\\\", workload_type=~\\\"$type\\\"}) by (workload))\\n\",\"legendFormat\":\"__auto\"}],\"title\":\"Rate of Transmitted Packets\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"pps\"}},\"gridPos\":{\"h\":9,\"w\":12,\"x\":0,\"y\":45},\"id\":10,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sort_desc(sum(rate(container_network_receive_packets_dropped_total{cluster=\\\"$cluster\\\",namespace=\\\"$namespace\\\"}[$__rate_interval])\\n* on (cluster,namespace,pod) group_left ()\\n topk by (cluster,namespace,pod) (\\n 1,\\n max by (cluster,namespace,pod) (kube_pod_info{host_network=\\\"false\\\"})\\n )\\n* on (cluster,namespace,pod)\\ngroup_left(workload,workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\",namespace=\\\"$namespace\\\", workload=~\\\".+\\\", workload_type=~\\\"$type\\\"}) by (workload))\\n\",\"legendFormat\":\"__auto\"}],\"title\":\"Rate of Received Packets Dropped\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"pps\"}},\"gridPos\":{\"h\":9,\"w\":12,\"x\":12,\"y\":45},\"id\":11,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sort_desc(sum(rate(container_network_transmit_packets_dropped_total{cluster=\\\"$cluster\\\",namespace=\\\"$namespace\\\"}[$__rate_interval])\\n* on (cluster,namespace,pod) group_left ()\\n topk by (cluster,namespace,pod) (\\n 1,\\n max by (cluster,namespace,pod) (kube_pod_info{host_network=\\\"false\\\"})\\n )\\n* on (cluster,namespace,pod)\\ngroup_left(workload,workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\",namespace=\\\"$namespace\\\", workload=~\\\".+\\\", workload_type=~\\\"$type\\\"}) by (workload))\\n\",\"legendFormat\":\"__auto\"}],\"title\":\"Rate of Transmitted Packets Dropped\",\"type\":\"timeseries\"}],\"refresh\":\"10s\",\"schemaVersion\":39,\"tags\":[\"kubernetes-mixin\"],\"templating\":{\"list\":[{\"current\":{\"selected\":true,\"text\":\"default\",\"value\":\"default\"},\"hide\":0,\"label\":\"Data source\",\"name\":\"datasource\",\"query\":\"prometheus\",\"regex\":\"\",\"type\":\"datasource\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"hide\":2,\"label\":\"cluster\",\"name\":\"cluster\",\"query\":\"label_values(up{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\"}, cluster)\",\"refresh\":2,\"sort\":1,\"type\":\"query\",\"allValue\":\".*\"},{\"current\":{\"selected\":false,\"text\":\"kube-system\",\"value\":\"kube-system\"},\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"hide\":0,\"label\":\"namespace\",\"name\":\"namespace\",\"query\":\"label_values(container_network_receive_packets_total{cluster=\\\"$cluster\\\"}, namespace)\",\"refresh\":2,\"sort\":1,\"type\":\"query\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"hide\":0,\"includeAll\":true,\"label\":\"workload_type\",\"name\":\"type\",\"query\":\"label_values(namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\", namespace=\\\"$namespace\\\", workload=~\\\".+\\\"}, workload_type)\",\"refresh\":2,\"sort\":1,\"type\":\"query\"}]},\"time\":{\"from\":\"now-1h\",\"to\":\"now\"},\"timezone\": \"utc\",\"title\":\"Kubernetes / Networking / Namespace (Workload)\",\"uid\":\"bbb2a765a623ae38130206c7d94a160f\"}" } }; -export const ConfigMap_KubePrometheusStackNodeClusterRsrcUse: ConfigMap = { +export const ConfigMap_KubePrometheusStackNodeClusterRsrcUse: KubernetesResource = { apiVersion: "v1", kind: "ConfigMap", metadata: { @@ -56996,7 +56996,7 @@ export const ConfigMap_KubePrometheusStackNodeClusterRsrcUse: ConfigMap = { "node-cluster-rsrc-use.json": "{\"graphTooltip\":1,\"panels\":[{\"collapsed\":false,\"gridPos\":{\"h\":1,\"w\":24,\"x\":0,\"y\":0},\"id\":1,\"panels\":[],\"title\":\"CPU\",\"type\":\"row\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":100,\"showPoints\":\"never\",\"stacking\":{\"mode\":\"normal\"}},\"unit\":\"percentunit\"}},\"gridPos\":{\"h\":7,\"w\":12,\"x\":0,\"y\":1},\"id\":2,\"options\":{\"legend\":{\"showLegend\":false},\"tooltip\":{\"mode\":\"multi\",\"sort\":\"desc\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"((\\n instance:node_cpu_utilisation:rate5m{job=\\\"node-exporter\\\", cluster=\\\"$cluster\\\"}\\n *\\n instance:node_num_cpu:sum{job=\\\"node-exporter\\\", cluster=\\\"$cluster\\\"}\\n) != 0 )\\n/ scalar(sum(instance:node_num_cpu:sum{job=\\\"node-exporter\\\", cluster=\\\"$cluster\\\"}))\\n\",\"legendFormat\":\"{{ instance }}\"}],\"title\":\"CPU Utilisation\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":100,\"showPoints\":\"never\",\"stacking\":{\"mode\":\"normal\"}},\"unit\":\"percentunit\"}},\"gridPos\":{\"h\":7,\"w\":12,\"x\":12,\"y\":1},\"id\":3,\"options\":{\"legend\":{\"showLegend\":false},\"tooltip\":{\"mode\":\"multi\",\"sort\":\"desc\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"(\\n instance:node_load1_per_cpu:ratio{job=\\\"node-exporter\\\", cluster=\\\"$cluster\\\"}\\n / scalar(count(instance:node_load1_per_cpu:ratio{job=\\\"node-exporter\\\", cluster=\\\"$cluster\\\"}))\\n) != 0\\n\",\"legendFormat\":\"{{ instance }}\"}],\"title\":\"CPU Saturation (Load1 per CPU)\",\"type\":\"timeseries\"},{\"collapsed\":false,\"gridPos\":{\"h\":1,\"w\":24,\"x\":0,\"y\":8},\"id\":4,\"panels\":[],\"title\":\"Memory\",\"type\":\"row\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":100,\"showPoints\":\"never\",\"stacking\":{\"mode\":\"normal\"}},\"unit\":\"percentunit\"}},\"gridPos\":{\"h\":7,\"w\":12,\"x\":0,\"y\":9},\"id\":5,\"options\":{\"legend\":{\"showLegend\":false},\"tooltip\":{\"mode\":\"multi\",\"sort\":\"desc\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"(\\n instance:node_memory_utilisation:ratio{job=\\\"node-exporter\\\", cluster=\\\"$cluster\\\"}\\n / scalar(count(instance:node_memory_utilisation:ratio{job=\\\"node-exporter\\\", cluster=\\\"$cluster\\\"}))\\n) != 0\\n\",\"legendFormat\":\"{{ instance }}\"}],\"title\":\"Memory Utilisation\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":100,\"showPoints\":\"never\",\"stacking\":{\"mode\":\"normal\"}},\"unit\":\"rds\"}},\"gridPos\":{\"h\":7,\"w\":12,\"x\":12,\"y\":9},\"id\":6,\"options\":{\"legend\":{\"showLegend\":false},\"tooltip\":{\"mode\":\"multi\",\"sort\":\"desc\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"instance:node_vmstat_pgmajfault:rate5m{job=\\\"node-exporter\\\", cluster=\\\"$cluster\\\"}\",\"legendFormat\":\"{{ instance }}\"}],\"title\":\"Memory Saturation (Major Page Faults)\",\"type\":\"timeseries\"},{\"collapsed\":false,\"gridPos\":{\"h\":1,\"w\":24,\"x\":0,\"y\":16},\"id\":7,\"panels\":[],\"title\":\"Network\",\"type\":\"row\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":100,\"showPoints\":\"never\",\"stacking\":{\"mode\":\"normal\"}},\"unit\":\"Bps\"},\"overrides\":[{\"matcher\":{\"id\":\"byRegexp\",\"options\":\"/Transmit/\"},\"properties\":[{\"id\":\"custom.transform\",\"value\":\"negative-Y\"}]}]},\"gridPos\":{\"h\":7,\"w\":12,\"x\":0,\"y\":17},\"id\":8,\"options\":{\"legend\":{\"showLegend\":false},\"tooltip\":{\"mode\":\"multi\",\"sort\":\"desc\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"instance:node_network_receive_bytes_excluding_lo:rate5m{job=\\\"node-exporter\\\", cluster=\\\"$cluster\\\"} != 0\",\"legendFormat\":\"{{ instance }} Receive\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"instance:node_network_transmit_bytes_excluding_lo:rate5m{job=\\\"node-exporter\\\", cluster=\\\"$cluster\\\"} != 0\",\"legendFormat\":\"{{ instance }} Transmit\"}],\"title\":\"Network Utilisation (Bytes Receive/Transmit)\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":100,\"showPoints\":\"never\",\"stacking\":{\"mode\":\"normal\"}},\"unit\":\"Bps\"},\"overrides\":[{\"matcher\":{\"id\":\"byRegexp\",\"options\":\"/Transmit/\"},\"properties\":[{\"id\":\"custom.transform\",\"value\":\"negative-Y\"}]}]},\"gridPos\":{\"h\":7,\"w\":12,\"x\":12,\"y\":17},\"id\":9,\"options\":{\"legend\":{\"showLegend\":false},\"tooltip\":{\"mode\":\"multi\",\"sort\":\"desc\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"instance:node_network_receive_drop_excluding_lo:rate5m{job=\\\"node-exporter\\\", cluster=\\\"$cluster\\\"} != 0\",\"legendFormat\":\"{{ instance }} Receive\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"instance:node_network_transmit_drop_excluding_lo:rate5m{job=\\\"node-exporter\\\", cluster=\\\"$cluster\\\"} != 0\",\"legendFormat\":\"{{ instance }} Transmit\"}],\"title\":\"Network Saturation (Drops Receive/Transmit)\",\"type\":\"timeseries\"},{\"collapsed\":false,\"gridPos\":{\"h\":1,\"w\":24,\"x\":0,\"y\":24},\"id\":10,\"panels\":[],\"title\":\"Disk IO\",\"type\":\"row\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":100,\"showPoints\":\"never\",\"stacking\":{\"mode\":\"normal\"}},\"unit\":\"percentunit\"}},\"gridPos\":{\"h\":7,\"w\":12,\"x\":0,\"y\":25},\"id\":11,\"options\":{\"legend\":{\"showLegend\":false},\"tooltip\":{\"mode\":\"multi\",\"sort\":\"desc\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"instance_device:node_disk_io_time_seconds:rate5m{job=\\\"node-exporter\\\", cluster=\\\"$cluster\\\"}\\n/ scalar(count(instance_device:node_disk_io_time_seconds:rate5m{job=\\\"node-exporter\\\", cluster=\\\"$cluster\\\"}))\\n\",\"legendFormat\":\"{{ instance }} {{device}}\"}],\"title\":\"Disk IO Utilisation\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":100,\"showPoints\":\"never\",\"stacking\":{\"mode\":\"normal\"}},\"unit\":\"percentunit\"}},\"gridPos\":{\"h\":7,\"w\":12,\"x\":12,\"y\":25},\"id\":12,\"options\":{\"legend\":{\"showLegend\":false},\"tooltip\":{\"mode\":\"multi\",\"sort\":\"desc\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"instance_device:node_disk_io_time_weighted_seconds:rate5m{job=\\\"node-exporter\\\", cluster=\\\"$cluster\\\"}\\n/ scalar(count(instance_device:node_disk_io_time_weighted_seconds:rate5m{job=\\\"node-exporter\\\", cluster=\\\"$cluster\\\"}))\\n\",\"legendFormat\":\"{{ instance }} {{device}}\"}],\"title\":\"Disk IO Saturation\",\"type\":\"timeseries\"},{\"collapsed\":false,\"gridPos\":{\"h\":1,\"w\":24,\"x\":0,\"y\":34},\"id\":13,\"panels\":[],\"title\":\"Disk Space\",\"type\":\"row\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":100,\"showPoints\":\"never\",\"stacking\":{\"mode\":\"normal\"}},\"unit\":\"percentunit\"}},\"gridPos\":{\"h\":7,\"w\":24,\"x\":0,\"y\":35},\"id\":14,\"options\":{\"legend\":{\"showLegend\":false},\"tooltip\":{\"mode\":\"multi\",\"sort\":\"desc\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"sum without (device) (\\n max without (fstype, mountpoint) ((\\n node_filesystem_size_bytes{job=\\\"node-exporter\\\", fstype!=\\\"\\\", mountpoint!=\\\"\\\", cluster=\\\"$cluster\\\"}\\n -\\n node_filesystem_avail_bytes{job=\\\"node-exporter\\\", fstype!=\\\"\\\", mountpoint!=\\\"\\\", cluster=\\\"$cluster\\\"}\\n ) != 0)\\n)\\n/ scalar(sum(max without (fstype, mountpoint) (node_filesystem_size_bytes{job=\\\"node-exporter\\\", fstype!=\\\"\\\", mountpoint!=\\\"\\\", cluster=\\\"$cluster\\\"})))\\n\",\"legendFormat\":\"{{ instance }}\"}],\"title\":\"Disk Space Utilisation\",\"type\":\"timeseries\"}],\"refresh\":\"30s\",\"schemaVersion\":39,\"tags\":[\"node-exporter-mixin\"],\"templating\":{\"list\":[{\"name\":\"datasource\",\"query\":\"prometheus\",\"type\":\"datasource\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"hide\":2,\"includeAll\":false,\"name\":\"cluster\",\"query\":\"label_values(node_time_seconds, cluster)\",\"refresh\":2,\"sort\":1,\"type\":\"query\",\"allValue\":\".*\"}]},\"time\":{\"from\":\"now-1h\",\"to\":\"now\"},\"timezone\": \"utc\",\"title\":\"Node Exporter / USE Method / Cluster\",\"uid\":\"3e97d1d02672cdd0861f4c97c64f89b2\"}" } }; -export const ConfigMap_KubePrometheusStackNodeRsrcUse: ConfigMap = { +export const ConfigMap_KubePrometheusStackNodeRsrcUse: KubernetesResource = { apiVersion: "v1", kind: "ConfigMap", metadata: { @@ -57019,7 +57019,7 @@ export const ConfigMap_KubePrometheusStackNodeRsrcUse: ConfigMap = { "node-rsrc-use.json": "{\"graphTooltip\":1,\"panels\":[{\"collapsed\":false,\"gridPos\":{\"h\":1,\"w\":24,\"x\":0,\"y\":0},\"id\":1,\"panels\":[],\"title\":\"CPU\",\"type\":\"row\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":100,\"showPoints\":\"never\",\"stacking\":{\"mode\":\"normal\"}},\"unit\":\"percentunit\"}},\"gridPos\":{\"h\":7,\"w\":12,\"x\":0,\"y\":1},\"id\":2,\"options\":{\"legend\":{\"showLegend\":false},\"tooltip\":{\"mode\":\"multi\",\"sort\":\"desc\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"instance:node_cpu_utilisation:rate5m{job=\\\"node-exporter\\\", instance=\\\"$instance\\\", cluster=\\\"$cluster\\\"} != 0\",\"legendFormat\":\"Utilisation\"}],\"title\":\"CPU Utilisation\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":100,\"showPoints\":\"never\",\"stacking\":{\"mode\":\"normal\"}},\"unit\":\"percentunit\"}},\"gridPos\":{\"h\":7,\"w\":12,\"x\":12,\"y\":1},\"id\":3,\"options\":{\"legend\":{\"showLegend\":false},\"tooltip\":{\"mode\":\"multi\",\"sort\":\"desc\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"instance:node_load1_per_cpu:ratio{job=\\\"node-exporter\\\", instance=\\\"$instance\\\", cluster=\\\"$cluster\\\"} != 0\",\"legendFormat\":\"Saturation\"}],\"title\":\"CPU Saturation (Load1 per CPU)\",\"type\":\"timeseries\"},{\"collapsed\":false,\"gridPos\":{\"h\":1,\"w\":24,\"x\":0,\"y\":8},\"id\":4,\"panels\":[],\"title\":\"Memory\",\"type\":\"row\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":100,\"showPoints\":\"never\",\"stacking\":{\"mode\":\"normal\"}},\"unit\":\"percentunit\"}},\"gridPos\":{\"h\":7,\"w\":12,\"x\":0,\"y\":9},\"id\":5,\"options\":{\"legend\":{\"showLegend\":false},\"tooltip\":{\"mode\":\"multi\",\"sort\":\"desc\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"instance:node_memory_utilisation:ratio{job=\\\"node-exporter\\\", instance=\\\"$instance\\\", cluster=\\\"$cluster\\\"} != 0\",\"legendFormat\":\"Utilisation\"}],\"title\":\"Memory Utilisation\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":100,\"showPoints\":\"never\",\"stacking\":{\"mode\":\"normal\"}},\"unit\":\"rds\"}},\"gridPos\":{\"h\":7,\"w\":12,\"x\":12,\"y\":9},\"id\":6,\"options\":{\"legend\":{\"showLegend\":false},\"tooltip\":{\"mode\":\"multi\",\"sort\":\"desc\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"instance:node_vmstat_pgmajfault:rate5m{job=\\\"node-exporter\\\", instance=\\\"$instance\\\", cluster=\\\"$cluster\\\"} != 0\",\"legendFormat\":\"Major page Faults\"}],\"title\":\"Memory Saturation (Major Page Faults)\",\"type\":\"timeseries\"},{\"collapsed\":false,\"gridPos\":{\"h\":1,\"w\":24,\"x\":0,\"y\":16},\"id\":7,\"panels\":[],\"title\":\"Network\",\"type\":\"row\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":100,\"showPoints\":\"never\",\"stacking\":{\"mode\":\"normal\"}},\"unit\":\"Bps\"},\"overrides\":[{\"matcher\":{\"id\":\"byRegexp\",\"options\":\"/Transmit/\"},\"properties\":[{\"id\":\"custom.transform\",\"value\":\"negative-Y\"}]}]},\"gridPos\":{\"h\":7,\"w\":12,\"x\":0,\"y\":17},\"id\":8,\"options\":{\"legend\":{\"showLegend\":false},\"tooltip\":{\"mode\":\"multi\",\"sort\":\"desc\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"instance:node_network_receive_bytes_excluding_lo:rate5m{job=\\\"node-exporter\\\", instance=\\\"$instance\\\", cluster=\\\"$cluster\\\"} != 0\",\"legendFormat\":\"Receive\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"instance:node_network_transmit_bytes_excluding_lo:rate5m{job=\\\"node-exporter\\\", instance=\\\"$instance\\\", cluster=\\\"$cluster\\\"} != 0\",\"legendFormat\":\"Transmit\"}],\"title\":\"Network Utilisation (Bytes Receive/Transmit)\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":100,\"showPoints\":\"never\",\"stacking\":{\"mode\":\"normal\"}},\"unit\":\"Bps\"},\"overrides\":[{\"matcher\":{\"id\":\"byRegexp\",\"options\":\"/Transmit/\"},\"properties\":[{\"id\":\"custom.transform\",\"value\":\"negative-Y\"}]}]},\"gridPos\":{\"h\":7,\"w\":12,\"x\":12,\"y\":17},\"id\":9,\"options\":{\"legend\":{\"showLegend\":false},\"tooltip\":{\"mode\":\"multi\",\"sort\":\"desc\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"instance:node_network_receive_drop_excluding_lo:rate5m{job=\\\"node-exporter\\\", instance=\\\"$instance\\\", cluster=\\\"$cluster\\\"} != 0\",\"legendFormat\":\"Receive\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"instance:node_network_transmit_drop_excluding_lo:rate5m{job=\\\"node-exporter\\\", instance=\\\"$instance\\\", cluster=\\\"$cluster\\\"} != 0\",\"legendFormat\":\"Transmit\"}],\"title\":\"Network Saturation (Drops Receive/Transmit)\",\"type\":\"timeseries\"},{\"collapsed\":false,\"gridPos\":{\"h\":1,\"w\":24,\"x\":0,\"y\":24},\"id\":10,\"panels\":[],\"title\":\"Disk IO\",\"type\":\"row\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":100,\"showPoints\":\"never\",\"stacking\":{\"mode\":\"normal\"}},\"unit\":\"percentunit\"}},\"gridPos\":{\"h\":7,\"w\":12,\"x\":0,\"y\":25},\"id\":11,\"options\":{\"legend\":{\"showLegend\":false},\"tooltip\":{\"mode\":\"multi\",\"sort\":\"desc\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"instance_device:node_disk_io_time_seconds:rate5m{job=\\\"node-exporter\\\", instance=\\\"$instance\\\", cluster=\\\"$cluster\\\"} != 0\",\"legendFormat\":\"{{device}}\"}],\"title\":\"Disk IO Utilisation\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":100,\"showPoints\":\"never\",\"stacking\":{\"mode\":\"normal\"}},\"unit\":\"percentunit\"}},\"gridPos\":{\"h\":7,\"w\":12,\"x\":12,\"y\":25},\"id\":12,\"options\":{\"legend\":{\"showLegend\":false},\"tooltip\":{\"mode\":\"multi\",\"sort\":\"desc\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"instance_device:node_disk_io_time_weighted_seconds:rate5m{job=\\\"node-exporter\\\", instance=\\\"$instance\\\", cluster=\\\"$cluster\\\"} != 0\",\"legendFormat\":\"{{device}}\"}],\"title\":\"Disk IO Saturation\",\"type\":\"timeseries\"},{\"collapsed\":false,\"gridPos\":{\"h\":1,\"w\":24,\"x\":0,\"y\":34},\"id\":13,\"panels\":[],\"title\":\"Disk Space\",\"type\":\"row\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":100,\"showPoints\":\"never\",\"stacking\":{\"mode\":\"normal\"}},\"unit\":\"percentunit\"}},\"gridPos\":{\"h\":7,\"w\":24,\"x\":0,\"y\":35},\"id\":14,\"options\":{\"legend\":{\"showLegend\":false},\"tooltip\":{\"mode\":\"multi\",\"sort\":\"desc\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"sort_desc(1 -\\n (\\n max without (mountpoint, fstype) (node_filesystem_avail_bytes{job=\\\"node-exporter\\\", fstype!=\\\"\\\", instance=\\\"$instance\\\", cluster=\\\"$cluster\\\"})\\n /\\n max without (mountpoint, fstype) (node_filesystem_size_bytes{job=\\\"node-exporter\\\", fstype!=\\\"\\\", instance=\\\"$instance\\\", cluster=\\\"$cluster\\\"})\\n ) != 0\\n)\\n\",\"legendFormat\":\"{{device}}\"}],\"title\":\"Disk Space Utilisation\",\"type\":\"timeseries\"}],\"refresh\":\"30s\",\"schemaVersion\":39,\"tags\":[\"node-exporter-mixin\"],\"templating\":{\"list\":[{\"name\":\"datasource\",\"query\":\"prometheus\",\"type\":\"datasource\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"hide\":2,\"includeAll\":false,\"name\":\"cluster\",\"query\":\"label_values(node_time_seconds, cluster)\",\"refresh\":2,\"sort\":1,\"type\":\"query\",\"allValue\":\".*\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"name\":\"instance\",\"query\":\"label_values(node_exporter_build_info{job=\\\"node-exporter\\\", cluster=\\\"$cluster\\\"}, instance)\",\"refresh\":2,\"sort\":1,\"type\":\"query\"}]},\"time\":{\"from\":\"now-1h\",\"to\":\"now\"},\"timezone\": \"utc\",\"title\":\"Node Exporter / USE Method / Node\",\"uid\":\"fac67cfbe174d3ef53eb473d73d9212f\"}" } }; -export const ConfigMap_KubePrometheusStackNodesAix: ConfigMap = { +export const ConfigMap_KubePrometheusStackNodesAix: KubernetesResource = { apiVersion: "v1", kind: "ConfigMap", metadata: { @@ -57042,7 +57042,7 @@ export const ConfigMap_KubePrometheusStackNodesAix: ConfigMap = { "nodes-aix.json": "{\"graphTooltip\":1,\"panels\":[{\"collapsed\":false,\"gridPos\":{\"h\":1,\"w\":24,\"x\":0,\"y\":0},\"id\":1,\"panels\":[],\"title\":\"CPU\",\"type\":\"row\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"stacking\":{\"mode\":\"normal\"}},\"max\":1,\"min\":0,\"unit\":\"percentunit\"}},\"gridPos\":{\"h\":7,\"w\":12,\"x\":0,\"y\":1},\"id\":2,\"options\":{\"tooltip\":{\"mode\":\"multi\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"(\\n (1 - sum without (mode) (rate(node_cpu_seconds_total{job=\\\"node-exporter\\\", mode=~\\\"idle|iowait|steal\\\", instance=\\\"$instance\\\", cluster=\\\"$cluster\\\"}[$__rate_interval])))\\n/ ignoring(cpu) group_left\\n count without (cpu, mode) (node_cpu_seconds_total{job=\\\"node-exporter\\\", mode=\\\"idle\\\", instance=\\\"$instance\\\", cluster=\\\"$cluster\\\"})\\n)\\n\",\"intervalFactor\":5,\"legendFormat\":\"{{cpu}}\"}],\"title\":\"CPU Usage\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":0,\"showPoints\":\"never\"},\"min\":0,\"unit\":\"short\"}},\"gridPos\":{\"h\":7,\"w\":12,\"x\":12,\"y\":1},\"id\":3,\"options\":{\"tooltip\":{\"mode\":\"multi\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"node_load1{job=\\\"node-exporter\\\", instance=\\\"$instance\\\", cluster=\\\"$cluster\\\"}\",\"legendFormat\":\"1m load average\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"node_load5{job=\\\"node-exporter\\\", instance=\\\"$instance\\\", cluster=\\\"$cluster\\\"}\",\"legendFormat\":\"5m load average\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"node_load15{job=\\\"node-exporter\\\", instance=\\\"$instance\\\", cluster=\\\"$cluster\\\"}\",\"legendFormat\":\"15m load average\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"count(node_cpu_seconds_total{job=\\\"node-exporter\\\", instance=\\\"$instance\\\", cluster=\\\"$cluster\\\", mode=\\\"idle\\\"})\",\"legendFormat\":\"logical cores\"}],\"title\":\"Load Average\",\"type\":\"timeseries\"},{\"collapsed\":false,\"gridPos\":{\"h\":1,\"w\":24,\"x\":0,\"y\":8},\"id\":4,\"title\":\"Memory\",\"type\":\"row\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"stacking\":{\"mode\":\"none\"}},\"min\":0,\"unit\":\"bytes\"}},\"gridPos\":{\"h\":7,\"w\":18,\"x\":0,\"y\":9},\"id\":5,\"options\":{\"tooltip\":{\"mode\":\"multi\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"node_memory_total_bytes{job=\\\"node-exporter\\\", instance=\\\"$instance\\\", cluster=\\\"$cluster\\\"}\",\"legendFormat\":\"Physical Memory\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"(\\n node_memory_total_bytes{job=\\\"node-exporter\\\", instance=\\\"$instance\\\", cluster=\\\"$cluster\\\"} -\\n node_memory_available_bytes{job=\\\"node-exporter\\\", instance=\\\"$instance\\\", cluster=\\\"$cluster\\\"}\\n)\\n\",\"legendFormat\":\"Memory Used\"}],\"title\":\"Memory Usage\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"fieldConfig\":{\"defaults\":{\"max\":100,\"min\":0,\"thresholds\":{\"steps\":[{\"color\":\"rgba(50, 172, 45, 0.97)\"},{\"color\":\"rgba(237, 129, 40, 0.89)\",\"value\":80},{\"color\":\"rgba(245, 54, 54, 0.9)\",\"value\":90}]},\"unit\":\"percent\"}},\"gridPos\":{\"h\":7,\"w\":6,\"x\":18,\"y\":9},\"id\":6,\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"100 -\\n(\\n avg(node_memory_available_bytes{job=\\\"node-exporter\\\", instance=\\\"$instance\\\", cluster=\\\"$cluster\\\"}) /\\n avg(node_memory_total_bytes{job=\\\"node-exporter\\\", instance=\\\"$instance\\\", cluster=\\\"$cluster\\\"})\\n * 100\\n)\\n\"}],\"title\":\"Memory Usage\",\"type\":\"gauge\"},{\"collapsed\":false,\"gridPos\":{\"h\":1,\"w\":24,\"x\":0,\"y\":18},\"id\":7,\"panels\":[],\"title\":\"Disk\",\"type\":\"row\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":0,\"showPoints\":\"never\"},\"min\":0},\"overrides\":[{\"matcher\":{\"id\":\"byRegexp\",\"options\":\"/ read| written/\"},\"properties\":[{\"id\":\"unit\",\"value\":\"Bps\"}]},{\"matcher\":{\"id\":\"byRegexp\",\"options\":\"/ io time/\"},\"properties\":[{\"id\":\"unit\",\"value\":\"percentunit\"}]}]},\"gridPos\":{\"h\":7,\"w\":12,\"x\":0,\"y\":19},\"id\":8,\"options\":{\"tooltip\":{\"mode\":\"multi\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"rate(node_disk_read_bytes_total{job=\\\"node-exporter\\\", instance=\\\"$instance\\\", cluster=\\\"$cluster\\\", device=~\\\"(/dev/)?(mmcblk.p.+|nvme.+|rbd.+|sd.+|vd.+|xvd.+|dm-.+|md.+|dasd.+)\\\"}[$__rate_interval])\",\"intervalFactor\":1,\"legendFormat\":\"{{device}} read\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"rate(node_disk_written_bytes_total{job=\\\"node-exporter\\\", instance=\\\"$instance\\\", cluster=\\\"$cluster\\\", device=~\\\"(/dev/)?(mmcblk.p.+|nvme.+|rbd.+|sd.+|vd.+|xvd.+|dm-.+|md.+|dasd.+)\\\"}[$__rate_interval])\",\"intervalFactor\":1,\"legendFormat\":\"{{device}} written\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"rate(node_disk_io_time_seconds_total{job=\\\"node-exporter\\\", instance=\\\"$instance\\\", cluster=\\\"$cluster\\\", device=~\\\"(/dev/)?(mmcblk.p.+|nvme.+|rbd.+|sd.+|vd.+|xvd.+|dm-.+|md.+|dasd.+)\\\"}[$__rate_interval])\",\"intervalFactor\":1,\"legendFormat\":\"{{device}} io time\"}],\"title\":\"Disk I/O\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"fieldConfig\":{\"defaults\":{\"thresholds\":{\"steps\":[{\"color\":\"green\"},{\"color\":\"yellow\",\"value\":0.8},{\"color\":\"red\",\"value\":0.9}]},\"unit\":\"decbytes\"},\"overrides\":[{\"matcher\":{\"id\":\"byName\",\"options\":\"Mounted on\"},\"properties\":[{\"id\":\"custom.width\",\"value\":260}]},{\"matcher\":{\"id\":\"byName\",\"options\":\"Size\"},\"properties\":[{\"id\":\"custom.width\",\"value\":93}]},{\"matcher\":{\"id\":\"byName\",\"options\":\"Used\"},\"properties\":[{\"id\":\"custom.width\",\"value\":72}]},{\"matcher\":{\"id\":\"byName\",\"options\":\"Available\"},\"properties\":[{\"id\":\"custom.width\",\"value\":88}]},{\"matcher\":{\"id\":\"byName\",\"options\":\"Used, %\"},\"properties\":[{\"id\":\"unit\",\"value\":\"percentunit\"},{\"id\":\"custom.cellOptions\",\"value\":{\"type\":\"gauge\"}},{\"id\":\"max\",\"value\":1},{\"id\":\"min\",\"value\":0}]}]},\"gridPos\":{\"h\":7,\"w\":12,\"x\":12,\"y\":19},\"id\":9,\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"max by (mountpoint) (node_filesystem_size_bytes{job=\\\"node-exporter\\\", instance=\\\"$instance\\\", cluster=\\\"$cluster\\\", fstype!=\\\"\\\", mountpoint!=\\\"\\\"})\\n\",\"format\":\"table\",\"instant\":true,\"legendFormat\":\"\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"max by (mountpoint) (node_filesystem_avail_bytes{job=\\\"node-exporter\\\", instance=\\\"$instance\\\", cluster=\\\"$cluster\\\", fstype!=\\\"\\\", mountpoint!=\\\"\\\"})\\n\",\"format\":\"table\",\"instant\":true,\"legendFormat\":\"\"}],\"title\":\"Disk Space Usage\",\"transformations\":[{\"id\":\"groupBy\",\"options\":{\"fields\":{\"Value #A\":{\"aggregations\":[\"lastNotNull\"],\"operation\":\"aggregate\"},\"Value #B\":{\"aggregations\":[\"lastNotNull\"],\"operation\":\"aggregate\"},\"mountpoint\":{\"aggregations\":[],\"operation\":\"groupby\"}}}},{\"id\":\"merge\"},{\"id\":\"calculateField\",\"options\":{\"alias\":\"Used\",\"binary\":{\"left\":\"Value #A (lastNotNull)\",\"operator\":\"-\",\"reducer\":\"sum\",\"right\":\"Value #B (lastNotNull)\"},\"mode\":\"binary\",\"reduce\":{\"reducer\":\"sum\"}}},{\"id\":\"calculateField\",\"options\":{\"alias\":\"Used, %\",\"binary\":{\"left\":\"Used\",\"operator\":\"/\",\"reducer\":\"sum\",\"right\":\"Value #A (lastNotNull)\"},\"mode\":\"binary\",\"reduce\":{\"reducer\":\"sum\"}}},{\"id\":\"organize\",\"options\":{\"excludeByName\":{},\"indexByName\":{},\"renameByName\":{\"Value #A (lastNotNull)\":\"Size\",\"Value #B (lastNotNull)\":\"Available\",\"mountpoint\":\"Mounted on\"}}},{\"id\":\"sortBy\",\"options\":{\"fields\":{},\"sort\":[{\"field\":\"Mounted on\"}]}}],\"type\":\"table\"},{\"collapsed\":false,\"gridPos\":{\"h\":1,\"w\":24,\"x\":0,\"y\":26},\"id\":10,\"panels\":[],\"title\":\"Network\",\"type\":\"row\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"description\":\"Network received (bits/s)\",\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":0,\"showPoints\":\"never\"},\"min\":0,\"unit\":\"bps\"}},\"gridPos\":{\"h\":7,\"w\":12,\"x\":0,\"y\":27},\"id\":11,\"options\":{\"tooltip\":{\"mode\":\"multi\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"rate(node_network_receive_bytes_total{job=\\\"node-exporter\\\", instance=\\\"$instance\\\", cluster=\\\"$cluster\\\", device!=\\\"lo\\\"}[$__rate_interval]) * 8\",\"intervalFactor\":1,\"legendFormat\":\"{{device}}\"}],\"title\":\"Network Received\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"description\":\"Network transmitted (bits/s)\",\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":0},\"min\":0,\"unit\":\"bps\"}},\"gridPos\":{\"h\":7,\"w\":12,\"x\":12,\"y\":27},\"id\":12,\"options\":{\"tooltip\":{\"mode\":\"multi\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"rate(node_network_transmit_bytes_total{job=\\\"node-exporter\\\", instance=\\\"$instance\\\", cluster=\\\"$cluster\\\", device!=\\\"lo\\\"}[$__rate_interval]) * 8\",\"intervalFactor\":1,\"legendFormat\":\"{{device}}\"}],\"title\":\"Network Transmitted\",\"type\":\"timeseries\"}],\"refresh\":\"30s\",\"schemaVersion\":39,\"tags\":[\"node-exporter-mixin\"],\"templating\":{\"list\":[{\"name\":\"datasource\",\"query\":\"prometheus\",\"type\":\"datasource\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"hide\":2,\"label\":\"Cluster\",\"name\":\"cluster\",\"query\":\"label_values(node_uname_info{job=\\\"node-exporter\\\", sysname!=\\\"Darwin\\\"}, cluster)\",\"refresh\":2,\"type\":\"query\",\"allValue\":\".*\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"label\":\"Instance\",\"name\":\"instance\",\"query\":\"label_values(node_uname_info{job=\\\"node-exporter\\\", cluster=\\\"$cluster\\\", sysname!=\\\"Darwin\\\"}, instance)\",\"refresh\":2,\"type\":\"query\"}]},\"time\":{\"from\":\"now-1h\",\"to\":\"now\"},\"timezone\": \"utc\",\"title\":\"Node Exporter / AIX\",\"uid\":\"7e0a61e486f727d763fb1d86fdd629c2\"}" } }; -export const ConfigMap_KubePrometheusStackNodesDarwin: ConfigMap = { +export const ConfigMap_KubePrometheusStackNodesDarwin: KubernetesResource = { apiVersion: "v1", kind: "ConfigMap", metadata: { @@ -57065,7 +57065,7 @@ export const ConfigMap_KubePrometheusStackNodesDarwin: ConfigMap = { "nodes-darwin.json": "{\"graphTooltip\":1,\"panels\":[{\"collapsed\":false,\"gridPos\":{\"h\":1,\"w\":24,\"x\":0,\"y\":0},\"id\":1,\"panels\":[],\"title\":\"CPU\",\"type\":\"row\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"stacking\":{\"mode\":\"normal\"}},\"max\":1,\"min\":0,\"unit\":\"percentunit\"}},\"gridPos\":{\"h\":7,\"w\":12,\"x\":0,\"y\":1},\"id\":2,\"options\":{\"tooltip\":{\"mode\":\"multi\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"(\\n (1 - sum without (mode) (rate(node_cpu_seconds_total{job=\\\"node-exporter\\\", mode=~\\\"idle|iowait|steal\\\", instance=\\\"$instance\\\", cluster=\\\"$cluster\\\"}[$__rate_interval])))\\n/ ignoring(cpu) group_left\\n count without (cpu, mode) (node_cpu_seconds_total{job=\\\"node-exporter\\\", mode=\\\"idle\\\", instance=\\\"$instance\\\", cluster=\\\"$cluster\\\"})\\n)\\n\",\"intervalFactor\":5,\"legendFormat\":\"{{cpu}}\"}],\"title\":\"CPU Usage\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":0,\"showPoints\":\"never\"},\"min\":0,\"unit\":\"short\"}},\"gridPos\":{\"h\":7,\"w\":12,\"x\":12,\"y\":1},\"id\":3,\"options\":{\"tooltip\":{\"mode\":\"multi\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"node_load1{job=\\\"node-exporter\\\", instance=\\\"$instance\\\", cluster=\\\"$cluster\\\"}\",\"legendFormat\":\"1m load average\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"node_load5{job=\\\"node-exporter\\\", instance=\\\"$instance\\\", cluster=\\\"$cluster\\\"}\",\"legendFormat\":\"5m load average\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"node_load15{job=\\\"node-exporter\\\", instance=\\\"$instance\\\", cluster=\\\"$cluster\\\"}\",\"legendFormat\":\"15m load average\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"count(node_cpu_seconds_total{job=\\\"node-exporter\\\", instance=\\\"$instance\\\", cluster=\\\"$cluster\\\", mode=\\\"idle\\\"})\",\"legendFormat\":\"logical cores\"}],\"title\":\"Load Average\",\"type\":\"timeseries\"},{\"collapsed\":false,\"gridPos\":{\"h\":1,\"w\":24,\"x\":0,\"y\":8},\"id\":4,\"title\":\"Memory\",\"type\":\"row\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"stacking\":{\"mode\":\"none\"}},\"min\":0,\"unit\":\"bytes\"}},\"gridPos\":{\"h\":7,\"w\":18,\"x\":0,\"y\":9},\"id\":5,\"options\":{\"tooltip\":{\"mode\":\"multi\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"node_memory_total_bytes{job=\\\"node-exporter\\\", instance=\\\"$instance\\\", cluster=\\\"$cluster\\\"}\",\"legendFormat\":\"Physical Memory\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"(\\n node_memory_internal_bytes{job=\\\"node-exporter\\\", instance=\\\"$instance\\\", cluster=\\\"$cluster\\\"} -\\n node_memory_purgeable_bytes{job=\\\"node-exporter\\\", instance=\\\"$instance\\\", cluster=\\\"$cluster\\\"} +\\n node_memory_wired_bytes{job=\\\"node-exporter\\\", instance=\\\"$instance\\\", cluster=\\\"$cluster\\\"} +\\n node_memory_compressed_bytes{job=\\\"node-exporter\\\", instance=\\\"$instance\\\", cluster=\\\"$cluster\\\"}\\n)\\n\",\"legendFormat\":\"Memory Used\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"(\\n node_memory_internal_bytes{job=\\\"node-exporter\\\", instance=\\\"$instance\\\", cluster=\\\"$cluster\\\"} -\\n node_memory_purgeable_bytes{job=\\\"node-exporter\\\", instance=\\\"$instance\\\", cluster=\\\"$cluster\\\"}\\n)\\n\",\"legendFormat\":\"App Memory\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"node_memory_wired_bytes{job=\\\"node-exporter\\\", instance=\\\"$instance\\\", cluster=\\\"$cluster\\\"}\",\"legendFormat\":\"Wired Memory\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"node_memory_compressed_bytes{job=\\\"node-exporter\\\", instance=\\\"$instance\\\", cluster=\\\"$cluster\\\"}\",\"legendFormat\":\"Compressed\"}],\"title\":\"Memory Usage\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"fieldConfig\":{\"defaults\":{\"max\":100,\"min\":0,\"thresholds\":{\"steps\":[{\"color\":\"rgba(50, 172, 45, 0.97)\"},{\"color\":\"rgba(237, 129, 40, 0.89)\",\"value\":80},{\"color\":\"rgba(245, 54, 54, 0.9)\",\"value\":90}]},\"unit\":\"percent\"}},\"gridPos\":{\"h\":7,\"w\":6,\"x\":18,\"y\":9},\"id\":6,\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"(\\n (\\n avg(node_memory_internal_bytes{job=\\\"node-exporter\\\", instance=\\\"$instance\\\", cluster=\\\"$cluster\\\"}) -\\n avg(node_memory_purgeable_bytes{job=\\\"node-exporter\\\", instance=\\\"$instance\\\", cluster=\\\"$cluster\\\"}) +\\n avg(node_memory_wired_bytes{job=\\\"node-exporter\\\", instance=\\\"$instance\\\", cluster=\\\"$cluster\\\"}) +\\n avg(node_memory_compressed_bytes{job=\\\"node-exporter\\\", instance=\\\"$instance\\\", cluster=\\\"$cluster\\\"})\\n ) /\\n avg(node_memory_total_bytes{job=\\\"node-exporter\\\", instance=\\\"$instance\\\", cluster=\\\"$cluster\\\"})\\n)\\n*\\n100\\n\"}],\"title\":\"Memory Usage\",\"type\":\"gauge\"},{\"collapsed\":false,\"gridPos\":{\"h\":1,\"w\":24,\"x\":0,\"y\":18},\"id\":7,\"panels\":[],\"title\":\"Disk\",\"type\":\"row\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":0,\"showPoints\":\"never\"},\"min\":0},\"overrides\":[{\"matcher\":{\"id\":\"byRegexp\",\"options\":\"/ read| written/\"},\"properties\":[{\"id\":\"unit\",\"value\":\"Bps\"}]},{\"matcher\":{\"id\":\"byRegexp\",\"options\":\"/ io time/\"},\"properties\":[{\"id\":\"unit\",\"value\":\"percentunit\"}]}]},\"gridPos\":{\"h\":7,\"w\":12,\"x\":0,\"y\":19},\"id\":8,\"options\":{\"tooltip\":{\"mode\":\"multi\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"rate(node_disk_read_bytes_total{job=\\\"node-exporter\\\", instance=\\\"$instance\\\", cluster=\\\"$cluster\\\", device=~\\\"(/dev/)?(mmcblk.p.+|nvme.+|rbd.+|sd.+|vd.+|xvd.+|dm-.+|md.+|dasd.+)\\\"}[$__rate_interval])\",\"intervalFactor\":1,\"legendFormat\":\"{{device}} read\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"rate(node_disk_written_bytes_total{job=\\\"node-exporter\\\", instance=\\\"$instance\\\", cluster=\\\"$cluster\\\", device=~\\\"(/dev/)?(mmcblk.p.+|nvme.+|rbd.+|sd.+|vd.+|xvd.+|dm-.+|md.+|dasd.+)\\\"}[$__rate_interval])\",\"intervalFactor\":1,\"legendFormat\":\"{{device}} written\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"rate(node_disk_io_time_seconds_total{job=\\\"node-exporter\\\", instance=\\\"$instance\\\", cluster=\\\"$cluster\\\", device=~\\\"(/dev/)?(mmcblk.p.+|nvme.+|rbd.+|sd.+|vd.+|xvd.+|dm-.+|md.+|dasd.+)\\\"}[$__rate_interval])\",\"intervalFactor\":1,\"legendFormat\":\"{{device}} io time\"}],\"title\":\"Disk I/O\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"fieldConfig\":{\"defaults\":{\"thresholds\":{\"steps\":[{\"color\":\"green\"},{\"color\":\"yellow\",\"value\":0.8},{\"color\":\"red\",\"value\":0.9}]},\"unit\":\"decbytes\"},\"overrides\":[{\"matcher\":{\"id\":\"byName\",\"options\":\"Mounted on\"},\"properties\":[{\"id\":\"custom.width\",\"value\":260}]},{\"matcher\":{\"id\":\"byName\",\"options\":\"Size\"},\"properties\":[{\"id\":\"custom.width\",\"value\":93}]},{\"matcher\":{\"id\":\"byName\",\"options\":\"Used\"},\"properties\":[{\"id\":\"custom.width\",\"value\":72}]},{\"matcher\":{\"id\":\"byName\",\"options\":\"Available\"},\"properties\":[{\"id\":\"custom.width\",\"value\":88}]},{\"matcher\":{\"id\":\"byName\",\"options\":\"Used, %\"},\"properties\":[{\"id\":\"unit\",\"value\":\"percentunit\"},{\"id\":\"custom.cellOptions\",\"value\":{\"type\":\"gauge\"}},{\"id\":\"max\",\"value\":1},{\"id\":\"min\",\"value\":0}]}]},\"gridPos\":{\"h\":7,\"w\":12,\"x\":12,\"y\":19},\"id\":9,\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"max by (mountpoint) (node_filesystem_size_bytes{job=\\\"node-exporter\\\", instance=\\\"$instance\\\", cluster=\\\"$cluster\\\", fstype!=\\\"\\\", mountpoint!=\\\"\\\"})\\n\",\"format\":\"table\",\"instant\":true,\"legendFormat\":\"\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"max by (mountpoint) (node_filesystem_avail_bytes{job=\\\"node-exporter\\\", instance=\\\"$instance\\\", cluster=\\\"$cluster\\\", fstype!=\\\"\\\", mountpoint!=\\\"\\\"})\\n\",\"format\":\"table\",\"instant\":true,\"legendFormat\":\"\"}],\"title\":\"Disk Space Usage\",\"transformations\":[{\"id\":\"groupBy\",\"options\":{\"fields\":{\"Value #A\":{\"aggregations\":[\"lastNotNull\"],\"operation\":\"aggregate\"},\"Value #B\":{\"aggregations\":[\"lastNotNull\"],\"operation\":\"aggregate\"},\"mountpoint\":{\"aggregations\":[],\"operation\":\"groupby\"}}}},{\"id\":\"merge\"},{\"id\":\"calculateField\",\"options\":{\"alias\":\"Used\",\"binary\":{\"left\":\"Value #A (lastNotNull)\",\"operator\":\"-\",\"reducer\":\"sum\",\"right\":\"Value #B (lastNotNull)\"},\"mode\":\"binary\",\"reduce\":{\"reducer\":\"sum\"}}},{\"id\":\"calculateField\",\"options\":{\"alias\":\"Used, %\",\"binary\":{\"left\":\"Used\",\"operator\":\"/\",\"reducer\":\"sum\",\"right\":\"Value #A (lastNotNull)\"},\"mode\":\"binary\",\"reduce\":{\"reducer\":\"sum\"}}},{\"id\":\"organize\",\"options\":{\"excludeByName\":{},\"indexByName\":{},\"renameByName\":{\"Value #A (lastNotNull)\":\"Size\",\"Value #B (lastNotNull)\":\"Available\",\"mountpoint\":\"Mounted on\"}}},{\"id\":\"sortBy\",\"options\":{\"fields\":{},\"sort\":[{\"field\":\"Mounted on\"}]}}],\"type\":\"table\"},{\"collapsed\":false,\"gridPos\":{\"h\":1,\"w\":24,\"x\":0,\"y\":26},\"id\":10,\"panels\":[],\"title\":\"Network\",\"type\":\"row\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"description\":\"Network received (bits/s)\",\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":0,\"showPoints\":\"never\"},\"min\":0,\"unit\":\"bps\"}},\"gridPos\":{\"h\":7,\"w\":12,\"x\":0,\"y\":27},\"id\":11,\"options\":{\"tooltip\":{\"mode\":\"multi\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"rate(node_network_receive_bytes_total{job=\\\"node-exporter\\\", instance=\\\"$instance\\\", cluster=\\\"$cluster\\\", device!=\\\"lo\\\"}[$__rate_interval]) * 8\",\"intervalFactor\":1,\"legendFormat\":\"{{device}}\"}],\"title\":\"Network Received\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"description\":\"Network transmitted (bits/s)\",\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":0},\"min\":0,\"unit\":\"bps\"}},\"gridPos\":{\"h\":7,\"w\":12,\"x\":12,\"y\":27},\"id\":12,\"options\":{\"tooltip\":{\"mode\":\"multi\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"rate(node_network_transmit_bytes_total{job=\\\"node-exporter\\\", instance=\\\"$instance\\\", cluster=\\\"$cluster\\\", device!=\\\"lo\\\"}[$__rate_interval]) * 8\",\"intervalFactor\":1,\"legendFormat\":\"{{device}}\"}],\"title\":\"Network Transmitted\",\"type\":\"timeseries\"}],\"refresh\":\"30s\",\"schemaVersion\":39,\"tags\":[\"node-exporter-mixin\"],\"templating\":{\"list\":[{\"name\":\"datasource\",\"query\":\"prometheus\",\"type\":\"datasource\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"hide\":2,\"label\":\"Cluster\",\"name\":\"cluster\",\"query\":\"label_values(node_uname_info{job=\\\"node-exporter\\\", sysname=\\\"Darwin\\\"}, cluster)\",\"refresh\":2,\"type\":\"query\",\"allValue\":\".*\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"label\":\"Instance\",\"name\":\"instance\",\"query\":\"label_values(node_uname_info{job=\\\"node-exporter\\\", cluster=\\\"$cluster\\\", sysname=\\\"Darwin\\\"}, instance)\",\"refresh\":2,\"type\":\"query\"}]},\"time\":{\"from\":\"now-1h\",\"to\":\"now\"},\"timezone\": \"utc\",\"title\":\"Node Exporter / MacOS\",\"uid\":\"629701ea43bf69291922ea45f4a87d37\"}" } }; -export const ConfigMap_KubePrometheusStackNodes: ConfigMap = { +export const ConfigMap_KubePrometheusStackNodes: KubernetesResource = { apiVersion: "v1", kind: "ConfigMap", metadata: { @@ -57088,7 +57088,7 @@ export const ConfigMap_KubePrometheusStackNodes: ConfigMap = { "nodes.json": "{\"graphTooltip\":1,\"panels\":[{\"collapsed\":false,\"gridPos\":{\"h\":1,\"w\":24,\"x\":0,\"y\":0},\"id\":1,\"panels\":[],\"title\":\"CPU\",\"type\":\"row\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"stacking\":{\"mode\":\"normal\"}},\"max\":1,\"min\":0,\"unit\":\"percentunit\"}},\"gridPos\":{\"h\":7,\"w\":12,\"x\":0,\"y\":1},\"id\":2,\"options\":{\"tooltip\":{\"mode\":\"multi\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"(\\n (1 - sum without (mode) (rate(node_cpu_seconds_total{job=\\\"node-exporter\\\", mode=~\\\"idle|iowait|steal\\\", instance=\\\"$instance\\\", cluster=\\\"$cluster\\\"}[$__rate_interval])))\\n/ ignoring(cpu) group_left\\n count without (cpu, mode) (node_cpu_seconds_total{job=\\\"node-exporter\\\", mode=\\\"idle\\\", instance=\\\"$instance\\\", cluster=\\\"$cluster\\\"})\\n)\\n\",\"intervalFactor\":5,\"legendFormat\":\"{{cpu}}\"}],\"title\":\"CPU Usage\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":0,\"showPoints\":\"never\"},\"min\":0,\"unit\":\"short\"}},\"gridPos\":{\"h\":7,\"w\":12,\"x\":12,\"y\":1},\"id\":3,\"options\":{\"tooltip\":{\"mode\":\"multi\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"node_load1{job=\\\"node-exporter\\\", instance=\\\"$instance\\\", cluster=\\\"$cluster\\\"}\",\"legendFormat\":\"1m load average\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"node_load5{job=\\\"node-exporter\\\", instance=\\\"$instance\\\", cluster=\\\"$cluster\\\"}\",\"legendFormat\":\"5m load average\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"node_load15{job=\\\"node-exporter\\\", instance=\\\"$instance\\\", cluster=\\\"$cluster\\\"}\",\"legendFormat\":\"15m load average\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"count(node_cpu_seconds_total{job=\\\"node-exporter\\\", instance=\\\"$instance\\\", cluster=\\\"$cluster\\\", mode=\\\"idle\\\"})\",\"legendFormat\":\"logical cores\"}],\"title\":\"Load Average\",\"type\":\"timeseries\"},{\"collapsed\":false,\"gridPos\":{\"h\":1,\"w\":24,\"x\":0,\"y\":8},\"id\":4,\"title\":\"Memory\",\"type\":\"row\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"stacking\":{\"mode\":\"normal\"}},\"min\":0,\"unit\":\"bytes\"}},\"gridPos\":{\"h\":7,\"w\":18,\"x\":0,\"y\":9},\"id\":5,\"options\":{\"tooltip\":{\"mode\":\"multi\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"(\\n node_memory_MemTotal_bytes{job=\\\"node-exporter\\\", instance=\\\"$instance\\\", cluster=\\\"$cluster\\\"}\\n-\\n node_memory_MemFree_bytes{job=\\\"node-exporter\\\", instance=\\\"$instance\\\", cluster=\\\"$cluster\\\"}\\n-\\n node_memory_Buffers_bytes{job=\\\"node-exporter\\\", instance=\\\"$instance\\\", cluster=\\\"$cluster\\\"}\\n-\\n node_memory_Cached_bytes{job=\\\"node-exporter\\\", instance=\\\"$instance\\\", cluster=\\\"$cluster\\\"}\\n)\\n\",\"legendFormat\":\"memory used\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"node_memory_Buffers_bytes{job=\\\"node-exporter\\\", instance=\\\"$instance\\\", cluster=\\\"$cluster\\\"}\",\"legendFormat\":\"memory buffers\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"node_memory_Cached_bytes{job=\\\"node-exporter\\\", instance=\\\"$instance\\\", cluster=\\\"$cluster\\\"}\",\"legendFormat\":\"memory cached\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"node_memory_MemFree_bytes{job=\\\"node-exporter\\\", instance=\\\"$instance\\\", cluster=\\\"$cluster\\\"}\",\"legendFormat\":\"memory free\"}],\"title\":\"Memory Usage\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"fieldConfig\":{\"defaults\":{\"max\":100,\"min\":0,\"thresholds\":{\"steps\":[{\"color\":\"rgba(50, 172, 45, 0.97)\"},{\"color\":\"rgba(237, 129, 40, 0.89)\",\"value\":80},{\"color\":\"rgba(245, 54, 54, 0.9)\",\"value\":90}]},\"unit\":\"percent\"}},\"gridPos\":{\"h\":7,\"w\":6,\"x\":18,\"y\":9},\"id\":6,\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"100 -\\n(\\n avg(node_memory_MemAvailable_bytes{job=\\\"node-exporter\\\", instance=\\\"$instance\\\", cluster=\\\"$cluster\\\"}) /\\n avg(node_memory_MemTotal_bytes{job=\\\"node-exporter\\\", instance=\\\"$instance\\\", cluster=\\\"$cluster\\\"})\\n* 100\\n)\\n\"}],\"title\":\"Memory Usage\",\"type\":\"gauge\"},{\"collapsed\":false,\"gridPos\":{\"h\":1,\"w\":24,\"x\":0,\"y\":18},\"id\":7,\"panels\":[],\"title\":\"Disk\",\"type\":\"row\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":0,\"showPoints\":\"never\"},\"min\":0},\"overrides\":[{\"matcher\":{\"id\":\"byRegexp\",\"options\":\"/ read| written/\"},\"properties\":[{\"id\":\"unit\",\"value\":\"Bps\"}]},{\"matcher\":{\"id\":\"byRegexp\",\"options\":\"/ io time/\"},\"properties\":[{\"id\":\"unit\",\"value\":\"percentunit\"}]}]},\"gridPos\":{\"h\":7,\"w\":12,\"x\":0,\"y\":19},\"id\":8,\"options\":{\"tooltip\":{\"mode\":\"multi\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"rate(node_disk_read_bytes_total{job=\\\"node-exporter\\\", instance=\\\"$instance\\\", cluster=\\\"$cluster\\\", device=~\\\"(/dev/)?(mmcblk.p.+|nvme.+|rbd.+|sd.+|vd.+|xvd.+|dm-.+|md.+|dasd.+)\\\"}[$__rate_interval])\",\"intervalFactor\":1,\"legendFormat\":\"{{device}} read\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"rate(node_disk_written_bytes_total{job=\\\"node-exporter\\\", instance=\\\"$instance\\\", cluster=\\\"$cluster\\\", device=~\\\"(/dev/)?(mmcblk.p.+|nvme.+|rbd.+|sd.+|vd.+|xvd.+|dm-.+|md.+|dasd.+)\\\"}[$__rate_interval])\",\"intervalFactor\":1,\"legendFormat\":\"{{device}} written\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"rate(node_disk_io_time_seconds_total{job=\\\"node-exporter\\\", instance=\\\"$instance\\\", cluster=\\\"$cluster\\\", device=~\\\"(/dev/)?(mmcblk.p.+|nvme.+|rbd.+|sd.+|vd.+|xvd.+|dm-.+|md.+|dasd.+)\\\"}[$__rate_interval])\",\"intervalFactor\":1,\"legendFormat\":\"{{device}} io time\"}],\"title\":\"Disk I/O\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"fieldConfig\":{\"defaults\":{\"thresholds\":{\"steps\":[{\"color\":\"green\"},{\"color\":\"yellow\",\"value\":0.8},{\"color\":\"red\",\"value\":0.9}]},\"unit\":\"decbytes\"},\"overrides\":[{\"matcher\":{\"id\":\"byName\",\"options\":\"Mounted on\"},\"properties\":[{\"id\":\"custom.width\",\"value\":260}]},{\"matcher\":{\"id\":\"byName\",\"options\":\"Size\"},\"properties\":[{\"id\":\"custom.width\",\"value\":93}]},{\"matcher\":{\"id\":\"byName\",\"options\":\"Used\"},\"properties\":[{\"id\":\"custom.width\",\"value\":72}]},{\"matcher\":{\"id\":\"byName\",\"options\":\"Available\"},\"properties\":[{\"id\":\"custom.width\",\"value\":88}]},{\"matcher\":{\"id\":\"byName\",\"options\":\"Used, %\"},\"properties\":[{\"id\":\"unit\",\"value\":\"percentunit\"},{\"id\":\"custom.cellOptions\",\"value\":{\"type\":\"gauge\"}},{\"id\":\"max\",\"value\":1},{\"id\":\"min\",\"value\":0}]}]},\"gridPos\":{\"h\":7,\"w\":12,\"x\":12,\"y\":19},\"id\":9,\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"max by (mountpoint) (node_filesystem_size_bytes{job=\\\"node-exporter\\\", instance=\\\"$instance\\\", cluster=\\\"$cluster\\\", fstype!=\\\"\\\", mountpoint!=\\\"\\\"})\\n\",\"format\":\"table\",\"instant\":true,\"legendFormat\":\"\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"max by (mountpoint) (node_filesystem_avail_bytes{job=\\\"node-exporter\\\", instance=\\\"$instance\\\", cluster=\\\"$cluster\\\", fstype!=\\\"\\\", mountpoint!=\\\"\\\"})\\n\",\"format\":\"table\",\"instant\":true,\"legendFormat\":\"\"}],\"title\":\"Disk Space Usage\",\"transformations\":[{\"id\":\"groupBy\",\"options\":{\"fields\":{\"Value #A\":{\"aggregations\":[\"lastNotNull\"],\"operation\":\"aggregate\"},\"Value #B\":{\"aggregations\":[\"lastNotNull\"],\"operation\":\"aggregate\"},\"mountpoint\":{\"aggregations\":[],\"operation\":\"groupby\"}}}},{\"id\":\"merge\"},{\"id\":\"calculateField\",\"options\":{\"alias\":\"Used\",\"binary\":{\"left\":\"Value #A (lastNotNull)\",\"operator\":\"-\",\"reducer\":\"sum\",\"right\":\"Value #B (lastNotNull)\"},\"mode\":\"binary\",\"reduce\":{\"reducer\":\"sum\"}}},{\"id\":\"calculateField\",\"options\":{\"alias\":\"Used, %\",\"binary\":{\"left\":\"Used\",\"operator\":\"/\",\"reducer\":\"sum\",\"right\":\"Value #A (lastNotNull)\"},\"mode\":\"binary\",\"reduce\":{\"reducer\":\"sum\"}}},{\"id\":\"organize\",\"options\":{\"excludeByName\":{},\"indexByName\":{},\"renameByName\":{\"Value #A (lastNotNull)\":\"Size\",\"Value #B (lastNotNull)\":\"Available\",\"mountpoint\":\"Mounted on\"}}},{\"id\":\"sortBy\",\"options\":{\"fields\":{},\"sort\":[{\"field\":\"Mounted on\"}]}}],\"type\":\"table\"},{\"collapsed\":false,\"gridPos\":{\"h\":1,\"w\":24,\"x\":0,\"y\":26},\"id\":10,\"panels\":[],\"title\":\"Network\",\"type\":\"row\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"description\":\"Network received (bits/s)\",\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":0,\"showPoints\":\"never\"},\"min\":0,\"unit\":\"bps\"}},\"gridPos\":{\"h\":7,\"w\":12,\"x\":0,\"y\":27},\"id\":11,\"options\":{\"tooltip\":{\"mode\":\"multi\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"rate(node_network_receive_bytes_total{job=\\\"node-exporter\\\", instance=\\\"$instance\\\", cluster=\\\"$cluster\\\", device!=\\\"lo\\\"}[$__rate_interval]) * 8\",\"intervalFactor\":1,\"legendFormat\":\"{{device}}\"}],\"title\":\"Network Received\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"description\":\"Network transmitted (bits/s)\",\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":0},\"min\":0,\"unit\":\"bps\"}},\"gridPos\":{\"h\":7,\"w\":12,\"x\":12,\"y\":27},\"id\":12,\"options\":{\"tooltip\":{\"mode\":\"multi\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"rate(node_network_transmit_bytes_total{job=\\\"node-exporter\\\", instance=\\\"$instance\\\", cluster=\\\"$cluster\\\", device!=\\\"lo\\\"}[$__rate_interval]) * 8\",\"intervalFactor\":1,\"legendFormat\":\"{{device}}\"}],\"title\":\"Network Transmitted\",\"type\":\"timeseries\"}],\"refresh\":\"30s\",\"schemaVersion\":39,\"tags\":[\"node-exporter-mixin\"],\"templating\":{\"list\":[{\"name\":\"datasource\",\"query\":\"prometheus\",\"type\":\"datasource\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"hide\":2,\"label\":\"Cluster\",\"name\":\"cluster\",\"query\":\"label_values(node_uname_info{job=\\\"node-exporter\\\", sysname!=\\\"Darwin\\\"}, cluster)\",\"refresh\":2,\"type\":\"query\",\"allValue\":\".*\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"label\":\"Instance\",\"name\":\"instance\",\"query\":\"label_values(node_uname_info{job=\\\"node-exporter\\\", cluster=\\\"$cluster\\\", sysname!=\\\"Darwin\\\"}, instance)\",\"refresh\":2,\"type\":\"query\"}]},\"time\":{\"from\":\"now-1h\",\"to\":\"now\"},\"timezone\": \"utc\",\"title\":\"Node Exporter / Nodes\",\"uid\":\"7d57716318ee0dddbac5a7f451fb7753\"}" } }; -export const ConfigMap_KubePrometheusStackPersistentvolumesusage: ConfigMap = { +export const ConfigMap_KubePrometheusStackPersistentvolumesusage: KubernetesResource = { apiVersion: "v1", kind: "ConfigMap", metadata: { @@ -57111,7 +57111,7 @@ export const ConfigMap_KubePrometheusStackPersistentvolumesusage: ConfigMap = { "persistentvolumesusage.json": "{\"editable\":true,\"links\":[{\"asDropdown\":true,\"includeVars\":true,\"keepTime\":true,\"tags\":[\"kubernetes-mixin\"],\"targetBlank\":false,\"title\":\"Kubernetes\",\"type\":\"dashboards\"}],\"panels\":[{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"bytes\"}},\"gridPos\":{\"h\":7,\"w\":18,\"y\":0},\"id\":1,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"(\\n sum without(instance, node) (topk(1, (kubelet_volume_stats_capacity_bytes{cluster=\\\"$cluster\\\", job=\\\"kubelet\\\", metrics_path=\\\"/metrics\\\", namespace=\\\"$namespace\\\", persistentvolumeclaim=\\\"$volume\\\"})))\\n -\\n sum without(instance, node) (topk(1, (kubelet_volume_stats_available_bytes{cluster=\\\"$cluster\\\", job=\\\"kubelet\\\", metrics_path=\\\"/metrics\\\", namespace=\\\"$namespace\\\", persistentvolumeclaim=\\\"$volume\\\"})))\\n)\\n\",\"legendFormat\":\"Used Space\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum without(instance, node) (topk(1, (kubelet_volume_stats_available_bytes{cluster=\\\"$cluster\\\", job=\\\"kubelet\\\", metrics_path=\\\"/metrics\\\", namespace=\\\"$namespace\\\", persistentvolumeclaim=\\\"$volume\\\"})))\\n\",\"legendFormat\":\"Free Space\"}],\"title\":\"Volume Space Usage\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"color\":{\"mode\":\"thresholds\"},\"max\":100,\"min\":0,\"thresholds\":{\"mode\":\"absolute\",\"steps\":[{\"color\":\"green\",\"value\":0},{\"color\":\"orange\",\"value\":80},{\"color\":\"red\",\"value\":90}]},\"unit\":\"percent\"}},\"gridPos\":{\"h\":7,\"w\":6,\"x\":18,\"y\":0},\"id\":2,\"interval\":\"1m\",\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"max without(instance,node) (\\n(\\n topk(1, kubelet_volume_stats_capacity_bytes{cluster=\\\"$cluster\\\", job=\\\"kubelet\\\", metrics_path=\\\"/metrics\\\", namespace=\\\"$namespace\\\", persistentvolumeclaim=\\\"$volume\\\"})\\n -\\n topk(1, kubelet_volume_stats_available_bytes{cluster=\\\"$cluster\\\", job=\\\"kubelet\\\", metrics_path=\\\"/metrics\\\", namespace=\\\"$namespace\\\", persistentvolumeclaim=\\\"$volume\\\"})\\n)\\n/\\ntopk(1, kubelet_volume_stats_capacity_bytes{cluster=\\\"$cluster\\\", job=\\\"kubelet\\\", metrics_path=\\\"/metrics\\\", namespace=\\\"$namespace\\\", persistentvolumeclaim=\\\"$volume\\\"})\\n* 100)\\n\",\"instant\":true}],\"title\":\"Volume Space Usage\",\"type\":\"gauge\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"none\"}},\"gridPos\":{\"h\":7,\"w\":18,\"y\":7},\"id\":3,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum without(instance, node) (topk(1, (kubelet_volume_stats_inodes_used{cluster=\\\"$cluster\\\", job=\\\"kubelet\\\", metrics_path=\\\"/metrics\\\", namespace=\\\"$namespace\\\", persistentvolumeclaim=\\\"$volume\\\"})))\",\"legendFormat\":\"Used inodes\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"(\\n sum without(instance, node) (topk(1, (kubelet_volume_stats_inodes{cluster=\\\"$cluster\\\", job=\\\"kubelet\\\", metrics_path=\\\"/metrics\\\", namespace=\\\"$namespace\\\", persistentvolumeclaim=\\\"$volume\\\"})))\\n -\\n sum without(instance, node) (topk(1, (kubelet_volume_stats_inodes_used{cluster=\\\"$cluster\\\", job=\\\"kubelet\\\", metrics_path=\\\"/metrics\\\", namespace=\\\"$namespace\\\", persistentvolumeclaim=\\\"$volume\\\"})))\\n)\\n\",\"legendFormat\":\"Free inodes\"}],\"title\":\"Volume inodes Usage\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"color\":{\"mode\":\"thresholds\"},\"max\":100,\"min\":0,\"thresholds\":{\"mode\":\"absolute\",\"steps\":[{\"color\":\"green\",\"value\":0},{\"color\":\"orange\",\"value\":80},{\"color\":\"red\",\"value\":90}]},\"unit\":\"percent\"}},\"gridPos\":{\"h\":7,\"w\":6,\"x\":18,\"y\":7},\"id\":4,\"interval\":\"1m\",\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"max without(instance,node) (\\ntopk(1, kubelet_volume_stats_inodes_used{cluster=\\\"$cluster\\\", job=\\\"kubelet\\\", metrics_path=\\\"/metrics\\\", namespace=\\\"$namespace\\\", persistentvolumeclaim=\\\"$volume\\\"})\\n/\\ntopk(1, kubelet_volume_stats_inodes{cluster=\\\"$cluster\\\", job=\\\"kubelet\\\", metrics_path=\\\"/metrics\\\", namespace=\\\"$namespace\\\", persistentvolumeclaim=\\\"$volume\\\"})\\n* 100)\\n\",\"instant\":true}],\"title\":\"Volume inodes Usage\",\"type\":\"gauge\"}],\"refresh\":\"10s\",\"schemaVersion\":39,\"tags\":[\"kubernetes-mixin\"],\"templating\":{\"list\":[{\"current\":{\"selected\":true,\"text\":\"default\",\"value\":\"default\"},\"hide\":0,\"label\":\"Data source\",\"name\":\"datasource\",\"query\":\"prometheus\",\"regex\":\"\",\"type\":\"datasource\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"hide\":2,\"label\":\"cluster\",\"name\":\"cluster\",\"query\":\"label_values(kubelet_volume_stats_capacity_bytes{job=\\\"kubelet\\\", metrics_path=\\\"/metrics\\\"}, cluster)\",\"refresh\":2,\"sort\":1,\"type\":\"query\",\"allValue\":\".*\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"hide\":0,\"label\":\"Namespace\",\"name\":\"namespace\",\"query\":\"label_values(kubelet_volume_stats_capacity_bytes{cluster=\\\"$cluster\\\", job=\\\"kubelet\\\", metrics_path=\\\"/metrics\\\"}, namespace)\",\"refresh\":2,\"sort\":1,\"type\":\"query\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"hide\":0,\"label\":\"PersistentVolumeClaim\",\"name\":\"volume\",\"query\":\"label_values(kubelet_volume_stats_capacity_bytes{cluster=\\\"$cluster\\\", job=\\\"kubelet\\\", metrics_path=\\\"/metrics\\\", namespace=\\\"$namespace\\\"}, persistentvolumeclaim)\",\"refresh\":2,\"sort\":1,\"type\":\"query\"}]},\"time\":{\"from\":\"now-1h\",\"to\":\"now\"},\"timezone\": \"utc\",\"title\":\"Kubernetes / Persistent Volumes\",\"uid\":\"919b92a8e8041bd567af9edab12c840c\"}" } }; -export const ConfigMap_KubePrometheusStackPodTotal: ConfigMap = { +export const ConfigMap_KubePrometheusStackPodTotal: KubernetesResource = { apiVersion: "v1", kind: "ConfigMap", metadata: { @@ -57134,7 +57134,7 @@ export const ConfigMap_KubePrometheusStackPodTotal: ConfigMap = { "pod-total.json": "{\"editable\":true,\"links\":[{\"asDropdown\":true,\"includeVars\":true,\"keepTime\":true,\"tags\":[\"kubernetes-mixin\"],\"targetBlank\":false,\"title\":\"Kubernetes\",\"type\":\"dashboards\"}],\"panels\":[{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"displayName\":\"$pod\",\"max\":10000000000,\"min\":0,\"thresholds\":{\"steps\":[{\"color\":\"dark-green\",\"index\":0,\"value\":null},{\"color\":\"dark-yellow\",\"index\":1,\"value\":5000000000},{\"color\":\"dark-red\",\"index\":2,\"value\":7000000000}]},\"unit\":\"Bps\"}},\"gridPos\":{\"h\":9,\"w\":12,\"x\":0,\"y\":0},\"id\":1,\"interval\":\"1m\",\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(rate(container_network_receive_bytes_total{cluster=\\\"$cluster\\\",namespace=~\\\"$namespace\\\", pod=~\\\"$pod\\\"}[$__rate_interval]))\",\"legendFormat\":\"__auto\"}],\"title\":\"Current Rate of Bytes Received\",\"type\":\"gauge\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"displayName\":\"$pod\",\"max\":10000000000,\"min\":0,\"thresholds\":{\"steps\":[{\"color\":\"dark-green\",\"index\":0,\"value\":null},{\"color\":\"dark-yellow\",\"index\":1,\"value\":5000000000},{\"color\":\"dark-red\",\"index\":2,\"value\":7000000000}]},\"unit\":\"Bps\"}},\"gridPos\":{\"h\":9,\"w\":12,\"x\":12,\"y\":0},\"id\":2,\"interval\":\"1m\",\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(rate(container_network_transmit_bytes_total{cluster=\\\"$cluster\\\",namespace=~\\\"$namespace\\\", pod=~\\\"$pod\\\"}[$__rate_interval]))\",\"legendFormat\":\"__auto\"}],\"title\":\"Current Rate of Bytes Transmitted\",\"type\":\"gauge\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"showPoints\":\"never\"},\"unit\":\"binBps\"}},\"gridPos\":{\"h\":9,\"w\":12,\"x\":0,\"y\":9},\"id\":3,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(rate(container_network_receive_bytes_total{cluster=\\\"$cluster\\\",namespace=~\\\"$namespace\\\", pod=~\\\"$pod\\\"}[$__rate_interval])) by (pod)\",\"legendFormat\":\"__auto\"}],\"title\":\"Receive Bandwidth\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"showPoints\":\"never\"},\"unit\":\"binBps\"}},\"gridPos\":{\"h\":9,\"w\":12,\"x\":12,\"y\":9},\"id\":4,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(rate(container_network_transmit_bytes_total{cluster=\\\"$cluster\\\",namespace=~\\\"$namespace\\\", pod=~\\\"$pod\\\"}[$__rate_interval])) by (pod)\",\"legendFormat\":\"__auto\"}],\"title\":\"Transmit Bandwidth\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"showPoints\":\"never\"},\"unit\":\"pps\"}},\"gridPos\":{\"h\":9,\"w\":12,\"x\":0,\"y\":18},\"id\":5,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(rate(container_network_receive_packets_total{cluster=\\\"$cluster\\\",namespace=~\\\"$namespace\\\", pod=~\\\"$pod\\\"}[$__rate_interval])) by (pod)\",\"legendFormat\":\"__auto\"}],\"title\":\"Rate of Received Packets\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"showPoints\":\"never\"},\"unit\":\"pps\"}},\"gridPos\":{\"h\":9,\"w\":12,\"x\":12,\"y\":18},\"id\":6,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(rate(container_network_transmit_packets_total{cluster=\\\"$cluster\\\",namespace=~\\\"$namespace\\\", pod=~\\\"$pod\\\"}[$__rate_interval])) by (pod)\",\"legendFormat\":\"__auto\"}],\"title\":\"Rate of Transmitted Packets\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"showPoints\":\"never\"},\"unit\":\"pps\"}},\"gridPos\":{\"h\":9,\"w\":12,\"x\":0,\"y\":27},\"id\":7,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(rate(container_network_receive_packets_dropped_total{cluster=\\\"$cluster\\\",namespace=~\\\"$namespace\\\", pod=~\\\"$pod\\\"}[$__rate_interval])) by (pod)\",\"legendFormat\":\"__auto\"}],\"title\":\"Rate of Received Packets Dropped\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"showPoints\":\"never\"},\"unit\":\"pps\"}},\"gridPos\":{\"h\":9,\"w\":12,\"x\":12,\"y\":27},\"id\":8,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(rate(container_network_transmit_packets_dropped_total{cluster=\\\"$cluster\\\",namespace=~\\\"$namespace\\\", pod=~\\\"$pod\\\"}[$__rate_interval])) by (pod)\",\"legendFormat\":\"__auto\"}],\"title\":\"Rate of Transmitted Packets Dropped\",\"type\":\"timeseries\"}],\"refresh\":\"10s\",\"schemaVersion\":39,\"tags\":[\"kubernetes-mixin\"],\"templating\":{\"list\":[{\"current\":{\"selected\":true,\"text\":\"default\",\"value\":\"default\"},\"hide\":0,\"label\":\"Data source\",\"name\":\"datasource\",\"query\":\"prometheus\",\"regex\":\"\",\"type\":\"datasource\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"hide\":2,\"label\":\"cluster\",\"name\":\"cluster\",\"query\":\"label_values(up{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\"}, cluster)\",\"refresh\":2,\"sort\":1,\"type\":\"query\",\"allValue\":\".*\"},{\"allValue\":\".+\",\"current\":{\"selected\":false,\"text\":\"kube-system\",\"value\":\"kube-system\"},\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"hide\":0,\"includeAll\":true,\"label\":\"namespace\",\"name\":\"namespace\",\"query\":\"label_values(container_network_receive_packets_total{cluster=\\\"$cluster\\\"}, namespace)\",\"refresh\":2,\"sort\":1,\"type\":\"query\"},{\"current\":{\"selected\":false,\"text\":\"kube-system\",\"value\":\"kube-system\"},\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"hide\":0,\"label\":\"pod\",\"name\":\"pod\",\"query\":\"label_values(container_network_receive_packets_total{cluster=\\\"$cluster\\\",namespace=~\\\"$namespace\\\"}, pod)\",\"refresh\":2,\"sort\":1,\"type\":\"query\"}]},\"time\":{\"from\":\"now-1h\",\"to\":\"now\"},\"timezone\": \"utc\",\"title\":\"Kubernetes / Networking / Pod\",\"uid\":\"7a18067ce943a40ae25454675c19ff5c\"}" } }; -export const ConfigMap_KubePrometheusStackPrometheus: ConfigMap = { +export const ConfigMap_KubePrometheusStackPrometheus: KubernetesResource = { apiVersion: "v1", kind: "ConfigMap", metadata: { @@ -57157,7 +57157,7 @@ export const ConfigMap_KubePrometheusStackPrometheus: ConfigMap = { "prometheus.json": "{\"panels\":[{\"collapsed\":false,\"gridPos\":{\"h\":1,\"w\":24,\"x\":0,\"y\":0},\"id\":1,\"panels\":[],\"title\":\"Prometheus Stats\",\"type\":\"row\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"fieldConfig\":{\"defaults\":{\"decimals\":2,\"displayName\":\"\",\"unit\":\"short\"},\"overrides\":[{\"matcher\":{\"id\":\"byName\",\"options\":\"Time\"},\"properties\":[{\"id\":\"displayName\",\"value\":\"Time\"},{\"id\":\"custom.align\",\"value\":null},{\"id\":\"custom.hidden\",\"value\":\"true\"}]},{\"matcher\":{\"id\":\"byName\",\"options\":\"cluster\"},\"properties\":[{\"id\":\"custom.align\",\"value\":null},{\"id\":\"unit\",\"value\":\"short\"},{\"id\":\"decimals\",\"value\":2},{\"id\":\"displayName\",\"value\":\"Cluster\"}]},{\"matcher\":{\"id\":\"byName\",\"options\":\"job\"},\"properties\":[{\"id\":\"custom.align\",\"value\":null},{\"id\":\"unit\",\"value\":\"short\"},{\"id\":\"decimals\",\"value\":2},{\"id\":\"displayName\",\"value\":\"Job\"}]},{\"matcher\":{\"id\":\"byName\",\"options\":\"instance\"},\"properties\":[{\"id\":\"displayName\",\"value\":\"Instance\"},{\"id\":\"custom.align\",\"value\":null},{\"id\":\"unit\",\"value\":\"short\"},{\"id\":\"decimals\",\"value\":2}]},{\"matcher\":{\"id\":\"byName\",\"options\":\"version\"},\"properties\":[{\"id\":\"displayName\",\"value\":\"Version\"},{\"id\":\"custom.align\",\"value\":null},{\"id\":\"unit\",\"value\":\"short\"},{\"id\":\"decimals\",\"value\":2}]},{\"matcher\":{\"id\":\"byName\",\"options\":\"Value #A\"},\"properties\":[{\"id\":\"displayName\",\"value\":\"Count\"},{\"id\":\"custom.align\",\"value\":null},{\"id\":\"unit\",\"value\":\"short\"},{\"id\":\"decimals\",\"value\":2},{\"id\":\"custom.hidden\",\"value\":\"true\"}]},{\"matcher\":{\"id\":\"byName\",\"options\":\"Value #B\"},\"properties\":[{\"id\":\"displayName\",\"value\":\"Uptime\"},{\"id\":\"custom.align\",\"value\":null},{\"id\":\"unit\",\"value\":\"s\"}]}]},\"gridPos\":{\"h\":7,\"w\":24,\"x\":0,\"y\":1},\"id\":2,\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"count by (cluster, job, instance, version) (prometheus_build_info{cluster=~\\\"$cluster\\\", job=~\\\"$job\\\", instance=~\\\"$instance\\\"})\",\"format\":\"table\",\"instant\":true,\"legendFormat\":\"\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"max by (cluster, job, instance) (time() - process_start_time_seconds{cluster=~\\\"$cluster\\\", job=~\\\"$job\\\", instance=~\\\"$instance\\\"})\",\"format\":\"table\",\"instant\":true,\"legendFormat\":\"\"}],\"title\":\"Prometheus Stats\",\"type\":\"table\"},{\"collapsed\":false,\"gridPos\":{\"h\":1,\"w\":24,\"x\":0,\"y\":8},\"id\":3,\"panels\":[],\"title\":\"Discovery\",\"type\":\"row\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\"},\"min\":0,\"unit\":\"ms\"}},\"gridPos\":{\"h\":7,\"w\":12,\"x\":0,\"y\":9},\"id\":4,\"options\":{\"tooltip\":{\"mode\":\"multi\",\"sort\":\"desc\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"sum(rate(prometheus_target_sync_length_seconds_sum{cluster=~\\\"$cluster\\\",job=~\\\"$job\\\",instance=~\\\"$instance\\\"}[5m])) by (cluster, job, scrape_job, instance) * 1e3\",\"format\":\"time_series\",\"legendFormat\":\"{{cluster}}:{{job}}:{{instance}}:{{scrape_job}}\"}],\"title\":\"Target Sync\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":100,\"lineWidth\":0,\"showPoints\":\"never\",\"stacking\":{\"mode\":\"normal\"}},\"min\":0,\"unit\":\"short\"}},\"gridPos\":{\"h\":7,\"w\":12,\"x\":12,\"y\":9},\"id\":5,\"options\":{\"tooltip\":{\"mode\":\"multi\",\"sort\":\"desc\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"sum by (cluster, job, instance) (prometheus_sd_discovered_targets{cluster=~\\\"$cluster\\\", job=~\\\"$job\\\",instance=~\\\"$instance\\\"})\",\"format\":\"time_series\",\"legendFormat\":\"{{cluster}}:{{job}}:{{instance}}\"}],\"title\":\"Targets\",\"type\":\"timeseries\"},{\"collapsed\":false,\"gridPos\":{\"h\":1,\"w\":24,\"x\":0,\"y\":16},\"id\":6,\"panels\":[],\"title\":\"Retrieval\",\"type\":\"row\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\"},\"min\":0,\"unit\":\"ms\"}},\"gridPos\":{\"h\":7,\"w\":8,\"x\":0,\"y\":17},\"id\":7,\"options\":{\"tooltip\":{\"mode\":\"multi\",\"sort\":\"desc\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"rate(prometheus_target_interval_length_seconds_sum{cluster=~\\\"$cluster\\\", job=~\\\"$job\\\",instance=~\\\"$instance\\\"}[5m]) / rate(prometheus_target_interval_length_seconds_count{cluster=~\\\"$cluster\\\", job=~\\\"$job\\\",instance=~\\\"$instance\\\"}[5m]) * 1e3\",\"format\":\"time_series\",\"legendFormat\":\"{{cluster}}:{{job}}:{{instance}} {{interval}} configured\"}],\"title\":\"Average Scrape Interval Duration\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":100,\"lineWidth\":0,\"showPoints\":\"never\",\"stacking\":{\"mode\":\"normal\"}},\"min\":0,\"unit\":\"short\"}},\"gridPos\":{\"h\":7,\"w\":8,\"x\":8,\"y\":17},\"id\":8,\"options\":{\"tooltip\":{\"mode\":\"multi\",\"sort\":\"desc\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"sum by (cluster, job, instance) (rate(prometheus_target_scrapes_exceeded_body_size_limit_total{cluster=~\\\"$cluster\\\",job=~\\\"$job\\\",instance=~\\\"$instance\\\"}[1m]))\",\"format\":\"time_series\",\"legendFormat\":\"exceeded body size limit: {{cluster}} {{job}} {{instance}}\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"sum by (cluster, job, instance) (rate(prometheus_target_scrapes_exceeded_sample_limit_total{cluster=~\\\"$cluster\\\",job=~\\\"$job\\\",instance=~\\\"$instance\\\"}[1m]))\",\"format\":\"time_series\",\"legendFormat\":\"exceeded sample limit: {{cluster}} {{job}} {{instance}}\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"sum by (cluster, job, instance) (rate(prometheus_target_scrapes_sample_duplicate_timestamp_total{cluster=~\\\"$cluster\\\",job=~\\\"$job\\\",instance=~\\\"$instance\\\"}[1m]))\",\"format\":\"time_series\",\"legendFormat\":\"duplicate timestamp: {{cluster}} {{job}} {{instance}}\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"sum by (cluster, job, instance) (rate(prometheus_target_scrapes_sample_out_of_bounds_total{cluster=~\\\"$cluster\\\",job=~\\\"$job\\\",instance=~\\\"$instance\\\"}[1m]))\",\"format\":\"time_series\",\"legendFormat\":\"out of bounds: {{cluster}} {{job}} {{instance}}\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"sum by (cluster, job, instance) (rate(prometheus_target_scrapes_sample_out_of_order_total{cluster=~\\\"$cluster\\\",job=~\\\"$job\\\",instance=~\\\"$instance\\\"}[1m]))\",\"format\":\"time_series\",\"legendFormat\":\"out of order: {{cluster}} {{job}} {{instance}}\"}],\"title\":\"Scrape failures\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":100,\"lineWidth\":0,\"showPoints\":\"never\",\"stacking\":{\"mode\":\"normal\"}},\"min\":0,\"unit\":\"short\"}},\"gridPos\":{\"h\":7,\"w\":8,\"x\":16,\"y\":17},\"id\":9,\"options\":{\"tooltip\":{\"mode\":\"multi\",\"sort\":\"desc\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"rate(prometheus_tsdb_head_samples_appended_total{cluster=~\\\"$cluster\\\", job=~\\\"$job\\\",instance=~\\\"$instance\\\"}[5m])\",\"format\":\"time_series\",\"legendFormat\":\"{{cluster}} {{job}} {{instance}}\"}],\"title\":\"Appended Samples\",\"type\":\"timeseries\"},{\"collapsed\":false,\"gridPos\":{\"h\":1,\"w\":24,\"x\":0,\"y\":24},\"id\":10,\"panels\":[],\"title\":\"Storage\",\"type\":\"row\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":100,\"lineWidth\":0,\"showPoints\":\"never\",\"stacking\":{\"mode\":\"normal\"}},\"min\":0,\"unit\":\"short\"}},\"gridPos\":{\"h\":7,\"w\":12,\"x\":0,\"y\":25},\"id\":11,\"options\":{\"tooltip\":{\"mode\":\"multi\",\"sort\":\"desc\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"prometheus_tsdb_head_series{cluster=~\\\"$cluster\\\",job=~\\\"$job\\\",instance=~\\\"$instance\\\"}\",\"format\":\"time_series\",\"legendFormat\":\"{{cluster}} {{job}} {{instance}} head series\"}],\"title\":\"Head Series\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":100,\"lineWidth\":0,\"showPoints\":\"never\",\"stacking\":{\"mode\":\"normal\"}},\"min\":0,\"unit\":\"short\"}},\"gridPos\":{\"h\":7,\"w\":12,\"x\":12,\"y\":25},\"id\":12,\"options\":{\"tooltip\":{\"mode\":\"multi\",\"sort\":\"desc\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"prometheus_tsdb_head_chunks{cluster=~\\\"$cluster\\\",job=~\\\"$job\\\",instance=~\\\"$instance\\\"}\",\"format\":\"time_series\",\"legendFormat\":\"{{cluster}} {{job}} {{instance}} head chunks\"}],\"title\":\"Head Chunks\",\"type\":\"timeseries\"},{\"collapsed\":false,\"gridPos\":{\"h\":1,\"w\":24,\"x\":0,\"y\":32},\"id\":13,\"panels\":[],\"title\":\"Query\",\"type\":\"row\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":100,\"lineWidth\":0,\"showPoints\":\"never\",\"stacking\":{\"mode\":\"normal\"}},\"min\":0,\"unit\":\"short\"}},\"gridPos\":{\"h\":7,\"w\":12,\"x\":0,\"y\":33},\"id\":14,\"options\":{\"tooltip\":{\"mode\":\"multi\",\"sort\":\"desc\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"rate(prometheus_engine_query_duration_seconds_count{cluster=~\\\"$cluster\\\",job=~\\\"$job\\\",instance=~\\\"$instance\\\",slice=\\\"inner_eval\\\"}[5m])\",\"format\":\"time_series\",\"legendFormat\":\"{{cluster}} {{job}} {{instance}}\"}],\"title\":\"Query Rate\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":100,\"lineWidth\":0,\"showPoints\":\"never\",\"stacking\":{\"mode\":\"normal\"}},\"min\":0,\"unit\":\"ms\"}},\"gridPos\":{\"h\":7,\"w\":12,\"x\":12,\"y\":33},\"id\":15,\"options\":{\"tooltip\":{\"mode\":\"multi\",\"sort\":\"desc\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"$datasource\"},\"expr\":\"max by (slice) (prometheus_engine_query_duration_seconds{quantile=\\\"0.9\\\",cluster=~\\\"$cluster\\\", job=~\\\"$job\\\",instance=~\\\"$instance\\\"}) * 1e3\",\"format\":\"time_series\",\"legendFormat\":\"{{slice}}\"}],\"title\":\"Stage Duration\",\"type\":\"timeseries\"}],\"schemaVersion\":39,\"tags\":[\"prometheus-mixin\"],\"templating\":{\"list\":[{\"current\":{\"selected\":false,\"text\":\"default\",\"value\":\"default\"},\"hide\":0,\"label\":\"Data source\",\"name\":\"datasource\",\"query\":\"prometheus\",\"type\":\"datasource\"},{\"allValue\":\".*\",\"current\":{\"selected\":false,\"text\":[\"$__all\"],\"value\":[\"$__all\"]},\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"hide\":2,\"includeAll\":true,\"label\":\"cluster\",\"multi\":true,\"name\":\"cluster\",\"query\":\"label_values(prometheus_build_info{}, cluster)\",\"refresh\":2,\"sort\":2,\"type\":\"query\"},{\"allValue\":\".+\",\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"includeAll\":true,\"label\":\"job\",\"multi\":true,\"name\":\"job\",\"query\":\"label_values(prometheus_build_info{cluster=~\\\"$cluster\\\"}, job)\",\"refresh\":2,\"sort\":2,\"type\":\"query\"},{\"allValue\":\".+\",\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"includeAll\":true,\"label\":\"instance\",\"multi\":true,\"name\":\"instance\",\"query\":\"label_values(prometheus_build_info{cluster=~\\\"$cluster\\\", job=~\\\"$job\\\"}, instance)\",\"refresh\":2,\"sort\":2,\"type\":\"query\"}]},\"time\":{\"from\":\"now-1h\",\"to\":\"now\"},\"timepicker\":{\"refresh_intervals\":[\"60s\"]},\"timezone\": \"utc\",\"title\":\"Prometheus / Overview\",\"uid\":\"9fa0d141-d019-4ad7-8bc5-42196ee308bd\"}" } }; -export const ConfigMap_KubePrometheusStackProxy: ConfigMap = { +export const ConfigMap_KubePrometheusStackProxy: KubernetesResource = { apiVersion: "v1", kind: "ConfigMap", metadata: { @@ -57180,7 +57180,7 @@ export const ConfigMap_KubePrometheusStackProxy: ConfigMap = { "proxy.json": "{\"editable\":true,\"links\":[{\"asDropdown\":true,\"includeVars\":true,\"keepTime\":true,\"tags\":[\"kubernetes-mixin\"],\"targetBlank\":false,\"title\":\"Kubernetes\",\"type\":\"dashboards\"}],\"panels\":[{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"unit\":\"none\"}},\"gridPos\":{\"h\":7,\"w\":4,\"x\":0,\"y\":0},\"id\":1,\"interval\":\"1m\",\"options\":{\"colorMode\":\"none\"},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(up{cluster=\\\"$cluster\\\", job=\\\"kube-proxy\\\"})\",\"instant\":true}],\"title\":\"Up\",\"type\":\"stat\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"ops\"}},\"gridPos\":{\"h\":7,\"w\":10,\"x\":4,\"y\":0},\"id\":2,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(rate(kubeproxy_sync_proxy_rules_duration_seconds_count{cluster=\\\"$cluster\\\", job=\\\"kube-proxy\\\", instance=~\\\"$instance\\\"}[$__rate_interval]))\",\"legendFormat\":\"rate\"}],\"title\":\"Rules Sync Rate\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"s\"}},\"gridPos\":{\"h\":7,\"w\":10,\"x\":14,\"y\":0},\"id\":3,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"histogram_quantile(0.99,rate(kubeproxy_sync_proxy_rules_duration_seconds_bucket{cluster=\\\"$cluster\\\", job=\\\"kube-proxy\\\", instance=~\\\"$instance\\\"}[$__rate_interval]))\",\"legendFormat\":\"{{instance}}\"}],\"title\":\"Rules Sync Latency 99th Quantile\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"ops\"}},\"gridPos\":{\"h\":7,\"w\":12,\"x\":0,\"y\":7},\"id\":4,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(rate(kubeproxy_network_programming_duration_seconds_count{cluster=\\\"$cluster\\\", job=\\\"kube-proxy\\\", instance=~\\\"$instance\\\"}[$__rate_interval]))\",\"legendFormat\":\"rate\"}],\"title\":\"Network Programming Rate\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"s\"}},\"gridPos\":{\"h\":7,\"w\":12,\"x\":12,\"y\":7},\"id\":5,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"histogram_quantile(0.99, sum(rate(kubeproxy_network_programming_duration_seconds_bucket{cluster=\\\"$cluster\\\", job=\\\"kube-proxy\\\", instance=~\\\"$instance\\\"}[$__rate_interval])) by (instance, le))\",\"legendFormat\":\"{{instance}}\"}],\"title\":\"Network Programming Latency 99th Quantile\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"ops\"}},\"gridPos\":{\"h\":7,\"w\":8,\"x\":0,\"y\":14},\"id\":6,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(rate(rest_client_requests_total{cluster=\\\"$cluster\\\",job=\\\"kube-proxy\\\", instance=~\\\"$instance\\\",code=~\\\"2..\\\"}[$__rate_interval]))\",\"legendFormat\":\"2xx\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(rate(rest_client_requests_total{cluster=\\\"$cluster\\\",job=\\\"kube-proxy\\\", instance=~\\\"$instance\\\",code=~\\\"3..\\\"}[$__rate_interval]))\",\"legendFormat\":\"3xx\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(rate(rest_client_requests_total{cluster=\\\"$cluster\\\",job=\\\"kube-proxy\\\", instance=~\\\"$instance\\\",code=~\\\"4..\\\"}[$__rate_interval]))\",\"legendFormat\":\"4xx\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(rate(rest_client_requests_total{cluster=\\\"$cluster\\\",job=\\\"kube-proxy\\\", instance=~\\\"$instance\\\",code=~\\\"5..\\\"}[$__rate_interval]))\",\"legendFormat\":\"5xx\"}],\"title\":\"Kube API Request Rate\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"ops\"}},\"gridPos\":{\"h\":7,\"w\":16,\"x\":8,\"y\":14},\"id\":7,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"histogram_quantile(0.99, sum(rate(rest_client_request_duration_seconds_bucket{cluster=\\\"$cluster\\\", job=\\\"kube-proxy\\\",instance=~\\\"$instance\\\",verb=\\\"POST\\\"}[$__rate_interval])) by (verb, le))\",\"legendFormat\":\"{{verb}}\"}],\"title\":\"Post Request Latency 99th Quantile\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"s\"}},\"gridPos\":{\"h\":7,\"w\":24,\"x\":0,\"y\":21},\"id\":8,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"histogram_quantile(0.99, sum(rate(rest_client_request_duration_seconds_bucket{cluster=\\\"$cluster\\\", job=\\\"kube-proxy\\\", instance=~\\\"$instance\\\", verb=\\\"GET\\\"}[$__rate_interval])) by (verb, le))\",\"legendFormat\":\"{{verb}}\"}],\"title\":\"Get Request Latency 99th Quantile\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"bytes\"}},\"gridPos\":{\"h\":7,\"w\":8,\"x\":0,\"y\":28},\"id\":9,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"process_resident_memory_bytes{cluster=\\\"$cluster\\\", job=\\\"kube-proxy\\\",instance=~\\\"$instance\\\"}\",\"legendFormat\":\"{{instance}}\"}],\"title\":\"Memory\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"short\"}},\"gridPos\":{\"h\":7,\"w\":8,\"x\":8,\"y\":28},\"id\":10,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"rate(process_cpu_seconds_total{cluster=\\\"$cluster\\\", job=\\\"kube-proxy\\\",instance=~\\\"$instance\\\"}[$__rate_interval])\",\"legendFormat\":\"{{instance}}\"}],\"title\":\"CPU usage\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"short\"}},\"gridPos\":{\"h\":7,\"w\":8,\"x\":16,\"y\":28},\"id\":11,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"go_goroutines{cluster=\\\"$cluster\\\", job=\\\"kube-proxy\\\",instance=~\\\"$instance\\\"}\",\"legendFormat\":\"{{instance}}\"}],\"title\":\"Goroutines\",\"type\":\"timeseries\"}],\"refresh\":\"10s\",\"schemaVersion\":39,\"tags\":[\"kubernetes-mixin\"],\"templating\":{\"list\":[{\"current\":{\"selected\":true,\"text\":\"default\",\"value\":\"default\"},\"hide\":0,\"label\":\"Data source\",\"name\":\"datasource\",\"query\":\"prometheus\",\"regex\":\"\",\"type\":\"datasource\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"hide\":2,\"label\":\"cluster\",\"name\":\"cluster\",\"query\":\"label_values(up{job=\\\"kube-proxy\\\"}, cluster)\",\"refresh\":2,\"sort\":1,\"type\":\"query\",\"allValue\":\".*\"},{\"allValue\":\".+\",\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"hide\":0,\"includeAll\":true,\"label\":\"instance\",\"name\":\"instance\",\"query\":\"label_values(up{job=\\\"kube-proxy\\\", cluster=\\\"$cluster\\\", job=\\\"kube-proxy\\\"}, instance)\",\"refresh\":2,\"type\":\"query\"}]},\"time\":{\"from\":\"now-1h\",\"to\":\"now\"},\"timezone\": \"utc\",\"title\":\"Kubernetes / Proxy\",\"uid\":\"632e265de029684c40b21cb76bca4f94\"}" } }; -export const ConfigMap_KubePrometheusStackScheduler: ConfigMap = { +export const ConfigMap_KubePrometheusStackScheduler: KubernetesResource = { apiVersion: "v1", kind: "ConfigMap", metadata: { @@ -57203,7 +57203,7 @@ export const ConfigMap_KubePrometheusStackScheduler: ConfigMap = { "scheduler.json": "{\"editable\":true,\"links\":[{\"asDropdown\":true,\"includeVars\":true,\"keepTime\":true,\"tags\":[\"kubernetes-mixin\"],\"targetBlank\":false,\"title\":\"Kubernetes\",\"type\":\"dashboards\"}],\"panels\":[{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"unit\":\"none\"}},\"gridPos\":{\"h\":7,\"w\":4,\"x\":0,\"y\":0},\"id\":1,\"interval\":\"1m\",\"options\":{\"colorMode\":\"none\"},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(up{cluster=\\\"$cluster\\\", job=\\\"kube-scheduler\\\"})\",\"instant\":true}],\"title\":\"Up\",\"type\":\"stat\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"ops\"}},\"gridPos\":{\"h\":7,\"w\":10,\"x\":4,\"y\":0},\"id\":2,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(rate(scheduler_e2e_scheduling_duration_seconds_count{cluster=\\\"$cluster\\\", job=\\\"kube-scheduler\\\", instance=~\\\"$instance\\\"}[$__rate_interval])) by (cluster, instance)\",\"legendFormat\":\"{{cluster}} {{instance}} e2e\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(rate(scheduler_binding_duration_seconds_count{cluster=\\\"$cluster\\\", job=\\\"kube-scheduler\\\", instance=~\\\"$instance\\\"}[$__rate_interval])) by (cluster, instance)\",\"legendFormat\":\"{{cluster}} {{instance}} binding\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(rate(scheduler_scheduling_algorithm_duration_seconds_count{cluster=\\\"$cluster\\\", job=\\\"kube-scheduler\\\", instance=~\\\"$instance\\\"}[$__rate_interval])) by (cluster, instance)\",\"legendFormat\":\"{{cluster}} {{instance}} scheduling algorithm\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(rate(scheduler_volume_scheduling_duration_seconds_count{cluster=\\\"$cluster\\\", job=\\\"kube-scheduler\\\", instance=~\\\"$instance\\\"}[$__rate_interval])) by (cluster, instance)\",\"legendFormat\":\"{{cluster}} {{instance}} volume\"}],\"title\":\"Scheduling Rate\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"s\"}},\"gridPos\":{\"h\":7,\"w\":10,\"x\":14,\"y\":0},\"id\":3,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"histogram_quantile(0.99, sum(rate(scheduler_e2e_scheduling_duration_seconds_bucket{cluster=\\\"$cluster\\\", job=\\\"kube-scheduler\\\",instance=~\\\"$instance\\\"}[$__rate_interval])) by (cluster, instance, le))\",\"legendFormat\":\"{{cluster}} {{instance}} e2e\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"histogram_quantile(0.99, sum(rate(scheduler_binding_duration_seconds_bucket{cluster=\\\"$cluster\\\", job=\\\"kube-scheduler\\\",instance=~\\\"$instance\\\"}[$__rate_interval])) by (cluster, instance, le))\",\"legendFormat\":\"{{cluster}} {{instance}} binding\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"histogram_quantile(0.99, sum(rate(scheduler_scheduling_algorithm_duration_seconds_bucket{cluster=\\\"$cluster\\\", job=\\\"kube-scheduler\\\",instance=~\\\"$instance\\\"}[$__rate_interval])) by (cluster, instance, le))\",\"legendFormat\":\"{{cluster}} {{instance}} scheduling algorithm\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"histogram_quantile(0.99, sum(rate(scheduler_volume_scheduling_duration_seconds_bucket{cluster=\\\"$cluster\\\", job=\\\"kube-scheduler\\\",instance=~\\\"$instance\\\"}[$__rate_interval])) by (cluster, instance, le))\",\"legendFormat\":\"{{cluster}} {{instance}} volume\"}],\"title\":\"Scheduling latency 99th Quantile\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"ops\"}},\"gridPos\":{\"h\":7,\"w\":8,\"x\":0,\"y\":7},\"id\":4,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(rate(rest_client_requests_total{cluster=\\\"$cluster\\\", job=\\\"kube-scheduler\\\", instance=~\\\"$instance\\\",code=~\\\"2..\\\"}[$__rate_interval]))\",\"legendFormat\":\"2xx\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(rate(rest_client_requests_total{cluster=\\\"$cluster\\\", job=\\\"kube-scheduler\\\", instance=~\\\"$instance\\\",code=~\\\"3..\\\"}[$__rate_interval]))\",\"legendFormat\":\"3xx\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(rate(rest_client_requests_total{cluster=\\\"$cluster\\\", job=\\\"kube-scheduler\\\", instance=~\\\"$instance\\\",code=~\\\"4..\\\"}[$__rate_interval]))\",\"legendFormat\":\"4xx\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sum(rate(rest_client_requests_total{cluster=\\\"$cluster\\\", job=\\\"kube-scheduler\\\", instance=~\\\"$instance\\\",code=~\\\"5..\\\"}[$__rate_interval]))\",\"legendFormat\":\"5xx\"}],\"title\":\"Kube API Request Rate\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"ops\"}},\"gridPos\":{\"h\":7,\"w\":16,\"x\":8,\"y\":7},\"id\":5,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"histogram_quantile(0.99, sum(rate(rest_client_request_duration_seconds_bucket{cluster=\\\"$cluster\\\", job=\\\"kube-scheduler\\\", instance=~\\\"$instance\\\", verb=\\\"POST\\\"}[$__rate_interval])) by (verb, le))\",\"legendFormat\":\"{{verb}}\"}],\"title\":\"Post Request Latency 99th Quantile\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"s\"}},\"gridPos\":{\"h\":7,\"w\":24,\"x\":0,\"y\":14},\"id\":6,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"histogram_quantile(0.99, sum(rate(rest_client_request_duration_seconds_bucket{cluster=\\\"$cluster\\\", job=\\\"kube-scheduler\\\", instance=~\\\"$instance\\\", verb=\\\"GET\\\"}[$__rate_interval])) by (verb, le))\",\"legendFormat\":\"{{verb}}\"}],\"title\":\"Get Request Latency 99th Quantile\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"bytes\"}},\"gridPos\":{\"h\":7,\"w\":8,\"x\":0,\"y\":21},\"id\":7,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"process_resident_memory_bytes{cluster=\\\"$cluster\\\", job=\\\"kube-scheduler\\\", instance=~\\\"$instance\\\"}\",\"legendFormat\":\"{{instance}}\"}],\"title\":\"Memory\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"short\"}},\"gridPos\":{\"h\":7,\"w\":8,\"x\":8,\"y\":21},\"id\":8,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"rate(process_cpu_seconds_total{cluster=\\\"$cluster\\\", job=\\\"kube-scheduler\\\", instance=~\\\"$instance\\\"}[$__rate_interval])\",\"legendFormat\":\"{{instance}}\"}],\"title\":\"CPU usage\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"short\"}},\"gridPos\":{\"h\":7,\"w\":8,\"x\":16,\"y\":21},\"id\":9,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"go_goroutines{cluster=\\\"$cluster\\\", job=\\\"kube-scheduler\\\",instance=~\\\"$instance\\\"}\",\"legendFormat\":\"{{instance}}\"}],\"title\":\"Goroutines\",\"type\":\"timeseries\"}],\"refresh\":\"10s\",\"schemaVersion\":39,\"tags\":[\"kubernetes-mixin\"],\"templating\":{\"list\":[{\"current\":{\"selected\":true,\"text\":\"default\",\"value\":\"default\"},\"hide\":0,\"label\":\"Data source\",\"name\":\"datasource\",\"query\":\"prometheus\",\"regex\":\"\",\"type\":\"datasource\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"hide\":2,\"label\":\"cluster\",\"name\":\"cluster\",\"query\":\"label_values(up{job=\\\"kube-scheduler\\\"}, cluster)\",\"refresh\":2,\"sort\":1,\"type\":\"query\",\"allValue\":\".*\"},{\"allValue\":\".+\",\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"hide\":0,\"includeAll\":true,\"label\":\"instance\",\"name\":\"instance\",\"query\":\"label_values(up{job=\\\"kube-scheduler\\\", cluster=\\\"$cluster\\\"}, instance)\",\"refresh\":2,\"type\":\"query\"}]},\"time\":{\"from\":\"now-1h\",\"to\":\"now\"},\"timezone\": \"utc\",\"title\":\"Kubernetes / Scheduler\",\"uid\":\"2e6b6a3b4bddf1427b3a55aa1311c656\"}" } }; -export const ConfigMap_KubePrometheusStackWorkloadTotal: ConfigMap = { +export const ConfigMap_KubePrometheusStackWorkloadTotal: KubernetesResource = { apiVersion: "v1", kind: "ConfigMap", metadata: { @@ -57226,7 +57226,7 @@ export const ConfigMap_KubePrometheusStackWorkloadTotal: ConfigMap = { "workload-total.json": "{\"editable\":true,\"links\":[{\"asDropdown\":true,\"includeVars\":true,\"keepTime\":true,\"tags\":[\"kubernetes-mixin\"],\"targetBlank\":false,\"title\":\"Kubernetes\",\"type\":\"dashboards\"}],\"panels\":[{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"color\":{\"fixedColor\":\"green\",\"mode\":\"fixed\"},\"unit\":\"Bps\"}},\"gridPos\":{\"h\":9,\"w\":12,\"x\":0,\"y\":0},\"id\":1,\"interval\":\"1m\",\"options\":{\"displayMode\":\"basic\",\"showUnfilled\":false},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sort_desc(sum(rate(container_network_receive_bytes_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\",namespace=~\\\"$namespace\\\"}[$__rate_interval])\\n* on (namespace,pod)\\ngroup_left(workload,workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\",namespace=~\\\"$namespace\\\", workload=~\\\"$workload\\\", workload_type=~\\\"$type\\\"}) by (pod))\\n\",\"legendFormat\":\"__auto\"}],\"title\":\"Current Rate of Bytes Received\",\"type\":\"bargauge\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"color\":{\"fixedColor\":\"green\",\"mode\":\"fixed\"},\"unit\":\"Bps\"}},\"gridPos\":{\"h\":9,\"w\":12,\"x\":12,\"y\":0},\"id\":2,\"interval\":\"1m\",\"options\":{\"displayMode\":\"basic\",\"showUnfilled\":false},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sort_desc(sum(rate(container_network_transmit_bytes_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\",namespace=~\\\"$namespace\\\"}[$__rate_interval])\\n* on (namespace,pod)\\ngroup_left(workload,workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\",namespace=~\\\"$namespace\\\", workload=~\\\"$workload\\\", workload_type=~\\\"$type\\\"}) by (pod))\\n\",\"legendFormat\":\"__auto\"}],\"title\":\"Current Rate of Bytes Transmitted\",\"type\":\"bargauge\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"color\":{\"fixedColor\":\"green\",\"mode\":\"fixed\"},\"unit\":\"Bps\"}},\"gridPos\":{\"h\":9,\"w\":12,\"x\":0,\"y\":9},\"id\":3,\"interval\":\"1m\",\"options\":{\"displayMode\":\"basic\",\"showUnfilled\":false},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sort_desc(avg(rate(container_network_receive_bytes_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\",namespace=~\\\"$namespace\\\"}[$__rate_interval])\\n* on (namespace,pod)\\ngroup_left(workload,workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\",namespace=~\\\"$namespace\\\", workload=~\\\"$workload\\\", workload_type=~\\\"$type\\\"}) by (pod))\\n\",\"legendFormat\":\"__auto\"}],\"title\":\"Average Rate of Bytes Received\",\"type\":\"bargauge\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"color\":{\"fixedColor\":\"green\",\"mode\":\"fixed\"},\"unit\":\"Bps\"}},\"gridPos\":{\"h\":9,\"w\":12,\"x\":12,\"y\":9},\"id\":4,\"interval\":\"1m\",\"options\":{\"displayMode\":\"basic\",\"showUnfilled\":false},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sort_desc(avg(rate(container_network_transmit_bytes_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\",namespace=~\\\"$namespace\\\"}[$__rate_interval])\\n* on (namespace,pod)\\ngroup_left(workload,workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\",namespace=~\\\"$namespace\\\", workload=~\\\"$workload\\\", workload_type=~\\\"$type\\\"}) by (pod))\\n\",\"legendFormat\":\"__auto\"}],\"title\":\"Average Rate of Bytes Transmitted\",\"type\":\"bargauge\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"binBps\"}},\"gridPos\":{\"h\":9,\"w\":12,\"x\":0,\"y\":18},\"id\":5,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sort_desc(sum(rate(container_network_receive_bytes_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\",namespace=~\\\"$namespace\\\"}[$__rate_interval])\\n* on (namespace,pod)\\ngroup_left(workload,workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\",namespace=~\\\"$namespace\\\", workload=~\\\"$workload\\\", workload_type=~\\\"$type\\\"}) by (pod))\\n\",\"legendFormat\":\"__auto\"}],\"title\":\"Receive Bandwidth\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"binBps\"}},\"gridPos\":{\"h\":9,\"w\":12,\"x\":12,\"y\":18},\"id\":6,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sort_desc(sum(rate(container_network_transmit_bytes_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\",namespace=~\\\"$namespace\\\"}[$__rate_interval])\\n* on (namespace,pod)\\ngroup_left(workload,workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\",namespace=~\\\"$namespace\\\", workload=~\\\"$workload\\\", workload_type=~\\\"$type\\\"}) by (pod))\\n\",\"legendFormat\":\"__auto\"}],\"title\":\"Transmit Bandwidth\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"pps\"}},\"gridPos\":{\"h\":9,\"w\":12,\"x\":0,\"y\":27},\"id\":7,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sort_desc(sum(rate(container_network_receive_packets_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\",namespace=~\\\"$namespace\\\"}[$__rate_interval])\\n* on (namespace,pod)\\ngroup_left(workload,workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\",namespace=~\\\"$namespace\\\", workload=~\\\"$workload\\\", workload_type=~\\\"$type\\\"}) by (pod))\\n\",\"legendFormat\":\"__auto\"}],\"title\":\"Rate of Received Packets\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"pps\"}},\"gridPos\":{\"h\":9,\"w\":12,\"x\":12,\"y\":27},\"id\":8,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sort_desc(sum(rate(container_network_transmit_packets_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\",namespace=~\\\"$namespace\\\"}[$__rate_interval])\\n* on (namespace,pod)\\ngroup_left(workload,workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\",namespace=~\\\"$namespace\\\", workload=~\\\"$workload\\\", workload_type=~\\\"$type\\\"}) by (pod))\\n\",\"legendFormat\":\"__auto\"}],\"title\":\"Rate of Transmitted Packets\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"pps\"}},\"gridPos\":{\"h\":9,\"w\":12,\"x\":0,\"y\":36},\"id\":9,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sort_desc(sum(rate(container_network_receive_packets_dropped_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\",namespace=~\\\"$namespace\\\"}[$__rate_interval])\\n* on (namespace,pod)\\ngroup_left(workload,workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\",namespace=~\\\"$namespace\\\", workload=~\\\"$workload\\\", workload_type=~\\\"$type\\\"}) by (pod))\\n\",\"legendFormat\":\"__auto\"}],\"title\":\"Rate of Received Packets Dropped\",\"type\":\"timeseries\"},{\"datasource\":{\"type\":\"datasource\",\"uid\":\"-- Mixed --\"},\"fieldConfig\":{\"defaults\":{\"custom\":{\"fillOpacity\":10,\"showPoints\":\"never\",\"spanNulls\":true},\"unit\":\"pps\"}},\"gridPos\":{\"h\":9,\"w\":12,\"x\":12,\"y\":36},\"id\":10,\"interval\":\"1m\",\"options\":{\"legend\":{\"asTable\":true,\"calcs\":[\"lastNotNull\"],\"displayMode\":\"table\",\"placement\":\"right\",\"showLegend\":true},\"tooltip\":{\"mode\":\"single\"}},\"pluginVersion\":\"v11.4.0\",\"targets\":[{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"expr\":\"sort_desc(sum(rate(container_network_transmit_packets_dropped_total{job=\\\"kubelet\\\", metrics_path=\\\"/metrics/cadvisor\\\", cluster=\\\"$cluster\\\",namespace=~\\\"$namespace\\\"}[$__rate_interval])\\n* on (namespace,pod)\\ngroup_left(workload,workload_type) namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\",namespace=~\\\"$namespace\\\", workload=~\\\"$workload\\\", workload_type=~\\\"$type\\\"}) by (pod))\\n\",\"legendFormat\":\"__auto\"}],\"title\":\"Rate of Transmitted Packets Dropped\",\"type\":\"timeseries\"}],\"refresh\":\"10s\",\"schemaVersion\":39,\"tags\":[\"kubernetes-mixin\"],\"templating\":{\"list\":[{\"current\":{\"selected\":true,\"text\":\"default\",\"value\":\"default\"},\"hide\":0,\"label\":\"Data source\",\"name\":\"datasource\",\"query\":\"prometheus\",\"regex\":\"\",\"type\":\"datasource\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"hide\":2,\"label\":\"cluster\",\"name\":\"cluster\",\"query\":\"label_values(kube_pod_info{job=\\\"kube-state-metrics\\\"}, cluster)\",\"refresh\":2,\"sort\":1,\"type\":\"query\",\"allValue\":\".*\"},{\"allValue\":\".+\",\"current\":{\"selected\":false,\"text\":\"kube-system\",\"value\":\"kube-system\"},\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"hide\":0,\"includeAll\":true,\"label\":\"namespace\",\"name\":\"namespace\",\"query\":\"label_values(container_network_receive_packets_total{cluster=\\\"$cluster\\\"}, namespace)\",\"refresh\":2,\"sort\":1,\"type\":\"query\"},{\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"hide\":0,\"label\":\"workload\",\"name\":\"workload\",\"query\":\"label_values(namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\", namespace=~\\\"$namespace\\\", workload=~\\\".+\\\"}, workload)\",\"refresh\":2,\"sort\":1,\"type\":\"query\"},{\"allValue\":\".+\",\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"hide\":0,\"includeAll\":true,\"label\":\"workload_type\",\"name\":\"type\",\"query\":\"label_values(namespace_workload_pod:kube_pod_owner:relabel{cluster=\\\"$cluster\\\", namespace=~\\\"$namespace\\\", workload=~\\\"$workload\\\"}, workload_type)\",\"refresh\":2,\"sort\":1,\"type\":\"query\"}]},\"time\":{\"from\":\"now-1h\",\"to\":\"now\"},\"timezone\": \"utc\",\"title\":\"Kubernetes / Networking / Workload\",\"uid\":\"728bf77cc1166d2f3133bf25846876cc\"}" } }; -export const PersistentVolumeClaim_KubePrometheusStackGrafana: PersistentVolumeClaim = { +export const PersistentVolumeClaim_KubePrometheusStackGrafana: KubernetesResource = { apiVersion: "v1", kind: "PersistentVolumeClaim", metadata: { @@ -57249,7 +57249,7 @@ export const PersistentVolumeClaim_KubePrometheusStackGrafana: PersistentVolumeC } } }; -export const ClusterRole_KubePrometheusStackGrafanaClusterrole: RbacAuthorizationK8sIoV1ClusterRole = { +export const ClusterRole_KubePrometheusStackGrafanaClusterrole: KubernetesResource = { apiVersion: "rbac.authorization.k8s.io/v1", kind: "ClusterRole", metadata: { @@ -57267,7 +57267,7 @@ export const ClusterRole_KubePrometheusStackGrafanaClusterrole: RbacAuthorizatio verbs: ["get", "watch", "list"] }] }; -export const ClusterRole_KubePrometheusStackKubeStateMetrics: RbacAuthorizationK8sIoV1ClusterRole = { +export const ClusterRole_KubePrometheusStackKubeStateMetrics: KubernetesResource = { apiVersion: "rbac.authorization.k8s.io/v1", kind: "ClusterRole", metadata: { @@ -57397,7 +57397,7 @@ export const ClusterRole_KubePrometheusStackKubeStateMetrics: RbacAuthorizationK verbs: ["list", "watch"] }] }; -export const ClusterRole_KubePrometheusStackOperator: RbacAuthorizationK8sIoV1ClusterRole = { +export const ClusterRole_KubePrometheusStackOperator: KubernetesResource = { apiVersion: "rbac.authorization.k8s.io/v1", kind: "ClusterRole", metadata: { @@ -57457,7 +57457,7 @@ export const ClusterRole_KubePrometheusStackOperator: RbacAuthorizationK8sIoV1Cl verbs: ["get"] }] }; -export const ClusterRole_KubePrometheusStackPrometheus: RbacAuthorizationK8sIoV1ClusterRole = { +export const ClusterRole_KubePrometheusStackPrometheus: KubernetesResource = { apiVersion: "rbac.authorization.k8s.io/v1", kind: "ClusterRole", metadata: { @@ -57490,7 +57490,7 @@ export const ClusterRole_KubePrometheusStackPrometheus: RbacAuthorizationK8sIoV1 verbs: ["get"] }] }; -export const ClusterRoleBinding_KubePrometheusStackGrafanaClusterrolebinding: RbacAuthorizationK8sIoV1ClusterRoleBinding = { +export const ClusterRoleBinding_KubePrometheusStackGrafanaClusterrolebinding: KubernetesResource = { apiVersion: "rbac.authorization.k8s.io/v1", kind: "ClusterRoleBinding", metadata: { @@ -57513,7 +57513,7 @@ export const ClusterRoleBinding_KubePrometheusStackGrafanaClusterrolebinding: Rb namespace: "monitoring" }] }; -export const ClusterRoleBinding_KubePrometheusStackKubeStateMetrics: RbacAuthorizationK8sIoV1ClusterRoleBinding = { +export const ClusterRoleBinding_KubePrometheusStackKubeStateMetrics: KubernetesResource = { apiVersion: "rbac.authorization.k8s.io/v1", kind: "ClusterRoleBinding", metadata: { @@ -57540,7 +57540,7 @@ export const ClusterRoleBinding_KubePrometheusStackKubeStateMetrics: RbacAuthori namespace: "monitoring" }] }; -export const ClusterRoleBinding_KubePrometheusStackOperator: RbacAuthorizationK8sIoV1ClusterRoleBinding = { +export const ClusterRoleBinding_KubePrometheusStackOperator: KubernetesResource = { apiVersion: "rbac.authorization.k8s.io/v1", kind: "ClusterRoleBinding", metadata: { @@ -57569,7 +57569,7 @@ export const ClusterRoleBinding_KubePrometheusStackOperator: RbacAuthorizationK8 namespace: "monitoring" }] }; -export const ClusterRoleBinding_KubePrometheusStackPrometheus: RbacAuthorizationK8sIoV1ClusterRoleBinding = { +export const ClusterRoleBinding_KubePrometheusStackPrometheus: KubernetesResource = { apiVersion: "rbac.authorization.k8s.io/v1", kind: "ClusterRoleBinding", metadata: { @@ -57596,7 +57596,7 @@ export const ClusterRoleBinding_KubePrometheusStackPrometheus: RbacAuthorization namespace: "monitoring" }] }; -export const Role_KubePrometheusStackGrafana: RbacAuthorizationK8sIoV1Role = { +export const Role_KubePrometheusStackGrafana: KubernetesResource = { apiVersion: "rbac.authorization.k8s.io/v1", kind: "Role", metadata: { @@ -57611,7 +57611,7 @@ export const Role_KubePrometheusStackGrafana: RbacAuthorizationK8sIoV1Role = { }, rules: [] }; -export const RoleBinding_KubePrometheusStackGrafana: RbacAuthorizationK8sIoV1RoleBinding = { +export const RoleBinding_KubePrometheusStackGrafana: KubernetesResource = { apiVersion: "rbac.authorization.k8s.io/v1", kind: "RoleBinding", metadata: { @@ -57635,7 +57635,7 @@ export const RoleBinding_KubePrometheusStackGrafana: RbacAuthorizationK8sIoV1Rol namespace: "monitoring" }] }; -export const Service_KubePrometheusStackGrafana: Service = { +export const Service_KubePrometheusStackGrafana: KubernetesResource = { apiVersion: "v1", kind: "Service", metadata: { @@ -57662,7 +57662,7 @@ export const Service_KubePrometheusStackGrafana: Service = { type: "ClusterIP" } }; -export const Service_KubePrometheusStackKubeStateMetrics: Service = { +export const Service_KubePrometheusStackKubeStateMetrics: KubernetesResource = { apiVersion: "v1", kind: "Service", metadata: { @@ -57694,7 +57694,7 @@ export const Service_KubePrometheusStackKubeStateMetrics: Service = { type: "ClusterIP" } }; -export const Service_KubePrometheusStackPrometheusNodeExporter: Service = { +export const Service_KubePrometheusStackPrometheusNodeExporter: KubernetesResource = { apiVersion: "v1", kind: "Service", metadata: { @@ -57729,7 +57729,7 @@ export const Service_KubePrometheusStackPrometheusNodeExporter: Service = { type: "ClusterIP" } }; -export const Service_KubePrometheusStackAlertmanager: Service = { +export const Service_KubePrometheusStackAlertmanager: KubernetesResource = { apiVersion: "v1", kind: "Service", metadata: { @@ -57767,7 +57767,7 @@ export const Service_KubePrometheusStackAlertmanager: Service = { type: "ClusterIP" } }; -export const Service_KubePrometheusStackCoredns: Service = { +export const Service_KubePrometheusStackCoredns: KubernetesResource = { apiVersion: "v1", kind: "Service", metadata: { @@ -57798,7 +57798,7 @@ export const Service_KubePrometheusStackCoredns: Service = { } } }; -export const Service_KubePrometheusStackKubeControllerManager: Service = { +export const Service_KubePrometheusStackKubeControllerManager: KubernetesResource = { apiVersion: "v1", kind: "Service", metadata: { @@ -57830,7 +57830,7 @@ export const Service_KubePrometheusStackKubeControllerManager: Service = { type: "ClusterIP" } }; -export const Service_KubePrometheusStackKubeEtcd: Service = { +export const Service_KubePrometheusStackKubeEtcd: KubernetesResource = { apiVersion: "v1", kind: "Service", metadata: { @@ -57862,7 +57862,7 @@ export const Service_KubePrometheusStackKubeEtcd: Service = { type: "ClusterIP" } }; -export const Service_KubePrometheusStackKubeProxy: Service = { +export const Service_KubePrometheusStackKubeProxy: KubernetesResource = { apiVersion: "v1", kind: "Service", metadata: { @@ -57894,7 +57894,7 @@ export const Service_KubePrometheusStackKubeProxy: Service = { type: "ClusterIP" } }; -export const Service_KubePrometheusStackKubeScheduler: Service = { +export const Service_KubePrometheusStackKubeScheduler: KubernetesResource = { apiVersion: "v1", kind: "Service", metadata: { @@ -57926,7 +57926,7 @@ export const Service_KubePrometheusStackKubeScheduler: Service = { type: "ClusterIP" } }; -export const Service_KubePrometheusStackOperator: Service = { +export const Service_KubePrometheusStackOperator: KubernetesResource = { apiVersion: "v1", kind: "Service", metadata: { @@ -57958,7 +57958,7 @@ export const Service_KubePrometheusStackOperator: Service = { type: "ClusterIP" } }; -export const Service_KubePrometheusStackPrometheus: Service = { +export const Service_KubePrometheusStackPrometheus: KubernetesResource = { apiVersion: "v1", kind: "Service", metadata: { @@ -57996,7 +57996,7 @@ export const Service_KubePrometheusStackPrometheus: Service = { type: "ClusterIP" } }; -export const DaemonSet_KubePrometheusStackPrometheusNodeExporter: AppsV1DaemonSet = { +export const DaemonSet_KubePrometheusStackPrometheusNodeExporter: KubernetesResource = { apiVersion: "apps/v1", kind: "DaemonSet", metadata: { @@ -58158,7 +58158,7 @@ export const DaemonSet_KubePrometheusStackPrometheusNodeExporter: AppsV1DaemonSe } } }; -export const Deployment_KubePrometheusStackGrafana: AppsV1Deployment = { +export const Deployment_KubePrometheusStackGrafana: KubernetesResource = { apiVersion: "apps/v1", kind: "Deployment", metadata: { @@ -58470,7 +58470,7 @@ export const Deployment_KubePrometheusStackGrafana: AppsV1Deployment = { } } }; -export const Deployment_KubePrometheusStackKubeStateMetrics: AppsV1Deployment = { +export const Deployment_KubePrometheusStackKubeStateMetrics: KubernetesResource = { apiVersion: "apps/v1", kind: "Deployment", metadata: { @@ -58574,7 +58574,7 @@ export const Deployment_KubePrometheusStackKubeStateMetrics: AppsV1Deployment = } } }; -export const Deployment_KubePrometheusStackOperator: AppsV1Deployment = { +export const Deployment_KubePrometheusStackOperator: KubernetesResource = { apiVersion: "apps/v1", kind: "Deployment", metadata: { @@ -58692,7 +58692,87 @@ export const Deployment_KubePrometheusStackOperator: AppsV1Deployment = { } } }; -export const Alertmanager_KubePrometheusStackAlertmanager: MonitoringCoreosComV1Alertmanager = { +export const MutatingWebhookConfiguration_KubePrometheusStackAdmission: KubernetesResource = { + apiVersion: "admissionregistration.k8s.io/v1", + kind: "MutatingWebhookConfiguration", + metadata: { + annotations: null, + labels: { + app: "kube-prometheus-stack-admission", + "app.kubernetes.io/component": "prometheus-operator-webhook", + "app.kubernetes.io/instance": "kube-prometheus-stack", + "app.kubernetes.io/managed-by": "Helm", + "app.kubernetes.io/name": "kube-prometheus-stack-prometheus-operator", + "app.kubernetes.io/part-of": "kube-prometheus-stack", + "app.kubernetes.io/version": "77.5.0", + chart: "kube-prometheus-stack-77.5.0", + heritage: "Helm", + release: "kube-prometheus-stack" + }, + name: "kube-prometheus-stack-admission" + }, + webhooks: [{ + admissionReviewVersions: ["v1", "v1beta1"], + clientConfig: { + service: { + name: "kube-prometheus-stack-operator", + namespace: "monitoring", + path: "/admission-prometheusrules/mutate" + } + }, + failurePolicy: "Ignore", + name: "prometheusrulemutate.monitoring.coreos.com", + rules: [{ + apiGroups: ["monitoring.coreos.com"], + apiVersions: ["*"], + operations: ["CREATE", "UPDATE"], + resources: ["prometheusrules"] + }], + sideEffects: "None", + timeoutSeconds: 10 + }] +}; +export const ValidatingWebhookConfiguration_KubePrometheusStackAdmission: KubernetesResource = { + apiVersion: "admissionregistration.k8s.io/v1", + kind: "ValidatingWebhookConfiguration", + metadata: { + annotations: null, + labels: { + app: "kube-prometheus-stack-admission", + "app.kubernetes.io/component": "prometheus-operator-webhook", + "app.kubernetes.io/instance": "kube-prometheus-stack", + "app.kubernetes.io/managed-by": "Helm", + "app.kubernetes.io/name": "kube-prometheus-stack-prometheus-operator", + "app.kubernetes.io/part-of": "kube-prometheus-stack", + "app.kubernetes.io/version": "77.5.0", + chart: "kube-prometheus-stack-77.5.0", + heritage: "Helm", + release: "kube-prometheus-stack" + }, + name: "kube-prometheus-stack-admission" + }, + webhooks: [{ + admissionReviewVersions: ["v1", "v1beta1"], + clientConfig: { + service: { + name: "kube-prometheus-stack-operator", + namespace: "monitoring", + path: "/admission-prometheusrules/validate" + } + }, + failurePolicy: "Ignore", + name: "prometheusrulemutate.monitoring.coreos.com", + rules: [{ + apiGroups: ["monitoring.coreos.com"], + apiVersions: ["*"], + operations: ["CREATE", "UPDATE"], + resources: ["prometheusrules"] + }], + sideEffects: "None", + timeoutSeconds: 10 + }] +}; +export const Alertmanager_KubePrometheusStackAlertmanager: KubernetesResource = { apiVersion: "monitoring.coreos.com/v1", kind: "Alertmanager", metadata: { @@ -58758,47 +58838,7 @@ export const Alertmanager_KubePrometheusStackAlertmanager: MonitoringCoreosComV1 version: "v0.28.1" } }; -export const MutatingWebhookConfiguration_KubePrometheusStackAdmission: AdmissionregistrationK8sIoV1MutatingWebhookConfiguration = { - apiVersion: "admissionregistration.k8s.io/v1", - kind: "MutatingWebhookConfiguration", - metadata: { - annotations: null, - labels: { - app: "kube-prometheus-stack-admission", - "app.kubernetes.io/component": "prometheus-operator-webhook", - "app.kubernetes.io/instance": "kube-prometheus-stack", - "app.kubernetes.io/managed-by": "Helm", - "app.kubernetes.io/name": "kube-prometheus-stack-prometheus-operator", - "app.kubernetes.io/part-of": "kube-prometheus-stack", - "app.kubernetes.io/version": "77.5.0", - chart: "kube-prometheus-stack-77.5.0", - heritage: "Helm", - release: "kube-prometheus-stack" - }, - name: "kube-prometheus-stack-admission" - }, - webhooks: [{ - admissionReviewVersions: ["v1", "v1beta1"], - clientConfig: { - service: { - name: "kube-prometheus-stack-operator", - namespace: "monitoring", - path: "/admission-prometheusrules/mutate" - } - }, - failurePolicy: "Ignore", - name: "prometheusrulemutate.monitoring.coreos.com", - rules: [{ - apiGroups: ["monitoring.coreos.com"], - apiVersions: ["*"], - operations: ["CREATE", "UPDATE"], - resources: ["prometheusrules"] - }], - sideEffects: "None", - timeoutSeconds: 10 - }] -}; -export const Prometheus_KubePrometheusStackPrometheus: MonitoringCoreosComV1Prometheus = { +export const Prometheus_KubePrometheusStackPrometheus: KubernetesResource = { apiVersion: "monitoring.coreos.com/v1", kind: "Prometheus", metadata: { @@ -58920,7 +58960,7 @@ export const Prometheus_KubePrometheusStackPrometheus: MonitoringCoreosComV1Prom walCompression: true } }; -export const PrometheusRule_KubePrometheusStackAlertmanagerRules: MonitoringCoreosComV1PrometheusRule = { +export const PrometheusRule_KubePrometheusStackAlertmanagerRules: KubernetesResource = { apiVersion: "monitoring.coreos.com/v1", kind: "PrometheusRule", metadata: { @@ -59040,7 +59080,7 @@ export const PrometheusRule_KubePrometheusStackAlertmanagerRules: MonitoringCore }] } }; -export const PrometheusRule_KubePrometheusStackConfigReloaders: MonitoringCoreosComV1PrometheusRule = { +export const PrometheusRule_KubePrometheusStackConfigReloaders: KubernetesResource = { apiVersion: "monitoring.coreos.com/v1", kind: "PrometheusRule", metadata: { @@ -59076,7 +59116,7 @@ export const PrometheusRule_KubePrometheusStackConfigReloaders: MonitoringCoreos }] } }; -export const PrometheusRule_KubePrometheusStackEtcd: MonitoringCoreosComV1PrometheusRule = { +export const PrometheusRule_KubePrometheusStackEtcd: KubernetesResource = { apiVersion: "monitoring.coreos.com/v1", kind: "PrometheusRule", metadata: { @@ -59266,7 +59306,7 @@ export const PrometheusRule_KubePrometheusStackEtcd: MonitoringCoreosComV1Promet }] } }; -export const PrometheusRule_KubePrometheusStackGeneralRules: MonitoringCoreosComV1PrometheusRule = { +export const PrometheusRule_KubePrometheusStackGeneralRules: KubernetesResource = { apiVersion: "monitoring.coreos.com/v1", kind: "PrometheusRule", metadata: { @@ -59324,7 +59364,7 @@ export const PrometheusRule_KubePrometheusStackGeneralRules: MonitoringCoreosCom }] } }; -export const PrometheusRule_KubePrometheusStackK8sRulesContainerCpuUsageSecondsTot: MonitoringCoreosComV1PrometheusRule = { +export const PrometheusRule_KubePrometheusStackK8sRulesContainerCpuUsageSecondsTot: KubernetesResource = { apiVersion: "monitoring.coreos.com/v1", kind: "PrometheusRule", metadata: { @@ -59354,7 +59394,7 @@ export const PrometheusRule_KubePrometheusStackK8sRulesContainerCpuUsageSecondsT }] } }; -export const PrometheusRule_KubePrometheusStackK8sRulesContainerMemoryCache: MonitoringCoreosComV1PrometheusRule = { +export const PrometheusRule_KubePrometheusStackK8sRulesContainerMemoryCache: KubernetesResource = { apiVersion: "monitoring.coreos.com/v1", kind: "PrometheusRule", metadata: { @@ -59381,7 +59421,7 @@ export const PrometheusRule_KubePrometheusStackK8sRulesContainerMemoryCache: Mon }] } }; -export const PrometheusRule_KubePrometheusStackK8sRulesContainerMemoryRss: MonitoringCoreosComV1PrometheusRule = { +export const PrometheusRule_KubePrometheusStackK8sRulesContainerMemoryRss: KubernetesResource = { apiVersion: "monitoring.coreos.com/v1", kind: "PrometheusRule", metadata: { @@ -59408,7 +59448,7 @@ export const PrometheusRule_KubePrometheusStackK8sRulesContainerMemoryRss: Monit }] } }; -export const PrometheusRule_KubePrometheusStackK8sRulesContainerMemorySwap: MonitoringCoreosComV1PrometheusRule = { +export const PrometheusRule_KubePrometheusStackK8sRulesContainerMemorySwap: KubernetesResource = { apiVersion: "monitoring.coreos.com/v1", kind: "PrometheusRule", metadata: { @@ -59435,7 +59475,7 @@ export const PrometheusRule_KubePrometheusStackK8sRulesContainerMemorySwap: Moni }] } }; -export const PrometheusRule_KubePrometheusStackK8sRulesContainerMemoryWorkingSetBy: MonitoringCoreosComV1PrometheusRule = { +export const PrometheusRule_KubePrometheusStackK8sRulesContainerMemoryWorkingSetBy: KubernetesResource = { apiVersion: "monitoring.coreos.com/v1", kind: "PrometheusRule", metadata: { @@ -59462,7 +59502,7 @@ export const PrometheusRule_KubePrometheusStackK8sRulesContainerMemoryWorkingSet }] } }; -export const PrometheusRule_KubePrometheusStackK8sRulesContainerResource: MonitoringCoreosComV1PrometheusRule = { +export const PrometheusRule_KubePrometheusStackK8sRulesContainerResource: KubernetesResource = { apiVersion: "monitoring.coreos.com/v1", kind: "PrometheusRule", metadata: { @@ -59510,7 +59550,7 @@ export const PrometheusRule_KubePrometheusStackK8sRulesContainerResource: Monito }] } }; -export const PrometheusRule_KubePrometheusStackK8sRulesPodOwner: MonitoringCoreosComV1PrometheusRule = { +export const PrometheusRule_KubePrometheusStackK8sRulesPodOwner: KubernetesResource = { apiVersion: "monitoring.coreos.com/v1", kind: "PrometheusRule", metadata: { @@ -59579,7 +59619,7 @@ export const PrometheusRule_KubePrometheusStackK8sRulesPodOwner: MonitoringCoreo }] } }; -export const PrometheusRule_KubePrometheusStackKubeApiserverAvailabilityRules: MonitoringCoreosComV1PrometheusRule = { +export const PrometheusRule_KubePrometheusStackKubeApiserverAvailabilityRules: KubernetesResource = { apiVersion: "monitoring.coreos.com/v1", kind: "PrometheusRule", metadata: { @@ -59673,7 +59713,7 @@ export const PrometheusRule_KubePrometheusStackKubeApiserverAvailabilityRules: M }] } }; -export const PrometheusRule_KubePrometheusStackKubeApiserverBurnrateRules: MonitoringCoreosComV1PrometheusRule = { +export const PrometheusRule_KubePrometheusStackKubeApiserverBurnrateRules: KubernetesResource = { apiVersion: "monitoring.coreos.com/v1", kind: "PrometheusRule", metadata: { @@ -59781,7 +59821,7 @@ export const PrometheusRule_KubePrometheusStackKubeApiserverBurnrateRules: Monit }] } }; -export const PrometheusRule_KubePrometheusStackKubeApiserverHistogramRules: MonitoringCoreosComV1PrometheusRule = { +export const PrometheusRule_KubePrometheusStackKubeApiserverHistogramRules: KubernetesResource = { apiVersion: "monitoring.coreos.com/v1", kind: "PrometheusRule", metadata: { @@ -59819,7 +59859,7 @@ export const PrometheusRule_KubePrometheusStackKubeApiserverHistogramRules: Moni }] } }; -export const PrometheusRule_KubePrometheusStackKubeApiserverSlos: MonitoringCoreosComV1PrometheusRule = { +export const PrometheusRule_KubePrometheusStackKubeApiserverSlos: KubernetesResource = { apiVersion: "monitoring.coreos.com/v1", kind: "PrometheusRule", metadata: { @@ -59899,7 +59939,7 @@ export const PrometheusRule_KubePrometheusStackKubeApiserverSlos: MonitoringCore }] } }; -export const PrometheusRule_KubePrometheusStackKubePrometheusGeneralRules: MonitoringCoreosComV1PrometheusRule = { +export const PrometheusRule_KubePrometheusStackKubePrometheusGeneralRules: KubernetesResource = { apiVersion: "monitoring.coreos.com/v1", kind: "PrometheusRule", metadata: { @@ -59929,7 +59969,7 @@ export const PrometheusRule_KubePrometheusStackKubePrometheusGeneralRules: Monit }] } }; -export const PrometheusRule_KubePrometheusStackKubePrometheusNodeRecordingRules: MonitoringCoreosComV1PrometheusRule = { +export const PrometheusRule_KubePrometheusStackKubePrometheusNodeRecordingRules: KubernetesResource = { apiVersion: "monitoring.coreos.com/v1", kind: "PrometheusRule", metadata: { @@ -59971,7 +60011,7 @@ export const PrometheusRule_KubePrometheusStackKubePrometheusNodeRecordingRules: }] } }; -export const PrometheusRule_KubePrometheusStackKubeSchedulerRules: MonitoringCoreosComV1PrometheusRule = { +export const PrometheusRule_KubePrometheusStackKubeSchedulerRules: KubernetesResource = { apiVersion: "monitoring.coreos.com/v1", kind: "PrometheusRule", metadata: { @@ -60049,7 +60089,7 @@ export const PrometheusRule_KubePrometheusStackKubeSchedulerRules: MonitoringCor }] } }; -export const PrometheusRule_KubePrometheusStackKubeStateMetrics: MonitoringCoreosComV1PrometheusRule = { +export const PrometheusRule_KubePrometheusStackKubeStateMetrics: KubernetesResource = { apiVersion: "monitoring.coreos.com/v1", kind: "PrometheusRule", metadata: { @@ -60121,7 +60161,7 @@ export const PrometheusRule_KubePrometheusStackKubeStateMetrics: MonitoringCoreo }] } }; -export const PrometheusRule_KubePrometheusStackKubeletRules: MonitoringCoreosComV1PrometheusRule = { +export const PrometheusRule_KubePrometheusStackKubeletRules: KubernetesResource = { apiVersion: "monitoring.coreos.com/v1", kind: "PrometheusRule", metadata: { @@ -60163,7 +60203,7 @@ export const PrometheusRule_KubePrometheusStackKubeletRules: MonitoringCoreosCom }] } }; -export const PrometheusRule_KubePrometheusStackKubernetesApps: MonitoringCoreosComV1PrometheusRule = { +export const PrometheusRule_KubePrometheusStackKubernetesApps: KubernetesResource = { apiVersion: "monitoring.coreos.com/v1", kind: "PrometheusRule", metadata: { @@ -60390,7 +60430,7 @@ export const PrometheusRule_KubePrometheusStackKubernetesApps: MonitoringCoreosC }] } }; -export const PrometheusRule_KubePrometheusStackKubernetesResources: MonitoringCoreosComV1PrometheusRule = { +export const PrometheusRule_KubePrometheusStackKubernetesResources: KubernetesResource = { apiVersion: "monitoring.coreos.com/v1", kind: "PrometheusRule", metadata: { @@ -60510,7 +60550,7 @@ export const PrometheusRule_KubePrometheusStackKubernetesResources: MonitoringCo }] } }; -export const PrometheusRule_KubePrometheusStackKubernetesStorage: MonitoringCoreosComV1PrometheusRule = { +export const PrometheusRule_KubePrometheusStackKubernetesStorage: KubernetesResource = { apiVersion: "monitoring.coreos.com/v1", kind: "PrometheusRule", metadata: { @@ -60594,7 +60634,7 @@ export const PrometheusRule_KubePrometheusStackKubernetesStorage: MonitoringCore }] } }; -export const PrometheusRule_KubePrometheusStackKubernetesSystemApiserver: MonitoringCoreosComV1PrometheusRule = { +export const PrometheusRule_KubePrometheusStackKubernetesSystemApiserver: KubernetesResource = { apiVersion: "monitoring.coreos.com/v1", kind: "PrometheusRule", metadata: { @@ -60690,7 +60730,7 @@ export const PrometheusRule_KubePrometheusStackKubernetesSystemApiserver: Monito }] } }; -export const PrometheusRule_KubePrometheusStackKubernetesSystemControllerManager: MonitoringCoreosComV1PrometheusRule = { +export const PrometheusRule_KubePrometheusStackKubernetesSystemControllerManager: KubernetesResource = { apiVersion: "monitoring.coreos.com/v1", kind: "PrometheusRule", metadata: { @@ -60726,7 +60766,7 @@ export const PrometheusRule_KubePrometheusStackKubernetesSystemControllerManager }] } }; -export const PrometheusRule_KubePrometheusStackKubernetesSystemKubeProxy: MonitoringCoreosComV1PrometheusRule = { +export const PrometheusRule_KubePrometheusStackKubernetesSystemKubeProxy: KubernetesResource = { apiVersion: "monitoring.coreos.com/v1", kind: "PrometheusRule", metadata: { @@ -60762,7 +60802,7 @@ export const PrometheusRule_KubePrometheusStackKubernetesSystemKubeProxy: Monito }] } }; -export const PrometheusRule_KubePrometheusStackKubernetesSystemKubelet: MonitoringCoreosComV1PrometheusRule = { +export const PrometheusRule_KubePrometheusStackKubernetesSystemKubelet: KubernetesResource = { apiVersion: "monitoring.coreos.com/v1", kind: "PrometheusRule", metadata: { @@ -60962,7 +61002,7 @@ export const PrometheusRule_KubePrometheusStackKubernetesSystemKubelet: Monitori }] } }; -export const PrometheusRule_KubePrometheusStackKubernetesSystemScheduler: MonitoringCoreosComV1PrometheusRule = { +export const PrometheusRule_KubePrometheusStackKubernetesSystemScheduler: KubernetesResource = { apiVersion: "monitoring.coreos.com/v1", kind: "PrometheusRule", metadata: { @@ -60998,7 +61038,7 @@ export const PrometheusRule_KubePrometheusStackKubernetesSystemScheduler: Monito }] } }; -export const PrometheusRule_KubePrometheusStackKubernetesSystem: MonitoringCoreosComV1PrometheusRule = { +export const PrometheusRule_KubePrometheusStackKubernetesSystem: KubernetesResource = { apiVersion: "monitoring.coreos.com/v1", kind: "PrometheusRule", metadata: { @@ -61046,7 +61086,7 @@ export const PrometheusRule_KubePrometheusStackKubernetesSystem: MonitoringCoreo }] } }; -export const PrometheusRule_KubePrometheusStackNodeExporterRules: MonitoringCoreosComV1PrometheusRule = { +export const PrometheusRule_KubePrometheusStackNodeExporterRules: KubernetesResource = { apiVersion: "monitoring.coreos.com/v1", kind: "PrometheusRule", metadata: { @@ -61103,7 +61143,7 @@ export const PrometheusRule_KubePrometheusStackNodeExporterRules: MonitoringCore }] } }; -export const PrometheusRule_KubePrometheusStackNodeExporter: MonitoringCoreosComV1PrometheusRule = { +export const PrometheusRule_KubePrometheusStackNodeExporter: KubernetesResource = { apiVersion: "monitoring.coreos.com/v1", kind: "PrometheusRule", metadata: { @@ -61436,7 +61476,7 @@ export const PrometheusRule_KubePrometheusStackNodeExporter: MonitoringCoreosCom }] } }; -export const PrometheusRule_KubePrometheusStackNodeNetwork: MonitoringCoreosComV1PrometheusRule = { +export const PrometheusRule_KubePrometheusStackNodeNetwork: KubernetesResource = { apiVersion: "monitoring.coreos.com/v1", kind: "PrometheusRule", metadata: { @@ -61472,7 +61512,7 @@ export const PrometheusRule_KubePrometheusStackNodeNetwork: MonitoringCoreosComV }] } }; -export const PrometheusRule_KubePrometheusStackNodeRules: MonitoringCoreosComV1PrometheusRule = { +export const PrometheusRule_KubePrometheusStackNodeRules: KubernetesResource = { apiVersion: "monitoring.coreos.com/v1", kind: "PrometheusRule", metadata: { @@ -61511,7 +61551,7 @@ export const PrometheusRule_KubePrometheusStackNodeRules: MonitoringCoreosComV1P }] } }; -export const PrometheusRule_KubePrometheusStackPrometheusOperator: MonitoringCoreosComV1PrometheusRule = { +export const PrometheusRule_KubePrometheusStackPrometheusOperator: KubernetesResource = { apiVersion: "monitoring.coreos.com/v1", kind: "PrometheusRule", metadata: { @@ -61631,7 +61671,7 @@ export const PrometheusRule_KubePrometheusStackPrometheusOperator: MonitoringCor }] } }; -export const PrometheusRule_KubePrometheusStackPrometheus: MonitoringCoreosComV1PrometheusRule = { +export const PrometheusRule_KubePrometheusStackPrometheus: KubernetesResource = { apiVersion: "monitoring.coreos.com/v1", kind: "PrometheusRule", metadata: { @@ -61931,7 +61971,7 @@ export const PrometheusRule_KubePrometheusStackPrometheus: MonitoringCoreosComV1 }] } }; -export const ServiceMonitor_KubePrometheusStackGrafana: MonitoringCoreosComV1ServiceMonitor = { +export const ServiceMonitor_KubePrometheusStackGrafana: KubernetesResource = { apiVersion: "monitoring.coreos.com/v1", kind: "ServiceMonitor", metadata: { @@ -61964,7 +62004,7 @@ export const ServiceMonitor_KubePrometheusStackGrafana: MonitoringCoreosComV1Ser } } }; -export const ServiceMonitor_KubePrometheusStackKubeStateMetrics: MonitoringCoreosComV1ServiceMonitor = { +export const ServiceMonitor_KubePrometheusStackKubeStateMetrics: KubernetesResource = { apiVersion: "monitoring.coreos.com/v1", kind: "ServiceMonitor", metadata: { @@ -61995,7 +62035,7 @@ export const ServiceMonitor_KubePrometheusStackKubeStateMetrics: MonitoringCoreo } } }; -export const ServiceMonitor_KubePrometheusStackPrometheusNodeExporter: MonitoringCoreosComV1ServiceMonitor = { +export const ServiceMonitor_KubePrometheusStackPrometheusNodeExporter: KubernetesResource = { apiVersion: "monitoring.coreos.com/v1", kind: "ServiceMonitor", metadata: { @@ -62029,7 +62069,7 @@ export const ServiceMonitor_KubePrometheusStackPrometheusNodeExporter: Monitorin } } }; -export const ServiceMonitor_KubePrometheusStackAlertmanager: MonitoringCoreosComV1ServiceMonitor = { +export const ServiceMonitor_KubePrometheusStackAlertmanager: KubernetesResource = { apiVersion: "monitoring.coreos.com/v1", kind: "ServiceMonitor", metadata: { @@ -62067,7 +62107,7 @@ export const ServiceMonitor_KubePrometheusStackAlertmanager: MonitoringCoreosCom } } }; -export const ServiceMonitor_KubePrometheusStackCoredns: MonitoringCoreosComV1ServiceMonitor = { +export const ServiceMonitor_KubePrometheusStackCoredns: KubernetesResource = { apiVersion: "monitoring.coreos.com/v1", kind: "ServiceMonitor", metadata: { @@ -62101,7 +62141,7 @@ export const ServiceMonitor_KubePrometheusStackCoredns: MonitoringCoreosComV1Ser } } }; -export const ServiceMonitor_KubePrometheusStackApiserver: MonitoringCoreosComV1ServiceMonitor = { +export const ServiceMonitor_KubePrometheusStackApiserver: KubernetesResource = { apiVersion: "monitoring.coreos.com/v1", kind: "ServiceMonitor", metadata: { @@ -62146,7 +62186,7 @@ export const ServiceMonitor_KubePrometheusStackApiserver: MonitoringCoreosComV1S } } }; -export const ServiceMonitor_KubePrometheusStackKubeControllerManager: MonitoringCoreosComV1ServiceMonitor = { +export const ServiceMonitor_KubePrometheusStackKubeControllerManager: KubernetesResource = { apiVersion: "monitoring.coreos.com/v1", kind: "ServiceMonitor", metadata: { @@ -62185,7 +62225,7 @@ export const ServiceMonitor_KubePrometheusStackKubeControllerManager: Monitoring } } }; -export const ServiceMonitor_KubePrometheusStackKubeEtcd: MonitoringCoreosComV1ServiceMonitor = { +export const ServiceMonitor_KubePrometheusStackKubeEtcd: KubernetesResource = { apiVersion: "monitoring.coreos.com/v1", kind: "ServiceMonitor", metadata: { @@ -62219,7 +62259,7 @@ export const ServiceMonitor_KubePrometheusStackKubeEtcd: MonitoringCoreosComV1Se } } }; -export const ServiceMonitor_KubePrometheusStackKubeProxy: MonitoringCoreosComV1ServiceMonitor = { +export const ServiceMonitor_KubePrometheusStackKubeProxy: KubernetesResource = { apiVersion: "monitoring.coreos.com/v1", kind: "ServiceMonitor", metadata: { @@ -62253,7 +62293,7 @@ export const ServiceMonitor_KubePrometheusStackKubeProxy: MonitoringCoreosComV1S } } }; -export const ServiceMonitor_KubePrometheusStackKubeScheduler: MonitoringCoreosComV1ServiceMonitor = { +export const ServiceMonitor_KubePrometheusStackKubeScheduler: KubernetesResource = { apiVersion: "monitoring.coreos.com/v1", kind: "ServiceMonitor", metadata: { @@ -62292,7 +62332,7 @@ export const ServiceMonitor_KubePrometheusStackKubeScheduler: MonitoringCoreosCo } } }; -export const ServiceMonitor_KubePrometheusStackKubelet: MonitoringCoreosComV1ServiceMonitor = { +export const ServiceMonitor_KubePrometheusStackKubelet: KubernetesResource = { apiVersion: "monitoring.coreos.com/v1", kind: "ServiceMonitor", metadata: { @@ -62413,7 +62453,7 @@ export const ServiceMonitor_KubePrometheusStackKubelet: MonitoringCoreosComV1Ser } } }; -export const ServiceMonitor_KubePrometheusStackOperator: MonitoringCoreosComV1ServiceMonitor = { +export const ServiceMonitor_KubePrometheusStackOperator: KubernetesResource = { apiVersion: "monitoring.coreos.com/v1", kind: "ServiceMonitor", metadata: { @@ -62459,7 +62499,7 @@ export const ServiceMonitor_KubePrometheusStackOperator: MonitoringCoreosComV1Se } } }; -export const ServiceMonitor_KubePrometheusStackPrometheus: MonitoringCoreosComV1ServiceMonitor = { +export const ServiceMonitor_KubePrometheusStackPrometheus: KubernetesResource = { apiVersion: "monitoring.coreos.com/v1", kind: "ServiceMonitor", metadata: { @@ -62496,47 +62536,7 @@ export const ServiceMonitor_KubePrometheusStackPrometheus: MonitoringCoreosComV1 } } }; -export const ValidatingWebhookConfiguration_KubePrometheusStackAdmission: AdmissionregistrationK8sIoV1ValidatingWebhookConfiguration = { - apiVersion: "admissionregistration.k8s.io/v1", - kind: "ValidatingWebhookConfiguration", - metadata: { - annotations: null, - labels: { - app: "kube-prometheus-stack-admission", - "app.kubernetes.io/component": "prometheus-operator-webhook", - "app.kubernetes.io/instance": "kube-prometheus-stack", - "app.kubernetes.io/managed-by": "Helm", - "app.kubernetes.io/name": "kube-prometheus-stack-prometheus-operator", - "app.kubernetes.io/part-of": "kube-prometheus-stack", - "app.kubernetes.io/version": "77.5.0", - chart: "kube-prometheus-stack-77.5.0", - heritage: "Helm", - release: "kube-prometheus-stack" - }, - name: "kube-prometheus-stack-admission" - }, - webhooks: [{ - admissionReviewVersions: ["v1", "v1beta1"], - clientConfig: { - service: { - name: "kube-prometheus-stack-operator", - namespace: "monitoring", - path: "/admission-prometheusrules/validate" - } - }, - failurePolicy: "Ignore", - name: "prometheusrulemutate.monitoring.coreos.com", - rules: [{ - apiGroups: ["monitoring.coreos.com"], - apiVersions: ["*"], - operations: ["CREATE", "UPDATE"], - resources: ["prometheusrules"] - }], - sideEffects: "None", - timeoutSeconds: 10 - }] -}; -export const ServiceAccount_KubePrometheusStackGrafanaTest: ServiceAccount = { +export const ServiceAccount_KubePrometheusStackGrafanaTest: KubernetesResource = { apiVersion: "v1", kind: "ServiceAccount", metadata: { @@ -62554,7 +62554,7 @@ export const ServiceAccount_KubePrometheusStackGrafanaTest: ServiceAccount = { namespace: "monitoring" } }; -export const ServiceAccount_KubePrometheusStackAdmission: ServiceAccount = { +export const ServiceAccount_KubePrometheusStackAdmission: KubernetesResource = { apiVersion: "v1", kind: "ServiceAccount", metadata: { @@ -62579,7 +62579,7 @@ export const ServiceAccount_KubePrometheusStackAdmission: ServiceAccount = { }, automountServiceAccountToken: true }; -export const ConfigMap_KubePrometheusStackGrafanaTest: ConfigMap = { +export const ConfigMap_KubePrometheusStackGrafanaTest: KubernetesResource = { apiVersion: "v1", kind: "ConfigMap", metadata: { @@ -62600,7 +62600,7 @@ export const ConfigMap_KubePrometheusStackGrafanaTest: ConfigMap = { "run.sh": "@test \"Test Health\" {\n url=\"http://kube-prometheus-stack-grafana/api/health\"\n\n code=$(wget --server-response --spider --timeout 90 --tries 10 ${url} 2>&1 | awk '/^ HTTP/{print $2}')\n [ \"$code\" == \"200\" ]\n}" } }; -export const ClusterRole_KubePrometheusStackAdmission: RbacAuthorizationK8sIoV1ClusterRole = { +export const ClusterRole_KubePrometheusStackAdmission: KubernetesResource = { apiVersion: "rbac.authorization.k8s.io/v1", kind: "ClusterRole", metadata: { @@ -62628,7 +62628,7 @@ export const ClusterRole_KubePrometheusStackAdmission: RbacAuthorizationK8sIoV1C verbs: ["get", "update"] }] }; -export const ClusterRoleBinding_KubePrometheusStackAdmission: RbacAuthorizationK8sIoV1ClusterRoleBinding = { +export const ClusterRoleBinding_KubePrometheusStackAdmission: KubernetesResource = { apiVersion: "rbac.authorization.k8s.io/v1", kind: "ClusterRoleBinding", metadata: { @@ -62661,7 +62661,7 @@ export const ClusterRoleBinding_KubePrometheusStackAdmission: RbacAuthorizationK namespace: "monitoring" }] }; -export const Role_KubePrometheusStackAdmission: RbacAuthorizationK8sIoV1Role = { +export const Role_KubePrometheusStackAdmission: KubernetesResource = { apiVersion: "rbac.authorization.k8s.io/v1", kind: "Role", metadata: { @@ -62690,7 +62690,7 @@ export const Role_KubePrometheusStackAdmission: RbacAuthorizationK8sIoV1Role = { verbs: ["get", "create"] }] }; -export const RoleBinding_KubePrometheusStackAdmission: RbacAuthorizationK8sIoV1RoleBinding = { +export const RoleBinding_KubePrometheusStackAdmission: KubernetesResource = { apiVersion: "rbac.authorization.k8s.io/v1", kind: "RoleBinding", metadata: { @@ -62724,7 +62724,7 @@ export const RoleBinding_KubePrometheusStackAdmission: RbacAuthorizationK8sIoV1R namespace: "monitoring" }] }; -export const Pod_KubePrometheusStackGrafanaTest: Pod = { +export const Pod_KubePrometheusStackGrafanaTest: KubernetesResource = { apiVersion: "v1", kind: "Pod", metadata: { @@ -62763,7 +62763,7 @@ export const Pod_KubePrometheusStackGrafanaTest: Pod = { }] } }; -export const Job_KubePrometheusStackAdmissionCreate: BatchV1Job = { +export const Job_KubePrometheusStackAdmissionCreate: KubernetesResource = { apiVersion: "batch/v1", kind: "Job", metadata: { @@ -62833,7 +62833,7 @@ export const Job_KubePrometheusStackAdmissionCreate: BatchV1Job = { ttlSecondsAfterFinished: 60 } }; -export const Job_KubePrometheusStackAdmissionPatch: BatchV1Job = { +export const Job_KubePrometheusStackAdmissionPatch: KubernetesResource = { apiVersion: "batch/v1", kind: "Job", metadata: { @@ -62903,7 +62903,7 @@ export const Job_KubePrometheusStackAdmissionPatch: BatchV1Job = { ttlSecondsAfterFinished: 60 } }; -export const resources: ReadonlyArray = [Namespace_Monitoring, CustomResourceDefinition_AlertmanagerconfigsMonitoringCoreosCom, CustomResourceDefinition_AlertmanagersMonitoringCoreosCom, CustomResourceDefinition_PodmonitorsMonitoringCoreosCom, CustomResourceDefinition_ProbesMonitoringCoreosCom, CustomResourceDefinition_PrometheusagentsMonitoringCoreosCom, CustomResourceDefinition_PrometheusesMonitoringCoreosCom, CustomResourceDefinition_PrometheusrulesMonitoringCoreosCom, CustomResourceDefinition_ScrapeconfigsMonitoringCoreosCom, CustomResourceDefinition_ServicemonitorsMonitoringCoreosCom, CustomResourceDefinition_ThanosrulersMonitoringCoreosCom, ServiceAccount_KubePrometheusStackGrafana, ServiceAccount_KubePrometheusStackKubeStateMetrics, ServiceAccount_KubePrometheusStackPrometheusNodeExporter, ServiceAccount_KubePrometheusStackAlertmanager, ServiceAccount_KubePrometheusStackOperator, ServiceAccount_KubePrometheusStackPrometheus, Secret_KubePrometheusStackGrafana, Secret_AlertmanagerKubePrometheusStackAlertmanager, ConfigMap_KubePrometheusStackGrafanaConfigDashboards, ConfigMap_KubePrometheusStackGrafana, ConfigMap_KubePrometheusStackGrafanaDatasource, ConfigMap_KubePrometheusStackAlertmanagerOverview, ConfigMap_KubePrometheusStackApiserver, ConfigMap_KubePrometheusStackClusterTotal, ConfigMap_KubePrometheusStackControllerManager, ConfigMap_KubePrometheusStackEtcd, ConfigMap_KubePrometheusStackGrafanaOverview, ConfigMap_KubePrometheusStackK8sCoredns, ConfigMap_KubePrometheusStackK8sResourcesCluster, ConfigMap_KubePrometheusStackK8sResourcesMulticluster, ConfigMap_KubePrometheusStackK8sResourcesNamespace, ConfigMap_KubePrometheusStackK8sResourcesNode, ConfigMap_KubePrometheusStackK8sResourcesPod, ConfigMap_KubePrometheusStackK8sResourcesWorkload, ConfigMap_KubePrometheusStackK8sResourcesWorkloadsNamespace, ConfigMap_KubePrometheusStackKubelet, ConfigMap_KubePrometheusStackNamespaceByPod, ConfigMap_KubePrometheusStackNamespaceByWorkload, ConfigMap_KubePrometheusStackNodeClusterRsrcUse, ConfigMap_KubePrometheusStackNodeRsrcUse, ConfigMap_KubePrometheusStackNodesAix, ConfigMap_KubePrometheusStackNodesDarwin, ConfigMap_KubePrometheusStackNodes, ConfigMap_KubePrometheusStackPersistentvolumesusage, ConfigMap_KubePrometheusStackPodTotal, ConfigMap_KubePrometheusStackPrometheus, ConfigMap_KubePrometheusStackProxy, ConfigMap_KubePrometheusStackScheduler, ConfigMap_KubePrometheusStackWorkloadTotal, PersistentVolumeClaim_KubePrometheusStackGrafana, ClusterRole_KubePrometheusStackGrafanaClusterrole, ClusterRole_KubePrometheusStackKubeStateMetrics, ClusterRole_KubePrometheusStackOperator, ClusterRole_KubePrometheusStackPrometheus, ClusterRoleBinding_KubePrometheusStackGrafanaClusterrolebinding, ClusterRoleBinding_KubePrometheusStackKubeStateMetrics, ClusterRoleBinding_KubePrometheusStackOperator, ClusterRoleBinding_KubePrometheusStackPrometheus, Role_KubePrometheusStackGrafana, RoleBinding_KubePrometheusStackGrafana, Service_KubePrometheusStackGrafana, Service_KubePrometheusStackKubeStateMetrics, Service_KubePrometheusStackPrometheusNodeExporter, Service_KubePrometheusStackAlertmanager, Service_KubePrometheusStackCoredns, Service_KubePrometheusStackKubeControllerManager, Service_KubePrometheusStackKubeEtcd, Service_KubePrometheusStackKubeProxy, Service_KubePrometheusStackKubeScheduler, Service_KubePrometheusStackOperator, Service_KubePrometheusStackPrometheus, DaemonSet_KubePrometheusStackPrometheusNodeExporter, Deployment_KubePrometheusStackGrafana, Deployment_KubePrometheusStackKubeStateMetrics, Deployment_KubePrometheusStackOperator, Alertmanager_KubePrometheusStackAlertmanager, MutatingWebhookConfiguration_KubePrometheusStackAdmission, Prometheus_KubePrometheusStackPrometheus, PrometheusRule_KubePrometheusStackAlertmanagerRules, PrometheusRule_KubePrometheusStackConfigReloaders, PrometheusRule_KubePrometheusStackEtcd, PrometheusRule_KubePrometheusStackGeneralRules, PrometheusRule_KubePrometheusStackK8sRulesContainerCpuUsageSecondsTot, PrometheusRule_KubePrometheusStackK8sRulesContainerMemoryCache, PrometheusRule_KubePrometheusStackK8sRulesContainerMemoryRss, PrometheusRule_KubePrometheusStackK8sRulesContainerMemorySwap, PrometheusRule_KubePrometheusStackK8sRulesContainerMemoryWorkingSetBy, PrometheusRule_KubePrometheusStackK8sRulesContainerResource, PrometheusRule_KubePrometheusStackK8sRulesPodOwner, PrometheusRule_KubePrometheusStackKubeApiserverAvailabilityRules, PrometheusRule_KubePrometheusStackKubeApiserverBurnrateRules, PrometheusRule_KubePrometheusStackKubeApiserverHistogramRules, PrometheusRule_KubePrometheusStackKubeApiserverSlos, PrometheusRule_KubePrometheusStackKubePrometheusGeneralRules, PrometheusRule_KubePrometheusStackKubePrometheusNodeRecordingRules, PrometheusRule_KubePrometheusStackKubeSchedulerRules, PrometheusRule_KubePrometheusStackKubeStateMetrics, PrometheusRule_KubePrometheusStackKubeletRules, PrometheusRule_KubePrometheusStackKubernetesApps, PrometheusRule_KubePrometheusStackKubernetesResources, PrometheusRule_KubePrometheusStackKubernetesStorage, PrometheusRule_KubePrometheusStackKubernetesSystemApiserver, PrometheusRule_KubePrometheusStackKubernetesSystemControllerManager, PrometheusRule_KubePrometheusStackKubernetesSystemKubeProxy, PrometheusRule_KubePrometheusStackKubernetesSystemKubelet, PrometheusRule_KubePrometheusStackKubernetesSystemScheduler, PrometheusRule_KubePrometheusStackKubernetesSystem, PrometheusRule_KubePrometheusStackNodeExporterRules, PrometheusRule_KubePrometheusStackNodeExporter, PrometheusRule_KubePrometheusStackNodeNetwork, PrometheusRule_KubePrometheusStackNodeRules, PrometheusRule_KubePrometheusStackPrometheusOperator, PrometheusRule_KubePrometheusStackPrometheus, ServiceMonitor_KubePrometheusStackGrafana, ServiceMonitor_KubePrometheusStackKubeStateMetrics, ServiceMonitor_KubePrometheusStackPrometheusNodeExporter, ServiceMonitor_KubePrometheusStackAlertmanager, ServiceMonitor_KubePrometheusStackCoredns, ServiceMonitor_KubePrometheusStackApiserver, ServiceMonitor_KubePrometheusStackKubeControllerManager, ServiceMonitor_KubePrometheusStackKubeEtcd, ServiceMonitor_KubePrometheusStackKubeProxy, ServiceMonitor_KubePrometheusStackKubeScheduler, ServiceMonitor_KubePrometheusStackKubelet, ServiceMonitor_KubePrometheusStackOperator, ServiceMonitor_KubePrometheusStackPrometheus, ValidatingWebhookConfiguration_KubePrometheusStackAdmission, ServiceAccount_KubePrometheusStackGrafanaTest, ServiceAccount_KubePrometheusStackAdmission, ConfigMap_KubePrometheusStackGrafanaTest, ClusterRole_KubePrometheusStackAdmission, ClusterRoleBinding_KubePrometheusStackAdmission, Role_KubePrometheusStackAdmission, RoleBinding_KubePrometheusStackAdmission, Pod_KubePrometheusStackGrafanaTest, Job_KubePrometheusStackAdmissionCreate, Job_KubePrometheusStackAdmissionPatch]; +export const resources: ReadonlyArray = [Namespace_Monitoring, CustomResourceDefinition_AlertmanagerconfigsMonitoringCoreosCom, CustomResourceDefinition_AlertmanagersMonitoringCoreosCom, CustomResourceDefinition_PodmonitorsMonitoringCoreosCom, CustomResourceDefinition_ProbesMonitoringCoreosCom, CustomResourceDefinition_PrometheusagentsMonitoringCoreosCom, CustomResourceDefinition_PrometheusesMonitoringCoreosCom, CustomResourceDefinition_PrometheusrulesMonitoringCoreosCom, CustomResourceDefinition_ScrapeconfigsMonitoringCoreosCom, CustomResourceDefinition_ServicemonitorsMonitoringCoreosCom, CustomResourceDefinition_ThanosrulersMonitoringCoreosCom, ServiceAccount_KubePrometheusStackGrafana, ServiceAccount_KubePrometheusStackKubeStateMetrics, ServiceAccount_KubePrometheusStackPrometheusNodeExporter, ServiceAccount_KubePrometheusStackAlertmanager, ServiceAccount_KubePrometheusStackOperator, ServiceAccount_KubePrometheusStackPrometheus, Secret_KubePrometheusStackGrafana, Secret_AlertmanagerKubePrometheusStackAlertmanager, ConfigMap_KubePrometheusStackGrafanaConfigDashboards, ConfigMap_KubePrometheusStackGrafana, ConfigMap_KubePrometheusStackGrafanaDatasource, ConfigMap_KubePrometheusStackAlertmanagerOverview, ConfigMap_KubePrometheusStackApiserver, ConfigMap_KubePrometheusStackClusterTotal, ConfigMap_KubePrometheusStackControllerManager, ConfigMap_KubePrometheusStackEtcd, ConfigMap_KubePrometheusStackGrafanaOverview, ConfigMap_KubePrometheusStackK8sCoredns, ConfigMap_KubePrometheusStackK8sResourcesCluster, ConfigMap_KubePrometheusStackK8sResourcesMulticluster, ConfigMap_KubePrometheusStackK8sResourcesNamespace, ConfigMap_KubePrometheusStackK8sResourcesNode, ConfigMap_KubePrometheusStackK8sResourcesPod, ConfigMap_KubePrometheusStackK8sResourcesWorkload, ConfigMap_KubePrometheusStackK8sResourcesWorkloadsNamespace, ConfigMap_KubePrometheusStackKubelet, ConfigMap_KubePrometheusStackNamespaceByPod, ConfigMap_KubePrometheusStackNamespaceByWorkload, ConfigMap_KubePrometheusStackNodeClusterRsrcUse, ConfigMap_KubePrometheusStackNodeRsrcUse, ConfigMap_KubePrometheusStackNodesAix, ConfigMap_KubePrometheusStackNodesDarwin, ConfigMap_KubePrometheusStackNodes, ConfigMap_KubePrometheusStackPersistentvolumesusage, ConfigMap_KubePrometheusStackPodTotal, ConfigMap_KubePrometheusStackPrometheus, ConfigMap_KubePrometheusStackProxy, ConfigMap_KubePrometheusStackScheduler, ConfigMap_KubePrometheusStackWorkloadTotal, PersistentVolumeClaim_KubePrometheusStackGrafana, ClusterRole_KubePrometheusStackGrafanaClusterrole, ClusterRole_KubePrometheusStackKubeStateMetrics, ClusterRole_KubePrometheusStackOperator, ClusterRole_KubePrometheusStackPrometheus, ClusterRoleBinding_KubePrometheusStackGrafanaClusterrolebinding, ClusterRoleBinding_KubePrometheusStackKubeStateMetrics, ClusterRoleBinding_KubePrometheusStackOperator, ClusterRoleBinding_KubePrometheusStackPrometheus, Role_KubePrometheusStackGrafana, RoleBinding_KubePrometheusStackGrafana, Service_KubePrometheusStackGrafana, Service_KubePrometheusStackKubeStateMetrics, Service_KubePrometheusStackPrometheusNodeExporter, Service_KubePrometheusStackAlertmanager, Service_KubePrometheusStackCoredns, Service_KubePrometheusStackKubeControllerManager, Service_KubePrometheusStackKubeEtcd, Service_KubePrometheusStackKubeProxy, Service_KubePrometheusStackKubeScheduler, Service_KubePrometheusStackOperator, Service_KubePrometheusStackPrometheus, DaemonSet_KubePrometheusStackPrometheusNodeExporter, Deployment_KubePrometheusStackGrafana, Deployment_KubePrometheusStackKubeStateMetrics, Deployment_KubePrometheusStackOperator, MutatingWebhookConfiguration_KubePrometheusStackAdmission, ValidatingWebhookConfiguration_KubePrometheusStackAdmission, Alertmanager_KubePrometheusStackAlertmanager, Prometheus_KubePrometheusStackPrometheus, PrometheusRule_KubePrometheusStackAlertmanagerRules, PrometheusRule_KubePrometheusStackConfigReloaders, PrometheusRule_KubePrometheusStackEtcd, PrometheusRule_KubePrometheusStackGeneralRules, PrometheusRule_KubePrometheusStackK8sRulesContainerCpuUsageSecondsTot, PrometheusRule_KubePrometheusStackK8sRulesContainerMemoryCache, PrometheusRule_KubePrometheusStackK8sRulesContainerMemoryRss, PrometheusRule_KubePrometheusStackK8sRulesContainerMemorySwap, PrometheusRule_KubePrometheusStackK8sRulesContainerMemoryWorkingSetBy, PrometheusRule_KubePrometheusStackK8sRulesContainerResource, PrometheusRule_KubePrometheusStackK8sRulesPodOwner, PrometheusRule_KubePrometheusStackKubeApiserverAvailabilityRules, PrometheusRule_KubePrometheusStackKubeApiserverBurnrateRules, PrometheusRule_KubePrometheusStackKubeApiserverHistogramRules, PrometheusRule_KubePrometheusStackKubeApiserverSlos, PrometheusRule_KubePrometheusStackKubePrometheusGeneralRules, PrometheusRule_KubePrometheusStackKubePrometheusNodeRecordingRules, PrometheusRule_KubePrometheusStackKubeSchedulerRules, PrometheusRule_KubePrometheusStackKubeStateMetrics, PrometheusRule_KubePrometheusStackKubeletRules, PrometheusRule_KubePrometheusStackKubernetesApps, PrometheusRule_KubePrometheusStackKubernetesResources, PrometheusRule_KubePrometheusStackKubernetesStorage, PrometheusRule_KubePrometheusStackKubernetesSystemApiserver, PrometheusRule_KubePrometheusStackKubernetesSystemControllerManager, PrometheusRule_KubePrometheusStackKubernetesSystemKubeProxy, PrometheusRule_KubePrometheusStackKubernetesSystemKubelet, PrometheusRule_KubePrometheusStackKubernetesSystemScheduler, PrometheusRule_KubePrometheusStackKubernetesSystem, PrometheusRule_KubePrometheusStackNodeExporterRules, PrometheusRule_KubePrometheusStackNodeExporter, PrometheusRule_KubePrometheusStackNodeNetwork, PrometheusRule_KubePrometheusStackNodeRules, PrometheusRule_KubePrometheusStackPrometheusOperator, PrometheusRule_KubePrometheusStackPrometheus, ServiceMonitor_KubePrometheusStackGrafana, ServiceMonitor_KubePrometheusStackKubeStateMetrics, ServiceMonitor_KubePrometheusStackPrometheusNodeExporter, ServiceMonitor_KubePrometheusStackAlertmanager, ServiceMonitor_KubePrometheusStackCoredns, ServiceMonitor_KubePrometheusStackApiserver, ServiceMonitor_KubePrometheusStackKubeControllerManager, ServiceMonitor_KubePrometheusStackKubeEtcd, ServiceMonitor_KubePrometheusStackKubeProxy, ServiceMonitor_KubePrometheusStackKubeScheduler, ServiceMonitor_KubePrometheusStackKubelet, ServiceMonitor_KubePrometheusStackOperator, ServiceMonitor_KubePrometheusStackPrometheus, ServiceAccount_KubePrometheusStackGrafanaTest, ServiceAccount_KubePrometheusStackAdmission, ConfigMap_KubePrometheusStackGrafanaTest, ClusterRole_KubePrometheusStackAdmission, ClusterRoleBinding_KubePrometheusStackAdmission, Role_KubePrometheusStackAdmission, RoleBinding_KubePrometheusStackAdmission, Pod_KubePrometheusStackGrafanaTest, Job_KubePrometheusStackAdmissionCreate, Job_KubePrometheusStackAdmissionPatch]; export default { resources: resources }; diff --git a/packages/manifests/src/generated/minio-operator.ts b/packages/manifests/src/generated/minio-operator.ts index caac0c0..1f7f9aa 100644 --- a/packages/manifests/src/generated/minio-operator.ts +++ b/packages/manifests/src/generated/minio-operator.ts @@ -1,6 +1,6 @@ /** Auto-generated typed resources for operator: minio-operator*/ -import type { KubernetesResource, ApiextensionsK8sIoV1CustomResourceDefinition, AppsV1Deployment, Namespace, RbacAuthorizationK8sIoV1ClusterRole, RbacAuthorizationK8sIoV1ClusterRoleBinding, Service, ServiceAccount } from "@kubernetesjs/ops"; -export const Namespace_MinioOperator: Namespace = { +import type { KubernetesResource } from "@kubernetesjs/ops"; +export const Namespace_MinioOperator: KubernetesResource = { apiVersion: "v1", kind: "Namespace", metadata: { @@ -10,7 +10,7 @@ export const Namespace_MinioOperator: Namespace = { name: "minio-operator" } }; -export const ServiceAccount_MinioOperator: ServiceAccount = { +export const ServiceAccount_MinioOperator: KubernetesResource = { apiVersion: "v1", kind: "ServiceAccount", metadata: { @@ -23,7 +23,7 @@ export const ServiceAccount_MinioOperator: ServiceAccount = { namespace: "minio-operator" } }; -export const CustomResourceDefinition_TenantsMinioMinIo: ApiextensionsK8sIoV1CustomResourceDefinition = { +export const CustomResourceDefinition_TenantsMinioMinIo: KubernetesResource = { apiVersion: "apiextensions.k8s.io/v1", kind: "CustomResourceDefinition", metadata: { @@ -7911,7 +7911,7 @@ export const CustomResourceDefinition_TenantsMinioMinIo: ApiextensionsK8sIoV1Cus }] } }; -export const CustomResourceDefinition_PolicybindingsStsMinIo: ApiextensionsK8sIoV1CustomResourceDefinition = { +export const CustomResourceDefinition_PolicybindingsStsMinIo: KubernetesResource = { apiVersion: "apiextensions.k8s.io/v1", kind: "CustomResourceDefinition", metadata: { @@ -8084,7 +8084,7 @@ export const CustomResourceDefinition_PolicybindingsStsMinIo: ApiextensionsK8sIo }] } }; -export const ClusterRole_MinioOperatorRole: RbacAuthorizationK8sIoV1ClusterRole = { +export const ClusterRole_MinioOperatorRole: KubernetesResource = { apiVersion: "rbac.authorization.k8s.io/v1", kind: "ClusterRole", metadata: { @@ -8166,7 +8166,7 @@ export const ClusterRole_MinioOperatorRole: RbacAuthorizationK8sIoV1ClusterRole verbs: ["create", "delete", "get", "list", "patch", "update", "deletecollection"] }] }; -export const ClusterRoleBinding_MinioOperatorBinding: RbacAuthorizationK8sIoV1ClusterRoleBinding = { +export const ClusterRoleBinding_MinioOperatorBinding: KubernetesResource = { apiVersion: "rbac.authorization.k8s.io/v1", kind: "ClusterRoleBinding", metadata: { @@ -8188,7 +8188,7 @@ export const ClusterRoleBinding_MinioOperatorBinding: RbacAuthorizationK8sIoV1Cl namespace: "minio-operator" }] }; -export const Service_Operator: Service = { +export const Service_Operator: KubernetesResource = { apiVersion: "v1", kind: "Service", metadata: { @@ -8213,7 +8213,7 @@ export const Service_Operator: Service = { type: "ClusterIP" } }; -export const Service_Sts: Service = { +export const Service_Sts: KubernetesResource = { apiVersion: "v1", kind: "Service", metadata: { @@ -8237,7 +8237,7 @@ export const Service_Sts: Service = { type: "ClusterIP" } }; -export const Deployment_MinioOperator: AppsV1Deployment = { +export const Deployment_MinioOperator: KubernetesResource = { apiVersion: "apps/v1", kind: "Deployment", metadata: { diff --git a/packages/manifests/src/generated/tekton-pipelines.ts b/packages/manifests/src/generated/tekton-pipelines.ts new file mode 100644 index 0000000..5f0d2d0 --- /dev/null +++ b/packages/manifests/src/generated/tekton-pipelines.ts @@ -0,0 +1,23445 @@ +/** Auto-generated typed resources for operator: tekton-pipelines*/ +import type { KubernetesResource } from "@kubernetesjs/ops"; +export const Namespace_TektonPipelines: KubernetesResource = { + apiVersion: "v1", + kind: "Namespace", + metadata: { + labels: { + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/part-of": "tekton-pipelines", + "pod-security.kubernetes.io/enforce": "restricted" + }, + name: "tekton-pipelines" + } +}; +export const ClusterRole_TektonPipelinesControllerClusterAccess: KubernetesResource = { + apiVersion: "rbac.authorization.k8s.io/v1", + kind: "ClusterRole", + metadata: { + labels: { + "app.kubernetes.io/component": "controller", + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/part-of": "tekton-pipelines" + }, + name: "tekton-pipelines-controller-cluster-access" + }, + rules: [{ + apiGroups: [""], + resources: ["pods"], + verbs: ["list", "watch"] + }, { + apiGroups: [""], + resources: ["nodes"], + verbs: ["list"] + }, { + apiGroups: ["tekton.dev"], + resources: ["tasks", "taskruns", "pipelines", "pipelineruns", "customruns", "stepactions"], + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] + }, { + apiGroups: ["tekton.dev"], + resources: ["verificationpolicies"], + verbs: ["get", "list", "watch"] + }, { + apiGroups: ["tekton.dev"], + resources: ["taskruns/finalizers", "pipelineruns/finalizers", "customruns/finalizers"], + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] + }, { + apiGroups: ["tekton.dev"], + resources: ["tasks/status", "taskruns/status", "pipelines/status", "pipelineruns/status", "customruns/status", "verificationpolicies/status", "stepactions/status"], + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] + }, { + apiGroups: ["resolution.tekton.dev"], + resources: ["resolutionrequests", "resolutionrequests/status"], + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] + }] +}; +export const ClusterRole_TektonPipelinesControllerTenantAccess: KubernetesResource = { + apiVersion: "rbac.authorization.k8s.io/v1", + kind: "ClusterRole", + metadata: { + labels: { + "app.kubernetes.io/component": "controller", + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/part-of": "tekton-pipelines" + }, + name: "tekton-pipelines-controller-tenant-access" + }, + rules: [{ + apiGroups: [""], + resources: ["pods", "persistentvolumeclaims"], + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] + }, { + apiGroups: [""], + resources: ["events"], + verbs: ["create", "update", "patch"] + }, { + apiGroups: [""], + resources: ["configmaps", "limitranges", "secrets", "serviceaccounts"], + verbs: ["get", "list", "watch"] + }, { + apiGroups: ["apps"], + resources: ["statefulsets"], + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] + }] +}; +export const ClusterRole_TektonPipelinesWebhookClusterAccess: KubernetesResource = { + apiVersion: "rbac.authorization.k8s.io/v1", + kind: "ClusterRole", + metadata: { + labels: { + "app.kubernetes.io/component": "webhook", + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/part-of": "tekton-pipelines" + }, + name: "tekton-pipelines-webhook-cluster-access" + }, + rules: [{ + apiGroups: ["apiextensions.k8s.io"], + resourceNames: ["pipelines.tekton.dev", "pipelineruns.tekton.dev", "tasks.tekton.dev", "taskruns.tekton.dev", "resolutionrequests.resolution.tekton.dev", "customruns.tekton.dev", "verificationpolicies.tekton.dev", "stepactions.tekton.dev"], + resources: ["customresourcedefinitions", "customresourcedefinitions/status"], + verbs: ["get", "update", "patch"] + }, { + apiGroups: ["apiextensions.k8s.io"], + resources: ["customresourcedefinitions"], + verbs: ["list", "watch"] + }, { + apiGroups: ["admissionregistration.k8s.io"], + resources: ["mutatingwebhookconfigurations", "validatingwebhookconfigurations"], + verbs: ["list", "watch"] + }, { + apiGroups: ["admissionregistration.k8s.io"], + resourceNames: ["webhook.pipeline.tekton.dev"], + resources: ["mutatingwebhookconfigurations"], + verbs: ["get", "update", "delete"] + }, { + apiGroups: ["admissionregistration.k8s.io"], + resourceNames: ["validation.webhook.pipeline.tekton.dev", "config.webhook.pipeline.tekton.dev"], + resources: ["validatingwebhookconfigurations"], + verbs: ["get", "update", "delete"] + }, { + apiGroups: [""], + resourceNames: ["tekton-pipelines"], + resources: ["namespaces"], + verbs: ["get"] + }, { + apiGroups: [""], + resourceNames: ["tekton-pipelines"], + resources: ["namespaces/finalizers"], + verbs: ["update"] + }] +}; +export const ClusterRole_TektonEventsControllerClusterAccess: KubernetesResource = { + apiVersion: "rbac.authorization.k8s.io/v1", + kind: "ClusterRole", + metadata: { + labels: { + "app.kubernetes.io/component": "events", + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/part-of": "tekton-pipelines" + }, + name: "tekton-events-controller-cluster-access" + }, + rules: [{ + apiGroups: ["tekton.dev"], + resources: ["tasks", "taskruns", "pipelines", "pipelineruns", "customruns"], + verbs: ["get", "list", "watch"] + }, { + apiGroups: [""], + resources: ["events"], + verbs: ["create", "patch"] + }] +}; +export const Role_TektonPipelinesController: KubernetesResource = { + apiVersion: "rbac.authorization.k8s.io/v1", + kind: "Role", + metadata: { + labels: { + "app.kubernetes.io/component": "controller", + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/part-of": "tekton-pipelines" + }, + name: "tekton-pipelines-controller", + namespace: "tekton-pipelines" + }, + rules: [{ + apiGroups: [""], + resources: ["configmaps"], + verbs: ["list", "watch"] + }, { + apiGroups: [""], + resourceNames: ["config-logging", "config-observability", "feature-flags", "config-leader-election-controller", "config-registry-cert"], + resources: ["configmaps"], + verbs: ["get"] + }] +}; +export const Role_TektonPipelinesWebhook: KubernetesResource = { + apiVersion: "rbac.authorization.k8s.io/v1", + kind: "Role", + metadata: { + labels: { + "app.kubernetes.io/component": "webhook", + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/part-of": "tekton-pipelines" + }, + name: "tekton-pipelines-webhook", + namespace: "tekton-pipelines" + }, + rules: [{ + apiGroups: [""], + resources: ["configmaps"], + verbs: ["list", "watch"] + }, { + apiGroups: [""], + resourceNames: ["config-logging", "config-observability", "config-leader-election-webhook", "feature-flags"], + resources: ["configmaps"], + verbs: ["get"] + }, { + apiGroups: [""], + resources: ["secrets"], + verbs: ["list", "watch"] + }, { + apiGroups: [""], + resourceNames: ["webhook-certs"], + resources: ["secrets"], + verbs: ["get", "update"] + }] +}; +export const Role_TektonPipelinesEventsController: KubernetesResource = { + apiVersion: "rbac.authorization.k8s.io/v1", + kind: "Role", + metadata: { + labels: { + "app.kubernetes.io/component": "events", + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/part-of": "tekton-pipelines" + }, + name: "tekton-pipelines-events-controller", + namespace: "tekton-pipelines" + }, + rules: [{ + apiGroups: [""], + resources: ["configmaps"], + verbs: ["list", "watch"] + }, { + apiGroups: [""], + resourceNames: ["config-logging", "config-observability", "feature-flags", "config-leader-election-events", "config-registry-cert"], + resources: ["configmaps"], + verbs: ["get"] + }] +}; +export const Role_TektonPipelinesLeaderElection: KubernetesResource = { + apiVersion: "rbac.authorization.k8s.io/v1", + kind: "Role", + metadata: { + labels: { + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/part-of": "tekton-pipelines" + }, + name: "tekton-pipelines-leader-election", + namespace: "tekton-pipelines" + }, + rules: [{ + apiGroups: ["coordination.k8s.io"], + resources: ["leases"], + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] + }] +}; +export const Role_TektonPipelinesInfo: KubernetesResource = { + apiVersion: "rbac.authorization.k8s.io/v1", + kind: "Role", + metadata: { + labels: { + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/part-of": "tekton-pipelines" + }, + name: "tekton-pipelines-info", + namespace: "tekton-pipelines" + }, + rules: [{ + apiGroups: [""], + resourceNames: ["pipelines-info"], + resources: ["configmaps"], + verbs: ["get"] + }] +}; +export const ServiceAccount_TektonPipelinesController: KubernetesResource = { + apiVersion: "v1", + kind: "ServiceAccount", + metadata: { + labels: { + "app.kubernetes.io/component": "controller", + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/part-of": "tekton-pipelines" + }, + name: "tekton-pipelines-controller", + namespace: "tekton-pipelines" + } +}; +export const ServiceAccount_TektonPipelinesWebhook: KubernetesResource = { + apiVersion: "v1", + kind: "ServiceAccount", + metadata: { + labels: { + "app.kubernetes.io/component": "webhook", + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/part-of": "tekton-pipelines" + }, + name: "tekton-pipelines-webhook", + namespace: "tekton-pipelines" + } +}; +export const ServiceAccount_TektonEventsController: KubernetesResource = { + apiVersion: "v1", + kind: "ServiceAccount", + metadata: { + labels: { + "app.kubernetes.io/component": "events", + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/part-of": "tekton-pipelines" + }, + name: "tekton-events-controller", + namespace: "tekton-pipelines" + } +}; +export const ClusterRoleBinding_TektonPipelinesControllerClusterAccess: KubernetesResource = { + apiVersion: "rbac.authorization.k8s.io/v1", + kind: "ClusterRoleBinding", + metadata: { + labels: { + "app.kubernetes.io/component": "controller", + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/part-of": "tekton-pipelines" + }, + name: "tekton-pipelines-controller-cluster-access" + }, + roleRef: { + apiGroup: "rbac.authorization.k8s.io", + kind: "ClusterRole", + name: "tekton-pipelines-controller-cluster-access" + }, + subjects: [{ + kind: "ServiceAccount", + name: "tekton-pipelines-controller", + namespace: "tekton-pipelines" + }] +}; +export const ClusterRoleBinding_TektonPipelinesControllerTenantAccess: KubernetesResource = { + apiVersion: "rbac.authorization.k8s.io/v1", + kind: "ClusterRoleBinding", + metadata: { + labels: { + "app.kubernetes.io/component": "controller", + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/part-of": "tekton-pipelines" + }, + name: "tekton-pipelines-controller-tenant-access" + }, + roleRef: { + apiGroup: "rbac.authorization.k8s.io", + kind: "ClusterRole", + name: "tekton-pipelines-controller-tenant-access" + }, + subjects: [{ + kind: "ServiceAccount", + name: "tekton-pipelines-controller", + namespace: "tekton-pipelines" + }] +}; +export const ClusterRoleBinding_TektonPipelinesWebhookClusterAccess: KubernetesResource = { + apiVersion: "rbac.authorization.k8s.io/v1", + kind: "ClusterRoleBinding", + metadata: { + labels: { + "app.kubernetes.io/component": "webhook", + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/part-of": "tekton-pipelines" + }, + name: "tekton-pipelines-webhook-cluster-access" + }, + roleRef: { + apiGroup: "rbac.authorization.k8s.io", + kind: "ClusterRole", + name: "tekton-pipelines-webhook-cluster-access" + }, + subjects: [{ + kind: "ServiceAccount", + name: "tekton-pipelines-webhook", + namespace: "tekton-pipelines" + }] +}; +export const ClusterRoleBinding_TektonEventsControllerClusterAccess: KubernetesResource = { + apiVersion: "rbac.authorization.k8s.io/v1", + kind: "ClusterRoleBinding", + metadata: { + labels: { + "app.kubernetes.io/component": "events", + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/part-of": "tekton-pipelines" + }, + name: "tekton-events-controller-cluster-access" + }, + roleRef: { + apiGroup: "rbac.authorization.k8s.io", + kind: "ClusterRole", + name: "tekton-events-controller-cluster-access" + }, + subjects: [{ + kind: "ServiceAccount", + name: "tekton-events-controller", + namespace: "tekton-pipelines" + }] +}; +export const RoleBinding_TektonPipelinesController: KubernetesResource = { + apiVersion: "rbac.authorization.k8s.io/v1", + kind: "RoleBinding", + metadata: { + labels: { + "app.kubernetes.io/component": "controller", + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/part-of": "tekton-pipelines" + }, + name: "tekton-pipelines-controller", + namespace: "tekton-pipelines" + }, + roleRef: { + apiGroup: "rbac.authorization.k8s.io", + kind: "Role", + name: "tekton-pipelines-controller" + }, + subjects: [{ + kind: "ServiceAccount", + name: "tekton-pipelines-controller", + namespace: "tekton-pipelines" + }] +}; +export const RoleBinding_TektonPipelinesWebhook: KubernetesResource = { + apiVersion: "rbac.authorization.k8s.io/v1", + kind: "RoleBinding", + metadata: { + labels: { + "app.kubernetes.io/component": "webhook", + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/part-of": "tekton-pipelines" + }, + name: "tekton-pipelines-webhook", + namespace: "tekton-pipelines" + }, + roleRef: { + apiGroup: "rbac.authorization.k8s.io", + kind: "Role", + name: "tekton-pipelines-webhook" + }, + subjects: [{ + kind: "ServiceAccount", + name: "tekton-pipelines-webhook", + namespace: "tekton-pipelines" + }] +}; +export const RoleBinding_TektonPipelinesControllerLeaderelection: KubernetesResource = { + apiVersion: "rbac.authorization.k8s.io/v1", + kind: "RoleBinding", + metadata: { + labels: { + "app.kubernetes.io/component": "controller", + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/part-of": "tekton-pipelines" + }, + name: "tekton-pipelines-controller-leaderelection", + namespace: "tekton-pipelines" + }, + roleRef: { + apiGroup: "rbac.authorization.k8s.io", + kind: "Role", + name: "tekton-pipelines-leader-election" + }, + subjects: [{ + kind: "ServiceAccount", + name: "tekton-pipelines-controller", + namespace: "tekton-pipelines" + }] +}; +export const RoleBinding_TektonPipelinesWebhookLeaderelection: KubernetesResource = { + apiVersion: "rbac.authorization.k8s.io/v1", + kind: "RoleBinding", + metadata: { + labels: { + "app.kubernetes.io/component": "webhook", + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/part-of": "tekton-pipelines" + }, + name: "tekton-pipelines-webhook-leaderelection", + namespace: "tekton-pipelines" + }, + roleRef: { + apiGroup: "rbac.authorization.k8s.io", + kind: "Role", + name: "tekton-pipelines-leader-election" + }, + subjects: [{ + kind: "ServiceAccount", + name: "tekton-pipelines-webhook", + namespace: "tekton-pipelines" + }] +}; +export const RoleBinding_TektonPipelinesInfo: KubernetesResource = { + apiVersion: "rbac.authorization.k8s.io/v1", + kind: "RoleBinding", + metadata: { + labels: { + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/part-of": "tekton-pipelines" + }, + name: "tekton-pipelines-info", + namespace: "tekton-pipelines" + }, + roleRef: { + apiGroup: "rbac.authorization.k8s.io", + kind: "Role", + name: "tekton-pipelines-info" + }, + subjects: [{ + apiGroup: "rbac.authorization.k8s.io", + kind: "Group", + name: "system:authenticated" + }] +}; +export const RoleBinding_TektonPipelinesEventsController: KubernetesResource = { + apiVersion: "rbac.authorization.k8s.io/v1", + kind: "RoleBinding", + metadata: { + labels: { + "app.kubernetes.io/component": "events", + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/part-of": "tekton-pipelines" + }, + name: "tekton-pipelines-events-controller", + namespace: "tekton-pipelines" + }, + roleRef: { + apiGroup: "rbac.authorization.k8s.io", + kind: "Role", + name: "tekton-pipelines-events-controller" + }, + subjects: [{ + kind: "ServiceAccount", + name: "tekton-events-controller", + namespace: "tekton-pipelines" + }] +}; +export const RoleBinding_TektonEventsControllerLeaderelection: KubernetesResource = { + apiVersion: "rbac.authorization.k8s.io/v1", + kind: "RoleBinding", + metadata: { + labels: { + "app.kubernetes.io/component": "events", + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/part-of": "tekton-pipelines" + }, + name: "tekton-events-controller-leaderelection", + namespace: "tekton-pipelines" + }, + roleRef: { + apiGroup: "rbac.authorization.k8s.io", + kind: "Role", + name: "tekton-pipelines-leader-election" + }, + subjects: [{ + kind: "ServiceAccount", + name: "tekton-events-controller", + namespace: "tekton-pipelines" + }] +}; +export const CustomResourceDefinition_CustomrunsTektonDev: KubernetesResource = { + apiVersion: "apiextensions.k8s.io/v1", + kind: "CustomResourceDefinition", + metadata: { + labels: { + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/part-of": "tekton-pipelines", + "pipeline.tekton.dev/release": "v1.15.0", + version: "v1.15.0" + }, + name: "customruns.tekton.dev" + }, + spec: { + group: "tekton.dev", + names: { + categories: ["tekton", "tekton-pipelines"], + kind: "CustomRun", + plural: "customruns", + singular: "customrun" + }, + preserveUnknownFields: false, + scope: "Namespaced", + versions: [{ + additionalPrinterColumns: [{ + jsonPath: ".status.conditions[?(@.type==\"Succeeded\")].status", + name: "Succeeded", + type: "string" + }, { + jsonPath: ".status.conditions[?(@.type==\"Succeeded\")].reason", + name: "Reason", + type: "string" + }, { + jsonPath: ".status.startTime", + name: "StartTime", + type: "date" + }, { + jsonPath: ".status.completionTime", + name: "CompletionTime", + type: "date" + }], + name: "v1beta1", + schema: { + openAPIV3Schema: { + description: "CustomRun represents a single execution of a Custom Task.", + properties: { + apiVersion: { + description: "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", + type: "string" + }, + kind: { + description: "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + type: "string" + }, + metadata: { + type: "object" + }, + spec: { + description: "CustomRunSpec defines the desired state of CustomRun", + properties: { + customRef: { + description: "TaskRef can be used to refer to a specific instance of a task.", + properties: { + apiVersion: { + description: "API version of the referent\nNote: A Task with non-empty APIVersion and Kind is considered a Custom Task", + type: "string" + }, + bundle: { + description: "Bundle url reference to a Tekton Bundle.\n\nDeprecated: Please use ResolverRef with the bundles resolver instead.\nThe field is staying there for go client backward compatibility, but is not used/allowed anymore.", + type: "string" + }, + kind: { + description: "TaskKind indicates the Kind of the Task:\n1. Namespaced Task when Kind is set to \"Task\". If Kind is \"\", it defaults to \"Task\".\n2. Custom Task when Kind is non-empty and APIVersion is non-empty", + type: "string" + }, + name: { + description: "Name of the referent; More info: http://kubernetes.io/docs/user-guide/identifiers#names", + type: "string" + }, + params: { + description: "Params contains the parameters used to identify the\nreferenced Tekton resource. Example entries might include\n\"repo\" or \"path\" but the set of params ultimately depends on\nthe chosen resolver.", + items: { + description: "Param declares an ParamValues to use for the parameter called name.", + properties: { + name: { + type: "string" + }, + value: { + "x-kubernetes-preserve-unknown-fields": true + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + resolver: { + description: "Resolver is the name of the resolver that should perform\nresolution of the referenced Tekton resource, such as \"git\".", + type: "string" + } + }, + type: "object" + }, + customSpec: { + description: "Spec is a specification of a custom task", + properties: { + apiVersion: { + type: "string" + }, + kind: { + type: "string" + }, + metadata: { + description: "PipelineTaskMetadata contains the labels or annotations for an EmbeddedTask", + properties: { + annotations: { + additionalProperties: { + type: "string" + }, + type: "object" + }, + labels: { + additionalProperties: { + type: "string" + }, + type: "object" + } + }, + type: "object" + }, + spec: { + description: "Spec is a specification of a custom task", + type: "object", + "x-kubernetes-preserve-unknown-fields": true + } + }, + type: "object" + }, + params: { + description: "Params is a list of Param", + items: { + description: "Param declares an ParamValues to use for the parameter called name.", + properties: { + name: { + type: "string" + }, + value: { + "x-kubernetes-preserve-unknown-fields": true + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + retries: { + description: "Used for propagating retries count to custom tasks", + type: "integer" + }, + serviceAccountName: { + type: "string" + }, + status: { + description: "Used for cancelling a customrun (and maybe more later on)", + type: "string" + }, + statusMessage: { + description: "Status message for cancellation.", + type: "string" + }, + timeout: { + description: "Time after which the custom-task times out.\nRefer Go's ParseDuration documentation for expected format: https://golang.org/pkg/time/#ParseDuration", + type: "string" + }, + workspaces: { + description: "Workspaces is a list of WorkspaceBindings from volumes to workspaces.", + items: { + description: "WorkspaceBinding maps a Task's declared workspace to a Volume.", + properties: { + configMap: { + description: "ConfigMap represents a configMap that should populate this workspace.", + properties: { + defaultMode: { + description: "defaultMode is optional: mode bits used to set permissions on created files by default.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nDefaults to 0644.\nDirectories within the path are not affected by this setting.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", + format: "int32", + type: "integer" + }, + items: { + description: "items if unspecified, each key-value pair in the Data field of the referenced\nConfigMap will be projected into the volume as a file whose name is the\nkey and content is the value. If specified, the listed keys will be\nprojected into the specified paths, and unlisted keys will not be\npresent. If a key is specified which is not present in the ConfigMap,\nthe volume setup will error unless it is marked optional. Paths must be\nrelative and may not contain the '..' path or start with '..'.", + items: { + description: "Maps a string key to a path within a volume.", + properties: { + key: { + description: "key is the key to project.", + type: "string" + }, + mode: { + description: "mode is Optional: mode bits used to set permissions on this file.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nIf not specified, the volume defaultMode will be used.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", + format: "int32", + type: "integer" + }, + path: { + description: "path is the relative path of the file to map the key to.\nMay not be an absolute path.\nMay not contain the path element '..'.\nMay not start with the string '..'.", + type: "string" + } + }, + required: ["key", "path"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "optional specify whether the ConfigMap or its keys must be defined", + type: "boolean" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + csi: { + description: "CSI (Container Storage Interface) represents ephemeral storage that is handled by certain external CSI drivers.", + properties: { + driver: { + description: "driver is the name of the CSI driver that handles this volume.\nConsult with your admin for the correct name as registered in the cluster.", + type: "string" + }, + fsType: { + description: "fsType to mount. Ex. \"ext4\", \"xfs\", \"ntfs\".\nIf not provided, the empty value is passed to the associated CSI driver\nwhich will determine the default filesystem to apply.", + type: "string" + }, + nodePublishSecretRef: { + description: "nodePublishSecretRef is a reference to the secret object containing\nsensitive information to pass to the CSI driver to complete the CSI\nNodePublishVolume and NodeUnpublishVolume calls.\nThis field is optional, and may be empty if no secret is required. If the\nsecret object contains more than one secret, all secret references are passed.", + properties: { + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + readOnly: { + description: "readOnly specifies a read-only configuration for the volume.\nDefaults to false (read/write).", + type: "boolean" + }, + volumeAttributes: { + additionalProperties: { + type: "string" + }, + description: "volumeAttributes stores driver-specific properties that are passed to the CSI\ndriver. Consult your driver's documentation for supported values.", + type: "object" + } + }, + required: ["driver"], + type: "object" + }, + emptyDir: { + description: "EmptyDir represents a temporary directory that shares a Task's lifetime.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir\nEither this OR PersistentVolumeClaim can be used.", + properties: { + medium: { + description: "medium represents what type of storage medium should back this directory.\nThe default is \"\" which means to use the node's default medium.\nMust be an empty string (default) or Memory.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir", + type: "string" + }, + sizeLimit: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "sizeLimit is the total amount of local storage required for this EmptyDir volume.\nThe size limit is also applicable for memory medium.\nThe maximum usage on memory medium EmptyDir would be the minimum value between\nthe SizeLimit specified here and the sum of memory limits of all containers in a pod.\nThe default is nil which means that the limit is undefined.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir", + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + } + }, + type: "object" + }, + name: { + description: "Name is the name of the workspace populated by the volume.", + type: "string" + }, + persistentVolumeClaim: { + description: "PersistentVolumeClaimVolumeSource represents a reference to a\nPersistentVolumeClaim in the same namespace. Either this OR EmptyDir can be used.", + properties: { + claimName: { + description: "claimName is the name of a PersistentVolumeClaim in the same namespace as the pod using this volume.\nMore info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims", + type: "string" + }, + readOnly: { + description: "readOnly Will force the ReadOnly setting in VolumeMounts.\nDefault false.", + type: "boolean" + } + }, + required: ["claimName"], + type: "object" + }, + projected: { + description: "Projected represents a projected volume that should populate this workspace.", + properties: { + defaultMode: { + description: "defaultMode are the mode bits used to set permissions on created files by default.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nDirectories within the path are not affected by this setting.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", + format: "int32", + type: "integer" + }, + sources: { + description: "sources is the list of volume projections. Each entry in this list\nhandles one source.", + items: { + description: "Projection that may be projected along with other supported volume types.\nExactly one of these fields must be set.", + properties: { + clusterTrustBundle: { + description: "ClusterTrustBundle allows a pod to access the `.spec.trustBundle` field\nof ClusterTrustBundle objects in an auto-updating file.\n\nAlpha, gated by the ClusterTrustBundleProjection feature gate.\n\nClusterTrustBundle objects can either be selected by name, or by the\ncombination of signer name and a label selector.\n\nKubelet performs aggressive normalization of the PEM contents written\ninto the pod filesystem. Esoteric PEM features such as inter-block\ncomments and block headers are stripped. Certificates are deduplicated.\nThe ordering of certificates within the file is arbitrary, and Kubelet\nmay change the order over time.", + properties: { + labelSelector: { + description: "Select all ClusterTrustBundles that match this label selector. Only has\neffect if signerName is set. Mutually-exclusive with name. If unset,\ninterpreted as \"match nothing\". If set but empty, interpreted as \"match\neverything\".", + properties: { + matchExpressions: { + description: "matchExpressions is a list of label selector requirements. The requirements are ANDed.", + items: { + description: "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", + properties: { + key: { + description: "key is the label key that the selector applies to.", + type: "string" + }, + operator: { + description: "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", + type: "string" + }, + values: { + description: "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + required: ["key", "operator"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + matchLabels: { + additionalProperties: { + type: "string" + }, + description: "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", + type: "object" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + name: { + description: "Select a single ClusterTrustBundle by object name. Mutually-exclusive\nwith signerName and labelSelector.", + type: "string" + }, + optional: { + description: "If true, don't block pod startup if the referenced ClusterTrustBundle(s)\naren't available. If using name, then the named ClusterTrustBundle is\nallowed not to exist. If using signerName, then the combination of\nsignerName and labelSelector is allowed to match zero\nClusterTrustBundles.", + type: "boolean" + }, + path: { + description: "Relative path from the volume root to write the bundle.", + type: "string" + }, + signerName: { + description: "Select all ClusterTrustBundles that match this signer name.\nMutually-exclusive with name. The contents of all selected\nClusterTrustBundles will be unified and deduplicated.", + type: "string" + } + }, + required: ["path"], + type: "object" + }, + configMap: { + description: "configMap information about the configMap data to project", + properties: { + items: { + description: "items if unspecified, each key-value pair in the Data field of the referenced\nConfigMap will be projected into the volume as a file whose name is the\nkey and content is the value. If specified, the listed keys will be\nprojected into the specified paths, and unlisted keys will not be\npresent. If a key is specified which is not present in the ConfigMap,\nthe volume setup will error unless it is marked optional. Paths must be\nrelative and may not contain the '..' path or start with '..'.", + items: { + description: "Maps a string key to a path within a volume.", + properties: { + key: { + description: "key is the key to project.", + type: "string" + }, + mode: { + description: "mode is Optional: mode bits used to set permissions on this file.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nIf not specified, the volume defaultMode will be used.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", + format: "int32", + type: "integer" + }, + path: { + description: "path is the relative path of the file to map the key to.\nMay not be an absolute path.\nMay not contain the path element '..'.\nMay not start with the string '..'.", + type: "string" + } + }, + required: ["key", "path"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "optional specify whether the ConfigMap or its keys must be defined", + type: "boolean" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + downwardAPI: { + description: "downwardAPI information about the downwardAPI data to project", + properties: { + items: { + description: "Items is a list of DownwardAPIVolume file", + items: { + description: "DownwardAPIVolumeFile represents information to create the file containing the pod field", + properties: { + fieldRef: { + description: "Required: Selects a field of the pod: only annotations, labels, name, namespace and uid are supported.", + properties: { + apiVersion: { + description: "Version of the schema the FieldPath is written in terms of, defaults to \"v1\".", + type: "string" + }, + fieldPath: { + description: "Path of the field to select in the specified API version.", + type: "string" + } + }, + required: ["fieldPath"], + type: "object", + "x-kubernetes-map-type": "atomic" + }, + mode: { + description: "Optional: mode bits used to set permissions on this file, must be an octal value\nbetween 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nIf not specified, the volume defaultMode will be used.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", + format: "int32", + type: "integer" + }, + path: { + description: "Required: Path is the relative path name of the file to be created. Must not be absolute or contain the '..' path. Must be utf-8 encoded. The first item of the relative path must not start with '..'", + type: "string" + }, + resourceFieldRef: { + description: "Selects a resource of the container: only resources limits and requests\n(limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported.", + properties: { + containerName: { + description: "Container name: required for volumes, optional for env vars", + type: "string" + }, + divisor: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Specifies the output format of the exposed resources, defaults to \"1\"", + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + }, + resource: { + description: "Required: resource to select", + type: "string" + } + }, + required: ["resource"], + type: "object", + "x-kubernetes-map-type": "atomic" + } + }, + required: ["path"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + secret: { + description: "secret information about the secret data to project", + properties: { + items: { + description: "items if unspecified, each key-value pair in the Data field of the referenced\nSecret will be projected into the volume as a file whose name is the\nkey and content is the value. If specified, the listed keys will be\nprojected into the specified paths, and unlisted keys will not be\npresent. If a key is specified which is not present in the Secret,\nthe volume setup will error unless it is marked optional. Paths must be\nrelative and may not contain the '..' path or start with '..'.", + items: { + description: "Maps a string key to a path within a volume.", + properties: { + key: { + description: "key is the key to project.", + type: "string" + }, + mode: { + description: "mode is Optional: mode bits used to set permissions on this file.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nIf not specified, the volume defaultMode will be used.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", + format: "int32", + type: "integer" + }, + path: { + description: "path is the relative path of the file to map the key to.\nMay not be an absolute path.\nMay not contain the path element '..'.\nMay not start with the string '..'.", + type: "string" + } + }, + required: ["key", "path"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "optional field specify whether the Secret or its key must be defined", + type: "boolean" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + serviceAccountToken: { + description: "serviceAccountToken is information about the serviceAccountToken data to project", + properties: { + audience: { + description: "audience is the intended audience of the token. A recipient of a token\nmust identify itself with an identifier specified in the audience of the\ntoken, and otherwise should reject the token. The audience defaults to the\nidentifier of the apiserver.", + type: "string" + }, + expirationSeconds: { + description: "expirationSeconds is the requested duration of validity of the service\naccount token. As the token approaches expiration, the kubelet volume\nplugin will proactively rotate the service account token. The kubelet will\nstart trying to rotate the token if the token is older than 80 percent of\nits time to live or if the token is older than 24 hours.Defaults to 1 hour\nand must be at least 10 minutes.", + format: "int64", + type: "integer" + }, + path: { + description: "path is the path relative to the mount point of the file to project the\ntoken into.", + type: "string" + } + }, + required: ["path"], + type: "object" + } + }, + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + secret: { + description: "Secret represents a secret that should populate this workspace.", + properties: { + defaultMode: { + description: "defaultMode is Optional: mode bits used to set permissions on created files by default.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values\nfor mode bits. Defaults to 0644.\nDirectories within the path are not affected by this setting.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", + format: "int32", + type: "integer" + }, + items: { + description: "items If unspecified, each key-value pair in the Data field of the referenced\nSecret will be projected into the volume as a file whose name is the\nkey and content is the value. If specified, the listed keys will be\nprojected into the specified paths, and unlisted keys will not be\npresent. If a key is specified which is not present in the Secret,\nthe volume setup will error unless it is marked optional. Paths must be\nrelative and may not contain the '..' path or start with '..'.", + items: { + description: "Maps a string key to a path within a volume.", + properties: { + key: { + description: "key is the key to project.", + type: "string" + }, + mode: { + description: "mode is Optional: mode bits used to set permissions on this file.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nIf not specified, the volume defaultMode will be used.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", + format: "int32", + type: "integer" + }, + path: { + description: "path is the relative path of the file to map the key to.\nMay not be an absolute path.\nMay not contain the path element '..'.\nMay not start with the string '..'.", + type: "string" + } + }, + required: ["key", "path"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + optional: { + description: "optional field specify whether the Secret or its keys must be defined", + type: "boolean" + }, + secretName: { + description: "secretName is the name of the secret in the pod's namespace to use.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#secret", + type: "string" + } + }, + type: "object" + }, + subPath: { + description: "SubPath is optionally a directory on the volume which should be used\nfor this binding (i.e. the volume will be mounted at this sub directory).", + type: "string" + }, + volumeClaimTemplate: { + description: "VolumeClaimTemplate is a template for a claim that will be created in the same namespace.\nThe PipelineRun controller is responsible for creating a unique claim for each instance of PipelineRun.\nSee PersistentVolumeClaim (API version: v1)", + "x-kubernetes-preserve-unknown-fields": true + } + }, + required: ["name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + status: { + description: "CustomRunStatus defines the observed state of CustomRun", + properties: { + annotations: { + additionalProperties: { + type: "string" + }, + description: "Annotations is additional Status fields for the Resource to save some\nadditional State as well as convey more information to the user. This is\nroughly akin to Annotations on any k8s resource, just the reconciler conveying\nricher information outwards.", + type: "object" + }, + completionTime: { + description: "CompletionTime is the time the build completed.", + format: "date-time", + type: "string" + }, + conditions: { + description: "Conditions the latest available observations of a resource's current state.", + items: { + description: "Condition defines a readiness condition for a Knative resource.\nSee: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties", + properties: { + lastTransitionTime: { + description: "LastTransitionTime is the last time the condition transitioned from one status to another.\nWe use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic\ndifferences (all other things held constant).", + type: "string" + }, + message: { + description: "A human readable message indicating details about the transition.", + type: "string" + }, + reason: { + description: "The reason for the condition's last transition.", + type: "string" + }, + severity: { + description: "Severity with which to treat failures of this type of condition.\nWhen this is not specified, it defaults to Error.", + type: "string" + }, + status: { + description: "Status of the condition, one of True, False, Unknown.", + type: "string" + }, + type: { + description: "Type of condition.", + type: "string" + } + }, + required: ["status", "type"], + type: "object" + }, + type: "array" + }, + extraFields: { + description: "ExtraFields holds arbitrary fields provided by the custom task\ncontroller.", + "x-kubernetes-preserve-unknown-fields": true + }, + observedGeneration: { + description: "ObservedGeneration is the 'Generation' of the Service that\nwas last processed by the controller.", + format: "int64", + type: "integer" + }, + results: { + description: "Results reports any output result values to be consumed by later\ntasks in a pipeline.", + items: { + description: "CustomRunResult used to describe the results of a task", + properties: { + name: { + description: "Name the given name", + type: "string" + }, + value: { + description: "Value the given value of the result", + type: "string" + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array" + }, + retriesStatus: { + description: "RetriesStatus contains the history of CustomRunStatus, in case of a retry.\nSee CustomRun.status (API version: tekton.dev/v1beta1)", + "x-kubernetes-preserve-unknown-fields": true + }, + startTime: { + description: "StartTime is the time the build is actually started.", + format: "date-time", + type: "string" + } + }, + type: "object" + } + }, + type: "object" + } + }, + served: true, + storage: true, + subresources: { + status: {} + } + }] + } +}; +export const CustomResourceDefinition_PipelinesTektonDev: KubernetesResource = { + apiVersion: "apiextensions.k8s.io/v1", + kind: "CustomResourceDefinition", + metadata: { + labels: { + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/part-of": "tekton-pipelines", + "pipeline.tekton.dev/release": "v1.15.0", + version: "v1.15.0" + }, + name: "pipelines.tekton.dev" + }, + spec: { + conversion: { + strategy: "Webhook", + webhook: { + clientConfig: { + service: { + name: "tekton-pipelines-webhook", + namespace: "tekton-pipelines" + } + }, + conversionReviewVersions: ["v1beta1", "v1"] + } + }, + group: "tekton.dev", + names: { + categories: ["tekton", "tekton-pipelines"], + kind: "Pipeline", + plural: "pipelines", + singular: "pipeline" + }, + preserveUnknownFields: false, + scope: "Namespaced", + versions: [{ + name: "v1beta1", + schema: { + openAPIV3Schema: { + description: "Pipeline\nDeprecated: Please use v1.Pipeline instead.", + properties: { + apiVersion: { + description: "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", + type: "string" + }, + kind: { + description: "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + type: "string" + }, + metadata: { + type: "object" + }, + spec: { + description: "Spec", + properties: { + description: { + description: "Description", + type: "string" + }, + displayName: { + description: "DisplayName", + type: "string" + }, + finally: { + description: "Finally", + items: { + description: "PipelineTask", + properties: { + description: { + description: "Description", + type: "string" + }, + displayName: { + description: "DisplayName", + type: "string" + }, + matrix: { + description: "Matrix", + properties: { + include: { + description: "Include", + items: { + description: "IncludeParams", + properties: { + name: { + description: "Name", + type: "string" + }, + params: { + description: "Params", + items: { + description: "Param", + properties: { + name: { + type: "string" + }, + value: { + description: "Value", + "x-kubernetes-preserve-unknown-fields": true + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + params: { + description: "Params", + items: { + description: "Param", + properties: { + name: { + type: "string" + }, + value: { + description: "Value", + "x-kubernetes-preserve-unknown-fields": true + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + name: { + description: "Name", + type: "string" + }, + onError: { + description: "OnError", + type: "string" + }, + params: { + description: "Params", + items: { + description: "Param", + properties: { + name: { + type: "string" + }, + value: { + description: "Value", + "x-kubernetes-preserve-unknown-fields": true + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + pipelineRef: { + description: "PipelineRef", + properties: { + apiVersion: { + description: "APIVersion", + type: "string" + }, + bundle: { + description: "Deprecated: Please use ResolverRef with the bundles resolver instead.\nBundle", + type: "string" + }, + name: { + description: "Name", + type: "string" + }, + params: { + description: "Params", + items: { + description: "Param", + properties: { + name: { + type: "string" + }, + value: { + description: "Value", + "x-kubernetes-preserve-unknown-fields": true + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + resolver: { + description: "Resolver", + type: "string" + } + }, + type: "object" + }, + pipelineSpec: { + description: "PipelineSpec", + "x-kubernetes-preserve-unknown-fields": true + }, + resources: { + description: "Resources\nDeprecated: Unused, preserved only for backwards compatibility", + properties: { + inputs: { + description: "Inputs", + items: { + description: "PipelineTaskInputResource\nDeprecated: Unused, preserved only for backwards compatibility", + properties: { + from: { + description: "From", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + name: { + description: "Name", + type: "string" + }, + resource: { + description: "Resource", + type: "string" + } + }, + required: ["name", "resource"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + outputs: { + description: "Outputs", + items: { + description: "PipelineTaskOutputResource\nDeprecated: Unused, preserved only for backwards compatibility", + properties: { + name: { + description: "Name", + type: "string" + }, + resource: { + description: "Resource", + type: "string" + } + }, + required: ["name", "resource"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + retries: { + description: "Retries", + type: "integer" + }, + runAfter: { + description: "RunAfter", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + taskRef: { + description: "TaskRef", + properties: { + apiVersion: { + description: "APIVersion", + type: "string" + }, + bundle: { + description: "Deprecated: Please use ResolverRef with the bundles resolver instead.\nBundle", + type: "string" + }, + kind: { + description: "Kind", + type: "string" + }, + name: { + description: "Name", + type: "string" + }, + params: { + description: "Params", + items: { + description: "Param", + properties: { + name: { + type: "string" + }, + value: { + description: "Value", + "x-kubernetes-preserve-unknown-fields": true + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + resolver: { + description: "Resolver", + type: "string" + } + }, + type: "object" + }, + taskSpec: { + description: "TaskSpec", + "x-kubernetes-preserve-unknown-fields": true + }, + timeout: { + description: "Timeout", + type: "string" + }, + when: { + description: "WhenExpressions", + items: { + description: "WhenExpression", + properties: { + cel: { + description: "CEL", + type: "string" + }, + input: { + description: "Input", + type: "string" + }, + operator: { + description: "Operator", + type: "string" + }, + values: { + description: "Values", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + type: "array" + }, + workspaces: { + description: "Workspaces", + items: { + description: "WorkspacePipelineTaskBinding", + properties: { + name: { + description: "Name", + type: "string" + }, + subPath: { + description: "SubPath", + type: "string" + }, + workspace: { + description: "Workspace", + type: "string" + } + }, + required: ["name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + params: { + description: "Params", + items: { + description: "ParamSpec", + properties: { + default: { + description: "Default", + "x-kubernetes-preserve-unknown-fields": true + }, + description: { + description: "Description", + type: "string" + }, + enum: { + description: "Enum", + items: { + type: "string" + }, + type: "array" + }, + name: { + description: "Name", + type: "string" + }, + properties: { + additionalProperties: { + description: "PropertySpec", + properties: { + type: { + description: "ParamType", + type: "string" + } + }, + type: "object" + }, + description: "Properties", + type: "object" + }, + type: { + description: "Type", + type: "string" + } + }, + required: ["name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + resources: { + description: "Resources\nDeprecated: Unused, preserved only for backwards compatibility", + items: { + description: "PipelineDeclaredResource\nDeprecated: Unused, preserved only for backwards compatibility", + properties: { + name: { + description: "Name", + type: "string" + }, + optional: { + description: "Optional", + type: "boolean" + }, + type: { + description: "Type", + type: "string" + } + }, + required: ["name", "type"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + results: { + description: "Results", + items: { + description: "PipelineResult", + properties: { + description: { + description: "Description", + type: "string" + }, + name: { + description: "Name", + type: "string" + }, + type: { + description: "Type", + type: "string" + }, + value: { + description: "Value", + "x-kubernetes-preserve-unknown-fields": true + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + tasks: { + description: "Tasks", + items: { + description: "PipelineTask", + properties: { + description: { + description: "Description", + type: "string" + }, + displayName: { + description: "DisplayName", + type: "string" + }, + matrix: { + description: "Matrix", + properties: { + include: { + description: "Include", + items: { + description: "IncludeParams", + properties: { + name: { + description: "Name", + type: "string" + }, + params: { + description: "Params", + items: { + description: "Param", + properties: { + name: { + type: "string" + }, + value: { + description: "Value", + "x-kubernetes-preserve-unknown-fields": true + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + params: { + description: "Params", + items: { + description: "Param", + properties: { + name: { + type: "string" + }, + value: { + description: "Value", + "x-kubernetes-preserve-unknown-fields": true + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + name: { + description: "Name", + type: "string" + }, + onError: { + description: "OnError", + type: "string" + }, + params: { + description: "Params", + items: { + description: "Param", + properties: { + name: { + type: "string" + }, + value: { + description: "Value", + "x-kubernetes-preserve-unknown-fields": true + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + pipelineRef: { + description: "PipelineRef", + properties: { + apiVersion: { + description: "APIVersion", + type: "string" + }, + bundle: { + description: "Deprecated: Please use ResolverRef with the bundles resolver instead.\nBundle", + type: "string" + }, + name: { + description: "Name", + type: "string" + }, + params: { + description: "Params", + items: { + description: "Param", + properties: { + name: { + type: "string" + }, + value: { + description: "Value", + "x-kubernetes-preserve-unknown-fields": true + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + resolver: { + description: "Resolver", + type: "string" + } + }, + type: "object" + }, + pipelineSpec: { + description: "PipelineSpec", + "x-kubernetes-preserve-unknown-fields": true + }, + resources: { + description: "Resources\nDeprecated: Unused, preserved only for backwards compatibility", + properties: { + inputs: { + description: "Inputs", + items: { + description: "PipelineTaskInputResource\nDeprecated: Unused, preserved only for backwards compatibility", + properties: { + from: { + description: "From", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + name: { + description: "Name", + type: "string" + }, + resource: { + description: "Resource", + type: "string" + } + }, + required: ["name", "resource"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + outputs: { + description: "Outputs", + items: { + description: "PipelineTaskOutputResource\nDeprecated: Unused, preserved only for backwards compatibility", + properties: { + name: { + description: "Name", + type: "string" + }, + resource: { + description: "Resource", + type: "string" + } + }, + required: ["name", "resource"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + retries: { + description: "Retries", + type: "integer" + }, + runAfter: { + description: "RunAfter", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + taskRef: { + description: "TaskRef", + properties: { + apiVersion: { + description: "APIVersion", + type: "string" + }, + bundle: { + description: "Deprecated: Please use ResolverRef with the bundles resolver instead.\nBundle", + type: "string" + }, + kind: { + description: "Kind", + type: "string" + }, + name: { + description: "Name", + type: "string" + }, + params: { + description: "Params", + items: { + description: "Param", + properties: { + name: { + type: "string" + }, + value: { + description: "Value", + "x-kubernetes-preserve-unknown-fields": true + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + resolver: { + description: "Resolver", + type: "string" + } + }, + type: "object" + }, + taskSpec: { + description: "TaskSpec", + "x-kubernetes-preserve-unknown-fields": true + }, + timeout: { + description: "Timeout", + type: "string" + }, + when: { + description: "WhenExpressions", + items: { + description: "WhenExpression", + properties: { + cel: { + description: "CEL", + type: "string" + }, + input: { + description: "Input", + type: "string" + }, + operator: { + description: "Operator", + type: "string" + }, + values: { + description: "Values", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + type: "array" + }, + workspaces: { + description: "Workspaces", + items: { + description: "WorkspacePipelineTaskBinding", + properties: { + name: { + description: "Name", + type: "string" + }, + subPath: { + description: "SubPath", + type: "string" + }, + workspace: { + description: "Workspace", + type: "string" + } + }, + required: ["name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + workspaces: { + description: "Workspaces", + items: { + description: "PipelineWorkspaceDeclaration", + properties: { + description: { + description: "Description", + type: "string" + }, + name: { + description: "Name", + type: "string" + }, + optional: { + description: "Optional", + type: "boolean" + } + }, + required: ["name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + } + }, + type: "object" + } + }, + served: true, + storage: false, + subresources: { + status: {} + } + }, { + name: "v1", + schema: { + openAPIV3Schema: { + description: "Pipeline describes a list of Tasks to execute. It expresses how outputs\nof tasks feed into inputs of subsequent tasks.", + properties: { + apiVersion: { + description: "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", + type: "string" + }, + kind: { + description: "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + type: "string" + }, + metadata: { + type: "object" + }, + spec: { + description: "Spec holds the desired state of the Pipeline from the client", + properties: { + description: { + description: "Description is a user-facing description of the pipeline that may be\nused to populate a UI.", + type: "string" + }, + displayName: { + description: "DisplayName is a user-facing name of the pipeline that may be\nused to populate a UI.", + type: "string" + }, + finally: { + description: "Finally declares the list of Tasks that execute just before leaving the Pipeline\ni.e. either after all Tasks are finished executing successfully\nor after a failure which would result in ending the Pipeline", + items: { + description: "PipelineTask defines a task in a Pipeline, passing inputs from both\nParams and from the output of previous tasks.", + properties: { + description: { + description: "Description is the description of this task within the context of a Pipeline.\nThis description may be used to populate a UI.", + type: "string" + }, + displayName: { + description: "DisplayName is the display name of this task within the context of a Pipeline.\nThis display name may be used to populate a UI.", + type: "string" + }, + matrix: { + description: "Matrix declares parameters used to fan out this task.", + properties: { + include: { + description: "Include is a list of IncludeParams which allows passing in specific combinations of Parameters into the Matrix.", + items: { + description: "IncludeParams allows passing in a specific combinations of Parameters into the Matrix.", + properties: { + name: { + description: "Name the specified combination", + type: "string" + }, + params: { + description: "Params takes only `Parameters` of type `\"string\"`\nThe names of the `params` must match the names of the `params` in the underlying `Task`", + items: { + description: "Param declares an ParamValues to use for the parameter called name.", + properties: { + name: { + type: "string" + }, + value: { + "x-kubernetes-preserve-unknown-fields": true + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + params: { + description: "Params is a list of parameters used to fan out the pipelineTask\nParams takes only `Parameters` of type `\"array\"`\nEach array element is supplied to the `PipelineTask` by substituting `params` of type `\"string\"` in the underlying `Task`.\nThe names of the `params` in the `Matrix` must match the names of the `params` in the underlying `Task` that they will be substituting.", + items: { + description: "Param declares an ParamValues to use for the parameter called name.", + properties: { + name: { + type: "string" + }, + value: { + "x-kubernetes-preserve-unknown-fields": true + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + name: { + description: "Name is the name of this task within the context of a Pipeline. Name is\nused as a coordinate with the `from` and `runAfter` fields to establish\nthe execution order of tasks relative to one another.", + type: "string" + }, + onError: { + description: "OnError defines the exiting behavior of a PipelineRun on error\ncan be set to [ continue | stopAndFail ]", + type: "string" + }, + params: { + description: "Parameters declares parameters passed to this task.", + items: { + description: "Param declares an ParamValues to use for the parameter called name.", + properties: { + name: { + type: "string" + }, + value: { + "x-kubernetes-preserve-unknown-fields": true + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + pipelineRef: { + description: "PipelineRef is a reference to a pipeline definition.\nThis is an alpha field. You must set the \"enable-api-fields\" feature flag\nto \"alpha\" for this field to be supported. When enabled, the referenced\nPipeline is executed as a child PipelineRun owned by the parent PipelineRun.", + properties: { + apiVersion: { + description: "API version of the referent", + type: "string" + }, + name: { + description: "Name of the referent; More info: http://kubernetes.io/docs/user-guide/identifiers#names", + type: "string" + }, + params: { + description: "Params contains the parameters used to identify the\nreferenced Tekton resource. Example entries might include\n\"repo\" or \"path\" but the set of params ultimately depends on\nthe chosen resolver.", + items: { + description: "Param declares an ParamValues to use for the parameter called name.", + properties: { + name: { + type: "string" + }, + value: { + "x-kubernetes-preserve-unknown-fields": true + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + resolver: { + description: "Resolver is the name of the resolver that should perform\nresolution of the referenced Tekton resource, such as \"git\".", + type: "string" + } + }, + type: "object" + }, + pipelineSpec: { + description: "PipelineSpec is a specification of a pipeline.\nThis is an alpha field. You must set the \"enable-api-fields\" feature flag\nto \"alpha\" for this field to be supported. When enabled, the embedded\nPipeline is executed as a child PipelineRun owned by the parent PipelineRun.\nSpecifying PipelineSpec can be disabled by setting\n`disable-inline-spec` feature flag.\nSee Pipeline.spec (API version: tekton.dev/v1)", + "x-kubernetes-preserve-unknown-fields": true + }, + retries: { + description: "Retries represents how many times this task should be retried in case of task failure: ConditionSucceeded set to False", + type: "integer" + }, + runAfter: { + description: "RunAfter is the list of PipelineTask names that should be executed before\nthis Task executes. (Used to force a specific ordering in graph execution.)", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + taskRef: { + description: "TaskRef is a reference to a task definition.", + properties: { + apiVersion: { + description: "API version of the referent\nNote: A Task with non-empty APIVersion and Kind is considered a Custom Task", + type: "string" + }, + kind: { + description: "TaskKind indicates the Kind of the Task:\n1. Namespaced Task when Kind is set to \"Task\". If Kind is \"\", it defaults to \"Task\".\n2. Custom Task when Kind is non-empty and APIVersion is non-empty", + type: "string" + }, + name: { + description: "Name of the referent; More info: http://kubernetes.io/docs/user-guide/identifiers#names", + type: "string" + }, + params: { + description: "Params contains the parameters used to identify the\nreferenced Tekton resource. Example entries might include\n\"repo\" or \"path\" but the set of params ultimately depends on\nthe chosen resolver.", + items: { + description: "Param declares an ParamValues to use for the parameter called name.", + properties: { + name: { + type: "string" + }, + value: { + "x-kubernetes-preserve-unknown-fields": true + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + resolver: { + description: "Resolver is the name of the resolver that should perform\nresolution of the referenced Tekton resource, such as \"git\".", + type: "string" + } + }, + type: "object" + }, + taskSpec: { + description: "TaskSpec is a specification of a task\nSpecifying TaskSpec can be disabled by setting\n`disable-inline-spec` feature flag.\nSee Task.spec (API version: tekton.dev/v1)", + "x-kubernetes-preserve-unknown-fields": true + }, + timeout: { + description: "Duration after which the TaskRun times out. Defaults to 1 hour.\nRefer Go's ParseDuration documentation for expected format: https://golang.org/pkg/time/#ParseDuration", + type: "string" + }, + when: { + description: "When is a list of when expressions that need to be true for the task to run", + items: { + description: "WhenExpression allows a PipelineTask to declare expressions to be evaluated before the Task is run\nto determine whether the Task should be executed or skipped", + properties: { + cel: { + description: "CEL is a string of Common Language Expression, which can be used to conditionally execute\nthe task based on the result of the expression evaluation\nMore info about CEL syntax: https://github.com/google/cel-spec/blob/master/doc/langdef.md", + type: "string" + }, + input: { + description: "Input is the string for guard checking which can be a static input or an output from a parent Task", + type: "string" + }, + operator: { + description: "Operator that represents an Input's relationship to the values", + type: "string" + }, + values: { + description: "Values is an array of strings, which is compared against the input, for guard checking\nIt must be non-empty", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + type: "array" + }, + workspaces: { + description: "Workspaces maps workspaces from the pipeline spec to the workspaces\ndeclared in the Task.", + items: { + description: "WorkspacePipelineTaskBinding describes how a workspace passed into the pipeline should be\nmapped to a task's declared workspace.", + properties: { + name: { + description: "Name is the name of the workspace as declared by the task", + type: "string" + }, + subPath: { + description: "SubPath is optionally a directory on the volume which should be used\nfor this binding (i.e. the volume will be mounted at this sub directory).", + type: "string" + }, + workspace: { + description: "Workspace is the name of the workspace declared by the pipeline", + type: "string" + } + }, + required: ["name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + params: { + description: "Params declares a list of input parameters that must be supplied when\nthis Pipeline is run.", + items: { + description: "ParamSpec defines arbitrary parameters needed beyond typed inputs (such as\nresources). Parameter values are provided by users as inputs on a TaskRun\nor PipelineRun.", + properties: { + default: { + description: "Default is the value a parameter takes if no input value is supplied. If\ndefault is set, a Task may be executed without a supplied value for the\nparameter.", + "x-kubernetes-preserve-unknown-fields": true + }, + description: { + description: "Description is a user-facing description of the parameter that may be\nused to populate a UI.", + type: "string" + }, + enum: { + description: "Enum declares a set of allowed param input values for tasks/pipelines that can be validated.\nIf Enum is not set, no input validation is performed for the param.", + items: { + type: "string" + }, + type: "array" + }, + name: { + description: "Name declares the name by which a parameter is referenced.", + type: "string" + }, + properties: { + additionalProperties: { + description: "PropertySpec defines the struct for object keys", + properties: { + type: { + description: "ParamType indicates the type of an input parameter;\nUsed to distinguish between a single string and an array of strings.", + type: "string" + } + }, + type: "object" + }, + description: "Properties is the JSON Schema properties to support key-value pairs parameter.", + type: "object" + }, + type: { + description: "Type is the user-specified type of the parameter. The possible types\nare currently \"string\", \"array\" and \"object\", and \"string\" is the default.", + type: "string" + } + }, + required: ["name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + results: { + description: "Results are values that this pipeline can output once run", + items: { + description: "PipelineResult used to describe the results of a pipeline", + properties: { + description: { + description: "Description is a human-readable description of the result", + type: "string" + }, + name: { + description: "Name the given name", + type: "string" + }, + type: { + description: "Type is the user-specified type of the result.\nThe possible types are 'string', 'array', and 'object', with 'string' as the default.\n'array' and 'object' types are alpha features.", + type: "string" + }, + value: { + description: "Value the expression used to retrieve the value", + "x-kubernetes-preserve-unknown-fields": true + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + tasks: { + description: "Tasks declares the graph of Tasks that execute when this Pipeline is run.", + items: { + description: "PipelineTask defines a task in a Pipeline, passing inputs from both\nParams and from the output of previous tasks.", + properties: { + description: { + description: "Description is the description of this task within the context of a Pipeline.\nThis description may be used to populate a UI.", + type: "string" + }, + displayName: { + description: "DisplayName is the display name of this task within the context of a Pipeline.\nThis display name may be used to populate a UI.", + type: "string" + }, + matrix: { + description: "Matrix declares parameters used to fan out this task.", + properties: { + include: { + description: "Include is a list of IncludeParams which allows passing in specific combinations of Parameters into the Matrix.", + items: { + description: "IncludeParams allows passing in a specific combinations of Parameters into the Matrix.", + properties: { + name: { + description: "Name the specified combination", + type: "string" + }, + params: { + description: "Params takes only `Parameters` of type `\"string\"`\nThe names of the `params` must match the names of the `params` in the underlying `Task`", + items: { + description: "Param declares an ParamValues to use for the parameter called name.", + properties: { + name: { + type: "string" + }, + value: { + "x-kubernetes-preserve-unknown-fields": true + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + params: { + description: "Params is a list of parameters used to fan out the pipelineTask\nParams takes only `Parameters` of type `\"array\"`\nEach array element is supplied to the `PipelineTask` by substituting `params` of type `\"string\"` in the underlying `Task`.\nThe names of the `params` in the `Matrix` must match the names of the `params` in the underlying `Task` that they will be substituting.", + items: { + description: "Param declares an ParamValues to use for the parameter called name.", + properties: { + name: { + type: "string" + }, + value: { + "x-kubernetes-preserve-unknown-fields": true + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + name: { + description: "Name is the name of this task within the context of a Pipeline. Name is\nused as a coordinate with the `from` and `runAfter` fields to establish\nthe execution order of tasks relative to one another.", + type: "string" + }, + onError: { + description: "OnError defines the exiting behavior of a PipelineRun on error\ncan be set to [ continue | stopAndFail ]", + type: "string" + }, + params: { + description: "Parameters declares parameters passed to this task.", + items: { + description: "Param declares an ParamValues to use for the parameter called name.", + properties: { + name: { + type: "string" + }, + value: { + "x-kubernetes-preserve-unknown-fields": true + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + pipelineRef: { + description: "PipelineRef is a reference to a pipeline definition.\nThis is an alpha field. You must set the \"enable-api-fields\" feature flag\nto \"alpha\" for this field to be supported. When enabled, the referenced\nPipeline is executed as a child PipelineRun owned by the parent PipelineRun.", + properties: { + apiVersion: { + description: "API version of the referent", + type: "string" + }, + name: { + description: "Name of the referent; More info: http://kubernetes.io/docs/user-guide/identifiers#names", + type: "string" + }, + params: { + description: "Params contains the parameters used to identify the\nreferenced Tekton resource. Example entries might include\n\"repo\" or \"path\" but the set of params ultimately depends on\nthe chosen resolver.", + items: { + description: "Param declares an ParamValues to use for the parameter called name.", + properties: { + name: { + type: "string" + }, + value: { + "x-kubernetes-preserve-unknown-fields": true + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + resolver: { + description: "Resolver is the name of the resolver that should perform\nresolution of the referenced Tekton resource, such as \"git\".", + type: "string" + } + }, + type: "object" + }, + pipelineSpec: { + description: "PipelineSpec is a specification of a pipeline.\nThis is an alpha field. You must set the \"enable-api-fields\" feature flag\nto \"alpha\" for this field to be supported. When enabled, the embedded\nPipeline is executed as a child PipelineRun owned by the parent PipelineRun.\nSpecifying PipelineSpec can be disabled by setting\n`disable-inline-spec` feature flag.\nSee Pipeline.spec (API version: tekton.dev/v1)", + "x-kubernetes-preserve-unknown-fields": true + }, + retries: { + description: "Retries represents how many times this task should be retried in case of task failure: ConditionSucceeded set to False", + type: "integer" + }, + runAfter: { + description: "RunAfter is the list of PipelineTask names that should be executed before\nthis Task executes. (Used to force a specific ordering in graph execution.)", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + taskRef: { + description: "TaskRef is a reference to a task definition.", + properties: { + apiVersion: { + description: "API version of the referent\nNote: A Task with non-empty APIVersion and Kind is considered a Custom Task", + type: "string" + }, + kind: { + description: "TaskKind indicates the Kind of the Task:\n1. Namespaced Task when Kind is set to \"Task\". If Kind is \"\", it defaults to \"Task\".\n2. Custom Task when Kind is non-empty and APIVersion is non-empty", + type: "string" + }, + name: { + description: "Name of the referent; More info: http://kubernetes.io/docs/user-guide/identifiers#names", + type: "string" + }, + params: { + description: "Params contains the parameters used to identify the\nreferenced Tekton resource. Example entries might include\n\"repo\" or \"path\" but the set of params ultimately depends on\nthe chosen resolver.", + items: { + description: "Param declares an ParamValues to use for the parameter called name.", + properties: { + name: { + type: "string" + }, + value: { + "x-kubernetes-preserve-unknown-fields": true + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + resolver: { + description: "Resolver is the name of the resolver that should perform\nresolution of the referenced Tekton resource, such as \"git\".", + type: "string" + } + }, + type: "object" + }, + taskSpec: { + description: "TaskSpec is a specification of a task\nSpecifying TaskSpec can be disabled by setting\n`disable-inline-spec` feature flag.\nSee Task.spec (API version: tekton.dev/v1)", + "x-kubernetes-preserve-unknown-fields": true + }, + timeout: { + description: "Duration after which the TaskRun times out. Defaults to 1 hour.\nRefer Go's ParseDuration documentation for expected format: https://golang.org/pkg/time/#ParseDuration", + type: "string" + }, + when: { + description: "When is a list of when expressions that need to be true for the task to run", + items: { + description: "WhenExpression allows a PipelineTask to declare expressions to be evaluated before the Task is run\nto determine whether the Task should be executed or skipped", + properties: { + cel: { + description: "CEL is a string of Common Language Expression, which can be used to conditionally execute\nthe task based on the result of the expression evaluation\nMore info about CEL syntax: https://github.com/google/cel-spec/blob/master/doc/langdef.md", + type: "string" + }, + input: { + description: "Input is the string for guard checking which can be a static input or an output from a parent Task", + type: "string" + }, + operator: { + description: "Operator that represents an Input's relationship to the values", + type: "string" + }, + values: { + description: "Values is an array of strings, which is compared against the input, for guard checking\nIt must be non-empty", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + type: "array" + }, + workspaces: { + description: "Workspaces maps workspaces from the pipeline spec to the workspaces\ndeclared in the Task.", + items: { + description: "WorkspacePipelineTaskBinding describes how a workspace passed into the pipeline should be\nmapped to a task's declared workspace.", + properties: { + name: { + description: "Name is the name of the workspace as declared by the task", + type: "string" + }, + subPath: { + description: "SubPath is optionally a directory on the volume which should be used\nfor this binding (i.e. the volume will be mounted at this sub directory).", + type: "string" + }, + workspace: { + description: "Workspace is the name of the workspace declared by the pipeline", + type: "string" + } + }, + required: ["name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + workspaces: { + description: "Workspaces declares a set of named workspaces that are expected to be\nprovided by a PipelineRun.", + items: { + description: "PipelineWorkspaceDeclaration creates a named slot in a Pipeline that a PipelineRun\nis expected to populate with a workspace binding.", + properties: { + description: { + description: "Description is a human readable string describing how the workspace will be\nused in the Pipeline. It can be useful to include a bit of detail about which\ntasks are intended to have access to the data on the workspace.", + type: "string" + }, + name: { + description: "Name is the name of a workspace to be provided by a PipelineRun.", + type: "string" + }, + optional: { + description: "Optional marks a Workspace as not being required in PipelineRuns. By default\nthis field is false and so declared workspaces are required.", + type: "boolean" + } + }, + required: ["name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + } + }, + type: "object" + } + }, + served: true, + storage: true, + subresources: { + status: {} + } + }] + } +}; +export const CustomResourceDefinition_PipelinerunsTektonDev: KubernetesResource = { + apiVersion: "apiextensions.k8s.io/v1", + kind: "CustomResourceDefinition", + metadata: { + labels: { + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/part-of": "tekton-pipelines", + "pipeline.tekton.dev/release": "v1.15.0", + version: "v1.15.0" + }, + name: "pipelineruns.tekton.dev" + }, + spec: { + conversion: { + strategy: "Webhook", + webhook: { + clientConfig: { + service: { + name: "tekton-pipelines-webhook", + namespace: "tekton-pipelines" + } + }, + conversionReviewVersions: ["v1beta1", "v1"] + } + }, + group: "tekton.dev", + names: { + categories: ["tekton", "tekton-pipelines"], + kind: "PipelineRun", + plural: "pipelineruns", + shortNames: ["pr", "prs"], + singular: "pipelinerun" + }, + preserveUnknownFields: false, + scope: "Namespaced", + versions: [{ + additionalPrinterColumns: [{ + jsonPath: ".status.conditions[?(@.type==\"Succeeded\")].status", + name: "Succeeded", + type: "string" + }, { + jsonPath: ".status.conditions[?(@.type==\"Succeeded\")].reason", + name: "Reason", + type: "string" + }, { + jsonPath: ".status.startTime", + name: "StartTime", + type: "date" + }, { + jsonPath: ".status.completionTime", + name: "CompletionTime", + type: "date" + }], + name: "v1beta1", + schema: { + openAPIV3Schema: { + description: "PipelineRun\nDeprecated: Please use v1.PipelineRun instead.", + properties: { + apiVersion: { + description: "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", + type: "string" + }, + kind: { + description: "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + type: "string" + }, + metadata: { + type: "object" + }, + spec: { + description: "Spec", + properties: { + managedBy: { + description: "ManagedBy", + type: "string" + }, + params: { + description: "Params", + items: { + description: "Param", + properties: { + name: { + type: "string" + }, + value: { + description: "Value", + "x-kubernetes-preserve-unknown-fields": true + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + pipelineRef: { + description: "PipelineRef", + properties: { + apiVersion: { + description: "APIVersion", + type: "string" + }, + bundle: { + description: "Deprecated: Please use ResolverRef with the bundles resolver instead.\nBundle", + type: "string" + }, + name: { + description: "Name", + type: "string" + }, + params: { + description: "Params", + items: { + description: "Param", + properties: { + name: { + type: "string" + }, + value: { + description: "Value", + "x-kubernetes-preserve-unknown-fields": true + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + resolver: { + description: "Resolver", + type: "string" + } + }, + type: "object" + }, + pipelineSpec: { + description: "PipelineSpec", + "x-kubernetes-preserve-unknown-fields": true + }, + podTemplate: { + description: "PodTemplate", + properties: { + affinity: { + description: "If specified, the pod's scheduling constraints.\nSee Pod.spec.affinity (API version: v1)", + "x-kubernetes-preserve-unknown-fields": true + }, + automountServiceAccountToken: { + description: "AutomountServiceAccountToken indicates whether pods running as this\nservice account should have an API token automatically mounted.", + type: "boolean" + }, + dnsConfig: { + description: "Specifies the DNS parameters of a pod.\nParameters specified here will be merged to the generated DNS\nconfiguration based on DNSPolicy.", + properties: { + nameservers: { + description: "A list of DNS name server IP addresses.\nThis will be appended to the base nameservers generated from DNSPolicy.\nDuplicated nameservers will be removed.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + options: { + description: "A list of DNS resolver options.\nThis will be merged with the base options generated from DNSPolicy.\nDuplicated entries will be removed. Resolution options given in Options\nwill override those that appear in the base DNSPolicy.", + items: { + description: "PodDNSConfigOption defines DNS resolver options of a pod.", + properties: { + name: { + description: "Name is this DNS resolver option's name.\nRequired.", + type: "string" + }, + value: { + description: "Value is this DNS resolver option's value.", + type: "string" + } + }, + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + searches: { + description: "A list of DNS search domains for host-name lookup.\nThis will be appended to the base search paths generated from DNSPolicy.\nDuplicated search paths will be removed.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + dnsPolicy: { + description: "Set DNS policy for the pod. Defaults to \"ClusterFirst\". Valid values are\n'ClusterFirst', 'Default' or 'None'. DNS parameters given in DNSConfig\nwill be merged with the policy selected with DNSPolicy.", + type: "string" + }, + enableServiceLinks: { + description: "EnableServiceLinks indicates whether information about services should be injected into pod's\nenvironment variables, matching the syntax of Docker links.\nOptional: Defaults to true.", + type: "boolean" + }, + env: { + description: "List of environment variables that can be provided to the containers belonging to the pod.", + items: { + description: "EnvVar represents an environment variable present in a Container.", + properties: { + name: { + description: "Name of the environment variable.\nMay consist of any printable ASCII characters except '='.", + type: "string" + }, + value: { + description: "Variable references $(VAR_NAME) are expanded\nusing the previously defined environment variables in the container and\nany service environment variables. If a variable cannot be resolved,\nthe reference in the input string will be unchanged. Double $$ are reduced\nto a single $, which allows for escaping the $(VAR_NAME) syntax: i.e.\n\"$$(VAR_NAME)\" will produce the string literal \"$(VAR_NAME)\".\nEscaped references will never be expanded, regardless of whether the variable\nexists or not.\nDefaults to \"\".", + type: "string" + }, + valueFrom: { + description: "Source for the environment variable's value. Cannot be used if value is not empty.", + properties: { + configMapKeyRef: { + description: "Selects a key of a ConfigMap.", + properties: { + key: { + description: "The key to select.", + type: "string" + }, + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "Specify whether the ConfigMap or its key must be defined", + type: "boolean" + } + }, + required: ["key"], + type: "object", + "x-kubernetes-map-type": "atomic" + }, + fieldRef: { + description: "Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`,\nspec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs.", + properties: { + apiVersion: { + description: "Version of the schema the FieldPath is written in terms of, defaults to \"v1\".", + type: "string" + }, + fieldPath: { + description: "Path of the field to select in the specified API version.", + type: "string" + } + }, + required: ["fieldPath"], + type: "object", + "x-kubernetes-map-type": "atomic" + }, + fileKeyRef: { + description: "FileKeyRef selects a key of the env file.\nRequires the EnvFiles feature gate to be enabled.", + properties: { + key: { + description: "The key within the env file. An invalid key will prevent the pod from starting.\nThe keys defined within a source may consist of any printable ASCII characters except '='.\nDuring Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.", + type: "string" + }, + optional: { + default: false, + description: "Specify whether the file or its key must be defined. If the file or key\ndoes not exist, then the env var is not published.\nIf optional is set to true and the specified key does not exist,\nthe environment variable will not be set in the Pod's containers.\n\nIf optional is set to false and the specified key does not exist,\nan error will be returned during Pod creation.", + type: "boolean" + }, + path: { + description: "The path within the volume from which to select the file.\nMust be relative and may not contain the '..' path or start with '..'.", + type: "string" + }, + volumeName: { + description: "The name of the volume mount containing the env file.", + type: "string" + } + }, + required: ["key", "path", "volumeName"], + type: "object", + "x-kubernetes-map-type": "atomic" + }, + resourceFieldRef: { + description: "Selects a resource of the container: only resources limits and requests\n(limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported.", + properties: { + containerName: { + description: "Container name: required for volumes, optional for env vars", + type: "string" + }, + divisor: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Specifies the output format of the exposed resources, defaults to \"1\"", + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + }, + resource: { + description: "Required: resource to select", + type: "string" + } + }, + required: ["resource"], + type: "object", + "x-kubernetes-map-type": "atomic" + }, + secretKeyRef: { + description: "Selects a key of a secret in the pod's namespace", + properties: { + key: { + description: "The key of the secret to select from. Must be a valid secret key.", + type: "string" + }, + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "Specify whether the Secret or its key must be defined", + type: "boolean" + } + }, + required: ["key"], + type: "object", + "x-kubernetes-map-type": "atomic" + } + }, + type: "object" + } + }, + required: ["name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + hostAliases: { + description: "HostAliases is an optional list of hosts and IPs that will be injected into the pod's hosts\nfile if specified. This is only valid for non-hostNetwork pods.", + items: { + description: "HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the\npod's hosts file.", + properties: { + hostnames: { + description: "Hostnames for the above IP address.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + ip: { + description: "IP address of the host file entry.", + type: "string" + } + }, + required: ["ip"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + hostNetwork: { + description: "HostNetwork specifies whether the pod may use the node network namespace", + type: "boolean" + }, + hostUsers: { + description: "HostUsers indicates whether the pod will use the host's user namespace.\nOptional: Default to true.\nIf set to true or not present, the pod will be run in the host user namespace, useful\nfor when the pod needs a feature only available to the host user namespace, such as\nloading a kernel module with CAP_SYS_MODULE.\nWhen set to false, a new user namespace is created for the pod. Setting false\nis useful to mitigating container breakout vulnerabilities such as allowing\ncontainers to run as root without their user having root privileges on the host.\nThis field depends on the kubernetes feature gate UserNamespacesSupport being enabled.", + type: "boolean" + }, + imagePullSecrets: { + description: "ImagePullSecrets gives the name of the secret used by the pod to pull the image if specified", + items: { + description: "LocalObjectReference contains enough information to let you locate the\nreferenced object inside the same namespace.", + properties: { + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + nodeSelector: { + additionalProperties: { + type: "string" + }, + description: "NodeSelector is a selector which must be true for the pod to fit on a node.\nSelector which must match a node's labels for the pod to be scheduled on that node.\nMore info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/", + type: "object" + }, + priorityClassName: { + description: "If specified, indicates the pod's priority. \"system-node-critical\" and\n\"system-cluster-critical\" are two special keywords which indicate the\nhighest priorities with the former being the highest priority. Any other\nname must be defined by creating a PriorityClass object with that name.\nIf not specified, the pod priority will be default or zero if there is no\ndefault.", + type: "string" + }, + runtimeClassName: { + description: "RuntimeClassName refers to a RuntimeClass object in the node.k8s.io\ngroup, which should be used to run this pod. If no RuntimeClass resource\nmatches the named class, the pod will not be run. If unset or empty, the\n\"legacy\" RuntimeClass will be used, which is an implicit class with an\nempty definition that uses the default runtime handler.\nMore info: https://git.k8s.io/enhancements/keps/sig-node/runtime-class.md\nThis is a beta feature as of Kubernetes v1.14.", + type: "string" + }, + schedulerName: { + description: "SchedulerName specifies the scheduler to be used to dispatch the Pod", + type: "string" + }, + securityContext: { + description: "SecurityContext holds pod-level security attributes and common container settings.\nOptional: Defaults to empty. See type description for default values of each field.\nSee Pod.spec.securityContext (API version: v1)", + "x-kubernetes-preserve-unknown-fields": true + }, + tolerations: { + description: "If specified, the pod's tolerations.", + items: { + description: "The pod this Toleration is attached to tolerates any taint that matches\nthe triple using the matching operator .", + properties: { + effect: { + description: "Effect indicates the taint effect to match. Empty means match all taint effects.\nWhen specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.", + type: "string" + }, + key: { + description: "Key is the taint key that the toleration applies to. Empty means match all taint keys.\nIf the key is empty, operator must be Exists; this combination means to match all values and all keys.", + type: "string" + }, + operator: { + description: "Operator represents a key's relationship to the value.\nValid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.\nExists is equivalent to wildcard for value, so that a pod can\ntolerate all taints of a particular category.\nLt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).", + type: "string" + }, + tolerationSeconds: { + description: "TolerationSeconds represents the period of time the toleration (which must be\nof effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,\nit is not set, which means tolerate the taint forever (do not evict). Zero and\nnegative values will be treated as 0 (evict immediately) by the system.", + format: "int64", + type: "integer" + }, + value: { + description: "Value is the taint value the toleration matches to.\nIf the operator is Exists, the value should be empty, otherwise just a regular string.", + type: "string" + } + }, + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + topologySpreadConstraints: { + description: "TopologySpreadConstraints controls how Pods are spread across your cluster among\nfailure-domains such as regions, zones, nodes, and other user-defined topology domains.", + items: { + description: "TopologySpreadConstraint specifies how to spread matching pods among the given topology.", + properties: { + labelSelector: { + description: "LabelSelector is used to find matching pods.\nPods that match this label selector are counted to determine the number of pods\nin their corresponding topology domain.", + properties: { + matchExpressions: { + description: "matchExpressions is a list of label selector requirements. The requirements are ANDed.", + items: { + description: "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", + properties: { + key: { + description: "key is the label key that the selector applies to.", + type: "string" + }, + operator: { + description: "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", + type: "string" + }, + values: { + description: "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + required: ["key", "operator"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + matchLabels: { + additionalProperties: { + type: "string" + }, + description: "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", + type: "object" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + matchLabelKeys: { + description: "MatchLabelKeys is a set of pod label keys to select the pods over which\nspreading will be calculated. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are ANDed with labelSelector\nto select the group of existing pods over which spreading will be calculated\nfor the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector.\nMatchLabelKeys cannot be set when LabelSelector isn't set.\nKeys that don't exist in the incoming pod labels will\nbe ignored. A null or empty list means only match against labelSelector.\n\nThis is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default).", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + maxSkew: { + description: "MaxSkew describes the degree to which pods may be unevenly distributed.\nWhen `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference\nbetween the number of matching pods in the target topology and the global minimum.\nThe global minimum is the minimum number of matching pods in an eligible domain\nor zero if the number of eligible domains is less than MinDomains.\nFor example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same\nlabelSelector spread as 2/2/1:\nIn this case, the global minimum is 1.\n| zone1 | zone2 | zone3 |\n| P P | P P | P |\n- if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2;\nscheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2)\nviolate MaxSkew(1).\n- if MaxSkew is 2, incoming pod can be scheduled onto any zone.\nWhen `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence\nto topologies that satisfy it.\nIt's a required field. Default value is 1 and 0 is not allowed.", + format: "int32", + type: "integer" + }, + minDomains: { + description: "MinDomains indicates a minimum number of eligible domains.\nWhen the number of eligible domains with matching topology keys is less than minDomains,\nPod Topology Spread treats \"global minimum\" as 0, and then the calculation of Skew is performed.\nAnd when the number of eligible domains with matching topology keys equals or greater than minDomains,\nthis value has no effect on scheduling.\nAs a result, when the number of eligible domains is less than minDomains,\nscheduler won't schedule more than maxSkew Pods to those domains.\nIf value is nil, the constraint behaves as if MinDomains is equal to 1.\nValid values are integers greater than 0.\nWhen value is not nil, WhenUnsatisfiable must be DoNotSchedule.\n\nFor example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same\nlabelSelector spread as 2/2/2:\n| zone1 | zone2 | zone3 |\n| P P | P P | P P |\nThe number of domains is less than 5(MinDomains), so \"global minimum\" is treated as 0.\nIn this situation, new pod with the same labelSelector cannot be scheduled,\nbecause computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones,\nit will violate MaxSkew.", + format: "int32", + type: "integer" + }, + nodeAffinityPolicy: { + description: "NodeAffinityPolicy indicates how we will treat Pod's nodeAffinity/nodeSelector\nwhen calculating pod topology spread skew. Options are:\n- Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations.\n- Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations.\n\nIf this value is nil, the behavior is equivalent to the Honor policy.", + type: "string" + }, + nodeTaintsPolicy: { + description: "NodeTaintsPolicy indicates how we will treat node taints when calculating\npod topology spread skew. Options are:\n- Honor: nodes without taints, along with tainted nodes for which the incoming pod\nhas a toleration, are included.\n- Ignore: node taints are ignored. All nodes are included.\n\nIf this value is nil, the behavior is equivalent to the Ignore policy.", + type: "string" + }, + topologyKey: { + description: "TopologyKey is the key of node labels. Nodes that have a label with this key\nand identical values are considered to be in the same topology.\nWe consider each as a \"bucket\", and try to put balanced number\nof pods into each bucket.\nWe define a domain as a particular instance of a topology.\nAlso, we define an eligible domain as a domain whose nodes meet the requirements of\nnodeAffinityPolicy and nodeTaintsPolicy.\ne.g. If TopologyKey is \"kubernetes.io/hostname\", each Node is a domain of that topology.\nAnd, if TopologyKey is \"topology.kubernetes.io/zone\", each zone is a domain of that topology.\nIt's a required field.", + type: "string" + }, + whenUnsatisfiable: { + description: "WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy\nthe spread constraint.\n- DoNotSchedule (default) tells the scheduler not to schedule it.\n- ScheduleAnyway tells the scheduler to schedule the pod in any location,\n but giving higher precedence to topologies that would help reduce the\n skew.\nA constraint is considered \"Unsatisfiable\" for an incoming pod\nif and only if every possible node assignment for that pod would violate\n\"MaxSkew\" on some topology.\nFor example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same\nlabelSelector spread as 3/1/1:\n| zone1 | zone2 | zone3 |\n| P P P | P | P |\nIf WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled\nto zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies\nMaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler\nwon't make it *more* imbalanced.\nIt's a required field.", + type: "string" + } + }, + required: ["maxSkew", "topologyKey", "whenUnsatisfiable"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + volumes: { + description: "List of volumes that can be mounted by containers belonging to the pod.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes\nSee Pod.spec.volumes (API version: v1)", + "x-kubernetes-preserve-unknown-fields": true + } + }, + type: "object" + }, + resources: { + description: "Resources\nDeprecated: Unused, preserved only for backwards compatibility", + items: { + description: "PipelineResourceBinding\nDeprecated: Unused, preserved only for backwards compatibility", + properties: { + name: { + description: "Name", + type: "string" + }, + resourceRef: { + description: "ResourceRef", + properties: { + apiVersion: { + description: "APIVersion", + type: "string" + }, + name: { + description: "Name", + type: "string" + } + }, + type: "object" + }, + resourceSpec: { + description: "ResourceSpec", + properties: { + description: { + description: "Description is a user-facing description of the resource that may be\nused to populate a UI.", + type: "string" + }, + params: { + items: { + description: "ResourceParam declares a string value to use for the parameter called Name, and is used in\nthe specific context of PipelineResources.\n\nDeprecated: Unused, preserved only for backwards compatibility", + properties: { + name: { + type: "string" + }, + value: { + type: "string" + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + secrets: { + description: "Secrets to fetch to populate some of resource fields", + items: { + description: "SecretParam indicates which secret can be used to populate a field of the resource\n\nDeprecated: Unused, preserved only for backwards compatibility", + properties: { + fieldName: { + type: "string" + }, + secretKey: { + type: "string" + }, + secretName: { + type: "string" + } + }, + required: ["fieldName", "secretKey", "secretName"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + type: { + description: "PipelineResourceType represents the type of endpoint the pipelineResource is, so that the\ncontroller will know this pipelineResource shouldx be fetched and optionally what\nadditional metatdata should be provided for it.\n\nDeprecated: Unused, preserved only for backwards compatibility", + type: "string" + } + }, + required: ["params", "type"], + type: "object" + } + }, + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + serviceAccountName: { + description: "ServiceAccountName", + type: "string" + }, + status: { + description: "Status", + type: "string" + }, + taskRunSpecs: { + description: "TaskRunSpecs", + items: { + description: "PipelineTaskRunSpec", + properties: { + computeResources: { + description: "ComputeResources", + properties: { + claims: { + description: "Claims lists the names of resources, defined in spec.resourceClaims,\nthat are used by this container.\n\nThis field depends on the\nDynamicResourceAllocation feature gate.\n\nThis field is immutable. It can only be set for containers.", + items: { + description: "ResourceClaim references one entry in PodSpec.ResourceClaims.", + properties: { + name: { + description: "Name must match the name of one entry in pod.spec.resourceClaims of\nthe Pod where this field is used. It makes that resource available\ninside a container.", + type: "string" + }, + request: { + description: "Request is the name chosen for a request in the referenced claim.\nIf empty, everything from the claim is made available, otherwise\nonly the result of this request.", + type: "string" + } + }, + required: ["name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-map-keys": ["name"], + "x-kubernetes-list-type": "map" + }, + limits: { + additionalProperties: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + }, + description: "Limits describes the maximum amount of compute resources allowed.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + type: "object" + }, + requests: { + additionalProperties: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + }, + description: "Requests describes the minimum amount of compute resources required.\nIf Requests is omitted for a container, it defaults to Limits if that is explicitly specified,\notherwise to an implementation-defined value. Requests cannot exceed Limits.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + type: "object" + } + }, + type: "object" + }, + metadata: { + description: "Metadata", + properties: { + annotations: { + additionalProperties: { + type: "string" + }, + description: "Annotations", + type: "object" + }, + labels: { + additionalProperties: { + type: "string" + }, + description: "Labels", + type: "object" + } + }, + type: "object" + }, + pipelineTaskName: { + type: "string" + }, + sidecarOverrides: { + description: "SidecarOverrides", + items: { + description: "TaskRunSidecarOverride", + properties: { + name: { + description: "Name", + type: "string" + }, + resources: { + description: "Resources", + properties: { + claims: { + description: "Claims lists the names of resources, defined in spec.resourceClaims,\nthat are used by this container.\n\nThis field depends on the\nDynamicResourceAllocation feature gate.\n\nThis field is immutable. It can only be set for containers.", + items: { + description: "ResourceClaim references one entry in PodSpec.ResourceClaims.", + properties: { + name: { + description: "Name must match the name of one entry in pod.spec.resourceClaims of\nthe Pod where this field is used. It makes that resource available\ninside a container.", + type: "string" + }, + request: { + description: "Request is the name chosen for a request in the referenced claim.\nIf empty, everything from the claim is made available, otherwise\nonly the result of this request.", + type: "string" + } + }, + required: ["name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-map-keys": ["name"], + "x-kubernetes-list-type": "map" + }, + limits: { + additionalProperties: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + }, + description: "Limits describes the maximum amount of compute resources allowed.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + type: "object" + }, + requests: { + additionalProperties: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + }, + description: "Requests describes the minimum amount of compute resources required.\nIf Requests is omitted for a container, it defaults to Limits if that is explicitly specified,\notherwise to an implementation-defined value. Requests cannot exceed Limits.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + type: "object" + } + }, + type: "object" + } + }, + required: ["name", "resources"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + stepOverrides: { + description: "StepOverrides", + items: { + description: "TaskRunStepOverride", + properties: { + name: { + description: "Name", + type: "string" + }, + resources: { + description: "Resources", + properties: { + claims: { + description: "Claims lists the names of resources, defined in spec.resourceClaims,\nthat are used by this container.\n\nThis field depends on the\nDynamicResourceAllocation feature gate.\n\nThis field is immutable. It can only be set for containers.", + items: { + description: "ResourceClaim references one entry in PodSpec.ResourceClaims.", + properties: { + name: { + description: "Name must match the name of one entry in pod.spec.resourceClaims of\nthe Pod where this field is used. It makes that resource available\ninside a container.", + type: "string" + }, + request: { + description: "Request is the name chosen for a request in the referenced claim.\nIf empty, everything from the claim is made available, otherwise\nonly the result of this request.", + type: "string" + } + }, + required: ["name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-map-keys": ["name"], + "x-kubernetes-list-type": "map" + }, + limits: { + additionalProperties: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + }, + description: "Limits describes the maximum amount of compute resources allowed.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + type: "object" + }, + requests: { + additionalProperties: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + }, + description: "Requests describes the minimum amount of compute resources required.\nIf Requests is omitted for a container, it defaults to Limits if that is explicitly specified,\notherwise to an implementation-defined value. Requests cannot exceed Limits.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + type: "object" + } + }, + type: "object" + } + }, + required: ["name", "resources"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + taskPodTemplate: { + description: "PodTemplate holds pod specific configuration", + properties: { + affinity: { + description: "If specified, the pod's scheduling constraints.\nSee Pod.spec.affinity (API version: v1)", + "x-kubernetes-preserve-unknown-fields": true + }, + automountServiceAccountToken: { + description: "AutomountServiceAccountToken indicates whether pods running as this\nservice account should have an API token automatically mounted.", + type: "boolean" + }, + dnsConfig: { + description: "Specifies the DNS parameters of a pod.\nParameters specified here will be merged to the generated DNS\nconfiguration based on DNSPolicy.", + properties: { + nameservers: { + description: "A list of DNS name server IP addresses.\nThis will be appended to the base nameservers generated from DNSPolicy.\nDuplicated nameservers will be removed.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + options: { + description: "A list of DNS resolver options.\nThis will be merged with the base options generated from DNSPolicy.\nDuplicated entries will be removed. Resolution options given in Options\nwill override those that appear in the base DNSPolicy.", + items: { + description: "PodDNSConfigOption defines DNS resolver options of a pod.", + properties: { + name: { + description: "Name is this DNS resolver option's name.\nRequired.", + type: "string" + }, + value: { + description: "Value is this DNS resolver option's value.", + type: "string" + } + }, + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + searches: { + description: "A list of DNS search domains for host-name lookup.\nThis will be appended to the base search paths generated from DNSPolicy.\nDuplicated search paths will be removed.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + dnsPolicy: { + description: "Set DNS policy for the pod. Defaults to \"ClusterFirst\". Valid values are\n'ClusterFirst', 'Default' or 'None'. DNS parameters given in DNSConfig\nwill be merged with the policy selected with DNSPolicy.", + type: "string" + }, + enableServiceLinks: { + description: "EnableServiceLinks indicates whether information about services should be injected into pod's\nenvironment variables, matching the syntax of Docker links.\nOptional: Defaults to true.", + type: "boolean" + }, + env: { + description: "List of environment variables that can be provided to the containers belonging to the pod.", + items: { + description: "EnvVar represents an environment variable present in a Container.", + properties: { + name: { + description: "Name of the environment variable.\nMay consist of any printable ASCII characters except '='.", + type: "string" + }, + value: { + description: "Variable references $(VAR_NAME) are expanded\nusing the previously defined environment variables in the container and\nany service environment variables. If a variable cannot be resolved,\nthe reference in the input string will be unchanged. Double $$ are reduced\nto a single $, which allows for escaping the $(VAR_NAME) syntax: i.e.\n\"$$(VAR_NAME)\" will produce the string literal \"$(VAR_NAME)\".\nEscaped references will never be expanded, regardless of whether the variable\nexists or not.\nDefaults to \"\".", + type: "string" + }, + valueFrom: { + description: "Source for the environment variable's value. Cannot be used if value is not empty.", + properties: { + configMapKeyRef: { + description: "Selects a key of a ConfigMap.", + properties: { + key: { + description: "The key to select.", + type: "string" + }, + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "Specify whether the ConfigMap or its key must be defined", + type: "boolean" + } + }, + required: ["key"], + type: "object", + "x-kubernetes-map-type": "atomic" + }, + fieldRef: { + description: "Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`,\nspec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs.", + properties: { + apiVersion: { + description: "Version of the schema the FieldPath is written in terms of, defaults to \"v1\".", + type: "string" + }, + fieldPath: { + description: "Path of the field to select in the specified API version.", + type: "string" + } + }, + required: ["fieldPath"], + type: "object", + "x-kubernetes-map-type": "atomic" + }, + fileKeyRef: { + description: "FileKeyRef selects a key of the env file.\nRequires the EnvFiles feature gate to be enabled.", + properties: { + key: { + description: "The key within the env file. An invalid key will prevent the pod from starting.\nThe keys defined within a source may consist of any printable ASCII characters except '='.\nDuring Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.", + type: "string" + }, + optional: { + default: false, + description: "Specify whether the file or its key must be defined. If the file or key\ndoes not exist, then the env var is not published.\nIf optional is set to true and the specified key does not exist,\nthe environment variable will not be set in the Pod's containers.\n\nIf optional is set to false and the specified key does not exist,\nan error will be returned during Pod creation.", + type: "boolean" + }, + path: { + description: "The path within the volume from which to select the file.\nMust be relative and may not contain the '..' path or start with '..'.", + type: "string" + }, + volumeName: { + description: "The name of the volume mount containing the env file.", + type: "string" + } + }, + required: ["key", "path", "volumeName"], + type: "object", + "x-kubernetes-map-type": "atomic" + }, + resourceFieldRef: { + description: "Selects a resource of the container: only resources limits and requests\n(limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported.", + properties: { + containerName: { + description: "Container name: required for volumes, optional for env vars", + type: "string" + }, + divisor: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Specifies the output format of the exposed resources, defaults to \"1\"", + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + }, + resource: { + description: "Required: resource to select", + type: "string" + } + }, + required: ["resource"], + type: "object", + "x-kubernetes-map-type": "atomic" + }, + secretKeyRef: { + description: "Selects a key of a secret in the pod's namespace", + properties: { + key: { + description: "The key of the secret to select from. Must be a valid secret key.", + type: "string" + }, + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "Specify whether the Secret or its key must be defined", + type: "boolean" + } + }, + required: ["key"], + type: "object", + "x-kubernetes-map-type": "atomic" + } + }, + type: "object" + } + }, + required: ["name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + hostAliases: { + description: "HostAliases is an optional list of hosts and IPs that will be injected into the pod's hosts\nfile if specified. This is only valid for non-hostNetwork pods.", + items: { + description: "HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the\npod's hosts file.", + properties: { + hostnames: { + description: "Hostnames for the above IP address.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + ip: { + description: "IP address of the host file entry.", + type: "string" + } + }, + required: ["ip"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + hostNetwork: { + description: "HostNetwork specifies whether the pod may use the node network namespace", + type: "boolean" + }, + hostUsers: { + description: "HostUsers indicates whether the pod will use the host's user namespace.\nOptional: Default to true.\nIf set to true or not present, the pod will be run in the host user namespace, useful\nfor when the pod needs a feature only available to the host user namespace, such as\nloading a kernel module with CAP_SYS_MODULE.\nWhen set to false, a new user namespace is created for the pod. Setting false\nis useful to mitigating container breakout vulnerabilities such as allowing\ncontainers to run as root without their user having root privileges on the host.\nThis field depends on the kubernetes feature gate UserNamespacesSupport being enabled.", + type: "boolean" + }, + imagePullSecrets: { + description: "ImagePullSecrets gives the name of the secret used by the pod to pull the image if specified", + items: { + description: "LocalObjectReference contains enough information to let you locate the\nreferenced object inside the same namespace.", + properties: { + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + nodeSelector: { + additionalProperties: { + type: "string" + }, + description: "NodeSelector is a selector which must be true for the pod to fit on a node.\nSelector which must match a node's labels for the pod to be scheduled on that node.\nMore info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/", + type: "object" + }, + priorityClassName: { + description: "If specified, indicates the pod's priority. \"system-node-critical\" and\n\"system-cluster-critical\" are two special keywords which indicate the\nhighest priorities with the former being the highest priority. Any other\nname must be defined by creating a PriorityClass object with that name.\nIf not specified, the pod priority will be default or zero if there is no\ndefault.", + type: "string" + }, + runtimeClassName: { + description: "RuntimeClassName refers to a RuntimeClass object in the node.k8s.io\ngroup, which should be used to run this pod. If no RuntimeClass resource\nmatches the named class, the pod will not be run. If unset or empty, the\n\"legacy\" RuntimeClass will be used, which is an implicit class with an\nempty definition that uses the default runtime handler.\nMore info: https://git.k8s.io/enhancements/keps/sig-node/runtime-class.md\nThis is a beta feature as of Kubernetes v1.14.", + type: "string" + }, + schedulerName: { + description: "SchedulerName specifies the scheduler to be used to dispatch the Pod", + type: "string" + }, + securityContext: { + description: "SecurityContext holds pod-level security attributes and common container settings.\nOptional: Defaults to empty. See type description for default values of each field.\nSee Pod.spec.securityContext (API version: v1)", + "x-kubernetes-preserve-unknown-fields": true + }, + tolerations: { + description: "If specified, the pod's tolerations.", + items: { + description: "The pod this Toleration is attached to tolerates any taint that matches\nthe triple using the matching operator .", + properties: { + effect: { + description: "Effect indicates the taint effect to match. Empty means match all taint effects.\nWhen specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.", + type: "string" + }, + key: { + description: "Key is the taint key that the toleration applies to. Empty means match all taint keys.\nIf the key is empty, operator must be Exists; this combination means to match all values and all keys.", + type: "string" + }, + operator: { + description: "Operator represents a key's relationship to the value.\nValid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.\nExists is equivalent to wildcard for value, so that a pod can\ntolerate all taints of a particular category.\nLt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).", + type: "string" + }, + tolerationSeconds: { + description: "TolerationSeconds represents the period of time the toleration (which must be\nof effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,\nit is not set, which means tolerate the taint forever (do not evict). Zero and\nnegative values will be treated as 0 (evict immediately) by the system.", + format: "int64", + type: "integer" + }, + value: { + description: "Value is the taint value the toleration matches to.\nIf the operator is Exists, the value should be empty, otherwise just a regular string.", + type: "string" + } + }, + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + topologySpreadConstraints: { + description: "TopologySpreadConstraints controls how Pods are spread across your cluster among\nfailure-domains such as regions, zones, nodes, and other user-defined topology domains.", + items: { + description: "TopologySpreadConstraint specifies how to spread matching pods among the given topology.", + properties: { + labelSelector: { + description: "LabelSelector is used to find matching pods.\nPods that match this label selector are counted to determine the number of pods\nin their corresponding topology domain.", + properties: { + matchExpressions: { + description: "matchExpressions is a list of label selector requirements. The requirements are ANDed.", + items: { + description: "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", + properties: { + key: { + description: "key is the label key that the selector applies to.", + type: "string" + }, + operator: { + description: "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", + type: "string" + }, + values: { + description: "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + required: ["key", "operator"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + matchLabels: { + additionalProperties: { + type: "string" + }, + description: "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", + type: "object" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + matchLabelKeys: { + description: "MatchLabelKeys is a set of pod label keys to select the pods over which\nspreading will be calculated. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are ANDed with labelSelector\nto select the group of existing pods over which spreading will be calculated\nfor the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector.\nMatchLabelKeys cannot be set when LabelSelector isn't set.\nKeys that don't exist in the incoming pod labels will\nbe ignored. A null or empty list means only match against labelSelector.\n\nThis is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default).", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + maxSkew: { + description: "MaxSkew describes the degree to which pods may be unevenly distributed.\nWhen `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference\nbetween the number of matching pods in the target topology and the global minimum.\nThe global minimum is the minimum number of matching pods in an eligible domain\nor zero if the number of eligible domains is less than MinDomains.\nFor example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same\nlabelSelector spread as 2/2/1:\nIn this case, the global minimum is 1.\n| zone1 | zone2 | zone3 |\n| P P | P P | P |\n- if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2;\nscheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2)\nviolate MaxSkew(1).\n- if MaxSkew is 2, incoming pod can be scheduled onto any zone.\nWhen `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence\nto topologies that satisfy it.\nIt's a required field. Default value is 1 and 0 is not allowed.", + format: "int32", + type: "integer" + }, + minDomains: { + description: "MinDomains indicates a minimum number of eligible domains.\nWhen the number of eligible domains with matching topology keys is less than minDomains,\nPod Topology Spread treats \"global minimum\" as 0, and then the calculation of Skew is performed.\nAnd when the number of eligible domains with matching topology keys equals or greater than minDomains,\nthis value has no effect on scheduling.\nAs a result, when the number of eligible domains is less than minDomains,\nscheduler won't schedule more than maxSkew Pods to those domains.\nIf value is nil, the constraint behaves as if MinDomains is equal to 1.\nValid values are integers greater than 0.\nWhen value is not nil, WhenUnsatisfiable must be DoNotSchedule.\n\nFor example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same\nlabelSelector spread as 2/2/2:\n| zone1 | zone2 | zone3 |\n| P P | P P | P P |\nThe number of domains is less than 5(MinDomains), so \"global minimum\" is treated as 0.\nIn this situation, new pod with the same labelSelector cannot be scheduled,\nbecause computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones,\nit will violate MaxSkew.", + format: "int32", + type: "integer" + }, + nodeAffinityPolicy: { + description: "NodeAffinityPolicy indicates how we will treat Pod's nodeAffinity/nodeSelector\nwhen calculating pod topology spread skew. Options are:\n- Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations.\n- Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations.\n\nIf this value is nil, the behavior is equivalent to the Honor policy.", + type: "string" + }, + nodeTaintsPolicy: { + description: "NodeTaintsPolicy indicates how we will treat node taints when calculating\npod topology spread skew. Options are:\n- Honor: nodes without taints, along with tainted nodes for which the incoming pod\nhas a toleration, are included.\n- Ignore: node taints are ignored. All nodes are included.\n\nIf this value is nil, the behavior is equivalent to the Ignore policy.", + type: "string" + }, + topologyKey: { + description: "TopologyKey is the key of node labels. Nodes that have a label with this key\nand identical values are considered to be in the same topology.\nWe consider each as a \"bucket\", and try to put balanced number\nof pods into each bucket.\nWe define a domain as a particular instance of a topology.\nAlso, we define an eligible domain as a domain whose nodes meet the requirements of\nnodeAffinityPolicy and nodeTaintsPolicy.\ne.g. If TopologyKey is \"kubernetes.io/hostname\", each Node is a domain of that topology.\nAnd, if TopologyKey is \"topology.kubernetes.io/zone\", each zone is a domain of that topology.\nIt's a required field.", + type: "string" + }, + whenUnsatisfiable: { + description: "WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy\nthe spread constraint.\n- DoNotSchedule (default) tells the scheduler not to schedule it.\n- ScheduleAnyway tells the scheduler to schedule the pod in any location,\n but giving higher precedence to topologies that would help reduce the\n skew.\nA constraint is considered \"Unsatisfiable\" for an incoming pod\nif and only if every possible node assignment for that pod would violate\n\"MaxSkew\" on some topology.\nFor example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same\nlabelSelector spread as 3/1/1:\n| zone1 | zone2 | zone3 |\n| P P P | P | P |\nIf WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled\nto zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies\nMaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler\nwon't make it *more* imbalanced.\nIt's a required field.", + type: "string" + } + }, + required: ["maxSkew", "topologyKey", "whenUnsatisfiable"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + volumes: { + description: "List of volumes that can be mounted by containers belonging to the pod.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes\nSee Pod.spec.volumes (API version: v1)", + "x-kubernetes-preserve-unknown-fields": true + } + }, + type: "object" + }, + taskServiceAccountName: { + type: "string" + }, + timeout: { + description: "Timeout", + type: "string" + } + }, + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + timeout: { + description: "Deprecated: use pipelineRunSpec.Timeouts.Pipeline instead\nTimeout", + type: "string" + }, + timeouts: { + description: "Timeouts", + properties: { + finally: { + description: "Finally", + type: "string" + }, + pipeline: { + description: "Pipeline", + type: "string" + }, + tasks: { + description: "Tasks", + type: "string" + } + }, + type: "object" + }, + workspaces: { + description: "Workspaces", + items: { + description: "WorkspaceBinding", + properties: { + configMap: { + description: "ConfigMap", + properties: { + defaultMode: { + description: "defaultMode is optional: mode bits used to set permissions on created files by default.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nDefaults to 0644.\nDirectories within the path are not affected by this setting.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", + format: "int32", + type: "integer" + }, + items: { + description: "items if unspecified, each key-value pair in the Data field of the referenced\nConfigMap will be projected into the volume as a file whose name is the\nkey and content is the value. If specified, the listed keys will be\nprojected into the specified paths, and unlisted keys will not be\npresent. If a key is specified which is not present in the ConfigMap,\nthe volume setup will error unless it is marked optional. Paths must be\nrelative and may not contain the '..' path or start with '..'.", + items: { + description: "Maps a string key to a path within a volume.", + properties: { + key: { + description: "key is the key to project.", + type: "string" + }, + mode: { + description: "mode is Optional: mode bits used to set permissions on this file.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nIf not specified, the volume defaultMode will be used.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", + format: "int32", + type: "integer" + }, + path: { + description: "path is the relative path of the file to map the key to.\nMay not be an absolute path.\nMay not contain the path element '..'.\nMay not start with the string '..'.", + type: "string" + } + }, + required: ["key", "path"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "optional specify whether the ConfigMap or its keys must be defined", + type: "boolean" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + csi: { + description: "CSI", + properties: { + driver: { + description: "driver is the name of the CSI driver that handles this volume.\nConsult with your admin for the correct name as registered in the cluster.", + type: "string" + }, + fsType: { + description: "fsType to mount. Ex. \"ext4\", \"xfs\", \"ntfs\".\nIf not provided, the empty value is passed to the associated CSI driver\nwhich will determine the default filesystem to apply.", + type: "string" + }, + nodePublishSecretRef: { + description: "nodePublishSecretRef is a reference to the secret object containing\nsensitive information to pass to the CSI driver to complete the CSI\nNodePublishVolume and NodeUnpublishVolume calls.\nThis field is optional, and may be empty if no secret is required. If the\nsecret object contains more than one secret, all secret references are passed.", + properties: { + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + readOnly: { + description: "readOnly specifies a read-only configuration for the volume.\nDefaults to false (read/write).", + type: "boolean" + }, + volumeAttributes: { + additionalProperties: { + type: "string" + }, + description: "volumeAttributes stores driver-specific properties that are passed to the CSI\ndriver. Consult your driver's documentation for supported values.", + type: "object" + } + }, + required: ["driver"], + type: "object" + }, + emptyDir: { + description: "EmptyDir", + properties: { + medium: { + description: "medium represents what type of storage medium should back this directory.\nThe default is \"\" which means to use the node's default medium.\nMust be an empty string (default) or Memory.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir", + type: "string" + }, + sizeLimit: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "sizeLimit is the total amount of local storage required for this EmptyDir volume.\nThe size limit is also applicable for memory medium.\nThe maximum usage on memory medium EmptyDir would be the minimum value between\nthe SizeLimit specified here and the sum of memory limits of all containers in a pod.\nThe default is nil which means that the limit is undefined.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir", + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + } + }, + type: "object" + }, + name: { + description: "Name", + type: "string" + }, + persistentVolumeClaim: { + description: "PersistentVolumeClaim", + properties: { + claimName: { + description: "claimName is the name of a PersistentVolumeClaim in the same namespace as the pod using this volume.\nMore info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims", + type: "string" + }, + readOnly: { + description: "readOnly Will force the ReadOnly setting in VolumeMounts.\nDefault false.", + type: "boolean" + } + }, + required: ["claimName"], + type: "object" + }, + projected: { + description: "Projected", + properties: { + defaultMode: { + description: "defaultMode are the mode bits used to set permissions on created files by default.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nDirectories within the path are not affected by this setting.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", + format: "int32", + type: "integer" + }, + sources: { + description: "sources is the list of volume projections. Each entry in this list\nhandles one source.", + items: { + description: "Projection that may be projected along with other supported volume types.\nExactly one of these fields must be set.", + properties: { + clusterTrustBundle: { + description: "ClusterTrustBundle allows a pod to access the `.spec.trustBundle` field\nof ClusterTrustBundle objects in an auto-updating file.\n\nAlpha, gated by the ClusterTrustBundleProjection feature gate.\n\nClusterTrustBundle objects can either be selected by name, or by the\ncombination of signer name and a label selector.\n\nKubelet performs aggressive normalization of the PEM contents written\ninto the pod filesystem. Esoteric PEM features such as inter-block\ncomments and block headers are stripped. Certificates are deduplicated.\nThe ordering of certificates within the file is arbitrary, and Kubelet\nmay change the order over time.", + properties: { + labelSelector: { + description: "Select all ClusterTrustBundles that match this label selector. Only has\neffect if signerName is set. Mutually-exclusive with name. If unset,\ninterpreted as \"match nothing\". If set but empty, interpreted as \"match\neverything\".", + properties: { + matchExpressions: { + description: "matchExpressions is a list of label selector requirements. The requirements are ANDed.", + items: { + description: "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", + properties: { + key: { + description: "key is the label key that the selector applies to.", + type: "string" + }, + operator: { + description: "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", + type: "string" + }, + values: { + description: "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + required: ["key", "operator"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + matchLabels: { + additionalProperties: { + type: "string" + }, + description: "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", + type: "object" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + name: { + description: "Select a single ClusterTrustBundle by object name. Mutually-exclusive\nwith signerName and labelSelector.", + type: "string" + }, + optional: { + description: "If true, don't block pod startup if the referenced ClusterTrustBundle(s)\naren't available. If using name, then the named ClusterTrustBundle is\nallowed not to exist. If using signerName, then the combination of\nsignerName and labelSelector is allowed to match zero\nClusterTrustBundles.", + type: "boolean" + }, + path: { + description: "Relative path from the volume root to write the bundle.", + type: "string" + }, + signerName: { + description: "Select all ClusterTrustBundles that match this signer name.\nMutually-exclusive with name. The contents of all selected\nClusterTrustBundles will be unified and deduplicated.", + type: "string" + } + }, + required: ["path"], + type: "object" + }, + configMap: { + description: "configMap information about the configMap data to project", + properties: { + items: { + description: "items if unspecified, each key-value pair in the Data field of the referenced\nConfigMap will be projected into the volume as a file whose name is the\nkey and content is the value. If specified, the listed keys will be\nprojected into the specified paths, and unlisted keys will not be\npresent. If a key is specified which is not present in the ConfigMap,\nthe volume setup will error unless it is marked optional. Paths must be\nrelative and may not contain the '..' path or start with '..'.", + items: { + description: "Maps a string key to a path within a volume.", + properties: { + key: { + description: "key is the key to project.", + type: "string" + }, + mode: { + description: "mode is Optional: mode bits used to set permissions on this file.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nIf not specified, the volume defaultMode will be used.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", + format: "int32", + type: "integer" + }, + path: { + description: "path is the relative path of the file to map the key to.\nMay not be an absolute path.\nMay not contain the path element '..'.\nMay not start with the string '..'.", + type: "string" + } + }, + required: ["key", "path"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "optional specify whether the ConfigMap or its keys must be defined", + type: "boolean" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + downwardAPI: { + description: "downwardAPI information about the downwardAPI data to project", + properties: { + items: { + description: "Items is a list of DownwardAPIVolume file", + items: { + description: "DownwardAPIVolumeFile represents information to create the file containing the pod field", + properties: { + fieldRef: { + description: "Required: Selects a field of the pod: only annotations, labels, name, namespace and uid are supported.", + properties: { + apiVersion: { + description: "Version of the schema the FieldPath is written in terms of, defaults to \"v1\".", + type: "string" + }, + fieldPath: { + description: "Path of the field to select in the specified API version.", + type: "string" + } + }, + required: ["fieldPath"], + type: "object", + "x-kubernetes-map-type": "atomic" + }, + mode: { + description: "Optional: mode bits used to set permissions on this file, must be an octal value\nbetween 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nIf not specified, the volume defaultMode will be used.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", + format: "int32", + type: "integer" + }, + path: { + description: "Required: Path is the relative path name of the file to be created. Must not be absolute or contain the '..' path. Must be utf-8 encoded. The first item of the relative path must not start with '..'", + type: "string" + }, + resourceFieldRef: { + description: "Selects a resource of the container: only resources limits and requests\n(limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported.", + properties: { + containerName: { + description: "Container name: required for volumes, optional for env vars", + type: "string" + }, + divisor: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Specifies the output format of the exposed resources, defaults to \"1\"", + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + }, + resource: { + description: "Required: resource to select", + type: "string" + } + }, + required: ["resource"], + type: "object", + "x-kubernetes-map-type": "atomic" + } + }, + required: ["path"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + podCertificate: { + description: "Projects an auto-rotating credential bundle (private key and certificate\nchain) that the pod can use either as a TLS client or server.\n\nKubelet generates a private key and uses it to send a\nPodCertificateRequest to the named signer. Once the signer approves the\nrequest and issues a certificate chain, Kubelet writes the key and\ncertificate chain to the pod filesystem. The pod does not start until\ncertificates have been issued for each podCertificate projected volume\nsource in its spec.\n\nKubelet will begin trying to rotate the certificate at the time indicated\nby the signer using the PodCertificateRequest.Status.BeginRefreshAt\ntimestamp.\n\nKubelet can write a single file, indicated by the credentialBundlePath\nfield, or separate files, indicated by the keyPath and\ncertificateChainPath fields.\n\nThe credential bundle is a single file in PEM format. The first PEM\nentry is the private key (in PKCS#8 format), and the remaining PEM\nentries are the certificate chain issued by the signer (typically,\nsigners will return their certificate chain in leaf-to-root order).\n\nPrefer using the credential bundle format, since your application code\ncan read it atomically. If you use keyPath and certificateChainPath,\nyour application must make two separate file reads. If these coincide\nwith a certificate rotation, it is possible that the private key and leaf\ncertificate you read may not correspond to each other. Your application\nwill need to check for this condition, and re-read until they are\nconsistent.\n\nThe named signer controls chooses the format of the certificate it\nissues; consult the signer implementation's documentation to learn how to\nuse the certificates it issues.", + properties: { + certificateChainPath: { + description: "Write the certificate chain at this path in the projected volume.\n\nMost applications should use credentialBundlePath. When using keyPath\nand certificateChainPath, your application needs to check that the key\nand leaf certificate are consistent, because it is possible to read the\nfiles mid-rotation.", + type: "string" + }, + credentialBundlePath: { + description: "Write the credential bundle at this path in the projected volume.\n\nThe credential bundle is a single file that contains multiple PEM blocks.\nThe first PEM block is a PRIVATE KEY block, containing a PKCS#8 private\nkey.\n\nThe remaining blocks are CERTIFICATE blocks, containing the issued\ncertificate chain from the signer (leaf and any intermediates).\n\nUsing credentialBundlePath lets your Pod's application code make a single\natomic read that retrieves a consistent key and certificate chain. If you\nproject them to separate files, your application code will need to\nadditionally check that the leaf certificate was issued to the key.", + type: "string" + }, + keyPath: { + description: "Write the key at this path in the projected volume.\n\nMost applications should use credentialBundlePath. When using keyPath\nand certificateChainPath, your application needs to check that the key\nand leaf certificate are consistent, because it is possible to read the\nfiles mid-rotation.", + type: "string" + }, + keyType: { + description: "The type of keypair Kubelet will generate for the pod.\n\nValid values are \"RSA3072\", \"RSA4096\", \"ECDSAP256\", \"ECDSAP384\",\n\"ECDSAP521\", and \"ED25519\".", + type: "string" + }, + maxExpirationSeconds: { + description: "maxExpirationSeconds is the maximum lifetime permitted for the\ncertificate.\n\nKubelet copies this value verbatim into the PodCertificateRequests it\ngenerates for this projection.\n\nIf omitted, kube-apiserver will set it to 86400(24 hours). kube-apiserver\nwill reject values shorter than 3600 (1 hour). The maximum allowable\nvalue is 7862400 (91 days).\n\nThe signer implementation is then free to issue a certificate with any\nlifetime *shorter* than MaxExpirationSeconds, but no shorter than 3600\nseconds (1 hour). This constraint is enforced by kube-apiserver.\n`kubernetes.io` signers will never issue certificates with a lifetime\nlonger than 24 hours.", + format: "int32", + type: "integer" + }, + signerName: { + description: "Kubelet's generated CSRs will be addressed to this signer.", + type: "string" + }, + userAnnotations: { + additionalProperties: { + type: "string" + }, + description: "userAnnotations allow pod authors to pass additional information to\nthe signer implementation. Kubernetes does not restrict or validate this\nmetadata in any way.\n\nThese values are copied verbatim into the `spec.unverifiedUserAnnotations` field of\nthe PodCertificateRequest objects that Kubelet creates.\n\nEntries are subject to the same validation as object metadata annotations,\nwith the addition that all keys must be domain-prefixed. No restrictions\nare placed on values, except an overall size limitation on the entire field.\n\nSigners should document the keys and values they support. Signers should\ndeny requests that contain keys they do not recognize.", + type: "object" + } + }, + required: ["keyType", "signerName"], + type: "object" + }, + secret: { + description: "secret information about the secret data to project", + properties: { + items: { + description: "items if unspecified, each key-value pair in the Data field of the referenced\nSecret will be projected into the volume as a file whose name is the\nkey and content is the value. If specified, the listed keys will be\nprojected into the specified paths, and unlisted keys will not be\npresent. If a key is specified which is not present in the Secret,\nthe volume setup will error unless it is marked optional. Paths must be\nrelative and may not contain the '..' path or start with '..'.", + items: { + description: "Maps a string key to a path within a volume.", + properties: { + key: { + description: "key is the key to project.", + type: "string" + }, + mode: { + description: "mode is Optional: mode bits used to set permissions on this file.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nIf not specified, the volume defaultMode will be used.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", + format: "int32", + type: "integer" + }, + path: { + description: "path is the relative path of the file to map the key to.\nMay not be an absolute path.\nMay not contain the path element '..'.\nMay not start with the string '..'.", + type: "string" + } + }, + required: ["key", "path"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "optional field specify whether the Secret or its key must be defined", + type: "boolean" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + serviceAccountToken: { + description: "serviceAccountToken is information about the serviceAccountToken data to project", + properties: { + audience: { + description: "audience is the intended audience of the token. A recipient of a token\nmust identify itself with an identifier specified in the audience of the\ntoken, and otherwise should reject the token. The audience defaults to the\nidentifier of the apiserver.", + type: "string" + }, + expirationSeconds: { + description: "expirationSeconds is the requested duration of validity of the service\naccount token. As the token approaches expiration, the kubelet volume\nplugin will proactively rotate the service account token. The kubelet will\nstart trying to rotate the token if the token is older than 80 percent of\nits time to live or if the token is older than 24 hours.Defaults to 1 hour\nand must be at least 10 minutes.", + format: "int64", + type: "integer" + }, + path: { + description: "path is the path relative to the mount point of the file to project the\ntoken into.", + type: "string" + } + }, + required: ["path"], + type: "object" + } + }, + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + secret: { + description: "Secret", + properties: { + defaultMode: { + description: "defaultMode is Optional: mode bits used to set permissions on created files by default.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values\nfor mode bits. Defaults to 0644.\nDirectories within the path are not affected by this setting.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", + format: "int32", + type: "integer" + }, + items: { + description: "items If unspecified, each key-value pair in the Data field of the referenced\nSecret will be projected into the volume as a file whose name is the\nkey and content is the value. If specified, the listed keys will be\nprojected into the specified paths, and unlisted keys will not be\npresent. If a key is specified which is not present in the Secret,\nthe volume setup will error unless it is marked optional. Paths must be\nrelative and may not contain the '..' path or start with '..'.", + items: { + description: "Maps a string key to a path within a volume.", + properties: { + key: { + description: "key is the key to project.", + type: "string" + }, + mode: { + description: "mode is Optional: mode bits used to set permissions on this file.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nIf not specified, the volume defaultMode will be used.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", + format: "int32", + type: "integer" + }, + path: { + description: "path is the relative path of the file to map the key to.\nMay not be an absolute path.\nMay not contain the path element '..'.\nMay not start with the string '..'.", + type: "string" + } + }, + required: ["key", "path"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + optional: { + description: "optional field specify whether the Secret or its keys must be defined", + type: "boolean" + }, + secretName: { + description: "secretName is the name of the secret in the pod's namespace to use.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#secret", + type: "string" + } + }, + type: "object" + }, + subPath: { + description: "SubPath", + type: "string" + }, + volumeClaimTemplate: { + description: "VolumeClaimTemplate", + "x-kubernetes-preserve-unknown-fields": true + } + }, + required: ["name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + status: { + description: "Status", + properties: { + annotations: { + additionalProperties: { + type: "string" + }, + description: "Annotations is additional Status fields for the Resource to save some\nadditional State as well as convey more information to the user. This is\nroughly akin to Annotations on any k8s resource, just the reconciler conveying\nricher information outwards.", + type: "object" + }, + childReferences: { + description: "ChildReferences", + items: { + description: "ChildStatusReference", + properties: { + apiVersion: { + type: "string" + }, + displayName: { + description: "DisplayName", + type: "string" + }, + kind: { + type: "string" + }, + name: { + description: "Name", + type: "string" + }, + pipelineTaskName: { + description: "PipelineTaskName", + type: "string" + }, + whenExpressions: { + description: "WhenExpressions", + items: { + description: "WhenExpression", + properties: { + cel: { + description: "CEL", + type: "string" + }, + input: { + description: "Input", + type: "string" + }, + operator: { + description: "Operator", + type: "string" + }, + values: { + description: "Values", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + completionTime: { + description: "CompletionTime", + format: "date-time", + type: "string" + }, + conditions: { + description: "Conditions the latest available observations of a resource's current state.", + items: { + description: "Condition defines a readiness condition for a Knative resource.\nSee: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties", + properties: { + lastTransitionTime: { + description: "LastTransitionTime is the last time the condition transitioned from one status to another.\nWe use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic\ndifferences (all other things held constant).", + type: "string" + }, + message: { + description: "A human readable message indicating details about the transition.", + type: "string" + }, + reason: { + description: "The reason for the condition's last transition.", + type: "string" + }, + severity: { + description: "Severity with which to treat failures of this type of condition.\nWhen this is not specified, it defaults to Error.", + type: "string" + }, + status: { + description: "Status of the condition, one of True, False, Unknown.", + type: "string" + }, + type: { + description: "Type of condition.", + type: "string" + } + }, + required: ["status", "type"], + type: "object" + }, + type: "array" + }, + finallyStartTime: { + description: "FinallyStartTime", + format: "date-time", + type: "string" + }, + observedGeneration: { + description: "ObservedGeneration is the 'Generation' of the Service that\nwas last processed by the controller.", + format: "int64", + type: "integer" + }, + pipelineResults: { + description: "PipelineResults", + items: { + description: "PipelineRunResult", + properties: { + name: { + description: "Name", + type: "string" + }, + value: { + description: "Value", + "x-kubernetes-preserve-unknown-fields": true + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + pipelineSpec: { + description: "PipelineSpec", + "x-kubernetes-preserve-unknown-fields": true + }, + provenance: { + description: "Provenance", + properties: { + configSource: { + description: "ConfigSource\nDeprecated: Use RefSource instead", + properties: { + digest: { + additionalProperties: { + type: "string" + }, + description: "Digest", + type: "object" + }, + entryPoint: { + description: "EntryPoint", + type: "string" + }, + uri: { + description: "URI", + type: "string" + } + }, + type: "object" + }, + featureFlags: { + description: "FeatureFlags", + properties: { + awaitSidecarReadiness: { + type: "boolean" + }, + coschedule: { + type: "string" + }, + disableCredsInit: { + type: "boolean" + }, + disableInlineSpec: { + type: "string" + }, + enableAPIFields: { + type: "string" + }, + enableArtifacts: { + type: "boolean" + }, + enableCELInWhenExpression: { + type: "boolean" + }, + enableConciseResolverSyntax: { + type: "boolean" + }, + enableKeepPodOnCancel: { + type: "boolean" + }, + enableKubernetesSidecar: { + type: "boolean" + }, + enableParamEnum: { + type: "boolean" + }, + enableProvenanceInStatus: { + type: "boolean" + }, + enableStepActions: { + description: "EnableStepActions is a no-op flag since StepActions are stable", + type: "boolean" + }, + enableTektonOCIBundles: { + description: "DeprecatedEnableTektonOCIBundles is maintained for backward compatibility\nto allow deletion of PipelineRuns created before v0.62.x.\nThis field is not used and can be removed in a future release\nonce we're confident old PipelineRuns have been cleaned up.\nSee issue #8359 for context.", + type: "boolean" + }, + enableTerminationMessageCompression: { + type: "boolean" + }, + enableWaitExponentialBackoff: { + type: "boolean" + }, + enforceNonfalsifiability: { + type: "string" + }, + maxResultSize: { + type: "integer" + }, + requireGitSSHSecretKnownHosts: { + type: "boolean" + }, + resultExtractionMethod: { + type: "string" + }, + runningInEnvWithInjectedSidecars: { + type: "boolean" + }, + sendCloudEventsForRuns: { + type: "boolean" + }, + setSecurityContext: { + type: "boolean" + }, + setSecurityContextReadOnlyRootFilesystem: { + type: "boolean" + }, + verificationNoMatchPolicy: { + description: "VerificationNoMatchPolicy is the feature flag for \"trusted-resources-verification-no-match-policy\"\nVerificationNoMatchPolicy can be set to \"ignore\", \"warn\" and \"fail\" values.\nignore: skip trusted resources verification when no matching verification policies found\nwarn: skip trusted resources verification when no matching verification policies found and log a warning\nfail: fail the taskrun or pipelines run if no matching verification policies found", + type: "string" + } + }, + type: "object" + }, + refSource: { + description: "RefSource", + properties: { + digest: { + additionalProperties: { + type: "string" + }, + description: "Digest", + type: "object" + }, + entryPoint: { + description: "EntryPoint", + type: "string" + }, + uri: { + description: "URI", + type: "string" + } + }, + type: "object" + } + }, + type: "object" + }, + runs: { + additionalProperties: { + description: "PipelineRunRunStatus", + properties: { + pipelineTaskName: { + description: "PipelineTaskName", + type: "string" + }, + status: { + description: "Status", + properties: { + annotations: { + additionalProperties: { + type: "string" + }, + description: "Annotations is additional Status fields for the Resource to save some\nadditional State as well as convey more information to the user. This is\nroughly akin to Annotations on any k8s resource, just the reconciler conveying\nricher information outwards.", + type: "object" + }, + completionTime: { + description: "CompletionTime is the time the build completed.", + format: "date-time", + type: "string" + }, + conditions: { + description: "Conditions the latest available observations of a resource's current state.", + items: { + description: "Condition defines a readiness condition for a Knative resource.\nSee: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties", + properties: { + lastTransitionTime: { + description: "LastTransitionTime is the last time the condition transitioned from one status to another.\nWe use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic\ndifferences (all other things held constant).", + type: "string" + }, + message: { + description: "A human readable message indicating details about the transition.", + type: "string" + }, + reason: { + description: "The reason for the condition's last transition.", + type: "string" + }, + severity: { + description: "Severity with which to treat failures of this type of condition.\nWhen this is not specified, it defaults to Error.", + type: "string" + }, + status: { + description: "Status of the condition, one of True, False, Unknown.", + type: "string" + }, + type: { + description: "Type of condition.", + type: "string" + } + }, + required: ["status", "type"], + type: "object" + }, + type: "array" + }, + extraFields: { + description: "ExtraFields holds arbitrary fields provided by the custom task\ncontroller.", + "x-kubernetes-preserve-unknown-fields": true + }, + observedGeneration: { + description: "ObservedGeneration is the 'Generation' of the Service that\nwas last processed by the controller.", + format: "int64", + type: "integer" + }, + results: { + description: "Results reports any output result values to be consumed by later\ntasks in a pipeline.", + items: { + description: "CustomRunResult used to describe the results of a task", + properties: { + name: { + description: "Name the given name", + type: "string" + }, + value: { + description: "Value the given value of the result", + type: "string" + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array" + }, + retriesStatus: { + description: "RetriesStatus contains the history of CustomRunStatus, in case of a retry.\nSee CustomRun.status (API version: tekton.dev/v1beta1)", + "x-kubernetes-preserve-unknown-fields": true + }, + startTime: { + description: "StartTime is the time the build is actually started.", + format: "date-time", + type: "string" + } + }, + type: "object" + }, + whenExpressions: { + description: "WhenExpressions", + items: { + description: "WhenExpression", + properties: { + cel: { + description: "CEL", + type: "string" + }, + input: { + description: "Input", + type: "string" + }, + operator: { + description: "Operator", + type: "string" + }, + values: { + description: "Values", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + description: "Runs", + type: "object" + }, + skippedTasks: { + description: "SkippedTasks", + items: { + description: "SkippedTask", + properties: { + name: { + description: "Name", + type: "string" + }, + reason: { + description: "Reason", + type: "string" + }, + whenExpressions: { + description: "WhenExpressions", + items: { + description: "WhenExpression", + properties: { + cel: { + description: "CEL", + type: "string" + }, + input: { + description: "Input", + type: "string" + }, + operator: { + description: "Operator", + type: "string" + }, + values: { + description: "Values", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + required: ["name", "reason"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + spanContext: { + additionalProperties: { + type: "string" + }, + description: "SpanContext", + type: "object" + }, + startTime: { + description: "StartTime", + format: "date-time", + type: "string" + }, + taskRuns: { + additionalProperties: { + description: "PipelineRunTaskRunStatus", + properties: { + pipelineTaskName: { + description: "PipelineTaskName", + type: "string" + }, + status: { + description: "Status", + properties: { + annotations: { + additionalProperties: { + type: "string" + }, + description: "Annotations is additional Status fields for the Resource to save some\nadditional State as well as convey more information to the user. This is\nroughly akin to Annotations on any k8s resource, just the reconciler conveying\nricher information outwards.", + type: "object" + }, + cloudEvents: { + description: "CloudEvents", + items: { + description: "CloudEventDelivery", + properties: { + status: { + description: "CloudEventDeliveryState", + properties: { + condition: { + description: "Condition", + type: "string" + }, + message: { + description: "Error", + type: "string" + }, + retryCount: { + description: "RetryCount", + format: "int32", + type: "integer" + }, + sentAt: { + description: "SentAt", + format: "date-time", + type: "string" + } + }, + required: ["message", "retryCount"], + type: "object" + }, + target: { + description: "Target", + type: "string" + } + }, + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + completionTime: { + description: "CompletionTime", + format: "date-time", + type: "string" + }, + conditions: { + description: "Conditions the latest available observations of a resource's current state.", + items: { + description: "Condition defines a readiness condition for a Knative resource.\nSee: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties", + properties: { + lastTransitionTime: { + description: "LastTransitionTime is the last time the condition transitioned from one status to another.\nWe use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic\ndifferences (all other things held constant).", + type: "string" + }, + message: { + description: "A human readable message indicating details about the transition.", + type: "string" + }, + reason: { + description: "The reason for the condition's last transition.", + type: "string" + }, + severity: { + description: "Severity with which to treat failures of this type of condition.\nWhen this is not specified, it defaults to Error.", + type: "string" + }, + status: { + description: "Status of the condition, one of True, False, Unknown.", + type: "string" + }, + type: { + description: "Type of condition.", + type: "string" + } + }, + required: ["status", "type"], + type: "object" + }, + type: "array" + }, + observedGeneration: { + description: "ObservedGeneration is the 'Generation' of the Service that\nwas last processed by the controller.", + format: "int64", + type: "integer" + }, + podName: { + description: "PodName", + type: "string" + }, + provenance: { + description: "Provenance", + properties: { + configSource: { + description: "ConfigSource\nDeprecated: Use RefSource instead", + properties: { + digest: { + additionalProperties: { + type: "string" + }, + description: "Digest", + type: "object" + }, + entryPoint: { + description: "EntryPoint", + type: "string" + }, + uri: { + description: "URI", + type: "string" + } + }, + type: "object" + }, + featureFlags: { + description: "FeatureFlags", + properties: { + awaitSidecarReadiness: { + type: "boolean" + }, + coschedule: { + type: "string" + }, + disableCredsInit: { + type: "boolean" + }, + disableInlineSpec: { + type: "string" + }, + enableAPIFields: { + type: "string" + }, + enableArtifacts: { + type: "boolean" + }, + enableCELInWhenExpression: { + type: "boolean" + }, + enableConciseResolverSyntax: { + type: "boolean" + }, + enableKeepPodOnCancel: { + type: "boolean" + }, + enableKubernetesSidecar: { + type: "boolean" + }, + enableParamEnum: { + type: "boolean" + }, + enableProvenanceInStatus: { + type: "boolean" + }, + enableStepActions: { + description: "EnableStepActions is a no-op flag since StepActions are stable", + type: "boolean" + }, + enableTektonOCIBundles: { + description: "DeprecatedEnableTektonOCIBundles is maintained for backward compatibility\nto allow deletion of PipelineRuns created before v0.62.x.\nThis field is not used and can be removed in a future release\nonce we're confident old PipelineRuns have been cleaned up.\nSee issue #8359 for context.", + type: "boolean" + }, + enableTerminationMessageCompression: { + type: "boolean" + }, + enableWaitExponentialBackoff: { + type: "boolean" + }, + enforceNonfalsifiability: { + type: "string" + }, + maxResultSize: { + type: "integer" + }, + requireGitSSHSecretKnownHosts: { + type: "boolean" + }, + resultExtractionMethod: { + type: "string" + }, + runningInEnvWithInjectedSidecars: { + type: "boolean" + }, + sendCloudEventsForRuns: { + type: "boolean" + }, + setSecurityContext: { + type: "boolean" + }, + setSecurityContextReadOnlyRootFilesystem: { + type: "boolean" + }, + verificationNoMatchPolicy: { + description: "VerificationNoMatchPolicy is the feature flag for \"trusted-resources-verification-no-match-policy\"\nVerificationNoMatchPolicy can be set to \"ignore\", \"warn\" and \"fail\" values.\nignore: skip trusted resources verification when no matching verification policies found\nwarn: skip trusted resources verification when no matching verification policies found and log a warning\nfail: fail the taskrun or pipelines run if no matching verification policies found", + type: "string" + } + }, + type: "object" + }, + refSource: { + description: "RefSource", + properties: { + digest: { + additionalProperties: { + type: "string" + }, + description: "Digest", + type: "object" + }, + entryPoint: { + description: "EntryPoint", + type: "string" + }, + uri: { + description: "URI", + type: "string" + } + }, + type: "object" + } + }, + type: "object" + }, + resourcesResult: { + description: "ResourcesResult\nDeprecated: this field is not populated and is preserved only for backwards compatibility", + items: { + description: "RunResult is used to write key/value pairs to TaskRun pod termination messages.\nThe key/value pairs may come from the entrypoint binary, or represent a TaskRunResult.\nIf they represent a TaskRunResult, the key is the name of the result and the value is the\nJSON-serialized value of the result.", + properties: { + key: { + type: "string" + }, + resourceName: { + description: "ResourceName may be used in tests, but it is not populated in termination messages.\nIt is preserved here for backwards compatibility and will not be ported to v1.", + type: "string" + }, + type: { + description: "ResultType used to find out whether a RunResult is from a task result or not\nNote that ResultsType is another type which is used to define the data type\n(e.g. string, array, etc) we used for Results", + type: "integer" + }, + value: { + type: "string" + } + }, + required: ["key", "value"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + retriesStatus: { + description: "RetriesStatus", + "x-kubernetes-preserve-unknown-fields": true + }, + sidecars: { + description: "Sidecars", + items: { + description: "SidecarState", + properties: { + container: { + type: "string" + }, + imageID: { + type: "string" + }, + name: { + type: "string" + }, + running: { + description: "Details about a running container", + properties: { + startedAt: { + description: "Time at which the container was last (re-)started", + format: "date-time", + type: "string" + } + }, + type: "object" + }, + terminated: { + description: "Details about a terminated container", + properties: { + containerID: { + description: "Container's ID in the format '://'", + type: "string" + }, + exitCode: { + description: "Exit status from the last termination of the container", + format: "int32", + type: "integer" + }, + finishedAt: { + description: "Time at which the container last terminated", + format: "date-time", + type: "string" + }, + message: { + description: "Message regarding the last termination of the container", + type: "string" + }, + reason: { + description: "(brief) reason from the last termination of the container", + type: "string" + }, + signal: { + description: "Signal from the last termination of the container", + format: "int32", + type: "integer" + }, + startedAt: { + description: "Time at which previous execution of the container started", + format: "date-time", + type: "string" + } + }, + required: ["exitCode"], + type: "object" + }, + waiting: { + description: "Details about a waiting container", + properties: { + message: { + description: "Message regarding why the container is not yet running.", + type: "string" + }, + reason: { + description: "(brief) reason the container is not yet running.", + type: "string" + } + }, + type: "object" + } + }, + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + spanContext: { + additionalProperties: { + type: "string" + }, + description: "SpanContext", + type: "object" + }, + startTime: { + description: "StartTime", + format: "date-time", + type: "string" + }, + steps: { + description: "Steps", + items: { + description: "StepState", + properties: { + container: { + type: "string" + }, + imageID: { + type: "string" + }, + inputs: { + items: { + description: "Artifact", + properties: { + buildOutput: { + description: "BuildOutput", + type: "boolean" + }, + name: { + description: "Name", + type: "string" + }, + values: { + description: "Values", + items: { + description: "ArtifactValue", + properties: { + digest: { + additionalProperties: { + type: "string" + }, + type: "object" + }, + uri: { + type: "string" + } + }, + type: "object" + }, + type: "array" + } + }, + type: "object" + }, + type: "array" + }, + name: { + type: "string" + }, + outputs: { + items: { + description: "Artifact", + properties: { + buildOutput: { + description: "BuildOutput", + type: "boolean" + }, + name: { + description: "Name", + type: "string" + }, + values: { + description: "Values", + items: { + description: "ArtifactValue", + properties: { + digest: { + additionalProperties: { + type: "string" + }, + type: "object" + }, + uri: { + type: "string" + } + }, + type: "object" + }, + type: "array" + } + }, + type: "object" + }, + type: "array" + }, + provenance: { + description: "Provenance", + properties: { + configSource: { + description: "ConfigSource\nDeprecated: Use RefSource instead", + properties: { + digest: { + additionalProperties: { + type: "string" + }, + description: "Digest", + type: "object" + }, + entryPoint: { + description: "EntryPoint", + type: "string" + }, + uri: { + description: "URI", + type: "string" + } + }, + type: "object" + }, + featureFlags: { + description: "FeatureFlags", + properties: { + awaitSidecarReadiness: { + type: "boolean" + }, + coschedule: { + type: "string" + }, + disableCredsInit: { + type: "boolean" + }, + disableInlineSpec: { + type: "string" + }, + enableAPIFields: { + type: "string" + }, + enableArtifacts: { + type: "boolean" + }, + enableCELInWhenExpression: { + type: "boolean" + }, + enableConciseResolverSyntax: { + type: "boolean" + }, + enableKeepPodOnCancel: { + type: "boolean" + }, + enableKubernetesSidecar: { + type: "boolean" + }, + enableParamEnum: { + type: "boolean" + }, + enableProvenanceInStatus: { + type: "boolean" + }, + enableStepActions: { + description: "EnableStepActions is a no-op flag since StepActions are stable", + type: "boolean" + }, + enableTektonOCIBundles: { + description: "DeprecatedEnableTektonOCIBundles is maintained for backward compatibility\nto allow deletion of PipelineRuns created before v0.62.x.\nThis field is not used and can be removed in a future release\nonce we're confident old PipelineRuns have been cleaned up.\nSee issue #8359 for context.", + type: "boolean" + }, + enableTerminationMessageCompression: { + type: "boolean" + }, + enableWaitExponentialBackoff: { + type: "boolean" + }, + enforceNonfalsifiability: { + type: "string" + }, + maxResultSize: { + type: "integer" + }, + requireGitSSHSecretKnownHosts: { + type: "boolean" + }, + resultExtractionMethod: { + type: "string" + }, + runningInEnvWithInjectedSidecars: { + type: "boolean" + }, + sendCloudEventsForRuns: { + type: "boolean" + }, + setSecurityContext: { + type: "boolean" + }, + setSecurityContextReadOnlyRootFilesystem: { + type: "boolean" + }, + verificationNoMatchPolicy: { + description: "VerificationNoMatchPolicy is the feature flag for \"trusted-resources-verification-no-match-policy\"\nVerificationNoMatchPolicy can be set to \"ignore\", \"warn\" and \"fail\" values.\nignore: skip trusted resources verification when no matching verification policies found\nwarn: skip trusted resources verification when no matching verification policies found and log a warning\nfail: fail the taskrun or pipelines run if no matching verification policies found", + type: "string" + } + }, + type: "object" + }, + refSource: { + description: "RefSource", + properties: { + digest: { + additionalProperties: { + type: "string" + }, + description: "Digest", + type: "object" + }, + entryPoint: { + description: "EntryPoint", + type: "string" + }, + uri: { + description: "URI", + type: "string" + } + }, + type: "object" + } + }, + type: "object" + }, + results: { + items: { + description: "TaskRunResult", + properties: { + name: { + description: "Name", + type: "string" + }, + type: { + description: "Type", + type: "string" + }, + value: { + description: "Value", + "x-kubernetes-preserve-unknown-fields": true + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array" + }, + running: { + description: "Details about a running container", + properties: { + startedAt: { + description: "Time at which the container was last (re-)started", + format: "date-time", + type: "string" + } + }, + type: "object" + }, + terminated: { + description: "Details about a terminated container", + properties: { + containerID: { + description: "Container's ID in the format '://'", + type: "string" + }, + exitCode: { + description: "Exit status from the last termination of the container", + format: "int32", + type: "integer" + }, + finishedAt: { + description: "Time at which the container last terminated", + format: "date-time", + type: "string" + }, + message: { + description: "Message regarding the last termination of the container", + type: "string" + }, + reason: { + description: "(brief) reason from the last termination of the container", + type: "string" + }, + signal: { + description: "Signal from the last termination of the container", + format: "int32", + type: "integer" + }, + startedAt: { + description: "Time at which previous execution of the container started", + format: "date-time", + type: "string" + } + }, + required: ["exitCode"], + type: "object" + }, + waiting: { + description: "Details about a waiting container", + properties: { + message: { + description: "Message regarding why the container is not yet running.", + type: "string" + }, + reason: { + description: "(brief) reason the container is not yet running.", + type: "string" + } + }, + type: "object" + } + }, + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + taskResults: { + description: "TaskRunResults", + items: { + description: "TaskRunResult", + properties: { + name: { + description: "Name", + type: "string" + }, + type: { + description: "Type", + type: "string" + }, + value: { + description: "Value", + "x-kubernetes-preserve-unknown-fields": true + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + taskSpec: { + description: "TaskSpec", + "x-kubernetes-preserve-unknown-fields": true + } + }, + required: ["podName"], + type: "object" + }, + whenExpressions: { + description: "WhenExpressions", + items: { + description: "WhenExpression", + properties: { + cel: { + description: "CEL", + type: "string" + }, + input: { + description: "Input", + type: "string" + }, + operator: { + description: "Operator", + type: "string" + }, + values: { + description: "Values", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + description: "TaskRuns", + type: "object" + } + }, + type: "object" + } + }, + type: "object" + } + }, + served: true, + storage: false, + subresources: { + status: {} + } + }, { + additionalPrinterColumns: [{ + jsonPath: ".status.conditions[?(@.type==\"Succeeded\")].status", + name: "Succeeded", + type: "string" + }, { + jsonPath: ".status.conditions[?(@.type==\"Succeeded\")].reason", + name: "Reason", + type: "string" + }, { + jsonPath: ".status.startTime", + name: "StartTime", + type: "date" + }, { + jsonPath: ".status.completionTime", + name: "CompletionTime", + type: "date" + }], + name: "v1", + schema: { + openAPIV3Schema: { + description: "PipelineRun represents a single execution of a Pipeline. PipelineRuns are how\nthe graph of Tasks declared in a Pipeline are executed; they specify inputs\nto Pipelines such as parameter values and capture operational aspects of the\nTasks execution such as service account and tolerations. Creating a\nPipelineRun creates TaskRuns for Tasks in the referenced Pipeline.", + properties: { + apiVersion: { + description: "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", + type: "string" + }, + kind: { + description: "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + type: "string" + }, + metadata: { + type: "object" + }, + spec: { + description: "PipelineRunSpec defines the desired state of PipelineRun", + properties: { + managedBy: { + description: "ManagedBy indicates which controller is responsible for reconciling\nthis resource. If unset or set to \"tekton.dev/pipeline\", the default\nTekton controller will manage this resource.\nThis field is immutable.", + type: "string" + }, + params: { + description: "Params is a list of parameter names and values.", + items: { + description: "Param declares an ParamValues to use for the parameter called name.", + properties: { + name: { + type: "string" + }, + value: { + "x-kubernetes-preserve-unknown-fields": true + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + pipelineRef: { + description: "PipelineRef can be used to refer to a specific instance of a Pipeline.", + properties: { + apiVersion: { + description: "API version of the referent", + type: "string" + }, + name: { + description: "Name of the referent; More info: http://kubernetes.io/docs/user-guide/identifiers#names", + type: "string" + }, + params: { + description: "Params contains the parameters used to identify the\nreferenced Tekton resource. Example entries might include\n\"repo\" or \"path\" but the set of params ultimately depends on\nthe chosen resolver.", + items: { + description: "Param declares an ParamValues to use for the parameter called name.", + properties: { + name: { + type: "string" + }, + value: { + "x-kubernetes-preserve-unknown-fields": true + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + resolver: { + description: "Resolver is the name of the resolver that should perform\nresolution of the referenced Tekton resource, such as \"git\".", + type: "string" + } + }, + type: "object" + }, + pipelineSpec: { + description: "Specifying PipelineSpec can be disabled by setting\n`disable-inline-spec` feature flag.\nSee Pipeline.spec (API version: tekton.dev/v1)", + "x-kubernetes-preserve-unknown-fields": true + }, + status: { + description: "Used for cancelling a pipelinerun (and maybe more later on)", + type: "string" + }, + taskRunSpecs: { + description: "TaskRunSpecs holds a set of runtime specs", + items: { + description: "PipelineTaskRunSpec can be used to configure specific\nspecs for a concrete Task", + properties: { + computeResources: { + description: "Compute resources to use for this TaskRun", + properties: { + claims: { + description: "Claims lists the names of resources, defined in spec.resourceClaims,\nthat are used by this container.\n\nThis field depends on the\nDynamicResourceAllocation feature gate.\n\nThis field is immutable. It can only be set for containers.", + items: { + description: "ResourceClaim references one entry in PodSpec.ResourceClaims.", + properties: { + name: { + description: "Name must match the name of one entry in pod.spec.resourceClaims of\nthe Pod where this field is used. It makes that resource available\ninside a container.", + type: "string" + }, + request: { + description: "Request is the name chosen for a request in the referenced claim.\nIf empty, everything from the claim is made available, otherwise\nonly the result of this request.", + type: "string" + } + }, + required: ["name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-map-keys": ["name"], + "x-kubernetes-list-type": "map" + }, + limits: { + additionalProperties: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + }, + description: "Limits describes the maximum amount of compute resources allowed.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + type: "object" + }, + requests: { + additionalProperties: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + }, + description: "Requests describes the minimum amount of compute resources required.\nIf Requests is omitted for a container, it defaults to Limits if that is explicitly specified,\notherwise to an implementation-defined value. Requests cannot exceed Limits.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + type: "object" + } + }, + type: "object" + }, + metadata: { + description: "PipelineTaskMetadata contains the labels or annotations for an EmbeddedTask", + properties: { + annotations: { + additionalProperties: { + type: "string" + }, + type: "object" + }, + labels: { + additionalProperties: { + type: "string" + }, + type: "object" + } + }, + type: "object" + }, + pipelineTaskName: { + type: "string" + }, + podTemplate: { + description: "PodTemplate holds pod specific configuration", + properties: { + affinity: { + description: "If specified, the pod's scheduling constraints.\nSee Pod.spec.affinity (API version: v1)", + "x-kubernetes-preserve-unknown-fields": true + }, + automountServiceAccountToken: { + description: "AutomountServiceAccountToken indicates whether pods running as this\nservice account should have an API token automatically mounted.", + type: "boolean" + }, + dnsConfig: { + description: "Specifies the DNS parameters of a pod.\nParameters specified here will be merged to the generated DNS\nconfiguration based on DNSPolicy.", + properties: { + nameservers: { + description: "A list of DNS name server IP addresses.\nThis will be appended to the base nameservers generated from DNSPolicy.\nDuplicated nameservers will be removed.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + options: { + description: "A list of DNS resolver options.\nThis will be merged with the base options generated from DNSPolicy.\nDuplicated entries will be removed. Resolution options given in Options\nwill override those that appear in the base DNSPolicy.", + items: { + description: "PodDNSConfigOption defines DNS resolver options of a pod.", + properties: { + name: { + description: "Name is this DNS resolver option's name.\nRequired.", + type: "string" + }, + value: { + description: "Value is this DNS resolver option's value.", + type: "string" + } + }, + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + searches: { + description: "A list of DNS search domains for host-name lookup.\nThis will be appended to the base search paths generated from DNSPolicy.\nDuplicated search paths will be removed.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + dnsPolicy: { + description: "Set DNS policy for the pod. Defaults to \"ClusterFirst\". Valid values are\n'ClusterFirst', 'Default' or 'None'. DNS parameters given in DNSConfig\nwill be merged with the policy selected with DNSPolicy.", + type: "string" + }, + enableServiceLinks: { + description: "EnableServiceLinks indicates whether information about services should be injected into pod's\nenvironment variables, matching the syntax of Docker links.\nOptional: Defaults to true.", + type: "boolean" + }, + env: { + description: "List of environment variables that can be provided to the containers belonging to the pod.", + items: { + description: "EnvVar represents an environment variable present in a Container.", + properties: { + name: { + description: "Name of the environment variable.\nMay consist of any printable ASCII characters except '='.", + type: "string" + }, + value: { + description: "Variable references $(VAR_NAME) are expanded\nusing the previously defined environment variables in the container and\nany service environment variables. If a variable cannot be resolved,\nthe reference in the input string will be unchanged. Double $$ are reduced\nto a single $, which allows for escaping the $(VAR_NAME) syntax: i.e.\n\"$$(VAR_NAME)\" will produce the string literal \"$(VAR_NAME)\".\nEscaped references will never be expanded, regardless of whether the variable\nexists or not.\nDefaults to \"\".", + type: "string" + }, + valueFrom: { + description: "Source for the environment variable's value. Cannot be used if value is not empty.", + properties: { + configMapKeyRef: { + description: "Selects a key of a ConfigMap.", + properties: { + key: { + description: "The key to select.", + type: "string" + }, + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "Specify whether the ConfigMap or its key must be defined", + type: "boolean" + } + }, + required: ["key"], + type: "object", + "x-kubernetes-map-type": "atomic" + }, + fieldRef: { + description: "Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`,\nspec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs.", + properties: { + apiVersion: { + description: "Version of the schema the FieldPath is written in terms of, defaults to \"v1\".", + type: "string" + }, + fieldPath: { + description: "Path of the field to select in the specified API version.", + type: "string" + } + }, + required: ["fieldPath"], + type: "object", + "x-kubernetes-map-type": "atomic" + }, + fileKeyRef: { + description: "FileKeyRef selects a key of the env file.\nRequires the EnvFiles feature gate to be enabled.", + properties: { + key: { + description: "The key within the env file. An invalid key will prevent the pod from starting.\nThe keys defined within a source may consist of any printable ASCII characters except '='.\nDuring Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.", + type: "string" + }, + optional: { + default: false, + description: "Specify whether the file or its key must be defined. If the file or key\ndoes not exist, then the env var is not published.\nIf optional is set to true and the specified key does not exist,\nthe environment variable will not be set in the Pod's containers.\n\nIf optional is set to false and the specified key does not exist,\nan error will be returned during Pod creation.", + type: "boolean" + }, + path: { + description: "The path within the volume from which to select the file.\nMust be relative and may not contain the '..' path or start with '..'.", + type: "string" + }, + volumeName: { + description: "The name of the volume mount containing the env file.", + type: "string" + } + }, + required: ["key", "path", "volumeName"], + type: "object", + "x-kubernetes-map-type": "atomic" + }, + resourceFieldRef: { + description: "Selects a resource of the container: only resources limits and requests\n(limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported.", + properties: { + containerName: { + description: "Container name: required for volumes, optional for env vars", + type: "string" + }, + divisor: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Specifies the output format of the exposed resources, defaults to \"1\"", + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + }, + resource: { + description: "Required: resource to select", + type: "string" + } + }, + required: ["resource"], + type: "object", + "x-kubernetes-map-type": "atomic" + }, + secretKeyRef: { + description: "Selects a key of a secret in the pod's namespace", + properties: { + key: { + description: "The key of the secret to select from. Must be a valid secret key.", + type: "string" + }, + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "Specify whether the Secret or its key must be defined", + type: "boolean" + } + }, + required: ["key"], + type: "object", + "x-kubernetes-map-type": "atomic" + } + }, + type: "object" + } + }, + required: ["name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + hostAliases: { + description: "HostAliases is an optional list of hosts and IPs that will be injected into the pod's hosts\nfile if specified. This is only valid for non-hostNetwork pods.", + items: { + description: "HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the\npod's hosts file.", + properties: { + hostnames: { + description: "Hostnames for the above IP address.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + ip: { + description: "IP address of the host file entry.", + type: "string" + } + }, + required: ["ip"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + hostNetwork: { + description: "HostNetwork specifies whether the pod may use the node network namespace", + type: "boolean" + }, + hostUsers: { + description: "HostUsers indicates whether the pod will use the host's user namespace.\nOptional: Default to true.\nIf set to true or not present, the pod will be run in the host user namespace, useful\nfor when the pod needs a feature only available to the host user namespace, such as\nloading a kernel module with CAP_SYS_MODULE.\nWhen set to false, a new user namespace is created for the pod. Setting false\nis useful to mitigating container breakout vulnerabilities such as allowing\ncontainers to run as root without their user having root privileges on the host.\nThis field depends on the kubernetes feature gate UserNamespacesSupport being enabled.", + type: "boolean" + }, + imagePullSecrets: { + description: "ImagePullSecrets gives the name of the secret used by the pod to pull the image if specified", + items: { + description: "LocalObjectReference contains enough information to let you locate the\nreferenced object inside the same namespace.", + properties: { + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + nodeSelector: { + additionalProperties: { + type: "string" + }, + description: "NodeSelector is a selector which must be true for the pod to fit on a node.\nSelector which must match a node's labels for the pod to be scheduled on that node.\nMore info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/", + type: "object" + }, + priorityClassName: { + description: "If specified, indicates the pod's priority. \"system-node-critical\" and\n\"system-cluster-critical\" are two special keywords which indicate the\nhighest priorities with the former being the highest priority. Any other\nname must be defined by creating a PriorityClass object with that name.\nIf not specified, the pod priority will be default or zero if there is no\ndefault.", + type: "string" + }, + runtimeClassName: { + description: "RuntimeClassName refers to a RuntimeClass object in the node.k8s.io\ngroup, which should be used to run this pod. If no RuntimeClass resource\nmatches the named class, the pod will not be run. If unset or empty, the\n\"legacy\" RuntimeClass will be used, which is an implicit class with an\nempty definition that uses the default runtime handler.\nMore info: https://git.k8s.io/enhancements/keps/sig-node/runtime-class.md\nThis is a beta feature as of Kubernetes v1.14.", + type: "string" + }, + schedulerName: { + description: "SchedulerName specifies the scheduler to be used to dispatch the Pod", + type: "string" + }, + securityContext: { + description: "SecurityContext holds pod-level security attributes and common container settings.\nOptional: Defaults to empty. See type description for default values of each field.\nSee Pod.spec.securityContext (API version: v1)", + "x-kubernetes-preserve-unknown-fields": true + }, + tolerations: { + description: "If specified, the pod's tolerations.", + items: { + description: "The pod this Toleration is attached to tolerates any taint that matches\nthe triple using the matching operator .", + properties: { + effect: { + description: "Effect indicates the taint effect to match. Empty means match all taint effects.\nWhen specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.", + type: "string" + }, + key: { + description: "Key is the taint key that the toleration applies to. Empty means match all taint keys.\nIf the key is empty, operator must be Exists; this combination means to match all values and all keys.", + type: "string" + }, + operator: { + description: "Operator represents a key's relationship to the value.\nValid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.\nExists is equivalent to wildcard for value, so that a pod can\ntolerate all taints of a particular category.\nLt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).", + type: "string" + }, + tolerationSeconds: { + description: "TolerationSeconds represents the period of time the toleration (which must be\nof effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,\nit is not set, which means tolerate the taint forever (do not evict). Zero and\nnegative values will be treated as 0 (evict immediately) by the system.", + format: "int64", + type: "integer" + }, + value: { + description: "Value is the taint value the toleration matches to.\nIf the operator is Exists, the value should be empty, otherwise just a regular string.", + type: "string" + } + }, + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + topologySpreadConstraints: { + description: "TopologySpreadConstraints controls how Pods are spread across your cluster among\nfailure-domains such as regions, zones, nodes, and other user-defined topology domains.", + items: { + description: "TopologySpreadConstraint specifies how to spread matching pods among the given topology.", + properties: { + labelSelector: { + description: "LabelSelector is used to find matching pods.\nPods that match this label selector are counted to determine the number of pods\nin their corresponding topology domain.", + properties: { + matchExpressions: { + description: "matchExpressions is a list of label selector requirements. The requirements are ANDed.", + items: { + description: "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", + properties: { + key: { + description: "key is the label key that the selector applies to.", + type: "string" + }, + operator: { + description: "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", + type: "string" + }, + values: { + description: "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + required: ["key", "operator"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + matchLabels: { + additionalProperties: { + type: "string" + }, + description: "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", + type: "object" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + matchLabelKeys: { + description: "MatchLabelKeys is a set of pod label keys to select the pods over which\nspreading will be calculated. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are ANDed with labelSelector\nto select the group of existing pods over which spreading will be calculated\nfor the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector.\nMatchLabelKeys cannot be set when LabelSelector isn't set.\nKeys that don't exist in the incoming pod labels will\nbe ignored. A null or empty list means only match against labelSelector.\n\nThis is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default).", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + maxSkew: { + description: "MaxSkew describes the degree to which pods may be unevenly distributed.\nWhen `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference\nbetween the number of matching pods in the target topology and the global minimum.\nThe global minimum is the minimum number of matching pods in an eligible domain\nor zero if the number of eligible domains is less than MinDomains.\nFor example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same\nlabelSelector spread as 2/2/1:\nIn this case, the global minimum is 1.\n| zone1 | zone2 | zone3 |\n| P P | P P | P |\n- if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2;\nscheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2)\nviolate MaxSkew(1).\n- if MaxSkew is 2, incoming pod can be scheduled onto any zone.\nWhen `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence\nto topologies that satisfy it.\nIt's a required field. Default value is 1 and 0 is not allowed.", + format: "int32", + type: "integer" + }, + minDomains: { + description: "MinDomains indicates a minimum number of eligible domains.\nWhen the number of eligible domains with matching topology keys is less than minDomains,\nPod Topology Spread treats \"global minimum\" as 0, and then the calculation of Skew is performed.\nAnd when the number of eligible domains with matching topology keys equals or greater than minDomains,\nthis value has no effect on scheduling.\nAs a result, when the number of eligible domains is less than minDomains,\nscheduler won't schedule more than maxSkew Pods to those domains.\nIf value is nil, the constraint behaves as if MinDomains is equal to 1.\nValid values are integers greater than 0.\nWhen value is not nil, WhenUnsatisfiable must be DoNotSchedule.\n\nFor example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same\nlabelSelector spread as 2/2/2:\n| zone1 | zone2 | zone3 |\n| P P | P P | P P |\nThe number of domains is less than 5(MinDomains), so \"global minimum\" is treated as 0.\nIn this situation, new pod with the same labelSelector cannot be scheduled,\nbecause computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones,\nit will violate MaxSkew.", + format: "int32", + type: "integer" + }, + nodeAffinityPolicy: { + description: "NodeAffinityPolicy indicates how we will treat Pod's nodeAffinity/nodeSelector\nwhen calculating pod topology spread skew. Options are:\n- Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations.\n- Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations.\n\nIf this value is nil, the behavior is equivalent to the Honor policy.", + type: "string" + }, + nodeTaintsPolicy: { + description: "NodeTaintsPolicy indicates how we will treat node taints when calculating\npod topology spread skew. Options are:\n- Honor: nodes without taints, along with tainted nodes for which the incoming pod\nhas a toleration, are included.\n- Ignore: node taints are ignored. All nodes are included.\n\nIf this value is nil, the behavior is equivalent to the Ignore policy.", + type: "string" + }, + topologyKey: { + description: "TopologyKey is the key of node labels. Nodes that have a label with this key\nand identical values are considered to be in the same topology.\nWe consider each as a \"bucket\", and try to put balanced number\nof pods into each bucket.\nWe define a domain as a particular instance of a topology.\nAlso, we define an eligible domain as a domain whose nodes meet the requirements of\nnodeAffinityPolicy and nodeTaintsPolicy.\ne.g. If TopologyKey is \"kubernetes.io/hostname\", each Node is a domain of that topology.\nAnd, if TopologyKey is \"topology.kubernetes.io/zone\", each zone is a domain of that topology.\nIt's a required field.", + type: "string" + }, + whenUnsatisfiable: { + description: "WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy\nthe spread constraint.\n- DoNotSchedule (default) tells the scheduler not to schedule it.\n- ScheduleAnyway tells the scheduler to schedule the pod in any location,\n but giving higher precedence to topologies that would help reduce the\n skew.\nA constraint is considered \"Unsatisfiable\" for an incoming pod\nif and only if every possible node assignment for that pod would violate\n\"MaxSkew\" on some topology.\nFor example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same\nlabelSelector spread as 3/1/1:\n| zone1 | zone2 | zone3 |\n| P P P | P | P |\nIf WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled\nto zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies\nMaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler\nwon't make it *more* imbalanced.\nIt's a required field.", + type: "string" + } + }, + required: ["maxSkew", "topologyKey", "whenUnsatisfiable"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + volumes: { + description: "List of volumes that can be mounted by containers belonging to the pod.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes\nSee Pod.spec.volumes (API version: v1)", + "x-kubernetes-preserve-unknown-fields": true + } + }, + type: "object" + }, + serviceAccountName: { + type: "string" + }, + sidecarSpecs: { + items: { + description: "TaskRunSidecarSpec is used to override the values of a Sidecar in the corresponding Task.", + properties: { + computeResources: { + description: "The resource requirements to apply to the Sidecar.", + properties: { + claims: { + description: "Claims lists the names of resources, defined in spec.resourceClaims,\nthat are used by this container.\n\nThis field depends on the\nDynamicResourceAllocation feature gate.\n\nThis field is immutable. It can only be set for containers.", + items: { + description: "ResourceClaim references one entry in PodSpec.ResourceClaims.", + properties: { + name: { + description: "Name must match the name of one entry in pod.spec.resourceClaims of\nthe Pod where this field is used. It makes that resource available\ninside a container.", + type: "string" + }, + request: { + description: "Request is the name chosen for a request in the referenced claim.\nIf empty, everything from the claim is made available, otherwise\nonly the result of this request.", + type: "string" + } + }, + required: ["name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-map-keys": ["name"], + "x-kubernetes-list-type": "map" + }, + limits: { + additionalProperties: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + }, + description: "Limits describes the maximum amount of compute resources allowed.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + type: "object" + }, + requests: { + additionalProperties: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + }, + description: "Requests describes the minimum amount of compute resources required.\nIf Requests is omitted for a container, it defaults to Limits if that is explicitly specified,\notherwise to an implementation-defined value. Requests cannot exceed Limits.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + type: "object" + } + }, + type: "object" + }, + name: { + description: "The name of the Sidecar to override.", + type: "string" + } + }, + required: ["computeResources", "name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + stepSpecs: { + items: { + description: "TaskRunStepSpec is used to override the values of a Step in the corresponding Task.", + properties: { + computeResources: { + description: "The resource requirements to apply to the Step.", + properties: { + claims: { + description: "Claims lists the names of resources, defined in spec.resourceClaims,\nthat are used by this container.\n\nThis field depends on the\nDynamicResourceAllocation feature gate.\n\nThis field is immutable. It can only be set for containers.", + items: { + description: "ResourceClaim references one entry in PodSpec.ResourceClaims.", + properties: { + name: { + description: "Name must match the name of one entry in pod.spec.resourceClaims of\nthe Pod where this field is used. It makes that resource available\ninside a container.", + type: "string" + }, + request: { + description: "Request is the name chosen for a request in the referenced claim.\nIf empty, everything from the claim is made available, otherwise\nonly the result of this request.", + type: "string" + } + }, + required: ["name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-map-keys": ["name"], + "x-kubernetes-list-type": "map" + }, + limits: { + additionalProperties: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + }, + description: "Limits describes the maximum amount of compute resources allowed.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + type: "object" + }, + requests: { + additionalProperties: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + }, + description: "Requests describes the minimum amount of compute resources required.\nIf Requests is omitted for a container, it defaults to Limits if that is explicitly specified,\notherwise to an implementation-defined value. Requests cannot exceed Limits.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + type: "object" + } + }, + type: "object" + }, + name: { + description: "The name of the Step to override.", + type: "string" + } + }, + required: ["computeResources", "name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + timeout: { + description: "Duration after which the TaskRun times out. Overrides the timeout specified\non the Task's spec if specified. Takes lower precedence to PipelineRun's\n`spec.timeouts.tasks`\nRefer Go's ParseDuration documentation for expected format: https://golang.org/pkg/time/#ParseDuration", + type: "string" + } + }, + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + taskRunTemplate: { + description: "TaskRunTemplate represent template of taskrun", + properties: { + podTemplate: { + description: "PodTemplate holds pod specific configuration", + properties: { + affinity: { + description: "If specified, the pod's scheduling constraints.\nSee Pod.spec.affinity (API version: v1)", + "x-kubernetes-preserve-unknown-fields": true + }, + automountServiceAccountToken: { + description: "AutomountServiceAccountToken indicates whether pods running as this\nservice account should have an API token automatically mounted.", + type: "boolean" + }, + dnsConfig: { + description: "Specifies the DNS parameters of a pod.\nParameters specified here will be merged to the generated DNS\nconfiguration based on DNSPolicy.", + properties: { + nameservers: { + description: "A list of DNS name server IP addresses.\nThis will be appended to the base nameservers generated from DNSPolicy.\nDuplicated nameservers will be removed.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + options: { + description: "A list of DNS resolver options.\nThis will be merged with the base options generated from DNSPolicy.\nDuplicated entries will be removed. Resolution options given in Options\nwill override those that appear in the base DNSPolicy.", + items: { + description: "PodDNSConfigOption defines DNS resolver options of a pod.", + properties: { + name: { + description: "Name is this DNS resolver option's name.\nRequired.", + type: "string" + }, + value: { + description: "Value is this DNS resolver option's value.", + type: "string" + } + }, + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + searches: { + description: "A list of DNS search domains for host-name lookup.\nThis will be appended to the base search paths generated from DNSPolicy.\nDuplicated search paths will be removed.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + dnsPolicy: { + description: "Set DNS policy for the pod. Defaults to \"ClusterFirst\". Valid values are\n'ClusterFirst', 'Default' or 'None'. DNS parameters given in DNSConfig\nwill be merged with the policy selected with DNSPolicy.", + type: "string" + }, + enableServiceLinks: { + description: "EnableServiceLinks indicates whether information about services should be injected into pod's\nenvironment variables, matching the syntax of Docker links.\nOptional: Defaults to true.", + type: "boolean" + }, + env: { + description: "List of environment variables that can be provided to the containers belonging to the pod.", + items: { + description: "EnvVar represents an environment variable present in a Container.", + properties: { + name: { + description: "Name of the environment variable.\nMay consist of any printable ASCII characters except '='.", + type: "string" + }, + value: { + description: "Variable references $(VAR_NAME) are expanded\nusing the previously defined environment variables in the container and\nany service environment variables. If a variable cannot be resolved,\nthe reference in the input string will be unchanged. Double $$ are reduced\nto a single $, which allows for escaping the $(VAR_NAME) syntax: i.e.\n\"$$(VAR_NAME)\" will produce the string literal \"$(VAR_NAME)\".\nEscaped references will never be expanded, regardless of whether the variable\nexists or not.\nDefaults to \"\".", + type: "string" + }, + valueFrom: { + description: "Source for the environment variable's value. Cannot be used if value is not empty.", + properties: { + configMapKeyRef: { + description: "Selects a key of a ConfigMap.", + properties: { + key: { + description: "The key to select.", + type: "string" + }, + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "Specify whether the ConfigMap or its key must be defined", + type: "boolean" + } + }, + required: ["key"], + type: "object", + "x-kubernetes-map-type": "atomic" + }, + fieldRef: { + description: "Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`,\nspec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs.", + properties: { + apiVersion: { + description: "Version of the schema the FieldPath is written in terms of, defaults to \"v1\".", + type: "string" + }, + fieldPath: { + description: "Path of the field to select in the specified API version.", + type: "string" + } + }, + required: ["fieldPath"], + type: "object", + "x-kubernetes-map-type": "atomic" + }, + fileKeyRef: { + description: "FileKeyRef selects a key of the env file.\nRequires the EnvFiles feature gate to be enabled.", + properties: { + key: { + description: "The key within the env file. An invalid key will prevent the pod from starting.\nThe keys defined within a source may consist of any printable ASCII characters except '='.\nDuring Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.", + type: "string" + }, + optional: { + default: false, + description: "Specify whether the file or its key must be defined. If the file or key\ndoes not exist, then the env var is not published.\nIf optional is set to true and the specified key does not exist,\nthe environment variable will not be set in the Pod's containers.\n\nIf optional is set to false and the specified key does not exist,\nan error will be returned during Pod creation.", + type: "boolean" + }, + path: { + description: "The path within the volume from which to select the file.\nMust be relative and may not contain the '..' path or start with '..'.", + type: "string" + }, + volumeName: { + description: "The name of the volume mount containing the env file.", + type: "string" + } + }, + required: ["key", "path", "volumeName"], + type: "object", + "x-kubernetes-map-type": "atomic" + }, + resourceFieldRef: { + description: "Selects a resource of the container: only resources limits and requests\n(limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported.", + properties: { + containerName: { + description: "Container name: required for volumes, optional for env vars", + type: "string" + }, + divisor: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Specifies the output format of the exposed resources, defaults to \"1\"", + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + }, + resource: { + description: "Required: resource to select", + type: "string" + } + }, + required: ["resource"], + type: "object", + "x-kubernetes-map-type": "atomic" + }, + secretKeyRef: { + description: "Selects a key of a secret in the pod's namespace", + properties: { + key: { + description: "The key of the secret to select from. Must be a valid secret key.", + type: "string" + }, + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "Specify whether the Secret or its key must be defined", + type: "boolean" + } + }, + required: ["key"], + type: "object", + "x-kubernetes-map-type": "atomic" + } + }, + type: "object" + } + }, + required: ["name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + hostAliases: { + description: "HostAliases is an optional list of hosts and IPs that will be injected into the pod's hosts\nfile if specified. This is only valid for non-hostNetwork pods.", + items: { + description: "HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the\npod's hosts file.", + properties: { + hostnames: { + description: "Hostnames for the above IP address.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + ip: { + description: "IP address of the host file entry.", + type: "string" + } + }, + required: ["ip"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + hostNetwork: { + description: "HostNetwork specifies whether the pod may use the node network namespace", + type: "boolean" + }, + hostUsers: { + description: "HostUsers indicates whether the pod will use the host's user namespace.\nOptional: Default to true.\nIf set to true or not present, the pod will be run in the host user namespace, useful\nfor when the pod needs a feature only available to the host user namespace, such as\nloading a kernel module with CAP_SYS_MODULE.\nWhen set to false, a new user namespace is created for the pod. Setting false\nis useful to mitigating container breakout vulnerabilities such as allowing\ncontainers to run as root without their user having root privileges on the host.\nThis field depends on the kubernetes feature gate UserNamespacesSupport being enabled.", + type: "boolean" + }, + imagePullSecrets: { + description: "ImagePullSecrets gives the name of the secret used by the pod to pull the image if specified", + items: { + description: "LocalObjectReference contains enough information to let you locate the\nreferenced object inside the same namespace.", + properties: { + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + nodeSelector: { + additionalProperties: { + type: "string" + }, + description: "NodeSelector is a selector which must be true for the pod to fit on a node.\nSelector which must match a node's labels for the pod to be scheduled on that node.\nMore info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/", + type: "object" + }, + priorityClassName: { + description: "If specified, indicates the pod's priority. \"system-node-critical\" and\n\"system-cluster-critical\" are two special keywords which indicate the\nhighest priorities with the former being the highest priority. Any other\nname must be defined by creating a PriorityClass object with that name.\nIf not specified, the pod priority will be default or zero if there is no\ndefault.", + type: "string" + }, + runtimeClassName: { + description: "RuntimeClassName refers to a RuntimeClass object in the node.k8s.io\ngroup, which should be used to run this pod. If no RuntimeClass resource\nmatches the named class, the pod will not be run. If unset or empty, the\n\"legacy\" RuntimeClass will be used, which is an implicit class with an\nempty definition that uses the default runtime handler.\nMore info: https://git.k8s.io/enhancements/keps/sig-node/runtime-class.md\nThis is a beta feature as of Kubernetes v1.14.", + type: "string" + }, + schedulerName: { + description: "SchedulerName specifies the scheduler to be used to dispatch the Pod", + type: "string" + }, + securityContext: { + description: "SecurityContext holds pod-level security attributes and common container settings.\nOptional: Defaults to empty. See type description for default values of each field.\nSee Pod.spec.securityContext (API version: v1)", + "x-kubernetes-preserve-unknown-fields": true + }, + tolerations: { + description: "If specified, the pod's tolerations.", + items: { + description: "The pod this Toleration is attached to tolerates any taint that matches\nthe triple using the matching operator .", + properties: { + effect: { + description: "Effect indicates the taint effect to match. Empty means match all taint effects.\nWhen specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.", + type: "string" + }, + key: { + description: "Key is the taint key that the toleration applies to. Empty means match all taint keys.\nIf the key is empty, operator must be Exists; this combination means to match all values and all keys.", + type: "string" + }, + operator: { + description: "Operator represents a key's relationship to the value.\nValid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.\nExists is equivalent to wildcard for value, so that a pod can\ntolerate all taints of a particular category.\nLt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).", + type: "string" + }, + tolerationSeconds: { + description: "TolerationSeconds represents the period of time the toleration (which must be\nof effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,\nit is not set, which means tolerate the taint forever (do not evict). Zero and\nnegative values will be treated as 0 (evict immediately) by the system.", + format: "int64", + type: "integer" + }, + value: { + description: "Value is the taint value the toleration matches to.\nIf the operator is Exists, the value should be empty, otherwise just a regular string.", + type: "string" + } + }, + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + topologySpreadConstraints: { + description: "TopologySpreadConstraints controls how Pods are spread across your cluster among\nfailure-domains such as regions, zones, nodes, and other user-defined topology domains.", + items: { + description: "TopologySpreadConstraint specifies how to spread matching pods among the given topology.", + properties: { + labelSelector: { + description: "LabelSelector is used to find matching pods.\nPods that match this label selector are counted to determine the number of pods\nin their corresponding topology domain.", + properties: { + matchExpressions: { + description: "matchExpressions is a list of label selector requirements. The requirements are ANDed.", + items: { + description: "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", + properties: { + key: { + description: "key is the label key that the selector applies to.", + type: "string" + }, + operator: { + description: "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", + type: "string" + }, + values: { + description: "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + required: ["key", "operator"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + matchLabels: { + additionalProperties: { + type: "string" + }, + description: "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", + type: "object" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + matchLabelKeys: { + description: "MatchLabelKeys is a set of pod label keys to select the pods over which\nspreading will be calculated. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are ANDed with labelSelector\nto select the group of existing pods over which spreading will be calculated\nfor the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector.\nMatchLabelKeys cannot be set when LabelSelector isn't set.\nKeys that don't exist in the incoming pod labels will\nbe ignored. A null or empty list means only match against labelSelector.\n\nThis is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default).", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + maxSkew: { + description: "MaxSkew describes the degree to which pods may be unevenly distributed.\nWhen `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference\nbetween the number of matching pods in the target topology and the global minimum.\nThe global minimum is the minimum number of matching pods in an eligible domain\nor zero if the number of eligible domains is less than MinDomains.\nFor example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same\nlabelSelector spread as 2/2/1:\nIn this case, the global minimum is 1.\n| zone1 | zone2 | zone3 |\n| P P | P P | P |\n- if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2;\nscheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2)\nviolate MaxSkew(1).\n- if MaxSkew is 2, incoming pod can be scheduled onto any zone.\nWhen `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence\nto topologies that satisfy it.\nIt's a required field. Default value is 1 and 0 is not allowed.", + format: "int32", + type: "integer" + }, + minDomains: { + description: "MinDomains indicates a minimum number of eligible domains.\nWhen the number of eligible domains with matching topology keys is less than minDomains,\nPod Topology Spread treats \"global minimum\" as 0, and then the calculation of Skew is performed.\nAnd when the number of eligible domains with matching topology keys equals or greater than minDomains,\nthis value has no effect on scheduling.\nAs a result, when the number of eligible domains is less than minDomains,\nscheduler won't schedule more than maxSkew Pods to those domains.\nIf value is nil, the constraint behaves as if MinDomains is equal to 1.\nValid values are integers greater than 0.\nWhen value is not nil, WhenUnsatisfiable must be DoNotSchedule.\n\nFor example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same\nlabelSelector spread as 2/2/2:\n| zone1 | zone2 | zone3 |\n| P P | P P | P P |\nThe number of domains is less than 5(MinDomains), so \"global minimum\" is treated as 0.\nIn this situation, new pod with the same labelSelector cannot be scheduled,\nbecause computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones,\nit will violate MaxSkew.", + format: "int32", + type: "integer" + }, + nodeAffinityPolicy: { + description: "NodeAffinityPolicy indicates how we will treat Pod's nodeAffinity/nodeSelector\nwhen calculating pod topology spread skew. Options are:\n- Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations.\n- Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations.\n\nIf this value is nil, the behavior is equivalent to the Honor policy.", + type: "string" + }, + nodeTaintsPolicy: { + description: "NodeTaintsPolicy indicates how we will treat node taints when calculating\npod topology spread skew. Options are:\n- Honor: nodes without taints, along with tainted nodes for which the incoming pod\nhas a toleration, are included.\n- Ignore: node taints are ignored. All nodes are included.\n\nIf this value is nil, the behavior is equivalent to the Ignore policy.", + type: "string" + }, + topologyKey: { + description: "TopologyKey is the key of node labels. Nodes that have a label with this key\nand identical values are considered to be in the same topology.\nWe consider each as a \"bucket\", and try to put balanced number\nof pods into each bucket.\nWe define a domain as a particular instance of a topology.\nAlso, we define an eligible domain as a domain whose nodes meet the requirements of\nnodeAffinityPolicy and nodeTaintsPolicy.\ne.g. If TopologyKey is \"kubernetes.io/hostname\", each Node is a domain of that topology.\nAnd, if TopologyKey is \"topology.kubernetes.io/zone\", each zone is a domain of that topology.\nIt's a required field.", + type: "string" + }, + whenUnsatisfiable: { + description: "WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy\nthe spread constraint.\n- DoNotSchedule (default) tells the scheduler not to schedule it.\n- ScheduleAnyway tells the scheduler to schedule the pod in any location,\n but giving higher precedence to topologies that would help reduce the\n skew.\nA constraint is considered \"Unsatisfiable\" for an incoming pod\nif and only if every possible node assignment for that pod would violate\n\"MaxSkew\" on some topology.\nFor example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same\nlabelSelector spread as 3/1/1:\n| zone1 | zone2 | zone3 |\n| P P P | P | P |\nIf WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled\nto zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies\nMaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler\nwon't make it *more* imbalanced.\nIt's a required field.", + type: "string" + } + }, + required: ["maxSkew", "topologyKey", "whenUnsatisfiable"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + volumes: { + description: "List of volumes that can be mounted by containers belonging to the pod.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes\nSee Pod.spec.volumes (API version: v1)", + "x-kubernetes-preserve-unknown-fields": true + } + }, + type: "object" + }, + serviceAccountName: { + type: "string" + } + }, + type: "object" + }, + timeouts: { + description: "Time after which the Pipeline times out.\nCurrently three keys are accepted in the map\npipeline, tasks and finally\nwith Timeouts.pipeline >= Timeouts.tasks + Timeouts.finally", + properties: { + finally: { + description: "Finally sets the maximum allowed duration of this pipeline's finally", + type: "string" + }, + pipeline: { + description: "Pipeline sets the maximum allowed duration for execution of the entire pipeline. The sum of individual timeouts for tasks and finally must not exceed this value.", + type: "string" + }, + tasks: { + description: "Tasks sets the maximum allowed duration of this pipeline's tasks", + type: "string" + } + }, + type: "object" + }, + workspaces: { + description: "Workspaces holds a set of workspace bindings that must match names\nwith those declared in the pipeline.", + items: { + description: "WorkspaceBinding maps a Task's declared workspace to a Volume.", + properties: { + configMap: { + description: "ConfigMap represents a configMap that should populate this workspace.", + properties: { + defaultMode: { + description: "defaultMode is optional: mode bits used to set permissions on created files by default.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nDefaults to 0644.\nDirectories within the path are not affected by this setting.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", + format: "int32", + type: "integer" + }, + items: { + description: "items if unspecified, each key-value pair in the Data field of the referenced\nConfigMap will be projected into the volume as a file whose name is the\nkey and content is the value. If specified, the listed keys will be\nprojected into the specified paths, and unlisted keys will not be\npresent. If a key is specified which is not present in the ConfigMap,\nthe volume setup will error unless it is marked optional. Paths must be\nrelative and may not contain the '..' path or start with '..'.", + items: { + description: "Maps a string key to a path within a volume.", + properties: { + key: { + description: "key is the key to project.", + type: "string" + }, + mode: { + description: "mode is Optional: mode bits used to set permissions on this file.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nIf not specified, the volume defaultMode will be used.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", + format: "int32", + type: "integer" + }, + path: { + description: "path is the relative path of the file to map the key to.\nMay not be an absolute path.\nMay not contain the path element '..'.\nMay not start with the string '..'.", + type: "string" + } + }, + required: ["key", "path"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "optional specify whether the ConfigMap or its keys must be defined", + type: "boolean" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + csi: { + description: "CSI (Container Storage Interface) represents ephemeral storage that is handled by certain external CSI drivers.", + properties: { + driver: { + description: "driver is the name of the CSI driver that handles this volume.\nConsult with your admin for the correct name as registered in the cluster.", + type: "string" + }, + fsType: { + description: "fsType to mount. Ex. \"ext4\", \"xfs\", \"ntfs\".\nIf not provided, the empty value is passed to the associated CSI driver\nwhich will determine the default filesystem to apply.", + type: "string" + }, + nodePublishSecretRef: { + description: "nodePublishSecretRef is a reference to the secret object containing\nsensitive information to pass to the CSI driver to complete the CSI\nNodePublishVolume and NodeUnpublishVolume calls.\nThis field is optional, and may be empty if no secret is required. If the\nsecret object contains more than one secret, all secret references are passed.", + properties: { + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + readOnly: { + description: "readOnly specifies a read-only configuration for the volume.\nDefaults to false (read/write).", + type: "boolean" + }, + volumeAttributes: { + additionalProperties: { + type: "string" + }, + description: "volumeAttributes stores driver-specific properties that are passed to the CSI\ndriver. Consult your driver's documentation for supported values.", + type: "object" + } + }, + required: ["driver"], + type: "object" + }, + emptyDir: { + description: "EmptyDir represents a temporary directory that shares a Task's lifetime.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir\nEither this OR PersistentVolumeClaim can be used.", + properties: { + medium: { + description: "medium represents what type of storage medium should back this directory.\nThe default is \"\" which means to use the node's default medium.\nMust be an empty string (default) or Memory.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir", + type: "string" + }, + sizeLimit: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "sizeLimit is the total amount of local storage required for this EmptyDir volume.\nThe size limit is also applicable for memory medium.\nThe maximum usage on memory medium EmptyDir would be the minimum value between\nthe SizeLimit specified here and the sum of memory limits of all containers in a pod.\nThe default is nil which means that the limit is undefined.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir", + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + } + }, + type: "object" + }, + name: { + description: "Name is the name of the workspace populated by the volume.", + type: "string" + }, + persistentVolumeClaim: { + description: "PersistentVolumeClaimVolumeSource represents a reference to a\nPersistentVolumeClaim in the same namespace. Either this OR EmptyDir can be used.", + properties: { + claimName: { + description: "claimName is the name of a PersistentVolumeClaim in the same namespace as the pod using this volume.\nMore info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims", + type: "string" + }, + readOnly: { + description: "readOnly Will force the ReadOnly setting in VolumeMounts.\nDefault false.", + type: "boolean" + } + }, + required: ["claimName"], + type: "object" + }, + projected: { + description: "Projected represents a projected volume that should populate this workspace.", + properties: { + defaultMode: { + description: "defaultMode are the mode bits used to set permissions on created files by default.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nDirectories within the path are not affected by this setting.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", + format: "int32", + type: "integer" + }, + sources: { + description: "sources is the list of volume projections. Each entry in this list\nhandles one source.", + items: { + description: "Projection that may be projected along with other supported volume types.\nExactly one of these fields must be set.", + properties: { + clusterTrustBundle: { + description: "ClusterTrustBundle allows a pod to access the `.spec.trustBundle` field\nof ClusterTrustBundle objects in an auto-updating file.\n\nAlpha, gated by the ClusterTrustBundleProjection feature gate.\n\nClusterTrustBundle objects can either be selected by name, or by the\ncombination of signer name and a label selector.\n\nKubelet performs aggressive normalization of the PEM contents written\ninto the pod filesystem. Esoteric PEM features such as inter-block\ncomments and block headers are stripped. Certificates are deduplicated.\nThe ordering of certificates within the file is arbitrary, and Kubelet\nmay change the order over time.", + properties: { + labelSelector: { + description: "Select all ClusterTrustBundles that match this label selector. Only has\neffect if signerName is set. Mutually-exclusive with name. If unset,\ninterpreted as \"match nothing\". If set but empty, interpreted as \"match\neverything\".", + properties: { + matchExpressions: { + description: "matchExpressions is a list of label selector requirements. The requirements are ANDed.", + items: { + description: "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", + properties: { + key: { + description: "key is the label key that the selector applies to.", + type: "string" + }, + operator: { + description: "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", + type: "string" + }, + values: { + description: "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + required: ["key", "operator"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + matchLabels: { + additionalProperties: { + type: "string" + }, + description: "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", + type: "object" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + name: { + description: "Select a single ClusterTrustBundle by object name. Mutually-exclusive\nwith signerName and labelSelector.", + type: "string" + }, + optional: { + description: "If true, don't block pod startup if the referenced ClusterTrustBundle(s)\naren't available. If using name, then the named ClusterTrustBundle is\nallowed not to exist. If using signerName, then the combination of\nsignerName and labelSelector is allowed to match zero\nClusterTrustBundles.", + type: "boolean" + }, + path: { + description: "Relative path from the volume root to write the bundle.", + type: "string" + }, + signerName: { + description: "Select all ClusterTrustBundles that match this signer name.\nMutually-exclusive with name. The contents of all selected\nClusterTrustBundles will be unified and deduplicated.", + type: "string" + } + }, + required: ["path"], + type: "object" + }, + configMap: { + description: "configMap information about the configMap data to project", + properties: { + items: { + description: "items if unspecified, each key-value pair in the Data field of the referenced\nConfigMap will be projected into the volume as a file whose name is the\nkey and content is the value. If specified, the listed keys will be\nprojected into the specified paths, and unlisted keys will not be\npresent. If a key is specified which is not present in the ConfigMap,\nthe volume setup will error unless it is marked optional. Paths must be\nrelative and may not contain the '..' path or start with '..'.", + items: { + description: "Maps a string key to a path within a volume.", + properties: { + key: { + description: "key is the key to project.", + type: "string" + }, + mode: { + description: "mode is Optional: mode bits used to set permissions on this file.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nIf not specified, the volume defaultMode will be used.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", + format: "int32", + type: "integer" + }, + path: { + description: "path is the relative path of the file to map the key to.\nMay not be an absolute path.\nMay not contain the path element '..'.\nMay not start with the string '..'.", + type: "string" + } + }, + required: ["key", "path"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "optional specify whether the ConfigMap or its keys must be defined", + type: "boolean" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + downwardAPI: { + description: "downwardAPI information about the downwardAPI data to project", + properties: { + items: { + description: "Items is a list of DownwardAPIVolume file", + items: { + description: "DownwardAPIVolumeFile represents information to create the file containing the pod field", + properties: { + fieldRef: { + description: "Required: Selects a field of the pod: only annotations, labels, name, namespace and uid are supported.", + properties: { + apiVersion: { + description: "Version of the schema the FieldPath is written in terms of, defaults to \"v1\".", + type: "string" + }, + fieldPath: { + description: "Path of the field to select in the specified API version.", + type: "string" + } + }, + required: ["fieldPath"], + type: "object", + "x-kubernetes-map-type": "atomic" + }, + mode: { + description: "Optional: mode bits used to set permissions on this file, must be an octal value\nbetween 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nIf not specified, the volume defaultMode will be used.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", + format: "int32", + type: "integer" + }, + path: { + description: "Required: Path is the relative path name of the file to be created. Must not be absolute or contain the '..' path. Must be utf-8 encoded. The first item of the relative path must not start with '..'", + type: "string" + }, + resourceFieldRef: { + description: "Selects a resource of the container: only resources limits and requests\n(limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported.", + properties: { + containerName: { + description: "Container name: required for volumes, optional for env vars", + type: "string" + }, + divisor: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Specifies the output format of the exposed resources, defaults to \"1\"", + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + }, + resource: { + description: "Required: resource to select", + type: "string" + } + }, + required: ["resource"], + type: "object", + "x-kubernetes-map-type": "atomic" + } + }, + required: ["path"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + podCertificate: { + description: "Projects an auto-rotating credential bundle (private key and certificate\nchain) that the pod can use either as a TLS client or server.\n\nKubelet generates a private key and uses it to send a\nPodCertificateRequest to the named signer. Once the signer approves the\nrequest and issues a certificate chain, Kubelet writes the key and\ncertificate chain to the pod filesystem. The pod does not start until\ncertificates have been issued for each podCertificate projected volume\nsource in its spec.\n\nKubelet will begin trying to rotate the certificate at the time indicated\nby the signer using the PodCertificateRequest.Status.BeginRefreshAt\ntimestamp.\n\nKubelet can write a single file, indicated by the credentialBundlePath\nfield, or separate files, indicated by the keyPath and\ncertificateChainPath fields.\n\nThe credential bundle is a single file in PEM format. The first PEM\nentry is the private key (in PKCS#8 format), and the remaining PEM\nentries are the certificate chain issued by the signer (typically,\nsigners will return their certificate chain in leaf-to-root order).\n\nPrefer using the credential bundle format, since your application code\ncan read it atomically. If you use keyPath and certificateChainPath,\nyour application must make two separate file reads. If these coincide\nwith a certificate rotation, it is possible that the private key and leaf\ncertificate you read may not correspond to each other. Your application\nwill need to check for this condition, and re-read until they are\nconsistent.\n\nThe named signer controls chooses the format of the certificate it\nissues; consult the signer implementation's documentation to learn how to\nuse the certificates it issues.", + properties: { + certificateChainPath: { + description: "Write the certificate chain at this path in the projected volume.\n\nMost applications should use credentialBundlePath. When using keyPath\nand certificateChainPath, your application needs to check that the key\nand leaf certificate are consistent, because it is possible to read the\nfiles mid-rotation.", + type: "string" + }, + credentialBundlePath: { + description: "Write the credential bundle at this path in the projected volume.\n\nThe credential bundle is a single file that contains multiple PEM blocks.\nThe first PEM block is a PRIVATE KEY block, containing a PKCS#8 private\nkey.\n\nThe remaining blocks are CERTIFICATE blocks, containing the issued\ncertificate chain from the signer (leaf and any intermediates).\n\nUsing credentialBundlePath lets your Pod's application code make a single\natomic read that retrieves a consistent key and certificate chain. If you\nproject them to separate files, your application code will need to\nadditionally check that the leaf certificate was issued to the key.", + type: "string" + }, + keyPath: { + description: "Write the key at this path in the projected volume.\n\nMost applications should use credentialBundlePath. When using keyPath\nand certificateChainPath, your application needs to check that the key\nand leaf certificate are consistent, because it is possible to read the\nfiles mid-rotation.", + type: "string" + }, + keyType: { + description: "The type of keypair Kubelet will generate for the pod.\n\nValid values are \"RSA3072\", \"RSA4096\", \"ECDSAP256\", \"ECDSAP384\",\n\"ECDSAP521\", and \"ED25519\".", + type: "string" + }, + maxExpirationSeconds: { + description: "maxExpirationSeconds is the maximum lifetime permitted for the\ncertificate.\n\nKubelet copies this value verbatim into the PodCertificateRequests it\ngenerates for this projection.\n\nIf omitted, kube-apiserver will set it to 86400(24 hours). kube-apiserver\nwill reject values shorter than 3600 (1 hour). The maximum allowable\nvalue is 7862400 (91 days).\n\nThe signer implementation is then free to issue a certificate with any\nlifetime *shorter* than MaxExpirationSeconds, but no shorter than 3600\nseconds (1 hour). This constraint is enforced by kube-apiserver.\n`kubernetes.io` signers will never issue certificates with a lifetime\nlonger than 24 hours.", + format: "int32", + type: "integer" + }, + signerName: { + description: "Kubelet's generated CSRs will be addressed to this signer.", + type: "string" + }, + userAnnotations: { + additionalProperties: { + type: "string" + }, + description: "userAnnotations allow pod authors to pass additional information to\nthe signer implementation. Kubernetes does not restrict or validate this\nmetadata in any way.\n\nThese values are copied verbatim into the `spec.unverifiedUserAnnotations` field of\nthe PodCertificateRequest objects that Kubelet creates.\n\nEntries are subject to the same validation as object metadata annotations,\nwith the addition that all keys must be domain-prefixed. No restrictions\nare placed on values, except an overall size limitation on the entire field.\n\nSigners should document the keys and values they support. Signers should\ndeny requests that contain keys they do not recognize.", + type: "object" + } + }, + required: ["keyType", "signerName"], + type: "object" + }, + secret: { + description: "secret information about the secret data to project", + properties: { + items: { + description: "items if unspecified, each key-value pair in the Data field of the referenced\nSecret will be projected into the volume as a file whose name is the\nkey and content is the value. If specified, the listed keys will be\nprojected into the specified paths, and unlisted keys will not be\npresent. If a key is specified which is not present in the Secret,\nthe volume setup will error unless it is marked optional. Paths must be\nrelative and may not contain the '..' path or start with '..'.", + items: { + description: "Maps a string key to a path within a volume.", + properties: { + key: { + description: "key is the key to project.", + type: "string" + }, + mode: { + description: "mode is Optional: mode bits used to set permissions on this file.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nIf not specified, the volume defaultMode will be used.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", + format: "int32", + type: "integer" + }, + path: { + description: "path is the relative path of the file to map the key to.\nMay not be an absolute path.\nMay not contain the path element '..'.\nMay not start with the string '..'.", + type: "string" + } + }, + required: ["key", "path"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "optional field specify whether the Secret or its key must be defined", + type: "boolean" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + serviceAccountToken: { + description: "serviceAccountToken is information about the serviceAccountToken data to project", + properties: { + audience: { + description: "audience is the intended audience of the token. A recipient of a token\nmust identify itself with an identifier specified in the audience of the\ntoken, and otherwise should reject the token. The audience defaults to the\nidentifier of the apiserver.", + type: "string" + }, + expirationSeconds: { + description: "expirationSeconds is the requested duration of validity of the service\naccount token. As the token approaches expiration, the kubelet volume\nplugin will proactively rotate the service account token. The kubelet will\nstart trying to rotate the token if the token is older than 80 percent of\nits time to live or if the token is older than 24 hours.Defaults to 1 hour\nand must be at least 10 minutes.", + format: "int64", + type: "integer" + }, + path: { + description: "path is the path relative to the mount point of the file to project the\ntoken into.", + type: "string" + } + }, + required: ["path"], + type: "object" + } + }, + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + secret: { + description: "Secret represents a secret that should populate this workspace.", + properties: { + defaultMode: { + description: "defaultMode is Optional: mode bits used to set permissions on created files by default.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values\nfor mode bits. Defaults to 0644.\nDirectories within the path are not affected by this setting.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", + format: "int32", + type: "integer" + }, + items: { + description: "items If unspecified, each key-value pair in the Data field of the referenced\nSecret will be projected into the volume as a file whose name is the\nkey and content is the value. If specified, the listed keys will be\nprojected into the specified paths, and unlisted keys will not be\npresent. If a key is specified which is not present in the Secret,\nthe volume setup will error unless it is marked optional. Paths must be\nrelative and may not contain the '..' path or start with '..'.", + items: { + description: "Maps a string key to a path within a volume.", + properties: { + key: { + description: "key is the key to project.", + type: "string" + }, + mode: { + description: "mode is Optional: mode bits used to set permissions on this file.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nIf not specified, the volume defaultMode will be used.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", + format: "int32", + type: "integer" + }, + path: { + description: "path is the relative path of the file to map the key to.\nMay not be an absolute path.\nMay not contain the path element '..'.\nMay not start with the string '..'.", + type: "string" + } + }, + required: ["key", "path"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + optional: { + description: "optional field specify whether the Secret or its keys must be defined", + type: "boolean" + }, + secretName: { + description: "secretName is the name of the secret in the pod's namespace to use.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#secret", + type: "string" + } + }, + type: "object" + }, + subPath: { + description: "SubPath is optionally a directory on the volume which should be used\nfor this binding (i.e. the volume will be mounted at this sub directory).", + type: "string" + }, + volumeClaimTemplate: { + description: "VolumeClaimTemplate is a template for a claim that will be created in the same namespace.\nThe PipelineRun controller is responsible for creating a unique claim for each instance of PipelineRun.\nSee PersistentVolumeClaim (API version: v1)", + "x-kubernetes-preserve-unknown-fields": true + } + }, + required: ["name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + status: { + description: "PipelineRunStatus defines the observed state of PipelineRun", + properties: { + annotations: { + additionalProperties: { + type: "string" + }, + description: "Annotations is additional Status fields for the Resource to save some\nadditional State as well as convey more information to the user. This is\nroughly akin to Annotations on any k8s resource, just the reconciler conveying\nricher information outwards.", + type: "object" + }, + childReferences: { + description: "list of TaskRun and Run names, PipelineTask names, and API versions/kinds for children of this PipelineRun.", + items: { + description: "ChildStatusReference is used to point to the statuses of individual TaskRuns and Runs within this PipelineRun.", + properties: { + apiVersion: { + type: "string" + }, + displayName: { + description: "DisplayName is a user-facing name of the pipelineTask that may be\nused to populate a UI.", + type: "string" + }, + kind: { + type: "string" + }, + name: { + description: "Name is the name of the TaskRun or Run this is referencing.", + type: "string" + }, + pipelineTaskName: { + description: "PipelineTaskName is the name of the PipelineTask this is referencing.", + type: "string" + }, + whenExpressions: { + description: "WhenExpressions is the list of checks guarding the execution of the PipelineTask", + items: { + description: "WhenExpression allows a PipelineTask to declare expressions to be evaluated before the Task is run\nto determine whether the Task should be executed or skipped", + properties: { + cel: { + description: "CEL is a string of Common Language Expression, which can be used to conditionally execute\nthe task based on the result of the expression evaluation\nMore info about CEL syntax: https://github.com/google/cel-spec/blob/master/doc/langdef.md", + type: "string" + }, + input: { + description: "Input is the string for guard checking which can be a static input or an output from a parent Task", + type: "string" + }, + operator: { + description: "Operator that represents an Input's relationship to the values", + type: "string" + }, + values: { + description: "Values is an array of strings, which is compared against the input, for guard checking\nIt must be non-empty", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + completionTime: { + description: "CompletionTime is the time the PipelineRun completed.", + format: "date-time", + type: "string" + }, + conditions: { + description: "Conditions the latest available observations of a resource's current state.", + items: { + description: "Condition defines a readiness condition for a Knative resource.\nSee: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties", + properties: { + lastTransitionTime: { + description: "LastTransitionTime is the last time the condition transitioned from one status to another.\nWe use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic\ndifferences (all other things held constant).", + type: "string" + }, + message: { + description: "A human readable message indicating details about the transition.", + type: "string" + }, + reason: { + description: "The reason for the condition's last transition.", + type: "string" + }, + severity: { + description: "Severity with which to treat failures of this type of condition.\nWhen this is not specified, it defaults to Error.", + type: "string" + }, + status: { + description: "Status of the condition, one of True, False, Unknown.", + type: "string" + }, + type: { + description: "Type of condition.", + type: "string" + } + }, + required: ["status", "type"], + type: "object" + }, + type: "array" + }, + finallyStartTime: { + description: "FinallyStartTime is when all non-finally tasks have been completed and only finally tasks are being executed.", + format: "date-time", + type: "string" + }, + observedGeneration: { + description: "ObservedGeneration is the 'Generation' of the Service that\nwas last processed by the controller.", + format: "int64", + type: "integer" + }, + pipelineSpec: { + description: "PipelineSpec contains the exact spec used to instantiate the run.\nSee Pipeline.spec (API version: tekton.dev/v1)", + "x-kubernetes-preserve-unknown-fields": true + }, + provenance: { + description: "Provenance contains some key authenticated metadata about how a software artifact was built (what sources, what inputs/outputs, etc.).", + properties: { + featureFlags: { + description: "FeatureFlags identifies the feature flags that were used during the task/pipeline run", + properties: { + awaitSidecarReadiness: { + type: "boolean" + }, + coschedule: { + type: "string" + }, + disableCredsInit: { + type: "boolean" + }, + disableInlineSpec: { + type: "string" + }, + enableAPIFields: { + type: "string" + }, + enableArtifacts: { + type: "boolean" + }, + enableCELInWhenExpression: { + type: "boolean" + }, + enableConciseResolverSyntax: { + type: "boolean" + }, + enableKeepPodOnCancel: { + type: "boolean" + }, + enableKubernetesSidecar: { + type: "boolean" + }, + enableParamEnum: { + type: "boolean" + }, + enableProvenanceInStatus: { + type: "boolean" + }, + enableStepActions: { + description: "EnableStepActions is a no-op flag since StepActions are stable", + type: "boolean" + }, + enableTektonOCIBundles: { + description: "DeprecatedEnableTektonOCIBundles is maintained for backward compatibility\nto allow deletion of PipelineRuns created before v0.62.x.\nThis field is not used and can be removed in a future release\nonce we're confident old PipelineRuns have been cleaned up.\nSee issue #8359 for context.", + type: "boolean" + }, + enableTerminationMessageCompression: { + type: "boolean" + }, + enableWaitExponentialBackoff: { + type: "boolean" + }, + enforceNonfalsifiability: { + type: "string" + }, + maxResultSize: { + type: "integer" + }, + requireGitSSHSecretKnownHosts: { + type: "boolean" + }, + resultExtractionMethod: { + type: "string" + }, + runningInEnvWithInjectedSidecars: { + type: "boolean" + }, + sendCloudEventsForRuns: { + type: "boolean" + }, + setSecurityContext: { + type: "boolean" + }, + setSecurityContextReadOnlyRootFilesystem: { + type: "boolean" + }, + verificationNoMatchPolicy: { + description: "VerificationNoMatchPolicy is the feature flag for \"trusted-resources-verification-no-match-policy\"\nVerificationNoMatchPolicy can be set to \"ignore\", \"warn\" and \"fail\" values.\nignore: skip trusted resources verification when no matching verification policies found\nwarn: skip trusted resources verification when no matching verification policies found and log a warning\nfail: fail the taskrun or pipelines run if no matching verification policies found", + type: "string" + } + }, + type: "object" + }, + refSource: { + description: "RefSource identifies the source where a remote task/pipeline came from.", + properties: { + digest: { + additionalProperties: { + type: "string" + }, + description: "Digest is a collection of cryptographic digests for the contents of the artifact specified by URI.\nExample: {\"sha1\": \"f99d13e554ffcb696dee719fa85b695cb5b0f428\"}", + type: "object" + }, + entryPoint: { + description: "EntryPoint identifies the entry point into the build. This is often a path to a\nbuild definition file and/or a target label within that file.\nExample: \"task/git-clone/0.10/git-clone.yaml\"", + type: "string" + }, + uri: { + description: "URI indicates the identity of the source of the build definition.\nExample: \"https://github.com/tektoncd/catalog\"", + type: "string" + } + }, + type: "object" + } + }, + type: "object" + }, + results: { + description: "Results are the list of results written out by the pipeline task's containers", + items: { + description: "PipelineRunResult used to describe the results of a pipeline", + properties: { + name: { + description: "Name is the result's name as declared by the Pipeline", + type: "string" + }, + value: { + description: "Value is the result returned from the execution of this PipelineRun", + "x-kubernetes-preserve-unknown-fields": true + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + skippedTasks: { + description: "list of tasks that were skipped due to when expressions evaluating to false", + items: { + description: "SkippedTask is used to describe the Tasks that were skipped due to their When Expressions\nevaluating to False. This is a struct because we are looking into including more details\nabout the When Expressions that caused this Task to be skipped.", + properties: { + name: { + description: "Name is the Pipeline Task name", + type: "string" + }, + reason: { + description: "Reason is the cause of the PipelineTask being skipped.", + type: "string" + }, + whenExpressions: { + description: "WhenExpressions is the list of checks guarding the execution of the PipelineTask", + items: { + description: "WhenExpression allows a PipelineTask to declare expressions to be evaluated before the Task is run\nto determine whether the Task should be executed or skipped", + properties: { + cel: { + description: "CEL is a string of Common Language Expression, which can be used to conditionally execute\nthe task based on the result of the expression evaluation\nMore info about CEL syntax: https://github.com/google/cel-spec/blob/master/doc/langdef.md", + type: "string" + }, + input: { + description: "Input is the string for guard checking which can be a static input or an output from a parent Task", + type: "string" + }, + operator: { + description: "Operator that represents an Input's relationship to the values", + type: "string" + }, + values: { + description: "Values is an array of strings, which is compared against the input, for guard checking\nIt must be non-empty", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + required: ["name", "reason"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + spanContext: { + additionalProperties: { + type: "string" + }, + description: "SpanContext contains tracing span context fields", + type: "object" + }, + startTime: { + description: "StartTime is the time the PipelineRun is actually started.", + format: "date-time", + type: "string" + } + }, + type: "object" + } + }, + type: "object" + } + }, + served: true, + storage: true, + subresources: { + status: {} + } + }] + } +}; +export const CustomResourceDefinition_ResolutionrequestsResolutionTektonDev: KubernetesResource = { + apiVersion: "apiextensions.k8s.io/v1", + kind: "CustomResourceDefinition", + metadata: { + labels: { + "resolution.tekton.dev/release": "devel" + }, + name: "resolutionrequests.resolution.tekton.dev" + }, + spec: { + conversion: { + strategy: "Webhook", + webhook: { + clientConfig: { + service: { + name: "tekton-pipelines-webhook", + namespace: "tekton-pipelines" + } + }, + conversionReviewVersions: ["v1alpha1", "v1beta1"] + } + }, + group: "resolution.tekton.dev", + names: { + categories: ["tekton", "tekton-pipelines"], + kind: "ResolutionRequest", + plural: "resolutionrequests", + singular: "resolutionrequest" + }, + scope: "Namespaced", + versions: [{ + additionalPrinterColumns: [{ + jsonPath: ".status.conditions[?(@.type=='Succeeded')].status", + name: "Succeeded", + type: "string" + }, { + jsonPath: ".status.conditions[?(@.type=='Succeeded')].reason", + name: "Reason", + type: "string" + }], + deprecated: true, + name: "v1alpha1", + schema: { + openAPIV3Schema: { + description: "ResolutionRequest is an object for requesting the content of\na Tekton resource like a pipeline.yaml.", + properties: { + apiVersion: { + description: "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", + type: "string" + }, + kind: { + description: "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + type: "string" + }, + metadata: { + type: "object" + }, + spec: { + description: "Spec holds the information for the request part of the resource request.", + properties: { + params: { + additionalProperties: { + type: "string" + }, + description: "Parameters are the runtime attributes passed to\nthe resolver to help it figure out how to resolve the\nresource being requested. For example: repo URL, commit SHA,\npath to file, the kind of authentication to leverage, etc.", + type: "object" + } + }, + type: "object" + }, + status: { + description: "Status communicates the state of the request and, ultimately,\nthe content of the resolved resource.", + properties: { + annotations: { + additionalProperties: { + type: "string" + }, + description: "Annotations is additional Status fields for the Resource to save some\nadditional State as well as convey more information to the user. This is\nroughly akin to Annotations on any k8s resource, just the reconciler conveying\nricher information outwards.", + type: "object" + }, + conditions: { + description: "Conditions the latest available observations of a resource's current state.", + items: { + description: "Condition defines a readiness condition for a Knative resource.\nSee: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties", + properties: { + lastTransitionTime: { + description: "LastTransitionTime is the last time the condition transitioned from one status to another.\nWe use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic\ndifferences (all other things held constant).", + type: "string" + }, + message: { + description: "A human readable message indicating details about the transition.", + type: "string" + }, + reason: { + description: "The reason for the condition's last transition.", + type: "string" + }, + severity: { + description: "Severity with which to treat failures of this type of condition.\nWhen this is not specified, it defaults to Error.", + type: "string" + }, + status: { + description: "Status of the condition, one of True, False, Unknown.", + type: "string" + }, + type: { + description: "Type of condition.", + type: "string" + } + }, + required: ["status", "type"], + type: "object" + }, + type: "array" + }, + data: { + description: "Data is a string representation of the resolved content\nof the requested resource in-lined into the ResolutionRequest\nobject.", + type: "string" + }, + observedGeneration: { + description: "ObservedGeneration is the 'Generation' of the Service that\nwas last processed by the controller.", + format: "int64", + type: "integer" + }, + refSource: { + description: "RefSource is the source reference of the remote data that records where the remote\nfile came from including the url, digest and the entrypoint.", + "x-kubernetes-preserve-unknown-fields": true + } + }, + required: ["data", "refSource"], + type: "object" + } + }, + type: "object" + } + }, + served: true, + storage: false, + subresources: { + status: {} + } + }, { + additionalPrinterColumns: [{ + jsonPath: ".metadata.ownerReferences[0].kind", + name: "OwnerKind", + type: "string" + }, { + jsonPath: ".metadata.ownerReferences[0].name", + name: "Owner", + type: "string" + }, { + jsonPath: ".status.conditions[?(@.type=='Succeeded')].status", + name: "Succeeded", + type: "string" + }, { + jsonPath: ".status.conditions[?(@.type=='Succeeded')].reason", + name: "Reason", + type: "string" + }, { + jsonPath: ".metadata.creationTimestamp", + name: "StartTime", + type: "string" + }, { + jsonPath: ".status.conditions[?(@.type=='Succeeded')].lastTransitionTime", + name: "EndTime", + type: "string" + }], + name: "v1beta1", + schema: { + openAPIV3Schema: { + description: "ResolutionRequest is an object for requesting the content of\na Tekton resource like a pipeline.yaml.", + properties: { + apiVersion: { + description: "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", + type: "string" + }, + kind: { + description: "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + type: "string" + }, + metadata: { + type: "object" + }, + spec: { + description: "Spec holds the information for the request part of the resource request.", + properties: { + params: { + description: "Parameters are the runtime attributes passed to\nthe resolver to help it figure out how to resolve the\nresource being requested. For example: repo URL, commit SHA,\npath to file, the kind of authentication to leverage, etc.", + items: { + description: "Param declares an ParamValues to use for the parameter called name.", + properties: { + name: { + type: "string" + }, + value: { + "x-kubernetes-preserve-unknown-fields": true + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + url: { + description: "URL is the runtime url passed to the resolver\nto help it figure out how to resolver the resource being\nrequested.\nThis is currently at an ALPHA stability level and subject to\nalpha API compatibility policies.", + type: "string" + } + }, + type: "object" + }, + status: { + description: "Status communicates the state of the request and, ultimately,\nthe content of the resolved resource.", + properties: { + annotations: { + additionalProperties: { + type: "string" + }, + description: "Annotations is additional Status fields for the Resource to save some\nadditional State as well as convey more information to the user. This is\nroughly akin to Annotations on any k8s resource, just the reconciler conveying\nricher information outwards.", + type: "object" + }, + conditions: { + description: "Conditions the latest available observations of a resource's current state.", + items: { + description: "Condition defines a readiness condition for a Knative resource.\nSee: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties", + properties: { + lastTransitionTime: { + description: "LastTransitionTime is the last time the condition transitioned from one status to another.\nWe use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic\ndifferences (all other things held constant).", + type: "string" + }, + message: { + description: "A human readable message indicating details about the transition.", + type: "string" + }, + reason: { + description: "The reason for the condition's last transition.", + type: "string" + }, + severity: { + description: "Severity with which to treat failures of this type of condition.\nWhen this is not specified, it defaults to Error.", + type: "string" + }, + status: { + description: "Status of the condition, one of True, False, Unknown.", + type: "string" + }, + type: { + description: "Type of condition.", + type: "string" + } + }, + required: ["status", "type"], + type: "object" + }, + type: "array" + }, + data: { + description: "Data is a string representation of the resolved content\nof the requested resource in-lined into the ResolutionRequest\nobject.", + type: "string" + }, + observedGeneration: { + description: "ObservedGeneration is the 'Generation' of the Service that\nwas last processed by the controller.", + format: "int64", + type: "integer" + }, + refSource: { + description: "RefSource is the source reference of the remote data that records the url, digest\nand the entrypoint.", + "x-kubernetes-preserve-unknown-fields": true + }, + source: { + description: "Deprecated: Use RefSource instead", + "x-kubernetes-preserve-unknown-fields": true + } + }, + required: ["data", "refSource", "source"], + type: "object" + } + }, + type: "object" + } + }, + served: true, + storage: true, + subresources: { + status: {} + } + }] + } +}; +export const CustomResourceDefinition_StepactionsTektonDev: KubernetesResource = { + apiVersion: "apiextensions.k8s.io/v1", + kind: "CustomResourceDefinition", + metadata: { + labels: { + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/part-of": "tekton-pipelines", + "pipeline.tekton.dev/release": "v1.15.0", + version: "v1.15.0" + }, + name: "stepactions.tekton.dev" + }, + spec: { + conversion: { + strategy: "Webhook", + webhook: { + clientConfig: { + service: { + name: "tekton-pipelines-webhook", + namespace: "tekton-pipelines" + } + }, + conversionReviewVersions: ["v1alpha1", "v1beta1"] + } + }, + group: "tekton.dev", + names: { + categories: ["tekton", "tekton-pipelines"], + kind: "StepAction", + plural: "stepactions", + singular: "stepaction" + }, + preserveUnknownFields: false, + scope: "Namespaced", + versions: [{ + name: "v1alpha1", + schema: { + openAPIV3Schema: { + description: "StepAction represents the actionable components of Step.\nThe Step can only reference it from the cluster or using remote resolution.", + properties: { + apiVersion: { + description: "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", + type: "string" + }, + kind: { + description: "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + type: "string" + }, + metadata: { + type: "object" + }, + spec: { + description: "Spec holds the desired state of the Step from the client", + properties: { + args: { + description: "Arguments to the entrypoint.\nThe image's CMD is used if this is not provided.\nVariable references $(VAR_NAME) are expanded using the container's environment. If a variable\ncannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced\nto a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. \"$$(VAR_NAME)\" will\nproduce the string literal \"$(VAR_NAME)\". Escaped references will never be expanded, regardless\nof whether the variable exists or not. Cannot be updated.\nMore info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + command: { + description: "Entrypoint array. Not executed within a shell.\nThe image's ENTRYPOINT is used if this is not provided.\nVariable references $(VAR_NAME) are expanded using the container's environment. If a variable\ncannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced\nto a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. \"$$(VAR_NAME)\" will\nproduce the string literal \"$(VAR_NAME)\". Escaped references will never be expanded, regardless\nof whether the variable exists or not. Cannot be updated.\nMore info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + description: { + description: "Description is a user-facing description of the stepaction that may be\nused to populate a UI.", + type: "string" + }, + env: { + description: "List of environment variables to set in the container.\nCannot be updated.", + items: { + description: "EnvVar represents an environment variable present in a Container.", + properties: { + name: { + description: "Name of the environment variable.\nMay consist of any printable ASCII characters except '='.", + type: "string" + }, + value: { + description: "Variable references $(VAR_NAME) are expanded\nusing the previously defined environment variables in the container and\nany service environment variables. If a variable cannot be resolved,\nthe reference in the input string will be unchanged. Double $$ are reduced\nto a single $, which allows for escaping the $(VAR_NAME) syntax: i.e.\n\"$$(VAR_NAME)\" will produce the string literal \"$(VAR_NAME)\".\nEscaped references will never be expanded, regardless of whether the variable\nexists or not.\nDefaults to \"\".", + type: "string" + }, + valueFrom: { + description: "Source for the environment variable's value. Cannot be used if value is not empty.", + properties: { + configMapKeyRef: { + description: "Selects a key of a ConfigMap.", + properties: { + key: { + description: "The key to select.", + type: "string" + }, + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "Specify whether the ConfigMap or its key must be defined", + type: "boolean" + } + }, + required: ["key"], + type: "object", + "x-kubernetes-map-type": "atomic" + }, + fieldRef: { + description: "Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`,\nspec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs.", + properties: { + apiVersion: { + description: "Version of the schema the FieldPath is written in terms of, defaults to \"v1\".", + type: "string" + }, + fieldPath: { + description: "Path of the field to select in the specified API version.", + type: "string" + } + }, + required: ["fieldPath"], + type: "object", + "x-kubernetes-map-type": "atomic" + }, + fileKeyRef: { + description: "FileKeyRef selects a key of the env file.\nRequires the EnvFiles feature gate to be enabled.", + properties: { + key: { + description: "The key within the env file. An invalid key will prevent the pod from starting.\nThe keys defined within a source may consist of any printable ASCII characters except '='.\nDuring Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.", + type: "string" + }, + optional: { + default: false, + description: "Specify whether the file or its key must be defined. If the file or key\ndoes not exist, then the env var is not published.\nIf optional is set to true and the specified key does not exist,\nthe environment variable will not be set in the Pod's containers.\n\nIf optional is set to false and the specified key does not exist,\nan error will be returned during Pod creation.", + type: "boolean" + }, + path: { + description: "The path within the volume from which to select the file.\nMust be relative and may not contain the '..' path or start with '..'.", + type: "string" + }, + volumeName: { + description: "The name of the volume mount containing the env file.", + type: "string" + } + }, + required: ["key", "path", "volumeName"], + type: "object", + "x-kubernetes-map-type": "atomic" + }, + resourceFieldRef: { + description: "Selects a resource of the container: only resources limits and requests\n(limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported.", + properties: { + containerName: { + description: "Container name: required for volumes, optional for env vars", + type: "string" + }, + divisor: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Specifies the output format of the exposed resources, defaults to \"1\"", + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + }, + resource: { + description: "Required: resource to select", + type: "string" + } + }, + required: ["resource"], + type: "object", + "x-kubernetes-map-type": "atomic" + }, + secretKeyRef: { + description: "Selects a key of a secret in the pod's namespace", + properties: { + key: { + description: "The key of the secret to select from. Must be a valid secret key.", + type: "string" + }, + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "Specify whether the Secret or its key must be defined", + type: "boolean" + } + }, + required: ["key"], + type: "object", + "x-kubernetes-map-type": "atomic" + } + }, + type: "object" + } + }, + required: ["name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + image: { + description: "Image reference name to run for this StepAction.\nMore info: https://kubernetes.io/docs/concepts/containers/images", + type: "string" + }, + params: { + description: "Params is a list of input parameters required to run the stepAction.\nParams must be supplied as inputs in Steps unless they declare a defaultvalue.", + items: { + description: "ParamSpec defines arbitrary parameters needed beyond typed inputs (such as\nresources). Parameter values are provided by users as inputs on a TaskRun\nor PipelineRun.", + properties: { + default: { + description: "Default is the value a parameter takes if no input value is supplied. If\ndefault is set, a Task may be executed without a supplied value for the\nparameter.", + "x-kubernetes-preserve-unknown-fields": true + }, + description: { + description: "Description is a user-facing description of the parameter that may be\nused to populate a UI.", + type: "string" + }, + enum: { + description: "Enum declares a set of allowed param input values for tasks/pipelines that can be validated.\nIf Enum is not set, no input validation is performed for the param.", + items: { + type: "string" + }, + type: "array" + }, + name: { + description: "Name declares the name by which a parameter is referenced.", + type: "string" + }, + properties: { + additionalProperties: { + description: "PropertySpec defines the struct for object keys", + properties: { + type: { + description: "ParamType indicates the type of an input parameter;\nUsed to distinguish between a single string and an array of strings.", + type: "string" + } + }, + type: "object" + }, + description: "Properties is the JSON Schema properties to support key-value pairs parameter.", + type: "object" + }, + type: { + description: "Type is the user-specified type of the parameter. The possible types\nare currently \"string\", \"array\" and \"object\", and \"string\" is the default.", + type: "string" + } + }, + required: ["name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + results: { + description: "Results are values that this StepAction can output", + items: { + description: "StepResult used to describe the Results of a Step.", + properties: { + description: { + description: "Description is a human-readable description of the result", + type: "string" + }, + name: { + description: "Name the given name", + type: "string" + }, + properties: { + additionalProperties: { + description: "PropertySpec defines the struct for object keys", + properties: { + type: { + description: "ParamType indicates the type of an input parameter;\nUsed to distinguish between a single string and an array of strings.", + type: "string" + } + }, + type: "object" + }, + description: "Properties is the JSON Schema properties to support key-value pairs results.", + type: "object" + }, + type: { + description: "The possible types are 'string', 'array', and 'object', with 'string' as the default.", + type: "string" + } + }, + required: ["name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + script: { + description: "Script is the contents of an executable file to execute.\n\nIf Script is not empty, the Step cannot have an Command and the Args will be passed to the Script.", + type: "string" + }, + securityContext: { + description: "SecurityContext defines the security options the Step should be run with.\nIf set, the fields of SecurityContext override the equivalent fields of PodSecurityContext.\nMore info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/\nThe value set in StepAction will take precedence over the value from Task.", + properties: { + allowPrivilegeEscalation: { + description: "AllowPrivilegeEscalation controls whether a process can gain more\nprivileges than its parent process. This bool directly controls if\nthe no_new_privs flag will be set on the container process.\nAllowPrivilegeEscalation is true always when the container is:\n1) run as Privileged\n2) has CAP_SYS_ADMIN\nNote that this field cannot be set when spec.os.name is windows.", + type: "boolean" + }, + appArmorProfile: { + description: "appArmorProfile is the AppArmor options to use by this container. If set, this profile\noverrides the pod's appArmorProfile.\nNote that this field cannot be set when spec.os.name is windows.", + properties: { + localhostProfile: { + description: "localhostProfile indicates a profile loaded on the node that should be used.\nThe profile must be preconfigured on the node to work.\nMust match the loaded name of the profile.\nMust be set if and only if type is \"Localhost\".", + type: "string" + }, + type: { + description: "type indicates which kind of AppArmor profile will be applied.\nValid options are:\n Localhost - a profile pre-loaded on the node.\n RuntimeDefault - the container runtime's default profile.\n Unconfined - no AppArmor enforcement.", + type: "string" + } + }, + required: ["type"], + type: "object" + }, + capabilities: { + description: "The capabilities to add/drop when running containers.\nDefaults to the default set of capabilities granted by the container runtime.\nNote that this field cannot be set when spec.os.name is windows.", + properties: { + add: { + description: "Added capabilities", + items: { + description: "Capability represent POSIX capabilities type", + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + drop: { + description: "Removed capabilities", + items: { + description: "Capability represent POSIX capabilities type", + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + privileged: { + description: "Run container in privileged mode.\nProcesses in privileged containers are essentially equivalent to root on the host.\nDefaults to false.\nNote that this field cannot be set when spec.os.name is windows.", + type: "boolean" + }, + procMount: { + description: "procMount denotes the type of proc mount to use for the containers.\nThe default value is Default which uses the container runtime defaults for\nreadonly paths and masked paths.\nThis requires the ProcMountType feature flag to be enabled.\nNote that this field cannot be set when spec.os.name is windows.", + type: "string" + }, + readOnlyRootFilesystem: { + description: "Whether this container has a read-only root filesystem.\nDefault is false.\nNote that this field cannot be set when spec.os.name is windows.", + type: "boolean" + }, + runAsGroup: { + description: "The GID to run the entrypoint of the container process.\nUses runtime default if unset.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is windows.", + format: "int64", + type: "integer" + }, + runAsNonRoot: { + description: "Indicates that the container must run as a non-root user.\nIf true, the Kubelet will validate the image at runtime to ensure that it\ndoes not run as UID 0 (root) and fail to start the container if it does.\nIf unset or false, no such validation will be performed.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.", + type: "boolean" + }, + runAsUser: { + description: "The UID to run the entrypoint of the container process.\nDefaults to user specified in image metadata if unspecified.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is windows.", + format: "int64", + type: "integer" + }, + seccompProfile: { + description: "The seccomp options to use by this container. If seccomp options are\nprovided at both the pod & container level, the container options\noverride the pod options.\nNote that this field cannot be set when spec.os.name is windows.", + properties: { + localhostProfile: { + description: "localhostProfile indicates a profile defined in a file on the node should be used.\nThe profile must be preconfigured on the node to work.\nMust be a descending path, relative to the kubelet's configured seccomp profile location.\nMust be set if type is \"Localhost\". Must NOT be set for any other type.", + type: "string" + }, + type: { + description: "type indicates which kind of seccomp profile will be applied.\nValid options are:\n\nLocalhost - a profile defined in a file on the node should be used.\nRuntimeDefault - the container runtime default profile should be used.\nUnconfined - no profile should be applied.", + type: "string" + } + }, + required: ["type"], + type: "object" + }, + seLinuxOptions: { + description: "The SELinux context to be applied to the container.\nIf unspecified, the container runtime will allocate a random SELinux context for each\ncontainer. May also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is windows.", + properties: { + level: { + description: "Level is SELinux level label that applies to the container.", + type: "string" + }, + role: { + description: "Role is a SELinux role label that applies to the container.", + type: "string" + }, + type: { + description: "Type is a SELinux type label that applies to the container.", + type: "string" + }, + user: { + description: "User is a SELinux user label that applies to the container.", + type: "string" + } + }, + type: "object" + }, + windowsOptions: { + description: "The Windows specific settings applied to all containers.\nIf unspecified, the options from the PodSecurityContext will be used.\nIf set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is linux.", + properties: { + gmsaCredentialSpec: { + description: "GMSACredentialSpec is where the GMSA admission webhook\n(https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the\nGMSA credential spec named by the GMSACredentialSpecName field.", + type: "string" + }, + gmsaCredentialSpecName: { + description: "GMSACredentialSpecName is the name of the GMSA credential spec to use.", + type: "string" + }, + hostProcess: { + description: "HostProcess determines if a container should be run as a 'Host Process' container.\nAll of a Pod's containers must have the same effective HostProcess value\n(it is not allowed to have a mix of HostProcess containers and non-HostProcess containers).\nIn addition, if HostProcess is true then HostNetwork must also be set to true.", + type: "boolean" + }, + runAsUserName: { + description: "The UserName in Windows to run the entrypoint of the container process.\nDefaults to the user specified in image metadata if unspecified.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.", + type: "string" + } + }, + type: "object" + } + }, + type: "object" + }, + volumeMounts: { + description: "Volumes to mount into the Step's filesystem.\nCannot be updated.", + items: { + description: "VolumeMount describes a mounting of a Volume within a container.", + properties: { + mountPath: { + description: "Path within the container at which the volume should be mounted. Must\nnot contain ':'.", + type: "string" + }, + mountPropagation: { + description: "mountPropagation determines how mounts are propagated from the host\nto container and the other way around.\nWhen not set, MountPropagationNone is used.\nThis field is beta in 1.10.\nWhen RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified\n(which defaults to None).", + type: "string" + }, + name: { + description: "This must match the Name of a Volume.", + type: "string" + }, + readOnly: { + description: "Mounted read-only if true, read-write otherwise (false or unspecified).\nDefaults to false.", + type: "boolean" + }, + recursiveReadOnly: { + description: "RecursiveReadOnly specifies whether read-only mounts should be handled\nrecursively.\n\nIf ReadOnly is false, this field has no meaning and must be unspecified.\n\nIf ReadOnly is true, and this field is set to Disabled, the mount is not made\nrecursively read-only. If this field is set to IfPossible, the mount is made\nrecursively read-only, if it is supported by the container runtime. If this\nfield is set to Enabled, the mount is made recursively read-only if it is\nsupported by the container runtime, otherwise the pod will not be started and\nan error will be generated to indicate the reason.\n\nIf this field is set to IfPossible or Enabled, MountPropagation must be set to\nNone (or be unspecified, which defaults to None).\n\nIf this field is not specified, it is treated as an equivalent of Disabled.", + type: "string" + }, + subPath: { + description: "Path within the volume from which the container's volume should be mounted.\nDefaults to \"\" (volume's root).", + type: "string" + }, + subPathExpr: { + description: "Expanded path within the volume from which the container's volume should be mounted.\nBehaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment.\nDefaults to \"\" (volume's root).\nSubPathExpr and SubPath are mutually exclusive.", + type: "string" + } + }, + required: ["mountPath", "name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + workingDir: { + description: "Step's working directory.\nIf not specified, the container runtime's default will be used, which\nmight be configured in the container image.\nCannot be updated.", + type: "string" + } + }, + type: "object" + } + }, + type: "object" + } + }, + served: true, + storage: false, + subresources: { + status: {} + } + }, { + name: "v1beta1", + schema: { + openAPIV3Schema: { + description: "StepAction", + properties: { + apiVersion: { + description: "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", + type: "string" + }, + kind: { + description: "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + type: "string" + }, + metadata: { + type: "object" + }, + spec: { + description: "Spec", + properties: { + args: { + description: "Args", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + command: { + description: "Command", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + description: { + description: "Description", + type: "string" + }, + env: { + description: "Env", + items: { + description: "EnvVar represents an environment variable present in a Container.", + properties: { + name: { + description: "Name of the environment variable.\nMay consist of any printable ASCII characters except '='.", + type: "string" + }, + value: { + description: "Variable references $(VAR_NAME) are expanded\nusing the previously defined environment variables in the container and\nany service environment variables. If a variable cannot be resolved,\nthe reference in the input string will be unchanged. Double $$ are reduced\nto a single $, which allows for escaping the $(VAR_NAME) syntax: i.e.\n\"$$(VAR_NAME)\" will produce the string literal \"$(VAR_NAME)\".\nEscaped references will never be expanded, regardless of whether the variable\nexists or not.\nDefaults to \"\".", + type: "string" + }, + valueFrom: { + description: "Source for the environment variable's value. Cannot be used if value is not empty.", + properties: { + configMapKeyRef: { + description: "Selects a key of a ConfigMap.", + properties: { + key: { + description: "The key to select.", + type: "string" + }, + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "Specify whether the ConfigMap or its key must be defined", + type: "boolean" + } + }, + required: ["key"], + type: "object", + "x-kubernetes-map-type": "atomic" + }, + fieldRef: { + description: "Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`,\nspec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs.", + properties: { + apiVersion: { + description: "Version of the schema the FieldPath is written in terms of, defaults to \"v1\".", + type: "string" + }, + fieldPath: { + description: "Path of the field to select in the specified API version.", + type: "string" + } + }, + required: ["fieldPath"], + type: "object", + "x-kubernetes-map-type": "atomic" + }, + fileKeyRef: { + description: "FileKeyRef selects a key of the env file.\nRequires the EnvFiles feature gate to be enabled.", + properties: { + key: { + description: "The key within the env file. An invalid key will prevent the pod from starting.\nThe keys defined within a source may consist of any printable ASCII characters except '='.\nDuring Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.", + type: "string" + }, + optional: { + default: false, + description: "Specify whether the file or its key must be defined. If the file or key\ndoes not exist, then the env var is not published.\nIf optional is set to true and the specified key does not exist,\nthe environment variable will not be set in the Pod's containers.\n\nIf optional is set to false and the specified key does not exist,\nan error will be returned during Pod creation.", + type: "boolean" + }, + path: { + description: "The path within the volume from which to select the file.\nMust be relative and may not contain the '..' path or start with '..'.", + type: "string" + }, + volumeName: { + description: "The name of the volume mount containing the env file.", + type: "string" + } + }, + required: ["key", "path", "volumeName"], + type: "object", + "x-kubernetes-map-type": "atomic" + }, + resourceFieldRef: { + description: "Selects a resource of the container: only resources limits and requests\n(limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported.", + properties: { + containerName: { + description: "Container name: required for volumes, optional for env vars", + type: "string" + }, + divisor: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Specifies the output format of the exposed resources, defaults to \"1\"", + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + }, + resource: { + description: "Required: resource to select", + type: "string" + } + }, + required: ["resource"], + type: "object", + "x-kubernetes-map-type": "atomic" + }, + secretKeyRef: { + description: "Selects a key of a secret in the pod's namespace", + properties: { + key: { + description: "The key of the secret to select from. Must be a valid secret key.", + type: "string" + }, + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "Specify whether the Secret or its key must be defined", + type: "boolean" + } + }, + required: ["key"], + type: "object", + "x-kubernetes-map-type": "atomic" + } + }, + type: "object" + } + }, + required: ["name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + image: { + description: "Image", + type: "string" + }, + params: { + description: "Params", + items: { + description: "ParamSpec defines arbitrary parameters needed beyond typed inputs (such as\nresources). Parameter values are provided by users as inputs on a TaskRun\nor PipelineRun.", + properties: { + default: { + description: "Default is the value a parameter takes if no input value is supplied. If\ndefault is set, a Task may be executed without a supplied value for the\nparameter.", + "x-kubernetes-preserve-unknown-fields": true + }, + description: { + description: "Description is a user-facing description of the parameter that may be\nused to populate a UI.", + type: "string" + }, + enum: { + description: "Enum declares a set of allowed param input values for tasks/pipelines that can be validated.\nIf Enum is not set, no input validation is performed for the param.", + items: { + type: "string" + }, + type: "array" + }, + name: { + description: "Name declares the name by which a parameter is referenced.", + type: "string" + }, + properties: { + additionalProperties: { + description: "PropertySpec defines the struct for object keys", + properties: { + type: { + description: "ParamType indicates the type of an input parameter;\nUsed to distinguish between a single string and an array of strings.", + type: "string" + } + }, + type: "object" + }, + description: "Properties is the JSON Schema properties to support key-value pairs parameter.", + type: "object" + }, + type: { + description: "Type is the user-specified type of the parameter. The possible types\nare currently \"string\", \"array\" and \"object\", and \"string\" is the default.", + type: "string" + } + }, + required: ["name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + results: { + description: "Results", + items: { + description: "StepResult used to describe the Results of a Step.", + properties: { + description: { + description: "Description is a human-readable description of the result", + type: "string" + }, + name: { + description: "Name the given name", + type: "string" + }, + properties: { + additionalProperties: { + description: "PropertySpec defines the struct for object keys", + properties: { + type: { + description: "ParamType indicates the type of an input parameter;\nUsed to distinguish between a single string and an array of strings.", + type: "string" + } + }, + type: "object" + }, + description: "Properties is the JSON Schema properties to support key-value pairs results.", + type: "object" + }, + type: { + description: "The possible types are 'string', 'array', and 'object', with 'string' as the default.", + type: "string" + } + }, + required: ["name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + script: { + description: "Script", + type: "string" + }, + securityContext: { + description: "SecurityContext", + properties: { + allowPrivilegeEscalation: { + description: "AllowPrivilegeEscalation controls whether a process can gain more\nprivileges than its parent process. This bool directly controls if\nthe no_new_privs flag will be set on the container process.\nAllowPrivilegeEscalation is true always when the container is:\n1) run as Privileged\n2) has CAP_SYS_ADMIN\nNote that this field cannot be set when spec.os.name is windows.", + type: "boolean" + }, + appArmorProfile: { + description: "appArmorProfile is the AppArmor options to use by this container. If set, this profile\noverrides the pod's appArmorProfile.\nNote that this field cannot be set when spec.os.name is windows.", + properties: { + localhostProfile: { + description: "localhostProfile indicates a profile loaded on the node that should be used.\nThe profile must be preconfigured on the node to work.\nMust match the loaded name of the profile.\nMust be set if and only if type is \"Localhost\".", + type: "string" + }, + type: { + description: "type indicates which kind of AppArmor profile will be applied.\nValid options are:\n Localhost - a profile pre-loaded on the node.\n RuntimeDefault - the container runtime's default profile.\n Unconfined - no AppArmor enforcement.", + type: "string" + } + }, + required: ["type"], + type: "object" + }, + capabilities: { + description: "The capabilities to add/drop when running containers.\nDefaults to the default set of capabilities granted by the container runtime.\nNote that this field cannot be set when spec.os.name is windows.", + properties: { + add: { + description: "Added capabilities", + items: { + description: "Capability represent POSIX capabilities type", + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + drop: { + description: "Removed capabilities", + items: { + description: "Capability represent POSIX capabilities type", + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + privileged: { + description: "Run container in privileged mode.\nProcesses in privileged containers are essentially equivalent to root on the host.\nDefaults to false.\nNote that this field cannot be set when spec.os.name is windows.", + type: "boolean" + }, + procMount: { + description: "procMount denotes the type of proc mount to use for the containers.\nThe default value is Default which uses the container runtime defaults for\nreadonly paths and masked paths.\nThis requires the ProcMountType feature flag to be enabled.\nNote that this field cannot be set when spec.os.name is windows.", + type: "string" + }, + readOnlyRootFilesystem: { + description: "Whether this container has a read-only root filesystem.\nDefault is false.\nNote that this field cannot be set when spec.os.name is windows.", + type: "boolean" + }, + runAsGroup: { + description: "The GID to run the entrypoint of the container process.\nUses runtime default if unset.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is windows.", + format: "int64", + type: "integer" + }, + runAsNonRoot: { + description: "Indicates that the container must run as a non-root user.\nIf true, the Kubelet will validate the image at runtime to ensure that it\ndoes not run as UID 0 (root) and fail to start the container if it does.\nIf unset or false, no such validation will be performed.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.", + type: "boolean" + }, + runAsUser: { + description: "The UID to run the entrypoint of the container process.\nDefaults to user specified in image metadata if unspecified.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is windows.", + format: "int64", + type: "integer" + }, + seccompProfile: { + description: "The seccomp options to use by this container. If seccomp options are\nprovided at both the pod & container level, the container options\noverride the pod options.\nNote that this field cannot be set when spec.os.name is windows.", + properties: { + localhostProfile: { + description: "localhostProfile indicates a profile defined in a file on the node should be used.\nThe profile must be preconfigured on the node to work.\nMust be a descending path, relative to the kubelet's configured seccomp profile location.\nMust be set if type is \"Localhost\". Must NOT be set for any other type.", + type: "string" + }, + type: { + description: "type indicates which kind of seccomp profile will be applied.\nValid options are:\n\nLocalhost - a profile defined in a file on the node should be used.\nRuntimeDefault - the container runtime default profile should be used.\nUnconfined - no profile should be applied.", + type: "string" + } + }, + required: ["type"], + type: "object" + }, + seLinuxOptions: { + description: "The SELinux context to be applied to the container.\nIf unspecified, the container runtime will allocate a random SELinux context for each\ncontainer. May also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is windows.", + properties: { + level: { + description: "Level is SELinux level label that applies to the container.", + type: "string" + }, + role: { + description: "Role is a SELinux role label that applies to the container.", + type: "string" + }, + type: { + description: "Type is a SELinux type label that applies to the container.", + type: "string" + }, + user: { + description: "User is a SELinux user label that applies to the container.", + type: "string" + } + }, + type: "object" + }, + windowsOptions: { + description: "The Windows specific settings applied to all containers.\nIf unspecified, the options from the PodSecurityContext will be used.\nIf set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is linux.", + properties: { + gmsaCredentialSpec: { + description: "GMSACredentialSpec is where the GMSA admission webhook\n(https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the\nGMSA credential spec named by the GMSACredentialSpecName field.", + type: "string" + }, + gmsaCredentialSpecName: { + description: "GMSACredentialSpecName is the name of the GMSA credential spec to use.", + type: "string" + }, + hostProcess: { + description: "HostProcess determines if a container should be run as a 'Host Process' container.\nAll of a Pod's containers must have the same effective HostProcess value\n(it is not allowed to have a mix of HostProcess containers and non-HostProcess containers).\nIn addition, if HostProcess is true then HostNetwork must also be set to true.", + type: "boolean" + }, + runAsUserName: { + description: "The UserName in Windows to run the entrypoint of the container process.\nDefaults to the user specified in image metadata if unspecified.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.", + type: "string" + } + }, + type: "object" + } + }, + type: "object" + }, + volumeMounts: { + description: "VolumeMounts", + items: { + description: "VolumeMount describes a mounting of a Volume within a container.", + properties: { + mountPath: { + description: "Path within the container at which the volume should be mounted. Must\nnot contain ':'.", + type: "string" + }, + mountPropagation: { + description: "mountPropagation determines how mounts are propagated from the host\nto container and the other way around.\nWhen not set, MountPropagationNone is used.\nThis field is beta in 1.10.\nWhen RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified\n(which defaults to None).", + type: "string" + }, + name: { + description: "This must match the Name of a Volume.", + type: "string" + }, + readOnly: { + description: "Mounted read-only if true, read-write otherwise (false or unspecified).\nDefaults to false.", + type: "boolean" + }, + recursiveReadOnly: { + description: "RecursiveReadOnly specifies whether read-only mounts should be handled\nrecursively.\n\nIf ReadOnly is false, this field has no meaning and must be unspecified.\n\nIf ReadOnly is true, and this field is set to Disabled, the mount is not made\nrecursively read-only. If this field is set to IfPossible, the mount is made\nrecursively read-only, if it is supported by the container runtime. If this\nfield is set to Enabled, the mount is made recursively read-only if it is\nsupported by the container runtime, otherwise the pod will not be started and\nan error will be generated to indicate the reason.\n\nIf this field is set to IfPossible or Enabled, MountPropagation must be set to\nNone (or be unspecified, which defaults to None).\n\nIf this field is not specified, it is treated as an equivalent of Disabled.", + type: "string" + }, + subPath: { + description: "Path within the volume from which the container's volume should be mounted.\nDefaults to \"\" (volume's root).", + type: "string" + }, + subPathExpr: { + description: "Expanded path within the volume from which the container's volume should be mounted.\nBehaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment.\nDefaults to \"\" (volume's root).\nSubPathExpr and SubPath are mutually exclusive.", + type: "string" + } + }, + required: ["mountPath", "name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + workingDir: { + description: "WorkingDir", + type: "string" + } + }, + type: "object" + } + }, + type: "object" + } + }, + served: true, + storage: true, + subresources: { + status: {} + } + }] + } +}; +export const CustomResourceDefinition_TasksTektonDev: KubernetesResource = { + apiVersion: "apiextensions.k8s.io/v1", + kind: "CustomResourceDefinition", + metadata: { + labels: { + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/part-of": "tekton-pipelines", + "pipeline.tekton.dev/release": "v1.15.0", + version: "v1.15.0" + }, + name: "tasks.tekton.dev" + }, + spec: { + conversion: { + strategy: "Webhook", + webhook: { + clientConfig: { + service: { + name: "tekton-pipelines-webhook", + namespace: "tekton-pipelines" + } + }, + conversionReviewVersions: ["v1beta1", "v1"] + } + }, + group: "tekton.dev", + names: { + categories: ["tekton", "tekton-pipelines"], + kind: "Task", + plural: "tasks", + singular: "task" + }, + preserveUnknownFields: false, + scope: "Namespaced", + versions: [{ + name: "v1beta1", + schema: { + openAPIV3Schema: { + description: "Task\nDeprecated: Please use v1.Task instead.", + properties: { + apiVersion: { + description: "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", + type: "string" + }, + kind: { + description: "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + type: "string" + }, + metadata: { + type: "object" + }, + spec: { + description: "Spec", + properties: { + description: { + description: "Description", + type: "string" + }, + displayName: { + description: "DisplayName", + type: "string" + }, + params: { + description: "Params", + items: { + description: "ParamSpec", + properties: { + default: { + description: "Default", + "x-kubernetes-preserve-unknown-fields": true + }, + description: { + description: "Description", + type: "string" + }, + enum: { + description: "Enum", + items: { + type: "string" + }, + type: "array" + }, + name: { + description: "Name", + type: "string" + }, + properties: { + additionalProperties: { + description: "PropertySpec", + properties: { + type: { + description: "ParamType", + type: "string" + } + }, + type: "object" + }, + description: "Properties", + type: "object" + }, + type: { + description: "Type", + type: "string" + } + }, + required: ["name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + resources: { + description: "Resources\nDeprecated: Unused, preserved only for backwards compatibility", + properties: { + inputs: { + description: "Inputs", + items: { + description: "TaskResource\nDeprecated: Unused, preserved only for backwards compatibility", + properties: { + description: { + description: "Description is a user-facing description of the declared resource that may be\nused to populate a UI.", + type: "string" + }, + name: { + description: "Name declares the name by which a resource is referenced in the\ndefinition. Resources may be referenced by name in the definition of a\nTask's steps.", + type: "string" + }, + optional: { + description: "Optional declares the resource as optional.\nBy default optional is set to false which makes a resource required.\noptional: true - the resource is considered optional\noptional: false - the resource is considered required (equivalent of not specifying it)", + type: "boolean" + }, + targetPath: { + description: "TargetPath is the path in workspace directory where the resource\nwill be copied.", + type: "string" + }, + type: { + description: "Type is the type of this resource;", + type: "string" + } + }, + required: ["name", "type"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + outputs: { + description: "Outputs", + items: { + description: "TaskResource\nDeprecated: Unused, preserved only for backwards compatibility", + properties: { + description: { + description: "Description is a user-facing description of the declared resource that may be\nused to populate a UI.", + type: "string" + }, + name: { + description: "Name declares the name by which a resource is referenced in the\ndefinition. Resources may be referenced by name in the definition of a\nTask's steps.", + type: "string" + }, + optional: { + description: "Optional declares the resource as optional.\nBy default optional is set to false which makes a resource required.\noptional: true - the resource is considered optional\noptional: false - the resource is considered required (equivalent of not specifying it)", + type: "boolean" + }, + targetPath: { + description: "TargetPath is the path in workspace directory where the resource\nwill be copied.", + type: "string" + }, + type: { + description: "Type is the type of this resource;", + type: "string" + } + }, + required: ["name", "type"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + results: { + description: "Results", + items: { + description: "TaskResult", + properties: { + description: { + description: "Description", + type: "string" + }, + name: { + description: "Name", + type: "string" + }, + properties: { + additionalProperties: { + description: "PropertySpec", + properties: { + type: { + description: "ParamType", + type: "string" + } + }, + type: "object" + }, + description: "Properties", + type: "object" + }, + type: { + description: "Type", + type: "string" + }, + value: { + description: "Value", + "x-kubernetes-preserve-unknown-fields": true + } + }, + required: ["name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + sidecars: { + description: "Sidecars", + items: { + description: "Sidecar", + properties: { + args: { + description: "Args", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + command: { + description: "Command", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + env: { + description: "Env", + items: { + description: "EnvVar represents an environment variable present in a Container.", + properties: { + name: { + description: "Name of the environment variable.\nMay consist of any printable ASCII characters except '='.", + type: "string" + }, + value: { + description: "Variable references $(VAR_NAME) are expanded\nusing the previously defined environment variables in the container and\nany service environment variables. If a variable cannot be resolved,\nthe reference in the input string will be unchanged. Double $$ are reduced\nto a single $, which allows for escaping the $(VAR_NAME) syntax: i.e.\n\"$$(VAR_NAME)\" will produce the string literal \"$(VAR_NAME)\".\nEscaped references will never be expanded, regardless of whether the variable\nexists or not.\nDefaults to \"\".", + type: "string" + }, + valueFrom: { + description: "Source for the environment variable's value. Cannot be used if value is not empty.", + properties: { + configMapKeyRef: { + description: "Selects a key of a ConfigMap.", + properties: { + key: { + description: "The key to select.", + type: "string" + }, + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "Specify whether the ConfigMap or its key must be defined", + type: "boolean" + } + }, + required: ["key"], + type: "object", + "x-kubernetes-map-type": "atomic" + }, + fieldRef: { + description: "Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`,\nspec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs.", + properties: { + apiVersion: { + description: "Version of the schema the FieldPath is written in terms of, defaults to \"v1\".", + type: "string" + }, + fieldPath: { + description: "Path of the field to select in the specified API version.", + type: "string" + } + }, + required: ["fieldPath"], + type: "object", + "x-kubernetes-map-type": "atomic" + }, + fileKeyRef: { + description: "FileKeyRef selects a key of the env file.\nRequires the EnvFiles feature gate to be enabled.", + properties: { + key: { + description: "The key within the env file. An invalid key will prevent the pod from starting.\nThe keys defined within a source may consist of any printable ASCII characters except '='.\nDuring Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.", + type: "string" + }, + optional: { + default: false, + description: "Specify whether the file or its key must be defined. If the file or key\ndoes not exist, then the env var is not published.\nIf optional is set to true and the specified key does not exist,\nthe environment variable will not be set in the Pod's containers.\n\nIf optional is set to false and the specified key does not exist,\nan error will be returned during Pod creation.", + type: "boolean" + }, + path: { + description: "The path within the volume from which to select the file.\nMust be relative and may not contain the '..' path or start with '..'.", + type: "string" + }, + volumeName: { + description: "The name of the volume mount containing the env file.", + type: "string" + } + }, + required: ["key", "path", "volumeName"], + type: "object", + "x-kubernetes-map-type": "atomic" + }, + resourceFieldRef: { + description: "Selects a resource of the container: only resources limits and requests\n(limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported.", + properties: { + containerName: { + description: "Container name: required for volumes, optional for env vars", + type: "string" + }, + divisor: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Specifies the output format of the exposed resources, defaults to \"1\"", + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + }, + resource: { + description: "Required: resource to select", + type: "string" + } + }, + required: ["resource"], + type: "object", + "x-kubernetes-map-type": "atomic" + }, + secretKeyRef: { + description: "Selects a key of a secret in the pod's namespace", + properties: { + key: { + description: "The key of the secret to select from. Must be a valid secret key.", + type: "string" + }, + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "Specify whether the Secret or its key must be defined", + type: "boolean" + } + }, + required: ["key"], + type: "object", + "x-kubernetes-map-type": "atomic" + } + }, + type: "object" + } + }, + required: ["name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + envFrom: { + description: "EnvFrom", + items: { + description: "EnvFromSource represents the source of a set of ConfigMaps or Secrets", + properties: { + configMapRef: { + description: "The ConfigMap to select from", + properties: { + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "Specify whether the ConfigMap must be defined", + type: "boolean" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + prefix: { + description: "Optional text to prepend to the name of each environment variable.\nMay consist of any printable ASCII characters except '='.", + type: "string" + }, + secretRef: { + description: "The Secret to select from", + properties: { + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "Specify whether the Secret must be defined", + type: "boolean" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + } + }, + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + image: { + description: "Image", + type: "string" + }, + imagePullPolicy: { + description: "ImagePullPolicy", + type: "string" + }, + lifecycle: { + description: "Lifecycle", + properties: { + postStart: { + description: "PostStart is called immediately after a container is created. If the handler fails,\nthe container is terminated and restarted according to its restart policy.\nOther management of the container blocks until the hook completes.\nMore info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks", + properties: { + exec: { + description: "Exec specifies a command to execute in the container.", + properties: { + command: { + description: "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + httpGet: { + description: "HTTPGet specifies an HTTP GET request to perform.", + properties: { + host: { + description: "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", + type: "string" + }, + httpHeaders: { + description: "Custom headers to set in the request. HTTP allows repeated headers.", + items: { + description: "HTTPHeader describes a custom header to be used in HTTP probes", + properties: { + name: { + description: "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", + type: "string" + }, + value: { + description: "The header field value", + type: "string" + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + path: { + description: "Path to access on the HTTP server.", + type: "string" + }, + port: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true + }, + scheme: { + description: "Scheme to use for connecting to the host.\nDefaults to HTTP.", + type: "string" + } + }, + required: ["port"], + type: "object" + }, + sleep: { + description: "Sleep represents a duration that the container should sleep.", + properties: { + seconds: { + description: "Seconds is the number of seconds to sleep.", + format: "int64", + type: "integer" + } + }, + required: ["seconds"], + type: "object" + }, + tcpSocket: { + description: "Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept\nfor backward compatibility. There is no validation of this field and\nlifecycle hooks will fail at runtime when it is specified.", + properties: { + host: { + description: "Optional: Host name to connect to, defaults to the pod IP.", + type: "string" + }, + port: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true + } + }, + required: ["port"], + type: "object" + } + }, + type: "object" + }, + preStop: { + description: "PreStop is called immediately before a container is terminated due to an\nAPI request or management event such as liveness/startup probe failure,\npreemption, resource contention, etc. The handler is not called if the\ncontainer crashes or exits. The Pod's termination grace period countdown begins before the\nPreStop hook is executed. Regardless of the outcome of the handler, the\ncontainer will eventually terminate within the Pod's termination grace\nperiod (unless delayed by finalizers). Other management of the container blocks until the hook completes\nor until the termination grace period is reached.\nMore info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks", + properties: { + exec: { + description: "Exec specifies a command to execute in the container.", + properties: { + command: { + description: "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + httpGet: { + description: "HTTPGet specifies an HTTP GET request to perform.", + properties: { + host: { + description: "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", + type: "string" + }, + httpHeaders: { + description: "Custom headers to set in the request. HTTP allows repeated headers.", + items: { + description: "HTTPHeader describes a custom header to be used in HTTP probes", + properties: { + name: { + description: "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", + type: "string" + }, + value: { + description: "The header field value", + type: "string" + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + path: { + description: "Path to access on the HTTP server.", + type: "string" + }, + port: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true + }, + scheme: { + description: "Scheme to use for connecting to the host.\nDefaults to HTTP.", + type: "string" + } + }, + required: ["port"], + type: "object" + }, + sleep: { + description: "Sleep represents a duration that the container should sleep.", + properties: { + seconds: { + description: "Seconds is the number of seconds to sleep.", + format: "int64", + type: "integer" + } + }, + required: ["seconds"], + type: "object" + }, + tcpSocket: { + description: "Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept\nfor backward compatibility. There is no validation of this field and\nlifecycle hooks will fail at runtime when it is specified.", + properties: { + host: { + description: "Optional: Host name to connect to, defaults to the pod IP.", + type: "string" + }, + port: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true + } + }, + required: ["port"], + type: "object" + } + }, + type: "object" + }, + stopSignal: { + description: "StopSignal defines which signal will be sent to a container when it is being stopped.\nIf not specified, the default is defined by the container runtime in use.\nStopSignal can only be set for Pods with a non-empty .spec.os.name", + type: "string" + } + }, + type: "object" + }, + livenessProbe: { + description: "LivenessProbe", + properties: { + exec: { + description: "Exec specifies a command to execute in the container.", + properties: { + command: { + description: "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + failureThreshold: { + description: "Minimum consecutive failures for the probe to be considered failed after having succeeded.\nDefaults to 3. Minimum value is 1.", + format: "int32", + type: "integer" + }, + grpc: { + description: "GRPC specifies a GRPC HealthCheckRequest.", + properties: { + port: { + description: "Port number of the gRPC service. Number must be in the range 1 to 65535.", + format: "int32", + type: "integer" + }, + service: { + default: "", + description: "Service is the name of the service to place in the gRPC HealthCheckRequest\n(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).\n\nIf this is not specified, the default behavior is defined by gRPC.", + type: "string" + } + }, + required: ["port"], + type: "object" + }, + httpGet: { + description: "HTTPGet specifies an HTTP GET request to perform.", + properties: { + host: { + description: "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", + type: "string" + }, + httpHeaders: { + description: "Custom headers to set in the request. HTTP allows repeated headers.", + items: { + description: "HTTPHeader describes a custom header to be used in HTTP probes", + properties: { + name: { + description: "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", + type: "string" + }, + value: { + description: "The header field value", + type: "string" + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + path: { + description: "Path to access on the HTTP server.", + type: "string" + }, + port: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true + }, + scheme: { + description: "Scheme to use for connecting to the host.\nDefaults to HTTP.", + type: "string" + } + }, + required: ["port"], + type: "object" + }, + initialDelaySeconds: { + description: "Number of seconds after the container has started before liveness probes are initiated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + format: "int32", + type: "integer" + }, + periodSeconds: { + description: "How often (in seconds) to perform the probe.\nDefault to 10 seconds. Minimum value is 1.", + format: "int32", + type: "integer" + }, + successThreshold: { + description: "Minimum consecutive successes for the probe to be considered successful after having failed.\nDefaults to 1. Must be 1 for liveness and startup. Minimum value is 1.", + format: "int32", + type: "integer" + }, + tcpSocket: { + description: "TCPSocket specifies a connection to a TCP port.", + properties: { + host: { + description: "Optional: Host name to connect to, defaults to the pod IP.", + type: "string" + }, + port: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true + } + }, + required: ["port"], + type: "object" + }, + terminationGracePeriodSeconds: { + description: "Optional duration in seconds the pod needs to terminate gracefully upon probe failure.\nThe grace period is the duration in seconds after the processes running in the pod are sent\na termination signal and the time when the processes are forcibly halted with a kill signal.\nSet this value longer than the expected cleanup time for your process.\nIf this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this\nvalue overrides the value provided by the pod spec.\nValue must be non-negative integer. The value zero indicates stop immediately via\nthe kill signal (no opportunity to shut down).\nThis is a beta field and requires enabling ProbeTerminationGracePeriod feature gate.\nMinimum value is 1. spec.terminationGracePeriodSeconds is used if unset.", + format: "int64", + type: "integer" + }, + timeoutSeconds: { + description: "Number of seconds after which the probe times out.\nDefaults to 1 second. Minimum value is 1.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + format: "int32", + type: "integer" + } + }, + type: "object" + }, + name: { + description: "Name", + type: "string" + }, + ports: { + description: "Ports", + items: { + description: "ContainerPort represents a network port in a single container.", + properties: { + containerPort: { + description: "Number of port to expose on the pod's IP address.\nThis must be a valid port number, 0 < x < 65536.", + format: "int32", + type: "integer" + }, + hostIP: { + description: "What host IP to bind the external port to.", + type: "string" + }, + hostPort: { + description: "Number of port to expose on the host.\nIf specified, this must be a valid port number, 0 < x < 65536.\nIf HostNetwork is specified, this must match ContainerPort.\nMost containers do not need this.", + format: "int32", + type: "integer" + }, + name: { + description: "If specified, this must be an IANA_SVC_NAME and unique within the pod. Each\nnamed port in a pod must have a unique name. Name for the port that can be\nreferred to by services.", + type: "string" + }, + protocol: { + default: "TCP", + description: "Protocol for port. Must be UDP, TCP, or SCTP.\nDefaults to \"TCP\".", + type: "string" + } + }, + required: ["containerPort"], + type: "object" + }, + type: "array", + "x-kubernetes-list-map-keys": ["containerPort", "protocol"], + "x-kubernetes-list-type": "map" + }, + readinessProbe: { + description: "ReadinessProbe", + properties: { + exec: { + description: "Exec specifies a command to execute in the container.", + properties: { + command: { + description: "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + failureThreshold: { + description: "Minimum consecutive failures for the probe to be considered failed after having succeeded.\nDefaults to 3. Minimum value is 1.", + format: "int32", + type: "integer" + }, + grpc: { + description: "GRPC specifies a GRPC HealthCheckRequest.", + properties: { + port: { + description: "Port number of the gRPC service. Number must be in the range 1 to 65535.", + format: "int32", + type: "integer" + }, + service: { + default: "", + description: "Service is the name of the service to place in the gRPC HealthCheckRequest\n(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).\n\nIf this is not specified, the default behavior is defined by gRPC.", + type: "string" + } + }, + required: ["port"], + type: "object" + }, + httpGet: { + description: "HTTPGet specifies an HTTP GET request to perform.", + properties: { + host: { + description: "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", + type: "string" + }, + httpHeaders: { + description: "Custom headers to set in the request. HTTP allows repeated headers.", + items: { + description: "HTTPHeader describes a custom header to be used in HTTP probes", + properties: { + name: { + description: "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", + type: "string" + }, + value: { + description: "The header field value", + type: "string" + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + path: { + description: "Path to access on the HTTP server.", + type: "string" + }, + port: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true + }, + scheme: { + description: "Scheme to use for connecting to the host.\nDefaults to HTTP.", + type: "string" + } + }, + required: ["port"], + type: "object" + }, + initialDelaySeconds: { + description: "Number of seconds after the container has started before liveness probes are initiated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + format: "int32", + type: "integer" + }, + periodSeconds: { + description: "How often (in seconds) to perform the probe.\nDefault to 10 seconds. Minimum value is 1.", + format: "int32", + type: "integer" + }, + successThreshold: { + description: "Minimum consecutive successes for the probe to be considered successful after having failed.\nDefaults to 1. Must be 1 for liveness and startup. Minimum value is 1.", + format: "int32", + type: "integer" + }, + tcpSocket: { + description: "TCPSocket specifies a connection to a TCP port.", + properties: { + host: { + description: "Optional: Host name to connect to, defaults to the pod IP.", + type: "string" + }, + port: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true + } + }, + required: ["port"], + type: "object" + }, + terminationGracePeriodSeconds: { + description: "Optional duration in seconds the pod needs to terminate gracefully upon probe failure.\nThe grace period is the duration in seconds after the processes running in the pod are sent\na termination signal and the time when the processes are forcibly halted with a kill signal.\nSet this value longer than the expected cleanup time for your process.\nIf this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this\nvalue overrides the value provided by the pod spec.\nValue must be non-negative integer. The value zero indicates stop immediately via\nthe kill signal (no opportunity to shut down).\nThis is a beta field and requires enabling ProbeTerminationGracePeriod feature gate.\nMinimum value is 1. spec.terminationGracePeriodSeconds is used if unset.", + format: "int64", + type: "integer" + }, + timeoutSeconds: { + description: "Number of seconds after which the probe times out.\nDefaults to 1 second. Minimum value is 1.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + format: "int32", + type: "integer" + } + }, + type: "object" + }, + resources: { + description: "Resources", + properties: { + claims: { + description: "Claims lists the names of resources, defined in spec.resourceClaims,\nthat are used by this container.\n\nThis field depends on the\nDynamicResourceAllocation feature gate.\n\nThis field is immutable. It can only be set for containers.", + items: { + description: "ResourceClaim references one entry in PodSpec.ResourceClaims.", + properties: { + name: { + description: "Name must match the name of one entry in pod.spec.resourceClaims of\nthe Pod where this field is used. It makes that resource available\ninside a container.", + type: "string" + }, + request: { + description: "Request is the name chosen for a request in the referenced claim.\nIf empty, everything from the claim is made available, otherwise\nonly the result of this request.", + type: "string" + } + }, + required: ["name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-map-keys": ["name"], + "x-kubernetes-list-type": "map" + }, + limits: { + additionalProperties: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + }, + description: "Limits describes the maximum amount of compute resources allowed.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + type: "object" + }, + requests: { + additionalProperties: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + }, + description: "Requests describes the minimum amount of compute resources required.\nIf Requests is omitted for a container, it defaults to Limits if that is explicitly specified,\notherwise to an implementation-defined value. Requests cannot exceed Limits.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + type: "object" + } + }, + type: "object" + }, + restartPolicy: { + description: "RestartPolicy", + type: "string" + }, + script: { + description: "Script", + type: "string" + }, + securityContext: { + description: "SecurityContext", + properties: { + allowPrivilegeEscalation: { + description: "AllowPrivilegeEscalation controls whether a process can gain more\nprivileges than its parent process. This bool directly controls if\nthe no_new_privs flag will be set on the container process.\nAllowPrivilegeEscalation is true always when the container is:\n1) run as Privileged\n2) has CAP_SYS_ADMIN\nNote that this field cannot be set when spec.os.name is windows.", + type: "boolean" + }, + appArmorProfile: { + description: "appArmorProfile is the AppArmor options to use by this container. If set, this profile\noverrides the pod's appArmorProfile.\nNote that this field cannot be set when spec.os.name is windows.", + properties: { + localhostProfile: { + description: "localhostProfile indicates a profile loaded on the node that should be used.\nThe profile must be preconfigured on the node to work.\nMust match the loaded name of the profile.\nMust be set if and only if type is \"Localhost\".", + type: "string" + }, + type: { + description: "type indicates which kind of AppArmor profile will be applied.\nValid options are:\n Localhost - a profile pre-loaded on the node.\n RuntimeDefault - the container runtime's default profile.\n Unconfined - no AppArmor enforcement.", + type: "string" + } + }, + required: ["type"], + type: "object" + }, + capabilities: { + description: "The capabilities to add/drop when running containers.\nDefaults to the default set of capabilities granted by the container runtime.\nNote that this field cannot be set when spec.os.name is windows.", + properties: { + add: { + description: "Added capabilities", + items: { + description: "Capability represent POSIX capabilities type", + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + drop: { + description: "Removed capabilities", + items: { + description: "Capability represent POSIX capabilities type", + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + privileged: { + description: "Run container in privileged mode.\nProcesses in privileged containers are essentially equivalent to root on the host.\nDefaults to false.\nNote that this field cannot be set when spec.os.name is windows.", + type: "boolean" + }, + procMount: { + description: "procMount denotes the type of proc mount to use for the containers.\nThe default value is Default which uses the container runtime defaults for\nreadonly paths and masked paths.\nThis requires the ProcMountType feature flag to be enabled.\nNote that this field cannot be set when spec.os.name is windows.", + type: "string" + }, + readOnlyRootFilesystem: { + description: "Whether this container has a read-only root filesystem.\nDefault is false.\nNote that this field cannot be set when spec.os.name is windows.", + type: "boolean" + }, + runAsGroup: { + description: "The GID to run the entrypoint of the container process.\nUses runtime default if unset.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is windows.", + format: "int64", + type: "integer" + }, + runAsNonRoot: { + description: "Indicates that the container must run as a non-root user.\nIf true, the Kubelet will validate the image at runtime to ensure that it\ndoes not run as UID 0 (root) and fail to start the container if it does.\nIf unset or false, no such validation will be performed.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.", + type: "boolean" + }, + runAsUser: { + description: "The UID to run the entrypoint of the container process.\nDefaults to user specified in image metadata if unspecified.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is windows.", + format: "int64", + type: "integer" + }, + seccompProfile: { + description: "The seccomp options to use by this container. If seccomp options are\nprovided at both the pod & container level, the container options\noverride the pod options.\nNote that this field cannot be set when spec.os.name is windows.", + properties: { + localhostProfile: { + description: "localhostProfile indicates a profile defined in a file on the node should be used.\nThe profile must be preconfigured on the node to work.\nMust be a descending path, relative to the kubelet's configured seccomp profile location.\nMust be set if type is \"Localhost\". Must NOT be set for any other type.", + type: "string" + }, + type: { + description: "type indicates which kind of seccomp profile will be applied.\nValid options are:\n\nLocalhost - a profile defined in a file on the node should be used.\nRuntimeDefault - the container runtime default profile should be used.\nUnconfined - no profile should be applied.", + type: "string" + } + }, + required: ["type"], + type: "object" + }, + seLinuxOptions: { + description: "The SELinux context to be applied to the container.\nIf unspecified, the container runtime will allocate a random SELinux context for each\ncontainer. May also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is windows.", + properties: { + level: { + description: "Level is SELinux level label that applies to the container.", + type: "string" + }, + role: { + description: "Role is a SELinux role label that applies to the container.", + type: "string" + }, + type: { + description: "Type is a SELinux type label that applies to the container.", + type: "string" + }, + user: { + description: "User is a SELinux user label that applies to the container.", + type: "string" + } + }, + type: "object" + }, + windowsOptions: { + description: "The Windows specific settings applied to all containers.\nIf unspecified, the options from the PodSecurityContext will be used.\nIf set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is linux.", + properties: { + gmsaCredentialSpec: { + description: "GMSACredentialSpec is where the GMSA admission webhook\n(https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the\nGMSA credential spec named by the GMSACredentialSpecName field.", + type: "string" + }, + gmsaCredentialSpecName: { + description: "GMSACredentialSpecName is the name of the GMSA credential spec to use.", + type: "string" + }, + hostProcess: { + description: "HostProcess determines if a container should be run as a 'Host Process' container.\nAll of a Pod's containers must have the same effective HostProcess value\n(it is not allowed to have a mix of HostProcess containers and non-HostProcess containers).\nIn addition, if HostProcess is true then HostNetwork must also be set to true.", + type: "boolean" + }, + runAsUserName: { + description: "The UserName in Windows to run the entrypoint of the container process.\nDefaults to the user specified in image metadata if unspecified.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.", + type: "string" + } + }, + type: "object" + } + }, + type: "object" + }, + startupProbe: { + description: "StartupProbe", + properties: { + exec: { + description: "Exec specifies a command to execute in the container.", + properties: { + command: { + description: "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + failureThreshold: { + description: "Minimum consecutive failures for the probe to be considered failed after having succeeded.\nDefaults to 3. Minimum value is 1.", + format: "int32", + type: "integer" + }, + grpc: { + description: "GRPC specifies a GRPC HealthCheckRequest.", + properties: { + port: { + description: "Port number of the gRPC service. Number must be in the range 1 to 65535.", + format: "int32", + type: "integer" + }, + service: { + default: "", + description: "Service is the name of the service to place in the gRPC HealthCheckRequest\n(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).\n\nIf this is not specified, the default behavior is defined by gRPC.", + type: "string" + } + }, + required: ["port"], + type: "object" + }, + httpGet: { + description: "HTTPGet specifies an HTTP GET request to perform.", + properties: { + host: { + description: "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", + type: "string" + }, + httpHeaders: { + description: "Custom headers to set in the request. HTTP allows repeated headers.", + items: { + description: "HTTPHeader describes a custom header to be used in HTTP probes", + properties: { + name: { + description: "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", + type: "string" + }, + value: { + description: "The header field value", + type: "string" + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + path: { + description: "Path to access on the HTTP server.", + type: "string" + }, + port: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true + }, + scheme: { + description: "Scheme to use for connecting to the host.\nDefaults to HTTP.", + type: "string" + } + }, + required: ["port"], + type: "object" + }, + initialDelaySeconds: { + description: "Number of seconds after the container has started before liveness probes are initiated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + format: "int32", + type: "integer" + }, + periodSeconds: { + description: "How often (in seconds) to perform the probe.\nDefault to 10 seconds. Minimum value is 1.", + format: "int32", + type: "integer" + }, + successThreshold: { + description: "Minimum consecutive successes for the probe to be considered successful after having failed.\nDefaults to 1. Must be 1 for liveness and startup. Minimum value is 1.", + format: "int32", + type: "integer" + }, + tcpSocket: { + description: "TCPSocket specifies a connection to a TCP port.", + properties: { + host: { + description: "Optional: Host name to connect to, defaults to the pod IP.", + type: "string" + }, + port: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true + } + }, + required: ["port"], + type: "object" + }, + terminationGracePeriodSeconds: { + description: "Optional duration in seconds the pod needs to terminate gracefully upon probe failure.\nThe grace period is the duration in seconds after the processes running in the pod are sent\na termination signal and the time when the processes are forcibly halted with a kill signal.\nSet this value longer than the expected cleanup time for your process.\nIf this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this\nvalue overrides the value provided by the pod spec.\nValue must be non-negative integer. The value zero indicates stop immediately via\nthe kill signal (no opportunity to shut down).\nThis is a beta field and requires enabling ProbeTerminationGracePeriod feature gate.\nMinimum value is 1. spec.terminationGracePeriodSeconds is used if unset.", + format: "int64", + type: "integer" + }, + timeoutSeconds: { + description: "Number of seconds after which the probe times out.\nDefaults to 1 second. Minimum value is 1.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + format: "int32", + type: "integer" + } + }, + type: "object" + }, + stdin: { + description: "Stdin", + type: "boolean" + }, + stdinOnce: { + description: "StdinOnce", + type: "boolean" + }, + terminationMessagePath: { + description: "TerminationMessagePath", + type: "string" + }, + terminationMessagePolicy: { + description: "TerminationMessagePolicy", + type: "string" + }, + tty: { + description: "TTY", + type: "boolean" + }, + volumeDevices: { + description: "VolumeDevices", + items: { + description: "volumeDevice describes a mapping of a raw block device within a container.", + properties: { + devicePath: { + description: "devicePath is the path inside of the container that the device will be mapped to.", + type: "string" + }, + name: { + description: "name must match the name of a persistentVolumeClaim in the pod", + type: "string" + } + }, + required: ["devicePath", "name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + volumeMounts: { + description: "VolumeMounts", + items: { + description: "VolumeMount describes a mounting of a Volume within a container.", + properties: { + mountPath: { + description: "Path within the container at which the volume should be mounted. Must\nnot contain ':'.", + type: "string" + }, + mountPropagation: { + description: "mountPropagation determines how mounts are propagated from the host\nto container and the other way around.\nWhen not set, MountPropagationNone is used.\nThis field is beta in 1.10.\nWhen RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified\n(which defaults to None).", + type: "string" + }, + name: { + description: "This must match the Name of a Volume.", + type: "string" + }, + readOnly: { + description: "Mounted read-only if true, read-write otherwise (false or unspecified).\nDefaults to false.", + type: "boolean" + }, + recursiveReadOnly: { + description: "RecursiveReadOnly specifies whether read-only mounts should be handled\nrecursively.\n\nIf ReadOnly is false, this field has no meaning and must be unspecified.\n\nIf ReadOnly is true, and this field is set to Disabled, the mount is not made\nrecursively read-only. If this field is set to IfPossible, the mount is made\nrecursively read-only, if it is supported by the container runtime. If this\nfield is set to Enabled, the mount is made recursively read-only if it is\nsupported by the container runtime, otherwise the pod will not be started and\nan error will be generated to indicate the reason.\n\nIf this field is set to IfPossible or Enabled, MountPropagation must be set to\nNone (or be unspecified, which defaults to None).\n\nIf this field is not specified, it is treated as an equivalent of Disabled.", + type: "string" + }, + subPath: { + description: "Path within the volume from which the container's volume should be mounted.\nDefaults to \"\" (volume's root).", + type: "string" + }, + subPathExpr: { + description: "Expanded path within the volume from which the container's volume should be mounted.\nBehaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment.\nDefaults to \"\" (volume's root).\nSubPathExpr and SubPath are mutually exclusive.", + type: "string" + } + }, + required: ["mountPath", "name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + workingDir: { + description: "WorkingDir", + type: "string" + }, + workspaces: { + description: "Workspaces", + items: { + description: "WorkspaceUsage", + properties: { + mountPath: { + description: "MountPath", + type: "string" + }, + name: { + description: "Name", + type: "string" + } + }, + required: ["mountPath", "name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + required: ["name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + steps: { + description: "Steps", + items: { + description: "Step", + properties: { + args: { + description: "Args", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + command: { + description: "Command", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + displayName: { + description: "DisplayName", + type: "string" + }, + env: { + description: "Env", + items: { + description: "EnvVar represents an environment variable present in a Container.", + properties: { + name: { + description: "Name of the environment variable.\nMay consist of any printable ASCII characters except '='.", + type: "string" + }, + value: { + description: "Variable references $(VAR_NAME) are expanded\nusing the previously defined environment variables in the container and\nany service environment variables. If a variable cannot be resolved,\nthe reference in the input string will be unchanged. Double $$ are reduced\nto a single $, which allows for escaping the $(VAR_NAME) syntax: i.e.\n\"$$(VAR_NAME)\" will produce the string literal \"$(VAR_NAME)\".\nEscaped references will never be expanded, regardless of whether the variable\nexists or not.\nDefaults to \"\".", + type: "string" + }, + valueFrom: { + description: "Source for the environment variable's value. Cannot be used if value is not empty.", + properties: { + configMapKeyRef: { + description: "Selects a key of a ConfigMap.", + properties: { + key: { + description: "The key to select.", + type: "string" + }, + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "Specify whether the ConfigMap or its key must be defined", + type: "boolean" + } + }, + required: ["key"], + type: "object", + "x-kubernetes-map-type": "atomic" + }, + fieldRef: { + description: "Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`,\nspec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs.", + properties: { + apiVersion: { + description: "Version of the schema the FieldPath is written in terms of, defaults to \"v1\".", + type: "string" + }, + fieldPath: { + description: "Path of the field to select in the specified API version.", + type: "string" + } + }, + required: ["fieldPath"], + type: "object", + "x-kubernetes-map-type": "atomic" + }, + fileKeyRef: { + description: "FileKeyRef selects a key of the env file.\nRequires the EnvFiles feature gate to be enabled.", + properties: { + key: { + description: "The key within the env file. An invalid key will prevent the pod from starting.\nThe keys defined within a source may consist of any printable ASCII characters except '='.\nDuring Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.", + type: "string" + }, + optional: { + default: false, + description: "Specify whether the file or its key must be defined. If the file or key\ndoes not exist, then the env var is not published.\nIf optional is set to true and the specified key does not exist,\nthe environment variable will not be set in the Pod's containers.\n\nIf optional is set to false and the specified key does not exist,\nan error will be returned during Pod creation.", + type: "boolean" + }, + path: { + description: "The path within the volume from which to select the file.\nMust be relative and may not contain the '..' path or start with '..'.", + type: "string" + }, + volumeName: { + description: "The name of the volume mount containing the env file.", + type: "string" + } + }, + required: ["key", "path", "volumeName"], + type: "object", + "x-kubernetes-map-type": "atomic" + }, + resourceFieldRef: { + description: "Selects a resource of the container: only resources limits and requests\n(limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported.", + properties: { + containerName: { + description: "Container name: required for volumes, optional for env vars", + type: "string" + }, + divisor: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Specifies the output format of the exposed resources, defaults to \"1\"", + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + }, + resource: { + description: "Required: resource to select", + type: "string" + } + }, + required: ["resource"], + type: "object", + "x-kubernetes-map-type": "atomic" + }, + secretKeyRef: { + description: "Selects a key of a secret in the pod's namespace", + properties: { + key: { + description: "The key of the secret to select from. Must be a valid secret key.", + type: "string" + }, + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "Specify whether the Secret or its key must be defined", + type: "boolean" + } + }, + required: ["key"], + type: "object", + "x-kubernetes-map-type": "atomic" + } + }, + type: "object" + } + }, + required: ["name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + envFrom: { + description: "EnvFrom", + items: { + description: "EnvFromSource represents the source of a set of ConfigMaps or Secrets", + properties: { + configMapRef: { + description: "The ConfigMap to select from", + properties: { + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "Specify whether the ConfigMap must be defined", + type: "boolean" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + prefix: { + description: "Optional text to prepend to the name of each environment variable.\nMay consist of any printable ASCII characters except '='.", + type: "string" + }, + secretRef: { + description: "The Secret to select from", + properties: { + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "Specify whether the Secret must be defined", + type: "boolean" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + } + }, + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + image: { + description: "Image", + type: "string" + }, + imagePullPolicy: { + description: "ImagePullPolicy", + type: "string" + }, + lifecycle: { + description: "Deprecated: This field will be removed in a future release.\nDeprecatedLifecycle", + properties: { + postStart: { + description: "PostStart is called immediately after a container is created. If the handler fails,\nthe container is terminated and restarted according to its restart policy.\nOther management of the container blocks until the hook completes.\nMore info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks", + properties: { + exec: { + description: "Exec specifies a command to execute in the container.", + properties: { + command: { + description: "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + httpGet: { + description: "HTTPGet specifies an HTTP GET request to perform.", + properties: { + host: { + description: "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", + type: "string" + }, + httpHeaders: { + description: "Custom headers to set in the request. HTTP allows repeated headers.", + items: { + description: "HTTPHeader describes a custom header to be used in HTTP probes", + properties: { + name: { + description: "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", + type: "string" + }, + value: { + description: "The header field value", + type: "string" + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + path: { + description: "Path to access on the HTTP server.", + type: "string" + }, + port: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true + }, + scheme: { + description: "Scheme to use for connecting to the host.\nDefaults to HTTP.", + type: "string" + } + }, + required: ["port"], + type: "object" + }, + sleep: { + description: "Sleep represents a duration that the container should sleep.", + properties: { + seconds: { + description: "Seconds is the number of seconds to sleep.", + format: "int64", + type: "integer" + } + }, + required: ["seconds"], + type: "object" + }, + tcpSocket: { + description: "Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept\nfor backward compatibility. There is no validation of this field and\nlifecycle hooks will fail at runtime when it is specified.", + properties: { + host: { + description: "Optional: Host name to connect to, defaults to the pod IP.", + type: "string" + }, + port: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true + } + }, + required: ["port"], + type: "object" + } + }, + type: "object" + }, + preStop: { + description: "PreStop is called immediately before a container is terminated due to an\nAPI request or management event such as liveness/startup probe failure,\npreemption, resource contention, etc. The handler is not called if the\ncontainer crashes or exits. The Pod's termination grace period countdown begins before the\nPreStop hook is executed. Regardless of the outcome of the handler, the\ncontainer will eventually terminate within the Pod's termination grace\nperiod (unless delayed by finalizers). Other management of the container blocks until the hook completes\nor until the termination grace period is reached.\nMore info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks", + properties: { + exec: { + description: "Exec specifies a command to execute in the container.", + properties: { + command: { + description: "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + httpGet: { + description: "HTTPGet specifies an HTTP GET request to perform.", + properties: { + host: { + description: "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", + type: "string" + }, + httpHeaders: { + description: "Custom headers to set in the request. HTTP allows repeated headers.", + items: { + description: "HTTPHeader describes a custom header to be used in HTTP probes", + properties: { + name: { + description: "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", + type: "string" + }, + value: { + description: "The header field value", + type: "string" + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + path: { + description: "Path to access on the HTTP server.", + type: "string" + }, + port: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true + }, + scheme: { + description: "Scheme to use for connecting to the host.\nDefaults to HTTP.", + type: "string" + } + }, + required: ["port"], + type: "object" + }, + sleep: { + description: "Sleep represents a duration that the container should sleep.", + properties: { + seconds: { + description: "Seconds is the number of seconds to sleep.", + format: "int64", + type: "integer" + } + }, + required: ["seconds"], + type: "object" + }, + tcpSocket: { + description: "Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept\nfor backward compatibility. There is no validation of this field and\nlifecycle hooks will fail at runtime when it is specified.", + properties: { + host: { + description: "Optional: Host name to connect to, defaults to the pod IP.", + type: "string" + }, + port: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true + } + }, + required: ["port"], + type: "object" + } + }, + type: "object" + }, + stopSignal: { + description: "StopSignal defines which signal will be sent to a container when it is being stopped.\nIf not specified, the default is defined by the container runtime in use.\nStopSignal can only be set for Pods with a non-empty .spec.os.name", + type: "string" + } + }, + type: "object" + }, + livenessProbe: { + description: "Deprecated: This field will be removed in a future release.\nDeprecatedLivenessProbe", + properties: { + exec: { + description: "Exec specifies a command to execute in the container.", + properties: { + command: { + description: "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + failureThreshold: { + description: "Minimum consecutive failures for the probe to be considered failed after having succeeded.\nDefaults to 3. Minimum value is 1.", + format: "int32", + type: "integer" + }, + grpc: { + description: "GRPC specifies a GRPC HealthCheckRequest.", + properties: { + port: { + description: "Port number of the gRPC service. Number must be in the range 1 to 65535.", + format: "int32", + type: "integer" + }, + service: { + default: "", + description: "Service is the name of the service to place in the gRPC HealthCheckRequest\n(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).\n\nIf this is not specified, the default behavior is defined by gRPC.", + type: "string" + } + }, + required: ["port"], + type: "object" + }, + httpGet: { + description: "HTTPGet specifies an HTTP GET request to perform.", + properties: { + host: { + description: "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", + type: "string" + }, + httpHeaders: { + description: "Custom headers to set in the request. HTTP allows repeated headers.", + items: { + description: "HTTPHeader describes a custom header to be used in HTTP probes", + properties: { + name: { + description: "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", + type: "string" + }, + value: { + description: "The header field value", + type: "string" + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + path: { + description: "Path to access on the HTTP server.", + type: "string" + }, + port: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true + }, + scheme: { + description: "Scheme to use for connecting to the host.\nDefaults to HTTP.", + type: "string" + } + }, + required: ["port"], + type: "object" + }, + initialDelaySeconds: { + description: "Number of seconds after the container has started before liveness probes are initiated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + format: "int32", + type: "integer" + }, + periodSeconds: { + description: "How often (in seconds) to perform the probe.\nDefault to 10 seconds. Minimum value is 1.", + format: "int32", + type: "integer" + }, + successThreshold: { + description: "Minimum consecutive successes for the probe to be considered successful after having failed.\nDefaults to 1. Must be 1 for liveness and startup. Minimum value is 1.", + format: "int32", + type: "integer" + }, + tcpSocket: { + description: "TCPSocket specifies a connection to a TCP port.", + properties: { + host: { + description: "Optional: Host name to connect to, defaults to the pod IP.", + type: "string" + }, + port: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true + } + }, + required: ["port"], + type: "object" + }, + terminationGracePeriodSeconds: { + description: "Optional duration in seconds the pod needs to terminate gracefully upon probe failure.\nThe grace period is the duration in seconds after the processes running in the pod are sent\na termination signal and the time when the processes are forcibly halted with a kill signal.\nSet this value longer than the expected cleanup time for your process.\nIf this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this\nvalue overrides the value provided by the pod spec.\nValue must be non-negative integer. The value zero indicates stop immediately via\nthe kill signal (no opportunity to shut down).\nThis is a beta field and requires enabling ProbeTerminationGracePeriod feature gate.\nMinimum value is 1. spec.terminationGracePeriodSeconds is used if unset.", + format: "int64", + type: "integer" + }, + timeoutSeconds: { + description: "Number of seconds after which the probe times out.\nDefaults to 1 second. Minimum value is 1.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + format: "int32", + type: "integer" + } + }, + type: "object" + }, + name: { + description: "Name", + type: "string" + }, + onError: { + description: "OnError", + type: "string" + }, + params: { + description: "Params", + items: { + description: "Param", + properties: { + name: { + type: "string" + }, + value: { + description: "Value", + "x-kubernetes-preserve-unknown-fields": true + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + ports: { + description: "Deprecated: This field will be removed in a future release.\nDeprecatedPorts", + items: { + description: "ContainerPort represents a network port in a single container.", + properties: { + containerPort: { + description: "Number of port to expose on the pod's IP address.\nThis must be a valid port number, 0 < x < 65536.", + format: "int32", + type: "integer" + }, + hostIP: { + description: "What host IP to bind the external port to.", + type: "string" + }, + hostPort: { + description: "Number of port to expose on the host.\nIf specified, this must be a valid port number, 0 < x < 65536.\nIf HostNetwork is specified, this must match ContainerPort.\nMost containers do not need this.", + format: "int32", + type: "integer" + }, + name: { + description: "If specified, this must be an IANA_SVC_NAME and unique within the pod. Each\nnamed port in a pod must have a unique name. Name for the port that can be\nreferred to by services.", + type: "string" + }, + protocol: { + default: "TCP", + description: "Protocol for port. Must be UDP, TCP, or SCTP.\nDefaults to \"TCP\".", + type: "string" + } + }, + required: ["containerPort"], + type: "object" + }, + type: "array", + "x-kubernetes-list-map-keys": ["containerPort", "protocol"], + "x-kubernetes-list-type": "map" + }, + readinessProbe: { + description: "Deprecated: This field will be removed in a future release.\nDeprecatedReadinessProbe", + properties: { + exec: { + description: "Exec specifies a command to execute in the container.", + properties: { + command: { + description: "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + failureThreshold: { + description: "Minimum consecutive failures for the probe to be considered failed after having succeeded.\nDefaults to 3. Minimum value is 1.", + format: "int32", + type: "integer" + }, + grpc: { + description: "GRPC specifies a GRPC HealthCheckRequest.", + properties: { + port: { + description: "Port number of the gRPC service. Number must be in the range 1 to 65535.", + format: "int32", + type: "integer" + }, + service: { + default: "", + description: "Service is the name of the service to place in the gRPC HealthCheckRequest\n(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).\n\nIf this is not specified, the default behavior is defined by gRPC.", + type: "string" + } + }, + required: ["port"], + type: "object" + }, + httpGet: { + description: "HTTPGet specifies an HTTP GET request to perform.", + properties: { + host: { + description: "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", + type: "string" + }, + httpHeaders: { + description: "Custom headers to set in the request. HTTP allows repeated headers.", + items: { + description: "HTTPHeader describes a custom header to be used in HTTP probes", + properties: { + name: { + description: "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", + type: "string" + }, + value: { + description: "The header field value", + type: "string" + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + path: { + description: "Path to access on the HTTP server.", + type: "string" + }, + port: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true + }, + scheme: { + description: "Scheme to use for connecting to the host.\nDefaults to HTTP.", + type: "string" + } + }, + required: ["port"], + type: "object" + }, + initialDelaySeconds: { + description: "Number of seconds after the container has started before liveness probes are initiated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + format: "int32", + type: "integer" + }, + periodSeconds: { + description: "How often (in seconds) to perform the probe.\nDefault to 10 seconds. Minimum value is 1.", + format: "int32", + type: "integer" + }, + successThreshold: { + description: "Minimum consecutive successes for the probe to be considered successful after having failed.\nDefaults to 1. Must be 1 for liveness and startup. Minimum value is 1.", + format: "int32", + type: "integer" + }, + tcpSocket: { + description: "TCPSocket specifies a connection to a TCP port.", + properties: { + host: { + description: "Optional: Host name to connect to, defaults to the pod IP.", + type: "string" + }, + port: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true + } + }, + required: ["port"], + type: "object" + }, + terminationGracePeriodSeconds: { + description: "Optional duration in seconds the pod needs to terminate gracefully upon probe failure.\nThe grace period is the duration in seconds after the processes running in the pod are sent\na termination signal and the time when the processes are forcibly halted with a kill signal.\nSet this value longer than the expected cleanup time for your process.\nIf this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this\nvalue overrides the value provided by the pod spec.\nValue must be non-negative integer. The value zero indicates stop immediately via\nthe kill signal (no opportunity to shut down).\nThis is a beta field and requires enabling ProbeTerminationGracePeriod feature gate.\nMinimum value is 1. spec.terminationGracePeriodSeconds is used if unset.", + format: "int64", + type: "integer" + }, + timeoutSeconds: { + description: "Number of seconds after which the probe times out.\nDefaults to 1 second. Minimum value is 1.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + format: "int32", + type: "integer" + } + }, + type: "object" + }, + ref: { + description: "Ref", + properties: { + name: { + description: "Name", + type: "string" + }, + params: { + description: "Params", + items: { + description: "Param", + properties: { + name: { + type: "string" + }, + value: { + description: "Value", + "x-kubernetes-preserve-unknown-fields": true + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + resolver: { + description: "Resolver", + type: "string" + } + }, + type: "object" + }, + resources: { + description: "Resources", + properties: { + claims: { + description: "Claims lists the names of resources, defined in spec.resourceClaims,\nthat are used by this container.\n\nThis field depends on the\nDynamicResourceAllocation feature gate.\n\nThis field is immutable. It can only be set for containers.", + items: { + description: "ResourceClaim references one entry in PodSpec.ResourceClaims.", + properties: { + name: { + description: "Name must match the name of one entry in pod.spec.resourceClaims of\nthe Pod where this field is used. It makes that resource available\ninside a container.", + type: "string" + }, + request: { + description: "Request is the name chosen for a request in the referenced claim.\nIf empty, everything from the claim is made available, otherwise\nonly the result of this request.", + type: "string" + } + }, + required: ["name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-map-keys": ["name"], + "x-kubernetes-list-type": "map" + }, + limits: { + additionalProperties: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + }, + description: "Limits describes the maximum amount of compute resources allowed.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + type: "object" + }, + requests: { + additionalProperties: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + }, + description: "Requests describes the minimum amount of compute resources required.\nIf Requests is omitted for a container, it defaults to Limits if that is explicitly specified,\notherwise to an implementation-defined value. Requests cannot exceed Limits.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + type: "object" + } + }, + type: "object" + }, + results: { + description: "Results", + items: { + description: "StepResult used to describe the Results of a Step.", + properties: { + description: { + description: "Description is a human-readable description of the result", + type: "string" + }, + name: { + description: "Name the given name", + type: "string" + }, + properties: { + additionalProperties: { + description: "PropertySpec defines the struct for object keys", + properties: { + type: { + description: "ParamType indicates the type of an input parameter;\nUsed to distinguish between a single string and an array of strings.", + type: "string" + } + }, + type: "object" + }, + description: "Properties is the JSON Schema properties to support key-value pairs results.", + type: "object" + }, + type: { + description: "The possible types are 'string', 'array', and 'object', with 'string' as the default.", + type: "string" + } + }, + required: ["name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + script: { + description: "Script", + type: "string" + }, + securityContext: { + description: "SecurityContext", + properties: { + allowPrivilegeEscalation: { + description: "AllowPrivilegeEscalation controls whether a process can gain more\nprivileges than its parent process. This bool directly controls if\nthe no_new_privs flag will be set on the container process.\nAllowPrivilegeEscalation is true always when the container is:\n1) run as Privileged\n2) has CAP_SYS_ADMIN\nNote that this field cannot be set when spec.os.name is windows.", + type: "boolean" + }, + appArmorProfile: { + description: "appArmorProfile is the AppArmor options to use by this container. If set, this profile\noverrides the pod's appArmorProfile.\nNote that this field cannot be set when spec.os.name is windows.", + properties: { + localhostProfile: { + description: "localhostProfile indicates a profile loaded on the node that should be used.\nThe profile must be preconfigured on the node to work.\nMust match the loaded name of the profile.\nMust be set if and only if type is \"Localhost\".", + type: "string" + }, + type: { + description: "type indicates which kind of AppArmor profile will be applied.\nValid options are:\n Localhost - a profile pre-loaded on the node.\n RuntimeDefault - the container runtime's default profile.\n Unconfined - no AppArmor enforcement.", + type: "string" + } + }, + required: ["type"], + type: "object" + }, + capabilities: { + description: "The capabilities to add/drop when running containers.\nDefaults to the default set of capabilities granted by the container runtime.\nNote that this field cannot be set when spec.os.name is windows.", + properties: { + add: { + description: "Added capabilities", + items: { + description: "Capability represent POSIX capabilities type", + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + drop: { + description: "Removed capabilities", + items: { + description: "Capability represent POSIX capabilities type", + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + privileged: { + description: "Run container in privileged mode.\nProcesses in privileged containers are essentially equivalent to root on the host.\nDefaults to false.\nNote that this field cannot be set when spec.os.name is windows.", + type: "boolean" + }, + procMount: { + description: "procMount denotes the type of proc mount to use for the containers.\nThe default value is Default which uses the container runtime defaults for\nreadonly paths and masked paths.\nThis requires the ProcMountType feature flag to be enabled.\nNote that this field cannot be set when spec.os.name is windows.", + type: "string" + }, + readOnlyRootFilesystem: { + description: "Whether this container has a read-only root filesystem.\nDefault is false.\nNote that this field cannot be set when spec.os.name is windows.", + type: "boolean" + }, + runAsGroup: { + description: "The GID to run the entrypoint of the container process.\nUses runtime default if unset.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is windows.", + format: "int64", + type: "integer" + }, + runAsNonRoot: { + description: "Indicates that the container must run as a non-root user.\nIf true, the Kubelet will validate the image at runtime to ensure that it\ndoes not run as UID 0 (root) and fail to start the container if it does.\nIf unset or false, no such validation will be performed.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.", + type: "boolean" + }, + runAsUser: { + description: "The UID to run the entrypoint of the container process.\nDefaults to user specified in image metadata if unspecified.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is windows.", + format: "int64", + type: "integer" + }, + seccompProfile: { + description: "The seccomp options to use by this container. If seccomp options are\nprovided at both the pod & container level, the container options\noverride the pod options.\nNote that this field cannot be set when spec.os.name is windows.", + properties: { + localhostProfile: { + description: "localhostProfile indicates a profile defined in a file on the node should be used.\nThe profile must be preconfigured on the node to work.\nMust be a descending path, relative to the kubelet's configured seccomp profile location.\nMust be set if type is \"Localhost\". Must NOT be set for any other type.", + type: "string" + }, + type: { + description: "type indicates which kind of seccomp profile will be applied.\nValid options are:\n\nLocalhost - a profile defined in a file on the node should be used.\nRuntimeDefault - the container runtime default profile should be used.\nUnconfined - no profile should be applied.", + type: "string" + } + }, + required: ["type"], + type: "object" + }, + seLinuxOptions: { + description: "The SELinux context to be applied to the container.\nIf unspecified, the container runtime will allocate a random SELinux context for each\ncontainer. May also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is windows.", + properties: { + level: { + description: "Level is SELinux level label that applies to the container.", + type: "string" + }, + role: { + description: "Role is a SELinux role label that applies to the container.", + type: "string" + }, + type: { + description: "Type is a SELinux type label that applies to the container.", + type: "string" + }, + user: { + description: "User is a SELinux user label that applies to the container.", + type: "string" + } + }, + type: "object" + }, + windowsOptions: { + description: "The Windows specific settings applied to all containers.\nIf unspecified, the options from the PodSecurityContext will be used.\nIf set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is linux.", + properties: { + gmsaCredentialSpec: { + description: "GMSACredentialSpec is where the GMSA admission webhook\n(https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the\nGMSA credential spec named by the GMSACredentialSpecName field.", + type: "string" + }, + gmsaCredentialSpecName: { + description: "GMSACredentialSpecName is the name of the GMSA credential spec to use.", + type: "string" + }, + hostProcess: { + description: "HostProcess determines if a container should be run as a 'Host Process' container.\nAll of a Pod's containers must have the same effective HostProcess value\n(it is not allowed to have a mix of HostProcess containers and non-HostProcess containers).\nIn addition, if HostProcess is true then HostNetwork must also be set to true.", + type: "boolean" + }, + runAsUserName: { + description: "The UserName in Windows to run the entrypoint of the container process.\nDefaults to the user specified in image metadata if unspecified.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.", + type: "string" + } + }, + type: "object" + } + }, + type: "object" + }, + startupProbe: { + description: "Deprecated: This field will be removed in a future release.\nDeprecatedStartupProbe", + properties: { + exec: { + description: "Exec specifies a command to execute in the container.", + properties: { + command: { + description: "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + failureThreshold: { + description: "Minimum consecutive failures for the probe to be considered failed after having succeeded.\nDefaults to 3. Minimum value is 1.", + format: "int32", + type: "integer" + }, + grpc: { + description: "GRPC specifies a GRPC HealthCheckRequest.", + properties: { + port: { + description: "Port number of the gRPC service. Number must be in the range 1 to 65535.", + format: "int32", + type: "integer" + }, + service: { + default: "", + description: "Service is the name of the service to place in the gRPC HealthCheckRequest\n(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).\n\nIf this is not specified, the default behavior is defined by gRPC.", + type: "string" + } + }, + required: ["port"], + type: "object" + }, + httpGet: { + description: "HTTPGet specifies an HTTP GET request to perform.", + properties: { + host: { + description: "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", + type: "string" + }, + httpHeaders: { + description: "Custom headers to set in the request. HTTP allows repeated headers.", + items: { + description: "HTTPHeader describes a custom header to be used in HTTP probes", + properties: { + name: { + description: "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", + type: "string" + }, + value: { + description: "The header field value", + type: "string" + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + path: { + description: "Path to access on the HTTP server.", + type: "string" + }, + port: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true + }, + scheme: { + description: "Scheme to use for connecting to the host.\nDefaults to HTTP.", + type: "string" + } + }, + required: ["port"], + type: "object" + }, + initialDelaySeconds: { + description: "Number of seconds after the container has started before liveness probes are initiated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + format: "int32", + type: "integer" + }, + periodSeconds: { + description: "How often (in seconds) to perform the probe.\nDefault to 10 seconds. Minimum value is 1.", + format: "int32", + type: "integer" + }, + successThreshold: { + description: "Minimum consecutive successes for the probe to be considered successful after having failed.\nDefaults to 1. Must be 1 for liveness and startup. Minimum value is 1.", + format: "int32", + type: "integer" + }, + tcpSocket: { + description: "TCPSocket specifies a connection to a TCP port.", + properties: { + host: { + description: "Optional: Host name to connect to, defaults to the pod IP.", + type: "string" + }, + port: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true + } + }, + required: ["port"], + type: "object" + }, + terminationGracePeriodSeconds: { + description: "Optional duration in seconds the pod needs to terminate gracefully upon probe failure.\nThe grace period is the duration in seconds after the processes running in the pod are sent\na termination signal and the time when the processes are forcibly halted with a kill signal.\nSet this value longer than the expected cleanup time for your process.\nIf this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this\nvalue overrides the value provided by the pod spec.\nValue must be non-negative integer. The value zero indicates stop immediately via\nthe kill signal (no opportunity to shut down).\nThis is a beta field and requires enabling ProbeTerminationGracePeriod feature gate.\nMinimum value is 1. spec.terminationGracePeriodSeconds is used if unset.", + format: "int64", + type: "integer" + }, + timeoutSeconds: { + description: "Number of seconds after which the probe times out.\nDefaults to 1 second. Minimum value is 1.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + format: "int32", + type: "integer" + } + }, + type: "object" + }, + stderrConfig: { + description: "StderrConfig", + properties: { + path: { + description: "Path", + type: "string" + } + }, + type: "object" + }, + stdin: { + description: "Deprecated: This field will be removed in a future release.\nDeprecatedStdin", + type: "boolean" + }, + stdinOnce: { + description: "Deprecated: This field will be removed in a future release.\nDeprecatedStdinOnce", + type: "boolean" + }, + stdoutConfig: { + description: "StdoutConfig", + properties: { + path: { + description: "Path", + type: "string" + } + }, + type: "object" + }, + terminationMessagePath: { + description: "DeprecatedTerminationMessagePath\nDeprecated: This field will be removed in a future release and can't be meaningfully used.", + type: "string" + }, + terminationMessagePolicy: { + description: "DeprecatedTerminationMessagePolicy\nDeprecated: This field will be removed in a future release and can't be meaningfully used.", + type: "string" + }, + timeout: { + description: "Timeout", + type: "string" + }, + tty: { + description: "Deprecated: This field will be removed in a future release.\nDeprecatedTTY", + type: "boolean" + }, + volumeDevices: { + description: "VolumeDevices", + items: { + description: "volumeDevice describes a mapping of a raw block device within a container.", + properties: { + devicePath: { + description: "devicePath is the path inside of the container that the device will be mapped to.", + type: "string" + }, + name: { + description: "name must match the name of a persistentVolumeClaim in the pod", + type: "string" + } + }, + required: ["devicePath", "name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + volumeMounts: { + description: "VolumeMounts", + items: { + description: "VolumeMount describes a mounting of a Volume within a container.", + properties: { + mountPath: { + description: "Path within the container at which the volume should be mounted. Must\nnot contain ':'.", + type: "string" + }, + mountPropagation: { + description: "mountPropagation determines how mounts are propagated from the host\nto container and the other way around.\nWhen not set, MountPropagationNone is used.\nThis field is beta in 1.10.\nWhen RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified\n(which defaults to None).", + type: "string" + }, + name: { + description: "This must match the Name of a Volume.", + type: "string" + }, + readOnly: { + description: "Mounted read-only if true, read-write otherwise (false or unspecified).\nDefaults to false.", + type: "boolean" + }, + recursiveReadOnly: { + description: "RecursiveReadOnly specifies whether read-only mounts should be handled\nrecursively.\n\nIf ReadOnly is false, this field has no meaning and must be unspecified.\n\nIf ReadOnly is true, and this field is set to Disabled, the mount is not made\nrecursively read-only. If this field is set to IfPossible, the mount is made\nrecursively read-only, if it is supported by the container runtime. If this\nfield is set to Enabled, the mount is made recursively read-only if it is\nsupported by the container runtime, otherwise the pod will not be started and\nan error will be generated to indicate the reason.\n\nIf this field is set to IfPossible or Enabled, MountPropagation must be set to\nNone (or be unspecified, which defaults to None).\n\nIf this field is not specified, it is treated as an equivalent of Disabled.", + type: "string" + }, + subPath: { + description: "Path within the volume from which the container's volume should be mounted.\nDefaults to \"\" (volume's root).", + type: "string" + }, + subPathExpr: { + description: "Expanded path within the volume from which the container's volume should be mounted.\nBehaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment.\nDefaults to \"\" (volume's root).\nSubPathExpr and SubPath are mutually exclusive.", + type: "string" + } + }, + required: ["mountPath", "name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + when: { + description: "WhenExpressions", + items: { + description: "WhenExpression", + properties: { + cel: { + description: "CEL", + type: "string" + }, + input: { + description: "Input", + type: "string" + }, + operator: { + description: "Operator", + type: "string" + }, + values: { + description: "Values", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + type: "array" + }, + workingDir: { + description: "WorkingDir", + type: "string" + }, + workspaces: { + description: "Workspaces", + items: { + description: "WorkspaceUsage", + properties: { + mountPath: { + description: "MountPath", + type: "string" + }, + name: { + description: "Name", + type: "string" + } + }, + required: ["mountPath", "name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + required: ["name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + stepTemplate: { + description: "StepTemplate", + properties: { + args: { + description: "Args", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + command: { + description: "Command", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + env: { + description: "Env", + items: { + description: "EnvVar represents an environment variable present in a Container.", + properties: { + name: { + description: "Name of the environment variable.\nMay consist of any printable ASCII characters except '='.", + type: "string" + }, + value: { + description: "Variable references $(VAR_NAME) are expanded\nusing the previously defined environment variables in the container and\nany service environment variables. If a variable cannot be resolved,\nthe reference in the input string will be unchanged. Double $$ are reduced\nto a single $, which allows for escaping the $(VAR_NAME) syntax: i.e.\n\"$$(VAR_NAME)\" will produce the string literal \"$(VAR_NAME)\".\nEscaped references will never be expanded, regardless of whether the variable\nexists or not.\nDefaults to \"\".", + type: "string" + }, + valueFrom: { + description: "Source for the environment variable's value. Cannot be used if value is not empty.", + properties: { + configMapKeyRef: { + description: "Selects a key of a ConfigMap.", + properties: { + key: { + description: "The key to select.", + type: "string" + }, + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "Specify whether the ConfigMap or its key must be defined", + type: "boolean" + } + }, + required: ["key"], + type: "object", + "x-kubernetes-map-type": "atomic" + }, + fieldRef: { + description: "Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`,\nspec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs.", + properties: { + apiVersion: { + description: "Version of the schema the FieldPath is written in terms of, defaults to \"v1\".", + type: "string" + }, + fieldPath: { + description: "Path of the field to select in the specified API version.", + type: "string" + } + }, + required: ["fieldPath"], + type: "object", + "x-kubernetes-map-type": "atomic" + }, + fileKeyRef: { + description: "FileKeyRef selects a key of the env file.\nRequires the EnvFiles feature gate to be enabled.", + properties: { + key: { + description: "The key within the env file. An invalid key will prevent the pod from starting.\nThe keys defined within a source may consist of any printable ASCII characters except '='.\nDuring Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.", + type: "string" + }, + optional: { + default: false, + description: "Specify whether the file or its key must be defined. If the file or key\ndoes not exist, then the env var is not published.\nIf optional is set to true and the specified key does not exist,\nthe environment variable will not be set in the Pod's containers.\n\nIf optional is set to false and the specified key does not exist,\nan error will be returned during Pod creation.", + type: "boolean" + }, + path: { + description: "The path within the volume from which to select the file.\nMust be relative and may not contain the '..' path or start with '..'.", + type: "string" + }, + volumeName: { + description: "The name of the volume mount containing the env file.", + type: "string" + } + }, + required: ["key", "path", "volumeName"], + type: "object", + "x-kubernetes-map-type": "atomic" + }, + resourceFieldRef: { + description: "Selects a resource of the container: only resources limits and requests\n(limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported.", + properties: { + containerName: { + description: "Container name: required for volumes, optional for env vars", + type: "string" + }, + divisor: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Specifies the output format of the exposed resources, defaults to \"1\"", + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + }, + resource: { + description: "Required: resource to select", + type: "string" + } + }, + required: ["resource"], + type: "object", + "x-kubernetes-map-type": "atomic" + }, + secretKeyRef: { + description: "Selects a key of a secret in the pod's namespace", + properties: { + key: { + description: "The key of the secret to select from. Must be a valid secret key.", + type: "string" + }, + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "Specify whether the Secret or its key must be defined", + type: "boolean" + } + }, + required: ["key"], + type: "object", + "x-kubernetes-map-type": "atomic" + } + }, + type: "object" + } + }, + required: ["name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + envFrom: { + description: "EnvFrom", + items: { + description: "EnvFromSource represents the source of a set of ConfigMaps or Secrets", + properties: { + configMapRef: { + description: "The ConfigMap to select from", + properties: { + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "Specify whether the ConfigMap must be defined", + type: "boolean" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + prefix: { + description: "Optional text to prepend to the name of each environment variable.\nMay consist of any printable ASCII characters except '='.", + type: "string" + }, + secretRef: { + description: "The Secret to select from", + properties: { + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "Specify whether the Secret must be defined", + type: "boolean" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + } + }, + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + image: { + description: "Image", + type: "string" + }, + imagePullPolicy: { + description: "ImagePullPolicy", + type: "string" + }, + lifecycle: { + description: "Deprecated: This field will be removed in a future release.\nDeprecatedLifecycle", + properties: { + postStart: { + description: "PostStart is called immediately after a container is created. If the handler fails,\nthe container is terminated and restarted according to its restart policy.\nOther management of the container blocks until the hook completes.\nMore info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks", + properties: { + exec: { + description: "Exec specifies a command to execute in the container.", + properties: { + command: { + description: "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + httpGet: { + description: "HTTPGet specifies an HTTP GET request to perform.", + properties: { + host: { + description: "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", + type: "string" + }, + httpHeaders: { + description: "Custom headers to set in the request. HTTP allows repeated headers.", + items: { + description: "HTTPHeader describes a custom header to be used in HTTP probes", + properties: { + name: { + description: "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", + type: "string" + }, + value: { + description: "The header field value", + type: "string" + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + path: { + description: "Path to access on the HTTP server.", + type: "string" + }, + port: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true + }, + scheme: { + description: "Scheme to use for connecting to the host.\nDefaults to HTTP.", + type: "string" + } + }, + required: ["port"], + type: "object" + }, + sleep: { + description: "Sleep represents a duration that the container should sleep.", + properties: { + seconds: { + description: "Seconds is the number of seconds to sleep.", + format: "int64", + type: "integer" + } + }, + required: ["seconds"], + type: "object" + }, + tcpSocket: { + description: "Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept\nfor backward compatibility. There is no validation of this field and\nlifecycle hooks will fail at runtime when it is specified.", + properties: { + host: { + description: "Optional: Host name to connect to, defaults to the pod IP.", + type: "string" + }, + port: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true + } + }, + required: ["port"], + type: "object" + } + }, + type: "object" + }, + preStop: { + description: "PreStop is called immediately before a container is terminated due to an\nAPI request or management event such as liveness/startup probe failure,\npreemption, resource contention, etc. The handler is not called if the\ncontainer crashes or exits. The Pod's termination grace period countdown begins before the\nPreStop hook is executed. Regardless of the outcome of the handler, the\ncontainer will eventually terminate within the Pod's termination grace\nperiod (unless delayed by finalizers). Other management of the container blocks until the hook completes\nor until the termination grace period is reached.\nMore info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks", + properties: { + exec: { + description: "Exec specifies a command to execute in the container.", + properties: { + command: { + description: "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + httpGet: { + description: "HTTPGet specifies an HTTP GET request to perform.", + properties: { + host: { + description: "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", + type: "string" + }, + httpHeaders: { + description: "Custom headers to set in the request. HTTP allows repeated headers.", + items: { + description: "HTTPHeader describes a custom header to be used in HTTP probes", + properties: { + name: { + description: "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", + type: "string" + }, + value: { + description: "The header field value", + type: "string" + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + path: { + description: "Path to access on the HTTP server.", + type: "string" + }, + port: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true + }, + scheme: { + description: "Scheme to use for connecting to the host.\nDefaults to HTTP.", + type: "string" + } + }, + required: ["port"], + type: "object" + }, + sleep: { + description: "Sleep represents a duration that the container should sleep.", + properties: { + seconds: { + description: "Seconds is the number of seconds to sleep.", + format: "int64", + type: "integer" + } + }, + required: ["seconds"], + type: "object" + }, + tcpSocket: { + description: "Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept\nfor backward compatibility. There is no validation of this field and\nlifecycle hooks will fail at runtime when it is specified.", + properties: { + host: { + description: "Optional: Host name to connect to, defaults to the pod IP.", + type: "string" + }, + port: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true + } + }, + required: ["port"], + type: "object" + } + }, + type: "object" + }, + stopSignal: { + description: "StopSignal defines which signal will be sent to a container when it is being stopped.\nIf not specified, the default is defined by the container runtime in use.\nStopSignal can only be set for Pods with a non-empty .spec.os.name", + type: "string" + } + }, + type: "object" + }, + livenessProbe: { + description: "Deprecated: This field will be removed in a future release.\nDeprecatedLivenessProbe", + properties: { + exec: { + description: "Exec specifies a command to execute in the container.", + properties: { + command: { + description: "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + failureThreshold: { + description: "Minimum consecutive failures for the probe to be considered failed after having succeeded.\nDefaults to 3. Minimum value is 1.", + format: "int32", + type: "integer" + }, + grpc: { + description: "GRPC specifies a GRPC HealthCheckRequest.", + properties: { + port: { + description: "Port number of the gRPC service. Number must be in the range 1 to 65535.", + format: "int32", + type: "integer" + }, + service: { + default: "", + description: "Service is the name of the service to place in the gRPC HealthCheckRequest\n(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).\n\nIf this is not specified, the default behavior is defined by gRPC.", + type: "string" + } + }, + required: ["port"], + type: "object" + }, + httpGet: { + description: "HTTPGet specifies an HTTP GET request to perform.", + properties: { + host: { + description: "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", + type: "string" + }, + httpHeaders: { + description: "Custom headers to set in the request. HTTP allows repeated headers.", + items: { + description: "HTTPHeader describes a custom header to be used in HTTP probes", + properties: { + name: { + description: "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", + type: "string" + }, + value: { + description: "The header field value", + type: "string" + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + path: { + description: "Path to access on the HTTP server.", + type: "string" + }, + port: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true + }, + scheme: { + description: "Scheme to use for connecting to the host.\nDefaults to HTTP.", + type: "string" + } + }, + required: ["port"], + type: "object" + }, + initialDelaySeconds: { + description: "Number of seconds after the container has started before liveness probes are initiated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + format: "int32", + type: "integer" + }, + periodSeconds: { + description: "How often (in seconds) to perform the probe.\nDefault to 10 seconds. Minimum value is 1.", + format: "int32", + type: "integer" + }, + successThreshold: { + description: "Minimum consecutive successes for the probe to be considered successful after having failed.\nDefaults to 1. Must be 1 for liveness and startup. Minimum value is 1.", + format: "int32", + type: "integer" + }, + tcpSocket: { + description: "TCPSocket specifies a connection to a TCP port.", + properties: { + host: { + description: "Optional: Host name to connect to, defaults to the pod IP.", + type: "string" + }, + port: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true + } + }, + required: ["port"], + type: "object" + }, + terminationGracePeriodSeconds: { + description: "Optional duration in seconds the pod needs to terminate gracefully upon probe failure.\nThe grace period is the duration in seconds after the processes running in the pod are sent\na termination signal and the time when the processes are forcibly halted with a kill signal.\nSet this value longer than the expected cleanup time for your process.\nIf this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this\nvalue overrides the value provided by the pod spec.\nValue must be non-negative integer. The value zero indicates stop immediately via\nthe kill signal (no opportunity to shut down).\nThis is a beta field and requires enabling ProbeTerminationGracePeriod feature gate.\nMinimum value is 1. spec.terminationGracePeriodSeconds is used if unset.", + format: "int64", + type: "integer" + }, + timeoutSeconds: { + description: "Number of seconds after which the probe times out.\nDefaults to 1 second. Minimum value is 1.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + format: "int32", + type: "integer" + } + }, + type: "object" + }, + name: { + description: "Deprecated: This field will be removed in a future release.\nDeprecatedName", + type: "string" + }, + ports: { + description: "Deprecated: This field will be removed in a future release.\nDeprecatedPorts", + items: { + description: "ContainerPort represents a network port in a single container.", + properties: { + containerPort: { + description: "Number of port to expose on the pod's IP address.\nThis must be a valid port number, 0 < x < 65536.", + format: "int32", + type: "integer" + }, + hostIP: { + description: "What host IP to bind the external port to.", + type: "string" + }, + hostPort: { + description: "Number of port to expose on the host.\nIf specified, this must be a valid port number, 0 < x < 65536.\nIf HostNetwork is specified, this must match ContainerPort.\nMost containers do not need this.", + format: "int32", + type: "integer" + }, + name: { + description: "If specified, this must be an IANA_SVC_NAME and unique within the pod. Each\nnamed port in a pod must have a unique name. Name for the port that can be\nreferred to by services.", + type: "string" + }, + protocol: { + default: "TCP", + description: "Protocol for port. Must be UDP, TCP, or SCTP.\nDefaults to \"TCP\".", + type: "string" + } + }, + required: ["containerPort"], + type: "object" + }, + type: "array", + "x-kubernetes-list-map-keys": ["containerPort", "protocol"], + "x-kubernetes-list-type": "map" + }, + readinessProbe: { + description: "Deprecated: This field will be removed in a future release.\nDeprecatedReadinessProbe", + properties: { + exec: { + description: "Exec specifies a command to execute in the container.", + properties: { + command: { + description: "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + failureThreshold: { + description: "Minimum consecutive failures for the probe to be considered failed after having succeeded.\nDefaults to 3. Minimum value is 1.", + format: "int32", + type: "integer" + }, + grpc: { + description: "GRPC specifies a GRPC HealthCheckRequest.", + properties: { + port: { + description: "Port number of the gRPC service. Number must be in the range 1 to 65535.", + format: "int32", + type: "integer" + }, + service: { + default: "", + description: "Service is the name of the service to place in the gRPC HealthCheckRequest\n(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).\n\nIf this is not specified, the default behavior is defined by gRPC.", + type: "string" + } + }, + required: ["port"], + type: "object" + }, + httpGet: { + description: "HTTPGet specifies an HTTP GET request to perform.", + properties: { + host: { + description: "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", + type: "string" + }, + httpHeaders: { + description: "Custom headers to set in the request. HTTP allows repeated headers.", + items: { + description: "HTTPHeader describes a custom header to be used in HTTP probes", + properties: { + name: { + description: "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", + type: "string" + }, + value: { + description: "The header field value", + type: "string" + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + path: { + description: "Path to access on the HTTP server.", + type: "string" + }, + port: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true + }, + scheme: { + description: "Scheme to use for connecting to the host.\nDefaults to HTTP.", + type: "string" + } + }, + required: ["port"], + type: "object" + }, + initialDelaySeconds: { + description: "Number of seconds after the container has started before liveness probes are initiated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + format: "int32", + type: "integer" + }, + periodSeconds: { + description: "How often (in seconds) to perform the probe.\nDefault to 10 seconds. Minimum value is 1.", + format: "int32", + type: "integer" + }, + successThreshold: { + description: "Minimum consecutive successes for the probe to be considered successful after having failed.\nDefaults to 1. Must be 1 for liveness and startup. Minimum value is 1.", + format: "int32", + type: "integer" + }, + tcpSocket: { + description: "TCPSocket specifies a connection to a TCP port.", + properties: { + host: { + description: "Optional: Host name to connect to, defaults to the pod IP.", + type: "string" + }, + port: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true + } + }, + required: ["port"], + type: "object" + }, + terminationGracePeriodSeconds: { + description: "Optional duration in seconds the pod needs to terminate gracefully upon probe failure.\nThe grace period is the duration in seconds after the processes running in the pod are sent\na termination signal and the time when the processes are forcibly halted with a kill signal.\nSet this value longer than the expected cleanup time for your process.\nIf this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this\nvalue overrides the value provided by the pod spec.\nValue must be non-negative integer. The value zero indicates stop immediately via\nthe kill signal (no opportunity to shut down).\nThis is a beta field and requires enabling ProbeTerminationGracePeriod feature gate.\nMinimum value is 1. spec.terminationGracePeriodSeconds is used if unset.", + format: "int64", + type: "integer" + }, + timeoutSeconds: { + description: "Number of seconds after which the probe times out.\nDefaults to 1 second. Minimum value is 1.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + format: "int32", + type: "integer" + } + }, + type: "object" + }, + resources: { + description: "Resources", + properties: { + claims: { + description: "Claims lists the names of resources, defined in spec.resourceClaims,\nthat are used by this container.\n\nThis field depends on the\nDynamicResourceAllocation feature gate.\n\nThis field is immutable. It can only be set for containers.", + items: { + description: "ResourceClaim references one entry in PodSpec.ResourceClaims.", + properties: { + name: { + description: "Name must match the name of one entry in pod.spec.resourceClaims of\nthe Pod where this field is used. It makes that resource available\ninside a container.", + type: "string" + }, + request: { + description: "Request is the name chosen for a request in the referenced claim.\nIf empty, everything from the claim is made available, otherwise\nonly the result of this request.", + type: "string" + } + }, + required: ["name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-map-keys": ["name"], + "x-kubernetes-list-type": "map" + }, + limits: { + additionalProperties: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + }, + description: "Limits describes the maximum amount of compute resources allowed.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + type: "object" + }, + requests: { + additionalProperties: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + }, + description: "Requests describes the minimum amount of compute resources required.\nIf Requests is omitted for a container, it defaults to Limits if that is explicitly specified,\notherwise to an implementation-defined value. Requests cannot exceed Limits.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + type: "object" + } + }, + type: "object" + }, + securityContext: { + description: "SecurityContext", + properties: { + allowPrivilegeEscalation: { + description: "AllowPrivilegeEscalation controls whether a process can gain more\nprivileges than its parent process. This bool directly controls if\nthe no_new_privs flag will be set on the container process.\nAllowPrivilegeEscalation is true always when the container is:\n1) run as Privileged\n2) has CAP_SYS_ADMIN\nNote that this field cannot be set when spec.os.name is windows.", + type: "boolean" + }, + appArmorProfile: { + description: "appArmorProfile is the AppArmor options to use by this container. If set, this profile\noverrides the pod's appArmorProfile.\nNote that this field cannot be set when spec.os.name is windows.", + properties: { + localhostProfile: { + description: "localhostProfile indicates a profile loaded on the node that should be used.\nThe profile must be preconfigured on the node to work.\nMust match the loaded name of the profile.\nMust be set if and only if type is \"Localhost\".", + type: "string" + }, + type: { + description: "type indicates which kind of AppArmor profile will be applied.\nValid options are:\n Localhost - a profile pre-loaded on the node.\n RuntimeDefault - the container runtime's default profile.\n Unconfined - no AppArmor enforcement.", + type: "string" + } + }, + required: ["type"], + type: "object" + }, + capabilities: { + description: "The capabilities to add/drop when running containers.\nDefaults to the default set of capabilities granted by the container runtime.\nNote that this field cannot be set when spec.os.name is windows.", + properties: { + add: { + description: "Added capabilities", + items: { + description: "Capability represent POSIX capabilities type", + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + drop: { + description: "Removed capabilities", + items: { + description: "Capability represent POSIX capabilities type", + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + privileged: { + description: "Run container in privileged mode.\nProcesses in privileged containers are essentially equivalent to root on the host.\nDefaults to false.\nNote that this field cannot be set when spec.os.name is windows.", + type: "boolean" + }, + procMount: { + description: "procMount denotes the type of proc mount to use for the containers.\nThe default value is Default which uses the container runtime defaults for\nreadonly paths and masked paths.\nThis requires the ProcMountType feature flag to be enabled.\nNote that this field cannot be set when spec.os.name is windows.", + type: "string" + }, + readOnlyRootFilesystem: { + description: "Whether this container has a read-only root filesystem.\nDefault is false.\nNote that this field cannot be set when spec.os.name is windows.", + type: "boolean" + }, + runAsGroup: { + description: "The GID to run the entrypoint of the container process.\nUses runtime default if unset.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is windows.", + format: "int64", + type: "integer" + }, + runAsNonRoot: { + description: "Indicates that the container must run as a non-root user.\nIf true, the Kubelet will validate the image at runtime to ensure that it\ndoes not run as UID 0 (root) and fail to start the container if it does.\nIf unset or false, no such validation will be performed.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.", + type: "boolean" + }, + runAsUser: { + description: "The UID to run the entrypoint of the container process.\nDefaults to user specified in image metadata if unspecified.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is windows.", + format: "int64", + type: "integer" + }, + seccompProfile: { + description: "The seccomp options to use by this container. If seccomp options are\nprovided at both the pod & container level, the container options\noverride the pod options.\nNote that this field cannot be set when spec.os.name is windows.", + properties: { + localhostProfile: { + description: "localhostProfile indicates a profile defined in a file on the node should be used.\nThe profile must be preconfigured on the node to work.\nMust be a descending path, relative to the kubelet's configured seccomp profile location.\nMust be set if type is \"Localhost\". Must NOT be set for any other type.", + type: "string" + }, + type: { + description: "type indicates which kind of seccomp profile will be applied.\nValid options are:\n\nLocalhost - a profile defined in a file on the node should be used.\nRuntimeDefault - the container runtime default profile should be used.\nUnconfined - no profile should be applied.", + type: "string" + } + }, + required: ["type"], + type: "object" + }, + seLinuxOptions: { + description: "The SELinux context to be applied to the container.\nIf unspecified, the container runtime will allocate a random SELinux context for each\ncontainer. May also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is windows.", + properties: { + level: { + description: "Level is SELinux level label that applies to the container.", + type: "string" + }, + role: { + description: "Role is a SELinux role label that applies to the container.", + type: "string" + }, + type: { + description: "Type is a SELinux type label that applies to the container.", + type: "string" + }, + user: { + description: "User is a SELinux user label that applies to the container.", + type: "string" + } + }, + type: "object" + }, + windowsOptions: { + description: "The Windows specific settings applied to all containers.\nIf unspecified, the options from the PodSecurityContext will be used.\nIf set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is linux.", + properties: { + gmsaCredentialSpec: { + description: "GMSACredentialSpec is where the GMSA admission webhook\n(https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the\nGMSA credential spec named by the GMSACredentialSpecName field.", + type: "string" + }, + gmsaCredentialSpecName: { + description: "GMSACredentialSpecName is the name of the GMSA credential spec to use.", + type: "string" + }, + hostProcess: { + description: "HostProcess determines if a container should be run as a 'Host Process' container.\nAll of a Pod's containers must have the same effective HostProcess value\n(it is not allowed to have a mix of HostProcess containers and non-HostProcess containers).\nIn addition, if HostProcess is true then HostNetwork must also be set to true.", + type: "boolean" + }, + runAsUserName: { + description: "The UserName in Windows to run the entrypoint of the container process.\nDefaults to the user specified in image metadata if unspecified.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.", + type: "string" + } + }, + type: "object" + } + }, + type: "object" + }, + startupProbe: { + description: "Deprecated: This field will be removed in a future release.\nDeprecatedStartupProbe", + properties: { + exec: { + description: "Exec specifies a command to execute in the container.", + properties: { + command: { + description: "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + failureThreshold: { + description: "Minimum consecutive failures for the probe to be considered failed after having succeeded.\nDefaults to 3. Minimum value is 1.", + format: "int32", + type: "integer" + }, + grpc: { + description: "GRPC specifies a GRPC HealthCheckRequest.", + properties: { + port: { + description: "Port number of the gRPC service. Number must be in the range 1 to 65535.", + format: "int32", + type: "integer" + }, + service: { + default: "", + description: "Service is the name of the service to place in the gRPC HealthCheckRequest\n(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).\n\nIf this is not specified, the default behavior is defined by gRPC.", + type: "string" + } + }, + required: ["port"], + type: "object" + }, + httpGet: { + description: "HTTPGet specifies an HTTP GET request to perform.", + properties: { + host: { + description: "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", + type: "string" + }, + httpHeaders: { + description: "Custom headers to set in the request. HTTP allows repeated headers.", + items: { + description: "HTTPHeader describes a custom header to be used in HTTP probes", + properties: { + name: { + description: "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", + type: "string" + }, + value: { + description: "The header field value", + type: "string" + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + path: { + description: "Path to access on the HTTP server.", + type: "string" + }, + port: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true + }, + scheme: { + description: "Scheme to use for connecting to the host.\nDefaults to HTTP.", + type: "string" + } + }, + required: ["port"], + type: "object" + }, + initialDelaySeconds: { + description: "Number of seconds after the container has started before liveness probes are initiated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + format: "int32", + type: "integer" + }, + periodSeconds: { + description: "How often (in seconds) to perform the probe.\nDefault to 10 seconds. Minimum value is 1.", + format: "int32", + type: "integer" + }, + successThreshold: { + description: "Minimum consecutive successes for the probe to be considered successful after having failed.\nDefaults to 1. Must be 1 for liveness and startup. Minimum value is 1.", + format: "int32", + type: "integer" + }, + tcpSocket: { + description: "TCPSocket specifies a connection to a TCP port.", + properties: { + host: { + description: "Optional: Host name to connect to, defaults to the pod IP.", + type: "string" + }, + port: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true + } + }, + required: ["port"], + type: "object" + }, + terminationGracePeriodSeconds: { + description: "Optional duration in seconds the pod needs to terminate gracefully upon probe failure.\nThe grace period is the duration in seconds after the processes running in the pod are sent\na termination signal and the time when the processes are forcibly halted with a kill signal.\nSet this value longer than the expected cleanup time for your process.\nIf this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this\nvalue overrides the value provided by the pod spec.\nValue must be non-negative integer. The value zero indicates stop immediately via\nthe kill signal (no opportunity to shut down).\nThis is a beta field and requires enabling ProbeTerminationGracePeriod feature gate.\nMinimum value is 1. spec.terminationGracePeriodSeconds is used if unset.", + format: "int64", + type: "integer" + }, + timeoutSeconds: { + description: "Number of seconds after which the probe times out.\nDefaults to 1 second. Minimum value is 1.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + format: "int32", + type: "integer" + } + }, + type: "object" + }, + stdin: { + description: "Deprecated: This field will be removed in a future release.\nDeprecatedStdin", + type: "boolean" + }, + stdinOnce: { + description: "Deprecated: This field will be removed in a future release.\nDeprecatedStdinOnce", + type: "boolean" + }, + terminationMessagePath: { + description: "DeprecatedTerminationMessagePath\nDeprecated: This field will be removed in a future release and cannot be meaningfully used.", + type: "string" + }, + terminationMessagePolicy: { + description: "DeprecatedTerminationMessagePolicy\nDeprecated: This field will be removed in a future release and cannot be meaningfully used.", + type: "string" + }, + tty: { + description: "Deprecated: This field will be removed in a future release.\nDeprecatedTTY", + type: "boolean" + }, + volumeDevices: { + description: "VolumeDevices", + items: { + description: "volumeDevice describes a mapping of a raw block device within a container.", + properties: { + devicePath: { + description: "devicePath is the path inside of the container that the device will be mapped to.", + type: "string" + }, + name: { + description: "name must match the name of a persistentVolumeClaim in the pod", + type: "string" + } + }, + required: ["devicePath", "name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + volumeMounts: { + description: "VolumeMounts", + items: { + description: "VolumeMount describes a mounting of a Volume within a container.", + properties: { + mountPath: { + description: "Path within the container at which the volume should be mounted. Must\nnot contain ':'.", + type: "string" + }, + mountPropagation: { + description: "mountPropagation determines how mounts are propagated from the host\nto container and the other way around.\nWhen not set, MountPropagationNone is used.\nThis field is beta in 1.10.\nWhen RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified\n(which defaults to None).", + type: "string" + }, + name: { + description: "This must match the Name of a Volume.", + type: "string" + }, + readOnly: { + description: "Mounted read-only if true, read-write otherwise (false or unspecified).\nDefaults to false.", + type: "boolean" + }, + recursiveReadOnly: { + description: "RecursiveReadOnly specifies whether read-only mounts should be handled\nrecursively.\n\nIf ReadOnly is false, this field has no meaning and must be unspecified.\n\nIf ReadOnly is true, and this field is set to Disabled, the mount is not made\nrecursively read-only. If this field is set to IfPossible, the mount is made\nrecursively read-only, if it is supported by the container runtime. If this\nfield is set to Enabled, the mount is made recursively read-only if it is\nsupported by the container runtime, otherwise the pod will not be started and\nan error will be generated to indicate the reason.\n\nIf this field is set to IfPossible or Enabled, MountPropagation must be set to\nNone (or be unspecified, which defaults to None).\n\nIf this field is not specified, it is treated as an equivalent of Disabled.", + type: "string" + }, + subPath: { + description: "Path within the volume from which the container's volume should be mounted.\nDefaults to \"\" (volume's root).", + type: "string" + }, + subPathExpr: { + description: "Expanded path within the volume from which the container's volume should be mounted.\nBehaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment.\nDefaults to \"\" (volume's root).\nSubPathExpr and SubPath are mutually exclusive.", + type: "string" + } + }, + required: ["mountPath", "name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + workingDir: { + description: "WorkingDir", + type: "string" + } + }, + type: "object" + }, + volumes: { + description: "Volumes", + "x-kubernetes-preserve-unknown-fields": true + }, + workspaces: { + description: "Workspaces", + items: { + description: "WorkspaceDeclaration", + properties: { + description: { + description: "Description", + type: "string" + }, + mountPath: { + description: "MountPath", + type: "string" + }, + name: { + description: "Name", + type: "string" + }, + optional: { + description: "Optional", + type: "boolean" + }, + readOnly: { + description: "ReadOnly", + type: "boolean" + } + }, + required: ["name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + } + }, + type: "object" + } + }, + served: true, + storage: false, + subresources: { + status: {} + } + }, { + name: "v1", + schema: { + openAPIV3Schema: { + description: "Task represents a collection of sequential steps that are run as part of a\nPipeline using a set of inputs and producing a set of outputs. Tasks execute\nwhen TaskRuns are created that provide the input parameters and resources and\noutput resources the Task requires.", + properties: { + apiVersion: { + description: "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", + type: "string" + }, + kind: { + description: "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + type: "string" + }, + metadata: { + type: "object" + }, + spec: { + description: "Spec holds the desired state of the Task from the client", + properties: { + description: { + description: "Description is a user-facing description of the task that may be\nused to populate a UI.", + type: "string" + }, + displayName: { + description: "DisplayName is a user-facing name of the task that may be\nused to populate a UI.", + type: "string" + }, + params: { + description: "Params is a list of input parameters required to run the task. Params\nmust be supplied as inputs in TaskRuns unless they declare a default\nvalue.", + items: { + description: "ParamSpec defines arbitrary parameters needed beyond typed inputs (such as\nresources). Parameter values are provided by users as inputs on a TaskRun\nor PipelineRun.", + properties: { + default: { + description: "Default is the value a parameter takes if no input value is supplied. If\ndefault is set, a Task may be executed without a supplied value for the\nparameter.", + "x-kubernetes-preserve-unknown-fields": true + }, + description: { + description: "Description is a user-facing description of the parameter that may be\nused to populate a UI.", + type: "string" + }, + enum: { + description: "Enum declares a set of allowed param input values for tasks/pipelines that can be validated.\nIf Enum is not set, no input validation is performed for the param.", + items: { + type: "string" + }, + type: "array" + }, + name: { + description: "Name declares the name by which a parameter is referenced.", + type: "string" + }, + properties: { + additionalProperties: { + description: "PropertySpec defines the struct for object keys", + properties: { + type: { + description: "ParamType indicates the type of an input parameter;\nUsed to distinguish between a single string and an array of strings.", + type: "string" + } + }, + type: "object" + }, + description: "Properties is the JSON Schema properties to support key-value pairs parameter.", + type: "object" + }, + type: { + description: "Type is the user-specified type of the parameter. The possible types\nare currently \"string\", \"array\" and \"object\", and \"string\" is the default.", + type: "string" + } + }, + required: ["name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + results: { + description: "Results are values that this Task can output", + items: { + description: "TaskResult used to describe the results of a task", + properties: { + description: { + description: "Description is a human-readable description of the result", + type: "string" + }, + name: { + description: "Name the given name", + type: "string" + }, + properties: { + additionalProperties: { + description: "PropertySpec defines the struct for object keys", + properties: { + type: { + description: "ParamType indicates the type of an input parameter;\nUsed to distinguish between a single string and an array of strings.", + type: "string" + } + }, + type: "object" + }, + description: "Properties is the JSON Schema properties to support key-value pairs results.", + type: "object" + }, + type: { + description: "Type is the user-specified type of the result. The possible type\nis currently \"string\" and will support \"array\" in following work.", + type: "string" + }, + value: { + description: "Value the expression used to retrieve the value of the result from an underlying Step.", + "x-kubernetes-preserve-unknown-fields": true + } + }, + required: ["name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + sidecars: { + description: "Sidecars are run alongside the Task's step containers. They begin before\nthe steps start and end after the steps complete.", + items: { + description: "Sidecar has nearly the same data structure as Step but does not have the ability to timeout.", + properties: { + args: { + description: "Arguments to the entrypoint.\nThe image's CMD is used if this is not provided.\nVariable references $(VAR_NAME) are expanded using the Sidecar's environment. If a variable\ncannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced\nto a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. \"$$(VAR_NAME)\" will\nproduce the string literal \"$(VAR_NAME)\". Escaped references will never be expanded, regardless\nof whether the variable exists or not. Cannot be updated.\nMore info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + command: { + description: "Entrypoint array. Not executed within a shell.\nThe image's ENTRYPOINT is used if this is not provided.\nVariable references $(VAR_NAME) are expanded using the Sidecar's environment. If a variable\ncannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced\nto a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. \"$$(VAR_NAME)\" will\nproduce the string literal \"$(VAR_NAME)\". Escaped references will never be expanded, regardless\nof whether the variable exists or not. Cannot be updated.\nMore info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + computeResources: { + description: "ComputeResources required by this Sidecar.\nCannot be updated.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + properties: { + claims: { + description: "Claims lists the names of resources, defined in spec.resourceClaims,\nthat are used by this container.\n\nThis field depends on the\nDynamicResourceAllocation feature gate.\n\nThis field is immutable. It can only be set for containers.", + items: { + description: "ResourceClaim references one entry in PodSpec.ResourceClaims.", + properties: { + name: { + description: "Name must match the name of one entry in pod.spec.resourceClaims of\nthe Pod where this field is used. It makes that resource available\ninside a container.", + type: "string" + }, + request: { + description: "Request is the name chosen for a request in the referenced claim.\nIf empty, everything from the claim is made available, otherwise\nonly the result of this request.", + type: "string" + } + }, + required: ["name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-map-keys": ["name"], + "x-kubernetes-list-type": "map" + }, + limits: { + additionalProperties: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + }, + description: "Limits describes the maximum amount of compute resources allowed.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + type: "object" + }, + requests: { + additionalProperties: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + }, + description: "Requests describes the minimum amount of compute resources required.\nIf Requests is omitted for a container, it defaults to Limits if that is explicitly specified,\notherwise to an implementation-defined value. Requests cannot exceed Limits.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + type: "object" + } + }, + type: "object" + }, + env: { + description: "List of environment variables to set in the Sidecar.\nCannot be updated.", + items: { + description: "EnvVar represents an environment variable present in a Container.", + properties: { + name: { + description: "Name of the environment variable.\nMay consist of any printable ASCII characters except '='.", + type: "string" + }, + value: { + description: "Variable references $(VAR_NAME) are expanded\nusing the previously defined environment variables in the container and\nany service environment variables. If a variable cannot be resolved,\nthe reference in the input string will be unchanged. Double $$ are reduced\nto a single $, which allows for escaping the $(VAR_NAME) syntax: i.e.\n\"$$(VAR_NAME)\" will produce the string literal \"$(VAR_NAME)\".\nEscaped references will never be expanded, regardless of whether the variable\nexists or not.\nDefaults to \"\".", + type: "string" + }, + valueFrom: { + description: "Source for the environment variable's value. Cannot be used if value is not empty.", + properties: { + configMapKeyRef: { + description: "Selects a key of a ConfigMap.", + properties: { + key: { + description: "The key to select.", + type: "string" + }, + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "Specify whether the ConfigMap or its key must be defined", + type: "boolean" + } + }, + required: ["key"], + type: "object", + "x-kubernetes-map-type": "atomic" + }, + fieldRef: { + description: "Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`,\nspec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs.", + properties: { + apiVersion: { + description: "Version of the schema the FieldPath is written in terms of, defaults to \"v1\".", + type: "string" + }, + fieldPath: { + description: "Path of the field to select in the specified API version.", + type: "string" + } + }, + required: ["fieldPath"], + type: "object", + "x-kubernetes-map-type": "atomic" + }, + fileKeyRef: { + description: "FileKeyRef selects a key of the env file.\nRequires the EnvFiles feature gate to be enabled.", + properties: { + key: { + description: "The key within the env file. An invalid key will prevent the pod from starting.\nThe keys defined within a source may consist of any printable ASCII characters except '='.\nDuring Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.", + type: "string" + }, + optional: { + default: false, + description: "Specify whether the file or its key must be defined. If the file or key\ndoes not exist, then the env var is not published.\nIf optional is set to true and the specified key does not exist,\nthe environment variable will not be set in the Pod's containers.\n\nIf optional is set to false and the specified key does not exist,\nan error will be returned during Pod creation.", + type: "boolean" + }, + path: { + description: "The path within the volume from which to select the file.\nMust be relative and may not contain the '..' path or start with '..'.", + type: "string" + }, + volumeName: { + description: "The name of the volume mount containing the env file.", + type: "string" + } + }, + required: ["key", "path", "volumeName"], + type: "object", + "x-kubernetes-map-type": "atomic" + }, + resourceFieldRef: { + description: "Selects a resource of the container: only resources limits and requests\n(limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported.", + properties: { + containerName: { + description: "Container name: required for volumes, optional for env vars", + type: "string" + }, + divisor: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Specifies the output format of the exposed resources, defaults to \"1\"", + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + }, + resource: { + description: "Required: resource to select", + type: "string" + } + }, + required: ["resource"], + type: "object", + "x-kubernetes-map-type": "atomic" + }, + secretKeyRef: { + description: "Selects a key of a secret in the pod's namespace", + properties: { + key: { + description: "The key of the secret to select from. Must be a valid secret key.", + type: "string" + }, + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "Specify whether the Secret or its key must be defined", + type: "boolean" + } + }, + required: ["key"], + type: "object", + "x-kubernetes-map-type": "atomic" + } + }, + type: "object" + } + }, + required: ["name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + envFrom: { + description: "List of sources to populate environment variables in the Sidecar.\nThe keys defined within a source must be a C_IDENTIFIER. All invalid keys\nwill be reported as an event when the container is starting. When a key exists in multiple\nsources, the value associated with the last source will take precedence.\nValues defined by an Env with a duplicate key will take precedence.\nCannot be updated.", + items: { + description: "EnvFromSource represents the source of a set of ConfigMaps or Secrets", + properties: { + configMapRef: { + description: "The ConfigMap to select from", + properties: { + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "Specify whether the ConfigMap must be defined", + type: "boolean" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + prefix: { + description: "Optional text to prepend to the name of each environment variable.\nMay consist of any printable ASCII characters except '='.", + type: "string" + }, + secretRef: { + description: "The Secret to select from", + properties: { + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "Specify whether the Secret must be defined", + type: "boolean" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + } + }, + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + image: { + description: "Image reference name.\nMore info: https://kubernetes.io/docs/concepts/containers/images", + type: "string" + }, + imagePullPolicy: { + description: "Image pull policy.\nOne of Always, Never, IfNotPresent.\nDefaults to Always if :latest tag is specified, or IfNotPresent otherwise.\nCannot be updated.\nMore info: https://kubernetes.io/docs/concepts/containers/images#updating-images", + type: "string" + }, + lifecycle: { + description: "Actions that the management system should take in response to Sidecar lifecycle events.\nCannot be updated.", + properties: { + postStart: { + description: "PostStart is called immediately after a container is created. If the handler fails,\nthe container is terminated and restarted according to its restart policy.\nOther management of the container blocks until the hook completes.\nMore info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks", + properties: { + exec: { + description: "Exec specifies a command to execute in the container.", + properties: { + command: { + description: "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + httpGet: { + description: "HTTPGet specifies an HTTP GET request to perform.", + properties: { + host: { + description: "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", + type: "string" + }, + httpHeaders: { + description: "Custom headers to set in the request. HTTP allows repeated headers.", + items: { + description: "HTTPHeader describes a custom header to be used in HTTP probes", + properties: { + name: { + description: "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", + type: "string" + }, + value: { + description: "The header field value", + type: "string" + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + path: { + description: "Path to access on the HTTP server.", + type: "string" + }, + port: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true + }, + scheme: { + description: "Scheme to use for connecting to the host.\nDefaults to HTTP.", + type: "string" + } + }, + required: ["port"], + type: "object" + }, + sleep: { + description: "Sleep represents a duration that the container should sleep.", + properties: { + seconds: { + description: "Seconds is the number of seconds to sleep.", + format: "int64", + type: "integer" + } + }, + required: ["seconds"], + type: "object" + }, + tcpSocket: { + description: "Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept\nfor backward compatibility. There is no validation of this field and\nlifecycle hooks will fail at runtime when it is specified.", + properties: { + host: { + description: "Optional: Host name to connect to, defaults to the pod IP.", + type: "string" + }, + port: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true + } + }, + required: ["port"], + type: "object" + } + }, + type: "object" + }, + preStop: { + description: "PreStop is called immediately before a container is terminated due to an\nAPI request or management event such as liveness/startup probe failure,\npreemption, resource contention, etc. The handler is not called if the\ncontainer crashes or exits. The Pod's termination grace period countdown begins before the\nPreStop hook is executed. Regardless of the outcome of the handler, the\ncontainer will eventually terminate within the Pod's termination grace\nperiod (unless delayed by finalizers). Other management of the container blocks until the hook completes\nor until the termination grace period is reached.\nMore info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks", + properties: { + exec: { + description: "Exec specifies a command to execute in the container.", + properties: { + command: { + description: "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + httpGet: { + description: "HTTPGet specifies an HTTP GET request to perform.", + properties: { + host: { + description: "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", + type: "string" + }, + httpHeaders: { + description: "Custom headers to set in the request. HTTP allows repeated headers.", + items: { + description: "HTTPHeader describes a custom header to be used in HTTP probes", + properties: { + name: { + description: "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", + type: "string" + }, + value: { + description: "The header field value", + type: "string" + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + path: { + description: "Path to access on the HTTP server.", + type: "string" + }, + port: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true + }, + scheme: { + description: "Scheme to use for connecting to the host.\nDefaults to HTTP.", + type: "string" + } + }, + required: ["port"], + type: "object" + }, + sleep: { + description: "Sleep represents a duration that the container should sleep.", + properties: { + seconds: { + description: "Seconds is the number of seconds to sleep.", + format: "int64", + type: "integer" + } + }, + required: ["seconds"], + type: "object" + }, + tcpSocket: { + description: "Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept\nfor backward compatibility. There is no validation of this field and\nlifecycle hooks will fail at runtime when it is specified.", + properties: { + host: { + description: "Optional: Host name to connect to, defaults to the pod IP.", + type: "string" + }, + port: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true + } + }, + required: ["port"], + type: "object" + } + }, + type: "object" + }, + stopSignal: { + description: "StopSignal defines which signal will be sent to a container when it is being stopped.\nIf not specified, the default is defined by the container runtime in use.\nStopSignal can only be set for Pods with a non-empty .spec.os.name", + type: "string" + } + }, + type: "object" + }, + livenessProbe: { + description: "Periodic probe of Sidecar liveness.\nContainer will be restarted if the probe fails.\nCannot be updated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + properties: { + exec: { + description: "Exec specifies a command to execute in the container.", + properties: { + command: { + description: "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + failureThreshold: { + description: "Minimum consecutive failures for the probe to be considered failed after having succeeded.\nDefaults to 3. Minimum value is 1.", + format: "int32", + type: "integer" + }, + grpc: { + description: "GRPC specifies a GRPC HealthCheckRequest.", + properties: { + port: { + description: "Port number of the gRPC service. Number must be in the range 1 to 65535.", + format: "int32", + type: "integer" + }, + service: { + default: "", + description: "Service is the name of the service to place in the gRPC HealthCheckRequest\n(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).\n\nIf this is not specified, the default behavior is defined by gRPC.", + type: "string" + } + }, + required: ["port"], + type: "object" + }, + httpGet: { + description: "HTTPGet specifies an HTTP GET request to perform.", + properties: { + host: { + description: "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", + type: "string" + }, + httpHeaders: { + description: "Custom headers to set in the request. HTTP allows repeated headers.", + items: { + description: "HTTPHeader describes a custom header to be used in HTTP probes", + properties: { + name: { + description: "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", + type: "string" + }, + value: { + description: "The header field value", + type: "string" + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + path: { + description: "Path to access on the HTTP server.", + type: "string" + }, + port: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true + }, + scheme: { + description: "Scheme to use for connecting to the host.\nDefaults to HTTP.", + type: "string" + } + }, + required: ["port"], + type: "object" + }, + initialDelaySeconds: { + description: "Number of seconds after the container has started before liveness probes are initiated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + format: "int32", + type: "integer" + }, + periodSeconds: { + description: "How often (in seconds) to perform the probe.\nDefault to 10 seconds. Minimum value is 1.", + format: "int32", + type: "integer" + }, + successThreshold: { + description: "Minimum consecutive successes for the probe to be considered successful after having failed.\nDefaults to 1. Must be 1 for liveness and startup. Minimum value is 1.", + format: "int32", + type: "integer" + }, + tcpSocket: { + description: "TCPSocket specifies a connection to a TCP port.", + properties: { + host: { + description: "Optional: Host name to connect to, defaults to the pod IP.", + type: "string" + }, + port: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true + } + }, + required: ["port"], + type: "object" + }, + terminationGracePeriodSeconds: { + description: "Optional duration in seconds the pod needs to terminate gracefully upon probe failure.\nThe grace period is the duration in seconds after the processes running in the pod are sent\na termination signal and the time when the processes are forcibly halted with a kill signal.\nSet this value longer than the expected cleanup time for your process.\nIf this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this\nvalue overrides the value provided by the pod spec.\nValue must be non-negative integer. The value zero indicates stop immediately via\nthe kill signal (no opportunity to shut down).\nThis is a beta field and requires enabling ProbeTerminationGracePeriod feature gate.\nMinimum value is 1. spec.terminationGracePeriodSeconds is used if unset.", + format: "int64", + type: "integer" + }, + timeoutSeconds: { + description: "Number of seconds after which the probe times out.\nDefaults to 1 second. Minimum value is 1.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + format: "int32", + type: "integer" + } + }, + type: "object" + }, + name: { + description: "Name of the Sidecar specified as a DNS_LABEL.\nEach Sidecar in a Task must have a unique name (DNS_LABEL).\nCannot be updated.", + type: "string" + }, + ports: { + description: "List of ports to expose from the Sidecar. Exposing a port here gives\nthe system additional information about the network connections a\ncontainer uses, but is primarily informational. Not specifying a port here\nDOES NOT prevent that port from being exposed. Any port which is\nlistening on the default \"0.0.0.0\" address inside a container will be\naccessible from the network.\nCannot be updated.", + items: { + description: "ContainerPort represents a network port in a single container.", + properties: { + containerPort: { + description: "Number of port to expose on the pod's IP address.\nThis must be a valid port number, 0 < x < 65536.", + format: "int32", + type: "integer" + }, + hostIP: { + description: "What host IP to bind the external port to.", + type: "string" + }, + hostPort: { + description: "Number of port to expose on the host.\nIf specified, this must be a valid port number, 0 < x < 65536.\nIf HostNetwork is specified, this must match ContainerPort.\nMost containers do not need this.", + format: "int32", + type: "integer" + }, + name: { + description: "If specified, this must be an IANA_SVC_NAME and unique within the pod. Each\nnamed port in a pod must have a unique name. Name for the port that can be\nreferred to by services.", + type: "string" + }, + protocol: { + default: "TCP", + description: "Protocol for port. Must be UDP, TCP, or SCTP.\nDefaults to \"TCP\".", + type: "string" + } + }, + required: ["containerPort"], + type: "object" + }, + type: "array", + "x-kubernetes-list-map-keys": ["containerPort", "protocol"], + "x-kubernetes-list-type": "map" + }, + readinessProbe: { + description: "Periodic probe of Sidecar service readiness.\nContainer will be removed from service endpoints if the probe fails.\nCannot be updated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + properties: { + exec: { + description: "Exec specifies a command to execute in the container.", + properties: { + command: { + description: "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + failureThreshold: { + description: "Minimum consecutive failures for the probe to be considered failed after having succeeded.\nDefaults to 3. Minimum value is 1.", + format: "int32", + type: "integer" + }, + grpc: { + description: "GRPC specifies a GRPC HealthCheckRequest.", + properties: { + port: { + description: "Port number of the gRPC service. Number must be in the range 1 to 65535.", + format: "int32", + type: "integer" + }, + service: { + default: "", + description: "Service is the name of the service to place in the gRPC HealthCheckRequest\n(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).\n\nIf this is not specified, the default behavior is defined by gRPC.", + type: "string" + } + }, + required: ["port"], + type: "object" + }, + httpGet: { + description: "HTTPGet specifies an HTTP GET request to perform.", + properties: { + host: { + description: "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", + type: "string" + }, + httpHeaders: { + description: "Custom headers to set in the request. HTTP allows repeated headers.", + items: { + description: "HTTPHeader describes a custom header to be used in HTTP probes", + properties: { + name: { + description: "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", + type: "string" + }, + value: { + description: "The header field value", + type: "string" + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + path: { + description: "Path to access on the HTTP server.", + type: "string" + }, + port: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true + }, + scheme: { + description: "Scheme to use for connecting to the host.\nDefaults to HTTP.", + type: "string" + } + }, + required: ["port"], + type: "object" + }, + initialDelaySeconds: { + description: "Number of seconds after the container has started before liveness probes are initiated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + format: "int32", + type: "integer" + }, + periodSeconds: { + description: "How often (in seconds) to perform the probe.\nDefault to 10 seconds. Minimum value is 1.", + format: "int32", + type: "integer" + }, + successThreshold: { + description: "Minimum consecutive successes for the probe to be considered successful after having failed.\nDefaults to 1. Must be 1 for liveness and startup. Minimum value is 1.", + format: "int32", + type: "integer" + }, + tcpSocket: { + description: "TCPSocket specifies a connection to a TCP port.", + properties: { + host: { + description: "Optional: Host name to connect to, defaults to the pod IP.", + type: "string" + }, + port: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true + } + }, + required: ["port"], + type: "object" + }, + terminationGracePeriodSeconds: { + description: "Optional duration in seconds the pod needs to terminate gracefully upon probe failure.\nThe grace period is the duration in seconds after the processes running in the pod are sent\na termination signal and the time when the processes are forcibly halted with a kill signal.\nSet this value longer than the expected cleanup time for your process.\nIf this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this\nvalue overrides the value provided by the pod spec.\nValue must be non-negative integer. The value zero indicates stop immediately via\nthe kill signal (no opportunity to shut down).\nThis is a beta field and requires enabling ProbeTerminationGracePeriod feature gate.\nMinimum value is 1. spec.terminationGracePeriodSeconds is used if unset.", + format: "int64", + type: "integer" + }, + timeoutSeconds: { + description: "Number of seconds after which the probe times out.\nDefaults to 1 second. Minimum value is 1.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + format: "int32", + type: "integer" + } + }, + type: "object" + }, + restartPolicy: { + description: "RestartPolicy refers to kubernetes RestartPolicy. It can only be set for an\ninitContainer and must have it's policy set to \"Always\". It is currently\nleft optional to help support Kubernetes versions prior to 1.29 when this feature\nwas introduced.", + type: "string" + }, + script: { + description: "Script is the contents of an executable file to execute.\n\nIf Script is not empty, the Step cannot have an Command or Args.", + type: "string" + }, + securityContext: { + description: "SecurityContext defines the security options the Sidecar should be run with.\nIf set, the fields of SecurityContext override the equivalent fields of PodSecurityContext.\nMore info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/", + properties: { + allowPrivilegeEscalation: { + description: "AllowPrivilegeEscalation controls whether a process can gain more\nprivileges than its parent process. This bool directly controls if\nthe no_new_privs flag will be set on the container process.\nAllowPrivilegeEscalation is true always when the container is:\n1) run as Privileged\n2) has CAP_SYS_ADMIN\nNote that this field cannot be set when spec.os.name is windows.", + type: "boolean" + }, + appArmorProfile: { + description: "appArmorProfile is the AppArmor options to use by this container. If set, this profile\noverrides the pod's appArmorProfile.\nNote that this field cannot be set when spec.os.name is windows.", + properties: { + localhostProfile: { + description: "localhostProfile indicates a profile loaded on the node that should be used.\nThe profile must be preconfigured on the node to work.\nMust match the loaded name of the profile.\nMust be set if and only if type is \"Localhost\".", + type: "string" + }, + type: { + description: "type indicates which kind of AppArmor profile will be applied.\nValid options are:\n Localhost - a profile pre-loaded on the node.\n RuntimeDefault - the container runtime's default profile.\n Unconfined - no AppArmor enforcement.", + type: "string" + } + }, + required: ["type"], + type: "object" + }, + capabilities: { + description: "The capabilities to add/drop when running containers.\nDefaults to the default set of capabilities granted by the container runtime.\nNote that this field cannot be set when spec.os.name is windows.", + properties: { + add: { + description: "Added capabilities", + items: { + description: "Capability represent POSIX capabilities type", + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + drop: { + description: "Removed capabilities", + items: { + description: "Capability represent POSIX capabilities type", + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + privileged: { + description: "Run container in privileged mode.\nProcesses in privileged containers are essentially equivalent to root on the host.\nDefaults to false.\nNote that this field cannot be set when spec.os.name is windows.", + type: "boolean" + }, + procMount: { + description: "procMount denotes the type of proc mount to use for the containers.\nThe default value is Default which uses the container runtime defaults for\nreadonly paths and masked paths.\nThis requires the ProcMountType feature flag to be enabled.\nNote that this field cannot be set when spec.os.name is windows.", + type: "string" + }, + readOnlyRootFilesystem: { + description: "Whether this container has a read-only root filesystem.\nDefault is false.\nNote that this field cannot be set when spec.os.name is windows.", + type: "boolean" + }, + runAsGroup: { + description: "The GID to run the entrypoint of the container process.\nUses runtime default if unset.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is windows.", + format: "int64", + type: "integer" + }, + runAsNonRoot: { + description: "Indicates that the container must run as a non-root user.\nIf true, the Kubelet will validate the image at runtime to ensure that it\ndoes not run as UID 0 (root) and fail to start the container if it does.\nIf unset or false, no such validation will be performed.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.", + type: "boolean" + }, + runAsUser: { + description: "The UID to run the entrypoint of the container process.\nDefaults to user specified in image metadata if unspecified.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is windows.", + format: "int64", + type: "integer" + }, + seccompProfile: { + description: "The seccomp options to use by this container. If seccomp options are\nprovided at both the pod & container level, the container options\noverride the pod options.\nNote that this field cannot be set when spec.os.name is windows.", + properties: { + localhostProfile: { + description: "localhostProfile indicates a profile defined in a file on the node should be used.\nThe profile must be preconfigured on the node to work.\nMust be a descending path, relative to the kubelet's configured seccomp profile location.\nMust be set if type is \"Localhost\". Must NOT be set for any other type.", + type: "string" + }, + type: { + description: "type indicates which kind of seccomp profile will be applied.\nValid options are:\n\nLocalhost - a profile defined in a file on the node should be used.\nRuntimeDefault - the container runtime default profile should be used.\nUnconfined - no profile should be applied.", + type: "string" + } + }, + required: ["type"], + type: "object" + }, + seLinuxOptions: { + description: "The SELinux context to be applied to the container.\nIf unspecified, the container runtime will allocate a random SELinux context for each\ncontainer. May also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is windows.", + properties: { + level: { + description: "Level is SELinux level label that applies to the container.", + type: "string" + }, + role: { + description: "Role is a SELinux role label that applies to the container.", + type: "string" + }, + type: { + description: "Type is a SELinux type label that applies to the container.", + type: "string" + }, + user: { + description: "User is a SELinux user label that applies to the container.", + type: "string" + } + }, + type: "object" + }, + windowsOptions: { + description: "The Windows specific settings applied to all containers.\nIf unspecified, the options from the PodSecurityContext will be used.\nIf set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is linux.", + properties: { + gmsaCredentialSpec: { + description: "GMSACredentialSpec is where the GMSA admission webhook\n(https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the\nGMSA credential spec named by the GMSACredentialSpecName field.", + type: "string" + }, + gmsaCredentialSpecName: { + description: "GMSACredentialSpecName is the name of the GMSA credential spec to use.", + type: "string" + }, + hostProcess: { + description: "HostProcess determines if a container should be run as a 'Host Process' container.\nAll of a Pod's containers must have the same effective HostProcess value\n(it is not allowed to have a mix of HostProcess containers and non-HostProcess containers).\nIn addition, if HostProcess is true then HostNetwork must also be set to true.", + type: "boolean" + }, + runAsUserName: { + description: "The UserName in Windows to run the entrypoint of the container process.\nDefaults to the user specified in image metadata if unspecified.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.", + type: "string" + } + }, + type: "object" + } + }, + type: "object" + }, + startupProbe: { + description: "StartupProbe indicates that the Pod the Sidecar is running in has successfully initialized.\nIf specified, no other probes are executed until this completes successfully.\nIf this probe fails, the Pod will be restarted, just as if the livenessProbe failed.\nThis can be used to provide different probe parameters at the beginning of a Pod's lifecycle,\nwhen it might take a long time to load data or warm a cache, than during steady-state operation.\nThis cannot be updated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + properties: { + exec: { + description: "Exec specifies a command to execute in the container.", + properties: { + command: { + description: "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + failureThreshold: { + description: "Minimum consecutive failures for the probe to be considered failed after having succeeded.\nDefaults to 3. Minimum value is 1.", + format: "int32", + type: "integer" + }, + grpc: { + description: "GRPC specifies a GRPC HealthCheckRequest.", + properties: { + port: { + description: "Port number of the gRPC service. Number must be in the range 1 to 65535.", + format: "int32", + type: "integer" + }, + service: { + default: "", + description: "Service is the name of the service to place in the gRPC HealthCheckRequest\n(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).\n\nIf this is not specified, the default behavior is defined by gRPC.", + type: "string" + } + }, + required: ["port"], + type: "object" + }, + httpGet: { + description: "HTTPGet specifies an HTTP GET request to perform.", + properties: { + host: { + description: "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", + type: "string" + }, + httpHeaders: { + description: "Custom headers to set in the request. HTTP allows repeated headers.", + items: { + description: "HTTPHeader describes a custom header to be used in HTTP probes", + properties: { + name: { + description: "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", + type: "string" + }, + value: { + description: "The header field value", + type: "string" + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + path: { + description: "Path to access on the HTTP server.", + type: "string" + }, + port: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true + }, + scheme: { + description: "Scheme to use for connecting to the host.\nDefaults to HTTP.", + type: "string" + } + }, + required: ["port"], + type: "object" + }, + initialDelaySeconds: { + description: "Number of seconds after the container has started before liveness probes are initiated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + format: "int32", + type: "integer" + }, + periodSeconds: { + description: "How often (in seconds) to perform the probe.\nDefault to 10 seconds. Minimum value is 1.", + format: "int32", + type: "integer" + }, + successThreshold: { + description: "Minimum consecutive successes for the probe to be considered successful after having failed.\nDefaults to 1. Must be 1 for liveness and startup. Minimum value is 1.", + format: "int32", + type: "integer" + }, + tcpSocket: { + description: "TCPSocket specifies a connection to a TCP port.", + properties: { + host: { + description: "Optional: Host name to connect to, defaults to the pod IP.", + type: "string" + }, + port: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true + } + }, + required: ["port"], + type: "object" + }, + terminationGracePeriodSeconds: { + description: "Optional duration in seconds the pod needs to terminate gracefully upon probe failure.\nThe grace period is the duration in seconds after the processes running in the pod are sent\na termination signal and the time when the processes are forcibly halted with a kill signal.\nSet this value longer than the expected cleanup time for your process.\nIf this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this\nvalue overrides the value provided by the pod spec.\nValue must be non-negative integer. The value zero indicates stop immediately via\nthe kill signal (no opportunity to shut down).\nThis is a beta field and requires enabling ProbeTerminationGracePeriod feature gate.\nMinimum value is 1. spec.terminationGracePeriodSeconds is used if unset.", + format: "int64", + type: "integer" + }, + timeoutSeconds: { + description: "Number of seconds after which the probe times out.\nDefaults to 1 second. Minimum value is 1.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + format: "int32", + type: "integer" + } + }, + type: "object" + }, + stdin: { + description: "Whether this Sidecar should allocate a buffer for stdin in the container runtime. If this\nis not set, reads from stdin in the Sidecar will always result in EOF.\nDefault is false.", + type: "boolean" + }, + stdinOnce: { + description: "Whether the container runtime should close the stdin channel after it has been opened by\na single attach. When stdin is true the stdin stream will remain open across multiple attach\nsessions. If stdinOnce is set to true, stdin is opened on Sidecar start, is empty until the\nfirst client attaches to stdin, and then remains open and accepts data until the client disconnects,\nat which time stdin is closed and remains closed until the Sidecar is restarted. If this\nflag is false, a container processes that reads from stdin will never receive an EOF.\nDefault is false", + type: "boolean" + }, + terminationMessagePath: { + description: "Optional: Path at which the file to which the Sidecar's termination message\nwill be written is mounted into the Sidecar's filesystem.\nMessage written is intended to be brief final status, such as an assertion failure message.\nWill be truncated by the node if greater than 4096 bytes. The total message length across\nall containers will be limited to 12kb.\nDefaults to /dev/termination-log.\nCannot be updated.", + type: "string" + }, + terminationMessagePolicy: { + description: "Indicate how the termination message should be populated. File will use the contents of\nterminationMessagePath to populate the Sidecar status message on both success and failure.\nFallbackToLogsOnError will use the last chunk of Sidecar log output if the termination\nmessage file is empty and the Sidecar exited with an error.\nThe log output is limited to 2048 bytes or 80 lines, whichever is smaller.\nDefaults to File.\nCannot be updated.", + type: "string" + }, + tty: { + description: "Whether this Sidecar should allocate a TTY for itself, also requires 'stdin' to be true.\nDefault is false.", + type: "boolean" + }, + volumeDevices: { + description: "volumeDevices is the list of block devices to be used by the Sidecar.", + items: { + description: "volumeDevice describes a mapping of a raw block device within a container.", + properties: { + devicePath: { + description: "devicePath is the path inside of the container that the device will be mapped to.", + type: "string" + }, + name: { + description: "name must match the name of a persistentVolumeClaim in the pod", + type: "string" + } + }, + required: ["devicePath", "name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + volumeMounts: { + description: "Volumes to mount into the Sidecar's filesystem.\nCannot be updated.", + items: { + description: "VolumeMount describes a mounting of a Volume within a container.", + properties: { + mountPath: { + description: "Path within the container at which the volume should be mounted. Must\nnot contain ':'.", + type: "string" + }, + mountPropagation: { + description: "mountPropagation determines how mounts are propagated from the host\nto container and the other way around.\nWhen not set, MountPropagationNone is used.\nThis field is beta in 1.10.\nWhen RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified\n(which defaults to None).", + type: "string" + }, + name: { + description: "This must match the Name of a Volume.", + type: "string" + }, + readOnly: { + description: "Mounted read-only if true, read-write otherwise (false or unspecified).\nDefaults to false.", + type: "boolean" + }, + recursiveReadOnly: { + description: "RecursiveReadOnly specifies whether read-only mounts should be handled\nrecursively.\n\nIf ReadOnly is false, this field has no meaning and must be unspecified.\n\nIf ReadOnly is true, and this field is set to Disabled, the mount is not made\nrecursively read-only. If this field is set to IfPossible, the mount is made\nrecursively read-only, if it is supported by the container runtime. If this\nfield is set to Enabled, the mount is made recursively read-only if it is\nsupported by the container runtime, otherwise the pod will not be started and\nan error will be generated to indicate the reason.\n\nIf this field is set to IfPossible or Enabled, MountPropagation must be set to\nNone (or be unspecified, which defaults to None).\n\nIf this field is not specified, it is treated as an equivalent of Disabled.", + type: "string" + }, + subPath: { + description: "Path within the volume from which the container's volume should be mounted.\nDefaults to \"\" (volume's root).", + type: "string" + }, + subPathExpr: { + description: "Expanded path within the volume from which the container's volume should be mounted.\nBehaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment.\nDefaults to \"\" (volume's root).\nSubPathExpr and SubPath are mutually exclusive.", + type: "string" + } + }, + required: ["mountPath", "name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + workingDir: { + description: "Sidecar's working directory.\nIf not specified, the container runtime's default will be used, which\nmight be configured in the container image.\nCannot be updated.", + type: "string" + }, + workspaces: { + description: "This is an alpha field. You must set the \"enable-api-fields\" feature flag to \"alpha\"\nfor this field to be supported.\n\nWorkspaces is a list of workspaces from the Task that this Sidecar wants\nexclusive access to. Adding a workspace to this list means that any\nother Step or Sidecar that does not also request this Workspace will\nnot have access to it.", + items: { + description: "WorkspaceUsage is used by a Step or Sidecar to declare that it wants isolated access\nto a Workspace defined in a Task.", + properties: { + mountPath: { + description: "MountPath is the path that the workspace should be mounted to inside the Step or Sidecar,\noverriding any MountPath specified in the Task's WorkspaceDeclaration.", + type: "string" + }, + name: { + description: "Name is the name of the workspace this Step or Sidecar wants access to.", + type: "string" + } + }, + required: ["mountPath", "name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + required: ["name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + steps: { + description: "Steps are the steps of the build; each step is run sequentially with the\nsource mounted into /workspace.", + items: { + description: "Step runs a subcomponent of a Task", + properties: { + args: { + description: "Arguments to the entrypoint.\nThe image's CMD is used if this is not provided.\nVariable references $(VAR_NAME) are expanded using the container's environment. If a variable\ncannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced\nto a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. \"$$(VAR_NAME)\" will\nproduce the string literal \"$(VAR_NAME)\". Escaped references will never be expanded, regardless\nof whether the variable exists or not. Cannot be updated.\nMore info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + command: { + description: "Entrypoint array. Not executed within a shell.\nThe image's ENTRYPOINT is used if this is not provided.\nVariable references $(VAR_NAME) are expanded using the container's environment. If a variable\ncannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced\nto a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. \"$$(VAR_NAME)\" will\nproduce the string literal \"$(VAR_NAME)\". Escaped references will never be expanded, regardless\nof whether the variable exists or not. Cannot be updated.\nMore info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + computeResources: { + description: "ComputeResources required by this Step.\nCannot be updated.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + properties: { + claims: { + description: "Claims lists the names of resources, defined in spec.resourceClaims,\nthat are used by this container.\n\nThis field depends on the\nDynamicResourceAllocation feature gate.\n\nThis field is immutable. It can only be set for containers.", + items: { + description: "ResourceClaim references one entry in PodSpec.ResourceClaims.", + properties: { + name: { + description: "Name must match the name of one entry in pod.spec.resourceClaims of\nthe Pod where this field is used. It makes that resource available\ninside a container.", + type: "string" + }, + request: { + description: "Request is the name chosen for a request in the referenced claim.\nIf empty, everything from the claim is made available, otherwise\nonly the result of this request.", + type: "string" + } + }, + required: ["name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-map-keys": ["name"], + "x-kubernetes-list-type": "map" + }, + limits: { + additionalProperties: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + }, + description: "Limits describes the maximum amount of compute resources allowed.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + type: "object" + }, + requests: { + additionalProperties: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + }, + description: "Requests describes the minimum amount of compute resources required.\nIf Requests is omitted for a container, it defaults to Limits if that is explicitly specified,\notherwise to an implementation-defined value. Requests cannot exceed Limits.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + type: "object" + } + }, + type: "object" + }, + displayName: { + description: "DisplayName is a user-facing name of the step that may be\nused to populate a UI.", + type: "string" + }, + env: { + description: "List of environment variables to set in the Step.\nCannot be updated.", + items: { + description: "EnvVar represents an environment variable present in a Container.", + properties: { + name: { + description: "Name of the environment variable.\nMay consist of any printable ASCII characters except '='.", + type: "string" + }, + value: { + description: "Variable references $(VAR_NAME) are expanded\nusing the previously defined environment variables in the container and\nany service environment variables. If a variable cannot be resolved,\nthe reference in the input string will be unchanged. Double $$ are reduced\nto a single $, which allows for escaping the $(VAR_NAME) syntax: i.e.\n\"$$(VAR_NAME)\" will produce the string literal \"$(VAR_NAME)\".\nEscaped references will never be expanded, regardless of whether the variable\nexists or not.\nDefaults to \"\".", + type: "string" + }, + valueFrom: { + description: "Source for the environment variable's value. Cannot be used if value is not empty.", + properties: { + configMapKeyRef: { + description: "Selects a key of a ConfigMap.", + properties: { + key: { + description: "The key to select.", + type: "string" + }, + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "Specify whether the ConfigMap or its key must be defined", + type: "boolean" + } + }, + required: ["key"], + type: "object", + "x-kubernetes-map-type": "atomic" + }, + fieldRef: { + description: "Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`,\nspec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs.", + properties: { + apiVersion: { + description: "Version of the schema the FieldPath is written in terms of, defaults to \"v1\".", + type: "string" + }, + fieldPath: { + description: "Path of the field to select in the specified API version.", + type: "string" + } + }, + required: ["fieldPath"], + type: "object", + "x-kubernetes-map-type": "atomic" + }, + fileKeyRef: { + description: "FileKeyRef selects a key of the env file.\nRequires the EnvFiles feature gate to be enabled.", + properties: { + key: { + description: "The key within the env file. An invalid key will prevent the pod from starting.\nThe keys defined within a source may consist of any printable ASCII characters except '='.\nDuring Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.", + type: "string" + }, + optional: { + default: false, + description: "Specify whether the file or its key must be defined. If the file or key\ndoes not exist, then the env var is not published.\nIf optional is set to true and the specified key does not exist,\nthe environment variable will not be set in the Pod's containers.\n\nIf optional is set to false and the specified key does not exist,\nan error will be returned during Pod creation.", + type: "boolean" + }, + path: { + description: "The path within the volume from which to select the file.\nMust be relative and may not contain the '..' path or start with '..'.", + type: "string" + }, + volumeName: { + description: "The name of the volume mount containing the env file.", + type: "string" + } + }, + required: ["key", "path", "volumeName"], + type: "object", + "x-kubernetes-map-type": "atomic" + }, + resourceFieldRef: { + description: "Selects a resource of the container: only resources limits and requests\n(limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported.", + properties: { + containerName: { + description: "Container name: required for volumes, optional for env vars", + type: "string" + }, + divisor: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Specifies the output format of the exposed resources, defaults to \"1\"", + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + }, + resource: { + description: "Required: resource to select", + type: "string" + } + }, + required: ["resource"], + type: "object", + "x-kubernetes-map-type": "atomic" + }, + secretKeyRef: { + description: "Selects a key of a secret in the pod's namespace", + properties: { + key: { + description: "The key of the secret to select from. Must be a valid secret key.", + type: "string" + }, + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "Specify whether the Secret or its key must be defined", + type: "boolean" + } + }, + required: ["key"], + type: "object", + "x-kubernetes-map-type": "atomic" + } + }, + type: "object" + } + }, + required: ["name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + envFrom: { + description: "List of sources to populate environment variables in the Step.\nThe keys defined within a source must be a C_IDENTIFIER. All invalid keys\nwill be reported as an event when the Step is starting. When a key exists in multiple\nsources, the value associated with the last source will take precedence.\nValues defined by an Env with a duplicate key will take precedence.\nCannot be updated.", + items: { + description: "EnvFromSource represents the source of a set of ConfigMaps or Secrets", + properties: { + configMapRef: { + description: "The ConfigMap to select from", + properties: { + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "Specify whether the ConfigMap must be defined", + type: "boolean" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + prefix: { + description: "Optional text to prepend to the name of each environment variable.\nMay consist of any printable ASCII characters except '='.", + type: "string" + }, + secretRef: { + description: "The Secret to select from", + properties: { + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "Specify whether the Secret must be defined", + type: "boolean" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + } + }, + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + image: { + description: "Docker image name.\nMore info: https://kubernetes.io/docs/concepts/containers/images", + type: "string" + }, + imagePullPolicy: { + description: "Image pull policy.\nOne of Always, Never, IfNotPresent.\nDefaults to Always if :latest tag is specified, or IfNotPresent otherwise.\nCannot be updated.\nMore info: https://kubernetes.io/docs/concepts/containers/images#updating-images", + type: "string" + }, + name: { + description: "Name of the Step specified as a DNS_LABEL.\nEach Step in a Task must have a unique name.", + type: "string" + }, + onError: { + description: "OnError defines the exiting behavior of a container on error\ncan be set to [ continue | stopAndFail ]", + type: "string" + }, + params: { + description: "Params declares parameters passed to this step action.", + items: { + description: "Param declares an ParamValues to use for the parameter called name.", + properties: { + name: { + type: "string" + }, + value: { + "x-kubernetes-preserve-unknown-fields": true + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + ref: { + description: "Contains the reference to an existing StepAction.", + properties: { + name: { + description: "Name of the referenced step", + type: "string" + }, + params: { + description: "Params contains the parameters used to identify the\nreferenced Tekton resource. Example entries might include\n\"repo\" or \"path\" but the set of params ultimately depends on\nthe chosen resolver.", + items: { + description: "Param declares an ParamValues to use for the parameter called name.", + properties: { + name: { + type: "string" + }, + value: { + "x-kubernetes-preserve-unknown-fields": true + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + resolver: { + description: "Resolver is the name of the resolver that should perform\nresolution of the referenced Tekton resource, such as \"git\".", + type: "string" + } + }, + type: "object" + }, + results: { + description: "Results declares StepResults produced by the Step.\n\nIt can be used in an inlined Step when used to store Results to $(step.results.resultName.path).\nIt cannot be used when referencing StepActions using [v1.Step.Ref].\nThe Results declared by the StepActions will be stored here instead.", + items: { + description: "StepResult used to describe the Results of a Step.", + properties: { + description: { + description: "Description is a human-readable description of the result", + type: "string" + }, + name: { + description: "Name the given name", + type: "string" + }, + properties: { + additionalProperties: { + description: "PropertySpec defines the struct for object keys", + properties: { + type: { + description: "ParamType indicates the type of an input parameter;\nUsed to distinguish between a single string and an array of strings.", + type: "string" + } + }, + type: "object" + }, + description: "Properties is the JSON Schema properties to support key-value pairs results.", + type: "object" + }, + type: { + description: "The possible types are 'string', 'array', and 'object', with 'string' as the default.", + type: "string" + } + }, + required: ["name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + script: { + description: "Script is the contents of an executable file to execute.\n\nIf Script is not empty, the Step cannot have an Command and the Args will be passed to the Script.", + type: "string" + }, + securityContext: { + description: "SecurityContext defines the security options the Step should be run with.\nIf set, the fields of SecurityContext override the equivalent fields of PodSecurityContext.\nMore info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/", + properties: { + allowPrivilegeEscalation: { + description: "AllowPrivilegeEscalation controls whether a process can gain more\nprivileges than its parent process. This bool directly controls if\nthe no_new_privs flag will be set on the container process.\nAllowPrivilegeEscalation is true always when the container is:\n1) run as Privileged\n2) has CAP_SYS_ADMIN\nNote that this field cannot be set when spec.os.name is windows.", + type: "boolean" + }, + appArmorProfile: { + description: "appArmorProfile is the AppArmor options to use by this container. If set, this profile\noverrides the pod's appArmorProfile.\nNote that this field cannot be set when spec.os.name is windows.", + properties: { + localhostProfile: { + description: "localhostProfile indicates a profile loaded on the node that should be used.\nThe profile must be preconfigured on the node to work.\nMust match the loaded name of the profile.\nMust be set if and only if type is \"Localhost\".", + type: "string" + }, + type: { + description: "type indicates which kind of AppArmor profile will be applied.\nValid options are:\n Localhost - a profile pre-loaded on the node.\n RuntimeDefault - the container runtime's default profile.\n Unconfined - no AppArmor enforcement.", + type: "string" + } + }, + required: ["type"], + type: "object" + }, + capabilities: { + description: "The capabilities to add/drop when running containers.\nDefaults to the default set of capabilities granted by the container runtime.\nNote that this field cannot be set when spec.os.name is windows.", + properties: { + add: { + description: "Added capabilities", + items: { + description: "Capability represent POSIX capabilities type", + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + drop: { + description: "Removed capabilities", + items: { + description: "Capability represent POSIX capabilities type", + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + privileged: { + description: "Run container in privileged mode.\nProcesses in privileged containers are essentially equivalent to root on the host.\nDefaults to false.\nNote that this field cannot be set when spec.os.name is windows.", + type: "boolean" + }, + procMount: { + description: "procMount denotes the type of proc mount to use for the containers.\nThe default value is Default which uses the container runtime defaults for\nreadonly paths and masked paths.\nThis requires the ProcMountType feature flag to be enabled.\nNote that this field cannot be set when spec.os.name is windows.", + type: "string" + }, + readOnlyRootFilesystem: { + description: "Whether this container has a read-only root filesystem.\nDefault is false.\nNote that this field cannot be set when spec.os.name is windows.", + type: "boolean" + }, + runAsGroup: { + description: "The GID to run the entrypoint of the container process.\nUses runtime default if unset.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is windows.", + format: "int64", + type: "integer" + }, + runAsNonRoot: { + description: "Indicates that the container must run as a non-root user.\nIf true, the Kubelet will validate the image at runtime to ensure that it\ndoes not run as UID 0 (root) and fail to start the container if it does.\nIf unset or false, no such validation will be performed.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.", + type: "boolean" + }, + runAsUser: { + description: "The UID to run the entrypoint of the container process.\nDefaults to user specified in image metadata if unspecified.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is windows.", + format: "int64", + type: "integer" + }, + seccompProfile: { + description: "The seccomp options to use by this container. If seccomp options are\nprovided at both the pod & container level, the container options\noverride the pod options.\nNote that this field cannot be set when spec.os.name is windows.", + properties: { + localhostProfile: { + description: "localhostProfile indicates a profile defined in a file on the node should be used.\nThe profile must be preconfigured on the node to work.\nMust be a descending path, relative to the kubelet's configured seccomp profile location.\nMust be set if type is \"Localhost\". Must NOT be set for any other type.", + type: "string" + }, + type: { + description: "type indicates which kind of seccomp profile will be applied.\nValid options are:\n\nLocalhost - a profile defined in a file on the node should be used.\nRuntimeDefault - the container runtime default profile should be used.\nUnconfined - no profile should be applied.", + type: "string" + } + }, + required: ["type"], + type: "object" + }, + seLinuxOptions: { + description: "The SELinux context to be applied to the container.\nIf unspecified, the container runtime will allocate a random SELinux context for each\ncontainer. May also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is windows.", + properties: { + level: { + description: "Level is SELinux level label that applies to the container.", + type: "string" + }, + role: { + description: "Role is a SELinux role label that applies to the container.", + type: "string" + }, + type: { + description: "Type is a SELinux type label that applies to the container.", + type: "string" + }, + user: { + description: "User is a SELinux user label that applies to the container.", + type: "string" + } + }, + type: "object" + }, + windowsOptions: { + description: "The Windows specific settings applied to all containers.\nIf unspecified, the options from the PodSecurityContext will be used.\nIf set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is linux.", + properties: { + gmsaCredentialSpec: { + description: "GMSACredentialSpec is where the GMSA admission webhook\n(https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the\nGMSA credential spec named by the GMSACredentialSpecName field.", + type: "string" + }, + gmsaCredentialSpecName: { + description: "GMSACredentialSpecName is the name of the GMSA credential spec to use.", + type: "string" + }, + hostProcess: { + description: "HostProcess determines if a container should be run as a 'Host Process' container.\nAll of a Pod's containers must have the same effective HostProcess value\n(it is not allowed to have a mix of HostProcess containers and non-HostProcess containers).\nIn addition, if HostProcess is true then HostNetwork must also be set to true.", + type: "boolean" + }, + runAsUserName: { + description: "The UserName in Windows to run the entrypoint of the container process.\nDefaults to the user specified in image metadata if unspecified.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.", + type: "string" + } + }, + type: "object" + } + }, + type: "object" + }, + stderrConfig: { + description: "Stores configuration for the stderr stream of the step.", + properties: { + path: { + description: "Path to duplicate stdout stream to on container's local filesystem.", + type: "string" + } + }, + type: "object" + }, + stdoutConfig: { + description: "Stores configuration for the stdout stream of the step.", + properties: { + path: { + description: "Path to duplicate stdout stream to on container's local filesystem.", + type: "string" + } + }, + type: "object" + }, + timeout: { + description: "Timeout is the time after which the step times out. Defaults to never.\nRefer to Go's ParseDuration documentation for expected format: https://golang.org/pkg/time/#ParseDuration", + type: "string" + }, + volumeDevices: { + description: "volumeDevices is the list of block devices to be used by the Step.", + items: { + description: "volumeDevice describes a mapping of a raw block device within a container.", + properties: { + devicePath: { + description: "devicePath is the path inside of the container that the device will be mapped to.", + type: "string" + }, + name: { + description: "name must match the name of a persistentVolumeClaim in the pod", + type: "string" + } + }, + required: ["devicePath", "name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + volumeMounts: { + description: "Volumes to mount into the Step's filesystem.\nCannot be updated.", + items: { + description: "VolumeMount describes a mounting of a Volume within a container.", + properties: { + mountPath: { + description: "Path within the container at which the volume should be mounted. Must\nnot contain ':'.", + type: "string" + }, + mountPropagation: { + description: "mountPropagation determines how mounts are propagated from the host\nto container and the other way around.\nWhen not set, MountPropagationNone is used.\nThis field is beta in 1.10.\nWhen RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified\n(which defaults to None).", + type: "string" + }, + name: { + description: "This must match the Name of a Volume.", + type: "string" + }, + readOnly: { + description: "Mounted read-only if true, read-write otherwise (false or unspecified).\nDefaults to false.", + type: "boolean" + }, + recursiveReadOnly: { + description: "RecursiveReadOnly specifies whether read-only mounts should be handled\nrecursively.\n\nIf ReadOnly is false, this field has no meaning and must be unspecified.\n\nIf ReadOnly is true, and this field is set to Disabled, the mount is not made\nrecursively read-only. If this field is set to IfPossible, the mount is made\nrecursively read-only, if it is supported by the container runtime. If this\nfield is set to Enabled, the mount is made recursively read-only if it is\nsupported by the container runtime, otherwise the pod will not be started and\nan error will be generated to indicate the reason.\n\nIf this field is set to IfPossible or Enabled, MountPropagation must be set to\nNone (or be unspecified, which defaults to None).\n\nIf this field is not specified, it is treated as an equivalent of Disabled.", + type: "string" + }, + subPath: { + description: "Path within the volume from which the container's volume should be mounted.\nDefaults to \"\" (volume's root).", + type: "string" + }, + subPathExpr: { + description: "Expanded path within the volume from which the container's volume should be mounted.\nBehaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment.\nDefaults to \"\" (volume's root).\nSubPathExpr and SubPath are mutually exclusive.", + type: "string" + } + }, + required: ["mountPath", "name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + when: { + description: "When is a list of when expressions that need to be true for the task to run", + items: { + description: "WhenExpression allows a PipelineTask to declare expressions to be evaluated before the Task is run\nto determine whether the Task should be executed or skipped", + properties: { + cel: { + description: "CEL is a string of Common Language Expression, which can be used to conditionally execute\nthe task based on the result of the expression evaluation\nMore info about CEL syntax: https://github.com/google/cel-spec/blob/master/doc/langdef.md", + type: "string" + }, + input: { + description: "Input is the string for guard checking which can be a static input or an output from a parent Task", + type: "string" + }, + operator: { + description: "Operator that represents an Input's relationship to the values", + type: "string" + }, + values: { + description: "Values is an array of strings, which is compared against the input, for guard checking\nIt must be non-empty", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + type: "array" + }, + workingDir: { + description: "Step's working directory.\nIf not specified, the container runtime's default will be used, which\nmight be configured in the container image.\nCannot be updated.", + type: "string" + }, + workspaces: { + description: "This is an alpha field. You must set the \"enable-api-fields\" feature flag to \"alpha\"\nfor this field to be supported.\n\nWorkspaces is a list of workspaces from the Task that this Step wants\nexclusive access to. Adding a workspace to this list means that any\nother Step or Sidecar that does not also request this Workspace will\nnot have access to it.", + items: { + description: "WorkspaceUsage is used by a Step or Sidecar to declare that it wants isolated access\nto a Workspace defined in a Task.", + properties: { + mountPath: { + description: "MountPath is the path that the workspace should be mounted to inside the Step or Sidecar,\noverriding any MountPath specified in the Task's WorkspaceDeclaration.", + type: "string" + }, + name: { + description: "Name is the name of the workspace this Step or Sidecar wants access to.", + type: "string" + } + }, + required: ["mountPath", "name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + required: ["name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + stepTemplate: { + description: "StepTemplate can be used as the basis for all step containers within the\nTask, so that the steps inherit settings on the base container.", + properties: { + args: { + description: "Arguments to the entrypoint.\nThe image's CMD is used if this is not provided.\nVariable references $(VAR_NAME) are expanded using the Step's environment. If a variable\ncannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced\nto a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. \"$$(VAR_NAME)\" will\nproduce the string literal \"$(VAR_NAME)\". Escaped references will never be expanded, regardless\nof whether the variable exists or not. Cannot be updated.\nMore info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + command: { + description: "Entrypoint array. Not executed within a shell.\nThe image's ENTRYPOINT is used if this is not provided.\nVariable references $(VAR_NAME) are expanded using the Step's environment. If a variable\ncannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced\nto a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. \"$$(VAR_NAME)\" will\nproduce the string literal \"$(VAR_NAME)\". Escaped references will never be expanded, regardless\nof whether the variable exists or not. Cannot be updated.\nMore info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + computeResources: { + description: "ComputeResources required by this Step.\nCannot be updated.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + properties: { + claims: { + description: "Claims lists the names of resources, defined in spec.resourceClaims,\nthat are used by this container.\n\nThis field depends on the\nDynamicResourceAllocation feature gate.\n\nThis field is immutable. It can only be set for containers.", + items: { + description: "ResourceClaim references one entry in PodSpec.ResourceClaims.", + properties: { + name: { + description: "Name must match the name of one entry in pod.spec.resourceClaims of\nthe Pod where this field is used. It makes that resource available\ninside a container.", + type: "string" + }, + request: { + description: "Request is the name chosen for a request in the referenced claim.\nIf empty, everything from the claim is made available, otherwise\nonly the result of this request.", + type: "string" + } + }, + required: ["name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-map-keys": ["name"], + "x-kubernetes-list-type": "map" + }, + limits: { + additionalProperties: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + }, + description: "Limits describes the maximum amount of compute resources allowed.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + type: "object" + }, + requests: { + additionalProperties: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + }, + description: "Requests describes the minimum amount of compute resources required.\nIf Requests is omitted for a container, it defaults to Limits if that is explicitly specified,\notherwise to an implementation-defined value. Requests cannot exceed Limits.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + type: "object" + } + }, + type: "object" + }, + env: { + description: "List of environment variables to set in the Step.\nCannot be updated.", + items: { + description: "EnvVar represents an environment variable present in a Container.", + properties: { + name: { + description: "Name of the environment variable.\nMay consist of any printable ASCII characters except '='.", + type: "string" + }, + value: { + description: "Variable references $(VAR_NAME) are expanded\nusing the previously defined environment variables in the container and\nany service environment variables. If a variable cannot be resolved,\nthe reference in the input string will be unchanged. Double $$ are reduced\nto a single $, which allows for escaping the $(VAR_NAME) syntax: i.e.\n\"$$(VAR_NAME)\" will produce the string literal \"$(VAR_NAME)\".\nEscaped references will never be expanded, regardless of whether the variable\nexists or not.\nDefaults to \"\".", + type: "string" + }, + valueFrom: { + description: "Source for the environment variable's value. Cannot be used if value is not empty.", + properties: { + configMapKeyRef: { + description: "Selects a key of a ConfigMap.", + properties: { + key: { + description: "The key to select.", + type: "string" + }, + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "Specify whether the ConfigMap or its key must be defined", + type: "boolean" + } + }, + required: ["key"], + type: "object", + "x-kubernetes-map-type": "atomic" + }, + fieldRef: { + description: "Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`,\nspec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs.", + properties: { + apiVersion: { + description: "Version of the schema the FieldPath is written in terms of, defaults to \"v1\".", + type: "string" + }, + fieldPath: { + description: "Path of the field to select in the specified API version.", + type: "string" + } + }, + required: ["fieldPath"], + type: "object", + "x-kubernetes-map-type": "atomic" + }, + fileKeyRef: { + description: "FileKeyRef selects a key of the env file.\nRequires the EnvFiles feature gate to be enabled.", + properties: { + key: { + description: "The key within the env file. An invalid key will prevent the pod from starting.\nThe keys defined within a source may consist of any printable ASCII characters except '='.\nDuring Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.", + type: "string" + }, + optional: { + default: false, + description: "Specify whether the file or its key must be defined. If the file or key\ndoes not exist, then the env var is not published.\nIf optional is set to true and the specified key does not exist,\nthe environment variable will not be set in the Pod's containers.\n\nIf optional is set to false and the specified key does not exist,\nan error will be returned during Pod creation.", + type: "boolean" + }, + path: { + description: "The path within the volume from which to select the file.\nMust be relative and may not contain the '..' path or start with '..'.", + type: "string" + }, + volumeName: { + description: "The name of the volume mount containing the env file.", + type: "string" + } + }, + required: ["key", "path", "volumeName"], + type: "object", + "x-kubernetes-map-type": "atomic" + }, + resourceFieldRef: { + description: "Selects a resource of the container: only resources limits and requests\n(limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported.", + properties: { + containerName: { + description: "Container name: required for volumes, optional for env vars", + type: "string" + }, + divisor: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Specifies the output format of the exposed resources, defaults to \"1\"", + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + }, + resource: { + description: "Required: resource to select", + type: "string" + } + }, + required: ["resource"], + type: "object", + "x-kubernetes-map-type": "atomic" + }, + secretKeyRef: { + description: "Selects a key of a secret in the pod's namespace", + properties: { + key: { + description: "The key of the secret to select from. Must be a valid secret key.", + type: "string" + }, + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "Specify whether the Secret or its key must be defined", + type: "boolean" + } + }, + required: ["key"], + type: "object", + "x-kubernetes-map-type": "atomic" + } + }, + type: "object" + } + }, + required: ["name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + envFrom: { + description: "List of sources to populate environment variables in the Step.\nThe keys defined within a source must be a C_IDENTIFIER. All invalid keys\nwill be reported as an event when the Step is starting. When a key exists in multiple\nsources, the value associated with the last source will take precedence.\nValues defined by an Env with a duplicate key will take precedence.\nCannot be updated.", + items: { + description: "EnvFromSource represents the source of a set of ConfigMaps or Secrets", + properties: { + configMapRef: { + description: "The ConfigMap to select from", + properties: { + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "Specify whether the ConfigMap must be defined", + type: "boolean" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + prefix: { + description: "Optional text to prepend to the name of each environment variable.\nMay consist of any printable ASCII characters except '='.", + type: "string" + }, + secretRef: { + description: "The Secret to select from", + properties: { + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "Specify whether the Secret must be defined", + type: "boolean" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + } + }, + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + image: { + description: "Image reference name.\nMore info: https://kubernetes.io/docs/concepts/containers/images", + type: "string" + }, + imagePullPolicy: { + description: "Image pull policy.\nOne of Always, Never, IfNotPresent.\nDefaults to Always if :latest tag is specified, or IfNotPresent otherwise.\nCannot be updated.\nMore info: https://kubernetes.io/docs/concepts/containers/images#updating-images", + type: "string" + }, + securityContext: { + description: "SecurityContext defines the security options the Step should be run with.\nIf set, the fields of SecurityContext override the equivalent fields of PodSecurityContext.\nMore info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/", + properties: { + allowPrivilegeEscalation: { + description: "AllowPrivilegeEscalation controls whether a process can gain more\nprivileges than its parent process. This bool directly controls if\nthe no_new_privs flag will be set on the container process.\nAllowPrivilegeEscalation is true always when the container is:\n1) run as Privileged\n2) has CAP_SYS_ADMIN\nNote that this field cannot be set when spec.os.name is windows.", + type: "boolean" + }, + appArmorProfile: { + description: "appArmorProfile is the AppArmor options to use by this container. If set, this profile\noverrides the pod's appArmorProfile.\nNote that this field cannot be set when spec.os.name is windows.", + properties: { + localhostProfile: { + description: "localhostProfile indicates a profile loaded on the node that should be used.\nThe profile must be preconfigured on the node to work.\nMust match the loaded name of the profile.\nMust be set if and only if type is \"Localhost\".", + type: "string" + }, + type: { + description: "type indicates which kind of AppArmor profile will be applied.\nValid options are:\n Localhost - a profile pre-loaded on the node.\n RuntimeDefault - the container runtime's default profile.\n Unconfined - no AppArmor enforcement.", + type: "string" + } + }, + required: ["type"], + type: "object" + }, + capabilities: { + description: "The capabilities to add/drop when running containers.\nDefaults to the default set of capabilities granted by the container runtime.\nNote that this field cannot be set when spec.os.name is windows.", + properties: { + add: { + description: "Added capabilities", + items: { + description: "Capability represent POSIX capabilities type", + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + drop: { + description: "Removed capabilities", + items: { + description: "Capability represent POSIX capabilities type", + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + privileged: { + description: "Run container in privileged mode.\nProcesses in privileged containers are essentially equivalent to root on the host.\nDefaults to false.\nNote that this field cannot be set when spec.os.name is windows.", + type: "boolean" + }, + procMount: { + description: "procMount denotes the type of proc mount to use for the containers.\nThe default value is Default which uses the container runtime defaults for\nreadonly paths and masked paths.\nThis requires the ProcMountType feature flag to be enabled.\nNote that this field cannot be set when spec.os.name is windows.", + type: "string" + }, + readOnlyRootFilesystem: { + description: "Whether this container has a read-only root filesystem.\nDefault is false.\nNote that this field cannot be set when spec.os.name is windows.", + type: "boolean" + }, + runAsGroup: { + description: "The GID to run the entrypoint of the container process.\nUses runtime default if unset.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is windows.", + format: "int64", + type: "integer" + }, + runAsNonRoot: { + description: "Indicates that the container must run as a non-root user.\nIf true, the Kubelet will validate the image at runtime to ensure that it\ndoes not run as UID 0 (root) and fail to start the container if it does.\nIf unset or false, no such validation will be performed.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.", + type: "boolean" + }, + runAsUser: { + description: "The UID to run the entrypoint of the container process.\nDefaults to user specified in image metadata if unspecified.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is windows.", + format: "int64", + type: "integer" + }, + seccompProfile: { + description: "The seccomp options to use by this container. If seccomp options are\nprovided at both the pod & container level, the container options\noverride the pod options.\nNote that this field cannot be set when spec.os.name is windows.", + properties: { + localhostProfile: { + description: "localhostProfile indicates a profile defined in a file on the node should be used.\nThe profile must be preconfigured on the node to work.\nMust be a descending path, relative to the kubelet's configured seccomp profile location.\nMust be set if type is \"Localhost\". Must NOT be set for any other type.", + type: "string" + }, + type: { + description: "type indicates which kind of seccomp profile will be applied.\nValid options are:\n\nLocalhost - a profile defined in a file on the node should be used.\nRuntimeDefault - the container runtime default profile should be used.\nUnconfined - no profile should be applied.", + type: "string" + } + }, + required: ["type"], + type: "object" + }, + seLinuxOptions: { + description: "The SELinux context to be applied to the container.\nIf unspecified, the container runtime will allocate a random SELinux context for each\ncontainer. May also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is windows.", + properties: { + level: { + description: "Level is SELinux level label that applies to the container.", + type: "string" + }, + role: { + description: "Role is a SELinux role label that applies to the container.", + type: "string" + }, + type: { + description: "Type is a SELinux type label that applies to the container.", + type: "string" + }, + user: { + description: "User is a SELinux user label that applies to the container.", + type: "string" + } + }, + type: "object" + }, + windowsOptions: { + description: "The Windows specific settings applied to all containers.\nIf unspecified, the options from the PodSecurityContext will be used.\nIf set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is linux.", + properties: { + gmsaCredentialSpec: { + description: "GMSACredentialSpec is where the GMSA admission webhook\n(https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the\nGMSA credential spec named by the GMSACredentialSpecName field.", + type: "string" + }, + gmsaCredentialSpecName: { + description: "GMSACredentialSpecName is the name of the GMSA credential spec to use.", + type: "string" + }, + hostProcess: { + description: "HostProcess determines if a container should be run as a 'Host Process' container.\nAll of a Pod's containers must have the same effective HostProcess value\n(it is not allowed to have a mix of HostProcess containers and non-HostProcess containers).\nIn addition, if HostProcess is true then HostNetwork must also be set to true.", + type: "boolean" + }, + runAsUserName: { + description: "The UserName in Windows to run the entrypoint of the container process.\nDefaults to the user specified in image metadata if unspecified.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.", + type: "string" + } + }, + type: "object" + } + }, + type: "object" + }, + volumeDevices: { + description: "volumeDevices is the list of block devices to be used by the Step.", + items: { + description: "volumeDevice describes a mapping of a raw block device within a container.", + properties: { + devicePath: { + description: "devicePath is the path inside of the container that the device will be mapped to.", + type: "string" + }, + name: { + description: "name must match the name of a persistentVolumeClaim in the pod", + type: "string" + } + }, + required: ["devicePath", "name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + volumeMounts: { + description: "Volumes to mount into the Step's filesystem.\nCannot be updated.", + items: { + description: "VolumeMount describes a mounting of a Volume within a container.", + properties: { + mountPath: { + description: "Path within the container at which the volume should be mounted. Must\nnot contain ':'.", + type: "string" + }, + mountPropagation: { + description: "mountPropagation determines how mounts are propagated from the host\nto container and the other way around.\nWhen not set, MountPropagationNone is used.\nThis field is beta in 1.10.\nWhen RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified\n(which defaults to None).", + type: "string" + }, + name: { + description: "This must match the Name of a Volume.", + type: "string" + }, + readOnly: { + description: "Mounted read-only if true, read-write otherwise (false or unspecified).\nDefaults to false.", + type: "boolean" + }, + recursiveReadOnly: { + description: "RecursiveReadOnly specifies whether read-only mounts should be handled\nrecursively.\n\nIf ReadOnly is false, this field has no meaning and must be unspecified.\n\nIf ReadOnly is true, and this field is set to Disabled, the mount is not made\nrecursively read-only. If this field is set to IfPossible, the mount is made\nrecursively read-only, if it is supported by the container runtime. If this\nfield is set to Enabled, the mount is made recursively read-only if it is\nsupported by the container runtime, otherwise the pod will not be started and\nan error will be generated to indicate the reason.\n\nIf this field is set to IfPossible or Enabled, MountPropagation must be set to\nNone (or be unspecified, which defaults to None).\n\nIf this field is not specified, it is treated as an equivalent of Disabled.", + type: "string" + }, + subPath: { + description: "Path within the volume from which the container's volume should be mounted.\nDefaults to \"\" (volume's root).", + type: "string" + }, + subPathExpr: { + description: "Expanded path within the volume from which the container's volume should be mounted.\nBehaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment.\nDefaults to \"\" (volume's root).\nSubPathExpr and SubPath are mutually exclusive.", + type: "string" + } + }, + required: ["mountPath", "name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + workingDir: { + description: "Step's working directory.\nIf not specified, the container runtime's default will be used, which\nmight be configured in the container image.\nCannot be updated.", + type: "string" + } + }, + type: "object" + }, + volumes: { + description: "Volumes is a collection of volumes that are available to mount into the\nsteps of the build.\nSee Pod.spec.volumes (API version: v1)", + "x-kubernetes-preserve-unknown-fields": true + }, + workspaces: { + description: "Workspaces are the volumes that this Task requires.", + items: { + description: "WorkspaceDeclaration is a declaration of a volume that a Task requires.", + properties: { + description: { + description: "Description is an optional human readable description of this volume.", + type: "string" + }, + mountPath: { + description: "MountPath overrides the directory that the volume will be made available at.", + type: "string" + }, + name: { + description: "Name is the name by which you can bind the volume at runtime.", + type: "string" + }, + optional: { + description: "Optional marks a Workspace as not being required in TaskRuns. By default\nthis field is false and so declared workspaces are required.", + type: "boolean" + }, + readOnly: { + description: "ReadOnly dictates whether a mounted volume is writable. By default this\nfield is false and so mounted volumes are writable.", + type: "boolean" + } + }, + required: ["name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + } + }, + type: "object" + } + }, + served: true, + storage: true, + subresources: { + status: {} + } + }] + } +}; +export const CustomResourceDefinition_TaskrunsTektonDev: KubernetesResource = { + apiVersion: "apiextensions.k8s.io/v1", + kind: "CustomResourceDefinition", + metadata: { + labels: { + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/part-of": "tekton-pipelines", + "pipeline.tekton.dev/release": "v1.15.0", + version: "v1.15.0" + }, + name: "taskruns.tekton.dev" + }, + spec: { + conversion: { + strategy: "Webhook", + webhook: { + clientConfig: { + service: { + name: "tekton-pipelines-webhook", + namespace: "tekton-pipelines" + } + }, + conversionReviewVersions: ["v1beta1", "v1"] + } + }, + group: "tekton.dev", + names: { + categories: ["tekton", "tekton-pipelines"], + kind: "TaskRun", + plural: "taskruns", + shortNames: ["tr", "trs"], + singular: "taskrun" + }, + preserveUnknownFields: false, + scope: "Namespaced", + versions: [{ + additionalPrinterColumns: [{ + jsonPath: ".status.conditions[?(@.type==\"Succeeded\")].status", + name: "Succeeded", + type: "string" + }, { + jsonPath: ".status.conditions[?(@.type==\"Succeeded\")].reason", + name: "Reason", + type: "string" + }, { + jsonPath: ".status.startTime", + name: "StartTime", + type: "date" + }, { + jsonPath: ".status.completionTime", + name: "CompletionTime", + type: "date" + }], + name: "v1beta1", + schema: { + openAPIV3Schema: { + description: "TaskRun\nDeprecated: Please use v1.TaskRun instead.", + properties: { + apiVersion: { + description: "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", + type: "string" + }, + kind: { + description: "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + type: "string" + }, + metadata: { + type: "object" + }, + spec: { + description: "Spec", + properties: { + computeResources: { + description: "ComputeResources", + properties: { + claims: { + description: "Claims lists the names of resources, defined in spec.resourceClaims,\nthat are used by this container.\n\nThis field depends on the\nDynamicResourceAllocation feature gate.\n\nThis field is immutable. It can only be set for containers.", + items: { + description: "ResourceClaim references one entry in PodSpec.ResourceClaims.", + properties: { + name: { + description: "Name must match the name of one entry in pod.spec.resourceClaims of\nthe Pod where this field is used. It makes that resource available\ninside a container.", + type: "string" + }, + request: { + description: "Request is the name chosen for a request in the referenced claim.\nIf empty, everything from the claim is made available, otherwise\nonly the result of this request.", + type: "string" + } + }, + required: ["name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-map-keys": ["name"], + "x-kubernetes-list-type": "map" + }, + limits: { + additionalProperties: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + }, + description: "Limits describes the maximum amount of compute resources allowed.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + type: "object" + }, + requests: { + additionalProperties: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + }, + description: "Requests describes the minimum amount of compute resources required.\nIf Requests is omitted for a container, it defaults to Limits if that is explicitly specified,\notherwise to an implementation-defined value. Requests cannot exceed Limits.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + type: "object" + } + }, + type: "object" + }, + debug: { + description: "Debug", + properties: { + breakpoints: { + description: "Breakpoints", + properties: { + beforeSteps: { + description: "BeforeSteps", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + onFailure: { + description: "OnFailure", + type: "string" + } + }, + type: "object" + } + }, + type: "object" + }, + managedBy: { + description: "ManagedBy", + type: "string" + }, + params: { + description: "Params", + items: { + description: "Param", + properties: { + name: { + type: "string" + }, + value: { + description: "Value", + "x-kubernetes-preserve-unknown-fields": true + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + podTemplate: { + description: "PodTemplate", + properties: { + affinity: { + description: "If specified, the pod's scheduling constraints.\nSee Pod.spec.affinity (API version: v1)", + "x-kubernetes-preserve-unknown-fields": true + }, + automountServiceAccountToken: { + description: "AutomountServiceAccountToken indicates whether pods running as this\nservice account should have an API token automatically mounted.", + type: "boolean" + }, + dnsConfig: { + description: "Specifies the DNS parameters of a pod.\nParameters specified here will be merged to the generated DNS\nconfiguration based on DNSPolicy.", + properties: { + nameservers: { + description: "A list of DNS name server IP addresses.\nThis will be appended to the base nameservers generated from DNSPolicy.\nDuplicated nameservers will be removed.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + options: { + description: "A list of DNS resolver options.\nThis will be merged with the base options generated from DNSPolicy.\nDuplicated entries will be removed. Resolution options given in Options\nwill override those that appear in the base DNSPolicy.", + items: { + description: "PodDNSConfigOption defines DNS resolver options of a pod.", + properties: { + name: { + description: "Name is this DNS resolver option's name.\nRequired.", + type: "string" + }, + value: { + description: "Value is this DNS resolver option's value.", + type: "string" + } + }, + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + searches: { + description: "A list of DNS search domains for host-name lookup.\nThis will be appended to the base search paths generated from DNSPolicy.\nDuplicated search paths will be removed.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + dnsPolicy: { + description: "Set DNS policy for the pod. Defaults to \"ClusterFirst\". Valid values are\n'ClusterFirst', 'Default' or 'None'. DNS parameters given in DNSConfig\nwill be merged with the policy selected with DNSPolicy.", + type: "string" + }, + enableServiceLinks: { + description: "EnableServiceLinks indicates whether information about services should be injected into pod's\nenvironment variables, matching the syntax of Docker links.\nOptional: Defaults to true.", + type: "boolean" + }, + env: { + description: "List of environment variables that can be provided to the containers belonging to the pod.", + items: { + description: "EnvVar represents an environment variable present in a Container.", + properties: { + name: { + description: "Name of the environment variable.\nMay consist of any printable ASCII characters except '='.", + type: "string" + }, + value: { + description: "Variable references $(VAR_NAME) are expanded\nusing the previously defined environment variables in the container and\nany service environment variables. If a variable cannot be resolved,\nthe reference in the input string will be unchanged. Double $$ are reduced\nto a single $, which allows for escaping the $(VAR_NAME) syntax: i.e.\n\"$$(VAR_NAME)\" will produce the string literal \"$(VAR_NAME)\".\nEscaped references will never be expanded, regardless of whether the variable\nexists or not.\nDefaults to \"\".", + type: "string" + }, + valueFrom: { + description: "Source for the environment variable's value. Cannot be used if value is not empty.", + properties: { + configMapKeyRef: { + description: "Selects a key of a ConfigMap.", + properties: { + key: { + description: "The key to select.", + type: "string" + }, + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "Specify whether the ConfigMap or its key must be defined", + type: "boolean" + } + }, + required: ["key"], + type: "object", + "x-kubernetes-map-type": "atomic" + }, + fieldRef: { + description: "Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`,\nspec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs.", + properties: { + apiVersion: { + description: "Version of the schema the FieldPath is written in terms of, defaults to \"v1\".", + type: "string" + }, + fieldPath: { + description: "Path of the field to select in the specified API version.", + type: "string" + } + }, + required: ["fieldPath"], + type: "object", + "x-kubernetes-map-type": "atomic" + }, + fileKeyRef: { + description: "FileKeyRef selects a key of the env file.\nRequires the EnvFiles feature gate to be enabled.", + properties: { + key: { + description: "The key within the env file. An invalid key will prevent the pod from starting.\nThe keys defined within a source may consist of any printable ASCII characters except '='.\nDuring Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.", + type: "string" + }, + optional: { + default: false, + description: "Specify whether the file or its key must be defined. If the file or key\ndoes not exist, then the env var is not published.\nIf optional is set to true and the specified key does not exist,\nthe environment variable will not be set in the Pod's containers.\n\nIf optional is set to false and the specified key does not exist,\nan error will be returned during Pod creation.", + type: "boolean" + }, + path: { + description: "The path within the volume from which to select the file.\nMust be relative and may not contain the '..' path or start with '..'.", + type: "string" + }, + volumeName: { + description: "The name of the volume mount containing the env file.", + type: "string" + } + }, + required: ["key", "path", "volumeName"], + type: "object", + "x-kubernetes-map-type": "atomic" + }, + resourceFieldRef: { + description: "Selects a resource of the container: only resources limits and requests\n(limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported.", + properties: { + containerName: { + description: "Container name: required for volumes, optional for env vars", + type: "string" + }, + divisor: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Specifies the output format of the exposed resources, defaults to \"1\"", + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + }, + resource: { + description: "Required: resource to select", + type: "string" + } + }, + required: ["resource"], + type: "object", + "x-kubernetes-map-type": "atomic" + }, + secretKeyRef: { + description: "Selects a key of a secret in the pod's namespace", + properties: { + key: { + description: "The key of the secret to select from. Must be a valid secret key.", + type: "string" + }, + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "Specify whether the Secret or its key must be defined", + type: "boolean" + } + }, + required: ["key"], + type: "object", + "x-kubernetes-map-type": "atomic" + } + }, + type: "object" + } + }, + required: ["name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + hostAliases: { + description: "HostAliases is an optional list of hosts and IPs that will be injected into the pod's hosts\nfile if specified. This is only valid for non-hostNetwork pods.", + items: { + description: "HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the\npod's hosts file.", + properties: { + hostnames: { + description: "Hostnames for the above IP address.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + ip: { + description: "IP address of the host file entry.", + type: "string" + } + }, + required: ["ip"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + hostNetwork: { + description: "HostNetwork specifies whether the pod may use the node network namespace", + type: "boolean" + }, + hostUsers: { + description: "HostUsers indicates whether the pod will use the host's user namespace.\nOptional: Default to true.\nIf set to true or not present, the pod will be run in the host user namespace, useful\nfor when the pod needs a feature only available to the host user namespace, such as\nloading a kernel module with CAP_SYS_MODULE.\nWhen set to false, a new user namespace is created for the pod. Setting false\nis useful to mitigating container breakout vulnerabilities such as allowing\ncontainers to run as root without their user having root privileges on the host.\nThis field depends on the kubernetes feature gate UserNamespacesSupport being enabled.", + type: "boolean" + }, + imagePullSecrets: { + description: "ImagePullSecrets gives the name of the secret used by the pod to pull the image if specified", + items: { + description: "LocalObjectReference contains enough information to let you locate the\nreferenced object inside the same namespace.", + properties: { + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + nodeSelector: { + additionalProperties: { + type: "string" + }, + description: "NodeSelector is a selector which must be true for the pod to fit on a node.\nSelector which must match a node's labels for the pod to be scheduled on that node.\nMore info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/", + type: "object" + }, + priorityClassName: { + description: "If specified, indicates the pod's priority. \"system-node-critical\" and\n\"system-cluster-critical\" are two special keywords which indicate the\nhighest priorities with the former being the highest priority. Any other\nname must be defined by creating a PriorityClass object with that name.\nIf not specified, the pod priority will be default or zero if there is no\ndefault.", + type: "string" + }, + runtimeClassName: { + description: "RuntimeClassName refers to a RuntimeClass object in the node.k8s.io\ngroup, which should be used to run this pod. If no RuntimeClass resource\nmatches the named class, the pod will not be run. If unset or empty, the\n\"legacy\" RuntimeClass will be used, which is an implicit class with an\nempty definition that uses the default runtime handler.\nMore info: https://git.k8s.io/enhancements/keps/sig-node/runtime-class.md\nThis is a beta feature as of Kubernetes v1.14.", + type: "string" + }, + schedulerName: { + description: "SchedulerName specifies the scheduler to be used to dispatch the Pod", + type: "string" + }, + securityContext: { + description: "SecurityContext holds pod-level security attributes and common container settings.\nOptional: Defaults to empty. See type description for default values of each field.\nSee Pod.spec.securityContext (API version: v1)", + "x-kubernetes-preserve-unknown-fields": true + }, + tolerations: { + description: "If specified, the pod's tolerations.", + items: { + description: "The pod this Toleration is attached to tolerates any taint that matches\nthe triple using the matching operator .", + properties: { + effect: { + description: "Effect indicates the taint effect to match. Empty means match all taint effects.\nWhen specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.", + type: "string" + }, + key: { + description: "Key is the taint key that the toleration applies to. Empty means match all taint keys.\nIf the key is empty, operator must be Exists; this combination means to match all values and all keys.", + type: "string" + }, + operator: { + description: "Operator represents a key's relationship to the value.\nValid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.\nExists is equivalent to wildcard for value, so that a pod can\ntolerate all taints of a particular category.\nLt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).", + type: "string" + }, + tolerationSeconds: { + description: "TolerationSeconds represents the period of time the toleration (which must be\nof effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,\nit is not set, which means tolerate the taint forever (do not evict). Zero and\nnegative values will be treated as 0 (evict immediately) by the system.", + format: "int64", + type: "integer" + }, + value: { + description: "Value is the taint value the toleration matches to.\nIf the operator is Exists, the value should be empty, otherwise just a regular string.", + type: "string" + } + }, + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + topologySpreadConstraints: { + description: "TopologySpreadConstraints controls how Pods are spread across your cluster among\nfailure-domains such as regions, zones, nodes, and other user-defined topology domains.", + items: { + description: "TopologySpreadConstraint specifies how to spread matching pods among the given topology.", + properties: { + labelSelector: { + description: "LabelSelector is used to find matching pods.\nPods that match this label selector are counted to determine the number of pods\nin their corresponding topology domain.", + properties: { + matchExpressions: { + description: "matchExpressions is a list of label selector requirements. The requirements are ANDed.", + items: { + description: "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", + properties: { + key: { + description: "key is the label key that the selector applies to.", + type: "string" + }, + operator: { + description: "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", + type: "string" + }, + values: { + description: "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + required: ["key", "operator"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + matchLabels: { + additionalProperties: { + type: "string" + }, + description: "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", + type: "object" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + matchLabelKeys: { + description: "MatchLabelKeys is a set of pod label keys to select the pods over which\nspreading will be calculated. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are ANDed with labelSelector\nto select the group of existing pods over which spreading will be calculated\nfor the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector.\nMatchLabelKeys cannot be set when LabelSelector isn't set.\nKeys that don't exist in the incoming pod labels will\nbe ignored. A null or empty list means only match against labelSelector.\n\nThis is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default).", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + maxSkew: { + description: "MaxSkew describes the degree to which pods may be unevenly distributed.\nWhen `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference\nbetween the number of matching pods in the target topology and the global minimum.\nThe global minimum is the minimum number of matching pods in an eligible domain\nor zero if the number of eligible domains is less than MinDomains.\nFor example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same\nlabelSelector spread as 2/2/1:\nIn this case, the global minimum is 1.\n| zone1 | zone2 | zone3 |\n| P P | P P | P |\n- if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2;\nscheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2)\nviolate MaxSkew(1).\n- if MaxSkew is 2, incoming pod can be scheduled onto any zone.\nWhen `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence\nto topologies that satisfy it.\nIt's a required field. Default value is 1 and 0 is not allowed.", + format: "int32", + type: "integer" + }, + minDomains: { + description: "MinDomains indicates a minimum number of eligible domains.\nWhen the number of eligible domains with matching topology keys is less than minDomains,\nPod Topology Spread treats \"global minimum\" as 0, and then the calculation of Skew is performed.\nAnd when the number of eligible domains with matching topology keys equals or greater than minDomains,\nthis value has no effect on scheduling.\nAs a result, when the number of eligible domains is less than minDomains,\nscheduler won't schedule more than maxSkew Pods to those domains.\nIf value is nil, the constraint behaves as if MinDomains is equal to 1.\nValid values are integers greater than 0.\nWhen value is not nil, WhenUnsatisfiable must be DoNotSchedule.\n\nFor example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same\nlabelSelector spread as 2/2/2:\n| zone1 | zone2 | zone3 |\n| P P | P P | P P |\nThe number of domains is less than 5(MinDomains), so \"global minimum\" is treated as 0.\nIn this situation, new pod with the same labelSelector cannot be scheduled,\nbecause computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones,\nit will violate MaxSkew.", + format: "int32", + type: "integer" + }, + nodeAffinityPolicy: { + description: "NodeAffinityPolicy indicates how we will treat Pod's nodeAffinity/nodeSelector\nwhen calculating pod topology spread skew. Options are:\n- Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations.\n- Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations.\n\nIf this value is nil, the behavior is equivalent to the Honor policy.", + type: "string" + }, + nodeTaintsPolicy: { + description: "NodeTaintsPolicy indicates how we will treat node taints when calculating\npod topology spread skew. Options are:\n- Honor: nodes without taints, along with tainted nodes for which the incoming pod\nhas a toleration, are included.\n- Ignore: node taints are ignored. All nodes are included.\n\nIf this value is nil, the behavior is equivalent to the Ignore policy.", + type: "string" + }, + topologyKey: { + description: "TopologyKey is the key of node labels. Nodes that have a label with this key\nand identical values are considered to be in the same topology.\nWe consider each as a \"bucket\", and try to put balanced number\nof pods into each bucket.\nWe define a domain as a particular instance of a topology.\nAlso, we define an eligible domain as a domain whose nodes meet the requirements of\nnodeAffinityPolicy and nodeTaintsPolicy.\ne.g. If TopologyKey is \"kubernetes.io/hostname\", each Node is a domain of that topology.\nAnd, if TopologyKey is \"topology.kubernetes.io/zone\", each zone is a domain of that topology.\nIt's a required field.", + type: "string" + }, + whenUnsatisfiable: { + description: "WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy\nthe spread constraint.\n- DoNotSchedule (default) tells the scheduler not to schedule it.\n- ScheduleAnyway tells the scheduler to schedule the pod in any location,\n but giving higher precedence to topologies that would help reduce the\n skew.\nA constraint is considered \"Unsatisfiable\" for an incoming pod\nif and only if every possible node assignment for that pod would violate\n\"MaxSkew\" on some topology.\nFor example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same\nlabelSelector spread as 3/1/1:\n| zone1 | zone2 | zone3 |\n| P P P | P | P |\nIf WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled\nto zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies\nMaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler\nwon't make it *more* imbalanced.\nIt's a required field.", + type: "string" + } + }, + required: ["maxSkew", "topologyKey", "whenUnsatisfiable"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + volumes: { + description: "List of volumes that can be mounted by containers belonging to the pod.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes\nSee Pod.spec.volumes (API version: v1)", + "x-kubernetes-preserve-unknown-fields": true + } + }, + type: "object" + }, + resources: { + description: "Resources\nDeprecated: Unused, preserved only for backwards compatibility", + properties: { + inputs: { + description: "Inputs", + items: { + description: "TaskResourceBinding\nDeprecated: Unused, preserved only for backwards compatibility", + properties: { + name: { + description: "Name", + type: "string" + }, + paths: { + description: "Paths", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + resourceRef: { + description: "ResourceRef", + properties: { + apiVersion: { + description: "APIVersion", + type: "string" + }, + name: { + description: "Name", + type: "string" + } + }, + type: "object" + }, + resourceSpec: { + description: "ResourceSpec", + properties: { + description: { + description: "Description is a user-facing description of the resource that may be\nused to populate a UI.", + type: "string" + }, + params: { + items: { + description: "ResourceParam declares a string value to use for the parameter called Name, and is used in\nthe specific context of PipelineResources.\n\nDeprecated: Unused, preserved only for backwards compatibility", + properties: { + name: { + type: "string" + }, + value: { + type: "string" + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + secrets: { + description: "Secrets to fetch to populate some of resource fields", + items: { + description: "SecretParam indicates which secret can be used to populate a field of the resource\n\nDeprecated: Unused, preserved only for backwards compatibility", + properties: { + fieldName: { + type: "string" + }, + secretKey: { + type: "string" + }, + secretName: { + type: "string" + } + }, + required: ["fieldName", "secretKey", "secretName"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + type: { + description: "PipelineResourceType represents the type of endpoint the pipelineResource is, so that the\ncontroller will know this pipelineResource shouldx be fetched and optionally what\nadditional metatdata should be provided for it.\n\nDeprecated: Unused, preserved only for backwards compatibility", + type: "string" + } + }, + required: ["params", "type"], + type: "object" + } + }, + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + outputs: { + description: "Outputs", + items: { + description: "TaskResourceBinding\nDeprecated: Unused, preserved only for backwards compatibility", + properties: { + name: { + description: "Name", + type: "string" + }, + paths: { + description: "Paths", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + resourceRef: { + description: "ResourceRef", + properties: { + apiVersion: { + description: "APIVersion", + type: "string" + }, + name: { + description: "Name", + type: "string" + } + }, + type: "object" + }, + resourceSpec: { + description: "ResourceSpec", + properties: { + description: { + description: "Description is a user-facing description of the resource that may be\nused to populate a UI.", + type: "string" + }, + params: { + items: { + description: "ResourceParam declares a string value to use for the parameter called Name, and is used in\nthe specific context of PipelineResources.\n\nDeprecated: Unused, preserved only for backwards compatibility", + properties: { + name: { + type: "string" + }, + value: { + type: "string" + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + secrets: { + description: "Secrets to fetch to populate some of resource fields", + items: { + description: "SecretParam indicates which secret can be used to populate a field of the resource\n\nDeprecated: Unused, preserved only for backwards compatibility", + properties: { + fieldName: { + type: "string" + }, + secretKey: { + type: "string" + }, + secretName: { + type: "string" + } + }, + required: ["fieldName", "secretKey", "secretName"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + type: { + description: "PipelineResourceType represents the type of endpoint the pipelineResource is, so that the\ncontroller will know this pipelineResource shouldx be fetched and optionally what\nadditional metatdata should be provided for it.\n\nDeprecated: Unused, preserved only for backwards compatibility", + type: "string" + } + }, + required: ["params", "type"], + type: "object" + } + }, + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + retries: { + description: "Retries", + type: "integer" + }, + serviceAccountName: { + description: "ServiceAccountName", + type: "string" + }, + sidecarOverrides: { + description: "SidecarOverrides", + items: { + description: "TaskRunSidecarOverride", + properties: { + name: { + description: "Name", + type: "string" + }, + resources: { + description: "Resources", + properties: { + claims: { + description: "Claims lists the names of resources, defined in spec.resourceClaims,\nthat are used by this container.\n\nThis field depends on the\nDynamicResourceAllocation feature gate.\n\nThis field is immutable. It can only be set for containers.", + items: { + description: "ResourceClaim references one entry in PodSpec.ResourceClaims.", + properties: { + name: { + description: "Name must match the name of one entry in pod.spec.resourceClaims of\nthe Pod where this field is used. It makes that resource available\ninside a container.", + type: "string" + }, + request: { + description: "Request is the name chosen for a request in the referenced claim.\nIf empty, everything from the claim is made available, otherwise\nonly the result of this request.", + type: "string" + } + }, + required: ["name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-map-keys": ["name"], + "x-kubernetes-list-type": "map" + }, + limits: { + additionalProperties: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + }, + description: "Limits describes the maximum amount of compute resources allowed.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + type: "object" + }, + requests: { + additionalProperties: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + }, + description: "Requests describes the minimum amount of compute resources required.\nIf Requests is omitted for a container, it defaults to Limits if that is explicitly specified,\notherwise to an implementation-defined value. Requests cannot exceed Limits.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + type: "object" + } + }, + type: "object" + } + }, + required: ["name", "resources"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + status: { + description: "Status", + type: "string" + }, + statusMessage: { + description: "StatusMessage", + type: "string" + }, + stepOverrides: { + description: "StepOverrides", + items: { + description: "TaskRunStepOverride", + properties: { + name: { + description: "Name", + type: "string" + }, + resources: { + description: "Resources", + properties: { + claims: { + description: "Claims lists the names of resources, defined in spec.resourceClaims,\nthat are used by this container.\n\nThis field depends on the\nDynamicResourceAllocation feature gate.\n\nThis field is immutable. It can only be set for containers.", + items: { + description: "ResourceClaim references one entry in PodSpec.ResourceClaims.", + properties: { + name: { + description: "Name must match the name of one entry in pod.spec.resourceClaims of\nthe Pod where this field is used. It makes that resource available\ninside a container.", + type: "string" + }, + request: { + description: "Request is the name chosen for a request in the referenced claim.\nIf empty, everything from the claim is made available, otherwise\nonly the result of this request.", + type: "string" + } + }, + required: ["name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-map-keys": ["name"], + "x-kubernetes-list-type": "map" + }, + limits: { + additionalProperties: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + }, + description: "Limits describes the maximum amount of compute resources allowed.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + type: "object" + }, + requests: { + additionalProperties: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + }, + description: "Requests describes the minimum amount of compute resources required.\nIf Requests is omitted for a container, it defaults to Limits if that is explicitly specified,\notherwise to an implementation-defined value. Requests cannot exceed Limits.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + type: "object" + } + }, + type: "object" + } + }, + required: ["name", "resources"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + taskRef: { + description: "TaskRef", + properties: { + apiVersion: { + description: "APIVersion", + type: "string" + }, + bundle: { + description: "Deprecated: Please use ResolverRef with the bundles resolver instead.\nBundle", + type: "string" + }, + kind: { + description: "Kind", + type: "string" + }, + name: { + description: "Name", + type: "string" + }, + params: { + description: "Params", + items: { + description: "Param", + properties: { + name: { + type: "string" + }, + value: { + description: "Value", + "x-kubernetes-preserve-unknown-fields": true + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + resolver: { + description: "Resolver", + type: "string" + } + }, + type: "object" + }, + taskSpec: { + description: "TaskSpec", + "x-kubernetes-preserve-unknown-fields": true + }, + timeout: { + description: "Timeout", + type: "string" + }, + workspaces: { + description: "Workspaces", + items: { + description: "WorkspaceBinding", + properties: { + configMap: { + description: "ConfigMap", + properties: { + defaultMode: { + description: "defaultMode is optional: mode bits used to set permissions on created files by default.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nDefaults to 0644.\nDirectories within the path are not affected by this setting.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", + format: "int32", + type: "integer" + }, + items: { + description: "items if unspecified, each key-value pair in the Data field of the referenced\nConfigMap will be projected into the volume as a file whose name is the\nkey and content is the value. If specified, the listed keys will be\nprojected into the specified paths, and unlisted keys will not be\npresent. If a key is specified which is not present in the ConfigMap,\nthe volume setup will error unless it is marked optional. Paths must be\nrelative and may not contain the '..' path or start with '..'.", + items: { + description: "Maps a string key to a path within a volume.", + properties: { + key: { + description: "key is the key to project.", + type: "string" + }, + mode: { + description: "mode is Optional: mode bits used to set permissions on this file.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nIf not specified, the volume defaultMode will be used.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", + format: "int32", + type: "integer" + }, + path: { + description: "path is the relative path of the file to map the key to.\nMay not be an absolute path.\nMay not contain the path element '..'.\nMay not start with the string '..'.", + type: "string" + } + }, + required: ["key", "path"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "optional specify whether the ConfigMap or its keys must be defined", + type: "boolean" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + csi: { + description: "CSI", + properties: { + driver: { + description: "driver is the name of the CSI driver that handles this volume.\nConsult with your admin for the correct name as registered in the cluster.", + type: "string" + }, + fsType: { + description: "fsType to mount. Ex. \"ext4\", \"xfs\", \"ntfs\".\nIf not provided, the empty value is passed to the associated CSI driver\nwhich will determine the default filesystem to apply.", + type: "string" + }, + nodePublishSecretRef: { + description: "nodePublishSecretRef is a reference to the secret object containing\nsensitive information to pass to the CSI driver to complete the CSI\nNodePublishVolume and NodeUnpublishVolume calls.\nThis field is optional, and may be empty if no secret is required. If the\nsecret object contains more than one secret, all secret references are passed.", + properties: { + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + readOnly: { + description: "readOnly specifies a read-only configuration for the volume.\nDefaults to false (read/write).", + type: "boolean" + }, + volumeAttributes: { + additionalProperties: { + type: "string" + }, + description: "volumeAttributes stores driver-specific properties that are passed to the CSI\ndriver. Consult your driver's documentation for supported values.", + type: "object" + } + }, + required: ["driver"], + type: "object" + }, + emptyDir: { + description: "EmptyDir", + properties: { + medium: { + description: "medium represents what type of storage medium should back this directory.\nThe default is \"\" which means to use the node's default medium.\nMust be an empty string (default) or Memory.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir", + type: "string" + }, + sizeLimit: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "sizeLimit is the total amount of local storage required for this EmptyDir volume.\nThe size limit is also applicable for memory medium.\nThe maximum usage on memory medium EmptyDir would be the minimum value between\nthe SizeLimit specified here and the sum of memory limits of all containers in a pod.\nThe default is nil which means that the limit is undefined.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir", + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + } + }, + type: "object" + }, + name: { + description: "Name", + type: "string" + }, + persistentVolumeClaim: { + description: "PersistentVolumeClaim", + properties: { + claimName: { + description: "claimName is the name of a PersistentVolumeClaim in the same namespace as the pod using this volume.\nMore info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims", + type: "string" + }, + readOnly: { + description: "readOnly Will force the ReadOnly setting in VolumeMounts.\nDefault false.", + type: "boolean" + } + }, + required: ["claimName"], + type: "object" + }, + projected: { + description: "Projected", + properties: { + defaultMode: { + description: "defaultMode are the mode bits used to set permissions on created files by default.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nDirectories within the path are not affected by this setting.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", + format: "int32", + type: "integer" + }, + sources: { + description: "sources is the list of volume projections. Each entry in this list\nhandles one source.", + items: { + description: "Projection that may be projected along with other supported volume types.\nExactly one of these fields must be set.", + properties: { + clusterTrustBundle: { + description: "ClusterTrustBundle allows a pod to access the `.spec.trustBundle` field\nof ClusterTrustBundle objects in an auto-updating file.\n\nAlpha, gated by the ClusterTrustBundleProjection feature gate.\n\nClusterTrustBundle objects can either be selected by name, or by the\ncombination of signer name and a label selector.\n\nKubelet performs aggressive normalization of the PEM contents written\ninto the pod filesystem. Esoteric PEM features such as inter-block\ncomments and block headers are stripped. Certificates are deduplicated.\nThe ordering of certificates within the file is arbitrary, and Kubelet\nmay change the order over time.", + properties: { + labelSelector: { + description: "Select all ClusterTrustBundles that match this label selector. Only has\neffect if signerName is set. Mutually-exclusive with name. If unset,\ninterpreted as \"match nothing\". If set but empty, interpreted as \"match\neverything\".", + properties: { + matchExpressions: { + description: "matchExpressions is a list of label selector requirements. The requirements are ANDed.", + items: { + description: "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", + properties: { + key: { + description: "key is the label key that the selector applies to.", + type: "string" + }, + operator: { + description: "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", + type: "string" + }, + values: { + description: "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + required: ["key", "operator"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + matchLabels: { + additionalProperties: { + type: "string" + }, + description: "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", + type: "object" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + name: { + description: "Select a single ClusterTrustBundle by object name. Mutually-exclusive\nwith signerName and labelSelector.", + type: "string" + }, + optional: { + description: "If true, don't block pod startup if the referenced ClusterTrustBundle(s)\naren't available. If using name, then the named ClusterTrustBundle is\nallowed not to exist. If using signerName, then the combination of\nsignerName and labelSelector is allowed to match zero\nClusterTrustBundles.", + type: "boolean" + }, + path: { + description: "Relative path from the volume root to write the bundle.", + type: "string" + }, + signerName: { + description: "Select all ClusterTrustBundles that match this signer name.\nMutually-exclusive with name. The contents of all selected\nClusterTrustBundles will be unified and deduplicated.", + type: "string" + } + }, + required: ["path"], + type: "object" + }, + configMap: { + description: "configMap information about the configMap data to project", + properties: { + items: { + description: "items if unspecified, each key-value pair in the Data field of the referenced\nConfigMap will be projected into the volume as a file whose name is the\nkey and content is the value. If specified, the listed keys will be\nprojected into the specified paths, and unlisted keys will not be\npresent. If a key is specified which is not present in the ConfigMap,\nthe volume setup will error unless it is marked optional. Paths must be\nrelative and may not contain the '..' path or start with '..'.", + items: { + description: "Maps a string key to a path within a volume.", + properties: { + key: { + description: "key is the key to project.", + type: "string" + }, + mode: { + description: "mode is Optional: mode bits used to set permissions on this file.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nIf not specified, the volume defaultMode will be used.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", + format: "int32", + type: "integer" + }, + path: { + description: "path is the relative path of the file to map the key to.\nMay not be an absolute path.\nMay not contain the path element '..'.\nMay not start with the string '..'.", + type: "string" + } + }, + required: ["key", "path"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "optional specify whether the ConfigMap or its keys must be defined", + type: "boolean" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + downwardAPI: { + description: "downwardAPI information about the downwardAPI data to project", + properties: { + items: { + description: "Items is a list of DownwardAPIVolume file", + items: { + description: "DownwardAPIVolumeFile represents information to create the file containing the pod field", + properties: { + fieldRef: { + description: "Required: Selects a field of the pod: only annotations, labels, name, namespace and uid are supported.", + properties: { + apiVersion: { + description: "Version of the schema the FieldPath is written in terms of, defaults to \"v1\".", + type: "string" + }, + fieldPath: { + description: "Path of the field to select in the specified API version.", + type: "string" + } + }, + required: ["fieldPath"], + type: "object", + "x-kubernetes-map-type": "atomic" + }, + mode: { + description: "Optional: mode bits used to set permissions on this file, must be an octal value\nbetween 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nIf not specified, the volume defaultMode will be used.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", + format: "int32", + type: "integer" + }, + path: { + description: "Required: Path is the relative path name of the file to be created. Must not be absolute or contain the '..' path. Must be utf-8 encoded. The first item of the relative path must not start with '..'", + type: "string" + }, + resourceFieldRef: { + description: "Selects a resource of the container: only resources limits and requests\n(limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported.", + properties: { + containerName: { + description: "Container name: required for volumes, optional for env vars", + type: "string" + }, + divisor: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Specifies the output format of the exposed resources, defaults to \"1\"", + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + }, + resource: { + description: "Required: resource to select", + type: "string" + } + }, + required: ["resource"], + type: "object", + "x-kubernetes-map-type": "atomic" + } + }, + required: ["path"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + podCertificate: { + description: "Projects an auto-rotating credential bundle (private key and certificate\nchain) that the pod can use either as a TLS client or server.\n\nKubelet generates a private key and uses it to send a\nPodCertificateRequest to the named signer. Once the signer approves the\nrequest and issues a certificate chain, Kubelet writes the key and\ncertificate chain to the pod filesystem. The pod does not start until\ncertificates have been issued for each podCertificate projected volume\nsource in its spec.\n\nKubelet will begin trying to rotate the certificate at the time indicated\nby the signer using the PodCertificateRequest.Status.BeginRefreshAt\ntimestamp.\n\nKubelet can write a single file, indicated by the credentialBundlePath\nfield, or separate files, indicated by the keyPath and\ncertificateChainPath fields.\n\nThe credential bundle is a single file in PEM format. The first PEM\nentry is the private key (in PKCS#8 format), and the remaining PEM\nentries are the certificate chain issued by the signer (typically,\nsigners will return their certificate chain in leaf-to-root order).\n\nPrefer using the credential bundle format, since your application code\ncan read it atomically. If you use keyPath and certificateChainPath,\nyour application must make two separate file reads. If these coincide\nwith a certificate rotation, it is possible that the private key and leaf\ncertificate you read may not correspond to each other. Your application\nwill need to check for this condition, and re-read until they are\nconsistent.\n\nThe named signer controls chooses the format of the certificate it\nissues; consult the signer implementation's documentation to learn how to\nuse the certificates it issues.", + properties: { + certificateChainPath: { + description: "Write the certificate chain at this path in the projected volume.\n\nMost applications should use credentialBundlePath. When using keyPath\nand certificateChainPath, your application needs to check that the key\nand leaf certificate are consistent, because it is possible to read the\nfiles mid-rotation.", + type: "string" + }, + credentialBundlePath: { + description: "Write the credential bundle at this path in the projected volume.\n\nThe credential bundle is a single file that contains multiple PEM blocks.\nThe first PEM block is a PRIVATE KEY block, containing a PKCS#8 private\nkey.\n\nThe remaining blocks are CERTIFICATE blocks, containing the issued\ncertificate chain from the signer (leaf and any intermediates).\n\nUsing credentialBundlePath lets your Pod's application code make a single\natomic read that retrieves a consistent key and certificate chain. If you\nproject them to separate files, your application code will need to\nadditionally check that the leaf certificate was issued to the key.", + type: "string" + }, + keyPath: { + description: "Write the key at this path in the projected volume.\n\nMost applications should use credentialBundlePath. When using keyPath\nand certificateChainPath, your application needs to check that the key\nand leaf certificate are consistent, because it is possible to read the\nfiles mid-rotation.", + type: "string" + }, + keyType: { + description: "The type of keypair Kubelet will generate for the pod.\n\nValid values are \"RSA3072\", \"RSA4096\", \"ECDSAP256\", \"ECDSAP384\",\n\"ECDSAP521\", and \"ED25519\".", + type: "string" + }, + maxExpirationSeconds: { + description: "maxExpirationSeconds is the maximum lifetime permitted for the\ncertificate.\n\nKubelet copies this value verbatim into the PodCertificateRequests it\ngenerates for this projection.\n\nIf omitted, kube-apiserver will set it to 86400(24 hours). kube-apiserver\nwill reject values shorter than 3600 (1 hour). The maximum allowable\nvalue is 7862400 (91 days).\n\nThe signer implementation is then free to issue a certificate with any\nlifetime *shorter* than MaxExpirationSeconds, but no shorter than 3600\nseconds (1 hour). This constraint is enforced by kube-apiserver.\n`kubernetes.io` signers will never issue certificates with a lifetime\nlonger than 24 hours.", + format: "int32", + type: "integer" + }, + signerName: { + description: "Kubelet's generated CSRs will be addressed to this signer.", + type: "string" + }, + userAnnotations: { + additionalProperties: { + type: "string" + }, + description: "userAnnotations allow pod authors to pass additional information to\nthe signer implementation. Kubernetes does not restrict or validate this\nmetadata in any way.\n\nThese values are copied verbatim into the `spec.unverifiedUserAnnotations` field of\nthe PodCertificateRequest objects that Kubelet creates.\n\nEntries are subject to the same validation as object metadata annotations,\nwith the addition that all keys must be domain-prefixed. No restrictions\nare placed on values, except an overall size limitation on the entire field.\n\nSigners should document the keys and values they support. Signers should\ndeny requests that contain keys they do not recognize.", + type: "object" + } + }, + required: ["keyType", "signerName"], + type: "object" + }, + secret: { + description: "secret information about the secret data to project", + properties: { + items: { + description: "items if unspecified, each key-value pair in the Data field of the referenced\nSecret will be projected into the volume as a file whose name is the\nkey and content is the value. If specified, the listed keys will be\nprojected into the specified paths, and unlisted keys will not be\npresent. If a key is specified which is not present in the Secret,\nthe volume setup will error unless it is marked optional. Paths must be\nrelative and may not contain the '..' path or start with '..'.", + items: { + description: "Maps a string key to a path within a volume.", + properties: { + key: { + description: "key is the key to project.", + type: "string" + }, + mode: { + description: "mode is Optional: mode bits used to set permissions on this file.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nIf not specified, the volume defaultMode will be used.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", + format: "int32", + type: "integer" + }, + path: { + description: "path is the relative path of the file to map the key to.\nMay not be an absolute path.\nMay not contain the path element '..'.\nMay not start with the string '..'.", + type: "string" + } + }, + required: ["key", "path"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "optional field specify whether the Secret or its key must be defined", + type: "boolean" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + serviceAccountToken: { + description: "serviceAccountToken is information about the serviceAccountToken data to project", + properties: { + audience: { + description: "audience is the intended audience of the token. A recipient of a token\nmust identify itself with an identifier specified in the audience of the\ntoken, and otherwise should reject the token. The audience defaults to the\nidentifier of the apiserver.", + type: "string" + }, + expirationSeconds: { + description: "expirationSeconds is the requested duration of validity of the service\naccount token. As the token approaches expiration, the kubelet volume\nplugin will proactively rotate the service account token. The kubelet will\nstart trying to rotate the token if the token is older than 80 percent of\nits time to live or if the token is older than 24 hours.Defaults to 1 hour\nand must be at least 10 minutes.", + format: "int64", + type: "integer" + }, + path: { + description: "path is the path relative to the mount point of the file to project the\ntoken into.", + type: "string" + } + }, + required: ["path"], + type: "object" + } + }, + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + secret: { + description: "Secret", + properties: { + defaultMode: { + description: "defaultMode is Optional: mode bits used to set permissions on created files by default.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values\nfor mode bits. Defaults to 0644.\nDirectories within the path are not affected by this setting.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", + format: "int32", + type: "integer" + }, + items: { + description: "items If unspecified, each key-value pair in the Data field of the referenced\nSecret will be projected into the volume as a file whose name is the\nkey and content is the value. If specified, the listed keys will be\nprojected into the specified paths, and unlisted keys will not be\npresent. If a key is specified which is not present in the Secret,\nthe volume setup will error unless it is marked optional. Paths must be\nrelative and may not contain the '..' path or start with '..'.", + items: { + description: "Maps a string key to a path within a volume.", + properties: { + key: { + description: "key is the key to project.", + type: "string" + }, + mode: { + description: "mode is Optional: mode bits used to set permissions on this file.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nIf not specified, the volume defaultMode will be used.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", + format: "int32", + type: "integer" + }, + path: { + description: "path is the relative path of the file to map the key to.\nMay not be an absolute path.\nMay not contain the path element '..'.\nMay not start with the string '..'.", + type: "string" + } + }, + required: ["key", "path"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + optional: { + description: "optional field specify whether the Secret or its keys must be defined", + type: "boolean" + }, + secretName: { + description: "secretName is the name of the secret in the pod's namespace to use.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#secret", + type: "string" + } + }, + type: "object" + }, + subPath: { + description: "SubPath", + type: "string" + }, + volumeClaimTemplate: { + description: "VolumeClaimTemplate", + "x-kubernetes-preserve-unknown-fields": true + } + }, + required: ["name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + status: { + description: "Status", + properties: { + annotations: { + additionalProperties: { + type: "string" + }, + description: "Annotations is additional Status fields for the Resource to save some\nadditional State as well as convey more information to the user. This is\nroughly akin to Annotations on any k8s resource, just the reconciler conveying\nricher information outwards.", + type: "object" + }, + cloudEvents: { + description: "CloudEvents", + items: { + description: "CloudEventDelivery", + properties: { + status: { + description: "CloudEventDeliveryState", + properties: { + condition: { + description: "Condition", + type: "string" + }, + message: { + description: "Error", + type: "string" + }, + retryCount: { + description: "RetryCount", + format: "int32", + type: "integer" + }, + sentAt: { + description: "SentAt", + format: "date-time", + type: "string" + } + }, + required: ["message", "retryCount"], + type: "object" + }, + target: { + description: "Target", + type: "string" + } + }, + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + completionTime: { + description: "CompletionTime", + format: "date-time", + type: "string" + }, + conditions: { + description: "Conditions the latest available observations of a resource's current state.", + items: { + description: "Condition defines a readiness condition for a Knative resource.\nSee: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties", + properties: { + lastTransitionTime: { + description: "LastTransitionTime is the last time the condition transitioned from one status to another.\nWe use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic\ndifferences (all other things held constant).", + type: "string" + }, + message: { + description: "A human readable message indicating details about the transition.", + type: "string" + }, + reason: { + description: "The reason for the condition's last transition.", + type: "string" + }, + severity: { + description: "Severity with which to treat failures of this type of condition.\nWhen this is not specified, it defaults to Error.", + type: "string" + }, + status: { + description: "Status of the condition, one of True, False, Unknown.", + type: "string" + }, + type: { + description: "Type of condition.", + type: "string" + } + }, + required: ["status", "type"], + type: "object" + }, + type: "array" + }, + observedGeneration: { + description: "ObservedGeneration is the 'Generation' of the Service that\nwas last processed by the controller.", + format: "int64", + type: "integer" + }, + podName: { + description: "PodName", + type: "string" + }, + provenance: { + description: "Provenance", + properties: { + configSource: { + description: "ConfigSource\nDeprecated: Use RefSource instead", + properties: { + digest: { + additionalProperties: { + type: "string" + }, + description: "Digest", + type: "object" + }, + entryPoint: { + description: "EntryPoint", + type: "string" + }, + uri: { + description: "URI", + type: "string" + } + }, + type: "object" + }, + featureFlags: { + description: "FeatureFlags", + properties: { + awaitSidecarReadiness: { + type: "boolean" + }, + coschedule: { + type: "string" + }, + disableCredsInit: { + type: "boolean" + }, + disableInlineSpec: { + type: "string" + }, + enableAPIFields: { + type: "string" + }, + enableArtifacts: { + type: "boolean" + }, + enableCELInWhenExpression: { + type: "boolean" + }, + enableConciseResolverSyntax: { + type: "boolean" + }, + enableKeepPodOnCancel: { + type: "boolean" + }, + enableKubernetesSidecar: { + type: "boolean" + }, + enableParamEnum: { + type: "boolean" + }, + enableProvenanceInStatus: { + type: "boolean" + }, + enableStepActions: { + description: "EnableStepActions is a no-op flag since StepActions are stable", + type: "boolean" + }, + enableTektonOCIBundles: { + description: "DeprecatedEnableTektonOCIBundles is maintained for backward compatibility\nto allow deletion of PipelineRuns created before v0.62.x.\nThis field is not used and can be removed in a future release\nonce we're confident old PipelineRuns have been cleaned up.\nSee issue #8359 for context.", + type: "boolean" + }, + enableTerminationMessageCompression: { + type: "boolean" + }, + enableWaitExponentialBackoff: { + type: "boolean" + }, + enforceNonfalsifiability: { + type: "string" + }, + maxResultSize: { + type: "integer" + }, + requireGitSSHSecretKnownHosts: { + type: "boolean" + }, + resultExtractionMethod: { + type: "string" + }, + runningInEnvWithInjectedSidecars: { + type: "boolean" + }, + sendCloudEventsForRuns: { + type: "boolean" + }, + setSecurityContext: { + type: "boolean" + }, + setSecurityContextReadOnlyRootFilesystem: { + type: "boolean" + }, + verificationNoMatchPolicy: { + description: "VerificationNoMatchPolicy is the feature flag for \"trusted-resources-verification-no-match-policy\"\nVerificationNoMatchPolicy can be set to \"ignore\", \"warn\" and \"fail\" values.\nignore: skip trusted resources verification when no matching verification policies found\nwarn: skip trusted resources verification when no matching verification policies found and log a warning\nfail: fail the taskrun or pipelines run if no matching verification policies found", + type: "string" + } + }, + type: "object" + }, + refSource: { + description: "RefSource", + properties: { + digest: { + additionalProperties: { + type: "string" + }, + description: "Digest", + type: "object" + }, + entryPoint: { + description: "EntryPoint", + type: "string" + }, + uri: { + description: "URI", + type: "string" + } + }, + type: "object" + } + }, + type: "object" + }, + resourcesResult: { + description: "ResourcesResult\nDeprecated: this field is not populated and is preserved only for backwards compatibility", + items: { + description: "RunResult is used to write key/value pairs to TaskRun pod termination messages.\nThe key/value pairs may come from the entrypoint binary, or represent a TaskRunResult.\nIf they represent a TaskRunResult, the key is the name of the result and the value is the\nJSON-serialized value of the result.", + properties: { + key: { + type: "string" + }, + resourceName: { + description: "ResourceName may be used in tests, but it is not populated in termination messages.\nIt is preserved here for backwards compatibility and will not be ported to v1.", + type: "string" + }, + type: { + description: "ResultType used to find out whether a RunResult is from a task result or not\nNote that ResultsType is another type which is used to define the data type\n(e.g. string, array, etc) we used for Results", + type: "integer" + }, + value: { + type: "string" + } + }, + required: ["key", "value"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + retriesStatus: { + description: "RetriesStatus", + "x-kubernetes-preserve-unknown-fields": true + }, + sidecars: { + description: "Sidecars", + items: { + description: "SidecarState", + properties: { + container: { + type: "string" + }, + imageID: { + type: "string" + }, + name: { + type: "string" + }, + running: { + description: "Details about a running container", + properties: { + startedAt: { + description: "Time at which the container was last (re-)started", + format: "date-time", + type: "string" + } + }, + type: "object" + }, + terminated: { + description: "Details about a terminated container", + properties: { + containerID: { + description: "Container's ID in the format '://'", + type: "string" + }, + exitCode: { + description: "Exit status from the last termination of the container", + format: "int32", + type: "integer" + }, + finishedAt: { + description: "Time at which the container last terminated", + format: "date-time", + type: "string" + }, + message: { + description: "Message regarding the last termination of the container", + type: "string" + }, + reason: { + description: "(brief) reason from the last termination of the container", + type: "string" + }, + signal: { + description: "Signal from the last termination of the container", + format: "int32", + type: "integer" + }, + startedAt: { + description: "Time at which previous execution of the container started", + format: "date-time", + type: "string" + } + }, + required: ["exitCode"], + type: "object" + }, + waiting: { + description: "Details about a waiting container", + properties: { + message: { + description: "Message regarding why the container is not yet running.", + type: "string" + }, + reason: { + description: "(brief) reason the container is not yet running.", + type: "string" + } + }, + type: "object" + } + }, + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + spanContext: { + additionalProperties: { + type: "string" + }, + description: "SpanContext", + type: "object" + }, + startTime: { + description: "StartTime", + format: "date-time", + type: "string" + }, + steps: { + description: "Steps", + items: { + description: "StepState", + properties: { + container: { + type: "string" + }, + imageID: { + type: "string" + }, + inputs: { + items: { + description: "Artifact", + properties: { + buildOutput: { + description: "BuildOutput", + type: "boolean" + }, + name: { + description: "Name", + type: "string" + }, + values: { + description: "Values", + items: { + description: "ArtifactValue", + properties: { + digest: { + additionalProperties: { + type: "string" + }, + type: "object" + }, + uri: { + type: "string" + } + }, + type: "object" + }, + type: "array" + } + }, + type: "object" + }, + type: "array" + }, + name: { + type: "string" + }, + outputs: { + items: { + description: "Artifact", + properties: { + buildOutput: { + description: "BuildOutput", + type: "boolean" + }, + name: { + description: "Name", + type: "string" + }, + values: { + description: "Values", + items: { + description: "ArtifactValue", + properties: { + digest: { + additionalProperties: { + type: "string" + }, + type: "object" + }, + uri: { + type: "string" + } + }, + type: "object" + }, + type: "array" + } + }, + type: "object" + }, + type: "array" + }, + provenance: { + description: "Provenance", + properties: { + configSource: { + description: "ConfigSource\nDeprecated: Use RefSource instead", + properties: { + digest: { + additionalProperties: { + type: "string" + }, + description: "Digest", + type: "object" + }, + entryPoint: { + description: "EntryPoint", + type: "string" + }, + uri: { + description: "URI", + type: "string" + } + }, + type: "object" + }, + featureFlags: { + description: "FeatureFlags", + properties: { + awaitSidecarReadiness: { + type: "boolean" + }, + coschedule: { + type: "string" + }, + disableCredsInit: { + type: "boolean" + }, + disableInlineSpec: { + type: "string" + }, + enableAPIFields: { + type: "string" + }, + enableArtifacts: { + type: "boolean" + }, + enableCELInWhenExpression: { + type: "boolean" + }, + enableConciseResolverSyntax: { + type: "boolean" + }, + enableKeepPodOnCancel: { + type: "boolean" + }, + enableKubernetesSidecar: { + type: "boolean" + }, + enableParamEnum: { + type: "boolean" + }, + enableProvenanceInStatus: { + type: "boolean" + }, + enableStepActions: { + description: "EnableStepActions is a no-op flag since StepActions are stable", + type: "boolean" + }, + enableTektonOCIBundles: { + description: "DeprecatedEnableTektonOCIBundles is maintained for backward compatibility\nto allow deletion of PipelineRuns created before v0.62.x.\nThis field is not used and can be removed in a future release\nonce we're confident old PipelineRuns have been cleaned up.\nSee issue #8359 for context.", + type: "boolean" + }, + enableTerminationMessageCompression: { + type: "boolean" + }, + enableWaitExponentialBackoff: { + type: "boolean" + }, + enforceNonfalsifiability: { + type: "string" + }, + maxResultSize: { + type: "integer" + }, + requireGitSSHSecretKnownHosts: { + type: "boolean" + }, + resultExtractionMethod: { + type: "string" + }, + runningInEnvWithInjectedSidecars: { + type: "boolean" + }, + sendCloudEventsForRuns: { + type: "boolean" + }, + setSecurityContext: { + type: "boolean" + }, + setSecurityContextReadOnlyRootFilesystem: { + type: "boolean" + }, + verificationNoMatchPolicy: { + description: "VerificationNoMatchPolicy is the feature flag for \"trusted-resources-verification-no-match-policy\"\nVerificationNoMatchPolicy can be set to \"ignore\", \"warn\" and \"fail\" values.\nignore: skip trusted resources verification when no matching verification policies found\nwarn: skip trusted resources verification when no matching verification policies found and log a warning\nfail: fail the taskrun or pipelines run if no matching verification policies found", + type: "string" + } + }, + type: "object" + }, + refSource: { + description: "RefSource", + properties: { + digest: { + additionalProperties: { + type: "string" + }, + description: "Digest", + type: "object" + }, + entryPoint: { + description: "EntryPoint", + type: "string" + }, + uri: { + description: "URI", + type: "string" + } + }, + type: "object" + } + }, + type: "object" + }, + results: { + items: { + description: "TaskRunResult", + properties: { + name: { + description: "Name", + type: "string" + }, + type: { + description: "Type", + type: "string" + }, + value: { + description: "Value", + "x-kubernetes-preserve-unknown-fields": true + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array" + }, + running: { + description: "Details about a running container", + properties: { + startedAt: { + description: "Time at which the container was last (re-)started", + format: "date-time", + type: "string" + } + }, + type: "object" + }, + terminated: { + description: "Details about a terminated container", + properties: { + containerID: { + description: "Container's ID in the format '://'", + type: "string" + }, + exitCode: { + description: "Exit status from the last termination of the container", + format: "int32", + type: "integer" + }, + finishedAt: { + description: "Time at which the container last terminated", + format: "date-time", + type: "string" + }, + message: { + description: "Message regarding the last termination of the container", + type: "string" + }, + reason: { + description: "(brief) reason from the last termination of the container", + type: "string" + }, + signal: { + description: "Signal from the last termination of the container", + format: "int32", + type: "integer" + }, + startedAt: { + description: "Time at which previous execution of the container started", + format: "date-time", + type: "string" + } + }, + required: ["exitCode"], + type: "object" + }, + waiting: { + description: "Details about a waiting container", + properties: { + message: { + description: "Message regarding why the container is not yet running.", + type: "string" + }, + reason: { + description: "(brief) reason the container is not yet running.", + type: "string" + } + }, + type: "object" + } + }, + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + taskResults: { + description: "TaskRunResults", + items: { + description: "TaskRunResult", + properties: { + name: { + description: "Name", + type: "string" + }, + type: { + description: "Type", + type: "string" + }, + value: { + description: "Value", + "x-kubernetes-preserve-unknown-fields": true + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + taskSpec: { + description: "TaskSpec", + "x-kubernetes-preserve-unknown-fields": true + } + }, + required: ["podName"], + type: "object" + } + }, + type: "object" + } + }, + served: true, + storage: false, + subresources: { + status: {} + } + }, { + additionalPrinterColumns: [{ + jsonPath: ".status.conditions[?(@.type==\"Succeeded\")].status", + name: "Succeeded", + type: "string" + }, { + jsonPath: ".status.conditions[?(@.type==\"Succeeded\")].reason", + name: "Reason", + type: "string" + }, { + jsonPath: ".status.startTime", + name: "StartTime", + type: "date" + }, { + jsonPath: ".status.completionTime", + name: "CompletionTime", + type: "date" + }], + name: "v1", + schema: { + openAPIV3Schema: { + description: "TaskRun represents a single execution of a Task. TaskRuns are how the steps\nspecified in a Task are executed; they specify the parameters and resources\nused to run the steps in a Task.", + properties: { + apiVersion: { + description: "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", + type: "string" + }, + kind: { + description: "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + type: "string" + }, + metadata: { + type: "object" + }, + spec: { + description: "TaskRunSpec defines the desired state of TaskRun", + properties: { + computeResources: { + description: "Compute resources to use for this TaskRun", + properties: { + claims: { + description: "Claims lists the names of resources, defined in spec.resourceClaims,\nthat are used by this container.\n\nThis field depends on the\nDynamicResourceAllocation feature gate.\n\nThis field is immutable. It can only be set for containers.", + items: { + description: "ResourceClaim references one entry in PodSpec.ResourceClaims.", + properties: { + name: { + description: "Name must match the name of one entry in pod.spec.resourceClaims of\nthe Pod where this field is used. It makes that resource available\ninside a container.", + type: "string" + }, + request: { + description: "Request is the name chosen for a request in the referenced claim.\nIf empty, everything from the claim is made available, otherwise\nonly the result of this request.", + type: "string" + } + }, + required: ["name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-map-keys": ["name"], + "x-kubernetes-list-type": "map" + }, + limits: { + additionalProperties: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + }, + description: "Limits describes the maximum amount of compute resources allowed.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + type: "object" + }, + requests: { + additionalProperties: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + }, + description: "Requests describes the minimum amount of compute resources required.\nIf Requests is omitted for a container, it defaults to Limits if that is explicitly specified,\notherwise to an implementation-defined value. Requests cannot exceed Limits.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + type: "object" + } + }, + type: "object" + }, + debug: { + description: "TaskRunDebug defines the breakpoint config for a particular TaskRun", + properties: { + breakpoints: { + description: "TaskBreakpoints defines the breakpoint config for a particular Task", + properties: { + beforeSteps: { + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + onFailure: { + description: "if enabled, pause TaskRun on failure of a step\nfailed step will not exit", + type: "string" + } + }, + type: "object" + } + }, + type: "object" + }, + managedBy: { + description: "ManagedBy indicates which controller is responsible for reconciling\nthis resource. If unset or set to \"tekton.dev/pipeline\", the default\nTekton controller will manage this resource.\nThis field is immutable.", + type: "string" + }, + params: { + description: "Params is a list of Param", + items: { + description: "Param declares an ParamValues to use for the parameter called name.", + properties: { + name: { + type: "string" + }, + value: { + "x-kubernetes-preserve-unknown-fields": true + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + podTemplate: { + description: "PodTemplate holds pod specific configuration", + properties: { + affinity: { + description: "If specified, the pod's scheduling constraints.\nSee Pod.spec.affinity (API version: v1)", + "x-kubernetes-preserve-unknown-fields": true + }, + automountServiceAccountToken: { + description: "AutomountServiceAccountToken indicates whether pods running as this\nservice account should have an API token automatically mounted.", + type: "boolean" + }, + dnsConfig: { + description: "Specifies the DNS parameters of a pod.\nParameters specified here will be merged to the generated DNS\nconfiguration based on DNSPolicy.", + properties: { + nameservers: { + description: "A list of DNS name server IP addresses.\nThis will be appended to the base nameservers generated from DNSPolicy.\nDuplicated nameservers will be removed.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + options: { + description: "A list of DNS resolver options.\nThis will be merged with the base options generated from DNSPolicy.\nDuplicated entries will be removed. Resolution options given in Options\nwill override those that appear in the base DNSPolicy.", + items: { + description: "PodDNSConfigOption defines DNS resolver options of a pod.", + properties: { + name: { + description: "Name is this DNS resolver option's name.\nRequired.", + type: "string" + }, + value: { + description: "Value is this DNS resolver option's value.", + type: "string" + } + }, + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + searches: { + description: "A list of DNS search domains for host-name lookup.\nThis will be appended to the base search paths generated from DNSPolicy.\nDuplicated search paths will be removed.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + dnsPolicy: { + description: "Set DNS policy for the pod. Defaults to \"ClusterFirst\". Valid values are\n'ClusterFirst', 'Default' or 'None'. DNS parameters given in DNSConfig\nwill be merged with the policy selected with DNSPolicy.", + type: "string" + }, + enableServiceLinks: { + description: "EnableServiceLinks indicates whether information about services should be injected into pod's\nenvironment variables, matching the syntax of Docker links.\nOptional: Defaults to true.", + type: "boolean" + }, + env: { + description: "List of environment variables that can be provided to the containers belonging to the pod.", + items: { + description: "EnvVar represents an environment variable present in a Container.", + properties: { + name: { + description: "Name of the environment variable.\nMay consist of any printable ASCII characters except '='.", + type: "string" + }, + value: { + description: "Variable references $(VAR_NAME) are expanded\nusing the previously defined environment variables in the container and\nany service environment variables. If a variable cannot be resolved,\nthe reference in the input string will be unchanged. Double $$ are reduced\nto a single $, which allows for escaping the $(VAR_NAME) syntax: i.e.\n\"$$(VAR_NAME)\" will produce the string literal \"$(VAR_NAME)\".\nEscaped references will never be expanded, regardless of whether the variable\nexists or not.\nDefaults to \"\".", + type: "string" + }, + valueFrom: { + description: "Source for the environment variable's value. Cannot be used if value is not empty.", + properties: { + configMapKeyRef: { + description: "Selects a key of a ConfigMap.", + properties: { + key: { + description: "The key to select.", + type: "string" + }, + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "Specify whether the ConfigMap or its key must be defined", + type: "boolean" + } + }, + required: ["key"], + type: "object", + "x-kubernetes-map-type": "atomic" + }, + fieldRef: { + description: "Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`,\nspec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs.", + properties: { + apiVersion: { + description: "Version of the schema the FieldPath is written in terms of, defaults to \"v1\".", + type: "string" + }, + fieldPath: { + description: "Path of the field to select in the specified API version.", + type: "string" + } + }, + required: ["fieldPath"], + type: "object", + "x-kubernetes-map-type": "atomic" + }, + fileKeyRef: { + description: "FileKeyRef selects a key of the env file.\nRequires the EnvFiles feature gate to be enabled.", + properties: { + key: { + description: "The key within the env file. An invalid key will prevent the pod from starting.\nThe keys defined within a source may consist of any printable ASCII characters except '='.\nDuring Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.", + type: "string" + }, + optional: { + default: false, + description: "Specify whether the file or its key must be defined. If the file or key\ndoes not exist, then the env var is not published.\nIf optional is set to true and the specified key does not exist,\nthe environment variable will not be set in the Pod's containers.\n\nIf optional is set to false and the specified key does not exist,\nan error will be returned during Pod creation.", + type: "boolean" + }, + path: { + description: "The path within the volume from which to select the file.\nMust be relative and may not contain the '..' path or start with '..'.", + type: "string" + }, + volumeName: { + description: "The name of the volume mount containing the env file.", + type: "string" + } + }, + required: ["key", "path", "volumeName"], + type: "object", + "x-kubernetes-map-type": "atomic" + }, + resourceFieldRef: { + description: "Selects a resource of the container: only resources limits and requests\n(limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported.", + properties: { + containerName: { + description: "Container name: required for volumes, optional for env vars", + type: "string" + }, + divisor: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Specifies the output format of the exposed resources, defaults to \"1\"", + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + }, + resource: { + description: "Required: resource to select", + type: "string" + } + }, + required: ["resource"], + type: "object", + "x-kubernetes-map-type": "atomic" + }, + secretKeyRef: { + description: "Selects a key of a secret in the pod's namespace", + properties: { + key: { + description: "The key of the secret to select from. Must be a valid secret key.", + type: "string" + }, + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "Specify whether the Secret or its key must be defined", + type: "boolean" + } + }, + required: ["key"], + type: "object", + "x-kubernetes-map-type": "atomic" + } + }, + type: "object" + } + }, + required: ["name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + hostAliases: { + description: "HostAliases is an optional list of hosts and IPs that will be injected into the pod's hosts\nfile if specified. This is only valid for non-hostNetwork pods.", + items: { + description: "HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the\npod's hosts file.", + properties: { + hostnames: { + description: "Hostnames for the above IP address.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + ip: { + description: "IP address of the host file entry.", + type: "string" + } + }, + required: ["ip"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + hostNetwork: { + description: "HostNetwork specifies whether the pod may use the node network namespace", + type: "boolean" + }, + hostUsers: { + description: "HostUsers indicates whether the pod will use the host's user namespace.\nOptional: Default to true.\nIf set to true or not present, the pod will be run in the host user namespace, useful\nfor when the pod needs a feature only available to the host user namespace, such as\nloading a kernel module with CAP_SYS_MODULE.\nWhen set to false, a new user namespace is created for the pod. Setting false\nis useful to mitigating container breakout vulnerabilities such as allowing\ncontainers to run as root without their user having root privileges on the host.\nThis field depends on the kubernetes feature gate UserNamespacesSupport being enabled.", + type: "boolean" + }, + imagePullSecrets: { + description: "ImagePullSecrets gives the name of the secret used by the pod to pull the image if specified", + items: { + description: "LocalObjectReference contains enough information to let you locate the\nreferenced object inside the same namespace.", + properties: { + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + nodeSelector: { + additionalProperties: { + type: "string" + }, + description: "NodeSelector is a selector which must be true for the pod to fit on a node.\nSelector which must match a node's labels for the pod to be scheduled on that node.\nMore info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/", + type: "object" + }, + priorityClassName: { + description: "If specified, indicates the pod's priority. \"system-node-critical\" and\n\"system-cluster-critical\" are two special keywords which indicate the\nhighest priorities with the former being the highest priority. Any other\nname must be defined by creating a PriorityClass object with that name.\nIf not specified, the pod priority will be default or zero if there is no\ndefault.", + type: "string" + }, + runtimeClassName: { + description: "RuntimeClassName refers to a RuntimeClass object in the node.k8s.io\ngroup, which should be used to run this pod. If no RuntimeClass resource\nmatches the named class, the pod will not be run. If unset or empty, the\n\"legacy\" RuntimeClass will be used, which is an implicit class with an\nempty definition that uses the default runtime handler.\nMore info: https://git.k8s.io/enhancements/keps/sig-node/runtime-class.md\nThis is a beta feature as of Kubernetes v1.14.", + type: "string" + }, + schedulerName: { + description: "SchedulerName specifies the scheduler to be used to dispatch the Pod", + type: "string" + }, + securityContext: { + description: "SecurityContext holds pod-level security attributes and common container settings.\nOptional: Defaults to empty. See type description for default values of each field.\nSee Pod.spec.securityContext (API version: v1)", + "x-kubernetes-preserve-unknown-fields": true + }, + tolerations: { + description: "If specified, the pod's tolerations.", + items: { + description: "The pod this Toleration is attached to tolerates any taint that matches\nthe triple using the matching operator .", + properties: { + effect: { + description: "Effect indicates the taint effect to match. Empty means match all taint effects.\nWhen specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.", + type: "string" + }, + key: { + description: "Key is the taint key that the toleration applies to. Empty means match all taint keys.\nIf the key is empty, operator must be Exists; this combination means to match all values and all keys.", + type: "string" + }, + operator: { + description: "Operator represents a key's relationship to the value.\nValid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.\nExists is equivalent to wildcard for value, so that a pod can\ntolerate all taints of a particular category.\nLt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).", + type: "string" + }, + tolerationSeconds: { + description: "TolerationSeconds represents the period of time the toleration (which must be\nof effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,\nit is not set, which means tolerate the taint forever (do not evict). Zero and\nnegative values will be treated as 0 (evict immediately) by the system.", + format: "int64", + type: "integer" + }, + value: { + description: "Value is the taint value the toleration matches to.\nIf the operator is Exists, the value should be empty, otherwise just a regular string.", + type: "string" + } + }, + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + topologySpreadConstraints: { + description: "TopologySpreadConstraints controls how Pods are spread across your cluster among\nfailure-domains such as regions, zones, nodes, and other user-defined topology domains.", + items: { + description: "TopologySpreadConstraint specifies how to spread matching pods among the given topology.", + properties: { + labelSelector: { + description: "LabelSelector is used to find matching pods.\nPods that match this label selector are counted to determine the number of pods\nin their corresponding topology domain.", + properties: { + matchExpressions: { + description: "matchExpressions is a list of label selector requirements. The requirements are ANDed.", + items: { + description: "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", + properties: { + key: { + description: "key is the label key that the selector applies to.", + type: "string" + }, + operator: { + description: "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", + type: "string" + }, + values: { + description: "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + required: ["key", "operator"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + matchLabels: { + additionalProperties: { + type: "string" + }, + description: "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", + type: "object" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + matchLabelKeys: { + description: "MatchLabelKeys is a set of pod label keys to select the pods over which\nspreading will be calculated. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are ANDed with labelSelector\nto select the group of existing pods over which spreading will be calculated\nfor the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector.\nMatchLabelKeys cannot be set when LabelSelector isn't set.\nKeys that don't exist in the incoming pod labels will\nbe ignored. A null or empty list means only match against labelSelector.\n\nThis is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default).", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + maxSkew: { + description: "MaxSkew describes the degree to which pods may be unevenly distributed.\nWhen `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference\nbetween the number of matching pods in the target topology and the global minimum.\nThe global minimum is the minimum number of matching pods in an eligible domain\nor zero if the number of eligible domains is less than MinDomains.\nFor example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same\nlabelSelector spread as 2/2/1:\nIn this case, the global minimum is 1.\n| zone1 | zone2 | zone3 |\n| P P | P P | P |\n- if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2;\nscheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2)\nviolate MaxSkew(1).\n- if MaxSkew is 2, incoming pod can be scheduled onto any zone.\nWhen `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence\nto topologies that satisfy it.\nIt's a required field. Default value is 1 and 0 is not allowed.", + format: "int32", + type: "integer" + }, + minDomains: { + description: "MinDomains indicates a minimum number of eligible domains.\nWhen the number of eligible domains with matching topology keys is less than minDomains,\nPod Topology Spread treats \"global minimum\" as 0, and then the calculation of Skew is performed.\nAnd when the number of eligible domains with matching topology keys equals or greater than minDomains,\nthis value has no effect on scheduling.\nAs a result, when the number of eligible domains is less than minDomains,\nscheduler won't schedule more than maxSkew Pods to those domains.\nIf value is nil, the constraint behaves as if MinDomains is equal to 1.\nValid values are integers greater than 0.\nWhen value is not nil, WhenUnsatisfiable must be DoNotSchedule.\n\nFor example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same\nlabelSelector spread as 2/2/2:\n| zone1 | zone2 | zone3 |\n| P P | P P | P P |\nThe number of domains is less than 5(MinDomains), so \"global minimum\" is treated as 0.\nIn this situation, new pod with the same labelSelector cannot be scheduled,\nbecause computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones,\nit will violate MaxSkew.", + format: "int32", + type: "integer" + }, + nodeAffinityPolicy: { + description: "NodeAffinityPolicy indicates how we will treat Pod's nodeAffinity/nodeSelector\nwhen calculating pod topology spread skew. Options are:\n- Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations.\n- Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations.\n\nIf this value is nil, the behavior is equivalent to the Honor policy.", + type: "string" + }, + nodeTaintsPolicy: { + description: "NodeTaintsPolicy indicates how we will treat node taints when calculating\npod topology spread skew. Options are:\n- Honor: nodes without taints, along with tainted nodes for which the incoming pod\nhas a toleration, are included.\n- Ignore: node taints are ignored. All nodes are included.\n\nIf this value is nil, the behavior is equivalent to the Ignore policy.", + type: "string" + }, + topologyKey: { + description: "TopologyKey is the key of node labels. Nodes that have a label with this key\nand identical values are considered to be in the same topology.\nWe consider each as a \"bucket\", and try to put balanced number\nof pods into each bucket.\nWe define a domain as a particular instance of a topology.\nAlso, we define an eligible domain as a domain whose nodes meet the requirements of\nnodeAffinityPolicy and nodeTaintsPolicy.\ne.g. If TopologyKey is \"kubernetes.io/hostname\", each Node is a domain of that topology.\nAnd, if TopologyKey is \"topology.kubernetes.io/zone\", each zone is a domain of that topology.\nIt's a required field.", + type: "string" + }, + whenUnsatisfiable: { + description: "WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy\nthe spread constraint.\n- DoNotSchedule (default) tells the scheduler not to schedule it.\n- ScheduleAnyway tells the scheduler to schedule the pod in any location,\n but giving higher precedence to topologies that would help reduce the\n skew.\nA constraint is considered \"Unsatisfiable\" for an incoming pod\nif and only if every possible node assignment for that pod would violate\n\"MaxSkew\" on some topology.\nFor example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same\nlabelSelector spread as 3/1/1:\n| zone1 | zone2 | zone3 |\n| P P P | P | P |\nIf WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled\nto zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies\nMaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler\nwon't make it *more* imbalanced.\nIt's a required field.", + type: "string" + } + }, + required: ["maxSkew", "topologyKey", "whenUnsatisfiable"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + volumes: { + description: "List of volumes that can be mounted by containers belonging to the pod.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes\nSee Pod.spec.volumes (API version: v1)", + "x-kubernetes-preserve-unknown-fields": true + } + }, + type: "object" + }, + retries: { + description: "Retries represents how many times this TaskRun should be retried in the event of task failure.", + type: "integer" + }, + serviceAccountName: { + type: "string" + }, + sidecarSpecs: { + description: "Specs to apply to Sidecars in this TaskRun.\nIf a field is specified in both a Sidecar and a SidecarSpec,\nthe value from the SidecarSpec will be used.\nThis field is only supported when the alpha feature gate is enabled.", + items: { + description: "TaskRunSidecarSpec is used to override the values of a Sidecar in the corresponding Task.", + properties: { + computeResources: { + description: "The resource requirements to apply to the Sidecar.", + properties: { + claims: { + description: "Claims lists the names of resources, defined in spec.resourceClaims,\nthat are used by this container.\n\nThis field depends on the\nDynamicResourceAllocation feature gate.\n\nThis field is immutable. It can only be set for containers.", + items: { + description: "ResourceClaim references one entry in PodSpec.ResourceClaims.", + properties: { + name: { + description: "Name must match the name of one entry in pod.spec.resourceClaims of\nthe Pod where this field is used. It makes that resource available\ninside a container.", + type: "string" + }, + request: { + description: "Request is the name chosen for a request in the referenced claim.\nIf empty, everything from the claim is made available, otherwise\nonly the result of this request.", + type: "string" + } + }, + required: ["name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-map-keys": ["name"], + "x-kubernetes-list-type": "map" + }, + limits: { + additionalProperties: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + }, + description: "Limits describes the maximum amount of compute resources allowed.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + type: "object" + }, + requests: { + additionalProperties: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + }, + description: "Requests describes the minimum amount of compute resources required.\nIf Requests is omitted for a container, it defaults to Limits if that is explicitly specified,\notherwise to an implementation-defined value. Requests cannot exceed Limits.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + type: "object" + } + }, + type: "object" + }, + name: { + description: "The name of the Sidecar to override.", + type: "string" + } + }, + required: ["computeResources", "name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + status: { + description: "Used for cancelling a TaskRun (and maybe more later on)", + type: "string" + }, + statusMessage: { + description: "Status message for cancellation.", + type: "string" + }, + stepSpecs: { + description: "Specs to apply to Steps in this TaskRun.\nIf a field is specified in both a Step and a StepSpec,\nthe value from the StepSpec will be used.\nThis field is only supported when the alpha feature gate is enabled.", + items: { + description: "TaskRunStepSpec is used to override the values of a Step in the corresponding Task.", + properties: { + computeResources: { + description: "The resource requirements to apply to the Step.", + properties: { + claims: { + description: "Claims lists the names of resources, defined in spec.resourceClaims,\nthat are used by this container.\n\nThis field depends on the\nDynamicResourceAllocation feature gate.\n\nThis field is immutable. It can only be set for containers.", + items: { + description: "ResourceClaim references one entry in PodSpec.ResourceClaims.", + properties: { + name: { + description: "Name must match the name of one entry in pod.spec.resourceClaims of\nthe Pod where this field is used. It makes that resource available\ninside a container.", + type: "string" + }, + request: { + description: "Request is the name chosen for a request in the referenced claim.\nIf empty, everything from the claim is made available, otherwise\nonly the result of this request.", + type: "string" + } + }, + required: ["name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-map-keys": ["name"], + "x-kubernetes-list-type": "map" + }, + limits: { + additionalProperties: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + }, + description: "Limits describes the maximum amount of compute resources allowed.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + type: "object" + }, + requests: { + additionalProperties: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + }, + description: "Requests describes the minimum amount of compute resources required.\nIf Requests is omitted for a container, it defaults to Limits if that is explicitly specified,\notherwise to an implementation-defined value. Requests cannot exceed Limits.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + type: "object" + } + }, + type: "object" + }, + name: { + description: "The name of the Step to override.", + type: "string" + } + }, + required: ["computeResources", "name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + taskRef: { + description: "no more than one of the TaskRef and TaskSpec may be specified.", + properties: { + apiVersion: { + description: "API version of the referent\nNote: A Task with non-empty APIVersion and Kind is considered a Custom Task", + type: "string" + }, + kind: { + description: "TaskKind indicates the Kind of the Task:\n1. Namespaced Task when Kind is set to \"Task\". If Kind is \"\", it defaults to \"Task\".\n2. Custom Task when Kind is non-empty and APIVersion is non-empty", + type: "string" + }, + name: { + description: "Name of the referent; More info: http://kubernetes.io/docs/user-guide/identifiers#names", + type: "string" + }, + params: { + description: "Params contains the parameters used to identify the\nreferenced Tekton resource. Example entries might include\n\"repo\" or \"path\" but the set of params ultimately depends on\nthe chosen resolver.", + items: { + description: "Param declares an ParamValues to use for the parameter called name.", + properties: { + name: { + type: "string" + }, + value: { + "x-kubernetes-preserve-unknown-fields": true + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + resolver: { + description: "Resolver is the name of the resolver that should perform\nresolution of the referenced Tekton resource, such as \"git\".", + type: "string" + } + }, + type: "object" + }, + taskSpec: { + description: "Specifying TaskSpec can be disabled by setting\n`disable-inline-spec` feature flag.\nSee Task.spec (API version: tekton.dev/v1)", + "x-kubernetes-preserve-unknown-fields": true + }, + timeout: { + description: "Time after which one retry attempt times out. Defaults to 1 hour.\nRefer Go's ParseDuration documentation for expected format: https://golang.org/pkg/time/#ParseDuration", + type: "string" + }, + workspaces: { + description: "Workspaces is a list of WorkspaceBindings from volumes to workspaces.", + items: { + description: "WorkspaceBinding maps a Task's declared workspace to a Volume.", + properties: { + configMap: { + description: "ConfigMap represents a configMap that should populate this workspace.", + properties: { + defaultMode: { + description: "defaultMode is optional: mode bits used to set permissions on created files by default.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nDefaults to 0644.\nDirectories within the path are not affected by this setting.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", + format: "int32", + type: "integer" + }, + items: { + description: "items if unspecified, each key-value pair in the Data field of the referenced\nConfigMap will be projected into the volume as a file whose name is the\nkey and content is the value. If specified, the listed keys will be\nprojected into the specified paths, and unlisted keys will not be\npresent. If a key is specified which is not present in the ConfigMap,\nthe volume setup will error unless it is marked optional. Paths must be\nrelative and may not contain the '..' path or start with '..'.", + items: { + description: "Maps a string key to a path within a volume.", + properties: { + key: { + description: "key is the key to project.", + type: "string" + }, + mode: { + description: "mode is Optional: mode bits used to set permissions on this file.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nIf not specified, the volume defaultMode will be used.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", + format: "int32", + type: "integer" + }, + path: { + description: "path is the relative path of the file to map the key to.\nMay not be an absolute path.\nMay not contain the path element '..'.\nMay not start with the string '..'.", + type: "string" + } + }, + required: ["key", "path"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "optional specify whether the ConfigMap or its keys must be defined", + type: "boolean" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + csi: { + description: "CSI (Container Storage Interface) represents ephemeral storage that is handled by certain external CSI drivers.", + properties: { + driver: { + description: "driver is the name of the CSI driver that handles this volume.\nConsult with your admin for the correct name as registered in the cluster.", + type: "string" + }, + fsType: { + description: "fsType to mount. Ex. \"ext4\", \"xfs\", \"ntfs\".\nIf not provided, the empty value is passed to the associated CSI driver\nwhich will determine the default filesystem to apply.", + type: "string" + }, + nodePublishSecretRef: { + description: "nodePublishSecretRef is a reference to the secret object containing\nsensitive information to pass to the CSI driver to complete the CSI\nNodePublishVolume and NodeUnpublishVolume calls.\nThis field is optional, and may be empty if no secret is required. If the\nsecret object contains more than one secret, all secret references are passed.", + properties: { + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + readOnly: { + description: "readOnly specifies a read-only configuration for the volume.\nDefaults to false (read/write).", + type: "boolean" + }, + volumeAttributes: { + additionalProperties: { + type: "string" + }, + description: "volumeAttributes stores driver-specific properties that are passed to the CSI\ndriver. Consult your driver's documentation for supported values.", + type: "object" + } + }, + required: ["driver"], + type: "object" + }, + emptyDir: { + description: "EmptyDir represents a temporary directory that shares a Task's lifetime.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir\nEither this OR PersistentVolumeClaim can be used.", + properties: { + medium: { + description: "medium represents what type of storage medium should back this directory.\nThe default is \"\" which means to use the node's default medium.\nMust be an empty string (default) or Memory.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir", + type: "string" + }, + sizeLimit: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "sizeLimit is the total amount of local storage required for this EmptyDir volume.\nThe size limit is also applicable for memory medium.\nThe maximum usage on memory medium EmptyDir would be the minimum value between\nthe SizeLimit specified here and the sum of memory limits of all containers in a pod.\nThe default is nil which means that the limit is undefined.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir", + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + } + }, + type: "object" + }, + name: { + description: "Name is the name of the workspace populated by the volume.", + type: "string" + }, + persistentVolumeClaim: { + description: "PersistentVolumeClaimVolumeSource represents a reference to a\nPersistentVolumeClaim in the same namespace. Either this OR EmptyDir can be used.", + properties: { + claimName: { + description: "claimName is the name of a PersistentVolumeClaim in the same namespace as the pod using this volume.\nMore info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims", + type: "string" + }, + readOnly: { + description: "readOnly Will force the ReadOnly setting in VolumeMounts.\nDefault false.", + type: "boolean" + } + }, + required: ["claimName"], + type: "object" + }, + projected: { + description: "Projected represents a projected volume that should populate this workspace.", + properties: { + defaultMode: { + description: "defaultMode are the mode bits used to set permissions on created files by default.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nDirectories within the path are not affected by this setting.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", + format: "int32", + type: "integer" + }, + sources: { + description: "sources is the list of volume projections. Each entry in this list\nhandles one source.", + items: { + description: "Projection that may be projected along with other supported volume types.\nExactly one of these fields must be set.", + properties: { + clusterTrustBundle: { + description: "ClusterTrustBundle allows a pod to access the `.spec.trustBundle` field\nof ClusterTrustBundle objects in an auto-updating file.\n\nAlpha, gated by the ClusterTrustBundleProjection feature gate.\n\nClusterTrustBundle objects can either be selected by name, or by the\ncombination of signer name and a label selector.\n\nKubelet performs aggressive normalization of the PEM contents written\ninto the pod filesystem. Esoteric PEM features such as inter-block\ncomments and block headers are stripped. Certificates are deduplicated.\nThe ordering of certificates within the file is arbitrary, and Kubelet\nmay change the order over time.", + properties: { + labelSelector: { + description: "Select all ClusterTrustBundles that match this label selector. Only has\neffect if signerName is set. Mutually-exclusive with name. If unset,\ninterpreted as \"match nothing\". If set but empty, interpreted as \"match\neverything\".", + properties: { + matchExpressions: { + description: "matchExpressions is a list of label selector requirements. The requirements are ANDed.", + items: { + description: "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", + properties: { + key: { + description: "key is the label key that the selector applies to.", + type: "string" + }, + operator: { + description: "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", + type: "string" + }, + values: { + description: "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + required: ["key", "operator"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + matchLabels: { + additionalProperties: { + type: "string" + }, + description: "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", + type: "object" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + name: { + description: "Select a single ClusterTrustBundle by object name. Mutually-exclusive\nwith signerName and labelSelector.", + type: "string" + }, + optional: { + description: "If true, don't block pod startup if the referenced ClusterTrustBundle(s)\naren't available. If using name, then the named ClusterTrustBundle is\nallowed not to exist. If using signerName, then the combination of\nsignerName and labelSelector is allowed to match zero\nClusterTrustBundles.", + type: "boolean" + }, + path: { + description: "Relative path from the volume root to write the bundle.", + type: "string" + }, + signerName: { + description: "Select all ClusterTrustBundles that match this signer name.\nMutually-exclusive with name. The contents of all selected\nClusterTrustBundles will be unified and deduplicated.", + type: "string" + } + }, + required: ["path"], + type: "object" + }, + configMap: { + description: "configMap information about the configMap data to project", + properties: { + items: { + description: "items if unspecified, each key-value pair in the Data field of the referenced\nConfigMap will be projected into the volume as a file whose name is the\nkey and content is the value. If specified, the listed keys will be\nprojected into the specified paths, and unlisted keys will not be\npresent. If a key is specified which is not present in the ConfigMap,\nthe volume setup will error unless it is marked optional. Paths must be\nrelative and may not contain the '..' path or start with '..'.", + items: { + description: "Maps a string key to a path within a volume.", + properties: { + key: { + description: "key is the key to project.", + type: "string" + }, + mode: { + description: "mode is Optional: mode bits used to set permissions on this file.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nIf not specified, the volume defaultMode will be used.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", + format: "int32", + type: "integer" + }, + path: { + description: "path is the relative path of the file to map the key to.\nMay not be an absolute path.\nMay not contain the path element '..'.\nMay not start with the string '..'.", + type: "string" + } + }, + required: ["key", "path"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "optional specify whether the ConfigMap or its keys must be defined", + type: "boolean" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + downwardAPI: { + description: "downwardAPI information about the downwardAPI data to project", + properties: { + items: { + description: "Items is a list of DownwardAPIVolume file", + items: { + description: "DownwardAPIVolumeFile represents information to create the file containing the pod field", + properties: { + fieldRef: { + description: "Required: Selects a field of the pod: only annotations, labels, name, namespace and uid are supported.", + properties: { + apiVersion: { + description: "Version of the schema the FieldPath is written in terms of, defaults to \"v1\".", + type: "string" + }, + fieldPath: { + description: "Path of the field to select in the specified API version.", + type: "string" + } + }, + required: ["fieldPath"], + type: "object", + "x-kubernetes-map-type": "atomic" + }, + mode: { + description: "Optional: mode bits used to set permissions on this file, must be an octal value\nbetween 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nIf not specified, the volume defaultMode will be used.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", + format: "int32", + type: "integer" + }, + path: { + description: "Required: Path is the relative path name of the file to be created. Must not be absolute or contain the '..' path. Must be utf-8 encoded. The first item of the relative path must not start with '..'", + type: "string" + }, + resourceFieldRef: { + description: "Selects a resource of the container: only resources limits and requests\n(limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported.", + properties: { + containerName: { + description: "Container name: required for volumes, optional for env vars", + type: "string" + }, + divisor: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Specifies the output format of the exposed resources, defaults to \"1\"", + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + }, + resource: { + description: "Required: resource to select", + type: "string" + } + }, + required: ["resource"], + type: "object", + "x-kubernetes-map-type": "atomic" + } + }, + required: ["path"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + podCertificate: { + description: "Projects an auto-rotating credential bundle (private key and certificate\nchain) that the pod can use either as a TLS client or server.\n\nKubelet generates a private key and uses it to send a\nPodCertificateRequest to the named signer. Once the signer approves the\nrequest and issues a certificate chain, Kubelet writes the key and\ncertificate chain to the pod filesystem. The pod does not start until\ncertificates have been issued for each podCertificate projected volume\nsource in its spec.\n\nKubelet will begin trying to rotate the certificate at the time indicated\nby the signer using the PodCertificateRequest.Status.BeginRefreshAt\ntimestamp.\n\nKubelet can write a single file, indicated by the credentialBundlePath\nfield, or separate files, indicated by the keyPath and\ncertificateChainPath fields.\n\nThe credential bundle is a single file in PEM format. The first PEM\nentry is the private key (in PKCS#8 format), and the remaining PEM\nentries are the certificate chain issued by the signer (typically,\nsigners will return their certificate chain in leaf-to-root order).\n\nPrefer using the credential bundle format, since your application code\ncan read it atomically. If you use keyPath and certificateChainPath,\nyour application must make two separate file reads. If these coincide\nwith a certificate rotation, it is possible that the private key and leaf\ncertificate you read may not correspond to each other. Your application\nwill need to check for this condition, and re-read until they are\nconsistent.\n\nThe named signer controls chooses the format of the certificate it\nissues; consult the signer implementation's documentation to learn how to\nuse the certificates it issues.", + properties: { + certificateChainPath: { + description: "Write the certificate chain at this path in the projected volume.\n\nMost applications should use credentialBundlePath. When using keyPath\nand certificateChainPath, your application needs to check that the key\nand leaf certificate are consistent, because it is possible to read the\nfiles mid-rotation.", + type: "string" + }, + credentialBundlePath: { + description: "Write the credential bundle at this path in the projected volume.\n\nThe credential bundle is a single file that contains multiple PEM blocks.\nThe first PEM block is a PRIVATE KEY block, containing a PKCS#8 private\nkey.\n\nThe remaining blocks are CERTIFICATE blocks, containing the issued\ncertificate chain from the signer (leaf and any intermediates).\n\nUsing credentialBundlePath lets your Pod's application code make a single\natomic read that retrieves a consistent key and certificate chain. If you\nproject them to separate files, your application code will need to\nadditionally check that the leaf certificate was issued to the key.", + type: "string" + }, + keyPath: { + description: "Write the key at this path in the projected volume.\n\nMost applications should use credentialBundlePath. When using keyPath\nand certificateChainPath, your application needs to check that the key\nand leaf certificate are consistent, because it is possible to read the\nfiles mid-rotation.", + type: "string" + }, + keyType: { + description: "The type of keypair Kubelet will generate for the pod.\n\nValid values are \"RSA3072\", \"RSA4096\", \"ECDSAP256\", \"ECDSAP384\",\n\"ECDSAP521\", and \"ED25519\".", + type: "string" + }, + maxExpirationSeconds: { + description: "maxExpirationSeconds is the maximum lifetime permitted for the\ncertificate.\n\nKubelet copies this value verbatim into the PodCertificateRequests it\ngenerates for this projection.\n\nIf omitted, kube-apiserver will set it to 86400(24 hours). kube-apiserver\nwill reject values shorter than 3600 (1 hour). The maximum allowable\nvalue is 7862400 (91 days).\n\nThe signer implementation is then free to issue a certificate with any\nlifetime *shorter* than MaxExpirationSeconds, but no shorter than 3600\nseconds (1 hour). This constraint is enforced by kube-apiserver.\n`kubernetes.io` signers will never issue certificates with a lifetime\nlonger than 24 hours.", + format: "int32", + type: "integer" + }, + signerName: { + description: "Kubelet's generated CSRs will be addressed to this signer.", + type: "string" + }, + userAnnotations: { + additionalProperties: { + type: "string" + }, + description: "userAnnotations allow pod authors to pass additional information to\nthe signer implementation. Kubernetes does not restrict or validate this\nmetadata in any way.\n\nThese values are copied verbatim into the `spec.unverifiedUserAnnotations` field of\nthe PodCertificateRequest objects that Kubelet creates.\n\nEntries are subject to the same validation as object metadata annotations,\nwith the addition that all keys must be domain-prefixed. No restrictions\nare placed on values, except an overall size limitation on the entire field.\n\nSigners should document the keys and values they support. Signers should\ndeny requests that contain keys they do not recognize.", + type: "object" + } + }, + required: ["keyType", "signerName"], + type: "object" + }, + secret: { + description: "secret information about the secret data to project", + properties: { + items: { + description: "items if unspecified, each key-value pair in the Data field of the referenced\nSecret will be projected into the volume as a file whose name is the\nkey and content is the value. If specified, the listed keys will be\nprojected into the specified paths, and unlisted keys will not be\npresent. If a key is specified which is not present in the Secret,\nthe volume setup will error unless it is marked optional. Paths must be\nrelative and may not contain the '..' path or start with '..'.", + items: { + description: "Maps a string key to a path within a volume.", + properties: { + key: { + description: "key is the key to project.", + type: "string" + }, + mode: { + description: "mode is Optional: mode bits used to set permissions on this file.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nIf not specified, the volume defaultMode will be used.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", + format: "int32", + type: "integer" + }, + path: { + description: "path is the relative path of the file to map the key to.\nMay not be an absolute path.\nMay not contain the path element '..'.\nMay not start with the string '..'.", + type: "string" + } + }, + required: ["key", "path"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "optional field specify whether the Secret or its key must be defined", + type: "boolean" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + serviceAccountToken: { + description: "serviceAccountToken is information about the serviceAccountToken data to project", + properties: { + audience: { + description: "audience is the intended audience of the token. A recipient of a token\nmust identify itself with an identifier specified in the audience of the\ntoken, and otherwise should reject the token. The audience defaults to the\nidentifier of the apiserver.", + type: "string" + }, + expirationSeconds: { + description: "expirationSeconds is the requested duration of validity of the service\naccount token. As the token approaches expiration, the kubelet volume\nplugin will proactively rotate the service account token. The kubelet will\nstart trying to rotate the token if the token is older than 80 percent of\nits time to live or if the token is older than 24 hours.Defaults to 1 hour\nand must be at least 10 minutes.", + format: "int64", + type: "integer" + }, + path: { + description: "path is the path relative to the mount point of the file to project the\ntoken into.", + type: "string" + } + }, + required: ["path"], + type: "object" + } + }, + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + secret: { + description: "Secret represents a secret that should populate this workspace.", + properties: { + defaultMode: { + description: "defaultMode is Optional: mode bits used to set permissions on created files by default.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values\nfor mode bits. Defaults to 0644.\nDirectories within the path are not affected by this setting.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", + format: "int32", + type: "integer" + }, + items: { + description: "items If unspecified, each key-value pair in the Data field of the referenced\nSecret will be projected into the volume as a file whose name is the\nkey and content is the value. If specified, the listed keys will be\nprojected into the specified paths, and unlisted keys will not be\npresent. If a key is specified which is not present in the Secret,\nthe volume setup will error unless it is marked optional. Paths must be\nrelative and may not contain the '..' path or start with '..'.", + items: { + description: "Maps a string key to a path within a volume.", + properties: { + key: { + description: "key is the key to project.", + type: "string" + }, + mode: { + description: "mode is Optional: mode bits used to set permissions on this file.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nIf not specified, the volume defaultMode will be used.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", + format: "int32", + type: "integer" + }, + path: { + description: "path is the relative path of the file to map the key to.\nMay not be an absolute path.\nMay not contain the path element '..'.\nMay not start with the string '..'.", + type: "string" + } + }, + required: ["key", "path"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + optional: { + description: "optional field specify whether the Secret or its keys must be defined", + type: "boolean" + }, + secretName: { + description: "secretName is the name of the secret in the pod's namespace to use.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#secret", + type: "string" + } + }, + type: "object" + }, + subPath: { + description: "SubPath is optionally a directory on the volume which should be used\nfor this binding (i.e. the volume will be mounted at this sub directory).", + type: "string" + }, + volumeClaimTemplate: { + description: "VolumeClaimTemplate is a template for a claim that will be created in the same namespace.\nThe PipelineRun controller is responsible for creating a unique claim for each instance of PipelineRun.\nSee PersistentVolumeClaim (API version: v1)", + "x-kubernetes-preserve-unknown-fields": true + } + }, + required: ["name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + status: { + description: "TaskRunStatus defines the observed state of TaskRun", + properties: { + annotations: { + additionalProperties: { + type: "string" + }, + description: "Annotations is additional Status fields for the Resource to save some\nadditional State as well as convey more information to the user. This is\nroughly akin to Annotations on any k8s resource, just the reconciler conveying\nricher information outwards.", + type: "object" + }, + artifacts: { + description: "Artifacts are the list of artifacts written out by the task's containers", + properties: { + inputs: { + items: { + description: "Artifact represents an artifact within a system, potentially containing multiple values\nassociated with it.", + properties: { + buildOutput: { + description: "Indicate if the artifact is a build output or a by-product", + type: "boolean" + }, + name: { + description: "The artifact's identifying category name", + type: "string" + }, + values: { + description: "A collection of values related to the artifact", + items: { + description: "ArtifactValue represents a specific value or data element within an Artifact.", + properties: { + digest: { + additionalProperties: { + type: "string" + }, + type: "object" + }, + uri: { + type: "string" + } + }, + type: "object" + }, + type: "array" + } + }, + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + outputs: { + items: { + description: "Artifact represents an artifact within a system, potentially containing multiple values\nassociated with it.", + properties: { + buildOutput: { + description: "Indicate if the artifact is a build output or a by-product", + type: "boolean" + }, + name: { + description: "The artifact's identifying category name", + type: "string" + }, + values: { + description: "A collection of values related to the artifact", + items: { + description: "ArtifactValue represents a specific value or data element within an Artifact.", + properties: { + digest: { + additionalProperties: { + type: "string" + }, + type: "object" + }, + uri: { + type: "string" + } + }, + type: "object" + }, + type: "array" + } + }, + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + completionTime: { + description: "CompletionTime is the time the build completed.", + format: "date-time", + type: "string" + }, + conditions: { + description: "Conditions the latest available observations of a resource's current state.", + items: { + description: "Condition defines a readiness condition for a Knative resource.\nSee: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties", + properties: { + lastTransitionTime: { + description: "LastTransitionTime is the last time the condition transitioned from one status to another.\nWe use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic\ndifferences (all other things held constant).", + type: "string" + }, + message: { + description: "A human readable message indicating details about the transition.", + type: "string" + }, + reason: { + description: "The reason for the condition's last transition.", + type: "string" + }, + severity: { + description: "Severity with which to treat failures of this type of condition.\nWhen this is not specified, it defaults to Error.", + type: "string" + }, + status: { + description: "Status of the condition, one of True, False, Unknown.", + type: "string" + }, + type: { + description: "Type of condition.", + type: "string" + } + }, + required: ["status", "type"], + type: "object" + }, + type: "array" + }, + observedGeneration: { + description: "ObservedGeneration is the 'Generation' of the Service that\nwas last processed by the controller.", + format: "int64", + type: "integer" + }, + podName: { + description: "PodName is the name of the pod responsible for executing this task's steps.", + type: "string" + }, + provenance: { + description: "Provenance contains some key authenticated metadata about how a software artifact was built (what sources, what inputs/outputs, etc.).", + properties: { + featureFlags: { + description: "FeatureFlags identifies the feature flags that were used during the task/pipeline run", + properties: { + awaitSidecarReadiness: { + type: "boolean" + }, + coschedule: { + type: "string" + }, + disableCredsInit: { + type: "boolean" + }, + disableInlineSpec: { + type: "string" + }, + enableAPIFields: { + type: "string" + }, + enableArtifacts: { + type: "boolean" + }, + enableCELInWhenExpression: { + type: "boolean" + }, + enableConciseResolverSyntax: { + type: "boolean" + }, + enableKeepPodOnCancel: { + type: "boolean" + }, + enableKubernetesSidecar: { + type: "boolean" + }, + enableParamEnum: { + type: "boolean" + }, + enableProvenanceInStatus: { + type: "boolean" + }, + enableStepActions: { + description: "EnableStepActions is a no-op flag since StepActions are stable", + type: "boolean" + }, + enableTektonOCIBundles: { + description: "DeprecatedEnableTektonOCIBundles is maintained for backward compatibility\nto allow deletion of PipelineRuns created before v0.62.x.\nThis field is not used and can be removed in a future release\nonce we're confident old PipelineRuns have been cleaned up.\nSee issue #8359 for context.", + type: "boolean" + }, + enableTerminationMessageCompression: { + type: "boolean" + }, + enableWaitExponentialBackoff: { + type: "boolean" + }, + enforceNonfalsifiability: { + type: "string" + }, + maxResultSize: { + type: "integer" + }, + requireGitSSHSecretKnownHosts: { + type: "boolean" + }, + resultExtractionMethod: { + type: "string" + }, + runningInEnvWithInjectedSidecars: { + type: "boolean" + }, + sendCloudEventsForRuns: { + type: "boolean" + }, + setSecurityContext: { + type: "boolean" + }, + setSecurityContextReadOnlyRootFilesystem: { + type: "boolean" + }, + verificationNoMatchPolicy: { + description: "VerificationNoMatchPolicy is the feature flag for \"trusted-resources-verification-no-match-policy\"\nVerificationNoMatchPolicy can be set to \"ignore\", \"warn\" and \"fail\" values.\nignore: skip trusted resources verification when no matching verification policies found\nwarn: skip trusted resources verification when no matching verification policies found and log a warning\nfail: fail the taskrun or pipelines run if no matching verification policies found", + type: "string" + } + }, + type: "object" + }, + refSource: { + description: "RefSource identifies the source where a remote task/pipeline came from.", + properties: { + digest: { + additionalProperties: { + type: "string" + }, + description: "Digest is a collection of cryptographic digests for the contents of the artifact specified by URI.\nExample: {\"sha1\": \"f99d13e554ffcb696dee719fa85b695cb5b0f428\"}", + type: "object" + }, + entryPoint: { + description: "EntryPoint identifies the entry point into the build. This is often a path to a\nbuild definition file and/or a target label within that file.\nExample: \"task/git-clone/0.10/git-clone.yaml\"", + type: "string" + }, + uri: { + description: "URI indicates the identity of the source of the build definition.\nExample: \"https://github.com/tektoncd/catalog\"", + type: "string" + } + }, + type: "object" + } + }, + type: "object" + }, + results: { + description: "Results are the list of results written out by the task's containers", + items: { + description: "TaskRunResult used to describe the results of a task", + properties: { + name: { + description: "Name the given name", + type: "string" + }, + type: { + description: "Type is the user-specified type of the result. The possible type\nis currently \"string\" and will support \"array\" in following work.", + type: "string" + }, + value: { + description: "Value the given value of the result", + "x-kubernetes-preserve-unknown-fields": true + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + retriesStatus: { + description: "RetriesStatus contains the history of TaskRunStatus in case of a retry in order to keep record of failures.\nAll TaskRunStatus stored in RetriesStatus will have no date within the RetriesStatus as is redundant.", + "x-kubernetes-preserve-unknown-fields": true + }, + sidecars: { + description: "The list has one entry per sidecar in the manifest. Each entry is\nrepresents the imageid of the corresponding sidecar.", + items: { + description: "SidecarState reports the results of running a sidecar in a Task.", + properties: { + container: { + type: "string" + }, + imageID: { + type: "string" + }, + name: { + type: "string" + }, + running: { + description: "Details about a running container", + properties: { + startedAt: { + description: "Time at which the container was last (re-)started", + format: "date-time", + type: "string" + } + }, + type: "object" + }, + terminated: { + description: "Details about a terminated container", + properties: { + containerID: { + description: "Container's ID in the format '://'", + type: "string" + }, + exitCode: { + description: "Exit status from the last termination of the container", + format: "int32", + type: "integer" + }, + finishedAt: { + description: "Time at which the container last terminated", + format: "date-time", + type: "string" + }, + message: { + description: "Message regarding the last termination of the container", + type: "string" + }, + reason: { + description: "(brief) reason from the last termination of the container", + type: "string" + }, + signal: { + description: "Signal from the last termination of the container", + format: "int32", + type: "integer" + }, + startedAt: { + description: "Time at which previous execution of the container started", + format: "date-time", + type: "string" + } + }, + required: ["exitCode"], + type: "object" + }, + waiting: { + description: "Details about a waiting container", + properties: { + message: { + description: "Message regarding why the container is not yet running.", + type: "string" + }, + reason: { + description: "(brief) reason the container is not yet running.", + type: "string" + } + }, + type: "object" + } + }, + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + spanContext: { + additionalProperties: { + type: "string" + }, + description: "SpanContext contains tracing span context fields", + type: "object" + }, + startTime: { + description: "StartTime is the time the build is actually started.", + format: "date-time", + type: "string" + }, + steps: { + description: "Steps describes the state of each build step container.", + items: { + description: "StepState reports the results of running a step in a Task.", + properties: { + container: { + type: "string" + }, + imageID: { + type: "string" + }, + inputs: { + items: { + description: "Artifact represents an artifact within a system, potentially containing multiple values\nassociated with it.", + properties: { + buildOutput: { + description: "Indicate if the artifact is a build output or a by-product", + type: "boolean" + }, + name: { + description: "The artifact's identifying category name", + type: "string" + }, + values: { + description: "A collection of values related to the artifact", + items: { + description: "ArtifactValue represents a specific value or data element within an Artifact.", + properties: { + digest: { + additionalProperties: { + type: "string" + }, + type: "object" + }, + uri: { + type: "string" + } + }, + type: "object" + }, + type: "array" + } + }, + type: "object" + }, + type: "array" + }, + name: { + type: "string" + }, + outputs: { + items: { + description: "Artifact represents an artifact within a system, potentially containing multiple values\nassociated with it.", + properties: { + buildOutput: { + description: "Indicate if the artifact is a build output or a by-product", + type: "boolean" + }, + name: { + description: "The artifact's identifying category name", + type: "string" + }, + values: { + description: "A collection of values related to the artifact", + items: { + description: "ArtifactValue represents a specific value or data element within an Artifact.", + properties: { + digest: { + additionalProperties: { + type: "string" + }, + type: "object" + }, + uri: { + type: "string" + } + }, + type: "object" + }, + type: "array" + } + }, + type: "object" + }, + type: "array" + }, + provenance: { + description: "Provenance contains metadata about resources used in the TaskRun/PipelineRun\nsuch as the source from where a remote build definition was fetched.\nThis field aims to carry minimum amoumt of metadata in *Run status so that\nTekton Chains can capture them in the provenance.", + properties: { + featureFlags: { + description: "FeatureFlags identifies the feature flags that were used during the task/pipeline run", + properties: { + awaitSidecarReadiness: { + type: "boolean" + }, + coschedule: { + type: "string" + }, + disableCredsInit: { + type: "boolean" + }, + disableInlineSpec: { + type: "string" + }, + enableAPIFields: { + type: "string" + }, + enableArtifacts: { + type: "boolean" + }, + enableCELInWhenExpression: { + type: "boolean" + }, + enableConciseResolverSyntax: { + type: "boolean" + }, + enableKeepPodOnCancel: { + type: "boolean" + }, + enableKubernetesSidecar: { + type: "boolean" + }, + enableParamEnum: { + type: "boolean" + }, + enableProvenanceInStatus: { + type: "boolean" + }, + enableStepActions: { + description: "EnableStepActions is a no-op flag since StepActions are stable", + type: "boolean" + }, + enableTektonOCIBundles: { + description: "DeprecatedEnableTektonOCIBundles is maintained for backward compatibility\nto allow deletion of PipelineRuns created before v0.62.x.\nThis field is not used and can be removed in a future release\nonce we're confident old PipelineRuns have been cleaned up.\nSee issue #8359 for context.", + type: "boolean" + }, + enableTerminationMessageCompression: { + type: "boolean" + }, + enableWaitExponentialBackoff: { + type: "boolean" + }, + enforceNonfalsifiability: { + type: "string" + }, + maxResultSize: { + type: "integer" + }, + requireGitSSHSecretKnownHosts: { + type: "boolean" + }, + resultExtractionMethod: { + type: "string" + }, + runningInEnvWithInjectedSidecars: { + type: "boolean" + }, + sendCloudEventsForRuns: { + type: "boolean" + }, + setSecurityContext: { + type: "boolean" + }, + setSecurityContextReadOnlyRootFilesystem: { + type: "boolean" + }, + verificationNoMatchPolicy: { + description: "VerificationNoMatchPolicy is the feature flag for \"trusted-resources-verification-no-match-policy\"\nVerificationNoMatchPolicy can be set to \"ignore\", \"warn\" and \"fail\" values.\nignore: skip trusted resources verification when no matching verification policies found\nwarn: skip trusted resources verification when no matching verification policies found and log a warning\nfail: fail the taskrun or pipelines run if no matching verification policies found", + type: "string" + } + }, + type: "object" + }, + refSource: { + description: "RefSource identifies the source where a remote task/pipeline came from.", + properties: { + digest: { + additionalProperties: { + type: "string" + }, + description: "Digest is a collection of cryptographic digests for the contents of the artifact specified by URI.\nExample: {\"sha1\": \"f99d13e554ffcb696dee719fa85b695cb5b0f428\"}", + type: "object" + }, + entryPoint: { + description: "EntryPoint identifies the entry point into the build. This is often a path to a\nbuild definition file and/or a target label within that file.\nExample: \"task/git-clone/0.10/git-clone.yaml\"", + type: "string" + }, + uri: { + description: "URI indicates the identity of the source of the build definition.\nExample: \"https://github.com/tektoncd/catalog\"", + type: "string" + } + }, + type: "object" + } + }, + type: "object" + }, + results: { + items: { + description: "TaskRunResult used to describe the results of a task", + properties: { + name: { + description: "Name the given name", + type: "string" + }, + type: { + description: "Type is the user-specified type of the result. The possible type\nis currently \"string\" and will support \"array\" in following work.", + type: "string" + }, + value: { + description: "Value the given value of the result", + "x-kubernetes-preserve-unknown-fields": true + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array" + }, + running: { + description: "Details about a running container", + properties: { + startedAt: { + description: "Time at which the container was last (re-)started", + format: "date-time", + type: "string" + } + }, + type: "object" + }, + terminated: { + description: "Details about a terminated container", + properties: { + containerID: { + description: "Container's ID in the format '://'", + type: "string" + }, + exitCode: { + description: "Exit status from the last termination of the container", + format: "int32", + type: "integer" + }, + finishedAt: { + description: "Time at which the container last terminated", + format: "date-time", + type: "string" + }, + message: { + description: "Message regarding the last termination of the container", + type: "string" + }, + reason: { + description: "(brief) reason from the last termination of the container", + type: "string" + }, + signal: { + description: "Signal from the last termination of the container", + format: "int32", + type: "integer" + }, + startedAt: { + description: "Time at which previous execution of the container started", + format: "date-time", + type: "string" + } + }, + required: ["exitCode"], + type: "object" + }, + terminationReason: { + type: "string" + }, + waiting: { + description: "Details about a waiting container", + properties: { + message: { + description: "Message regarding why the container is not yet running.", + type: "string" + }, + reason: { + description: "(brief) reason the container is not yet running.", + type: "string" + } + }, + type: "object" + } + }, + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + taskSpec: { + description: "TaskSpec contains the Spec from the dereferenced Task definition used to instantiate this TaskRun.", + properties: { + description: { + description: "Description is a user-facing description of the task that may be\nused to populate a UI.", + type: "string" + }, + displayName: { + description: "DisplayName is a user-facing name of the task that may be\nused to populate a UI.", + type: "string" + }, + params: { + description: "Params is a list of input parameters required to run the task. Params\nmust be supplied as inputs in TaskRuns unless they declare a default\nvalue.", + items: { + description: "ParamSpec defines arbitrary parameters needed beyond typed inputs (such as\nresources). Parameter values are provided by users as inputs on a TaskRun\nor PipelineRun.", + properties: { + default: { + description: "Default is the value a parameter takes if no input value is supplied. If\ndefault is set, a Task may be executed without a supplied value for the\nparameter.", + "x-kubernetes-preserve-unknown-fields": true + }, + description: { + description: "Description is a user-facing description of the parameter that may be\nused to populate a UI.", + type: "string" + }, + enum: { + description: "Enum declares a set of allowed param input values for tasks/pipelines that can be validated.\nIf Enum is not set, no input validation is performed for the param.", + items: { + type: "string" + }, + type: "array" + }, + name: { + description: "Name declares the name by which a parameter is referenced.", + type: "string" + }, + properties: { + additionalProperties: { + description: "PropertySpec defines the struct for object keys", + properties: { + type: { + description: "ParamType indicates the type of an input parameter;\nUsed to distinguish between a single string and an array of strings.", + type: "string" + } + }, + type: "object" + }, + description: "Properties is the JSON Schema properties to support key-value pairs parameter.", + type: "object" + }, + type: { + description: "Type is the user-specified type of the parameter. The possible types\nare currently \"string\", \"array\" and \"object\", and \"string\" is the default.", + type: "string" + } + }, + required: ["name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + results: { + description: "Results are values that this Task can output", + items: { + description: "TaskResult used to describe the results of a task", + properties: { + description: { + description: "Description is a human-readable description of the result", + type: "string" + }, + name: { + description: "Name the given name", + type: "string" + }, + properties: { + additionalProperties: { + description: "PropertySpec defines the struct for object keys", + properties: { + type: { + description: "ParamType indicates the type of an input parameter;\nUsed to distinguish between a single string and an array of strings.", + type: "string" + } + }, + type: "object" + }, + description: "Properties is the JSON Schema properties to support key-value pairs results.", + type: "object" + }, + type: { + description: "Type is the user-specified type of the result. The possible type\nis currently \"string\" and will support \"array\" in following work.", + type: "string" + }, + value: { + description: "Value the expression used to retrieve the value of the result from an underlying Step.", + "x-kubernetes-preserve-unknown-fields": true + } + }, + required: ["name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + sidecars: { + description: "Sidecars are run alongside the Task's step containers. They begin before\nthe steps start and end after the steps complete.", + items: { + description: "Sidecar has nearly the same data structure as Step but does not have the ability to timeout.", + properties: { + args: { + description: "Arguments to the entrypoint.\nThe image's CMD is used if this is not provided.\nVariable references $(VAR_NAME) are expanded using the Sidecar's environment. If a variable\ncannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced\nto a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. \"$$(VAR_NAME)\" will\nproduce the string literal \"$(VAR_NAME)\". Escaped references will never be expanded, regardless\nof whether the variable exists or not. Cannot be updated.\nMore info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + command: { + description: "Entrypoint array. Not executed within a shell.\nThe image's ENTRYPOINT is used if this is not provided.\nVariable references $(VAR_NAME) are expanded using the Sidecar's environment. If a variable\ncannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced\nto a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. \"$$(VAR_NAME)\" will\nproduce the string literal \"$(VAR_NAME)\". Escaped references will never be expanded, regardless\nof whether the variable exists or not. Cannot be updated.\nMore info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + computeResources: { + description: "ComputeResources required by this Sidecar.\nCannot be updated.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + properties: { + claims: { + description: "Claims lists the names of resources, defined in spec.resourceClaims,\nthat are used by this container.\n\nThis field depends on the\nDynamicResourceAllocation feature gate.\n\nThis field is immutable. It can only be set for containers.", + items: { + description: "ResourceClaim references one entry in PodSpec.ResourceClaims.", + properties: { + name: { + description: "Name must match the name of one entry in pod.spec.resourceClaims of\nthe Pod where this field is used. It makes that resource available\ninside a container.", + type: "string" + }, + request: { + description: "Request is the name chosen for a request in the referenced claim.\nIf empty, everything from the claim is made available, otherwise\nonly the result of this request.", + type: "string" + } + }, + required: ["name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-map-keys": ["name"], + "x-kubernetes-list-type": "map" + }, + limits: { + additionalProperties: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + }, + description: "Limits describes the maximum amount of compute resources allowed.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + type: "object" + }, + requests: { + additionalProperties: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + }, + description: "Requests describes the minimum amount of compute resources required.\nIf Requests is omitted for a container, it defaults to Limits if that is explicitly specified,\notherwise to an implementation-defined value. Requests cannot exceed Limits.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + type: "object" + } + }, + type: "object" + }, + env: { + description: "List of environment variables to set in the Sidecar.\nCannot be updated.", + items: { + description: "EnvVar represents an environment variable present in a Container.", + properties: { + name: { + description: "Name of the environment variable.\nMay consist of any printable ASCII characters except '='.", + type: "string" + }, + value: { + description: "Variable references $(VAR_NAME) are expanded\nusing the previously defined environment variables in the container and\nany service environment variables. If a variable cannot be resolved,\nthe reference in the input string will be unchanged. Double $$ are reduced\nto a single $, which allows for escaping the $(VAR_NAME) syntax: i.e.\n\"$$(VAR_NAME)\" will produce the string literal \"$(VAR_NAME)\".\nEscaped references will never be expanded, regardless of whether the variable\nexists or not.\nDefaults to \"\".", + type: "string" + }, + valueFrom: { + description: "Source for the environment variable's value. Cannot be used if value is not empty.", + properties: { + configMapKeyRef: { + description: "Selects a key of a ConfigMap.", + properties: { + key: { + description: "The key to select.", + type: "string" + }, + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "Specify whether the ConfigMap or its key must be defined", + type: "boolean" + } + }, + required: ["key"], + type: "object", + "x-kubernetes-map-type": "atomic" + }, + fieldRef: { + description: "Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`,\nspec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs.", + properties: { + apiVersion: { + description: "Version of the schema the FieldPath is written in terms of, defaults to \"v1\".", + type: "string" + }, + fieldPath: { + description: "Path of the field to select in the specified API version.", + type: "string" + } + }, + required: ["fieldPath"], + type: "object", + "x-kubernetes-map-type": "atomic" + }, + fileKeyRef: { + description: "FileKeyRef selects a key of the env file.\nRequires the EnvFiles feature gate to be enabled.", + properties: { + key: { + description: "The key within the env file. An invalid key will prevent the pod from starting.\nThe keys defined within a source may consist of any printable ASCII characters except '='.\nDuring Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.", + type: "string" + }, + optional: { + default: false, + description: "Specify whether the file or its key must be defined. If the file or key\ndoes not exist, then the env var is not published.\nIf optional is set to true and the specified key does not exist,\nthe environment variable will not be set in the Pod's containers.\n\nIf optional is set to false and the specified key does not exist,\nan error will be returned during Pod creation.", + type: "boolean" + }, + path: { + description: "The path within the volume from which to select the file.\nMust be relative and may not contain the '..' path or start with '..'.", + type: "string" + }, + volumeName: { + description: "The name of the volume mount containing the env file.", + type: "string" + } + }, + required: ["key", "path", "volumeName"], + type: "object", + "x-kubernetes-map-type": "atomic" + }, + resourceFieldRef: { + description: "Selects a resource of the container: only resources limits and requests\n(limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported.", + properties: { + containerName: { + description: "Container name: required for volumes, optional for env vars", + type: "string" + }, + divisor: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Specifies the output format of the exposed resources, defaults to \"1\"", + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + }, + resource: { + description: "Required: resource to select", + type: "string" + } + }, + required: ["resource"], + type: "object", + "x-kubernetes-map-type": "atomic" + }, + secretKeyRef: { + description: "Selects a key of a secret in the pod's namespace", + properties: { + key: { + description: "The key of the secret to select from. Must be a valid secret key.", + type: "string" + }, + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "Specify whether the Secret or its key must be defined", + type: "boolean" + } + }, + required: ["key"], + type: "object", + "x-kubernetes-map-type": "atomic" + } + }, + type: "object" + } + }, + required: ["name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + envFrom: { + description: "List of sources to populate environment variables in the Sidecar.\nThe keys defined within a source must be a C_IDENTIFIER. All invalid keys\nwill be reported as an event when the container is starting. When a key exists in multiple\nsources, the value associated with the last source will take precedence.\nValues defined by an Env with a duplicate key will take precedence.\nCannot be updated.", + items: { + description: "EnvFromSource represents the source of a set of ConfigMaps or Secrets", + properties: { + configMapRef: { + description: "The ConfigMap to select from", + properties: { + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "Specify whether the ConfigMap must be defined", + type: "boolean" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + prefix: { + description: "Optional text to prepend to the name of each environment variable.\nMay consist of any printable ASCII characters except '='.", + type: "string" + }, + secretRef: { + description: "The Secret to select from", + properties: { + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "Specify whether the Secret must be defined", + type: "boolean" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + } + }, + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + image: { + description: "Image reference name.\nMore info: https://kubernetes.io/docs/concepts/containers/images", + type: "string" + }, + imagePullPolicy: { + description: "Image pull policy.\nOne of Always, Never, IfNotPresent.\nDefaults to Always if :latest tag is specified, or IfNotPresent otherwise.\nCannot be updated.\nMore info: https://kubernetes.io/docs/concepts/containers/images#updating-images", + type: "string" + }, + lifecycle: { + description: "Actions that the management system should take in response to Sidecar lifecycle events.\nCannot be updated.", + properties: { + postStart: { + description: "PostStart is called immediately after a container is created. If the handler fails,\nthe container is terminated and restarted according to its restart policy.\nOther management of the container blocks until the hook completes.\nMore info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks", + properties: { + exec: { + description: "Exec specifies a command to execute in the container.", + properties: { + command: { + description: "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + httpGet: { + description: "HTTPGet specifies an HTTP GET request to perform.", + properties: { + host: { + description: "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", + type: "string" + }, + httpHeaders: { + description: "Custom headers to set in the request. HTTP allows repeated headers.", + items: { + description: "HTTPHeader describes a custom header to be used in HTTP probes", + properties: { + name: { + description: "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", + type: "string" + }, + value: { + description: "The header field value", + type: "string" + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + path: { + description: "Path to access on the HTTP server.", + type: "string" + }, + port: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true + }, + scheme: { + description: "Scheme to use for connecting to the host.\nDefaults to HTTP.", + type: "string" + } + }, + required: ["port"], + type: "object" + }, + sleep: { + description: "Sleep represents a duration that the container should sleep.", + properties: { + seconds: { + description: "Seconds is the number of seconds to sleep.", + format: "int64", + type: "integer" + } + }, + required: ["seconds"], + type: "object" + }, + tcpSocket: { + description: "Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept\nfor backward compatibility. There is no validation of this field and\nlifecycle hooks will fail at runtime when it is specified.", + properties: { + host: { + description: "Optional: Host name to connect to, defaults to the pod IP.", + type: "string" + }, + port: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true + } + }, + required: ["port"], + type: "object" + } + }, + type: "object" + }, + preStop: { + description: "PreStop is called immediately before a container is terminated due to an\nAPI request or management event such as liveness/startup probe failure,\npreemption, resource contention, etc. The handler is not called if the\ncontainer crashes or exits. The Pod's termination grace period countdown begins before the\nPreStop hook is executed. Regardless of the outcome of the handler, the\ncontainer will eventually terminate within the Pod's termination grace\nperiod (unless delayed by finalizers). Other management of the container blocks until the hook completes\nor until the termination grace period is reached.\nMore info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks", + properties: { + exec: { + description: "Exec specifies a command to execute in the container.", + properties: { + command: { + description: "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + httpGet: { + description: "HTTPGet specifies an HTTP GET request to perform.", + properties: { + host: { + description: "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", + type: "string" + }, + httpHeaders: { + description: "Custom headers to set in the request. HTTP allows repeated headers.", + items: { + description: "HTTPHeader describes a custom header to be used in HTTP probes", + properties: { + name: { + description: "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", + type: "string" + }, + value: { + description: "The header field value", + type: "string" + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + path: { + description: "Path to access on the HTTP server.", + type: "string" + }, + port: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true + }, + scheme: { + description: "Scheme to use for connecting to the host.\nDefaults to HTTP.", + type: "string" + } + }, + required: ["port"], + type: "object" + }, + sleep: { + description: "Sleep represents a duration that the container should sleep.", + properties: { + seconds: { + description: "Seconds is the number of seconds to sleep.", + format: "int64", + type: "integer" + } + }, + required: ["seconds"], + type: "object" + }, + tcpSocket: { + description: "Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept\nfor backward compatibility. There is no validation of this field and\nlifecycle hooks will fail at runtime when it is specified.", + properties: { + host: { + description: "Optional: Host name to connect to, defaults to the pod IP.", + type: "string" + }, + port: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true + } + }, + required: ["port"], + type: "object" + } + }, + type: "object" + }, + stopSignal: { + description: "StopSignal defines which signal will be sent to a container when it is being stopped.\nIf not specified, the default is defined by the container runtime in use.\nStopSignal can only be set for Pods with a non-empty .spec.os.name", + type: "string" + } + }, + type: "object" + }, + livenessProbe: { + description: "Periodic probe of Sidecar liveness.\nContainer will be restarted if the probe fails.\nCannot be updated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + properties: { + exec: { + description: "Exec specifies a command to execute in the container.", + properties: { + command: { + description: "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + failureThreshold: { + description: "Minimum consecutive failures for the probe to be considered failed after having succeeded.\nDefaults to 3. Minimum value is 1.", + format: "int32", + type: "integer" + }, + grpc: { + description: "GRPC specifies a GRPC HealthCheckRequest.", + properties: { + port: { + description: "Port number of the gRPC service. Number must be in the range 1 to 65535.", + format: "int32", + type: "integer" + }, + service: { + default: "", + description: "Service is the name of the service to place in the gRPC HealthCheckRequest\n(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).\n\nIf this is not specified, the default behavior is defined by gRPC.", + type: "string" + } + }, + required: ["port"], + type: "object" + }, + httpGet: { + description: "HTTPGet specifies an HTTP GET request to perform.", + properties: { + host: { + description: "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", + type: "string" + }, + httpHeaders: { + description: "Custom headers to set in the request. HTTP allows repeated headers.", + items: { + description: "HTTPHeader describes a custom header to be used in HTTP probes", + properties: { + name: { + description: "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", + type: "string" + }, + value: { + description: "The header field value", + type: "string" + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + path: { + description: "Path to access on the HTTP server.", + type: "string" + }, + port: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true + }, + scheme: { + description: "Scheme to use for connecting to the host.\nDefaults to HTTP.", + type: "string" + } + }, + required: ["port"], + type: "object" + }, + initialDelaySeconds: { + description: "Number of seconds after the container has started before liveness probes are initiated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + format: "int32", + type: "integer" + }, + periodSeconds: { + description: "How often (in seconds) to perform the probe.\nDefault to 10 seconds. Minimum value is 1.", + format: "int32", + type: "integer" + }, + successThreshold: { + description: "Minimum consecutive successes for the probe to be considered successful after having failed.\nDefaults to 1. Must be 1 for liveness and startup. Minimum value is 1.", + format: "int32", + type: "integer" + }, + tcpSocket: { + description: "TCPSocket specifies a connection to a TCP port.", + properties: { + host: { + description: "Optional: Host name to connect to, defaults to the pod IP.", + type: "string" + }, + port: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true + } + }, + required: ["port"], + type: "object" + }, + terminationGracePeriodSeconds: { + description: "Optional duration in seconds the pod needs to terminate gracefully upon probe failure.\nThe grace period is the duration in seconds after the processes running in the pod are sent\na termination signal and the time when the processes are forcibly halted with a kill signal.\nSet this value longer than the expected cleanup time for your process.\nIf this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this\nvalue overrides the value provided by the pod spec.\nValue must be non-negative integer. The value zero indicates stop immediately via\nthe kill signal (no opportunity to shut down).\nThis is a beta field and requires enabling ProbeTerminationGracePeriod feature gate.\nMinimum value is 1. spec.terminationGracePeriodSeconds is used if unset.", + format: "int64", + type: "integer" + }, + timeoutSeconds: { + description: "Number of seconds after which the probe times out.\nDefaults to 1 second. Minimum value is 1.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + format: "int32", + type: "integer" + } + }, + type: "object" + }, + name: { + description: "Name of the Sidecar specified as a DNS_LABEL.\nEach Sidecar in a Task must have a unique name (DNS_LABEL).\nCannot be updated.", + type: "string" + }, + ports: { + description: "List of ports to expose from the Sidecar. Exposing a port here gives\nthe system additional information about the network connections a\ncontainer uses, but is primarily informational. Not specifying a port here\nDOES NOT prevent that port from being exposed. Any port which is\nlistening on the default \"0.0.0.0\" address inside a container will be\naccessible from the network.\nCannot be updated.", + items: { + description: "ContainerPort represents a network port in a single container.", + properties: { + containerPort: { + description: "Number of port to expose on the pod's IP address.\nThis must be a valid port number, 0 < x < 65536.", + format: "int32", + type: "integer" + }, + hostIP: { + description: "What host IP to bind the external port to.", + type: "string" + }, + hostPort: { + description: "Number of port to expose on the host.\nIf specified, this must be a valid port number, 0 < x < 65536.\nIf HostNetwork is specified, this must match ContainerPort.\nMost containers do not need this.", + format: "int32", + type: "integer" + }, + name: { + description: "If specified, this must be an IANA_SVC_NAME and unique within the pod. Each\nnamed port in a pod must have a unique name. Name for the port that can be\nreferred to by services.", + type: "string" + }, + protocol: { + default: "TCP", + description: "Protocol for port. Must be UDP, TCP, or SCTP.\nDefaults to \"TCP\".", + type: "string" + } + }, + required: ["containerPort"], + type: "object" + }, + type: "array", + "x-kubernetes-list-map-keys": ["containerPort", "protocol"], + "x-kubernetes-list-type": "map" + }, + readinessProbe: { + description: "Periodic probe of Sidecar service readiness.\nContainer will be removed from service endpoints if the probe fails.\nCannot be updated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + properties: { + exec: { + description: "Exec specifies a command to execute in the container.", + properties: { + command: { + description: "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + failureThreshold: { + description: "Minimum consecutive failures for the probe to be considered failed after having succeeded.\nDefaults to 3. Minimum value is 1.", + format: "int32", + type: "integer" + }, + grpc: { + description: "GRPC specifies a GRPC HealthCheckRequest.", + properties: { + port: { + description: "Port number of the gRPC service. Number must be in the range 1 to 65535.", + format: "int32", + type: "integer" + }, + service: { + default: "", + description: "Service is the name of the service to place in the gRPC HealthCheckRequest\n(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).\n\nIf this is not specified, the default behavior is defined by gRPC.", + type: "string" + } + }, + required: ["port"], + type: "object" + }, + httpGet: { + description: "HTTPGet specifies an HTTP GET request to perform.", + properties: { + host: { + description: "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", + type: "string" + }, + httpHeaders: { + description: "Custom headers to set in the request. HTTP allows repeated headers.", + items: { + description: "HTTPHeader describes a custom header to be used in HTTP probes", + properties: { + name: { + description: "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", + type: "string" + }, + value: { + description: "The header field value", + type: "string" + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + path: { + description: "Path to access on the HTTP server.", + type: "string" + }, + port: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true + }, + scheme: { + description: "Scheme to use for connecting to the host.\nDefaults to HTTP.", + type: "string" + } + }, + required: ["port"], + type: "object" + }, + initialDelaySeconds: { + description: "Number of seconds after the container has started before liveness probes are initiated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + format: "int32", + type: "integer" + }, + periodSeconds: { + description: "How often (in seconds) to perform the probe.\nDefault to 10 seconds. Minimum value is 1.", + format: "int32", + type: "integer" + }, + successThreshold: { + description: "Minimum consecutive successes for the probe to be considered successful after having failed.\nDefaults to 1. Must be 1 for liveness and startup. Minimum value is 1.", + format: "int32", + type: "integer" + }, + tcpSocket: { + description: "TCPSocket specifies a connection to a TCP port.", + properties: { + host: { + description: "Optional: Host name to connect to, defaults to the pod IP.", + type: "string" + }, + port: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true + } + }, + required: ["port"], + type: "object" + }, + terminationGracePeriodSeconds: { + description: "Optional duration in seconds the pod needs to terminate gracefully upon probe failure.\nThe grace period is the duration in seconds after the processes running in the pod are sent\na termination signal and the time when the processes are forcibly halted with a kill signal.\nSet this value longer than the expected cleanup time for your process.\nIf this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this\nvalue overrides the value provided by the pod spec.\nValue must be non-negative integer. The value zero indicates stop immediately via\nthe kill signal (no opportunity to shut down).\nThis is a beta field and requires enabling ProbeTerminationGracePeriod feature gate.\nMinimum value is 1. spec.terminationGracePeriodSeconds is used if unset.", + format: "int64", + type: "integer" + }, + timeoutSeconds: { + description: "Number of seconds after which the probe times out.\nDefaults to 1 second. Minimum value is 1.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + format: "int32", + type: "integer" + } + }, + type: "object" + }, + restartPolicy: { + description: "RestartPolicy refers to kubernetes RestartPolicy. It can only be set for an\ninitContainer and must have it's policy set to \"Always\". It is currently\nleft optional to help support Kubernetes versions prior to 1.29 when this feature\nwas introduced.", + type: "string" + }, + script: { + description: "Script is the contents of an executable file to execute.\n\nIf Script is not empty, the Step cannot have an Command or Args.", + type: "string" + }, + securityContext: { + description: "SecurityContext defines the security options the Sidecar should be run with.\nIf set, the fields of SecurityContext override the equivalent fields of PodSecurityContext.\nMore info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/", + properties: { + allowPrivilegeEscalation: { + description: "AllowPrivilegeEscalation controls whether a process can gain more\nprivileges than its parent process. This bool directly controls if\nthe no_new_privs flag will be set on the container process.\nAllowPrivilegeEscalation is true always when the container is:\n1) run as Privileged\n2) has CAP_SYS_ADMIN\nNote that this field cannot be set when spec.os.name is windows.", + type: "boolean" + }, + appArmorProfile: { + description: "appArmorProfile is the AppArmor options to use by this container. If set, this profile\noverrides the pod's appArmorProfile.\nNote that this field cannot be set when spec.os.name is windows.", + properties: { + localhostProfile: { + description: "localhostProfile indicates a profile loaded on the node that should be used.\nThe profile must be preconfigured on the node to work.\nMust match the loaded name of the profile.\nMust be set if and only if type is \"Localhost\".", + type: "string" + }, + type: { + description: "type indicates which kind of AppArmor profile will be applied.\nValid options are:\n Localhost - a profile pre-loaded on the node.\n RuntimeDefault - the container runtime's default profile.\n Unconfined - no AppArmor enforcement.", + type: "string" + } + }, + required: ["type"], + type: "object" + }, + capabilities: { + description: "The capabilities to add/drop when running containers.\nDefaults to the default set of capabilities granted by the container runtime.\nNote that this field cannot be set when spec.os.name is windows.", + properties: { + add: { + description: "Added capabilities", + items: { + description: "Capability represent POSIX capabilities type", + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + drop: { + description: "Removed capabilities", + items: { + description: "Capability represent POSIX capabilities type", + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + privileged: { + description: "Run container in privileged mode.\nProcesses in privileged containers are essentially equivalent to root on the host.\nDefaults to false.\nNote that this field cannot be set when spec.os.name is windows.", + type: "boolean" + }, + procMount: { + description: "procMount denotes the type of proc mount to use for the containers.\nThe default value is Default which uses the container runtime defaults for\nreadonly paths and masked paths.\nThis requires the ProcMountType feature flag to be enabled.\nNote that this field cannot be set when spec.os.name is windows.", + type: "string" + }, + readOnlyRootFilesystem: { + description: "Whether this container has a read-only root filesystem.\nDefault is false.\nNote that this field cannot be set when spec.os.name is windows.", + type: "boolean" + }, + runAsGroup: { + description: "The GID to run the entrypoint of the container process.\nUses runtime default if unset.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is windows.", + format: "int64", + type: "integer" + }, + runAsNonRoot: { + description: "Indicates that the container must run as a non-root user.\nIf true, the Kubelet will validate the image at runtime to ensure that it\ndoes not run as UID 0 (root) and fail to start the container if it does.\nIf unset or false, no such validation will be performed.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.", + type: "boolean" + }, + runAsUser: { + description: "The UID to run the entrypoint of the container process.\nDefaults to user specified in image metadata if unspecified.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is windows.", + format: "int64", + type: "integer" + }, + seccompProfile: { + description: "The seccomp options to use by this container. If seccomp options are\nprovided at both the pod & container level, the container options\noverride the pod options.\nNote that this field cannot be set when spec.os.name is windows.", + properties: { + localhostProfile: { + description: "localhostProfile indicates a profile defined in a file on the node should be used.\nThe profile must be preconfigured on the node to work.\nMust be a descending path, relative to the kubelet's configured seccomp profile location.\nMust be set if type is \"Localhost\". Must NOT be set for any other type.", + type: "string" + }, + type: { + description: "type indicates which kind of seccomp profile will be applied.\nValid options are:\n\nLocalhost - a profile defined in a file on the node should be used.\nRuntimeDefault - the container runtime default profile should be used.\nUnconfined - no profile should be applied.", + type: "string" + } + }, + required: ["type"], + type: "object" + }, + seLinuxOptions: { + description: "The SELinux context to be applied to the container.\nIf unspecified, the container runtime will allocate a random SELinux context for each\ncontainer. May also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is windows.", + properties: { + level: { + description: "Level is SELinux level label that applies to the container.", + type: "string" + }, + role: { + description: "Role is a SELinux role label that applies to the container.", + type: "string" + }, + type: { + description: "Type is a SELinux type label that applies to the container.", + type: "string" + }, + user: { + description: "User is a SELinux user label that applies to the container.", + type: "string" + } + }, + type: "object" + }, + windowsOptions: { + description: "The Windows specific settings applied to all containers.\nIf unspecified, the options from the PodSecurityContext will be used.\nIf set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is linux.", + properties: { + gmsaCredentialSpec: { + description: "GMSACredentialSpec is where the GMSA admission webhook\n(https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the\nGMSA credential spec named by the GMSACredentialSpecName field.", + type: "string" + }, + gmsaCredentialSpecName: { + description: "GMSACredentialSpecName is the name of the GMSA credential spec to use.", + type: "string" + }, + hostProcess: { + description: "HostProcess determines if a container should be run as a 'Host Process' container.\nAll of a Pod's containers must have the same effective HostProcess value\n(it is not allowed to have a mix of HostProcess containers and non-HostProcess containers).\nIn addition, if HostProcess is true then HostNetwork must also be set to true.", + type: "boolean" + }, + runAsUserName: { + description: "The UserName in Windows to run the entrypoint of the container process.\nDefaults to the user specified in image metadata if unspecified.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.", + type: "string" + } + }, + type: "object" + } + }, + type: "object" + }, + startupProbe: { + description: "StartupProbe indicates that the Pod the Sidecar is running in has successfully initialized.\nIf specified, no other probes are executed until this completes successfully.\nIf this probe fails, the Pod will be restarted, just as if the livenessProbe failed.\nThis can be used to provide different probe parameters at the beginning of a Pod's lifecycle,\nwhen it might take a long time to load data or warm a cache, than during steady-state operation.\nThis cannot be updated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + properties: { + exec: { + description: "Exec specifies a command to execute in the container.", + properties: { + command: { + description: "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + failureThreshold: { + description: "Minimum consecutive failures for the probe to be considered failed after having succeeded.\nDefaults to 3. Minimum value is 1.", + format: "int32", + type: "integer" + }, + grpc: { + description: "GRPC specifies a GRPC HealthCheckRequest.", + properties: { + port: { + description: "Port number of the gRPC service. Number must be in the range 1 to 65535.", + format: "int32", + type: "integer" + }, + service: { + default: "", + description: "Service is the name of the service to place in the gRPC HealthCheckRequest\n(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).\n\nIf this is not specified, the default behavior is defined by gRPC.", + type: "string" + } + }, + required: ["port"], + type: "object" + }, + httpGet: { + description: "HTTPGet specifies an HTTP GET request to perform.", + properties: { + host: { + description: "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", + type: "string" + }, + httpHeaders: { + description: "Custom headers to set in the request. HTTP allows repeated headers.", + items: { + description: "HTTPHeader describes a custom header to be used in HTTP probes", + properties: { + name: { + description: "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", + type: "string" + }, + value: { + description: "The header field value", + type: "string" + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + path: { + description: "Path to access on the HTTP server.", + type: "string" + }, + port: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true + }, + scheme: { + description: "Scheme to use for connecting to the host.\nDefaults to HTTP.", + type: "string" + } + }, + required: ["port"], + type: "object" + }, + initialDelaySeconds: { + description: "Number of seconds after the container has started before liveness probes are initiated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + format: "int32", + type: "integer" + }, + periodSeconds: { + description: "How often (in seconds) to perform the probe.\nDefault to 10 seconds. Minimum value is 1.", + format: "int32", + type: "integer" + }, + successThreshold: { + description: "Minimum consecutive successes for the probe to be considered successful after having failed.\nDefaults to 1. Must be 1 for liveness and startup. Minimum value is 1.", + format: "int32", + type: "integer" + }, + tcpSocket: { + description: "TCPSocket specifies a connection to a TCP port.", + properties: { + host: { + description: "Optional: Host name to connect to, defaults to the pod IP.", + type: "string" + }, + port: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true + } + }, + required: ["port"], + type: "object" + }, + terminationGracePeriodSeconds: { + description: "Optional duration in seconds the pod needs to terminate gracefully upon probe failure.\nThe grace period is the duration in seconds after the processes running in the pod are sent\na termination signal and the time when the processes are forcibly halted with a kill signal.\nSet this value longer than the expected cleanup time for your process.\nIf this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this\nvalue overrides the value provided by the pod spec.\nValue must be non-negative integer. The value zero indicates stop immediately via\nthe kill signal (no opportunity to shut down).\nThis is a beta field and requires enabling ProbeTerminationGracePeriod feature gate.\nMinimum value is 1. spec.terminationGracePeriodSeconds is used if unset.", + format: "int64", + type: "integer" + }, + timeoutSeconds: { + description: "Number of seconds after which the probe times out.\nDefaults to 1 second. Minimum value is 1.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + format: "int32", + type: "integer" + } + }, + type: "object" + }, + stdin: { + description: "Whether this Sidecar should allocate a buffer for stdin in the container runtime. If this\nis not set, reads from stdin in the Sidecar will always result in EOF.\nDefault is false.", + type: "boolean" + }, + stdinOnce: { + description: "Whether the container runtime should close the stdin channel after it has been opened by\na single attach. When stdin is true the stdin stream will remain open across multiple attach\nsessions. If stdinOnce is set to true, stdin is opened on Sidecar start, is empty until the\nfirst client attaches to stdin, and then remains open and accepts data until the client disconnects,\nat which time stdin is closed and remains closed until the Sidecar is restarted. If this\nflag is false, a container processes that reads from stdin will never receive an EOF.\nDefault is false", + type: "boolean" + }, + terminationMessagePath: { + description: "Optional: Path at which the file to which the Sidecar's termination message\nwill be written is mounted into the Sidecar's filesystem.\nMessage written is intended to be brief final status, such as an assertion failure message.\nWill be truncated by the node if greater than 4096 bytes. The total message length across\nall containers will be limited to 12kb.\nDefaults to /dev/termination-log.\nCannot be updated.", + type: "string" + }, + terminationMessagePolicy: { + description: "Indicate how the termination message should be populated. File will use the contents of\nterminationMessagePath to populate the Sidecar status message on both success and failure.\nFallbackToLogsOnError will use the last chunk of Sidecar log output if the termination\nmessage file is empty and the Sidecar exited with an error.\nThe log output is limited to 2048 bytes or 80 lines, whichever is smaller.\nDefaults to File.\nCannot be updated.", + type: "string" + }, + tty: { + description: "Whether this Sidecar should allocate a TTY for itself, also requires 'stdin' to be true.\nDefault is false.", + type: "boolean" + }, + volumeDevices: { + description: "volumeDevices is the list of block devices to be used by the Sidecar.", + items: { + description: "volumeDevice describes a mapping of a raw block device within a container.", + properties: { + devicePath: { + description: "devicePath is the path inside of the container that the device will be mapped to.", + type: "string" + }, + name: { + description: "name must match the name of a persistentVolumeClaim in the pod", + type: "string" + } + }, + required: ["devicePath", "name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + volumeMounts: { + description: "Volumes to mount into the Sidecar's filesystem.\nCannot be updated.", + items: { + description: "VolumeMount describes a mounting of a Volume within a container.", + properties: { + mountPath: { + description: "Path within the container at which the volume should be mounted. Must\nnot contain ':'.", + type: "string" + }, + mountPropagation: { + description: "mountPropagation determines how mounts are propagated from the host\nto container and the other way around.\nWhen not set, MountPropagationNone is used.\nThis field is beta in 1.10.\nWhen RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified\n(which defaults to None).", + type: "string" + }, + name: { + description: "This must match the Name of a Volume.", + type: "string" + }, + readOnly: { + description: "Mounted read-only if true, read-write otherwise (false or unspecified).\nDefaults to false.", + type: "boolean" + }, + recursiveReadOnly: { + description: "RecursiveReadOnly specifies whether read-only mounts should be handled\nrecursively.\n\nIf ReadOnly is false, this field has no meaning and must be unspecified.\n\nIf ReadOnly is true, and this field is set to Disabled, the mount is not made\nrecursively read-only. If this field is set to IfPossible, the mount is made\nrecursively read-only, if it is supported by the container runtime. If this\nfield is set to Enabled, the mount is made recursively read-only if it is\nsupported by the container runtime, otherwise the pod will not be started and\nan error will be generated to indicate the reason.\n\nIf this field is set to IfPossible or Enabled, MountPropagation must be set to\nNone (or be unspecified, which defaults to None).\n\nIf this field is not specified, it is treated as an equivalent of Disabled.", + type: "string" + }, + subPath: { + description: "Path within the volume from which the container's volume should be mounted.\nDefaults to \"\" (volume's root).", + type: "string" + }, + subPathExpr: { + description: "Expanded path within the volume from which the container's volume should be mounted.\nBehaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment.\nDefaults to \"\" (volume's root).\nSubPathExpr and SubPath are mutually exclusive.", + type: "string" + } + }, + required: ["mountPath", "name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + workingDir: { + description: "Sidecar's working directory.\nIf not specified, the container runtime's default will be used, which\nmight be configured in the container image.\nCannot be updated.", + type: "string" + }, + workspaces: { + description: "This is an alpha field. You must set the \"enable-api-fields\" feature flag to \"alpha\"\nfor this field to be supported.\n\nWorkspaces is a list of workspaces from the Task that this Sidecar wants\nexclusive access to. Adding a workspace to this list means that any\nother Step or Sidecar that does not also request this Workspace will\nnot have access to it.", + items: { + description: "WorkspaceUsage is used by a Step or Sidecar to declare that it wants isolated access\nto a Workspace defined in a Task.", + properties: { + mountPath: { + description: "MountPath is the path that the workspace should be mounted to inside the Step or Sidecar,\noverriding any MountPath specified in the Task's WorkspaceDeclaration.", + type: "string" + }, + name: { + description: "Name is the name of the workspace this Step or Sidecar wants access to.", + type: "string" + } + }, + required: ["mountPath", "name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + required: ["name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + steps: { + description: "Steps are the steps of the build; each step is run sequentially with the\nsource mounted into /workspace.", + items: { + description: "Step runs a subcomponent of a Task", + properties: { + args: { + description: "Arguments to the entrypoint.\nThe image's CMD is used if this is not provided.\nVariable references $(VAR_NAME) are expanded using the container's environment. If a variable\ncannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced\nto a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. \"$$(VAR_NAME)\" will\nproduce the string literal \"$(VAR_NAME)\". Escaped references will never be expanded, regardless\nof whether the variable exists or not. Cannot be updated.\nMore info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + command: { + description: "Entrypoint array. Not executed within a shell.\nThe image's ENTRYPOINT is used if this is not provided.\nVariable references $(VAR_NAME) are expanded using the container's environment. If a variable\ncannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced\nto a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. \"$$(VAR_NAME)\" will\nproduce the string literal \"$(VAR_NAME)\". Escaped references will never be expanded, regardless\nof whether the variable exists or not. Cannot be updated.\nMore info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + computeResources: { + description: "ComputeResources required by this Step.\nCannot be updated.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + properties: { + claims: { + description: "Claims lists the names of resources, defined in spec.resourceClaims,\nthat are used by this container.\n\nThis field depends on the\nDynamicResourceAllocation feature gate.\n\nThis field is immutable. It can only be set for containers.", + items: { + description: "ResourceClaim references one entry in PodSpec.ResourceClaims.", + properties: { + name: { + description: "Name must match the name of one entry in pod.spec.resourceClaims of\nthe Pod where this field is used. It makes that resource available\ninside a container.", + type: "string" + }, + request: { + description: "Request is the name chosen for a request in the referenced claim.\nIf empty, everything from the claim is made available, otherwise\nonly the result of this request.", + type: "string" + } + }, + required: ["name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-map-keys": ["name"], + "x-kubernetes-list-type": "map" + }, + limits: { + additionalProperties: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + }, + description: "Limits describes the maximum amount of compute resources allowed.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + type: "object" + }, + requests: { + additionalProperties: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + }, + description: "Requests describes the minimum amount of compute resources required.\nIf Requests is omitted for a container, it defaults to Limits if that is explicitly specified,\notherwise to an implementation-defined value. Requests cannot exceed Limits.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + type: "object" + } + }, + type: "object" + }, + displayName: { + description: "DisplayName is a user-facing name of the step that may be\nused to populate a UI.", + type: "string" + }, + env: { + description: "List of environment variables to set in the Step.\nCannot be updated.", + items: { + description: "EnvVar represents an environment variable present in a Container.", + properties: { + name: { + description: "Name of the environment variable.\nMay consist of any printable ASCII characters except '='.", + type: "string" + }, + value: { + description: "Variable references $(VAR_NAME) are expanded\nusing the previously defined environment variables in the container and\nany service environment variables. If a variable cannot be resolved,\nthe reference in the input string will be unchanged. Double $$ are reduced\nto a single $, which allows for escaping the $(VAR_NAME) syntax: i.e.\n\"$$(VAR_NAME)\" will produce the string literal \"$(VAR_NAME)\".\nEscaped references will never be expanded, regardless of whether the variable\nexists or not.\nDefaults to \"\".", + type: "string" + }, + valueFrom: { + description: "Source for the environment variable's value. Cannot be used if value is not empty.", + properties: { + configMapKeyRef: { + description: "Selects a key of a ConfigMap.", + properties: { + key: { + description: "The key to select.", + type: "string" + }, + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "Specify whether the ConfigMap or its key must be defined", + type: "boolean" + } + }, + required: ["key"], + type: "object", + "x-kubernetes-map-type": "atomic" + }, + fieldRef: { + description: "Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`,\nspec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs.", + properties: { + apiVersion: { + description: "Version of the schema the FieldPath is written in terms of, defaults to \"v1\".", + type: "string" + }, + fieldPath: { + description: "Path of the field to select in the specified API version.", + type: "string" + } + }, + required: ["fieldPath"], + type: "object", + "x-kubernetes-map-type": "atomic" + }, + fileKeyRef: { + description: "FileKeyRef selects a key of the env file.\nRequires the EnvFiles feature gate to be enabled.", + properties: { + key: { + description: "The key within the env file. An invalid key will prevent the pod from starting.\nThe keys defined within a source may consist of any printable ASCII characters except '='.\nDuring Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.", + type: "string" + }, + optional: { + default: false, + description: "Specify whether the file or its key must be defined. If the file or key\ndoes not exist, then the env var is not published.\nIf optional is set to true and the specified key does not exist,\nthe environment variable will not be set in the Pod's containers.\n\nIf optional is set to false and the specified key does not exist,\nan error will be returned during Pod creation.", + type: "boolean" + }, + path: { + description: "The path within the volume from which to select the file.\nMust be relative and may not contain the '..' path or start with '..'.", + type: "string" + }, + volumeName: { + description: "The name of the volume mount containing the env file.", + type: "string" + } + }, + required: ["key", "path", "volumeName"], + type: "object", + "x-kubernetes-map-type": "atomic" + }, + resourceFieldRef: { + description: "Selects a resource of the container: only resources limits and requests\n(limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported.", + properties: { + containerName: { + description: "Container name: required for volumes, optional for env vars", + type: "string" + }, + divisor: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Specifies the output format of the exposed resources, defaults to \"1\"", + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + }, + resource: { + description: "Required: resource to select", + type: "string" + } + }, + required: ["resource"], + type: "object", + "x-kubernetes-map-type": "atomic" + }, + secretKeyRef: { + description: "Selects a key of a secret in the pod's namespace", + properties: { + key: { + description: "The key of the secret to select from. Must be a valid secret key.", + type: "string" + }, + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "Specify whether the Secret or its key must be defined", + type: "boolean" + } + }, + required: ["key"], + type: "object", + "x-kubernetes-map-type": "atomic" + } + }, + type: "object" + } + }, + required: ["name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + envFrom: { + description: "List of sources to populate environment variables in the Step.\nThe keys defined within a source must be a C_IDENTIFIER. All invalid keys\nwill be reported as an event when the Step is starting. When a key exists in multiple\nsources, the value associated with the last source will take precedence.\nValues defined by an Env with a duplicate key will take precedence.\nCannot be updated.", + items: { + description: "EnvFromSource represents the source of a set of ConfigMaps or Secrets", + properties: { + configMapRef: { + description: "The ConfigMap to select from", + properties: { + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "Specify whether the ConfigMap must be defined", + type: "boolean" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + prefix: { + description: "Optional text to prepend to the name of each environment variable.\nMay consist of any printable ASCII characters except '='.", + type: "string" + }, + secretRef: { + description: "The Secret to select from", + properties: { + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "Specify whether the Secret must be defined", + type: "boolean" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + } + }, + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + image: { + description: "Docker image name.\nMore info: https://kubernetes.io/docs/concepts/containers/images", + type: "string" + }, + imagePullPolicy: { + description: "Image pull policy.\nOne of Always, Never, IfNotPresent.\nDefaults to Always if :latest tag is specified, or IfNotPresent otherwise.\nCannot be updated.\nMore info: https://kubernetes.io/docs/concepts/containers/images#updating-images", + type: "string" + }, + name: { + description: "Name of the Step specified as a DNS_LABEL.\nEach Step in a Task must have a unique name.", + type: "string" + }, + onError: { + description: "OnError defines the exiting behavior of a container on error\ncan be set to [ continue | stopAndFail ]", + type: "string" + }, + params: { + description: "Params declares parameters passed to this step action.", + items: { + description: "Param declares an ParamValues to use for the parameter called name.", + properties: { + name: { + type: "string" + }, + value: { + "x-kubernetes-preserve-unknown-fields": true + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + ref: { + description: "Contains the reference to an existing StepAction.", + properties: { + name: { + description: "Name of the referenced step", + type: "string" + }, + params: { + description: "Params contains the parameters used to identify the\nreferenced Tekton resource. Example entries might include\n\"repo\" or \"path\" but the set of params ultimately depends on\nthe chosen resolver.", + items: { + description: "Param declares an ParamValues to use for the parameter called name.", + properties: { + name: { + type: "string" + }, + value: { + "x-kubernetes-preserve-unknown-fields": true + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + resolver: { + description: "Resolver is the name of the resolver that should perform\nresolution of the referenced Tekton resource, such as \"git\".", + type: "string" + } + }, + type: "object" + }, + results: { + description: "Results declares StepResults produced by the Step.\n\nIt can be used in an inlined Step when used to store Results to $(step.results.resultName.path).\nIt cannot be used when referencing StepActions using [v1.Step.Ref].\nThe Results declared by the StepActions will be stored here instead.", + items: { + description: "StepResult used to describe the Results of a Step.", + properties: { + description: { + description: "Description is a human-readable description of the result", + type: "string" + }, + name: { + description: "Name the given name", + type: "string" + }, + properties: { + additionalProperties: { + description: "PropertySpec defines the struct for object keys", + properties: { + type: { + description: "ParamType indicates the type of an input parameter;\nUsed to distinguish between a single string and an array of strings.", + type: "string" + } + }, + type: "object" + }, + description: "Properties is the JSON Schema properties to support key-value pairs results.", + type: "object" + }, + type: { + description: "The possible types are 'string', 'array', and 'object', with 'string' as the default.", + type: "string" + } + }, + required: ["name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + script: { + description: "Script is the contents of an executable file to execute.\n\nIf Script is not empty, the Step cannot have an Command and the Args will be passed to the Script.", + type: "string" + }, + securityContext: { + description: "SecurityContext defines the security options the Step should be run with.\nIf set, the fields of SecurityContext override the equivalent fields of PodSecurityContext.\nMore info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/", + properties: { + allowPrivilegeEscalation: { + description: "AllowPrivilegeEscalation controls whether a process can gain more\nprivileges than its parent process. This bool directly controls if\nthe no_new_privs flag will be set on the container process.\nAllowPrivilegeEscalation is true always when the container is:\n1) run as Privileged\n2) has CAP_SYS_ADMIN\nNote that this field cannot be set when spec.os.name is windows.", + type: "boolean" + }, + appArmorProfile: { + description: "appArmorProfile is the AppArmor options to use by this container. If set, this profile\noverrides the pod's appArmorProfile.\nNote that this field cannot be set when spec.os.name is windows.", + properties: { + localhostProfile: { + description: "localhostProfile indicates a profile loaded on the node that should be used.\nThe profile must be preconfigured on the node to work.\nMust match the loaded name of the profile.\nMust be set if and only if type is \"Localhost\".", + type: "string" + }, + type: { + description: "type indicates which kind of AppArmor profile will be applied.\nValid options are:\n Localhost - a profile pre-loaded on the node.\n RuntimeDefault - the container runtime's default profile.\n Unconfined - no AppArmor enforcement.", + type: "string" + } + }, + required: ["type"], + type: "object" + }, + capabilities: { + description: "The capabilities to add/drop when running containers.\nDefaults to the default set of capabilities granted by the container runtime.\nNote that this field cannot be set when spec.os.name is windows.", + properties: { + add: { + description: "Added capabilities", + items: { + description: "Capability represent POSIX capabilities type", + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + drop: { + description: "Removed capabilities", + items: { + description: "Capability represent POSIX capabilities type", + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + privileged: { + description: "Run container in privileged mode.\nProcesses in privileged containers are essentially equivalent to root on the host.\nDefaults to false.\nNote that this field cannot be set when spec.os.name is windows.", + type: "boolean" + }, + procMount: { + description: "procMount denotes the type of proc mount to use for the containers.\nThe default value is Default which uses the container runtime defaults for\nreadonly paths and masked paths.\nThis requires the ProcMountType feature flag to be enabled.\nNote that this field cannot be set when spec.os.name is windows.", + type: "string" + }, + readOnlyRootFilesystem: { + description: "Whether this container has a read-only root filesystem.\nDefault is false.\nNote that this field cannot be set when spec.os.name is windows.", + type: "boolean" + }, + runAsGroup: { + description: "The GID to run the entrypoint of the container process.\nUses runtime default if unset.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is windows.", + format: "int64", + type: "integer" + }, + runAsNonRoot: { + description: "Indicates that the container must run as a non-root user.\nIf true, the Kubelet will validate the image at runtime to ensure that it\ndoes not run as UID 0 (root) and fail to start the container if it does.\nIf unset or false, no such validation will be performed.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.", + type: "boolean" + }, + runAsUser: { + description: "The UID to run the entrypoint of the container process.\nDefaults to user specified in image metadata if unspecified.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is windows.", + format: "int64", + type: "integer" + }, + seccompProfile: { + description: "The seccomp options to use by this container. If seccomp options are\nprovided at both the pod & container level, the container options\noverride the pod options.\nNote that this field cannot be set when spec.os.name is windows.", + properties: { + localhostProfile: { + description: "localhostProfile indicates a profile defined in a file on the node should be used.\nThe profile must be preconfigured on the node to work.\nMust be a descending path, relative to the kubelet's configured seccomp profile location.\nMust be set if type is \"Localhost\". Must NOT be set for any other type.", + type: "string" + }, + type: { + description: "type indicates which kind of seccomp profile will be applied.\nValid options are:\n\nLocalhost - a profile defined in a file on the node should be used.\nRuntimeDefault - the container runtime default profile should be used.\nUnconfined - no profile should be applied.", + type: "string" + } + }, + required: ["type"], + type: "object" + }, + seLinuxOptions: { + description: "The SELinux context to be applied to the container.\nIf unspecified, the container runtime will allocate a random SELinux context for each\ncontainer. May also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is windows.", + properties: { + level: { + description: "Level is SELinux level label that applies to the container.", + type: "string" + }, + role: { + description: "Role is a SELinux role label that applies to the container.", + type: "string" + }, + type: { + description: "Type is a SELinux type label that applies to the container.", + type: "string" + }, + user: { + description: "User is a SELinux user label that applies to the container.", + type: "string" + } + }, + type: "object" + }, + windowsOptions: { + description: "The Windows specific settings applied to all containers.\nIf unspecified, the options from the PodSecurityContext will be used.\nIf set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is linux.", + properties: { + gmsaCredentialSpec: { + description: "GMSACredentialSpec is where the GMSA admission webhook\n(https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the\nGMSA credential spec named by the GMSACredentialSpecName field.", + type: "string" + }, + gmsaCredentialSpecName: { + description: "GMSACredentialSpecName is the name of the GMSA credential spec to use.", + type: "string" + }, + hostProcess: { + description: "HostProcess determines if a container should be run as a 'Host Process' container.\nAll of a Pod's containers must have the same effective HostProcess value\n(it is not allowed to have a mix of HostProcess containers and non-HostProcess containers).\nIn addition, if HostProcess is true then HostNetwork must also be set to true.", + type: "boolean" + }, + runAsUserName: { + description: "The UserName in Windows to run the entrypoint of the container process.\nDefaults to the user specified in image metadata if unspecified.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.", + type: "string" + } + }, + type: "object" + } + }, + type: "object" + }, + stderrConfig: { + description: "Stores configuration for the stderr stream of the step.", + properties: { + path: { + description: "Path to duplicate stdout stream to on container's local filesystem.", + type: "string" + } + }, + type: "object" + }, + stdoutConfig: { + description: "Stores configuration for the stdout stream of the step.", + properties: { + path: { + description: "Path to duplicate stdout stream to on container's local filesystem.", + type: "string" + } + }, + type: "object" + }, + timeout: { + description: "Timeout is the time after which the step times out. Defaults to never.\nRefer to Go's ParseDuration documentation for expected format: https://golang.org/pkg/time/#ParseDuration", + type: "string" + }, + volumeDevices: { + description: "volumeDevices is the list of block devices to be used by the Step.", + items: { + description: "volumeDevice describes a mapping of a raw block device within a container.", + properties: { + devicePath: { + description: "devicePath is the path inside of the container that the device will be mapped to.", + type: "string" + }, + name: { + description: "name must match the name of a persistentVolumeClaim in the pod", + type: "string" + } + }, + required: ["devicePath", "name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + volumeMounts: { + description: "Volumes to mount into the Step's filesystem.\nCannot be updated.", + items: { + description: "VolumeMount describes a mounting of a Volume within a container.", + properties: { + mountPath: { + description: "Path within the container at which the volume should be mounted. Must\nnot contain ':'.", + type: "string" + }, + mountPropagation: { + description: "mountPropagation determines how mounts are propagated from the host\nto container and the other way around.\nWhen not set, MountPropagationNone is used.\nThis field is beta in 1.10.\nWhen RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified\n(which defaults to None).", + type: "string" + }, + name: { + description: "This must match the Name of a Volume.", + type: "string" + }, + readOnly: { + description: "Mounted read-only if true, read-write otherwise (false or unspecified).\nDefaults to false.", + type: "boolean" + }, + recursiveReadOnly: { + description: "RecursiveReadOnly specifies whether read-only mounts should be handled\nrecursively.\n\nIf ReadOnly is false, this field has no meaning and must be unspecified.\n\nIf ReadOnly is true, and this field is set to Disabled, the mount is not made\nrecursively read-only. If this field is set to IfPossible, the mount is made\nrecursively read-only, if it is supported by the container runtime. If this\nfield is set to Enabled, the mount is made recursively read-only if it is\nsupported by the container runtime, otherwise the pod will not be started and\nan error will be generated to indicate the reason.\n\nIf this field is set to IfPossible or Enabled, MountPropagation must be set to\nNone (or be unspecified, which defaults to None).\n\nIf this field is not specified, it is treated as an equivalent of Disabled.", + type: "string" + }, + subPath: { + description: "Path within the volume from which the container's volume should be mounted.\nDefaults to \"\" (volume's root).", + type: "string" + }, + subPathExpr: { + description: "Expanded path within the volume from which the container's volume should be mounted.\nBehaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment.\nDefaults to \"\" (volume's root).\nSubPathExpr and SubPath are mutually exclusive.", + type: "string" + } + }, + required: ["mountPath", "name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + when: { + description: "When is a list of when expressions that need to be true for the task to run", + items: { + description: "WhenExpression allows a PipelineTask to declare expressions to be evaluated before the Task is run\nto determine whether the Task should be executed or skipped", + properties: { + cel: { + description: "CEL is a string of Common Language Expression, which can be used to conditionally execute\nthe task based on the result of the expression evaluation\nMore info about CEL syntax: https://github.com/google/cel-spec/blob/master/doc/langdef.md", + type: "string" + }, + input: { + description: "Input is the string for guard checking which can be a static input or an output from a parent Task", + type: "string" + }, + operator: { + description: "Operator that represents an Input's relationship to the values", + type: "string" + }, + values: { + description: "Values is an array of strings, which is compared against the input, for guard checking\nIt must be non-empty", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + type: "array" + }, + workingDir: { + description: "Step's working directory.\nIf not specified, the container runtime's default will be used, which\nmight be configured in the container image.\nCannot be updated.", + type: "string" + }, + workspaces: { + description: "This is an alpha field. You must set the \"enable-api-fields\" feature flag to \"alpha\"\nfor this field to be supported.\n\nWorkspaces is a list of workspaces from the Task that this Step wants\nexclusive access to. Adding a workspace to this list means that any\nother Step or Sidecar that does not also request this Workspace will\nnot have access to it.", + items: { + description: "WorkspaceUsage is used by a Step or Sidecar to declare that it wants isolated access\nto a Workspace defined in a Task.", + properties: { + mountPath: { + description: "MountPath is the path that the workspace should be mounted to inside the Step or Sidecar,\noverriding any MountPath specified in the Task's WorkspaceDeclaration.", + type: "string" + }, + name: { + description: "Name is the name of the workspace this Step or Sidecar wants access to.", + type: "string" + } + }, + required: ["mountPath", "name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + required: ["name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + stepTemplate: { + description: "StepTemplate can be used as the basis for all step containers within the\nTask, so that the steps inherit settings on the base container.", + properties: { + args: { + description: "Arguments to the entrypoint.\nThe image's CMD is used if this is not provided.\nVariable references $(VAR_NAME) are expanded using the Step's environment. If a variable\ncannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced\nto a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. \"$$(VAR_NAME)\" will\nproduce the string literal \"$(VAR_NAME)\". Escaped references will never be expanded, regardless\nof whether the variable exists or not. Cannot be updated.\nMore info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + command: { + description: "Entrypoint array. Not executed within a shell.\nThe image's ENTRYPOINT is used if this is not provided.\nVariable references $(VAR_NAME) are expanded using the Step's environment. If a variable\ncannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced\nto a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. \"$$(VAR_NAME)\" will\nproduce the string literal \"$(VAR_NAME)\". Escaped references will never be expanded, regardless\nof whether the variable exists or not. Cannot be updated.\nMore info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + computeResources: { + description: "ComputeResources required by this Step.\nCannot be updated.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + properties: { + claims: { + description: "Claims lists the names of resources, defined in spec.resourceClaims,\nthat are used by this container.\n\nThis field depends on the\nDynamicResourceAllocation feature gate.\n\nThis field is immutable. It can only be set for containers.", + items: { + description: "ResourceClaim references one entry in PodSpec.ResourceClaims.", + properties: { + name: { + description: "Name must match the name of one entry in pod.spec.resourceClaims of\nthe Pod where this field is used. It makes that resource available\ninside a container.", + type: "string" + }, + request: { + description: "Request is the name chosen for a request in the referenced claim.\nIf empty, everything from the claim is made available, otherwise\nonly the result of this request.", + type: "string" + } + }, + required: ["name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-map-keys": ["name"], + "x-kubernetes-list-type": "map" + }, + limits: { + additionalProperties: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + }, + description: "Limits describes the maximum amount of compute resources allowed.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + type: "object" + }, + requests: { + additionalProperties: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + }, + description: "Requests describes the minimum amount of compute resources required.\nIf Requests is omitted for a container, it defaults to Limits if that is explicitly specified,\notherwise to an implementation-defined value. Requests cannot exceed Limits.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + type: "object" + } + }, + type: "object" + }, + env: { + description: "List of environment variables to set in the Step.\nCannot be updated.", + items: { + description: "EnvVar represents an environment variable present in a Container.", + properties: { + name: { + description: "Name of the environment variable.\nMay consist of any printable ASCII characters except '='.", + type: "string" + }, + value: { + description: "Variable references $(VAR_NAME) are expanded\nusing the previously defined environment variables in the container and\nany service environment variables. If a variable cannot be resolved,\nthe reference in the input string will be unchanged. Double $$ are reduced\nto a single $, which allows for escaping the $(VAR_NAME) syntax: i.e.\n\"$$(VAR_NAME)\" will produce the string literal \"$(VAR_NAME)\".\nEscaped references will never be expanded, regardless of whether the variable\nexists or not.\nDefaults to \"\".", + type: "string" + }, + valueFrom: { + description: "Source for the environment variable's value. Cannot be used if value is not empty.", + properties: { + configMapKeyRef: { + description: "Selects a key of a ConfigMap.", + properties: { + key: { + description: "The key to select.", + type: "string" + }, + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "Specify whether the ConfigMap or its key must be defined", + type: "boolean" + } + }, + required: ["key"], + type: "object", + "x-kubernetes-map-type": "atomic" + }, + fieldRef: { + description: "Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`,\nspec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs.", + properties: { + apiVersion: { + description: "Version of the schema the FieldPath is written in terms of, defaults to \"v1\".", + type: "string" + }, + fieldPath: { + description: "Path of the field to select in the specified API version.", + type: "string" + } + }, + required: ["fieldPath"], + type: "object", + "x-kubernetes-map-type": "atomic" + }, + fileKeyRef: { + description: "FileKeyRef selects a key of the env file.\nRequires the EnvFiles feature gate to be enabled.", + properties: { + key: { + description: "The key within the env file. An invalid key will prevent the pod from starting.\nThe keys defined within a source may consist of any printable ASCII characters except '='.\nDuring Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.", + type: "string" + }, + optional: { + default: false, + description: "Specify whether the file or its key must be defined. If the file or key\ndoes not exist, then the env var is not published.\nIf optional is set to true and the specified key does not exist,\nthe environment variable will not be set in the Pod's containers.\n\nIf optional is set to false and the specified key does not exist,\nan error will be returned during Pod creation.", + type: "boolean" + }, + path: { + description: "The path within the volume from which to select the file.\nMust be relative and may not contain the '..' path or start with '..'.", + type: "string" + }, + volumeName: { + description: "The name of the volume mount containing the env file.", + type: "string" + } + }, + required: ["key", "path", "volumeName"], + type: "object", + "x-kubernetes-map-type": "atomic" + }, + resourceFieldRef: { + description: "Selects a resource of the container: only resources limits and requests\n(limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported.", + properties: { + containerName: { + description: "Container name: required for volumes, optional for env vars", + type: "string" + }, + divisor: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Specifies the output format of the exposed resources, defaults to \"1\"", + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + }, + resource: { + description: "Required: resource to select", + type: "string" + } + }, + required: ["resource"], + type: "object", + "x-kubernetes-map-type": "atomic" + }, + secretKeyRef: { + description: "Selects a key of a secret in the pod's namespace", + properties: { + key: { + description: "The key of the secret to select from. Must be a valid secret key.", + type: "string" + }, + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "Specify whether the Secret or its key must be defined", + type: "boolean" + } + }, + required: ["key"], + type: "object", + "x-kubernetes-map-type": "atomic" + } + }, + type: "object" + } + }, + required: ["name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + envFrom: { + description: "List of sources to populate environment variables in the Step.\nThe keys defined within a source must be a C_IDENTIFIER. All invalid keys\nwill be reported as an event when the Step is starting. When a key exists in multiple\nsources, the value associated with the last source will take precedence.\nValues defined by an Env with a duplicate key will take precedence.\nCannot be updated.", + items: { + description: "EnvFromSource represents the source of a set of ConfigMaps or Secrets", + properties: { + configMapRef: { + description: "The ConfigMap to select from", + properties: { + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "Specify whether the ConfigMap must be defined", + type: "boolean" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + prefix: { + description: "Optional text to prepend to the name of each environment variable.\nMay consist of any printable ASCII characters except '='.", + type: "string" + }, + secretRef: { + description: "The Secret to select from", + properties: { + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "Specify whether the Secret must be defined", + type: "boolean" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + } + }, + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + image: { + description: "Image reference name.\nMore info: https://kubernetes.io/docs/concepts/containers/images", + type: "string" + }, + imagePullPolicy: { + description: "Image pull policy.\nOne of Always, Never, IfNotPresent.\nDefaults to Always if :latest tag is specified, or IfNotPresent otherwise.\nCannot be updated.\nMore info: https://kubernetes.io/docs/concepts/containers/images#updating-images", + type: "string" + }, + securityContext: { + description: "SecurityContext defines the security options the Step should be run with.\nIf set, the fields of SecurityContext override the equivalent fields of PodSecurityContext.\nMore info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/", + properties: { + allowPrivilegeEscalation: { + description: "AllowPrivilegeEscalation controls whether a process can gain more\nprivileges than its parent process. This bool directly controls if\nthe no_new_privs flag will be set on the container process.\nAllowPrivilegeEscalation is true always when the container is:\n1) run as Privileged\n2) has CAP_SYS_ADMIN\nNote that this field cannot be set when spec.os.name is windows.", + type: "boolean" + }, + appArmorProfile: { + description: "appArmorProfile is the AppArmor options to use by this container. If set, this profile\noverrides the pod's appArmorProfile.\nNote that this field cannot be set when spec.os.name is windows.", + properties: { + localhostProfile: { + description: "localhostProfile indicates a profile loaded on the node that should be used.\nThe profile must be preconfigured on the node to work.\nMust match the loaded name of the profile.\nMust be set if and only if type is \"Localhost\".", + type: "string" + }, + type: { + description: "type indicates which kind of AppArmor profile will be applied.\nValid options are:\n Localhost - a profile pre-loaded on the node.\n RuntimeDefault - the container runtime's default profile.\n Unconfined - no AppArmor enforcement.", + type: "string" + } + }, + required: ["type"], + type: "object" + }, + capabilities: { + description: "The capabilities to add/drop when running containers.\nDefaults to the default set of capabilities granted by the container runtime.\nNote that this field cannot be set when spec.os.name is windows.", + properties: { + add: { + description: "Added capabilities", + items: { + description: "Capability represent POSIX capabilities type", + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + drop: { + description: "Removed capabilities", + items: { + description: "Capability represent POSIX capabilities type", + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + privileged: { + description: "Run container in privileged mode.\nProcesses in privileged containers are essentially equivalent to root on the host.\nDefaults to false.\nNote that this field cannot be set when spec.os.name is windows.", + type: "boolean" + }, + procMount: { + description: "procMount denotes the type of proc mount to use for the containers.\nThe default value is Default which uses the container runtime defaults for\nreadonly paths and masked paths.\nThis requires the ProcMountType feature flag to be enabled.\nNote that this field cannot be set when spec.os.name is windows.", + type: "string" + }, + readOnlyRootFilesystem: { + description: "Whether this container has a read-only root filesystem.\nDefault is false.\nNote that this field cannot be set when spec.os.name is windows.", + type: "boolean" + }, + runAsGroup: { + description: "The GID to run the entrypoint of the container process.\nUses runtime default if unset.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is windows.", + format: "int64", + type: "integer" + }, + runAsNonRoot: { + description: "Indicates that the container must run as a non-root user.\nIf true, the Kubelet will validate the image at runtime to ensure that it\ndoes not run as UID 0 (root) and fail to start the container if it does.\nIf unset or false, no such validation will be performed.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.", + type: "boolean" + }, + runAsUser: { + description: "The UID to run the entrypoint of the container process.\nDefaults to user specified in image metadata if unspecified.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is windows.", + format: "int64", + type: "integer" + }, + seccompProfile: { + description: "The seccomp options to use by this container. If seccomp options are\nprovided at both the pod & container level, the container options\noverride the pod options.\nNote that this field cannot be set when spec.os.name is windows.", + properties: { + localhostProfile: { + description: "localhostProfile indicates a profile defined in a file on the node should be used.\nThe profile must be preconfigured on the node to work.\nMust be a descending path, relative to the kubelet's configured seccomp profile location.\nMust be set if type is \"Localhost\". Must NOT be set for any other type.", + type: "string" + }, + type: { + description: "type indicates which kind of seccomp profile will be applied.\nValid options are:\n\nLocalhost - a profile defined in a file on the node should be used.\nRuntimeDefault - the container runtime default profile should be used.\nUnconfined - no profile should be applied.", + type: "string" + } + }, + required: ["type"], + type: "object" + }, + seLinuxOptions: { + description: "The SELinux context to be applied to the container.\nIf unspecified, the container runtime will allocate a random SELinux context for each\ncontainer. May also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is windows.", + properties: { + level: { + description: "Level is SELinux level label that applies to the container.", + type: "string" + }, + role: { + description: "Role is a SELinux role label that applies to the container.", + type: "string" + }, + type: { + description: "Type is a SELinux type label that applies to the container.", + type: "string" + }, + user: { + description: "User is a SELinux user label that applies to the container.", + type: "string" + } + }, + type: "object" + }, + windowsOptions: { + description: "The Windows specific settings applied to all containers.\nIf unspecified, the options from the PodSecurityContext will be used.\nIf set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is linux.", + properties: { + gmsaCredentialSpec: { + description: "GMSACredentialSpec is where the GMSA admission webhook\n(https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the\nGMSA credential spec named by the GMSACredentialSpecName field.", + type: "string" + }, + gmsaCredentialSpecName: { + description: "GMSACredentialSpecName is the name of the GMSA credential spec to use.", + type: "string" + }, + hostProcess: { + description: "HostProcess determines if a container should be run as a 'Host Process' container.\nAll of a Pod's containers must have the same effective HostProcess value\n(it is not allowed to have a mix of HostProcess containers and non-HostProcess containers).\nIn addition, if HostProcess is true then HostNetwork must also be set to true.", + type: "boolean" + }, + runAsUserName: { + description: "The UserName in Windows to run the entrypoint of the container process.\nDefaults to the user specified in image metadata if unspecified.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.", + type: "string" + } + }, + type: "object" + } + }, + type: "object" + }, + volumeDevices: { + description: "volumeDevices is the list of block devices to be used by the Step.", + items: { + description: "volumeDevice describes a mapping of a raw block device within a container.", + properties: { + devicePath: { + description: "devicePath is the path inside of the container that the device will be mapped to.", + type: "string" + }, + name: { + description: "name must match the name of a persistentVolumeClaim in the pod", + type: "string" + } + }, + required: ["devicePath", "name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + volumeMounts: { + description: "Volumes to mount into the Step's filesystem.\nCannot be updated.", + items: { + description: "VolumeMount describes a mounting of a Volume within a container.", + properties: { + mountPath: { + description: "Path within the container at which the volume should be mounted. Must\nnot contain ':'.", + type: "string" + }, + mountPropagation: { + description: "mountPropagation determines how mounts are propagated from the host\nto container and the other way around.\nWhen not set, MountPropagationNone is used.\nThis field is beta in 1.10.\nWhen RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified\n(which defaults to None).", + type: "string" + }, + name: { + description: "This must match the Name of a Volume.", + type: "string" + }, + readOnly: { + description: "Mounted read-only if true, read-write otherwise (false or unspecified).\nDefaults to false.", + type: "boolean" + }, + recursiveReadOnly: { + description: "RecursiveReadOnly specifies whether read-only mounts should be handled\nrecursively.\n\nIf ReadOnly is false, this field has no meaning and must be unspecified.\n\nIf ReadOnly is true, and this field is set to Disabled, the mount is not made\nrecursively read-only. If this field is set to IfPossible, the mount is made\nrecursively read-only, if it is supported by the container runtime. If this\nfield is set to Enabled, the mount is made recursively read-only if it is\nsupported by the container runtime, otherwise the pod will not be started and\nan error will be generated to indicate the reason.\n\nIf this field is set to IfPossible or Enabled, MountPropagation must be set to\nNone (or be unspecified, which defaults to None).\n\nIf this field is not specified, it is treated as an equivalent of Disabled.", + type: "string" + }, + subPath: { + description: "Path within the volume from which the container's volume should be mounted.\nDefaults to \"\" (volume's root).", + type: "string" + }, + subPathExpr: { + description: "Expanded path within the volume from which the container's volume should be mounted.\nBehaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment.\nDefaults to \"\" (volume's root).\nSubPathExpr and SubPath are mutually exclusive.", + type: "string" + } + }, + required: ["mountPath", "name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + workingDir: { + description: "Step's working directory.\nIf not specified, the container runtime's default will be used, which\nmight be configured in the container image.\nCannot be updated.", + type: "string" + } + }, + type: "object" + }, + volumes: { + description: "Volumes is a collection of volumes that are available to mount into the\nsteps of the build.\nSee Pod.spec.volumes (API version: v1)", + "x-kubernetes-preserve-unknown-fields": true + }, + workspaces: { + description: "Workspaces are the volumes that this Task requires.", + items: { + description: "WorkspaceDeclaration is a declaration of a volume that a Task requires.", + properties: { + description: { + description: "Description is an optional human readable description of this volume.", + type: "string" + }, + mountPath: { + description: "MountPath overrides the directory that the volume will be made available at.", + type: "string" + }, + name: { + description: "Name is the name by which you can bind the volume at runtime.", + type: "string" + }, + optional: { + description: "Optional marks a Workspace as not being required in TaskRuns. By default\nthis field is false and so declared workspaces are required.", + type: "boolean" + }, + readOnly: { + description: "ReadOnly dictates whether a mounted volume is writable. By default this\nfield is false and so mounted volumes are writable.", + type: "boolean" + } + }, + required: ["name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + } + }, + required: ["podName"], + type: "object" + } + }, + type: "object" + } + }, + served: true, + storage: true, + subresources: { + status: {} + } + }] + } +}; +export const CustomResourceDefinition_VerificationpoliciesTektonDev: KubernetesResource = { + apiVersion: "apiextensions.k8s.io/v1", + kind: "CustomResourceDefinition", + metadata: { + labels: { + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/part-of": "tekton-pipelines", + "pipeline.tekton.dev/release": "v1.15.0", + version: "v1.15.0" + }, + name: "verificationpolicies.tekton.dev" + }, + spec: { + group: "tekton.dev", + names: { + categories: ["tekton", "tekton-pipelines"], + kind: "VerificationPolicy", + plural: "verificationpolicies", + singular: "verificationpolicy" + }, + scope: "Namespaced", + versions: [{ + name: "v1alpha1", + schema: { + openAPIV3Schema: { + description: "VerificationPolicy defines the rules to verify Tekton resources.\nVerificationPolicy can config the mapping from resources to a list of public\nkeys, so when verifying the resources we can use the corresponding public keys.", + properties: { + apiVersion: { + description: "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", + type: "string" + }, + kind: { + description: "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + type: "string" + }, + metadata: { + type: "object" + }, + spec: { + description: "Spec holds the desired state of the VerificationPolicy.", + properties: { + authorities: { + description: "Authorities defines the rules for validating signatures.", + items: { + description: "The Authority block defines the keys for validating signatures.", + properties: { + key: { + description: "Key contains the public key to validate the resource.", + properties: { + data: { + description: "Data contains the inline public key.", + type: "string" + }, + hashAlgorithm: { + description: "HashAlgorithm always defaults to sha256 if the algorithm hasn't been explicitly set", + type: "string" + }, + kms: { + description: "KMS contains the KMS url of the public key\nSupported formats differ based on the KMS system used.\nOne example of a KMS url could be:\ngcpkms://projects/[PROJECT]/locations/[LOCATION]>/keyRings/[KEYRING]/cryptoKeys/[KEY]/cryptoKeyVersions/[KEY_VERSION]\nFor more examples please refer https://docs.sigstore.dev/cosign/kms_support.\nNote that the KMS is not supported yet.", + type: "string" + }, + secretRef: { + description: "SecretRef sets a reference to a secret with the key.", + properties: { + name: { + description: "name is unique within a namespace to reference a secret resource.", + type: "string" + }, + namespace: { + description: "namespace defines the space within which the secret name must be unique.", + type: "string" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + } + }, + type: "object" + }, + name: { + description: "Name is the name for this authority.", + type: "string" + } + }, + required: ["name"], + type: "object" + }, + type: "array" + }, + mode: { + description: "Mode controls whether a failing policy will fail the taskrun/pipelinerun, or only log the warnings\nenforce - fail the taskrun/pipelinerun if verification fails (default)\nwarn - don't fail the taskrun/pipelinerun if verification fails but log warnings", + type: "string" + }, + resources: { + description: "Resources defines the patterns of resources sources that should be subject to this policy.\nFor example, we may want to apply this Policy from a certain GitHub repo.\nThen the ResourcesPattern should be valid regex. E.g. If using gitresolver, and we want to config keys from a certain git repo.\n`ResourcesPattern` can be `https://github.com/tektoncd/catalog.git`, we will use regex to filter out those resources.", + items: { + description: "ResourcePattern defines the pattern of the resource source", + properties: { + pattern: { + description: "Pattern defines a resource pattern. Regex is created to filter resources based on `Pattern`\nExample patterns:\nGitHub resource: https://github.com/tektoncd/catalog.git, https://github.com/tektoncd/*\nBundle resource: gcr.io/tekton-releases/catalog/upstream/git-clone, gcr.io/tekton-releases/catalog/upstream/*\nHub resource: https://artifacthub.io/*,", + type: "string" + } + }, + required: ["pattern"], + type: "object" + }, + type: "array" + } + }, + required: ["authorities", "resources"], + type: "object" + } + }, + required: ["spec"], + type: "object" + } + }, + served: true, + storage: true + }] + } +}; +export const Secret_WebhookCerts: KubernetesResource = { + apiVersion: "v1", + kind: "Secret", + metadata: { + labels: { + "app.kubernetes.io/component": "webhook", + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/part-of": "tekton-pipelines", + "pipeline.tekton.dev/release": "v1.15.0" + }, + name: "webhook-certs", + namespace: "tekton-pipelines" + } +}; +export const ValidatingWebhookConfiguration_ValidationWebhookPipelineTektonDev: KubernetesResource = { + apiVersion: "admissionregistration.k8s.io/v1", + kind: "ValidatingWebhookConfiguration", + metadata: { + labels: { + "app.kubernetes.io/component": "webhook", + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/part-of": "tekton-pipelines", + "pipeline.tekton.dev/release": "v1.15.0" + }, + name: "validation.webhook.pipeline.tekton.dev" + }, + webhooks: [{ + admissionReviewVersions: ["v1"], + clientConfig: { + service: { + name: "tekton-pipelines-webhook", + namespace: "tekton-pipelines" + } + }, + failurePolicy: "Fail", + name: "validation.webhook.pipeline.tekton.dev", + sideEffects: "None" + }] +}; +export const MutatingWebhookConfiguration_WebhookPipelineTektonDev: KubernetesResource = { + apiVersion: "admissionregistration.k8s.io/v1", + kind: "MutatingWebhookConfiguration", + metadata: { + labels: { + "app.kubernetes.io/component": "webhook", + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/part-of": "tekton-pipelines", + "pipeline.tekton.dev/release": "v1.15.0" + }, + name: "webhook.pipeline.tekton.dev" + }, + webhooks: [{ + admissionReviewVersions: ["v1"], + clientConfig: { + service: { + name: "tekton-pipelines-webhook", + namespace: "tekton-pipelines" + } + }, + failurePolicy: "Fail", + name: "webhook.pipeline.tekton.dev", + sideEffects: "None" + }] +}; +export const ValidatingWebhookConfiguration_ConfigWebhookPipelineTektonDev: KubernetesResource = { + apiVersion: "admissionregistration.k8s.io/v1", + kind: "ValidatingWebhookConfiguration", + metadata: { + labels: { + "app.kubernetes.io/component": "webhook", + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/part-of": "tekton-pipelines", + "pipeline.tekton.dev/release": "v1.15.0" + }, + name: "config.webhook.pipeline.tekton.dev" + }, + webhooks: [{ + admissionReviewVersions: ["v1"], + clientConfig: { + service: { + name: "tekton-pipelines-webhook", + namespace: "tekton-pipelines" + } + }, + failurePolicy: "Fail", + name: "config.webhook.pipeline.tekton.dev", + objectSelector: { + matchLabels: { + "app.kubernetes.io/part-of": "tekton-pipelines" + } + }, + sideEffects: "None" + }] +}; +export const ClusterRole_TektonAggregateEdit: KubernetesResource = { + apiVersion: "rbac.authorization.k8s.io/v1", + kind: "ClusterRole", + metadata: { + labels: { + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/part-of": "tekton-pipelines", + "rbac.authorization.k8s.io/aggregate-to-admin": "true", + "rbac.authorization.k8s.io/aggregate-to-edit": "true" + }, + name: "tekton-aggregate-edit" + }, + rules: [{ + apiGroups: ["tekton.dev"], + resources: ["tasks", "taskruns", "pipelines", "pipelineruns", "runs", "customruns", "stepactions"], + verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"] + }] +}; +export const ClusterRole_TektonAggregateView: KubernetesResource = { + apiVersion: "rbac.authorization.k8s.io/v1", + kind: "ClusterRole", + metadata: { + labels: { + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/part-of": "tekton-pipelines", + "rbac.authorization.k8s.io/aggregate-to-view": "true" + }, + name: "tekton-aggregate-view" + }, + rules: [{ + apiGroups: ["tekton.dev"], + resources: ["tasks", "taskruns", "pipelines", "pipelineruns", "runs", "customruns", "stepactions"], + verbs: ["get", "list", "watch"] + }] +}; +export const ConfigMap_ConfigDefaults: KubernetesResource = { + apiVersion: "v1", + kind: "ConfigMap", + metadata: { + labels: { + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/part-of": "tekton-pipelines" + }, + name: "config-defaults", + namespace: "tekton-pipelines" + }, + data: { + _example: "################################\n# #\n# EXAMPLE CONFIGURATION #\n# #\n################################\n\n# This block is not actually functional configuration,\n# but serves to illustrate the available configuration\n# options and document them in a way that is accessible\n# to users that `kubectl edit` this config map.\n#\n# These sample configuration options may be copied out of\n# this example block and unindented to be in the data block\n# to actually change the configuration.\n\n# default-timeout-minutes contains the default number of\n# minutes to use for TaskRun and PipelineRun, if none is specified.\ndefault-timeout-minutes: \"60\" # 60 minutes\n\n# default-service-account contains the default service account name\n# to use for TaskRun and PipelineRun, if none is specified.\ndefault-service-account: \"default\"\n\n# default-managed-by-label-value contains the default value given to the\n# \"app.kubernetes.io/managed-by\" label applied to all Pods created for\n# TaskRuns. If a user's requested TaskRun specifies another value for this\n# label, the user's request supercedes.\ndefault-managed-by-label-value: \"tekton-pipelines\"\n\n# default-pod-template contains the default pod template to use for\n# TaskRun and PipelineRun. If a pod template is specified on the\n# PipelineRun, the default-pod-template is merged with that one.\n# default-pod-template:\n\n# default-affinity-assistant-pod-template contains the default pod template\n# to use for affinity assistant pods. If a pod template is specified on the\n# PipelineRun, the default-affinity-assistant-pod-template is merged with\n# that one.\n# default-affinity-assistant-pod-template:\n\n# default-cloud-events-sink contains the default CloudEvents sink to be\n# used for TaskRun and PipelineRun, when no sink is specified.\n# Note that right now it is still not possible to set a PipelineRun or\n# TaskRun specific sink, so the default is the only option available.\n# If no sink is specified, no CloudEvent is generated\n# default-cloud-events-sink:\n\n# default-task-run-workspace-binding contains the default workspace\n# configuration provided for any Workspaces that a Task declares\n# but that a TaskRun does not explicitly provide.\n# default-task-run-workspace-binding: |\n# emptyDir: {}\n\n# default-max-matrix-combinations-count contains the default maximum number\n# of combinations from a Matrix, if none is specified.\ndefault-max-matrix-combinations-count: \"256\"\n\n# default-forbidden-env contains comma seperated environment variables that cannot be\n# overridden by podTemplate.\ndefault-forbidden-env:\n\n# default-resolver-type contains the default resolver type to be used in the cluster,\n# no default-resolver-type is specified by default\ndefault-resolver-type:\n\n# default-imagepullbackoff-timeout contains the default duration to wait\n# before requeuing the TaskRun to retry, specifying 0 here is equivalent to fail fast\n# possible values could be 1m, 5m, 10s, 1h, etc\n# default-imagepullbackoff-timeout: \"5m\"\n\n# default-create-container-error-timeout contains the default duration to wait\n# before failing a TaskRun when a container fails with \"context deadline exceeded\"\n# (e.g. CRI-O under heavy load). Specifying 0 here is equivalent to fail fast.\n# possible values could be 1m, 5m, 10s, 1h, etc\n# default-create-container-error-timeout: \"5m\"\n\n# default-maximum-resolution-timeout specifies the default duration used by the\n# resolution controller before timing out when exceeded.\n# Possible values include \"1m\", \"5m\", \"10s\", \"1h\", etc.\n# Example: default-maximum-resolution-timeout: \"1m\"\n\n# default-container-resource-requirements allow users to configure default resource\n# requirements for init containers and containers in pods created by the controller.\n# No resource requirements are applied by default when this key is unset.\n# Note: All the resource requirements are applied to init-containers and containers\n# only if the existing resource requirements are empty, except Tekton internal\n# containers can be overridden by named entries such as prepare or place-scripts.\n# default-container-resource-requirements: |\n# place-scripts: # updates resource requirements of a 'place-scripts' container\n# requests:\n# memory: \"64Mi\"\n# cpu: \"250m\"\n# limits:\n# memory: \"128Mi\"\n# cpu: \"500m\"\n#\n# prepare: # updates resource requirements of a 'prepare' container\n# requests:\n# memory: \"64Mi\"\n# cpu: \"250m\"\n# limits:\n# memory: \"256Mi\"\n# cpu: \"500m\"\n#\n# working-dir-initializer: # updates resource requirements of a 'working-dir-initializer' container\n# requests:\n# memory: \"64Mi\"\n# cpu: \"250m\"\n# limits:\n# memory: \"512Mi\"\n# cpu: \"500m\"\n#\n# prefix-scripts: # updates resource requirements of containers which starts with 'scripts-'\n# requests:\n# memory: \"64Mi\"\n# cpu: \"250m\"\n# limits:\n# memory: \"128Mi\"\n# cpu: \"500m\"\n#\n# prefix-sidecar-scripts: # updates resource requirements of containers which starts with 'sidecar-scripts-'\n# requests:\n# memory: \"64Mi\"\n# cpu: \"250m\"\n# limits:\n# memory: \"128Mi\"\n# cpu: \"500m\"\n#\n# default: # updates resource requirements of init-containers and containers which has empty resource requirements\n# requests:\n# memory: \"64Mi\"\n# cpu: \"250m\"\n# limits:\n# memory: \"256Mi\"\n# cpu: \"500m\"\n\n# default-sidecar-log-polling-interval specifies the polling interval for the Tekton sidecar log results container.\n# This controls how frequently the sidecar checks for step completion files written by steps in a TaskRun.\n# Lower values (e.g., \"10ms\") make the sidecar more responsive but may increase CPU usage; higher values (e.g., \"1s\")\n# reduce resource usage but may delay result collection.\n# This value is used by the sidecar-tekton-log-results container and can be tuned for performance or test scenarios.\n# Example values: \"100ms\", \"500ms\", \"1s\"\ndefault-sidecar-log-polling-interval: \"100ms\"\n\n# default-step-ref-concurrency-limit specifies the concurrency limit for resolving step references.\n# This setting controls the maximum number of concurrent goroutines used to resolve\n# step references (`step.ref` fields) simultaneously. This limit acts as a throttle\n# to prevent overwhelming remote servers (e.g., git providers, OCI registries) or\n# the Kubernetes API server, especially when a TaskRun contains many steps that\n# reference StepActions.\ndefault-step-ref-concurrency-limit: \"5\"\n" + } +}; +export const ConfigMap_ConfigEvents: KubernetesResource = { + apiVersion: "v1", + kind: "ConfigMap", + metadata: { + labels: { + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/part-of": "tekton-pipelines" + }, + name: "config-events", + namespace: "tekton-pipelines" + }, + data: { + _example: "################################\n# #\n# EXAMPLE CONFIGURATION #\n# #\n################################\n\n# This block is not actually functional configuration,\n# but serves to illustrate the available configuration\n# options and document them in a way that is accessible\n# to users that `kubectl edit` this config map.\n#\n# These sample configuration options may be copied out of\n# this example block and unindented to be in the data block\n# to actually change the configuration.\n\n# formats contains a comma separated list of event formats to be used\n# the only format supported today is \"tektonv1\". An empty string is not\n# a valid configuration. To disable events, do not specify the sink.\nformats: \"tektonv1\"\n\n# sink contains the event sink to be used for TaskRun, PipelineRun and\n# CustomRun. If no sink is specified, no CloudEvent is generated.\n# This setting supercedes the \"default-cloud-events-sink\" from the\n# \"config-defaults\" config map\nsink: \"https://events.sink/cdevents\"\n" + } +}; +export const ConfigMap_FeatureFlags: KubernetesResource = { + apiVersion: "v1", + kind: "ConfigMap", + metadata: { + labels: { + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/part-of": "tekton-pipelines" + }, + name: "feature-flags", + namespace: "tekton-pipelines" + }, + data: { + "await-sidecar-readiness": "true", + coschedule: "workspaces", + "disable-creds-init": "false", + "disable-inline-spec": "", + "enable-api-fields": "beta", + "enable-artifacts": "false", + "enable-cel-in-whenexpression": "false", + "enable-concise-resolver-syntax": "false", + "enable-informer-cache-transforms": "true", + "enable-kubernetes-sidecar": "false", + "enable-param-enum": "false", + "enable-provenance-in-status": "true", + "enable-step-actions": "true", + "enable-tekton-oci-bundles": "false", + "enable-termination-message-compression": "false", + "enable-wait-exponential-backoff": "false", + "enforce-nonfalsifiability": "none", + "keep-pod-on-cancel": "false", + "require-git-ssh-secret-known-hosts": "false", + "results-from": "termination-message", + "running-in-environment-with-injected-sidecars": "true", + "send-cloudevents-for-runs": "true", + "set-security-context": "false", + "set-security-context-read-only-root-filesystem": "false", + "trusted-resources-verification-no-match-policy": "ignore" + } +}; +export const ConfigMap_PipelinesInfo: KubernetesResource = { + apiVersion: "v1", + kind: "ConfigMap", + metadata: { + labels: { + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/part-of": "tekton-pipelines" + }, + name: "pipelines-info", + namespace: "tekton-pipelines" + }, + data: { + version: "v1.15.0" + } +}; +export const ConfigMap_ConfigLeaderElectionController: KubernetesResource = { + apiVersion: "v1", + kind: "ConfigMap", + metadata: { + labels: { + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/part-of": "tekton-pipelines" + }, + name: "config-leader-election-controller", + namespace: "tekton-pipelines" + }, + data: { + _example: "################################\n# #\n# EXAMPLE CONFIGURATION #\n# #\n################################\n# This block is not actually functional configuration,\n# but serves to illustrate the available configuration\n# options and document them in a way that is accessible\n# to users that `kubectl edit` this config map.\n#\n# These sample configuration options may be copied out of\n# this example block and unindented to be in the data block\n# to actually change the configuration.\n# lease-duration is how long non-leaders will wait to try to acquire the\n# lock; 15 seconds is the value used by core kubernetes controllers.\nlease-duration: \"60s\"\n# renew-deadline is how long a leader will try to renew the lease before\n# giving up; 10 seconds is the value used by core kubernetes controllers.\nrenew-deadline: \"40s\"\n# retry-period is how long the leader election client waits between tries of\n# actions; 2 seconds is the value used by core kubernetes controllers.\nretry-period: \"10s\"\n# buckets is the number of buckets used to partition key space of each\n# Reconciler. If this number is M and the replica number of the controller\n# is N, the N replicas will compete for the M buckets. The owner of a\n# bucket will take care of the reconciling for the keys partitioned into\n# that bucket.\nbuckets: \"1\"\n" + } +}; +export const ConfigMap_ConfigLeaderElectionEvents: KubernetesResource = { + apiVersion: "v1", + kind: "ConfigMap", + metadata: { + labels: { + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/part-of": "tekton-pipelines" + }, + name: "config-leader-election-events", + namespace: "tekton-pipelines" + }, + data: { + _example: "################################\n# #\n# EXAMPLE CONFIGURATION #\n# #\n################################\n# This block is not actually functional configuration,\n# but serves to illustrate the available configuration\n# options and document them in a way that is accessible\n# to users that `kubectl edit` this config map.\n#\n# These sample configuration options may be copied out of\n# this example block and unindented to be in the data block\n# to actually change the configuration.\n# lease-duration is how long non-leaders will wait to try to acquire the\n# lock; 15 seconds is the value used by core kubernetes controllers.\nlease-duration: \"60s\"\n# renew-deadline is how long a leader will try to renew the lease before\n# giving up; 10 seconds is the value used by core kubernetes controllers.\nrenew-deadline: \"40s\"\n# retry-period is how long the leader election client waits between tries of\n# actions; 2 seconds is the value used by core kubernetes controllers.\nretry-period: \"10s\"\n# buckets is the number of buckets used to partition key space of each\n# Reconciler. If this number is M and the replica number of the controller\n# is N, the N replicas will compete for the M buckets. The owner of a\n# bucket will take care of the reconciling for the keys partitioned into\n# that bucket.\nbuckets: \"1\"\n" + } +}; +export const ConfigMap_ConfigLeaderElectionWebhook: KubernetesResource = { + apiVersion: "v1", + kind: "ConfigMap", + metadata: { + labels: { + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/part-of": "tekton-pipelines" + }, + name: "config-leader-election-webhook", + namespace: "tekton-pipelines" + }, + data: { + _example: "################################\n# #\n# EXAMPLE CONFIGURATION #\n# #\n################################\n# This block is not actually functional configuration,\n# but serves to illustrate the available configuration\n# options and document them in a way that is accessible\n# to users that `kubectl edit` this config map.\n#\n# These sample configuration options may be copied out of\n# this example block and unindented to be in the data block\n# to actually change the configuration.\n# lease-duration is how long non-leaders will wait to try to acquire the\n# lock; 15 seconds is the value used by core kubernetes controllers.\nlease-duration: \"60s\"\n# renew-deadline is how long a leader will try to renew the lease before\n# giving up; 10 seconds is the value used by core kubernetes controllers.\nrenew-deadline: \"40s\"\n# retry-period is how long the leader election client waits between tries of\n# actions; 2 seconds is the value used by core kubernetes controllers.\nretry-period: \"10s\"\n# buckets is the number of buckets used to partition key space of each\n# Reconciler. If this number is M and the replica number of the controller\n# is N, the N replicas will compete for the M buckets. The owner of a\n# bucket will take care of the reconciling for the keys partitioned into\n# that bucket.\nbuckets: \"1\"\n" + } +}; +export const ConfigMap_ConfigLogging: KubernetesResource = { + apiVersion: "v1", + kind: "ConfigMap", + metadata: { + labels: { + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/part-of": "tekton-pipelines" + }, + name: "config-logging", + namespace: "tekton-pipelines" + }, + data: { + "loglevel.controller": "info", + "loglevel.webhook": "info", + "zap-logger-config": "{\n \"level\": \"info\",\n \"development\": false,\n \"sampling\": {\n \"initial\": 100,\n \"thereafter\": 100\n },\n \"outputPaths\": [\"stdout\"],\n \"errorOutputPaths\": [\"stderr\"],\n \"encoding\": \"json\",\n \"encoderConfig\": {\n \"timeKey\": \"timestamp\",\n \"levelKey\": \"severity\",\n \"nameKey\": \"logger\",\n \"callerKey\": \"caller\",\n \"messageKey\": \"message\",\n \"stacktraceKey\": \"stacktrace\",\n \"lineEnding\": \"\",\n \"levelEncoder\": \"\",\n \"timeEncoder\": \"iso8601\",\n \"durationEncoder\": \"\",\n \"callerEncoder\": \"\"\n }\n}\n" + } +}; +export const ConfigMap_ConfigObservability: KubernetesResource = { + apiVersion: "v1", + kind: "ConfigMap", + metadata: { + labels: { + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/part-of": "tekton-pipelines" + }, + name: "config-observability", + namespace: "tekton-pipelines" + }, + data: { + _example: "################################\n# #\n# EXAMPLE CONFIGURATION #\n# #\n################################\n\n# This block is not actually functional configuration,\n# but serves to illustrate the available configuration\n# options and document them in a way that is accessible\n# to users that `kubectl edit` this config map.\n#\n# These sample configuration options may be copied out of\n# this example block and unindented to be in the data block\n# to actually change the configuration.\n\n# OpenTelemetry Metrics Configuration\n# Protocol for metrics export (prometheus, grpc, http/protobuf, none)\n# Default if not specified: \"none\"\nmetrics-protocol: prometheus\n\n# Metrics endpoint (for grpc/http protocols)\n# Default: empty (uses default OTLP endpoint)\nmetrics-endpoint: \"\"\n\n# Metrics export interval (e.g., \"30s\", \"1m\")\n# Default: empty (uses default interval)\nmetrics-export-interval: \"\"\n\n# OpenTelemetry Tracing Configuration\n# Protocol for tracing export (grpc, http/protobuf, none, stdout)\n# Default: none\ntracing-protocol: none\n\n# Tracing endpoint (for grpc/http protocols)\n# Default: empty\ntracing-endpoint: \"\"\n\n# Tracing sampling rate (0.0 to 1.0)\n# Default: 1.0 (100% sampling)\ntracing-sampling-rate: \"1.0\"\n\n# Runtime Configuration\n# Enable profiling (enabled, disabled)\n# Default: disabled\nruntime-profiling: disabled\n\n# Runtime export interval (e.g., \"15s\")\n# Default: 15s\nruntime-export-interval: \"15s\"\n\n# Note: Legacy OpenCensus configuration (metrics.backend-destination, etc.) has been\n# removed as OpenCensus support is no longer provided by the underlying infrastructure.\n# Please use the OpenTelemetry configuration options above.\n\n# Tekton-specific metrics configuration\nmetrics.taskrun.level: \"task\"\nmetrics.taskrun.duration-type: \"histogram\"\nmetrics.pipelinerun.level: \"pipeline\"\nmetrics.pipelinerun.duration-type: \"histogram\"\nmetrics.count.enable-reason: \"false\"\nmetrics.running-pipelinerun.level: \"\"\n", + "metrics-protocol": "prometheus" + } +}; +export const ConfigMap_ConfigRegistryCert: KubernetesResource = { + apiVersion: "v1", + kind: "ConfigMap", + metadata: { + labels: { + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/part-of": "tekton-pipelines" + }, + name: "config-registry-cert", + namespace: "tekton-pipelines" + } +}; +export const ConfigMap_ConfigSpire: KubernetesResource = { + apiVersion: "v1", + kind: "ConfigMap", + metadata: { + labels: { + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/part-of": "tekton-pipelines" + }, + name: "config-spire", + namespace: "tekton-pipelines" + }, + data: { + _example: "################################\n# #\n# EXAMPLE CONFIGURATION #\n# #\n################################\n# This block is not actually functional configuration,\n# but serves to illustrate the available configuration\n# options and document them in a way that is accessible\n# to users that `kubectl edit` this config map.\n#\n# These sample configuration options may be copied out of\n# this example block and unindented to be in the data block\n# to actually change the configuration.\n#\n# spire-trust-domain specifies the SPIRE trust domain to use.\n# spire-trust-domain: \"example.org\"\n#\n# spire-socket-path specifies the SPIRE agent socket for SPIFFE workload API.\n# spire-socket-path: \"unix:///spiffe-workload-api/spire-agent.sock\"\n#\n# spire-server-addr specifies the SPIRE server address for workload/node registration.\n# spire-server-addr: \"spire-server.spire.svc.cluster.local:8081\"\n#\n# spire-node-alias-prefix specifies the SPIRE node alias prefix to use.\n# spire-node-alias-prefix: \"/tekton-node/\"\n" + } +}; +export const ConfigMap_ConfigTracing: KubernetesResource = { + apiVersion: "v1", + kind: "ConfigMap", + metadata: { + labels: { + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/part-of": "tekton-pipelines" + }, + name: "config-tracing", + namespace: "tekton-pipelines" + }, + data: { + _example: "################################\n# #\n# EXAMPLE CONFIGURATION #\n# #\n################################\n# This block is not actually functional configuration,\n# but serves to illustrate the available configuration\n# options and document them in a way that is accessible\n# to users that `kubectl edit` this config map.\n#\n# These sample configuration options may be copied out of\n# this example block and unindented to be in the data block\n# to actually change the configuration.\n#\n# Enable sending traces to defined endpoint by setting this to true\nenabled: \"true\"\n#\n# API endpoint to send the traces to\n# (optional): The default value is given below\nendpoint: \"http://jaeger-collector.jaeger.svc.cluster.local:4318/v1/traces\"\n# (optional) Name of the k8s secret which contains basic auth credentials\ncredentialsSecret: \"jaeger-creds\"\n" + } +}; +export const ConfigMap_ConfigWaitExponentialBackoff: KubernetesResource = { + apiVersion: "v1", + kind: "ConfigMap", + metadata: { + labels: { + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/part-of": "tekton-pipelines" + }, + name: "config-wait-exponential-backoff", + namespace: "tekton-pipelines" + }, + data: { + cap: "60s", + duration: "10s", + factor: "2.0", + jitter: "0.0", + steps: "5" + } +}; +export const Deployment_TektonPipelinesController: KubernetesResource = { + apiVersion: "apps/v1", + kind: "Deployment", + metadata: { + labels: { + "app.kubernetes.io/component": "controller", + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/name": "controller", + "app.kubernetes.io/part-of": "tekton-pipelines", + "app.kubernetes.io/version": "v1.15.0", + "pipeline.tekton.dev/release": "v1.15.0", + version: "v1.15.0" + }, + name: "tekton-pipelines-controller", + namespace: "tekton-pipelines" + }, + spec: { + replicas: 1, + selector: { + matchLabels: { + "app.kubernetes.io/component": "controller", + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/name": "controller", + "app.kubernetes.io/part-of": "tekton-pipelines" + } + }, + template: { + metadata: { + labels: { + app: "tekton-pipelines-controller", + "app.kubernetes.io/component": "controller", + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/name": "controller", + "app.kubernetes.io/part-of": "tekton-pipelines", + "app.kubernetes.io/version": "v1.15.0", + "pipeline.tekton.dev/release": "v1.15.0", + version: "v1.15.0" + } + }, + spec: { + affinity: { + nodeAffinity: { + requiredDuringSchedulingIgnoredDuringExecution: { + nodeSelectorTerms: [{ + matchExpressions: [{ + key: "kubernetes.io/os", + operator: "NotIn", + values: ["windows"] + }] + }] + } + }, + podAntiAffinity: { + preferredDuringSchedulingIgnoredDuringExecution: [{ + podAffinityTerm: { + labelSelector: { + matchLabels: { + "app.kubernetes.io/component": "controller", + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/name": "controller", + "app.kubernetes.io/part-of": "tekton-pipelines" + } + }, + topologyKey: "kubernetes.io/hostname" + }, + weight: 100 + }] + } + }, + containers: [{ + args: ["-entrypoint-image", "ghcr.io/tektoncd/pipeline/entrypoint-bff0a22da108bc2f16c818c97641a296:v1.15.0@sha256:1ae5944a51f5c5f19e575de5abf268ea7a49a3a54bdad411cf27e3142af5f5c0", "-nop-image", "ghcr.io/tektoncd/pipeline/nop-8eac7c133edad5df719dc37b36b62482:v1.15.0@sha256:f49260b33c3142f8224d26d6204b15b96b312997a169bc79fe4792981af9580c", "-sidecarlogresults-image", "ghcr.io/tektoncd/pipeline/sidecarlogresults-7501c6a20d741631510a448b48ab098f:v1.15.0@sha256:9dbe5ed48cce1324daa49784c6fc729d8b62a7c0d15c9656126bdada1a870b98", "-workingdirinit-image", "ghcr.io/tektoncd/pipeline/workingdirinit-0c558922ec6a1b739e550e349f2d5fc1:v1.15.0@sha256:fc38f8bc3c196e8f7cc2c22ea19194afd093175a23c9ab1b900cb150fd38307f", "-shell-image", "cgr.dev/chainguard/busybox@sha256:19f02276bf8dbdd62f069b922f10c65262cc34b710eea26ff928129a736be791", "-shell-image-win", "mcr.microsoft.com/powershell:nanoserver@sha256:b6d5ff841b78bdf2dfed7550000fd4f3437385b8fa686ec0f010be24777654d6"], + env: [{ + name: "SYSTEM_NAMESPACE", + valueFrom: { + fieldRef: { + fieldPath: "metadata.namespace" + } + } + }, { + name: "KUBERNETES_MIN_VERSION", + value: "v1.28.0" + }, { + name: "CONFIG_DEFAULTS_NAME", + value: "config-defaults" + }, { + name: "CONFIG_LOGGING_NAME", + value: "config-logging" + }, { + name: "CONFIG_OBSERVABILITY_NAME", + value: "config-observability" + }, { + name: "CONFIG_FEATURE_FLAGS_NAME", + value: "feature-flags" + }, { + name: "CONFIG_LEADERELECTION_NAME", + value: "config-leader-election-controller" + }, { + name: "CONFIG_SPIRE", + value: "config-spire" + }, { + name: "SSL_CERT_FILE", + value: "/etc/config-registry-cert/cert" + }, { + name: "SSL_CERT_DIR", + value: "/etc/ssl/certs" + }, { + name: "METRICS_DOMAIN", + value: "tekton.dev/pipeline" + }], + image: "ghcr.io/tektoncd/pipeline/controller-10a3e32792f33651396d02b6855a6e36:v1.15.0@sha256:ed33d9696b882716ab58062ec928828d5c15f4f9bac94661fb6b76ea5d27ff17", + livenessProbe: { + httpGet: { + path: "/health", + port: "probes", + scheme: "HTTP" + }, + initialDelaySeconds: 5, + periodSeconds: 10, + timeoutSeconds: 5 + }, + name: "tekton-pipelines-controller", + ports: [{ + containerPort: 9090, + name: "metrics" + }, { + containerPort: 8008, + name: "profiling" + }, { + containerPort: 8080, + name: "probes" + }], + readinessProbe: { + httpGet: { + path: "/readiness", + port: "probes", + scheme: "HTTP" + }, + initialDelaySeconds: 5, + periodSeconds: 10, + timeoutSeconds: 5 + }, + securityContext: { + allowPrivilegeEscalation: false, + capabilities: { + drop: ["ALL"] + }, + readOnlyRootFilesystem: true, + runAsGroup: 65532, + runAsNonRoot: true, + runAsUser: 65532, + seccompProfile: { + type: "RuntimeDefault" + } + }, + volumeMounts: [{ + mountPath: "/etc/config-logging", + name: "config-logging" + }, { + mountPath: "/etc/config-registry-cert", + name: "config-registry-cert" + }] + }], + serviceAccountName: "tekton-pipelines-controller", + volumes: [{ + configMap: { + name: "config-logging" + }, + name: "config-logging" + }, { + configMap: { + name: "config-registry-cert" + }, + name: "config-registry-cert" + }] + } + } + } +}; +export const Service_TektonPipelinesController: KubernetesResource = { + apiVersion: "v1", + kind: "Service", + metadata: { + labels: { + app: "tekton-pipelines-controller", + "app.kubernetes.io/component": "controller", + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/name": "controller", + "app.kubernetes.io/part-of": "tekton-pipelines", + "app.kubernetes.io/version": "v1.15.0", + "pipeline.tekton.dev/release": "v1.15.0", + version: "v1.15.0" + }, + name: "tekton-pipelines-controller", + namespace: "tekton-pipelines" + }, + spec: { + ports: [{ + name: "http-metrics", + port: 9090, + protocol: "TCP", + targetPort: 9090 + }, { + name: "http-profiling", + port: 8008, + targetPort: 8008 + }, { + name: "probes", + port: 8080 + }], + selector: { + "app.kubernetes.io/component": "controller", + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/name": "controller", + "app.kubernetes.io/part-of": "tekton-pipelines" + } + } +}; +export const Deployment_TektonEventsController: KubernetesResource = { + apiVersion: "apps/v1", + kind: "Deployment", + metadata: { + labels: { + "app.kubernetes.io/component": "events", + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/name": "events", + "app.kubernetes.io/part-of": "tekton-pipelines", + "app.kubernetes.io/version": "v1.15.0", + "pipeline.tekton.dev/release": "v1.15.0", + version: "v1.15.0" + }, + name: "tekton-events-controller", + namespace: "tekton-pipelines" + }, + spec: { + replicas: 1, + selector: { + matchLabels: { + "app.kubernetes.io/component": "events", + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/name": "events", + "app.kubernetes.io/part-of": "tekton-pipelines" + } + }, + template: { + metadata: { + labels: { + app: "tekton-events-controller", + "app.kubernetes.io/component": "events", + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/name": "events", + "app.kubernetes.io/part-of": "tekton-pipelines", + "app.kubernetes.io/version": "v1.15.0", + "pipeline.tekton.dev/release": "v1.15.0", + version: "v1.15.0" + } + }, + spec: { + affinity: { + nodeAffinity: { + requiredDuringSchedulingIgnoredDuringExecution: { + nodeSelectorTerms: [{ + matchExpressions: [{ + key: "kubernetes.io/os", + operator: "NotIn", + values: ["windows"] + }] + }] + } + } + }, + containers: [{ + args: [], + env: [{ + name: "SYSTEM_NAMESPACE", + valueFrom: { + fieldRef: { + fieldPath: "metadata.namespace" + } + } + }, { + name: "KUBERNETES_MIN_VERSION", + value: "v1.28.0" + }, { + name: "CONFIG_DEFAULTS_NAME", + value: "config-defaults" + }, { + name: "CONFIG_LOGGING_NAME", + value: "config-logging" + }, { + name: "CONFIG_OBSERVABILITY_NAME", + value: "config-observability" + }, { + name: "CONFIG_LEADERELECTION_NAME", + value: "config-leader-election-events" + }, { + name: "SSL_CERT_FILE", + value: "/etc/config-registry-cert/cert" + }, { + name: "SSL_CERT_DIR", + value: "/etc/ssl/certs" + }], + image: "ghcr.io/tektoncd/pipeline/events-a9042f7efb0cbade2a868a1ee5ddd52c:v1.15.0@sha256:050f4ae0fee5d2f9b9a9b9a6270b131c0b0ecd8a1c24707746aa18d10b435604", + livenessProbe: { + httpGet: { + path: "/health", + port: "probes", + scheme: "HTTP" + }, + initialDelaySeconds: 5, + periodSeconds: 10, + timeoutSeconds: 5 + }, + name: "tekton-events-controller", + ports: [{ + containerPort: 9090, + name: "metrics" + }, { + containerPort: 8008, + name: "profiling" + }, { + containerPort: 8080, + name: "probes" + }], + readinessProbe: { + httpGet: { + path: "/readiness", + port: "probes", + scheme: "HTTP" + }, + initialDelaySeconds: 5, + periodSeconds: 10, + timeoutSeconds: 5 + }, + securityContext: { + allowPrivilegeEscalation: false, + capabilities: { + drop: ["ALL"] + }, + readOnlyRootFilesystem: true, + runAsGroup: 65532, + runAsNonRoot: true, + runAsUser: 65532, + seccompProfile: { + type: "RuntimeDefault" + } + }, + volumeMounts: [{ + mountPath: "/etc/config-logging", + name: "config-logging" + }, { + mountPath: "/etc/config-registry-cert", + name: "config-registry-cert" + }] + }], + serviceAccountName: "tekton-events-controller", + volumes: [{ + configMap: { + name: "config-logging" + }, + name: "config-logging" + }, { + configMap: { + name: "config-registry-cert" + }, + name: "config-registry-cert" + }] + } + } + } +}; +export const Service_TektonEventsController: KubernetesResource = { + apiVersion: "v1", + kind: "Service", + metadata: { + labels: { + app: "tekton-events-controller", + "app.kubernetes.io/component": "events", + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/name": "events", + "app.kubernetes.io/part-of": "tekton-pipelines", + "app.kubernetes.io/version": "v1.15.0", + "pipeline.tekton.dev/release": "v1.15.0", + version: "v1.15.0" + }, + name: "tekton-events-controller", + namespace: "tekton-pipelines" + }, + spec: { + ports: [{ + name: "http-metrics", + port: 9090, + protocol: "TCP", + targetPort: 9090 + }, { + name: "http-profiling", + port: 8008, + targetPort: 8008 + }, { + name: "probes", + port: 8080 + }], + selector: { + "app.kubernetes.io/component": "events", + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/name": "events", + "app.kubernetes.io/part-of": "tekton-pipelines" + } + } +}; +export const Namespace_TektonPipelinesResolvers: KubernetesResource = { + apiVersion: "v1", + kind: "Namespace", + metadata: { + labels: { + "app.kubernetes.io/component": "resolvers", + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/part-of": "tekton-pipelines", + "pod-security.kubernetes.io/enforce": "restricted" + }, + name: "tekton-pipelines-resolvers" + } +}; +export const ClusterRole_TektonPipelinesResolversResolutionRequestUpdates: KubernetesResource = { + apiVersion: "rbac.authorization.k8s.io/v1", + kind: "ClusterRole", + metadata: { + labels: { + "app.kubernetes.io/component": "resolvers", + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/part-of": "tekton-pipelines" + }, + name: "tekton-pipelines-resolvers-resolution-request-updates" + }, + rules: [{ + apiGroups: ["resolution.tekton.dev"], + resources: ["resolutionrequests", "resolutionrequests/status"], + verbs: ["get", "list", "watch", "update", "patch"] + }, { + apiGroups: ["tekton.dev"], + resources: ["tasks", "pipelines", "stepactions"], + verbs: ["get", "list"] + }, { + apiGroups: [""], + resources: ["secrets", "serviceaccounts"], + verbs: ["get", "list", "watch"] + }] +}; +export const Role_TektonPipelinesResolversNamespaceRbac: KubernetesResource = { + apiVersion: "rbac.authorization.k8s.io/v1", + kind: "Role", + metadata: { + labels: { + "app.kubernetes.io/component": "resolvers", + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/part-of": "tekton-pipelines" + }, + name: "tekton-pipelines-resolvers-namespace-rbac", + namespace: "tekton-pipelines-resolvers" + }, + rules: [{ + apiGroups: [""], + resources: ["configmaps", "secrets"], + verbs: ["get", "list", "update", "watch"] + }, { + apiGroups: ["coordination.k8s.io"], + resources: ["leases"], + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] + }] +}; +export const ServiceAccount_TektonPipelinesResolvers: KubernetesResource = { + apiVersion: "v1", + kind: "ServiceAccount", + metadata: { + labels: { + "app.kubernetes.io/component": "resolvers", + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/part-of": "tekton-pipelines" + }, + name: "tekton-pipelines-resolvers", + namespace: "tekton-pipelines-resolvers" + } +}; +export const ClusterRoleBinding_TektonPipelinesResolvers: KubernetesResource = { + apiVersion: "rbac.authorization.k8s.io/v1", + kind: "ClusterRoleBinding", + metadata: { + labels: { + "app.kubernetes.io/component": "resolvers", + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/part-of": "tekton-pipelines" + }, + name: "tekton-pipelines-resolvers" + }, + roleRef: { + apiGroup: "rbac.authorization.k8s.io", + kind: "ClusterRole", + name: "tekton-pipelines-resolvers-resolution-request-updates" + }, + subjects: [{ + kind: "ServiceAccount", + name: "tekton-pipelines-resolvers", + namespace: "tekton-pipelines-resolvers" + }] +}; +export const RoleBinding_TektonPipelinesResolversNamespaceRbac: KubernetesResource = { + apiVersion: "rbac.authorization.k8s.io/v1", + kind: "RoleBinding", + metadata: { + labels: { + "app.kubernetes.io/component": "resolvers", + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/part-of": "tekton-pipelines" + }, + name: "tekton-pipelines-resolvers-namespace-rbac", + namespace: "tekton-pipelines-resolvers" + }, + roleRef: { + apiGroup: "rbac.authorization.k8s.io", + kind: "Role", + name: "tekton-pipelines-resolvers-namespace-rbac" + }, + subjects: [{ + kind: "ServiceAccount", + name: "tekton-pipelines-resolvers", + namespace: "tekton-pipelines-resolvers" + }] +}; +export const ConfigMap_BundleresolverConfig: KubernetesResource = { + apiVersion: "v1", + kind: "ConfigMap", + metadata: { + labels: { + "app.kubernetes.io/component": "resolvers", + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/part-of": "tekton-pipelines" + }, + name: "bundleresolver-config", + namespace: "tekton-pipelines-resolvers" + }, + data: { + "default-kind": "task", + "default-service-account": "default" + } +}; +export const ConfigMap_ClusterResolverConfig: KubernetesResource = { + apiVersion: "v1", + kind: "ConfigMap", + metadata: { + labels: { + "app.kubernetes.io/component": "resolvers", + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/part-of": "tekton-pipelines" + }, + name: "cluster-resolver-config", + namespace: "tekton-pipelines-resolvers" + }, + data: { + "allowed-namespaces": "", + "blocked-namespaces": "", + "default-kind": "task", + "default-namespace": "" + } +}; +export const ConfigMap_ResolversFeatureFlags: KubernetesResource = { + apiVersion: "v1", + kind: "ConfigMap", + metadata: { + labels: { + "app.kubernetes.io/component": "resolvers", + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/part-of": "tekton-pipelines" + }, + name: "resolvers-feature-flags", + namespace: "tekton-pipelines-resolvers" + }, + data: { + "enable-bundles-resolver": "true", + "enable-cluster-resolver": "true", + "enable-git-resolver": "true", + "enable-http-resolver": "true", + "enable-hub-resolver": "true" + } +}; +export const ConfigMap_ConfigLeaderElectionResolvers: KubernetesResource = { + apiVersion: "v1", + kind: "ConfigMap", + metadata: { + labels: { + "app.kubernetes.io/component": "resolvers", + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/part-of": "tekton-pipelines" + }, + name: "config-leader-election-resolvers", + namespace: "tekton-pipelines-resolvers" + }, + data: { + _example: "################################\n# #\n# EXAMPLE CONFIGURATION #\n# #\n################################\n# This block is not actually functional configuration,\n# but serves to illustrate the available configuration\n# options and document them in a way that is accessible\n# to users that `kubectl edit` this config map.\n#\n# These sample configuration options may be copied out of\n# this example block and unindented to be in the data block\n# to actually change the configuration.\n# lease-duration is how long non-leaders will wait to try to acquire the\n# lock; 15 seconds is the value used by core kubernetes controllers.\nlease-duration: \"60s\"\n# renew-deadline is how long a leader will try to renew the lease before\n# giving up; 10 seconds is the value used by core kubernetes controllers.\nrenew-deadline: \"40s\"\n# retry-period is how long the leader election client waits between tries of\n# actions; 2 seconds is the value used by core kubernetes controllers.\nretry-period: \"10s\"\n# buckets is the number of buckets used to partition key space of each\n# Reconciler. If this number is M and the replica number of the controller\n# is N, the N replicas will compete for the M buckets. The owner of a\n# bucket will take care of the reconciling for the keys partitioned into\n# that bucket.\nbuckets: \"1\"\n" + } +}; +export const ConfigMap_ConfigLogging__1: KubernetesResource = { + apiVersion: "v1", + kind: "ConfigMap", + metadata: { + labels: { + "app.kubernetes.io/component": "resolvers", + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/part-of": "tekton-pipelines" + }, + name: "config-logging", + namespace: "tekton-pipelines-resolvers" + }, + data: { + "loglevel.controller": "info", + "loglevel.webhook": "info", + "zap-logger-config": "{\n \"level\": \"info\",\n \"development\": false,\n \"sampling\": {\n \"initial\": 100,\n \"thereafter\": 100\n },\n \"outputPaths\": [\"stdout\"],\n \"errorOutputPaths\": [\"stderr\"],\n \"encoding\": \"json\",\n \"encoderConfig\": {\n \"timeKey\": \"timestamp\",\n \"levelKey\": \"severity\",\n \"nameKey\": \"logger\",\n \"callerKey\": \"caller\",\n \"messageKey\": \"message\",\n \"stacktraceKey\": \"stacktrace\",\n \"lineEnding\": \"\",\n \"levelEncoder\": \"\",\n \"timeEncoder\": \"iso8601\",\n \"durationEncoder\": \"\",\n \"callerEncoder\": \"\"\n }\n}\n" + } +}; +export const ConfigMap_ConfigObservability__1: KubernetesResource = { + apiVersion: "v1", + kind: "ConfigMap", + metadata: { + labels: { + "app.kubernetes.io/component": "resolvers", + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/part-of": "tekton-pipelines" + }, + name: "config-observability", + namespace: "tekton-pipelines-resolvers" + }, + data: { + _example: "################################\n# #\n# EXAMPLE CONFIGURATION #\n# #\n################################\n\n# This block is not actually functional configuration,\n# but serves to illustrate the available configuration\n# options and document them in a way that is accessible\n# to users that `kubectl edit` this config map.\n#\n# These sample configuration options may be copied out of\n# this example block and unindented to be in the data block\n# to actually change the configuration.\n\n# OpenTelemetry Metrics Configuration\n# Protocol for metrics export (prometheus, grpc, http/protobuf, none)\n# Default if not specified: \"none\"\nmetrics-protocol: prometheus\n\n# Metrics endpoint (for grpc/http protocols)\n# Default: empty (uses default OTLP endpoint)\nmetrics-endpoint: \"\"\n\n# Metrics export interval (e.g., \"30s\", \"1m\")\n# Default: empty (uses default interval)\nmetrics-export-interval: \"\"\n\n# OpenTelemetry Tracing Configuration\n# Protocol for tracing export (grpc, http/protobuf, none, stdout)\n# Default: none\ntracing-protocol: none\n\n# Tracing endpoint (for grpc/http protocols)\n# Default: empty\ntracing-endpoint: \"\"\n\n# Tracing sampling rate (0.0 to 1.0)\n# Default: 1.0 (100% sampling)\ntracing-sampling-rate: \"1.0\"\n\n# Runtime Configuration\n# Enable profiling (enabled, disabled)\n# Default: disabled\nruntime-profiling: disabled\n\n# Runtime export interval (e.g., \"15s\")\n# Default: 15s\nruntime-export-interval: \"15s\"\n\n# Note: Legacy OpenCensus configuration (metrics.backend-destination, etc.) has been\n# removed as OpenCensus support is no longer provided by the underlying infrastructure.\n# Please use the OpenTelemetry configuration options above.\n", + "metrics-protocol": "prometheus" + } +}; +export const ConfigMap_GitResolverConfig: KubernetesResource = { + apiVersion: "v1", + kind: "ConfigMap", + metadata: { + labels: { + "app.kubernetes.io/component": "resolvers", + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/part-of": "tekton-pipelines" + }, + name: "git-resolver-config", + namespace: "tekton-pipelines-resolvers" + }, + data: { + "api-token-secret-key": "", + "api-token-secret-name": "", + "api-token-secret-namespace": "default", + "default-org": "", + "default-revision": "main", + "default-url": "https://github.com/tektoncd/catalog.git", + "fetch-timeout": "1m", + "scm-type": "github", + "server-url": "" + } +}; +export const ConfigMap_HttpResolverConfig: KubernetesResource = { + apiVersion: "v1", + kind: "ConfigMap", + metadata: { + labels: { + "app.kubernetes.io/component": "resolvers", + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/part-of": "tekton-pipelines" + }, + name: "http-resolver-config", + namespace: "tekton-pipelines-resolvers" + }, + data: { + "fetch-timeout": "1m" + } +}; +export const ConfigMap_HubresolverConfig: KubernetesResource = { + apiVersion: "v1", + kind: "ConfigMap", + metadata: { + labels: { + "app.kubernetes.io/component": "resolvers", + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/part-of": "tekton-pipelines" + }, + name: "hubresolver-config", + namespace: "tekton-pipelines-resolvers" + }, + data: { + "default-artifact-hub-pipeline-catalog": "tekton-catalog-pipelines", + "default-artifact-hub-task-catalog": "tekton-catalog-tasks", + "default-kind": "task", + "default-tekton-hub-catalog": "Tekton", + "default-type": "artifact" + } +}; +export const ConfigMap_ResolverCacheConfig: KubernetesResource = { + apiVersion: "v1", + kind: "ConfigMap", + metadata: { + labels: { + "app.kubernetes.io/component": "resolvers", + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/part-of": "tekton-pipelines" + }, + name: "resolver-cache-config", + namespace: "tekton-pipelines-resolvers" + }, + data: { + "max-size": "1000", + ttl: "5m" + } +}; +export const Deployment_TektonPipelinesRemoteResolvers: KubernetesResource = { + apiVersion: "apps/v1", + kind: "Deployment", + metadata: { + labels: { + "app.kubernetes.io/component": "resolvers", + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/name": "resolvers", + "app.kubernetes.io/part-of": "tekton-pipelines", + "app.kubernetes.io/version": "v1.15.0", + "pipeline.tekton.dev/release": "v1.15.0", + version: "v1.15.0" + }, + name: "tekton-pipelines-remote-resolvers", + namespace: "tekton-pipelines-resolvers" + }, + spec: { + replicas: 1, + selector: { + matchLabels: { + "app.kubernetes.io/component": "resolvers", + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/name": "resolvers", + "app.kubernetes.io/part-of": "tekton-pipelines" + } + }, + template: { + metadata: { + labels: { + app: "tekton-pipelines-resolvers", + "app.kubernetes.io/component": "resolvers", + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/name": "resolvers", + "app.kubernetes.io/part-of": "tekton-pipelines", + "app.kubernetes.io/version": "v1.15.0", + "pipeline.tekton.dev/release": "v1.15.0", + version: "v1.15.0" + } + }, + spec: { + affinity: { + nodeAffinity: { + requiredDuringSchedulingIgnoredDuringExecution: { + nodeSelectorTerms: [{ + matchExpressions: [{ + key: "kubernetes.io/os", + operator: "NotIn", + values: ["windows"] + }] + }] + } + }, + podAntiAffinity: { + preferredDuringSchedulingIgnoredDuringExecution: [{ + podAffinityTerm: { + labelSelector: { + matchLabels: { + "app.kubernetes.io/component": "resolvers", + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/name": "resolvers", + "app.kubernetes.io/part-of": "tekton-pipelines" + } + }, + topologyKey: "kubernetes.io/hostname" + }, + weight: 100 + }] + } + }, + containers: [{ + args: [], + command: ["/sbin/tini", "--", "/ko-app/resolvers"], + env: [{ + name: "SYSTEM_NAMESPACE", + valueFrom: { + fieldRef: { + fieldPath: "metadata.namespace" + } + } + }, { + name: "KUBERNETES_MIN_VERSION", + value: "v1.28.0" + }, { + name: "CONFIG_LOGGING_NAME", + value: "config-logging" + }, { + name: "CONFIG_OBSERVABILITY_NAME", + value: "config-observability" + }, { + name: "CONFIG_FEATURE_FLAGS_NAME", + value: "feature-flags" + }, { + name: "CONFIG_LEADERELECTION_NAME", + value: "config-leader-election-resolvers" + }, { + name: "METRICS_DOMAIN", + value: "tekton.dev/resolution" + }, { + name: "PROBES_PORT", + value: "8080" + }, { + name: "TEKTON_HUB_API", + value: "" + }, { + name: "ARTIFACT_HUB_API", + value: "https://artifacthub.io/" + }], + image: "ghcr.io/tektoncd/pipeline/resolvers-ff86b24f130c42b88983d3c13993056d:v1.15.0@sha256:fac274d8185ad9f3ef14ab8f1a316d92c478254c7d17efa52bc60f1899a889d2", + name: "controller", + ports: [{ + containerPort: 9090, + name: "metrics" + }, { + containerPort: 8008, + name: "profiling" + }, { + containerPort: 8080, + name: "probes" + }], + resources: { + limits: { + cpu: "1000m", + memory: "4Gi" + }, + requests: { + cpu: "100m", + memory: "100Mi" + } + }, + securityContext: { + allowPrivilegeEscalation: false, + capabilities: { + drop: ["ALL"] + }, + readOnlyRootFilesystem: true, + runAsNonRoot: true, + runAsUser: 65532, + seccompProfile: { + type: "RuntimeDefault" + } + }, + volumeMounts: [{ + mountPath: "/tmp", + name: "tmp-clone-volume" + }] + }], + serviceAccountName: "tekton-pipelines-resolvers", + volumes: [{ + emptyDir: { + sizeLimit: "4Gi" + }, + name: "tmp-clone-volume" + }] + } + } + } +}; +export const Service_TektonPipelinesRemoteResolvers: KubernetesResource = { + apiVersion: "v1", + kind: "Service", + metadata: { + labels: { + app: "tekton-pipelines-remote-resolvers", + "app.kubernetes.io/component": "resolvers", + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/name": "resolvers", + "app.kubernetes.io/part-of": "tekton-pipelines", + "app.kubernetes.io/version": "v1.15.0", + "pipeline.tekton.dev/release": "v1.15.0", + version: "v1.15.0" + }, + name: "tekton-pipelines-remote-resolvers", + namespace: "tekton-pipelines-resolvers" + }, + spec: { + ports: [{ + name: "http-metrics", + port: 9090, + protocol: "TCP", + targetPort: 9090 + }, { + name: "http-profiling", + port: 8008, + targetPort: 8008 + }, { + name: "probes", + port: 8080 + }], + selector: { + "app.kubernetes.io/component": "resolvers", + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/name": "resolvers", + "app.kubernetes.io/part-of": "tekton-pipelines" + } + } +}; +export const HorizontalPodAutoscaler_TektonPipelinesWebhook: KubernetesResource = { + apiVersion: "autoscaling/v2", + kind: "HorizontalPodAutoscaler", + metadata: { + labels: { + "app.kubernetes.io/component": "webhook", + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/name": "webhook", + "app.kubernetes.io/part-of": "tekton-pipelines", + "app.kubernetes.io/version": "v1.15.0", + "pipeline.tekton.dev/release": "v1.15.0", + version: "v1.15.0" + }, + name: "tekton-pipelines-webhook", + namespace: "tekton-pipelines" + }, + spec: { + maxReplicas: 5, + metrics: [{ + resource: { + name: "cpu", + target: { + averageUtilization: 100, + type: "Utilization" + } + }, + type: "Resource" + }], + minReplicas: 1, + scaleTargetRef: { + apiVersion: "apps/v1", + kind: "Deployment", + name: "tekton-pipelines-webhook" + } + } +}; +export const Deployment_TektonPipelinesWebhook: KubernetesResource = { + apiVersion: "apps/v1", + kind: "Deployment", + metadata: { + labels: { + "app.kubernetes.io/component": "webhook", + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/name": "webhook", + "app.kubernetes.io/part-of": "tekton-pipelines", + "app.kubernetes.io/version": "v1.15.0", + "pipeline.tekton.dev/release": "v1.15.0", + version: "v1.15.0" + }, + name: "tekton-pipelines-webhook", + namespace: "tekton-pipelines" + }, + spec: { + selector: { + matchLabels: { + "app.kubernetes.io/component": "webhook", + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/name": "webhook", + "app.kubernetes.io/part-of": "tekton-pipelines" + } + }, + template: { + metadata: { + labels: { + app: "tekton-pipelines-webhook", + "app.kubernetes.io/component": "webhook", + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/name": "webhook", + "app.kubernetes.io/part-of": "tekton-pipelines", + "app.kubernetes.io/version": "v1.15.0", + "pipeline.tekton.dev/release": "v1.15.0", + version: "v1.15.0" + } + }, + spec: { + affinity: { + nodeAffinity: { + requiredDuringSchedulingIgnoredDuringExecution: { + nodeSelectorTerms: [{ + matchExpressions: [{ + key: "kubernetes.io/os", + operator: "NotIn", + values: ["windows"] + }] + }] + } + }, + podAntiAffinity: { + preferredDuringSchedulingIgnoredDuringExecution: [{ + podAffinityTerm: { + labelSelector: { + matchLabels: { + "app.kubernetes.io/component": "webhook", + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/name": "webhook", + "app.kubernetes.io/part-of": "tekton-pipelines" + } + }, + topologyKey: "kubernetes.io/hostname" + }, + weight: 100 + }] + } + }, + containers: [{ + env: [{ + name: "SYSTEM_NAMESPACE", + valueFrom: { + fieldRef: { + fieldPath: "metadata.namespace" + } + } + }, { + name: "KUBERNETES_MIN_VERSION", + value: "v1.28.0" + }, { + name: "CONFIG_LOGGING_NAME", + value: "config-logging" + }, { + name: "CONFIG_OBSERVABILITY_NAME", + value: "config-observability" + }, { + name: "CONFIG_LEADERELECTION_NAME", + value: "config-leader-election-webhook" + }, { + name: "CONFIG_FEATURE_FLAGS_NAME", + value: "feature-flags" + }, { + name: "PROBES_PORT", + value: "8080" + }, { + name: "WEBHOOK_PORT", + value: "8443" + }, { + name: "WEBHOOK_ADMISSION_CONTROLLER_NAME", + value: "webhook.pipeline.tekton.dev" + }, { + name: "WEBHOOK_SERVICE_NAME", + value: "tekton-pipelines-webhook" + }, { + name: "WEBHOOK_SECRET_NAME", + value: "webhook-certs" + }, { + name: "METRICS_DOMAIN", + value: "tekton.dev/pipeline" + }], + image: "ghcr.io/tektoncd/pipeline/webhook-d4749e605405422fd87700164e31b2d1:v1.15.0@sha256:660a4a3bc55eaafcf8672d2c8c2469d9cf0e6090cd367a3d4bac82f834487947", + livenessProbe: { + httpGet: { + path: "/health", + port: "probes", + scheme: "HTTP" + }, + initialDelaySeconds: 5, + periodSeconds: 10, + timeoutSeconds: 5 + }, + name: "webhook", + ports: [{ + containerPort: 9090, + name: "metrics" + }, { + containerPort: 8008, + name: "profiling" + }, { + containerPort: 8443, + name: "https-webhook" + }, { + containerPort: 8080, + name: "probes" + }], + readinessProbe: { + httpGet: { + path: "/readiness", + port: "probes", + scheme: "HTTP" + }, + initialDelaySeconds: 5, + periodSeconds: 10, + timeoutSeconds: 5 + }, + resources: { + limits: { + cpu: "500m", + memory: "500Mi" + }, + requests: { + cpu: "100m", + memory: "100Mi" + } + }, + securityContext: { + allowPrivilegeEscalation: false, + capabilities: { + drop: ["ALL"] + }, + readOnlyRootFilesystem: true, + runAsGroup: 65532, + runAsNonRoot: true, + runAsUser: 65532, + seccompProfile: { + type: "RuntimeDefault" + } + } + }], + serviceAccountName: "tekton-pipelines-webhook" + } + } + } +}; +export const Service_TektonPipelinesWebhook: KubernetesResource = { + apiVersion: "v1", + kind: "Service", + metadata: { + labels: { + app: "tekton-pipelines-webhook", + "app.kubernetes.io/component": "webhook", + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/name": "webhook", + "app.kubernetes.io/part-of": "tekton-pipelines", + "app.kubernetes.io/version": "v1.15.0", + "pipeline.tekton.dev/release": "v1.15.0", + version: "v1.15.0" + }, + name: "tekton-pipelines-webhook", + namespace: "tekton-pipelines" + }, + spec: { + ports: [{ + name: "http-metrics", + port: 9090, + targetPort: "metrics" + }, { + name: "http-profiling", + port: 8008, + targetPort: "profiling" + }, { + name: "https-webhook", + port: 443, + targetPort: "https-webhook" + }, { + name: "probes", + port: 8080, + targetPort: "probes" + }], + selector: { + "app.kubernetes.io/component": "webhook", + "app.kubernetes.io/instance": "default", + "app.kubernetes.io/name": "webhook", + "app.kubernetes.io/part-of": "tekton-pipelines" + } + } +}; +export const resources: ReadonlyArray = [Namespace_TektonPipelines, ClusterRole_TektonPipelinesControllerClusterAccess, ClusterRole_TektonPipelinesControllerTenantAccess, ClusterRole_TektonPipelinesWebhookClusterAccess, ClusterRole_TektonEventsControllerClusterAccess, Role_TektonPipelinesController, Role_TektonPipelinesWebhook, Role_TektonPipelinesEventsController, Role_TektonPipelinesLeaderElection, Role_TektonPipelinesInfo, ServiceAccount_TektonPipelinesController, ServiceAccount_TektonPipelinesWebhook, ServiceAccount_TektonEventsController, ClusterRoleBinding_TektonPipelinesControllerClusterAccess, ClusterRoleBinding_TektonPipelinesControllerTenantAccess, ClusterRoleBinding_TektonPipelinesWebhookClusterAccess, ClusterRoleBinding_TektonEventsControllerClusterAccess, RoleBinding_TektonPipelinesController, RoleBinding_TektonPipelinesWebhook, RoleBinding_TektonPipelinesControllerLeaderelection, RoleBinding_TektonPipelinesWebhookLeaderelection, RoleBinding_TektonPipelinesInfo, RoleBinding_TektonPipelinesEventsController, RoleBinding_TektonEventsControllerLeaderelection, CustomResourceDefinition_CustomrunsTektonDev, CustomResourceDefinition_PipelinesTektonDev, CustomResourceDefinition_PipelinerunsTektonDev, CustomResourceDefinition_ResolutionrequestsResolutionTektonDev, CustomResourceDefinition_StepactionsTektonDev, CustomResourceDefinition_TasksTektonDev, CustomResourceDefinition_TaskrunsTektonDev, CustomResourceDefinition_VerificationpoliciesTektonDev, Secret_WebhookCerts, ValidatingWebhookConfiguration_ValidationWebhookPipelineTektonDev, MutatingWebhookConfiguration_WebhookPipelineTektonDev, ValidatingWebhookConfiguration_ConfigWebhookPipelineTektonDev, ClusterRole_TektonAggregateEdit, ClusterRole_TektonAggregateView, ConfigMap_ConfigDefaults, ConfigMap_ConfigEvents, ConfigMap_FeatureFlags, ConfigMap_PipelinesInfo, ConfigMap_ConfigLeaderElectionController, ConfigMap_ConfigLeaderElectionEvents, ConfigMap_ConfigLeaderElectionWebhook, ConfigMap_ConfigLogging, ConfigMap_ConfigObservability, ConfigMap_ConfigRegistryCert, ConfigMap_ConfigSpire, ConfigMap_ConfigTracing, ConfigMap_ConfigWaitExponentialBackoff, Deployment_TektonPipelinesController, Service_TektonPipelinesController, Deployment_TektonEventsController, Service_TektonEventsController, Namespace_TektonPipelinesResolvers, ClusterRole_TektonPipelinesResolversResolutionRequestUpdates, Role_TektonPipelinesResolversNamespaceRbac, ServiceAccount_TektonPipelinesResolvers, ClusterRoleBinding_TektonPipelinesResolvers, RoleBinding_TektonPipelinesResolversNamespaceRbac, ConfigMap_BundleresolverConfig, ConfigMap_ClusterResolverConfig, ConfigMap_ResolversFeatureFlags, ConfigMap_ConfigLeaderElectionResolvers, ConfigMap_ConfigLogging__1, ConfigMap_ConfigObservability__1, ConfigMap_GitResolverConfig, ConfigMap_HttpResolverConfig, ConfigMap_HubresolverConfig, ConfigMap_ResolverCacheConfig, Deployment_TektonPipelinesRemoteResolvers, Service_TektonPipelinesRemoteResolvers, HorizontalPodAutoscaler_TektonPipelinesWebhook, Deployment_TektonPipelinesWebhook, Service_TektonPipelinesWebhook]; +export default { + resources: resources +}; diff --git a/packages/manifests/src/generated/traefik.ts b/packages/manifests/src/generated/traefik.ts new file mode 100644 index 0000000..bbaed19 --- /dev/null +++ b/packages/manifests/src/generated/traefik.ts @@ -0,0 +1,11292 @@ +/** Auto-generated typed resources for operator: traefik*/ +import type { KubernetesResource } from "@kubernetesjs/ops"; +export const Namespace_Traefik: KubernetesResource = { + apiVersion: "v1", + kind: "Namespace", + metadata: { + labels: { + "app.kubernetes.io/name": "traefik" + }, + name: "traefik" + } +}; +export const CustomResourceDefinition_GatewayclassesGatewayNetworkingK8sIo: KubernetesResource = { + apiVersion: "apiextensions.k8s.io/v1", + kind: "CustomResourceDefinition", + metadata: { + annotations: { + "api-approved.kubernetes.io": "https://github.com/kubernetes-sigs/gateway-api/pull/3328", + "gateway.networking.k8s.io/bundle-version": "v1.2.1", + "gateway.networking.k8s.io/channel": "standard" + }, + creationTimestamp: null, + name: "gatewayclasses.gateway.networking.k8s.io" + }, + spec: { + group: "gateway.networking.k8s.io", + names: { + categories: ["gateway-api"], + kind: "GatewayClass", + listKind: "GatewayClassList", + plural: "gatewayclasses", + shortNames: ["gc"], + singular: "gatewayclass" + }, + scope: "Cluster", + versions: [{ + additionalPrinterColumns: [{ + jsonPath: ".spec.controllerName", + name: "Controller", + type: "string" + }, { + jsonPath: ".status.conditions[?(@.type==\"Accepted\")].status", + name: "Accepted", + type: "string" + }, { + jsonPath: ".metadata.creationTimestamp", + name: "Age", + type: "date" + }, { + jsonPath: ".spec.description", + name: "Description", + priority: 1, + type: "string" + }], + name: "v1", + schema: { + openAPIV3Schema: { + description: "GatewayClass describes a class of Gateways available to the user for creating\nGateway resources.\n\nIt is recommended that this resource be used as a template for Gateways. This\nmeans that a Gateway is based on the state of the GatewayClass at the time it\nwas created and changes to the GatewayClass or associated parameters are not\npropagated down to existing Gateways. This recommendation is intended to\nlimit the blast radius of changes to GatewayClass or associated parameters.\nIf implementations choose to propagate GatewayClass changes to existing\nGateways, that MUST be clearly documented by the implementation.\n\nWhenever one or more Gateways are using a GatewayClass, implementations SHOULD\nadd the `gateway-exists-finalizer.gateway.networking.k8s.io` finalizer on the\nassociated GatewayClass. This ensures that a GatewayClass associated with a\nGateway is not deleted while in use.\n\nGatewayClass is a Cluster level resource.", + properties: { + apiVersion: { + description: "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", + type: "string" + }, + kind: { + description: "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + type: "string" + }, + metadata: { + type: "object" + }, + spec: { + description: "Spec defines the desired state of GatewayClass.", + properties: { + controllerName: { + description: "ControllerName is the name of the controller that is managing Gateways of\nthis class. The value of this field MUST be a domain prefixed path.\n\nExample: \"example.net/gateway-controller\".\n\nThis field is not mutable and cannot be empty.\n\nSupport: Core", + maxLength: 253, + minLength: 1, + pattern: "^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\\/[A-Za-z0-9\\/\\-._~%!$&'()*+,;=:]+$", + type: "string", + "x-kubernetes-validations": [{ + message: "Value is immutable", + rule: "self == oldSelf" + }] + }, + description: { + description: "Description helps describe a GatewayClass with more details.", + maxLength: 64, + type: "string" + }, + parametersRef: { + description: "ParametersRef is a reference to a resource that contains the configuration\nparameters corresponding to the GatewayClass. This is optional if the\ncontroller does not require any additional configuration.\n\nParametersRef can reference a standard Kubernetes resource, i.e. ConfigMap,\nor an implementation-specific custom resource. The resource can be\ncluster-scoped or namespace-scoped.\n\nIf the referent cannot be found, refers to an unsupported kind, or when\nthe data within that resource is malformed, the GatewayClass SHOULD be\nrejected with the \"Accepted\" status condition set to \"False\" and an\n\"InvalidParameters\" reason.\n\nA Gateway for this GatewayClass may provide its own `parametersRef`. When both are specified,\nthe merging behavior is implementation specific.\nIt is generally recommended that GatewayClass provides defaults that can be overridden by a Gateway.\n\nSupport: Implementation-specific", + properties: { + group: { + description: "Group is the group of the referent.", + maxLength: 253, + pattern: "^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$", + type: "string" + }, + kind: { + description: "Kind is kind of the referent.", + maxLength: 63, + minLength: 1, + pattern: "^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$", + type: "string" + }, + name: { + description: "Name is the name of the referent.", + maxLength: 253, + minLength: 1, + type: "string" + }, + namespace: { + description: "Namespace is the namespace of the referent.\nThis field is required when referring to a Namespace-scoped resource and\nMUST be unset when referring to a Cluster-scoped resource.", + maxLength: 63, + minLength: 1, + pattern: "^[a-z0-9]([-a-z0-9]*[a-z0-9])?$", + type: "string" + } + }, + required: ["group", "kind", "name"], + type: "object" + } + }, + required: ["controllerName"], + type: "object" + }, + status: { + default: { + conditions: [{ + lastTransitionTime: "1970-01-01T00:00:00Z", + message: "Waiting for controller", + reason: "Pending", + status: "Unknown", + type: "Accepted" + }] + }, + description: "Status defines the current state of GatewayClass.\n\nImplementations MUST populate status on all GatewayClass resources which\nspecify their controller name.", + properties: { + conditions: { + default: [{ + lastTransitionTime: "1970-01-01T00:00:00Z", + message: "Waiting for controller", + reason: "Pending", + status: "Unknown", + type: "Accepted" + }], + description: "Conditions is the current status from the controller for\nthis GatewayClass.\n\nControllers should prefer to publish conditions using values\nof GatewayClassConditionType for the type of each Condition.", + items: { + description: "Condition contains details for one aspect of the current state of this API Resource.", + properties: { + lastTransitionTime: { + description: "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.", + format: "date-time", + type: "string" + }, + message: { + description: "message is a human readable message indicating details about the transition.\nThis may be an empty string.", + maxLength: 32768, + type: "string" + }, + observedGeneration: { + description: "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.", + format: "int64", + minimum: 0, + type: "integer" + }, + reason: { + description: "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.", + maxLength: 1024, + minLength: 1, + pattern: "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$", + type: "string" + }, + status: { + description: "status of the condition, one of True, False, Unknown.", + enum: ["True", "False", "Unknown"], + type: "string" + }, + type: { + description: "type of condition in CamelCase or in foo.example.com/CamelCase.", + maxLength: 316, + pattern: "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$", + type: "string" + } + }, + required: ["lastTransitionTime", "message", "reason", "status", "type"], + type: "object" + }, + maxItems: 8, + type: "array", + "x-kubernetes-list-map-keys": ["type"], + "x-kubernetes-list-type": "map" + } + }, + type: "object" + } + }, + required: ["spec"], + type: "object" + } + }, + served: true, + storage: true, + subresources: { + status: {} + } + }, { + additionalPrinterColumns: [{ + jsonPath: ".spec.controllerName", + name: "Controller", + type: "string" + }, { + jsonPath: ".status.conditions[?(@.type==\"Accepted\")].status", + name: "Accepted", + type: "string" + }, { + jsonPath: ".metadata.creationTimestamp", + name: "Age", + type: "date" + }, { + jsonPath: ".spec.description", + name: "Description", + priority: 1, + type: "string" + }], + name: "v1beta1", + schema: { + openAPIV3Schema: { + description: "GatewayClass describes a class of Gateways available to the user for creating\nGateway resources.\n\nIt is recommended that this resource be used as a template for Gateways. This\nmeans that a Gateway is based on the state of the GatewayClass at the time it\nwas created and changes to the GatewayClass or associated parameters are not\npropagated down to existing Gateways. This recommendation is intended to\nlimit the blast radius of changes to GatewayClass or associated parameters.\nIf implementations choose to propagate GatewayClass changes to existing\nGateways, that MUST be clearly documented by the implementation.\n\nWhenever one or more Gateways are using a GatewayClass, implementations SHOULD\nadd the `gateway-exists-finalizer.gateway.networking.k8s.io` finalizer on the\nassociated GatewayClass. This ensures that a GatewayClass associated with a\nGateway is not deleted while in use.\n\nGatewayClass is a Cluster level resource.", + properties: { + apiVersion: { + description: "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", + type: "string" + }, + kind: { + description: "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + type: "string" + }, + metadata: { + type: "object" + }, + spec: { + description: "Spec defines the desired state of GatewayClass.", + properties: { + controllerName: { + description: "ControllerName is the name of the controller that is managing Gateways of\nthis class. The value of this field MUST be a domain prefixed path.\n\nExample: \"example.net/gateway-controller\".\n\nThis field is not mutable and cannot be empty.\n\nSupport: Core", + maxLength: 253, + minLength: 1, + pattern: "^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\\/[A-Za-z0-9\\/\\-._~%!$&'()*+,;=:]+$", + type: "string", + "x-kubernetes-validations": [{ + message: "Value is immutable", + rule: "self == oldSelf" + }] + }, + description: { + description: "Description helps describe a GatewayClass with more details.", + maxLength: 64, + type: "string" + }, + parametersRef: { + description: "ParametersRef is a reference to a resource that contains the configuration\nparameters corresponding to the GatewayClass. This is optional if the\ncontroller does not require any additional configuration.\n\nParametersRef can reference a standard Kubernetes resource, i.e. ConfigMap,\nor an implementation-specific custom resource. The resource can be\ncluster-scoped or namespace-scoped.\n\nIf the referent cannot be found, refers to an unsupported kind, or when\nthe data within that resource is malformed, the GatewayClass SHOULD be\nrejected with the \"Accepted\" status condition set to \"False\" and an\n\"InvalidParameters\" reason.\n\nA Gateway for this GatewayClass may provide its own `parametersRef`. When both are specified,\nthe merging behavior is implementation specific.\nIt is generally recommended that GatewayClass provides defaults that can be overridden by a Gateway.\n\nSupport: Implementation-specific", + properties: { + group: { + description: "Group is the group of the referent.", + maxLength: 253, + pattern: "^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$", + type: "string" + }, + kind: { + description: "Kind is kind of the referent.", + maxLength: 63, + minLength: 1, + pattern: "^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$", + type: "string" + }, + name: { + description: "Name is the name of the referent.", + maxLength: 253, + minLength: 1, + type: "string" + }, + namespace: { + description: "Namespace is the namespace of the referent.\nThis field is required when referring to a Namespace-scoped resource and\nMUST be unset when referring to a Cluster-scoped resource.", + maxLength: 63, + minLength: 1, + pattern: "^[a-z0-9]([-a-z0-9]*[a-z0-9])?$", + type: "string" + } + }, + required: ["group", "kind", "name"], + type: "object" + } + }, + required: ["controllerName"], + type: "object" + }, + status: { + default: { + conditions: [{ + lastTransitionTime: "1970-01-01T00:00:00Z", + message: "Waiting for controller", + reason: "Pending", + status: "Unknown", + type: "Accepted" + }] + }, + description: "Status defines the current state of GatewayClass.\n\nImplementations MUST populate status on all GatewayClass resources which\nspecify their controller name.", + properties: { + conditions: { + default: [{ + lastTransitionTime: "1970-01-01T00:00:00Z", + message: "Waiting for controller", + reason: "Pending", + status: "Unknown", + type: "Accepted" + }], + description: "Conditions is the current status from the controller for\nthis GatewayClass.\n\nControllers should prefer to publish conditions using values\nof GatewayClassConditionType for the type of each Condition.", + items: { + description: "Condition contains details for one aspect of the current state of this API Resource.", + properties: { + lastTransitionTime: { + description: "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.", + format: "date-time", + type: "string" + }, + message: { + description: "message is a human readable message indicating details about the transition.\nThis may be an empty string.", + maxLength: 32768, + type: "string" + }, + observedGeneration: { + description: "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.", + format: "int64", + minimum: 0, + type: "integer" + }, + reason: { + description: "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.", + maxLength: 1024, + minLength: 1, + pattern: "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$", + type: "string" + }, + status: { + description: "status of the condition, one of True, False, Unknown.", + enum: ["True", "False", "Unknown"], + type: "string" + }, + type: { + description: "type of condition in CamelCase or in foo.example.com/CamelCase.", + maxLength: 316, + pattern: "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$", + type: "string" + } + }, + required: ["lastTransitionTime", "message", "reason", "status", "type"], + type: "object" + }, + maxItems: 8, + type: "array", + "x-kubernetes-list-map-keys": ["type"], + "x-kubernetes-list-type": "map" + } + }, + type: "object" + } + }, + required: ["spec"], + type: "object" + } + }, + served: true, + storage: false, + subresources: { + status: {} + } + }] + }, + status: { + acceptedNames: { + kind: "", + plural: "" + }, + conditions: null, + storedVersions: null + } +}; +export const CustomResourceDefinition_GatewaysGatewayNetworkingK8sIo: KubernetesResource = { + apiVersion: "apiextensions.k8s.io/v1", + kind: "CustomResourceDefinition", + metadata: { + annotations: { + "api-approved.kubernetes.io": "https://github.com/kubernetes-sigs/gateway-api/pull/3328", + "gateway.networking.k8s.io/bundle-version": "v1.2.1", + "gateway.networking.k8s.io/channel": "standard" + }, + creationTimestamp: null, + name: "gateways.gateway.networking.k8s.io" + }, + spec: { + group: "gateway.networking.k8s.io", + names: { + categories: ["gateway-api"], + kind: "Gateway", + listKind: "GatewayList", + plural: "gateways", + shortNames: ["gtw"], + singular: "gateway" + }, + scope: "Namespaced", + versions: [{ + additionalPrinterColumns: [{ + jsonPath: ".spec.gatewayClassName", + name: "Class", + type: "string" + }, { + jsonPath: ".status.addresses[*].value", + name: "Address", + type: "string" + }, { + jsonPath: ".status.conditions[?(@.type==\"Programmed\")].status", + name: "Programmed", + type: "string" + }, { + jsonPath: ".metadata.creationTimestamp", + name: "Age", + type: "date" + }], + name: "v1", + schema: { + openAPIV3Schema: { + description: "Gateway represents an instance of a service-traffic handling infrastructure\nby binding Listeners to a set of IP addresses.", + properties: { + apiVersion: { + description: "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", + type: "string" + }, + kind: { + description: "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + type: "string" + }, + metadata: { + type: "object" + }, + spec: { + description: "Spec defines the desired state of Gateway.", + properties: { + addresses: { + description: "Addresses requested for this Gateway. This is optional and behavior can\ndepend on the implementation. If a value is set in the spec and the\nrequested address is invalid or unavailable, the implementation MUST\nindicate this in the associated entry in GatewayStatus.Addresses.\n\nThe Addresses field represents a request for the address(es) on the\n\"outside of the Gateway\", that traffic bound for this Gateway will use.\nThis could be the IP address or hostname of an external load balancer or\nother networking infrastructure, or some other address that traffic will\nbe sent to.\n\nIf no Addresses are specified, the implementation MAY schedule the\nGateway in an implementation-specific manner, assigning an appropriate\nset of Addresses.\n\nThe implementation MUST bind all Listeners to every GatewayAddress that\nit assigns to the Gateway and add a corresponding entry in\nGatewayStatus.Addresses.\n\nSupport: Extended\n\n", + items: { + description: "GatewayAddress describes an address that can be bound to a Gateway.", + oneOf: [{ + properties: { + type: { + enum: ["IPAddress"] + }, + value: { + anyOf: [{ + format: "ipv4" + }, { + format: "ipv6" + }] + } + } + }, { + properties: { + type: { + not: { + enum: ["IPAddress"] + } + } + } + }], + properties: { + type: { + default: "IPAddress", + description: "Type of the address.", + maxLength: 253, + minLength: 1, + pattern: "^Hostname|IPAddress|NamedAddress|[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\\/[A-Za-z0-9\\/\\-._~%!$&'()*+,;=:]+$", + type: "string" + }, + value: { + description: "Value of the address. The validity of the values will depend\non the type and support by the controller.\n\nExamples: `1.2.3.4`, `128::1`, `my-ip-address`.", + maxLength: 253, + minLength: 1, + type: "string" + } + }, + required: ["value"], + type: "object", + "x-kubernetes-validations": [{ + message: "Hostname value must only contain valid characters (matching ^(\\*\\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$)", + rule: "self.type == 'Hostname' ? self.value.matches(r\"\"\"^(\\*\\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\"\"\"): true" + }] + }, + maxItems: 16, + type: "array", + "x-kubernetes-validations": [{ + message: "IPAddress values must be unique", + rule: "self.all(a1, a1.type == 'IPAddress' ? self.exists_one(a2, a2.type == a1.type && a2.value == a1.value) : true )" + }, { + message: "Hostname values must be unique", + rule: "self.all(a1, a1.type == 'Hostname' ? self.exists_one(a2, a2.type == a1.type && a2.value == a1.value) : true )" + }] + }, + gatewayClassName: { + description: "GatewayClassName used for this Gateway. This is the name of a\nGatewayClass resource.", + maxLength: 253, + minLength: 1, + type: "string" + }, + infrastructure: { + description: "Infrastructure defines infrastructure level attributes about this Gateway instance.\n\nSupport: Extended", + properties: { + annotations: { + additionalProperties: { + description: "AnnotationValue is the value of an annotation in Gateway API. This is used\nfor validation of maps such as TLS options. This roughly matches Kubernetes\nannotation validation, although the length validation in that case is based\non the entire size of the annotations struct.", + maxLength: 4096, + minLength: 0, + type: "string" + }, + description: "Annotations that SHOULD be applied to any resources created in response to this Gateway.\n\nFor implementations creating other Kubernetes objects, this should be the `metadata.annotations` field on resources.\nFor other implementations, this refers to any relevant (implementation specific) \"annotations\" concepts.\n\nAn implementation may chose to add additional implementation-specific annotations as they see fit.\n\nSupport: Extended", + maxProperties: 8, + type: "object", + "x-kubernetes-validations": [{ + message: "Annotation keys must be in the form of an optional DNS subdomain prefix followed by a required name segment of up to 63 characters.", + rule: "self.all(key, key.matches(r\"\"\"^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?([A-Za-z0-9][-A-Za-z0-9_.]{0,61})?[A-Za-z0-9]$\"\"\"))" + }, { + message: "If specified, the annotation key's prefix must be a DNS subdomain not longer than 253 characters in total.", + rule: "self.all(key, key.split(\"/\")[0].size() < 253)" + }] + }, + labels: { + additionalProperties: { + description: "LabelValue is the value of a label in the Gateway API. This is used for validation\nof maps such as Gateway infrastructure labels. This matches the Kubernetes\nlabel validation rules:\n* must be 63 characters or less (can be empty),\n* unless empty, must begin and end with an alphanumeric character ([a-z0-9A-Z]),\n* could contain dashes (-), underscores (_), dots (.), and alphanumerics between.\n\nValid values include:\n\n* MyValue\n* my.name\n* 123-my-value", + maxLength: 63, + minLength: 0, + pattern: "^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$", + type: "string" + }, + description: "Labels that SHOULD be applied to any resources created in response to this Gateway.\n\nFor implementations creating other Kubernetes objects, this should be the `metadata.labels` field on resources.\nFor other implementations, this refers to any relevant (implementation specific) \"labels\" concepts.\n\nAn implementation may chose to add additional implementation-specific labels as they see fit.\n\nIf an implementation maps these labels to Pods, or any other resource that would need to be recreated when labels\nchange, it SHOULD clearly warn about this behavior in documentation.\n\nSupport: Extended", + maxProperties: 8, + type: "object", + "x-kubernetes-validations": [{ + message: "Label keys must be in the form of an optional DNS subdomain prefix followed by a required name segment of up to 63 characters.", + rule: "self.all(key, key.matches(r\"\"\"^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?([A-Za-z0-9][-A-Za-z0-9_.]{0,61})?[A-Za-z0-9]$\"\"\"))" + }, { + message: "If specified, the label key's prefix must be a DNS subdomain not longer than 253 characters in total.", + rule: "self.all(key, key.split(\"/\")[0].size() < 253)" + }] + }, + parametersRef: { + description: "ParametersRef is a reference to a resource that contains the configuration\nparameters corresponding to the Gateway. This is optional if the\ncontroller does not require any additional configuration.\n\nThis follows the same semantics as GatewayClass's `parametersRef`, but on a per-Gateway basis\n\nThe Gateway's GatewayClass may provide its own `parametersRef`. When both are specified,\nthe merging behavior is implementation specific.\nIt is generally recommended that GatewayClass provides defaults that can be overridden by a Gateway.\n\nSupport: Implementation-specific", + properties: { + group: { + description: "Group is the group of the referent.", + maxLength: 253, + pattern: "^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$", + type: "string" + }, + kind: { + description: "Kind is kind of the referent.", + maxLength: 63, + minLength: 1, + pattern: "^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$", + type: "string" + }, + name: { + description: "Name is the name of the referent.", + maxLength: 253, + minLength: 1, + type: "string" + } + }, + required: ["group", "kind", "name"], + type: "object" + } + }, + type: "object" + }, + listeners: { + description: "Listeners associated with this Gateway. Listeners define\nlogical endpoints that are bound on this Gateway's addresses.\nAt least one Listener MUST be specified.\n\nEach Listener in a set of Listeners (for example, in a single Gateway)\nMUST be _distinct_, in that a traffic flow MUST be able to be assigned to\nexactly one listener. (This section uses \"set of Listeners\" rather than\n\"Listeners in a single Gateway\" because implementations MAY merge configuration\nfrom multiple Gateways onto a single data plane, and these rules _also_\napply in that case).\n\nPractically, this means that each listener in a set MUST have a unique\ncombination of Port, Protocol, and, if supported by the protocol, Hostname.\n\nSome combinations of port, protocol, and TLS settings are considered\nCore support and MUST be supported by implementations based on their\ntargeted conformance profile:\n\nHTTP Profile\n\n1. HTTPRoute, Port: 80, Protocol: HTTP\n2. HTTPRoute, Port: 443, Protocol: HTTPS, TLS Mode: Terminate, TLS keypair provided\n\nTLS Profile\n\n1. TLSRoute, Port: 443, Protocol: TLS, TLS Mode: Passthrough\n\n\"Distinct\" Listeners have the following property:\n\nThe implementation can match inbound requests to a single distinct\nListener. When multiple Listeners share values for fields (for\nexample, two Listeners with the same Port value), the implementation\ncan match requests to only one of the Listeners using other\nListener fields.\n\nFor example, the following Listener scenarios are distinct:\n\n1. Multiple Listeners with the same Port that all use the \"HTTP\"\n Protocol that all have unique Hostname values.\n2. Multiple Listeners with the same Port that use either the \"HTTPS\" or\n \"TLS\" Protocol that all have unique Hostname values.\n3. A mixture of \"TCP\" and \"UDP\" Protocol Listeners, where no Listener\n with the same Protocol has the same Port value.\n\nSome fields in the Listener struct have possible values that affect\nwhether the Listener is distinct. Hostname is particularly relevant\nfor HTTP or HTTPS protocols.\n\nWhen using the Hostname value to select between same-Port, same-Protocol\nListeners, the Hostname value must be different on each Listener for the\nListener to be distinct.\n\nWhen the Listeners are distinct based on Hostname, inbound request\nhostnames MUST match from the most specific to least specific Hostname\nvalues to choose the correct Listener and its associated set of Routes.\n\nExact matches must be processed before wildcard matches, and wildcard\nmatches must be processed before fallback (empty Hostname value)\nmatches. For example, `\"foo.example.com\"` takes precedence over\n`\"*.example.com\"`, and `\"*.example.com\"` takes precedence over `\"\"`.\n\nAdditionally, if there are multiple wildcard entries, more specific\nwildcard entries must be processed before less specific wildcard entries.\nFor example, `\"*.foo.example.com\"` takes precedence over `\"*.example.com\"`.\nThe precise definition here is that the higher the number of dots in the\nhostname to the right of the wildcard character, the higher the precedence.\n\nThe wildcard character will match any number of characters _and dots_ to\nthe left, however, so `\"*.example.com\"` will match both\n`\"foo.bar.example.com\"` _and_ `\"bar.example.com\"`.\n\nIf a set of Listeners contains Listeners that are not distinct, then those\nListeners are Conflicted, and the implementation MUST set the \"Conflicted\"\ncondition in the Listener Status to \"True\".\n\nImplementations MAY choose to accept a Gateway with some Conflicted\nListeners only if they only accept the partial Listener set that contains\nno Conflicted Listeners. To put this another way, implementations may\naccept a partial Listener set only if they throw out *all* the conflicting\nListeners. No picking one of the conflicting listeners as the winner.\nThis also means that the Gateway must have at least one non-conflicting\nListener in this case, otherwise it violates the requirement that at\nleast one Listener must be present.\n\nThe implementation MUST set a \"ListenersNotValid\" condition on the\nGateway Status when the Gateway contains Conflicted Listeners whether or\nnot they accept the Gateway. That Condition SHOULD clearly\nindicate in the Message which Listeners are conflicted, and which are\nAccepted. Additionally, the Listener status for those listeners SHOULD\nindicate which Listeners are conflicted and not Accepted.\n\nA Gateway's Listeners are considered \"compatible\" if:\n\n1. They are distinct.\n2. The implementation can serve them in compliance with the Addresses\n requirement that all Listeners are available on all assigned\n addresses.\n\nCompatible combinations in Extended support are expected to vary across\nimplementations. A combination that is compatible for one implementation\nmay not be compatible for another.\n\nFor example, an implementation that cannot serve both TCP and UDP listeners\non the same address, or cannot mix HTTPS and generic TLS listens on the same port\nwould not consider those cases compatible, even though they are distinct.\n\nNote that requests SHOULD match at most one Listener. For example, if\nListeners are defined for \"foo.example.com\" and \"*.example.com\", a\nrequest to \"foo.example.com\" SHOULD only be routed using routes attached\nto the \"foo.example.com\" Listener (and not the \"*.example.com\" Listener).\nThis concept is known as \"Listener Isolation\". Implementations that do\nnot support Listener Isolation MUST clearly document this.\n\nImplementations MAY merge separate Gateways onto a single set of\nAddresses if all Listeners across all Gateways are compatible.\n\nSupport: Core", + items: { + description: "Listener embodies the concept of a logical endpoint where a Gateway accepts\nnetwork connections.", + properties: { + allowedRoutes: { + default: { + namespaces: { + from: "Same" + } + }, + description: "AllowedRoutes defines the types of routes that MAY be attached to a\nListener and the trusted namespaces where those Route resources MAY be\npresent.\n\nAlthough a client request may match multiple route rules, only one rule\nmay ultimately receive the request. Matching precedence MUST be\ndetermined in order of the following criteria:\n\n* The most specific match as defined by the Route type.\n* The oldest Route based on creation timestamp. For example, a Route with\n a creation timestamp of \"2020-09-08 01:02:03\" is given precedence over\n a Route with a creation timestamp of \"2020-09-08 01:02:04\".\n* If everything else is equivalent, the Route appearing first in\n alphabetical order (namespace/name) should be given precedence. For\n example, foo/bar is given precedence over foo/baz.\n\nAll valid rules within a Route attached to this Listener should be\nimplemented. Invalid Route rules can be ignored (sometimes that will mean\nthe full Route). If a Route rule transitions from valid to invalid,\nsupport for that Route rule should be dropped to ensure consistency. For\nexample, even if a filter specified by a Route rule is invalid, the rest\nof the rules within that Route should still be supported.\n\nSupport: Core", + properties: { + kinds: { + description: "Kinds specifies the groups and kinds of Routes that are allowed to bind\nto this Gateway Listener. When unspecified or empty, the kinds of Routes\nselected are determined using the Listener protocol.\n\nA RouteGroupKind MUST correspond to kinds of Routes that are compatible\nwith the application protocol specified in the Listener's Protocol field.\nIf an implementation does not support or recognize this resource type, it\nMUST set the \"ResolvedRefs\" condition to False for this Listener with the\n\"InvalidRouteKinds\" reason.\n\nSupport: Core", + items: { + description: "RouteGroupKind indicates the group and kind of a Route resource.", + properties: { + group: { + default: "gateway.networking.k8s.io", + description: "Group is the group of the Route.", + maxLength: 253, + pattern: "^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$", + type: "string" + }, + kind: { + description: "Kind is the kind of the Route.", + maxLength: 63, + minLength: 1, + pattern: "^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$", + type: "string" + } + }, + required: ["kind"], + type: "object" + }, + maxItems: 8, + type: "array" + }, + namespaces: { + default: { + from: "Same" + }, + description: "Namespaces indicates namespaces from which Routes may be attached to this\nListener. This is restricted to the namespace of this Gateway by default.\n\nSupport: Core", + properties: { + from: { + default: "Same", + description: "From indicates where Routes will be selected for this Gateway. Possible\nvalues are:\n\n* All: Routes in all namespaces may be used by this Gateway.\n* Selector: Routes in namespaces selected by the selector may be used by\n this Gateway.\n* Same: Only Routes in the same namespace may be used by this Gateway.\n\nSupport: Core", + enum: ["All", "Selector", "Same"], + type: "string" + }, + selector: { + description: "Selector must be specified when From is set to \"Selector\". In that case,\nonly Routes in Namespaces matching this Selector will be selected by this\nGateway. This field is ignored for other values of \"From\".\n\nSupport: Core", + properties: { + matchExpressions: { + description: "matchExpressions is a list of label selector requirements. The requirements are ANDed.", + items: { + description: "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", + properties: { + key: { + description: "key is the label key that the selector applies to.", + type: "string" + }, + operator: { + description: "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", + type: "string" + }, + values: { + description: "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + required: ["key", "operator"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + matchLabels: { + additionalProperties: { + type: "string" + }, + description: "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", + type: "object" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + } + }, + type: "object" + } + }, + type: "object" + }, + hostname: { + description: "Hostname specifies the virtual hostname to match for protocol types that\ndefine this concept. When unspecified, all hostnames are matched. This\nfield is ignored for protocols that don't require hostname based\nmatching.\n\nImplementations MUST apply Hostname matching appropriately for each of\nthe following protocols:\n\n* TLS: The Listener Hostname MUST match the SNI.\n* HTTP: The Listener Hostname MUST match the Host header of the request.\n* HTTPS: The Listener Hostname SHOULD match at both the TLS and HTTP\n protocol layers as described above. If an implementation does not\n ensure that both the SNI and Host header match the Listener hostname,\n it MUST clearly document that.\n\nFor HTTPRoute and TLSRoute resources, there is an interaction with the\n`spec.hostnames` array. When both listener and route specify hostnames,\nthere MUST be an intersection between the values for a Route to be\naccepted. For more information, refer to the Route specific Hostnames\ndocumentation.\n\nHostnames that are prefixed with a wildcard label (`*.`) are interpreted\nas a suffix match. That means that a match for `*.example.com` would match\nboth `test.example.com`, and `foo.test.example.com`, but not `example.com`.\n\nSupport: Core", + maxLength: 253, + minLength: 1, + pattern: "^(\\*\\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$", + type: "string" + }, + name: { + description: "Name is the name of the Listener. This name MUST be unique within a\nGateway.\n\nSupport: Core", + maxLength: 253, + minLength: 1, + pattern: "^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$", + type: "string" + }, + port: { + description: "Port is the network port. Multiple listeners may use the\nsame port, subject to the Listener compatibility rules.\n\nSupport: Core", + format: "int32", + maximum: 65535, + minimum: 1, + type: "integer" + }, + protocol: { + description: "Protocol specifies the network protocol this listener expects to receive.\n\nSupport: Core", + maxLength: 255, + minLength: 1, + pattern: "^[a-zA-Z0-9]([-a-zA-Z0-9]*[a-zA-Z0-9])?$|[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\\/[A-Za-z0-9]+$", + type: "string" + }, + tls: { + description: "TLS is the TLS configuration for the Listener. This field is required if\nthe Protocol field is \"HTTPS\" or \"TLS\". It is invalid to set this field\nif the Protocol field is \"HTTP\", \"TCP\", or \"UDP\".\n\nThe association of SNIs to Certificate defined in GatewayTLSConfig is\ndefined based on the Hostname field for this listener.\n\nThe GatewayClass MUST use the longest matching SNI out of all\navailable certificates for any TLS handshake.\n\nSupport: Core", + properties: { + certificateRefs: { + description: "CertificateRefs contains a series of references to Kubernetes objects that\ncontains TLS certificates and private keys. These certificates are used to\nestablish a TLS handshake for requests that match the hostname of the\nassociated listener.\n\nA single CertificateRef to a Kubernetes Secret has \"Core\" support.\nImplementations MAY choose to support attaching multiple certificates to\na Listener, but this behavior is implementation-specific.\n\nReferences to a resource in different namespace are invalid UNLESS there\nis a ReferenceGrant in the target namespace that allows the certificate\nto be attached. If a ReferenceGrant does not allow this reference, the\n\"ResolvedRefs\" condition MUST be set to False for this listener with the\n\"RefNotPermitted\" reason.\n\nThis field is required to have at least one element when the mode is set\nto \"Terminate\" (default) and is optional otherwise.\n\nCertificateRefs can reference to standard Kubernetes resources, i.e.\nSecret, or implementation-specific custom resources.\n\nSupport: Core - A single reference to a Kubernetes Secret of type kubernetes.io/tls\n\nSupport: Implementation-specific (More than one reference or other resource types)", + items: { + description: "SecretObjectReference identifies an API object including its namespace,\ndefaulting to Secret.\n\nThe API object must be valid in the cluster; the Group and Kind must\nbe registered in the cluster for this reference to be valid.\n\nReferences to objects with invalid Group and Kind are not valid, and must\nbe rejected by the implementation, with appropriate Conditions set\non the containing object.", + properties: { + group: { + default: "", + description: "Group is the group of the referent. For example, \"gateway.networking.k8s.io\".\nWhen unspecified or empty string, core API group is inferred.", + maxLength: 253, + pattern: "^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$", + type: "string" + }, + kind: { + default: "Secret", + description: "Kind is kind of the referent. For example \"Secret\".", + maxLength: 63, + minLength: 1, + pattern: "^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$", + type: "string" + }, + name: { + description: "Name is the name of the referent.", + maxLength: 253, + minLength: 1, + type: "string" + }, + namespace: { + description: "Namespace is the namespace of the referenced object. When unspecified, the local\nnamespace is inferred.\n\nNote that when a namespace different than the local namespace is specified,\na ReferenceGrant object is required in the referent namespace to allow that\nnamespace's owner to accept the reference. See the ReferenceGrant\ndocumentation for details.\n\nSupport: Core", + maxLength: 63, + minLength: 1, + pattern: "^[a-z0-9]([-a-z0-9]*[a-z0-9])?$", + type: "string" + } + }, + required: ["name"], + type: "object" + }, + maxItems: 64, + type: "array" + }, + mode: { + default: "Terminate", + description: "Mode defines the TLS behavior for the TLS session initiated by the client.\nThere are two possible modes:\n\n- Terminate: The TLS session between the downstream client and the\n Gateway is terminated at the Gateway. This mode requires certificates\n to be specified in some way, such as populating the certificateRefs\n field.\n- Passthrough: The TLS session is NOT terminated by the Gateway. This\n implies that the Gateway can't decipher the TLS stream except for\n the ClientHello message of the TLS protocol. The certificateRefs field\n is ignored in this mode.\n\nSupport: Core", + enum: ["Terminate", "Passthrough"], + type: "string" + }, + options: { + additionalProperties: { + description: "AnnotationValue is the value of an annotation in Gateway API. This is used\nfor validation of maps such as TLS options. This roughly matches Kubernetes\nannotation validation, although the length validation in that case is based\non the entire size of the annotations struct.", + maxLength: 4096, + minLength: 0, + type: "string" + }, + description: "Options are a list of key/value pairs to enable extended TLS\nconfiguration for each implementation. For example, configuring the\nminimum TLS version or supported cipher suites.\n\nA set of common keys MAY be defined by the API in the future. To avoid\nany ambiguity, implementation-specific definitions MUST use\ndomain-prefixed names, such as `example.com/my-custom-option`.\nUn-prefixed names are reserved for key names defined by Gateway API.\n\nSupport: Implementation-specific", + maxProperties: 16, + type: "object" + } + }, + type: "object", + "x-kubernetes-validations": [{ + message: "certificateRefs or options must be specified when mode is Terminate", + rule: "self.mode == 'Terminate' ? size(self.certificateRefs) > 0 || size(self.options) > 0 : true" + }] + } + }, + required: ["name", "port", "protocol"], + type: "object" + }, + maxItems: 64, + minItems: 1, + type: "array", + "x-kubernetes-list-map-keys": ["name"], + "x-kubernetes-list-type": "map", + "x-kubernetes-validations": [{ + message: "tls must not be specified for protocols ['HTTP', 'TCP', 'UDP']", + rule: "self.all(l, l.protocol in ['HTTP', 'TCP', 'UDP'] ? !has(l.tls) : true)" + }, { + message: "tls mode must be Terminate for protocol HTTPS", + rule: "self.all(l, (l.protocol == 'HTTPS' && has(l.tls)) ? (l.tls.mode == '' || l.tls.mode == 'Terminate') : true)" + }, { + message: "hostname must not be specified for protocols ['TCP', 'UDP']", + rule: "self.all(l, l.protocol in ['TCP', 'UDP'] ? (!has(l.hostname) || l.hostname == '') : true)" + }, { + message: "Listener name must be unique within the Gateway", + rule: "self.all(l1, self.exists_one(l2, l1.name == l2.name))" + }, { + message: "Combination of port, protocol and hostname must be unique for each listener", + rule: "self.all(l1, self.exists_one(l2, l1.port == l2.port && l1.protocol == l2.protocol && (has(l1.hostname) && has(l2.hostname) ? l1.hostname == l2.hostname : !has(l1.hostname) && !has(l2.hostname))))" + }] + } + }, + required: ["gatewayClassName", "listeners"], + type: "object" + }, + status: { + default: { + conditions: [{ + lastTransitionTime: "1970-01-01T00:00:00Z", + message: "Waiting for controller", + reason: "Pending", + status: "Unknown", + type: "Accepted" + }, { + lastTransitionTime: "1970-01-01T00:00:00Z", + message: "Waiting for controller", + reason: "Pending", + status: "Unknown", + type: "Programmed" + }] + }, + description: "Status defines the current state of Gateway.", + properties: { + addresses: { + description: "Addresses lists the network addresses that have been bound to the\nGateway.\n\nThis list may differ from the addresses provided in the spec under some\nconditions:\n\n * no addresses are specified, all addresses are dynamically assigned\n * a combination of specified and dynamic addresses are assigned\n * a specified address was unusable (e.g. already in use)\n\n", + items: { + description: "GatewayStatusAddress describes a network address that is bound to a Gateway.", + oneOf: [{ + properties: { + type: { + enum: ["IPAddress"] + }, + value: { + anyOf: [{ + format: "ipv4" + }, { + format: "ipv6" + }] + } + } + }, { + properties: { + type: { + not: { + enum: ["IPAddress"] + } + } + } + }], + properties: { + type: { + default: "IPAddress", + description: "Type of the address.", + maxLength: 253, + minLength: 1, + pattern: "^Hostname|IPAddress|NamedAddress|[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\\/[A-Za-z0-9\\/\\-._~%!$&'()*+,;=:]+$", + type: "string" + }, + value: { + description: "Value of the address. The validity of the values will depend\non the type and support by the controller.\n\nExamples: `1.2.3.4`, `128::1`, `my-ip-address`.", + maxLength: 253, + minLength: 1, + type: "string" + } + }, + required: ["value"], + type: "object", + "x-kubernetes-validations": [{ + message: "Hostname value must only contain valid characters (matching ^(\\*\\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$)", + rule: "self.type == 'Hostname' ? self.value.matches(r\"\"\"^(\\*\\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\"\"\"): true" + }] + }, + maxItems: 16, + type: "array" + }, + conditions: { + default: [{ + lastTransitionTime: "1970-01-01T00:00:00Z", + message: "Waiting for controller", + reason: "Pending", + status: "Unknown", + type: "Accepted" + }, { + lastTransitionTime: "1970-01-01T00:00:00Z", + message: "Waiting for controller", + reason: "Pending", + status: "Unknown", + type: "Programmed" + }], + description: "Conditions describe the current conditions of the Gateway.\n\nImplementations should prefer to express Gateway conditions\nusing the `GatewayConditionType` and `GatewayConditionReason`\nconstants so that operators and tools can converge on a common\nvocabulary to describe Gateway state.\n\nKnown condition types are:\n\n* \"Accepted\"\n* \"Programmed\"\n* \"Ready\"", + items: { + description: "Condition contains details for one aspect of the current state of this API Resource.", + properties: { + lastTransitionTime: { + description: "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.", + format: "date-time", + type: "string" + }, + message: { + description: "message is a human readable message indicating details about the transition.\nThis may be an empty string.", + maxLength: 32768, + type: "string" + }, + observedGeneration: { + description: "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.", + format: "int64", + minimum: 0, + type: "integer" + }, + reason: { + description: "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.", + maxLength: 1024, + minLength: 1, + pattern: "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$", + type: "string" + }, + status: { + description: "status of the condition, one of True, False, Unknown.", + enum: ["True", "False", "Unknown"], + type: "string" + }, + type: { + description: "type of condition in CamelCase or in foo.example.com/CamelCase.", + maxLength: 316, + pattern: "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$", + type: "string" + } + }, + required: ["lastTransitionTime", "message", "reason", "status", "type"], + type: "object" + }, + maxItems: 8, + type: "array", + "x-kubernetes-list-map-keys": ["type"], + "x-kubernetes-list-type": "map" + }, + listeners: { + description: "Listeners provide status for each unique listener port defined in the Spec.", + items: { + description: "ListenerStatus is the status associated with a Listener.", + properties: { + attachedRoutes: { + description: "AttachedRoutes represents the total number of Routes that have been\nsuccessfully attached to this Listener.\n\nSuccessful attachment of a Route to a Listener is based solely on the\ncombination of the AllowedRoutes field on the corresponding Listener\nand the Route's ParentRefs field. A Route is successfully attached to\na Listener when it is selected by the Listener's AllowedRoutes field\nAND the Route has a valid ParentRef selecting the whole Gateway\nresource or a specific Listener as a parent resource (more detail on\nattachment semantics can be found in the documentation on the various\nRoute kinds ParentRefs fields). Listener or Route status does not impact\nsuccessful attachment, i.e. the AttachedRoutes field count MUST be set\nfor Listeners with condition Accepted: false and MUST count successfully\nattached Routes that may themselves have Accepted: false conditions.\n\nUses for this field include troubleshooting Route attachment and\nmeasuring blast radius/impact of changes to a Listener.", + format: "int32", + type: "integer" + }, + conditions: { + description: "Conditions describe the current condition of this listener.", + items: { + description: "Condition contains details for one aspect of the current state of this API Resource.", + properties: { + lastTransitionTime: { + description: "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.", + format: "date-time", + type: "string" + }, + message: { + description: "message is a human readable message indicating details about the transition.\nThis may be an empty string.", + maxLength: 32768, + type: "string" + }, + observedGeneration: { + description: "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.", + format: "int64", + minimum: 0, + type: "integer" + }, + reason: { + description: "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.", + maxLength: 1024, + minLength: 1, + pattern: "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$", + type: "string" + }, + status: { + description: "status of the condition, one of True, False, Unknown.", + enum: ["True", "False", "Unknown"], + type: "string" + }, + type: { + description: "type of condition in CamelCase or in foo.example.com/CamelCase.", + maxLength: 316, + pattern: "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$", + type: "string" + } + }, + required: ["lastTransitionTime", "message", "reason", "status", "type"], + type: "object" + }, + maxItems: 8, + type: "array", + "x-kubernetes-list-map-keys": ["type"], + "x-kubernetes-list-type": "map" + }, + name: { + description: "Name is the name of the Listener that this status corresponds to.", + maxLength: 253, + minLength: 1, + pattern: "^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$", + type: "string" + }, + supportedKinds: { + description: "SupportedKinds is the list indicating the Kinds supported by this\nlistener. This MUST represent the kinds an implementation supports for\nthat Listener configuration.\n\nIf kinds are specified in Spec that are not supported, they MUST NOT\nappear in this list and an implementation MUST set the \"ResolvedRefs\"\ncondition to \"False\" with the \"InvalidRouteKinds\" reason. If both valid\nand invalid Route kinds are specified, the implementation MUST\nreference the valid Route kinds that have been specified.", + items: { + description: "RouteGroupKind indicates the group and kind of a Route resource.", + properties: { + group: { + default: "gateway.networking.k8s.io", + description: "Group is the group of the Route.", + maxLength: 253, + pattern: "^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$", + type: "string" + }, + kind: { + description: "Kind is the kind of the Route.", + maxLength: 63, + minLength: 1, + pattern: "^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$", + type: "string" + } + }, + required: ["kind"], + type: "object" + }, + maxItems: 8, + type: "array" + } + }, + required: ["attachedRoutes", "conditions", "name", "supportedKinds"], + type: "object" + }, + maxItems: 64, + type: "array", + "x-kubernetes-list-map-keys": ["name"], + "x-kubernetes-list-type": "map" + } + }, + type: "object" + } + }, + required: ["spec"], + type: "object" + } + }, + served: true, + storage: true, + subresources: { + status: {} + } + }, { + additionalPrinterColumns: [{ + jsonPath: ".spec.gatewayClassName", + name: "Class", + type: "string" + }, { + jsonPath: ".status.addresses[*].value", + name: "Address", + type: "string" + }, { + jsonPath: ".status.conditions[?(@.type==\"Programmed\")].status", + name: "Programmed", + type: "string" + }, { + jsonPath: ".metadata.creationTimestamp", + name: "Age", + type: "date" + }], + name: "v1beta1", + schema: { + openAPIV3Schema: { + description: "Gateway represents an instance of a service-traffic handling infrastructure\nby binding Listeners to a set of IP addresses.", + properties: { + apiVersion: { + description: "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", + type: "string" + }, + kind: { + description: "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + type: "string" + }, + metadata: { + type: "object" + }, + spec: { + description: "Spec defines the desired state of Gateway.", + properties: { + addresses: { + description: "Addresses requested for this Gateway. This is optional and behavior can\ndepend on the implementation. If a value is set in the spec and the\nrequested address is invalid or unavailable, the implementation MUST\nindicate this in the associated entry in GatewayStatus.Addresses.\n\nThe Addresses field represents a request for the address(es) on the\n\"outside of the Gateway\", that traffic bound for this Gateway will use.\nThis could be the IP address or hostname of an external load balancer or\nother networking infrastructure, or some other address that traffic will\nbe sent to.\n\nIf no Addresses are specified, the implementation MAY schedule the\nGateway in an implementation-specific manner, assigning an appropriate\nset of Addresses.\n\nThe implementation MUST bind all Listeners to every GatewayAddress that\nit assigns to the Gateway and add a corresponding entry in\nGatewayStatus.Addresses.\n\nSupport: Extended\n\n", + items: { + description: "GatewayAddress describes an address that can be bound to a Gateway.", + oneOf: [{ + properties: { + type: { + enum: ["IPAddress"] + }, + value: { + anyOf: [{ + format: "ipv4" + }, { + format: "ipv6" + }] + } + } + }, { + properties: { + type: { + not: { + enum: ["IPAddress"] + } + } + } + }], + properties: { + type: { + default: "IPAddress", + description: "Type of the address.", + maxLength: 253, + minLength: 1, + pattern: "^Hostname|IPAddress|NamedAddress|[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\\/[A-Za-z0-9\\/\\-._~%!$&'()*+,;=:]+$", + type: "string" + }, + value: { + description: "Value of the address. The validity of the values will depend\non the type and support by the controller.\n\nExamples: `1.2.3.4`, `128::1`, `my-ip-address`.", + maxLength: 253, + minLength: 1, + type: "string" + } + }, + required: ["value"], + type: "object", + "x-kubernetes-validations": [{ + message: "Hostname value must only contain valid characters (matching ^(\\*\\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$)", + rule: "self.type == 'Hostname' ? self.value.matches(r\"\"\"^(\\*\\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\"\"\"): true" + }] + }, + maxItems: 16, + type: "array", + "x-kubernetes-validations": [{ + message: "IPAddress values must be unique", + rule: "self.all(a1, a1.type == 'IPAddress' ? self.exists_one(a2, a2.type == a1.type && a2.value == a1.value) : true )" + }, { + message: "Hostname values must be unique", + rule: "self.all(a1, a1.type == 'Hostname' ? self.exists_one(a2, a2.type == a1.type && a2.value == a1.value) : true )" + }] + }, + gatewayClassName: { + description: "GatewayClassName used for this Gateway. This is the name of a\nGatewayClass resource.", + maxLength: 253, + minLength: 1, + type: "string" + }, + infrastructure: { + description: "Infrastructure defines infrastructure level attributes about this Gateway instance.\n\nSupport: Extended", + properties: { + annotations: { + additionalProperties: { + description: "AnnotationValue is the value of an annotation in Gateway API. This is used\nfor validation of maps such as TLS options. This roughly matches Kubernetes\nannotation validation, although the length validation in that case is based\non the entire size of the annotations struct.", + maxLength: 4096, + minLength: 0, + type: "string" + }, + description: "Annotations that SHOULD be applied to any resources created in response to this Gateway.\n\nFor implementations creating other Kubernetes objects, this should be the `metadata.annotations` field on resources.\nFor other implementations, this refers to any relevant (implementation specific) \"annotations\" concepts.\n\nAn implementation may chose to add additional implementation-specific annotations as they see fit.\n\nSupport: Extended", + maxProperties: 8, + type: "object", + "x-kubernetes-validations": [{ + message: "Annotation keys must be in the form of an optional DNS subdomain prefix followed by a required name segment of up to 63 characters.", + rule: "self.all(key, key.matches(r\"\"\"^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?([A-Za-z0-9][-A-Za-z0-9_.]{0,61})?[A-Za-z0-9]$\"\"\"))" + }, { + message: "If specified, the annotation key's prefix must be a DNS subdomain not longer than 253 characters in total.", + rule: "self.all(key, key.split(\"/\")[0].size() < 253)" + }] + }, + labels: { + additionalProperties: { + description: "LabelValue is the value of a label in the Gateway API. This is used for validation\nof maps such as Gateway infrastructure labels. This matches the Kubernetes\nlabel validation rules:\n* must be 63 characters or less (can be empty),\n* unless empty, must begin and end with an alphanumeric character ([a-z0-9A-Z]),\n* could contain dashes (-), underscores (_), dots (.), and alphanumerics between.\n\nValid values include:\n\n* MyValue\n* my.name\n* 123-my-value", + maxLength: 63, + minLength: 0, + pattern: "^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$", + type: "string" + }, + description: "Labels that SHOULD be applied to any resources created in response to this Gateway.\n\nFor implementations creating other Kubernetes objects, this should be the `metadata.labels` field on resources.\nFor other implementations, this refers to any relevant (implementation specific) \"labels\" concepts.\n\nAn implementation may chose to add additional implementation-specific labels as they see fit.\n\nIf an implementation maps these labels to Pods, or any other resource that would need to be recreated when labels\nchange, it SHOULD clearly warn about this behavior in documentation.\n\nSupport: Extended", + maxProperties: 8, + type: "object", + "x-kubernetes-validations": [{ + message: "Label keys must be in the form of an optional DNS subdomain prefix followed by a required name segment of up to 63 characters.", + rule: "self.all(key, key.matches(r\"\"\"^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?([A-Za-z0-9][-A-Za-z0-9_.]{0,61})?[A-Za-z0-9]$\"\"\"))" + }, { + message: "If specified, the label key's prefix must be a DNS subdomain not longer than 253 characters in total.", + rule: "self.all(key, key.split(\"/\")[0].size() < 253)" + }] + }, + parametersRef: { + description: "ParametersRef is a reference to a resource that contains the configuration\nparameters corresponding to the Gateway. This is optional if the\ncontroller does not require any additional configuration.\n\nThis follows the same semantics as GatewayClass's `parametersRef`, but on a per-Gateway basis\n\nThe Gateway's GatewayClass may provide its own `parametersRef`. When both are specified,\nthe merging behavior is implementation specific.\nIt is generally recommended that GatewayClass provides defaults that can be overridden by a Gateway.\n\nSupport: Implementation-specific", + properties: { + group: { + description: "Group is the group of the referent.", + maxLength: 253, + pattern: "^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$", + type: "string" + }, + kind: { + description: "Kind is kind of the referent.", + maxLength: 63, + minLength: 1, + pattern: "^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$", + type: "string" + }, + name: { + description: "Name is the name of the referent.", + maxLength: 253, + minLength: 1, + type: "string" + } + }, + required: ["group", "kind", "name"], + type: "object" + } + }, + type: "object" + }, + listeners: { + description: "Listeners associated with this Gateway. Listeners define\nlogical endpoints that are bound on this Gateway's addresses.\nAt least one Listener MUST be specified.\n\nEach Listener in a set of Listeners (for example, in a single Gateway)\nMUST be _distinct_, in that a traffic flow MUST be able to be assigned to\nexactly one listener. (This section uses \"set of Listeners\" rather than\n\"Listeners in a single Gateway\" because implementations MAY merge configuration\nfrom multiple Gateways onto a single data plane, and these rules _also_\napply in that case).\n\nPractically, this means that each listener in a set MUST have a unique\ncombination of Port, Protocol, and, if supported by the protocol, Hostname.\n\nSome combinations of port, protocol, and TLS settings are considered\nCore support and MUST be supported by implementations based on their\ntargeted conformance profile:\n\nHTTP Profile\n\n1. HTTPRoute, Port: 80, Protocol: HTTP\n2. HTTPRoute, Port: 443, Protocol: HTTPS, TLS Mode: Terminate, TLS keypair provided\n\nTLS Profile\n\n1. TLSRoute, Port: 443, Protocol: TLS, TLS Mode: Passthrough\n\n\"Distinct\" Listeners have the following property:\n\nThe implementation can match inbound requests to a single distinct\nListener. When multiple Listeners share values for fields (for\nexample, two Listeners with the same Port value), the implementation\ncan match requests to only one of the Listeners using other\nListener fields.\n\nFor example, the following Listener scenarios are distinct:\n\n1. Multiple Listeners with the same Port that all use the \"HTTP\"\n Protocol that all have unique Hostname values.\n2. Multiple Listeners with the same Port that use either the \"HTTPS\" or\n \"TLS\" Protocol that all have unique Hostname values.\n3. A mixture of \"TCP\" and \"UDP\" Protocol Listeners, where no Listener\n with the same Protocol has the same Port value.\n\nSome fields in the Listener struct have possible values that affect\nwhether the Listener is distinct. Hostname is particularly relevant\nfor HTTP or HTTPS protocols.\n\nWhen using the Hostname value to select between same-Port, same-Protocol\nListeners, the Hostname value must be different on each Listener for the\nListener to be distinct.\n\nWhen the Listeners are distinct based on Hostname, inbound request\nhostnames MUST match from the most specific to least specific Hostname\nvalues to choose the correct Listener and its associated set of Routes.\n\nExact matches must be processed before wildcard matches, and wildcard\nmatches must be processed before fallback (empty Hostname value)\nmatches. For example, `\"foo.example.com\"` takes precedence over\n`\"*.example.com\"`, and `\"*.example.com\"` takes precedence over `\"\"`.\n\nAdditionally, if there are multiple wildcard entries, more specific\nwildcard entries must be processed before less specific wildcard entries.\nFor example, `\"*.foo.example.com\"` takes precedence over `\"*.example.com\"`.\nThe precise definition here is that the higher the number of dots in the\nhostname to the right of the wildcard character, the higher the precedence.\n\nThe wildcard character will match any number of characters _and dots_ to\nthe left, however, so `\"*.example.com\"` will match both\n`\"foo.bar.example.com\"` _and_ `\"bar.example.com\"`.\n\nIf a set of Listeners contains Listeners that are not distinct, then those\nListeners are Conflicted, and the implementation MUST set the \"Conflicted\"\ncondition in the Listener Status to \"True\".\n\nImplementations MAY choose to accept a Gateway with some Conflicted\nListeners only if they only accept the partial Listener set that contains\nno Conflicted Listeners. To put this another way, implementations may\naccept a partial Listener set only if they throw out *all* the conflicting\nListeners. No picking one of the conflicting listeners as the winner.\nThis also means that the Gateway must have at least one non-conflicting\nListener in this case, otherwise it violates the requirement that at\nleast one Listener must be present.\n\nThe implementation MUST set a \"ListenersNotValid\" condition on the\nGateway Status when the Gateway contains Conflicted Listeners whether or\nnot they accept the Gateway. That Condition SHOULD clearly\nindicate in the Message which Listeners are conflicted, and which are\nAccepted. Additionally, the Listener status for those listeners SHOULD\nindicate which Listeners are conflicted and not Accepted.\n\nA Gateway's Listeners are considered \"compatible\" if:\n\n1. They are distinct.\n2. The implementation can serve them in compliance with the Addresses\n requirement that all Listeners are available on all assigned\n addresses.\n\nCompatible combinations in Extended support are expected to vary across\nimplementations. A combination that is compatible for one implementation\nmay not be compatible for another.\n\nFor example, an implementation that cannot serve both TCP and UDP listeners\non the same address, or cannot mix HTTPS and generic TLS listens on the same port\nwould not consider those cases compatible, even though they are distinct.\n\nNote that requests SHOULD match at most one Listener. For example, if\nListeners are defined for \"foo.example.com\" and \"*.example.com\", a\nrequest to \"foo.example.com\" SHOULD only be routed using routes attached\nto the \"foo.example.com\" Listener (and not the \"*.example.com\" Listener).\nThis concept is known as \"Listener Isolation\". Implementations that do\nnot support Listener Isolation MUST clearly document this.\n\nImplementations MAY merge separate Gateways onto a single set of\nAddresses if all Listeners across all Gateways are compatible.\n\nSupport: Core", + items: { + description: "Listener embodies the concept of a logical endpoint where a Gateway accepts\nnetwork connections.", + properties: { + allowedRoutes: { + default: { + namespaces: { + from: "Same" + } + }, + description: "AllowedRoutes defines the types of routes that MAY be attached to a\nListener and the trusted namespaces where those Route resources MAY be\npresent.\n\nAlthough a client request may match multiple route rules, only one rule\nmay ultimately receive the request. Matching precedence MUST be\ndetermined in order of the following criteria:\n\n* The most specific match as defined by the Route type.\n* The oldest Route based on creation timestamp. For example, a Route with\n a creation timestamp of \"2020-09-08 01:02:03\" is given precedence over\n a Route with a creation timestamp of \"2020-09-08 01:02:04\".\n* If everything else is equivalent, the Route appearing first in\n alphabetical order (namespace/name) should be given precedence. For\n example, foo/bar is given precedence over foo/baz.\n\nAll valid rules within a Route attached to this Listener should be\nimplemented. Invalid Route rules can be ignored (sometimes that will mean\nthe full Route). If a Route rule transitions from valid to invalid,\nsupport for that Route rule should be dropped to ensure consistency. For\nexample, even if a filter specified by a Route rule is invalid, the rest\nof the rules within that Route should still be supported.\n\nSupport: Core", + properties: { + kinds: { + description: "Kinds specifies the groups and kinds of Routes that are allowed to bind\nto this Gateway Listener. When unspecified or empty, the kinds of Routes\nselected are determined using the Listener protocol.\n\nA RouteGroupKind MUST correspond to kinds of Routes that are compatible\nwith the application protocol specified in the Listener's Protocol field.\nIf an implementation does not support or recognize this resource type, it\nMUST set the \"ResolvedRefs\" condition to False for this Listener with the\n\"InvalidRouteKinds\" reason.\n\nSupport: Core", + items: { + description: "RouteGroupKind indicates the group and kind of a Route resource.", + properties: { + group: { + default: "gateway.networking.k8s.io", + description: "Group is the group of the Route.", + maxLength: 253, + pattern: "^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$", + type: "string" + }, + kind: { + description: "Kind is the kind of the Route.", + maxLength: 63, + minLength: 1, + pattern: "^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$", + type: "string" + } + }, + required: ["kind"], + type: "object" + }, + maxItems: 8, + type: "array" + }, + namespaces: { + default: { + from: "Same" + }, + description: "Namespaces indicates namespaces from which Routes may be attached to this\nListener. This is restricted to the namespace of this Gateway by default.\n\nSupport: Core", + properties: { + from: { + default: "Same", + description: "From indicates where Routes will be selected for this Gateway. Possible\nvalues are:\n\n* All: Routes in all namespaces may be used by this Gateway.\n* Selector: Routes in namespaces selected by the selector may be used by\n this Gateway.\n* Same: Only Routes in the same namespace may be used by this Gateway.\n\nSupport: Core", + enum: ["All", "Selector", "Same"], + type: "string" + }, + selector: { + description: "Selector must be specified when From is set to \"Selector\". In that case,\nonly Routes in Namespaces matching this Selector will be selected by this\nGateway. This field is ignored for other values of \"From\".\n\nSupport: Core", + properties: { + matchExpressions: { + description: "matchExpressions is a list of label selector requirements. The requirements are ANDed.", + items: { + description: "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", + properties: { + key: { + description: "key is the label key that the selector applies to.", + type: "string" + }, + operator: { + description: "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", + type: "string" + }, + values: { + description: "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + required: ["key", "operator"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + matchLabels: { + additionalProperties: { + type: "string" + }, + description: "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", + type: "object" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + } + }, + type: "object" + } + }, + type: "object" + }, + hostname: { + description: "Hostname specifies the virtual hostname to match for protocol types that\ndefine this concept. When unspecified, all hostnames are matched. This\nfield is ignored for protocols that don't require hostname based\nmatching.\n\nImplementations MUST apply Hostname matching appropriately for each of\nthe following protocols:\n\n* TLS: The Listener Hostname MUST match the SNI.\n* HTTP: The Listener Hostname MUST match the Host header of the request.\n* HTTPS: The Listener Hostname SHOULD match at both the TLS and HTTP\n protocol layers as described above. If an implementation does not\n ensure that both the SNI and Host header match the Listener hostname,\n it MUST clearly document that.\n\nFor HTTPRoute and TLSRoute resources, there is an interaction with the\n`spec.hostnames` array. When both listener and route specify hostnames,\nthere MUST be an intersection between the values for a Route to be\naccepted. For more information, refer to the Route specific Hostnames\ndocumentation.\n\nHostnames that are prefixed with a wildcard label (`*.`) are interpreted\nas a suffix match. That means that a match for `*.example.com` would match\nboth `test.example.com`, and `foo.test.example.com`, but not `example.com`.\n\nSupport: Core", + maxLength: 253, + minLength: 1, + pattern: "^(\\*\\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$", + type: "string" + }, + name: { + description: "Name is the name of the Listener. This name MUST be unique within a\nGateway.\n\nSupport: Core", + maxLength: 253, + minLength: 1, + pattern: "^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$", + type: "string" + }, + port: { + description: "Port is the network port. Multiple listeners may use the\nsame port, subject to the Listener compatibility rules.\n\nSupport: Core", + format: "int32", + maximum: 65535, + minimum: 1, + type: "integer" + }, + protocol: { + description: "Protocol specifies the network protocol this listener expects to receive.\n\nSupport: Core", + maxLength: 255, + minLength: 1, + pattern: "^[a-zA-Z0-9]([-a-zA-Z0-9]*[a-zA-Z0-9])?$|[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\\/[A-Za-z0-9]+$", + type: "string" + }, + tls: { + description: "TLS is the TLS configuration for the Listener. This field is required if\nthe Protocol field is \"HTTPS\" or \"TLS\". It is invalid to set this field\nif the Protocol field is \"HTTP\", \"TCP\", or \"UDP\".\n\nThe association of SNIs to Certificate defined in GatewayTLSConfig is\ndefined based on the Hostname field for this listener.\n\nThe GatewayClass MUST use the longest matching SNI out of all\navailable certificates for any TLS handshake.\n\nSupport: Core", + properties: { + certificateRefs: { + description: "CertificateRefs contains a series of references to Kubernetes objects that\ncontains TLS certificates and private keys. These certificates are used to\nestablish a TLS handshake for requests that match the hostname of the\nassociated listener.\n\nA single CertificateRef to a Kubernetes Secret has \"Core\" support.\nImplementations MAY choose to support attaching multiple certificates to\na Listener, but this behavior is implementation-specific.\n\nReferences to a resource in different namespace are invalid UNLESS there\nis a ReferenceGrant in the target namespace that allows the certificate\nto be attached. If a ReferenceGrant does not allow this reference, the\n\"ResolvedRefs\" condition MUST be set to False for this listener with the\n\"RefNotPermitted\" reason.\n\nThis field is required to have at least one element when the mode is set\nto \"Terminate\" (default) and is optional otherwise.\n\nCertificateRefs can reference to standard Kubernetes resources, i.e.\nSecret, or implementation-specific custom resources.\n\nSupport: Core - A single reference to a Kubernetes Secret of type kubernetes.io/tls\n\nSupport: Implementation-specific (More than one reference or other resource types)", + items: { + description: "SecretObjectReference identifies an API object including its namespace,\ndefaulting to Secret.\n\nThe API object must be valid in the cluster; the Group and Kind must\nbe registered in the cluster for this reference to be valid.\n\nReferences to objects with invalid Group and Kind are not valid, and must\nbe rejected by the implementation, with appropriate Conditions set\non the containing object.", + properties: { + group: { + default: "", + description: "Group is the group of the referent. For example, \"gateway.networking.k8s.io\".\nWhen unspecified or empty string, core API group is inferred.", + maxLength: 253, + pattern: "^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$", + type: "string" + }, + kind: { + default: "Secret", + description: "Kind is kind of the referent. For example \"Secret\".", + maxLength: 63, + minLength: 1, + pattern: "^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$", + type: "string" + }, + name: { + description: "Name is the name of the referent.", + maxLength: 253, + minLength: 1, + type: "string" + }, + namespace: { + description: "Namespace is the namespace of the referenced object. When unspecified, the local\nnamespace is inferred.\n\nNote that when a namespace different than the local namespace is specified,\na ReferenceGrant object is required in the referent namespace to allow that\nnamespace's owner to accept the reference. See the ReferenceGrant\ndocumentation for details.\n\nSupport: Core", + maxLength: 63, + minLength: 1, + pattern: "^[a-z0-9]([-a-z0-9]*[a-z0-9])?$", + type: "string" + } + }, + required: ["name"], + type: "object" + }, + maxItems: 64, + type: "array" + }, + mode: { + default: "Terminate", + description: "Mode defines the TLS behavior for the TLS session initiated by the client.\nThere are two possible modes:\n\n- Terminate: The TLS session between the downstream client and the\n Gateway is terminated at the Gateway. This mode requires certificates\n to be specified in some way, such as populating the certificateRefs\n field.\n- Passthrough: The TLS session is NOT terminated by the Gateway. This\n implies that the Gateway can't decipher the TLS stream except for\n the ClientHello message of the TLS protocol. The certificateRefs field\n is ignored in this mode.\n\nSupport: Core", + enum: ["Terminate", "Passthrough"], + type: "string" + }, + options: { + additionalProperties: { + description: "AnnotationValue is the value of an annotation in Gateway API. This is used\nfor validation of maps such as TLS options. This roughly matches Kubernetes\nannotation validation, although the length validation in that case is based\non the entire size of the annotations struct.", + maxLength: 4096, + minLength: 0, + type: "string" + }, + description: "Options are a list of key/value pairs to enable extended TLS\nconfiguration for each implementation. For example, configuring the\nminimum TLS version or supported cipher suites.\n\nA set of common keys MAY be defined by the API in the future. To avoid\nany ambiguity, implementation-specific definitions MUST use\ndomain-prefixed names, such as `example.com/my-custom-option`.\nUn-prefixed names are reserved for key names defined by Gateway API.\n\nSupport: Implementation-specific", + maxProperties: 16, + type: "object" + } + }, + type: "object", + "x-kubernetes-validations": [{ + message: "certificateRefs or options must be specified when mode is Terminate", + rule: "self.mode == 'Terminate' ? size(self.certificateRefs) > 0 || size(self.options) > 0 : true" + }] + } + }, + required: ["name", "port", "protocol"], + type: "object" + }, + maxItems: 64, + minItems: 1, + type: "array", + "x-kubernetes-list-map-keys": ["name"], + "x-kubernetes-list-type": "map", + "x-kubernetes-validations": [{ + message: "tls must not be specified for protocols ['HTTP', 'TCP', 'UDP']", + rule: "self.all(l, l.protocol in ['HTTP', 'TCP', 'UDP'] ? !has(l.tls) : true)" + }, { + message: "tls mode must be Terminate for protocol HTTPS", + rule: "self.all(l, (l.protocol == 'HTTPS' && has(l.tls)) ? (l.tls.mode == '' || l.tls.mode == 'Terminate') : true)" + }, { + message: "hostname must not be specified for protocols ['TCP', 'UDP']", + rule: "self.all(l, l.protocol in ['TCP', 'UDP'] ? (!has(l.hostname) || l.hostname == '') : true)" + }, { + message: "Listener name must be unique within the Gateway", + rule: "self.all(l1, self.exists_one(l2, l1.name == l2.name))" + }, { + message: "Combination of port, protocol and hostname must be unique for each listener", + rule: "self.all(l1, self.exists_one(l2, l1.port == l2.port && l1.protocol == l2.protocol && (has(l1.hostname) && has(l2.hostname) ? l1.hostname == l2.hostname : !has(l1.hostname) && !has(l2.hostname))))" + }] + } + }, + required: ["gatewayClassName", "listeners"], + type: "object" + }, + status: { + default: { + conditions: [{ + lastTransitionTime: "1970-01-01T00:00:00Z", + message: "Waiting for controller", + reason: "Pending", + status: "Unknown", + type: "Accepted" + }, { + lastTransitionTime: "1970-01-01T00:00:00Z", + message: "Waiting for controller", + reason: "Pending", + status: "Unknown", + type: "Programmed" + }] + }, + description: "Status defines the current state of Gateway.", + properties: { + addresses: { + description: "Addresses lists the network addresses that have been bound to the\nGateway.\n\nThis list may differ from the addresses provided in the spec under some\nconditions:\n\n * no addresses are specified, all addresses are dynamically assigned\n * a combination of specified and dynamic addresses are assigned\n * a specified address was unusable (e.g. already in use)\n\n", + items: { + description: "GatewayStatusAddress describes a network address that is bound to a Gateway.", + oneOf: [{ + properties: { + type: { + enum: ["IPAddress"] + }, + value: { + anyOf: [{ + format: "ipv4" + }, { + format: "ipv6" + }] + } + } + }, { + properties: { + type: { + not: { + enum: ["IPAddress"] + } + } + } + }], + properties: { + type: { + default: "IPAddress", + description: "Type of the address.", + maxLength: 253, + minLength: 1, + pattern: "^Hostname|IPAddress|NamedAddress|[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\\/[A-Za-z0-9\\/\\-._~%!$&'()*+,;=:]+$", + type: "string" + }, + value: { + description: "Value of the address. The validity of the values will depend\non the type and support by the controller.\n\nExamples: `1.2.3.4`, `128::1`, `my-ip-address`.", + maxLength: 253, + minLength: 1, + type: "string" + } + }, + required: ["value"], + type: "object", + "x-kubernetes-validations": [{ + message: "Hostname value must only contain valid characters (matching ^(\\*\\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$)", + rule: "self.type == 'Hostname' ? self.value.matches(r\"\"\"^(\\*\\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$\"\"\"): true" + }] + }, + maxItems: 16, + type: "array" + }, + conditions: { + default: [{ + lastTransitionTime: "1970-01-01T00:00:00Z", + message: "Waiting for controller", + reason: "Pending", + status: "Unknown", + type: "Accepted" + }, { + lastTransitionTime: "1970-01-01T00:00:00Z", + message: "Waiting for controller", + reason: "Pending", + status: "Unknown", + type: "Programmed" + }], + description: "Conditions describe the current conditions of the Gateway.\n\nImplementations should prefer to express Gateway conditions\nusing the `GatewayConditionType` and `GatewayConditionReason`\nconstants so that operators and tools can converge on a common\nvocabulary to describe Gateway state.\n\nKnown condition types are:\n\n* \"Accepted\"\n* \"Programmed\"\n* \"Ready\"", + items: { + description: "Condition contains details for one aspect of the current state of this API Resource.", + properties: { + lastTransitionTime: { + description: "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.", + format: "date-time", + type: "string" + }, + message: { + description: "message is a human readable message indicating details about the transition.\nThis may be an empty string.", + maxLength: 32768, + type: "string" + }, + observedGeneration: { + description: "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.", + format: "int64", + minimum: 0, + type: "integer" + }, + reason: { + description: "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.", + maxLength: 1024, + minLength: 1, + pattern: "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$", + type: "string" + }, + status: { + description: "status of the condition, one of True, False, Unknown.", + enum: ["True", "False", "Unknown"], + type: "string" + }, + type: { + description: "type of condition in CamelCase or in foo.example.com/CamelCase.", + maxLength: 316, + pattern: "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$", + type: "string" + } + }, + required: ["lastTransitionTime", "message", "reason", "status", "type"], + type: "object" + }, + maxItems: 8, + type: "array", + "x-kubernetes-list-map-keys": ["type"], + "x-kubernetes-list-type": "map" + }, + listeners: { + description: "Listeners provide status for each unique listener port defined in the Spec.", + items: { + description: "ListenerStatus is the status associated with a Listener.", + properties: { + attachedRoutes: { + description: "AttachedRoutes represents the total number of Routes that have been\nsuccessfully attached to this Listener.\n\nSuccessful attachment of a Route to a Listener is based solely on the\ncombination of the AllowedRoutes field on the corresponding Listener\nand the Route's ParentRefs field. A Route is successfully attached to\na Listener when it is selected by the Listener's AllowedRoutes field\nAND the Route has a valid ParentRef selecting the whole Gateway\nresource or a specific Listener as a parent resource (more detail on\nattachment semantics can be found in the documentation on the various\nRoute kinds ParentRefs fields). Listener or Route status does not impact\nsuccessful attachment, i.e. the AttachedRoutes field count MUST be set\nfor Listeners with condition Accepted: false and MUST count successfully\nattached Routes that may themselves have Accepted: false conditions.\n\nUses for this field include troubleshooting Route attachment and\nmeasuring blast radius/impact of changes to a Listener.", + format: "int32", + type: "integer" + }, + conditions: { + description: "Conditions describe the current condition of this listener.", + items: { + description: "Condition contains details for one aspect of the current state of this API Resource.", + properties: { + lastTransitionTime: { + description: "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.", + format: "date-time", + type: "string" + }, + message: { + description: "message is a human readable message indicating details about the transition.\nThis may be an empty string.", + maxLength: 32768, + type: "string" + }, + observedGeneration: { + description: "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.", + format: "int64", + minimum: 0, + type: "integer" + }, + reason: { + description: "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.", + maxLength: 1024, + minLength: 1, + pattern: "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$", + type: "string" + }, + status: { + description: "status of the condition, one of True, False, Unknown.", + enum: ["True", "False", "Unknown"], + type: "string" + }, + type: { + description: "type of condition in CamelCase or in foo.example.com/CamelCase.", + maxLength: 316, + pattern: "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$", + type: "string" + } + }, + required: ["lastTransitionTime", "message", "reason", "status", "type"], + type: "object" + }, + maxItems: 8, + type: "array", + "x-kubernetes-list-map-keys": ["type"], + "x-kubernetes-list-type": "map" + }, + name: { + description: "Name is the name of the Listener that this status corresponds to.", + maxLength: 253, + minLength: 1, + pattern: "^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$", + type: "string" + }, + supportedKinds: { + description: "SupportedKinds is the list indicating the Kinds supported by this\nlistener. This MUST represent the kinds an implementation supports for\nthat Listener configuration.\n\nIf kinds are specified in Spec that are not supported, they MUST NOT\nappear in this list and an implementation MUST set the \"ResolvedRefs\"\ncondition to \"False\" with the \"InvalidRouteKinds\" reason. If both valid\nand invalid Route kinds are specified, the implementation MUST\nreference the valid Route kinds that have been specified.", + items: { + description: "RouteGroupKind indicates the group and kind of a Route resource.", + properties: { + group: { + default: "gateway.networking.k8s.io", + description: "Group is the group of the Route.", + maxLength: 253, + pattern: "^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$", + type: "string" + }, + kind: { + description: "Kind is the kind of the Route.", + maxLength: 63, + minLength: 1, + pattern: "^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$", + type: "string" + } + }, + required: ["kind"], + type: "object" + }, + maxItems: 8, + type: "array" + } + }, + required: ["attachedRoutes", "conditions", "name", "supportedKinds"], + type: "object" + }, + maxItems: 64, + type: "array", + "x-kubernetes-list-map-keys": ["name"], + "x-kubernetes-list-type": "map" + } + }, + type: "object" + } + }, + required: ["spec"], + type: "object" + } + }, + served: true, + storage: false, + subresources: { + status: {} + } + }] + }, + status: { + acceptedNames: { + kind: "", + plural: "" + }, + conditions: null, + storedVersions: null + } +}; +export const CustomResourceDefinition_GrpcroutesGatewayNetworkingK8sIo: KubernetesResource = { + apiVersion: "apiextensions.k8s.io/v1", + kind: "CustomResourceDefinition", + metadata: { + annotations: { + "api-approved.kubernetes.io": "https://github.com/kubernetes-sigs/gateway-api/pull/3328", + "gateway.networking.k8s.io/bundle-version": "v1.2.1", + "gateway.networking.k8s.io/channel": "standard" + }, + creationTimestamp: null, + name: "grpcroutes.gateway.networking.k8s.io" + }, + spec: { + group: "gateway.networking.k8s.io", + names: { + categories: ["gateway-api"], + kind: "GRPCRoute", + listKind: "GRPCRouteList", + plural: "grpcroutes", + singular: "grpcroute" + }, + scope: "Namespaced", + versions: [{ + additionalPrinterColumns: [{ + jsonPath: ".spec.hostnames", + name: "Hostnames", + type: "string" + }, { + jsonPath: ".metadata.creationTimestamp", + name: "Age", + type: "date" + }], + name: "v1", + schema: { + openAPIV3Schema: { + description: "GRPCRoute provides a way to route gRPC requests. This includes the capability\nto match requests by hostname, gRPC service, gRPC method, or HTTP/2 header.\nFilters can be used to specify additional processing steps. Backends specify\nwhere matching requests will be routed.\n\nGRPCRoute falls under extended support within the Gateway API. Within the\nfollowing specification, the word \"MUST\" indicates that an implementation\nsupporting GRPCRoute must conform to the indicated requirement, but an\nimplementation not supporting this route type need not follow the requirement\nunless explicitly indicated.\n\nImplementations supporting `GRPCRoute` with the `HTTPS` `ProtocolType` MUST\naccept HTTP/2 connections without an initial upgrade from HTTP/1.1, i.e. via\nALPN. If the implementation does not support this, then it MUST set the\n\"Accepted\" condition to \"False\" for the affected listener with a reason of\n\"UnsupportedProtocol\". Implementations MAY also accept HTTP/2 connections\nwith an upgrade from HTTP/1.\n\nImplementations supporting `GRPCRoute` with the `HTTP` `ProtocolType` MUST\nsupport HTTP/2 over cleartext TCP (h2c,\nhttps://www.rfc-editor.org/rfc/rfc7540#section-3.1) without an initial\nupgrade from HTTP/1.1, i.e. with prior knowledge\n(https://www.rfc-editor.org/rfc/rfc7540#section-3.4). If the implementation\ndoes not support this, then it MUST set the \"Accepted\" condition to \"False\"\nfor the affected listener with a reason of \"UnsupportedProtocol\".\nImplementations MAY also accept HTTP/2 connections with an upgrade from\nHTTP/1, i.e. without prior knowledge.", + properties: { + apiVersion: { + description: "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", + type: "string" + }, + kind: { + description: "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + type: "string" + }, + metadata: { + type: "object" + }, + spec: { + description: "Spec defines the desired state of GRPCRoute.", + properties: { + hostnames: { + description: "Hostnames defines a set of hostnames to match against the GRPC\nHost header to select a GRPCRoute to process the request. This matches\nthe RFC 1123 definition of a hostname with 2 notable exceptions:\n\n1. IPs are not allowed.\n2. A hostname may be prefixed with a wildcard label (`*.`). The wildcard\n label MUST appear by itself as the first label.\n\nIf a hostname is specified by both the Listener and GRPCRoute, there\nMUST be at least one intersecting hostname for the GRPCRoute to be\nattached to the Listener. For example:\n\n* A Listener with `test.example.com` as the hostname matches GRPCRoutes\n that have either not specified any hostnames, or have specified at\n least one of `test.example.com` or `*.example.com`.\n* A Listener with `*.example.com` as the hostname matches GRPCRoutes\n that have either not specified any hostnames or have specified at least\n one hostname that matches the Listener hostname. For example,\n `test.example.com` and `*.example.com` would both match. On the other\n hand, `example.com` and `test.example.net` would not match.\n\nHostnames that are prefixed with a wildcard label (`*.`) are interpreted\nas a suffix match. That means that a match for `*.example.com` would match\nboth `test.example.com`, and `foo.test.example.com`, but not `example.com`.\n\nIf both the Listener and GRPCRoute have specified hostnames, any\nGRPCRoute hostnames that do not match the Listener hostname MUST be\nignored. For example, if a Listener specified `*.example.com`, and the\nGRPCRoute specified `test.example.com` and `test.example.net`,\n`test.example.net` MUST NOT be considered for a match.\n\nIf both the Listener and GRPCRoute have specified hostnames, and none\nmatch with the criteria above, then the GRPCRoute MUST NOT be accepted by\nthe implementation. The implementation MUST raise an 'Accepted' Condition\nwith a status of `False` in the corresponding RouteParentStatus.\n\nIf a Route (A) of type HTTPRoute or GRPCRoute is attached to a\nListener and that listener already has another Route (B) of the other\ntype attached and the intersection of the hostnames of A and B is\nnon-empty, then the implementation MUST accept exactly one of these two\nroutes, determined by the following criteria, in order:\n\n* The oldest Route based on creation timestamp.\n* The Route appearing first in alphabetical order by\n \"{namespace}/{name}\".\n\nThe rejected Route MUST raise an 'Accepted' condition with a status of\n'False' in the corresponding RouteParentStatus.\n\nSupport: Core", + items: { + description: "Hostname is the fully qualified domain name of a network host. This matches\nthe RFC 1123 definition of a hostname with 2 notable exceptions:\n\n 1. IPs are not allowed.\n 2. A hostname may be prefixed with a wildcard label (`*.`). The wildcard\n label must appear by itself as the first label.\n\nHostname can be \"precise\" which is a domain name without the terminating\ndot of a network host (e.g. \"foo.example.com\") or \"wildcard\", which is a\ndomain name prefixed with a single wildcard label (e.g. `*.example.com`).\n\nNote that as per RFC1035 and RFC1123, a *label* must consist of lower case\nalphanumeric characters or '-', and must start and end with an alphanumeric\ncharacter. No other punctuation is allowed.", + maxLength: 253, + minLength: 1, + pattern: "^(\\*\\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$", + type: "string" + }, + maxItems: 16, + type: "array" + }, + parentRefs: { + description: "ParentRefs references the resources (usually Gateways) that a Route wants\nto be attached to. Note that the referenced parent resource needs to\nallow this for the attachment to be complete. For Gateways, that means\nthe Gateway needs to allow attachment from Routes of this kind and\nnamespace. For Services, that means the Service must either be in the same\nnamespace for a \"producer\" route, or the mesh implementation must support\nand allow \"consumer\" routes for the referenced Service. ReferenceGrant is\nnot applicable for governing ParentRefs to Services - it is not possible to\ncreate a \"producer\" route for a Service in a different namespace from the\nRoute.\n\nThere are two kinds of parent resources with \"Core\" support:\n\n* Gateway (Gateway conformance profile)\n* Service (Mesh conformance profile, ClusterIP Services only)\n\nThis API may be extended in the future to support additional kinds of parent\nresources.\n\nParentRefs must be _distinct_. This means either that:\n\n* They select different objects. If this is the case, then parentRef\n entries are distinct. In terms of fields, this means that the\n multi-part key defined by `group`, `kind`, `namespace`, and `name` must\n be unique across all parentRef entries in the Route.\n* They do not select different objects, but for each optional field used,\n each ParentRef that selects the same object must set the same set of\n optional fields to different values. If one ParentRef sets a\n combination of optional fields, all must set the same combination.\n\nSome examples:\n\n* If one ParentRef sets `sectionName`, all ParentRefs referencing the\n same object must also set `sectionName`.\n* If one ParentRef sets `port`, all ParentRefs referencing the same\n object must also set `port`.\n* If one ParentRef sets `sectionName` and `port`, all ParentRefs\n referencing the same object must also set `sectionName` and `port`.\n\nIt is possible to separately reference multiple distinct objects that may\nbe collapsed by an implementation. For example, some implementations may\nchoose to merge compatible Gateway Listeners together. If that is the\ncase, the list of routes attached to those resources should also be\nmerged.\n\nNote that for ParentRefs that cross namespace boundaries, there are specific\nrules. Cross-namespace references are only valid if they are explicitly\nallowed by something in the namespace they are referring to. For example,\nGateway has the AllowedRoutes field, and ReferenceGrant provides a\ngeneric way to enable other kinds of cross-namespace reference.\n\n\n\n\n\n\n", + items: { + description: "ParentReference identifies an API object (usually a Gateway) that can be considered\na parent of this resource (usually a route). There are two kinds of parent resources\nwith \"Core\" support:\n\n* Gateway (Gateway conformance profile)\n* Service (Mesh conformance profile, ClusterIP Services only)\n\nThis API may be extended in the future to support additional kinds of parent\nresources.\n\nThe API object must be valid in the cluster; the Group and Kind must\nbe registered in the cluster for this reference to be valid.", + properties: { + group: { + default: "gateway.networking.k8s.io", + description: "Group is the group of the referent.\nWhen unspecified, \"gateway.networking.k8s.io\" is inferred.\nTo set the core API group (such as for a \"Service\" kind referent),\nGroup must be explicitly set to \"\" (empty string).\n\nSupport: Core", + maxLength: 253, + pattern: "^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$", + type: "string" + }, + kind: { + default: "Gateway", + description: "Kind is kind of the referent.\n\nThere are two kinds of parent resources with \"Core\" support:\n\n* Gateway (Gateway conformance profile)\n* Service (Mesh conformance profile, ClusterIP Services only)\n\nSupport for other resources is Implementation-Specific.", + maxLength: 63, + minLength: 1, + pattern: "^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$", + type: "string" + }, + name: { + description: "Name is the name of the referent.\n\nSupport: Core", + maxLength: 253, + minLength: 1, + type: "string" + }, + namespace: { + description: "Namespace is the namespace of the referent. When unspecified, this refers\nto the local namespace of the Route.\n\nNote that there are specific rules for ParentRefs which cross namespace\nboundaries. Cross-namespace references are only valid if they are explicitly\nallowed by something in the namespace they are referring to. For example:\nGateway has the AllowedRoutes field, and ReferenceGrant provides a\ngeneric way to enable any other kind of cross-namespace reference.\n\n\n\nSupport: Core", + maxLength: 63, + minLength: 1, + pattern: "^[a-z0-9]([-a-z0-9]*[a-z0-9])?$", + type: "string" + }, + port: { + description: "Port is the network port this Route targets. It can be interpreted\ndifferently based on the type of parent resource.\n\nWhen the parent resource is a Gateway, this targets all listeners\nlistening on the specified port that also support this kind of Route(and\nselect this Route). It's not recommended to set `Port` unless the\nnetworking behaviors specified in a Route must apply to a specific port\nas opposed to a listener(s) whose port(s) may be changed. When both Port\nand SectionName are specified, the name and port of the selected listener\nmust match both specified values.\n\n\n\nImplementations MAY choose to support other parent resources.\nImplementations supporting other types of parent resources MUST clearly\ndocument how/if Port is interpreted.\n\nFor the purpose of status, an attachment is considered successful as\nlong as the parent resource accepts it partially. For example, Gateway\nlisteners can restrict which Routes can attach to them by Route kind,\nnamespace, or hostname. If 1 of 2 Gateway listeners accept attachment\nfrom the referencing Route, the Route MUST be considered successfully\nattached. If no Gateway listeners accept attachment from this Route,\nthe Route MUST be considered detached from the Gateway.\n\nSupport: Extended", + format: "int32", + maximum: 65535, + minimum: 1, + type: "integer" + }, + sectionName: { + description: "SectionName is the name of a section within the target resource. In the\nfollowing resources, SectionName is interpreted as the following:\n\n* Gateway: Listener name. When both Port (experimental) and SectionName\nare specified, the name and port of the selected listener must match\nboth specified values.\n* Service: Port name. When both Port (experimental) and SectionName\nare specified, the name and port of the selected listener must match\nboth specified values.\n\nImplementations MAY choose to support attaching Routes to other resources.\nIf that is the case, they MUST clearly document how SectionName is\ninterpreted.\n\nWhen unspecified (empty string), this will reference the entire resource.\nFor the purpose of status, an attachment is considered successful if at\nleast one section in the parent resource accepts it. For example, Gateway\nlisteners can restrict which Routes can attach to them by Route kind,\nnamespace, or hostname. If 1 of 2 Gateway listeners accept attachment from\nthe referencing Route, the Route MUST be considered successfully\nattached. If no Gateway listeners accept attachment from this Route, the\nRoute MUST be considered detached from the Gateway.\n\nSupport: Core", + maxLength: 253, + minLength: 1, + pattern: "^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$", + type: "string" + } + }, + required: ["name"], + type: "object" + }, + maxItems: 32, + type: "array", + "x-kubernetes-validations": [{ + message: "sectionName must be specified when parentRefs includes 2 or more references to the same parent", + rule: "self.all(p1, self.all(p2, p1.group == p2.group && p1.kind == p2.kind && p1.name == p2.name && (((!has(p1.__namespace__) || p1.__namespace__ == '') && (!has(p2.__namespace__) || p2.__namespace__ == '')) || (has(p1.__namespace__) && has(p2.__namespace__) && p1.__namespace__ == p2.__namespace__ )) ? ((!has(p1.sectionName) || p1.sectionName == '') == (!has(p2.sectionName) || p2.sectionName == '')) : true))" + }, { + message: "sectionName must be unique when parentRefs includes 2 or more references to the same parent", + rule: "self.all(p1, self.exists_one(p2, p1.group == p2.group && p1.kind == p2.kind && p1.name == p2.name && (((!has(p1.__namespace__) || p1.__namespace__ == '') && (!has(p2.__namespace__) || p2.__namespace__ == '')) || (has(p1.__namespace__) && has(p2.__namespace__) && p1.__namespace__ == p2.__namespace__ )) && (((!has(p1.sectionName) || p1.sectionName == '') && (!has(p2.sectionName) || p2.sectionName == '')) || (has(p1.sectionName) && has(p2.sectionName) && p1.sectionName == p2.sectionName))))" + }] + }, + rules: { + description: "Rules are a list of GRPC matchers, filters and actions.\n\n", + items: { + description: "GRPCRouteRule defines the semantics for matching a gRPC request based on\nconditions (matches), processing it (filters), and forwarding the request to\nan API object (backendRefs).", + properties: { + backendRefs: { + description: "BackendRefs defines the backend(s) where matching requests should be\nsent.\n\nFailure behavior here depends on how many BackendRefs are specified and\nhow many are invalid.\n\nIf *all* entries in BackendRefs are invalid, and there are also no filters\nspecified in this route rule, *all* traffic which matches this rule MUST\nreceive an `UNAVAILABLE` status.\n\nSee the GRPCBackendRef definition for the rules about what makes a single\nGRPCBackendRef invalid.\n\nWhen a GRPCBackendRef is invalid, `UNAVAILABLE` statuses MUST be returned for\nrequests that would have otherwise been routed to an invalid backend. If\nmultiple backends are specified, and some are invalid, the proportion of\nrequests that would otherwise have been routed to an invalid backend\nMUST receive an `UNAVAILABLE` status.\n\nFor example, if two backends are specified with equal weights, and one is\ninvalid, 50 percent of traffic MUST receive an `UNAVAILABLE` status.\nImplementations may choose how that 50 percent is determined.\n\nSupport: Core for Kubernetes Service\n\nSupport: Implementation-specific for any other resource\n\nSupport for weight: Core", + items: { + description: "GRPCBackendRef defines how a GRPCRoute forwards a gRPC request.\n\nNote that when a namespace different than the local namespace is specified, a\nReferenceGrant object is required in the referent namespace to allow that\nnamespace's owner to accept the reference. See the ReferenceGrant\ndocumentation for details.\n\n\n\nWhen the BackendRef points to a Kubernetes Service, implementations SHOULD\nhonor the appProtocol field if it is set for the target Service Port.\n\nImplementations supporting appProtocol SHOULD recognize the Kubernetes\nStandard Application Protocols defined in KEP-3726.\n\nIf a Service appProtocol isn't specified, an implementation MAY infer the\nbackend protocol through its own means. Implementations MAY infer the\nprotocol from the Route type referring to the backend Service.\n\nIf a Route is not able to send traffic to the backend using the specified\nprotocol then the backend is considered invalid. Implementations MUST set the\n\"ResolvedRefs\" condition to \"False\" with the \"UnsupportedProtocol\" reason.\n\n", + properties: { + filters: { + description: "Filters defined at this level MUST be executed if and only if the\nrequest is being forwarded to the backend defined here.\n\nSupport: Implementation-specific (For broader support of filters, use the\nFilters field in GRPCRouteRule.)", + items: { + description: "GRPCRouteFilter defines processing steps that must be completed during the\nrequest or response lifecycle. GRPCRouteFilters are meant as an extension\npoint to express processing that may be done in Gateway implementations. Some\nexamples include request or response modification, implementing\nauthentication strategies, rate-limiting, and traffic shaping. API\nguarantee/conformance is defined based on the type of the filter.", + properties: { + extensionRef: { + description: "ExtensionRef is an optional, implementation-specific extension to the\n\"filter\" behavior. For example, resource \"myroutefilter\" in group\n\"networking.example.net\"). ExtensionRef MUST NOT be used for core and\nextended filters.\n\nSupport: Implementation-specific\n\nThis filter can be used multiple times within the same rule.", + properties: { + group: { + description: "Group is the group of the referent. For example, \"gateway.networking.k8s.io\".\nWhen unspecified or empty string, core API group is inferred.", + maxLength: 253, + pattern: "^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$", + type: "string" + }, + kind: { + description: "Kind is kind of the referent. For example \"HTTPRoute\" or \"Service\".", + maxLength: 63, + minLength: 1, + pattern: "^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$", + type: "string" + }, + name: { + description: "Name is the name of the referent.", + maxLength: 253, + minLength: 1, + type: "string" + } + }, + required: ["group", "kind", "name"], + type: "object" + }, + requestHeaderModifier: { + description: "RequestHeaderModifier defines a schema for a filter that modifies request\nheaders.\n\nSupport: Core", + properties: { + add: { + description: "Add adds the given header(s) (name, value) to the request\nbefore the action. It appends to any existing values associated\nwith the header name.\n\nInput:\n GET /foo HTTP/1.1\n my-header: foo\n\nConfig:\n add:\n - name: \"my-header\"\n value: \"bar,baz\"\n\nOutput:\n GET /foo HTTP/1.1\n my-header: foo,bar,baz", + items: { + description: "HTTPHeader represents an HTTP Header name and value as defined by RFC 7230.", + properties: { + name: { + description: "Name is the name of the HTTP Header to be matched. Name matching MUST be\ncase insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).\n\nIf multiple entries specify equivalent header names, the first entry with\nan equivalent name MUST be considered for a match. Subsequent entries\nwith an equivalent header name MUST be ignored. Due to the\ncase-insensitivity of header names, \"foo\" and \"Foo\" are considered\nequivalent.", + maxLength: 256, + minLength: 1, + pattern: "^[A-Za-z0-9!#$%&'*+\\-.^_\\x60|~]+$", + type: "string" + }, + value: { + description: "Value is the value of HTTP Header to be matched.", + maxLength: 4096, + minLength: 1, + type: "string" + } + }, + required: ["name", "value"], + type: "object" + }, + maxItems: 16, + type: "array", + "x-kubernetes-list-map-keys": ["name"], + "x-kubernetes-list-type": "map" + }, + remove: { + description: "Remove the given header(s) from the HTTP request before the action. The\nvalue of Remove is a list of HTTP header names. Note that the header\nnames are case-insensitive (see\nhttps://datatracker.ietf.org/doc/html/rfc2616#section-4.2).\n\nInput:\n GET /foo HTTP/1.1\n my-header1: foo\n my-header2: bar\n my-header3: baz\n\nConfig:\n remove: [\"my-header1\", \"my-header3\"]\n\nOutput:\n GET /foo HTTP/1.1\n my-header2: bar", + items: { + type: "string" + }, + maxItems: 16, + type: "array", + "x-kubernetes-list-type": "set" + }, + set: { + description: "Set overwrites the request with the given header (name, value)\nbefore the action.\n\nInput:\n GET /foo HTTP/1.1\n my-header: foo\n\nConfig:\n set:\n - name: \"my-header\"\n value: \"bar\"\n\nOutput:\n GET /foo HTTP/1.1\n my-header: bar", + items: { + description: "HTTPHeader represents an HTTP Header name and value as defined by RFC 7230.", + properties: { + name: { + description: "Name is the name of the HTTP Header to be matched. Name matching MUST be\ncase insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).\n\nIf multiple entries specify equivalent header names, the first entry with\nan equivalent name MUST be considered for a match. Subsequent entries\nwith an equivalent header name MUST be ignored. Due to the\ncase-insensitivity of header names, \"foo\" and \"Foo\" are considered\nequivalent.", + maxLength: 256, + minLength: 1, + pattern: "^[A-Za-z0-9!#$%&'*+\\-.^_\\x60|~]+$", + type: "string" + }, + value: { + description: "Value is the value of HTTP Header to be matched.", + maxLength: 4096, + minLength: 1, + type: "string" + } + }, + required: ["name", "value"], + type: "object" + }, + maxItems: 16, + type: "array", + "x-kubernetes-list-map-keys": ["name"], + "x-kubernetes-list-type": "map" + } + }, + type: "object" + }, + requestMirror: { + description: "RequestMirror defines a schema for a filter that mirrors requests.\nRequests are sent to the specified destination, but responses from\nthat destination are ignored.\n\nThis filter can be used multiple times within the same rule. Note that\nnot all implementations will be able to support mirroring to multiple\nbackends.\n\nSupport: Extended\n\n", + properties: { + backendRef: { + description: "BackendRef references a resource where mirrored requests are sent.\n\nMirrored requests must be sent only to a single destination endpoint\nwithin this BackendRef, irrespective of how many endpoints are present\nwithin this BackendRef.\n\nIf the referent cannot be found, this BackendRef is invalid and must be\ndropped from the Gateway. The controller must ensure the \"ResolvedRefs\"\ncondition on the Route status is set to `status: False` and not configure\nthis backend in the underlying implementation.\n\nIf there is a cross-namespace reference to an *existing* object\nthat is not allowed by a ReferenceGrant, the controller must ensure the\n\"ResolvedRefs\" condition on the Route is set to `status: False`,\nwith the \"RefNotPermitted\" reason and not configure this backend in the\nunderlying implementation.\n\nIn either error case, the Message of the `ResolvedRefs` Condition\nshould be used to provide more detail about the problem.\n\nSupport: Extended for Kubernetes Service\n\nSupport: Implementation-specific for any other resource", + properties: { + group: { + default: "", + description: "Group is the group of the referent. For example, \"gateway.networking.k8s.io\".\nWhen unspecified or empty string, core API group is inferred.", + maxLength: 253, + pattern: "^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$", + type: "string" + }, + kind: { + default: "Service", + description: "Kind is the Kubernetes resource kind of the referent. For example\n\"Service\".\n\nDefaults to \"Service\" when not specified.\n\nExternalName services can refer to CNAME DNS records that may live\noutside of the cluster and as such are difficult to reason about in\nterms of conformance. They also may not be safe to forward to (see\nCVE-2021-25740 for more information). Implementations SHOULD NOT\nsupport ExternalName Services.\n\nSupport: Core (Services with a type other than ExternalName)\n\nSupport: Implementation-specific (Services with type ExternalName)", + maxLength: 63, + minLength: 1, + pattern: "^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$", + type: "string" + }, + name: { + description: "Name is the name of the referent.", + maxLength: 253, + minLength: 1, + type: "string" + }, + namespace: { + description: "Namespace is the namespace of the backend. When unspecified, the local\nnamespace is inferred.\n\nNote that when a namespace different than the local namespace is specified,\na ReferenceGrant object is required in the referent namespace to allow that\nnamespace's owner to accept the reference. See the ReferenceGrant\ndocumentation for details.\n\nSupport: Core", + maxLength: 63, + minLength: 1, + pattern: "^[a-z0-9]([-a-z0-9]*[a-z0-9])?$", + type: "string" + }, + port: { + description: "Port specifies the destination port number to use for this resource.\nPort is required when the referent is a Kubernetes Service. In this\ncase, the port number is the service port number, not the target port.\nFor other resources, destination port might be derived from the referent\nresource or this field.", + format: "int32", + maximum: 65535, + minimum: 1, + type: "integer" + } + }, + required: ["name"], + type: "object", + "x-kubernetes-validations": [{ + message: "Must have port for Service reference", + rule: "(size(self.group) == 0 && self.kind == 'Service') ? has(self.port) : true" + }] + } + }, + required: ["backendRef"], + type: "object" + }, + responseHeaderModifier: { + description: "ResponseHeaderModifier defines a schema for a filter that modifies response\nheaders.\n\nSupport: Extended", + properties: { + add: { + description: "Add adds the given header(s) (name, value) to the request\nbefore the action. It appends to any existing values associated\nwith the header name.\n\nInput:\n GET /foo HTTP/1.1\n my-header: foo\n\nConfig:\n add:\n - name: \"my-header\"\n value: \"bar,baz\"\n\nOutput:\n GET /foo HTTP/1.1\n my-header: foo,bar,baz", + items: { + description: "HTTPHeader represents an HTTP Header name and value as defined by RFC 7230.", + properties: { + name: { + description: "Name is the name of the HTTP Header to be matched. Name matching MUST be\ncase insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).\n\nIf multiple entries specify equivalent header names, the first entry with\nan equivalent name MUST be considered for a match. Subsequent entries\nwith an equivalent header name MUST be ignored. Due to the\ncase-insensitivity of header names, \"foo\" and \"Foo\" are considered\nequivalent.", + maxLength: 256, + minLength: 1, + pattern: "^[A-Za-z0-9!#$%&'*+\\-.^_\\x60|~]+$", + type: "string" + }, + value: { + description: "Value is the value of HTTP Header to be matched.", + maxLength: 4096, + minLength: 1, + type: "string" + } + }, + required: ["name", "value"], + type: "object" + }, + maxItems: 16, + type: "array", + "x-kubernetes-list-map-keys": ["name"], + "x-kubernetes-list-type": "map" + }, + remove: { + description: "Remove the given header(s) from the HTTP request before the action. The\nvalue of Remove is a list of HTTP header names. Note that the header\nnames are case-insensitive (see\nhttps://datatracker.ietf.org/doc/html/rfc2616#section-4.2).\n\nInput:\n GET /foo HTTP/1.1\n my-header1: foo\n my-header2: bar\n my-header3: baz\n\nConfig:\n remove: [\"my-header1\", \"my-header3\"]\n\nOutput:\n GET /foo HTTP/1.1\n my-header2: bar", + items: { + type: "string" + }, + maxItems: 16, + type: "array", + "x-kubernetes-list-type": "set" + }, + set: { + description: "Set overwrites the request with the given header (name, value)\nbefore the action.\n\nInput:\n GET /foo HTTP/1.1\n my-header: foo\n\nConfig:\n set:\n - name: \"my-header\"\n value: \"bar\"\n\nOutput:\n GET /foo HTTP/1.1\n my-header: bar", + items: { + description: "HTTPHeader represents an HTTP Header name and value as defined by RFC 7230.", + properties: { + name: { + description: "Name is the name of the HTTP Header to be matched. Name matching MUST be\ncase insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).\n\nIf multiple entries specify equivalent header names, the first entry with\nan equivalent name MUST be considered for a match. Subsequent entries\nwith an equivalent header name MUST be ignored. Due to the\ncase-insensitivity of header names, \"foo\" and \"Foo\" are considered\nequivalent.", + maxLength: 256, + minLength: 1, + pattern: "^[A-Za-z0-9!#$%&'*+\\-.^_\\x60|~]+$", + type: "string" + }, + value: { + description: "Value is the value of HTTP Header to be matched.", + maxLength: 4096, + minLength: 1, + type: "string" + } + }, + required: ["name", "value"], + type: "object" + }, + maxItems: 16, + type: "array", + "x-kubernetes-list-map-keys": ["name"], + "x-kubernetes-list-type": "map" + } + }, + type: "object" + }, + type: { + description: "Type identifies the type of filter to apply. As with other API fields,\ntypes are classified into three conformance levels:\n\n- Core: Filter types and their corresponding configuration defined by\n \"Support: Core\" in this package, e.g. \"RequestHeaderModifier\". All\n implementations supporting GRPCRoute MUST support core filters.\n\n- Extended: Filter types and their corresponding configuration defined by\n \"Support: Extended\" in this package, e.g. \"RequestMirror\". Implementers\n are encouraged to support extended filters.\n\n- Implementation-specific: Filters that are defined and supported by specific vendors.\n In the future, filters showing convergence in behavior across multiple\n implementations will be considered for inclusion in extended or core\n conformance levels. Filter-specific configuration for such filters\n is specified using the ExtensionRef field. `Type` MUST be set to\n \"ExtensionRef\" for custom filters.\n\nImplementers are encouraged to define custom implementation types to\nextend the core API with implementation-specific behavior.\n\nIf a reference to a custom filter type cannot be resolved, the filter\nMUST NOT be skipped. Instead, requests that would have been processed by\nthat filter MUST receive a HTTP error response.\n\n", + enum: ["ResponseHeaderModifier", "RequestHeaderModifier", "RequestMirror", "ExtensionRef"], + type: "string" + } + }, + required: ["type"], + type: "object", + "x-kubernetes-validations": [{ + message: "filter.requestHeaderModifier must be nil if the filter.type is not RequestHeaderModifier", + rule: "!(has(self.requestHeaderModifier) && self.type != 'RequestHeaderModifier')" + }, { + message: "filter.requestHeaderModifier must be specified for RequestHeaderModifier filter.type", + rule: "!(!has(self.requestHeaderModifier) && self.type == 'RequestHeaderModifier')" + }, { + message: "filter.responseHeaderModifier must be nil if the filter.type is not ResponseHeaderModifier", + rule: "!(has(self.responseHeaderModifier) && self.type != 'ResponseHeaderModifier')" + }, { + message: "filter.responseHeaderModifier must be specified for ResponseHeaderModifier filter.type", + rule: "!(!has(self.responseHeaderModifier) && self.type == 'ResponseHeaderModifier')" + }, { + message: "filter.requestMirror must be nil if the filter.type is not RequestMirror", + rule: "!(has(self.requestMirror) && self.type != 'RequestMirror')" + }, { + message: "filter.requestMirror must be specified for RequestMirror filter.type", + rule: "!(!has(self.requestMirror) && self.type == 'RequestMirror')" + }, { + message: "filter.extensionRef must be nil if the filter.type is not ExtensionRef", + rule: "!(has(self.extensionRef) && self.type != 'ExtensionRef')" + }, { + message: "filter.extensionRef must be specified for ExtensionRef filter.type", + rule: "!(!has(self.extensionRef) && self.type == 'ExtensionRef')" + }] + }, + maxItems: 16, + type: "array", + "x-kubernetes-validations": [{ + message: "RequestHeaderModifier filter cannot be repeated", + rule: "self.filter(f, f.type == 'RequestHeaderModifier').size() <= 1" + }, { + message: "ResponseHeaderModifier filter cannot be repeated", + rule: "self.filter(f, f.type == 'ResponseHeaderModifier').size() <= 1" + }] + }, + group: { + default: "", + description: "Group is the group of the referent. For example, \"gateway.networking.k8s.io\".\nWhen unspecified or empty string, core API group is inferred.", + maxLength: 253, + pattern: "^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$", + type: "string" + }, + kind: { + default: "Service", + description: "Kind is the Kubernetes resource kind of the referent. For example\n\"Service\".\n\nDefaults to \"Service\" when not specified.\n\nExternalName services can refer to CNAME DNS records that may live\noutside of the cluster and as such are difficult to reason about in\nterms of conformance. They also may not be safe to forward to (see\nCVE-2021-25740 for more information). Implementations SHOULD NOT\nsupport ExternalName Services.\n\nSupport: Core (Services with a type other than ExternalName)\n\nSupport: Implementation-specific (Services with type ExternalName)", + maxLength: 63, + minLength: 1, + pattern: "^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$", + type: "string" + }, + name: { + description: "Name is the name of the referent.", + maxLength: 253, + minLength: 1, + type: "string" + }, + namespace: { + description: "Namespace is the namespace of the backend. When unspecified, the local\nnamespace is inferred.\n\nNote that when a namespace different than the local namespace is specified,\na ReferenceGrant object is required in the referent namespace to allow that\nnamespace's owner to accept the reference. See the ReferenceGrant\ndocumentation for details.\n\nSupport: Core", + maxLength: 63, + minLength: 1, + pattern: "^[a-z0-9]([-a-z0-9]*[a-z0-9])?$", + type: "string" + }, + port: { + description: "Port specifies the destination port number to use for this resource.\nPort is required when the referent is a Kubernetes Service. In this\ncase, the port number is the service port number, not the target port.\nFor other resources, destination port might be derived from the referent\nresource or this field.", + format: "int32", + maximum: 65535, + minimum: 1, + type: "integer" + }, + weight: { + default: 1, + description: "Weight specifies the proportion of requests forwarded to the referenced\nbackend. This is computed as weight/(sum of all weights in this\nBackendRefs list). For non-zero values, there may be some epsilon from\nthe exact proportion defined here depending on the precision an\nimplementation supports. Weight is not a percentage and the sum of\nweights does not need to equal 100.\n\nIf only one backend is specified and it has a weight greater than 0, 100%\nof the traffic is forwarded to that backend. If weight is set to 0, no\ntraffic should be forwarded for this entry. If unspecified, weight\ndefaults to 1.\n\nSupport for this field varies based on the context where used.", + format: "int32", + maximum: 1000000, + minimum: 0, + type: "integer" + } + }, + required: ["name"], + type: "object", + "x-kubernetes-validations": [{ + message: "Must have port for Service reference", + rule: "(size(self.group) == 0 && self.kind == 'Service') ? has(self.port) : true" + }] + }, + maxItems: 16, + type: "array" + }, + filters: { + description: "Filters define the filters that are applied to requests that match\nthis rule.\n\nThe effects of ordering of multiple behaviors are currently unspecified.\nThis can change in the future based on feedback during the alpha stage.\n\nConformance-levels at this level are defined based on the type of filter:\n\n- ALL core filters MUST be supported by all implementations that support\n GRPCRoute.\n- Implementers are encouraged to support extended filters.\n- Implementation-specific custom filters have no API guarantees across\n implementations.\n\nSpecifying the same filter multiple times is not supported unless explicitly\nindicated in the filter.\n\nIf an implementation can not support a combination of filters, it must clearly\ndocument that limitation. In cases where incompatible or unsupported\nfilters are specified and cause the `Accepted` condition to be set to status\n`False`, implementations may use the `IncompatibleFilters` reason to specify\nthis configuration error.\n\nSupport: Core", + items: { + description: "GRPCRouteFilter defines processing steps that must be completed during the\nrequest or response lifecycle. GRPCRouteFilters are meant as an extension\npoint to express processing that may be done in Gateway implementations. Some\nexamples include request or response modification, implementing\nauthentication strategies, rate-limiting, and traffic shaping. API\nguarantee/conformance is defined based on the type of the filter.", + properties: { + extensionRef: { + description: "ExtensionRef is an optional, implementation-specific extension to the\n\"filter\" behavior. For example, resource \"myroutefilter\" in group\n\"networking.example.net\"). ExtensionRef MUST NOT be used for core and\nextended filters.\n\nSupport: Implementation-specific\n\nThis filter can be used multiple times within the same rule.", + properties: { + group: { + description: "Group is the group of the referent. For example, \"gateway.networking.k8s.io\".\nWhen unspecified or empty string, core API group is inferred.", + maxLength: 253, + pattern: "^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$", + type: "string" + }, + kind: { + description: "Kind is kind of the referent. For example \"HTTPRoute\" or \"Service\".", + maxLength: 63, + minLength: 1, + pattern: "^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$", + type: "string" + }, + name: { + description: "Name is the name of the referent.", + maxLength: 253, + minLength: 1, + type: "string" + } + }, + required: ["group", "kind", "name"], + type: "object" + }, + requestHeaderModifier: { + description: "RequestHeaderModifier defines a schema for a filter that modifies request\nheaders.\n\nSupport: Core", + properties: { + add: { + description: "Add adds the given header(s) (name, value) to the request\nbefore the action. It appends to any existing values associated\nwith the header name.\n\nInput:\n GET /foo HTTP/1.1\n my-header: foo\n\nConfig:\n add:\n - name: \"my-header\"\n value: \"bar,baz\"\n\nOutput:\n GET /foo HTTP/1.1\n my-header: foo,bar,baz", + items: { + description: "HTTPHeader represents an HTTP Header name and value as defined by RFC 7230.", + properties: { + name: { + description: "Name is the name of the HTTP Header to be matched. Name matching MUST be\ncase insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).\n\nIf multiple entries specify equivalent header names, the first entry with\nan equivalent name MUST be considered for a match. Subsequent entries\nwith an equivalent header name MUST be ignored. Due to the\ncase-insensitivity of header names, \"foo\" and \"Foo\" are considered\nequivalent.", + maxLength: 256, + minLength: 1, + pattern: "^[A-Za-z0-9!#$%&'*+\\-.^_\\x60|~]+$", + type: "string" + }, + value: { + description: "Value is the value of HTTP Header to be matched.", + maxLength: 4096, + minLength: 1, + type: "string" + } + }, + required: ["name", "value"], + type: "object" + }, + maxItems: 16, + type: "array", + "x-kubernetes-list-map-keys": ["name"], + "x-kubernetes-list-type": "map" + }, + remove: { + description: "Remove the given header(s) from the HTTP request before the action. The\nvalue of Remove is a list of HTTP header names. Note that the header\nnames are case-insensitive (see\nhttps://datatracker.ietf.org/doc/html/rfc2616#section-4.2).\n\nInput:\n GET /foo HTTP/1.1\n my-header1: foo\n my-header2: bar\n my-header3: baz\n\nConfig:\n remove: [\"my-header1\", \"my-header3\"]\n\nOutput:\n GET /foo HTTP/1.1\n my-header2: bar", + items: { + type: "string" + }, + maxItems: 16, + type: "array", + "x-kubernetes-list-type": "set" + }, + set: { + description: "Set overwrites the request with the given header (name, value)\nbefore the action.\n\nInput:\n GET /foo HTTP/1.1\n my-header: foo\n\nConfig:\n set:\n - name: \"my-header\"\n value: \"bar\"\n\nOutput:\n GET /foo HTTP/1.1\n my-header: bar", + items: { + description: "HTTPHeader represents an HTTP Header name and value as defined by RFC 7230.", + properties: { + name: { + description: "Name is the name of the HTTP Header to be matched. Name matching MUST be\ncase insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).\n\nIf multiple entries specify equivalent header names, the first entry with\nan equivalent name MUST be considered for a match. Subsequent entries\nwith an equivalent header name MUST be ignored. Due to the\ncase-insensitivity of header names, \"foo\" and \"Foo\" are considered\nequivalent.", + maxLength: 256, + minLength: 1, + pattern: "^[A-Za-z0-9!#$%&'*+\\-.^_\\x60|~]+$", + type: "string" + }, + value: { + description: "Value is the value of HTTP Header to be matched.", + maxLength: 4096, + minLength: 1, + type: "string" + } + }, + required: ["name", "value"], + type: "object" + }, + maxItems: 16, + type: "array", + "x-kubernetes-list-map-keys": ["name"], + "x-kubernetes-list-type": "map" + } + }, + type: "object" + }, + requestMirror: { + description: "RequestMirror defines a schema for a filter that mirrors requests.\nRequests are sent to the specified destination, but responses from\nthat destination are ignored.\n\nThis filter can be used multiple times within the same rule. Note that\nnot all implementations will be able to support mirroring to multiple\nbackends.\n\nSupport: Extended\n\n", + properties: { + backendRef: { + description: "BackendRef references a resource where mirrored requests are sent.\n\nMirrored requests must be sent only to a single destination endpoint\nwithin this BackendRef, irrespective of how many endpoints are present\nwithin this BackendRef.\n\nIf the referent cannot be found, this BackendRef is invalid and must be\ndropped from the Gateway. The controller must ensure the \"ResolvedRefs\"\ncondition on the Route status is set to `status: False` and not configure\nthis backend in the underlying implementation.\n\nIf there is a cross-namespace reference to an *existing* object\nthat is not allowed by a ReferenceGrant, the controller must ensure the\n\"ResolvedRefs\" condition on the Route is set to `status: False`,\nwith the \"RefNotPermitted\" reason and not configure this backend in the\nunderlying implementation.\n\nIn either error case, the Message of the `ResolvedRefs` Condition\nshould be used to provide more detail about the problem.\n\nSupport: Extended for Kubernetes Service\n\nSupport: Implementation-specific for any other resource", + properties: { + group: { + default: "", + description: "Group is the group of the referent. For example, \"gateway.networking.k8s.io\".\nWhen unspecified or empty string, core API group is inferred.", + maxLength: 253, + pattern: "^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$", + type: "string" + }, + kind: { + default: "Service", + description: "Kind is the Kubernetes resource kind of the referent. For example\n\"Service\".\n\nDefaults to \"Service\" when not specified.\n\nExternalName services can refer to CNAME DNS records that may live\noutside of the cluster and as such are difficult to reason about in\nterms of conformance. They also may not be safe to forward to (see\nCVE-2021-25740 for more information). Implementations SHOULD NOT\nsupport ExternalName Services.\n\nSupport: Core (Services with a type other than ExternalName)\n\nSupport: Implementation-specific (Services with type ExternalName)", + maxLength: 63, + minLength: 1, + pattern: "^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$", + type: "string" + }, + name: { + description: "Name is the name of the referent.", + maxLength: 253, + minLength: 1, + type: "string" + }, + namespace: { + description: "Namespace is the namespace of the backend. When unspecified, the local\nnamespace is inferred.\n\nNote that when a namespace different than the local namespace is specified,\na ReferenceGrant object is required in the referent namespace to allow that\nnamespace's owner to accept the reference. See the ReferenceGrant\ndocumentation for details.\n\nSupport: Core", + maxLength: 63, + minLength: 1, + pattern: "^[a-z0-9]([-a-z0-9]*[a-z0-9])?$", + type: "string" + }, + port: { + description: "Port specifies the destination port number to use for this resource.\nPort is required when the referent is a Kubernetes Service. In this\ncase, the port number is the service port number, not the target port.\nFor other resources, destination port might be derived from the referent\nresource or this field.", + format: "int32", + maximum: 65535, + minimum: 1, + type: "integer" + } + }, + required: ["name"], + type: "object", + "x-kubernetes-validations": [{ + message: "Must have port for Service reference", + rule: "(size(self.group) == 0 && self.kind == 'Service') ? has(self.port) : true" + }] + } + }, + required: ["backendRef"], + type: "object" + }, + responseHeaderModifier: { + description: "ResponseHeaderModifier defines a schema for a filter that modifies response\nheaders.\n\nSupport: Extended", + properties: { + add: { + description: "Add adds the given header(s) (name, value) to the request\nbefore the action. It appends to any existing values associated\nwith the header name.\n\nInput:\n GET /foo HTTP/1.1\n my-header: foo\n\nConfig:\n add:\n - name: \"my-header\"\n value: \"bar,baz\"\n\nOutput:\n GET /foo HTTP/1.1\n my-header: foo,bar,baz", + items: { + description: "HTTPHeader represents an HTTP Header name and value as defined by RFC 7230.", + properties: { + name: { + description: "Name is the name of the HTTP Header to be matched. Name matching MUST be\ncase insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).\n\nIf multiple entries specify equivalent header names, the first entry with\nan equivalent name MUST be considered for a match. Subsequent entries\nwith an equivalent header name MUST be ignored. Due to the\ncase-insensitivity of header names, \"foo\" and \"Foo\" are considered\nequivalent.", + maxLength: 256, + minLength: 1, + pattern: "^[A-Za-z0-9!#$%&'*+\\-.^_\\x60|~]+$", + type: "string" + }, + value: { + description: "Value is the value of HTTP Header to be matched.", + maxLength: 4096, + minLength: 1, + type: "string" + } + }, + required: ["name", "value"], + type: "object" + }, + maxItems: 16, + type: "array", + "x-kubernetes-list-map-keys": ["name"], + "x-kubernetes-list-type": "map" + }, + remove: { + description: "Remove the given header(s) from the HTTP request before the action. The\nvalue of Remove is a list of HTTP header names. Note that the header\nnames are case-insensitive (see\nhttps://datatracker.ietf.org/doc/html/rfc2616#section-4.2).\n\nInput:\n GET /foo HTTP/1.1\n my-header1: foo\n my-header2: bar\n my-header3: baz\n\nConfig:\n remove: [\"my-header1\", \"my-header3\"]\n\nOutput:\n GET /foo HTTP/1.1\n my-header2: bar", + items: { + type: "string" + }, + maxItems: 16, + type: "array", + "x-kubernetes-list-type": "set" + }, + set: { + description: "Set overwrites the request with the given header (name, value)\nbefore the action.\n\nInput:\n GET /foo HTTP/1.1\n my-header: foo\n\nConfig:\n set:\n - name: \"my-header\"\n value: \"bar\"\n\nOutput:\n GET /foo HTTP/1.1\n my-header: bar", + items: { + description: "HTTPHeader represents an HTTP Header name and value as defined by RFC 7230.", + properties: { + name: { + description: "Name is the name of the HTTP Header to be matched. Name matching MUST be\ncase insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).\n\nIf multiple entries specify equivalent header names, the first entry with\nan equivalent name MUST be considered for a match. Subsequent entries\nwith an equivalent header name MUST be ignored. Due to the\ncase-insensitivity of header names, \"foo\" and \"Foo\" are considered\nequivalent.", + maxLength: 256, + minLength: 1, + pattern: "^[A-Za-z0-9!#$%&'*+\\-.^_\\x60|~]+$", + type: "string" + }, + value: { + description: "Value is the value of HTTP Header to be matched.", + maxLength: 4096, + minLength: 1, + type: "string" + } + }, + required: ["name", "value"], + type: "object" + }, + maxItems: 16, + type: "array", + "x-kubernetes-list-map-keys": ["name"], + "x-kubernetes-list-type": "map" + } + }, + type: "object" + }, + type: { + description: "Type identifies the type of filter to apply. As with other API fields,\ntypes are classified into three conformance levels:\n\n- Core: Filter types and their corresponding configuration defined by\n \"Support: Core\" in this package, e.g. \"RequestHeaderModifier\". All\n implementations supporting GRPCRoute MUST support core filters.\n\n- Extended: Filter types and their corresponding configuration defined by\n \"Support: Extended\" in this package, e.g. \"RequestMirror\". Implementers\n are encouraged to support extended filters.\n\n- Implementation-specific: Filters that are defined and supported by specific vendors.\n In the future, filters showing convergence in behavior across multiple\n implementations will be considered for inclusion in extended or core\n conformance levels. Filter-specific configuration for such filters\n is specified using the ExtensionRef field. `Type` MUST be set to\n \"ExtensionRef\" for custom filters.\n\nImplementers are encouraged to define custom implementation types to\nextend the core API with implementation-specific behavior.\n\nIf a reference to a custom filter type cannot be resolved, the filter\nMUST NOT be skipped. Instead, requests that would have been processed by\nthat filter MUST receive a HTTP error response.\n\n", + enum: ["ResponseHeaderModifier", "RequestHeaderModifier", "RequestMirror", "ExtensionRef"], + type: "string" + } + }, + required: ["type"], + type: "object", + "x-kubernetes-validations": [{ + message: "filter.requestHeaderModifier must be nil if the filter.type is not RequestHeaderModifier", + rule: "!(has(self.requestHeaderModifier) && self.type != 'RequestHeaderModifier')" + }, { + message: "filter.requestHeaderModifier must be specified for RequestHeaderModifier filter.type", + rule: "!(!has(self.requestHeaderModifier) && self.type == 'RequestHeaderModifier')" + }, { + message: "filter.responseHeaderModifier must be nil if the filter.type is not ResponseHeaderModifier", + rule: "!(has(self.responseHeaderModifier) && self.type != 'ResponseHeaderModifier')" + }, { + message: "filter.responseHeaderModifier must be specified for ResponseHeaderModifier filter.type", + rule: "!(!has(self.responseHeaderModifier) && self.type == 'ResponseHeaderModifier')" + }, { + message: "filter.requestMirror must be nil if the filter.type is not RequestMirror", + rule: "!(has(self.requestMirror) && self.type != 'RequestMirror')" + }, { + message: "filter.requestMirror must be specified for RequestMirror filter.type", + rule: "!(!has(self.requestMirror) && self.type == 'RequestMirror')" + }, { + message: "filter.extensionRef must be nil if the filter.type is not ExtensionRef", + rule: "!(has(self.extensionRef) && self.type != 'ExtensionRef')" + }, { + message: "filter.extensionRef must be specified for ExtensionRef filter.type", + rule: "!(!has(self.extensionRef) && self.type == 'ExtensionRef')" + }] + }, + maxItems: 16, + type: "array", + "x-kubernetes-validations": [{ + message: "RequestHeaderModifier filter cannot be repeated", + rule: "self.filter(f, f.type == 'RequestHeaderModifier').size() <= 1" + }, { + message: "ResponseHeaderModifier filter cannot be repeated", + rule: "self.filter(f, f.type == 'ResponseHeaderModifier').size() <= 1" + }] + }, + matches: { + description: "Matches define conditions used for matching the rule against incoming\ngRPC requests. Each match is independent, i.e. this rule will be matched\nif **any** one of the matches is satisfied.\n\nFor example, take the following matches configuration:\n\n```\nmatches:\n- method:\n service: foo.bar\n headers:\n values:\n version: 2\n- method:\n service: foo.bar.v2\n```\n\nFor a request to match against this rule, it MUST satisfy\nEITHER of the two conditions:\n\n- service of foo.bar AND contains the header `version: 2`\n- service of foo.bar.v2\n\nSee the documentation for GRPCRouteMatch on how to specify multiple\nmatch conditions to be ANDed together.\n\nIf no matches are specified, the implementation MUST match every gRPC request.\n\nProxy or Load Balancer routing configuration generated from GRPCRoutes\nMUST prioritize rules based on the following criteria, continuing on\nties. Merging MUST not be done between GRPCRoutes and HTTPRoutes.\nPrecedence MUST be given to the rule with the largest number of:\n\n* Characters in a matching non-wildcard hostname.\n* Characters in a matching hostname.\n* Characters in a matching service.\n* Characters in a matching method.\n* Header matches.\n\nIf ties still exist across multiple Routes, matching precedence MUST be\ndetermined in order of the following criteria, continuing on ties:\n\n* The oldest Route based on creation timestamp.\n* The Route appearing first in alphabetical order by\n \"{namespace}/{name}\".\n\nIf ties still exist within the Route that has been given precedence,\nmatching precedence MUST be granted to the first matching rule meeting\nthe above criteria.", + items: { + description: "GRPCRouteMatch defines the predicate used to match requests to a given\naction. Multiple match types are ANDed together, i.e. the match will\nevaluate to true only if all conditions are satisfied.\n\nFor example, the match below will match a gRPC request only if its service\nis `foo` AND it contains the `version: v1` header:\n\n```\nmatches:\n - method:\n type: Exact\n service: \"foo\"\n headers:\n - name: \"version\"\n value \"v1\"\n\n```", + properties: { + headers: { + description: "Headers specifies gRPC request header matchers. Multiple match values are\nANDed together, meaning, a request MUST match all the specified headers\nto select the route.", + items: { + description: "GRPCHeaderMatch describes how to select a gRPC route by matching gRPC request\nheaders.", + properties: { + name: { + description: "Name is the name of the gRPC Header to be matched.\n\nIf multiple entries specify equivalent header names, only the first\nentry with an equivalent name MUST be considered for a match. Subsequent\nentries with an equivalent header name MUST be ignored. Due to the\ncase-insensitivity of header names, \"foo\" and \"Foo\" are considered\nequivalent.", + maxLength: 256, + minLength: 1, + pattern: "^[A-Za-z0-9!#$%&'*+\\-.^_\\x60|~]+$", + type: "string" + }, + type: { + default: "Exact", + description: "Type specifies how to match against the value of the header.", + enum: ["Exact", "RegularExpression"], + type: "string" + }, + value: { + description: "Value is the value of the gRPC Header to be matched.", + maxLength: 4096, + minLength: 1, + type: "string" + } + }, + required: ["name", "value"], + type: "object" + }, + maxItems: 16, + type: "array", + "x-kubernetes-list-map-keys": ["name"], + "x-kubernetes-list-type": "map" + }, + method: { + description: "Method specifies a gRPC request service/method matcher. If this field is\nnot specified, all services and methods will match.", + properties: { + method: { + description: "Value of the method to match against. If left empty or omitted, will\nmatch all services.\n\nAt least one of Service and Method MUST be a non-empty string.", + maxLength: 1024, + type: "string" + }, + service: { + description: "Value of the service to match against. If left empty or omitted, will\nmatch any service.\n\nAt least one of Service and Method MUST be a non-empty string.", + maxLength: 1024, + type: "string" + }, + type: { + default: "Exact", + description: "Type specifies how to match against the service and/or method.\nSupport: Core (Exact with service and method specified)\n\nSupport: Implementation-specific (Exact with method specified but no service specified)\n\nSupport: Implementation-specific (RegularExpression)", + enum: ["Exact", "RegularExpression"], + type: "string" + } + }, + type: "object", + "x-kubernetes-validations": [{ + message: "One or both of 'service' or 'method' must be specified", + rule: "has(self.type) ? has(self.service) || has(self.method) : true" + }, { + message: "service must only contain valid characters (matching ^(?i)\\.?[a-z_][a-z_0-9]*(\\.[a-z_][a-z_0-9]*)*$)", + rule: "(!has(self.type) || self.type == 'Exact') && has(self.service) ? self.service.matches(r\"\"\"^(?i)\\.?[a-z_][a-z_0-9]*(\\.[a-z_][a-z_0-9]*)*$\"\"\"): true" + }, { + message: "method must only contain valid characters (matching ^[A-Za-z_][A-Za-z_0-9]*$)", + rule: "(!has(self.type) || self.type == 'Exact') && has(self.method) ? self.method.matches(r\"\"\"^[A-Za-z_][A-Za-z_0-9]*$\"\"\"): true" + }] + } + }, + type: "object" + }, + maxItems: 8, + type: "array" + } + }, + type: "object" + }, + maxItems: 16, + type: "array", + "x-kubernetes-validations": [{ + message: "While 16 rules and 64 matches per rule are allowed, the total number of matches across all rules in a route must be less than 128", + rule: "(self.size() > 0 ? (has(self[0].matches) ? self[0].matches.size() : 0) : 0) + (self.size() > 1 ? (has(self[1].matches) ? self[1].matches.size() : 0) : 0) + (self.size() > 2 ? (has(self[2].matches) ? self[2].matches.size() : 0) : 0) + (self.size() > 3 ? (has(self[3].matches) ? self[3].matches.size() : 0) : 0) + (self.size() > 4 ? (has(self[4].matches) ? self[4].matches.size() : 0) : 0) + (self.size() > 5 ? (has(self[5].matches) ? self[5].matches.size() : 0) : 0) + (self.size() > 6 ? (has(self[6].matches) ? self[6].matches.size() : 0) : 0) + (self.size() > 7 ? (has(self[7].matches) ? self[7].matches.size() : 0) : 0) + (self.size() > 8 ? (has(self[8].matches) ? self[8].matches.size() : 0) : 0) + (self.size() > 9 ? (has(self[9].matches) ? self[9].matches.size() : 0) : 0) + (self.size() > 10 ? (has(self[10].matches) ? self[10].matches.size() : 0) : 0) + (self.size() > 11 ? (has(self[11].matches) ? self[11].matches.size() : 0) : 0) + (self.size() > 12 ? (has(self[12].matches) ? self[12].matches.size() : 0) : 0) + (self.size() > 13 ? (has(self[13].matches) ? self[13].matches.size() : 0) : 0) + (self.size() > 14 ? (has(self[14].matches) ? self[14].matches.size() : 0) : 0) + (self.size() > 15 ? (has(self[15].matches) ? self[15].matches.size() : 0) : 0) <= 128" + }] + } + }, + type: "object" + }, + status: { + description: "Status defines the current state of GRPCRoute.", + properties: { + parents: { + description: "Parents is a list of parent resources (usually Gateways) that are\nassociated with the route, and the status of the route with respect to\neach parent. When this route attaches to a parent, the controller that\nmanages the parent must add an entry to this list when the controller\nfirst sees the route and should update the entry as appropriate when the\nroute or gateway is modified.\n\nNote that parent references that cannot be resolved by an implementation\nof this API will not be added to this list. Implementations of this API\ncan only populate Route status for the Gateways/parent resources they are\nresponsible for.\n\nA maximum of 32 Gateways will be represented in this list. An empty list\nmeans the route has not been attached to any Gateway.", + items: { + description: "RouteParentStatus describes the status of a route with respect to an\nassociated Parent.", + properties: { + conditions: { + description: "Conditions describes the status of the route with respect to the Gateway.\nNote that the route's availability is also subject to the Gateway's own\nstatus conditions and listener status.\n\nIf the Route's ParentRef specifies an existing Gateway that supports\nRoutes of this kind AND that Gateway's controller has sufficient access,\nthen that Gateway's controller MUST set the \"Accepted\" condition on the\nRoute, to indicate whether the route has been accepted or rejected by the\nGateway, and why.\n\nA Route MUST be considered \"Accepted\" if at least one of the Route's\nrules is implemented by the Gateway.\n\nThere are a number of cases where the \"Accepted\" condition may not be set\ndue to lack of controller visibility, that includes when:\n\n* The Route refers to a non-existent parent.\n* The Route is of a type that the controller does not support.\n* The Route is in a namespace the controller does not have access to.", + items: { + description: "Condition contains details for one aspect of the current state of this API Resource.", + properties: { + lastTransitionTime: { + description: "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.", + format: "date-time", + type: "string" + }, + message: { + description: "message is a human readable message indicating details about the transition.\nThis may be an empty string.", + maxLength: 32768, + type: "string" + }, + observedGeneration: { + description: "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.", + format: "int64", + minimum: 0, + type: "integer" + }, + reason: { + description: "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.", + maxLength: 1024, + minLength: 1, + pattern: "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$", + type: "string" + }, + status: { + description: "status of the condition, one of True, False, Unknown.", + enum: ["True", "False", "Unknown"], + type: "string" + }, + type: { + description: "type of condition in CamelCase or in foo.example.com/CamelCase.", + maxLength: 316, + pattern: "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$", + type: "string" + } + }, + required: ["lastTransitionTime", "message", "reason", "status", "type"], + type: "object" + }, + maxItems: 8, + minItems: 1, + type: "array", + "x-kubernetes-list-map-keys": ["type"], + "x-kubernetes-list-type": "map" + }, + controllerName: { + description: "ControllerName is a domain/path string that indicates the name of the\ncontroller that wrote this status. This corresponds with the\ncontrollerName field on GatewayClass.\n\nExample: \"example.net/gateway-controller\".\n\nThe format of this field is DOMAIN \"/\" PATH, where DOMAIN and PATH are\nvalid Kubernetes names\n(https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names).\n\nControllers MUST populate this field when writing status. Controllers should ensure that\nentries to status populated with their ControllerName are cleaned up when they are no\nlonger necessary.", + maxLength: 253, + minLength: 1, + pattern: "^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\\/[A-Za-z0-9\\/\\-._~%!$&'()*+,;=:]+$", + type: "string" + }, + parentRef: { + description: "ParentRef corresponds with a ParentRef in the spec that this\nRouteParentStatus struct describes the status of.", + properties: { + group: { + default: "gateway.networking.k8s.io", + description: "Group is the group of the referent.\nWhen unspecified, \"gateway.networking.k8s.io\" is inferred.\nTo set the core API group (such as for a \"Service\" kind referent),\nGroup must be explicitly set to \"\" (empty string).\n\nSupport: Core", + maxLength: 253, + pattern: "^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$", + type: "string" + }, + kind: { + default: "Gateway", + description: "Kind is kind of the referent.\n\nThere are two kinds of parent resources with \"Core\" support:\n\n* Gateway (Gateway conformance profile)\n* Service (Mesh conformance profile, ClusterIP Services only)\n\nSupport for other resources is Implementation-Specific.", + maxLength: 63, + minLength: 1, + pattern: "^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$", + type: "string" + }, + name: { + description: "Name is the name of the referent.\n\nSupport: Core", + maxLength: 253, + minLength: 1, + type: "string" + }, + namespace: { + description: "Namespace is the namespace of the referent. When unspecified, this refers\nto the local namespace of the Route.\n\nNote that there are specific rules for ParentRefs which cross namespace\nboundaries. Cross-namespace references are only valid if they are explicitly\nallowed by something in the namespace they are referring to. For example:\nGateway has the AllowedRoutes field, and ReferenceGrant provides a\ngeneric way to enable any other kind of cross-namespace reference.\n\n\n\nSupport: Core", + maxLength: 63, + minLength: 1, + pattern: "^[a-z0-9]([-a-z0-9]*[a-z0-9])?$", + type: "string" + }, + port: { + description: "Port is the network port this Route targets. It can be interpreted\ndifferently based on the type of parent resource.\n\nWhen the parent resource is a Gateway, this targets all listeners\nlistening on the specified port that also support this kind of Route(and\nselect this Route). It's not recommended to set `Port` unless the\nnetworking behaviors specified in a Route must apply to a specific port\nas opposed to a listener(s) whose port(s) may be changed. When both Port\nand SectionName are specified, the name and port of the selected listener\nmust match both specified values.\n\n\n\nImplementations MAY choose to support other parent resources.\nImplementations supporting other types of parent resources MUST clearly\ndocument how/if Port is interpreted.\n\nFor the purpose of status, an attachment is considered successful as\nlong as the parent resource accepts it partially. For example, Gateway\nlisteners can restrict which Routes can attach to them by Route kind,\nnamespace, or hostname. If 1 of 2 Gateway listeners accept attachment\nfrom the referencing Route, the Route MUST be considered successfully\nattached. If no Gateway listeners accept attachment from this Route,\nthe Route MUST be considered detached from the Gateway.\n\nSupport: Extended", + format: "int32", + maximum: 65535, + minimum: 1, + type: "integer" + }, + sectionName: { + description: "SectionName is the name of a section within the target resource. In the\nfollowing resources, SectionName is interpreted as the following:\n\n* Gateway: Listener name. When both Port (experimental) and SectionName\nare specified, the name and port of the selected listener must match\nboth specified values.\n* Service: Port name. When both Port (experimental) and SectionName\nare specified, the name and port of the selected listener must match\nboth specified values.\n\nImplementations MAY choose to support attaching Routes to other resources.\nIf that is the case, they MUST clearly document how SectionName is\ninterpreted.\n\nWhen unspecified (empty string), this will reference the entire resource.\nFor the purpose of status, an attachment is considered successful if at\nleast one section in the parent resource accepts it. For example, Gateway\nlisteners can restrict which Routes can attach to them by Route kind,\nnamespace, or hostname. If 1 of 2 Gateway listeners accept attachment from\nthe referencing Route, the Route MUST be considered successfully\nattached. If no Gateway listeners accept attachment from this Route, the\nRoute MUST be considered detached from the Gateway.\n\nSupport: Core", + maxLength: 253, + minLength: 1, + pattern: "^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$", + type: "string" + } + }, + required: ["name"], + type: "object" + } + }, + required: ["controllerName", "parentRef"], + type: "object" + }, + maxItems: 32, + type: "array" + } + }, + required: ["parents"], + type: "object" + } + }, + type: "object" + } + }, + served: true, + storage: true, + subresources: { + status: {} + } + }] + }, + status: { + acceptedNames: { + kind: "", + plural: "" + }, + conditions: null, + storedVersions: null + } +}; +export const CustomResourceDefinition_HttproutesGatewayNetworkingK8sIo: KubernetesResource = { + apiVersion: "apiextensions.k8s.io/v1", + kind: "CustomResourceDefinition", + metadata: { + annotations: { + "api-approved.kubernetes.io": "https://github.com/kubernetes-sigs/gateway-api/pull/3328", + "gateway.networking.k8s.io/bundle-version": "v1.2.1", + "gateway.networking.k8s.io/channel": "standard" + }, + creationTimestamp: null, + name: "httproutes.gateway.networking.k8s.io" + }, + spec: { + group: "gateway.networking.k8s.io", + names: { + categories: ["gateway-api"], + kind: "HTTPRoute", + listKind: "HTTPRouteList", + plural: "httproutes", + singular: "httproute" + }, + scope: "Namespaced", + versions: [{ + additionalPrinterColumns: [{ + jsonPath: ".spec.hostnames", + name: "Hostnames", + type: "string" + }, { + jsonPath: ".metadata.creationTimestamp", + name: "Age", + type: "date" + }], + name: "v1", + schema: { + openAPIV3Schema: { + description: "HTTPRoute provides a way to route HTTP requests. This includes the capability\nto match requests by hostname, path, header, or query param. Filters can be\nused to specify additional processing steps. Backends specify where matching\nrequests should be routed.", + properties: { + apiVersion: { + description: "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", + type: "string" + }, + kind: { + description: "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + type: "string" + }, + metadata: { + type: "object" + }, + spec: { + description: "Spec defines the desired state of HTTPRoute.", + properties: { + hostnames: { + description: "Hostnames defines a set of hostnames that should match against the HTTP Host\nheader to select a HTTPRoute used to process the request. Implementations\nMUST ignore any port value specified in the HTTP Host header while\nperforming a match and (absent of any applicable header modification\nconfiguration) MUST forward this header unmodified to the backend.\n\nValid values for Hostnames are determined by RFC 1123 definition of a\nhostname with 2 notable exceptions:\n\n1. IPs are not allowed.\n2. A hostname may be prefixed with a wildcard label (`*.`). The wildcard\n label must appear by itself as the first label.\n\nIf a hostname is specified by both the Listener and HTTPRoute, there\nmust be at least one intersecting hostname for the HTTPRoute to be\nattached to the Listener. For example:\n\n* A Listener with `test.example.com` as the hostname matches HTTPRoutes\n that have either not specified any hostnames, or have specified at\n least one of `test.example.com` or `*.example.com`.\n* A Listener with `*.example.com` as the hostname matches HTTPRoutes\n that have either not specified any hostnames or have specified at least\n one hostname that matches the Listener hostname. For example,\n `*.example.com`, `test.example.com`, and `foo.test.example.com` would\n all match. On the other hand, `example.com` and `test.example.net` would\n not match.\n\nHostnames that are prefixed with a wildcard label (`*.`) are interpreted\nas a suffix match. That means that a match for `*.example.com` would match\nboth `test.example.com`, and `foo.test.example.com`, but not `example.com`.\n\nIf both the Listener and HTTPRoute have specified hostnames, any\nHTTPRoute hostnames that do not match the Listener hostname MUST be\nignored. For example, if a Listener specified `*.example.com`, and the\nHTTPRoute specified `test.example.com` and `test.example.net`,\n`test.example.net` must not be considered for a match.\n\nIf both the Listener and HTTPRoute have specified hostnames, and none\nmatch with the criteria above, then the HTTPRoute is not accepted. The\nimplementation must raise an 'Accepted' Condition with a status of\n`False` in the corresponding RouteParentStatus.\n\nIn the event that multiple HTTPRoutes specify intersecting hostnames (e.g.\noverlapping wildcard matching and exact matching hostnames), precedence must\nbe given to rules from the HTTPRoute with the largest number of:\n\n* Characters in a matching non-wildcard hostname.\n* Characters in a matching hostname.\n\nIf ties exist across multiple Routes, the matching precedence rules for\nHTTPRouteMatches takes over.\n\nSupport: Core", + items: { + description: "Hostname is the fully qualified domain name of a network host. This matches\nthe RFC 1123 definition of a hostname with 2 notable exceptions:\n\n 1. IPs are not allowed.\n 2. A hostname may be prefixed with a wildcard label (`*.`). The wildcard\n label must appear by itself as the first label.\n\nHostname can be \"precise\" which is a domain name without the terminating\ndot of a network host (e.g. \"foo.example.com\") or \"wildcard\", which is a\ndomain name prefixed with a single wildcard label (e.g. `*.example.com`).\n\nNote that as per RFC1035 and RFC1123, a *label* must consist of lower case\nalphanumeric characters or '-', and must start and end with an alphanumeric\ncharacter. No other punctuation is allowed.", + maxLength: 253, + minLength: 1, + pattern: "^(\\*\\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$", + type: "string" + }, + maxItems: 16, + type: "array" + }, + parentRefs: { + description: "ParentRefs references the resources (usually Gateways) that a Route wants\nto be attached to. Note that the referenced parent resource needs to\nallow this for the attachment to be complete. For Gateways, that means\nthe Gateway needs to allow attachment from Routes of this kind and\nnamespace. For Services, that means the Service must either be in the same\nnamespace for a \"producer\" route, or the mesh implementation must support\nand allow \"consumer\" routes for the referenced Service. ReferenceGrant is\nnot applicable for governing ParentRefs to Services - it is not possible to\ncreate a \"producer\" route for a Service in a different namespace from the\nRoute.\n\nThere are two kinds of parent resources with \"Core\" support:\n\n* Gateway (Gateway conformance profile)\n* Service (Mesh conformance profile, ClusterIP Services only)\n\nThis API may be extended in the future to support additional kinds of parent\nresources.\n\nParentRefs must be _distinct_. This means either that:\n\n* They select different objects. If this is the case, then parentRef\n entries are distinct. In terms of fields, this means that the\n multi-part key defined by `group`, `kind`, `namespace`, and `name` must\n be unique across all parentRef entries in the Route.\n* They do not select different objects, but for each optional field used,\n each ParentRef that selects the same object must set the same set of\n optional fields to different values. If one ParentRef sets a\n combination of optional fields, all must set the same combination.\n\nSome examples:\n\n* If one ParentRef sets `sectionName`, all ParentRefs referencing the\n same object must also set `sectionName`.\n* If one ParentRef sets `port`, all ParentRefs referencing the same\n object must also set `port`.\n* If one ParentRef sets `sectionName` and `port`, all ParentRefs\n referencing the same object must also set `sectionName` and `port`.\n\nIt is possible to separately reference multiple distinct objects that may\nbe collapsed by an implementation. For example, some implementations may\nchoose to merge compatible Gateway Listeners together. If that is the\ncase, the list of routes attached to those resources should also be\nmerged.\n\nNote that for ParentRefs that cross namespace boundaries, there are specific\nrules. Cross-namespace references are only valid if they are explicitly\nallowed by something in the namespace they are referring to. For example,\nGateway has the AllowedRoutes field, and ReferenceGrant provides a\ngeneric way to enable other kinds of cross-namespace reference.\n\n\n\n\n\n\n", + items: { + description: "ParentReference identifies an API object (usually a Gateway) that can be considered\na parent of this resource (usually a route). There are two kinds of parent resources\nwith \"Core\" support:\n\n* Gateway (Gateway conformance profile)\n* Service (Mesh conformance profile, ClusterIP Services only)\n\nThis API may be extended in the future to support additional kinds of parent\nresources.\n\nThe API object must be valid in the cluster; the Group and Kind must\nbe registered in the cluster for this reference to be valid.", + properties: { + group: { + default: "gateway.networking.k8s.io", + description: "Group is the group of the referent.\nWhen unspecified, \"gateway.networking.k8s.io\" is inferred.\nTo set the core API group (such as for a \"Service\" kind referent),\nGroup must be explicitly set to \"\" (empty string).\n\nSupport: Core", + maxLength: 253, + pattern: "^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$", + type: "string" + }, + kind: { + default: "Gateway", + description: "Kind is kind of the referent.\n\nThere are two kinds of parent resources with \"Core\" support:\n\n* Gateway (Gateway conformance profile)\n* Service (Mesh conformance profile, ClusterIP Services only)\n\nSupport for other resources is Implementation-Specific.", + maxLength: 63, + minLength: 1, + pattern: "^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$", + type: "string" + }, + name: { + description: "Name is the name of the referent.\n\nSupport: Core", + maxLength: 253, + minLength: 1, + type: "string" + }, + namespace: { + description: "Namespace is the namespace of the referent. When unspecified, this refers\nto the local namespace of the Route.\n\nNote that there are specific rules for ParentRefs which cross namespace\nboundaries. Cross-namespace references are only valid if they are explicitly\nallowed by something in the namespace they are referring to. For example:\nGateway has the AllowedRoutes field, and ReferenceGrant provides a\ngeneric way to enable any other kind of cross-namespace reference.\n\n\n\nSupport: Core", + maxLength: 63, + minLength: 1, + pattern: "^[a-z0-9]([-a-z0-9]*[a-z0-9])?$", + type: "string" + }, + port: { + description: "Port is the network port this Route targets. It can be interpreted\ndifferently based on the type of parent resource.\n\nWhen the parent resource is a Gateway, this targets all listeners\nlistening on the specified port that also support this kind of Route(and\nselect this Route). It's not recommended to set `Port` unless the\nnetworking behaviors specified in a Route must apply to a specific port\nas opposed to a listener(s) whose port(s) may be changed. When both Port\nand SectionName are specified, the name and port of the selected listener\nmust match both specified values.\n\n\n\nImplementations MAY choose to support other parent resources.\nImplementations supporting other types of parent resources MUST clearly\ndocument how/if Port is interpreted.\n\nFor the purpose of status, an attachment is considered successful as\nlong as the parent resource accepts it partially. For example, Gateway\nlisteners can restrict which Routes can attach to them by Route kind,\nnamespace, or hostname. If 1 of 2 Gateway listeners accept attachment\nfrom the referencing Route, the Route MUST be considered successfully\nattached. If no Gateway listeners accept attachment from this Route,\nthe Route MUST be considered detached from the Gateway.\n\nSupport: Extended", + format: "int32", + maximum: 65535, + minimum: 1, + type: "integer" + }, + sectionName: { + description: "SectionName is the name of a section within the target resource. In the\nfollowing resources, SectionName is interpreted as the following:\n\n* Gateway: Listener name. When both Port (experimental) and SectionName\nare specified, the name and port of the selected listener must match\nboth specified values.\n* Service: Port name. When both Port (experimental) and SectionName\nare specified, the name and port of the selected listener must match\nboth specified values.\n\nImplementations MAY choose to support attaching Routes to other resources.\nIf that is the case, they MUST clearly document how SectionName is\ninterpreted.\n\nWhen unspecified (empty string), this will reference the entire resource.\nFor the purpose of status, an attachment is considered successful if at\nleast one section in the parent resource accepts it. For example, Gateway\nlisteners can restrict which Routes can attach to them by Route kind,\nnamespace, or hostname. If 1 of 2 Gateway listeners accept attachment from\nthe referencing Route, the Route MUST be considered successfully\nattached. If no Gateway listeners accept attachment from this Route, the\nRoute MUST be considered detached from the Gateway.\n\nSupport: Core", + maxLength: 253, + minLength: 1, + pattern: "^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$", + type: "string" + } + }, + required: ["name"], + type: "object" + }, + maxItems: 32, + type: "array", + "x-kubernetes-validations": [{ + message: "sectionName must be specified when parentRefs includes 2 or more references to the same parent", + rule: "self.all(p1, self.all(p2, p1.group == p2.group && p1.kind == p2.kind && p1.name == p2.name && (((!has(p1.__namespace__) || p1.__namespace__ == '') && (!has(p2.__namespace__) || p2.__namespace__ == '')) || (has(p1.__namespace__) && has(p2.__namespace__) && p1.__namespace__ == p2.__namespace__ )) ? ((!has(p1.sectionName) || p1.sectionName == '') == (!has(p2.sectionName) || p2.sectionName == '')) : true))" + }, { + message: "sectionName must be unique when parentRefs includes 2 or more references to the same parent", + rule: "self.all(p1, self.exists_one(p2, p1.group == p2.group && p1.kind == p2.kind && p1.name == p2.name && (((!has(p1.__namespace__) || p1.__namespace__ == '') && (!has(p2.__namespace__) || p2.__namespace__ == '')) || (has(p1.__namespace__) && has(p2.__namespace__) && p1.__namespace__ == p2.__namespace__ )) && (((!has(p1.sectionName) || p1.sectionName == '') && (!has(p2.sectionName) || p2.sectionName == '')) || (has(p1.sectionName) && has(p2.sectionName) && p1.sectionName == p2.sectionName))))" + }] + }, + rules: { + default: [{ + matches: [{ + path: { + type: "PathPrefix", + value: "/" + } + }] + }], + description: "Rules are a list of HTTP matchers, filters and actions.\n\n", + items: { + description: "HTTPRouteRule defines semantics for matching an HTTP request based on\nconditions (matches), processing it (filters), and forwarding the request to\nan API object (backendRefs).", + properties: { + backendRefs: { + description: "BackendRefs defines the backend(s) where matching requests should be\nsent.\n\nFailure behavior here depends on how many BackendRefs are specified and\nhow many are invalid.\n\nIf *all* entries in BackendRefs are invalid, and there are also no filters\nspecified in this route rule, *all* traffic which matches this rule MUST\nreceive a 500 status code.\n\nSee the HTTPBackendRef definition for the rules about what makes a single\nHTTPBackendRef invalid.\n\nWhen a HTTPBackendRef is invalid, 500 status codes MUST be returned for\nrequests that would have otherwise been routed to an invalid backend. If\nmultiple backends are specified, and some are invalid, the proportion of\nrequests that would otherwise have been routed to an invalid backend\nMUST receive a 500 status code.\n\nFor example, if two backends are specified with equal weights, and one is\ninvalid, 50 percent of traffic must receive a 500. Implementations may\nchoose how that 50 percent is determined.\n\nWhen a HTTPBackendRef refers to a Service that has no ready endpoints,\nimplementations SHOULD return a 503 for requests to that backend instead.\nIf an implementation chooses to do this, all of the above rules for 500 responses\nMUST also apply for responses that return a 503.\n\nSupport: Core for Kubernetes Service\n\nSupport: Extended for Kubernetes ServiceImport\n\nSupport: Implementation-specific for any other resource\n\nSupport for weight: Core", + items: { + description: "HTTPBackendRef defines how a HTTPRoute forwards a HTTP request.\n\nNote that when a namespace different than the local namespace is specified, a\nReferenceGrant object is required in the referent namespace to allow that\nnamespace's owner to accept the reference. See the ReferenceGrant\ndocumentation for details.\n\n\n\nWhen the BackendRef points to a Kubernetes Service, implementations SHOULD\nhonor the appProtocol field if it is set for the target Service Port.\n\nImplementations supporting appProtocol SHOULD recognize the Kubernetes\nStandard Application Protocols defined in KEP-3726.\n\nIf a Service appProtocol isn't specified, an implementation MAY infer the\nbackend protocol through its own means. Implementations MAY infer the\nprotocol from the Route type referring to the backend Service.\n\nIf a Route is not able to send traffic to the backend using the specified\nprotocol then the backend is considered invalid. Implementations MUST set the\n\"ResolvedRefs\" condition to \"False\" with the \"UnsupportedProtocol\" reason.\n\n", + properties: { + filters: { + description: "Filters defined at this level should be executed if and only if the\nrequest is being forwarded to the backend defined here.\n\nSupport: Implementation-specific (For broader support of filters, use the\nFilters field in HTTPRouteRule.)", + items: { + description: "HTTPRouteFilter defines processing steps that must be completed during the\nrequest or response lifecycle. HTTPRouteFilters are meant as an extension\npoint to express processing that may be done in Gateway implementations. Some\nexamples include request or response modification, implementing\nauthentication strategies, rate-limiting, and traffic shaping. API\nguarantee/conformance is defined based on the type of the filter.", + properties: { + extensionRef: { + description: "ExtensionRef is an optional, implementation-specific extension to the\n\"filter\" behavior. For example, resource \"myroutefilter\" in group\n\"networking.example.net\"). ExtensionRef MUST NOT be used for core and\nextended filters.\n\nThis filter can be used multiple times within the same rule.\n\nSupport: Implementation-specific", + properties: { + group: { + description: "Group is the group of the referent. For example, \"gateway.networking.k8s.io\".\nWhen unspecified or empty string, core API group is inferred.", + maxLength: 253, + pattern: "^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$", + type: "string" + }, + kind: { + description: "Kind is kind of the referent. For example \"HTTPRoute\" or \"Service\".", + maxLength: 63, + minLength: 1, + pattern: "^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$", + type: "string" + }, + name: { + description: "Name is the name of the referent.", + maxLength: 253, + minLength: 1, + type: "string" + } + }, + required: ["group", "kind", "name"], + type: "object" + }, + requestHeaderModifier: { + description: "RequestHeaderModifier defines a schema for a filter that modifies request\nheaders.\n\nSupport: Core", + properties: { + add: { + description: "Add adds the given header(s) (name, value) to the request\nbefore the action. It appends to any existing values associated\nwith the header name.\n\nInput:\n GET /foo HTTP/1.1\n my-header: foo\n\nConfig:\n add:\n - name: \"my-header\"\n value: \"bar,baz\"\n\nOutput:\n GET /foo HTTP/1.1\n my-header: foo,bar,baz", + items: { + description: "HTTPHeader represents an HTTP Header name and value as defined by RFC 7230.", + properties: { + name: { + description: "Name is the name of the HTTP Header to be matched. Name matching MUST be\ncase insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).\n\nIf multiple entries specify equivalent header names, the first entry with\nan equivalent name MUST be considered for a match. Subsequent entries\nwith an equivalent header name MUST be ignored. Due to the\ncase-insensitivity of header names, \"foo\" and \"Foo\" are considered\nequivalent.", + maxLength: 256, + minLength: 1, + pattern: "^[A-Za-z0-9!#$%&'*+\\-.^_\\x60|~]+$", + type: "string" + }, + value: { + description: "Value is the value of HTTP Header to be matched.", + maxLength: 4096, + minLength: 1, + type: "string" + } + }, + required: ["name", "value"], + type: "object" + }, + maxItems: 16, + type: "array", + "x-kubernetes-list-map-keys": ["name"], + "x-kubernetes-list-type": "map" + }, + remove: { + description: "Remove the given header(s) from the HTTP request before the action. The\nvalue of Remove is a list of HTTP header names. Note that the header\nnames are case-insensitive (see\nhttps://datatracker.ietf.org/doc/html/rfc2616#section-4.2).\n\nInput:\n GET /foo HTTP/1.1\n my-header1: foo\n my-header2: bar\n my-header3: baz\n\nConfig:\n remove: [\"my-header1\", \"my-header3\"]\n\nOutput:\n GET /foo HTTP/1.1\n my-header2: bar", + items: { + type: "string" + }, + maxItems: 16, + type: "array", + "x-kubernetes-list-type": "set" + }, + set: { + description: "Set overwrites the request with the given header (name, value)\nbefore the action.\n\nInput:\n GET /foo HTTP/1.1\n my-header: foo\n\nConfig:\n set:\n - name: \"my-header\"\n value: \"bar\"\n\nOutput:\n GET /foo HTTP/1.1\n my-header: bar", + items: { + description: "HTTPHeader represents an HTTP Header name and value as defined by RFC 7230.", + properties: { + name: { + description: "Name is the name of the HTTP Header to be matched. Name matching MUST be\ncase insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).\n\nIf multiple entries specify equivalent header names, the first entry with\nan equivalent name MUST be considered for a match. Subsequent entries\nwith an equivalent header name MUST be ignored. Due to the\ncase-insensitivity of header names, \"foo\" and \"Foo\" are considered\nequivalent.", + maxLength: 256, + minLength: 1, + pattern: "^[A-Za-z0-9!#$%&'*+\\-.^_\\x60|~]+$", + type: "string" + }, + value: { + description: "Value is the value of HTTP Header to be matched.", + maxLength: 4096, + minLength: 1, + type: "string" + } + }, + required: ["name", "value"], + type: "object" + }, + maxItems: 16, + type: "array", + "x-kubernetes-list-map-keys": ["name"], + "x-kubernetes-list-type": "map" + } + }, + type: "object" + }, + requestMirror: { + description: "RequestMirror defines a schema for a filter that mirrors requests.\nRequests are sent to the specified destination, but responses from\nthat destination are ignored.\n\nThis filter can be used multiple times within the same rule. Note that\nnot all implementations will be able to support mirroring to multiple\nbackends.\n\nSupport: Extended\n\n", + properties: { + backendRef: { + description: "BackendRef references a resource where mirrored requests are sent.\n\nMirrored requests must be sent only to a single destination endpoint\nwithin this BackendRef, irrespective of how many endpoints are present\nwithin this BackendRef.\n\nIf the referent cannot be found, this BackendRef is invalid and must be\ndropped from the Gateway. The controller must ensure the \"ResolvedRefs\"\ncondition on the Route status is set to `status: False` and not configure\nthis backend in the underlying implementation.\n\nIf there is a cross-namespace reference to an *existing* object\nthat is not allowed by a ReferenceGrant, the controller must ensure the\n\"ResolvedRefs\" condition on the Route is set to `status: False`,\nwith the \"RefNotPermitted\" reason and not configure this backend in the\nunderlying implementation.\n\nIn either error case, the Message of the `ResolvedRefs` Condition\nshould be used to provide more detail about the problem.\n\nSupport: Extended for Kubernetes Service\n\nSupport: Implementation-specific for any other resource", + properties: { + group: { + default: "", + description: "Group is the group of the referent. For example, \"gateway.networking.k8s.io\".\nWhen unspecified or empty string, core API group is inferred.", + maxLength: 253, + pattern: "^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$", + type: "string" + }, + kind: { + default: "Service", + description: "Kind is the Kubernetes resource kind of the referent. For example\n\"Service\".\n\nDefaults to \"Service\" when not specified.\n\nExternalName services can refer to CNAME DNS records that may live\noutside of the cluster and as such are difficult to reason about in\nterms of conformance. They also may not be safe to forward to (see\nCVE-2021-25740 for more information). Implementations SHOULD NOT\nsupport ExternalName Services.\n\nSupport: Core (Services with a type other than ExternalName)\n\nSupport: Implementation-specific (Services with type ExternalName)", + maxLength: 63, + minLength: 1, + pattern: "^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$", + type: "string" + }, + name: { + description: "Name is the name of the referent.", + maxLength: 253, + minLength: 1, + type: "string" + }, + namespace: { + description: "Namespace is the namespace of the backend. When unspecified, the local\nnamespace is inferred.\n\nNote that when a namespace different than the local namespace is specified,\na ReferenceGrant object is required in the referent namespace to allow that\nnamespace's owner to accept the reference. See the ReferenceGrant\ndocumentation for details.\n\nSupport: Core", + maxLength: 63, + minLength: 1, + pattern: "^[a-z0-9]([-a-z0-9]*[a-z0-9])?$", + type: "string" + }, + port: { + description: "Port specifies the destination port number to use for this resource.\nPort is required when the referent is a Kubernetes Service. In this\ncase, the port number is the service port number, not the target port.\nFor other resources, destination port might be derived from the referent\nresource or this field.", + format: "int32", + maximum: 65535, + minimum: 1, + type: "integer" + } + }, + required: ["name"], + type: "object", + "x-kubernetes-validations": [{ + message: "Must have port for Service reference", + rule: "(size(self.group) == 0 && self.kind == 'Service') ? has(self.port) : true" + }] + } + }, + required: ["backendRef"], + type: "object" + }, + requestRedirect: { + description: "RequestRedirect defines a schema for a filter that responds to the\nrequest with an HTTP redirection.\n\nSupport: Core", + properties: { + hostname: { + description: "Hostname is the hostname to be used in the value of the `Location`\nheader in the response.\nWhen empty, the hostname in the `Host` header of the request is used.\n\nSupport: Core", + maxLength: 253, + minLength: 1, + pattern: "^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$", + type: "string" + }, + path: { + description: "Path defines parameters used to modify the path of the incoming request.\nThe modified path is then used to construct the `Location` header. When\nempty, the request path is used as-is.\n\nSupport: Extended", + properties: { + replaceFullPath: { + description: "ReplaceFullPath specifies the value with which to replace the full path\nof a request during a rewrite or redirect.", + maxLength: 1024, + type: "string" + }, + replacePrefixMatch: { + description: "ReplacePrefixMatch specifies the value with which to replace the prefix\nmatch of a request during a rewrite or redirect. For example, a request\nto \"/foo/bar\" with a prefix match of \"/foo\" and a ReplacePrefixMatch\nof \"/xyz\" would be modified to \"/xyz/bar\".\n\nNote that this matches the behavior of the PathPrefix match type. This\nmatches full path elements. A path element refers to the list of labels\nin the path split by the `/` separator. When specified, a trailing `/` is\nignored. For example, the paths `/abc`, `/abc/`, and `/abc/def` would all\nmatch the prefix `/abc`, but the path `/abcd` would not.\n\nReplacePrefixMatch is only compatible with a `PathPrefix` HTTPRouteMatch.\nUsing any other HTTPRouteMatch type on the same HTTPRouteRule will result in\nthe implementation setting the Accepted Condition for the Route to `status: False`.\n\nRequest Path | Prefix Match | Replace Prefix | Modified Path", + maxLength: 1024, + type: "string" + }, + type: { + description: "Type defines the type of path modifier. Additional types may be\nadded in a future release of the API.\n\nNote that values may be added to this enum, implementations\nmust ensure that unknown values will not cause a crash.\n\nUnknown values here must result in the implementation setting the\nAccepted Condition for the Route to `status: False`, with a\nReason of `UnsupportedValue`.", + enum: ["ReplaceFullPath", "ReplacePrefixMatch"], + type: "string" + } + }, + required: ["type"], + type: "object", + "x-kubernetes-validations": [{ + message: "replaceFullPath must be specified when type is set to 'ReplaceFullPath'", + rule: "self.type == 'ReplaceFullPath' ? has(self.replaceFullPath) : true" + }, { + message: "type must be 'ReplaceFullPath' when replaceFullPath is set", + rule: "has(self.replaceFullPath) ? self.type == 'ReplaceFullPath' : true" + }, { + message: "replacePrefixMatch must be specified when type is set to 'ReplacePrefixMatch'", + rule: "self.type == 'ReplacePrefixMatch' ? has(self.replacePrefixMatch) : true" + }, { + message: "type must be 'ReplacePrefixMatch' when replacePrefixMatch is set", + rule: "has(self.replacePrefixMatch) ? self.type == 'ReplacePrefixMatch' : true" + }] + }, + port: { + description: "Port is the port to be used in the value of the `Location`\nheader in the response.\n\nIf no port is specified, the redirect port MUST be derived using the\nfollowing rules:\n\n* If redirect scheme is not-empty, the redirect port MUST be the well-known\n port associated with the redirect scheme. Specifically \"http\" to port 80\n and \"https\" to port 443. If the redirect scheme does not have a\n well-known port, the listener port of the Gateway SHOULD be used.\n* If redirect scheme is empty, the redirect port MUST be the Gateway\n Listener port.\n\nImplementations SHOULD NOT add the port number in the 'Location'\nheader in the following cases:\n\n* A Location header that will use HTTP (whether that is determined via\n the Listener protocol or the Scheme field) _and_ use port 80.\n* A Location header that will use HTTPS (whether that is determined via\n the Listener protocol or the Scheme field) _and_ use port 443.\n\nSupport: Extended", + format: "int32", + maximum: 65535, + minimum: 1, + type: "integer" + }, + scheme: { + description: "Scheme is the scheme to be used in the value of the `Location` header in\nthe response. When empty, the scheme of the request is used.\n\nScheme redirects can affect the port of the redirect, for more information,\nrefer to the documentation for the port field of this filter.\n\nNote that values may be added to this enum, implementations\nmust ensure that unknown values will not cause a crash.\n\nUnknown values here must result in the implementation setting the\nAccepted Condition for the Route to `status: False`, with a\nReason of `UnsupportedValue`.\n\nSupport: Extended", + enum: ["http", "https"], + type: "string" + }, + statusCode: { + default: 302, + description: "StatusCode is the HTTP status code to be used in response.\n\nNote that values may be added to this enum, implementations\nmust ensure that unknown values will not cause a crash.\n\nUnknown values here must result in the implementation setting the\nAccepted Condition for the Route to `status: False`, with a\nReason of `UnsupportedValue`.\n\nSupport: Core", + enum: [301, 302], + type: "integer" + } + }, + type: "object" + }, + responseHeaderModifier: { + description: "ResponseHeaderModifier defines a schema for a filter that modifies response\nheaders.\n\nSupport: Extended", + properties: { + add: { + description: "Add adds the given header(s) (name, value) to the request\nbefore the action. It appends to any existing values associated\nwith the header name.\n\nInput:\n GET /foo HTTP/1.1\n my-header: foo\n\nConfig:\n add:\n - name: \"my-header\"\n value: \"bar,baz\"\n\nOutput:\n GET /foo HTTP/1.1\n my-header: foo,bar,baz", + items: { + description: "HTTPHeader represents an HTTP Header name and value as defined by RFC 7230.", + properties: { + name: { + description: "Name is the name of the HTTP Header to be matched. Name matching MUST be\ncase insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).\n\nIf multiple entries specify equivalent header names, the first entry with\nan equivalent name MUST be considered for a match. Subsequent entries\nwith an equivalent header name MUST be ignored. Due to the\ncase-insensitivity of header names, \"foo\" and \"Foo\" are considered\nequivalent.", + maxLength: 256, + minLength: 1, + pattern: "^[A-Za-z0-9!#$%&'*+\\-.^_\\x60|~]+$", + type: "string" + }, + value: { + description: "Value is the value of HTTP Header to be matched.", + maxLength: 4096, + minLength: 1, + type: "string" + } + }, + required: ["name", "value"], + type: "object" + }, + maxItems: 16, + type: "array", + "x-kubernetes-list-map-keys": ["name"], + "x-kubernetes-list-type": "map" + }, + remove: { + description: "Remove the given header(s) from the HTTP request before the action. The\nvalue of Remove is a list of HTTP header names. Note that the header\nnames are case-insensitive (see\nhttps://datatracker.ietf.org/doc/html/rfc2616#section-4.2).\n\nInput:\n GET /foo HTTP/1.1\n my-header1: foo\n my-header2: bar\n my-header3: baz\n\nConfig:\n remove: [\"my-header1\", \"my-header3\"]\n\nOutput:\n GET /foo HTTP/1.1\n my-header2: bar", + items: { + type: "string" + }, + maxItems: 16, + type: "array", + "x-kubernetes-list-type": "set" + }, + set: { + description: "Set overwrites the request with the given header (name, value)\nbefore the action.\n\nInput:\n GET /foo HTTP/1.1\n my-header: foo\n\nConfig:\n set:\n - name: \"my-header\"\n value: \"bar\"\n\nOutput:\n GET /foo HTTP/1.1\n my-header: bar", + items: { + description: "HTTPHeader represents an HTTP Header name and value as defined by RFC 7230.", + properties: { + name: { + description: "Name is the name of the HTTP Header to be matched. Name matching MUST be\ncase insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).\n\nIf multiple entries specify equivalent header names, the first entry with\nan equivalent name MUST be considered for a match. Subsequent entries\nwith an equivalent header name MUST be ignored. Due to the\ncase-insensitivity of header names, \"foo\" and \"Foo\" are considered\nequivalent.", + maxLength: 256, + minLength: 1, + pattern: "^[A-Za-z0-9!#$%&'*+\\-.^_\\x60|~]+$", + type: "string" + }, + value: { + description: "Value is the value of HTTP Header to be matched.", + maxLength: 4096, + minLength: 1, + type: "string" + } + }, + required: ["name", "value"], + type: "object" + }, + maxItems: 16, + type: "array", + "x-kubernetes-list-map-keys": ["name"], + "x-kubernetes-list-type": "map" + } + }, + type: "object" + }, + type: { + description: "Type identifies the type of filter to apply. As with other API fields,\ntypes are classified into three conformance levels:\n\n- Core: Filter types and their corresponding configuration defined by\n \"Support: Core\" in this package, e.g. \"RequestHeaderModifier\". All\n implementations must support core filters.\n\n- Extended: Filter types and their corresponding configuration defined by\n \"Support: Extended\" in this package, e.g. \"RequestMirror\". Implementers\n are encouraged to support extended filters.\n\n- Implementation-specific: Filters that are defined and supported by\n specific vendors.\n In the future, filters showing convergence in behavior across multiple\n implementations will be considered for inclusion in extended or core\n conformance levels. Filter-specific configuration for such filters\n is specified using the ExtensionRef field. `Type` should be set to\n \"ExtensionRef\" for custom filters.\n\nImplementers are encouraged to define custom implementation types to\nextend the core API with implementation-specific behavior.\n\nIf a reference to a custom filter type cannot be resolved, the filter\nMUST NOT be skipped. Instead, requests that would have been processed by\nthat filter MUST receive a HTTP error response.\n\nNote that values may be added to this enum, implementations\nmust ensure that unknown values will not cause a crash.\n\nUnknown values here must result in the implementation setting the\nAccepted Condition for the Route to `status: False`, with a\nReason of `UnsupportedValue`.", + enum: ["RequestHeaderModifier", "ResponseHeaderModifier", "RequestMirror", "RequestRedirect", "URLRewrite", "ExtensionRef"], + type: "string" + }, + urlRewrite: { + description: "URLRewrite defines a schema for a filter that modifies a request during forwarding.\n\nSupport: Extended", + properties: { + hostname: { + description: "Hostname is the value to be used to replace the Host header value during\nforwarding.\n\nSupport: Extended", + maxLength: 253, + minLength: 1, + pattern: "^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$", + type: "string" + }, + path: { + description: "Path defines a path rewrite.\n\nSupport: Extended", + properties: { + replaceFullPath: { + description: "ReplaceFullPath specifies the value with which to replace the full path\nof a request during a rewrite or redirect.", + maxLength: 1024, + type: "string" + }, + replacePrefixMatch: { + description: "ReplacePrefixMatch specifies the value with which to replace the prefix\nmatch of a request during a rewrite or redirect. For example, a request\nto \"/foo/bar\" with a prefix match of \"/foo\" and a ReplacePrefixMatch\nof \"/xyz\" would be modified to \"/xyz/bar\".\n\nNote that this matches the behavior of the PathPrefix match type. This\nmatches full path elements. A path element refers to the list of labels\nin the path split by the `/` separator. When specified, a trailing `/` is\nignored. For example, the paths `/abc`, `/abc/`, and `/abc/def` would all\nmatch the prefix `/abc`, but the path `/abcd` would not.\n\nReplacePrefixMatch is only compatible with a `PathPrefix` HTTPRouteMatch.\nUsing any other HTTPRouteMatch type on the same HTTPRouteRule will result in\nthe implementation setting the Accepted Condition for the Route to `status: False`.\n\nRequest Path | Prefix Match | Replace Prefix | Modified Path", + maxLength: 1024, + type: "string" + }, + type: { + description: "Type defines the type of path modifier. Additional types may be\nadded in a future release of the API.\n\nNote that values may be added to this enum, implementations\nmust ensure that unknown values will not cause a crash.\n\nUnknown values here must result in the implementation setting the\nAccepted Condition for the Route to `status: False`, with a\nReason of `UnsupportedValue`.", + enum: ["ReplaceFullPath", "ReplacePrefixMatch"], + type: "string" + } + }, + required: ["type"], + type: "object", + "x-kubernetes-validations": [{ + message: "replaceFullPath must be specified when type is set to 'ReplaceFullPath'", + rule: "self.type == 'ReplaceFullPath' ? has(self.replaceFullPath) : true" + }, { + message: "type must be 'ReplaceFullPath' when replaceFullPath is set", + rule: "has(self.replaceFullPath) ? self.type == 'ReplaceFullPath' : true" + }, { + message: "replacePrefixMatch must be specified when type is set to 'ReplacePrefixMatch'", + rule: "self.type == 'ReplacePrefixMatch' ? has(self.replacePrefixMatch) : true" + }, { + message: "type must be 'ReplacePrefixMatch' when replacePrefixMatch is set", + rule: "has(self.replacePrefixMatch) ? self.type == 'ReplacePrefixMatch' : true" + }] + } + }, + type: "object" + } + }, + required: ["type"], + type: "object", + "x-kubernetes-validations": [{ + message: "filter.requestHeaderModifier must be nil if the filter.type is not RequestHeaderModifier", + rule: "!(has(self.requestHeaderModifier) && self.type != 'RequestHeaderModifier')" + }, { + message: "filter.requestHeaderModifier must be specified for RequestHeaderModifier filter.type", + rule: "!(!has(self.requestHeaderModifier) && self.type == 'RequestHeaderModifier')" + }, { + message: "filter.responseHeaderModifier must be nil if the filter.type is not ResponseHeaderModifier", + rule: "!(has(self.responseHeaderModifier) && self.type != 'ResponseHeaderModifier')" + }, { + message: "filter.responseHeaderModifier must be specified for ResponseHeaderModifier filter.type", + rule: "!(!has(self.responseHeaderModifier) && self.type == 'ResponseHeaderModifier')" + }, { + message: "filter.requestMirror must be nil if the filter.type is not RequestMirror", + rule: "!(has(self.requestMirror) && self.type != 'RequestMirror')" + }, { + message: "filter.requestMirror must be specified for RequestMirror filter.type", + rule: "!(!has(self.requestMirror) && self.type == 'RequestMirror')" + }, { + message: "filter.requestRedirect must be nil if the filter.type is not RequestRedirect", + rule: "!(has(self.requestRedirect) && self.type != 'RequestRedirect')" + }, { + message: "filter.requestRedirect must be specified for RequestRedirect filter.type", + rule: "!(!has(self.requestRedirect) && self.type == 'RequestRedirect')" + }, { + message: "filter.urlRewrite must be nil if the filter.type is not URLRewrite", + rule: "!(has(self.urlRewrite) && self.type != 'URLRewrite')" + }, { + message: "filter.urlRewrite must be specified for URLRewrite filter.type", + rule: "!(!has(self.urlRewrite) && self.type == 'URLRewrite')" + }, { + message: "filter.extensionRef must be nil if the filter.type is not ExtensionRef", + rule: "!(has(self.extensionRef) && self.type != 'ExtensionRef')" + }, { + message: "filter.extensionRef must be specified for ExtensionRef filter.type", + rule: "!(!has(self.extensionRef) && self.type == 'ExtensionRef')" + }] + }, + maxItems: 16, + type: "array", + "x-kubernetes-validations": [{ + message: "May specify either httpRouteFilterRequestRedirect or httpRouteFilterRequestRewrite, but not both", + rule: "!(self.exists(f, f.type == 'RequestRedirect') && self.exists(f, f.type == 'URLRewrite'))" + }, { + message: "May specify either httpRouteFilterRequestRedirect or httpRouteFilterRequestRewrite, but not both", + rule: "!(self.exists(f, f.type == 'RequestRedirect') && self.exists(f, f.type == 'URLRewrite'))" + }, { + message: "RequestHeaderModifier filter cannot be repeated", + rule: "self.filter(f, f.type == 'RequestHeaderModifier').size() <= 1" + }, { + message: "ResponseHeaderModifier filter cannot be repeated", + rule: "self.filter(f, f.type == 'ResponseHeaderModifier').size() <= 1" + }, { + message: "RequestRedirect filter cannot be repeated", + rule: "self.filter(f, f.type == 'RequestRedirect').size() <= 1" + }, { + message: "URLRewrite filter cannot be repeated", + rule: "self.filter(f, f.type == 'URLRewrite').size() <= 1" + }] + }, + group: { + default: "", + description: "Group is the group of the referent. For example, \"gateway.networking.k8s.io\".\nWhen unspecified or empty string, core API group is inferred.", + maxLength: 253, + pattern: "^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$", + type: "string" + }, + kind: { + default: "Service", + description: "Kind is the Kubernetes resource kind of the referent. For example\n\"Service\".\n\nDefaults to \"Service\" when not specified.\n\nExternalName services can refer to CNAME DNS records that may live\noutside of the cluster and as such are difficult to reason about in\nterms of conformance. They also may not be safe to forward to (see\nCVE-2021-25740 for more information). Implementations SHOULD NOT\nsupport ExternalName Services.\n\nSupport: Core (Services with a type other than ExternalName)\n\nSupport: Implementation-specific (Services with type ExternalName)", + maxLength: 63, + minLength: 1, + pattern: "^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$", + type: "string" + }, + name: { + description: "Name is the name of the referent.", + maxLength: 253, + minLength: 1, + type: "string" + }, + namespace: { + description: "Namespace is the namespace of the backend. When unspecified, the local\nnamespace is inferred.\n\nNote that when a namespace different than the local namespace is specified,\na ReferenceGrant object is required in the referent namespace to allow that\nnamespace's owner to accept the reference. See the ReferenceGrant\ndocumentation for details.\n\nSupport: Core", + maxLength: 63, + minLength: 1, + pattern: "^[a-z0-9]([-a-z0-9]*[a-z0-9])?$", + type: "string" + }, + port: { + description: "Port specifies the destination port number to use for this resource.\nPort is required when the referent is a Kubernetes Service. In this\ncase, the port number is the service port number, not the target port.\nFor other resources, destination port might be derived from the referent\nresource or this field.", + format: "int32", + maximum: 65535, + minimum: 1, + type: "integer" + }, + weight: { + default: 1, + description: "Weight specifies the proportion of requests forwarded to the referenced\nbackend. This is computed as weight/(sum of all weights in this\nBackendRefs list). For non-zero values, there may be some epsilon from\nthe exact proportion defined here depending on the precision an\nimplementation supports. Weight is not a percentage and the sum of\nweights does not need to equal 100.\n\nIf only one backend is specified and it has a weight greater than 0, 100%\nof the traffic is forwarded to that backend. If weight is set to 0, no\ntraffic should be forwarded for this entry. If unspecified, weight\ndefaults to 1.\n\nSupport for this field varies based on the context where used.", + format: "int32", + maximum: 1000000, + minimum: 0, + type: "integer" + } + }, + required: ["name"], + type: "object", + "x-kubernetes-validations": [{ + message: "Must have port for Service reference", + rule: "(size(self.group) == 0 && self.kind == 'Service') ? has(self.port) : true" + }] + }, + maxItems: 16, + type: "array" + }, + filters: { + description: "Filters define the filters that are applied to requests that match\nthis rule.\n\nWherever possible, implementations SHOULD implement filters in the order\nthey are specified.\n\nImplementations MAY choose to implement this ordering strictly, rejecting\nany combination or order of filters that can not be supported. If implementations\nchoose a strict interpretation of filter ordering, they MUST clearly document\nthat behavior.\n\nTo reject an invalid combination or order of filters, implementations SHOULD\nconsider the Route Rules with this configuration invalid. If all Route Rules\nin a Route are invalid, the entire Route would be considered invalid. If only\na portion of Route Rules are invalid, implementations MUST set the\n\"PartiallyInvalid\" condition for the Route.\n\nConformance-levels at this level are defined based on the type of filter:\n\n- ALL core filters MUST be supported by all implementations.\n- Implementers are encouraged to support extended filters.\n- Implementation-specific custom filters have no API guarantees across\n implementations.\n\nSpecifying the same filter multiple times is not supported unless explicitly\nindicated in the filter.\n\nAll filters are expected to be compatible with each other except for the\nURLRewrite and RequestRedirect filters, which may not be combined. If an\nimplementation can not support other combinations of filters, they must clearly\ndocument that limitation. In cases where incompatible or unsupported\nfilters are specified and cause the `Accepted` condition to be set to status\n`False`, implementations may use the `IncompatibleFilters` reason to specify\nthis configuration error.\n\nSupport: Core", + items: { + description: "HTTPRouteFilter defines processing steps that must be completed during the\nrequest or response lifecycle. HTTPRouteFilters are meant as an extension\npoint to express processing that may be done in Gateway implementations. Some\nexamples include request or response modification, implementing\nauthentication strategies, rate-limiting, and traffic shaping. API\nguarantee/conformance is defined based on the type of the filter.", + properties: { + extensionRef: { + description: "ExtensionRef is an optional, implementation-specific extension to the\n\"filter\" behavior. For example, resource \"myroutefilter\" in group\n\"networking.example.net\"). ExtensionRef MUST NOT be used for core and\nextended filters.\n\nThis filter can be used multiple times within the same rule.\n\nSupport: Implementation-specific", + properties: { + group: { + description: "Group is the group of the referent. For example, \"gateway.networking.k8s.io\".\nWhen unspecified or empty string, core API group is inferred.", + maxLength: 253, + pattern: "^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$", + type: "string" + }, + kind: { + description: "Kind is kind of the referent. For example \"HTTPRoute\" or \"Service\".", + maxLength: 63, + minLength: 1, + pattern: "^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$", + type: "string" + }, + name: { + description: "Name is the name of the referent.", + maxLength: 253, + minLength: 1, + type: "string" + } + }, + required: ["group", "kind", "name"], + type: "object" + }, + requestHeaderModifier: { + description: "RequestHeaderModifier defines a schema for a filter that modifies request\nheaders.\n\nSupport: Core", + properties: { + add: { + description: "Add adds the given header(s) (name, value) to the request\nbefore the action. It appends to any existing values associated\nwith the header name.\n\nInput:\n GET /foo HTTP/1.1\n my-header: foo\n\nConfig:\n add:\n - name: \"my-header\"\n value: \"bar,baz\"\n\nOutput:\n GET /foo HTTP/1.1\n my-header: foo,bar,baz", + items: { + description: "HTTPHeader represents an HTTP Header name and value as defined by RFC 7230.", + properties: { + name: { + description: "Name is the name of the HTTP Header to be matched. Name matching MUST be\ncase insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).\n\nIf multiple entries specify equivalent header names, the first entry with\nan equivalent name MUST be considered for a match. Subsequent entries\nwith an equivalent header name MUST be ignored. Due to the\ncase-insensitivity of header names, \"foo\" and \"Foo\" are considered\nequivalent.", + maxLength: 256, + minLength: 1, + pattern: "^[A-Za-z0-9!#$%&'*+\\-.^_\\x60|~]+$", + type: "string" + }, + value: { + description: "Value is the value of HTTP Header to be matched.", + maxLength: 4096, + minLength: 1, + type: "string" + } + }, + required: ["name", "value"], + type: "object" + }, + maxItems: 16, + type: "array", + "x-kubernetes-list-map-keys": ["name"], + "x-kubernetes-list-type": "map" + }, + remove: { + description: "Remove the given header(s) from the HTTP request before the action. The\nvalue of Remove is a list of HTTP header names. Note that the header\nnames are case-insensitive (see\nhttps://datatracker.ietf.org/doc/html/rfc2616#section-4.2).\n\nInput:\n GET /foo HTTP/1.1\n my-header1: foo\n my-header2: bar\n my-header3: baz\n\nConfig:\n remove: [\"my-header1\", \"my-header3\"]\n\nOutput:\n GET /foo HTTP/1.1\n my-header2: bar", + items: { + type: "string" + }, + maxItems: 16, + type: "array", + "x-kubernetes-list-type": "set" + }, + set: { + description: "Set overwrites the request with the given header (name, value)\nbefore the action.\n\nInput:\n GET /foo HTTP/1.1\n my-header: foo\n\nConfig:\n set:\n - name: \"my-header\"\n value: \"bar\"\n\nOutput:\n GET /foo HTTP/1.1\n my-header: bar", + items: { + description: "HTTPHeader represents an HTTP Header name and value as defined by RFC 7230.", + properties: { + name: { + description: "Name is the name of the HTTP Header to be matched. Name matching MUST be\ncase insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).\n\nIf multiple entries specify equivalent header names, the first entry with\nan equivalent name MUST be considered for a match. Subsequent entries\nwith an equivalent header name MUST be ignored. Due to the\ncase-insensitivity of header names, \"foo\" and \"Foo\" are considered\nequivalent.", + maxLength: 256, + minLength: 1, + pattern: "^[A-Za-z0-9!#$%&'*+\\-.^_\\x60|~]+$", + type: "string" + }, + value: { + description: "Value is the value of HTTP Header to be matched.", + maxLength: 4096, + minLength: 1, + type: "string" + } + }, + required: ["name", "value"], + type: "object" + }, + maxItems: 16, + type: "array", + "x-kubernetes-list-map-keys": ["name"], + "x-kubernetes-list-type": "map" + } + }, + type: "object" + }, + requestMirror: { + description: "RequestMirror defines a schema for a filter that mirrors requests.\nRequests are sent to the specified destination, but responses from\nthat destination are ignored.\n\nThis filter can be used multiple times within the same rule. Note that\nnot all implementations will be able to support mirroring to multiple\nbackends.\n\nSupport: Extended\n\n", + properties: { + backendRef: { + description: "BackendRef references a resource where mirrored requests are sent.\n\nMirrored requests must be sent only to a single destination endpoint\nwithin this BackendRef, irrespective of how many endpoints are present\nwithin this BackendRef.\n\nIf the referent cannot be found, this BackendRef is invalid and must be\ndropped from the Gateway. The controller must ensure the \"ResolvedRefs\"\ncondition on the Route status is set to `status: False` and not configure\nthis backend in the underlying implementation.\n\nIf there is a cross-namespace reference to an *existing* object\nthat is not allowed by a ReferenceGrant, the controller must ensure the\n\"ResolvedRefs\" condition on the Route is set to `status: False`,\nwith the \"RefNotPermitted\" reason and not configure this backend in the\nunderlying implementation.\n\nIn either error case, the Message of the `ResolvedRefs` Condition\nshould be used to provide more detail about the problem.\n\nSupport: Extended for Kubernetes Service\n\nSupport: Implementation-specific for any other resource", + properties: { + group: { + default: "", + description: "Group is the group of the referent. For example, \"gateway.networking.k8s.io\".\nWhen unspecified or empty string, core API group is inferred.", + maxLength: 253, + pattern: "^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$", + type: "string" + }, + kind: { + default: "Service", + description: "Kind is the Kubernetes resource kind of the referent. For example\n\"Service\".\n\nDefaults to \"Service\" when not specified.\n\nExternalName services can refer to CNAME DNS records that may live\noutside of the cluster and as such are difficult to reason about in\nterms of conformance. They also may not be safe to forward to (see\nCVE-2021-25740 for more information). Implementations SHOULD NOT\nsupport ExternalName Services.\n\nSupport: Core (Services with a type other than ExternalName)\n\nSupport: Implementation-specific (Services with type ExternalName)", + maxLength: 63, + minLength: 1, + pattern: "^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$", + type: "string" + }, + name: { + description: "Name is the name of the referent.", + maxLength: 253, + minLength: 1, + type: "string" + }, + namespace: { + description: "Namespace is the namespace of the backend. When unspecified, the local\nnamespace is inferred.\n\nNote that when a namespace different than the local namespace is specified,\na ReferenceGrant object is required in the referent namespace to allow that\nnamespace's owner to accept the reference. See the ReferenceGrant\ndocumentation for details.\n\nSupport: Core", + maxLength: 63, + minLength: 1, + pattern: "^[a-z0-9]([-a-z0-9]*[a-z0-9])?$", + type: "string" + }, + port: { + description: "Port specifies the destination port number to use for this resource.\nPort is required when the referent is a Kubernetes Service. In this\ncase, the port number is the service port number, not the target port.\nFor other resources, destination port might be derived from the referent\nresource or this field.", + format: "int32", + maximum: 65535, + minimum: 1, + type: "integer" + } + }, + required: ["name"], + type: "object", + "x-kubernetes-validations": [{ + message: "Must have port for Service reference", + rule: "(size(self.group) == 0 && self.kind == 'Service') ? has(self.port) : true" + }] + } + }, + required: ["backendRef"], + type: "object" + }, + requestRedirect: { + description: "RequestRedirect defines a schema for a filter that responds to the\nrequest with an HTTP redirection.\n\nSupport: Core", + properties: { + hostname: { + description: "Hostname is the hostname to be used in the value of the `Location`\nheader in the response.\nWhen empty, the hostname in the `Host` header of the request is used.\n\nSupport: Core", + maxLength: 253, + minLength: 1, + pattern: "^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$", + type: "string" + }, + path: { + description: "Path defines parameters used to modify the path of the incoming request.\nThe modified path is then used to construct the `Location` header. When\nempty, the request path is used as-is.\n\nSupport: Extended", + properties: { + replaceFullPath: { + description: "ReplaceFullPath specifies the value with which to replace the full path\nof a request during a rewrite or redirect.", + maxLength: 1024, + type: "string" + }, + replacePrefixMatch: { + description: "ReplacePrefixMatch specifies the value with which to replace the prefix\nmatch of a request during a rewrite or redirect. For example, a request\nto \"/foo/bar\" with a prefix match of \"/foo\" and a ReplacePrefixMatch\nof \"/xyz\" would be modified to \"/xyz/bar\".\n\nNote that this matches the behavior of the PathPrefix match type. This\nmatches full path elements. A path element refers to the list of labels\nin the path split by the `/` separator. When specified, a trailing `/` is\nignored. For example, the paths `/abc`, `/abc/`, and `/abc/def` would all\nmatch the prefix `/abc`, but the path `/abcd` would not.\n\nReplacePrefixMatch is only compatible with a `PathPrefix` HTTPRouteMatch.\nUsing any other HTTPRouteMatch type on the same HTTPRouteRule will result in\nthe implementation setting the Accepted Condition for the Route to `status: False`.\n\nRequest Path | Prefix Match | Replace Prefix | Modified Path", + maxLength: 1024, + type: "string" + }, + type: { + description: "Type defines the type of path modifier. Additional types may be\nadded in a future release of the API.\n\nNote that values may be added to this enum, implementations\nmust ensure that unknown values will not cause a crash.\n\nUnknown values here must result in the implementation setting the\nAccepted Condition for the Route to `status: False`, with a\nReason of `UnsupportedValue`.", + enum: ["ReplaceFullPath", "ReplacePrefixMatch"], + type: "string" + } + }, + required: ["type"], + type: "object", + "x-kubernetes-validations": [{ + message: "replaceFullPath must be specified when type is set to 'ReplaceFullPath'", + rule: "self.type == 'ReplaceFullPath' ? has(self.replaceFullPath) : true" + }, { + message: "type must be 'ReplaceFullPath' when replaceFullPath is set", + rule: "has(self.replaceFullPath) ? self.type == 'ReplaceFullPath' : true" + }, { + message: "replacePrefixMatch must be specified when type is set to 'ReplacePrefixMatch'", + rule: "self.type == 'ReplacePrefixMatch' ? has(self.replacePrefixMatch) : true" + }, { + message: "type must be 'ReplacePrefixMatch' when replacePrefixMatch is set", + rule: "has(self.replacePrefixMatch) ? self.type == 'ReplacePrefixMatch' : true" + }] + }, + port: { + description: "Port is the port to be used in the value of the `Location`\nheader in the response.\n\nIf no port is specified, the redirect port MUST be derived using the\nfollowing rules:\n\n* If redirect scheme is not-empty, the redirect port MUST be the well-known\n port associated with the redirect scheme. Specifically \"http\" to port 80\n and \"https\" to port 443. If the redirect scheme does not have a\n well-known port, the listener port of the Gateway SHOULD be used.\n* If redirect scheme is empty, the redirect port MUST be the Gateway\n Listener port.\n\nImplementations SHOULD NOT add the port number in the 'Location'\nheader in the following cases:\n\n* A Location header that will use HTTP (whether that is determined via\n the Listener protocol or the Scheme field) _and_ use port 80.\n* A Location header that will use HTTPS (whether that is determined via\n the Listener protocol or the Scheme field) _and_ use port 443.\n\nSupport: Extended", + format: "int32", + maximum: 65535, + minimum: 1, + type: "integer" + }, + scheme: { + description: "Scheme is the scheme to be used in the value of the `Location` header in\nthe response. When empty, the scheme of the request is used.\n\nScheme redirects can affect the port of the redirect, for more information,\nrefer to the documentation for the port field of this filter.\n\nNote that values may be added to this enum, implementations\nmust ensure that unknown values will not cause a crash.\n\nUnknown values here must result in the implementation setting the\nAccepted Condition for the Route to `status: False`, with a\nReason of `UnsupportedValue`.\n\nSupport: Extended", + enum: ["http", "https"], + type: "string" + }, + statusCode: { + default: 302, + description: "StatusCode is the HTTP status code to be used in response.\n\nNote that values may be added to this enum, implementations\nmust ensure that unknown values will not cause a crash.\n\nUnknown values here must result in the implementation setting the\nAccepted Condition for the Route to `status: False`, with a\nReason of `UnsupportedValue`.\n\nSupport: Core", + enum: [301, 302], + type: "integer" + } + }, + type: "object" + }, + responseHeaderModifier: { + description: "ResponseHeaderModifier defines a schema for a filter that modifies response\nheaders.\n\nSupport: Extended", + properties: { + add: { + description: "Add adds the given header(s) (name, value) to the request\nbefore the action. It appends to any existing values associated\nwith the header name.\n\nInput:\n GET /foo HTTP/1.1\n my-header: foo\n\nConfig:\n add:\n - name: \"my-header\"\n value: \"bar,baz\"\n\nOutput:\n GET /foo HTTP/1.1\n my-header: foo,bar,baz", + items: { + description: "HTTPHeader represents an HTTP Header name and value as defined by RFC 7230.", + properties: { + name: { + description: "Name is the name of the HTTP Header to be matched. Name matching MUST be\ncase insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).\n\nIf multiple entries specify equivalent header names, the first entry with\nan equivalent name MUST be considered for a match. Subsequent entries\nwith an equivalent header name MUST be ignored. Due to the\ncase-insensitivity of header names, \"foo\" and \"Foo\" are considered\nequivalent.", + maxLength: 256, + minLength: 1, + pattern: "^[A-Za-z0-9!#$%&'*+\\-.^_\\x60|~]+$", + type: "string" + }, + value: { + description: "Value is the value of HTTP Header to be matched.", + maxLength: 4096, + minLength: 1, + type: "string" + } + }, + required: ["name", "value"], + type: "object" + }, + maxItems: 16, + type: "array", + "x-kubernetes-list-map-keys": ["name"], + "x-kubernetes-list-type": "map" + }, + remove: { + description: "Remove the given header(s) from the HTTP request before the action. The\nvalue of Remove is a list of HTTP header names. Note that the header\nnames are case-insensitive (see\nhttps://datatracker.ietf.org/doc/html/rfc2616#section-4.2).\n\nInput:\n GET /foo HTTP/1.1\n my-header1: foo\n my-header2: bar\n my-header3: baz\n\nConfig:\n remove: [\"my-header1\", \"my-header3\"]\n\nOutput:\n GET /foo HTTP/1.1\n my-header2: bar", + items: { + type: "string" + }, + maxItems: 16, + type: "array", + "x-kubernetes-list-type": "set" + }, + set: { + description: "Set overwrites the request with the given header (name, value)\nbefore the action.\n\nInput:\n GET /foo HTTP/1.1\n my-header: foo\n\nConfig:\n set:\n - name: \"my-header\"\n value: \"bar\"\n\nOutput:\n GET /foo HTTP/1.1\n my-header: bar", + items: { + description: "HTTPHeader represents an HTTP Header name and value as defined by RFC 7230.", + properties: { + name: { + description: "Name is the name of the HTTP Header to be matched. Name matching MUST be\ncase insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).\n\nIf multiple entries specify equivalent header names, the first entry with\nan equivalent name MUST be considered for a match. Subsequent entries\nwith an equivalent header name MUST be ignored. Due to the\ncase-insensitivity of header names, \"foo\" and \"Foo\" are considered\nequivalent.", + maxLength: 256, + minLength: 1, + pattern: "^[A-Za-z0-9!#$%&'*+\\-.^_\\x60|~]+$", + type: "string" + }, + value: { + description: "Value is the value of HTTP Header to be matched.", + maxLength: 4096, + minLength: 1, + type: "string" + } + }, + required: ["name", "value"], + type: "object" + }, + maxItems: 16, + type: "array", + "x-kubernetes-list-map-keys": ["name"], + "x-kubernetes-list-type": "map" + } + }, + type: "object" + }, + type: { + description: "Type identifies the type of filter to apply. As with other API fields,\ntypes are classified into three conformance levels:\n\n- Core: Filter types and their corresponding configuration defined by\n \"Support: Core\" in this package, e.g. \"RequestHeaderModifier\". All\n implementations must support core filters.\n\n- Extended: Filter types and their corresponding configuration defined by\n \"Support: Extended\" in this package, e.g. \"RequestMirror\". Implementers\n are encouraged to support extended filters.\n\n- Implementation-specific: Filters that are defined and supported by\n specific vendors.\n In the future, filters showing convergence in behavior across multiple\n implementations will be considered for inclusion in extended or core\n conformance levels. Filter-specific configuration for such filters\n is specified using the ExtensionRef field. `Type` should be set to\n \"ExtensionRef\" for custom filters.\n\nImplementers are encouraged to define custom implementation types to\nextend the core API with implementation-specific behavior.\n\nIf a reference to a custom filter type cannot be resolved, the filter\nMUST NOT be skipped. Instead, requests that would have been processed by\nthat filter MUST receive a HTTP error response.\n\nNote that values may be added to this enum, implementations\nmust ensure that unknown values will not cause a crash.\n\nUnknown values here must result in the implementation setting the\nAccepted Condition for the Route to `status: False`, with a\nReason of `UnsupportedValue`.", + enum: ["RequestHeaderModifier", "ResponseHeaderModifier", "RequestMirror", "RequestRedirect", "URLRewrite", "ExtensionRef"], + type: "string" + }, + urlRewrite: { + description: "URLRewrite defines a schema for a filter that modifies a request during forwarding.\n\nSupport: Extended", + properties: { + hostname: { + description: "Hostname is the value to be used to replace the Host header value during\nforwarding.\n\nSupport: Extended", + maxLength: 253, + minLength: 1, + pattern: "^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$", + type: "string" + }, + path: { + description: "Path defines a path rewrite.\n\nSupport: Extended", + properties: { + replaceFullPath: { + description: "ReplaceFullPath specifies the value with which to replace the full path\nof a request during a rewrite or redirect.", + maxLength: 1024, + type: "string" + }, + replacePrefixMatch: { + description: "ReplacePrefixMatch specifies the value with which to replace the prefix\nmatch of a request during a rewrite or redirect. For example, a request\nto \"/foo/bar\" with a prefix match of \"/foo\" and a ReplacePrefixMatch\nof \"/xyz\" would be modified to \"/xyz/bar\".\n\nNote that this matches the behavior of the PathPrefix match type. This\nmatches full path elements. A path element refers to the list of labels\nin the path split by the `/` separator. When specified, a trailing `/` is\nignored. For example, the paths `/abc`, `/abc/`, and `/abc/def` would all\nmatch the prefix `/abc`, but the path `/abcd` would not.\n\nReplacePrefixMatch is only compatible with a `PathPrefix` HTTPRouteMatch.\nUsing any other HTTPRouteMatch type on the same HTTPRouteRule will result in\nthe implementation setting the Accepted Condition for the Route to `status: False`.\n\nRequest Path | Prefix Match | Replace Prefix | Modified Path", + maxLength: 1024, + type: "string" + }, + type: { + description: "Type defines the type of path modifier. Additional types may be\nadded in a future release of the API.\n\nNote that values may be added to this enum, implementations\nmust ensure that unknown values will not cause a crash.\n\nUnknown values here must result in the implementation setting the\nAccepted Condition for the Route to `status: False`, with a\nReason of `UnsupportedValue`.", + enum: ["ReplaceFullPath", "ReplacePrefixMatch"], + type: "string" + } + }, + required: ["type"], + type: "object", + "x-kubernetes-validations": [{ + message: "replaceFullPath must be specified when type is set to 'ReplaceFullPath'", + rule: "self.type == 'ReplaceFullPath' ? has(self.replaceFullPath) : true" + }, { + message: "type must be 'ReplaceFullPath' when replaceFullPath is set", + rule: "has(self.replaceFullPath) ? self.type == 'ReplaceFullPath' : true" + }, { + message: "replacePrefixMatch must be specified when type is set to 'ReplacePrefixMatch'", + rule: "self.type == 'ReplacePrefixMatch' ? has(self.replacePrefixMatch) : true" + }, { + message: "type must be 'ReplacePrefixMatch' when replacePrefixMatch is set", + rule: "has(self.replacePrefixMatch) ? self.type == 'ReplacePrefixMatch' : true" + }] + } + }, + type: "object" + } + }, + required: ["type"], + type: "object", + "x-kubernetes-validations": [{ + message: "filter.requestHeaderModifier must be nil if the filter.type is not RequestHeaderModifier", + rule: "!(has(self.requestHeaderModifier) && self.type != 'RequestHeaderModifier')" + }, { + message: "filter.requestHeaderModifier must be specified for RequestHeaderModifier filter.type", + rule: "!(!has(self.requestHeaderModifier) && self.type == 'RequestHeaderModifier')" + }, { + message: "filter.responseHeaderModifier must be nil if the filter.type is not ResponseHeaderModifier", + rule: "!(has(self.responseHeaderModifier) && self.type != 'ResponseHeaderModifier')" + }, { + message: "filter.responseHeaderModifier must be specified for ResponseHeaderModifier filter.type", + rule: "!(!has(self.responseHeaderModifier) && self.type == 'ResponseHeaderModifier')" + }, { + message: "filter.requestMirror must be nil if the filter.type is not RequestMirror", + rule: "!(has(self.requestMirror) && self.type != 'RequestMirror')" + }, { + message: "filter.requestMirror must be specified for RequestMirror filter.type", + rule: "!(!has(self.requestMirror) && self.type == 'RequestMirror')" + }, { + message: "filter.requestRedirect must be nil if the filter.type is not RequestRedirect", + rule: "!(has(self.requestRedirect) && self.type != 'RequestRedirect')" + }, { + message: "filter.requestRedirect must be specified for RequestRedirect filter.type", + rule: "!(!has(self.requestRedirect) && self.type == 'RequestRedirect')" + }, { + message: "filter.urlRewrite must be nil if the filter.type is not URLRewrite", + rule: "!(has(self.urlRewrite) && self.type != 'URLRewrite')" + }, { + message: "filter.urlRewrite must be specified for URLRewrite filter.type", + rule: "!(!has(self.urlRewrite) && self.type == 'URLRewrite')" + }, { + message: "filter.extensionRef must be nil if the filter.type is not ExtensionRef", + rule: "!(has(self.extensionRef) && self.type != 'ExtensionRef')" + }, { + message: "filter.extensionRef must be specified for ExtensionRef filter.type", + rule: "!(!has(self.extensionRef) && self.type == 'ExtensionRef')" + }] + }, + maxItems: 16, + type: "array", + "x-kubernetes-validations": [{ + message: "May specify either httpRouteFilterRequestRedirect or httpRouteFilterRequestRewrite, but not both", + rule: "!(self.exists(f, f.type == 'RequestRedirect') && self.exists(f, f.type == 'URLRewrite'))" + }, { + message: "RequestHeaderModifier filter cannot be repeated", + rule: "self.filter(f, f.type == 'RequestHeaderModifier').size() <= 1" + }, { + message: "ResponseHeaderModifier filter cannot be repeated", + rule: "self.filter(f, f.type == 'ResponseHeaderModifier').size() <= 1" + }, { + message: "RequestRedirect filter cannot be repeated", + rule: "self.filter(f, f.type == 'RequestRedirect').size() <= 1" + }, { + message: "URLRewrite filter cannot be repeated", + rule: "self.filter(f, f.type == 'URLRewrite').size() <= 1" + }] + }, + matches: { + default: [{ + path: { + type: "PathPrefix", + value: "/" + } + }], + description: "Matches define conditions used for matching the rule against incoming\nHTTP requests. Each match is independent, i.e. this rule will be matched\nif **any** one of the matches is satisfied.\n\nFor example, take the following matches configuration:\n\n```\nmatches:\n- path:\n value: \"/foo\"\n headers:\n - name: \"version\"\n value: \"v2\"\n- path:\n value: \"/v2/foo\"\n```\n\nFor a request to match against this rule, a request must satisfy\nEITHER of the two conditions:\n\n- path prefixed with `/foo` AND contains the header `version: v2`\n- path prefix of `/v2/foo`\n\nSee the documentation for HTTPRouteMatch on how to specify multiple\nmatch conditions that should be ANDed together.\n\nIf no matches are specified, the default is a prefix\npath match on \"/\", which has the effect of matching every\nHTTP request.\n\nProxy or Load Balancer routing configuration generated from HTTPRoutes\nMUST prioritize matches based on the following criteria, continuing on\nties. Across all rules specified on applicable Routes, precedence must be\ngiven to the match having:\n\n* \"Exact\" path match.\n* \"Prefix\" path match with largest number of characters.\n* Method match.\n* Largest number of header matches.\n* Largest number of query param matches.\n\nNote: The precedence of RegularExpression path matches are implementation-specific.\n\nIf ties still exist across multiple Routes, matching precedence MUST be\ndetermined in order of the following criteria, continuing on ties:\n\n* The oldest Route based on creation timestamp.\n* The Route appearing first in alphabetical order by\n \"{namespace}/{name}\".\n\nIf ties still exist within an HTTPRoute, matching precedence MUST be granted\nto the FIRST matching rule (in list order) with a match meeting the above\ncriteria.\n\nWhen no rules matching a request have been successfully attached to the\nparent a request is coming from, a HTTP 404 status code MUST be returned.", + items: { + description: "HTTPRouteMatch defines the predicate used to match requests to a given\naction. Multiple match types are ANDed together, i.e. the match will\nevaluate to true only if all conditions are satisfied.\n\nFor example, the match below will match a HTTP request only if its path\nstarts with `/foo` AND it contains the `version: v1` header:\n\n```\nmatch:\n\n\tpath:\n\t value: \"/foo\"\n\theaders:\n\t- name: \"version\"\n\t value \"v1\"\n\n```", + properties: { + headers: { + description: "Headers specifies HTTP request header matchers. Multiple match values are\nANDed together, meaning, a request must match all the specified headers\nto select the route.", + items: { + description: "HTTPHeaderMatch describes how to select a HTTP route by matching HTTP request\nheaders.", + properties: { + name: { + description: "Name is the name of the HTTP Header to be matched. Name matching MUST be\ncase insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).\n\nIf multiple entries specify equivalent header names, only the first\nentry with an equivalent name MUST be considered for a match. Subsequent\nentries with an equivalent header name MUST be ignored. Due to the\ncase-insensitivity of header names, \"foo\" and \"Foo\" are considered\nequivalent.\n\nWhen a header is repeated in an HTTP request, it is\nimplementation-specific behavior as to how this is represented.\nGenerally, proxies should follow the guidance from the RFC:\nhttps://www.rfc-editor.org/rfc/rfc7230.html#section-3.2.2 regarding\nprocessing a repeated header, with special handling for \"Set-Cookie\".", + maxLength: 256, + minLength: 1, + pattern: "^[A-Za-z0-9!#$%&'*+\\-.^_\\x60|~]+$", + type: "string" + }, + type: { + default: "Exact", + description: "Type specifies how to match against the value of the header.\n\nSupport: Core (Exact)\n\nSupport: Implementation-specific (RegularExpression)\n\nSince RegularExpression HeaderMatchType has implementation-specific\nconformance, implementations can support POSIX, PCRE or any other dialects\nof regular expressions. Please read the implementation's documentation to\ndetermine the supported dialect.", + enum: ["Exact", "RegularExpression"], + type: "string" + }, + value: { + description: "Value is the value of HTTP Header to be matched.", + maxLength: 4096, + minLength: 1, + type: "string" + } + }, + required: ["name", "value"], + type: "object" + }, + maxItems: 16, + type: "array", + "x-kubernetes-list-map-keys": ["name"], + "x-kubernetes-list-type": "map" + }, + method: { + description: "Method specifies HTTP method matcher.\nWhen specified, this route will be matched only if the request has the\nspecified method.\n\nSupport: Extended", + enum: ["GET", "HEAD", "POST", "PUT", "DELETE", "CONNECT", "OPTIONS", "TRACE", "PATCH"], + type: "string" + }, + path: { + default: { + type: "PathPrefix", + value: "/" + }, + description: "Path specifies a HTTP request path matcher. If this field is not\nspecified, a default prefix match on the \"/\" path is provided.", + properties: { + type: { + default: "PathPrefix", + description: "Type specifies how to match against the path Value.\n\nSupport: Core (Exact, PathPrefix)\n\nSupport: Implementation-specific (RegularExpression)", + enum: ["Exact", "PathPrefix", "RegularExpression"], + type: "string" + }, + value: { + default: "/", + description: "Value of the HTTP path to match against.", + maxLength: 1024, + type: "string" + } + }, + type: "object", + "x-kubernetes-validations": [{ + message: "value must be an absolute path and start with '/' when type one of ['Exact', 'PathPrefix']", + rule: "(self.type in ['Exact','PathPrefix']) ? self.value.startsWith('/') : true" + }, { + message: "must not contain '//' when type one of ['Exact', 'PathPrefix']", + rule: "(self.type in ['Exact','PathPrefix']) ? !self.value.contains('//') : true" + }, { + message: "must not contain '/./' when type one of ['Exact', 'PathPrefix']", + rule: "(self.type in ['Exact','PathPrefix']) ? !self.value.contains('/./') : true" + }, { + message: "must not contain '/../' when type one of ['Exact', 'PathPrefix']", + rule: "(self.type in ['Exact','PathPrefix']) ? !self.value.contains('/../') : true" + }, { + message: "must not contain '%2f' when type one of ['Exact', 'PathPrefix']", + rule: "(self.type in ['Exact','PathPrefix']) ? !self.value.contains('%2f') : true" + }, { + message: "must not contain '%2F' when type one of ['Exact', 'PathPrefix']", + rule: "(self.type in ['Exact','PathPrefix']) ? !self.value.contains('%2F') : true" + }, { + message: "must not contain '#' when type one of ['Exact', 'PathPrefix']", + rule: "(self.type in ['Exact','PathPrefix']) ? !self.value.contains('#') : true" + }, { + message: "must not end with '/..' when type one of ['Exact', 'PathPrefix']", + rule: "(self.type in ['Exact','PathPrefix']) ? !self.value.endsWith('/..') : true" + }, { + message: "must not end with '/.' when type one of ['Exact', 'PathPrefix']", + rule: "(self.type in ['Exact','PathPrefix']) ? !self.value.endsWith('/.') : true" + }, { + message: "type must be one of ['Exact', 'PathPrefix', 'RegularExpression']", + rule: "self.type in ['Exact','PathPrefix'] || self.type == 'RegularExpression'" + }, { + message: "must only contain valid characters (matching ^(?:[-A-Za-z0-9/._~!$&'()*+,;=:@]|[%][0-9a-fA-F]{2})+$) for types ['Exact', 'PathPrefix']", + rule: "(self.type in ['Exact','PathPrefix']) ? self.value.matches(r\"\"\"^(?:[-A-Za-z0-9/._~!$&'()*+,;=:@]|[%][0-9a-fA-F]{2})+$\"\"\") : true" + }] + }, + queryParams: { + description: "QueryParams specifies HTTP query parameter matchers. Multiple match\nvalues are ANDed together, meaning, a request must match all the\nspecified query parameters to select the route.\n\nSupport: Extended", + items: { + description: "HTTPQueryParamMatch describes how to select a HTTP route by matching HTTP\nquery parameters.", + properties: { + name: { + description: "Name is the name of the HTTP query param to be matched. This must be an\nexact string match. (See\nhttps://tools.ietf.org/html/rfc7230#section-2.7.3).\n\nIf multiple entries specify equivalent query param names, only the first\nentry with an equivalent name MUST be considered for a match. Subsequent\nentries with an equivalent query param name MUST be ignored.\n\nIf a query param is repeated in an HTTP request, the behavior is\npurposely left undefined, since different data planes have different\ncapabilities. However, it is *recommended* that implementations should\nmatch against the first value of the param if the data plane supports it,\nas this behavior is expected in other load balancing contexts outside of\nthe Gateway API.\n\nUsers SHOULD NOT route traffic based on repeated query params to guard\nthemselves against potential differences in the implementations.", + maxLength: 256, + minLength: 1, + pattern: "^[A-Za-z0-9!#$%&'*+\\-.^_\\x60|~]+$", + type: "string" + }, + type: { + default: "Exact", + description: "Type specifies how to match against the value of the query parameter.\n\nSupport: Extended (Exact)\n\nSupport: Implementation-specific (RegularExpression)\n\nSince RegularExpression QueryParamMatchType has Implementation-specific\nconformance, implementations can support POSIX, PCRE or any other\ndialects of regular expressions. Please read the implementation's\ndocumentation to determine the supported dialect.", + enum: ["Exact", "RegularExpression"], + type: "string" + }, + value: { + description: "Value is the value of HTTP query param to be matched.", + maxLength: 1024, + minLength: 1, + type: "string" + } + }, + required: ["name", "value"], + type: "object" + }, + maxItems: 16, + type: "array", + "x-kubernetes-list-map-keys": ["name"], + "x-kubernetes-list-type": "map" + } + }, + type: "object" + }, + maxItems: 64, + type: "array" + }, + timeouts: { + description: "Timeouts defines the timeouts that can be configured for an HTTP request.\n\nSupport: Extended", + properties: { + backendRequest: { + description: "BackendRequest specifies a timeout for an individual request from the gateway\nto a backend. This covers the time from when the request first starts being\nsent from the gateway to when the full response has been received from the backend.\n\nSetting a timeout to the zero duration (e.g. \"0s\") SHOULD disable the timeout\ncompletely. Implementations that cannot completely disable the timeout MUST\ninstead interpret the zero duration as the longest possible value to which\nthe timeout can be set.\n\nAn entire client HTTP transaction with a gateway, covered by the Request timeout,\nmay result in more than one call from the gateway to the destination backend,\nfor example, if automatic retries are supported.\n\nThe value of BackendRequest must be a Gateway API Duration string as defined by\nGEP-2257. When this field is unspecified, its behavior is implementation-specific;\nwhen specified, the value of BackendRequest must be no more than the value of the\nRequest timeout (since the Request timeout encompasses the BackendRequest timeout).\n\nSupport: Extended", + pattern: "^([0-9]{1,5}(h|m|s|ms)){1,4}$", + type: "string" + }, + request: { + description: "Request specifies the maximum duration for a gateway to respond to an HTTP request.\nIf the gateway has not been able to respond before this deadline is met, the gateway\nMUST return a timeout error.\n\nFor example, setting the `rules.timeouts.request` field to the value `10s` in an\n`HTTPRoute` will cause a timeout if a client request is taking longer than 10 seconds\nto complete.\n\nSetting a timeout to the zero duration (e.g. \"0s\") SHOULD disable the timeout\ncompletely. Implementations that cannot completely disable the timeout MUST\ninstead interpret the zero duration as the longest possible value to which\nthe timeout can be set.\n\nThis timeout is intended to cover as close to the whole request-response transaction\nas possible although an implementation MAY choose to start the timeout after the entire\nrequest stream has been received instead of immediately after the transaction is\ninitiated by the client.\n\nThe value of Request is a Gateway API Duration string as defined by GEP-2257. When this\nfield is unspecified, request timeout behavior is implementation-specific.\n\nSupport: Extended", + pattern: "^([0-9]{1,5}(h|m|s|ms)){1,4}$", + type: "string" + } + }, + type: "object", + "x-kubernetes-validations": [{ + message: "backendRequest timeout cannot be longer than request timeout", + rule: "!(has(self.request) && has(self.backendRequest) && duration(self.request) != duration('0s') && duration(self.backendRequest) > duration(self.request))" + }] + } + }, + type: "object", + "x-kubernetes-validations": [{ + message: "RequestRedirect filter must not be used together with backendRefs", + rule: "(has(self.backendRefs) && size(self.backendRefs) > 0) ? (!has(self.filters) || self.filters.all(f, !has(f.requestRedirect))): true" + }, { + message: "When using RequestRedirect filter with path.replacePrefixMatch, exactly one PathPrefix match must be specified", + rule: "(has(self.filters) && self.filters.exists_one(f, has(f.requestRedirect) && has(f.requestRedirect.path) && f.requestRedirect.path.type == 'ReplacePrefixMatch' && has(f.requestRedirect.path.replacePrefixMatch))) ? ((size(self.matches) != 1 || !has(self.matches[0].path) || self.matches[0].path.type != 'PathPrefix') ? false : true) : true" + }, { + message: "When using URLRewrite filter with path.replacePrefixMatch, exactly one PathPrefix match must be specified", + rule: "(has(self.filters) && self.filters.exists_one(f, has(f.urlRewrite) && has(f.urlRewrite.path) && f.urlRewrite.path.type == 'ReplacePrefixMatch' && has(f.urlRewrite.path.replacePrefixMatch))) ? ((size(self.matches) != 1 || !has(self.matches[0].path) || self.matches[0].path.type != 'PathPrefix') ? false : true) : true" + }, { + message: "Within backendRefs, when using RequestRedirect filter with path.replacePrefixMatch, exactly one PathPrefix match must be specified", + rule: "(has(self.backendRefs) && self.backendRefs.exists_one(b, (has(b.filters) && b.filters.exists_one(f, has(f.requestRedirect) && has(f.requestRedirect.path) && f.requestRedirect.path.type == 'ReplacePrefixMatch' && has(f.requestRedirect.path.replacePrefixMatch))) )) ? ((size(self.matches) != 1 || !has(self.matches[0].path) || self.matches[0].path.type != 'PathPrefix') ? false : true) : true" + }, { + message: "Within backendRefs, When using URLRewrite filter with path.replacePrefixMatch, exactly one PathPrefix match must be specified", + rule: "(has(self.backendRefs) && self.backendRefs.exists_one(b, (has(b.filters) && b.filters.exists_one(f, has(f.urlRewrite) && has(f.urlRewrite.path) && f.urlRewrite.path.type == 'ReplacePrefixMatch' && has(f.urlRewrite.path.replacePrefixMatch))) )) ? ((size(self.matches) != 1 || !has(self.matches[0].path) || self.matches[0].path.type != 'PathPrefix') ? false : true) : true" + }] + }, + maxItems: 16, + type: "array", + "x-kubernetes-validations": [{ + message: "While 16 rules and 64 matches per rule are allowed, the total number of matches across all rules in a route must be less than 128", + rule: "(self.size() > 0 ? self[0].matches.size() : 0) + (self.size() > 1 ? self[1].matches.size() : 0) + (self.size() > 2 ? self[2].matches.size() : 0) + (self.size() > 3 ? self[3].matches.size() : 0) + (self.size() > 4 ? self[4].matches.size() : 0) + (self.size() > 5 ? self[5].matches.size() : 0) + (self.size() > 6 ? self[6].matches.size() : 0) + (self.size() > 7 ? self[7].matches.size() : 0) + (self.size() > 8 ? self[8].matches.size() : 0) + (self.size() > 9 ? self[9].matches.size() : 0) + (self.size() > 10 ? self[10].matches.size() : 0) + (self.size() > 11 ? self[11].matches.size() : 0) + (self.size() > 12 ? self[12].matches.size() : 0) + (self.size() > 13 ? self[13].matches.size() : 0) + (self.size() > 14 ? self[14].matches.size() : 0) + (self.size() > 15 ? self[15].matches.size() : 0) <= 128" + }] + } + }, + type: "object" + }, + status: { + description: "Status defines the current state of HTTPRoute.", + properties: { + parents: { + description: "Parents is a list of parent resources (usually Gateways) that are\nassociated with the route, and the status of the route with respect to\neach parent. When this route attaches to a parent, the controller that\nmanages the parent must add an entry to this list when the controller\nfirst sees the route and should update the entry as appropriate when the\nroute or gateway is modified.\n\nNote that parent references that cannot be resolved by an implementation\nof this API will not be added to this list. Implementations of this API\ncan only populate Route status for the Gateways/parent resources they are\nresponsible for.\n\nA maximum of 32 Gateways will be represented in this list. An empty list\nmeans the route has not been attached to any Gateway.", + items: { + description: "RouteParentStatus describes the status of a route with respect to an\nassociated Parent.", + properties: { + conditions: { + description: "Conditions describes the status of the route with respect to the Gateway.\nNote that the route's availability is also subject to the Gateway's own\nstatus conditions and listener status.\n\nIf the Route's ParentRef specifies an existing Gateway that supports\nRoutes of this kind AND that Gateway's controller has sufficient access,\nthen that Gateway's controller MUST set the \"Accepted\" condition on the\nRoute, to indicate whether the route has been accepted or rejected by the\nGateway, and why.\n\nA Route MUST be considered \"Accepted\" if at least one of the Route's\nrules is implemented by the Gateway.\n\nThere are a number of cases where the \"Accepted\" condition may not be set\ndue to lack of controller visibility, that includes when:\n\n* The Route refers to a non-existent parent.\n* The Route is of a type that the controller does not support.\n* The Route is in a namespace the controller does not have access to.", + items: { + description: "Condition contains details for one aspect of the current state of this API Resource.", + properties: { + lastTransitionTime: { + description: "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.", + format: "date-time", + type: "string" + }, + message: { + description: "message is a human readable message indicating details about the transition.\nThis may be an empty string.", + maxLength: 32768, + type: "string" + }, + observedGeneration: { + description: "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.", + format: "int64", + minimum: 0, + type: "integer" + }, + reason: { + description: "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.", + maxLength: 1024, + minLength: 1, + pattern: "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$", + type: "string" + }, + status: { + description: "status of the condition, one of True, False, Unknown.", + enum: ["True", "False", "Unknown"], + type: "string" + }, + type: { + description: "type of condition in CamelCase or in foo.example.com/CamelCase.", + maxLength: 316, + pattern: "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$", + type: "string" + } + }, + required: ["lastTransitionTime", "message", "reason", "status", "type"], + type: "object" + }, + maxItems: 8, + minItems: 1, + type: "array", + "x-kubernetes-list-map-keys": ["type"], + "x-kubernetes-list-type": "map" + }, + controllerName: { + description: "ControllerName is a domain/path string that indicates the name of the\ncontroller that wrote this status. This corresponds with the\ncontrollerName field on GatewayClass.\n\nExample: \"example.net/gateway-controller\".\n\nThe format of this field is DOMAIN \"/\" PATH, where DOMAIN and PATH are\nvalid Kubernetes names\n(https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names).\n\nControllers MUST populate this field when writing status. Controllers should ensure that\nentries to status populated with their ControllerName are cleaned up when they are no\nlonger necessary.", + maxLength: 253, + minLength: 1, + pattern: "^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\\/[A-Za-z0-9\\/\\-._~%!$&'()*+,;=:]+$", + type: "string" + }, + parentRef: { + description: "ParentRef corresponds with a ParentRef in the spec that this\nRouteParentStatus struct describes the status of.", + properties: { + group: { + default: "gateway.networking.k8s.io", + description: "Group is the group of the referent.\nWhen unspecified, \"gateway.networking.k8s.io\" is inferred.\nTo set the core API group (such as for a \"Service\" kind referent),\nGroup must be explicitly set to \"\" (empty string).\n\nSupport: Core", + maxLength: 253, + pattern: "^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$", + type: "string" + }, + kind: { + default: "Gateway", + description: "Kind is kind of the referent.\n\nThere are two kinds of parent resources with \"Core\" support:\n\n* Gateway (Gateway conformance profile)\n* Service (Mesh conformance profile, ClusterIP Services only)\n\nSupport for other resources is Implementation-Specific.", + maxLength: 63, + minLength: 1, + pattern: "^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$", + type: "string" + }, + name: { + description: "Name is the name of the referent.\n\nSupport: Core", + maxLength: 253, + minLength: 1, + type: "string" + }, + namespace: { + description: "Namespace is the namespace of the referent. When unspecified, this refers\nto the local namespace of the Route.\n\nNote that there are specific rules for ParentRefs which cross namespace\nboundaries. Cross-namespace references are only valid if they are explicitly\nallowed by something in the namespace they are referring to. For example:\nGateway has the AllowedRoutes field, and ReferenceGrant provides a\ngeneric way to enable any other kind of cross-namespace reference.\n\n\n\nSupport: Core", + maxLength: 63, + minLength: 1, + pattern: "^[a-z0-9]([-a-z0-9]*[a-z0-9])?$", + type: "string" + }, + port: { + description: "Port is the network port this Route targets. It can be interpreted\ndifferently based on the type of parent resource.\n\nWhen the parent resource is a Gateway, this targets all listeners\nlistening on the specified port that also support this kind of Route(and\nselect this Route). It's not recommended to set `Port` unless the\nnetworking behaviors specified in a Route must apply to a specific port\nas opposed to a listener(s) whose port(s) may be changed. When both Port\nand SectionName are specified, the name and port of the selected listener\nmust match both specified values.\n\n\n\nImplementations MAY choose to support other parent resources.\nImplementations supporting other types of parent resources MUST clearly\ndocument how/if Port is interpreted.\n\nFor the purpose of status, an attachment is considered successful as\nlong as the parent resource accepts it partially. For example, Gateway\nlisteners can restrict which Routes can attach to them by Route kind,\nnamespace, or hostname. If 1 of 2 Gateway listeners accept attachment\nfrom the referencing Route, the Route MUST be considered successfully\nattached. If no Gateway listeners accept attachment from this Route,\nthe Route MUST be considered detached from the Gateway.\n\nSupport: Extended", + format: "int32", + maximum: 65535, + minimum: 1, + type: "integer" + }, + sectionName: { + description: "SectionName is the name of a section within the target resource. In the\nfollowing resources, SectionName is interpreted as the following:\n\n* Gateway: Listener name. When both Port (experimental) and SectionName\nare specified, the name and port of the selected listener must match\nboth specified values.\n* Service: Port name. When both Port (experimental) and SectionName\nare specified, the name and port of the selected listener must match\nboth specified values.\n\nImplementations MAY choose to support attaching Routes to other resources.\nIf that is the case, they MUST clearly document how SectionName is\ninterpreted.\n\nWhen unspecified (empty string), this will reference the entire resource.\nFor the purpose of status, an attachment is considered successful if at\nleast one section in the parent resource accepts it. For example, Gateway\nlisteners can restrict which Routes can attach to them by Route kind,\nnamespace, or hostname. If 1 of 2 Gateway listeners accept attachment from\nthe referencing Route, the Route MUST be considered successfully\nattached. If no Gateway listeners accept attachment from this Route, the\nRoute MUST be considered detached from the Gateway.\n\nSupport: Core", + maxLength: 253, + minLength: 1, + pattern: "^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$", + type: "string" + } + }, + required: ["name"], + type: "object" + } + }, + required: ["controllerName", "parentRef"], + type: "object" + }, + maxItems: 32, + type: "array" + } + }, + required: ["parents"], + type: "object" + } + }, + required: ["spec"], + type: "object" + } + }, + served: true, + storage: true, + subresources: { + status: {} + } + }, { + additionalPrinterColumns: [{ + jsonPath: ".spec.hostnames", + name: "Hostnames", + type: "string" + }, { + jsonPath: ".metadata.creationTimestamp", + name: "Age", + type: "date" + }], + name: "v1beta1", + schema: { + openAPIV3Schema: { + description: "HTTPRoute provides a way to route HTTP requests. This includes the capability\nto match requests by hostname, path, header, or query param. Filters can be\nused to specify additional processing steps. Backends specify where matching\nrequests should be routed.", + properties: { + apiVersion: { + description: "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", + type: "string" + }, + kind: { + description: "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + type: "string" + }, + metadata: { + type: "object" + }, + spec: { + description: "Spec defines the desired state of HTTPRoute.", + properties: { + hostnames: { + description: "Hostnames defines a set of hostnames that should match against the HTTP Host\nheader to select a HTTPRoute used to process the request. Implementations\nMUST ignore any port value specified in the HTTP Host header while\nperforming a match and (absent of any applicable header modification\nconfiguration) MUST forward this header unmodified to the backend.\n\nValid values for Hostnames are determined by RFC 1123 definition of a\nhostname with 2 notable exceptions:\n\n1. IPs are not allowed.\n2. A hostname may be prefixed with a wildcard label (`*.`). The wildcard\n label must appear by itself as the first label.\n\nIf a hostname is specified by both the Listener and HTTPRoute, there\nmust be at least one intersecting hostname for the HTTPRoute to be\nattached to the Listener. For example:\n\n* A Listener with `test.example.com` as the hostname matches HTTPRoutes\n that have either not specified any hostnames, or have specified at\n least one of `test.example.com` or `*.example.com`.\n* A Listener with `*.example.com` as the hostname matches HTTPRoutes\n that have either not specified any hostnames or have specified at least\n one hostname that matches the Listener hostname. For example,\n `*.example.com`, `test.example.com`, and `foo.test.example.com` would\n all match. On the other hand, `example.com` and `test.example.net` would\n not match.\n\nHostnames that are prefixed with a wildcard label (`*.`) are interpreted\nas a suffix match. That means that a match for `*.example.com` would match\nboth `test.example.com`, and `foo.test.example.com`, but not `example.com`.\n\nIf both the Listener and HTTPRoute have specified hostnames, any\nHTTPRoute hostnames that do not match the Listener hostname MUST be\nignored. For example, if a Listener specified `*.example.com`, and the\nHTTPRoute specified `test.example.com` and `test.example.net`,\n`test.example.net` must not be considered for a match.\n\nIf both the Listener and HTTPRoute have specified hostnames, and none\nmatch with the criteria above, then the HTTPRoute is not accepted. The\nimplementation must raise an 'Accepted' Condition with a status of\n`False` in the corresponding RouteParentStatus.\n\nIn the event that multiple HTTPRoutes specify intersecting hostnames (e.g.\noverlapping wildcard matching and exact matching hostnames), precedence must\nbe given to rules from the HTTPRoute with the largest number of:\n\n* Characters in a matching non-wildcard hostname.\n* Characters in a matching hostname.\n\nIf ties exist across multiple Routes, the matching precedence rules for\nHTTPRouteMatches takes over.\n\nSupport: Core", + items: { + description: "Hostname is the fully qualified domain name of a network host. This matches\nthe RFC 1123 definition of a hostname with 2 notable exceptions:\n\n 1. IPs are not allowed.\n 2. A hostname may be prefixed with a wildcard label (`*.`). The wildcard\n label must appear by itself as the first label.\n\nHostname can be \"precise\" which is a domain name without the terminating\ndot of a network host (e.g. \"foo.example.com\") or \"wildcard\", which is a\ndomain name prefixed with a single wildcard label (e.g. `*.example.com`).\n\nNote that as per RFC1035 and RFC1123, a *label* must consist of lower case\nalphanumeric characters or '-', and must start and end with an alphanumeric\ncharacter. No other punctuation is allowed.", + maxLength: 253, + minLength: 1, + pattern: "^(\\*\\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$", + type: "string" + }, + maxItems: 16, + type: "array" + }, + parentRefs: { + description: "ParentRefs references the resources (usually Gateways) that a Route wants\nto be attached to. Note that the referenced parent resource needs to\nallow this for the attachment to be complete. For Gateways, that means\nthe Gateway needs to allow attachment from Routes of this kind and\nnamespace. For Services, that means the Service must either be in the same\nnamespace for a \"producer\" route, or the mesh implementation must support\nand allow \"consumer\" routes for the referenced Service. ReferenceGrant is\nnot applicable for governing ParentRefs to Services - it is not possible to\ncreate a \"producer\" route for a Service in a different namespace from the\nRoute.\n\nThere are two kinds of parent resources with \"Core\" support:\n\n* Gateway (Gateway conformance profile)\n* Service (Mesh conformance profile, ClusterIP Services only)\n\nThis API may be extended in the future to support additional kinds of parent\nresources.\n\nParentRefs must be _distinct_. This means either that:\n\n* They select different objects. If this is the case, then parentRef\n entries are distinct. In terms of fields, this means that the\n multi-part key defined by `group`, `kind`, `namespace`, and `name` must\n be unique across all parentRef entries in the Route.\n* They do not select different objects, but for each optional field used,\n each ParentRef that selects the same object must set the same set of\n optional fields to different values. If one ParentRef sets a\n combination of optional fields, all must set the same combination.\n\nSome examples:\n\n* If one ParentRef sets `sectionName`, all ParentRefs referencing the\n same object must also set `sectionName`.\n* If one ParentRef sets `port`, all ParentRefs referencing the same\n object must also set `port`.\n* If one ParentRef sets `sectionName` and `port`, all ParentRefs\n referencing the same object must also set `sectionName` and `port`.\n\nIt is possible to separately reference multiple distinct objects that may\nbe collapsed by an implementation. For example, some implementations may\nchoose to merge compatible Gateway Listeners together. If that is the\ncase, the list of routes attached to those resources should also be\nmerged.\n\nNote that for ParentRefs that cross namespace boundaries, there are specific\nrules. Cross-namespace references are only valid if they are explicitly\nallowed by something in the namespace they are referring to. For example,\nGateway has the AllowedRoutes field, and ReferenceGrant provides a\ngeneric way to enable other kinds of cross-namespace reference.\n\n\n\n\n\n\n", + items: { + description: "ParentReference identifies an API object (usually a Gateway) that can be considered\na parent of this resource (usually a route). There are two kinds of parent resources\nwith \"Core\" support:\n\n* Gateway (Gateway conformance profile)\n* Service (Mesh conformance profile, ClusterIP Services only)\n\nThis API may be extended in the future to support additional kinds of parent\nresources.\n\nThe API object must be valid in the cluster; the Group and Kind must\nbe registered in the cluster for this reference to be valid.", + properties: { + group: { + default: "gateway.networking.k8s.io", + description: "Group is the group of the referent.\nWhen unspecified, \"gateway.networking.k8s.io\" is inferred.\nTo set the core API group (such as for a \"Service\" kind referent),\nGroup must be explicitly set to \"\" (empty string).\n\nSupport: Core", + maxLength: 253, + pattern: "^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$", + type: "string" + }, + kind: { + default: "Gateway", + description: "Kind is kind of the referent.\n\nThere are two kinds of parent resources with \"Core\" support:\n\n* Gateway (Gateway conformance profile)\n* Service (Mesh conformance profile, ClusterIP Services only)\n\nSupport for other resources is Implementation-Specific.", + maxLength: 63, + minLength: 1, + pattern: "^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$", + type: "string" + }, + name: { + description: "Name is the name of the referent.\n\nSupport: Core", + maxLength: 253, + minLength: 1, + type: "string" + }, + namespace: { + description: "Namespace is the namespace of the referent. When unspecified, this refers\nto the local namespace of the Route.\n\nNote that there are specific rules for ParentRefs which cross namespace\nboundaries. Cross-namespace references are only valid if they are explicitly\nallowed by something in the namespace they are referring to. For example:\nGateway has the AllowedRoutes field, and ReferenceGrant provides a\ngeneric way to enable any other kind of cross-namespace reference.\n\n\n\nSupport: Core", + maxLength: 63, + minLength: 1, + pattern: "^[a-z0-9]([-a-z0-9]*[a-z0-9])?$", + type: "string" + }, + port: { + description: "Port is the network port this Route targets. It can be interpreted\ndifferently based on the type of parent resource.\n\nWhen the parent resource is a Gateway, this targets all listeners\nlistening on the specified port that also support this kind of Route(and\nselect this Route). It's not recommended to set `Port` unless the\nnetworking behaviors specified in a Route must apply to a specific port\nas opposed to a listener(s) whose port(s) may be changed. When both Port\nand SectionName are specified, the name and port of the selected listener\nmust match both specified values.\n\n\n\nImplementations MAY choose to support other parent resources.\nImplementations supporting other types of parent resources MUST clearly\ndocument how/if Port is interpreted.\n\nFor the purpose of status, an attachment is considered successful as\nlong as the parent resource accepts it partially. For example, Gateway\nlisteners can restrict which Routes can attach to them by Route kind,\nnamespace, or hostname. If 1 of 2 Gateway listeners accept attachment\nfrom the referencing Route, the Route MUST be considered successfully\nattached. If no Gateway listeners accept attachment from this Route,\nthe Route MUST be considered detached from the Gateway.\n\nSupport: Extended", + format: "int32", + maximum: 65535, + minimum: 1, + type: "integer" + }, + sectionName: { + description: "SectionName is the name of a section within the target resource. In the\nfollowing resources, SectionName is interpreted as the following:\n\n* Gateway: Listener name. When both Port (experimental) and SectionName\nare specified, the name and port of the selected listener must match\nboth specified values.\n* Service: Port name. When both Port (experimental) and SectionName\nare specified, the name and port of the selected listener must match\nboth specified values.\n\nImplementations MAY choose to support attaching Routes to other resources.\nIf that is the case, they MUST clearly document how SectionName is\ninterpreted.\n\nWhen unspecified (empty string), this will reference the entire resource.\nFor the purpose of status, an attachment is considered successful if at\nleast one section in the parent resource accepts it. For example, Gateway\nlisteners can restrict which Routes can attach to them by Route kind,\nnamespace, or hostname. If 1 of 2 Gateway listeners accept attachment from\nthe referencing Route, the Route MUST be considered successfully\nattached. If no Gateway listeners accept attachment from this Route, the\nRoute MUST be considered detached from the Gateway.\n\nSupport: Core", + maxLength: 253, + minLength: 1, + pattern: "^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$", + type: "string" + } + }, + required: ["name"], + type: "object" + }, + maxItems: 32, + type: "array", + "x-kubernetes-validations": [{ + message: "sectionName must be specified when parentRefs includes 2 or more references to the same parent", + rule: "self.all(p1, self.all(p2, p1.group == p2.group && p1.kind == p2.kind && p1.name == p2.name && (((!has(p1.__namespace__) || p1.__namespace__ == '') && (!has(p2.__namespace__) || p2.__namespace__ == '')) || (has(p1.__namespace__) && has(p2.__namespace__) && p1.__namespace__ == p2.__namespace__ )) ? ((!has(p1.sectionName) || p1.sectionName == '') == (!has(p2.sectionName) || p2.sectionName == '')) : true))" + }, { + message: "sectionName must be unique when parentRefs includes 2 or more references to the same parent", + rule: "self.all(p1, self.exists_one(p2, p1.group == p2.group && p1.kind == p2.kind && p1.name == p2.name && (((!has(p1.__namespace__) || p1.__namespace__ == '') && (!has(p2.__namespace__) || p2.__namespace__ == '')) || (has(p1.__namespace__) && has(p2.__namespace__) && p1.__namespace__ == p2.__namespace__ )) && (((!has(p1.sectionName) || p1.sectionName == '') && (!has(p2.sectionName) || p2.sectionName == '')) || (has(p1.sectionName) && has(p2.sectionName) && p1.sectionName == p2.sectionName))))" + }] + }, + rules: { + default: [{ + matches: [{ + path: { + type: "PathPrefix", + value: "/" + } + }] + }], + description: "Rules are a list of HTTP matchers, filters and actions.\n\n", + items: { + description: "HTTPRouteRule defines semantics for matching an HTTP request based on\nconditions (matches), processing it (filters), and forwarding the request to\nan API object (backendRefs).", + properties: { + backendRefs: { + description: "BackendRefs defines the backend(s) where matching requests should be\nsent.\n\nFailure behavior here depends on how many BackendRefs are specified and\nhow many are invalid.\n\nIf *all* entries in BackendRefs are invalid, and there are also no filters\nspecified in this route rule, *all* traffic which matches this rule MUST\nreceive a 500 status code.\n\nSee the HTTPBackendRef definition for the rules about what makes a single\nHTTPBackendRef invalid.\n\nWhen a HTTPBackendRef is invalid, 500 status codes MUST be returned for\nrequests that would have otherwise been routed to an invalid backend. If\nmultiple backends are specified, and some are invalid, the proportion of\nrequests that would otherwise have been routed to an invalid backend\nMUST receive a 500 status code.\n\nFor example, if two backends are specified with equal weights, and one is\ninvalid, 50 percent of traffic must receive a 500. Implementations may\nchoose how that 50 percent is determined.\n\nWhen a HTTPBackendRef refers to a Service that has no ready endpoints,\nimplementations SHOULD return a 503 for requests to that backend instead.\nIf an implementation chooses to do this, all of the above rules for 500 responses\nMUST also apply for responses that return a 503.\n\nSupport: Core for Kubernetes Service\n\nSupport: Extended for Kubernetes ServiceImport\n\nSupport: Implementation-specific for any other resource\n\nSupport for weight: Core", + items: { + description: "HTTPBackendRef defines how a HTTPRoute forwards a HTTP request.\n\nNote that when a namespace different than the local namespace is specified, a\nReferenceGrant object is required in the referent namespace to allow that\nnamespace's owner to accept the reference. See the ReferenceGrant\ndocumentation for details.\n\n\n\nWhen the BackendRef points to a Kubernetes Service, implementations SHOULD\nhonor the appProtocol field if it is set for the target Service Port.\n\nImplementations supporting appProtocol SHOULD recognize the Kubernetes\nStandard Application Protocols defined in KEP-3726.\n\nIf a Service appProtocol isn't specified, an implementation MAY infer the\nbackend protocol through its own means. Implementations MAY infer the\nprotocol from the Route type referring to the backend Service.\n\nIf a Route is not able to send traffic to the backend using the specified\nprotocol then the backend is considered invalid. Implementations MUST set the\n\"ResolvedRefs\" condition to \"False\" with the \"UnsupportedProtocol\" reason.\n\n", + properties: { + filters: { + description: "Filters defined at this level should be executed if and only if the\nrequest is being forwarded to the backend defined here.\n\nSupport: Implementation-specific (For broader support of filters, use the\nFilters field in HTTPRouteRule.)", + items: { + description: "HTTPRouteFilter defines processing steps that must be completed during the\nrequest or response lifecycle. HTTPRouteFilters are meant as an extension\npoint to express processing that may be done in Gateway implementations. Some\nexamples include request or response modification, implementing\nauthentication strategies, rate-limiting, and traffic shaping. API\nguarantee/conformance is defined based on the type of the filter.", + properties: { + extensionRef: { + description: "ExtensionRef is an optional, implementation-specific extension to the\n\"filter\" behavior. For example, resource \"myroutefilter\" in group\n\"networking.example.net\"). ExtensionRef MUST NOT be used for core and\nextended filters.\n\nThis filter can be used multiple times within the same rule.\n\nSupport: Implementation-specific", + properties: { + group: { + description: "Group is the group of the referent. For example, \"gateway.networking.k8s.io\".\nWhen unspecified or empty string, core API group is inferred.", + maxLength: 253, + pattern: "^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$", + type: "string" + }, + kind: { + description: "Kind is kind of the referent. For example \"HTTPRoute\" or \"Service\".", + maxLength: 63, + minLength: 1, + pattern: "^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$", + type: "string" + }, + name: { + description: "Name is the name of the referent.", + maxLength: 253, + minLength: 1, + type: "string" + } + }, + required: ["group", "kind", "name"], + type: "object" + }, + requestHeaderModifier: { + description: "RequestHeaderModifier defines a schema for a filter that modifies request\nheaders.\n\nSupport: Core", + properties: { + add: { + description: "Add adds the given header(s) (name, value) to the request\nbefore the action. It appends to any existing values associated\nwith the header name.\n\nInput:\n GET /foo HTTP/1.1\n my-header: foo\n\nConfig:\n add:\n - name: \"my-header\"\n value: \"bar,baz\"\n\nOutput:\n GET /foo HTTP/1.1\n my-header: foo,bar,baz", + items: { + description: "HTTPHeader represents an HTTP Header name and value as defined by RFC 7230.", + properties: { + name: { + description: "Name is the name of the HTTP Header to be matched. Name matching MUST be\ncase insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).\n\nIf multiple entries specify equivalent header names, the first entry with\nan equivalent name MUST be considered for a match. Subsequent entries\nwith an equivalent header name MUST be ignored. Due to the\ncase-insensitivity of header names, \"foo\" and \"Foo\" are considered\nequivalent.", + maxLength: 256, + minLength: 1, + pattern: "^[A-Za-z0-9!#$%&'*+\\-.^_\\x60|~]+$", + type: "string" + }, + value: { + description: "Value is the value of HTTP Header to be matched.", + maxLength: 4096, + minLength: 1, + type: "string" + } + }, + required: ["name", "value"], + type: "object" + }, + maxItems: 16, + type: "array", + "x-kubernetes-list-map-keys": ["name"], + "x-kubernetes-list-type": "map" + }, + remove: { + description: "Remove the given header(s) from the HTTP request before the action. The\nvalue of Remove is a list of HTTP header names. Note that the header\nnames are case-insensitive (see\nhttps://datatracker.ietf.org/doc/html/rfc2616#section-4.2).\n\nInput:\n GET /foo HTTP/1.1\n my-header1: foo\n my-header2: bar\n my-header3: baz\n\nConfig:\n remove: [\"my-header1\", \"my-header3\"]\n\nOutput:\n GET /foo HTTP/1.1\n my-header2: bar", + items: { + type: "string" + }, + maxItems: 16, + type: "array", + "x-kubernetes-list-type": "set" + }, + set: { + description: "Set overwrites the request with the given header (name, value)\nbefore the action.\n\nInput:\n GET /foo HTTP/1.1\n my-header: foo\n\nConfig:\n set:\n - name: \"my-header\"\n value: \"bar\"\n\nOutput:\n GET /foo HTTP/1.1\n my-header: bar", + items: { + description: "HTTPHeader represents an HTTP Header name and value as defined by RFC 7230.", + properties: { + name: { + description: "Name is the name of the HTTP Header to be matched. Name matching MUST be\ncase insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).\n\nIf multiple entries specify equivalent header names, the first entry with\nan equivalent name MUST be considered for a match. Subsequent entries\nwith an equivalent header name MUST be ignored. Due to the\ncase-insensitivity of header names, \"foo\" and \"Foo\" are considered\nequivalent.", + maxLength: 256, + minLength: 1, + pattern: "^[A-Za-z0-9!#$%&'*+\\-.^_\\x60|~]+$", + type: "string" + }, + value: { + description: "Value is the value of HTTP Header to be matched.", + maxLength: 4096, + minLength: 1, + type: "string" + } + }, + required: ["name", "value"], + type: "object" + }, + maxItems: 16, + type: "array", + "x-kubernetes-list-map-keys": ["name"], + "x-kubernetes-list-type": "map" + } + }, + type: "object" + }, + requestMirror: { + description: "RequestMirror defines a schema for a filter that mirrors requests.\nRequests are sent to the specified destination, but responses from\nthat destination are ignored.\n\nThis filter can be used multiple times within the same rule. Note that\nnot all implementations will be able to support mirroring to multiple\nbackends.\n\nSupport: Extended\n\n", + properties: { + backendRef: { + description: "BackendRef references a resource where mirrored requests are sent.\n\nMirrored requests must be sent only to a single destination endpoint\nwithin this BackendRef, irrespective of how many endpoints are present\nwithin this BackendRef.\n\nIf the referent cannot be found, this BackendRef is invalid and must be\ndropped from the Gateway. The controller must ensure the \"ResolvedRefs\"\ncondition on the Route status is set to `status: False` and not configure\nthis backend in the underlying implementation.\n\nIf there is a cross-namespace reference to an *existing* object\nthat is not allowed by a ReferenceGrant, the controller must ensure the\n\"ResolvedRefs\" condition on the Route is set to `status: False`,\nwith the \"RefNotPermitted\" reason and not configure this backend in the\nunderlying implementation.\n\nIn either error case, the Message of the `ResolvedRefs` Condition\nshould be used to provide more detail about the problem.\n\nSupport: Extended for Kubernetes Service\n\nSupport: Implementation-specific for any other resource", + properties: { + group: { + default: "", + description: "Group is the group of the referent. For example, \"gateway.networking.k8s.io\".\nWhen unspecified or empty string, core API group is inferred.", + maxLength: 253, + pattern: "^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$", + type: "string" + }, + kind: { + default: "Service", + description: "Kind is the Kubernetes resource kind of the referent. For example\n\"Service\".\n\nDefaults to \"Service\" when not specified.\n\nExternalName services can refer to CNAME DNS records that may live\noutside of the cluster and as such are difficult to reason about in\nterms of conformance. They also may not be safe to forward to (see\nCVE-2021-25740 for more information). Implementations SHOULD NOT\nsupport ExternalName Services.\n\nSupport: Core (Services with a type other than ExternalName)\n\nSupport: Implementation-specific (Services with type ExternalName)", + maxLength: 63, + minLength: 1, + pattern: "^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$", + type: "string" + }, + name: { + description: "Name is the name of the referent.", + maxLength: 253, + minLength: 1, + type: "string" + }, + namespace: { + description: "Namespace is the namespace of the backend. When unspecified, the local\nnamespace is inferred.\n\nNote that when a namespace different than the local namespace is specified,\na ReferenceGrant object is required in the referent namespace to allow that\nnamespace's owner to accept the reference. See the ReferenceGrant\ndocumentation for details.\n\nSupport: Core", + maxLength: 63, + minLength: 1, + pattern: "^[a-z0-9]([-a-z0-9]*[a-z0-9])?$", + type: "string" + }, + port: { + description: "Port specifies the destination port number to use for this resource.\nPort is required when the referent is a Kubernetes Service. In this\ncase, the port number is the service port number, not the target port.\nFor other resources, destination port might be derived from the referent\nresource or this field.", + format: "int32", + maximum: 65535, + minimum: 1, + type: "integer" + } + }, + required: ["name"], + type: "object", + "x-kubernetes-validations": [{ + message: "Must have port for Service reference", + rule: "(size(self.group) == 0 && self.kind == 'Service') ? has(self.port) : true" + }] + } + }, + required: ["backendRef"], + type: "object" + }, + requestRedirect: { + description: "RequestRedirect defines a schema for a filter that responds to the\nrequest with an HTTP redirection.\n\nSupport: Core", + properties: { + hostname: { + description: "Hostname is the hostname to be used in the value of the `Location`\nheader in the response.\nWhen empty, the hostname in the `Host` header of the request is used.\n\nSupport: Core", + maxLength: 253, + minLength: 1, + pattern: "^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$", + type: "string" + }, + path: { + description: "Path defines parameters used to modify the path of the incoming request.\nThe modified path is then used to construct the `Location` header. When\nempty, the request path is used as-is.\n\nSupport: Extended", + properties: { + replaceFullPath: { + description: "ReplaceFullPath specifies the value with which to replace the full path\nof a request during a rewrite or redirect.", + maxLength: 1024, + type: "string" + }, + replacePrefixMatch: { + description: "ReplacePrefixMatch specifies the value with which to replace the prefix\nmatch of a request during a rewrite or redirect. For example, a request\nto \"/foo/bar\" with a prefix match of \"/foo\" and a ReplacePrefixMatch\nof \"/xyz\" would be modified to \"/xyz/bar\".\n\nNote that this matches the behavior of the PathPrefix match type. This\nmatches full path elements. A path element refers to the list of labels\nin the path split by the `/` separator. When specified, a trailing `/` is\nignored. For example, the paths `/abc`, `/abc/`, and `/abc/def` would all\nmatch the prefix `/abc`, but the path `/abcd` would not.\n\nReplacePrefixMatch is only compatible with a `PathPrefix` HTTPRouteMatch.\nUsing any other HTTPRouteMatch type on the same HTTPRouteRule will result in\nthe implementation setting the Accepted Condition for the Route to `status: False`.\n\nRequest Path | Prefix Match | Replace Prefix | Modified Path", + maxLength: 1024, + type: "string" + }, + type: { + description: "Type defines the type of path modifier. Additional types may be\nadded in a future release of the API.\n\nNote that values may be added to this enum, implementations\nmust ensure that unknown values will not cause a crash.\n\nUnknown values here must result in the implementation setting the\nAccepted Condition for the Route to `status: False`, with a\nReason of `UnsupportedValue`.", + enum: ["ReplaceFullPath", "ReplacePrefixMatch"], + type: "string" + } + }, + required: ["type"], + type: "object", + "x-kubernetes-validations": [{ + message: "replaceFullPath must be specified when type is set to 'ReplaceFullPath'", + rule: "self.type == 'ReplaceFullPath' ? has(self.replaceFullPath) : true" + }, { + message: "type must be 'ReplaceFullPath' when replaceFullPath is set", + rule: "has(self.replaceFullPath) ? self.type == 'ReplaceFullPath' : true" + }, { + message: "replacePrefixMatch must be specified when type is set to 'ReplacePrefixMatch'", + rule: "self.type == 'ReplacePrefixMatch' ? has(self.replacePrefixMatch) : true" + }, { + message: "type must be 'ReplacePrefixMatch' when replacePrefixMatch is set", + rule: "has(self.replacePrefixMatch) ? self.type == 'ReplacePrefixMatch' : true" + }] + }, + port: { + description: "Port is the port to be used in the value of the `Location`\nheader in the response.\n\nIf no port is specified, the redirect port MUST be derived using the\nfollowing rules:\n\n* If redirect scheme is not-empty, the redirect port MUST be the well-known\n port associated with the redirect scheme. Specifically \"http\" to port 80\n and \"https\" to port 443. If the redirect scheme does not have a\n well-known port, the listener port of the Gateway SHOULD be used.\n* If redirect scheme is empty, the redirect port MUST be the Gateway\n Listener port.\n\nImplementations SHOULD NOT add the port number in the 'Location'\nheader in the following cases:\n\n* A Location header that will use HTTP (whether that is determined via\n the Listener protocol or the Scheme field) _and_ use port 80.\n* A Location header that will use HTTPS (whether that is determined via\n the Listener protocol or the Scheme field) _and_ use port 443.\n\nSupport: Extended", + format: "int32", + maximum: 65535, + minimum: 1, + type: "integer" + }, + scheme: { + description: "Scheme is the scheme to be used in the value of the `Location` header in\nthe response. When empty, the scheme of the request is used.\n\nScheme redirects can affect the port of the redirect, for more information,\nrefer to the documentation for the port field of this filter.\n\nNote that values may be added to this enum, implementations\nmust ensure that unknown values will not cause a crash.\n\nUnknown values here must result in the implementation setting the\nAccepted Condition for the Route to `status: False`, with a\nReason of `UnsupportedValue`.\n\nSupport: Extended", + enum: ["http", "https"], + type: "string" + }, + statusCode: { + default: 302, + description: "StatusCode is the HTTP status code to be used in response.\n\nNote that values may be added to this enum, implementations\nmust ensure that unknown values will not cause a crash.\n\nUnknown values here must result in the implementation setting the\nAccepted Condition for the Route to `status: False`, with a\nReason of `UnsupportedValue`.\n\nSupport: Core", + enum: [301, 302], + type: "integer" + } + }, + type: "object" + }, + responseHeaderModifier: { + description: "ResponseHeaderModifier defines a schema for a filter that modifies response\nheaders.\n\nSupport: Extended", + properties: { + add: { + description: "Add adds the given header(s) (name, value) to the request\nbefore the action. It appends to any existing values associated\nwith the header name.\n\nInput:\n GET /foo HTTP/1.1\n my-header: foo\n\nConfig:\n add:\n - name: \"my-header\"\n value: \"bar,baz\"\n\nOutput:\n GET /foo HTTP/1.1\n my-header: foo,bar,baz", + items: { + description: "HTTPHeader represents an HTTP Header name and value as defined by RFC 7230.", + properties: { + name: { + description: "Name is the name of the HTTP Header to be matched. Name matching MUST be\ncase insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).\n\nIf multiple entries specify equivalent header names, the first entry with\nan equivalent name MUST be considered for a match. Subsequent entries\nwith an equivalent header name MUST be ignored. Due to the\ncase-insensitivity of header names, \"foo\" and \"Foo\" are considered\nequivalent.", + maxLength: 256, + minLength: 1, + pattern: "^[A-Za-z0-9!#$%&'*+\\-.^_\\x60|~]+$", + type: "string" + }, + value: { + description: "Value is the value of HTTP Header to be matched.", + maxLength: 4096, + minLength: 1, + type: "string" + } + }, + required: ["name", "value"], + type: "object" + }, + maxItems: 16, + type: "array", + "x-kubernetes-list-map-keys": ["name"], + "x-kubernetes-list-type": "map" + }, + remove: { + description: "Remove the given header(s) from the HTTP request before the action. The\nvalue of Remove is a list of HTTP header names. Note that the header\nnames are case-insensitive (see\nhttps://datatracker.ietf.org/doc/html/rfc2616#section-4.2).\n\nInput:\n GET /foo HTTP/1.1\n my-header1: foo\n my-header2: bar\n my-header3: baz\n\nConfig:\n remove: [\"my-header1\", \"my-header3\"]\n\nOutput:\n GET /foo HTTP/1.1\n my-header2: bar", + items: { + type: "string" + }, + maxItems: 16, + type: "array", + "x-kubernetes-list-type": "set" + }, + set: { + description: "Set overwrites the request with the given header (name, value)\nbefore the action.\n\nInput:\n GET /foo HTTP/1.1\n my-header: foo\n\nConfig:\n set:\n - name: \"my-header\"\n value: \"bar\"\n\nOutput:\n GET /foo HTTP/1.1\n my-header: bar", + items: { + description: "HTTPHeader represents an HTTP Header name and value as defined by RFC 7230.", + properties: { + name: { + description: "Name is the name of the HTTP Header to be matched. Name matching MUST be\ncase insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).\n\nIf multiple entries specify equivalent header names, the first entry with\nan equivalent name MUST be considered for a match. Subsequent entries\nwith an equivalent header name MUST be ignored. Due to the\ncase-insensitivity of header names, \"foo\" and \"Foo\" are considered\nequivalent.", + maxLength: 256, + minLength: 1, + pattern: "^[A-Za-z0-9!#$%&'*+\\-.^_\\x60|~]+$", + type: "string" + }, + value: { + description: "Value is the value of HTTP Header to be matched.", + maxLength: 4096, + minLength: 1, + type: "string" + } + }, + required: ["name", "value"], + type: "object" + }, + maxItems: 16, + type: "array", + "x-kubernetes-list-map-keys": ["name"], + "x-kubernetes-list-type": "map" + } + }, + type: "object" + }, + type: { + description: "Type identifies the type of filter to apply. As with other API fields,\ntypes are classified into three conformance levels:\n\n- Core: Filter types and their corresponding configuration defined by\n \"Support: Core\" in this package, e.g. \"RequestHeaderModifier\". All\n implementations must support core filters.\n\n- Extended: Filter types and their corresponding configuration defined by\n \"Support: Extended\" in this package, e.g. \"RequestMirror\". Implementers\n are encouraged to support extended filters.\n\n- Implementation-specific: Filters that are defined and supported by\n specific vendors.\n In the future, filters showing convergence in behavior across multiple\n implementations will be considered for inclusion in extended or core\n conformance levels. Filter-specific configuration for such filters\n is specified using the ExtensionRef field. `Type` should be set to\n \"ExtensionRef\" for custom filters.\n\nImplementers are encouraged to define custom implementation types to\nextend the core API with implementation-specific behavior.\n\nIf a reference to a custom filter type cannot be resolved, the filter\nMUST NOT be skipped. Instead, requests that would have been processed by\nthat filter MUST receive a HTTP error response.\n\nNote that values may be added to this enum, implementations\nmust ensure that unknown values will not cause a crash.\n\nUnknown values here must result in the implementation setting the\nAccepted Condition for the Route to `status: False`, with a\nReason of `UnsupportedValue`.", + enum: ["RequestHeaderModifier", "ResponseHeaderModifier", "RequestMirror", "RequestRedirect", "URLRewrite", "ExtensionRef"], + type: "string" + }, + urlRewrite: { + description: "URLRewrite defines a schema for a filter that modifies a request during forwarding.\n\nSupport: Extended", + properties: { + hostname: { + description: "Hostname is the value to be used to replace the Host header value during\nforwarding.\n\nSupport: Extended", + maxLength: 253, + minLength: 1, + pattern: "^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$", + type: "string" + }, + path: { + description: "Path defines a path rewrite.\n\nSupport: Extended", + properties: { + replaceFullPath: { + description: "ReplaceFullPath specifies the value with which to replace the full path\nof a request during a rewrite or redirect.", + maxLength: 1024, + type: "string" + }, + replacePrefixMatch: { + description: "ReplacePrefixMatch specifies the value with which to replace the prefix\nmatch of a request during a rewrite or redirect. For example, a request\nto \"/foo/bar\" with a prefix match of \"/foo\" and a ReplacePrefixMatch\nof \"/xyz\" would be modified to \"/xyz/bar\".\n\nNote that this matches the behavior of the PathPrefix match type. This\nmatches full path elements. A path element refers to the list of labels\nin the path split by the `/` separator. When specified, a trailing `/` is\nignored. For example, the paths `/abc`, `/abc/`, and `/abc/def` would all\nmatch the prefix `/abc`, but the path `/abcd` would not.\n\nReplacePrefixMatch is only compatible with a `PathPrefix` HTTPRouteMatch.\nUsing any other HTTPRouteMatch type on the same HTTPRouteRule will result in\nthe implementation setting the Accepted Condition for the Route to `status: False`.\n\nRequest Path | Prefix Match | Replace Prefix | Modified Path", + maxLength: 1024, + type: "string" + }, + type: { + description: "Type defines the type of path modifier. Additional types may be\nadded in a future release of the API.\n\nNote that values may be added to this enum, implementations\nmust ensure that unknown values will not cause a crash.\n\nUnknown values here must result in the implementation setting the\nAccepted Condition for the Route to `status: False`, with a\nReason of `UnsupportedValue`.", + enum: ["ReplaceFullPath", "ReplacePrefixMatch"], + type: "string" + } + }, + required: ["type"], + type: "object", + "x-kubernetes-validations": [{ + message: "replaceFullPath must be specified when type is set to 'ReplaceFullPath'", + rule: "self.type == 'ReplaceFullPath' ? has(self.replaceFullPath) : true" + }, { + message: "type must be 'ReplaceFullPath' when replaceFullPath is set", + rule: "has(self.replaceFullPath) ? self.type == 'ReplaceFullPath' : true" + }, { + message: "replacePrefixMatch must be specified when type is set to 'ReplacePrefixMatch'", + rule: "self.type == 'ReplacePrefixMatch' ? has(self.replacePrefixMatch) : true" + }, { + message: "type must be 'ReplacePrefixMatch' when replacePrefixMatch is set", + rule: "has(self.replacePrefixMatch) ? self.type == 'ReplacePrefixMatch' : true" + }] + } + }, + type: "object" + } + }, + required: ["type"], + type: "object", + "x-kubernetes-validations": [{ + message: "filter.requestHeaderModifier must be nil if the filter.type is not RequestHeaderModifier", + rule: "!(has(self.requestHeaderModifier) && self.type != 'RequestHeaderModifier')" + }, { + message: "filter.requestHeaderModifier must be specified for RequestHeaderModifier filter.type", + rule: "!(!has(self.requestHeaderModifier) && self.type == 'RequestHeaderModifier')" + }, { + message: "filter.responseHeaderModifier must be nil if the filter.type is not ResponseHeaderModifier", + rule: "!(has(self.responseHeaderModifier) && self.type != 'ResponseHeaderModifier')" + }, { + message: "filter.responseHeaderModifier must be specified for ResponseHeaderModifier filter.type", + rule: "!(!has(self.responseHeaderModifier) && self.type == 'ResponseHeaderModifier')" + }, { + message: "filter.requestMirror must be nil if the filter.type is not RequestMirror", + rule: "!(has(self.requestMirror) && self.type != 'RequestMirror')" + }, { + message: "filter.requestMirror must be specified for RequestMirror filter.type", + rule: "!(!has(self.requestMirror) && self.type == 'RequestMirror')" + }, { + message: "filter.requestRedirect must be nil if the filter.type is not RequestRedirect", + rule: "!(has(self.requestRedirect) && self.type != 'RequestRedirect')" + }, { + message: "filter.requestRedirect must be specified for RequestRedirect filter.type", + rule: "!(!has(self.requestRedirect) && self.type == 'RequestRedirect')" + }, { + message: "filter.urlRewrite must be nil if the filter.type is not URLRewrite", + rule: "!(has(self.urlRewrite) && self.type != 'URLRewrite')" + }, { + message: "filter.urlRewrite must be specified for URLRewrite filter.type", + rule: "!(!has(self.urlRewrite) && self.type == 'URLRewrite')" + }, { + message: "filter.extensionRef must be nil if the filter.type is not ExtensionRef", + rule: "!(has(self.extensionRef) && self.type != 'ExtensionRef')" + }, { + message: "filter.extensionRef must be specified for ExtensionRef filter.type", + rule: "!(!has(self.extensionRef) && self.type == 'ExtensionRef')" + }] + }, + maxItems: 16, + type: "array", + "x-kubernetes-validations": [{ + message: "May specify either httpRouteFilterRequestRedirect or httpRouteFilterRequestRewrite, but not both", + rule: "!(self.exists(f, f.type == 'RequestRedirect') && self.exists(f, f.type == 'URLRewrite'))" + }, { + message: "May specify either httpRouteFilterRequestRedirect or httpRouteFilterRequestRewrite, but not both", + rule: "!(self.exists(f, f.type == 'RequestRedirect') && self.exists(f, f.type == 'URLRewrite'))" + }, { + message: "RequestHeaderModifier filter cannot be repeated", + rule: "self.filter(f, f.type == 'RequestHeaderModifier').size() <= 1" + }, { + message: "ResponseHeaderModifier filter cannot be repeated", + rule: "self.filter(f, f.type == 'ResponseHeaderModifier').size() <= 1" + }, { + message: "RequestRedirect filter cannot be repeated", + rule: "self.filter(f, f.type == 'RequestRedirect').size() <= 1" + }, { + message: "URLRewrite filter cannot be repeated", + rule: "self.filter(f, f.type == 'URLRewrite').size() <= 1" + }] + }, + group: { + default: "", + description: "Group is the group of the referent. For example, \"gateway.networking.k8s.io\".\nWhen unspecified or empty string, core API group is inferred.", + maxLength: 253, + pattern: "^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$", + type: "string" + }, + kind: { + default: "Service", + description: "Kind is the Kubernetes resource kind of the referent. For example\n\"Service\".\n\nDefaults to \"Service\" when not specified.\n\nExternalName services can refer to CNAME DNS records that may live\noutside of the cluster and as such are difficult to reason about in\nterms of conformance. They also may not be safe to forward to (see\nCVE-2021-25740 for more information). Implementations SHOULD NOT\nsupport ExternalName Services.\n\nSupport: Core (Services with a type other than ExternalName)\n\nSupport: Implementation-specific (Services with type ExternalName)", + maxLength: 63, + minLength: 1, + pattern: "^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$", + type: "string" + }, + name: { + description: "Name is the name of the referent.", + maxLength: 253, + minLength: 1, + type: "string" + }, + namespace: { + description: "Namespace is the namespace of the backend. When unspecified, the local\nnamespace is inferred.\n\nNote that when a namespace different than the local namespace is specified,\na ReferenceGrant object is required in the referent namespace to allow that\nnamespace's owner to accept the reference. See the ReferenceGrant\ndocumentation for details.\n\nSupport: Core", + maxLength: 63, + minLength: 1, + pattern: "^[a-z0-9]([-a-z0-9]*[a-z0-9])?$", + type: "string" + }, + port: { + description: "Port specifies the destination port number to use for this resource.\nPort is required when the referent is a Kubernetes Service. In this\ncase, the port number is the service port number, not the target port.\nFor other resources, destination port might be derived from the referent\nresource or this field.", + format: "int32", + maximum: 65535, + minimum: 1, + type: "integer" + }, + weight: { + default: 1, + description: "Weight specifies the proportion of requests forwarded to the referenced\nbackend. This is computed as weight/(sum of all weights in this\nBackendRefs list). For non-zero values, there may be some epsilon from\nthe exact proportion defined here depending on the precision an\nimplementation supports. Weight is not a percentage and the sum of\nweights does not need to equal 100.\n\nIf only one backend is specified and it has a weight greater than 0, 100%\nof the traffic is forwarded to that backend. If weight is set to 0, no\ntraffic should be forwarded for this entry. If unspecified, weight\ndefaults to 1.\n\nSupport for this field varies based on the context where used.", + format: "int32", + maximum: 1000000, + minimum: 0, + type: "integer" + } + }, + required: ["name"], + type: "object", + "x-kubernetes-validations": [{ + message: "Must have port for Service reference", + rule: "(size(self.group) == 0 && self.kind == 'Service') ? has(self.port) : true" + }] + }, + maxItems: 16, + type: "array" + }, + filters: { + description: "Filters define the filters that are applied to requests that match\nthis rule.\n\nWherever possible, implementations SHOULD implement filters in the order\nthey are specified.\n\nImplementations MAY choose to implement this ordering strictly, rejecting\nany combination or order of filters that can not be supported. If implementations\nchoose a strict interpretation of filter ordering, they MUST clearly document\nthat behavior.\n\nTo reject an invalid combination or order of filters, implementations SHOULD\nconsider the Route Rules with this configuration invalid. If all Route Rules\nin a Route are invalid, the entire Route would be considered invalid. If only\na portion of Route Rules are invalid, implementations MUST set the\n\"PartiallyInvalid\" condition for the Route.\n\nConformance-levels at this level are defined based on the type of filter:\n\n- ALL core filters MUST be supported by all implementations.\n- Implementers are encouraged to support extended filters.\n- Implementation-specific custom filters have no API guarantees across\n implementations.\n\nSpecifying the same filter multiple times is not supported unless explicitly\nindicated in the filter.\n\nAll filters are expected to be compatible with each other except for the\nURLRewrite and RequestRedirect filters, which may not be combined. If an\nimplementation can not support other combinations of filters, they must clearly\ndocument that limitation. In cases where incompatible or unsupported\nfilters are specified and cause the `Accepted` condition to be set to status\n`False`, implementations may use the `IncompatibleFilters` reason to specify\nthis configuration error.\n\nSupport: Core", + items: { + description: "HTTPRouteFilter defines processing steps that must be completed during the\nrequest or response lifecycle. HTTPRouteFilters are meant as an extension\npoint to express processing that may be done in Gateway implementations. Some\nexamples include request or response modification, implementing\nauthentication strategies, rate-limiting, and traffic shaping. API\nguarantee/conformance is defined based on the type of the filter.", + properties: { + extensionRef: { + description: "ExtensionRef is an optional, implementation-specific extension to the\n\"filter\" behavior. For example, resource \"myroutefilter\" in group\n\"networking.example.net\"). ExtensionRef MUST NOT be used for core and\nextended filters.\n\nThis filter can be used multiple times within the same rule.\n\nSupport: Implementation-specific", + properties: { + group: { + description: "Group is the group of the referent. For example, \"gateway.networking.k8s.io\".\nWhen unspecified or empty string, core API group is inferred.", + maxLength: 253, + pattern: "^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$", + type: "string" + }, + kind: { + description: "Kind is kind of the referent. For example \"HTTPRoute\" or \"Service\".", + maxLength: 63, + minLength: 1, + pattern: "^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$", + type: "string" + }, + name: { + description: "Name is the name of the referent.", + maxLength: 253, + minLength: 1, + type: "string" + } + }, + required: ["group", "kind", "name"], + type: "object" + }, + requestHeaderModifier: { + description: "RequestHeaderModifier defines a schema for a filter that modifies request\nheaders.\n\nSupport: Core", + properties: { + add: { + description: "Add adds the given header(s) (name, value) to the request\nbefore the action. It appends to any existing values associated\nwith the header name.\n\nInput:\n GET /foo HTTP/1.1\n my-header: foo\n\nConfig:\n add:\n - name: \"my-header\"\n value: \"bar,baz\"\n\nOutput:\n GET /foo HTTP/1.1\n my-header: foo,bar,baz", + items: { + description: "HTTPHeader represents an HTTP Header name and value as defined by RFC 7230.", + properties: { + name: { + description: "Name is the name of the HTTP Header to be matched. Name matching MUST be\ncase insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).\n\nIf multiple entries specify equivalent header names, the first entry with\nan equivalent name MUST be considered for a match. Subsequent entries\nwith an equivalent header name MUST be ignored. Due to the\ncase-insensitivity of header names, \"foo\" and \"Foo\" are considered\nequivalent.", + maxLength: 256, + minLength: 1, + pattern: "^[A-Za-z0-9!#$%&'*+\\-.^_\\x60|~]+$", + type: "string" + }, + value: { + description: "Value is the value of HTTP Header to be matched.", + maxLength: 4096, + minLength: 1, + type: "string" + } + }, + required: ["name", "value"], + type: "object" + }, + maxItems: 16, + type: "array", + "x-kubernetes-list-map-keys": ["name"], + "x-kubernetes-list-type": "map" + }, + remove: { + description: "Remove the given header(s) from the HTTP request before the action. The\nvalue of Remove is a list of HTTP header names. Note that the header\nnames are case-insensitive (see\nhttps://datatracker.ietf.org/doc/html/rfc2616#section-4.2).\n\nInput:\n GET /foo HTTP/1.1\n my-header1: foo\n my-header2: bar\n my-header3: baz\n\nConfig:\n remove: [\"my-header1\", \"my-header3\"]\n\nOutput:\n GET /foo HTTP/1.1\n my-header2: bar", + items: { + type: "string" + }, + maxItems: 16, + type: "array", + "x-kubernetes-list-type": "set" + }, + set: { + description: "Set overwrites the request with the given header (name, value)\nbefore the action.\n\nInput:\n GET /foo HTTP/1.1\n my-header: foo\n\nConfig:\n set:\n - name: \"my-header\"\n value: \"bar\"\n\nOutput:\n GET /foo HTTP/1.1\n my-header: bar", + items: { + description: "HTTPHeader represents an HTTP Header name and value as defined by RFC 7230.", + properties: { + name: { + description: "Name is the name of the HTTP Header to be matched. Name matching MUST be\ncase insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).\n\nIf multiple entries specify equivalent header names, the first entry with\nan equivalent name MUST be considered for a match. Subsequent entries\nwith an equivalent header name MUST be ignored. Due to the\ncase-insensitivity of header names, \"foo\" and \"Foo\" are considered\nequivalent.", + maxLength: 256, + minLength: 1, + pattern: "^[A-Za-z0-9!#$%&'*+\\-.^_\\x60|~]+$", + type: "string" + }, + value: { + description: "Value is the value of HTTP Header to be matched.", + maxLength: 4096, + minLength: 1, + type: "string" + } + }, + required: ["name", "value"], + type: "object" + }, + maxItems: 16, + type: "array", + "x-kubernetes-list-map-keys": ["name"], + "x-kubernetes-list-type": "map" + } + }, + type: "object" + }, + requestMirror: { + description: "RequestMirror defines a schema for a filter that mirrors requests.\nRequests are sent to the specified destination, but responses from\nthat destination are ignored.\n\nThis filter can be used multiple times within the same rule. Note that\nnot all implementations will be able to support mirroring to multiple\nbackends.\n\nSupport: Extended\n\n", + properties: { + backendRef: { + description: "BackendRef references a resource where mirrored requests are sent.\n\nMirrored requests must be sent only to a single destination endpoint\nwithin this BackendRef, irrespective of how many endpoints are present\nwithin this BackendRef.\n\nIf the referent cannot be found, this BackendRef is invalid and must be\ndropped from the Gateway. The controller must ensure the \"ResolvedRefs\"\ncondition on the Route status is set to `status: False` and not configure\nthis backend in the underlying implementation.\n\nIf there is a cross-namespace reference to an *existing* object\nthat is not allowed by a ReferenceGrant, the controller must ensure the\n\"ResolvedRefs\" condition on the Route is set to `status: False`,\nwith the \"RefNotPermitted\" reason and not configure this backend in the\nunderlying implementation.\n\nIn either error case, the Message of the `ResolvedRefs` Condition\nshould be used to provide more detail about the problem.\n\nSupport: Extended for Kubernetes Service\n\nSupport: Implementation-specific for any other resource", + properties: { + group: { + default: "", + description: "Group is the group of the referent. For example, \"gateway.networking.k8s.io\".\nWhen unspecified or empty string, core API group is inferred.", + maxLength: 253, + pattern: "^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$", + type: "string" + }, + kind: { + default: "Service", + description: "Kind is the Kubernetes resource kind of the referent. For example\n\"Service\".\n\nDefaults to \"Service\" when not specified.\n\nExternalName services can refer to CNAME DNS records that may live\noutside of the cluster and as such are difficult to reason about in\nterms of conformance. They also may not be safe to forward to (see\nCVE-2021-25740 for more information). Implementations SHOULD NOT\nsupport ExternalName Services.\n\nSupport: Core (Services with a type other than ExternalName)\n\nSupport: Implementation-specific (Services with type ExternalName)", + maxLength: 63, + minLength: 1, + pattern: "^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$", + type: "string" + }, + name: { + description: "Name is the name of the referent.", + maxLength: 253, + minLength: 1, + type: "string" + }, + namespace: { + description: "Namespace is the namespace of the backend. When unspecified, the local\nnamespace is inferred.\n\nNote that when a namespace different than the local namespace is specified,\na ReferenceGrant object is required in the referent namespace to allow that\nnamespace's owner to accept the reference. See the ReferenceGrant\ndocumentation for details.\n\nSupport: Core", + maxLength: 63, + minLength: 1, + pattern: "^[a-z0-9]([-a-z0-9]*[a-z0-9])?$", + type: "string" + }, + port: { + description: "Port specifies the destination port number to use for this resource.\nPort is required when the referent is a Kubernetes Service. In this\ncase, the port number is the service port number, not the target port.\nFor other resources, destination port might be derived from the referent\nresource or this field.", + format: "int32", + maximum: 65535, + minimum: 1, + type: "integer" + } + }, + required: ["name"], + type: "object", + "x-kubernetes-validations": [{ + message: "Must have port for Service reference", + rule: "(size(self.group) == 0 && self.kind == 'Service') ? has(self.port) : true" + }] + } + }, + required: ["backendRef"], + type: "object" + }, + requestRedirect: { + description: "RequestRedirect defines a schema for a filter that responds to the\nrequest with an HTTP redirection.\n\nSupport: Core", + properties: { + hostname: { + description: "Hostname is the hostname to be used in the value of the `Location`\nheader in the response.\nWhen empty, the hostname in the `Host` header of the request is used.\n\nSupport: Core", + maxLength: 253, + minLength: 1, + pattern: "^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$", + type: "string" + }, + path: { + description: "Path defines parameters used to modify the path of the incoming request.\nThe modified path is then used to construct the `Location` header. When\nempty, the request path is used as-is.\n\nSupport: Extended", + properties: { + replaceFullPath: { + description: "ReplaceFullPath specifies the value with which to replace the full path\nof a request during a rewrite or redirect.", + maxLength: 1024, + type: "string" + }, + replacePrefixMatch: { + description: "ReplacePrefixMatch specifies the value with which to replace the prefix\nmatch of a request during a rewrite or redirect. For example, a request\nto \"/foo/bar\" with a prefix match of \"/foo\" and a ReplacePrefixMatch\nof \"/xyz\" would be modified to \"/xyz/bar\".\n\nNote that this matches the behavior of the PathPrefix match type. This\nmatches full path elements. A path element refers to the list of labels\nin the path split by the `/` separator. When specified, a trailing `/` is\nignored. For example, the paths `/abc`, `/abc/`, and `/abc/def` would all\nmatch the prefix `/abc`, but the path `/abcd` would not.\n\nReplacePrefixMatch is only compatible with a `PathPrefix` HTTPRouteMatch.\nUsing any other HTTPRouteMatch type on the same HTTPRouteRule will result in\nthe implementation setting the Accepted Condition for the Route to `status: False`.\n\nRequest Path | Prefix Match | Replace Prefix | Modified Path", + maxLength: 1024, + type: "string" + }, + type: { + description: "Type defines the type of path modifier. Additional types may be\nadded in a future release of the API.\n\nNote that values may be added to this enum, implementations\nmust ensure that unknown values will not cause a crash.\n\nUnknown values here must result in the implementation setting the\nAccepted Condition for the Route to `status: False`, with a\nReason of `UnsupportedValue`.", + enum: ["ReplaceFullPath", "ReplacePrefixMatch"], + type: "string" + } + }, + required: ["type"], + type: "object", + "x-kubernetes-validations": [{ + message: "replaceFullPath must be specified when type is set to 'ReplaceFullPath'", + rule: "self.type == 'ReplaceFullPath' ? has(self.replaceFullPath) : true" + }, { + message: "type must be 'ReplaceFullPath' when replaceFullPath is set", + rule: "has(self.replaceFullPath) ? self.type == 'ReplaceFullPath' : true" + }, { + message: "replacePrefixMatch must be specified when type is set to 'ReplacePrefixMatch'", + rule: "self.type == 'ReplacePrefixMatch' ? has(self.replacePrefixMatch) : true" + }, { + message: "type must be 'ReplacePrefixMatch' when replacePrefixMatch is set", + rule: "has(self.replacePrefixMatch) ? self.type == 'ReplacePrefixMatch' : true" + }] + }, + port: { + description: "Port is the port to be used in the value of the `Location`\nheader in the response.\n\nIf no port is specified, the redirect port MUST be derived using the\nfollowing rules:\n\n* If redirect scheme is not-empty, the redirect port MUST be the well-known\n port associated with the redirect scheme. Specifically \"http\" to port 80\n and \"https\" to port 443. If the redirect scheme does not have a\n well-known port, the listener port of the Gateway SHOULD be used.\n* If redirect scheme is empty, the redirect port MUST be the Gateway\n Listener port.\n\nImplementations SHOULD NOT add the port number in the 'Location'\nheader in the following cases:\n\n* A Location header that will use HTTP (whether that is determined via\n the Listener protocol or the Scheme field) _and_ use port 80.\n* A Location header that will use HTTPS (whether that is determined via\n the Listener protocol or the Scheme field) _and_ use port 443.\n\nSupport: Extended", + format: "int32", + maximum: 65535, + minimum: 1, + type: "integer" + }, + scheme: { + description: "Scheme is the scheme to be used in the value of the `Location` header in\nthe response. When empty, the scheme of the request is used.\n\nScheme redirects can affect the port of the redirect, for more information,\nrefer to the documentation for the port field of this filter.\n\nNote that values may be added to this enum, implementations\nmust ensure that unknown values will not cause a crash.\n\nUnknown values here must result in the implementation setting the\nAccepted Condition for the Route to `status: False`, with a\nReason of `UnsupportedValue`.\n\nSupport: Extended", + enum: ["http", "https"], + type: "string" + }, + statusCode: { + default: 302, + description: "StatusCode is the HTTP status code to be used in response.\n\nNote that values may be added to this enum, implementations\nmust ensure that unknown values will not cause a crash.\n\nUnknown values here must result in the implementation setting the\nAccepted Condition for the Route to `status: False`, with a\nReason of `UnsupportedValue`.\n\nSupport: Core", + enum: [301, 302], + type: "integer" + } + }, + type: "object" + }, + responseHeaderModifier: { + description: "ResponseHeaderModifier defines a schema for a filter that modifies response\nheaders.\n\nSupport: Extended", + properties: { + add: { + description: "Add adds the given header(s) (name, value) to the request\nbefore the action. It appends to any existing values associated\nwith the header name.\n\nInput:\n GET /foo HTTP/1.1\n my-header: foo\n\nConfig:\n add:\n - name: \"my-header\"\n value: \"bar,baz\"\n\nOutput:\n GET /foo HTTP/1.1\n my-header: foo,bar,baz", + items: { + description: "HTTPHeader represents an HTTP Header name and value as defined by RFC 7230.", + properties: { + name: { + description: "Name is the name of the HTTP Header to be matched. Name matching MUST be\ncase insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).\n\nIf multiple entries specify equivalent header names, the first entry with\nan equivalent name MUST be considered for a match. Subsequent entries\nwith an equivalent header name MUST be ignored. Due to the\ncase-insensitivity of header names, \"foo\" and \"Foo\" are considered\nequivalent.", + maxLength: 256, + minLength: 1, + pattern: "^[A-Za-z0-9!#$%&'*+\\-.^_\\x60|~]+$", + type: "string" + }, + value: { + description: "Value is the value of HTTP Header to be matched.", + maxLength: 4096, + minLength: 1, + type: "string" + } + }, + required: ["name", "value"], + type: "object" + }, + maxItems: 16, + type: "array", + "x-kubernetes-list-map-keys": ["name"], + "x-kubernetes-list-type": "map" + }, + remove: { + description: "Remove the given header(s) from the HTTP request before the action. The\nvalue of Remove is a list of HTTP header names. Note that the header\nnames are case-insensitive (see\nhttps://datatracker.ietf.org/doc/html/rfc2616#section-4.2).\n\nInput:\n GET /foo HTTP/1.1\n my-header1: foo\n my-header2: bar\n my-header3: baz\n\nConfig:\n remove: [\"my-header1\", \"my-header3\"]\n\nOutput:\n GET /foo HTTP/1.1\n my-header2: bar", + items: { + type: "string" + }, + maxItems: 16, + type: "array", + "x-kubernetes-list-type": "set" + }, + set: { + description: "Set overwrites the request with the given header (name, value)\nbefore the action.\n\nInput:\n GET /foo HTTP/1.1\n my-header: foo\n\nConfig:\n set:\n - name: \"my-header\"\n value: \"bar\"\n\nOutput:\n GET /foo HTTP/1.1\n my-header: bar", + items: { + description: "HTTPHeader represents an HTTP Header name and value as defined by RFC 7230.", + properties: { + name: { + description: "Name is the name of the HTTP Header to be matched. Name matching MUST be\ncase insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).\n\nIf multiple entries specify equivalent header names, the first entry with\nan equivalent name MUST be considered for a match. Subsequent entries\nwith an equivalent header name MUST be ignored. Due to the\ncase-insensitivity of header names, \"foo\" and \"Foo\" are considered\nequivalent.", + maxLength: 256, + minLength: 1, + pattern: "^[A-Za-z0-9!#$%&'*+\\-.^_\\x60|~]+$", + type: "string" + }, + value: { + description: "Value is the value of HTTP Header to be matched.", + maxLength: 4096, + minLength: 1, + type: "string" + } + }, + required: ["name", "value"], + type: "object" + }, + maxItems: 16, + type: "array", + "x-kubernetes-list-map-keys": ["name"], + "x-kubernetes-list-type": "map" + } + }, + type: "object" + }, + type: { + description: "Type identifies the type of filter to apply. As with other API fields,\ntypes are classified into three conformance levels:\n\n- Core: Filter types and their corresponding configuration defined by\n \"Support: Core\" in this package, e.g. \"RequestHeaderModifier\". All\n implementations must support core filters.\n\n- Extended: Filter types and their corresponding configuration defined by\n \"Support: Extended\" in this package, e.g. \"RequestMirror\". Implementers\n are encouraged to support extended filters.\n\n- Implementation-specific: Filters that are defined and supported by\n specific vendors.\n In the future, filters showing convergence in behavior across multiple\n implementations will be considered for inclusion in extended or core\n conformance levels. Filter-specific configuration for such filters\n is specified using the ExtensionRef field. `Type` should be set to\n \"ExtensionRef\" for custom filters.\n\nImplementers are encouraged to define custom implementation types to\nextend the core API with implementation-specific behavior.\n\nIf a reference to a custom filter type cannot be resolved, the filter\nMUST NOT be skipped. Instead, requests that would have been processed by\nthat filter MUST receive a HTTP error response.\n\nNote that values may be added to this enum, implementations\nmust ensure that unknown values will not cause a crash.\n\nUnknown values here must result in the implementation setting the\nAccepted Condition for the Route to `status: False`, with a\nReason of `UnsupportedValue`.", + enum: ["RequestHeaderModifier", "ResponseHeaderModifier", "RequestMirror", "RequestRedirect", "URLRewrite", "ExtensionRef"], + type: "string" + }, + urlRewrite: { + description: "URLRewrite defines a schema for a filter that modifies a request during forwarding.\n\nSupport: Extended", + properties: { + hostname: { + description: "Hostname is the value to be used to replace the Host header value during\nforwarding.\n\nSupport: Extended", + maxLength: 253, + minLength: 1, + pattern: "^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$", + type: "string" + }, + path: { + description: "Path defines a path rewrite.\n\nSupport: Extended", + properties: { + replaceFullPath: { + description: "ReplaceFullPath specifies the value with which to replace the full path\nof a request during a rewrite or redirect.", + maxLength: 1024, + type: "string" + }, + replacePrefixMatch: { + description: "ReplacePrefixMatch specifies the value with which to replace the prefix\nmatch of a request during a rewrite or redirect. For example, a request\nto \"/foo/bar\" with a prefix match of \"/foo\" and a ReplacePrefixMatch\nof \"/xyz\" would be modified to \"/xyz/bar\".\n\nNote that this matches the behavior of the PathPrefix match type. This\nmatches full path elements. A path element refers to the list of labels\nin the path split by the `/` separator. When specified, a trailing `/` is\nignored. For example, the paths `/abc`, `/abc/`, and `/abc/def` would all\nmatch the prefix `/abc`, but the path `/abcd` would not.\n\nReplacePrefixMatch is only compatible with a `PathPrefix` HTTPRouteMatch.\nUsing any other HTTPRouteMatch type on the same HTTPRouteRule will result in\nthe implementation setting the Accepted Condition for the Route to `status: False`.\n\nRequest Path | Prefix Match | Replace Prefix | Modified Path", + maxLength: 1024, + type: "string" + }, + type: { + description: "Type defines the type of path modifier. Additional types may be\nadded in a future release of the API.\n\nNote that values may be added to this enum, implementations\nmust ensure that unknown values will not cause a crash.\n\nUnknown values here must result in the implementation setting the\nAccepted Condition for the Route to `status: False`, with a\nReason of `UnsupportedValue`.", + enum: ["ReplaceFullPath", "ReplacePrefixMatch"], + type: "string" + } + }, + required: ["type"], + type: "object", + "x-kubernetes-validations": [{ + message: "replaceFullPath must be specified when type is set to 'ReplaceFullPath'", + rule: "self.type == 'ReplaceFullPath' ? has(self.replaceFullPath) : true" + }, { + message: "type must be 'ReplaceFullPath' when replaceFullPath is set", + rule: "has(self.replaceFullPath) ? self.type == 'ReplaceFullPath' : true" + }, { + message: "replacePrefixMatch must be specified when type is set to 'ReplacePrefixMatch'", + rule: "self.type == 'ReplacePrefixMatch' ? has(self.replacePrefixMatch) : true" + }, { + message: "type must be 'ReplacePrefixMatch' when replacePrefixMatch is set", + rule: "has(self.replacePrefixMatch) ? self.type == 'ReplacePrefixMatch' : true" + }] + } + }, + type: "object" + } + }, + required: ["type"], + type: "object", + "x-kubernetes-validations": [{ + message: "filter.requestHeaderModifier must be nil if the filter.type is not RequestHeaderModifier", + rule: "!(has(self.requestHeaderModifier) && self.type != 'RequestHeaderModifier')" + }, { + message: "filter.requestHeaderModifier must be specified for RequestHeaderModifier filter.type", + rule: "!(!has(self.requestHeaderModifier) && self.type == 'RequestHeaderModifier')" + }, { + message: "filter.responseHeaderModifier must be nil if the filter.type is not ResponseHeaderModifier", + rule: "!(has(self.responseHeaderModifier) && self.type != 'ResponseHeaderModifier')" + }, { + message: "filter.responseHeaderModifier must be specified for ResponseHeaderModifier filter.type", + rule: "!(!has(self.responseHeaderModifier) && self.type == 'ResponseHeaderModifier')" + }, { + message: "filter.requestMirror must be nil if the filter.type is not RequestMirror", + rule: "!(has(self.requestMirror) && self.type != 'RequestMirror')" + }, { + message: "filter.requestMirror must be specified for RequestMirror filter.type", + rule: "!(!has(self.requestMirror) && self.type == 'RequestMirror')" + }, { + message: "filter.requestRedirect must be nil if the filter.type is not RequestRedirect", + rule: "!(has(self.requestRedirect) && self.type != 'RequestRedirect')" + }, { + message: "filter.requestRedirect must be specified for RequestRedirect filter.type", + rule: "!(!has(self.requestRedirect) && self.type == 'RequestRedirect')" + }, { + message: "filter.urlRewrite must be nil if the filter.type is not URLRewrite", + rule: "!(has(self.urlRewrite) && self.type != 'URLRewrite')" + }, { + message: "filter.urlRewrite must be specified for URLRewrite filter.type", + rule: "!(!has(self.urlRewrite) && self.type == 'URLRewrite')" + }, { + message: "filter.extensionRef must be nil if the filter.type is not ExtensionRef", + rule: "!(has(self.extensionRef) && self.type != 'ExtensionRef')" + }, { + message: "filter.extensionRef must be specified for ExtensionRef filter.type", + rule: "!(!has(self.extensionRef) && self.type == 'ExtensionRef')" + }] + }, + maxItems: 16, + type: "array", + "x-kubernetes-validations": [{ + message: "May specify either httpRouteFilterRequestRedirect or httpRouteFilterRequestRewrite, but not both", + rule: "!(self.exists(f, f.type == 'RequestRedirect') && self.exists(f, f.type == 'URLRewrite'))" + }, { + message: "RequestHeaderModifier filter cannot be repeated", + rule: "self.filter(f, f.type == 'RequestHeaderModifier').size() <= 1" + }, { + message: "ResponseHeaderModifier filter cannot be repeated", + rule: "self.filter(f, f.type == 'ResponseHeaderModifier').size() <= 1" + }, { + message: "RequestRedirect filter cannot be repeated", + rule: "self.filter(f, f.type == 'RequestRedirect').size() <= 1" + }, { + message: "URLRewrite filter cannot be repeated", + rule: "self.filter(f, f.type == 'URLRewrite').size() <= 1" + }] + }, + matches: { + default: [{ + path: { + type: "PathPrefix", + value: "/" + } + }], + description: "Matches define conditions used for matching the rule against incoming\nHTTP requests. Each match is independent, i.e. this rule will be matched\nif **any** one of the matches is satisfied.\n\nFor example, take the following matches configuration:\n\n```\nmatches:\n- path:\n value: \"/foo\"\n headers:\n - name: \"version\"\n value: \"v2\"\n- path:\n value: \"/v2/foo\"\n```\n\nFor a request to match against this rule, a request must satisfy\nEITHER of the two conditions:\n\n- path prefixed with `/foo` AND contains the header `version: v2`\n- path prefix of `/v2/foo`\n\nSee the documentation for HTTPRouteMatch on how to specify multiple\nmatch conditions that should be ANDed together.\n\nIf no matches are specified, the default is a prefix\npath match on \"/\", which has the effect of matching every\nHTTP request.\n\nProxy or Load Balancer routing configuration generated from HTTPRoutes\nMUST prioritize matches based on the following criteria, continuing on\nties. Across all rules specified on applicable Routes, precedence must be\ngiven to the match having:\n\n* \"Exact\" path match.\n* \"Prefix\" path match with largest number of characters.\n* Method match.\n* Largest number of header matches.\n* Largest number of query param matches.\n\nNote: The precedence of RegularExpression path matches are implementation-specific.\n\nIf ties still exist across multiple Routes, matching precedence MUST be\ndetermined in order of the following criteria, continuing on ties:\n\n* The oldest Route based on creation timestamp.\n* The Route appearing first in alphabetical order by\n \"{namespace}/{name}\".\n\nIf ties still exist within an HTTPRoute, matching precedence MUST be granted\nto the FIRST matching rule (in list order) with a match meeting the above\ncriteria.\n\nWhen no rules matching a request have been successfully attached to the\nparent a request is coming from, a HTTP 404 status code MUST be returned.", + items: { + description: "HTTPRouteMatch defines the predicate used to match requests to a given\naction. Multiple match types are ANDed together, i.e. the match will\nevaluate to true only if all conditions are satisfied.\n\nFor example, the match below will match a HTTP request only if its path\nstarts with `/foo` AND it contains the `version: v1` header:\n\n```\nmatch:\n\n\tpath:\n\t value: \"/foo\"\n\theaders:\n\t- name: \"version\"\n\t value \"v1\"\n\n```", + properties: { + headers: { + description: "Headers specifies HTTP request header matchers. Multiple match values are\nANDed together, meaning, a request must match all the specified headers\nto select the route.", + items: { + description: "HTTPHeaderMatch describes how to select a HTTP route by matching HTTP request\nheaders.", + properties: { + name: { + description: "Name is the name of the HTTP Header to be matched. Name matching MUST be\ncase insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).\n\nIf multiple entries specify equivalent header names, only the first\nentry with an equivalent name MUST be considered for a match. Subsequent\nentries with an equivalent header name MUST be ignored. Due to the\ncase-insensitivity of header names, \"foo\" and \"Foo\" are considered\nequivalent.\n\nWhen a header is repeated in an HTTP request, it is\nimplementation-specific behavior as to how this is represented.\nGenerally, proxies should follow the guidance from the RFC:\nhttps://www.rfc-editor.org/rfc/rfc7230.html#section-3.2.2 regarding\nprocessing a repeated header, with special handling for \"Set-Cookie\".", + maxLength: 256, + minLength: 1, + pattern: "^[A-Za-z0-9!#$%&'*+\\-.^_\\x60|~]+$", + type: "string" + }, + type: { + default: "Exact", + description: "Type specifies how to match against the value of the header.\n\nSupport: Core (Exact)\n\nSupport: Implementation-specific (RegularExpression)\n\nSince RegularExpression HeaderMatchType has implementation-specific\nconformance, implementations can support POSIX, PCRE or any other dialects\nof regular expressions. Please read the implementation's documentation to\ndetermine the supported dialect.", + enum: ["Exact", "RegularExpression"], + type: "string" + }, + value: { + description: "Value is the value of HTTP Header to be matched.", + maxLength: 4096, + minLength: 1, + type: "string" + } + }, + required: ["name", "value"], + type: "object" + }, + maxItems: 16, + type: "array", + "x-kubernetes-list-map-keys": ["name"], + "x-kubernetes-list-type": "map" + }, + method: { + description: "Method specifies HTTP method matcher.\nWhen specified, this route will be matched only if the request has the\nspecified method.\n\nSupport: Extended", + enum: ["GET", "HEAD", "POST", "PUT", "DELETE", "CONNECT", "OPTIONS", "TRACE", "PATCH"], + type: "string" + }, + path: { + default: { + type: "PathPrefix", + value: "/" + }, + description: "Path specifies a HTTP request path matcher. If this field is not\nspecified, a default prefix match on the \"/\" path is provided.", + properties: { + type: { + default: "PathPrefix", + description: "Type specifies how to match against the path Value.\n\nSupport: Core (Exact, PathPrefix)\n\nSupport: Implementation-specific (RegularExpression)", + enum: ["Exact", "PathPrefix", "RegularExpression"], + type: "string" + }, + value: { + default: "/", + description: "Value of the HTTP path to match against.", + maxLength: 1024, + type: "string" + } + }, + type: "object", + "x-kubernetes-validations": [{ + message: "value must be an absolute path and start with '/' when type one of ['Exact', 'PathPrefix']", + rule: "(self.type in ['Exact','PathPrefix']) ? self.value.startsWith('/') : true" + }, { + message: "must not contain '//' when type one of ['Exact', 'PathPrefix']", + rule: "(self.type in ['Exact','PathPrefix']) ? !self.value.contains('//') : true" + }, { + message: "must not contain '/./' when type one of ['Exact', 'PathPrefix']", + rule: "(self.type in ['Exact','PathPrefix']) ? !self.value.contains('/./') : true" + }, { + message: "must not contain '/../' when type one of ['Exact', 'PathPrefix']", + rule: "(self.type in ['Exact','PathPrefix']) ? !self.value.contains('/../') : true" + }, { + message: "must not contain '%2f' when type one of ['Exact', 'PathPrefix']", + rule: "(self.type in ['Exact','PathPrefix']) ? !self.value.contains('%2f') : true" + }, { + message: "must not contain '%2F' when type one of ['Exact', 'PathPrefix']", + rule: "(self.type in ['Exact','PathPrefix']) ? !self.value.contains('%2F') : true" + }, { + message: "must not contain '#' when type one of ['Exact', 'PathPrefix']", + rule: "(self.type in ['Exact','PathPrefix']) ? !self.value.contains('#') : true" + }, { + message: "must not end with '/..' when type one of ['Exact', 'PathPrefix']", + rule: "(self.type in ['Exact','PathPrefix']) ? !self.value.endsWith('/..') : true" + }, { + message: "must not end with '/.' when type one of ['Exact', 'PathPrefix']", + rule: "(self.type in ['Exact','PathPrefix']) ? !self.value.endsWith('/.') : true" + }, { + message: "type must be one of ['Exact', 'PathPrefix', 'RegularExpression']", + rule: "self.type in ['Exact','PathPrefix'] || self.type == 'RegularExpression'" + }, { + message: "must only contain valid characters (matching ^(?:[-A-Za-z0-9/._~!$&'()*+,;=:@]|[%][0-9a-fA-F]{2})+$) for types ['Exact', 'PathPrefix']", + rule: "(self.type in ['Exact','PathPrefix']) ? self.value.matches(r\"\"\"^(?:[-A-Za-z0-9/._~!$&'()*+,;=:@]|[%][0-9a-fA-F]{2})+$\"\"\") : true" + }] + }, + queryParams: { + description: "QueryParams specifies HTTP query parameter matchers. Multiple match\nvalues are ANDed together, meaning, a request must match all the\nspecified query parameters to select the route.\n\nSupport: Extended", + items: { + description: "HTTPQueryParamMatch describes how to select a HTTP route by matching HTTP\nquery parameters.", + properties: { + name: { + description: "Name is the name of the HTTP query param to be matched. This must be an\nexact string match. (See\nhttps://tools.ietf.org/html/rfc7230#section-2.7.3).\n\nIf multiple entries specify equivalent query param names, only the first\nentry with an equivalent name MUST be considered for a match. Subsequent\nentries with an equivalent query param name MUST be ignored.\n\nIf a query param is repeated in an HTTP request, the behavior is\npurposely left undefined, since different data planes have different\ncapabilities. However, it is *recommended* that implementations should\nmatch against the first value of the param if the data plane supports it,\nas this behavior is expected in other load balancing contexts outside of\nthe Gateway API.\n\nUsers SHOULD NOT route traffic based on repeated query params to guard\nthemselves against potential differences in the implementations.", + maxLength: 256, + minLength: 1, + pattern: "^[A-Za-z0-9!#$%&'*+\\-.^_\\x60|~]+$", + type: "string" + }, + type: { + default: "Exact", + description: "Type specifies how to match against the value of the query parameter.\n\nSupport: Extended (Exact)\n\nSupport: Implementation-specific (RegularExpression)\n\nSince RegularExpression QueryParamMatchType has Implementation-specific\nconformance, implementations can support POSIX, PCRE or any other\ndialects of regular expressions. Please read the implementation's\ndocumentation to determine the supported dialect.", + enum: ["Exact", "RegularExpression"], + type: "string" + }, + value: { + description: "Value is the value of HTTP query param to be matched.", + maxLength: 1024, + minLength: 1, + type: "string" + } + }, + required: ["name", "value"], + type: "object" + }, + maxItems: 16, + type: "array", + "x-kubernetes-list-map-keys": ["name"], + "x-kubernetes-list-type": "map" + } + }, + type: "object" + }, + maxItems: 64, + type: "array" + }, + timeouts: { + description: "Timeouts defines the timeouts that can be configured for an HTTP request.\n\nSupport: Extended", + properties: { + backendRequest: { + description: "BackendRequest specifies a timeout for an individual request from the gateway\nto a backend. This covers the time from when the request first starts being\nsent from the gateway to when the full response has been received from the backend.\n\nSetting a timeout to the zero duration (e.g. \"0s\") SHOULD disable the timeout\ncompletely. Implementations that cannot completely disable the timeout MUST\ninstead interpret the zero duration as the longest possible value to which\nthe timeout can be set.\n\nAn entire client HTTP transaction with a gateway, covered by the Request timeout,\nmay result in more than one call from the gateway to the destination backend,\nfor example, if automatic retries are supported.\n\nThe value of BackendRequest must be a Gateway API Duration string as defined by\nGEP-2257. When this field is unspecified, its behavior is implementation-specific;\nwhen specified, the value of BackendRequest must be no more than the value of the\nRequest timeout (since the Request timeout encompasses the BackendRequest timeout).\n\nSupport: Extended", + pattern: "^([0-9]{1,5}(h|m|s|ms)){1,4}$", + type: "string" + }, + request: { + description: "Request specifies the maximum duration for a gateway to respond to an HTTP request.\nIf the gateway has not been able to respond before this deadline is met, the gateway\nMUST return a timeout error.\n\nFor example, setting the `rules.timeouts.request` field to the value `10s` in an\n`HTTPRoute` will cause a timeout if a client request is taking longer than 10 seconds\nto complete.\n\nSetting a timeout to the zero duration (e.g. \"0s\") SHOULD disable the timeout\ncompletely. Implementations that cannot completely disable the timeout MUST\ninstead interpret the zero duration as the longest possible value to which\nthe timeout can be set.\n\nThis timeout is intended to cover as close to the whole request-response transaction\nas possible although an implementation MAY choose to start the timeout after the entire\nrequest stream has been received instead of immediately after the transaction is\ninitiated by the client.\n\nThe value of Request is a Gateway API Duration string as defined by GEP-2257. When this\nfield is unspecified, request timeout behavior is implementation-specific.\n\nSupport: Extended", + pattern: "^([0-9]{1,5}(h|m|s|ms)){1,4}$", + type: "string" + } + }, + type: "object", + "x-kubernetes-validations": [{ + message: "backendRequest timeout cannot be longer than request timeout", + rule: "!(has(self.request) && has(self.backendRequest) && duration(self.request) != duration('0s') && duration(self.backendRequest) > duration(self.request))" + }] + } + }, + type: "object", + "x-kubernetes-validations": [{ + message: "RequestRedirect filter must not be used together with backendRefs", + rule: "(has(self.backendRefs) && size(self.backendRefs) > 0) ? (!has(self.filters) || self.filters.all(f, !has(f.requestRedirect))): true" + }, { + message: "When using RequestRedirect filter with path.replacePrefixMatch, exactly one PathPrefix match must be specified", + rule: "(has(self.filters) && self.filters.exists_one(f, has(f.requestRedirect) && has(f.requestRedirect.path) && f.requestRedirect.path.type == 'ReplacePrefixMatch' && has(f.requestRedirect.path.replacePrefixMatch))) ? ((size(self.matches) != 1 || !has(self.matches[0].path) || self.matches[0].path.type != 'PathPrefix') ? false : true) : true" + }, { + message: "When using URLRewrite filter with path.replacePrefixMatch, exactly one PathPrefix match must be specified", + rule: "(has(self.filters) && self.filters.exists_one(f, has(f.urlRewrite) && has(f.urlRewrite.path) && f.urlRewrite.path.type == 'ReplacePrefixMatch' && has(f.urlRewrite.path.replacePrefixMatch))) ? ((size(self.matches) != 1 || !has(self.matches[0].path) || self.matches[0].path.type != 'PathPrefix') ? false : true) : true" + }, { + message: "Within backendRefs, when using RequestRedirect filter with path.replacePrefixMatch, exactly one PathPrefix match must be specified", + rule: "(has(self.backendRefs) && self.backendRefs.exists_one(b, (has(b.filters) && b.filters.exists_one(f, has(f.requestRedirect) && has(f.requestRedirect.path) && f.requestRedirect.path.type == 'ReplacePrefixMatch' && has(f.requestRedirect.path.replacePrefixMatch))) )) ? ((size(self.matches) != 1 || !has(self.matches[0].path) || self.matches[0].path.type != 'PathPrefix') ? false : true) : true" + }, { + message: "Within backendRefs, When using URLRewrite filter with path.replacePrefixMatch, exactly one PathPrefix match must be specified", + rule: "(has(self.backendRefs) && self.backendRefs.exists_one(b, (has(b.filters) && b.filters.exists_one(f, has(f.urlRewrite) && has(f.urlRewrite.path) && f.urlRewrite.path.type == 'ReplacePrefixMatch' && has(f.urlRewrite.path.replacePrefixMatch))) )) ? ((size(self.matches) != 1 || !has(self.matches[0].path) || self.matches[0].path.type != 'PathPrefix') ? false : true) : true" + }] + }, + maxItems: 16, + type: "array", + "x-kubernetes-validations": [{ + message: "While 16 rules and 64 matches per rule are allowed, the total number of matches across all rules in a route must be less than 128", + rule: "(self.size() > 0 ? self[0].matches.size() : 0) + (self.size() > 1 ? self[1].matches.size() : 0) + (self.size() > 2 ? self[2].matches.size() : 0) + (self.size() > 3 ? self[3].matches.size() : 0) + (self.size() > 4 ? self[4].matches.size() : 0) + (self.size() > 5 ? self[5].matches.size() : 0) + (self.size() > 6 ? self[6].matches.size() : 0) + (self.size() > 7 ? self[7].matches.size() : 0) + (self.size() > 8 ? self[8].matches.size() : 0) + (self.size() > 9 ? self[9].matches.size() : 0) + (self.size() > 10 ? self[10].matches.size() : 0) + (self.size() > 11 ? self[11].matches.size() : 0) + (self.size() > 12 ? self[12].matches.size() : 0) + (self.size() > 13 ? self[13].matches.size() : 0) + (self.size() > 14 ? self[14].matches.size() : 0) + (self.size() > 15 ? self[15].matches.size() : 0) <= 128" + }] + } + }, + type: "object" + }, + status: { + description: "Status defines the current state of HTTPRoute.", + properties: { + parents: { + description: "Parents is a list of parent resources (usually Gateways) that are\nassociated with the route, and the status of the route with respect to\neach parent. When this route attaches to a parent, the controller that\nmanages the parent must add an entry to this list when the controller\nfirst sees the route and should update the entry as appropriate when the\nroute or gateway is modified.\n\nNote that parent references that cannot be resolved by an implementation\nof this API will not be added to this list. Implementations of this API\ncan only populate Route status for the Gateways/parent resources they are\nresponsible for.\n\nA maximum of 32 Gateways will be represented in this list. An empty list\nmeans the route has not been attached to any Gateway.", + items: { + description: "RouteParentStatus describes the status of a route with respect to an\nassociated Parent.", + properties: { + conditions: { + description: "Conditions describes the status of the route with respect to the Gateway.\nNote that the route's availability is also subject to the Gateway's own\nstatus conditions and listener status.\n\nIf the Route's ParentRef specifies an existing Gateway that supports\nRoutes of this kind AND that Gateway's controller has sufficient access,\nthen that Gateway's controller MUST set the \"Accepted\" condition on the\nRoute, to indicate whether the route has been accepted or rejected by the\nGateway, and why.\n\nA Route MUST be considered \"Accepted\" if at least one of the Route's\nrules is implemented by the Gateway.\n\nThere are a number of cases where the \"Accepted\" condition may not be set\ndue to lack of controller visibility, that includes when:\n\n* The Route refers to a non-existent parent.\n* The Route is of a type that the controller does not support.\n* The Route is in a namespace the controller does not have access to.", + items: { + description: "Condition contains details for one aspect of the current state of this API Resource.", + properties: { + lastTransitionTime: { + description: "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.", + format: "date-time", + type: "string" + }, + message: { + description: "message is a human readable message indicating details about the transition.\nThis may be an empty string.", + maxLength: 32768, + type: "string" + }, + observedGeneration: { + description: "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.", + format: "int64", + minimum: 0, + type: "integer" + }, + reason: { + description: "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.", + maxLength: 1024, + minLength: 1, + pattern: "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$", + type: "string" + }, + status: { + description: "status of the condition, one of True, False, Unknown.", + enum: ["True", "False", "Unknown"], + type: "string" + }, + type: { + description: "type of condition in CamelCase or in foo.example.com/CamelCase.", + maxLength: 316, + pattern: "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$", + type: "string" + } + }, + required: ["lastTransitionTime", "message", "reason", "status", "type"], + type: "object" + }, + maxItems: 8, + minItems: 1, + type: "array", + "x-kubernetes-list-map-keys": ["type"], + "x-kubernetes-list-type": "map" + }, + controllerName: { + description: "ControllerName is a domain/path string that indicates the name of the\ncontroller that wrote this status. This corresponds with the\ncontrollerName field on GatewayClass.\n\nExample: \"example.net/gateway-controller\".\n\nThe format of this field is DOMAIN \"/\" PATH, where DOMAIN and PATH are\nvalid Kubernetes names\n(https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names).\n\nControllers MUST populate this field when writing status. Controllers should ensure that\nentries to status populated with their ControllerName are cleaned up when they are no\nlonger necessary.", + maxLength: 253, + minLength: 1, + pattern: "^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\\/[A-Za-z0-9\\/\\-._~%!$&'()*+,;=:]+$", + type: "string" + }, + parentRef: { + description: "ParentRef corresponds with a ParentRef in the spec that this\nRouteParentStatus struct describes the status of.", + properties: { + group: { + default: "gateway.networking.k8s.io", + description: "Group is the group of the referent.\nWhen unspecified, \"gateway.networking.k8s.io\" is inferred.\nTo set the core API group (such as for a \"Service\" kind referent),\nGroup must be explicitly set to \"\" (empty string).\n\nSupport: Core", + maxLength: 253, + pattern: "^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$", + type: "string" + }, + kind: { + default: "Gateway", + description: "Kind is kind of the referent.\n\nThere are two kinds of parent resources with \"Core\" support:\n\n* Gateway (Gateway conformance profile)\n* Service (Mesh conformance profile, ClusterIP Services only)\n\nSupport for other resources is Implementation-Specific.", + maxLength: 63, + minLength: 1, + pattern: "^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$", + type: "string" + }, + name: { + description: "Name is the name of the referent.\n\nSupport: Core", + maxLength: 253, + minLength: 1, + type: "string" + }, + namespace: { + description: "Namespace is the namespace of the referent. When unspecified, this refers\nto the local namespace of the Route.\n\nNote that there are specific rules for ParentRefs which cross namespace\nboundaries. Cross-namespace references are only valid if they are explicitly\nallowed by something in the namespace they are referring to. For example:\nGateway has the AllowedRoutes field, and ReferenceGrant provides a\ngeneric way to enable any other kind of cross-namespace reference.\n\n\n\nSupport: Core", + maxLength: 63, + minLength: 1, + pattern: "^[a-z0-9]([-a-z0-9]*[a-z0-9])?$", + type: "string" + }, + port: { + description: "Port is the network port this Route targets. It can be interpreted\ndifferently based on the type of parent resource.\n\nWhen the parent resource is a Gateway, this targets all listeners\nlistening on the specified port that also support this kind of Route(and\nselect this Route). It's not recommended to set `Port` unless the\nnetworking behaviors specified in a Route must apply to a specific port\nas opposed to a listener(s) whose port(s) may be changed. When both Port\nand SectionName are specified, the name and port of the selected listener\nmust match both specified values.\n\n\n\nImplementations MAY choose to support other parent resources.\nImplementations supporting other types of parent resources MUST clearly\ndocument how/if Port is interpreted.\n\nFor the purpose of status, an attachment is considered successful as\nlong as the parent resource accepts it partially. For example, Gateway\nlisteners can restrict which Routes can attach to them by Route kind,\nnamespace, or hostname. If 1 of 2 Gateway listeners accept attachment\nfrom the referencing Route, the Route MUST be considered successfully\nattached. If no Gateway listeners accept attachment from this Route,\nthe Route MUST be considered detached from the Gateway.\n\nSupport: Extended", + format: "int32", + maximum: 65535, + minimum: 1, + type: "integer" + }, + sectionName: { + description: "SectionName is the name of a section within the target resource. In the\nfollowing resources, SectionName is interpreted as the following:\n\n* Gateway: Listener name. When both Port (experimental) and SectionName\nare specified, the name and port of the selected listener must match\nboth specified values.\n* Service: Port name. When both Port (experimental) and SectionName\nare specified, the name and port of the selected listener must match\nboth specified values.\n\nImplementations MAY choose to support attaching Routes to other resources.\nIf that is the case, they MUST clearly document how SectionName is\ninterpreted.\n\nWhen unspecified (empty string), this will reference the entire resource.\nFor the purpose of status, an attachment is considered successful if at\nleast one section in the parent resource accepts it. For example, Gateway\nlisteners can restrict which Routes can attach to them by Route kind,\nnamespace, or hostname. If 1 of 2 Gateway listeners accept attachment from\nthe referencing Route, the Route MUST be considered successfully\nattached. If no Gateway listeners accept attachment from this Route, the\nRoute MUST be considered detached from the Gateway.\n\nSupport: Core", + maxLength: 253, + minLength: 1, + pattern: "^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$", + type: "string" + } + }, + required: ["name"], + type: "object" + } + }, + required: ["controllerName", "parentRef"], + type: "object" + }, + maxItems: 32, + type: "array" + } + }, + required: ["parents"], + type: "object" + } + }, + required: ["spec"], + type: "object" + } + }, + served: true, + storage: false, + subresources: { + status: {} + } + }] + }, + status: { + acceptedNames: { + kind: "", + plural: "" + }, + conditions: null, + storedVersions: null + } +}; +export const CustomResourceDefinition_ReferencegrantsGatewayNetworkingK8sIo: KubernetesResource = { + apiVersion: "apiextensions.k8s.io/v1", + kind: "CustomResourceDefinition", + metadata: { + annotations: { + "api-approved.kubernetes.io": "https://github.com/kubernetes-sigs/gateway-api/pull/3328", + "gateway.networking.k8s.io/bundle-version": "v1.2.1", + "gateway.networking.k8s.io/channel": "standard" + }, + creationTimestamp: null, + name: "referencegrants.gateway.networking.k8s.io" + }, + spec: { + group: "gateway.networking.k8s.io", + names: { + categories: ["gateway-api"], + kind: "ReferenceGrant", + listKind: "ReferenceGrantList", + plural: "referencegrants", + shortNames: ["refgrant"], + singular: "referencegrant" + }, + scope: "Namespaced", + versions: [{ + additionalPrinterColumns: [{ + jsonPath: ".metadata.creationTimestamp", + name: "Age", + type: "date" + }], + name: "v1beta1", + schema: { + openAPIV3Schema: { + description: "ReferenceGrant identifies kinds of resources in other namespaces that are\ntrusted to reference the specified kinds of resources in the same namespace\nas the policy.\n\nEach ReferenceGrant can be used to represent a unique trust relationship.\nAdditional Reference Grants can be used to add to the set of trusted\nsources of inbound references for the namespace they are defined within.\n\nAll cross-namespace references in Gateway API (with the exception of cross-namespace\nGateway-route attachment) require a ReferenceGrant.\n\nReferenceGrant is a form of runtime verification allowing users to assert\nwhich cross-namespace object references are permitted. Implementations that\nsupport ReferenceGrant MUST NOT permit cross-namespace references which have\nno grant, and MUST respond to the removal of a grant by revoking the access\nthat the grant allowed.", + properties: { + apiVersion: { + description: "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", + type: "string" + }, + kind: { + description: "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + type: "string" + }, + metadata: { + type: "object" + }, + spec: { + description: "Spec defines the desired state of ReferenceGrant.", + properties: { + from: { + description: "From describes the trusted namespaces and kinds that can reference the\nresources described in \"To\". Each entry in this list MUST be considered\nto be an additional place that references can be valid from, or to put\nthis another way, entries MUST be combined using OR.\n\nSupport: Core", + items: { + description: "ReferenceGrantFrom describes trusted namespaces and kinds.", + properties: { + group: { + description: "Group is the group of the referent.\nWhen empty, the Kubernetes core API group is inferred.\n\nSupport: Core", + maxLength: 253, + pattern: "^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$", + type: "string" + }, + kind: { + description: "Kind is the kind of the referent. Although implementations may support\nadditional resources, the following types are part of the \"Core\"\nsupport level for this field.\n\nWhen used to permit a SecretObjectReference:\n\n* Gateway\n\nWhen used to permit a BackendObjectReference:\n\n* GRPCRoute\n* HTTPRoute\n* TCPRoute\n* TLSRoute\n* UDPRoute", + maxLength: 63, + minLength: 1, + pattern: "^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$", + type: "string" + }, + namespace: { + description: "Namespace is the namespace of the referent.\n\nSupport: Core", + maxLength: 63, + minLength: 1, + pattern: "^[a-z0-9]([-a-z0-9]*[a-z0-9])?$", + type: "string" + } + }, + required: ["group", "kind", "namespace"], + type: "object" + }, + maxItems: 16, + minItems: 1, + type: "array" + }, + to: { + description: "To describes the resources that may be referenced by the resources\ndescribed in \"From\". Each entry in this list MUST be considered to be an\nadditional place that references can be valid to, or to put this another\nway, entries MUST be combined using OR.\n\nSupport: Core", + items: { + description: "ReferenceGrantTo describes what Kinds are allowed as targets of the\nreferences.", + properties: { + group: { + description: "Group is the group of the referent.\nWhen empty, the Kubernetes core API group is inferred.\n\nSupport: Core", + maxLength: 253, + pattern: "^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$", + type: "string" + }, + kind: { + description: "Kind is the kind of the referent. Although implementations may support\nadditional resources, the following types are part of the \"Core\"\nsupport level for this field:\n\n* Secret when used to permit a SecretObjectReference\n* Service when used to permit a BackendObjectReference", + maxLength: 63, + minLength: 1, + pattern: "^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$", + type: "string" + }, + name: { + description: "Name is the name of the referent. When unspecified, this policy\nrefers to all resources of the specified Group and Kind in the local\nnamespace.", + maxLength: 253, + minLength: 1, + type: "string" + } + }, + required: ["group", "kind"], + type: "object" + }, + maxItems: 16, + minItems: 1, + type: "array" + } + }, + required: ["from", "to"], + type: "object" + } + }, + type: "object" + } + }, + served: true, + storage: true, + subresources: {} + }] + }, + status: { + acceptedNames: { + kind: "", + plural: "" + }, + conditions: null, + storedVersions: null + } +}; +export const CustomResourceDefinition_AccesscontrolpoliciesHubTraefikIo: KubernetesResource = { + apiVersion: "apiextensions.k8s.io/v1", + kind: "CustomResourceDefinition", + metadata: { + annotations: { + "controller-gen.kubebuilder.io/version": "v0.17.1" + }, + name: "accesscontrolpolicies.hub.traefik.io" + }, + spec: { + group: "hub.traefik.io", + names: { + kind: "AccessControlPolicy", + listKind: "AccessControlPolicyList", + plural: "accesscontrolpolicies", + singular: "accesscontrolpolicy" + }, + scope: "Cluster", + versions: [{ + name: "v1alpha1", + schema: { + openAPIV3Schema: { + description: "AccessControlPolicy defines an access control policy.", + properties: { + apiVersion: { + description: "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", + type: "string" + }, + kind: { + description: "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + type: "string" + }, + metadata: { + type: "object" + }, + spec: { + description: "AccessControlPolicySpec configures an access control policy.", + properties: { + apiKey: { + description: "AccessControlPolicyAPIKey configure an APIKey control policy.", + properties: { + forwardHeaders: { + additionalProperties: { + type: "string" + }, + description: "ForwardHeaders instructs the middleware to forward key metadata as header values upon successful authentication.", + type: "object" + }, + keys: { + description: "Keys define the set of authorized keys to access a protected resource.", + items: { + description: "AccessControlPolicyAPIKeyKey defines an API key.", + properties: { + id: { + description: "ID is the unique identifier of the key.", + type: "string" + }, + metadata: { + additionalProperties: { + type: "string" + }, + description: "Metadata holds arbitrary metadata for this key, can be used by ForwardHeaders.", + type: "object" + }, + value: { + description: "Value is the SHAKE-256 hash (using 64 bytes) of the API key.", + type: "string" + } + }, + required: ["id", "value"], + type: "object" + }, + type: "array" + }, + keySource: { + description: "KeySource defines how to extract API keys from requests.", + properties: { + cookie: { + description: "Cookie is the name of a cookie.", + type: "string" + }, + header: { + description: "Header is the name of a header.", + type: "string" + }, + headerAuthScheme: { + description: "HeaderAuthScheme sets an optional auth scheme when Header is set to \"Authorization\".\nIf set, this scheme is removed from the token, and all requests not including it are dropped.", + type: "string" + }, + query: { + description: "Query is the name of a query parameter.", + type: "string" + } + }, + type: "object" + } + }, + required: ["keySource"], + type: "object" + }, + basicAuth: { + description: "AccessControlPolicyBasicAuth holds the HTTP basic authentication configuration.", + properties: { + forwardUsernameHeader: { + type: "string" + }, + realm: { + type: "string" + }, + stripAuthorizationHeader: { + type: "boolean" + }, + users: { + items: { + type: "string" + }, + type: "array" + } + }, + type: "object" + }, + jwt: { + description: "AccessControlPolicyJWT configures a JWT access control policy.", + properties: { + claims: { + type: "string" + }, + forwardHeaders: { + additionalProperties: { + type: "string" + }, + type: "object" + }, + jwksFile: { + type: "string" + }, + jwksUrl: { + type: "string" + }, + publicKey: { + type: "string" + }, + signingSecret: { + type: "string" + }, + signingSecretBase64Encoded: { + type: "boolean" + }, + stripAuthorizationHeader: { + type: "boolean" + }, + tokenQueryKey: { + type: "string" + } + }, + type: "object" + }, + oAuthIntro: { + description: "AccessControlOAuthIntro configures an OAuth 2.0 Token Introspection access control policy.", + properties: { + claims: { + type: "string" + }, + clientConfig: { + description: "AccessControlOAuthIntroClientConfig configures the OAuth 2.0 client for issuing token introspection requests.", + properties: { + headers: { + additionalProperties: { + type: "string" + }, + description: "Headers to set when sending requests to the Authorization Server.", + type: "object" + }, + maxRetries: { + default: 3, + description: "MaxRetries defines the number of retries for introspection requests.", + type: "integer" + }, + timeoutSeconds: { + default: 5, + description: "TimeoutSeconds configures the maximum amount of seconds to wait before giving up on requests.", + type: "integer" + }, + tls: { + description: "TLS configures TLS communication with the Authorization Server.", + properties: { + ca: { + description: "CA sets the CA bundle used to sign the Authorization Server certificate.", + type: "string" + }, + insecureSkipVerify: { + description: "InsecureSkipVerify skips the Authorization Server certificate validation.\nFor testing purposes only, do not use in production.", + type: "boolean" + } + }, + type: "object" + }, + tokenTypeHint: { + description: "TokenTypeHint is a hint to pass to the Authorization Server.\nSee https://tools.ietf.org/html/rfc7662#section-2.1 for more information.", + type: "string" + }, + url: { + description: "URL of the Authorization Server.", + type: "string" + } + }, + required: ["url"], + type: "object" + }, + forwardHeaders: { + additionalProperties: { + type: "string" + }, + type: "object" + }, + tokenSource: { + description: "TokenSource describes how to extract tokens from HTTP requests.\nIf multiple sources are set, the order is the following: header > query > cookie.", + properties: { + cookie: { + description: "Cookie is the name of a cookie.", + type: "string" + }, + header: { + description: "Header is the name of a header.", + type: "string" + }, + headerAuthScheme: { + description: "HeaderAuthScheme sets an optional auth scheme when Header is set to \"Authorization\".\nIf set, this scheme is removed from the token, and all requests not including it are dropped.", + type: "string" + }, + query: { + description: "Query is the name of a query parameter.", + type: "string" + } + }, + type: "object" + } + }, + required: ["clientConfig", "tokenSource"], + type: "object" + }, + oidc: { + description: "AccessControlPolicyOIDC holds the OIDC authentication configuration.", + properties: { + authParams: { + additionalProperties: { + type: "string" + }, + type: "object" + }, + claims: { + type: "string" + }, + clientId: { + type: "string" + }, + disableAuthRedirectionPaths: { + items: { + type: "string" + }, + type: "array" + }, + forwardHeaders: { + additionalProperties: { + type: "string" + }, + type: "object" + }, + issuer: { + type: "string" + }, + logoutUrl: { + type: "string" + }, + redirectUrl: { + type: "string" + }, + scopes: { + items: { + type: "string" + }, + type: "array" + }, + secret: { + description: "SecretReference represents a Secret Reference. It has enough information to retrieve secret\nin any namespace", + properties: { + name: { + description: "name is unique within a namespace to reference a secret resource.", + type: "string" + }, + namespace: { + description: "namespace defines the space within which the secret name must be unique.", + type: "string" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + session: { + description: "Session holds session configuration.", + properties: { + domain: { + type: "string" + }, + path: { + type: "string" + }, + refresh: { + type: "boolean" + }, + sameSite: { + type: "string" + }, + secure: { + type: "boolean" + } + }, + type: "object" + }, + stateCookie: { + description: "StateCookie holds state cookie configuration.", + properties: { + domain: { + type: "string" + }, + path: { + type: "string" + }, + sameSite: { + type: "string" + }, + secure: { + type: "boolean" + } + }, + type: "object" + } + }, + type: "object" + }, + oidcGoogle: { + description: "AccessControlPolicyOIDCGoogle holds the Google OIDC authentication configuration.", + properties: { + authParams: { + additionalProperties: { + type: "string" + }, + type: "object" + }, + clientId: { + type: "string" + }, + emails: { + description: "Emails are the allowed emails to connect.", + items: { + type: "string" + }, + minItems: 1, + type: "array" + }, + forwardHeaders: { + additionalProperties: { + type: "string" + }, + type: "object" + }, + logoutUrl: { + type: "string" + }, + redirectUrl: { + type: "string" + }, + secret: { + description: "SecretReference represents a Secret Reference. It has enough information to retrieve secret\nin any namespace", + properties: { + name: { + description: "name is unique within a namespace to reference a secret resource.", + type: "string" + }, + namespace: { + description: "namespace defines the space within which the secret name must be unique.", + type: "string" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + session: { + description: "Session holds session configuration.", + properties: { + domain: { + type: "string" + }, + path: { + type: "string" + }, + refresh: { + type: "boolean" + }, + sameSite: { + type: "string" + }, + secure: { + type: "boolean" + } + }, + type: "object" + }, + stateCookie: { + description: "StateCookie holds state cookie configuration.", + properties: { + domain: { + type: "string" + }, + path: { + type: "string" + }, + sameSite: { + type: "string" + }, + secure: { + type: "boolean" + } + }, + type: "object" + } + }, + type: "object" + } + }, + type: "object" + }, + status: { + description: "The current status of this access control policy.", + properties: { + specHash: { + type: "string" + }, + syncedAt: { + format: "date-time", + type: "string" + }, + version: { + type: "string" + } + }, + type: "object" + } + }, + type: "object" + } + }, + served: true, + storage: true + }] + } +}; +export const CustomResourceDefinition_AiservicesHubTraefikIo: KubernetesResource = { + apiVersion: "apiextensions.k8s.io/v1", + kind: "CustomResourceDefinition", + metadata: { + annotations: { + "controller-gen.kubebuilder.io/version": "v0.17.1" + }, + name: "aiservices.hub.traefik.io" + }, + spec: { + group: "hub.traefik.io", + names: { + kind: "AIService", + listKind: "AIServiceList", + plural: "aiservices", + singular: "aiservice" + }, + scope: "Namespaced", + versions: [{ + name: "v1alpha1", + schema: { + openAPIV3Schema: { + description: "AIService is a Kubernetes-like Service to interact with a text-based LLM provider. It defines the parameters and credentials required to interact with various LLM providers.", + properties: { + apiVersion: { + description: "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", + type: "string" + }, + kind: { + description: "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + type: "string" + }, + metadata: { + type: "object" + }, + spec: { + description: "The desired behavior of this AIService.", + properties: { + anthropic: { + description: "Anthropic configures Anthropic backend.", + properties: { + model: { + type: "string" + }, + params: { + description: "Params holds the LLM hyperparameters.", + properties: { + frequencyPenalty: { + type: "number" + }, + maxTokens: { + type: "integer" + }, + presencePenalty: { + type: "number" + }, + temperature: { + type: "number" + }, + topP: { + type: "number" + } + }, + type: "object" + }, + token: { + type: "string" + } + }, + required: ["token"], + type: "object" + }, + azureOpenai: { + description: "AzureOpenAI configures AzureOpenAI.", + properties: { + apiKey: { + type: "string" + }, + baseUrl: { + type: "string" + }, + deploymentName: { + type: "string" + }, + model: { + type: "string" + }, + params: { + description: "Params holds the LLM hyperparameters.", + properties: { + frequencyPenalty: { + type: "number" + }, + maxTokens: { + type: "integer" + }, + presencePenalty: { + type: "number" + }, + temperature: { + type: "number" + }, + topP: { + type: "number" + } + }, + type: "object" + } + }, + required: ["apiKey", "baseUrl", "deploymentName"], + type: "object" + }, + bedrock: { + description: "Bedrock configures Bedrock backend.", + properties: { + model: { + type: "string" + }, + params: { + description: "Params holds the LLM hyperparameters.", + properties: { + frequencyPenalty: { + type: "number" + }, + maxTokens: { + type: "integer" + }, + presencePenalty: { + type: "number" + }, + temperature: { + type: "number" + }, + topP: { + type: "number" + } + }, + type: "object" + }, + region: { + type: "string" + }, + systemMessage: { + type: "boolean" + } + }, + type: "object" + }, + cohere: { + description: "Cohere configures Cohere backend.", + properties: { + model: { + type: "string" + }, + params: { + description: "Params holds the LLM hyperparameters.", + properties: { + frequencyPenalty: { + type: "number" + }, + maxTokens: { + type: "integer" + }, + presencePenalty: { + type: "number" + }, + temperature: { + type: "number" + }, + topP: { + type: "number" + } + }, + type: "object" + }, + token: { + type: "string" + } + }, + required: ["token"], + type: "object" + }, + deepSeek: { + description: "DeepSeek configures DeepSeek.", + properties: { + baseUrl: { + type: "string" + }, + model: { + type: "string" + }, + params: { + description: "Params holds the LLM hyperparameters.", + properties: { + frequencyPenalty: { + type: "number" + }, + maxTokens: { + type: "integer" + }, + presencePenalty: { + type: "number" + }, + temperature: { + type: "number" + }, + topP: { + type: "number" + } + }, + type: "object" + }, + token: { + type: "string" + } + }, + required: ["token"], + type: "object" + }, + gemini: { + description: "Gemini configures Gemini backend.", + properties: { + apiKey: { + type: "string" + }, + model: { + type: "string" + }, + params: { + description: "Params holds the LLM hyperparameters.", + properties: { + frequencyPenalty: { + type: "number" + }, + maxTokens: { + type: "integer" + }, + presencePenalty: { + type: "number" + }, + temperature: { + type: "number" + }, + topP: { + type: "number" + } + }, + type: "object" + } + }, + required: ["apiKey"], + type: "object" + }, + mistral: { + description: "Mistral configures Mistral AI backend.", + properties: { + apiKey: { + type: "string" + }, + model: { + type: "string" + }, + params: { + description: "Params holds the LLM hyperparameters.", + properties: { + frequencyPenalty: { + type: "number" + }, + maxTokens: { + type: "integer" + }, + presencePenalty: { + type: "number" + }, + temperature: { + type: "number" + }, + topP: { + type: "number" + } + }, + type: "object" + } + }, + required: ["apiKey"], + type: "object" + }, + ollama: { + description: "Ollama configures Ollama backend.", + properties: { + baseUrl: { + type: "string" + }, + model: { + type: "string" + }, + params: { + description: "Params holds the LLM hyperparameters.", + properties: { + frequencyPenalty: { + type: "number" + }, + maxTokens: { + type: "integer" + }, + presencePenalty: { + type: "number" + }, + temperature: { + type: "number" + }, + topP: { + type: "number" + } + }, + type: "object" + } + }, + required: ["baseUrl"], + type: "object" + }, + openai: { + description: "OpenAI configures OpenAI.", + properties: { + baseUrl: { + type: "string" + }, + model: { + type: "string" + }, + params: { + description: "Params holds the LLM hyperparameters.", + properties: { + frequencyPenalty: { + type: "number" + }, + maxTokens: { + type: "integer" + }, + presencePenalty: { + type: "number" + }, + temperature: { + type: "number" + }, + topP: { + type: "number" + } + }, + type: "object" + }, + token: { + type: "string" + } + }, + required: ["token"], + type: "object" + }, + qWen: { + description: "QWen configures QWen.", + properties: { + baseUrl: { + type: "string" + }, + model: { + type: "string" + }, + params: { + description: "Params holds the LLM hyperparameters.", + properties: { + frequencyPenalty: { + type: "number" + }, + maxTokens: { + type: "integer" + }, + presencePenalty: { + type: "number" + }, + temperature: { + type: "number" + }, + topP: { + type: "number" + } + }, + type: "object" + }, + token: { + type: "string" + } + }, + required: ["token"], + type: "object" + } + }, + type: "object" + } + }, + type: "object" + } + }, + served: true, + storage: true + }] + } +}; +export const CustomResourceDefinition_ApiaccessesHubTraefikIo: KubernetesResource = { + apiVersion: "apiextensions.k8s.io/v1", + kind: "CustomResourceDefinition", + metadata: { + annotations: { + "controller-gen.kubebuilder.io/version": "v0.17.1" + }, + name: "apiaccesses.hub.traefik.io" + }, + spec: { + group: "hub.traefik.io", + names: { + kind: "APIAccess", + listKind: "APIAccessList", + plural: "apiaccesses", + singular: "apiaccess" + }, + scope: "Namespaced", + versions: [{ + deprecated: true, + deprecationWarning: "APIAccess is deprecated in favor of APICatalogItems and ManagedSubscription", + name: "v1alpha1", + schema: { + openAPIV3Schema: { + description: "APIAccess defines who can access to a set of APIs.", + properties: { + apiVersion: { + description: "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", + type: "string" + }, + kind: { + description: "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + type: "string" + }, + metadata: { + type: "object" + }, + spec: { + description: "The desired behavior of this APIAccess.", + properties: { + apiBundles: { + description: "APIBundles defines a set of APIBundle that will be accessible to the configured audience.\nMultiple APIAccesses can select the same APIBundles.", + items: { + description: "APIBundleReference references an APIBundle.", + properties: { + name: { + description: "Name of the APIBundle.", + maxLength: 253, + type: "string" + } + }, + required: ["name"], + type: "object" + }, + maxItems: 100, + type: "array", + "x-kubernetes-validations": [{ + message: "duplicated apiBundles", + rule: "self.all(x, self.exists_one(y, x.name == y.name))" + }] + }, + apiPlan: { + description: "APIPlan defines which APIPlan will be used.", + properties: { + name: { + description: "Name of the APIPlan.", + maxLength: 253, + type: "string" + } + }, + required: ["name"], + type: "object" + }, + apis: { + description: "APIs defines a set of APIs that will be accessible to the configured audience.\nMultiple APIAccesses can select the same APIs.\nWhen combined with APISelector, this set of APIs is appended to the matching APIs.", + items: { + description: "APIReference references an API.", + properties: { + name: { + description: "Name of the API.", + maxLength: 253, + type: "string" + } + }, + required: ["name"], + type: "object" + }, + maxItems: 100, + type: "array", + "x-kubernetes-validations": [{ + message: "duplicated apis", + rule: "self.all(x, self.exists_one(y, x.name == y.name))" + }] + }, + apiSelector: { + description: "APISelector selects the APIs that will be accessible to the configured audience.\nMultiple APIAccesses can select the same set of APIs.\nThis field is optional and follows standard label selector semantics.\nAn empty APISelector matches any API.", + properties: { + matchExpressions: { + description: "matchExpressions is a list of label selector requirements. The requirements are ANDed.", + items: { + description: "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", + properties: { + key: { + description: "key is the label key that the selector applies to.", + type: "string" + }, + operator: { + description: "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", + type: "string" + }, + values: { + description: "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + required: ["key", "operator"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + matchLabels: { + additionalProperties: { + type: "string" + }, + description: "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", + type: "object" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + everyone: { + description: "Everyone indicates that all users will have access to the selected APIs.", + type: "boolean" + }, + groups: { + description: "Groups are the consumer groups that will gain access to the selected APIs.", + items: { + type: "string" + }, + type: "array" + }, + operationFilter: { + description: "OperationFilter specifies the allowed operations on APIs and APIVersions.\nIf not set, all operations are available.\nAn empty OperationFilter prohibits all operations.", + properties: { + include: { + description: "Include defines the names of OperationSets that will be accessible.", + items: { + type: "string" + }, + maxItems: 100, + type: "array" + } + }, + type: "object" + }, + weight: { + description: "Weight specifies the evaluation order of the plan.", + type: "integer", + "x-kubernetes-validations": [{ + message: "must be a positive number", + rule: "self >= 0" + }] + } + }, + type: "object", + "x-kubernetes-validations": [{ + message: "groups and everyone are mutually exclusive", + rule: "(has(self.everyone) && has(self.groups)) ? !(self.everyone && self.groups.size() > 0) : true" + }] + }, + status: { + description: "The current status of this APIAccess.", + properties: { + hash: { + description: "Hash is a hash representing the APIAccess.", + type: "string" + }, + syncedAt: { + format: "date-time", + type: "string" + }, + version: { + type: "string" + } + }, + type: "object" + } + }, + type: "object" + } + }, + served: true, + storage: true + }] + } +}; +export const CustomResourceDefinition_ApibundlesHubTraefikIo: KubernetesResource = { + apiVersion: "apiextensions.k8s.io/v1", + kind: "CustomResourceDefinition", + metadata: { + annotations: { + "controller-gen.kubebuilder.io/version": "v0.17.1" + }, + name: "apibundles.hub.traefik.io" + }, + spec: { + group: "hub.traefik.io", + names: { + kind: "APIBundle", + listKind: "APIBundleList", + plural: "apibundles", + singular: "apibundle" + }, + scope: "Namespaced", + versions: [{ + name: "v1alpha1", + schema: { + openAPIV3Schema: { + description: "APIBundle defines a set of APIs.", + properties: { + apiVersion: { + description: "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", + type: "string" + }, + kind: { + description: "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + type: "string" + }, + metadata: { + type: "object" + }, + spec: { + description: "The desired behavior of this APIBundle.", + properties: { + apis: { + description: "APIs defines a set of APIs that will be accessible to the configured audience.\nMultiple APIBundles can select the same APIs.\nWhen combined with APISelector, this set of APIs is appended to the matching APIs.", + items: { + description: "APIReference references an API.", + properties: { + name: { + description: "Name of the API.", + maxLength: 253, + type: "string" + } + }, + required: ["name"], + type: "object" + }, + maxItems: 100, + type: "array", + "x-kubernetes-validations": [{ + message: "duplicated apis", + rule: "self.all(x, self.exists_one(y, x.name == y.name))" + }] + }, + apiSelector: { + description: "APISelector selects the APIs that will be accessible to the configured audience.\nMultiple APIBundles can select the same set of APIs.\nThis field is optional and follows standard label selector semantics.\nAn empty APISelector matches any API.", + properties: { + matchExpressions: { + description: "matchExpressions is a list of label selector requirements. The requirements are ANDed.", + items: { + description: "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", + properties: { + key: { + description: "key is the label key that the selector applies to.", + type: "string" + }, + operator: { + description: "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", + type: "string" + }, + values: { + description: "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + required: ["key", "operator"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + matchLabels: { + additionalProperties: { + type: "string" + }, + description: "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", + type: "object" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + title: { + description: "Title is the human-readable name of the APIBundle that will be used on the portal.", + maxLength: 253, + type: "string" + } + }, + type: "object" + }, + status: { + description: "The current status of this APIBundle.", + properties: { + hash: { + description: "Hash is a hash representing the APIBundle.", + type: "string" + }, + syncedAt: { + format: "date-time", + type: "string" + }, + version: { + type: "string" + } + }, + type: "object" + } + }, + type: "object" + } + }, + served: true, + storage: true + }] + } +}; +export const CustomResourceDefinition_ApicatalogitemsHubTraefikIo: KubernetesResource = { + apiVersion: "apiextensions.k8s.io/v1", + kind: "CustomResourceDefinition", + metadata: { + annotations: { + "controller-gen.kubebuilder.io/version": "v0.17.1" + }, + name: "apicatalogitems.hub.traefik.io" + }, + spec: { + group: "hub.traefik.io", + names: { + kind: "APICatalogItem", + listKind: "APICatalogItemList", + plural: "apicatalogitems", + singular: "apicatalogitem" + }, + scope: "Namespaced", + versions: [{ + name: "v1alpha1", + schema: { + openAPIV3Schema: { + description: "APICatalogItem defines APIs that will be part of the API catalog on the portal.", + properties: { + apiVersion: { + description: "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", + type: "string" + }, + kind: { + description: "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + type: "string" + }, + metadata: { + type: "object" + }, + spec: { + description: "The desired behavior of this APICatalogItem.", + properties: { + apiBundles: { + description: "APIBundles defines a set of APIBundle that will be visible to the configured audience.\nMultiple APICatalogItem can select the same APIBundles.", + items: { + description: "APIBundleReference references an APIBundle.", + properties: { + name: { + description: "Name of the APIBundle.", + maxLength: 253, + type: "string" + } + }, + required: ["name"], + type: "object" + }, + maxItems: 100, + type: "array", + "x-kubernetes-validations": [{ + message: "duplicated apiBundles", + rule: "self.all(x, self.exists_one(y, x.name == y.name))" + }] + }, + apiPlan: { + description: "APIPlan defines which APIPlan will be available.\nIf multiple APICatalogItem specify the same API with different APIPlan, the API consumer will be able to pick\na plan from this list.", + properties: { + name: { + description: "Name of the APIPlan.", + maxLength: 253, + type: "string" + } + }, + required: ["name"], + type: "object" + }, + apis: { + description: "APIs defines a set of APIs that will be visible to the configured audience.\nMultiple APICatalogItem can select the same APIs.\nWhen combined with APISelector, this set of APIs is appended to the matching APIs.", + items: { + description: "APIReference references an API.", + properties: { + name: { + description: "Name of the API.", + maxLength: 253, + type: "string" + } + }, + required: ["name"], + type: "object" + }, + maxItems: 100, + type: "array", + "x-kubernetes-validations": [{ + message: "duplicated apis", + rule: "self.all(x, self.exists_one(y, x.name == y.name))" + }] + }, + apiSelector: { + description: "APISelector selects the APIs that will be visible to the configured audience.\nMultiple APICatalogItem can select the same set of APIs.\nThis field is optional and follows standard label selector semantics.\nAn empty APISelector matches any API.", + properties: { + matchExpressions: { + description: "matchExpressions is a list of label selector requirements. The requirements are ANDed.", + items: { + description: "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", + properties: { + key: { + description: "key is the label key that the selector applies to.", + type: "string" + }, + operator: { + description: "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", + type: "string" + }, + values: { + description: "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + required: ["key", "operator"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + matchLabels: { + additionalProperties: { + type: "string" + }, + description: "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", + type: "object" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + everyone: { + description: "Everyone indicates that all users will see these APIs.", + type: "boolean" + }, + groups: { + description: "Groups are the consumer groups that will see the APIs.", + items: { + type: "string" + }, + type: "array" + }, + operationFilter: { + description: "OperationFilter specifies the visible operations on APIs and APIVersions.\nIf not set, all operations are available.\nAn empty OperationFilter prohibits all operations.", + properties: { + include: { + description: "Include defines the names of OperationSets that will be accessible.", + items: { + type: "string" + }, + maxItems: 100, + type: "array" + } + }, + type: "object" + } + }, + type: "object", + "x-kubernetes-validations": [{ + message: "groups and everyone are mutually exclusive", + rule: "(has(self.everyone) && has(self.groups)) ? !(self.everyone && self.groups.size() > 0) : true" + }] + }, + status: { + description: "The current status of this APICatalogItem.", + properties: { + hash: { + description: "Hash is a hash representing the APICatalogItem.", + type: "string" + }, + syncedAt: { + format: "date-time", + type: "string" + }, + version: { + type: "string" + } + }, + type: "object" + } + }, + type: "object" + } + }, + served: true, + storage: true + }] + } +}; +export const CustomResourceDefinition_ApiplansHubTraefikIo: KubernetesResource = { + apiVersion: "apiextensions.k8s.io/v1", + kind: "CustomResourceDefinition", + metadata: { + annotations: { + "controller-gen.kubebuilder.io/version": "v0.17.1" + }, + name: "apiplans.hub.traefik.io" + }, + spec: { + group: "hub.traefik.io", + names: { + kind: "APIPlan", + listKind: "APIPlanList", + plural: "apiplans", + singular: "apiplan" + }, + scope: "Namespaced", + versions: [{ + name: "v1alpha1", + schema: { + openAPIV3Schema: { + description: "APIPlan defines API Plan policy.", + properties: { + apiVersion: { + description: "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", + type: "string" + }, + kind: { + description: "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + type: "string" + }, + metadata: { + type: "object" + }, + spec: { + description: "The desired behavior of this APIPlan.", + properties: { + description: { + description: "Description describes the plan.", + type: "string" + }, + quota: { + description: "Quota defines the quota policy.", + properties: { + limit: { + description: "Limit is the maximum number of token in the bucket.", + type: "integer", + "x-kubernetes-validations": [{ + message: "must be a positive number", + rule: "self >= 0" + }] + }, + period: { + description: "Period is the unit of time for the Limit.", + format: "duration", + type: "string", + "x-kubernetes-validations": [{ + message: "must be between 1s and 9999h", + rule: "self >= duration('1s') && self <= duration('9999h')" + }] + } + }, + required: ["limit"], + type: "object" + }, + rateLimit: { + description: "RateLimit defines the rate limit policy.", + properties: { + limit: { + description: "Limit is the maximum number of token in the bucket.", + type: "integer", + "x-kubernetes-validations": [{ + message: "must be a positive number", + rule: "self >= 0" + }] + }, + period: { + description: "Period is the unit of time for the Limit.", + format: "duration", + type: "string", + "x-kubernetes-validations": [{ + message: "must be between 1s and 1h", + rule: "self >= duration('1s') && self <= duration('1h')" + }] + } + }, + required: ["limit"], + type: "object" + }, + title: { + description: "Title is the human-readable name of the plan.", + type: "string" + } + }, + required: ["title"], + type: "object" + }, + status: { + description: "The current status of this APIPlan.", + properties: { + hash: { + description: "Hash is a hash representing the APIPlan.", + type: "string" + }, + syncedAt: { + format: "date-time", + type: "string" + }, + version: { + type: "string" + } + }, + type: "object" + } + }, + type: "object" + } + }, + served: true, + storage: true + }] + } +}; +export const CustomResourceDefinition_ApiportalsHubTraefikIo: KubernetesResource = { + apiVersion: "apiextensions.k8s.io/v1", + kind: "CustomResourceDefinition", + metadata: { + annotations: { + "controller-gen.kubebuilder.io/version": "v0.17.1" + }, + name: "apiportals.hub.traefik.io" + }, + spec: { + group: "hub.traefik.io", + names: { + kind: "APIPortal", + listKind: "APIPortalList", + plural: "apiportals", + singular: "apiportal" + }, + scope: "Namespaced", + versions: [{ + name: "v1alpha1", + schema: { + openAPIV3Schema: { + description: "APIPortal defines a developer portal for accessing the documentation of APIs.", + properties: { + apiVersion: { + description: "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", + type: "string" + }, + kind: { + description: "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + type: "string" + }, + metadata: { + type: "object" + }, + spec: { + description: "The desired behavior of this APIPortal.", + properties: { + description: { + description: "Description of the APIPortal.", + type: "string" + }, + title: { + description: "Title is the public facing name of the APIPortal.", + type: "string" + }, + trustedUrls: { + description: "TrustedURLs are the urls that are trusted by the OAuth 2.0 authorization server.", + items: { + type: "string" + }, + maxItems: 1, + minItems: 1, + type: "array", + "x-kubernetes-validations": [{ + message: "must be a valid URLs", + rule: "self.all(x, isURL(x))" + }] + }, + ui: { + description: "UI holds the UI customization options.", + properties: { + logoUrl: { + description: "LogoURL is the public URL of the logo.", + type: "string" + } + }, + type: "object" + } + }, + required: ["trustedUrls"], + type: "object" + }, + status: { + description: "The current status of this APIPortal.", + properties: { + hash: { + description: "Hash is a hash representing the APIPortal.", + type: "string" + }, + oidc: { + description: "OIDC is the OIDC configuration for accessing the exposed APIPortal WebUI.", + properties: { + clientId: { + description: "ClientID is the OIDC ClientID for accessing the exposed APIPortal WebUI.", + type: "string" + }, + companyClaim: { + description: "CompanyClaim is the name of the JWT claim containing the user company.", + type: "string" + }, + emailClaim: { + description: "EmailClaim is the name of the JWT claim containing the user email.", + type: "string" + }, + firstnameClaim: { + description: "FirstnameClaim is the name of the JWT claim containing the user firstname.", + type: "string" + }, + generic: { + description: "Generic indicates whether or not the APIPortal authentication relies on Generic OIDC.", + type: "boolean" + }, + groupsClaim: { + description: "GroupsClaim is the name of the JWT claim containing the user groups.", + type: "string" + }, + issuer: { + description: "Issuer is the OIDC issuer for accessing the exposed APIPortal WebUI.", + type: "string" + }, + lastnameClaim: { + description: "LastnameClaim is the name of the JWT claim containing the user lastname.", + type: "string" + }, + scopes: { + description: "Scopes is the OIDC scopes for getting user attributes during the authentication to the exposed APIPortal WebUI.", + type: "string" + }, + secretName: { + description: "SecretName is the name of the secret containing the OIDC ClientSecret for accessing the exposed APIPortal WebUI.", + type: "string" + }, + syncedAttributes: { + description: "SyncedAttributes configure the user attributes to sync.", + items: { + type: "string" + }, + type: "array" + }, + userIdClaim: { + description: "UserIDClaim is the name of the JWT claim containing the user ID.", + type: "string" + } + }, + type: "object" + }, + syncedAt: { + format: "date-time", + type: "string" + }, + version: { + type: "string" + } + }, + type: "object" + } + }, + type: "object" + } + }, + served: true, + storage: true + }] + } +}; +export const CustomResourceDefinition_ApiratelimitsHubTraefikIo: KubernetesResource = { + apiVersion: "apiextensions.k8s.io/v1", + kind: "CustomResourceDefinition", + metadata: { + annotations: { + "controller-gen.kubebuilder.io/version": "v0.17.1" + }, + name: "apiratelimits.hub.traefik.io" + }, + spec: { + group: "hub.traefik.io", + names: { + kind: "APIRateLimit", + listKind: "APIRateLimitList", + plural: "apiratelimits", + singular: "apiratelimit" + }, + scope: "Namespaced", + versions: [{ + name: "v1alpha1", + schema: { + openAPIV3Schema: { + description: "APIRateLimit defines how group of consumers are rate limited on a set of APIs.", + properties: { + apiVersion: { + description: "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", + type: "string" + }, + kind: { + description: "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + type: "string" + }, + metadata: { + type: "object" + }, + spec: { + description: "The desired behavior of this APIRateLimit.", + properties: { + apis: { + description: "APIs defines a set of APIs that will be rate limited.\nMultiple APIRateLimits can select the same APIs.\nWhen combined with APISelector, this set of APIs is appended to the matching APIs.", + items: { + description: "APIReference references an API.", + properties: { + name: { + description: "Name of the API.", + maxLength: 253, + type: "string" + } + }, + required: ["name"], + type: "object" + }, + maxItems: 100, + type: "array", + "x-kubernetes-validations": [{ + message: "duplicated apis", + rule: "self.all(x, self.exists_one(y, x.name == y.name))" + }] + }, + apiSelector: { + description: "APISelector selects the APIs that will be rate limited.\nMultiple APIRateLimits can select the same set of APIs.\nThis field is optional and follows standard label selector semantics.\nAn empty APISelector matches any API.", + properties: { + matchExpressions: { + description: "matchExpressions is a list of label selector requirements. The requirements are ANDed.", + items: { + description: "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", + properties: { + key: { + description: "key is the label key that the selector applies to.", + type: "string" + }, + operator: { + description: "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", + type: "string" + }, + values: { + description: "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + required: ["key", "operator"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + matchLabels: { + additionalProperties: { + type: "string" + }, + description: "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", + type: "object" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + everyone: { + description: "Everyone indicates that all users will, by default, be rate limited with this configuration.\nIf an APIRateLimit explicitly target a group, the default rate limit will be ignored.", + type: "boolean" + }, + groups: { + description: "Groups are the consumer groups that will be rate limited.\nMultiple APIRateLimits can target the same set of consumer groups, the most restrictive one applies.\nWhen a consumer belongs to multiple groups, the least restrictive APIRateLimit applies.", + items: { + type: "string" + }, + type: "array" + }, + limit: { + description: "Limit is the maximum number of token in the bucket.", + type: "integer", + "x-kubernetes-validations": [{ + message: "must be a positive number", + rule: "self >= 0" + }] + }, + period: { + description: "Period is the unit of time for the Limit.", + format: "duration", + type: "string", + "x-kubernetes-validations": [{ + message: "must be between 1s and 1h", + rule: "self >= duration('1s') && self <= duration('1h')" + }] + }, + strategy: { + description: "Strategy defines how the bucket state will be synchronized between the different Traefik Hub instances.\nIt can be, either \"local\" or \"distributed\".", + enum: ["local", "distributed"], + type: "string" + } + }, + required: ["limit"], + type: "object", + "x-kubernetes-validations": [{ + message: "groups and everyone are mutually exclusive", + rule: "(has(self.everyone) && has(self.groups)) ? !(self.everyone && self.groups.size() > 0) : true" + }] + }, + status: { + description: "The current status of this APIRateLimit.", + properties: { + hash: { + description: "Hash is a hash representing the APIRateLimit.", + type: "string" + }, + syncedAt: { + format: "date-time", + type: "string" + }, + version: { + type: "string" + } + }, + type: "object" + } + }, + type: "object" + } + }, + served: true, + storage: true + }] + } +}; +export const CustomResourceDefinition_ApisHubTraefikIo: KubernetesResource = { + apiVersion: "apiextensions.k8s.io/v1", + kind: "CustomResourceDefinition", + metadata: { + annotations: { + "controller-gen.kubebuilder.io/version": "v0.17.1" + }, + name: "apis.hub.traefik.io" + }, + spec: { + group: "hub.traefik.io", + names: { + kind: "API", + listKind: "APIList", + plural: "apis", + singular: "api" + }, + scope: "Namespaced", + versions: [{ + name: "v1alpha1", + schema: { + openAPIV3Schema: { + description: "API defines an HTTP interface that is exposed to external clients. It specifies the supported versions\nand provides instructions for accessing its documentation. Once instantiated, an API object is associated\nwith an Ingress, IngressRoute, or HTTPRoute resource, enabling the exposure of the described API to the outside world.", + properties: { + apiVersion: { + description: "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", + type: "string" + }, + kind: { + description: "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + type: "string" + }, + metadata: { + type: "object" + }, + spec: { + description: "APISpec describes the API.", + properties: { + cors: { + description: "Cors defines the Cross-Origin Resource Sharing configuration.", + properties: { + addVaryHeader: { + description: "AddVaryHeader defines whether the Vary header is automatically added/updated when the AllowOriginsList is set.", + type: "boolean" + }, + allowCredentials: { + description: "AllowCredentials defines whether the request can include user credentials.", + type: "boolean" + }, + allowHeadersList: { + description: "AllowHeadersList defines the Access-Control-Request-Headers values sent in preflight response.", + items: { + type: "string" + }, + type: "array" + }, + allowMethodsList: { + description: "AllowMethodsList defines the Access-Control-Request-Method values sent in preflight response.", + items: { + type: "string" + }, + type: "array" + }, + allowOriginListRegex: { + description: "AllowOriginListRegex is a list of allowable origins written following the Regular Expression syntax (https://golang.org/pkg/regexp/).", + items: { + type: "string" + }, + type: "array" + }, + allowOriginsList: { + description: "AllowOriginsList is a list of allowable origins. Can also be a wildcard origin \"*\".", + items: { + type: "string" + }, + type: "array" + }, + exposeHeadersList: { + description: "ExposeHeadersList defines the Access-Control-Expose-Headers values sent in preflight response.", + items: { + type: "string" + }, + type: "array" + }, + maxAge: { + description: "MaxAge defines the time that a preflight request may be cached.", + format: "int64", + type: "integer" + } + }, + type: "object" + }, + description: { + description: "Description explains what the API does.", + type: "string" + }, + openApiSpec: { + description: "OpenAPISpec defines the API contract as an OpenAPI specification.", + properties: { + operationSets: { + description: "OperationSets defines the sets of operations to be referenced for granular filtering in APIAccesses.", + items: { + description: "OperationSet gives a name to a set of matching OpenAPI operations.\nThis set of operations can then be referenced for granular filtering in APIAccesses.", + properties: { + matchers: { + description: "Matchers defines a list of alternative rules for matching OpenAPI operations.", + items: { + description: "OperationMatcher defines criteria for matching an OpenAPI operation.", + minProperties: 1, + properties: { + methods: { + description: "Methods specifies the HTTP methods to be included for selection.", + items: { + type: "string" + }, + maxItems: 10, + type: "array" + }, + path: { + description: "Path specifies the exact path of the operations to select.", + maxLength: 255, + type: "string", + "x-kubernetes-validations": [{ + message: "must start with a '/'", + rule: "self.startsWith('/')" + }, { + message: "cannot contains '../'", + rule: "!self.matches(r\"\"\"(\\/\\.\\.\\/)|(\\/\\.\\.$)\"\"\")" + }] + }, + pathPrefix: { + description: "PathPrefix specifies the path prefix of the operations to select.", + maxLength: 255, + type: "string", + "x-kubernetes-validations": [{ + message: "must start with a '/'", + rule: "self.startsWith('/')" + }, { + message: "cannot contains '../'", + rule: "!self.matches(r\"\"\"(\\/\\.\\.\\/)|(\\/\\.\\.$)\"\"\")" + }] + }, + pathRegex: { + description: "PathRegex specifies a regular expression pattern for matching operations based on their paths.", + type: "string" + } + }, + type: "object", + "x-kubernetes-validations": [{ + message: "path, pathPrefix and pathRegex are mutually exclusive", + rule: "[has(self.path), has(self.pathPrefix), has(self.pathRegex)].filter(x, x).size() <= 1" + }] + }, + maxItems: 100, + minItems: 1, + type: "array" + }, + name: { + description: "Name is the name of the OperationSet to reference in APIAccesses.", + maxLength: 253, + type: "string" + } + }, + required: ["matchers", "name"], + type: "object" + }, + maxItems: 100, + type: "array" + }, + override: { + description: "Override holds data used to override OpenAPI specification.", + properties: { + servers: { + items: { + properties: { + url: { + type: "string", + "x-kubernetes-validations": [{ + message: "must be a valid URL", + rule: "isURL(self)" + }] + } + }, + required: ["url"], + type: "object" + }, + maxItems: 100, + minItems: 1, + type: "array" + } + }, + required: ["servers"], + type: "object" + }, + path: { + description: "Path specifies the endpoint path within the Kubernetes Service where the OpenAPI specification can be obtained.\nThe Service queried is determined by the associated Ingress, IngressRoute, or HTTPRoute resource to which the API is attached.\nIt's important to note that this option is incompatible if the Ingress or IngressRoute specifies multiple backend services.\nThe Path must be accessible via a GET request method and should serve a YAML or JSON document containing the OpenAPI specification.", + maxLength: 255, + type: "string", + "x-kubernetes-validations": [{ + message: "must start with a '/'", + rule: "self.startsWith('/')" + }, { + message: "cannot contains '../'", + rule: "!self.matches(r\"\"\"(\\/\\.\\.\\/)|(\\/\\.\\.$)\"\"\")" + }] + }, + url: { + description: "URL is a Traefik Hub agent accessible URL for obtaining the OpenAPI specification.\nThe URL must be accessible via a GET request method and should serve a YAML or JSON document containing the OpenAPI specification.", + type: "string", + "x-kubernetes-validations": [{ + message: "must be a valid URL", + rule: "isURL(self)" + }] + }, + validateRequestMethodAndPath: { + description: "ValidateRequestMethodAndPath validates that the path and method matches an operation defined in the OpenAPI specification.\nThis option overrides the default behavior configured in the static configuration.", + type: "boolean" + } + }, + type: "object", + "x-kubernetes-validations": [{ + message: "path or url must be defined", + rule: "has(self.path) || has(self.url)" + }] + }, + title: { + description: "Title is the human-readable name of the API that will be used on the portal.", + maxLength: 253, + type: "string" + }, + versions: { + description: "Versions are the different APIVersions available.", + items: { + description: "APIVersionRef references an APIVersion.", + properties: { + name: { + description: "Name of the APIVersion.", + maxLength: 253, + type: "string" + } + }, + required: ["name"], + type: "object" + }, + maxItems: 100, + minItems: 1, + type: "array" + } + }, + type: "object" + }, + status: { + description: "The current status of this API.", + properties: { + hash: { + description: "Hash is a hash representing the API.", + type: "string" + }, + syncedAt: { + format: "date-time", + type: "string" + }, + version: { + type: "string" + } + }, + type: "object" + } + }, + type: "object" + } + }, + served: true, + storage: true + }] + } +}; +export const CustomResourceDefinition_ApiversionsHubTraefikIo: KubernetesResource = { + apiVersion: "apiextensions.k8s.io/v1", + kind: "CustomResourceDefinition", + metadata: { + annotations: { + "controller-gen.kubebuilder.io/version": "v0.17.1" + }, + name: "apiversions.hub.traefik.io" + }, + spec: { + group: "hub.traefik.io", + names: { + kind: "APIVersion", + listKind: "APIVersionList", + plural: "apiversions", + singular: "apiversion" + }, + scope: "Namespaced", + versions: [{ + additionalPrinterColumns: [{ + jsonPath: ".spec.title", + name: "Title", + type: "string" + }, { + jsonPath: ".spec.release", + name: "Release", + type: "string" + }], + name: "v1alpha1", + schema: { + openAPIV3Schema: { + description: "APIVersion defines a version of an API.", + properties: { + apiVersion: { + description: "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", + type: "string" + }, + kind: { + description: "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + type: "string" + }, + metadata: { + type: "object" + }, + spec: { + description: "The desired behavior of this APIVersion.", + properties: { + cors: { + description: "Cors defines the Cross-Origin Resource Sharing configuration.", + properties: { + addVaryHeader: { + description: "AddVaryHeader defines whether the Vary header is automatically added/updated when the AllowOriginsList is set.", + type: "boolean" + }, + allowCredentials: { + description: "AllowCredentials defines whether the request can include user credentials.", + type: "boolean" + }, + allowHeadersList: { + description: "AllowHeadersList defines the Access-Control-Request-Headers values sent in preflight response.", + items: { + type: "string" + }, + type: "array" + }, + allowMethodsList: { + description: "AllowMethodsList defines the Access-Control-Request-Method values sent in preflight response.", + items: { + type: "string" + }, + type: "array" + }, + allowOriginListRegex: { + description: "AllowOriginListRegex is a list of allowable origins written following the Regular Expression syntax (https://golang.org/pkg/regexp/).", + items: { + type: "string" + }, + type: "array" + }, + allowOriginsList: { + description: "AllowOriginsList is a list of allowable origins. Can also be a wildcard origin \"*\".", + items: { + type: "string" + }, + type: "array" + }, + exposeHeadersList: { + description: "ExposeHeadersList defines the Access-Control-Expose-Headers values sent in preflight response.", + items: { + type: "string" + }, + type: "array" + }, + maxAge: { + description: "MaxAge defines the time that a preflight request may be cached.", + format: "int64", + type: "integer" + } + }, + type: "object" + }, + description: { + description: "Description explains what the APIVersion does.", + type: "string" + }, + openApiSpec: { + description: "OpenAPISpec defines the API contract as an OpenAPI specification.", + properties: { + operationSets: { + description: "OperationSets defines the sets of operations to be referenced for granular filtering in APIAccesses.", + items: { + description: "OperationSet gives a name to a set of matching OpenAPI operations.\nThis set of operations can then be referenced for granular filtering in APIAccesses.", + properties: { + matchers: { + description: "Matchers defines a list of alternative rules for matching OpenAPI operations.", + items: { + description: "OperationMatcher defines criteria for matching an OpenAPI operation.", + minProperties: 1, + properties: { + methods: { + description: "Methods specifies the HTTP methods to be included for selection.", + items: { + type: "string" + }, + maxItems: 10, + type: "array" + }, + path: { + description: "Path specifies the exact path of the operations to select.", + maxLength: 255, + type: "string", + "x-kubernetes-validations": [{ + message: "must start with a '/'", + rule: "self.startsWith('/')" + }, { + message: "cannot contains '../'", + rule: "!self.matches(r\"\"\"(\\/\\.\\.\\/)|(\\/\\.\\.$)\"\"\")" + }] + }, + pathPrefix: { + description: "PathPrefix specifies the path prefix of the operations to select.", + maxLength: 255, + type: "string", + "x-kubernetes-validations": [{ + message: "must start with a '/'", + rule: "self.startsWith('/')" + }, { + message: "cannot contains '../'", + rule: "!self.matches(r\"\"\"(\\/\\.\\.\\/)|(\\/\\.\\.$)\"\"\")" + }] + }, + pathRegex: { + description: "PathRegex specifies a regular expression pattern for matching operations based on their paths.", + type: "string" + } + }, + type: "object", + "x-kubernetes-validations": [{ + message: "path, pathPrefix and pathRegex are mutually exclusive", + rule: "[has(self.path), has(self.pathPrefix), has(self.pathRegex)].filter(x, x).size() <= 1" + }] + }, + maxItems: 100, + minItems: 1, + type: "array" + }, + name: { + description: "Name is the name of the OperationSet to reference in APIAccesses.", + maxLength: 253, + type: "string" + } + }, + required: ["matchers", "name"], + type: "object" + }, + maxItems: 100, + type: "array" + }, + override: { + description: "Override holds data used to override OpenAPI specification.", + properties: { + servers: { + items: { + properties: { + url: { + type: "string", + "x-kubernetes-validations": [{ + message: "must be a valid URL", + rule: "isURL(self)" + }] + } + }, + required: ["url"], + type: "object" + }, + maxItems: 100, + minItems: 1, + type: "array" + } + }, + required: ["servers"], + type: "object" + }, + path: { + description: "Path specifies the endpoint path within the Kubernetes Service where the OpenAPI specification can be obtained.\nThe Service queried is determined by the associated Ingress, IngressRoute, or HTTPRoute resource to which the API is attached.\nIt's important to note that this option is incompatible if the Ingress or IngressRoute specifies multiple backend services.\nThe Path must be accessible via a GET request method and should serve a YAML or JSON document containing the OpenAPI specification.", + maxLength: 255, + type: "string", + "x-kubernetes-validations": [{ + message: "must start with a '/'", + rule: "self.startsWith('/')" + }, { + message: "cannot contains '../'", + rule: "!self.matches(r\"\"\"(\\/\\.\\.\\/)|(\\/\\.\\.$)\"\"\")" + }] + }, + url: { + description: "URL is a Traefik Hub agent accessible URL for obtaining the OpenAPI specification.\nThe URL must be accessible via a GET request method and should serve a YAML or JSON document containing the OpenAPI specification.", + type: "string", + "x-kubernetes-validations": [{ + message: "must be a valid URL", + rule: "isURL(self)" + }] + }, + validateRequestMethodAndPath: { + description: "ValidateRequestMethodAndPath validates that the path and method matches an operation defined in the OpenAPI specification.\nThis option overrides the default behavior configured in the static configuration.", + type: "boolean" + } + }, + type: "object", + "x-kubernetes-validations": [{ + message: "path or url must be defined", + rule: "has(self.path) || has(self.url)" + }] + }, + release: { + description: "Release is the version number of the API.\nThis value must follow the SemVer format: https://semver.org/", + maxLength: 100, + type: "string", + "x-kubernetes-validations": [{ + message: "must be a valid semver version", + rule: "self.matches(r\"\"\"^v?(0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)(?:-((?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\\+([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?$\"\"\")" + }] + }, + title: { + description: "Title is the public facing name of the APIVersion.", + type: "string" + } + }, + required: ["release"], + type: "object" + }, + status: { + description: "The current status of this APIVersion.", + properties: { + hash: { + description: "Hash is a hash representing the APIVersion.", + type: "string" + }, + syncedAt: { + format: "date-time", + type: "string" + }, + version: { + type: "string" + } + }, + type: "object" + } + }, + type: "object" + } + }, + served: true, + storage: true, + subresources: {} + }] + } +}; +export const CustomResourceDefinition_ManagedsubscriptionsHubTraefikIo: KubernetesResource = { + apiVersion: "apiextensions.k8s.io/v1", + kind: "CustomResourceDefinition", + metadata: { + annotations: { + "controller-gen.kubebuilder.io/version": "v0.17.1" + }, + name: "managedsubscriptions.hub.traefik.io" + }, + spec: { + group: "hub.traefik.io", + names: { + kind: "ManagedSubscription", + listKind: "ManagedSubscriptionList", + plural: "managedsubscriptions", + singular: "managedsubscription" + }, + scope: "Namespaced", + versions: [{ + name: "v1alpha1", + schema: { + openAPIV3Schema: { + description: "ManagedSubscription defines a Subscription managed by the API manager as the result of a pre-negotiation with its\nAPI consumers. This subscription grant consuming access to a set of APIs to a set of Applications.", + properties: { + apiVersion: { + description: "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", + type: "string" + }, + kind: { + description: "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + type: "string" + }, + metadata: { + type: "object" + }, + spec: { + description: "The desired behavior of this ManagedSubscription.", + properties: { + apiBundles: { + description: "APIBundles defines a set of APIBundle that will be accessible.\nMultiple ManagedSubscriptions can select the same APIBundles.", + items: { + description: "APIBundleReference references an APIBundle.", + properties: { + name: { + description: "Name of the APIBundle.", + maxLength: 253, + type: "string" + } + }, + required: ["name"], + type: "object" + }, + maxItems: 100, + type: "array", + "x-kubernetes-validations": [{ + message: "duplicated apiBundles", + rule: "self.all(x, self.exists_one(y, x.name == y.name))" + }] + }, + apiPlan: { + description: "APIPlan defines which APIPlan will be used.", + properties: { + name: { + description: "Name of the APIPlan.", + maxLength: 253, + type: "string" + } + }, + required: ["name"], + type: "object" + }, + apis: { + description: "APIs defines a set of APIs that will be accessible.\nMultiple ManagedSubscriptions can select the same APIs.\nWhen combined with APISelector, this set of APIs is appended to the matching APIs.", + items: { + description: "APIReference references an API.", + properties: { + name: { + description: "Name of the API.", + maxLength: 253, + type: "string" + } + }, + required: ["name"], + type: "object" + }, + maxItems: 100, + type: "array", + "x-kubernetes-validations": [{ + message: "duplicated apis", + rule: "self.all(x, self.exists_one(y, x.name == y.name))" + }] + }, + apiSelector: { + description: "APISelector selects the APIs that will be accessible.\nMultiple ManagedSubscriptions can select the same set of APIs.\nThis field is optional and follows standard label selector semantics.\nAn empty APISelector matches any API.", + properties: { + matchExpressions: { + description: "matchExpressions is a list of label selector requirements. The requirements are ANDed.", + items: { + description: "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", + properties: { + key: { + description: "key is the label key that the selector applies to.", + type: "string" + }, + operator: { + description: "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", + type: "string" + }, + values: { + description: "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + required: ["key", "operator"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + matchLabels: { + additionalProperties: { + type: "string" + }, + description: "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", + type: "object" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + applications: { + description: "Applications references the Applications that will gain access to the specified APIs.\nMultiple ManagedSubscriptions can select the same AppID.", + items: { + description: "ApplicationReference references an Application.", + properties: { + appId: { + description: "AppID is the public identifier of the application.\nIn the case of OIDC, it corresponds to the clientId.", + maxLength: 253, + type: "string" + } + }, + required: ["appId"], + type: "object" + }, + maxItems: 100, + minItems: 1, + type: "array" + }, + claims: { + description: "Claims specifies an expression that validate claims in order to authorize the request.", + type: "string" + }, + operationFilter: { + description: "OperationFilter specifies the allowed operations on APIs and APIVersions.\nIf not set, all operations are available.\nAn empty OperationFilter prohibits all operations.", + properties: { + include: { + description: "Include defines the names of OperationSets that will be accessible.", + items: { + type: "string" + }, + maxItems: 100, + type: "array" + } + }, + type: "object" + }, + weight: { + description: "Weight specifies the evaluation order of the APIPlan.\nWhen multiple ManagedSubscriptions targets the same API and Application with different APIPlan,\nthe APIPlan with the highest weight will be enforced. If weights are equal, alphabetical order is used.", + type: "integer", + "x-kubernetes-validations": [{ + message: "must be a positive number", + rule: "self >= 0" + }] + } + }, + required: ["apiPlan", "applications"], + type: "object" + }, + status: { + description: "The current status of this ManagedSubscription.", + properties: { + hash: { + description: "Hash is a hash representing the ManagedSubscription.", + type: "string" + }, + syncedAt: { + format: "date-time", + type: "string" + }, + version: { + type: "string" + } + }, + type: "object" + } + }, + type: "object" + } + }, + served: true, + storage: true + }] + } +}; +export const CustomResourceDefinition_IngressroutesTraefikIo: KubernetesResource = { + apiVersion: "apiextensions.k8s.io/v1", + kind: "CustomResourceDefinition", + metadata: { + annotations: { + "controller-gen.kubebuilder.io/version": "v0.16.1" + }, + name: "ingressroutes.traefik.io" + }, + spec: { + group: "traefik.io", + names: { + kind: "IngressRoute", + listKind: "IngressRouteList", + plural: "ingressroutes", + singular: "ingressroute" + }, + scope: "Namespaced", + versions: [{ + name: "v1alpha1", + schema: { + openAPIV3Schema: { + description: "IngressRoute is the CRD implementation of a Traefik HTTP Router.", + properties: { + apiVersion: { + description: "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", + type: "string" + }, + kind: { + description: "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + type: "string" + }, + metadata: { + type: "object" + }, + spec: { + description: "IngressRouteSpec defines the desired state of IngressRoute.", + properties: { + entryPoints: { + description: "EntryPoints defines the list of entry point names to bind to.\nEntry points have to be configured in the static configuration.\nMore info: https://doc.traefik.io/traefik/v3.3/routing/entrypoints/\nDefault: all.", + items: { + type: "string" + }, + type: "array" + }, + routes: { + description: "Routes defines the list of routes.", + items: { + description: "Route holds the HTTP route configuration.", + properties: { + kind: { + description: "Kind defines the kind of the route.\nRule is the only supported kind.\nIf not defined, defaults to Rule.", + enum: ["Rule"], + type: "string" + }, + match: { + description: "Match defines the router's rule.\nMore info: https://doc.traefik.io/traefik/v3.3/routing/routers/#rule", + type: "string" + }, + middlewares: { + description: "Middlewares defines the list of references to Middleware resources.\nMore info: https://doc.traefik.io/traefik/v3.3/routing/providers/kubernetes-crd/#kind-middleware", + items: { + description: "MiddlewareRef is a reference to a Middleware resource.", + properties: { + name: { + description: "Name defines the name of the referenced Middleware resource.", + type: "string" + }, + namespace: { + description: "Namespace defines the namespace of the referenced Middleware resource.", + type: "string" + } + }, + required: ["name"], + type: "object" + }, + type: "array" + }, + observability: { + description: "Observability defines the observability configuration for a router.\nMore info: https://doc.traefik.io/traefik/v3.2/routing/routers/#observability", + properties: { + accessLogs: { + type: "boolean" + }, + metrics: { + type: "boolean" + }, + tracing: { + type: "boolean" + } + }, + type: "object" + }, + priority: { + description: "Priority defines the router's priority.\nMore info: https://doc.traefik.io/traefik/v3.3/routing/routers/#priority", + type: "integer" + }, + services: { + description: "Services defines the list of Service.\nIt can contain any combination of TraefikService and/or reference to a Kubernetes Service.", + items: { + description: "Service defines an upstream HTTP service to proxy traffic to.", + properties: { + healthCheck: { + description: "Healthcheck defines health checks for ExternalName services.", + properties: { + followRedirects: { + description: "FollowRedirects defines whether redirects should be followed during the health check calls.\nDefault: true", + type: "boolean" + }, + headers: { + additionalProperties: { + type: "string" + }, + description: "Headers defines custom headers to be sent to the health check endpoint.", + type: "object" + }, + hostname: { + description: "Hostname defines the value of hostname in the Host header of the health check request.", + type: "string" + }, + interval: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Interval defines the frequency of the health check calls.\nDefault: 30s", + "x-kubernetes-int-or-string": true + }, + method: { + description: "Method defines the healthcheck method.", + type: "string" + }, + mode: { + description: "Mode defines the health check mode.\nIf defined to grpc, will use the gRPC health check protocol to probe the server.\nDefault: http", + type: "string" + }, + path: { + description: "Path defines the server URL path for the health check endpoint.", + type: "string" + }, + port: { + description: "Port defines the server URL port for the health check endpoint.", + type: "integer" + }, + scheme: { + description: "Scheme replaces the server URL scheme for the health check endpoint.", + type: "string" + }, + status: { + description: "Status defines the expected HTTP status code of the response to the health check request.", + type: "integer" + }, + timeout: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Timeout defines the maximum duration Traefik will wait for a health check request before considering the server unhealthy.\nDefault: 5s", + "x-kubernetes-int-or-string": true + } + }, + type: "object" + }, + kind: { + description: "Kind defines the kind of the Service.", + enum: ["Service", "TraefikService"], + type: "string" + }, + name: { + description: "Name defines the name of the referenced Kubernetes Service or TraefikService.\nThe differentiation between the two is specified in the Kind field.", + type: "string" + }, + namespace: { + description: "Namespace defines the namespace of the referenced Kubernetes Service or TraefikService.", + type: "string" + }, + nativeLB: { + description: "NativeLB controls, when creating the load-balancer,\nwhether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP.\nThe Kubernetes Service itself does load-balance to the pods.\nBy default, NativeLB is false.", + type: "boolean" + }, + nodePortLB: { + description: "NodePortLB controls, when creating the load-balancer,\nwhether the LB's children are directly the nodes internal IPs using the nodePort when the service type is NodePort.\nIt allows services to be reachable when Traefik runs externally from the Kubernetes cluster but within the same network of the nodes.\nBy default, NodePortLB is false.", + type: "boolean" + }, + passHostHeader: { + description: "PassHostHeader defines whether the client Host header is forwarded to the upstream Kubernetes Service.\nBy default, passHostHeader is true.", + type: "boolean" + }, + port: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Port defines the port of a Kubernetes Service.\nThis can be a reference to a named port.", + "x-kubernetes-int-or-string": true + }, + responseForwarding: { + description: "ResponseForwarding defines how Traefik forwards the response from the upstream Kubernetes Service to the client.", + properties: { + flushInterval: { + description: "FlushInterval defines the interval, in milliseconds, in between flushes to the client while copying the response body.\nA negative value means to flush immediately after each write to the client.\nThis configuration is ignored when ReverseProxy recognizes a response as a streaming response;\nfor such responses, writes are flushed to the client immediately.\nDefault: 100ms", + type: "string" + } + }, + type: "object" + }, + scheme: { + description: "Scheme defines the scheme to use for the request to the upstream Kubernetes Service.\nIt defaults to https when Kubernetes Service port is 443, http otherwise.", + type: "string" + }, + serversTransport: { + description: "ServersTransport defines the name of ServersTransport resource to use.\nIt allows to configure the transport between Traefik and your servers.\nCan only be used on a Kubernetes Service.", + type: "string" + }, + sticky: { + description: "Sticky defines the sticky sessions configuration.\nMore info: https://doc.traefik.io/traefik/v3.3/routing/services/#sticky-sessions", + properties: { + cookie: { + description: "Cookie defines the sticky cookie configuration.", + properties: { + httpOnly: { + description: "HTTPOnly defines whether the cookie can be accessed by client-side APIs, such as JavaScript.", + type: "boolean" + }, + maxAge: { + description: "MaxAge defines the number of seconds until the cookie expires.\nWhen set to a negative number, the cookie expires immediately.\nWhen set to zero, the cookie never expires.", + type: "integer" + }, + name: { + description: "Name defines the Cookie name.", + type: "string" + }, + path: { + description: "Path defines the path that must exist in the requested URL for the browser to send the Cookie header.\nWhen not provided the cookie will be sent on every request to the domain.\nMore info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#pathpath-value", + type: "string" + }, + sameSite: { + description: "SameSite defines the same site policy.\nMore info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite", + type: "string" + }, + secure: { + description: "Secure defines whether the cookie can only be transmitted over an encrypted connection (i.e. HTTPS).", + type: "boolean" + } + }, + type: "object" + } + }, + type: "object" + }, + strategy: { + description: "Strategy defines the load balancing strategy between the servers.\nRoundRobin is the only supported value at the moment.", + type: "string" + }, + weight: { + description: "Weight defines the weight and should only be specified when Name references a TraefikService object\n(and to be precise, one that embeds a Weighted Round Robin).", + type: "integer" + } + }, + required: ["name"], + type: "object" + }, + type: "array" + }, + syntax: { + description: "Syntax defines the router's rule syntax.\nMore info: https://doc.traefik.io/traefik/v3.3/routing/routers/#rulesyntax", + type: "string" + } + }, + required: ["match"], + type: "object" + }, + type: "array" + }, + tls: { + description: "TLS defines the TLS configuration.\nMore info: https://doc.traefik.io/traefik/v3.3/routing/routers/#tls", + properties: { + certResolver: { + description: "CertResolver defines the name of the certificate resolver to use.\nCert resolvers have to be configured in the static configuration.\nMore info: https://doc.traefik.io/traefik/v3.3/https/acme/#certificate-resolvers", + type: "string" + }, + domains: { + description: "Domains defines the list of domains that will be used to issue certificates.\nMore info: https://doc.traefik.io/traefik/v3.3/routing/routers/#domains", + items: { + description: "Domain holds a domain name with SANs.", + properties: { + main: { + description: "Main defines the main domain name.", + type: "string" + }, + sans: { + description: "SANs defines the subject alternative domain names.", + items: { + type: "string" + }, + type: "array" + } + }, + type: "object" + }, + type: "array" + }, + options: { + description: "Options defines the reference to a TLSOption, that specifies the parameters of the TLS connection.\nIf not defined, the `default` TLSOption is used.\nMore info: https://doc.traefik.io/traefik/v3.3/https/tls/#tls-options", + properties: { + name: { + description: "Name defines the name of the referenced TLSOption.\nMore info: https://doc.traefik.io/traefik/v3.3/routing/providers/kubernetes-crd/#kind-tlsoption", + type: "string" + }, + namespace: { + description: "Namespace defines the namespace of the referenced TLSOption.\nMore info: https://doc.traefik.io/traefik/v3.3/routing/providers/kubernetes-crd/#kind-tlsoption", + type: "string" + } + }, + required: ["name"], + type: "object" + }, + secretName: { + description: "SecretName is the name of the referenced Kubernetes Secret to specify the certificate details.", + type: "string" + }, + store: { + description: "Store defines the reference to the TLSStore, that will be used to store certificates.\nPlease note that only `default` TLSStore can be used.", + properties: { + name: { + description: "Name defines the name of the referenced TLSStore.\nMore info: https://doc.traefik.io/traefik/v3.3/routing/providers/kubernetes-crd/#kind-tlsstore", + type: "string" + }, + namespace: { + description: "Namespace defines the namespace of the referenced TLSStore.\nMore info: https://doc.traefik.io/traefik/v3.3/routing/providers/kubernetes-crd/#kind-tlsstore", + type: "string" + } + }, + required: ["name"], + type: "object" + } + }, + type: "object" + } + }, + required: ["routes"], + type: "object" + } + }, + required: ["metadata", "spec"], + type: "object" + } + }, + served: true, + storage: true + }] + } +}; +export const CustomResourceDefinition_IngressroutetcpsTraefikIo: KubernetesResource = { + apiVersion: "apiextensions.k8s.io/v1", + kind: "CustomResourceDefinition", + metadata: { + annotations: { + "controller-gen.kubebuilder.io/version": "v0.16.1" + }, + name: "ingressroutetcps.traefik.io" + }, + spec: { + group: "traefik.io", + names: { + kind: "IngressRouteTCP", + listKind: "IngressRouteTCPList", + plural: "ingressroutetcps", + singular: "ingressroutetcp" + }, + scope: "Namespaced", + versions: [{ + name: "v1alpha1", + schema: { + openAPIV3Schema: { + description: "IngressRouteTCP is the CRD implementation of a Traefik TCP Router.", + properties: { + apiVersion: { + description: "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", + type: "string" + }, + kind: { + description: "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + type: "string" + }, + metadata: { + type: "object" + }, + spec: { + description: "IngressRouteTCPSpec defines the desired state of IngressRouteTCP.", + properties: { + entryPoints: { + description: "EntryPoints defines the list of entry point names to bind to.\nEntry points have to be configured in the static configuration.\nMore info: https://doc.traefik.io/traefik/v3.3/routing/entrypoints/\nDefault: all.", + items: { + type: "string" + }, + type: "array" + }, + routes: { + description: "Routes defines the list of routes.", + items: { + description: "RouteTCP holds the TCP route configuration.", + properties: { + match: { + description: "Match defines the router's rule.\nMore info: https://doc.traefik.io/traefik/v3.3/routing/routers/#rule_1", + type: "string" + }, + middlewares: { + description: "Middlewares defines the list of references to MiddlewareTCP resources.", + items: { + description: "ObjectReference is a generic reference to a Traefik resource.", + properties: { + name: { + description: "Name defines the name of the referenced Traefik resource.", + type: "string" + }, + namespace: { + description: "Namespace defines the namespace of the referenced Traefik resource.", + type: "string" + } + }, + required: ["name"], + type: "object" + }, + type: "array" + }, + priority: { + description: "Priority defines the router's priority.\nMore info: https://doc.traefik.io/traefik/v3.3/routing/routers/#priority_1", + type: "integer" + }, + services: { + description: "Services defines the list of TCP services.", + items: { + description: "ServiceTCP defines an upstream TCP service to proxy traffic to.", + properties: { + name: { + description: "Name defines the name of the referenced Kubernetes Service.", + type: "string" + }, + namespace: { + description: "Namespace defines the namespace of the referenced Kubernetes Service.", + type: "string" + }, + nativeLB: { + description: "NativeLB controls, when creating the load-balancer,\nwhether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP.\nThe Kubernetes Service itself does load-balance to the pods.\nBy default, NativeLB is false.", + type: "boolean" + }, + nodePortLB: { + description: "NodePortLB controls, when creating the load-balancer,\nwhether the LB's children are directly the nodes internal IPs using the nodePort when the service type is NodePort.\nIt allows services to be reachable when Traefik runs externally from the Kubernetes cluster but within the same network of the nodes.\nBy default, NodePortLB is false.", + type: "boolean" + }, + port: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Port defines the port of a Kubernetes Service.\nThis can be a reference to a named port.", + "x-kubernetes-int-or-string": true + }, + proxyProtocol: { + description: "ProxyProtocol defines the PROXY protocol configuration.\nMore info: https://doc.traefik.io/traefik/v3.3/routing/services/#proxy-protocol", + properties: { + version: { + description: "Version defines the PROXY Protocol version to use.", + type: "integer" + } + }, + type: "object" + }, + serversTransport: { + description: "ServersTransport defines the name of ServersTransportTCP resource to use.\nIt allows to configure the transport between Traefik and your servers.\nCan only be used on a Kubernetes Service.", + type: "string" + }, + terminationDelay: { + description: "TerminationDelay defines the deadline that the proxy sets, after one of its connected peers indicates\nit has closed the writing capability of its connection, to close the reading capability as well,\nhence fully terminating the connection.\nIt is a duration in milliseconds, defaulting to 100.\nA negative value means an infinite deadline (i.e. the reading capability is never closed).\nDeprecated: TerminationDelay will not be supported in future APIVersions, please use ServersTransport to configure the TerminationDelay instead.", + type: "integer" + }, + tls: { + description: "TLS determines whether to use TLS when dialing with the backend.", + type: "boolean" + }, + weight: { + description: "Weight defines the weight used when balancing requests between multiple Kubernetes Service.", + type: "integer" + } + }, + required: ["name", "port"], + type: "object" + }, + type: "array" + }, + syntax: { + description: "Syntax defines the router's rule syntax.\nMore info: https://doc.traefik.io/traefik/v3.3/routing/routers/#rulesyntax_1", + type: "string" + } + }, + required: ["match"], + type: "object" + }, + type: "array" + }, + tls: { + description: "TLS defines the TLS configuration on a layer 4 / TCP Route.\nMore info: https://doc.traefik.io/traefik/v3.3/routing/routers/#tls_1", + properties: { + certResolver: { + description: "CertResolver defines the name of the certificate resolver to use.\nCert resolvers have to be configured in the static configuration.\nMore info: https://doc.traefik.io/traefik/v3.3/https/acme/#certificate-resolvers", + type: "string" + }, + domains: { + description: "Domains defines the list of domains that will be used to issue certificates.\nMore info: https://doc.traefik.io/traefik/v3.3/routing/routers/#domains", + items: { + description: "Domain holds a domain name with SANs.", + properties: { + main: { + description: "Main defines the main domain name.", + type: "string" + }, + sans: { + description: "SANs defines the subject alternative domain names.", + items: { + type: "string" + }, + type: "array" + } + }, + type: "object" + }, + type: "array" + }, + options: { + description: "Options defines the reference to a TLSOption, that specifies the parameters of the TLS connection.\nIf not defined, the `default` TLSOption is used.\nMore info: https://doc.traefik.io/traefik/v3.3/https/tls/#tls-options", + properties: { + name: { + description: "Name defines the name of the referenced Traefik resource.", + type: "string" + }, + namespace: { + description: "Namespace defines the namespace of the referenced Traefik resource.", + type: "string" + } + }, + required: ["name"], + type: "object" + }, + passthrough: { + description: "Passthrough defines whether a TLS router will terminate the TLS connection.", + type: "boolean" + }, + secretName: { + description: "SecretName is the name of the referenced Kubernetes Secret to specify the certificate details.", + type: "string" + }, + store: { + description: "Store defines the reference to the TLSStore, that will be used to store certificates.\nPlease note that only `default` TLSStore can be used.", + properties: { + name: { + description: "Name defines the name of the referenced Traefik resource.", + type: "string" + }, + namespace: { + description: "Namespace defines the namespace of the referenced Traefik resource.", + type: "string" + } + }, + required: ["name"], + type: "object" + } + }, + type: "object" + } + }, + required: ["routes"], + type: "object" + } + }, + required: ["metadata", "spec"], + type: "object" + } + }, + served: true, + storage: true + }] + } +}; +export const CustomResourceDefinition_IngressrouteudpsTraefikIo: KubernetesResource = { + apiVersion: "apiextensions.k8s.io/v1", + kind: "CustomResourceDefinition", + metadata: { + annotations: { + "controller-gen.kubebuilder.io/version": "v0.16.1" + }, + name: "ingressrouteudps.traefik.io" + }, + spec: { + group: "traefik.io", + names: { + kind: "IngressRouteUDP", + listKind: "IngressRouteUDPList", + plural: "ingressrouteudps", + singular: "ingressrouteudp" + }, + scope: "Namespaced", + versions: [{ + name: "v1alpha1", + schema: { + openAPIV3Schema: { + description: "IngressRouteUDP is a CRD implementation of a Traefik UDP Router.", + properties: { + apiVersion: { + description: "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", + type: "string" + }, + kind: { + description: "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + type: "string" + }, + metadata: { + type: "object" + }, + spec: { + description: "IngressRouteUDPSpec defines the desired state of a IngressRouteUDP.", + properties: { + entryPoints: { + description: "EntryPoints defines the list of entry point names to bind to.\nEntry points have to be configured in the static configuration.\nMore info: https://doc.traefik.io/traefik/v3.3/routing/entrypoints/\nDefault: all.", + items: { + type: "string" + }, + type: "array" + }, + routes: { + description: "Routes defines the list of routes.", + items: { + description: "RouteUDP holds the UDP route configuration.", + properties: { + services: { + description: "Services defines the list of UDP services.", + items: { + description: "ServiceUDP defines an upstream UDP service to proxy traffic to.", + properties: { + name: { + description: "Name defines the name of the referenced Kubernetes Service.", + type: "string" + }, + namespace: { + description: "Namespace defines the namespace of the referenced Kubernetes Service.", + type: "string" + }, + nativeLB: { + description: "NativeLB controls, when creating the load-balancer,\nwhether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP.\nThe Kubernetes Service itself does load-balance to the pods.\nBy default, NativeLB is false.", + type: "boolean" + }, + nodePortLB: { + description: "NodePortLB controls, when creating the load-balancer,\nwhether the LB's children are directly the nodes internal IPs using the nodePort when the service type is NodePort.\nIt allows services to be reachable when Traefik runs externally from the Kubernetes cluster but within the same network of the nodes.\nBy default, NodePortLB is false.", + type: "boolean" + }, + port: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Port defines the port of a Kubernetes Service.\nThis can be a reference to a named port.", + "x-kubernetes-int-or-string": true + }, + weight: { + description: "Weight defines the weight used when balancing requests between multiple Kubernetes Service.", + type: "integer" + } + }, + required: ["name", "port"], + type: "object" + }, + type: "array" + } + }, + type: "object" + }, + type: "array" + } + }, + required: ["routes"], + type: "object" + } + }, + required: ["metadata", "spec"], + type: "object" + } + }, + served: true, + storage: true + }] + } +}; +export const CustomResourceDefinition_MiddlewaresTraefikIo: KubernetesResource = { + apiVersion: "apiextensions.k8s.io/v1", + kind: "CustomResourceDefinition", + metadata: { + annotations: { + "controller-gen.kubebuilder.io/version": "v0.16.1" + }, + name: "middlewares.traefik.io" + }, + spec: { + group: "traefik.io", + names: { + kind: "Middleware", + listKind: "MiddlewareList", + plural: "middlewares", + singular: "middleware" + }, + scope: "Namespaced", + versions: [{ + name: "v1alpha1", + schema: { + openAPIV3Schema: { + description: "Middleware is the CRD implementation of a Traefik Middleware.\nMore info: https://doc.traefik.io/traefik/v3.3/middlewares/http/overview/", + properties: { + apiVersion: { + description: "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", + type: "string" + }, + kind: { + description: "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + type: "string" + }, + metadata: { + type: "object" + }, + spec: { + description: "MiddlewareSpec defines the desired state of a Middleware.", + properties: { + addPrefix: { + description: "AddPrefix holds the add prefix middleware configuration.\nThis middleware updates the path of a request before forwarding it.\nMore info: https://doc.traefik.io/traefik/v3.3/middlewares/http/addprefix/", + properties: { + prefix: { + description: "Prefix is the string to add before the current path in the requested URL.\nIt should include a leading slash (/).", + type: "string" + } + }, + type: "object" + }, + basicAuth: { + description: "BasicAuth holds the basic auth middleware configuration.\nThis middleware restricts access to your services to known users.\nMore info: https://doc.traefik.io/traefik/v3.3/middlewares/http/basicauth/", + properties: { + headerField: { + description: "HeaderField defines a header field to store the authenticated user.\nMore info: https://doc.traefik.io/traefik/v3.3/middlewares/http/basicauth/#headerfield", + type: "string" + }, + realm: { + description: "Realm allows the protected resources on a server to be partitioned into a set of protection spaces, each with its own authentication scheme.\nDefault: traefik.", + type: "string" + }, + removeHeader: { + description: "RemoveHeader sets the removeHeader option to true to remove the authorization header before forwarding the request to your service.\nDefault: false.", + type: "boolean" + }, + secret: { + description: "Secret is the name of the referenced Kubernetes Secret containing user credentials.", + type: "string" + } + }, + type: "object" + }, + buffering: { + description: "Buffering holds the buffering middleware configuration.\nThis middleware retries or limits the size of requests that can be forwarded to backends.\nMore info: https://doc.traefik.io/traefik/v3.3/middlewares/http/buffering/#maxrequestbodybytes", + properties: { + maxRequestBodyBytes: { + description: "MaxRequestBodyBytes defines the maximum allowed body size for the request (in bytes).\nIf the request exceeds the allowed size, it is not forwarded to the service, and the client gets a 413 (Request Entity Too Large) response.\nDefault: 0 (no maximum).", + format: "int64", + type: "integer" + }, + maxResponseBodyBytes: { + description: "MaxResponseBodyBytes defines the maximum allowed response size from the service (in bytes).\nIf the response exceeds the allowed size, it is not forwarded to the client. The client gets a 500 (Internal Server Error) response instead.\nDefault: 0 (no maximum).", + format: "int64", + type: "integer" + }, + memRequestBodyBytes: { + description: "MemRequestBodyBytes defines the threshold (in bytes) from which the request will be buffered on disk instead of in memory.\nDefault: 1048576 (1Mi).", + format: "int64", + type: "integer" + }, + memResponseBodyBytes: { + description: "MemResponseBodyBytes defines the threshold (in bytes) from which the response will be buffered on disk instead of in memory.\nDefault: 1048576 (1Mi).", + format: "int64", + type: "integer" + }, + retryExpression: { + description: "RetryExpression defines the retry conditions.\nIt is a logical combination of functions with operators AND (&&) and OR (||).\nMore info: https://doc.traefik.io/traefik/v3.3/middlewares/http/buffering/#retryexpression", + type: "string" + } + }, + type: "object" + }, + chain: { + description: "Chain holds the configuration of the chain middleware.\nThis middleware enables to define reusable combinations of other pieces of middleware.\nMore info: https://doc.traefik.io/traefik/v3.3/middlewares/http/chain/", + properties: { + middlewares: { + description: "Middlewares is the list of MiddlewareRef which composes the chain.", + items: { + description: "MiddlewareRef is a reference to a Middleware resource.", + properties: { + name: { + description: "Name defines the name of the referenced Middleware resource.", + type: "string" + }, + namespace: { + description: "Namespace defines the namespace of the referenced Middleware resource.", + type: "string" + } + }, + required: ["name"], + type: "object" + }, + type: "array" + } + }, + type: "object" + }, + circuitBreaker: { + description: "CircuitBreaker holds the circuit breaker configuration.", + properties: { + checkPeriod: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "CheckPeriod is the interval between successive checks of the circuit breaker condition (when in standby state).", + "x-kubernetes-int-or-string": true + }, + expression: { + description: "Expression is the condition that triggers the tripped state.", + type: "string" + }, + fallbackDuration: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "FallbackDuration is the duration for which the circuit breaker will wait before trying to recover (from a tripped state).", + "x-kubernetes-int-or-string": true + }, + recoveryDuration: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "RecoveryDuration is the duration for which the circuit breaker will try to recover (as soon as it is in recovering state).", + "x-kubernetes-int-or-string": true + }, + responseCode: { + description: "ResponseCode is the status code that the circuit breaker will return while it is in the open state.", + type: "integer" + } + }, + type: "object" + }, + compress: { + description: "Compress holds the compress middleware configuration.\nThis middleware compresses responses before sending them to the client, using gzip, brotli, or zstd compression.\nMore info: https://doc.traefik.io/traefik/v3.3/middlewares/http/compress/", + properties: { + defaultEncoding: { + description: "DefaultEncoding specifies the default encoding if the `Accept-Encoding` header is not in the request or contains a wildcard (`*`).", + type: "string" + }, + encodings: { + description: "Encodings defines the list of supported compression algorithms.", + items: { + type: "string" + }, + type: "array" + }, + excludedContentTypes: { + description: "ExcludedContentTypes defines the list of content types to compare the Content-Type header of the incoming requests and responses before compressing.\n`application/grpc` is always excluded.", + items: { + type: "string" + }, + type: "array" + }, + includedContentTypes: { + description: "IncludedContentTypes defines the list of content types to compare the Content-Type header of the responses before compressing.", + items: { + type: "string" + }, + type: "array" + }, + minResponseBodyBytes: { + description: "MinResponseBodyBytes defines the minimum amount of bytes a response body must have to be compressed.\nDefault: 1024.", + type: "integer" + } + }, + type: "object" + }, + contentType: { + description: "ContentType holds the content-type middleware configuration.\nThis middleware exists to enable the correct behavior until at least the default one can be changed in a future version.", + properties: { + autoDetect: { + description: "AutoDetect specifies whether to let the `Content-Type` header, if it has not been set by the backend,\nbe automatically set to a value derived from the contents of the response.\nDeprecated: AutoDetect option is deprecated, Content-Type middleware is only meant to be used to enable the content-type detection, please remove any usage of this option.", + type: "boolean" + } + }, + type: "object" + }, + digestAuth: { + description: "DigestAuth holds the digest auth middleware configuration.\nThis middleware restricts access to your services to known users.\nMore info: https://doc.traefik.io/traefik/v3.3/middlewares/http/digestauth/", + properties: { + headerField: { + description: "HeaderField defines a header field to store the authenticated user.\nMore info: https://doc.traefik.io/traefik/v3.3/middlewares/http/basicauth/#headerfield", + type: "string" + }, + realm: { + description: "Realm allows the protected resources on a server to be partitioned into a set of protection spaces, each with its own authentication scheme.\nDefault: traefik.", + type: "string" + }, + removeHeader: { + description: "RemoveHeader defines whether to remove the authorization header before forwarding the request to the backend.", + type: "boolean" + }, + secret: { + description: "Secret is the name of the referenced Kubernetes Secret containing user credentials.", + type: "string" + } + }, + type: "object" + }, + errors: { + description: "ErrorPage holds the custom error middleware configuration.\nThis middleware returns a custom page in lieu of the default, according to configured ranges of HTTP Status codes.\nMore info: https://doc.traefik.io/traefik/v3.3/middlewares/http/errorpages/", + properties: { + query: { + description: "Query defines the URL for the error page (hosted by service).\nThe {status} variable can be used in order to insert the status code in the URL.", + type: "string" + }, + service: { + description: "Service defines the reference to a Kubernetes Service that will serve the error page.\nMore info: https://doc.traefik.io/traefik/v3.3/middlewares/http/errorpages/#service", + properties: { + healthCheck: { + description: "Healthcheck defines health checks for ExternalName services.", + properties: { + followRedirects: { + description: "FollowRedirects defines whether redirects should be followed during the health check calls.\nDefault: true", + type: "boolean" + }, + headers: { + additionalProperties: { + type: "string" + }, + description: "Headers defines custom headers to be sent to the health check endpoint.", + type: "object" + }, + hostname: { + description: "Hostname defines the value of hostname in the Host header of the health check request.", + type: "string" + }, + interval: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Interval defines the frequency of the health check calls.\nDefault: 30s", + "x-kubernetes-int-or-string": true + }, + method: { + description: "Method defines the healthcheck method.", + type: "string" + }, + mode: { + description: "Mode defines the health check mode.\nIf defined to grpc, will use the gRPC health check protocol to probe the server.\nDefault: http", + type: "string" + }, + path: { + description: "Path defines the server URL path for the health check endpoint.", + type: "string" + }, + port: { + description: "Port defines the server URL port for the health check endpoint.", + type: "integer" + }, + scheme: { + description: "Scheme replaces the server URL scheme for the health check endpoint.", + type: "string" + }, + status: { + description: "Status defines the expected HTTP status code of the response to the health check request.", + type: "integer" + }, + timeout: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Timeout defines the maximum duration Traefik will wait for a health check request before considering the server unhealthy.\nDefault: 5s", + "x-kubernetes-int-or-string": true + } + }, + type: "object" + }, + kind: { + description: "Kind defines the kind of the Service.", + enum: ["Service", "TraefikService"], + type: "string" + }, + name: { + description: "Name defines the name of the referenced Kubernetes Service or TraefikService.\nThe differentiation between the two is specified in the Kind field.", + type: "string" + }, + namespace: { + description: "Namespace defines the namespace of the referenced Kubernetes Service or TraefikService.", + type: "string" + }, + nativeLB: { + description: "NativeLB controls, when creating the load-balancer,\nwhether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP.\nThe Kubernetes Service itself does load-balance to the pods.\nBy default, NativeLB is false.", + type: "boolean" + }, + nodePortLB: { + description: "NodePortLB controls, when creating the load-balancer,\nwhether the LB's children are directly the nodes internal IPs using the nodePort when the service type is NodePort.\nIt allows services to be reachable when Traefik runs externally from the Kubernetes cluster but within the same network of the nodes.\nBy default, NodePortLB is false.", + type: "boolean" + }, + passHostHeader: { + description: "PassHostHeader defines whether the client Host header is forwarded to the upstream Kubernetes Service.\nBy default, passHostHeader is true.", + type: "boolean" + }, + port: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Port defines the port of a Kubernetes Service.\nThis can be a reference to a named port.", + "x-kubernetes-int-or-string": true + }, + responseForwarding: { + description: "ResponseForwarding defines how Traefik forwards the response from the upstream Kubernetes Service to the client.", + properties: { + flushInterval: { + description: "FlushInterval defines the interval, in milliseconds, in between flushes to the client while copying the response body.\nA negative value means to flush immediately after each write to the client.\nThis configuration is ignored when ReverseProxy recognizes a response as a streaming response;\nfor such responses, writes are flushed to the client immediately.\nDefault: 100ms", + type: "string" + } + }, + type: "object" + }, + scheme: { + description: "Scheme defines the scheme to use for the request to the upstream Kubernetes Service.\nIt defaults to https when Kubernetes Service port is 443, http otherwise.", + type: "string" + }, + serversTransport: { + description: "ServersTransport defines the name of ServersTransport resource to use.\nIt allows to configure the transport between Traefik and your servers.\nCan only be used on a Kubernetes Service.", + type: "string" + }, + sticky: { + description: "Sticky defines the sticky sessions configuration.\nMore info: https://doc.traefik.io/traefik/v3.3/routing/services/#sticky-sessions", + properties: { + cookie: { + description: "Cookie defines the sticky cookie configuration.", + properties: { + httpOnly: { + description: "HTTPOnly defines whether the cookie can be accessed by client-side APIs, such as JavaScript.", + type: "boolean" + }, + maxAge: { + description: "MaxAge defines the number of seconds until the cookie expires.\nWhen set to a negative number, the cookie expires immediately.\nWhen set to zero, the cookie never expires.", + type: "integer" + }, + name: { + description: "Name defines the Cookie name.", + type: "string" + }, + path: { + description: "Path defines the path that must exist in the requested URL for the browser to send the Cookie header.\nWhen not provided the cookie will be sent on every request to the domain.\nMore info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#pathpath-value", + type: "string" + }, + sameSite: { + description: "SameSite defines the same site policy.\nMore info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite", + type: "string" + }, + secure: { + description: "Secure defines whether the cookie can only be transmitted over an encrypted connection (i.e. HTTPS).", + type: "boolean" + } + }, + type: "object" + } + }, + type: "object" + }, + strategy: { + description: "Strategy defines the load balancing strategy between the servers.\nRoundRobin is the only supported value at the moment.", + type: "string" + }, + weight: { + description: "Weight defines the weight and should only be specified when Name references a TraefikService object\n(and to be precise, one that embeds a Weighted Round Robin).", + type: "integer" + } + }, + required: ["name"], + type: "object" + }, + status: { + description: "Status defines which status or range of statuses should result in an error page.\nIt can be either a status code as a number (500),\nas multiple comma-separated numbers (500,502),\nas ranges by separating two codes with a dash (500-599),\nor a combination of the two (404,418,500-599).", + items: { + type: "string" + }, + type: "array" + } + }, + type: "object" + }, + forwardAuth: { + description: "ForwardAuth holds the forward auth middleware configuration.\nThis middleware delegates the request authentication to a Service.\nMore info: https://doc.traefik.io/traefik/v3.3/middlewares/http/forwardauth/", + properties: { + addAuthCookiesToResponse: { + description: "AddAuthCookiesToResponse defines the list of cookies to copy from the authentication server response to the response.", + items: { + type: "string" + }, + type: "array" + }, + address: { + description: "Address defines the authentication server address.", + type: "string" + }, + authRequestHeaders: { + description: "AuthRequestHeaders defines the list of the headers to copy from the request to the authentication server.\nIf not set or empty then all request headers are passed.", + items: { + type: "string" + }, + type: "array" + }, + authResponseHeaders: { + description: "AuthResponseHeaders defines the list of headers to copy from the authentication server response and set on forwarded request, replacing any existing conflicting headers.", + items: { + type: "string" + }, + type: "array" + }, + authResponseHeadersRegex: { + description: "AuthResponseHeadersRegex defines the regex to match headers to copy from the authentication server response and set on forwarded request, after stripping all headers that match the regex.\nMore info: https://doc.traefik.io/traefik/v3.3/middlewares/http/forwardauth/#authresponseheadersregex", + type: "string" + }, + forwardBody: { + description: "ForwardBody defines whether to send the request body to the authentication server.", + type: "boolean" + }, + headerField: { + description: "HeaderField defines a header field to store the authenticated user.\nMore info: https://doc.traefik.io/traefik/v3.3/middlewares/http/forwardauth/#headerfield", + type: "string" + }, + maxBodySize: { + description: "MaxBodySize defines the maximum body size in bytes allowed to be forwarded to the authentication server.", + format: "int64", + type: "integer" + }, + preserveLocationHeader: { + description: "PreserveLocationHeader defines whether to forward the Location header to the client as is or prefix it with the domain name of the authentication server.", + type: "boolean" + }, + tls: { + description: "TLS defines the configuration used to secure the connection to the authentication server.", + properties: { + caOptional: { + description: "Deprecated: TLS client authentication is a server side option (see https://github.com/golang/go/blob/740a490f71d026bb7d2d13cb8fa2d6d6e0572b70/src/crypto/tls/common.go#L634).", + type: "boolean" + }, + caSecret: { + description: "CASecret is the name of the referenced Kubernetes Secret containing the CA to validate the server certificate.\nThe CA certificate is extracted from key `tls.ca` or `ca.crt`.", + type: "string" + }, + certSecret: { + description: "CertSecret is the name of the referenced Kubernetes Secret containing the client certificate.\nThe client certificate is extracted from the keys `tls.crt` and `tls.key`.", + type: "string" + }, + insecureSkipVerify: { + description: "InsecureSkipVerify defines whether the server certificates should be validated.", + type: "boolean" + } + }, + type: "object" + }, + trustForwardHeader: { + description: "TrustForwardHeader defines whether to trust (ie: forward) all X-Forwarded-* headers.", + type: "boolean" + } + }, + type: "object" + }, + grpcWeb: { + description: "GrpcWeb holds the gRPC web middleware configuration.\nThis middleware converts a gRPC web request to an HTTP/2 gRPC request.", + properties: { + allowOrigins: { + description: "AllowOrigins is a list of allowable origins.\nCan also be a wildcard origin \"*\".", + items: { + type: "string" + }, + type: "array" + } + }, + type: "object" + }, + headers: { + description: "Headers holds the headers middleware configuration.\nThis middleware manages the requests and responses headers.\nMore info: https://doc.traefik.io/traefik/v3.3/middlewares/http/headers/#customrequestheaders", + properties: { + accessControlAllowCredentials: { + description: "AccessControlAllowCredentials defines whether the request can include user credentials.", + type: "boolean" + }, + accessControlAllowHeaders: { + description: "AccessControlAllowHeaders defines the Access-Control-Request-Headers values sent in preflight response.", + items: { + type: "string" + }, + type: "array" + }, + accessControlAllowMethods: { + description: "AccessControlAllowMethods defines the Access-Control-Request-Method values sent in preflight response.", + items: { + type: "string" + }, + type: "array" + }, + accessControlAllowOriginList: { + description: "AccessControlAllowOriginList is a list of allowable origins. Can also be a wildcard origin \"*\".", + items: { + type: "string" + }, + type: "array" + }, + accessControlAllowOriginListRegex: { + description: "AccessControlAllowOriginListRegex is a list of allowable origins written following the Regular Expression syntax (https://golang.org/pkg/regexp/).", + items: { + type: "string" + }, + type: "array" + }, + accessControlExposeHeaders: { + description: "AccessControlExposeHeaders defines the Access-Control-Expose-Headers values sent in preflight response.", + items: { + type: "string" + }, + type: "array" + }, + accessControlMaxAge: { + description: "AccessControlMaxAge defines the time that a preflight request may be cached.", + format: "int64", + type: "integer" + }, + addVaryHeader: { + description: "AddVaryHeader defines whether the Vary header is automatically added/updated when the AccessControlAllowOriginList is set.", + type: "boolean" + }, + allowedHosts: { + description: "AllowedHosts defines the fully qualified list of allowed domain names.", + items: { + type: "string" + }, + type: "array" + }, + browserXssFilter: { + description: "BrowserXSSFilter defines whether to add the X-XSS-Protection header with the value 1; mode=block.", + type: "boolean" + }, + contentSecurityPolicy: { + description: "ContentSecurityPolicy defines the Content-Security-Policy header value.", + type: "string" + }, + contentSecurityPolicyReportOnly: { + description: "ContentSecurityPolicyReportOnly defines the Content-Security-Policy-Report-Only header value.", + type: "string" + }, + contentTypeNosniff: { + description: "ContentTypeNosniff defines whether to add the X-Content-Type-Options header with the nosniff value.", + type: "boolean" + }, + customBrowserXSSValue: { + description: "CustomBrowserXSSValue defines the X-XSS-Protection header value.\nThis overrides the BrowserXssFilter option.", + type: "string" + }, + customFrameOptionsValue: { + description: "CustomFrameOptionsValue defines the X-Frame-Options header value.\nThis overrides the FrameDeny option.", + type: "string" + }, + customRequestHeaders: { + additionalProperties: { + type: "string" + }, + description: "CustomRequestHeaders defines the header names and values to apply to the request.", + type: "object" + }, + customResponseHeaders: { + additionalProperties: { + type: "string" + }, + description: "CustomResponseHeaders defines the header names and values to apply to the response.", + type: "object" + }, + featurePolicy: { + description: "Deprecated: FeaturePolicy option is deprecated, please use PermissionsPolicy instead.", + type: "string" + }, + forceSTSHeader: { + description: "ForceSTSHeader defines whether to add the STS header even when the connection is HTTP.", + type: "boolean" + }, + frameDeny: { + description: "FrameDeny defines whether to add the X-Frame-Options header with the DENY value.", + type: "boolean" + }, + hostsProxyHeaders: { + description: "HostsProxyHeaders defines the header keys that may hold a proxied hostname value for the request.", + items: { + type: "string" + }, + type: "array" + }, + isDevelopment: { + description: "IsDevelopment defines whether to mitigate the unwanted effects of the AllowedHosts, SSL, and STS options when developing.\nUsually testing takes place using HTTP, not HTTPS, and on localhost, not your production domain.\nIf you would like your development environment to mimic production with complete Host blocking, SSL redirects,\nand STS headers, leave this as false.", + type: "boolean" + }, + permissionsPolicy: { + description: "PermissionsPolicy defines the Permissions-Policy header value.\nThis allows sites to control browser features.", + type: "string" + }, + publicKey: { + description: "PublicKey is the public key that implements HPKP to prevent MITM attacks with forged certificates.", + type: "string" + }, + referrerPolicy: { + description: "ReferrerPolicy defines the Referrer-Policy header value.\nThis allows sites to control whether browsers forward the Referer header to other sites.", + type: "string" + }, + sslForceHost: { + description: "Deprecated: SSLForceHost option is deprecated, please use RedirectRegex instead.", + type: "boolean" + }, + sslHost: { + description: "Deprecated: SSLHost option is deprecated, please use RedirectRegex instead.", + type: "string" + }, + sslProxyHeaders: { + additionalProperties: { + type: "string" + }, + description: "SSLProxyHeaders defines the header keys with associated values that would indicate a valid HTTPS request.\nIt can be useful when using other proxies (example: \"X-Forwarded-Proto\": \"https\").", + type: "object" + }, + sslRedirect: { + description: "Deprecated: SSLRedirect option is deprecated, please use EntryPoint redirection or RedirectScheme instead.", + type: "boolean" + }, + sslTemporaryRedirect: { + description: "Deprecated: SSLTemporaryRedirect option is deprecated, please use EntryPoint redirection or RedirectScheme instead.", + type: "boolean" + }, + stsIncludeSubdomains: { + description: "STSIncludeSubdomains defines whether the includeSubDomains directive is appended to the Strict-Transport-Security header.", + type: "boolean" + }, + stsPreload: { + description: "STSPreload defines whether the preload flag is appended to the Strict-Transport-Security header.", + type: "boolean" + }, + stsSeconds: { + description: "STSSeconds defines the max-age of the Strict-Transport-Security header.\nIf set to 0, the header is not set.", + format: "int64", + type: "integer" + } + }, + type: "object" + }, + inFlightReq: { + description: "InFlightReq holds the in-flight request middleware configuration.\nThis middleware limits the number of requests being processed and served concurrently.\nMore info: https://doc.traefik.io/traefik/v3.3/middlewares/http/inflightreq/", + properties: { + amount: { + description: "Amount defines the maximum amount of allowed simultaneous in-flight request.\nThe middleware responds with HTTP 429 Too Many Requests if there are already amount requests in progress (based on the same sourceCriterion strategy).", + format: "int64", + type: "integer" + }, + sourceCriterion: { + description: "SourceCriterion defines what criterion is used to group requests as originating from a common source.\nIf several strategies are defined at the same time, an error will be raised.\nIf none are set, the default is to use the requestHost.\nMore info: https://doc.traefik.io/traefik/v3.3/middlewares/http/inflightreq/#sourcecriterion", + properties: { + ipStrategy: { + description: "IPStrategy holds the IP strategy configuration used by Traefik to determine the client IP.\nMore info: https://doc.traefik.io/traefik/v3.3/middlewares/http/ipallowlist/#ipstrategy", + properties: { + depth: { + description: "Depth tells Traefik to use the X-Forwarded-For header and take the IP located at the depth position (starting from the right).", + type: "integer" + }, + excludedIPs: { + description: "ExcludedIPs configures Traefik to scan the X-Forwarded-For header and select the first IP not in the list.", + items: { + type: "string" + }, + type: "array" + }, + ipv6Subnet: { + description: "IPv6Subnet configures Traefik to consider all IPv6 addresses from the defined subnet as originating from the same IP. Applies to RemoteAddrStrategy and DepthStrategy.", + type: "integer" + } + }, + type: "object" + }, + requestHeaderName: { + description: "RequestHeaderName defines the name of the header used to group incoming requests.", + type: "string" + }, + requestHost: { + description: "RequestHost defines whether to consider the request Host as the source.", + type: "boolean" + } + }, + type: "object" + } + }, + type: "object" + }, + ipAllowList: { + description: "IPAllowList holds the IP allowlist middleware configuration.\nThis middleware limits allowed requests based on the client IP.\nMore info: https://doc.traefik.io/traefik/v3.3/middlewares/http/ipallowlist/", + properties: { + ipStrategy: { + description: "IPStrategy holds the IP strategy configuration used by Traefik to determine the client IP.\nMore info: https://doc.traefik.io/traefik/v3.3/middlewares/http/ipallowlist/#ipstrategy", + properties: { + depth: { + description: "Depth tells Traefik to use the X-Forwarded-For header and take the IP located at the depth position (starting from the right).", + type: "integer" + }, + excludedIPs: { + description: "ExcludedIPs configures Traefik to scan the X-Forwarded-For header and select the first IP not in the list.", + items: { + type: "string" + }, + type: "array" + }, + ipv6Subnet: { + description: "IPv6Subnet configures Traefik to consider all IPv6 addresses from the defined subnet as originating from the same IP. Applies to RemoteAddrStrategy and DepthStrategy.", + type: "integer" + } + }, + type: "object" + }, + rejectStatusCode: { + description: "RejectStatusCode defines the HTTP status code used for refused requests.\nIf not set, the default is 403 (Forbidden).", + type: "integer" + }, + sourceRange: { + description: "SourceRange defines the set of allowed IPs (or ranges of allowed IPs by using CIDR notation).", + items: { + type: "string" + }, + type: "array" + } + }, + type: "object" + }, + ipWhiteList: { + description: "Deprecated: please use IPAllowList instead.", + properties: { + ipStrategy: { + description: "IPStrategy holds the IP strategy configuration used by Traefik to determine the client IP.\nMore info: https://doc.traefik.io/traefik/v3.3/middlewares/http/ipallowlist/#ipstrategy", + properties: { + depth: { + description: "Depth tells Traefik to use the X-Forwarded-For header and take the IP located at the depth position (starting from the right).", + type: "integer" + }, + excludedIPs: { + description: "ExcludedIPs configures Traefik to scan the X-Forwarded-For header and select the first IP not in the list.", + items: { + type: "string" + }, + type: "array" + }, + ipv6Subnet: { + description: "IPv6Subnet configures Traefik to consider all IPv6 addresses from the defined subnet as originating from the same IP. Applies to RemoteAddrStrategy and DepthStrategy.", + type: "integer" + } + }, + type: "object" + }, + sourceRange: { + description: "SourceRange defines the set of allowed IPs (or ranges of allowed IPs by using CIDR notation). Required.", + items: { + type: "string" + }, + type: "array" + } + }, + type: "object" + }, + passTLSClientCert: { + description: "PassTLSClientCert holds the pass TLS client cert middleware configuration.\nThis middleware adds the selected data from the passed client TLS certificate to a header.\nMore info: https://doc.traefik.io/traefik/v3.3/middlewares/http/passtlsclientcert/", + properties: { + info: { + description: "Info selects the specific client certificate details you want to add to the X-Forwarded-Tls-Client-Cert-Info header.", + properties: { + issuer: { + description: "Issuer defines the client certificate issuer details to add to the X-Forwarded-Tls-Client-Cert-Info header.", + properties: { + commonName: { + description: "CommonName defines whether to add the organizationalUnit information into the issuer.", + type: "boolean" + }, + country: { + description: "Country defines whether to add the country information into the issuer.", + type: "boolean" + }, + domainComponent: { + description: "DomainComponent defines whether to add the domainComponent information into the issuer.", + type: "boolean" + }, + locality: { + description: "Locality defines whether to add the locality information into the issuer.", + type: "boolean" + }, + organization: { + description: "Organization defines whether to add the organization information into the issuer.", + type: "boolean" + }, + province: { + description: "Province defines whether to add the province information into the issuer.", + type: "boolean" + }, + serialNumber: { + description: "SerialNumber defines whether to add the serialNumber information into the issuer.", + type: "boolean" + } + }, + type: "object" + }, + notAfter: { + description: "NotAfter defines whether to add the Not After information from the Validity part.", + type: "boolean" + }, + notBefore: { + description: "NotBefore defines whether to add the Not Before information from the Validity part.", + type: "boolean" + }, + sans: { + description: "Sans defines whether to add the Subject Alternative Name information from the Subject Alternative Name part.", + type: "boolean" + }, + serialNumber: { + description: "SerialNumber defines whether to add the client serialNumber information.", + type: "boolean" + }, + subject: { + description: "Subject defines the client certificate subject details to add to the X-Forwarded-Tls-Client-Cert-Info header.", + properties: { + commonName: { + description: "CommonName defines whether to add the organizationalUnit information into the subject.", + type: "boolean" + }, + country: { + description: "Country defines whether to add the country information into the subject.", + type: "boolean" + }, + domainComponent: { + description: "DomainComponent defines whether to add the domainComponent information into the subject.", + type: "boolean" + }, + locality: { + description: "Locality defines whether to add the locality information into the subject.", + type: "boolean" + }, + organization: { + description: "Organization defines whether to add the organization information into the subject.", + type: "boolean" + }, + organizationalUnit: { + description: "OrganizationalUnit defines whether to add the organizationalUnit information into the subject.", + type: "boolean" + }, + province: { + description: "Province defines whether to add the province information into the subject.", + type: "boolean" + }, + serialNumber: { + description: "SerialNumber defines whether to add the serialNumber information into the subject.", + type: "boolean" + } + }, + type: "object" + } + }, + type: "object" + }, + pem: { + description: "PEM sets the X-Forwarded-Tls-Client-Cert header with the certificate.", + type: "boolean" + } + }, + type: "object" + }, + plugin: { + additionalProperties: { + "x-kubernetes-preserve-unknown-fields": true + }, + description: "Plugin defines the middleware plugin configuration.\nMore info: https://doc.traefik.io/traefik/plugins/", + type: "object" + }, + rateLimit: { + description: "RateLimit holds the rate limit configuration.\nThis middleware ensures that services will receive a fair amount of requests, and allows one to define what fair is.\nMore info: https://doc.traefik.io/traefik/v3.3/middlewares/http/ratelimit/", + properties: { + average: { + description: "Average is the maximum rate, by default in requests/s, allowed for the given source.\nIt defaults to 0, which means no rate limiting.\nThe rate is actually defined by dividing Average by Period. So for a rate below 1req/s,\none needs to define a Period larger than a second.", + format: "int64", + type: "integer" + }, + burst: { + description: "Burst is the maximum number of requests allowed to arrive in the same arbitrarily small period of time.\nIt defaults to 1.", + format: "int64", + type: "integer" + }, + period: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Period, in combination with Average, defines the actual maximum rate, such as:\nr = Average / Period. It defaults to a second.", + "x-kubernetes-int-or-string": true + }, + sourceCriterion: { + description: "SourceCriterion defines what criterion is used to group requests as originating from a common source.\nIf several strategies are defined at the same time, an error will be raised.\nIf none are set, the default is to use the request's remote address field (as an ipStrategy).", + properties: { + ipStrategy: { + description: "IPStrategy holds the IP strategy configuration used by Traefik to determine the client IP.\nMore info: https://doc.traefik.io/traefik/v3.3/middlewares/http/ipallowlist/#ipstrategy", + properties: { + depth: { + description: "Depth tells Traefik to use the X-Forwarded-For header and take the IP located at the depth position (starting from the right).", + type: "integer" + }, + excludedIPs: { + description: "ExcludedIPs configures Traefik to scan the X-Forwarded-For header and select the first IP not in the list.", + items: { + type: "string" + }, + type: "array" + }, + ipv6Subnet: { + description: "IPv6Subnet configures Traefik to consider all IPv6 addresses from the defined subnet as originating from the same IP. Applies to RemoteAddrStrategy and DepthStrategy.", + type: "integer" + } + }, + type: "object" + }, + requestHeaderName: { + description: "RequestHeaderName defines the name of the header used to group incoming requests.", + type: "string" + }, + requestHost: { + description: "RequestHost defines whether to consider the request Host as the source.", + type: "boolean" + } + }, + type: "object" + } + }, + type: "object" + }, + redirectRegex: { + description: "RedirectRegex holds the redirect regex middleware configuration.\nThis middleware redirects a request using regex matching and replacement.\nMore info: https://doc.traefik.io/traefik/v3.3/middlewares/http/redirectregex/#regex", + properties: { + permanent: { + description: "Permanent defines whether the redirection is permanent (301).", + type: "boolean" + }, + regex: { + description: "Regex defines the regex used to match and capture elements from the request URL.", + type: "string" + }, + replacement: { + description: "Replacement defines how to modify the URL to have the new target URL.", + type: "string" + } + }, + type: "object" + }, + redirectScheme: { + description: "RedirectScheme holds the redirect scheme middleware configuration.\nThis middleware redirects requests from a scheme/port to another.\nMore info: https://doc.traefik.io/traefik/v3.3/middlewares/http/redirectscheme/", + properties: { + permanent: { + description: "Permanent defines whether the redirection is permanent (301).", + type: "boolean" + }, + port: { + description: "Port defines the port of the new URL.", + type: "string" + }, + scheme: { + description: "Scheme defines the scheme of the new URL.", + type: "string" + } + }, + type: "object" + }, + replacePath: { + description: "ReplacePath holds the replace path middleware configuration.\nThis middleware replaces the path of the request URL and store the original path in an X-Replaced-Path header.\nMore info: https://doc.traefik.io/traefik/v3.3/middlewares/http/replacepath/", + properties: { + path: { + description: "Path defines the path to use as replacement in the request URL.", + type: "string" + } + }, + type: "object" + }, + replacePathRegex: { + description: "ReplacePathRegex holds the replace path regex middleware configuration.\nThis middleware replaces the path of a URL using regex matching and replacement.\nMore info: https://doc.traefik.io/traefik/v3.3/middlewares/http/replacepathregex/", + properties: { + regex: { + description: "Regex defines the regular expression used to match and capture the path from the request URL.", + type: "string" + }, + replacement: { + description: "Replacement defines the replacement path format, which can include captured variables.", + type: "string" + } + }, + type: "object" + }, + retry: { + description: "Retry holds the retry middleware configuration.\nThis middleware reissues requests a given number of times to a backend server if that server does not reply.\nAs soon as the server answers, the middleware stops retrying, regardless of the response status.\nMore info: https://doc.traefik.io/traefik/v3.3/middlewares/http/retry/", + properties: { + attempts: { + description: "Attempts defines how many times the request should be retried.", + type: "integer" + }, + initialInterval: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "InitialInterval defines the first wait time in the exponential backoff series.\nThe maximum interval is calculated as twice the initialInterval.\nIf unspecified, requests will be retried immediately.\nThe value of initialInterval should be provided in seconds or as a valid duration format,\nsee https://pkg.go.dev/time#ParseDuration.", + "x-kubernetes-int-or-string": true + } + }, + type: "object" + }, + stripPrefix: { + description: "StripPrefix holds the strip prefix middleware configuration.\nThis middleware removes the specified prefixes from the URL path.\nMore info: https://doc.traefik.io/traefik/v3.3/middlewares/http/stripprefix/", + properties: { + forceSlash: { + description: "Deprecated: ForceSlash option is deprecated, please remove any usage of this option.\nForceSlash ensures that the resulting stripped path is not the empty string, by replacing it with / when necessary.\nDefault: true.", + type: "boolean" + }, + prefixes: { + description: "Prefixes defines the prefixes to strip from the request URL.", + items: { + type: "string" + }, + type: "array" + } + }, + type: "object" + }, + stripPrefixRegex: { + description: "StripPrefixRegex holds the strip prefix regex middleware configuration.\nThis middleware removes the matching prefixes from the URL path.\nMore info: https://doc.traefik.io/traefik/v3.3/middlewares/http/stripprefixregex/", + properties: { + regex: { + description: "Regex defines the regular expression to match the path prefix from the request URL.", + items: { + type: "string" + }, + type: "array" + } + }, + type: "object" + } + }, + type: "object" + } + }, + required: ["metadata", "spec"], + type: "object" + } + }, + served: true, + storage: true + }] + } +}; +export const CustomResourceDefinition_MiddlewaretcpsTraefikIo: KubernetesResource = { + apiVersion: "apiextensions.k8s.io/v1", + kind: "CustomResourceDefinition", + metadata: { + annotations: { + "controller-gen.kubebuilder.io/version": "v0.16.1" + }, + name: "middlewaretcps.traefik.io" + }, + spec: { + group: "traefik.io", + names: { + kind: "MiddlewareTCP", + listKind: "MiddlewareTCPList", + plural: "middlewaretcps", + singular: "middlewaretcp" + }, + scope: "Namespaced", + versions: [{ + name: "v1alpha1", + schema: { + openAPIV3Schema: { + description: "MiddlewareTCP is the CRD implementation of a Traefik TCP middleware.\nMore info: https://doc.traefik.io/traefik/v3.3/middlewares/overview/", + properties: { + apiVersion: { + description: "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", + type: "string" + }, + kind: { + description: "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + type: "string" + }, + metadata: { + type: "object" + }, + spec: { + description: "MiddlewareTCPSpec defines the desired state of a MiddlewareTCP.", + properties: { + inFlightConn: { + description: "InFlightConn defines the InFlightConn middleware configuration.", + properties: { + amount: { + description: "Amount defines the maximum amount of allowed simultaneous connections.\nThe middleware closes the connection if there are already amount connections opened.", + format: "int64", + type: "integer" + } + }, + type: "object" + }, + ipAllowList: { + description: "IPAllowList defines the IPAllowList middleware configuration.\nThis middleware accepts/refuses connections based on the client IP.\nMore info: https://doc.traefik.io/traefik/v3.3/middlewares/tcp/ipallowlist/", + properties: { + sourceRange: { + description: "SourceRange defines the allowed IPs (or ranges of allowed IPs by using CIDR notation).", + items: { + type: "string" + }, + type: "array" + } + }, + type: "object" + }, + ipWhiteList: { + description: "IPWhiteList defines the IPWhiteList middleware configuration.\nThis middleware accepts/refuses connections based on the client IP.\nDeprecated: please use IPAllowList instead.\nMore info: https://doc.traefik.io/traefik/v3.3/middlewares/tcp/ipwhitelist/", + properties: { + sourceRange: { + description: "SourceRange defines the allowed IPs (or ranges of allowed IPs by using CIDR notation).", + items: { + type: "string" + }, + type: "array" + } + }, + type: "object" + } + }, + type: "object" + } + }, + required: ["metadata", "spec"], + type: "object" + } + }, + served: true, + storage: true + }] + } +}; +export const CustomResourceDefinition_ServerstransportsTraefikIo: KubernetesResource = { + apiVersion: "apiextensions.k8s.io/v1", + kind: "CustomResourceDefinition", + metadata: { + annotations: { + "controller-gen.kubebuilder.io/version": "v0.16.1" + }, + name: "serverstransports.traefik.io" + }, + spec: { + group: "traefik.io", + names: { + kind: "ServersTransport", + listKind: "ServersTransportList", + plural: "serverstransports", + singular: "serverstransport" + }, + scope: "Namespaced", + versions: [{ + name: "v1alpha1", + schema: { + openAPIV3Schema: { + description: "ServersTransport is the CRD implementation of a ServersTransport.\nIf no serversTransport is specified, the default@internal will be used.\nThe default@internal serversTransport is created from the static configuration.\nMore info: https://doc.traefik.io/traefik/v3.3/routing/services/#serverstransport_1", + properties: { + apiVersion: { + description: "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", + type: "string" + }, + kind: { + description: "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + type: "string" + }, + metadata: { + type: "object" + }, + spec: { + description: "ServersTransportSpec defines the desired state of a ServersTransport.", + properties: { + certificatesSecrets: { + description: "CertificatesSecrets defines a list of secret storing client certificates for mTLS.", + items: { + type: "string" + }, + type: "array" + }, + disableHTTP2: { + description: "DisableHTTP2 disables HTTP/2 for connections with backend servers.", + type: "boolean" + }, + forwardingTimeouts: { + description: "ForwardingTimeouts defines the timeouts for requests forwarded to the backend servers.", + properties: { + dialTimeout: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "DialTimeout is the amount of time to wait until a connection to a backend server can be established.", + "x-kubernetes-int-or-string": true + }, + idleConnTimeout: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "IdleConnTimeout is the maximum period for which an idle HTTP keep-alive connection will remain open before closing itself.", + "x-kubernetes-int-or-string": true + }, + pingTimeout: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "PingTimeout is the timeout after which the HTTP/2 connection will be closed if a response to ping is not received.", + "x-kubernetes-int-or-string": true + }, + readIdleTimeout: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "ReadIdleTimeout is the timeout after which a health check using ping frame will be carried out if no frame is received on the HTTP/2 connection.", + "x-kubernetes-int-or-string": true + }, + responseHeaderTimeout: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "ResponseHeaderTimeout is the amount of time to wait for a server's response headers after fully writing the request (including its body, if any).", + "x-kubernetes-int-or-string": true + } + }, + type: "object" + }, + insecureSkipVerify: { + description: "InsecureSkipVerify disables SSL certificate verification.", + type: "boolean" + }, + maxIdleConnsPerHost: { + description: "MaxIdleConnsPerHost controls the maximum idle (keep-alive) to keep per-host.", + type: "integer" + }, + peerCertURI: { + description: "PeerCertURI defines the peer cert URI used to match against SAN URI during the peer certificate verification.", + type: "string" + }, + rootCAsSecrets: { + description: "RootCAsSecrets defines a list of CA secret used to validate self-signed certificate.", + items: { + type: "string" + }, + type: "array" + }, + serverName: { + description: "ServerName defines the server name used to contact the server.", + type: "string" + }, + spiffe: { + description: "Spiffe defines the SPIFFE configuration.", + properties: { + ids: { + description: "IDs defines the allowed SPIFFE IDs (takes precedence over the SPIFFE TrustDomain).", + items: { + type: "string" + }, + type: "array" + }, + trustDomain: { + description: "TrustDomain defines the allowed SPIFFE trust domain.", + type: "string" + } + }, + type: "object" + } + }, + type: "object" + } + }, + required: ["metadata", "spec"], + type: "object" + } + }, + served: true, + storage: true + }] + } +}; +export const CustomResourceDefinition_ServerstransporttcpsTraefikIo: KubernetesResource = { + apiVersion: "apiextensions.k8s.io/v1", + kind: "CustomResourceDefinition", + metadata: { + annotations: { + "controller-gen.kubebuilder.io/version": "v0.16.1" + }, + name: "serverstransporttcps.traefik.io" + }, + spec: { + group: "traefik.io", + names: { + kind: "ServersTransportTCP", + listKind: "ServersTransportTCPList", + plural: "serverstransporttcps", + singular: "serverstransporttcp" + }, + scope: "Namespaced", + versions: [{ + name: "v1alpha1", + schema: { + openAPIV3Schema: { + description: "ServersTransportTCP is the CRD implementation of a TCPServersTransport.\nIf no tcpServersTransport is specified, a default one named default@internal will be used.\nThe default@internal tcpServersTransport can be configured in the static configuration.\nMore info: https://doc.traefik.io/traefik/v3.3/routing/services/#serverstransport_3", + properties: { + apiVersion: { + description: "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", + type: "string" + }, + kind: { + description: "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + type: "string" + }, + metadata: { + type: "object" + }, + spec: { + description: "ServersTransportTCPSpec defines the desired state of a ServersTransportTCP.", + properties: { + dialKeepAlive: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "DialKeepAlive is the interval between keep-alive probes for an active network connection. If zero, keep-alive probes are sent with a default value (currently 15 seconds), if supported by the protocol and operating system. Network protocols or operating systems that do not support keep-alives ignore this field. If negative, keep-alive probes are disabled.", + "x-kubernetes-int-or-string": true + }, + dialTimeout: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "DialTimeout is the amount of time to wait until a connection to a backend server can be established.", + "x-kubernetes-int-or-string": true + }, + terminationDelay: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "TerminationDelay defines the delay to wait before fully terminating the connection, after one connected peer has closed its writing capability.", + "x-kubernetes-int-or-string": true + }, + tls: { + description: "TLS defines the TLS configuration", + properties: { + certificatesSecrets: { + description: "CertificatesSecrets defines a list of secret storing client certificates for mTLS.", + items: { + type: "string" + }, + type: "array" + }, + insecureSkipVerify: { + description: "InsecureSkipVerify disables TLS certificate verification.", + type: "boolean" + }, + peerCertURI: { + description: "MaxIdleConnsPerHost controls the maximum idle (keep-alive) to keep per-host.\nPeerCertURI defines the peer cert URI used to match against SAN URI during the peer certificate verification.", + type: "string" + }, + rootCAsSecrets: { + description: "RootCAsSecrets defines a list of CA secret used to validate self-signed certificates.", + items: { + type: "string" + }, + type: "array" + }, + serverName: { + description: "ServerName defines the server name used to contact the server.", + type: "string" + }, + spiffe: { + description: "Spiffe defines the SPIFFE configuration.", + properties: { + ids: { + description: "IDs defines the allowed SPIFFE IDs (takes precedence over the SPIFFE TrustDomain).", + items: { + type: "string" + }, + type: "array" + }, + trustDomain: { + description: "TrustDomain defines the allowed SPIFFE trust domain.", + type: "string" + } + }, + type: "object" + } + }, + type: "object" + } + }, + type: "object" + } + }, + required: ["metadata", "spec"], + type: "object" + } + }, + served: true, + storage: true + }] + } +}; +export const CustomResourceDefinition_TlsoptionsTraefikIo: KubernetesResource = { + apiVersion: "apiextensions.k8s.io/v1", + kind: "CustomResourceDefinition", + metadata: { + annotations: { + "controller-gen.kubebuilder.io/version": "v0.16.1" + }, + name: "tlsoptions.traefik.io" + }, + spec: { + group: "traefik.io", + names: { + kind: "TLSOption", + listKind: "TLSOptionList", + plural: "tlsoptions", + singular: "tlsoption" + }, + scope: "Namespaced", + versions: [{ + name: "v1alpha1", + schema: { + openAPIV3Schema: { + description: "TLSOption is the CRD implementation of a Traefik TLS Option, allowing to configure some parameters of the TLS connection.\nMore info: https://doc.traefik.io/traefik/v3.3/https/tls/#tls-options", + properties: { + apiVersion: { + description: "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", + type: "string" + }, + kind: { + description: "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + type: "string" + }, + metadata: { + type: "object" + }, + spec: { + description: "TLSOptionSpec defines the desired state of a TLSOption.", + properties: { + alpnProtocols: { + description: "ALPNProtocols defines the list of supported application level protocols for the TLS handshake, in order of preference.\nMore info: https://doc.traefik.io/traefik/v3.3/https/tls/#alpn-protocols", + items: { + type: "string" + }, + type: "array" + }, + cipherSuites: { + description: "CipherSuites defines the list of supported cipher suites for TLS versions up to TLS 1.2.\nMore info: https://doc.traefik.io/traefik/v3.3/https/tls/#cipher-suites", + items: { + type: "string" + }, + type: "array" + }, + clientAuth: { + description: "ClientAuth defines the server's policy for TLS Client Authentication.", + properties: { + clientAuthType: { + description: "ClientAuthType defines the client authentication type to apply.", + enum: ["NoClientCert", "RequestClientCert", "RequireAnyClientCert", "VerifyClientCertIfGiven", "RequireAndVerifyClientCert"], + type: "string" + }, + secretNames: { + description: "SecretNames defines the names of the referenced Kubernetes Secret storing certificate details.", + items: { + type: "string" + }, + type: "array" + } + }, + type: "object" + }, + curvePreferences: { + description: "CurvePreferences defines the preferred elliptic curves in a specific order.\nMore info: https://doc.traefik.io/traefik/v3.3/https/tls/#curve-preferences", + items: { + type: "string" + }, + type: "array" + }, + maxVersion: { + description: "MaxVersion defines the maximum TLS version that Traefik will accept.\nPossible values: VersionTLS10, VersionTLS11, VersionTLS12, VersionTLS13.\nDefault: None.", + type: "string" + }, + minVersion: { + description: "MinVersion defines the minimum TLS version that Traefik will accept.\nPossible values: VersionTLS10, VersionTLS11, VersionTLS12, VersionTLS13.\nDefault: VersionTLS10.", + type: "string" + }, + preferServerCipherSuites: { + description: "PreferServerCipherSuites defines whether the server chooses a cipher suite among his own instead of among the client's.\nIt is enabled automatically when minVersion or maxVersion is set.\nDeprecated: https://github.com/golang/go/issues/45430", + type: "boolean" + }, + sniStrict: { + description: "SniStrict defines whether Traefik allows connections from clients connections that do not specify a server_name extension.", + type: "boolean" + } + }, + type: "object" + } + }, + required: ["metadata", "spec"], + type: "object" + } + }, + served: true, + storage: true + }] + } +}; +export const CustomResourceDefinition_TlsstoresTraefikIo: KubernetesResource = { + apiVersion: "apiextensions.k8s.io/v1", + kind: "CustomResourceDefinition", + metadata: { + annotations: { + "controller-gen.kubebuilder.io/version": "v0.16.1" + }, + name: "tlsstores.traefik.io" + }, + spec: { + group: "traefik.io", + names: { + kind: "TLSStore", + listKind: "TLSStoreList", + plural: "tlsstores", + singular: "tlsstore" + }, + scope: "Namespaced", + versions: [{ + name: "v1alpha1", + schema: { + openAPIV3Schema: { + description: "TLSStore is the CRD implementation of a Traefik TLS Store.\nFor the time being, only the TLSStore named default is supported.\nThis means that you cannot have two stores that are named default in different Kubernetes namespaces.\nMore info: https://doc.traefik.io/traefik/v3.3/https/tls/#certificates-stores", + properties: { + apiVersion: { + description: "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", + type: "string" + }, + kind: { + description: "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + type: "string" + }, + metadata: { + type: "object" + }, + spec: { + description: "TLSStoreSpec defines the desired state of a TLSStore.", + properties: { + certificates: { + description: "Certificates is a list of secret names, each secret holding a key/certificate pair to add to the store.", + items: { + description: "Certificate holds a secret name for the TLSStore resource.", + properties: { + secretName: { + description: "SecretName is the name of the referenced Kubernetes Secret to specify the certificate details.", + type: "string" + } + }, + required: ["secretName"], + type: "object" + }, + type: "array" + }, + defaultCertificate: { + description: "DefaultCertificate defines the default certificate configuration.", + properties: { + secretName: { + description: "SecretName is the name of the referenced Kubernetes Secret to specify the certificate details.", + type: "string" + } + }, + required: ["secretName"], + type: "object" + }, + defaultGeneratedCert: { + description: "DefaultGeneratedCert defines the default generated certificate configuration.", + properties: { + domain: { + description: "Domain is the domain definition for the DefaultCertificate.", + properties: { + main: { + description: "Main defines the main domain name.", + type: "string" + }, + sans: { + description: "SANs defines the subject alternative domain names.", + items: { + type: "string" + }, + type: "array" + } + }, + type: "object" + }, + resolver: { + description: "Resolver is the name of the resolver that will be used to issue the DefaultCertificate.", + type: "string" + } + }, + type: "object" + } + }, + type: "object" + } + }, + required: ["metadata", "spec"], + type: "object" + } + }, + served: true, + storage: true + }] + } +}; +export const CustomResourceDefinition_TraefikservicesTraefikIo: KubernetesResource = { + apiVersion: "apiextensions.k8s.io/v1", + kind: "CustomResourceDefinition", + metadata: { + annotations: { + "controller-gen.kubebuilder.io/version": "v0.16.1" + }, + name: "traefikservices.traefik.io" + }, + spec: { + group: "traefik.io", + names: { + kind: "TraefikService", + listKind: "TraefikServiceList", + plural: "traefikservices", + singular: "traefikservice" + }, + scope: "Namespaced", + versions: [{ + name: "v1alpha1", + schema: { + openAPIV3Schema: { + description: "TraefikService is the CRD implementation of a Traefik Service.\nTraefikService object allows to:\n- Apply weight to Services on load-balancing\n- Mirror traffic on services\nMore info: https://doc.traefik.io/traefik/v3.3/routing/providers/kubernetes-crd/#kind-traefikservice", + properties: { + apiVersion: { + description: "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", + type: "string" + }, + kind: { + description: "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + type: "string" + }, + metadata: { + type: "object" + }, + spec: { + description: "TraefikServiceSpec defines the desired state of a TraefikService.", + properties: { + mirroring: { + description: "Mirroring defines the Mirroring service configuration.", + properties: { + healthCheck: { + description: "Healthcheck defines health checks for ExternalName services.", + properties: { + followRedirects: { + description: "FollowRedirects defines whether redirects should be followed during the health check calls.\nDefault: true", + type: "boolean" + }, + headers: { + additionalProperties: { + type: "string" + }, + description: "Headers defines custom headers to be sent to the health check endpoint.", + type: "object" + }, + hostname: { + description: "Hostname defines the value of hostname in the Host header of the health check request.", + type: "string" + }, + interval: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Interval defines the frequency of the health check calls.\nDefault: 30s", + "x-kubernetes-int-or-string": true + }, + method: { + description: "Method defines the healthcheck method.", + type: "string" + }, + mode: { + description: "Mode defines the health check mode.\nIf defined to grpc, will use the gRPC health check protocol to probe the server.\nDefault: http", + type: "string" + }, + path: { + description: "Path defines the server URL path for the health check endpoint.", + type: "string" + }, + port: { + description: "Port defines the server URL port for the health check endpoint.", + type: "integer" + }, + scheme: { + description: "Scheme replaces the server URL scheme for the health check endpoint.", + type: "string" + }, + status: { + description: "Status defines the expected HTTP status code of the response to the health check request.", + type: "integer" + }, + timeout: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Timeout defines the maximum duration Traefik will wait for a health check request before considering the server unhealthy.\nDefault: 5s", + "x-kubernetes-int-or-string": true + } + }, + type: "object" + }, + kind: { + description: "Kind defines the kind of the Service.", + enum: ["Service", "TraefikService"], + type: "string" + }, + maxBodySize: { + description: "MaxBodySize defines the maximum size allowed for the body of the request.\nIf the body is larger, the request is not mirrored.\nDefault value is -1, which means unlimited size.", + format: "int64", + type: "integer" + }, + mirrorBody: { + description: "MirrorBody defines whether the body of the request should be mirrored.\nDefault value is true.", + type: "boolean" + }, + mirrors: { + description: "Mirrors defines the list of mirrors where Traefik will duplicate the traffic.", + items: { + description: "MirrorService holds the mirror configuration.", + properties: { + healthCheck: { + description: "Healthcheck defines health checks for ExternalName services.", + properties: { + followRedirects: { + description: "FollowRedirects defines whether redirects should be followed during the health check calls.\nDefault: true", + type: "boolean" + }, + headers: { + additionalProperties: { + type: "string" + }, + description: "Headers defines custom headers to be sent to the health check endpoint.", + type: "object" + }, + hostname: { + description: "Hostname defines the value of hostname in the Host header of the health check request.", + type: "string" + }, + interval: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Interval defines the frequency of the health check calls.\nDefault: 30s", + "x-kubernetes-int-or-string": true + }, + method: { + description: "Method defines the healthcheck method.", + type: "string" + }, + mode: { + description: "Mode defines the health check mode.\nIf defined to grpc, will use the gRPC health check protocol to probe the server.\nDefault: http", + type: "string" + }, + path: { + description: "Path defines the server URL path for the health check endpoint.", + type: "string" + }, + port: { + description: "Port defines the server URL port for the health check endpoint.", + type: "integer" + }, + scheme: { + description: "Scheme replaces the server URL scheme for the health check endpoint.", + type: "string" + }, + status: { + description: "Status defines the expected HTTP status code of the response to the health check request.", + type: "integer" + }, + timeout: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Timeout defines the maximum duration Traefik will wait for a health check request before considering the server unhealthy.\nDefault: 5s", + "x-kubernetes-int-or-string": true + } + }, + type: "object" + }, + kind: { + description: "Kind defines the kind of the Service.", + enum: ["Service", "TraefikService"], + type: "string" + }, + name: { + description: "Name defines the name of the referenced Kubernetes Service or TraefikService.\nThe differentiation between the two is specified in the Kind field.", + type: "string" + }, + namespace: { + description: "Namespace defines the namespace of the referenced Kubernetes Service or TraefikService.", + type: "string" + }, + nativeLB: { + description: "NativeLB controls, when creating the load-balancer,\nwhether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP.\nThe Kubernetes Service itself does load-balance to the pods.\nBy default, NativeLB is false.", + type: "boolean" + }, + nodePortLB: { + description: "NodePortLB controls, when creating the load-balancer,\nwhether the LB's children are directly the nodes internal IPs using the nodePort when the service type is NodePort.\nIt allows services to be reachable when Traefik runs externally from the Kubernetes cluster but within the same network of the nodes.\nBy default, NodePortLB is false.", + type: "boolean" + }, + passHostHeader: { + description: "PassHostHeader defines whether the client Host header is forwarded to the upstream Kubernetes Service.\nBy default, passHostHeader is true.", + type: "boolean" + }, + percent: { + description: "Percent defines the part of the traffic to mirror.\nSupported values: 0 to 100.", + type: "integer" + }, + port: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Port defines the port of a Kubernetes Service.\nThis can be a reference to a named port.", + "x-kubernetes-int-or-string": true + }, + responseForwarding: { + description: "ResponseForwarding defines how Traefik forwards the response from the upstream Kubernetes Service to the client.", + properties: { + flushInterval: { + description: "FlushInterval defines the interval, in milliseconds, in between flushes to the client while copying the response body.\nA negative value means to flush immediately after each write to the client.\nThis configuration is ignored when ReverseProxy recognizes a response as a streaming response;\nfor such responses, writes are flushed to the client immediately.\nDefault: 100ms", + type: "string" + } + }, + type: "object" + }, + scheme: { + description: "Scheme defines the scheme to use for the request to the upstream Kubernetes Service.\nIt defaults to https when Kubernetes Service port is 443, http otherwise.", + type: "string" + }, + serversTransport: { + description: "ServersTransport defines the name of ServersTransport resource to use.\nIt allows to configure the transport between Traefik and your servers.\nCan only be used on a Kubernetes Service.", + type: "string" + }, + sticky: { + description: "Sticky defines the sticky sessions configuration.\nMore info: https://doc.traefik.io/traefik/v3.3/routing/services/#sticky-sessions", + properties: { + cookie: { + description: "Cookie defines the sticky cookie configuration.", + properties: { + httpOnly: { + description: "HTTPOnly defines whether the cookie can be accessed by client-side APIs, such as JavaScript.", + type: "boolean" + }, + maxAge: { + description: "MaxAge defines the number of seconds until the cookie expires.\nWhen set to a negative number, the cookie expires immediately.\nWhen set to zero, the cookie never expires.", + type: "integer" + }, + name: { + description: "Name defines the Cookie name.", + type: "string" + }, + path: { + description: "Path defines the path that must exist in the requested URL for the browser to send the Cookie header.\nWhen not provided the cookie will be sent on every request to the domain.\nMore info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#pathpath-value", + type: "string" + }, + sameSite: { + description: "SameSite defines the same site policy.\nMore info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite", + type: "string" + }, + secure: { + description: "Secure defines whether the cookie can only be transmitted over an encrypted connection (i.e. HTTPS).", + type: "boolean" + } + }, + type: "object" + } + }, + type: "object" + }, + strategy: { + description: "Strategy defines the load balancing strategy between the servers.\nRoundRobin is the only supported value at the moment.", + type: "string" + }, + weight: { + description: "Weight defines the weight and should only be specified when Name references a TraefikService object\n(and to be precise, one that embeds a Weighted Round Robin).", + type: "integer" + } + }, + required: ["name"], + type: "object" + }, + type: "array" + }, + name: { + description: "Name defines the name of the referenced Kubernetes Service or TraefikService.\nThe differentiation between the two is specified in the Kind field.", + type: "string" + }, + namespace: { + description: "Namespace defines the namespace of the referenced Kubernetes Service or TraefikService.", + type: "string" + }, + nativeLB: { + description: "NativeLB controls, when creating the load-balancer,\nwhether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP.\nThe Kubernetes Service itself does load-balance to the pods.\nBy default, NativeLB is false.", + type: "boolean" + }, + nodePortLB: { + description: "NodePortLB controls, when creating the load-balancer,\nwhether the LB's children are directly the nodes internal IPs using the nodePort when the service type is NodePort.\nIt allows services to be reachable when Traefik runs externally from the Kubernetes cluster but within the same network of the nodes.\nBy default, NodePortLB is false.", + type: "boolean" + }, + passHostHeader: { + description: "PassHostHeader defines whether the client Host header is forwarded to the upstream Kubernetes Service.\nBy default, passHostHeader is true.", + type: "boolean" + }, + port: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Port defines the port of a Kubernetes Service.\nThis can be a reference to a named port.", + "x-kubernetes-int-or-string": true + }, + responseForwarding: { + description: "ResponseForwarding defines how Traefik forwards the response from the upstream Kubernetes Service to the client.", + properties: { + flushInterval: { + description: "FlushInterval defines the interval, in milliseconds, in between flushes to the client while copying the response body.\nA negative value means to flush immediately after each write to the client.\nThis configuration is ignored when ReverseProxy recognizes a response as a streaming response;\nfor such responses, writes are flushed to the client immediately.\nDefault: 100ms", + type: "string" + } + }, + type: "object" + }, + scheme: { + description: "Scheme defines the scheme to use for the request to the upstream Kubernetes Service.\nIt defaults to https when Kubernetes Service port is 443, http otherwise.", + type: "string" + }, + serversTransport: { + description: "ServersTransport defines the name of ServersTransport resource to use.\nIt allows to configure the transport between Traefik and your servers.\nCan only be used on a Kubernetes Service.", + type: "string" + }, + sticky: { + description: "Sticky defines the sticky sessions configuration.\nMore info: https://doc.traefik.io/traefik/v3.3/routing/services/#sticky-sessions", + properties: { + cookie: { + description: "Cookie defines the sticky cookie configuration.", + properties: { + httpOnly: { + description: "HTTPOnly defines whether the cookie can be accessed by client-side APIs, such as JavaScript.", + type: "boolean" + }, + maxAge: { + description: "MaxAge defines the number of seconds until the cookie expires.\nWhen set to a negative number, the cookie expires immediately.\nWhen set to zero, the cookie never expires.", + type: "integer" + }, + name: { + description: "Name defines the Cookie name.", + type: "string" + }, + path: { + description: "Path defines the path that must exist in the requested URL for the browser to send the Cookie header.\nWhen not provided the cookie will be sent on every request to the domain.\nMore info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#pathpath-value", + type: "string" + }, + sameSite: { + description: "SameSite defines the same site policy.\nMore info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite", + type: "string" + }, + secure: { + description: "Secure defines whether the cookie can only be transmitted over an encrypted connection (i.e. HTTPS).", + type: "boolean" + } + }, + type: "object" + } + }, + type: "object" + }, + strategy: { + description: "Strategy defines the load balancing strategy between the servers.\nRoundRobin is the only supported value at the moment.", + type: "string" + }, + weight: { + description: "Weight defines the weight and should only be specified when Name references a TraefikService object\n(and to be precise, one that embeds a Weighted Round Robin).", + type: "integer" + } + }, + required: ["name"], + type: "object" + }, + weighted: { + description: "Weighted defines the Weighted Round Robin configuration.", + properties: { + services: { + description: "Services defines the list of Kubernetes Service and/or TraefikService to load-balance, with weight.", + items: { + description: "Service defines an upstream HTTP service to proxy traffic to.", + properties: { + healthCheck: { + description: "Healthcheck defines health checks for ExternalName services.", + properties: { + followRedirects: { + description: "FollowRedirects defines whether redirects should be followed during the health check calls.\nDefault: true", + type: "boolean" + }, + headers: { + additionalProperties: { + type: "string" + }, + description: "Headers defines custom headers to be sent to the health check endpoint.", + type: "object" + }, + hostname: { + description: "Hostname defines the value of hostname in the Host header of the health check request.", + type: "string" + }, + interval: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Interval defines the frequency of the health check calls.\nDefault: 30s", + "x-kubernetes-int-or-string": true + }, + method: { + description: "Method defines the healthcheck method.", + type: "string" + }, + mode: { + description: "Mode defines the health check mode.\nIf defined to grpc, will use the gRPC health check protocol to probe the server.\nDefault: http", + type: "string" + }, + path: { + description: "Path defines the server URL path for the health check endpoint.", + type: "string" + }, + port: { + description: "Port defines the server URL port for the health check endpoint.", + type: "integer" + }, + scheme: { + description: "Scheme replaces the server URL scheme for the health check endpoint.", + type: "string" + }, + status: { + description: "Status defines the expected HTTP status code of the response to the health check request.", + type: "integer" + }, + timeout: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Timeout defines the maximum duration Traefik will wait for a health check request before considering the server unhealthy.\nDefault: 5s", + "x-kubernetes-int-or-string": true + } + }, + type: "object" + }, + kind: { + description: "Kind defines the kind of the Service.", + enum: ["Service", "TraefikService"], + type: "string" + }, + name: { + description: "Name defines the name of the referenced Kubernetes Service or TraefikService.\nThe differentiation between the two is specified in the Kind field.", + type: "string" + }, + namespace: { + description: "Namespace defines the namespace of the referenced Kubernetes Service or TraefikService.", + type: "string" + }, + nativeLB: { + description: "NativeLB controls, when creating the load-balancer,\nwhether the LB's children are directly the pods IPs or if the only child is the Kubernetes Service clusterIP.\nThe Kubernetes Service itself does load-balance to the pods.\nBy default, NativeLB is false.", + type: "boolean" + }, + nodePortLB: { + description: "NodePortLB controls, when creating the load-balancer,\nwhether the LB's children are directly the nodes internal IPs using the nodePort when the service type is NodePort.\nIt allows services to be reachable when Traefik runs externally from the Kubernetes cluster but within the same network of the nodes.\nBy default, NodePortLB is false.", + type: "boolean" + }, + passHostHeader: { + description: "PassHostHeader defines whether the client Host header is forwarded to the upstream Kubernetes Service.\nBy default, passHostHeader is true.", + type: "boolean" + }, + port: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Port defines the port of a Kubernetes Service.\nThis can be a reference to a named port.", + "x-kubernetes-int-or-string": true + }, + responseForwarding: { + description: "ResponseForwarding defines how Traefik forwards the response from the upstream Kubernetes Service to the client.", + properties: { + flushInterval: { + description: "FlushInterval defines the interval, in milliseconds, in between flushes to the client while copying the response body.\nA negative value means to flush immediately after each write to the client.\nThis configuration is ignored when ReverseProxy recognizes a response as a streaming response;\nfor such responses, writes are flushed to the client immediately.\nDefault: 100ms", + type: "string" + } + }, + type: "object" + }, + scheme: { + description: "Scheme defines the scheme to use for the request to the upstream Kubernetes Service.\nIt defaults to https when Kubernetes Service port is 443, http otherwise.", + type: "string" + }, + serversTransport: { + description: "ServersTransport defines the name of ServersTransport resource to use.\nIt allows to configure the transport between Traefik and your servers.\nCan only be used on a Kubernetes Service.", + type: "string" + }, + sticky: { + description: "Sticky defines the sticky sessions configuration.\nMore info: https://doc.traefik.io/traefik/v3.3/routing/services/#sticky-sessions", + properties: { + cookie: { + description: "Cookie defines the sticky cookie configuration.", + properties: { + httpOnly: { + description: "HTTPOnly defines whether the cookie can be accessed by client-side APIs, such as JavaScript.", + type: "boolean" + }, + maxAge: { + description: "MaxAge defines the number of seconds until the cookie expires.\nWhen set to a negative number, the cookie expires immediately.\nWhen set to zero, the cookie never expires.", + type: "integer" + }, + name: { + description: "Name defines the Cookie name.", + type: "string" + }, + path: { + description: "Path defines the path that must exist in the requested URL for the browser to send the Cookie header.\nWhen not provided the cookie will be sent on every request to the domain.\nMore info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#pathpath-value", + type: "string" + }, + sameSite: { + description: "SameSite defines the same site policy.\nMore info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite", + type: "string" + }, + secure: { + description: "Secure defines whether the cookie can only be transmitted over an encrypted connection (i.e. HTTPS).", + type: "boolean" + } + }, + type: "object" + } + }, + type: "object" + }, + strategy: { + description: "Strategy defines the load balancing strategy between the servers.\nRoundRobin is the only supported value at the moment.", + type: "string" + }, + weight: { + description: "Weight defines the weight and should only be specified when Name references a TraefikService object\n(and to be precise, one that embeds a Weighted Round Robin).", + type: "integer" + } + }, + required: ["name"], + type: "object" + }, + type: "array" + }, + sticky: { + description: "Sticky defines whether sticky sessions are enabled.\nMore info: https://doc.traefik.io/traefik/v3.3/routing/providers/kubernetes-crd/#stickiness-and-load-balancing", + properties: { + cookie: { + description: "Cookie defines the sticky cookie configuration.", + properties: { + httpOnly: { + description: "HTTPOnly defines whether the cookie can be accessed by client-side APIs, such as JavaScript.", + type: "boolean" + }, + maxAge: { + description: "MaxAge defines the number of seconds until the cookie expires.\nWhen set to a negative number, the cookie expires immediately.\nWhen set to zero, the cookie never expires.", + type: "integer" + }, + name: { + description: "Name defines the Cookie name.", + type: "string" + }, + path: { + description: "Path defines the path that must exist in the requested URL for the browser to send the Cookie header.\nWhen not provided the cookie will be sent on every request to the domain.\nMore info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#pathpath-value", + type: "string" + }, + sameSite: { + description: "SameSite defines the same site policy.\nMore info: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite", + type: "string" + }, + secure: { + description: "Secure defines whether the cookie can only be transmitted over an encrypted connection (i.e. HTTPS).", + type: "boolean" + } + }, + type: "object" + } + }, + type: "object" + } + }, + type: "object" + } + }, + type: "object" + } + }, + required: ["metadata", "spec"], + type: "object" + } + }, + served: true, + storage: true + }] + } +}; +export const ServiceAccount_Traefik: KubernetesResource = { + apiVersion: "v1", + kind: "ServiceAccount", + metadata: { + annotations: null, + labels: { + "app.kubernetes.io/instance": "traefik-traefik", + "app.kubernetes.io/managed-by": "Helm", + "app.kubernetes.io/name": "traefik", + "helm.sh/chart": "traefik-34.4.1" + }, + name: "traefik", + namespace: "traefik" + }, + automountServiceAccountToken: false +}; +export const ClusterRole_TraefikTraefik: KubernetesResource = { + apiVersion: "rbac.authorization.k8s.io/v1", + kind: "ClusterRole", + metadata: { + labels: { + "app.kubernetes.io/instance": "traefik-traefik", + "app.kubernetes.io/managed-by": "Helm", + "app.kubernetes.io/name": "traefik", + "helm.sh/chart": "traefik-34.4.1" + }, + name: "traefik-traefik" + }, + rules: [{ + apiGroups: [""], + resources: ["nodes"], + verbs: ["get", "list", "watch"] + }, { + apiGroups: [""], + resources: ["services"], + verbs: ["get", "list", "watch"] + }, { + apiGroups: ["discovery.k8s.io"], + resources: ["endpointslices"], + verbs: ["list", "watch"] + }, { + apiGroups: [""], + resources: ["secrets"], + verbs: ["get", "list", "watch"] + }, { + apiGroups: ["extensions", "networking.k8s.io"], + resources: ["ingressclasses", "ingresses"], + verbs: ["get", "list", "watch"] + }, { + apiGroups: ["extensions", "networking.k8s.io"], + resources: ["ingresses/status"], + verbs: ["update"] + }, { + apiGroups: ["traefik.io"], + resources: ["ingressroutes", "ingressroutetcps", "ingressrouteudps", "middlewares", "middlewaretcps", "serverstransports", "serverstransporttcps", "tlsoptions", "tlsstores", "traefikservices"], + verbs: ["get", "list", "watch"] + }] +}; +export const ClusterRoleBinding_TraefikTraefik: KubernetesResource = { + apiVersion: "rbac.authorization.k8s.io/v1", + kind: "ClusterRoleBinding", + metadata: { + labels: { + "app.kubernetes.io/instance": "traefik-traefik", + "app.kubernetes.io/managed-by": "Helm", + "app.kubernetes.io/name": "traefik", + "helm.sh/chart": "traefik-34.4.1" + }, + name: "traefik-traefik" + }, + roleRef: { + apiGroup: "rbac.authorization.k8s.io", + kind: "ClusterRole", + name: "traefik-traefik" + }, + subjects: [{ + kind: "ServiceAccount", + name: "traefik", + namespace: "traefik" + }] +}; +export const Service_Traefik: KubernetesResource = { + apiVersion: "v1", + kind: "Service", + metadata: { + annotations: null, + labels: { + "app.kubernetes.io/instance": "traefik-traefik", + "app.kubernetes.io/managed-by": "Helm", + "app.kubernetes.io/name": "traefik", + "helm.sh/chart": "traefik-34.4.1" + }, + name: "traefik", + namespace: "traefik" + }, + spec: { + ports: [{ + name: "web", + port: 80, + protocol: "TCP", + targetPort: "web" + }, { + name: "websecure", + port: 443, + protocol: "TCP", + targetPort: "websecure" + }], + selector: { + "app.kubernetes.io/instance": "traefik-traefik", + "app.kubernetes.io/name": "traefik" + }, + type: "LoadBalancer" + } +}; +export const Deployment_Traefik: KubernetesResource = { + apiVersion: "apps/v1", + kind: "Deployment", + metadata: { + annotations: null, + labels: { + "app.kubernetes.io/instance": "traefik-traefik", + "app.kubernetes.io/managed-by": "Helm", + "app.kubernetes.io/name": "traefik", + "helm.sh/chart": "traefik-34.4.1" + }, + name: "traefik", + namespace: "traefik" + }, + spec: { + minReadySeconds: 0, + replicas: 1, + selector: { + matchLabels: { + "app.kubernetes.io/instance": "traefik-traefik", + "app.kubernetes.io/name": "traefik" + } + }, + strategy: { + rollingUpdate: { + maxSurge: 1, + maxUnavailable: 0 + }, + type: "RollingUpdate" + }, + template: { + metadata: { + annotations: { + "prometheus.io/path": "/metrics", + "prometheus.io/port": "9100", + "prometheus.io/scrape": "true" + }, + labels: { + "app.kubernetes.io/instance": "traefik-traefik", + "app.kubernetes.io/managed-by": "Helm", + "app.kubernetes.io/name": "traefik", + "helm.sh/chart": "traefik-34.4.1" + } + }, + spec: { + automountServiceAccountToken: true, + containers: [{ + args: ["--global.checknewversion", "--global.sendanonymoususage", "--entryPoints.metrics.address=:9100/tcp", "--entryPoints.traefik.address=:8080/tcp", "--entryPoints.web.address=:8000/tcp", "--entryPoints.websecure.address=:8443/tcp", "--api.dashboard=true", "--ping=true", "--metrics.prometheus=true", "--metrics.prometheus.entrypoint=metrics", "--providers.kubernetescrd", "--providers.kubernetescrd.allowEmptyServices=true", "--providers.kubernetesingress", "--providers.kubernetesingress.allowEmptyServices=true", "--providers.kubernetesingress.ingressendpoint.publishedservice=traefik/traefik", "--entryPoints.websecure.http.tls=true", "--log.level=INFO"], + env: [{ + name: "POD_NAME", + valueFrom: { + fieldRef: { + fieldPath: "metadata.name" + } + } + }, { + name: "POD_NAMESPACE", + valueFrom: { + fieldRef: { + fieldPath: "metadata.namespace" + } + } + }], + image: "docker.io/traefik:v3.3.4", + imagePullPolicy: "IfNotPresent", + lifecycle: null, + livenessProbe: { + failureThreshold: 3, + httpGet: { + path: "/ping", + port: 8080, + scheme: "HTTP" + }, + initialDelaySeconds: 2, + periodSeconds: 10, + successThreshold: 1, + timeoutSeconds: 2 + }, + name: "traefik", + ports: [{ + containerPort: 9100, + name: "metrics", + protocol: "TCP" + }, { + containerPort: 8080, + name: "traefik", + protocol: "TCP" + }, { + containerPort: 8000, + name: "web", + protocol: "TCP" + }, { + containerPort: 8443, + name: "websecure", + protocol: "TCP" + }], + readinessProbe: { + failureThreshold: 1, + httpGet: { + path: "/ping", + port: 8080, + scheme: "HTTP" + }, + initialDelaySeconds: 2, + periodSeconds: 10, + successThreshold: 1, + timeoutSeconds: 2 + }, + resources: null, + securityContext: { + allowPrivilegeEscalation: false, + capabilities: { + drop: ["ALL"] + }, + readOnlyRootFilesystem: true + }, + volumeMounts: [{ + mountPath: "/data", + name: "data" + }, { + mountPath: "/tmp", + name: "tmp" + }] + }], + hostNetwork: false, + securityContext: { + runAsGroup: 65532, + runAsNonRoot: true, + runAsUser: 65532 + }, + serviceAccountName: "traefik", + terminationGracePeriodSeconds: 60, + volumes: [{ + emptyDir: {}, + name: "data" + }, { + emptyDir: {}, + name: "tmp" + }] + } + } + } +}; +export const IngressClass_Traefik: KubernetesResource = { + apiVersion: "networking.k8s.io/v1", + kind: "IngressClass", + metadata: { + annotations: { + "ingressclass.kubernetes.io/is-default-class": "true" + }, + labels: { + "app.kubernetes.io/instance": "traefik-traefik", + "app.kubernetes.io/managed-by": "Helm", + "app.kubernetes.io/name": "traefik", + "helm.sh/chart": "traefik-34.4.1" + }, + name: "traefik" + }, + spec: { + controller: "traefik.io/ingress-controller" + } +}; +export const resources: ReadonlyArray = [Namespace_Traefik, CustomResourceDefinition_GatewayclassesGatewayNetworkingK8sIo, CustomResourceDefinition_GatewaysGatewayNetworkingK8sIo, CustomResourceDefinition_GrpcroutesGatewayNetworkingK8sIo, CustomResourceDefinition_HttproutesGatewayNetworkingK8sIo, CustomResourceDefinition_ReferencegrantsGatewayNetworkingK8sIo, CustomResourceDefinition_AccesscontrolpoliciesHubTraefikIo, CustomResourceDefinition_AiservicesHubTraefikIo, CustomResourceDefinition_ApiaccessesHubTraefikIo, CustomResourceDefinition_ApibundlesHubTraefikIo, CustomResourceDefinition_ApicatalogitemsHubTraefikIo, CustomResourceDefinition_ApiplansHubTraefikIo, CustomResourceDefinition_ApiportalsHubTraefikIo, CustomResourceDefinition_ApiratelimitsHubTraefikIo, CustomResourceDefinition_ApisHubTraefikIo, CustomResourceDefinition_ApiversionsHubTraefikIo, CustomResourceDefinition_ManagedsubscriptionsHubTraefikIo, CustomResourceDefinition_IngressroutesTraefikIo, CustomResourceDefinition_IngressroutetcpsTraefikIo, CustomResourceDefinition_IngressrouteudpsTraefikIo, CustomResourceDefinition_MiddlewaresTraefikIo, CustomResourceDefinition_MiddlewaretcpsTraefikIo, CustomResourceDefinition_ServerstransportsTraefikIo, CustomResourceDefinition_ServerstransporttcpsTraefikIo, CustomResourceDefinition_TlsoptionsTraefikIo, CustomResourceDefinition_TlsstoresTraefikIo, CustomResourceDefinition_TraefikservicesTraefikIo, ServiceAccount_Traefik, ClusterRole_TraefikTraefik, ClusterRoleBinding_TraefikTraefik, Service_Traefik, Deployment_Traefik, IngressClass_Traefik]; +export default { + resources: resources +}; diff --git a/packages/manifests/src/index.ts b/packages/manifests/src/index.ts index 6ec8181..374c817 100644 --- a/packages/manifests/src/index.ts +++ b/packages/manifests/src/index.ts @@ -22,13 +22,6 @@ export const OPERATOR_CATALOG: Record = { docsUrl: 'https://operator.min.io', namespaces: ['minio-operator'], }, - 'ingress-nginx': { - name: 'ingress-nginx', - displayName: 'NGINX Ingress Controller', - description: 'Ingress controller using NGINX as a reverse proxy and load balancer', - docsUrl: 'https://kubernetes.github.io/ingress-nginx/', - namespaces: ['ingress-nginx'], - }, 'cert-manager': { name: 'cert-manager', displayName: 'cert-manager', From 51a2b6bb3d55a493335a8f159b58a4ee09d71875 Mon Sep 17 00:00:00 2001 From: Dan Lynch Date: Wed, 12 Aug 2026 14:38:10 -0700 Subject: [PATCH 02/11] ci: always re-pull manifests Made the pull unconditional rather than an input. Versions are pinned in pull-manifests.ts, so this re-downloads the same content rather than picking up something newer -- it is idempotent, and making it optional only created a way for the vendored files to lag the config that names them. Leaves the workflow with no inputs at all, which is the point: there is one source of truth and no switch that can make a run mean something different. --- .github/workflows/regenerate-ops.yml | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/.github/workflows/regenerate-ops.yml b/.github/workflows/regenerate-ops.yml index 83ad08d..2407f19 100644 --- a/.github/workflows/regenerate-ops.yml +++ b/.github/workflows/regenerate-ops.yml @@ -2,11 +2,6 @@ name: Regenerate Ops Client on: workflow_dispatch: - inputs: - pull_manifests: - description: 'Re-pull vendored manifests from upstream first' - type: boolean - default: true # Versions are NOT declared here. # @@ -63,8 +58,11 @@ jobs: # Refresh the vendored manifests from upstream, then regenerate the typed # objects built from them. Both are inputs to everything below, so they # run before the cluster exists rather than alongside it. + # Always, and unconditionally. The versions are pinned in + # pull-manifests.ts, so this re-downloads the same content rather than + # picking up something newer — it is idempotent, and skipping it only + # creates a way for the vendored files to lag the config that names them. - name: Pull manifests - if: ${{ inputs.pull_manifests }} run: pnpm --filter @kubernetesjs/manifests run pull:all - name: Regenerate operator objects From c594e4d26b88439df422558f0bc0af2723927756 Mon Sep 17 00:00:00 2001 From: Dan Lynch Date: Wed, 12 Aug 2026 14:42:48 -0700 Subject: [PATCH 03/11] ci: install kind with an authenticated download CI keeps failing while installing kind: Installing kind... curl: (56) Connection died, tried 5 times before giving up helm/kind-action fetches the binary from GitHub releases unauthenticated. Those are rate-limited per IP, and CI runners share egress addresses -- so the allowance is spent by other people's traffic, and the limit arrives as a killed connection rather than a clean error. The action's five internal retries cannot help: retrying against a spent allowance spends more of nothing. `gh` authenticates with the token every run already has, which moves the download onto a per-token allowance instead of a shared per-IP one. Done as a composite action rather than inline, because there are four call sites across three workflows and the fix should not be pasted four times. It installs the same kind version helm/kind-action@v1.12.0 did (0.26.0), so nothing changes but the way the binary is fetched. Fourth occurrence of this failure today across two repos. --- .github/actions/setup-kind/action.yml | 75 +++++++++++++++++++++++++++ .github/workflows/regenerate-ops.yml | 2 +- .github/workflows/test-client.yml | 2 +- .github/workflows/test-e2e-client.yml | 4 +- 4 files changed, 79 insertions(+), 4 deletions(-) create mode 100644 .github/actions/setup-kind/action.yml diff --git a/.github/actions/setup-kind/action.yml b/.github/actions/setup-kind/action.yml new file mode 100644 index 0000000..4d69a28 --- /dev/null +++ b/.github/actions/setup-kind/action.yml @@ -0,0 +1,75 @@ +name: Setup Kind cluster +description: > + Creates a Kind cluster, installing the kind binary with an authenticated + download. + + helm/kind-action fetches kind from GitHub releases unauthenticated. Those are + rate-limited per IP, and CI runners share egress addresses — so the limit is + reached by strangers' traffic, and it arrives as a killed connection + (`curl: (56) Connection died`) rather than a clean error. The action retries + five times internally and still fails, because retrying against a spent + allowance spends more of nothing. + + `gh` authenticates with the token every run already has, which moves the + download onto a per-token allowance instead of a shared per-IP one. + +inputs: + cluster_name: + description: Name of the cluster to create + required: false + default: kind + kind_version: + description: kind version, without the leading v + required: false + # What helm/kind-action@v1.12.0 installed, so this changes nothing but the + # way it is fetched. + default: '0.26.0' + kubectl_version: + description: kubectl version + required: false + default: v1.31.3 + config: + description: Optional path to a kind cluster config + required: false + default: '' + wait: + description: How long to wait for the control plane + required: false + default: 300s + token: + description: Token used to authenticate the download + required: false + default: ${{ github.token }} + +runs: + using: composite + steps: + - name: Install kind + shell: bash + env: + GH_TOKEN: ${{ inputs.token }} + run: | + set -euo pipefail + if command -v kind >/dev/null && kind version | grep -q "${{ inputs.kind_version }}"; then + echo "kind ${{ inputs.kind_version }} already present" + exit 0 + fi + gh release download "v${{ inputs.kind_version }}" \ + --repo kubernetes-sigs/kind \ + --pattern kind-linux-amd64 --output /tmp/kind + sudo install -m 0755 /tmp/kind /usr/local/bin/kind + kind version + + - name: Install kubectl + uses: azure/setup-kubectl@v3 + with: + version: ${{ inputs.kubectl_version }} + + - name: Create cluster + shell: bash + run: | + set -euo pipefail + args=(--name "${{ inputs.cluster_name }}" --wait "${{ inputs.wait }}") + [ -n "${{ inputs.config }}" ] && args+=(--config "${{ inputs.config }}") + kind create cluster "${args[@]}" + kubectl cluster-info diff --git a/.github/workflows/regenerate-ops.yml b/.github/workflows/regenerate-ops.yml index 2407f19..f3f9ccb 100644 --- a/.github/workflows/regenerate-ops.yml +++ b/.github/workflows/regenerate-ops.yml @@ -69,7 +69,7 @@ jobs: run: pnpm --filter @kubernetesjs/manifests run codegen - name: Create Kind cluster - uses: helm/kind-action@v1.12.0 + uses: ./.github/actions/setup-kind with: cluster_name: ops-codegen kubectl_version: v1.31.3 diff --git a/.github/workflows/test-client.yml b/.github/workflows/test-client.yml index 9024122..2a062eb 100644 --- a/.github/workflows/test-client.yml +++ b/.github/workflows/test-client.yml @@ -42,7 +42,7 @@ jobs: - name: Setup Kind cluster if: ${{ inputs.kubeconfig == '' }} - uses: helm/kind-action@v1.12.0 + uses: ./.github/actions/setup-kind with: cluster_name: kind kubectl_version: v1.31.3 diff --git a/.github/workflows/test-e2e-client.yml b/.github/workflows/test-e2e-client.yml index 8533bb6..bacb51a 100644 --- a/.github/workflows/test-e2e-client.yml +++ b/.github/workflows/test-e2e-client.yml @@ -42,7 +42,7 @@ jobs: version: v1.31.3 - name: Setup Kind cluster - uses: helm/kind-action@v1.12.0 + uses: ./.github/actions/setup-kind with: cluster_name: kind kubectl_version: v1.31.3 @@ -108,7 +108,7 @@ jobs: version: v1.31.3 - name: Setup Kind cluster - uses: helm/kind-action@v1.12.0 + uses: ./.github/actions/setup-kind with: cluster_name: kind kubectl_version: v1.31.3 From 6c852106c6ebe8db1288f8d5866daf2f25e6e6c4 Mon Sep 17 00:00:00 2001 From: Dan Lynch Date: Wed, 12 Aug 2026 14:49:06 -0700 Subject: [PATCH 04/11] test: drop the ingress-nginx fixtures, cover traefik Removing ingress-nginx from the manifests package left three consumers behind: an e2e matrix entry, a standalone e2e apply test, and two fixtures that named its namespace and chart version. The unit test failed because getOperatorResources returned nothing for an operator that no longer ships. Also extends the namespace-coverage assertion to traefik. That test checks a manifest set carries a Namespace, which is what makes it applicable standalone -- worth asserting for the operators added here rather than only the ones that predate them. Unit tests: 7 passed. --- .github/workflows/test-e2e-client.yml | 1 - .../__tests__/e2e/apply.ingress-nginx.test.ts | 56 ------------------- .../__tests__/e2e/e2e.setup.operator.test.ts | 2 - .../integration/apply.cert-manager.test.ts | 5 +- .../client/__tests__/unit/manifests.test.ts | 5 +- 5 files changed, 5 insertions(+), 64 deletions(-) delete mode 100644 packages/client/__tests__/e2e/apply.ingress-nginx.test.ts diff --git a/.github/workflows/test-e2e-client.yml b/.github/workflows/test-e2e-client.yml index bacb51a..d260c8c 100644 --- a/.github/workflows/test-e2e-client.yml +++ b/.github/workflows/test-e2e-client.yml @@ -25,7 +25,6 @@ jobs: fail-fast: false matrix: operator: - - ingress-nginx - cert-manager - knative-serving - cloudnative-pg diff --git a/packages/client/__tests__/e2e/apply.ingress-nginx.test.ts b/packages/client/__tests__/e2e/apply.ingress-nginx.test.ts deleted file mode 100644 index ec64da2..0000000 --- a/packages/client/__tests__/e2e/apply.ingress-nginx.test.ts +++ /dev/null @@ -1,56 +0,0 @@ -import { KubernetesClient } from "@kubernetesjs/ops"; -import { getOperatorResources } from "@kubernetesjs/manifests"; -import { SetupClient } from "../../src/setup"; -import { ensureNamespaceReady, ensureNamespaceExists, forceDeleteNamespace } from "../utils/test-utils"; -import { globalCleanup } from "../setup/e2e-setup"; - -jest.setTimeout(10 * 60 * 1000); // up to 10 minutes for full operator - -const K8S_API = process.env.K8S_API || "http://127.0.0.1:8001"; -const nsName = "ingress-nginx"; - -describe("FULL APPLY: ingress-nginx operator", () => { - const api = new KubernetesClient({ restEndpoint: K8S_API } as any); - const setup = new SetupClient(api as any); - - beforeAll(async () => { - // Ensure namespace exists before starting tests - await ensureNamespaceExists(api as any, nsName); - - // Register cleanup for the namespace - globalCleanup.register(async () => { - await forceDeleteNamespace(api as any, nsName); - }); - }); - - afterAll(async () => { - // Clean up the namespace after tests - try { - await forceDeleteNamespace(api as any, nsName); - } catch (err: any) { - console.warn(`Failed to cleanup namespace ${nsName}:`, err.message); - } - }); - - it("applies all ingress-nginx manifests", async () => { - const connected = await setup.checkConnection(); - if (!connected) { - console.warn("Kubernetes cluster not reachable; skipping test."); - return; - } - - const manifests = getOperatorResources("ingress-nginx"); - await setup.applyManifests(manifests); - - // Wait a moment for namespace to be created by manifests - await new Promise(r => setTimeout(r, 2000)); - - // Ensure namespace exists after applying manifests - await ensureNamespaceExists(api as any, nsName); - - const res = await api.listCoreV1Namespace({ query: {} as any }); - const namespaces = res?.items || []; - const ns = namespaces.find((n: any) => n?.metadata?.name === nsName); - expect(ns?.metadata?.name).toBe(nsName); - }); -}); diff --git a/packages/client/__tests__/e2e/e2e.setup.operator.test.ts b/packages/client/__tests__/e2e/e2e.setup.operator.test.ts index 3bf6f59..59cc75f 100644 --- a/packages/client/__tests__/e2e/e2e.setup.operator.test.ts +++ b/packages/client/__tests__/e2e/e2e.setup.operator.test.ts @@ -11,7 +11,6 @@ jest.setTimeout(15 * 60 * 1000); // generous for CI const K8S_API = process.env.K8S_API || "http://127.0.0.1:8001"; const DEFAULT_VERSIONS: Record = { - "ingress-nginx": "4.11.2", "cert-manager": "v1.17.0", "knative-serving": "v1.15.0", "cloudnative-pg": "1.25.2", @@ -20,7 +19,6 @@ const DEFAULT_VERSIONS: Record = { }; const DEFAULT_NAMESPACES: Record = { - "ingress-nginx": "ingress-nginx", "cert-manager": "cert-manager", "knative-serving": "knative-serving", "cloudnative-pg": "cnpg-system", diff --git a/packages/client/__tests__/integration/apply.cert-manager.test.ts b/packages/client/__tests__/integration/apply.cert-manager.test.ts index 4eef309..d6bebfa 100644 --- a/packages/client/__tests__/integration/apply.cert-manager.test.ts +++ b/packages/client/__tests__/integration/apply.cert-manager.test.ts @@ -8,7 +8,6 @@ describe("SetupClient.installOperators integration", () => { { namespace: string; version: string } > = { "cert-manager": { namespace: "cert-manager", version: "v1.17.0" }, - "ingress-nginx": { namespace: "ingress-nginx", version: "4.11.2" }, }; const createConfig = (names: string[]): ClusterSetupConfig => ({ @@ -76,7 +75,7 @@ describe("SetupClient.installOperators integration", () => { jest.spyOn(console, "log").mockImplementation(() => {}); - const config = createConfig(["cert-manager", "ingress-nginx"]); + const config = createConfig(["cert-manager"]); await setup.installOperators(config); expect(applySpy).toHaveBeenCalledTimes(2); @@ -96,8 +95,6 @@ describe("SetupClient.installOperators integration", () => { ); expect(secondCall[0]).toEqual( getOperatorResources( - "ingress-nginx", - operatorDetails["ingress-nginx"].version ) ); }, 30000); // 30 second timeout diff --git a/packages/client/__tests__/unit/manifests.test.ts b/packages/client/__tests__/unit/manifests.test.ts index c85227d..bff0da1 100644 --- a/packages/client/__tests__/unit/manifests.test.ts +++ b/packages/client/__tests__/unit/manifests.test.ts @@ -2,11 +2,14 @@ import { getOperatorResources } from "@kubernetesjs/manifests"; describe("manifests: metadata coverage", () => { const operatorNamespaceMap = { - "ingress-nginx": "ingress-nginx", "cert-manager": "cert-manager", "knative-serving": "knative-serving", "cloudnative-pg": "cnpg-system", "kube-prometheus-stack": "monitoring", + // Added with the operators themselves: a manifest set that ships + // without a Namespace is a manifest set that cannot be applied + // standalone, and this is the assertion that catches it. + traefik: "traefik", }; it("exports namespaces for supported operators", () => { From 2316c4d10cf9bff8ad6953f351241c882fad3d87 Mon Sep 17 00:00:00 2001 From: Dan Lynch Date: Wed, 12 Aug 2026 14:57:04 -0700 Subject: [PATCH 05/11] ci: route ci.yml through the composite action too, fix the cert-manager assertions ci.yml installed its own tooling and so was missed by the earlier sweep. Two problems beyond the flaky download: kubectl came from dl.k8s.io resolved through stable.txt, so the version moved whenever upstream cut a release -- an unpinned dependency in a job whose purpose is reproducibility. kind came from kind.sigs.k8s.io/dl, which redirects to GitHub releases, and pinned 0.20.0 while every other workflow used 0.26.0. Both now go through .github/actions/setup-kind, which leaves no unauthenticated binary fetch anywhere in the workflows. Also fixes the cert-manager integration test. Removing ingress-nginx left it asserting two apply calls when one operator remains, and my earlier regex deleted the arguments from a getOperatorResources call rather than the whole assertion -- so the suite failed to compile rather than failing an assertion, which is why it showed as a suite error with its tests still passing. Unit tests: 7 passed. --- .github/workflows/ci.yml | 29 +++++++++---------- .../integration/apply.cert-manager.test.ts | 9 ++---- 2 files changed, 16 insertions(+), 22 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 0553c1b..ffffe9d 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -33,21 +33,15 @@ jobs: - name: Build packages run: pnpm build - - name: Install kubectl + # Was two curls: kubectl from dl.k8s.io resolved through stable.txt, so the + # version moved whenever upstream cut a release, and kind from + # kind.sigs.k8s.io/dl — which redirects to GitHub releases, where an + # unauthenticated download is rate-limited per IP and dies mid-transfer as + # `curl: (56)`. It also pinned kind 0.20.0 while the rest of the repo used + # 0.26.0. + - name: Write cluster config run: | - curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl" - chmod +x kubectl - sudo mv kubectl /usr/local/bin/ - - - name: Install Kind - run: | - curl -Lo ./kind https://kind.sigs.k8s.io/dl/v0.20.0/kind-linux-amd64 - chmod +x ./kind - sudo mv ./kind /usr/local/bin/kind - - - name: Create Kind cluster - run: | - cat < kind-config.yaml + cat <<'EOF' > kind-config.yaml kind: Cluster apiVersion: kind.x-k8s.io/v1alpha4 nodes: @@ -57,7 +51,12 @@ jobs: hostPort: 30000 protocol: TCP EOF - kind create cluster --config kind-config.yaml --wait 5m + + - name: Create Kind cluster + uses: ./.github/actions/setup-kind + with: + config: kind-config.yaml + wait: 5m - name: Wait for cluster to be ready run: | diff --git a/packages/client/__tests__/integration/apply.cert-manager.test.ts b/packages/client/__tests__/integration/apply.cert-manager.test.ts index d6bebfa..9a34f6f 100644 --- a/packages/client/__tests__/integration/apply.cert-manager.test.ts +++ b/packages/client/__tests__/integration/apply.cert-manager.test.ts @@ -78,11 +78,10 @@ describe("SetupClient.installOperators integration", () => { const config = createConfig(["cert-manager"]); await setup.installOperators(config); - expect(applySpy).toHaveBeenCalledTimes(2); - expect(waitForOperatorSpy).toHaveBeenCalledTimes(2); + expect(applySpy).toHaveBeenCalledTimes(1); + expect(waitForOperatorSpy).toHaveBeenCalledTimes(1); const firstCall = applySpy.mock.calls[0]; - const secondCall = applySpy.mock.calls[1]; expect(firstCall[0]).toEqual( getOperatorResources( @@ -93,10 +92,6 @@ describe("SetupClient.installOperators integration", () => { expect(firstCall[1]).toEqual( expect.objectContaining({ continueOnError: false }) ); - expect(secondCall[0]).toEqual( - getOperatorResources( - ) - ); }, 30000); // 30 second timeout it("throws for unsupported operators", async () => { From 6e181238033194e6b3b1bb5da117d522670ec52e Mon Sep 17 00:00:00 2001 From: Dan Lynch Date: Wed, 12 Aug 2026 15:30:58 -0700 Subject: [PATCH 06/11] fix: hold cert-manager at v1.17.0, widen the webhook retry budget cert-manager was bumped to v1.21.1 on the reasoning that no consumer installs it. That was wrong -- constructive-cloud deploys v1.17.0 (k8s/operators/cert-manager.yaml carries helm.sh/chart: cert-manager-v1.17.0), so a client generated from v1.21.1 CRDs would describe an API that is not running. Held at v1.17.0 with a note saying why, since 'newer' is the obvious thing for someone to do next. The knative e2e failure was not the predicate: isAdmissionWebhookTransient already matches 'failed calling webhook' plus 'connection refused', and both the create and replace paths already retry. The budget was the problem -- 6 attempts capped at 10s is roughly 34 seconds, which is sized for a rolling webhook being briefly unavailable. That is not this case. The webhook is created by the same apply: Knative v1.22.1 ships Certificates in serving-core.yaml that its own webhook must admit, so the wait is a Deployment scheduling, pulling an image and passing a readiness probe. On a cold cluster that is minutes. Now 12 attempts capped at 15s, about 150s. Also drops the superseded versioned copies. The puller writes a per-version file and never removed old ones, so OPERATOR_VERSIONS listed both v1.17.0 and v1.21.1 for cert-manager -- which reintroduced the ambiguity this package exists to remove, and is why the e2e fixture silently picked the older one. --- .../__tests__/e2e/e2e.setup.operator.test.ts | 21 +- packages/client/src/apply.ts | 18 +- .../manifests/operators/cert-manager.yaml | 12285 +++++++------ .../operators/cert-manager/v1.17.0.yaml | 14 + .../operators/cert-manager/v1.21.1.yaml | 14190 ---------------- packages/manifests/operators/cilium.yaml | 10 +- .../manifests/operators/cilium/1.19.5.yaml | 10 +- .../operators/knative-serving/v1.15.0.yaml | 9926 ----------- packages/manifests/scripts/pull-manifests.ts | 5 +- .../manifests/src/generated/cert-manager.ts | 7435 ++++---- packages/manifests/src/generated/cilium.ts | 10 +- packages/manifests/src/generated/index.ts | 8 +- 12 files changed, 9288 insertions(+), 34644 deletions(-) delete mode 100644 packages/manifests/operators/cert-manager/v1.21.1.yaml delete mode 100644 packages/manifests/operators/knative-serving/v1.15.0.yaml diff --git a/packages/client/__tests__/e2e/e2e.setup.operator.test.ts b/packages/client/__tests__/e2e/e2e.setup.operator.test.ts index 59cc75f..d7b87b2 100644 --- a/packages/client/__tests__/e2e/e2e.setup.operator.test.ts +++ b/packages/client/__tests__/e2e/e2e.setup.operator.test.ts @@ -1,4 +1,5 @@ import { KubernetesClient } from "@kubernetesjs/ops"; +import { getOperatorVersions } from "@kubernetesjs/manifests"; import { SetupClient } from "../../src/setup"; import type { ClusterSetupConfig, OperatorConfig } from "../../src/types"; @@ -10,13 +11,16 @@ jest.setTimeout(15 * 60 * 1000); // generous for CI const K8S_API = process.env.K8S_API || "http://127.0.0.1:8001"; -const DEFAULT_VERSIONS: Record = { - "cert-manager": "v1.17.0", - "knative-serving": "v1.15.0", - "cloudnative-pg": "1.25.2", - "kube-prometheus-stack": "77.5.0", - "minio-operator": "7.1.1", -}; +// Versions are not declared here. They come from the manifests package, which +// is the only place a version is written — a hardcoded copy is a third place +// for them to disagree, and it already had: this fixture pinned cert-manager +// v1.17.0 and knative v1.15.0 long after the package had moved on, so the e2e +// suite was installing versions the package no longer shipped. +function latestVersion(name: string): string { + const versions = getOperatorVersions(name); + if (!versions.length) throw new Error(`Unknown operator '${name}'`); + return versions[versions.length - 1]; +} const DEFAULT_NAMESPACES: Record = { "cert-manager": "cert-manager", @@ -34,8 +38,7 @@ const OPERATOR_DEPENDENCIES: Record = { }; function buildOperator(name: string): OperatorConfig { - const version = DEFAULT_VERSIONS[name]; - if (!version) throw new Error(`Unknown operator '${name}'`); + const version = latestVersion(name); const namespace = DEFAULT_NAMESPACES[name] || name; return { name, enabled: true, version, namespace } as OperatorConfig; } diff --git a/packages/client/src/apply.ts b/packages/client/src/apply.ts index 4f74a7c..12f52d3 100644 --- a/packages/client/src/apply.ts +++ b/packages/client/src/apply.ts @@ -492,7 +492,17 @@ export class K8sApplier { ); } - private async postWithRetries(path: string, body: any, ref: string, maxAttempts = 6, baseDelayMs = 2_000) { + // The webhook being waited on is usually created by this same apply — a + // manifest set that contains both an admission webhook and resources it must + // admit. So the wait is not "a rolling webhook briefly unavailable", it is + // "a Deployment scheduling, pulling an image and passing its readiness + // probe", which on a cold cluster is minutes rather than seconds. + // + // The previous budget (6 attempts capped at 10s ≈ 34s) was sized for the + // former and timed out on the latter: Knative v1.22 ships Certificates in + // serving-core.yaml that its own webhook must admit, and the apply failed + // before the webhook pod was ready. + private async postWithRetries(path: string, body: any, ref: string, maxAttempts = 12, baseDelayMs = 2_000) { let attempt = 0; let lastErr: any; while (attempt < maxAttempts) { @@ -501,7 +511,7 @@ export class K8sApplier { } catch (err: any) { lastErr = err; if (!this.isAdmissionWebhookTransient(err)) throw err; - const delay = Math.min(baseDelayMs * Math.pow(2, attempt), 10_000); + const delay = Math.min(baseDelayMs * Math.pow(2, attempt), 15_000); this.opts.log(`Retrying ${ref} due to webhook readiness (attempt ${attempt + 1}/${maxAttempts}) in ${delay}ms...`); await new Promise((r) => setTimeout(r, delay)); attempt++; @@ -510,7 +520,7 @@ export class K8sApplier { throw lastErr; } - private async putWithRetries(path: string, body: any, ref: string, maxAttempts = 5, baseDelayMs = 2_000) { + private async putWithRetries(path: string, body: any, ref: string, maxAttempts = 12, baseDelayMs = 2_000) { let attempt = 0; let lastErr: any; while (attempt < maxAttempts) { @@ -519,7 +529,7 @@ export class K8sApplier { } catch (err: any) { lastErr = err; if (!this.isAdmissionWebhookTransient(err)) throw err; - const delay = Math.min(baseDelayMs * Math.pow(2, attempt), 10_000); + const delay = Math.min(baseDelayMs * Math.pow(2, attempt), 15_000); this.opts.log(`Retrying update for ${ref} due to webhook readiness (attempt ${attempt + 1}/${maxAttempts}) in ${delay}ms...`); await new Promise((r) => setTimeout(r, delay)); attempt++; diff --git a/packages/manifests/operators/cert-manager.yaml b/packages/manifests/operators/cert-manager.yaml index 6a83c36..a0a5053 100644 --- a/packages/manifests/operators/cert-manager.yaml +++ b/packages/manifests/operators/cert-manager.yaml @@ -1,4 +1,4 @@ -# Source: jetstack/cert-manager@v1.21.1 +# Source: jetstack/cert-manager@v1.17.0 --- # Added by pull-manifests.ts to ensure namespace exists apiVersion: v1 @@ -22,9 +22,9 @@ metadata: app.kubernetes.io/name: cainjector app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "cainjector" - app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/version: "v1.17.0" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 + helm.sh/chart: cert-manager-v1.17.0 --- # Source: cert-manager/templates/serviceaccount.yaml @@ -39,9 +39,9 @@ metadata: app.kubernetes.io/name: cert-manager app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "controller" - app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/version: "v1.17.0" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 + helm.sh/chart: cert-manager-v1.17.0 --- # Source: cert-manager/templates/webhook-serviceaccount.yaml @@ -56,57 +56,84 @@ metadata: app.kubernetes.io/name: webhook app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "webhook" - app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/version: "v1.17.0" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 + helm.sh/chart: cert-manager-v1.17.0 --- -# Source: cert-manager/templates/crd-acme.cert-manager.io_challenges.yaml +# Source: cert-manager/templates/crds.yaml +# +# START crd apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: - name: "challenges.acme.cert-manager.io" + name: certificaterequests.cert-manager.io + # START annotations annotations: helm.sh/resource-policy: keep + # END annotations labels: - app: "cert-manager" - app.kubernetes.io/name: "cert-manager" - app.kubernetes.io/instance: "cert-manager" - app.kubernetes.io/component: "crds" - app.kubernetes.io/version: "v1.21.1" + app: 'cert-manager' + app.kubernetes.io/name: 'cert-manager' + app.kubernetes.io/instance: 'cert-manager' + # Generated labels + app.kubernetes.io/version: "v1.17.0" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 + helm.sh/chart: cert-manager-v1.17.0 spec: - group: acme.cert-manager.io + group: cert-manager.io names: + kind: CertificateRequest + listKind: CertificateRequestList + plural: certificaterequests + shortNames: + - cr + - crs + singular: certificaterequest categories: - cert-manager - - cert-manager-acme - kind: Challenge - listKind: ChallengeList - plural: challenges - singular: challenge scope: Namespaced versions: - - additionalPrinterColumns: - - jsonPath: .status.state - name: State + - name: v1 + subresources: + status: {} + additionalPrinterColumns: + - jsonPath: .status.conditions[?(@.type=="Approved")].status + name: Approved type: string - - jsonPath: .spec.dnsName - name: Domain + - jsonPath: .status.conditions[?(@.type=="Denied")].status + name: Denied type: string - - jsonPath: .status.reason - name: Reason + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .spec.issuerRef.name + name: Issuer + type: string + - jsonPath: .spec.username + name: Requester + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status priority: 1 type: string - - description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. - jsonPath: .metadata.creationTimestamp + - jsonPath: .metadata.creationTimestamp + description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. name: Age type: date - name: v1 schema: openAPIV3Schema: - description: Challenge is a type to represent a Challenge request with an ACME server + description: |- + A CertificateRequest is used to request a signed certificate from one of the + configured issuers. + + All fields within the CertificateRequest's `spec` are immutable after creation. + A CertificateRequest will either succeed or fail, as denoted by its `Ready` status + condition and its `status.failureTime` field. + + A CertificateRequest is a one-shot resource, meaning it represents a single + point in time request for a certificate and cannot be re-used. + type: object properties: apiVersion: description: |- @@ -126,3749 +153,848 @@ spec: metadata: type: object spec: + description: |- + Specification of the desired state of the CertificateRequest resource. + https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status + type: object + required: + - issuerRef + - request properties: - authorizationURL: + duration: description: |- - The URL to the ACME Authorization resource that this - challenge is a part of. + Requested 'duration' (i.e. lifetime) of the Certificate. Note that the + issuer may choose to ignore the requested duration, just like any other + requested attribute. type: string - dnsName: + extra: description: |- - dnsName is the identifier that this challenge is for, e.g., example.com. - If the requested DNSName is a 'wildcard', this field MUST be set to the - non-wildcard domain, e.g., for `*.example.com`, it must be `example.com`. - type: string + Extra contains extra attributes of the user that created the CertificateRequest. + Populated by the cert-manager webhook on creation and immutable. + type: object + additionalProperties: + type: array + items: + type: string + groups: + description: |- + Groups contains group membership of the user that created the CertificateRequest. + Populated by the cert-manager webhook on creation and immutable. + type: array + items: + type: string + x-kubernetes-list-type: atomic + isCA: + description: |- + Requested basic constraints isCA value. Note that the issuer may choose + to ignore the requested isCA value, just like any other requested attribute. + + NOTE: If the CSR in the `Request` field has a BasicConstraints extension, + it must have the same isCA value as specified here. + + If true, this will automatically add the `cert sign` usage to the list + of requested `usages`. + type: boolean issuerRef: description: |- - References a properly configured ACME-type Issuer which should - be used to create this Challenge. - If the Issuer does not exist, processing will be retried. - If the Issuer is not an 'ACME' Issuer, an error will be returned and the - Challenge will be marked as failed. + Reference to the issuer responsible for issuing the certificate. + If the issuer is namespace-scoped, it must be in the same namespace + as the Certificate. If the issuer is cluster-scoped, it can be used + from any namespace. + + The `name` field of the reference must always be specified. + type: object + required: + - name properties: group: - description: |- - Group of the issuer being referred to. - Defaults to 'cert-manager.io'. + description: Group of the resource being referred to. type: string kind: - description: |- - Kind of the issuer being referred to. - Defaults to 'Issuer'. + description: Kind of the resource being referred to. type: string name: - description: Name of the issuer being referred to. + description: Name of the resource being referred to. type: string - required: - - name - type: object - key: + request: description: |- - The ACME challenge key for this challenge - For HTTP01 challenges, this is the value that must be responded with to - complete the HTTP01 challenge in the format: - `.`. - For DNS01 challenges, this is the base64 encoded SHA256 sum of the - `.` - text that must be set as the TXT record content. + The PEM-encoded X.509 certificate signing request to be submitted to the + issuer for signing. + + If the CSR has a BasicConstraints extension, its isCA attribute must + match the `isCA` value of this CertificateRequest. + If the CSR has a KeyUsage extension, its key usages must match the + key usages in the `usages` field of this CertificateRequest. + If the CSR has a ExtKeyUsage extension, its extended key usages + must match the extended key usages in the `usages` field of this + CertificateRequest. type: string - solver: + format: byte + uid: description: |- - Contains the domain solving configuration that should be used to - solve this challenge resource. - properties: - dns01: - description: |- - Configures cert-manager to attempt to complete authorizations by - performing the DNS01 challenge flow. - properties: - acmeDNS: - description: |- - Use the 'ACME DNS' (https://github.com/joohoi/acme-dns) API to manage - DNS01 challenge records. - properties: - accountSecretRef: - description: |- - A reference to a specific 'key' within a Secret resource. - In some instances, `key` is a required field. - properties: - key: - description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. - type: string - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - required: - - name - type: object - host: - type: string - required: - - accountSecretRef - - host - type: object - akamai: - description: Use the Akamai DNS zone management API to manage DNS01 challenge records. - properties: - accessTokenSecretRef: - description: |- - A reference to a specific 'key' within a Secret resource. - In some instances, `key` is a required field. - properties: - key: - description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. - type: string - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - required: - - name - type: object - clientSecretSecretRef: - description: |- - A reference to a specific 'key' within a Secret resource. - In some instances, `key` is a required field. - properties: - key: - description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. - type: string - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - required: - - name - type: object - clientTokenSecretRef: - description: |- - A reference to a specific 'key' within a Secret resource. - In some instances, `key` is a required field. - properties: - key: - description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. - type: string - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - required: - - name - type: object - serviceConsumerDomain: - type: string - required: - - accessTokenSecretRef - - clientSecretSecretRef - - clientTokenSecretRef - - serviceConsumerDomain - type: object - azureDNS: - description: Use the Microsoft Azure DNS API to manage DNS01 challenge records. - properties: - clientID: - description: |- - Auth: Azure Service Principal: - The ClientID of the Azure Service Principal used to authenticate with Azure DNS. - If set, ClientSecret and TenantID must also be set. - type: string - clientSecretSecretRef: - description: |- - Auth: Azure Service Principal: - A reference to a Secret containing the password associated with the Service Principal. - If set, ClientID and TenantID must also be set. - properties: - key: - description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. - type: string - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - required: - - name - type: object - environment: - description: name of the Azure environment (default AzurePublicCloud) - enum: - - AzurePublicCloud - - AzureChinaCloud - - AzureGermanCloud - - AzureUSGovernmentCloud - type: string - hostedZoneName: - description: name of the DNS zone that should be used - type: string - managedIdentity: - description: |- - Auth: Azure Workload Identity or Azure Managed Service Identity: - Settings to enable Azure Workload Identity or Azure Managed Service Identity - If set, ClientID, ClientSecret and TenantID must not be set. - properties: - clientID: - description: client ID of the managed identity, cannot be used at the same time as resourceID - type: string - resourceID: - description: |- - resource ID of the managed identity, cannot be used at the same time as clientID - Cannot be used for Azure Managed Service Identity - type: string - tenantID: - description: tenant ID of the managed identity, cannot be used at the same time as resourceID - type: string - type: object - resourceGroupName: - description: resource group the DNS zone is located in - type: string - subscriptionID: - description: ID of the Azure subscription - type: string - tenantID: - description: |- - Auth: Azure Service Principal: - The TenantID of the Azure Service Principal used to authenticate with Azure DNS. - If set, ClientID and ClientSecret must also be set. - type: string - zoneType: - description: |- - ZoneType determines which type of Azure DNS zone to use. + UID contains the uid of the user that created the CertificateRequest. + Populated by the cert-manager webhook on creation and immutable. + type: string + usages: + description: |- + Requested key usages and extended key usages. - Valid values are: - - AzurePublicZone (default): Use a public Azure DNS zone. - - AzurePrivateZone: Use an Azure Private DNS zone. + NOTE: If the CSR in the `Request` field has uses the KeyUsage or + ExtKeyUsage extension, these extensions must have the same values + as specified here without any additional values. - If not specified, AzurePublicZone is used. + If unset, defaults to `digital signature` and `key encipherment`. + type: array + items: + description: |- + KeyUsage specifies valid usage contexts for keys. + See: + https://tools.ietf.org/html/rfc5280#section-4.2.1.3 + https://tools.ietf.org/html/rfc5280#section-4.2.1.12 - Support for Azure Private DNS zones is currently - experimental and may change in future releases. - enum: - - AzurePublicZone - - AzurePrivateZone - type: string - required: - - resourceGroupName - - subscriptionID - type: object - cloudDNS: - description: Use the Google Cloud DNS API to manage DNS01 challenge records. - properties: - hostedZoneName: - description: |- - HostedZoneName is an optional field that tells cert-manager in which - Cloud DNS zone the challenge record has to be created. - If left empty cert-manager will automatically choose a zone. - type: string - project: - type: string - serviceAccountSecretRef: - description: |- - A reference to a specific 'key' within a Secret resource. - In some instances, `key` is a required field. - properties: - key: - description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. - type: string - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - required: - - name - type: object - required: - - project - type: object - cloudflare: - description: Use the Cloudflare API to manage DNS01 challenge records. - properties: - apiKeySecretRef: - description: |- - API key to use to authenticate with Cloudflare. - Note: using an API token to authenticate is now the recommended method - as it allows greater control of permissions. - properties: - key: - description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. - type: string - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - required: - - name - type: object - apiTokenSecretRef: - description: API token used to authenticate with Cloudflare. - properties: - key: - description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. - type: string - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - required: - - name - type: object - email: - description: Email of the account, only required when using API key based authentication. - type: string - type: object - cnameStrategy: - description: |- - CNAMEStrategy configures how the DNS01 provider should handle CNAME - records when found in DNS zones. - enum: - - None - - Follow - type: string - digitalocean: - description: Use the DigitalOcean DNS API to manage DNS01 challenge records. - properties: - tokenSecretRef: - description: |- - A reference to a specific 'key' within a Secret resource. - In some instances, `key` is a required field. - properties: - key: - description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. - type: string - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - required: - - name - type: object - required: - - tokenSecretRef - type: object - rfc2136: - description: |- - Use RFC2136 ("Dynamic Updates in the Domain Name System") (https://datatracker.ietf.org/doc/rfc2136/) - to manage DNS01 challenge records. - properties: - nameserver: - description: |- - The IP address or hostname of an authoritative DNS server supporting - RFC2136 in the form host:port. If the host is an IPv6 address it must be - enclosed in square brackets (e.g [2001:db8::1]); port is optional. - This field is required. - type: string - protocol: - description: Protocol to use for dynamic DNS update queries. Valid values are (case-sensitive) ``TCP`` and ``UDP``; ``UDP`` (default). - enum: - - TCP - - UDP - type: string - tsigAlgorithm: - description: |- - The TSIG Algorithm configured in the DNS supporting RFC2136. Used only - when ``tsigSecretSecretRef`` and ``tsigKeyName`` are defined. - Supported values are (case-insensitive): ``HMACMD5`` (default), - ``HMACSHA1``, ``HMACSHA256`` or ``HMACSHA512``. - type: string - tsigKeyName: - description: |- - The TSIG Key name configured in the DNS. - If ``tsigSecretSecretRef`` is defined, this field is required. - type: string - tsigSecretSecretRef: - description: |- - The name of the secret containing the TSIG value. - If ``tsigKeyName`` is defined, this field is required. - properties: - key: - description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. - type: string - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - required: - - name - type: object - required: - - nameserver - type: object - route53: - description: Use the AWS Route53 API to manage DNS01 challenge records. - properties: - accessKeyID: - description: |- - The AccessKeyID is used for authentication. - Cannot be set when SecretAccessKeyID is set. - If neither the Access Key nor Key ID are set, we fall back to using env - vars, shared credentials file, or AWS Instance metadata, - see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials - type: string - accessKeyIDSecretRef: - description: |- - The SecretAccessKey is used for authentication. If set, pull the AWS - access key ID from a key within a Kubernetes Secret. - Cannot be set when AccessKeyID is set. - If neither the Access Key nor Key ID are set, we fall back to using env - vars, shared credentials file, or AWS Instance metadata, - see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials - properties: - key: - description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. - type: string - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - required: - - name - type: object - auth: - description: Auth configures how cert-manager authenticates. - properties: - kubernetes: - description: |- - Kubernetes authenticates with Route53 using AssumeRoleWithWebIdentity - by passing a bound ServiceAccount token. - properties: - serviceAccountRef: - description: |- - A reference to a service account that will be used to request a bound - token (also known as "projected token"). To use this field, you must - configure an RBAC rule to let cert-manager request a token. - properties: - audiences: - description: |- - TokenAudiences is an optional list of audiences to include in the - token passed to AWS. The default token consisting of the issuer's namespace - and name is always included. - If unset the audience defaults to `sts.amazonaws.com`. - items: - type: string - type: array - x-kubernetes-list-type: atomic - name: - description: Name of the ServiceAccount used to request a token. - type: string - required: - - name - type: object - required: - - serviceAccountRef - type: object - required: - - kubernetes - type: object - hostedZoneID: - description: If set, the provider will manage only this zone in Route53 and will not do a lookup using the route53:ListHostedZonesByName api call. - type: string - region: - description: |- - Override the AWS region. - - Route53 is a global service and does not have regional endpoints but the - region specified here (or via environment variables) is used as a hint to - help compute the correct AWS credential scope and partition when it - connects to Route53. See: - - [Amazon Route 53 endpoints and quotas](https://docs.aws.amazon.com/general/latest/gr/r53.html) - - [Global services](https://docs.aws.amazon.com/whitepapers/latest/aws-fault-isolation-boundaries/global-services.html) - - If you omit this region field, cert-manager will use the region from - AWS_REGION and AWS_DEFAULT_REGION environment variables, if they are set - in the cert-manager controller Pod. + Valid KeyUsage values are as follows: + "signing", + "digital signature", + "content commitment", + "key encipherment", + "key agreement", + "data encipherment", + "cert sign", + "crl sign", + "encipher only", + "decipher only", + "any", + "server auth", + "client auth", + "code signing", + "email protection", + "s/mime", + "ipsec end system", + "ipsec tunnel", + "ipsec user", + "timestamping", + "ocsp signing", + "microsoft sgc", + "netscape sgc" + type: string + enum: + - signing + - digital signature + - content commitment + - key encipherment + - key agreement + - data encipherment + - cert sign + - crl sign + - encipher only + - decipher only + - any + - server auth + - client auth + - code signing + - email protection + - s/mime + - ipsec end system + - ipsec tunnel + - ipsec user + - timestamping + - ocsp signing + - microsoft sgc + - netscape sgc + username: + description: |- + Username contains the name of the user that created the CertificateRequest. + Populated by the cert-manager webhook on creation and immutable. + type: string + status: + description: |- + Status of the CertificateRequest. + This is set and managed automatically. + Read-only. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status + type: object + properties: + ca: + description: |- + The PEM encoded X.509 certificate of the signer, also known as the CA + (Certificate Authority). + This is set on a best-effort basis by different issuers. + If not set, the CA is assumed to be unknown/not available. + type: string + format: byte + certificate: + description: |- + The PEM encoded X.509 certificate resulting from the certificate + signing request. + If not set, the CertificateRequest has either not been completed or has + failed. More information on failure can be found by checking the + `conditions` field. + type: string + format: byte + conditions: + description: |- + List of status conditions to indicate the status of a CertificateRequest. + Known condition types are `Ready`, `InvalidRequest`, `Approved` and `Denied`. + type: array + items: + description: CertificateRequestCondition contains condition information for a CertificateRequest. + type: object + required: + - status + - type + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the timestamp corresponding to the last status + change of this condition. + type: string + format: date-time + message: + description: |- + Message is a human readable description of the details of the last + transition, complementing reason. + type: string + reason: + description: |- + Reason is a brief machine readable explanation for the condition's last + transition. + type: string + status: + description: Status of the condition, one of (`True`, `False`, `Unknown`). + type: string + enum: + - "True" + - "False" + - Unknown + type: + description: |- + Type of the condition, known values are (`Ready`, `InvalidRequest`, + `Approved`, `Denied`). + type: string + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + failureTime: + description: |- + FailureTime stores the time that this CertificateRequest failed. This is + used to influence garbage collection and back-off. + type: string + format: date-time + served: true + storage: true - The `region` field is not needed if you use [IAM Roles for Service Accounts (IRSA)](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html). - Instead an AWS_REGION environment variable is added to the cert-manager controller Pod by: - [Amazon EKS Pod Identity Webhook](https://github.com/aws/amazon-eks-pod-identity-webhook). - In this case this `region` field value is ignored. +# END crd +--- +# Source: cert-manager/templates/crds.yaml +# START crd +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: certificates.cert-manager.io + # START annotations + annotations: + helm.sh/resource-policy: keep + # END annotations + labels: + app: 'cert-manager' + app.kubernetes.io/name: 'cert-manager' + app.kubernetes.io/instance: 'cert-manager' + # Generated labels + app.kubernetes.io/version: "v1.17.0" + app.kubernetes.io/managed-by: Helm + helm.sh/chart: cert-manager-v1.17.0 +spec: + group: cert-manager.io + names: + kind: Certificate + listKind: CertificateList + plural: certificates + shortNames: + - cert + - certs + singular: certificate + categories: + - cert-manager + scope: Namespaced + versions: + - name: v1 + subresources: + status: {} + additionalPrinterColumns: + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .spec.secretName + name: Secret + type: string + - jsonPath: .spec.issuerRef.name + name: Issuer + priority: 1 + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + priority: 1 + type: string + - jsonPath: .metadata.creationTimestamp + description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. + name: Age + type: date + schema: + openAPIV3Schema: + description: |- + A Certificate resource should be created to ensure an up to date and signed + X.509 certificate is stored in the Kubernetes Secret resource named in `spec.secretName`. - The `region` field is not needed if you use [EKS Pod Identities](https://docs.aws.amazon.com/eks/latest/userguide/pod-identities.html). - Instead an AWS_REGION environment variable is added to the cert-manager controller Pod by: - [Amazon EKS Pod Identity Agent](https://github.com/aws/eks-pod-identity-agent), - In this case this `region` field value is ignored. - type: string - role: - description: |- - Role is a Role ARN which the Route53 provider will assume using either the explicit credentials AccessKeyID/SecretAccessKey - or the inferred credentials from environment variables, shared credentials file or AWS Instance metadata - type: string - secretAccessKeySecretRef: - description: |- - The SecretAccessKey is used for authentication. - If neither the Access Key nor Key ID are set, we fall back to using env - vars, shared credentials file, or AWS Instance metadata, - see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials - properties: - key: - description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. - type: string - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - required: - - name - type: object - type: object - webhook: + The stored certificate will be renewed before it expires (as configured by `spec.renewBefore`). + type: object + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: |- + Specification of the desired state of the Certificate resource. + https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status + type: object + required: + - issuerRef + - secretName + properties: + additionalOutputFormats: + description: |- + Defines extra output formats of the private key and signed certificate chain + to be written to this Certificate's target Secret. + + This is a Beta Feature enabled by default. It can be disabled with the + `--feature-gates=AdditionalCertificateOutputFormats=false` option set on both + the controller and webhook components. + type: array + items: + description: |- + CertificateAdditionalOutputFormat defines an additional output format of a + Certificate resource. These contain supplementary data formats of the signed + certificate chain and paired private key. + type: object + required: + - type + properties: + type: + description: |- + Type is the name of the format type that should be written to the + Certificate's target Secret. + type: string + enum: + - DER + - CombinedPEM + commonName: + description: |- + Requested common name X509 certificate subject attribute. + More info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.6 + NOTE: TLS clients will ignore this value when any subject alternative name is + set (see https://tools.ietf.org/html/rfc6125#section-6.4.4). + + Should have a length of 64 characters or fewer to avoid generating invalid CSRs. + Cannot be set if the `literalSubject` field is set. + type: string + dnsNames: + description: Requested DNS subject alternative names. + type: array + items: + type: string + duration: + description: |- + Requested 'duration' (i.e. lifetime) of the Certificate. Note that the + issuer may choose to ignore the requested duration, just like any other + requested attribute. + + If unset, this defaults to 90 days. + Minimum accepted duration is 1 hour. + Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration. + type: string + emailAddresses: + description: Requested email subject alternative names. + type: array + items: + type: string + encodeUsagesInRequest: + description: |- + Whether the KeyUsage and ExtKeyUsage extensions should be set in the encoded CSR. + + This option defaults to true, and should only be disabled if the target + issuer does not support CSRs with these X509 KeyUsage/ ExtKeyUsage extensions. + type: boolean + ipAddresses: + description: Requested IP address subject alternative names. + type: array + items: + type: string + isCA: + description: |- + Requested basic constraints isCA value. + The isCA value is used to set the `isCA` field on the created CertificateRequest + resources. Note that the issuer may choose to ignore the requested isCA value, just + like any other requested attribute. + + If true, this will automatically add the `cert sign` usage to the list + of requested `usages`. + type: boolean + issuerRef: + description: |- + Reference to the issuer responsible for issuing the certificate. + If the issuer is namespace-scoped, it must be in the same namespace + as the Certificate. If the issuer is cluster-scoped, it can be used + from any namespace. + + The `name` field of the reference must always be specified. + type: object + required: + - name + properties: + group: + description: Group of the resource being referred to. + type: string + kind: + description: Kind of the resource being referred to. + type: string + name: + description: Name of the resource being referred to. + type: string + keystores: + description: Additional keystore output formats to be stored in the Certificate's Secret. + type: object + properties: + jks: + description: |- + JKS configures options for storing a JKS keystore in the + `spec.secretName` Secret resource. + type: object + required: + - create + properties: + alias: description: |- - Configure an external webhook based DNS01 challenge solver to manage - DNS01 challenge records. + Alias specifies the alias of the key in the keystore, required by the JKS format. + If not provided, the default alias `certificate` will be used. + type: string + create: + description: |- + Create enables JKS keystore creation for the Certificate. + If true, a file named `keystore.jks` will be created in the target + Secret resource, encrypted using the password stored in + `passwordSecretRef` or `password`. + The keystore file will be updated immediately. + If the issuer provided a CA certificate, a file named `truststore.jks` + will also be created in the target Secret resource, encrypted using the + password stored in `passwordSecretRef` + containing the issuing Certificate Authority + type: boolean + password: + description: |- + Password provides a literal password used to encrypt the JKS keystore. + Mutually exclusive with passwordSecretRef. + One of password or passwordSecretRef must provide a password with a non-zero length. + type: string + passwordSecretRef: + description: |- + PasswordSecretRef is a reference to a non-empty key in a Secret resource + containing the password used to encrypt the JKS keystore. + Mutually exclusive with password. + One of password or passwordSecretRef must provide a password with a non-zero length. + type: object + required: + - name properties: - config: - description: |- - Additional configuration that should be passed to the webhook apiserver - when challenges are processed. - This can contain arbitrary JSON data. - Secret values should not be specified in this stanza. - If secret values are needed (e.g., credentials for a DNS service), you - should use a SecretKeySelector to reference a Secret resource. - For details on the schema of this field, consult the webhook provider - implementation's documentation. - x-kubernetes-preserve-unknown-fields: true - groupName: + key: description: |- - The API group name that should be used when POSTing ChallengePayload - resources to the webhook apiserver. - This should be the same as the GroupName specified in the webhook - provider implementation. + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. type: string - solverName: + name: description: |- - The name of the solver to use, as defined in the webhook provider - implementation. - This will typically be the name of the provider, e.g., 'cloudflare'. + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string - required: - - groupName - - solverName - type: object - type: object - http01: + pkcs12: description: |- - Configures cert-manager to attempt to complete authorizations by - performing the HTTP01 challenge flow. - It is not possible to obtain certificates for wildcard domain names - (e.g., `*.example.com`) using the HTTP01 challenge mechanism. + PKCS12 configures options for storing a PKCS12 keystore in the + `spec.secretName` Secret resource. + type: object + required: + - create properties: - gatewayHTTPRoute: + create: description: |- - The Gateway API is a sig-network community API that models service networking - in Kubernetes (https://gateway-api.sigs.k8s.io/). The Gateway solver will - create HTTPRoutes with the specified labels in the same namespace as the challenge. - This solver is experimental, and fields / behaviour may change in the future. + Create enables PKCS12 keystore creation for the Certificate. + If true, a file named `keystore.p12` will be created in the target + Secret resource, encrypted using the password stored in + `passwordSecretRef` or in `password`. + The keystore file will be updated immediately. + If the issuer provided a CA certificate, a file named `truststore.p12` will + also be created in the target Secret resource, encrypted using the + password stored in `passwordSecretRef` containing the issuing Certificate + Authority + type: boolean + password: + description: |- + Password provides a literal password used to encrypt the PKCS#12 keystore. + Mutually exclusive with passwordSecretRef. + One of password or passwordSecretRef must provide a password with a non-zero length. + type: string + passwordSecretRef: + description: |- + PasswordSecretRef is a reference to a non-empty key in a Secret resource + containing the password used to encrypt the PKCS#12 keystore. + Mutually exclusive with password. + One of password or passwordSecretRef must provide a password with a non-zero length. + type: object + required: + - name properties: - labels: - additionalProperties: - type: string + key: description: |- - Custom labels that will be applied to HTTPRoutes created by cert-manager - while solving HTTP-01 challenges. - type: object - parentRefs: + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: description: |- - When solving an HTTP-01 challenge, cert-manager creates an HTTPRoute. - cert-manager needs to know which parentRefs should be used when creating - the HTTPRoute. Usually, the parentRef references a Gateway. See: - https://gateway-api.sigs.k8s.io/api-types/httproute/#attaching-to-gateways - items: - description: |- - ParentReference identifies an API object (usually a Gateway) that can be considered - a parent of this resource (usually a route). There are two kinds of parent resources - with "Core" support: + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + profile: + description: |- + Profile specifies the key and certificate encryption algorithms and the HMAC algorithm + used to create the PKCS12 keystore. Default value is `LegacyRC2` for backward compatibility. - * Gateway (Gateway conformance profile) - * Service (Mesh conformance profile, ClusterIP Services only) + If provided, allowed values are: + `LegacyRC2`: Deprecated. Not supported by default in OpenSSL 3 or Java 20. + `LegacyDES`: Less secure algorithm. Use this option for maximal compatibility. + `Modern2023`: Secure algorithm. Use this option in case you have to always use secure algorithms + (eg. because of company policy). Please note that the security of the algorithm is not that important + in reality, because the unencrypted certificate and private key are also stored in the Secret. + type: string + enum: + - LegacyRC2 + - LegacyDES + - Modern2023 + literalSubject: + description: |- + Requested X.509 certificate subject, represented using the LDAP "String + Representation of a Distinguished Name" [1]. + Important: the LDAP string format also specifies the order of the attributes + in the subject, this is important when issuing certs for LDAP authentication. + Example: `CN=foo,DC=corp,DC=example,DC=com` + More info [1]: https://datatracker.ietf.org/doc/html/rfc4514 + More info: https://github.com/cert-manager/cert-manager/issues/3203 + More info: https://github.com/cert-manager/cert-manager/issues/4424 - This API may be extended in the future to support additional kinds of parent - resources. + Cannot be set if the `subject` or `commonName` field is set. + type: string + nameConstraints: + description: |- + x.509 certificate NameConstraint extension which MUST NOT be used in a non-CA certificate. + More Info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.10 - The API object must be valid in the cluster; the Group and Kind must - be registered in the cluster for this reference to be valid. - properties: - group: - default: gateway.networking.k8s.io - description: |- - Group is the group of the referent. - When unspecified, "gateway.networking.k8s.io" is inferred. - To set the core API group (such as for a "Service" kind referent), - Group must be explicitly set to "" (empty string). + This is an Alpha Feature and is only enabled with the + `--feature-gates=NameConstraints=true` option set on both + the controller and webhook components. + type: object + properties: + critical: + description: if true then the name constraints are marked critical. + type: boolean + excluded: + description: |- + Excluded contains the constraints which must be disallowed. Any name matching a + restriction in the excluded field is invalid regardless + of information appearing in the permitted + type: object + properties: + dnsDomains: + description: DNSDomains is a list of DNS domains that are permitted or excluded. + type: array + items: + type: string + emailAddresses: + description: EmailAddresses is a list of Email Addresses that are permitted or excluded. + type: array + items: + type: string + ipRanges: + description: |- + IPRanges is a list of IP Ranges that are permitted or excluded. + This should be a valid CIDR notation. + type: array + items: + type: string + uriDomains: + description: URIDomains is a list of URI domains that are permitted or excluded. + type: array + items: + type: string + permitted: + description: Permitted contains the constraints in which the names must be located. + type: object + properties: + dnsDomains: + description: DNSDomains is a list of DNS domains that are permitted or excluded. + type: array + items: + type: string + emailAddresses: + description: EmailAddresses is a list of Email Addresses that are permitted or excluded. + type: array + items: + type: string + ipRanges: + description: |- + IPRanges is a list of IP Ranges that are permitted or excluded. + This should be a valid CIDR notation. + type: array + items: + type: string + uriDomains: + description: URIDomains is a list of URI domains that are permitted or excluded. + type: array + items: + type: string + otherNames: + description: |- + `otherNames` is an escape hatch for SAN that allows any type. We currently restrict the support to string like otherNames, cf RFC 5280 p 37 + Any UTF8 String valued otherName can be passed with by setting the keys oid: x.x.x.x and UTF8Value: somevalue for `otherName`. + Most commonly this would be UPN set with oid: 1.3.6.1.4.1.311.20.2.3 + You should ensure that any OID passed is valid for the UTF8String type as we do not explicitly validate this. + type: array + items: + type: object + properties: + oid: + description: |- + OID is the object identifier for the otherName SAN. + The object identifier must be expressed as a dotted string, for + example, "1.2.840.113556.1.4.221". + type: string + utf8Value: + description: |- + utf8Value is the string value of the otherName SAN. + The utf8Value accepts any valid UTF8 string to set as value for the otherName SAN. + type: string + privateKey: + description: |- + Private key options. These include the key algorithm and size, the used + encoding and the rotation policy. + type: object + properties: + algorithm: + description: |- + Algorithm is the private key algorithm of the corresponding private key + for this certificate. - Support: Core - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - default: Gateway - description: |- - Kind is kind of the referent. + If provided, allowed values are either `RSA`, `ECDSA` or `Ed25519`. + If `algorithm` is specified and `size` is not provided, + key size of 2048 will be used for `RSA` key algorithm and + key size of 256 will be used for `ECDSA` key algorithm. + key size is ignored when using the `Ed25519` key algorithm. + type: string + enum: + - RSA + - ECDSA + - Ed25519 + encoding: + description: |- + The private key cryptography standards (PKCS) encoding for this + certificate's private key to be encoded in. - There are two kinds of parent resources with "Core" support: + If provided, allowed values are `PKCS1` and `PKCS8` standing for PKCS#1 + and PKCS#8, respectively. + Defaults to `PKCS1` if not specified. + type: string + enum: + - PKCS1 + - PKCS8 + rotationPolicy: + description: |- + RotationPolicy controls how private keys should be regenerated when a + re-issuance is being processed. - * Gateway (Gateway conformance profile) - * Service (Mesh conformance profile, ClusterIP Services only) + If set to `Never`, a private key will only be generated if one does not + already exist in the target `spec.secretName`. If one does exist but it + does not have the correct algorithm or size, a warning will be raised + to await user intervention. + If set to `Always`, a private key matching the specified requirements + will be generated whenever a re-issuance occurs. + Default is `Never` for backward compatibility. + type: string + enum: + - Never + - Always + size: + description: |- + Size is the key bit size of the corresponding private key for this certificate. - Support for other resources is Implementation-Specific. - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: |- - Name is the name of the referent. + If `algorithm` is set to `RSA`, valid values are `2048`, `4096` or `8192`, + and will default to `2048` if not specified. + If `algorithm` is set to `ECDSA`, valid values are `256`, `384` or `521`, + and will default to `256` if not specified. + If `algorithm` is set to `Ed25519`, Size is ignored. + No other values are allowed. + type: integer + renewBefore: + description: |- + How long before the currently issued certificate's expiry cert-manager should + renew the certificate. For example, if a certificate is valid for 60 minutes, + and `renewBefore=10m`, cert-manager will begin to attempt to renew the certificate + 50 minutes after it was issued (i.e. when there are 10 minutes remaining until + the certificate is no longer valid). - Support: Core - maxLength: 253 - minLength: 1 - type: string - namespace: - description: |- - Namespace is the namespace of the referent. When unspecified, this refers - to the local namespace of the Route. + NOTE: The actual lifetime of the issued certificate is used to determine the + renewal time. If an issuer returns a certificate with a different lifetime than + the one requested, cert-manager will use the lifetime of the issued certificate. - Note that there are specific rules for ParentRefs which cross namespace - boundaries. Cross-namespace references are only valid if they are explicitly - allowed by something in the namespace they are referring to. For example: - Gateway has the AllowedRoutes field, and ReferenceGrant provides a - generic way to enable any other kind of cross-namespace reference. + If unset, this defaults to 1/3 of the issued certificate's lifetime. + Minimum accepted value is 5 minutes. + Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration. + Cannot be set if the `renewBeforePercentage` field is set. + type: string + renewBeforePercentage: + description: |- + `renewBeforePercentage` is like `renewBefore`, except it is a relative percentage + rather than an absolute duration. For example, if a certificate is valid for 60 + minutes, and `renewBeforePercentage=25`, cert-manager will begin to attempt to + renew the certificate 45 minutes after it was issued (i.e. when there are 15 + minutes (25%) remaining until the certificate is no longer valid). - - ParentRefs from a Route to a Service in the same namespace are "producer" - routes, which apply default routing rules to inbound connections from - any namespace to the Service. - - ParentRefs from a Route to a Service in a different namespace are - "consumer" routes, and these routing rules are only applied to outbound - connections originating from the same namespace as the Route, for which - the intended destination of the connections are a Service targeted as a - ParentRef of the Route. - - - Support: Core - maxLength: 63 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ - type: string - port: - description: |- - Port is the network port this Route targets. It can be interpreted - differently based on the type of parent resource. - - When the parent resource is a Gateway, this targets all listeners - listening on the specified port that also support this kind of Route(and - select this Route). It's not recommended to set `Port` unless the - networking behaviors specified in a Route must apply to a specific port - as opposed to a listener(s) whose port(s) may be changed. When both Port - and SectionName are specified, the name and port of the selected listener - must match both specified values. - - - When the parent resource is a Service, this targets a specific port in the - Service spec. When both Port (experimental) and SectionName are specified, - the name and port of the selected port must match both specified values. - - - Implementations MAY choose to support other parent resources. - Implementations supporting other types of parent resources MUST clearly - document how/if Port is interpreted. - - For the purpose of status, an attachment is considered successful as - long as the parent resource accepts it partially. For example, Gateway - listeners can restrict which Routes can attach to them by Route kind, - namespace, or hostname. If 1 of 2 Gateway listeners accept attachment - from the referencing Route, the Route MUST be considered successfully - attached. If no Gateway listeners accept attachment from this Route, - the Route MUST be considered detached from the Gateway. + NOTE: The actual lifetime of the issued certificate is used to determine the + renewal time. If an issuer returns a certificate with a different lifetime than + the one requested, cert-manager will use the lifetime of the issued certificate. - Support: Extended - format: int32 - maximum: 65535 - minimum: 1 - type: integer - sectionName: - description: |- - SectionName is the name of a section within the target resource. In the - following resources, SectionName is interpreted as the following: + Value must be an integer in the range (0,100). The minimum effective + `renewBefore` derived from the `renewBeforePercentage` and `duration` fields is 5 + minutes. + Cannot be set if the `renewBefore` field is set. + type: integer + format: int32 + revisionHistoryLimit: + description: |- + The maximum number of CertificateRequest revisions that are maintained in + the Certificate's history. Each revision represents a single `CertificateRequest` + created by this Certificate, either when it was created, renewed, or Spec + was changed. Revisions will be removed by oldest first if the number of + revisions exceeds this number. - * Gateway: Listener name. When both Port (experimental) and SectionName - are specified, the name and port of the selected listener must match - both specified values. - * Service: Port name. When both Port (experimental) and SectionName - are specified, the name and port of the selected listener must match - both specified values. + If set, revisionHistoryLimit must be a value of `1` or greater. + If unset (`nil`), revisions will not be garbage collected. + Default value is `nil`. + type: integer + format: int32 + secretName: + description: |- + Name of the Secret resource that will be automatically created and + managed by this Certificate resource. It will be populated with a + private key and certificate, signed by the denoted issuer. The Secret + resource lives in the same namespace as the Certificate resource. + type: string + secretTemplate: + description: |- + Defines annotations and labels to be copied to the Certificate's Secret. + Labels and annotations on the Secret will be changed as they appear on the + SecretTemplate when added or removed. SecretTemplate annotations are added + in conjunction with, and cannot overwrite, the base set of annotations + cert-manager sets on the Certificate's Secret. + type: object + properties: + annotations: + description: Annotations is a key value map to be copied to the target Kubernetes Secret. + type: object + additionalProperties: + type: string + labels: + description: Labels is a key value map to be copied to the target Kubernetes Secret. + type: object + additionalProperties: + type: string + subject: + description: |- + Requested set of X509 certificate subject attributes. + More info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.6 - Implementations MAY choose to support attaching Routes to other resources. - If that is the case, they MUST clearly document how SectionName is - interpreted. + The common name attribute is specified separately in the `commonName` field. + Cannot be set if the `literalSubject` field is set. + type: object + properties: + countries: + description: Countries to be used on the Certificate. + type: array + items: + type: string + localities: + description: Cities to be used on the Certificate. + type: array + items: + type: string + organizationalUnits: + description: Organizational Units to be used on the Certificate. + type: array + items: + type: string + organizations: + description: Organizations to be used on the Certificate. + type: array + items: + type: string + postalCodes: + description: Postal codes to be used on the Certificate. + type: array + items: + type: string + provinces: + description: State/Provinces to be used on the Certificate. + type: array + items: + type: string + serialNumber: + description: Serial number to be used on the Certificate. + type: string + streetAddresses: + description: Street addresses to be used on the Certificate. + type: array + items: + type: string + uris: + description: Requested URI subject alternative names. + type: array + items: + type: string + usages: + description: |- + Requested key usages and extended key usages. + These usages are used to set the `usages` field on the created CertificateRequest + resources. If `encodeUsagesInRequest` is unset or set to `true`, the usages + will additionally be encoded in the `request` field which contains the CSR blob. - When unspecified (empty string), this will reference the entire resource. - For the purpose of status, an attachment is considered successful if at - least one section in the parent resource accepts it. For example, Gateway - listeners can restrict which Routes can attach to them by Route kind, - namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from - the referencing Route, the Route MUST be considered successfully - attached. If no Gateway listeners accept attachment from this Route, the - Route MUST be considered detached from the Gateway. - - Support: Core - maxLength: 253 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - required: - - name - type: object - type: array - x-kubernetes-list-type: atomic - podTemplate: - description: |- - Optional pod template used to configure the ACME challenge solver pods - used for HTTP01 challenges. - properties: - metadata: - description: |- - ObjectMeta overrides for the pod used to solve HTTP01 challenges. - Only the 'labels' and 'annotations' fields may be set. - If labels or annotations overlap with in-built values, the values here - will override the in-built values. - properties: - annotations: - additionalProperties: - type: string - description: Annotations that should be added to the created ACME HTTP01 solver pods. - type: object - labels: - additionalProperties: - type: string - description: Labels that should be added to the created ACME HTTP01 solver pods. - type: object - type: object - spec: - description: |- - PodSpec defines overrides for the HTTP01 challenge solver pod. - Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields. - All other fields will be ignored. - properties: - affinity: - description: If specified, the pod's scheduling constraints - properties: - nodeAffinity: - description: Describes node affinity scheduling rules for the pod. - properties: - preferredDuringSchedulingIgnoredDuringExecution: - description: |- - The scheduler will prefer to schedule pods to nodes that satisfy - the affinity expressions specified by this field, but it may choose - a node that violates one or more of the expressions. The node that is - most preferred is the one with the greatest sum of weights, i.e. - for each node that meets all of the scheduling requirements (resource - request, requiredDuringScheduling affinity expressions, etc.), - compute a sum by iterating through the elements of this field and adding - "weight" to the sum if the node matches the corresponding matchExpressions; the - node(s) with the highest sum are the most preferred. - items: - description: |- - An empty preferred scheduling term matches all objects with implicit weight 0 - (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). - properties: - preference: - description: A node selector term, associated with the corresponding weight. - properties: - matchExpressions: - description: A list of node selector requirements by node's labels. - items: - description: |- - A node selector requirement is a selector that contains values, a key, and an operator - that relates the key and values. - properties: - key: - description: The label key that the selector applies to. - type: string - operator: - description: |- - Represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. - type: string - values: - description: |- - An array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. If the operator is Gt or Lt, the values - array must have a single element, which will be interpreted as an integer. - This array is replaced during a strategic merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchFields: - description: A list of node selector requirements by node's fields. - items: - description: |- - A node selector requirement is a selector that contains values, a key, and an operator - that relates the key and values. - properties: - key: - description: The label key that the selector applies to. - type: string - operator: - description: |- - Represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. - type: string - values: - description: |- - An array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. If the operator is Gt or Lt, the values - array must have a single element, which will be interpreted as an integer. - This array is replaced during a strategic merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - type: object - x-kubernetes-map-type: atomic - weight: - description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100. - format: int32 - type: integer - required: - - preference - - weight - type: object - type: array - x-kubernetes-list-type: atomic - requiredDuringSchedulingIgnoredDuringExecution: - description: |- - If the affinity requirements specified by this field are not met at - scheduling time, the pod will not be scheduled onto the node. - If the affinity requirements specified by this field cease to be met - at some point during pod execution (e.g. due to an update), the system - may or may not try to eventually evict the pod from its node. - properties: - nodeSelectorTerms: - description: Required. A list of node selector terms. The terms are ORed. - items: - description: |- - A null or empty node selector term matches no objects. The requirements of - them are ANDed. - The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. - properties: - matchExpressions: - description: A list of node selector requirements by node's labels. - items: - description: |- - A node selector requirement is a selector that contains values, a key, and an operator - that relates the key and values. - properties: - key: - description: The label key that the selector applies to. - type: string - operator: - description: |- - Represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. - type: string - values: - description: |- - An array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. If the operator is Gt or Lt, the values - array must have a single element, which will be interpreted as an integer. - This array is replaced during a strategic merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchFields: - description: A list of node selector requirements by node's fields. - items: - description: |- - A node selector requirement is a selector that contains values, a key, and an operator - that relates the key and values. - properties: - key: - description: The label key that the selector applies to. - type: string - operator: - description: |- - Represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. - type: string - values: - description: |- - An array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. If the operator is Gt or Lt, the values - array must have a single element, which will be interpreted as an integer. - This array is replaced during a strategic merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - type: object - x-kubernetes-map-type: atomic - type: array - x-kubernetes-list-type: atomic - required: - - nodeSelectorTerms - type: object - x-kubernetes-map-type: atomic - type: object - podAffinity: - description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)). - properties: - preferredDuringSchedulingIgnoredDuringExecution: - description: |- - The scheduler will prefer to schedule pods to nodes that satisfy - the affinity expressions specified by this field, but it may choose - a node that violates one or more of the expressions. The node that is - most preferred is the one with the greatest sum of weights, i.e. - for each node that meets all of the scheduling requirements (resource - request, requiredDuringScheduling affinity expressions, etc.), - compute a sum by iterating through the elements of this field and adding - "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the - node(s) with the highest sum are the most preferred. - items: - description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) - properties: - podAffinityTerm: - description: Required. A pod affinity term, associated with the corresponding weight. - properties: - labelSelector: - description: |- - A label query over a set of resources, in this case pods. - If it's null, this PodAffinityTerm matches with no Pods. - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - matchLabelKeys: - description: |- - MatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both matchLabelKeys and labelSelector. - Also, matchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - mismatchLabelKeys: - description: |- - MismatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. - Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - namespaceSelector: - description: |- - A label query over the set of namespaces that the term applies to. - The term is applied to the union of the namespaces selected by this field - and the ones listed in the namespaces field. - null selector and null or empty namespaces list means "this pod's namespace". - An empty selector ({}) matches all namespaces. - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - namespaces: - description: |- - namespaces specifies a static list of namespace names that the term applies to. - The term is applied to the union of the namespaces listed in this field - and the ones selected by namespaceSelector. - null or empty namespaces list and null namespaceSelector means "this pod's namespace". - items: - type: string - type: array - x-kubernetes-list-type: atomic - topologyKey: - description: |- - This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching - the labelSelector in the specified namespaces, where co-located is defined as running on a node - whose value of the label with key topologyKey matches that of any node on which any of the - selected pods is running. - Empty topologyKey is not allowed. - type: string - required: - - topologyKey - type: object - weight: - description: |- - weight associated with matching the corresponding podAffinityTerm, - in the range 1-100. - format: int32 - type: integer - required: - - podAffinityTerm - - weight - type: object - type: array - x-kubernetes-list-type: atomic - requiredDuringSchedulingIgnoredDuringExecution: - description: |- - If the affinity requirements specified by this field are not met at - scheduling time, the pod will not be scheduled onto the node. - If the affinity requirements specified by this field cease to be met - at some point during pod execution (e.g. due to a pod label update), the - system may or may not try to eventually evict the pod from its node. - When there are multiple elements, the lists of nodes corresponding to each - podAffinityTerm are intersected, i.e. all terms must be satisfied. - items: - description: |- - Defines a set of pods (namely those matching the labelSelector - relative to the given namespace(s)) that this pod should be - co-located (affinity) or not co-located (anti-affinity) with, - where co-located is defined as running on a node whose value of - the label with key matches that of any node on which - a pod of the set of pods is running - properties: - labelSelector: - description: |- - A label query over a set of resources, in this case pods. - If it's null, this PodAffinityTerm matches with no Pods. - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - matchLabelKeys: - description: |- - MatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both matchLabelKeys and labelSelector. - Also, matchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - mismatchLabelKeys: - description: |- - MismatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. - Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - namespaceSelector: - description: |- - A label query over the set of namespaces that the term applies to. - The term is applied to the union of the namespaces selected by this field - and the ones listed in the namespaces field. - null selector and null or empty namespaces list means "this pod's namespace". - An empty selector ({}) matches all namespaces. - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - namespaces: - description: |- - namespaces specifies a static list of namespace names that the term applies to. - The term is applied to the union of the namespaces listed in this field - and the ones selected by namespaceSelector. - null or empty namespaces list and null namespaceSelector means "this pod's namespace". - items: - type: string - type: array - x-kubernetes-list-type: atomic - topologyKey: - description: |- - This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching - the labelSelector in the specified namespaces, where co-located is defined as running on a node - whose value of the label with key topologyKey matches that of any node on which any of the - selected pods is running. - Empty topologyKey is not allowed. - type: string - required: - - topologyKey - type: object - type: array - x-kubernetes-list-type: atomic - type: object - podAntiAffinity: - description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)). - properties: - preferredDuringSchedulingIgnoredDuringExecution: - description: |- - The scheduler will prefer to schedule pods to nodes that satisfy - the anti-affinity expressions specified by this field, but it may choose - a node that violates one or more of the expressions. The node that is - most preferred is the one with the greatest sum of weights, i.e. - for each node that meets all of the scheduling requirements (resource - request, requiredDuringScheduling anti-affinity expressions, etc.), - compute a sum by iterating through the elements of this field and subtracting - "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the - node(s) with the highest sum are the most preferred. - items: - description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) - properties: - podAffinityTerm: - description: Required. A pod affinity term, associated with the corresponding weight. - properties: - labelSelector: - description: |- - A label query over a set of resources, in this case pods. - If it's null, this PodAffinityTerm matches with no Pods. - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - matchLabelKeys: - description: |- - MatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both matchLabelKeys and labelSelector. - Also, matchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - mismatchLabelKeys: - description: |- - MismatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. - Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - namespaceSelector: - description: |- - A label query over the set of namespaces that the term applies to. - The term is applied to the union of the namespaces selected by this field - and the ones listed in the namespaces field. - null selector and null or empty namespaces list means "this pod's namespace". - An empty selector ({}) matches all namespaces. - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - namespaces: - description: |- - namespaces specifies a static list of namespace names that the term applies to. - The term is applied to the union of the namespaces listed in this field - and the ones selected by namespaceSelector. - null or empty namespaces list and null namespaceSelector means "this pod's namespace". - items: - type: string - type: array - x-kubernetes-list-type: atomic - topologyKey: - description: |- - This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching - the labelSelector in the specified namespaces, where co-located is defined as running on a node - whose value of the label with key topologyKey matches that of any node on which any of the - selected pods is running. - Empty topologyKey is not allowed. - type: string - required: - - topologyKey - type: object - weight: - description: |- - weight associated with matching the corresponding podAffinityTerm, - in the range 1-100. - format: int32 - type: integer - required: - - podAffinityTerm - - weight - type: object - type: array - x-kubernetes-list-type: atomic - requiredDuringSchedulingIgnoredDuringExecution: - description: |- - If the anti-affinity requirements specified by this field are not met at - scheduling time, the pod will not be scheduled onto the node. - If the anti-affinity requirements specified by this field cease to be met - at some point during pod execution (e.g. due to a pod label update), the - system may or may not try to eventually evict the pod from its node. - When there are multiple elements, the lists of nodes corresponding to each - podAffinityTerm are intersected, i.e. all terms must be satisfied. - items: - description: |- - Defines a set of pods (namely those matching the labelSelector - relative to the given namespace(s)) that this pod should be - co-located (affinity) or not co-located (anti-affinity) with, - where co-located is defined as running on a node whose value of - the label with key matches that of any node on which - a pod of the set of pods is running - properties: - labelSelector: - description: |- - A label query over a set of resources, in this case pods. - If it's null, this PodAffinityTerm matches with no Pods. - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - matchLabelKeys: - description: |- - MatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both matchLabelKeys and labelSelector. - Also, matchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - mismatchLabelKeys: - description: |- - MismatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. - Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - namespaceSelector: - description: |- - A label query over the set of namespaces that the term applies to. - The term is applied to the union of the namespaces selected by this field - and the ones listed in the namespaces field. - null selector and null or empty namespaces list means "this pod's namespace". - An empty selector ({}) matches all namespaces. - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - namespaces: - description: |- - namespaces specifies a static list of namespace names that the term applies to. - The term is applied to the union of the namespaces listed in this field - and the ones selected by namespaceSelector. - null or empty namespaces list and null namespaceSelector means "this pod's namespace". - items: - type: string - type: array - x-kubernetes-list-type: atomic - topologyKey: - description: |- - This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching - the labelSelector in the specified namespaces, where co-located is defined as running on a node - whose value of the label with key topologyKey matches that of any node on which any of the - selected pods is running. - Empty topologyKey is not allowed. - type: string - required: - - topologyKey - type: object - type: array - x-kubernetes-list-type: atomic - type: object - type: object - imagePullSecrets: - description: If specified, the pod's imagePullSecrets - items: - description: |- - LocalObjectReference contains enough information to let you locate the - referenced object inside the same namespace. - properties: - name: - default: "" - description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - type: object - x-kubernetes-map-type: atomic - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - nodeSelector: - additionalProperties: - type: string - description: |- - NodeSelector is a selector which must be true for the pod to fit on a node. - Selector which must match a node's labels for the pod to be scheduled on that node. - More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ - type: object - priorityClassName: - description: If specified, the pod's priorityClassName. - type: string - resources: - description: |- - If specified, the pod's resource requirements. - These values override the global resource configuration flags. - Note that when only specifying resource limits, ensure they are greater than or equal - to the corresponding global resource requests configured via controller flags - (--acme-http01-solver-resource-request-cpu, --acme-http01-solver-resource-request-memory). - Kubernetes will reject pod creation if limits are lower than requests, causing challenge failures. - properties: - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: |- - Limits describes the maximum amount of compute resources allowed. - More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: |- - Requests describes the minimum amount of compute resources required. - If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, - otherwise to the global values configured via controller flags. Requests cannot exceed Limits. - More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ - type: object - type: object - securityContext: - description: If specified, the pod's security context - properties: - fsGroup: - description: |- - A special supplemental group that applies to all containers in a pod. - Some volume types allow the Kubelet to change the ownership of that volume - to be owned by the pod: - - 1. The owning GID will be the FSGroup - 2. The setgid bit is set (new files created in the volume will be owned by FSGroup) - 3. The permission bits are OR'd with rw-rw---- - - If unset, the Kubelet will not modify the ownership and permissions of any volume. - Note that this field cannot be set when spec.os.name is windows. - format: int64 - type: integer - fsGroupChangePolicy: - description: |- - fsGroupChangePolicy defines behavior of changing ownership and permission of the volume - before being exposed inside Pod. This field will only apply to - volume types which support fsGroup based ownership(and permissions). - It will have no effect on ephemeral volume types such as: secret, configmaps - and emptydir. - Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used. - Note that this field cannot be set when spec.os.name is windows. - type: string - runAsGroup: - description: |- - The GID to run the entrypoint of the container process. - Uses runtime default if unset. - May also be set in SecurityContext. If set in both SecurityContext and - PodSecurityContext, the value specified in SecurityContext takes precedence - for that container. - Note that this field cannot be set when spec.os.name is windows. - format: int64 - type: integer - runAsNonRoot: - description: |- - Indicates that the container must run as a non-root user. - If true, the Kubelet will validate the image at runtime to ensure that it - does not run as UID 0 (root) and fail to start the container if it does. - If unset or false, no such validation will be performed. - May also be set in SecurityContext. If set in both SecurityContext and - PodSecurityContext, the value specified in SecurityContext takes precedence. - type: boolean - runAsUser: - description: |- - The UID to run the entrypoint of the container process. - Defaults to user specified in image metadata if unspecified. - May also be set in SecurityContext. If set in both SecurityContext and - PodSecurityContext, the value specified in SecurityContext takes precedence - for that container. - Note that this field cannot be set when spec.os.name is windows. - format: int64 - type: integer - seLinuxOptions: - description: |- - The SELinux context to be applied to all containers. - If unspecified, the container runtime will allocate a random SELinux context for each - container. May also be set in SecurityContext. If set in - both SecurityContext and PodSecurityContext, the value specified in SecurityContext - takes precedence for that container. - Note that this field cannot be set when spec.os.name is windows. - properties: - level: - description: Level is SELinux level label that applies to the container. - type: string - role: - description: Role is a SELinux role label that applies to the container. - type: string - type: - description: Type is a SELinux type label that applies to the container. - type: string - user: - description: User is a SELinux user label that applies to the container. - type: string - type: object - seccompProfile: - description: |- - The seccomp options to use by the containers in this pod. - Note that this field cannot be set when spec.os.name is windows. - properties: - localhostProfile: - description: |- - localhostProfile indicates a profile defined in a file on the node should be used. - The profile must be preconfigured on the node to work. - Must be a descending path, relative to the kubelet's configured seccomp profile location. - Must be set if type is "Localhost". Must NOT be set for any other type. - type: string - type: - description: |- - type indicates which kind of seccomp profile will be applied. - Valid options are: - - Localhost - a profile defined in a file on the node should be used. - RuntimeDefault - the container runtime default profile should be used. - Unconfined - no profile should be applied. - type: string - required: - - type - type: object - supplementalGroups: - description: |- - A list of groups applied to the first process run in each container, in addition - to the container's primary GID, the fsGroup (if specified), and group memberships - defined in the container image for the uid of the container process. If unspecified, - no additional groups are added to any container. Note that group memberships - defined in the container image for the uid of the container process are still effective, - even if they are not included in this list. - Note that this field cannot be set when spec.os.name is windows. - items: - format: int64 - type: integer - type: array - x-kubernetes-list-type: atomic - sysctls: - description: |- - Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported - sysctls (by the container runtime) might fail to launch. - Note that this field cannot be set when spec.os.name is windows. - items: - description: Sysctl defines a kernel parameter to be set - properties: - name: - description: Name of a property to set - type: string - value: - description: Value of a property to set - type: string - required: - - name - - value - type: object - type: array - x-kubernetes-list-type: atomic - type: object - serviceAccountName: - description: If specified, the pod's service account - type: string - tolerations: - description: If specified, the pod's tolerations. - items: - description: |- - The pod this Toleration is attached to tolerates any taint that matches - the triple using the matching operator . - properties: - effect: - description: |- - Effect indicates the taint effect to match. Empty means match all taint effects. - When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. - type: string - key: - description: |- - Key is the taint key that the toleration applies to. Empty means match all taint keys. - If the key is empty, operator must be Exists; this combination means to match all values and all keys. - type: string - operator: - description: |- - Operator represents a key's relationship to the value. - Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. - Exists is equivalent to wildcard for value, so that a pod can - tolerate all taints of a particular category. - Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). - type: string - tolerationSeconds: - description: |- - TolerationSeconds represents the period of time the toleration (which must be - of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, - it is not set, which means tolerate the taint forever (do not evict). Zero and - negative values will be treated as 0 (evict immediately) by the system. - format: int64 - type: integer - value: - description: |- - Value is the taint value the toleration matches to. - If the operator is Exists, the value should be empty, otherwise just a regular string. - type: string - type: object - type: array - x-kubernetes-list-type: atomic - type: object - type: object - serviceType: - description: |- - Optional service type for Kubernetes solver service. Supported values - are NodePort or ClusterIP. If unset, defaults to NodePort. - type: string - type: object - ingress: - description: |- - The ingress based HTTP01 challenge solver will solve challenges by - creating or modifying Ingress resources in order to route requests for - '/.well-known/acme-challenge/XYZ' to 'challenge solver' pods that are - provisioned by cert-manager for each Challenge to be completed. - properties: - class: - description: |- - This field configures the annotation `kubernetes.io/ingress.class` when - creating Ingress resources to solve ACME challenges that use this - challenge solver. Only one of `class`, `name` or `ingressClassName` may - be specified. - type: string - ingressClassName: - description: |- - This field configures the field `ingressClassName` on the created Ingress - resources used to solve ACME challenges that use this challenge solver. - This is the recommended way of configuring the ingress class. Only one of - `class`, `name` or `ingressClassName` may be specified. - type: string - ingressTemplate: - description: |- - Optional ingress template used to configure the ACME challenge solver - ingress used for HTTP01 challenges. - properties: - metadata: - description: |- - ObjectMeta overrides for the ingress used to solve HTTP01 challenges. - Only the 'labels' and 'annotations' fields may be set. - If labels or annotations overlap with in-built values, the values here - will override the in-built values. - properties: - annotations: - additionalProperties: - type: string - description: Annotations that should be added to the created ACME HTTP01 solver ingress. - type: object - labels: - additionalProperties: - type: string - description: Labels that should be added to the created ACME HTTP01 solver ingress. - type: object - type: object - type: object - name: - description: |- - The name of the ingress resource that should have ACME challenge solving - routes inserted into it in order to solve HTTP01 challenges. - This is typically used in conjunction with ingress controllers like - ingress-gce, which maintains a 1:1 mapping between external IPs and - ingress resources. Only one of `class`, `name` or `ingressClassName` may - be specified. - type: string - podTemplate: - description: |- - Optional pod template used to configure the ACME challenge solver pods - used for HTTP01 challenges. - properties: - metadata: - description: |- - ObjectMeta overrides for the pod used to solve HTTP01 challenges. - Only the 'labels' and 'annotations' fields may be set. - If labels or annotations overlap with in-built values, the values here - will override the in-built values. - properties: - annotations: - additionalProperties: - type: string - description: Annotations that should be added to the created ACME HTTP01 solver pods. - type: object - labels: - additionalProperties: - type: string - description: Labels that should be added to the created ACME HTTP01 solver pods. - type: object - type: object - spec: - description: |- - PodSpec defines overrides for the HTTP01 challenge solver pod. - Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields. - All other fields will be ignored. - properties: - affinity: - description: If specified, the pod's scheduling constraints - properties: - nodeAffinity: - description: Describes node affinity scheduling rules for the pod. - properties: - preferredDuringSchedulingIgnoredDuringExecution: - description: |- - The scheduler will prefer to schedule pods to nodes that satisfy - the affinity expressions specified by this field, but it may choose - a node that violates one or more of the expressions. The node that is - most preferred is the one with the greatest sum of weights, i.e. - for each node that meets all of the scheduling requirements (resource - request, requiredDuringScheduling affinity expressions, etc.), - compute a sum by iterating through the elements of this field and adding - "weight" to the sum if the node matches the corresponding matchExpressions; the - node(s) with the highest sum are the most preferred. - items: - description: |- - An empty preferred scheduling term matches all objects with implicit weight 0 - (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). - properties: - preference: - description: A node selector term, associated with the corresponding weight. - properties: - matchExpressions: - description: A list of node selector requirements by node's labels. - items: - description: |- - A node selector requirement is a selector that contains values, a key, and an operator - that relates the key and values. - properties: - key: - description: The label key that the selector applies to. - type: string - operator: - description: |- - Represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. - type: string - values: - description: |- - An array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. If the operator is Gt or Lt, the values - array must have a single element, which will be interpreted as an integer. - This array is replaced during a strategic merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchFields: - description: A list of node selector requirements by node's fields. - items: - description: |- - A node selector requirement is a selector that contains values, a key, and an operator - that relates the key and values. - properties: - key: - description: The label key that the selector applies to. - type: string - operator: - description: |- - Represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. - type: string - values: - description: |- - An array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. If the operator is Gt or Lt, the values - array must have a single element, which will be interpreted as an integer. - This array is replaced during a strategic merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - type: object - x-kubernetes-map-type: atomic - weight: - description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100. - format: int32 - type: integer - required: - - preference - - weight - type: object - type: array - x-kubernetes-list-type: atomic - requiredDuringSchedulingIgnoredDuringExecution: - description: |- - If the affinity requirements specified by this field are not met at - scheduling time, the pod will not be scheduled onto the node. - If the affinity requirements specified by this field cease to be met - at some point during pod execution (e.g. due to an update), the system - may or may not try to eventually evict the pod from its node. - properties: - nodeSelectorTerms: - description: Required. A list of node selector terms. The terms are ORed. - items: - description: |- - A null or empty node selector term matches no objects. The requirements of - them are ANDed. - The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. - properties: - matchExpressions: - description: A list of node selector requirements by node's labels. - items: - description: |- - A node selector requirement is a selector that contains values, a key, and an operator - that relates the key and values. - properties: - key: - description: The label key that the selector applies to. - type: string - operator: - description: |- - Represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. - type: string - values: - description: |- - An array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. If the operator is Gt or Lt, the values - array must have a single element, which will be interpreted as an integer. - This array is replaced during a strategic merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchFields: - description: A list of node selector requirements by node's fields. - items: - description: |- - A node selector requirement is a selector that contains values, a key, and an operator - that relates the key and values. - properties: - key: - description: The label key that the selector applies to. - type: string - operator: - description: |- - Represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. - type: string - values: - description: |- - An array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. If the operator is Gt or Lt, the values - array must have a single element, which will be interpreted as an integer. - This array is replaced during a strategic merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - type: object - x-kubernetes-map-type: atomic - type: array - x-kubernetes-list-type: atomic - required: - - nodeSelectorTerms - type: object - x-kubernetes-map-type: atomic - type: object - podAffinity: - description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)). - properties: - preferredDuringSchedulingIgnoredDuringExecution: - description: |- - The scheduler will prefer to schedule pods to nodes that satisfy - the affinity expressions specified by this field, but it may choose - a node that violates one or more of the expressions. The node that is - most preferred is the one with the greatest sum of weights, i.e. - for each node that meets all of the scheduling requirements (resource - request, requiredDuringScheduling affinity expressions, etc.), - compute a sum by iterating through the elements of this field and adding - "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the - node(s) with the highest sum are the most preferred. - items: - description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) - properties: - podAffinityTerm: - description: Required. A pod affinity term, associated with the corresponding weight. - properties: - labelSelector: - description: |- - A label query over a set of resources, in this case pods. - If it's null, this PodAffinityTerm matches with no Pods. - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - matchLabelKeys: - description: |- - MatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both matchLabelKeys and labelSelector. - Also, matchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - mismatchLabelKeys: - description: |- - MismatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. - Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - namespaceSelector: - description: |- - A label query over the set of namespaces that the term applies to. - The term is applied to the union of the namespaces selected by this field - and the ones listed in the namespaces field. - null selector and null or empty namespaces list means "this pod's namespace". - An empty selector ({}) matches all namespaces. - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - namespaces: - description: |- - namespaces specifies a static list of namespace names that the term applies to. - The term is applied to the union of the namespaces listed in this field - and the ones selected by namespaceSelector. - null or empty namespaces list and null namespaceSelector means "this pod's namespace". - items: - type: string - type: array - x-kubernetes-list-type: atomic - topologyKey: - description: |- - This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching - the labelSelector in the specified namespaces, where co-located is defined as running on a node - whose value of the label with key topologyKey matches that of any node on which any of the - selected pods is running. - Empty topologyKey is not allowed. - type: string - required: - - topologyKey - type: object - weight: - description: |- - weight associated with matching the corresponding podAffinityTerm, - in the range 1-100. - format: int32 - type: integer - required: - - podAffinityTerm - - weight - type: object - type: array - x-kubernetes-list-type: atomic - requiredDuringSchedulingIgnoredDuringExecution: - description: |- - If the affinity requirements specified by this field are not met at - scheduling time, the pod will not be scheduled onto the node. - If the affinity requirements specified by this field cease to be met - at some point during pod execution (e.g. due to a pod label update), the - system may or may not try to eventually evict the pod from its node. - When there are multiple elements, the lists of nodes corresponding to each - podAffinityTerm are intersected, i.e. all terms must be satisfied. - items: - description: |- - Defines a set of pods (namely those matching the labelSelector - relative to the given namespace(s)) that this pod should be - co-located (affinity) or not co-located (anti-affinity) with, - where co-located is defined as running on a node whose value of - the label with key matches that of any node on which - a pod of the set of pods is running - properties: - labelSelector: - description: |- - A label query over a set of resources, in this case pods. - If it's null, this PodAffinityTerm matches with no Pods. - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - matchLabelKeys: - description: |- - MatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both matchLabelKeys and labelSelector. - Also, matchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - mismatchLabelKeys: - description: |- - MismatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. - Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - namespaceSelector: - description: |- - A label query over the set of namespaces that the term applies to. - The term is applied to the union of the namespaces selected by this field - and the ones listed in the namespaces field. - null selector and null or empty namespaces list means "this pod's namespace". - An empty selector ({}) matches all namespaces. - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - namespaces: - description: |- - namespaces specifies a static list of namespace names that the term applies to. - The term is applied to the union of the namespaces listed in this field - and the ones selected by namespaceSelector. - null or empty namespaces list and null namespaceSelector means "this pod's namespace". - items: - type: string - type: array - x-kubernetes-list-type: atomic - topologyKey: - description: |- - This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching - the labelSelector in the specified namespaces, where co-located is defined as running on a node - whose value of the label with key topologyKey matches that of any node on which any of the - selected pods is running. - Empty topologyKey is not allowed. - type: string - required: - - topologyKey - type: object - type: array - x-kubernetes-list-type: atomic - type: object - podAntiAffinity: - description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)). - properties: - preferredDuringSchedulingIgnoredDuringExecution: - description: |- - The scheduler will prefer to schedule pods to nodes that satisfy - the anti-affinity expressions specified by this field, but it may choose - a node that violates one or more of the expressions. The node that is - most preferred is the one with the greatest sum of weights, i.e. - for each node that meets all of the scheduling requirements (resource - request, requiredDuringScheduling anti-affinity expressions, etc.), - compute a sum by iterating through the elements of this field and subtracting - "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the - node(s) with the highest sum are the most preferred. - items: - description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) - properties: - podAffinityTerm: - description: Required. A pod affinity term, associated with the corresponding weight. - properties: - labelSelector: - description: |- - A label query over a set of resources, in this case pods. - If it's null, this PodAffinityTerm matches with no Pods. - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - matchLabelKeys: - description: |- - MatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both matchLabelKeys and labelSelector. - Also, matchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - mismatchLabelKeys: - description: |- - MismatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. - Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - namespaceSelector: - description: |- - A label query over the set of namespaces that the term applies to. - The term is applied to the union of the namespaces selected by this field - and the ones listed in the namespaces field. - null selector and null or empty namespaces list means "this pod's namespace". - An empty selector ({}) matches all namespaces. - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - namespaces: - description: |- - namespaces specifies a static list of namespace names that the term applies to. - The term is applied to the union of the namespaces listed in this field - and the ones selected by namespaceSelector. - null or empty namespaces list and null namespaceSelector means "this pod's namespace". - items: - type: string - type: array - x-kubernetes-list-type: atomic - topologyKey: - description: |- - This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching - the labelSelector in the specified namespaces, where co-located is defined as running on a node - whose value of the label with key topologyKey matches that of any node on which any of the - selected pods is running. - Empty topologyKey is not allowed. - type: string - required: - - topologyKey - type: object - weight: - description: |- - weight associated with matching the corresponding podAffinityTerm, - in the range 1-100. - format: int32 - type: integer - required: - - podAffinityTerm - - weight - type: object - type: array - x-kubernetes-list-type: atomic - requiredDuringSchedulingIgnoredDuringExecution: - description: |- - If the anti-affinity requirements specified by this field are not met at - scheduling time, the pod will not be scheduled onto the node. - If the anti-affinity requirements specified by this field cease to be met - at some point during pod execution (e.g. due to a pod label update), the - system may or may not try to eventually evict the pod from its node. - When there are multiple elements, the lists of nodes corresponding to each - podAffinityTerm are intersected, i.e. all terms must be satisfied. - items: - description: |- - Defines a set of pods (namely those matching the labelSelector - relative to the given namespace(s)) that this pod should be - co-located (affinity) or not co-located (anti-affinity) with, - where co-located is defined as running on a node whose value of - the label with key matches that of any node on which - a pod of the set of pods is running - properties: - labelSelector: - description: |- - A label query over a set of resources, in this case pods. - If it's null, this PodAffinityTerm matches with no Pods. - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - matchLabelKeys: - description: |- - MatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both matchLabelKeys and labelSelector. - Also, matchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - mismatchLabelKeys: - description: |- - MismatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. - Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - namespaceSelector: - description: |- - A label query over the set of namespaces that the term applies to. - The term is applied to the union of the namespaces selected by this field - and the ones listed in the namespaces field. - null selector and null or empty namespaces list means "this pod's namespace". - An empty selector ({}) matches all namespaces. - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - namespaces: - description: |- - namespaces specifies a static list of namespace names that the term applies to. - The term is applied to the union of the namespaces listed in this field - and the ones selected by namespaceSelector. - null or empty namespaces list and null namespaceSelector means "this pod's namespace". - items: - type: string - type: array - x-kubernetes-list-type: atomic - topologyKey: - description: |- - This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching - the labelSelector in the specified namespaces, where co-located is defined as running on a node - whose value of the label with key topologyKey matches that of any node on which any of the - selected pods is running. - Empty topologyKey is not allowed. - type: string - required: - - topologyKey - type: object - type: array - x-kubernetes-list-type: atomic - type: object - type: object - imagePullSecrets: - description: If specified, the pod's imagePullSecrets - items: - description: |- - LocalObjectReference contains enough information to let you locate the - referenced object inside the same namespace. - properties: - name: - default: "" - description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - type: object - x-kubernetes-map-type: atomic - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - nodeSelector: - additionalProperties: - type: string - description: |- - NodeSelector is a selector which must be true for the pod to fit on a node. - Selector which must match a node's labels for the pod to be scheduled on that node. - More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ - type: object - priorityClassName: - description: If specified, the pod's priorityClassName. - type: string - resources: - description: |- - If specified, the pod's resource requirements. - These values override the global resource configuration flags. - Note that when only specifying resource limits, ensure they are greater than or equal - to the corresponding global resource requests configured via controller flags - (--acme-http01-solver-resource-request-cpu, --acme-http01-solver-resource-request-memory). - Kubernetes will reject pod creation if limits are lower than requests, causing challenge failures. - properties: - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: |- - Limits describes the maximum amount of compute resources allowed. - More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: |- - Requests describes the minimum amount of compute resources required. - If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, - otherwise to the global values configured via controller flags. Requests cannot exceed Limits. - More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ - type: object - type: object - securityContext: - description: If specified, the pod's security context - properties: - fsGroup: - description: |- - A special supplemental group that applies to all containers in a pod. - Some volume types allow the Kubelet to change the ownership of that volume - to be owned by the pod: - - 1. The owning GID will be the FSGroup - 2. The setgid bit is set (new files created in the volume will be owned by FSGroup) - 3. The permission bits are OR'd with rw-rw---- - - If unset, the Kubelet will not modify the ownership and permissions of any volume. - Note that this field cannot be set when spec.os.name is windows. - format: int64 - type: integer - fsGroupChangePolicy: - description: |- - fsGroupChangePolicy defines behavior of changing ownership and permission of the volume - before being exposed inside Pod. This field will only apply to - volume types which support fsGroup based ownership(and permissions). - It will have no effect on ephemeral volume types such as: secret, configmaps - and emptydir. - Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used. - Note that this field cannot be set when spec.os.name is windows. - type: string - runAsGroup: - description: |- - The GID to run the entrypoint of the container process. - Uses runtime default if unset. - May also be set in SecurityContext. If set in both SecurityContext and - PodSecurityContext, the value specified in SecurityContext takes precedence - for that container. - Note that this field cannot be set when spec.os.name is windows. - format: int64 - type: integer - runAsNonRoot: - description: |- - Indicates that the container must run as a non-root user. - If true, the Kubelet will validate the image at runtime to ensure that it - does not run as UID 0 (root) and fail to start the container if it does. - If unset or false, no such validation will be performed. - May also be set in SecurityContext. If set in both SecurityContext and - PodSecurityContext, the value specified in SecurityContext takes precedence. - type: boolean - runAsUser: - description: |- - The UID to run the entrypoint of the container process. - Defaults to user specified in image metadata if unspecified. - May also be set in SecurityContext. If set in both SecurityContext and - PodSecurityContext, the value specified in SecurityContext takes precedence - for that container. - Note that this field cannot be set when spec.os.name is windows. - format: int64 - type: integer - seLinuxOptions: - description: |- - The SELinux context to be applied to all containers. - If unspecified, the container runtime will allocate a random SELinux context for each - container. May also be set in SecurityContext. If set in - both SecurityContext and PodSecurityContext, the value specified in SecurityContext - takes precedence for that container. - Note that this field cannot be set when spec.os.name is windows. - properties: - level: - description: Level is SELinux level label that applies to the container. - type: string - role: - description: Role is a SELinux role label that applies to the container. - type: string - type: - description: Type is a SELinux type label that applies to the container. - type: string - user: - description: User is a SELinux user label that applies to the container. - type: string - type: object - seccompProfile: - description: |- - The seccomp options to use by the containers in this pod. - Note that this field cannot be set when spec.os.name is windows. - properties: - localhostProfile: - description: |- - localhostProfile indicates a profile defined in a file on the node should be used. - The profile must be preconfigured on the node to work. - Must be a descending path, relative to the kubelet's configured seccomp profile location. - Must be set if type is "Localhost". Must NOT be set for any other type. - type: string - type: - description: |- - type indicates which kind of seccomp profile will be applied. - Valid options are: - - Localhost - a profile defined in a file on the node should be used. - RuntimeDefault - the container runtime default profile should be used. - Unconfined - no profile should be applied. - type: string - required: - - type - type: object - supplementalGroups: - description: |- - A list of groups applied to the first process run in each container, in addition - to the container's primary GID, the fsGroup (if specified), and group memberships - defined in the container image for the uid of the container process. If unspecified, - no additional groups are added to any container. Note that group memberships - defined in the container image for the uid of the container process are still effective, - even if they are not included in this list. - Note that this field cannot be set when spec.os.name is windows. - items: - format: int64 - type: integer - type: array - x-kubernetes-list-type: atomic - sysctls: - description: |- - Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported - sysctls (by the container runtime) might fail to launch. - Note that this field cannot be set when spec.os.name is windows. - items: - description: Sysctl defines a kernel parameter to be set - properties: - name: - description: Name of a property to set - type: string - value: - description: Value of a property to set - type: string - required: - - name - - value - type: object - type: array - x-kubernetes-list-type: atomic - type: object - serviceAccountName: - description: If specified, the pod's service account - type: string - tolerations: - description: If specified, the pod's tolerations. - items: - description: |- - The pod this Toleration is attached to tolerates any taint that matches - the triple using the matching operator . - properties: - effect: - description: |- - Effect indicates the taint effect to match. Empty means match all taint effects. - When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. - type: string - key: - description: |- - Key is the taint key that the toleration applies to. Empty means match all taint keys. - If the key is empty, operator must be Exists; this combination means to match all values and all keys. - type: string - operator: - description: |- - Operator represents a key's relationship to the value. - Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. - Exists is equivalent to wildcard for value, so that a pod can - tolerate all taints of a particular category. - Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). - type: string - tolerationSeconds: - description: |- - TolerationSeconds represents the period of time the toleration (which must be - of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, - it is not set, which means tolerate the taint forever (do not evict). Zero and - negative values will be treated as 0 (evict immediately) by the system. - format: int64 - type: integer - value: - description: |- - Value is the taint value the toleration matches to. - If the operator is Exists, the value should be empty, otherwise just a regular string. - type: string - type: object - type: array - x-kubernetes-list-type: atomic - type: object - type: object - serviceType: - description: |- - Optional service type for Kubernetes solver service. Supported values - are NodePort or ClusterIP. If unset, defaults to NodePort. - type: string - type: object - type: object - selector: - description: |- - Selector selects a set of DNSNames on the Certificate resource that - should be solved using this challenge solver. - If not specified, the solver will be treated as the 'default' solver - with the lowest priority, i.e. if any other solver has a more specific - match, it will be used instead. - properties: - dnsNames: - description: |- - List of DNSNames that this solver will be used to solve. - If specified and a match is found, a dnsNames selector will take - precedence over a dnsZones selector. - If multiple solvers match with the same dnsNames value, the solver - with the most matching labels in matchLabels will be selected. - If neither has more matches, the solver defined earlier in the list - will be selected. - items: - type: string - type: array - x-kubernetes-list-type: atomic - dnsZones: - description: |- - List of DNSZones that this solver will be used to solve. - The most specific DNS zone match specified here will take precedence - over other DNS zone matches, so a solver specifying sys.example.com - will be selected over one specifying example.com for the domain - www.sys.example.com. - If multiple solvers match with the same dnsZones value, the solver - with the most matching labels in matchLabels will be selected. - If neither has more matches, the solver defined earlier in the list - will be selected. - items: - type: string - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - A label selector that is used to refine the set of certificate's that - this challenge solver will apply to. - type: object - type: object - waitInsteadOfSelfCheck: - description: |- - WaitInsteadOfSelfCheck, if set, skips cert-manager's self-check and - instead waits this long after presentation before asking the ACME server - to validate the challenge. - - This is an advanced escape hatch for environments where cert-manager's - self-check cannot succeed from its own network or DNS viewpoint even - though the ACME server can still validate successfully, for example due - to split-horizon DNS or NAT hairpinning. - - A value of 0 skips the self-check and asks the ACME server to validate - immediately after presentation, relying on the ACME server's own - validation retries (RFC 8555 section 8.2) to succeed once the challenge - has propagated. A negative duration is rejected. - Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration, - for example `30s` or `2m`. - type: string - type: object - token: - description: |- - The ACME challenge token for this challenge. - This is the raw value returned from the ACME server. - type: string - type: - description: |- - The type of ACME challenge this resource represents. - One of "HTTP-01" or "DNS-01". - enum: - - HTTP-01 - - DNS-01 - type: string - url: - description: |- - The URL of the ACME Challenge resource for this challenge. - This can be used to lookup details about the status of this challenge. - type: string - wildcard: - description: |- - wildcard will be true if this challenge is for a wildcard identifier, - for example '*.example.com'. - type: boolean - required: - - authorizationURL - - dnsName - - issuerRef - - key - - solver - - token - - type - - url - type: object - status: - properties: - presented: - description: |- - Presented is true once cert-manager has configured the solver resources - needed to expose this challenge's validation material. - For example, the DNS01 TXT record has been created, or the HTTP01 solver - has been configured to serve the challenge token. - This does not imply the self check is passing, that the ACME server has - validated the challenge, or that cert-manager has already accepted the - challenge with the ACME server. - type: boolean - presentedAt: - description: |- - PresentedAt records when cert-manager first configured the solver - resources for this challenge. This is used by the optional delay-based - readiness logic. - format: date-time - type: string - processing: - description: |- - Used to denote whether this challenge should be processed or not. - This field will only be set to true by the 'scheduling' component. - It will only be set to false by the 'challenges' controller, after the - challenge has reached a final state or timed out. - If this field is set to false, the challenge controller will not take - any more action. - type: boolean - reason: - description: |- - Contains human readable information on why the Challenge is in the - current state. - type: string - state: - description: |- - Contains the current 'state' of the challenge. - If not set, the state of the challenge is unknown. - enum: - - valid - - ready - - pending - - processing - - invalid - - expired - - errored - type: string - type: object - required: - - metadata - - spec - type: object - selectableFields: - - jsonPath: .spec.issuerRef.group - - jsonPath: .spec.issuerRef.kind - - jsonPath: .spec.issuerRef.name - served: true - storage: true - subresources: - status: {} - ---- -# Source: cert-manager/templates/crd-acme.cert-manager.io_orders.yaml -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - name: "orders.acme.cert-manager.io" - annotations: - helm.sh/resource-policy: keep - labels: - app: "cert-manager" - app.kubernetes.io/name: "cert-manager" - app.kubernetes.io/instance: "cert-manager" - app.kubernetes.io/component: "crds" - app.kubernetes.io/version: "v1.21.1" - app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 -spec: - group: acme.cert-manager.io - names: - categories: - - cert-manager - - cert-manager-acme - kind: Order - listKind: OrderList - plural: orders - singular: order - scope: Namespaced - versions: - - additionalPrinterColumns: - - jsonPath: .status.state - name: State - type: string - - jsonPath: .spec.issuerRef.name - name: Issuer - priority: 1 - type: string - - jsonPath: .status.reason - name: Reason - priority: 1 - type: string - - description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1 - schema: - openAPIV3Schema: - description: Order is a type to represent an Order with an ACME server - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - properties: - commonName: - description: |- - CommonName is the common name as specified on the DER encoded CSR. - If specified, this value must also be present in `dnsNames` or `ipAddresses`. - This field must match the corresponding field on the DER encoded CSR. - type: string - dnsNames: - description: |- - DNSNames is a list of DNS names that should be included as part of the Order - validation process. - This field must match the corresponding field on the DER encoded CSR. - items: - type: string - type: array - x-kubernetes-list-type: atomic - duration: - description: |- - Duration is the duration for the not after date for the requested certificate. - This is set on order creation as per the ACME spec. - type: string - ipAddresses: - description: |- - IPAddresses is a list of IP addresses that should be included as part of the Order - validation process. - This field must match the corresponding field on the DER encoded CSR. - items: - type: string - type: array - x-kubernetes-list-type: atomic - issuerRef: - description: |- - IssuerRef references a properly configured ACME-type Issuer which should - be used to create this Order. - If the Issuer does not exist, processing will be retried. - If the Issuer is not an 'ACME' Issuer, an error will be returned and the - Order will be marked as failed. - properties: - group: - description: |- - Group of the issuer being referred to. - Defaults to 'cert-manager.io'. - type: string - kind: - description: |- - Kind of the issuer being referred to. - Defaults to 'Issuer'. - type: string - name: - description: Name of the issuer being referred to. - type: string - required: - - name - type: object - profile: - description: |- - Profile allows requesting a certificate profile from the ACME server. - Supported profiles are listed by the server's ACME directory URL. - type: string - replaces: - description: |- - Replaces is the ARI CertID (RFC 9773 §4.1) of the certificate that this - Order is intended to replace. When set, cert-manager will include the - "replaces" field on the newOrder request to the ACME server if and only - if the server advertises ARI support in its directory. The CertID has - the form "base64url(AKI).base64url(serial)" and is derived locally from - the currently issued leaf certificate. - type: string - request: - description: |- - Certificate signing request bytes in DER encoding. - This will be used when finalizing the order. - This field must be set on the order. - format: byte - type: string - required: - - issuerRef - - request - type: object - status: - properties: - authorizations: - description: |- - Authorizations contains data returned from the ACME server on what - authorizations must be completed in order to validate the DNS names - specified on the Order. - items: - description: |- - ACMEAuthorization contains data returned from the ACME server on an - authorization that must be completed in order validate a DNS name on an ACME - Order resource. - properties: - challenges: - description: |- - Challenges specifies the challenge types offered by the ACME server. - One of these challenge types will be selected when validating the DNS - name and an appropriate Challenge resource will be created to perform - the ACME challenge process. - items: - description: |- - Challenge specifies a challenge offered by the ACME server for an Order. - An appropriate Challenge resource can be created to perform the ACME - challenge process. - properties: - token: - description: |- - Token is the token that must be presented for this challenge. - This is used to compute the 'key' that must also be presented. - type: string - type: - description: |- - Type is the type of challenge being offered, e.g., 'http-01', 'dns-01', - 'tls-sni-01', etc. - This is the raw value retrieved from the ACME server. - Only 'http-01' and 'dns-01' are supported by cert-manager, other values - will be ignored. - type: string - url: - description: |- - URL is the URL of this challenge. It can be used to retrieve additional - metadata about the Challenge from the ACME server. - type: string - required: - - token - - type - - url - type: object - type: array - x-kubernetes-list-type: atomic - identifier: - description: Identifier is the DNS name to be validated as part of this authorization - type: string - initialState: - description: |- - InitialState is the initial state of the ACME authorization when first - fetched from the ACME server. - If an Authorization is already 'valid', the Order controller will not - create a Challenge resource for the authorization. This will occur when - working with an ACME server that enables 'authz reuse' (such as Let's - Encrypt's production endpoint). - If not set and 'identifier' is set, the state is assumed to be pending - and a Challenge will be created. - enum: - - valid - - ready - - pending - - processing - - invalid - - expired - - errored - type: string - url: - description: URL is the URL of the Authorization that must be completed - type: string - wildcard: - description: |- - Wildcard will be true if this authorization is for a wildcard DNS name. - If this is true, the identifier will be the *non-wildcard* version of - the DNS name. - For example, if '*.example.com' is the DNS name being validated, this - field will be 'true' and the 'identifier' field will be 'example.com'. - type: boolean - required: - - url - type: object - type: array - x-kubernetes-list-type: atomic - certificate: - description: |- - Certificate is a copy of the PEM encoded certificate for this Order. - This field will be populated after the order has been successfully - finalized with the ACME server, and the order has transitioned to the - 'valid' state. - format: byte - type: string - failureTime: - description: |- - FailureTime stores the time that this order failed. - This is used to influence garbage collection and back-off. - format: date-time - type: string - finalizeURL: - description: |- - FinalizeURL of the Order. - This is used to obtain certificates for this order once it has been completed. - type: string - reason: - description: |- - Reason optionally provides more information about a why the order is in - the current state. - type: string - state: - description: |- - State contains the current state of this Order resource. - States 'success' and 'expired' are 'final' - enum: - - valid - - ready - - pending - - processing - - invalid - - expired - - errored - type: string - url: - description: |- - URL of the Order. - This will initially be empty when the resource is first created. - The Order controller will populate this field when the Order is first processed. - This field will be immutable after it is initially set. - type: string - type: object - required: - - metadata - - spec - type: object - selectableFields: - - jsonPath: .spec.issuerRef.group - - jsonPath: .spec.issuerRef.kind - - jsonPath: .spec.issuerRef.name - served: true - storage: true - subresources: - status: {} - ---- -# Source: cert-manager/templates/crd-cert-manager.io_certificaterequests.yaml -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - name: "certificaterequests.cert-manager.io" - annotations: - helm.sh/resource-policy: keep - labels: - app: "cert-manager" - app.kubernetes.io/name: "cert-manager" - app.kubernetes.io/instance: "cert-manager" - app.kubernetes.io/component: "crds" - app.kubernetes.io/version: "v1.21.1" - app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 -spec: - group: cert-manager.io - names: - categories: - - cert-manager - kind: CertificateRequest - listKind: CertificateRequestList - plural: certificaterequests - shortNames: - - cr - - crs - singular: certificaterequest - scope: Namespaced - versions: - - additionalPrinterColumns: - - jsonPath: .status.conditions[?(@.type == "Approved")].status - name: Approved - type: string - - jsonPath: .status.conditions[?(@.type == "Denied")].status - name: Denied - type: string - - jsonPath: .status.conditions[?(@.type == "Ready")].status - name: Ready - type: string - - jsonPath: .spec.issuerRef.name - name: Issuer - type: string - - jsonPath: .spec.username - name: Requester - type: string - - jsonPath: .status.conditions[?(@.type == "Ready")].message - name: Status - priority: 1 - type: string - - description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1 - schema: - openAPIV3Schema: - description: |- - A CertificateRequest is used to request a signed certificate from one of the - configured issuers. - - All fields within the CertificateRequest's `spec` are immutable after creation. - A CertificateRequest will either succeed or fail, as denoted by its `Ready` status - condition and its `status.failureTime` field. - - A CertificateRequest is a one-shot resource, meaning it represents a single - point in time request for a certificate and cannot be re-used. - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: |- - Specification of the desired state of the CertificateRequest resource. - https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status - properties: - duration: - description: |- - Requested 'duration' (i.e. lifetime) of the Certificate. Note that the - issuer may choose to ignore the requested duration, just like any other - requested attribute. - type: string - extra: - additionalProperties: - items: - type: string - type: array - description: |- - Extra contains extra attributes of the user that created the CertificateRequest. - Populated by the cert-manager webhook on creation and immutable. - type: object - groups: - description: |- - Groups contains group membership of the user that created the CertificateRequest. - Populated by the cert-manager webhook on creation and immutable. - items: - type: string - type: array - x-kubernetes-list-type: atomic - isCA: - description: |- - Requested basic constraints isCA value. Note that the issuer may choose - to ignore the requested isCA value, just like any other requested attribute. - - NOTE: If the CSR in the `Request` field has a BasicConstraints extension, - it must have the same isCA value as specified here. - - If true, this will automatically add the `cert sign` usage to the list - of requested `usages`. - type: boolean - issuerRef: - description: |- - Reference to the issuer responsible for issuing the certificate. - If the issuer is namespace-scoped, it must be in the same namespace - as the Certificate. If the issuer is cluster-scoped, it can be used - from any namespace. - - The `name` field of the reference must always be specified. - properties: - group: - description: |- - Group of the issuer being referred to. - Defaults to 'cert-manager.io'. - type: string - kind: - description: |- - Kind of the issuer being referred to. - Defaults to 'Issuer'. - type: string - name: - description: Name of the issuer being referred to. - type: string - required: - - name - type: object - request: - description: |- - The PEM-encoded X.509 certificate signing request to be submitted to the - issuer for signing. - - If the CSR has a BasicConstraints extension, its isCA attribute must - match the `isCA` value of this CertificateRequest. - If the CSR has a KeyUsage extension, its key usages must match the - key usages in the `usages` field of this CertificateRequest. - If the CSR has a ExtKeyUsage extension, its extended key usages - must match the extended key usages in the `usages` field of this - CertificateRequest. - format: byte - type: string - uid: - description: |- - UID contains the uid of the user that created the CertificateRequest. - Populated by the cert-manager webhook on creation and immutable. - type: string - usages: - description: |- - Requested key usages and extended key usages. - - NOTE: If the CSR in the `Request` field has uses the KeyUsage or - ExtKeyUsage extension, these extensions must have the same values - as specified here without any additional values. - - If unset, defaults to `digital signature` and `key encipherment`. - items: - description: |- - KeyUsage specifies valid usage contexts for keys. - See: - https://tools.ietf.org/html/rfc5280#section-4.2.1.3 - https://tools.ietf.org/html/rfc5280#section-4.2.1.12 + If unset, defaults to `digital signature` and `key encipherment`. + type: array + items: + description: |- + KeyUsage specifies valid usage contexts for keys. + See: + https://tools.ietf.org/html/rfc5280#section-4.2.1.3 + https://tools.ietf.org/html/rfc5280#section-4.2.1.12 Valid KeyUsage values are as follows: "signing", @@ -3894,6 +1020,7 @@ spec: "ocsp signing", "microsoft sgc", "netscape sgc" + type: string enum: - signing - digital signature @@ -3918,60 +1045,46 @@ spec: - ocsp signing - microsoft sgc - netscape sgc - type: string - type: array - x-kubernetes-list-type: atomic - username: - description: |- - Username contains the name of the user that created the CertificateRequest. - Populated by the cert-manager webhook on creation and immutable. - type: string - required: - - issuerRef - - request - type: object status: description: |- - Status of the CertificateRequest. + Status of the Certificate. This is set and managed automatically. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status + type: object properties: - ca: - description: |- - The PEM encoded X.509 certificate of the signer, also known as the CA - (Certificate Authority). - This is set on a best-effort basis by different issuers. - If not set, the CA is assumed to be unknown/not available. - format: byte - type: string - certificate: - description: |- - The PEM encoded X.509 certificate resulting from the certificate - signing request. - If not set, the CertificateRequest has either not been completed or has - failed. More information on failure can be found by checking the - `conditions` field. - format: byte - type: string conditions: description: |- - List of status conditions to indicate the status of a CertificateRequest. - Known condition types are `Ready`, `InvalidRequest`, `Approved` and `Denied`. + List of status conditions to indicate the status of certificates. + Known condition types are `Ready` and `Issuing`. + type: array items: - description: CertificateRequestCondition contains condition information for a CertificateRequest. + description: CertificateCondition contains condition information for a Certificate. + type: object + required: + - status + - type properties: lastTransitionTime: description: |- LastTransitionTime is the timestamp corresponding to the last status change of this condition. - format: date-time type: string + format: date-time message: description: |- Message is a human readable description of the details of the last transition, complementing reason. type: string + observedGeneration: + description: |- + If set, this represents the .metadata.generation that the condition was + set based upon. + For instance, if .metadata.generation is currently 12, but the + .status.condition[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the Certificate. + type: integer + format: int64 reason: description: |- Reason is a brief machine readable explanation for the condition's last @@ -3979,84 +1092,123 @@ spec: type: string status: description: Status of the condition, one of (`True`, `False`, `Unknown`). + type: string enum: - "True" - "False" - Unknown - type: string type: - description: |- - Type of the condition, known values are (`Ready`, `InvalidRequest`, - `Approved`, `Denied`). + description: Type of the condition, known values are (`Ready`, `Issuing`). type: string - required: - - status - - type - type: object - type: array x-kubernetes-list-map-keys: - type x-kubernetes-list-type: map - failureTime: + failedIssuanceAttempts: + description: |- + The number of continuous failed issuance attempts up till now. This + field gets removed (if set) on a successful issuance and gets set to + 1 if unset and an issuance has failed. If an issuance has failed, the + delay till the next issuance will be calculated using formula + time.Hour * 2 ^ (failedIssuanceAttempts - 1). + type: integer + lastFailureTime: + description: |- + LastFailureTime is set only if the latest issuance for this + Certificate failed and contains the time of the failure. If an + issuance has failed, the delay till the next issuance will be + calculated using formula time.Hour * 2 ^ (failedIssuanceAttempts - + 1). If the latest issuance has succeeded this field will be unset. + type: string + format: date-time + nextPrivateKeySecretName: + description: |- + The name of the Secret resource containing the private key to be used + for the next certificate iteration. + The keymanager controller will automatically set this field if the + `Issuing` condition is set to `True`. + It will automatically unset this field when the Issuing condition is + not set or False. + type: string + notAfter: + description: |- + The expiration time of the certificate stored in the secret named + by this resource in `spec.secretName`. + type: string + format: date-time + notBefore: description: |- - FailureTime stores the time that this CertificateRequest failed. This is - used to influence garbage collection and back-off. + The time after which the certificate stored in the secret named + by this resource in `spec.secretName` is valid. + type: string format: date-time + renewalTime: + description: |- + RenewalTime is the time at which the certificate will be next + renewed. + If not set, no upcoming renewal is scheduled. type: string - type: object - type: object - selectableFields: - - jsonPath: .spec.issuerRef.group - - jsonPath: .spec.issuerRef.kind - - jsonPath: .spec.issuerRef.name + format: date-time + revision: + description: |- + The current 'revision' of the certificate as issued. + + When a CertificateRequest resource is created, it will have the + `cert-manager.io/certificate-revision` set to one greater than the + current value of this field. + + Upon issuance, this field will be set to the value of the annotation + on the CertificateRequest resource used to issue the certificate. + + Persisting the value on the CertificateRequest resource allows the + certificates controller to know whether a request is part of an old + issuance or if it is part of the ongoing revision's issuance by + checking if the revision value in the annotation is greater than this + field. + type: integer served: true storage: true - subresources: - status: {} +# END crd --- -# Source: cert-manager/templates/crd-cert-manager.io_certificates.yaml +# Source: cert-manager/templates/crds.yaml +# START crd apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: - name: "certificates.cert-manager.io" + name: challenges.acme.cert-manager.io + # START annotations annotations: helm.sh/resource-policy: keep + # END annotations labels: - app: "cert-manager" - app.kubernetes.io/name: "cert-manager" - app.kubernetes.io/instance: "cert-manager" - app.kubernetes.io/component: "crds" - app.kubernetes.io/version: "v1.21.1" + app: 'cert-manager' + app.kubernetes.io/name: 'cert-manager' + app.kubernetes.io/instance: 'cert-manager' + # Generated labels + app.kubernetes.io/version: "v1.17.0" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 + helm.sh/chart: cert-manager-v1.17.0 spec: - group: cert-manager.io + group: acme.cert-manager.io names: + kind: Challenge + listKind: ChallengeList + plural: challenges + singular: challenge categories: - cert-manager - kind: Certificate - listKind: CertificateList - plural: certificates - shortNames: - - cert - - certs - singular: certificate + - cert-manager-acme scope: Namespaced versions: - additionalPrinterColumns: - - jsonPath: .status.conditions[?(@.type == "Ready")].status - name: Ready - type: string - - jsonPath: .spec.secretName - name: Secret + - jsonPath: .status.state + name: State type: string - - jsonPath: .spec.issuerRef.name - name: Issuer - priority: 1 + - jsonPath: .spec.dnsName + name: Domain type: string - - jsonPath: .status.conditions[?(@.type == "Ready")].message - name: Status + - jsonPath: .status.reason + name: Reason priority: 1 type: string - description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. @@ -4066,11 +1218,11 @@ spec: name: v1 schema: openAPIV3Schema: - description: |- - A Certificate resource should be created to ensure an up to date and signed - X.509 certificate is stored in the Kubernetes Secret resource named in `spec.secretName`. - - The stored certificate will be renewed before it expires (as configured by `spec.renewBefore`). + description: Challenge is a type to represent a Challenge request with an ACME server + type: object + required: + - metadata + - spec properties: apiVersion: description: |- @@ -4090,888 +1242,3190 @@ spec: metadata: type: object spec: - description: |- - Specification of the desired state of the Certificate resource. - https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status + type: object + required: + - authorizationURL + - dnsName + - issuerRef + - key + - solver + - token + - type + - url properties: - additionalOutputFormats: - description: |- - Defines extra output formats of the private key and signed certificate chain - to be written to this Certificate's target Secret. - items: - description: |- - CertificateAdditionalOutputFormat defines an additional output format of a - Certificate resource. These contain supplementary data formats of the signed - certificate chain and paired private key. - properties: - type: - description: |- - Type is the name of the format type that should be written to the - Certificate's target Secret. - enum: - - DER - - CombinedPEM - type: string - required: - - type - type: object - type: array - x-kubernetes-list-type: atomic - commonName: + authorizationURL: description: |- - Requested common name X509 certificate subject attribute. - More info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.6 - NOTE: TLS clients will ignore this value when any subject alternative name is - set (see https://tools.ietf.org/html/rfc6125#section-6.4.4). - - Should have a length of 64 characters or fewer to avoid generating invalid CSRs. - Cannot be set if the `literalSubject` field is set. + The URL to the ACME Authorization resource that this + challenge is a part of. type: string - dnsNames: - description: Requested DNS subject alternative names. - items: - type: string - type: array - x-kubernetes-list-type: atomic - duration: + dnsName: description: |- - Requested 'duration' (i.e. lifetime) of the Certificate. Note that the - issuer may choose to ignore the requested duration, just like any other - requested attribute. - - If unset, this defaults to 90 days. - Minimum accepted duration is 1 hour. - Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration. + dnsName is the identifier that this challenge is for, e.g. example.com. + If the requested DNSName is a 'wildcard', this field MUST be set to the + non-wildcard domain, e.g. for `*.example.com`, it must be `example.com`. type: string - emailAddresses: - description: Requested email subject alternative names. - items: - type: string - type: array - x-kubernetes-list-type: atomic - encodeUsagesInRequest: - description: |- - Whether the KeyUsage and ExtKeyUsage extensions should be set in the encoded CSR. - - This option defaults to true, and should only be disabled if the target - issuer does not support CSRs with these X509 KeyUsage/ ExtKeyUsage extensions. - type: boolean - ipAddresses: - description: Requested IP address subject alternative names. - items: - type: string - type: array - x-kubernetes-list-type: atomic - isCA: - description: |- - Requested basic constraints isCA value. - The isCA value is used to set the `isCA` field on the created CertificateRequest - resources. Note that the issuer may choose to ignore the requested isCA value, just - like any other requested attribute. - - If true, this will automatically add the `cert sign` usage to the list - of requested `usages`. - type: boolean issuerRef: description: |- - Reference to the issuer responsible for issuing the certificate. - If the issuer is namespace-scoped, it must be in the same namespace - as the Certificate. If the issuer is cluster-scoped, it can be used - from any namespace. - - The `name` field of the reference must always be specified. + References a properly configured ACME-type Issuer which should + be used to create this Challenge. + If the Issuer does not exist, processing will be retried. + If the Issuer is not an 'ACME' Issuer, an error will be returned and the + Challenge will be marked as failed. + type: object + required: + - name properties: group: - description: |- - Group of the issuer being referred to. - Defaults to 'cert-manager.io'. + description: Group of the resource being referred to. type: string kind: - description: |- - Kind of the issuer being referred to. - Defaults to 'Issuer'. + description: Kind of the resource being referred to. type: string name: - description: Name of the issuer being referred to. + description: Name of the resource being referred to. type: string - required: - - name + key: + description: |- + The ACME challenge key for this challenge + For HTTP01 challenges, this is the value that must be responded with to + complete the HTTP01 challenge in the format: + `.`. + For DNS01 challenges, this is the base64 encoded SHA256 sum of the + `.` + text that must be set as the TXT record content. + type: string + solver: + description: |- + Contains the domain solving configuration that should be used to + solve this challenge resource. type: object - keystores: - description: Additional keystore output formats to be stored in the Certificate's Secret. properties: - jks: + dns01: description: |- - JKS configures options for storing a JKS keystore in the - `spec.secretName` Secret resource. + Configures cert-manager to attempt to complete authorizations by + performing the DNS01 challenge flow. + type: object properties: - alias: - description: |- - Alias specifies the alias of the key in the keystore, required by the JKS format. - If not provided, the default alias `certificate` will be used. - type: string - create: + acmeDNS: description: |- - Create enables JKS keystore creation for the Certificate. - If true, a file named `keystore.jks` will be created in the target - Secret resource, encrypted using the password stored in - `passwordSecretRef` or `password`. - The keystore file will be updated immediately. - If the issuer provided a CA certificate, a file named `truststore.jks` - will also be created in the target Secret resource, encrypted using the - password stored in `passwordSecretRef` - containing the issuing Certificate Authority - type: boolean - password: + Use the 'ACME DNS' (https://github.com/joohoi/acme-dns) API to manage + DNS01 challenge records. + type: object + required: + - accountSecretRef + - host + properties: + accountSecretRef: + description: |- + A reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + host: + type: string + akamai: + description: Use the Akamai DNS zone management API to manage DNS01 challenge records. + type: object + required: + - accessTokenSecretRef + - clientSecretSecretRef + - clientTokenSecretRef + - serviceConsumerDomain + properties: + accessTokenSecretRef: + description: |- + A reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + clientSecretSecretRef: + description: |- + A reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + clientTokenSecretRef: + description: |- + A reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + serviceConsumerDomain: + type: string + azureDNS: + description: Use the Microsoft Azure DNS API to manage DNS01 challenge records. + type: object + required: + - resourceGroupName + - subscriptionID + properties: + clientID: + description: |- + Auth: Azure Service Principal: + The ClientID of the Azure Service Principal used to authenticate with Azure DNS. + If set, ClientSecret and TenantID must also be set. + type: string + clientSecretSecretRef: + description: |- + Auth: Azure Service Principal: + A reference to a Secret containing the password associated with the Service Principal. + If set, ClientID and TenantID must also be set. + type: object + required: + - name + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + environment: + description: name of the Azure environment (default AzurePublicCloud) + type: string + enum: + - AzurePublicCloud + - AzureChinaCloud + - AzureGermanCloud + - AzureUSGovernmentCloud + hostedZoneName: + description: name of the DNS zone that should be used + type: string + managedIdentity: + description: |- + Auth: Azure Workload Identity or Azure Managed Service Identity: + Settings to enable Azure Workload Identity or Azure Managed Service Identity + If set, ClientID, ClientSecret and TenantID must not be set. + type: object + properties: + clientID: + description: client ID of the managed identity, can not be used at the same time as resourceID + type: string + resourceID: + description: |- + resource ID of the managed identity, can not be used at the same time as clientID + Cannot be used for Azure Managed Service Identity + type: string + tenantID: + description: tenant ID of the managed identity, can not be used at the same time as resourceID + type: string + resourceGroupName: + description: resource group the DNS zone is located in + type: string + subscriptionID: + description: ID of the Azure subscription + type: string + tenantID: + description: |- + Auth: Azure Service Principal: + The TenantID of the Azure Service Principal used to authenticate with Azure DNS. + If set, ClientID and ClientSecret must also be set. + type: string + cloudDNS: + description: Use the Google Cloud DNS API to manage DNS01 challenge records. + type: object + required: + - project + properties: + hostedZoneName: + description: |- + HostedZoneName is an optional field that tells cert-manager in which + Cloud DNS zone the challenge record has to be created. + If left empty cert-manager will automatically choose a zone. + type: string + project: + type: string + serviceAccountSecretRef: + description: |- + A reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + cloudflare: + description: Use the Cloudflare API to manage DNS01 challenge records. + type: object + properties: + apiKeySecretRef: + description: |- + API key to use to authenticate with Cloudflare. + Note: using an API token to authenticate is now the recommended method + as it allows greater control of permissions. + type: object + required: + - name + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + apiTokenSecretRef: + description: API token used to authenticate with Cloudflare. + type: object + required: + - name + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + email: + description: Email of the account, only required when using API key based authentication. + type: string + cnameStrategy: description: |- - Password provides a literal password used to encrypt the JKS keystore. - Mutually exclusive with passwordSecretRef. - One of password or passwordSecretRef must provide a password with a non-zero length. + CNAMEStrategy configures how the DNS01 provider should handle CNAME + records when found in DNS zones. type: string - passwordSecretRef: - description: |- - PasswordSecretRef is a reference to a non-empty key in a Secret resource - containing the password used to encrypt the JKS keystore. - Mutually exclusive with password. - One of password or passwordSecretRef must provide a password with a non-zero length. + enum: + - None + - Follow + digitalocean: + description: Use the DigitalOcean DNS API to manage DNS01 challenge records. + type: object + required: + - tokenSecretRef + properties: + tokenSecretRef: + description: |- + A reference to a specific 'key' within a Secret resource. + In some instances, `key` is a required field. + type: object + required: + - name + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + rfc2136: + description: |- + Use RFC2136 ("Dynamic Updates in the Domain Name System") (https://datatracker.ietf.org/doc/rfc2136/) + to manage DNS01 challenge records. + type: object + required: + - nameserver properties: - key: + nameserver: description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. + The IP address or hostname of an authoritative DNS server supporting + RFC2136 in the form host:port. If the host is an IPv6 address it must be + enclosed in square brackets (e.g [2001:db8::1]) ; port is optional. + This field is required. type: string - name: + tsigAlgorithm: description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + The TSIG Algorithm configured in the DNS supporting RFC2136. Used only + when ``tsigSecretSecretRef`` and ``tsigKeyName`` are defined. + Supported values are (case-insensitive): ``HMACMD5`` (default), + ``HMACSHA1``, ``HMACSHA256`` or ``HMACSHA512``. type: string - required: - - name + tsigKeyName: + description: |- + The TSIG Key name configured in the DNS. + If ``tsigSecretSecretRef`` is defined, this field is required. + type: string + tsigSecretSecretRef: + description: |- + The name of the secret containing the TSIG value. + If ``tsigKeyName`` is defined, this field is required. + type: object + required: + - name + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + route53: + description: Use the AWS Route53 API to manage DNS01 challenge records. type: object - required: - - create - type: object - pkcs12: - description: |- - PKCS12 configures options for storing a PKCS12 keystore in the - `spec.secretName` Secret resource. - properties: - create: - description: |- - Create enables PKCS12 keystore creation for the Certificate. - If true, a file named `keystore.p12` will be created in the target - Secret resource, encrypted using the password stored in - `passwordSecretRef` or in `password`. - The keystore file will be updated immediately. - If the issuer provided a CA certificate, a file named `truststore.p12` will - also be created in the target Secret resource, encrypted using the - password stored in `passwordSecretRef` containing the issuing Certificate - Authority - type: boolean - password: - description: |- - Password provides a literal password used to encrypt the PKCS#12 keystore. - Mutually exclusive with passwordSecretRef. - One of password or passwordSecretRef must provide a password with a non-zero length. - type: string - passwordSecretRef: - description: |- - PasswordSecretRef is a reference to a non-empty key in a Secret resource - containing the password used to encrypt the PKCS#12 keystore. - Mutually exclusive with password. - One of password or passwordSecretRef must provide a password with a non-zero length. properties: - key: + accessKeyID: description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. + The AccessKeyID is used for authentication. + Cannot be set when SecretAccessKeyID is set. + If neither the Access Key nor Key ID are set, we fall-back to using env + vars, shared credentials file or AWS Instance metadata, + see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials type: string - name: + accessKeyIDSecretRef: description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + The SecretAccessKey is used for authentication. If set, pull the AWS + access key ID from a key within a Kubernetes Secret. + Cannot be set when AccessKeyID is set. + If neither the Access Key nor Key ID are set, we fall-back to using env + vars, shared credentials file or AWS Instance metadata, + see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials + type: object + required: + - name + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + auth: + description: Auth configures how cert-manager authenticates. + type: object + required: + - kubernetes + properties: + kubernetes: + description: |- + Kubernetes authenticates with Route53 using AssumeRoleWithWebIdentity + by passing a bound ServiceAccount token. + type: object + required: + - serviceAccountRef + properties: + serviceAccountRef: + description: |- + A reference to a service account that will be used to request a bound + token (also known as "projected token"). To use this field, you must + configure an RBAC rule to let cert-manager request a token. + type: object + required: + - name + properties: + audiences: + description: |- + TokenAudiences is an optional list of audiences to include in the + token passed to AWS. The default token consisting of the issuer's namespace + and name is always included. + If unset the audience defaults to `sts.amazonaws.com`. + type: array + items: + type: string + name: + description: Name of the ServiceAccount used to request a token. + type: string + hostedZoneID: + description: If set, the provider will manage only this zone in Route53 and will not do a lookup using the route53:ListHostedZonesByName api call. type: string - required: - - name - type: object - profile: - description: |- - Profile specifies the key and certificate encryption algorithms and the HMAC algorithm - used to create the PKCS12 keystore. Default value is `LegacyRC2` for backward compatibility. + region: + description: |- + Override the AWS region. - If provided, allowed values are: - `LegacyRC2`: Deprecated. Not supported by default in OpenSSL 3 or Java 20. - `LegacyDES`: Less secure algorithm. Use this option for maximal compatibility. - `Modern2023`: Secure algorithm. Use this option in case you have to always use secure algorithms - (e.g., because of company policy). Please note that the security of the algorithm is not that important - in reality, because the unencrypted certificate and private key are also stored in the Secret. - `Modern2026`: Encodes PKCS#12 files using algorithms that are considered modern as of 2026. - Private keys and certificates are encrypted using PBES2 with PBKDF2-HMAC-SHA-256 and AES-256-CBC. - The MAC algorithm is PBMAC1 with PBKDF2-HMAC-SHA-256 and HMAC-SHA256. - Files produced with this profile can be read by OpenSSL 3.4.0 and higher, Java 26 and higher, - or with Java using compatible versions of Bouncy Castle. Meets FIPS 140-3 requirements. - enum: - - LegacyRC2 - - LegacyDES - - Modern2023 - - Modern2026 - type: string - required: - - create - type: object - type: object - literalSubject: - description: |- - Requested X.509 certificate subject, represented using the LDAP "String - Representation of a Distinguished Name" [1]. - Important: the LDAP string format also specifies the order of the attributes - in the subject, this is important when issuing certs for LDAP authentication. - Example: `CN=foo,DC=corp,DC=example,DC=com` - More info [1]: https://datatracker.ietf.org/doc/html/rfc4514 - More info: https://github.com/cert-manager/cert-manager/issues/3203 - More info: https://github.com/cert-manager/cert-manager/issues/4424 + Route53 is a global service and does not have regional endpoints but the + region specified here (or via environment variables) is used as a hint to + help compute the correct AWS credential scope and partition when it + connects to Route53. See: + - [Amazon Route 53 endpoints and quotas](https://docs.aws.amazon.com/general/latest/gr/r53.html) + - [Global services](https://docs.aws.amazon.com/whitepapers/latest/aws-fault-isolation-boundaries/global-services.html) - Cannot be set if the `subject` or `commonName` field is set. - type: string - nameConstraints: - description: |- - x.509 certificate NameConstraint extension which MUST NOT be used in a non-CA certificate. - More Info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.10 + If you omit this region field, cert-manager will use the region from + AWS_REGION and AWS_DEFAULT_REGION environment variables, if they are set + in the cert-manager controller Pod. - This is an Alpha Feature and is only enabled with the - `--feature-gates=NameConstraints=true` option set on both - the controller and webhook components. - properties: - critical: - description: if true then the name constraints are marked critical. - type: boolean - excluded: - description: |- - Excluded contains the constraints which must be disallowed. Any name matching a - restriction in the excluded field is invalid regardless - of information appearing in the permitted - properties: - dnsDomains: - description: DNSDomains is a list of DNS domains that are permitted or excluded. - items: - type: string - type: array - x-kubernetes-list-type: atomic - emailAddresses: - description: EmailAddresses is a list of Email Addresses that are permitted or excluded. - items: - type: string - type: array - x-kubernetes-list-type: atomic - ipRanges: + The `region` field is not needed if you use [IAM Roles for Service Accounts (IRSA)](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html). + Instead an AWS_REGION environment variable is added to the cert-manager controller Pod by: + [Amazon EKS Pod Identity Webhook](https://github.com/aws/amazon-eks-pod-identity-webhook). + In this case this `region` field value is ignored. + + The `region` field is not needed if you use [EKS Pod Identities](https://docs.aws.amazon.com/eks/latest/userguide/pod-identities.html). + Instead an AWS_REGION environment variable is added to the cert-manager controller Pod by: + [Amazon EKS Pod Identity Agent](https://github.com/aws/eks-pod-identity-agent), + In this case this `region` field value is ignored. + type: string + role: + description: |- + Role is a Role ARN which the Route53 provider will assume using either the explicit credentials AccessKeyID/SecretAccessKey + or the inferred credentials from environment variables, shared credentials file or AWS Instance metadata + type: string + secretAccessKeySecretRef: + description: |- + The SecretAccessKey is used for authentication. + If neither the Access Key nor Key ID are set, we fall-back to using env + vars, shared credentials file or AWS Instance metadata, + see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials + type: object + required: + - name + properties: + key: + description: |- + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string + name: + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + webhook: description: |- - IPRanges is a list of IP Ranges that are permitted or excluded. - This should be a valid CIDR notation. - items: - type: string - type: array - x-kubernetes-list-type: atomic - uriDomains: - description: URIDomains is a list of URI domains that are permitted or excluded. - items: - type: string - type: array - x-kubernetes-list-type: atomic + Configure an external webhook based DNS01 challenge solver to manage + DNS01 challenge records. + type: object + required: + - groupName + - solverName + properties: + config: + description: |- + Additional configuration that should be passed to the webhook apiserver + when challenges are processed. + This can contain arbitrary JSON data. + Secret values should not be specified in this stanza. + If secret values are needed (e.g. credentials for a DNS service), you + should use a SecretKeySelector to reference a Secret resource. + For details on the schema of this field, consult the webhook provider + implementation's documentation. + x-kubernetes-preserve-unknown-fields: true + groupName: + description: |- + The API group name that should be used when POSTing ChallengePayload + resources to the webhook apiserver. + This should be the same as the GroupName specified in the webhook + provider implementation. + type: string + solverName: + description: |- + The name of the solver to use, as defined in the webhook provider + implementation. + This will typically be the name of the provider, e.g. 'cloudflare'. + type: string + http01: + description: |- + Configures cert-manager to attempt to complete authorizations by + performing the HTTP01 challenge flow. + It is not possible to obtain certificates for wildcard domain names + (e.g. `*.example.com`) using the HTTP01 challenge mechanism. type: object - permitted: - description: Permitted contains the constraints in which the names must be located. properties: - dnsDomains: - description: DNSDomains is a list of DNS domains that are permitted or excluded. - items: - type: string - type: array - x-kubernetes-list-type: atomic - emailAddresses: - description: EmailAddresses is a list of Email Addresses that are permitted or excluded. - items: - type: string - type: array - x-kubernetes-list-type: atomic - ipRanges: + gatewayHTTPRoute: description: |- - IPRanges is a list of IP Ranges that are permitted or excluded. - This should be a valid CIDR notation. - items: - type: string - type: array - x-kubernetes-list-type: atomic - uriDomains: - description: URIDomains is a list of URI domains that are permitted or excluded. - items: - type: string - type: array - x-kubernetes-list-type: atomic - type: object - type: object - otherNames: - description: |- - `otherNames` is an escape hatch for SAN that allows any type. We currently restrict the support to string like otherNames, cf RFC 5280 p 37 - Any UTF8 String valued otherName can be passed with by setting the keys oid: x.x.x.x and UTF8Value: somevalue for `otherName`. - Most commonly this would be UPN set with oid: 1.3.6.1.4.1.311.20.2.3 - You should ensure that any OID passed is valid for the UTF8String type as we do not explicitly validate this. - items: - properties: - oid: - description: |- - OID is the object identifier for the otherName SAN. - The object identifier must be expressed as a dotted string, for - example, "1.2.840.113556.1.4.221". - type: string - utf8Value: - description: |- - utf8Value is the string value of the otherName SAN. - The utf8Value accepts any valid UTF8 string to set as value for the otherName SAN. - type: string - type: object - type: array - x-kubernetes-list-type: atomic - privateKey: - description: |- - Private key options. These include the key algorithm and size, the used - encoding and the rotation policy. - properties: - algorithm: - description: |- - Algorithm is the private key algorithm of the corresponding private key - for this certificate. + The Gateway API is a sig-network community API that models service networking + in Kubernetes (https://gateway-api.sigs.k8s.io/). The Gateway solver will + create HTTPRoutes with the specified labels in the same namespace as the challenge. + This solver is experimental, and fields / behaviour may change in the future. + type: object + properties: + labels: + description: |- + Custom labels that will be applied to HTTPRoutes created by cert-manager + while solving HTTP-01 challenges. + type: object + additionalProperties: + type: string + parentRefs: + description: |- + When solving an HTTP-01 challenge, cert-manager creates an HTTPRoute. + cert-manager needs to know which parentRefs should be used when creating + the HTTPRoute. Usually, the parentRef references a Gateway. See: + https://gateway-api.sigs.k8s.io/api-types/httproute/#attaching-to-gateways + type: array + items: + description: |- + ParentReference identifies an API object (usually a Gateway) that can be considered + a parent of this resource (usually a route). There are two kinds of parent resources + with "Core" support: - If provided, allowed values are either `RSA`, `ECDSA` or `Ed25519`. - If `algorithm` is specified and `size` is not provided, - key size of 2048 will be used for `RSA` key algorithm and - key size of 256 will be used for `ECDSA` key algorithm. - key size is ignored when using the `Ed25519` key algorithm. - enum: - - RSA - - ECDSA - - Ed25519 - type: string - encoding: - description: |- - The private key cryptography standards (PKCS) encoding for this - certificate's private key to be encoded in. + * Gateway (Gateway conformance profile) + * Service (Mesh conformance profile, ClusterIP Services only) - If provided, allowed values are `PKCS1` and `PKCS8` standing for PKCS#1 - and PKCS#8, respectively. - Defaults to `PKCS1` if not specified. - enum: - - PKCS1 - - PKCS8 - type: string - rotationPolicy: - description: |- - RotationPolicy controls how private keys should be regenerated when a - re-issuance is being processed. + This API may be extended in the future to support additional kinds of parent + resources. - If set to `Never`, a private key will only be generated if one does not - already exist in the target `spec.secretName`. If one does exist but it - does not have the correct algorithm or size, a warning will be raised - to await user intervention. - If set to `Always`, a private key matching the specified requirements - will be generated whenever a re-issuance occurs. - Default is `Always`. - The default was changed from `Never` to `Always` in cert-manager >=v1.18.0. - enum: - - Never - - Always - type: string - size: - description: |- - Size is the key bit size of the corresponding private key for this certificate. + The API object must be valid in the cluster; the Group and Kind must + be registered in the cluster for this reference to be valid. + type: object + required: + - name + properties: + group: + description: |- + Group is the group of the referent. + When unspecified, "gateway.networking.k8s.io" is inferred. + To set the core API group (such as for a "Service" kind referent), + Group must be explicitly set to "" (empty string). + + Support: Core + type: string + default: gateway.networking.k8s.io + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + kind: + description: |- + Kind is kind of the referent. + + There are two kinds of parent resources with "Core" support: + + * Gateway (Gateway conformance profile) + * Service (Mesh conformance profile, ClusterIP Services only) + + Support for other resources is Implementation-Specific. + type: string + default: Gateway + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + name: + description: |- + Name is the name of the referent. + + Support: Core + type: string + maxLength: 253 + minLength: 1 + namespace: + description: |- + Namespace is the namespace of the referent. When unspecified, this refers + to the local namespace of the Route. + + Note that there are specific rules for ParentRefs which cross namespace + boundaries. Cross-namespace references are only valid if they are explicitly + allowed by something in the namespace they are referring to. For example: + Gateway has the AllowedRoutes field, and ReferenceGrant provides a + generic way to enable any other kind of cross-namespace reference. + + + ParentRefs from a Route to a Service in the same namespace are "producer" + routes, which apply default routing rules to inbound connections from + any namespace to the Service. + + ParentRefs from a Route to a Service in a different namespace are + "consumer" routes, and these routing rules are only applied to outbound + connections originating from the same namespace as the Route, for which + the intended destination of the connections are a Service targeted as a + ParentRef of the Route. + + + Support: Core + type: string + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + port: + description: |- + Port is the network port this Route targets. It can be interpreted + differently based on the type of parent resource. + + When the parent resource is a Gateway, this targets all listeners + listening on the specified port that also support this kind of Route(and + select this Route). It's not recommended to set `Port` unless the + networking behaviors specified in a Route must apply to a specific port + as opposed to a listener(s) whose port(s) may be changed. When both Port + and SectionName are specified, the name and port of the selected listener + must match both specified values. + + + When the parent resource is a Service, this targets a specific port in the + Service spec. When both Port (experimental) and SectionName are specified, + the name and port of the selected port must match both specified values. + - If `algorithm` is set to `RSA`, valid values are `2048`, `4096` or `8192`, - and will default to `2048` if not specified. - If `algorithm` is set to `ECDSA`, valid values are `256`, `384` or `521`, - and will default to `256` if not specified. - If `algorithm` is set to `Ed25519`, Size is ignored. - No other values are allowed. - type: integer - type: object - renewBefore: - description: |- - How long before the currently issued certificate's expiry cert-manager should - renew the certificate. For example, if a certificate is valid for 60 minutes, - and `renewBefore=10m`, cert-manager will begin to attempt to renew the certificate - 50 minutes after it was issued (i.e. when there are 10 minutes remaining until - the certificate is no longer valid). + Implementations MAY choose to support other parent resources. + Implementations supporting other types of parent resources MUST clearly + document how/if Port is interpreted. - NOTE: The actual lifetime of the issued certificate is used to determine the - renewal time. If an issuer returns a certificate with a different lifetime than - the one requested, cert-manager will use the lifetime of the issued certificate. + For the purpose of status, an attachment is considered successful as + long as the parent resource accepts it partially. For example, Gateway + listeners can restrict which Routes can attach to them by Route kind, + namespace, or hostname. If 1 of 2 Gateway listeners accept attachment + from the referencing Route, the Route MUST be considered successfully + attached. If no Gateway listeners accept attachment from this Route, + the Route MUST be considered detached from the Gateway. - If unset, this defaults to 1/3 of the issued certificate's lifetime. - Minimum accepted value is 5 minutes. - Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration. - Cannot be set if the `renewBeforePercentage` field is set. - type: string - renewBeforePercentage: - description: |- - `renewBeforePercentage` is like `renewBefore`, except it is a relative percentage - rather than an absolute duration. For example, if a certificate is valid for 60 - minutes, and `renewBeforePercentage=25`, cert-manager will begin to attempt to - renew the certificate 45 minutes after it was issued (i.e. when there are 15 - minutes (25%) remaining until the certificate is no longer valid). + Support: Extended + type: integer + format: int32 + maximum: 65535 + minimum: 1 + sectionName: + description: |- + SectionName is the name of a section within the target resource. In the + following resources, SectionName is interpreted as the following: - NOTE: The actual lifetime of the issued certificate is used to determine the - renewal time. If an issuer returns a certificate with a different lifetime than - the one requested, cert-manager will use the lifetime of the issued certificate. + * Gateway: Listener name. When both Port (experimental) and SectionName + are specified, the name and port of the selected listener must match + both specified values. + * Service: Port name. When both Port (experimental) and SectionName + are specified, the name and port of the selected listener must match + both specified values. - Value must be an integer in the range (0,100). The minimum effective - `renewBefore` derived from the `renewBeforePercentage` and `duration` fields is 5 - minutes. - Cannot be set if the `renewBefore` field is set. - format: int32 - type: integer - renewal: - description: |- - `renewal` allows configuration of how your certificate is renewed. If the policy mentioned is - `RenewBefore` then the controller respects `renewBefore` and `renewBeforePercentage`. - properties: - policy: - description: '`policy` must be one of `Disabled`, `RenewBefore`.' - enum: - - RenewBefore - - Disabled - type: string - windows: - description: '`windows` mentions the behavior of when the renewal must happen.' - items: - description: CertificateRenewalWindows is the definition for renewal windows - properties: - cron: - description: |- - `cron` is a cron compliant string to allow when the renewal should be allowed. Format is as shown below: - * * * * * - | | | | | - | | | | day of the week (0–6) (Sunday to Saturday; - | | | month (1–12) 7 is also Sunday on some systems) - | | day of the month (1–31) - | hour (0–23) - minute (0–59) - minLength: 1 - type: string - timezone: - description: |- - `timezone` is IANA compliant timezone. For example America/Denver. - If this field is not set, timezone is treated as UTC. - minLength: 1 - type: string - windowDuration: - description: |- - `windowDuration` is how long the cron definition is active for. - Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration. - pattern: ^([0-9]+(\.[0-9]+)?(s|m|h))+$ - type: string - required: - - cron - - windowDuration - type: object - type: array - x-kubernetes-list-type: atomic - type: object - revisionHistoryLimit: - description: |- - The maximum number of CertificateRequest revisions that are maintained in - the Certificate's history. Each revision represents a single `CertificateRequest` - created by this Certificate, either when it was created, renewed, or Spec - was changed. Revisions will be removed by oldest first if the number of - revisions exceeds this number. + Implementations MAY choose to support attaching Routes to other resources. + If that is the case, they MUST clearly document how SectionName is + interpreted. + + When unspecified (empty string), this will reference the entire resource. + For the purpose of status, an attachment is considered successful if at + least one section in the parent resource accepts it. For example, Gateway + listeners can restrict which Routes can attach to them by Route kind, + namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from + the referencing Route, the Route MUST be considered successfully + attached. If no Gateway listeners accept attachment from this Route, the + Route MUST be considered detached from the Gateway. + + Support: Core + type: string + maxLength: 253 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + podTemplate: + description: |- + Optional pod template used to configure the ACME challenge solver pods + used for HTTP01 challenges. + type: object + properties: + metadata: + description: |- + ObjectMeta overrides for the pod used to solve HTTP01 challenges. + Only the 'labels' and 'annotations' fields may be set. + If labels or annotations overlap with in-built values, the values here + will override the in-built values. + type: object + properties: + annotations: + description: Annotations that should be added to the created ACME HTTP01 solver pods. + type: object + additionalProperties: + type: string + labels: + description: Labels that should be added to the created ACME HTTP01 solver pods. + type: object + additionalProperties: + type: string + spec: + description: |- + PodSpec defines overrides for the HTTP01 challenge solver pod. + Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields. + All other fields will be ignored. + type: object + properties: + affinity: + description: If specified, the pod's scheduling constraints + type: object + properties: + nodeAffinity: + description: Describes node affinity scheduling rules for the pod. + type: object + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node matches the corresponding matchExpressions; the + node(s) with the highest sum are the most preferred. + type: array + items: + description: |- + An empty preferred scheduling term matches all objects with implicit weight 0 + (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). + type: object + required: + - preference + - weight + properties: + preference: + description: A node selector term, associated with the corresponding weight. + type: object + properties: + matchExpressions: + description: A list of node selector requirements by node's labels. + type: array + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchFields: + description: A list of node selector requirements by node's fields. + type: array + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + x-kubernetes-map-type: atomic + weight: + description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100. + type: integer + format: int32 + x-kubernetes-list-type: atomic + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to an update), the system + may or may not try to eventually evict the pod from its node. + type: object + required: + - nodeSelectorTerms + properties: + nodeSelectorTerms: + description: Required. A list of node selector terms. The terms are ORed. + type: array + items: + description: |- + A null or empty node selector term matches no objects. The requirements of + them are ANDed. + The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. + type: object + properties: + matchExpressions: + description: A list of node selector requirements by node's labels. + type: array + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchFields: + description: A list of node selector requirements by node's fields. + type: array + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + x-kubernetes-map-type: atomic + podAffinity: + description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)). + type: object + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + type: array + items: + description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) + type: object + required: + - podAffinityTerm + - weight + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated with the corresponding weight. + type: object + required: + - topologyKey + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both matchLabelKeys and labelSelector. + Also, matchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array + items: + type: string + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. + Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array + items: + type: string + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + type: array + items: + type: string + x-kubernetes-list-type: atomic + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + type: integer + format: int32 + x-kubernetes-list-type: atomic + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + type: array + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + type: object + required: + - topologyKey + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both matchLabelKeys and labelSelector. + Also, matchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array + items: + type: string + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. + Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array + items: + type: string + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + type: array + items: + type: string + x-kubernetes-list-type: atomic + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + x-kubernetes-list-type: atomic + podAntiAffinity: + description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)). + type: object + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the anti-affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling anti-affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + type: array + items: + description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) + type: object + required: + - podAffinityTerm + - weight + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated with the corresponding weight. + type: object + required: + - topologyKey + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both matchLabelKeys and labelSelector. + Also, matchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array + items: + type: string + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. + Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array + items: + type: string + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + type: array + items: + type: string + x-kubernetes-list-type: atomic + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + type: integer + format: int32 + x-kubernetes-list-type: atomic + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the anti-affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the anti-affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + type: array + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + type: object + required: + - topologyKey + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both matchLabelKeys and labelSelector. + Also, matchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array + items: + type: string + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. + Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array + items: + type: string + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + type: array + items: + type: string + x-kubernetes-list-type: atomic + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + x-kubernetes-list-type: atomic + imagePullSecrets: + description: If specified, the pod's imagePullSecrets + type: array + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + x-kubernetes-map-type: atomic + nodeSelector: + description: |- + NodeSelector is a selector which must be true for the pod to fit on a node. + Selector which must match a node's labels for the pod to be scheduled on that node. + More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ + type: object + additionalProperties: + type: string + priorityClassName: + description: If specified, the pod's priorityClassName. + type: string + securityContext: + description: If specified, the pod's security context + type: object + properties: + fsGroup: + description: |- + A special supplemental group that applies to all containers in a pod. + Some volume types allow the Kubelet to change the ownership of that volume + to be owned by the pod: - If set, revisionHistoryLimit must be a value of `1` or greater. - Default value is `1`. - format: int32 - type: integer - secretName: - description: |- - Name of the Secret resource that will be automatically created and - managed by this Certificate resource. It will be populated with a - private key and certificate, signed by the denoted issuer. The Secret - resource lives in the same namespace as the Certificate resource. - type: string - secretTemplate: - description: |- - Defines annotations and labels to be copied to the Certificate's Secret. - Labels and annotations on the Secret will be changed as they appear on the - SecretTemplate when added or removed. SecretTemplate annotations are added - in conjunction with, and cannot overwrite, the base set of annotations - cert-manager sets on the Certificate's Secret. - properties: - annotations: - additionalProperties: - type: string - description: Annotations is a key value map to be copied to the target Kubernetes Secret. - type: object - labels: - additionalProperties: - type: string - description: Labels is a key value map to be copied to the target Kubernetes Secret. - type: object - type: object - signatureAlgorithm: - description: |- - Signature algorithm to use. - Allowed values for RSA keys: SHA256WithRSA, SHA384WithRSA, SHA512WithRSA. - Allowed values for ECDSA keys: ECDSAWithSHA256, ECDSAWithSHA384, ECDSAWithSHA512. - Allowed values for Ed25519 keys: PureEd25519. - enum: - - SHA256WithRSA - - SHA384WithRSA - - SHA512WithRSA - - ECDSAWithSHA256 - - ECDSAWithSHA384 - - ECDSAWithSHA512 - - PureEd25519 - type: string - subject: - description: |- - Requested set of X509 certificate subject attributes. - More info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.6 + 1. The owning GID will be the FSGroup + 2. The setgid bit is set (new files created in the volume will be owned by FSGroup) + 3. The permission bits are OR'd with rw-rw---- - The common name attribute is specified separately in the `commonName` field. - Cannot be set if the `literalSubject` field is set. - properties: - countries: - description: Countries to be used on the Certificate. - items: - type: string - type: array - x-kubernetes-list-type: atomic - localities: - description: Cities to be used on the Certificate. - items: - type: string - type: array - x-kubernetes-list-type: atomic - organizationalUnits: - description: Organizational Units to be used on the Certificate. - items: - type: string - type: array - x-kubernetes-list-type: atomic - organizations: - description: Organizations to be used on the Certificate. - items: - type: string - type: array - x-kubernetes-list-type: atomic - postalCodes: - description: Postal codes to be used on the Certificate. - items: - type: string - type: array - x-kubernetes-list-type: atomic - provinces: - description: State/Provinces to be used on the Certificate. - items: - type: string - type: array - x-kubernetes-list-type: atomic - serialNumber: - description: Serial number to be used on the Certificate. - type: string - streetAddresses: - description: Street addresses to be used on the Certificate. - items: - type: string - type: array - x-kubernetes-list-type: atomic - type: object - uris: - description: Requested URI subject alternative names. - items: - type: string - type: array - x-kubernetes-list-type: atomic - usages: - description: |- - Requested key usages and extended key usages. - These usages are used to set the `usages` field on the created CertificateRequest - resources. If `encodeUsagesInRequest` is unset or set to `true`, the usages - will additionally be encoded in the `request` field which contains the CSR blob. + If unset, the Kubelet will not modify the ownership and permissions of any volume. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + fsGroupChangePolicy: + description: |- + fsGroupChangePolicy defines behavior of changing ownership and permission of the volume + before being exposed inside Pod. This field will only apply to + volume types which support fsGroup based ownership(and permissions). + It will have no effect on ephemeral volume types such as: secret, configmaps + and emptydir. + Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used. + Note that this field cannot be set when spec.os.name is windows. + type: string + runAsGroup: + description: |- + The GID to run the entrypoint of the container process. + Uses runtime default if unset. + May also be set in SecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence + for that container. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + runAsNonRoot: + description: |- + Indicates that the container must run as a non-root user. + If true, the Kubelet will validate the image at runtime to ensure that it + does not run as UID 0 (root) and fail to start the container if it does. + If unset or false, no such validation will be performed. + May also be set in SecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: boolean + runAsUser: + description: |- + The UID to run the entrypoint of the container process. + Defaults to user specified in image metadata if unspecified. + May also be set in SecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence + for that container. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + seLinuxOptions: + description: |- + The SELinux context to be applied to all containers. + If unspecified, the container runtime will allocate a random SELinux context for each + container. May also be set in SecurityContext. If set in + both SecurityContext and PodSecurityContext, the value specified in SecurityContext + takes precedence for that container. + Note that this field cannot be set when spec.os.name is windows. + type: object + properties: + level: + description: Level is SELinux level label that applies to the container. + type: string + role: + description: Role is a SELinux role label that applies to the container. + type: string + type: + description: Type is a SELinux type label that applies to the container. + type: string + user: + description: User is a SELinux user label that applies to the container. + type: string + seccompProfile: + description: |- + The seccomp options to use by the containers in this pod. + Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile defined in a file on the node should be used. + The profile must be preconfigured on the node to work. + Must be a descending path, relative to the kubelet's configured seccomp profile location. + Must be set if type is "Localhost". Must NOT be set for any other type. + type: string + type: + description: |- + type indicates which kind of seccomp profile will be applied. + Valid options are: + + Localhost - a profile defined in a file on the node should be used. + RuntimeDefault - the container runtime default profile should be used. + Unconfined - no profile should be applied. + type: string + supplementalGroups: + description: |- + A list of groups applied to the first process run in each container, in addition + to the container's primary GID, the fsGroup (if specified), and group memberships + defined in the container image for the uid of the container process. If unspecified, + no additional groups are added to any container. Note that group memberships + defined in the container image for the uid of the container process are still effective, + even if they are not included in this list. + Note that this field cannot be set when spec.os.name is windows. + type: array + items: + type: integer + format: int64 + sysctls: + description: |- + Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported + sysctls (by the container runtime) might fail to launch. + Note that this field cannot be set when spec.os.name is windows. + type: array + items: + description: Sysctl defines a kernel parameter to be set + type: object + required: + - name + - value + properties: + name: + description: Name of a property to set + type: string + value: + description: Value of a property to set + type: string + serviceAccountName: + description: If specified, the pod's service account + type: string + tolerations: + description: If specified, the pod's tolerations. + type: array + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + type: object + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists and Equal. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + type: integer + format: int64 + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + serviceType: + description: |- + Optional service type for Kubernetes solver service. Supported values + are NodePort or ClusterIP. If unset, defaults to NodePort. + type: string + ingress: + description: |- + The ingress based HTTP01 challenge solver will solve challenges by + creating or modifying Ingress resources in order to route requests for + '/.well-known/acme-challenge/XYZ' to 'challenge solver' pods that are + provisioned by cert-manager for each Challenge to be completed. + type: object + properties: + class: + description: |- + This field configures the annotation `kubernetes.io/ingress.class` when + creating Ingress resources to solve ACME challenges that use this + challenge solver. Only one of `class`, `name` or `ingressClassName` may + be specified. + type: string + ingressClassName: + description: |- + This field configures the field `ingressClassName` on the created Ingress + resources used to solve ACME challenges that use this challenge solver. + This is the recommended way of configuring the ingress class. Only one of + `class`, `name` or `ingressClassName` may be specified. + type: string + ingressTemplate: + description: |- + Optional ingress template used to configure the ACME challenge solver + ingress used for HTTP01 challenges. + type: object + properties: + metadata: + description: |- + ObjectMeta overrides for the ingress used to solve HTTP01 challenges. + Only the 'labels' and 'annotations' fields may be set. + If labels or annotations overlap with in-built values, the values here + will override the in-built values. + type: object + properties: + annotations: + description: Annotations that should be added to the created ACME HTTP01 solver ingress. + type: object + additionalProperties: + type: string + labels: + description: Labels that should be added to the created ACME HTTP01 solver ingress. + type: object + additionalProperties: + type: string + name: + description: |- + The name of the ingress resource that should have ACME challenge solving + routes inserted into it in order to solve HTTP01 challenges. + This is typically used in conjunction with ingress controllers like + ingress-gce, which maintains a 1:1 mapping between external IPs and + ingress resources. Only one of `class`, `name` or `ingressClassName` may + be specified. + type: string + podTemplate: + description: |- + Optional pod template used to configure the ACME challenge solver pods + used for HTTP01 challenges. + type: object + properties: + metadata: + description: |- + ObjectMeta overrides for the pod used to solve HTTP01 challenges. + Only the 'labels' and 'annotations' fields may be set. + If labels or annotations overlap with in-built values, the values here + will override the in-built values. + type: object + properties: + annotations: + description: Annotations that should be added to the created ACME HTTP01 solver pods. + type: object + additionalProperties: + type: string + labels: + description: Labels that should be added to the created ACME HTTP01 solver pods. + type: object + additionalProperties: + type: string + spec: + description: |- + PodSpec defines overrides for the HTTP01 challenge solver pod. + Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields. + All other fields will be ignored. + type: object + properties: + affinity: + description: If specified, the pod's scheduling constraints + type: object + properties: + nodeAffinity: + description: Describes node affinity scheduling rules for the pod. + type: object + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node matches the corresponding matchExpressions; the + node(s) with the highest sum are the most preferred. + type: array + items: + description: |- + An empty preferred scheduling term matches all objects with implicit weight 0 + (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). + type: object + required: + - preference + - weight + properties: + preference: + description: A node selector term, associated with the corresponding weight. + type: object + properties: + matchExpressions: + description: A list of node selector requirements by node's labels. + type: array + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchFields: + description: A list of node selector requirements by node's fields. + type: array + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + x-kubernetes-map-type: atomic + weight: + description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100. + type: integer + format: int32 + x-kubernetes-list-type: atomic + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to an update), the system + may or may not try to eventually evict the pod from its node. + type: object + required: + - nodeSelectorTerms + properties: + nodeSelectorTerms: + description: Required. A list of node selector terms. The terms are ORed. + type: array + items: + description: |- + A null or empty node selector term matches no objects. The requirements of + them are ANDed. + The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. + type: object + properties: + matchExpressions: + description: A list of node selector requirements by node's labels. + type: array + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchFields: + description: A list of node selector requirements by node's fields. + type: array + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: The label key that the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + x-kubernetes-map-type: atomic + podAffinity: + description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)). + type: object + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + type: array + items: + description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) + type: object + required: + - podAffinityTerm + - weight + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated with the corresponding weight. + type: object + required: + - topologyKey + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both matchLabelKeys and labelSelector. + Also, matchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array + items: + type: string + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. + Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array + items: + type: string + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + type: array + items: + type: string + x-kubernetes-list-type: atomic + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + type: integer + format: int32 + x-kubernetes-list-type: atomic + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + type: array + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + type: object + required: + - topologyKey + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both matchLabelKeys and labelSelector. + Also, matchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array + items: + type: string + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. + Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array + items: + type: string + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + type: array + items: + type: string + x-kubernetes-list-type: atomic + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + x-kubernetes-list-type: atomic + podAntiAffinity: + description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)). + type: object + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the anti-affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling anti-affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + type: array + items: + description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) + type: object + required: + - podAffinityTerm + - weight + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated with the corresponding weight. + type: object + required: + - topologyKey + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both matchLabelKeys and labelSelector. + Also, matchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array + items: + type: string + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. + Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array + items: + type: string + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + type: array + items: + type: string + x-kubernetes-list-type: atomic + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + type: integer + format: int32 + x-kubernetes-list-type: atomic + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the anti-affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the anti-affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + type: array + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + type: object + required: + - topologyKey + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both matchLabelKeys and labelSelector. + Also, matchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array + items: + type: string + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. + Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array + items: + type: string + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + type: array + items: + type: string + x-kubernetes-list-type: atomic + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + x-kubernetes-list-type: atomic + imagePullSecrets: + description: If specified, the pod's imagePullSecrets + type: array + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + x-kubernetes-map-type: atomic + nodeSelector: + description: |- + NodeSelector is a selector which must be true for the pod to fit on a node. + Selector which must match a node's labels for the pod to be scheduled on that node. + More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ + type: object + additionalProperties: + type: string + priorityClassName: + description: If specified, the pod's priorityClassName. + type: string + securityContext: + description: If specified, the pod's security context + type: object + properties: + fsGroup: + description: |- + A special supplemental group that applies to all containers in a pod. + Some volume types allow the Kubelet to change the ownership of that volume + to be owned by the pod: - If unset, defaults to `digital signature` and `key encipherment`. - items: - description: |- - KeyUsage specifies valid usage contexts for keys. - See: - https://tools.ietf.org/html/rfc5280#section-4.2.1.3 - https://tools.ietf.org/html/rfc5280#section-4.2.1.12 + 1. The owning GID will be the FSGroup + 2. The setgid bit is set (new files created in the volume will be owned by FSGroup) + 3. The permission bits are OR'd with rw-rw---- - Valid KeyUsage values are as follows: - "signing", - "digital signature", - "content commitment", - "key encipherment", - "key agreement", - "data encipherment", - "cert sign", - "crl sign", - "encipher only", - "decipher only", - "any", - "server auth", - "client auth", - "code signing", - "email protection", - "s/mime", - "ipsec end system", - "ipsec tunnel", - "ipsec user", - "timestamping", - "ocsp signing", - "microsoft sgc", - "netscape sgc" - enum: - - signing - - digital signature - - content commitment - - key encipherment - - key agreement - - data encipherment - - cert sign - - crl sign - - encipher only - - decipher only - - any - - server auth - - client auth - - code signing - - email protection - - s/mime - - ipsec end system - - ipsec tunnel - - ipsec user - - timestamping - - ocsp signing - - microsoft sgc - - netscape sgc - type: string - type: array - x-kubernetes-list-type: atomic - required: - - issuerRef - - secretName - type: object - status: - description: |- - Status of the Certificate. - This is set and managed automatically. - Read-only. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status - properties: - acme: - description: ACME stores information that is fetched from the ACME CA server. - properties: - ari: + If unset, the Kubelet will not modify the ownership and permissions of any volume. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + fsGroupChangePolicy: + description: |- + fsGroupChangePolicy defines behavior of changing ownership and permission of the volume + before being exposed inside Pod. This field will only apply to + volume types which support fsGroup based ownership(and permissions). + It will have no effect on ephemeral volume types such as: secret, configmaps + and emptydir. + Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used. + Note that this field cannot be set when spec.os.name is windows. + type: string + runAsGroup: + description: |- + The GID to run the entrypoint of the container process. + Uses runtime default if unset. + May also be set in SecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence + for that container. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + runAsNonRoot: + description: |- + Indicates that the container must run as a non-root user. + If true, the Kubelet will validate the image at runtime to ensure that it + does not run as UID 0 (root) and fail to start the container if it does. + If unset or false, no such validation will be performed. + May also be set in SecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: boolean + runAsUser: + description: |- + The UID to run the entrypoint of the container process. + Defaults to user specified in image metadata if unspecified. + May also be set in SecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence + for that container. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + seLinuxOptions: + description: |- + The SELinux context to be applied to all containers. + If unspecified, the container runtime will allocate a random SELinux context for each + container. May also be set in SecurityContext. If set in + both SecurityContext and PodSecurityContext, the value specified in SecurityContext + takes precedence for that container. + Note that this field cannot be set when spec.os.name is windows. + type: object + properties: + level: + description: Level is SELinux level label that applies to the container. + type: string + role: + description: Role is a SELinux role label that applies to the container. + type: string + type: + description: Type is a SELinux type label that applies to the container. + type: string + user: + description: User is a SELinux user label that applies to the container. + type: string + seccompProfile: + description: |- + The seccomp options to use by the containers in this pod. + Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile defined in a file on the node should be used. + The profile must be preconfigured on the node to work. + Must be a descending path, relative to the kubelet's configured seccomp profile location. + Must be set if type is "Localhost". Must NOT be set for any other type. + type: string + type: + description: |- + type indicates which kind of seccomp profile will be applied. + Valid options are: + + Localhost - a profile defined in a file on the node should be used. + RuntimeDefault - the container runtime default profile should be used. + Unconfined - no profile should be applied. + type: string + supplementalGroups: + description: |- + A list of groups applied to the first process run in each container, in addition + to the container's primary GID, the fsGroup (if specified), and group memberships + defined in the container image for the uid of the container process. If unspecified, + no additional groups are added to any container. Note that group memberships + defined in the container image for the uid of the container process are still effective, + even if they are not included in this list. + Note that this field cannot be set when spec.os.name is windows. + type: array + items: + type: integer + format: int64 + sysctls: + description: |- + Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported + sysctls (by the container runtime) might fail to launch. + Note that this field cannot be set when spec.os.name is windows. + type: array + items: + description: Sysctl defines a kernel parameter to be set + type: object + required: + - name + - value + properties: + name: + description: Name of a property to set + type: string + value: + description: Value of a property to set + type: string + serviceAccountName: + description: If specified, the pod's service account + type: string + tolerations: + description: If specified, the pod's tolerations. + type: array + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + type: object + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists and Equal. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + type: integer + format: int64 + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + serviceType: + description: |- + Optional service type for Kubernetes solver service. Supported values + are NodePort or ClusterIP. If unset, defaults to NodePort. + type: string + selector: description: |- - ARI stores the ACME Renewal Information that is fetched from the ACME server - in accordance with RFC 9773. This is only populated if the ARI feature gate is enabled. + Selector selects a set of DNSNames on the Certificate resource that + should be solved using this challenge solver. + If not specified, the solver will be treated as the 'default' solver + with the lowest priority, i.e. if any other solver has a more specific + match, it will be used instead. + type: object properties: - explanationURL: + dnsNames: + description: |- + List of DNSNames that this solver will be used to solve. + If specified and a match is found, a dnsNames selector will take + precedence over a dnsZones selector. + If multiple solvers match with the same dnsNames value, the solver + with the most matching labels in matchLabels will be selected. + If neither has more matches, the solver defined earlier in the list + will be selected. + type: array + items: + type: string + dnsZones: description: |- - ExplanationURL is a human-readable URL that may explain why the suggested window - has its current value. - type: string - lastChecked: - description: LastChecked is the time at which the ACME server was last checked for renewal information. - format: date-time - type: string - lastError: - description: LastError is the last error encountered when checking the ACME server for renewal information, if any. - type: string - nextCheck: - description: NextCheck is the time at which the ACME server will next be checked for renewal information. - format: date-time - type: string - suggestedWindow: - description: SuggestedWindow is the suggested renewal window as returned by the ACME server in accordance with RFC 9773. - properties: - end: - description: End is the end of the suggested renewal window. - format: date-time - type: string - start: - description: Start is the start of the suggested renewal window. - format: date-time - type: string - required: - - end - - start + List of DNSZones that this solver will be used to solve. + The most specific DNS zone match specified here will take precedence + over other DNS zone matches, so a solver specifying sys.example.com + will be selected over one specifying example.com for the domain + www.sys.example.com. + If multiple solvers match with the same dnsZones value, the solver + with the most matching labels in matchLabels will be selected. + If neither has more matches, the solver defined earlier in the list + will be selected. + type: array + items: + type: string + matchLabels: + description: |- + A label selector that is used to refine the set of certificate's that + this challenge solver will apply to. type: object - type: object - type: object - conditions: - description: |- - List of status conditions to indicate the status of certificates. - Known condition types are `Ready` and `Issuing`. - items: - description: CertificateCondition contains condition information for a Certificate. - properties: - lastTransitionTime: - description: |- - LastTransitionTime is the timestamp corresponding to the last status - change of this condition. - format: date-time - type: string - message: - description: |- - Message is a human readable description of the details of the last - transition, complementing reason. - type: string - observedGeneration: - description: |- - If set, this represents the .metadata.generation that the condition was - set based upon. - For instance, if .metadata.generation is currently 12, but the - .status.condition[x].observedGeneration is 9, the condition is out of date - with respect to the current state of the Certificate. - format: int64 - type: integer - reason: - description: |- - Reason is a brief machine readable explanation for the condition's last - transition. - type: string - status: - description: Status of the condition, one of (`True`, `False`, `Unknown`). - enum: - - "True" - - "False" - - Unknown - type: string - type: - description: Type of the condition, known values are (`Ready`, `Issuing`). - type: string - required: - - status - - type - type: object - type: array - x-kubernetes-list-map-keys: - - type - x-kubernetes-list-type: map - failedIssuanceAttempts: - description: |- - The number of continuous failed issuance attempts up till now. This - field gets removed (if set) on a successful issuance and gets set to - 1 if unset and an issuance has failed. If an issuance has failed, the - delay till the next issuance will be calculated using formula - time.Hour * 2 ^ (failedIssuanceAttempts - 1). - type: integer - lastFailureTime: + additionalProperties: + type: string + token: description: |- - LastFailureTime is set only if the latest issuance for this - Certificate failed and contains the time of the failure. If an - issuance has failed, the delay till the next issuance will be - calculated using formula time.Hour * 2 ^ (failedIssuanceAttempts - - 1). If the latest issuance has succeeded this field will be unset. - format: date-time + The ACME challenge token for this challenge. + This is the raw value returned from the ACME server. type: string - nextPrivateKeySecretName: + type: description: |- - The name of the Secret resource containing the private key to be used - for the next certificate iteration. - The keymanager controller will automatically set this field if the - `Issuing` condition is set to `True`. - It will automatically unset this field when the Issuing condition is - not set or False. + The type of ACME challenge this resource represents. + One of "HTTP-01" or "DNS-01". type: string - notAfter: + enum: + - HTTP-01 + - DNS-01 + url: description: |- - The expiration time of the certificate stored in the secret named - by this resource in `spec.secretName`. - format: date-time + The URL of the ACME Challenge resource for this challenge. + This can be used to lookup details about the status of this challenge. type: string - notBefore: + wildcard: description: |- - The time after which the certificate stored in the secret named - by this resource in `spec.secretName` is valid. - format: date-time - type: string - renewalTime: + wildcard will be true if this challenge is for a wildcard identifier, + for example '*.example.com'. + type: boolean + status: + type: object + properties: + presented: description: |- - RenewalTime is the time at which the certificate will be next - renewed. - If not set, no upcoming renewal is scheduled. - format: date-time + presented will be set to true if the challenge values for this challenge + are currently 'presented'. + This *does not* imply the self check is passing. Only that the values + have been 'submitted' for the appropriate challenge mechanism (i.e. the + DNS01 TXT record has been presented, or the HTTP01 configuration has been + configured). + type: boolean + processing: + description: |- + Used to denote whether this challenge should be processed or not. + This field will only be set to true by the 'scheduling' component. + It will only be set to false by the 'challenges' controller, after the + challenge has reached a final state or timed out. + If this field is set to false, the challenge controller will not take + any more action. + type: boolean + reason: + description: |- + Contains human readable information on why the Challenge is in the + current state. type: string - revision: + state: description: |- - The current 'revision' of the certificate as issued. - - When a CertificateRequest resource is created, it will have the - `cert-manager.io/certificate-revision` set to one greater than the - current value of this field. - - Upon issuance, this field will be set to the value of the annotation - on the CertificateRequest resource used to issue the certificate. - - Persisting the value on the CertificateRequest resource allows the - certificates controller to know whether a request is part of an old - issuance or if it is part of the ongoing revision's issuance by - checking if the revision value in the annotation is greater than this - field. - type: integer - type: object - type: object - selectableFields: - - jsonPath: .spec.issuerRef.group - - jsonPath: .spec.issuerRef.kind - - jsonPath: .spec.issuerRef.name + Contains the current 'state' of the challenge. + If not set, the state of the challenge is unknown. + type: string + enum: + - valid + - ready + - pending + - processing + - invalid + - expired + - errored served: true storage: true subresources: status: {} +# END crd --- -# Source: cert-manager/templates/crd-cert-manager.io_clusterissuers.yaml +# Source: cert-manager/templates/crds.yaml +# START crd apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: - name: "clusterissuers.cert-manager.io" + name: clusterissuers.cert-manager.io + # START annotations annotations: helm.sh/resource-policy: keep + # END annotations labels: - app: "cert-manager" - app.kubernetes.io/name: "cert-manager" - app.kubernetes.io/instance: "cert-manager" - app.kubernetes.io/component: "crds" - app.kubernetes.io/version: "v1.21.1" + app: 'cert-manager' + app.kubernetes.io/name: 'cert-manager' + app.kubernetes.io/instance: 'cert-manager' + # Generated labels + app.kubernetes.io/version: "v1.17.0" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 + helm.sh/chart: cert-manager-v1.17.0 spec: group: cert-manager.io names: - categories: - - cert-manager kind: ClusterIssuer listKind: ClusterIssuerList plural: clusterissuers - shortNames: - - ciss singular: clusterissuer + categories: + - cert-manager scope: Cluster versions: - - additionalPrinterColumns: - - jsonPath: .status.conditions[?(@.type == "Ready")].status + - name: v1 + subresources: + status: {} + additionalPrinterColumns: + - jsonPath: .status.conditions[?(@.type=="Ready")].status name: Ready type: string - - jsonPath: .status.conditions[?(@.type == "Ready")].message + - jsonPath: .status.conditions[?(@.type=="Ready")].message name: Status priority: 1 type: string - - description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. - jsonPath: .metadata.creationTimestamp + - jsonPath: .metadata.creationTimestamp + description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. name: Age type: date - name: v1 schema: openAPIV3Schema: description: |- @@ -4980,6 +4434,9 @@ spec: It is similar to an Issuer, however it is cluster-scoped and therefore can be referenced by resources that exist in *any* namespace, not just the same namespace as the referent. + type: object + required: + - spec properties: apiVersion: description: |- @@ -5000,11 +4457,16 @@ spec: type: object spec: description: Desired state of the ClusterIssuer resource. + type: object properties: acme: description: |- ACME configures this issuer to communicate with a RFC8555 (ACME) server to obtain signed x509 certificates. + type: object + required: + - privateKeySecretRef + - server properties: caBundle: description: |- @@ -5014,8 +4476,8 @@ spec: kinds of security vulnerabilities. If CABundle and SkipTLSVerify are unset, the system certificate bundle inside the container is used to validate the TLS connection. - format: byte type: string + format: byte disableAccountKeyGeneration: description: |- Enables or disables generating a new ACME account key. @@ -5047,17 +4509,21 @@ spec: server. If set, upon registration cert-manager will attempt to associate the given external account credentials with the registered ACME account. + type: object + required: + - keyID + - keySecretRef properties: keyAlgorithm: description: |- Deprecated: keyAlgorithm field exists for historical compatibility reasons and should not be used. The algorithm is now hardcoded to HS256 in golang/x/crypto/acme. + type: string enum: - HS256 - HS384 - HS512 - type: string keyID: description: keyID is the ID of the CA key that the External Account is bound to. type: string @@ -5070,6 +4536,9 @@ spec: the External Account Binding keyID above. The secret key stored in the Secret **must** be un-padded, base64 URL encoded data. + type: object + required: + - name properties: key: description: |- @@ -5082,25 +4551,18 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string - required: - - name - type: object - required: - - keyID - - keySecretRef - type: object preferredChain: description: |- PreferredChain is the chain to use if the ACME server outputs multiple. PreferredChain is no guarantee that this one gets delivered by the ACME endpoint. - For example, for Let's Encrypt's DST cross-sign you would use: + For example, for Let's Encrypt's DST crosssign you would use: "DST Root CA X3" or "ISRG Root X1" for the newer Let's Encrypt root CA. This value picks the first certificate bundle in the combined set of ACME default and alternative chains that has a root-most certificate with this value as its issuer's commonname. - maxLength: 64 type: string + maxLength: 64 privateKeySecretRef: description: |- PrivateKey is the name of a Kubernetes Secret resource that will be used to @@ -5108,6 +4570,9 @@ spec: Optionally, a `key` may be specified to select a specific entry within the named Secret resource. If `key` is not specified, a default of `tls.key` will be used. + type: object + required: + - name properties: key: description: |- @@ -5120,14 +4585,6 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string - required: - - name - type: object - profile: - description: |- - Profile allows requesting a certificate profile from the ACME server. - Supported profiles are listed by the server's ACME directory URL. - type: string server: description: |- Server is the URL used to access the ACME server's 'directory' endpoint. @@ -5154,26 +4611,36 @@ spec: Solver configurations must be provided in order to obtain certificates from an ACME server. For more information, see: https://cert-manager.io/docs/configuration/acme/ + type: array items: description: |- An ACMEChallengeSolver describes how to solve ACME challenges for the issuer it is part of. A selector may be provided to use different solving strategies for different DNS names. Only one of HTTP01 or DNS01 must be provided. + type: object properties: dns01: description: |- Configures cert-manager to attempt to complete authorizations by performing the DNS01 challenge flow. + type: object properties: acmeDNS: description: |- Use the 'ACME DNS' (https://github.com/joohoi/acme-dns) API to manage DNS01 challenge records. + type: object + required: + - accountSecretRef + - host properties: accountSecretRef: description: |- A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + type: object + required: + - name properties: key: description: |- @@ -5186,22 +4653,24 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string - required: - - name - type: object host: type: string - required: - - accountSecretRef - - host - type: object akamai: description: Use the Akamai DNS zone management API to manage DNS01 challenge records. + type: object + required: + - accessTokenSecretRef + - clientSecretSecretRef + - clientTokenSecretRef + - serviceConsumerDomain properties: accessTokenSecretRef: description: |- A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + type: object + required: + - name properties: key: description: |- @@ -5214,13 +4683,13 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string - required: - - name - type: object clientSecretSecretRef: description: |- A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + type: object + required: + - name properties: key: description: |- @@ -5233,13 +4702,13 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string - required: - - name - type: object clientTokenSecretRef: description: |- A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + type: object + required: + - name properties: key: description: |- @@ -5252,19 +4721,14 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string - required: - - name - type: object serviceConsumerDomain: type: string - required: - - accessTokenSecretRef - - clientSecretSecretRef - - clientTokenSecretRef - - serviceConsumerDomain - type: object azureDNS: description: Use the Microsoft Azure DNS API to manage DNS01 challenge records. + type: object + required: + - resourceGroupName + - subscriptionID properties: clientID: description: |- @@ -5277,6 +4741,9 @@ spec: Auth: Azure Service Principal: A reference to a Secret containing the password associated with the Service Principal. If set, ClientID and TenantID must also be set. + type: object + required: + - name properties: key: description: |- @@ -5289,17 +4756,14 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string - required: - - name - type: object environment: description: name of the Azure environment (default AzurePublicCloud) + type: string enum: - AzurePublicCloud - AzureChinaCloud - AzureGermanCloud - AzureUSGovernmentCloud - type: string hostedZoneName: description: name of the DNS zone that should be used type: string @@ -5308,19 +4772,19 @@ spec: Auth: Azure Workload Identity or Azure Managed Service Identity: Settings to enable Azure Workload Identity or Azure Managed Service Identity If set, ClientID, ClientSecret and TenantID must not be set. + type: object properties: clientID: - description: client ID of the managed identity, cannot be used at the same time as resourceID + description: client ID of the managed identity, can not be used at the same time as resourceID type: string resourceID: description: |- - resource ID of the managed identity, cannot be used at the same time as clientID + resource ID of the managed identity, can not be used at the same time as clientID Cannot be used for Azure Managed Service Identity type: string tenantID: - description: tenant ID of the managed identity, cannot be used at the same time as resourceID + description: tenant ID of the managed identity, can not be used at the same time as resourceID type: string - type: object resourceGroupName: description: resource group the DNS zone is located in type: string @@ -5333,28 +4797,11 @@ spec: The TenantID of the Azure Service Principal used to authenticate with Azure DNS. If set, ClientID and ClientSecret must also be set. type: string - zoneType: - description: |- - ZoneType determines which type of Azure DNS zone to use. - - Valid values are: - - AzurePublicZone (default): Use a public Azure DNS zone. - - AzurePrivateZone: Use an Azure Private DNS zone. - - If not specified, AzurePublicZone is used. - - Support for Azure Private DNS zones is currently - experimental and may change in future releases. - enum: - - AzurePublicZone - - AzurePrivateZone - type: string - required: - - resourceGroupName - - subscriptionID - type: object cloudDNS: description: Use the Google Cloud DNS API to manage DNS01 challenge records. + type: object + required: + - project properties: hostedZoneName: description: |- @@ -5368,6 +4815,9 @@ spec: description: |- A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + type: object + required: + - name properties: key: description: |- @@ -5380,20 +4830,18 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string - required: - - name - type: object - required: - - project - type: object cloudflare: description: Use the Cloudflare API to manage DNS01 challenge records. + type: object properties: apiKeySecretRef: description: |- API key to use to authenticate with Cloudflare. Note: using an API token to authenticate is now the recommended method as it allows greater control of permissions. + type: object + required: + - name properties: key: description: |- @@ -5406,11 +4854,11 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string - required: - - name - type: object apiTokenSecretRef: description: API token used to authenticate with Cloudflare. + type: object + required: + - name properties: key: description: |- @@ -5423,28 +4871,30 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string - required: - - name - type: object email: description: Email of the account, only required when using API key based authentication. type: string - type: object cnameStrategy: description: |- CNAMEStrategy configures how the DNS01 provider should handle CNAME records when found in DNS zones. + type: string enum: - None - Follow - type: string digitalocean: description: Use the DigitalOcean DNS API to manage DNS01 challenge records. + type: object + required: + - tokenSecretRef properties: tokenSecretRef: description: |- A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + type: object + required: + - name properties: key: description: |- @@ -5457,30 +4907,21 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string - required: - - name - type: object - required: - - tokenSecretRef - type: object rfc2136: description: |- Use RFC2136 ("Dynamic Updates in the Domain Name System") (https://datatracker.ietf.org/doc/rfc2136/) to manage DNS01 challenge records. + type: object + required: + - nameserver properties: nameserver: description: |- The IP address or hostname of an authoritative DNS server supporting RFC2136 in the form host:port. If the host is an IPv6 address it must be - enclosed in square brackets (e.g [2001:db8::1]); port is optional. + enclosed in square brackets (e.g [2001:db8::1]) ; port is optional. This field is required. type: string - protocol: - description: Protocol to use for dynamic DNS update queries. Valid values are (case-sensitive) ``TCP`` and ``UDP``; ``UDP`` (default). - enum: - - TCP - - UDP - type: string tsigAlgorithm: description: |- The TSIG Algorithm configured in the DNS supporting RFC2136. Used only @@ -5497,6 +4938,9 @@ spec: description: |- The name of the secret containing the TSIG value. If ``tsigKeyName`` is defined, this field is required. + type: object + required: + - name properties: key: description: |- @@ -5509,21 +4953,16 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string - required: - - name - type: object - required: - - nameserver - type: object route53: description: Use the AWS Route53 API to manage DNS01 challenge records. + type: object properties: accessKeyID: description: |- The AccessKeyID is used for authentication. Cannot be set when SecretAccessKeyID is set. - If neither the Access Key nor Key ID are set, we fall back to using env - vars, shared credentials file, or AWS Instance metadata, + If neither the Access Key nor Key ID are set, we fall-back to using env + vars, shared credentials file or AWS Instance metadata, see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials type: string accessKeyIDSecretRef: @@ -5531,9 +4970,12 @@ spec: The SecretAccessKey is used for authentication. If set, pull the AWS access key ID from a key within a Kubernetes Secret. Cannot be set when AccessKeyID is set. - If neither the Access Key nor Key ID are set, we fall back to using env - vars, shared credentials file, or AWS Instance metadata, + If neither the Access Key nor Key ID are set, we fall-back to using env + vars, shared credentials file or AWS Instance metadata, see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials + type: object + required: + - name properties: key: description: |- @@ -5546,22 +4988,28 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string - required: - - name - type: object auth: description: Auth configures how cert-manager authenticates. + type: object + required: + - kubernetes properties: kubernetes: description: |- Kubernetes authenticates with Route53 using AssumeRoleWithWebIdentity by passing a bound ServiceAccount token. + type: object + required: + - serviceAccountRef properties: serviceAccountRef: description: |- A reference to a service account that will be used to request a bound token (also known as "projected token"). To use this field, you must configure an RBAC rule to let cert-manager request a token. + type: object + required: + - name properties: audiences: description: |- @@ -5569,22 +5017,12 @@ spec: token passed to AWS. The default token consisting of the issuer's namespace and name is always included. If unset the audience defaults to `sts.amazonaws.com`. + type: array items: type: string - type: array - x-kubernetes-list-type: atomic name: description: Name of the ServiceAccount used to request a token. type: string - required: - - name - type: object - required: - - serviceAccountRef - type: object - required: - - kubernetes - type: object hostedZoneID: description: If set, the provider will manage only this zone in Route53 and will not do a lookup using the route53:ListHostedZonesByName api call. type: string @@ -5621,9 +5059,12 @@ spec: secretAccessKeySecretRef: description: |- The SecretAccessKey is used for authentication. - If neither the Access Key nor Key ID are set, we fall back to using env - vars, shared credentials file, or AWS Instance metadata, + If neither the Access Key nor Key ID are set, we fall-back to using env + vars, shared credentials file or AWS Instance metadata, see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials + type: object + required: + - name properties: key: description: |- @@ -5636,14 +5077,14 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string - required: - - name - type: object - type: object webhook: description: |- Configure an external webhook based DNS01 challenge solver to manage DNS01 challenge records. + type: object + required: + - groupName + - solverName properties: config: description: |- @@ -5651,7 +5092,7 @@ spec: when challenges are processed. This can contain arbitrary JSON data. Secret values should not be specified in this stanza. - If secret values are needed (e.g., credentials for a DNS service), you + If secret values are needed (e.g. credentials for a DNS service), you should use a SecretKeySelector to reference a Secret resource. For details on the schema of this field, consult the webhook provider implementation's documentation. @@ -5667,19 +5108,15 @@ spec: description: |- The name of the solver to use, as defined in the webhook provider implementation. - This will typically be the name of the provider, e.g., 'cloudflare'. + This will typically be the name of the provider, e.g. 'cloudflare'. type: string - required: - - groupName - - solverName - type: object - type: object http01: description: |- Configures cert-manager to attempt to complete authorizations by performing the HTTP01 challenge flow. It is not possible to obtain certificates for wildcard domain names - (e.g., `*.example.com`) using the HTTP01 challenge mechanism. + (e.g. `*.example.com`) using the HTTP01 challenge mechanism. + type: object properties: gatewayHTTPRoute: description: |- @@ -5687,20 +5124,22 @@ spec: in Kubernetes (https://gateway-api.sigs.k8s.io/). The Gateway solver will create HTTPRoutes with the specified labels in the same namespace as the challenge. This solver is experimental, and fields / behaviour may change in the future. + type: object properties: labels: - additionalProperties: - type: string description: |- Custom labels that will be applied to HTTPRoutes created by cert-manager while solving HTTP-01 challenges. type: object + additionalProperties: + type: string parentRefs: description: |- When solving an HTTP-01 challenge, cert-manager creates an HTTPRoute. cert-manager needs to know which parentRefs should be used when creating the HTTPRoute. Usually, the parentRef references a Gateway. See: https://gateway-api.sigs.k8s.io/api-types/httproute/#attaching-to-gateways + type: array items: description: |- ParentReference identifies an API object (usually a Gateway) that can be considered @@ -5715,9 +5154,11 @@ spec: The API object must be valid in the cluster; the Group and Kind must be registered in the cluster for this reference to be valid. + type: object + required: + - name properties: group: - default: gateway.networking.k8s.io description: |- Group is the group of the referent. When unspecified, "gateway.networking.k8s.io" is inferred. @@ -5725,11 +5166,11 @@ spec: Group must be explicitly set to "" (empty string). Support: Core + type: string + default: gateway.networking.k8s.io maxLength: 253 pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string kind: - default: Gateway description: |- Kind is kind of the referent. @@ -5739,18 +5180,19 @@ spec: * Service (Mesh conformance profile, ClusterIP Services only) Support for other resources is Implementation-Specific. + type: string + default: Gateway maxLength: 63 minLength: 1 pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string name: description: |- Name is the name of the referent. Support: Core + type: string maxLength: 253 minLength: 1 - type: string namespace: description: |- Namespace is the namespace of the referent. When unspecified, this refers @@ -5775,10 +5217,10 @@ spec: Support: Core + type: string maxLength: 63 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ - type: string port: description: |- Port is the network port this Route targets. It can be interpreted @@ -5811,10 +5253,10 @@ spec: the Route MUST be considered detached from the Gateway. Support: Extended + type: integer format: int32 maximum: 65535 minimum: 1 - type: integer sectionName: description: |- SectionName is the name of a section within the target resource. In the @@ -5841,19 +5283,15 @@ spec: Route MUST be considered detached from the Gateway. Support: Core + type: string maxLength: 253 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - required: - - name - type: object - type: array - x-kubernetes-list-type: atomic podTemplate: description: |- Optional pod template used to configure the ACME challenge solver pods used for HTTP01 challenges. + type: object properties: metadata: description: |- @@ -5861,29 +5299,32 @@ spec: Only the 'labels' and 'annotations' fields may be set. If labels or annotations overlap with in-built values, the values here will override the in-built values. + type: object properties: annotations: - additionalProperties: - type: string description: Annotations that should be added to the created ACME HTTP01 solver pods. type: object - labels: additionalProperties: type: string + labels: description: Labels that should be added to the created ACME HTTP01 solver pods. type: object - type: object + additionalProperties: + type: string spec: description: |- PodSpec defines overrides for the HTTP01 challenge solver pod. Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields. All other fields will be ignored. + type: object properties: affinity: description: If specified, the pod's scheduling constraints + type: object properties: nodeAffinity: description: Describes node affinity scheduling rules for the pod. + type: object properties: preferredDuringSchedulingIgnoredDuringExecution: description: |- @@ -5896,20 +5337,31 @@ spec: compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node matches the corresponding matchExpressions; the node(s) with the highest sum are the most preferred. + type: array items: description: |- An empty preferred scheduling term matches all objects with implicit weight 0 (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). + type: object + required: + - preference + - weight properties: preference: description: A node selector term, associated with the corresponding weight. + type: object properties: matchExpressions: description: A list of node selector requirements by node's labels. + type: array items: description: |- A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator properties: key: description: The label key that the selector applies to. @@ -5926,22 +5378,22 @@ spec: the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. + type: array items: type: string - type: array x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array x-kubernetes-list-type: atomic matchFields: description: A list of node selector requirements by node's fields. + type: array items: description: |- A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator properties: key: description: The label key that the selector applies to. @@ -5958,27 +5410,16 @@ spec: the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. + type: array items: type: string - type: array x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array x-kubernetes-list-type: atomic - type: object x-kubernetes-map-type: atomic weight: description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100. - format: int32 type: integer - required: - - preference - - weight - type: object - type: array + format: int32 x-kubernetes-list-type: atomic requiredDuringSchedulingIgnoredDuringExecution: description: |- @@ -5987,21 +5428,31 @@ spec: If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to an update), the system may or may not try to eventually evict the pod from its node. + type: object + required: + - nodeSelectorTerms properties: nodeSelectorTerms: description: Required. A list of node selector terms. The terms are ORed. + type: array items: description: |- A null or empty node selector term matches no objects. The requirements of them are ANDed. The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. + type: object properties: matchExpressions: description: A list of node selector requirements by node's labels. + type: array items: description: |- A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator properties: key: description: The label key that the selector applies to. @@ -6018,22 +5469,22 @@ spec: the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. + type: array items: type: string - type: array x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array x-kubernetes-list-type: atomic matchFields: description: A list of node selector requirements by node's fields. + type: array items: description: |- A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator properties: key: description: The label key that the selector applies to. @@ -6050,27 +5501,17 @@ spec: the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. - items: - type: string type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array + items: + type: string + x-kubernetes-list-type: atomic x-kubernetes-list-type: atomic - type: object x-kubernetes-map-type: atomic - type: array x-kubernetes-list-type: atomic - required: - - nodeSelectorTerms - type: object x-kubernetes-map-type: atomic - type: object podAffinity: description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)). + type: object properties: preferredDuringSchedulingIgnoredDuringExecution: description: |- @@ -6083,23 +5524,37 @@ spec: compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. + type: array items: description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) + type: object + required: + - podAffinityTerm + - weight properties: podAffinityTerm: description: Required. A pod affinity term, associated with the corresponding weight. + type: object + required: + - topologyKey properties: labelSelector: description: |- A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods. + type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator properties: key: description: key is the label key that the selector applies to. @@ -6115,25 +5570,19 @@ spec: the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array items: type: string - type: array x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array x-kubernetes-list-type: atomic matchLabels: - additionalProperties: - type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - type: object + additionalProperties: + type: string x-kubernetes-map-type: atomic matchLabelKeys: description: |- @@ -6145,9 +5594,10 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array items: type: string - type: array x-kubernetes-list-type: atomic mismatchLabelKeys: description: |- @@ -6159,9 +5609,10 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array items: type: string - type: array x-kubernetes-list-type: atomic namespaceSelector: description: |- @@ -6170,13 +5621,19 @@ spec: and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. + type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator properties: key: description: key is the label key that the selector applies to. @@ -6192,25 +5649,19 @@ spec: the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array items: type: string - type: array x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array x-kubernetes-list-type: atomic matchLabels: - additionalProperties: - type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - type: object + additionalProperties: + type: string x-kubernetes-map-type: atomic namespaces: description: |- @@ -6218,9 +5669,9 @@ spec: The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". + type: array items: type: string - type: array x-kubernetes-list-type: atomic topologyKey: description: |- @@ -6230,20 +5681,12 @@ spec: selected pods is running. Empty topologyKey is not allowed. type: string - required: - - topologyKey - type: object weight: description: |- weight associated with matching the corresponding podAffinityTerm, in the range 1-100. - format: int32 type: integer - required: - - podAffinityTerm - - weight - type: object - type: array + format: int32 x-kubernetes-list-type: atomic requiredDuringSchedulingIgnoredDuringExecution: description: |- @@ -6254,6 +5697,7 @@ spec: system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied. + type: array items: description: |- Defines a set of pods (namely those matching the labelSelector @@ -6262,18 +5706,27 @@ spec: where co-located is defined as running on a node whose value of the label with key matches that of any node on which a pod of the set of pods is running + type: object + required: + - topologyKey properties: labelSelector: description: |- A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods. + type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator properties: key: description: key is the label key that the selector applies to. @@ -6289,25 +5742,19 @@ spec: the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array items: type: string - type: array x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array x-kubernetes-list-type: atomic matchLabels: - additionalProperties: - type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - type: object + additionalProperties: + type: string x-kubernetes-map-type: atomic matchLabelKeys: description: |- @@ -6319,9 +5766,10 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array items: type: string - type: array x-kubernetes-list-type: atomic mismatchLabelKeys: description: |- @@ -6333,9 +5781,10 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array items: type: string - type: array x-kubernetes-list-type: atomic namespaceSelector: description: |- @@ -6344,13 +5793,19 @@ spec: and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. + type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator properties: key: description: key is the label key that the selector applies to. @@ -6366,25 +5821,19 @@ spec: the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array items: type: string - type: array x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array x-kubernetes-list-type: atomic matchLabels: - additionalProperties: - type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - type: object + additionalProperties: + type: string x-kubernetes-map-type: atomic namespaces: description: |- @@ -6392,9 +5841,9 @@ spec: The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". + type: array items: type: string - type: array x-kubernetes-list-type: atomic topologyKey: description: |- @@ -6404,14 +5853,10 @@ spec: selected pods is running. Empty topologyKey is not allowed. type: string - required: - - topologyKey - type: object - type: array x-kubernetes-list-type: atomic - type: object podAntiAffinity: description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)). + type: object properties: preferredDuringSchedulingIgnoredDuringExecution: description: |- @@ -6421,26 +5866,40 @@ spec: most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling anti-affinity expressions, etc.), - compute a sum by iterating through the elements of this field and subtracting - "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. + type: array items: description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) + type: object + required: + - podAffinityTerm + - weight properties: podAffinityTerm: description: Required. A pod affinity term, associated with the corresponding weight. + type: object + required: + - topologyKey properties: labelSelector: description: |- A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods. + type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator properties: key: description: key is the label key that the selector applies to. @@ -6456,25 +5915,19 @@ spec: the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array items: type: string - type: array x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array x-kubernetes-list-type: atomic matchLabels: - additionalProperties: - type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - type: object + additionalProperties: + type: string x-kubernetes-map-type: atomic matchLabelKeys: description: |- @@ -6486,9 +5939,10 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array items: type: string - type: array x-kubernetes-list-type: atomic mismatchLabelKeys: description: |- @@ -6500,9 +5954,10 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array items: type: string - type: array x-kubernetes-list-type: atomic namespaceSelector: description: |- @@ -6511,13 +5966,19 @@ spec: and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. + type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator properties: key: description: key is the label key that the selector applies to. @@ -6533,25 +5994,19 @@ spec: the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array items: type: string - type: array x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array x-kubernetes-list-type: atomic matchLabels: - additionalProperties: - type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - type: object + additionalProperties: + type: string x-kubernetes-map-type: atomic namespaces: description: |- @@ -6559,9 +6014,9 @@ spec: The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". + type: array items: type: string - type: array x-kubernetes-list-type: atomic topologyKey: description: |- @@ -6571,20 +6026,12 @@ spec: selected pods is running. Empty topologyKey is not allowed. type: string - required: - - topologyKey - type: object weight: description: |- weight associated with matching the corresponding podAffinityTerm, in the range 1-100. - format: int32 type: integer - required: - - podAffinityTerm - - weight - type: object - type: array + format: int32 x-kubernetes-list-type: atomic requiredDuringSchedulingIgnoredDuringExecution: description: |- @@ -6595,6 +6042,7 @@ spec: system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied. + type: array items: description: |- Defines a set of pods (namely those matching the labelSelector @@ -6603,18 +6051,27 @@ spec: where co-located is defined as running on a node whose value of the label with key matches that of any node on which a pod of the set of pods is running + type: object + required: + - topologyKey properties: labelSelector: description: |- A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods. + type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator properties: key: description: key is the label key that the selector applies to. @@ -6630,25 +6087,19 @@ spec: the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array items: type: string - type: array x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array x-kubernetes-list-type: atomic matchLabels: - additionalProperties: - type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - type: object + additionalProperties: + type: string x-kubernetes-map-type: atomic matchLabelKeys: description: |- @@ -6660,9 +6111,10 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array items: type: string - type: array x-kubernetes-list-type: atomic mismatchLabelKeys: description: |- @@ -6674,9 +6126,10 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array items: type: string - type: array x-kubernetes-list-type: atomic namespaceSelector: description: |- @@ -6685,13 +6138,19 @@ spec: and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. + type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator properties: key: description: key is the label key that the selector applies to. @@ -6707,25 +6166,19 @@ spec: the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array items: type: string - type: array x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array x-kubernetes-list-type: atomic matchLabels: - additionalProperties: - type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - type: object + additionalProperties: + type: string x-kubernetes-map-type: atomic namespaces: description: |- @@ -6733,9 +6186,9 @@ spec: The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". + type: array items: type: string - type: array x-kubernetes-list-type: atomic topologyKey: description: |- @@ -6745,22 +6198,17 @@ spec: selected pods is running. Empty topologyKey is not allowed. type: string - required: - - topologyKey - type: object - type: array x-kubernetes-list-type: atomic - type: object - type: object imagePullSecrets: description: If specified, the pod's imagePullSecrets + type: array items: description: |- LocalObjectReference contains enough information to let you locate the referenced object inside the same namespace. + type: object properties: name: - default: "" description: |- Name of the referent. This field is effectively required, but due to backwards compatibility is @@ -6768,59 +6216,22 @@ spec: almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string - type: object + default: "" x-kubernetes-map-type: atomic - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map nodeSelector: - additionalProperties: - type: string description: |- NodeSelector is a selector which must be true for the pod to fit on a node. Selector which must match a node's labels for the pod to be scheduled on that node. - More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ - type: object - priorityClassName: - description: If specified, the pod's priorityClassName. - type: string - resources: - description: |- - If specified, the pod's resource requirements. - These values override the global resource configuration flags. - Note that when only specifying resource limits, ensure they are greater than or equal - to the corresponding global resource requests configured via controller flags - (--acme-http01-solver-resource-request-cpu, --acme-http01-solver-resource-request-memory). - Kubernetes will reject pod creation if limits are lower than requests, causing challenge failures. - properties: - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: |- - Limits describes the maximum amount of compute resources allowed. - More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: |- - Requests describes the minimum amount of compute resources required. - If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, - otherwise to the global values configured via controller flags. Requests cannot exceed Limits. - More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ - type: object + More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ type: object + additionalProperties: + type: string + priorityClassName: + description: If specified, the pod's priorityClassName. + type: string securityContext: description: If specified, the pod's security context + type: object properties: fsGroup: description: |- @@ -6834,8 +6245,8 @@ spec: If unset, the Kubelet will not modify the ownership and permissions of any volume. Note that this field cannot be set when spec.os.name is windows. - format: int64 type: integer + format: int64 fsGroupChangePolicy: description: |- fsGroupChangePolicy defines behavior of changing ownership and permission of the volume @@ -6854,8 +6265,8 @@ spec: PodSecurityContext, the value specified in SecurityContext takes precedence for that container. Note that this field cannot be set when spec.os.name is windows. - format: int64 type: integer + format: int64 runAsNonRoot: description: |- Indicates that the container must run as a non-root user. @@ -6873,8 +6284,8 @@ spec: PodSecurityContext, the value specified in SecurityContext takes precedence for that container. Note that this field cannot be set when spec.os.name is windows. - format: int64 type: integer + format: int64 seLinuxOptions: description: |- The SELinux context to be applied to all containers. @@ -6883,6 +6294,7 @@ spec: both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence for that container. Note that this field cannot be set when spec.os.name is windows. + type: object properties: level: description: Level is SELinux level label that applies to the container. @@ -6896,11 +6308,13 @@ spec: user: description: User is a SELinux user label that applies to the container. type: string - type: object seccompProfile: description: |- The seccomp options to use by the containers in this pod. Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type properties: localhostProfile: description: |- @@ -6918,9 +6332,6 @@ spec: RuntimeDefault - the container runtime default profile should be used. Unconfined - no profile should be applied. type: string - required: - - type - type: object supplementalGroups: description: |- A list of groups applied to the first process run in each container, in addition @@ -6930,18 +6341,22 @@ spec: defined in the container image for the uid of the container process are still effective, even if they are not included in this list. Note that this field cannot be set when spec.os.name is windows. + type: array items: - format: int64 type: integer - type: array - x-kubernetes-list-type: atomic + format: int64 sysctls: description: |- Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported sysctls (by the container runtime) might fail to launch. Note that this field cannot be set when spec.os.name is windows. + type: array items: description: Sysctl defines a kernel parameter to be set + type: object + required: + - name + - value properties: name: description: Name of a property to set @@ -6949,22 +6364,17 @@ spec: value: description: Value of a property to set type: string - required: - - name - - value - type: object - type: array - x-kubernetes-list-type: atomic - type: object serviceAccountName: description: If specified, the pod's service account type: string tolerations: description: If specified, the pod's tolerations. + type: array items: description: |- The pod this Toleration is attached to tolerates any taint that matches the triple using the matching operator . + type: object properties: effect: description: |- @@ -6979,10 +6389,9 @@ spec: operator: description: |- Operator represents a key's relationship to the value. - Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. + Valid operators are Exists and Equal. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. - Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). type: string tolerationSeconds: description: |- @@ -6990,30 +6399,25 @@ spec: of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, it is not set, which means tolerate the taint forever (do not evict). Zero and negative values will be treated as 0 (evict immediately) by the system. - format: int64 type: integer + format: int64 value: description: |- Value is the taint value the toleration matches to. If the operator is Exists, the value should be empty, otherwise just a regular string. type: string - type: object - type: array - x-kubernetes-list-type: atomic - type: object - type: object serviceType: description: |- Optional service type for Kubernetes solver service. Supported values are NodePort or ClusterIP. If unset, defaults to NodePort. type: string - type: object ingress: description: |- The ingress based HTTP01 challenge solver will solve challenges by creating or modifying Ingress resources in order to route requests for '/.well-known/acme-challenge/XYZ' to 'challenge solver' pods that are provisioned by cert-manager for each Challenge to be completed. + type: object properties: class: description: |- @@ -7033,6 +6437,7 @@ spec: description: |- Optional ingress template used to configure the ACME challenge solver ingress used for HTTP01 challenges. + type: object properties: metadata: description: |- @@ -7040,19 +6445,18 @@ spec: Only the 'labels' and 'annotations' fields may be set. If labels or annotations overlap with in-built values, the values here will override the in-built values. + type: object properties: annotations: - additionalProperties: - type: string description: Annotations that should be added to the created ACME HTTP01 solver ingress. type: object - labels: additionalProperties: type: string + labels: description: Labels that should be added to the created ACME HTTP01 solver ingress. type: object - type: object - type: object + additionalProperties: + type: string name: description: |- The name of the ingress resource that should have ACME challenge solving @@ -7066,6 +6470,7 @@ spec: description: |- Optional pod template used to configure the ACME challenge solver pods used for HTTP01 challenges. + type: object properties: metadata: description: |- @@ -7073,29 +6478,32 @@ spec: Only the 'labels' and 'annotations' fields may be set. If labels or annotations overlap with in-built values, the values here will override the in-built values. + type: object properties: annotations: - additionalProperties: - type: string description: Annotations that should be added to the created ACME HTTP01 solver pods. type: object - labels: additionalProperties: type: string + labels: description: Labels that should be added to the created ACME HTTP01 solver pods. type: object - type: object + additionalProperties: + type: string spec: description: |- PodSpec defines overrides for the HTTP01 challenge solver pod. Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields. All other fields will be ignored. + type: object properties: affinity: description: If specified, the pod's scheduling constraints + type: object properties: nodeAffinity: description: Describes node affinity scheduling rules for the pod. + type: object properties: preferredDuringSchedulingIgnoredDuringExecution: description: |- @@ -7108,20 +6516,31 @@ spec: compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node matches the corresponding matchExpressions; the node(s) with the highest sum are the most preferred. + type: array items: description: |- An empty preferred scheduling term matches all objects with implicit weight 0 (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). + type: object + required: + - preference + - weight properties: preference: description: A node selector term, associated with the corresponding weight. + type: object properties: matchExpressions: description: A list of node selector requirements by node's labels. + type: array items: description: |- A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator properties: key: description: The label key that the selector applies to. @@ -7138,22 +6557,22 @@ spec: the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. + type: array items: type: string - type: array x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array x-kubernetes-list-type: atomic matchFields: description: A list of node selector requirements by node's fields. + type: array items: description: |- A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator properties: key: description: The label key that the selector applies to. @@ -7170,27 +6589,16 @@ spec: the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. + type: array items: type: string - type: array x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array x-kubernetes-list-type: atomic - type: object x-kubernetes-map-type: atomic weight: description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100. - format: int32 type: integer - required: - - preference - - weight - type: object - type: array + format: int32 x-kubernetes-list-type: atomic requiredDuringSchedulingIgnoredDuringExecution: description: |- @@ -7199,21 +6607,31 @@ spec: If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to an update), the system may or may not try to eventually evict the pod from its node. + type: object + required: + - nodeSelectorTerms properties: nodeSelectorTerms: description: Required. A list of node selector terms. The terms are ORed. + type: array items: description: |- A null or empty node selector term matches no objects. The requirements of them are ANDed. The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. + type: object properties: matchExpressions: description: A list of node selector requirements by node's labels. + type: array items: description: |- A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator properties: key: description: The label key that the selector applies to. @@ -7230,22 +6648,22 @@ spec: the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. + type: array items: type: string - type: array x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array x-kubernetes-list-type: atomic matchFields: description: A list of node selector requirements by node's fields. + type: array items: description: |- A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator properties: key: description: The label key that the selector applies to. @@ -7262,27 +6680,17 @@ spec: the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. + type: array items: type: string - type: array x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array x-kubernetes-list-type: atomic - type: object x-kubernetes-map-type: atomic - type: array x-kubernetes-list-type: atomic - required: - - nodeSelectorTerms - type: object x-kubernetes-map-type: atomic - type: object podAffinity: description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)). + type: object properties: preferredDuringSchedulingIgnoredDuringExecution: description: |- @@ -7295,23 +6703,37 @@ spec: compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. + type: array items: description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) + type: object + required: + - podAffinityTerm + - weight properties: podAffinityTerm: description: Required. A pod affinity term, associated with the corresponding weight. + type: object + required: + - topologyKey properties: labelSelector: description: |- A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods. + type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator properties: key: description: key is the label key that the selector applies to. @@ -7327,25 +6749,19 @@ spec: the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array items: type: string - type: array x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array x-kubernetes-list-type: atomic matchLabels: - additionalProperties: - type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - type: object + additionalProperties: + type: string x-kubernetes-map-type: atomic matchLabelKeys: description: |- @@ -7357,9 +6773,10 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array items: type: string - type: array x-kubernetes-list-type: atomic mismatchLabelKeys: description: |- @@ -7371,9 +6788,10 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array items: type: string - type: array x-kubernetes-list-type: atomic namespaceSelector: description: |- @@ -7382,13 +6800,19 @@ spec: and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. + type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator properties: key: description: key is the label key that the selector applies to. @@ -7404,25 +6828,19 @@ spec: the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array items: type: string - type: array x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array x-kubernetes-list-type: atomic matchLabels: - additionalProperties: - type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - type: object + additionalProperties: + type: string x-kubernetes-map-type: atomic namespaces: description: |- @@ -7430,9 +6848,9 @@ spec: The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". + type: array items: type: string - type: array x-kubernetes-list-type: atomic topologyKey: description: |- @@ -7442,20 +6860,12 @@ spec: selected pods is running. Empty topologyKey is not allowed. type: string - required: - - topologyKey - type: object weight: description: |- weight associated with matching the corresponding podAffinityTerm, in the range 1-100. - format: int32 type: integer - required: - - podAffinityTerm - - weight - type: object - type: array + format: int32 x-kubernetes-list-type: atomic requiredDuringSchedulingIgnoredDuringExecution: description: |- @@ -7466,6 +6876,7 @@ spec: system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied. + type: array items: description: |- Defines a set of pods (namely those matching the labelSelector @@ -7474,18 +6885,27 @@ spec: where co-located is defined as running on a node whose value of the label with key matches that of any node on which a pod of the set of pods is running + type: object + required: + - topologyKey properties: labelSelector: description: |- A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods. + type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator properties: key: description: key is the label key that the selector applies to. @@ -7501,25 +6921,19 @@ spec: the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array items: type: string - type: array x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array x-kubernetes-list-type: atomic matchLabels: - additionalProperties: - type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - type: object + additionalProperties: + type: string x-kubernetes-map-type: atomic matchLabelKeys: description: |- @@ -7531,9 +6945,10 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array items: type: string - type: array x-kubernetes-list-type: atomic mismatchLabelKeys: description: |- @@ -7545,9 +6960,10 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array items: type: string - type: array x-kubernetes-list-type: atomic namespaceSelector: description: |- @@ -7556,13 +6972,19 @@ spec: and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. + type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator properties: key: description: key is the label key that the selector applies to. @@ -7578,25 +7000,19 @@ spec: the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array items: type: string - type: array x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array x-kubernetes-list-type: atomic matchLabels: - additionalProperties: - type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - type: object + additionalProperties: + type: string x-kubernetes-map-type: atomic namespaces: description: |- @@ -7604,9 +7020,9 @@ spec: The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". + type: array items: type: string - type: array x-kubernetes-list-type: atomic topologyKey: description: |- @@ -7616,14 +7032,10 @@ spec: selected pods is running. Empty topologyKey is not allowed. type: string - required: - - topologyKey - type: object - type: array x-kubernetes-list-type: atomic - type: object podAntiAffinity: description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)). + type: object properties: preferredDuringSchedulingIgnoredDuringExecution: description: |- @@ -7633,26 +7045,40 @@ spec: most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling anti-affinity expressions, etc.), - compute a sum by iterating through the elements of this field and subtracting - "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. + type: array items: description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) + type: object + required: + - podAffinityTerm + - weight properties: podAffinityTerm: description: Required. A pod affinity term, associated with the corresponding weight. + type: object + required: + - topologyKey properties: labelSelector: description: |- A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods. + type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator properties: key: description: key is the label key that the selector applies to. @@ -7668,25 +7094,19 @@ spec: the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array items: type: string - type: array x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array x-kubernetes-list-type: atomic matchLabels: - additionalProperties: - type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - type: object + additionalProperties: + type: string x-kubernetes-map-type: atomic matchLabelKeys: description: |- @@ -7698,9 +7118,10 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array items: type: string - type: array x-kubernetes-list-type: atomic mismatchLabelKeys: description: |- @@ -7712,9 +7133,10 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array items: type: string - type: array x-kubernetes-list-type: atomic namespaceSelector: description: |- @@ -7723,13 +7145,19 @@ spec: and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. + type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator properties: key: description: key is the label key that the selector applies to. @@ -7745,25 +7173,19 @@ spec: the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array items: type: string - type: array x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array x-kubernetes-list-type: atomic matchLabels: - additionalProperties: - type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - type: object + additionalProperties: + type: string x-kubernetes-map-type: atomic namespaces: description: |- @@ -7771,9 +7193,9 @@ spec: The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". + type: array items: type: string - type: array x-kubernetes-list-type: atomic topologyKey: description: |- @@ -7783,20 +7205,12 @@ spec: selected pods is running. Empty topologyKey is not allowed. type: string - required: - - topologyKey - type: object weight: description: |- weight associated with matching the corresponding podAffinityTerm, in the range 1-100. - format: int32 type: integer - required: - - podAffinityTerm - - weight - type: object - type: array + format: int32 x-kubernetes-list-type: atomic requiredDuringSchedulingIgnoredDuringExecution: description: |- @@ -7807,6 +7221,7 @@ spec: system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied. + type: array items: description: |- Defines a set of pods (namely those matching the labelSelector @@ -7815,18 +7230,27 @@ spec: where co-located is defined as running on a node whose value of the label with key matches that of any node on which a pod of the set of pods is running + type: object + required: + - topologyKey properties: labelSelector: description: |- A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods. + type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator properties: key: description: key is the label key that the selector applies to. @@ -7842,25 +7266,19 @@ spec: the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array items: type: string - type: array x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array x-kubernetes-list-type: atomic matchLabels: - additionalProperties: - type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - type: object + additionalProperties: + type: string x-kubernetes-map-type: atomic matchLabelKeys: description: |- @@ -7872,9 +7290,10 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array items: type: string - type: array x-kubernetes-list-type: atomic mismatchLabelKeys: description: |- @@ -7886,9 +7305,10 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array items: type: string - type: array x-kubernetes-list-type: atomic namespaceSelector: description: |- @@ -7897,13 +7317,19 @@ spec: and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. + type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator properties: key: description: key is the label key that the selector applies to. @@ -7919,25 +7345,19 @@ spec: the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array items: type: string - type: array x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array x-kubernetes-list-type: atomic matchLabels: - additionalProperties: - type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - type: object + additionalProperties: + type: string x-kubernetes-map-type: atomic namespaces: description: |- @@ -7945,9 +7365,9 @@ spec: The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". + type: array items: type: string - type: array x-kubernetes-list-type: atomic topologyKey: description: |- @@ -7957,22 +7377,17 @@ spec: selected pods is running. Empty topologyKey is not allowed. type: string - required: - - topologyKey - type: object - type: array x-kubernetes-list-type: atomic - type: object - type: object imagePullSecrets: description: If specified, the pod's imagePullSecrets + type: array items: description: |- LocalObjectReference contains enough information to let you locate the referenced object inside the same namespace. + type: object properties: name: - default: "" description: |- Name of the referent. This field is effectively required, but due to backwards compatibility is @@ -7980,59 +7395,22 @@ spec: almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string - type: object + default: "" x-kubernetes-map-type: atomic - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map nodeSelector: - additionalProperties: - type: string description: |- NodeSelector is a selector which must be true for the pod to fit on a node. Selector which must match a node's labels for the pod to be scheduled on that node. More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ type: object + additionalProperties: + type: string priorityClassName: description: If specified, the pod's priorityClassName. type: string - resources: - description: |- - If specified, the pod's resource requirements. - These values override the global resource configuration flags. - Note that when only specifying resource limits, ensure they are greater than or equal - to the corresponding global resource requests configured via controller flags - (--acme-http01-solver-resource-request-cpu, --acme-http01-solver-resource-request-memory). - Kubernetes will reject pod creation if limits are lower than requests, causing challenge failures. - properties: - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: |- - Limits describes the maximum amount of compute resources allowed. - More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: |- - Requests describes the minimum amount of compute resources required. - If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, - otherwise to the global values configured via controller flags. Requests cannot exceed Limits. - More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ - type: object - type: object securityContext: description: If specified, the pod's security context + type: object properties: fsGroup: description: |- @@ -8046,8 +7424,8 @@ spec: If unset, the Kubelet will not modify the ownership and permissions of any volume. Note that this field cannot be set when spec.os.name is windows. - format: int64 type: integer + format: int64 fsGroupChangePolicy: description: |- fsGroupChangePolicy defines behavior of changing ownership and permission of the volume @@ -8066,8 +7444,8 @@ spec: PodSecurityContext, the value specified in SecurityContext takes precedence for that container. Note that this field cannot be set when spec.os.name is windows. - format: int64 type: integer + format: int64 runAsNonRoot: description: |- Indicates that the container must run as a non-root user. @@ -8085,8 +7463,8 @@ spec: PodSecurityContext, the value specified in SecurityContext takes precedence for that container. Note that this field cannot be set when spec.os.name is windows. - format: int64 type: integer + format: int64 seLinuxOptions: description: |- The SELinux context to be applied to all containers. @@ -8095,6 +7473,7 @@ spec: both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence for that container. Note that this field cannot be set when spec.os.name is windows. + type: object properties: level: description: Level is SELinux level label that applies to the container. @@ -8108,11 +7487,13 @@ spec: user: description: User is a SELinux user label that applies to the container. type: string - type: object seccompProfile: description: |- The seccomp options to use by the containers in this pod. Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type properties: localhostProfile: description: |- @@ -8130,9 +7511,6 @@ spec: RuntimeDefault - the container runtime default profile should be used. Unconfined - no profile should be applied. type: string - required: - - type - type: object supplementalGroups: description: |- A list of groups applied to the first process run in each container, in addition @@ -8142,18 +7520,22 @@ spec: defined in the container image for the uid of the container process are still effective, even if they are not included in this list. Note that this field cannot be set when spec.os.name is windows. + type: array items: - format: int64 type: integer - type: array - x-kubernetes-list-type: atomic + format: int64 sysctls: description: |- Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported sysctls (by the container runtime) might fail to launch. Note that this field cannot be set when spec.os.name is windows. + type: array items: description: Sysctl defines a kernel parameter to be set + type: object + required: + - name + - value properties: name: description: Name of a property to set @@ -8161,22 +7543,17 @@ spec: value: description: Value of a property to set type: string - required: - - name - - value - type: object - type: array - x-kubernetes-list-type: atomic - type: object serviceAccountName: description: If specified, the pod's service account type: string tolerations: description: If specified, the pod's tolerations. + type: array items: description: |- The pod this Toleration is attached to tolerates any taint that matches the triple using the matching operator . + type: object properties: effect: description: |- @@ -8191,10 +7568,9 @@ spec: operator: description: |- Operator represents a key's relationship to the value. - Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. + Valid operators are Exists and Equal. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. - Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). type: string tolerationSeconds: description: |- @@ -8202,25 +7578,18 @@ spec: of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, it is not set, which means tolerate the taint forever (do not evict). Zero and negative values will be treated as 0 (evict immediately) by the system. - format: int64 type: integer + format: int64 value: description: |- Value is the taint value the toleration matches to. If the operator is Exists, the value should be empty, otherwise just a regular string. type: string - type: object - type: array - x-kubernetes-list-type: atomic - type: object - type: object serviceType: description: |- Optional service type for Kubernetes solver service. Supported values are NodePort or ClusterIP. If unset, defaults to NodePort. type: string - type: object - type: object selector: description: |- Selector selects a set of DNSNames on the Certificate resource that @@ -8228,6 +7597,7 @@ spec: If not specified, the solver will be treated as the 'default' solver with the lowest priority, i.e. if any other solver has a more specific match, it will be used instead. + type: object properties: dnsNames: description: |- @@ -8238,10 +7608,9 @@ spec: with the most matching labels in matchLabels will be selected. If neither has more matches, the solver defined earlier in the list will be selected. + type: array items: type: string - type: array - x-kubernetes-list-type: atomic dnsZones: description: |- List of DNSZones that this solver will be used to solve. @@ -8253,67 +7622,41 @@ spec: with the most matching labels in matchLabels will be selected. If neither has more matches, the solver defined earlier in the list will be selected. + type: array items: type: string - type: array - x-kubernetes-list-type: atomic matchLabels: - additionalProperties: - type: string description: |- A label selector that is used to refine the set of certificate's that this challenge solver will apply to. type: object - type: object - waitInsteadOfSelfCheck: - description: |- - WaitInsteadOfSelfCheck, if set, skips cert-manager's self-check and - instead waits this long after presentation before asking the ACME server - to validate the challenge. - - This is an advanced escape hatch for environments where cert-manager's - self-check cannot succeed from its own network or DNS viewpoint even - though the ACME server can still validate successfully, for example due - to split-horizon DNS or NAT hairpinning. - - A value of 0 skips the self-check and asks the ACME server to validate - immediately after presentation, relying on the ACME server's own - validation retries (RFC 8555 section 8.2) to succeed once the challenge - has propagated. A negative duration is rejected. - Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration, - for example `30s` or `2m`. - type: string - type: object - type: array - x-kubernetes-list-type: atomic - required: - - privateKeySecretRef - - server - type: object + additionalProperties: + type: string ca: description: |- CA configures this issuer to sign certificates using a signing CA keypair stored in a Secret resource. This is used to build internal PKIs that are managed by cert-manager. + type: object + required: + - secretName properties: crlDistributionPoints: description: |- The CRL distribution points is an X.509 v3 certificate extension which identifies the location of the CRL from which the revocation of this certificate can be checked. If not set, certificates will be issued without distribution points set. + type: array items: type: string - type: array - x-kubernetes-list-type: atomic issuingCertificateURLs: description: |- IssuingCertificateURLs is a list of URLs which this issuer should embed into certificates it creates. See https://www.rfc-editor.org/rfc/rfc5280#section-4.2.2.1 for more details. As an example, such a URL might be "http://ca.domain.com/ca.crt". + type: array items: type: string - type: array - x-kubernetes-list-type: atomic ocspServers: description: |- The OCSP server list is an X.509 v3 extension that defines a list of @@ -8321,45 +7664,51 @@ spec: revocation status of an issued certificate. If not set, the certificate will be issued with no OCSP servers set. For example, an OCSP server URL could be "http://ocsp.int-x3.letsencrypt.org". + type: array items: type: string - type: array - x-kubernetes-list-type: atomic secretName: description: |- SecretName is the name of the secret used to sign Certificates issued by this Issuer. type: string - required: - - secretName - type: object selfSigned: description: |- SelfSigned configures this issuer to 'self sign' certificates using the private key used to create the CertificateRequest object. + type: object properties: crlDistributionPoints: description: |- The CRL distribution points is an X.509 v3 certificate extension which identifies the location of the CRL from which the revocation of this certificate can be checked. If not set certificate will be issued without CDP. Values are strings. + type: array items: type: string - type: array - x-kubernetes-list-type: atomic - type: object vault: description: |- Vault configures this issuer to sign certificates using a HashiCorp Vault PKI backend. + type: object + required: + - auth + - path + - server properties: auth: description: Auth configures how cert-manager authenticates with the Vault server. + type: object properties: appRole: description: |- AppRole authenticates with Vault using the App Role auth mechanism, with the role and secret stored in a Kubernetes Secret resource. + type: object + required: + - path + - roleId + - secretRef properties: path: description: |- @@ -8377,87 +7726,27 @@ spec: to authenticate with Vault. The `key` field must be specified and denotes which entry within the Secret resource is used as the app role secret. - properties: - key: - description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. - type: string - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string + type: object required: - name - type: object - required: - - path - - roleId - - secretRef - type: object - aws: - description: |- - AWS authenticates with Vault using AWS IAM authentication. - This allows authentication using IAM roles for service accounts (IRSA), - EKS Pod Identity (PIA), or ambient credentials (EC2 instance profiles, ECS task role). - properties: - iamRoleArn: - description: |- - The ARN of the AWS IAM role to assume using the Kubernetes service account - token. Required when using IRSA (serviceAccountRef is set). - This role must have a trust policy that allows the OIDC provider to assume it. - type: string - mountPath: - description: |- - The Vault mountPath here is the mount path to use when authenticating with - Vault. For example, setting a value to `/v1/auth/foo`, will use the path - `/v1/auth/foo/login` to authenticate with Vault. If unspecified, the - default value "/v1/auth/aws" will be used. - type: string - region: - description: |- - The AWS region to use for authentication. If not specified, the region - will be determined from AWS_REGION or AWS_DEFAULT_REGION environment - variables, falling back to "us-east-1" if not set. - type: string - role: - description: A required field containing the Vault Role to assume when authenticating. - minLength: 1 - type: string - serviceAccountRef: - description: |- - A reference to a service account that will be used to request a web identity - token for IRSA (IAM Roles for Service Accounts) authentication. properties: - audiences: + key: description: |- - TokenAudiences is an optional list of extra audiences to include in the token passed to Vault. - The default audiences are always included in the token. - items: - type: string - type: array - x-kubernetes-list-type: atomic + The key of the entry in the Secret resource's `data` field to be used. + Some instances of this field may be defaulted, in others it may be + required. + type: string name: - description: Name of the ServiceAccount used to request a token. + description: |- + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string - required: - - name - type: object - vaultHeaderValue: - description: |- - The Vault header value to include in the STS signing request. - This is used to prevent replay attacks. - type: string - required: - - role - type: object clientCertificate: description: |- ClientCertificate authenticates with Vault by presenting a client certificate during the request's TLS handshake. Works only when using HTTPS protocol. + type: object properties: mountPath: description: |- @@ -8477,11 +7766,13 @@ spec: tls.crt and tls.key) used to authenticate to Vault using TLS client authentication. type: string - type: object kubernetes: description: |- Kubernetes authenticates with Vault by passing the ServiceAccount token stored in the named Secret resource to the Vault server. + type: object + required: + - role properties: mountPath: description: |- @@ -8500,6 +7791,9 @@ spec: The required Secret field containing a Kubernetes ServiceAccount JWT used for authenticating with Vault. Use of 'ambient credentials' is not supported. + type: object + required: + - name properties: key: description: |- @@ -8512,9 +7806,6 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string - required: - - name - type: object serviceAccountRef: description: |- A reference to a service account that will be used to request a bound @@ -8522,26 +7813,25 @@ spec: using this field means that you don't rely on statically bound tokens. To use this field, you must configure an RBAC rule to let cert-manager request a token. + type: object + required: + - name properties: audiences: description: |- - TokenAudiences is an optional list of extra audiences to include in the token passed to Vault. - The default audiences are always included in the token. + TokenAudiences is an optional list of extra audiences to include in the token passed to Vault. The default token + consisting of the issuer's namespace and name is always included. + type: array items: type: string - type: array - x-kubernetes-list-type: atomic name: description: Name of the ServiceAccount used to request a token. type: string - required: - - name - type: object - required: - - role - type: object tokenSecretRef: description: TokenSecretRef authenticates with Vault by presenting a token. + type: object + required: + - name properties: key: description: |- @@ -8554,10 +7844,6 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string - required: - - name - type: object - type: object caBundle: description: |- Base64-encoded bundle of PEM CAs which will be used to validate the certificate @@ -8566,8 +7852,8 @@ spec: Mutually exclusive with CABundleSecretRef. If neither CABundle nor CABundleSecretRef are defined, the certificate bundle in the cert-manager controller container is used to validate the TLS connection. - format: byte type: string + format: byte caBundleSecretRef: description: |- Reference to a Secret containing a bundle of PEM-encoded CAs to use when @@ -8576,6 +7862,9 @@ spec: If neither CABundle nor CABundleSecretRef are defined, the certificate bundle in the cert-manager controller container is used to validate the TLS connection. If no key for the Secret is specified, cert-manager will default to 'ca.crt'. + type: object + required: + - name properties: key: description: |- @@ -8588,13 +7877,13 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string - required: - - name - type: object clientCertSecretRef: description: |- Reference to a Secret containing a PEM-encoded Client Certificate to use when the Vault server requires mTLS. + type: object + required: + - name properties: key: description: |- @@ -8607,13 +7896,13 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string - required: - - name - type: object clientKeySecretRef: description: |- Reference to a Secret containing a PEM-encoded Client Private Key to use when the Vault server requires mTLS. + type: object + required: + - name properties: key: description: |- @@ -8626,9 +7915,6 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string - required: - - name - type: object namespace: description: |- Name of the vault namespace. Namespaces is a set of features within Vault Enterprise that allows Vault environments to support Secure Multi-tenancy. e.g: "ns1" @@ -8642,28 +7928,27 @@ spec: server: description: 'Server is the connection address for the Vault server, e.g: "https://vault.example.com:8200".' type: string - serverName: - description: |- - ServerName is used to verify the hostname on the returned certificates - by the Vault server. - type: string - required: - - auth - - path - - server - type: object venafi: description: |- - Venafi configures this issuer to sign certificates using a CyberArk Certificate Manager Self-Hosted - or SaaS policy zone. + Venafi configures this issuer to sign certificates using a Venafi TPP + or Venafi Cloud policy zone. + type: object + required: + - zone properties: cloud: description: |- - Cloud specifies the CyberArk Certificate Manager SaaS configuration settings. - Only one of CyberArk Certificate Manager may be specified. + Cloud specifies the Venafi cloud configuration settings. + Only one of TPP or Cloud may be specified. + type: object + required: + - apiTokenSecretRef properties: apiTokenSecretRef: - description: APITokenSecretRef is a secret key selector for the CyberArk Certificate Manager SaaS API token. + description: APITokenSecretRef is a secret key selector for the Venafi Cloud API token. + type: object + required: + - name properties: key: description: |- @@ -8676,77 +7961,38 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string - required: - - name - type: object url: description: |- - URL is the base URL for CyberArk Certificate Manager SaaS. - Defaults to "https://api.venafi.cloud/". + URL is the base URL for Venafi Cloud. + Defaults to "https://api.venafi.cloud/v1". type: string - required: - - apiTokenSecretRef - type: object - ngts: + tpp: description: |- - NGTS specifies Palo Alto Networks Next Generation Trust Services (NGTS) configuration - using OAuth 2.0 Client Credentials. Only one of tpp, cloud, or ngts may be specified. - properties: - credentialsRef: - description: |- - CredentialsRef is a reference to a Kubernetes Secret containing the OAuth 2.0 - Client ID and Client Secret. The secret must contain the keys 'client-id' and - 'client-secret'. - properties: - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - required: - - name - type: object - tokenEndpoint: - description: |- - TokenEndpoint is the OAuth 2.0 token endpoint URL used to obtain access tokens, - for example "https://auth.apps.paloaltonetworks.com/oauth2/access_token". - Defaults to "https://auth.apps.paloaltonetworks.com/oauth2/access_token" if not set. - type: string - tsgID: - description: |- - TSGID is the Tenant Service Group ID used to scope the OAuth 2.0 access token, - for example "1234567890". The tsg_id: prefix is added automatically. - This field is required. - type: string - url: - description: |- - URL is the base URL for the NGTS API endpoint. - Defaults to "https://api.strata.paloaltonetworks.com/ngts" if not set. - type: string + TPP specifies Trust Protection Platform configuration settings. + Only one of TPP or Cloud may be specified. + type: object required: - credentialsRef - - tsgID - type: object - tpp: - description: |- - TPP specifies CyberArk Certificate Manager Self-Hosted configuration settings. - Only one of CyberArk Certificate Manager may be specified. + - url properties: caBundle: description: |- Base64-encoded bundle of PEM CAs which will be used to validate the certificate - chain presented by the CyberArk Certificate Manager Self-Hosted server. Only used if using HTTPS; ignored for HTTP. + chain presented by the TPP server. Only used if using HTTPS; ignored for HTTP. If undefined, the certificate bundle in the cert-manager controller container is used to validate the chain. - format: byte type: string + format: byte caBundleSecretRef: description: |- Reference to a Secret containing a base64-encoded bundle of PEM CAs - which will be used to validate the certificate chain presented by the CyberArk Certificate Manager Self-Hosted server. + which will be used to validate the certificate chain presented by the TPP server. Only used if using HTTPS; ignored for HTTP. Mutually exclusive with CABundle. If neither CABundle nor CABundleSecretRef is defined, the certificate bundle in the cert-manager controller container is used to validate the TLS connection. + type: object + required: + - name properties: key: description: |- @@ -8759,54 +8005,42 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string - required: - - name - type: object credentialsRef: description: |- - CredentialsRef is a reference to a Secret containing the CyberArk Certificate Manager Self-Hosted API credentials. + CredentialsRef is a reference to a Secret containing the Venafi TPP API credentials. The secret must contain the key 'access-token' for the Access Token Authentication, or two keys, 'username' and 'password' for the API Keys Authentication. + type: object + required: + - name properties: name: description: |- Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string - required: - - name - type: object url: description: |- - URL is the base URL for the vedsdk endpoint of the CyberArk Certificate Manager Self-Hosted instance, + URL is the base URL for the vedsdk endpoint of the Venafi TPP instance, for example: "https://tpp.example.com/vedsdk". type: string - required: - - credentialsRef - - url - type: object zone: description: |- - Zone is the Certificate Manager Policy Zone to use for this issuer. - All requests made to the Certificate Manager platform will be restricted by the named + Zone is the Venafi Policy Zone to use for this issuer. + All requests made to the Venafi platform will be restricted by the named zone policy. This field is required. type: string - required: - - zone - type: object - x-kubernetes-validations: - - message: exactly one of tpp, cloud, or ngts must be configured - rule: '(has(self.tpp) ? 1 : 0) + (has(self.cloud) ? 1 : 0) + (has(self.ngts) ? 1 : 0) == 1' - type: object status: description: Status of the ClusterIssuer. This is set and managed automatically. + type: object properties: acme: description: |- ACME specific status options. This field should only be set if the Issuer is configured to use an ACME server to issue certificates. + type: object properties: lastPrivateKeyHash: description: |- @@ -8825,20 +8059,24 @@ spec: URI is the unique account identifier, which can also be used to retrieve account details from the CA type: string - type: object conditions: description: |- List of status conditions to indicate the status of a CertificateRequest. Known condition types are `Ready`. + type: array items: description: IssuerCondition contains condition information for an Issuer. + type: object + required: + - status + - type properties: lastTransitionTime: description: |- LastTransitionTime is the timestamp corresponding to the last status change of this condition. - format: date-time type: string + format: date-time message: description: |- Message is a human readable description of the details of the last @@ -8851,8 +8089,8 @@ spec: For instance, if .metadata.generation is currently 12, but the .status.condition[x].observedGeneration is 9, the condition is out of date with respect to the current state of the Issuer. - format: int64 type: integer + format: int64 reason: description: |- Reason is a brief machine readable explanation for the condition's last @@ -8860,73 +8098,67 @@ spec: type: string status: description: Status of the condition, one of (`True`, `False`, `Unknown`). + type: string enum: - "True" - "False" - Unknown - type: string type: description: Type of the condition, known values are (`Ready`). type: string - required: - - status - - type - type: object - type: array x-kubernetes-list-map-keys: - type x-kubernetes-list-type: map - type: object - required: - - spec - type: object served: true storage: true - subresources: - status: {} +# END crd --- -# Source: cert-manager/templates/crd-cert-manager.io_issuers.yaml +# Source: cert-manager/templates/crds.yaml +# START crd apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: - name: "issuers.cert-manager.io" + name: issuers.cert-manager.io + # START annotations annotations: helm.sh/resource-policy: keep + # END annotations labels: - app: "cert-manager" - app.kubernetes.io/name: "cert-manager" - app.kubernetes.io/instance: "cert-manager" + app: 'cert-manager' + app.kubernetes.io/name: 'cert-manager' + app.kubernetes.io/instance: 'cert-manager' app.kubernetes.io/component: "crds" - app.kubernetes.io/version: "v1.21.1" + # Generated labels + app.kubernetes.io/version: "v1.17.0" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 + helm.sh/chart: cert-manager-v1.17.0 spec: group: cert-manager.io names: - categories: - - cert-manager kind: Issuer listKind: IssuerList plural: issuers - shortNames: - - iss singular: issuer + categories: + - cert-manager scope: Namespaced versions: - - additionalPrinterColumns: - - jsonPath: .status.conditions[?(@.type == "Ready")].status + - name: v1 + subresources: + status: {} + additionalPrinterColumns: + - jsonPath: .status.conditions[?(@.type=="Ready")].status name: Ready type: string - - jsonPath: .status.conditions[?(@.type == "Ready")].message + - jsonPath: .status.conditions[?(@.type=="Ready")].message name: Status priority: 1 type: string - - description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. - jsonPath: .metadata.creationTimestamp + - jsonPath: .metadata.creationTimestamp + description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. name: Age type: date - name: v1 schema: openAPIV3Schema: description: |- @@ -8934,6 +8166,9 @@ spec: referenced as part of `issuerRef` fields. It is scoped to a single namespace and can therefore only be referenced by resources within the same namespace. + type: object + required: + - spec properties: apiVersion: description: |- @@ -8954,11 +8189,16 @@ spec: type: object spec: description: Desired state of the Issuer resource. + type: object properties: acme: description: |- ACME configures this issuer to communicate with a RFC8555 (ACME) server to obtain signed x509 certificates. + type: object + required: + - privateKeySecretRef + - server properties: caBundle: description: |- @@ -8968,8 +8208,8 @@ spec: kinds of security vulnerabilities. If CABundle and SkipTLSVerify are unset, the system certificate bundle inside the container is used to validate the TLS connection. - format: byte type: string + format: byte disableAccountKeyGeneration: description: |- Enables or disables generating a new ACME account key. @@ -9001,17 +8241,21 @@ spec: server. If set, upon registration cert-manager will attempt to associate the given external account credentials with the registered ACME account. + type: object + required: + - keyID + - keySecretRef properties: keyAlgorithm: description: |- Deprecated: keyAlgorithm field exists for historical compatibility reasons and should not be used. The algorithm is now hardcoded to HS256 in golang/x/crypto/acme. + type: string enum: - HS256 - HS384 - HS512 - type: string keyID: description: keyID is the ID of the CA key that the External Account is bound to. type: string @@ -9024,6 +8268,9 @@ spec: the External Account Binding keyID above. The secret key stored in the Secret **must** be un-padded, base64 URL encoded data. + type: object + required: + - name properties: key: description: |- @@ -9036,25 +8283,18 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string - required: - - name - type: object - required: - - keyID - - keySecretRef - type: object preferredChain: description: |- PreferredChain is the chain to use if the ACME server outputs multiple. PreferredChain is no guarantee that this one gets delivered by the ACME endpoint. - For example, for Let's Encrypt's DST cross-sign you would use: + For example, for Let's Encrypt's DST crosssign you would use: "DST Root CA X3" or "ISRG Root X1" for the newer Let's Encrypt root CA. This value picks the first certificate bundle in the combined set of ACME default and alternative chains that has a root-most certificate with this value as its issuer's commonname. - maxLength: 64 type: string + maxLength: 64 privateKeySecretRef: description: |- PrivateKey is the name of a Kubernetes Secret resource that will be used to @@ -9062,6 +8302,9 @@ spec: Optionally, a `key` may be specified to select a specific entry within the named Secret resource. If `key` is not specified, a default of `tls.key` will be used. + type: object + required: + - name properties: key: description: |- @@ -9074,14 +8317,6 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string - required: - - name - type: object - profile: - description: |- - Profile allows requesting a certificate profile from the ACME server. - Supported profiles are listed by the server's ACME directory URL. - type: string server: description: |- Server is the URL used to access the ACME server's 'directory' endpoint. @@ -9108,26 +8343,36 @@ spec: Solver configurations must be provided in order to obtain certificates from an ACME server. For more information, see: https://cert-manager.io/docs/configuration/acme/ + type: array items: description: |- An ACMEChallengeSolver describes how to solve ACME challenges for the issuer it is part of. A selector may be provided to use different solving strategies for different DNS names. Only one of HTTP01 or DNS01 must be provided. + type: object properties: dns01: description: |- Configures cert-manager to attempt to complete authorizations by performing the DNS01 challenge flow. + type: object properties: acmeDNS: description: |- Use the 'ACME DNS' (https://github.com/joohoi/acme-dns) API to manage DNS01 challenge records. + type: object + required: + - accountSecretRef + - host properties: accountSecretRef: description: |- A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + type: object + required: + - name properties: key: description: |- @@ -9140,22 +8385,24 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string - required: - - name - type: object host: type: string - required: - - accountSecretRef - - host - type: object akamai: description: Use the Akamai DNS zone management API to manage DNS01 challenge records. + type: object + required: + - accessTokenSecretRef + - clientSecretSecretRef + - clientTokenSecretRef + - serviceConsumerDomain properties: accessTokenSecretRef: description: |- A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + type: object + required: + - name properties: key: description: |- @@ -9168,13 +8415,13 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string - required: - - name - type: object clientSecretSecretRef: description: |- A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + type: object + required: + - name properties: key: description: |- @@ -9187,13 +8434,13 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string - required: - - name - type: object clientTokenSecretRef: description: |- A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + type: object + required: + - name properties: key: description: |- @@ -9206,19 +8453,14 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string - required: - - name - type: object serviceConsumerDomain: type: string - required: - - accessTokenSecretRef - - clientSecretSecretRef - - clientTokenSecretRef - - serviceConsumerDomain - type: object azureDNS: description: Use the Microsoft Azure DNS API to manage DNS01 challenge records. + type: object + required: + - resourceGroupName + - subscriptionID properties: clientID: description: |- @@ -9231,6 +8473,9 @@ spec: Auth: Azure Service Principal: A reference to a Secret containing the password associated with the Service Principal. If set, ClientID and TenantID must also be set. + type: object + required: + - name properties: key: description: |- @@ -9243,17 +8488,14 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string - required: - - name - type: object environment: description: name of the Azure environment (default AzurePublicCloud) + type: string enum: - AzurePublicCloud - AzureChinaCloud - AzureGermanCloud - AzureUSGovernmentCloud - type: string hostedZoneName: description: name of the DNS zone that should be used type: string @@ -9262,19 +8504,19 @@ spec: Auth: Azure Workload Identity or Azure Managed Service Identity: Settings to enable Azure Workload Identity or Azure Managed Service Identity If set, ClientID, ClientSecret and TenantID must not be set. + type: object properties: clientID: - description: client ID of the managed identity, cannot be used at the same time as resourceID + description: client ID of the managed identity, can not be used at the same time as resourceID type: string resourceID: description: |- - resource ID of the managed identity, cannot be used at the same time as clientID + resource ID of the managed identity, can not be used at the same time as clientID Cannot be used for Azure Managed Service Identity type: string tenantID: - description: tenant ID of the managed identity, cannot be used at the same time as resourceID + description: tenant ID of the managed identity, can not be used at the same time as resourceID type: string - type: object resourceGroupName: description: resource group the DNS zone is located in type: string @@ -9287,28 +8529,11 @@ spec: The TenantID of the Azure Service Principal used to authenticate with Azure DNS. If set, ClientID and ClientSecret must also be set. type: string - zoneType: - description: |- - ZoneType determines which type of Azure DNS zone to use. - - Valid values are: - - AzurePublicZone (default): Use a public Azure DNS zone. - - AzurePrivateZone: Use an Azure Private DNS zone. - - If not specified, AzurePublicZone is used. - - Support for Azure Private DNS zones is currently - experimental and may change in future releases. - enum: - - AzurePublicZone - - AzurePrivateZone - type: string - required: - - resourceGroupName - - subscriptionID - type: object cloudDNS: description: Use the Google Cloud DNS API to manage DNS01 challenge records. + type: object + required: + - project properties: hostedZoneName: description: |- @@ -9322,6 +8547,9 @@ spec: description: |- A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + type: object + required: + - name properties: key: description: |- @@ -9334,20 +8562,18 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string - required: - - name - type: object - required: - - project - type: object cloudflare: description: Use the Cloudflare API to manage DNS01 challenge records. + type: object properties: apiKeySecretRef: description: |- API key to use to authenticate with Cloudflare. Note: using an API token to authenticate is now the recommended method as it allows greater control of permissions. + type: object + required: + - name properties: key: description: |- @@ -9360,11 +8586,11 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string - required: - - name - type: object apiTokenSecretRef: description: API token used to authenticate with Cloudflare. + type: object + required: + - name properties: key: description: |- @@ -9377,28 +8603,30 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string - required: - - name - type: object email: description: Email of the account, only required when using API key based authentication. type: string - type: object cnameStrategy: description: |- CNAMEStrategy configures how the DNS01 provider should handle CNAME records when found in DNS zones. + type: string enum: - None - Follow - type: string digitalocean: description: Use the DigitalOcean DNS API to manage DNS01 challenge records. + type: object + required: + - tokenSecretRef properties: tokenSecretRef: description: |- A reference to a specific 'key' within a Secret resource. In some instances, `key` is a required field. + type: object + required: + - name properties: key: description: |- @@ -9411,30 +8639,21 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string - required: - - name - type: object - required: - - tokenSecretRef - type: object rfc2136: description: |- Use RFC2136 ("Dynamic Updates in the Domain Name System") (https://datatracker.ietf.org/doc/rfc2136/) to manage DNS01 challenge records. + type: object + required: + - nameserver properties: nameserver: description: |- The IP address or hostname of an authoritative DNS server supporting RFC2136 in the form host:port. If the host is an IPv6 address it must be - enclosed in square brackets (e.g [2001:db8::1]); port is optional. + enclosed in square brackets (e.g [2001:db8::1]) ; port is optional. This field is required. type: string - protocol: - description: Protocol to use for dynamic DNS update queries. Valid values are (case-sensitive) ``TCP`` and ``UDP``; ``UDP`` (default). - enum: - - TCP - - UDP - type: string tsigAlgorithm: description: |- The TSIG Algorithm configured in the DNS supporting RFC2136. Used only @@ -9451,6 +8670,9 @@ spec: description: |- The name of the secret containing the TSIG value. If ``tsigKeyName`` is defined, this field is required. + type: object + required: + - name properties: key: description: |- @@ -9463,21 +8685,16 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string - required: - - name - type: object - required: - - nameserver - type: object route53: description: Use the AWS Route53 API to manage DNS01 challenge records. + type: object properties: accessKeyID: description: |- The AccessKeyID is used for authentication. Cannot be set when SecretAccessKeyID is set. - If neither the Access Key nor Key ID are set, we fall back to using env - vars, shared credentials file, or AWS Instance metadata, + If neither the Access Key nor Key ID are set, we fall-back to using env + vars, shared credentials file or AWS Instance metadata, see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials type: string accessKeyIDSecretRef: @@ -9485,9 +8702,12 @@ spec: The SecretAccessKey is used for authentication. If set, pull the AWS access key ID from a key within a Kubernetes Secret. Cannot be set when AccessKeyID is set. - If neither the Access Key nor Key ID are set, we fall back to using env - vars, shared credentials file, or AWS Instance metadata, + If neither the Access Key nor Key ID are set, we fall-back to using env + vars, shared credentials file or AWS Instance metadata, see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials + type: object + required: + - name properties: key: description: |- @@ -9500,22 +8720,28 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string - required: - - name - type: object auth: description: Auth configures how cert-manager authenticates. + type: object + required: + - kubernetes properties: kubernetes: description: |- Kubernetes authenticates with Route53 using AssumeRoleWithWebIdentity by passing a bound ServiceAccount token. + type: object + required: + - serviceAccountRef properties: serviceAccountRef: description: |- A reference to a service account that will be used to request a bound token (also known as "projected token"). To use this field, you must configure an RBAC rule to let cert-manager request a token. + type: object + required: + - name properties: audiences: description: |- @@ -9523,22 +8749,12 @@ spec: token passed to AWS. The default token consisting of the issuer's namespace and name is always included. If unset the audience defaults to `sts.amazonaws.com`. + type: array items: type: string - type: array - x-kubernetes-list-type: atomic name: description: Name of the ServiceAccount used to request a token. type: string - required: - - name - type: object - required: - - serviceAccountRef - type: object - required: - - kubernetes - type: object hostedZoneID: description: If set, the provider will manage only this zone in Route53 and will not do a lookup using the route53:ListHostedZonesByName api call. type: string @@ -9575,9 +8791,12 @@ spec: secretAccessKeySecretRef: description: |- The SecretAccessKey is used for authentication. - If neither the Access Key nor Key ID are set, we fall back to using env - vars, shared credentials file, or AWS Instance metadata, + If neither the Access Key nor Key ID are set, we fall-back to using env + vars, shared credentials file or AWS Instance metadata, see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials + type: object + required: + - name properties: key: description: |- @@ -9590,14 +8809,14 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string - required: - - name - type: object - type: object webhook: description: |- Configure an external webhook based DNS01 challenge solver to manage DNS01 challenge records. + type: object + required: + - groupName + - solverName properties: config: description: |- @@ -9605,7 +8824,7 @@ spec: when challenges are processed. This can contain arbitrary JSON data. Secret values should not be specified in this stanza. - If secret values are needed (e.g., credentials for a DNS service), you + If secret values are needed (e.g. credentials for a DNS service), you should use a SecretKeySelector to reference a Secret resource. For details on the schema of this field, consult the webhook provider implementation's documentation. @@ -9621,19 +8840,15 @@ spec: description: |- The name of the solver to use, as defined in the webhook provider implementation. - This will typically be the name of the provider, e.g., 'cloudflare'. + This will typically be the name of the provider, e.g. 'cloudflare'. type: string - required: - - groupName - - solverName - type: object - type: object http01: description: |- Configures cert-manager to attempt to complete authorizations by performing the HTTP01 challenge flow. It is not possible to obtain certificates for wildcard domain names - (e.g., `*.example.com`) using the HTTP01 challenge mechanism. + (e.g. `*.example.com`) using the HTTP01 challenge mechanism. + type: object properties: gatewayHTTPRoute: description: |- @@ -9641,20 +8856,22 @@ spec: in Kubernetes (https://gateway-api.sigs.k8s.io/). The Gateway solver will create HTTPRoutes with the specified labels in the same namespace as the challenge. This solver is experimental, and fields / behaviour may change in the future. + type: object properties: labels: - additionalProperties: - type: string description: |- Custom labels that will be applied to HTTPRoutes created by cert-manager while solving HTTP-01 challenges. type: object + additionalProperties: + type: string parentRefs: description: |- When solving an HTTP-01 challenge, cert-manager creates an HTTPRoute. cert-manager needs to know which parentRefs should be used when creating the HTTPRoute. Usually, the parentRef references a Gateway. See: https://gateway-api.sigs.k8s.io/api-types/httproute/#attaching-to-gateways + type: array items: description: |- ParentReference identifies an API object (usually a Gateway) that can be considered @@ -9669,9 +8886,11 @@ spec: The API object must be valid in the cluster; the Group and Kind must be registered in the cluster for this reference to be valid. + type: object + required: + - name properties: group: - default: gateway.networking.k8s.io description: |- Group is the group of the referent. When unspecified, "gateway.networking.k8s.io" is inferred. @@ -9679,11 +8898,11 @@ spec: Group must be explicitly set to "" (empty string). Support: Core + type: string + default: gateway.networking.k8s.io maxLength: 253 pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string kind: - default: Gateway description: |- Kind is kind of the referent. @@ -9693,18 +8912,19 @@ spec: * Service (Mesh conformance profile, ClusterIP Services only) Support for other resources is Implementation-Specific. + type: string + default: Gateway maxLength: 63 minLength: 1 pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string name: description: |- Name is the name of the referent. Support: Core + type: string maxLength: 253 minLength: 1 - type: string namespace: description: |- Namespace is the namespace of the referent. When unspecified, this refers @@ -9729,10 +8949,10 @@ spec: Support: Core + type: string maxLength: 63 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ - type: string port: description: |- Port is the network port this Route targets. It can be interpreted @@ -9765,10 +8985,10 @@ spec: the Route MUST be considered detached from the Gateway. Support: Extended + type: integer format: int32 maximum: 65535 minimum: 1 - type: integer sectionName: description: |- SectionName is the name of a section within the target resource. In the @@ -9795,19 +9015,15 @@ spec: Route MUST be considered detached from the Gateway. Support: Core + type: string maxLength: 253 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - required: - - name - type: object - type: array - x-kubernetes-list-type: atomic podTemplate: description: |- Optional pod template used to configure the ACME challenge solver pods used for HTTP01 challenges. + type: object properties: metadata: description: |- @@ -9815,29 +9031,32 @@ spec: Only the 'labels' and 'annotations' fields may be set. If labels or annotations overlap with in-built values, the values here will override the in-built values. + type: object properties: annotations: - additionalProperties: - type: string description: Annotations that should be added to the created ACME HTTP01 solver pods. type: object - labels: additionalProperties: type: string + labels: description: Labels that should be added to the created ACME HTTP01 solver pods. type: object - type: object + additionalProperties: + type: string spec: description: |- PodSpec defines overrides for the HTTP01 challenge solver pod. Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields. All other fields will be ignored. + type: object properties: affinity: description: If specified, the pod's scheduling constraints + type: object properties: nodeAffinity: description: Describes node affinity scheduling rules for the pod. + type: object properties: preferredDuringSchedulingIgnoredDuringExecution: description: |- @@ -9850,20 +9069,31 @@ spec: compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node matches the corresponding matchExpressions; the node(s) with the highest sum are the most preferred. + type: array items: description: |- An empty preferred scheduling term matches all objects with implicit weight 0 (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). + type: object + required: + - preference + - weight properties: preference: description: A node selector term, associated with the corresponding weight. + type: object properties: matchExpressions: description: A list of node selector requirements by node's labels. + type: array items: description: |- A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator properties: key: description: The label key that the selector applies to. @@ -9880,22 +9110,22 @@ spec: the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. + type: array items: type: string - type: array x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array x-kubernetes-list-type: atomic matchFields: description: A list of node selector requirements by node's fields. + type: array items: description: |- A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator properties: key: description: The label key that the selector applies to. @@ -9912,27 +9142,16 @@ spec: the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. + type: array items: type: string - type: array x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array x-kubernetes-list-type: atomic - type: object x-kubernetes-map-type: atomic weight: description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100. - format: int32 type: integer - required: - - preference - - weight - type: object - type: array + format: int32 x-kubernetes-list-type: atomic requiredDuringSchedulingIgnoredDuringExecution: description: |- @@ -9941,21 +9160,31 @@ spec: If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to an update), the system may or may not try to eventually evict the pod from its node. + type: object + required: + - nodeSelectorTerms properties: nodeSelectorTerms: description: Required. A list of node selector terms. The terms are ORed. + type: array items: description: |- A null or empty node selector term matches no objects. The requirements of them are ANDed. The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. + type: object properties: matchExpressions: description: A list of node selector requirements by node's labels. + type: array items: description: |- A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator properties: key: description: The label key that the selector applies to. @@ -9972,22 +9201,22 @@ spec: the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. + type: array items: type: string - type: array x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array x-kubernetes-list-type: atomic matchFields: description: A list of node selector requirements by node's fields. + type: array items: description: |- A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator properties: key: description: The label key that the selector applies to. @@ -10004,27 +9233,17 @@ spec: the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. + type: array items: type: string - type: array x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array x-kubernetes-list-type: atomic - type: object x-kubernetes-map-type: atomic - type: array x-kubernetes-list-type: atomic - required: - - nodeSelectorTerms - type: object x-kubernetes-map-type: atomic - type: object podAffinity: description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)). + type: object properties: preferredDuringSchedulingIgnoredDuringExecution: description: |- @@ -10037,23 +9256,37 @@ spec: compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. + type: array items: description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) + type: object + required: + - podAffinityTerm + - weight properties: podAffinityTerm: description: Required. A pod affinity term, associated with the corresponding weight. + type: object + required: + - topologyKey properties: labelSelector: description: |- A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods. + type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator properties: key: description: key is the label key that the selector applies to. @@ -10069,25 +9302,19 @@ spec: the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. - items: - type: string type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array + items: + type: string + x-kubernetes-list-type: atomic x-kubernetes-list-type: atomic matchLabels: - additionalProperties: - type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - type: object + additionalProperties: + type: string x-kubernetes-map-type: atomic matchLabelKeys: description: |- @@ -10099,9 +9326,10 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array items: type: string - type: array x-kubernetes-list-type: atomic mismatchLabelKeys: description: |- @@ -10113,9 +9341,10 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array items: type: string - type: array x-kubernetes-list-type: atomic namespaceSelector: description: |- @@ -10124,13 +9353,19 @@ spec: and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. + type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator properties: key: description: key is the label key that the selector applies to. @@ -10146,25 +9381,19 @@ spec: the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array items: type: string - type: array x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array x-kubernetes-list-type: atomic matchLabels: - additionalProperties: - type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - type: object + additionalProperties: + type: string x-kubernetes-map-type: atomic namespaces: description: |- @@ -10172,9 +9401,9 @@ spec: The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". + type: array items: type: string - type: array x-kubernetes-list-type: atomic topologyKey: description: |- @@ -10184,20 +9413,12 @@ spec: selected pods is running. Empty topologyKey is not allowed. type: string - required: - - topologyKey - type: object weight: description: |- weight associated with matching the corresponding podAffinityTerm, in the range 1-100. - format: int32 type: integer - required: - - podAffinityTerm - - weight - type: object - type: array + format: int32 x-kubernetes-list-type: atomic requiredDuringSchedulingIgnoredDuringExecution: description: |- @@ -10208,6 +9429,7 @@ spec: system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied. + type: array items: description: |- Defines a set of pods (namely those matching the labelSelector @@ -10216,18 +9438,27 @@ spec: where co-located is defined as running on a node whose value of the label with key matches that of any node on which a pod of the set of pods is running + type: object + required: + - topologyKey properties: labelSelector: description: |- A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods. + type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator properties: key: description: key is the label key that the selector applies to. @@ -10243,25 +9474,19 @@ spec: the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array items: type: string - type: array x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array x-kubernetes-list-type: atomic matchLabels: - additionalProperties: - type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - type: object + additionalProperties: + type: string x-kubernetes-map-type: atomic matchLabelKeys: description: |- @@ -10273,9 +9498,10 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array items: type: string - type: array x-kubernetes-list-type: atomic mismatchLabelKeys: description: |- @@ -10287,9 +9513,10 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array items: type: string - type: array x-kubernetes-list-type: atomic namespaceSelector: description: |- @@ -10298,13 +9525,19 @@ spec: and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. + type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator properties: key: description: key is the label key that the selector applies to. @@ -10320,25 +9553,19 @@ spec: the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array items: type: string - type: array x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array x-kubernetes-list-type: atomic matchLabels: - additionalProperties: - type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - type: object + additionalProperties: + type: string x-kubernetes-map-type: atomic namespaces: description: |- @@ -10346,9 +9573,9 @@ spec: The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". + type: array items: type: string - type: array x-kubernetes-list-type: atomic topologyKey: description: |- @@ -10358,14 +9585,10 @@ spec: selected pods is running. Empty topologyKey is not allowed. type: string - required: - - topologyKey - type: object - type: array x-kubernetes-list-type: atomic - type: object podAntiAffinity: description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)). + type: object properties: preferredDuringSchedulingIgnoredDuringExecution: description: |- @@ -10375,26 +9598,40 @@ spec: most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling anti-affinity expressions, etc.), - compute a sum by iterating through the elements of this field and subtracting - "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. + type: array items: description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) + type: object + required: + - podAffinityTerm + - weight properties: podAffinityTerm: description: Required. A pod affinity term, associated with the corresponding weight. + type: object + required: + - topologyKey properties: labelSelector: description: |- A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods. + type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator properties: key: description: key is the label key that the selector applies to. @@ -10410,25 +9647,19 @@ spec: the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array items: type: string - type: array x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array x-kubernetes-list-type: atomic matchLabels: - additionalProperties: - type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - type: object + additionalProperties: + type: string x-kubernetes-map-type: atomic matchLabelKeys: description: |- @@ -10440,9 +9671,10 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array items: type: string - type: array x-kubernetes-list-type: atomic mismatchLabelKeys: description: |- @@ -10454,9 +9686,10 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array items: type: string - type: array x-kubernetes-list-type: atomic namespaceSelector: description: |- @@ -10465,13 +9698,19 @@ spec: and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. + type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator properties: key: description: key is the label key that the selector applies to. @@ -10487,25 +9726,19 @@ spec: the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array items: type: string - type: array x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array x-kubernetes-list-type: atomic matchLabels: - additionalProperties: - type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - type: object + additionalProperties: + type: string x-kubernetes-map-type: atomic namespaces: description: |- @@ -10513,9 +9746,9 @@ spec: The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". + type: array items: type: string - type: array x-kubernetes-list-type: atomic topologyKey: description: |- @@ -10525,20 +9758,12 @@ spec: selected pods is running. Empty topologyKey is not allowed. type: string - required: - - topologyKey - type: object weight: description: |- weight associated with matching the corresponding podAffinityTerm, in the range 1-100. - format: int32 type: integer - required: - - podAffinityTerm - - weight - type: object - type: array + format: int32 x-kubernetes-list-type: atomic requiredDuringSchedulingIgnoredDuringExecution: description: |- @@ -10549,6 +9774,7 @@ spec: system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied. + type: array items: description: |- Defines a set of pods (namely those matching the labelSelector @@ -10557,18 +9783,27 @@ spec: where co-located is defined as running on a node whose value of the label with key matches that of any node on which a pod of the set of pods is running + type: object + required: + - topologyKey properties: labelSelector: description: |- A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods. + type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator properties: key: description: key is the label key that the selector applies to. @@ -10584,25 +9819,19 @@ spec: the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array items: type: string - type: array x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array x-kubernetes-list-type: atomic matchLabels: - additionalProperties: - type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - type: object + additionalProperties: + type: string x-kubernetes-map-type: atomic matchLabelKeys: description: |- @@ -10614,9 +9843,10 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array items: type: string - type: array x-kubernetes-list-type: atomic mismatchLabelKeys: description: |- @@ -10628,9 +9858,10 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array items: type: string - type: array x-kubernetes-list-type: atomic namespaceSelector: description: |- @@ -10639,13 +9870,19 @@ spec: and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. + type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator properties: key: description: key is the label key that the selector applies to. @@ -10661,25 +9898,19 @@ spec: the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array items: type: string - type: array x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array x-kubernetes-list-type: atomic matchLabels: - additionalProperties: - type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - type: object + additionalProperties: + type: string x-kubernetes-map-type: atomic namespaces: description: |- @@ -10687,9 +9918,9 @@ spec: The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". + type: array items: type: string - type: array x-kubernetes-list-type: atomic topologyKey: description: |- @@ -10699,22 +9930,17 @@ spec: selected pods is running. Empty topologyKey is not allowed. type: string - required: - - topologyKey - type: object - type: array x-kubernetes-list-type: atomic - type: object - type: object imagePullSecrets: description: If specified, the pod's imagePullSecrets + type: array items: description: |- LocalObjectReference contains enough information to let you locate the referenced object inside the same namespace. + type: object properties: name: - default: "" description: |- Name of the referent. This field is effectively required, but due to backwards compatibility is @@ -10722,59 +9948,22 @@ spec: almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string - type: object + default: "" x-kubernetes-map-type: atomic - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map nodeSelector: - additionalProperties: - type: string description: |- NodeSelector is a selector which must be true for the pod to fit on a node. Selector which must match a node's labels for the pod to be scheduled on that node. More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ type: object + additionalProperties: + type: string priorityClassName: description: If specified, the pod's priorityClassName. type: string - resources: - description: |- - If specified, the pod's resource requirements. - These values override the global resource configuration flags. - Note that when only specifying resource limits, ensure they are greater than or equal - to the corresponding global resource requests configured via controller flags - (--acme-http01-solver-resource-request-cpu, --acme-http01-solver-resource-request-memory). - Kubernetes will reject pod creation if limits are lower than requests, causing challenge failures. - properties: - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: |- - Limits describes the maximum amount of compute resources allowed. - More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: |- - Requests describes the minimum amount of compute resources required. - If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, - otherwise to the global values configured via controller flags. Requests cannot exceed Limits. - More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ - type: object - type: object securityContext: description: If specified, the pod's security context + type: object properties: fsGroup: description: |- @@ -10788,8 +9977,8 @@ spec: If unset, the Kubelet will not modify the ownership and permissions of any volume. Note that this field cannot be set when spec.os.name is windows. - format: int64 type: integer + format: int64 fsGroupChangePolicy: description: |- fsGroupChangePolicy defines behavior of changing ownership and permission of the volume @@ -10808,8 +9997,8 @@ spec: PodSecurityContext, the value specified in SecurityContext takes precedence for that container. Note that this field cannot be set when spec.os.name is windows. - format: int64 type: integer + format: int64 runAsNonRoot: description: |- Indicates that the container must run as a non-root user. @@ -10827,8 +10016,8 @@ spec: PodSecurityContext, the value specified in SecurityContext takes precedence for that container. Note that this field cannot be set when spec.os.name is windows. - format: int64 type: integer + format: int64 seLinuxOptions: description: |- The SELinux context to be applied to all containers. @@ -10837,6 +10026,7 @@ spec: both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence for that container. Note that this field cannot be set when spec.os.name is windows. + type: object properties: level: description: Level is SELinux level label that applies to the container. @@ -10850,11 +10040,13 @@ spec: user: description: User is a SELinux user label that applies to the container. type: string - type: object seccompProfile: description: |- The seccomp options to use by the containers in this pod. Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type properties: localhostProfile: description: |- @@ -10872,9 +10064,6 @@ spec: RuntimeDefault - the container runtime default profile should be used. Unconfined - no profile should be applied. type: string - required: - - type - type: object supplementalGroups: description: |- A list of groups applied to the first process run in each container, in addition @@ -10884,18 +10073,22 @@ spec: defined in the container image for the uid of the container process are still effective, even if they are not included in this list. Note that this field cannot be set when spec.os.name is windows. + type: array items: - format: int64 type: integer - type: array - x-kubernetes-list-type: atomic + format: int64 sysctls: description: |- Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported sysctls (by the container runtime) might fail to launch. Note that this field cannot be set when spec.os.name is windows. + type: array items: description: Sysctl defines a kernel parameter to be set + type: object + required: + - name + - value properties: name: description: Name of a property to set @@ -10903,22 +10096,17 @@ spec: value: description: Value of a property to set type: string - required: - - name - - value - type: object - type: array - x-kubernetes-list-type: atomic - type: object serviceAccountName: description: If specified, the pod's service account type: string tolerations: description: If specified, the pod's tolerations. + type: array items: description: |- The pod this Toleration is attached to tolerates any taint that matches the triple using the matching operator . + type: object properties: effect: description: |- @@ -10933,10 +10121,9 @@ spec: operator: description: |- Operator represents a key's relationship to the value. - Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. + Valid operators are Exists and Equal. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. - Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). type: string tolerationSeconds: description: |- @@ -10944,30 +10131,25 @@ spec: of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, it is not set, which means tolerate the taint forever (do not evict). Zero and negative values will be treated as 0 (evict immediately) by the system. - format: int64 type: integer + format: int64 value: description: |- Value is the taint value the toleration matches to. If the operator is Exists, the value should be empty, otherwise just a regular string. type: string - type: object - type: array - x-kubernetes-list-type: atomic - type: object - type: object serviceType: description: |- Optional service type for Kubernetes solver service. Supported values are NodePort or ClusterIP. If unset, defaults to NodePort. type: string - type: object ingress: description: |- The ingress based HTTP01 challenge solver will solve challenges by creating or modifying Ingress resources in order to route requests for '/.well-known/acme-challenge/XYZ' to 'challenge solver' pods that are provisioned by cert-manager for each Challenge to be completed. + type: object properties: class: description: |- @@ -10987,6 +10169,7 @@ spec: description: |- Optional ingress template used to configure the ACME challenge solver ingress used for HTTP01 challenges. + type: object properties: metadata: description: |- @@ -10994,19 +10177,18 @@ spec: Only the 'labels' and 'annotations' fields may be set. If labels or annotations overlap with in-built values, the values here will override the in-built values. + type: object properties: annotations: - additionalProperties: - type: string description: Annotations that should be added to the created ACME HTTP01 solver ingress. type: object - labels: additionalProperties: type: string + labels: description: Labels that should be added to the created ACME HTTP01 solver ingress. type: object - type: object - type: object + additionalProperties: + type: string name: description: |- The name of the ingress resource that should have ACME challenge solving @@ -11020,6 +10202,7 @@ spec: description: |- Optional pod template used to configure the ACME challenge solver pods used for HTTP01 challenges. + type: object properties: metadata: description: |- @@ -11027,29 +10210,32 @@ spec: Only the 'labels' and 'annotations' fields may be set. If labels or annotations overlap with in-built values, the values here will override the in-built values. + type: object properties: annotations: - additionalProperties: - type: string description: Annotations that should be added to the created ACME HTTP01 solver pods. type: object - labels: additionalProperties: type: string + labels: description: Labels that should be added to the created ACME HTTP01 solver pods. type: object - type: object + additionalProperties: + type: string spec: description: |- PodSpec defines overrides for the HTTP01 challenge solver pod. Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields. All other fields will be ignored. + type: object properties: affinity: description: If specified, the pod's scheduling constraints + type: object properties: nodeAffinity: description: Describes node affinity scheduling rules for the pod. + type: object properties: preferredDuringSchedulingIgnoredDuringExecution: description: |- @@ -11062,20 +10248,31 @@ spec: compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node matches the corresponding matchExpressions; the node(s) with the highest sum are the most preferred. + type: array items: description: |- An empty preferred scheduling term matches all objects with implicit weight 0 (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). + type: object + required: + - preference + - weight properties: preference: description: A node selector term, associated with the corresponding weight. + type: object properties: matchExpressions: description: A list of node selector requirements by node's labels. + type: array items: description: |- A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator properties: key: description: The label key that the selector applies to. @@ -11092,22 +10289,22 @@ spec: the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. + type: array items: type: string - type: array x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array x-kubernetes-list-type: atomic matchFields: description: A list of node selector requirements by node's fields. + type: array items: description: |- A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator properties: key: description: The label key that the selector applies to. @@ -11124,27 +10321,16 @@ spec: the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. + type: array items: type: string - type: array x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array x-kubernetes-list-type: atomic - type: object x-kubernetes-map-type: atomic weight: description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100. - format: int32 type: integer - required: - - preference - - weight - type: object - type: array + format: int32 x-kubernetes-list-type: atomic requiredDuringSchedulingIgnoredDuringExecution: description: |- @@ -11153,21 +10339,31 @@ spec: If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to an update), the system may or may not try to eventually evict the pod from its node. + type: object + required: + - nodeSelectorTerms properties: nodeSelectorTerms: description: Required. A list of node selector terms. The terms are ORed. + type: array items: description: |- A null or empty node selector term matches no objects. The requirements of them are ANDed. The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. + type: object properties: matchExpressions: description: A list of node selector requirements by node's labels. + type: array items: description: |- A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator properties: key: description: The label key that the selector applies to. @@ -11184,22 +10380,22 @@ spec: the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. + type: array items: type: string - type: array x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array x-kubernetes-list-type: atomic matchFields: description: A list of node selector requirements by node's fields. + type: array items: description: |- A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator properties: key: description: The label key that the selector applies to. @@ -11216,27 +10412,17 @@ spec: the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. + type: array items: type: string - type: array x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array x-kubernetes-list-type: atomic - type: object x-kubernetes-map-type: atomic - type: array x-kubernetes-list-type: atomic - required: - - nodeSelectorTerms - type: object x-kubernetes-map-type: atomic - type: object podAffinity: description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)). + type: object properties: preferredDuringSchedulingIgnoredDuringExecution: description: |- @@ -11249,23 +10435,37 @@ spec: compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. + type: array items: description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) + type: object + required: + - podAffinityTerm + - weight properties: podAffinityTerm: description: Required. A pod affinity term, associated with the corresponding weight. + type: object + required: + - topologyKey properties: labelSelector: description: |- A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods. + type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator properties: key: description: key is the label key that the selector applies to. @@ -11281,25 +10481,19 @@ spec: the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array items: type: string - type: array x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array x-kubernetes-list-type: atomic matchLabels: - additionalProperties: - type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - type: object + additionalProperties: + type: string x-kubernetes-map-type: atomic matchLabelKeys: description: |- @@ -11311,9 +10505,10 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array items: type: string - type: array x-kubernetes-list-type: atomic mismatchLabelKeys: description: |- @@ -11325,9 +10520,10 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array items: type: string - type: array x-kubernetes-list-type: atomic namespaceSelector: description: |- @@ -11336,13 +10532,19 @@ spec: and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. + type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator properties: key: description: key is the label key that the selector applies to. @@ -11358,25 +10560,19 @@ spec: the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array items: type: string - type: array x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array x-kubernetes-list-type: atomic matchLabels: - additionalProperties: - type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - type: object + additionalProperties: + type: string x-kubernetes-map-type: atomic namespaces: description: |- @@ -11384,9 +10580,9 @@ spec: The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". + type: array items: type: string - type: array x-kubernetes-list-type: atomic topologyKey: description: |- @@ -11396,20 +10592,12 @@ spec: selected pods is running. Empty topologyKey is not allowed. type: string - required: - - topologyKey - type: object weight: description: |- weight associated with matching the corresponding podAffinityTerm, in the range 1-100. - format: int32 type: integer - required: - - podAffinityTerm - - weight - type: object - type: array + format: int32 x-kubernetes-list-type: atomic requiredDuringSchedulingIgnoredDuringExecution: description: |- @@ -11420,6 +10608,7 @@ spec: system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied. + type: array items: description: |- Defines a set of pods (namely those matching the labelSelector @@ -11428,18 +10617,27 @@ spec: where co-located is defined as running on a node whose value of the label with key matches that of any node on which a pod of the set of pods is running + type: object + required: + - topologyKey properties: labelSelector: description: |- A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods. + type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator properties: key: description: key is the label key that the selector applies to. @@ -11455,25 +10653,19 @@ spec: the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array items: type: string - type: array x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array x-kubernetes-list-type: atomic matchLabels: - additionalProperties: - type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - type: object + additionalProperties: + type: string x-kubernetes-map-type: atomic matchLabelKeys: description: |- @@ -11485,9 +10677,10 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array items: type: string - type: array x-kubernetes-list-type: atomic mismatchLabelKeys: description: |- @@ -11499,9 +10692,10 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array items: type: string - type: array x-kubernetes-list-type: atomic namespaceSelector: description: |- @@ -11510,13 +10704,19 @@ spec: and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. + type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator properties: key: description: key is the label key that the selector applies to. @@ -11532,25 +10732,19 @@ spec: the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array items: type: string - type: array x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array x-kubernetes-list-type: atomic matchLabels: - additionalProperties: - type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - type: object + additionalProperties: + type: string x-kubernetes-map-type: atomic namespaces: description: |- @@ -11558,9 +10752,9 @@ spec: The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". + type: array items: type: string - type: array x-kubernetes-list-type: atomic topologyKey: description: |- @@ -11570,14 +10764,10 @@ spec: selected pods is running. Empty topologyKey is not allowed. type: string - required: - - topologyKey - type: object - type: array x-kubernetes-list-type: atomic - type: object podAntiAffinity: description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)). + type: object properties: preferredDuringSchedulingIgnoredDuringExecution: description: |- @@ -11587,26 +10777,40 @@ spec: most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling anti-affinity expressions, etc.), - compute a sum by iterating through the elements of this field and subtracting - "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. + type: array items: description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) + type: object + required: + - podAffinityTerm + - weight properties: podAffinityTerm: description: Required. A pod affinity term, associated with the corresponding weight. + type: object + required: + - topologyKey properties: labelSelector: description: |- A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods. + type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator properties: key: description: key is the label key that the selector applies to. @@ -11622,25 +10826,19 @@ spec: the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array items: type: string - type: array x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array x-kubernetes-list-type: atomic matchLabels: - additionalProperties: - type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - type: object + additionalProperties: + type: string x-kubernetes-map-type: atomic matchLabelKeys: description: |- @@ -11652,9 +10850,10 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array items: type: string - type: array x-kubernetes-list-type: atomic mismatchLabelKeys: description: |- @@ -11666,9 +10865,10 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array items: type: string - type: array x-kubernetes-list-type: atomic namespaceSelector: description: |- @@ -11677,13 +10877,19 @@ spec: and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. + type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator properties: key: description: key is the label key that the selector applies to. @@ -11699,25 +10905,19 @@ spec: the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array items: type: string - type: array x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array x-kubernetes-list-type: atomic matchLabels: - additionalProperties: - type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - type: object + additionalProperties: + type: string x-kubernetes-map-type: atomic namespaces: description: |- @@ -11725,9 +10925,9 @@ spec: The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". + type: array items: type: string - type: array x-kubernetes-list-type: atomic topologyKey: description: |- @@ -11737,20 +10937,12 @@ spec: selected pods is running. Empty topologyKey is not allowed. type: string - required: - - topologyKey - type: object weight: description: |- weight associated with matching the corresponding podAffinityTerm, in the range 1-100. - format: int32 type: integer - required: - - podAffinityTerm - - weight - type: object - type: array + format: int32 x-kubernetes-list-type: atomic requiredDuringSchedulingIgnoredDuringExecution: description: |- @@ -11761,6 +10953,7 @@ spec: system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied. + type: array items: description: |- Defines a set of pods (namely those matching the labelSelector @@ -11769,18 +10962,27 @@ spec: where co-located is defined as running on a node whose value of the label with key matches that of any node on which a pod of the set of pods is running + type: object + required: + - topologyKey properties: labelSelector: description: |- A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods. + type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator properties: key: description: key is the label key that the selector applies to. @@ -11796,25 +10998,19 @@ spec: the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array items: type: string - type: array x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array x-kubernetes-list-type: atomic matchLabels: - additionalProperties: - type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - type: object + additionalProperties: + type: string x-kubernetes-map-type: atomic matchLabelKeys: description: |- @@ -11826,9 +11022,10 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both matchLabelKeys and labelSelector. Also, matchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array items: type: string - type: array x-kubernetes-list-type: atomic mismatchLabelKeys: description: |- @@ -11840,9 +11037,10 @@ spec: pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. Also, mismatchLabelKeys cannot be set when labelSelector isn't set. + This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default). + type: array items: type: string - type: array x-kubernetes-list-type: atomic namespaceSelector: description: |- @@ -11851,13 +11049,19 @@ spec: and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. + type: object properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. + type: array items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. + type: object + required: + - key + - operator properties: key: description: key is the label key that the selector applies to. @@ -11873,25 +11077,19 @@ spec: the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. + type: array items: type: string - type: array x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array x-kubernetes-list-type: atomic matchLabels: - additionalProperties: - type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object - type: object + additionalProperties: + type: string x-kubernetes-map-type: atomic namespaces: description: |- @@ -11899,9 +11097,9 @@ spec: The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". + type: array items: type: string - type: array x-kubernetes-list-type: atomic topologyKey: description: |- @@ -11911,22 +11109,17 @@ spec: selected pods is running. Empty topologyKey is not allowed. type: string - required: - - topologyKey - type: object - type: array x-kubernetes-list-type: atomic - type: object - type: object imagePullSecrets: description: If specified, the pod's imagePullSecrets + type: array items: description: |- LocalObjectReference contains enough information to let you locate the referenced object inside the same namespace. + type: object properties: name: - default: "" description: |- Name of the referent. This field is effectively required, but due to backwards compatibility is @@ -11934,59 +11127,22 @@ spec: almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string - type: object + default: "" x-kubernetes-map-type: atomic - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map nodeSelector: - additionalProperties: - type: string description: |- NodeSelector is a selector which must be true for the pod to fit on a node. Selector which must match a node's labels for the pod to be scheduled on that node. More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ type: object + additionalProperties: + type: string priorityClassName: description: If specified, the pod's priorityClassName. type: string - resources: - description: |- - If specified, the pod's resource requirements. - These values override the global resource configuration flags. - Note that when only specifying resource limits, ensure they are greater than or equal - to the corresponding global resource requests configured via controller flags - (--acme-http01-solver-resource-request-cpu, --acme-http01-solver-resource-request-memory). - Kubernetes will reject pod creation if limits are lower than requests, causing challenge failures. - properties: - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: |- - Limits describes the maximum amount of compute resources allowed. - More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: |- - Requests describes the minimum amount of compute resources required. - If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, - otherwise to the global values configured via controller flags. Requests cannot exceed Limits. - More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ - type: object - type: object securityContext: description: If specified, the pod's security context + type: object properties: fsGroup: description: |- @@ -12000,8 +11156,8 @@ spec: If unset, the Kubelet will not modify the ownership and permissions of any volume. Note that this field cannot be set when spec.os.name is windows. - format: int64 type: integer + format: int64 fsGroupChangePolicy: description: |- fsGroupChangePolicy defines behavior of changing ownership and permission of the volume @@ -12020,8 +11176,8 @@ spec: PodSecurityContext, the value specified in SecurityContext takes precedence for that container. Note that this field cannot be set when spec.os.name is windows. - format: int64 type: integer + format: int64 runAsNonRoot: description: |- Indicates that the container must run as a non-root user. @@ -12039,8 +11195,8 @@ spec: PodSecurityContext, the value specified in SecurityContext takes precedence for that container. Note that this field cannot be set when spec.os.name is windows. - format: int64 type: integer + format: int64 seLinuxOptions: description: |- The SELinux context to be applied to all containers. @@ -12049,6 +11205,7 @@ spec: both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence for that container. Note that this field cannot be set when spec.os.name is windows. + type: object properties: level: description: Level is SELinux level label that applies to the container. @@ -12062,11 +11219,13 @@ spec: user: description: User is a SELinux user label that applies to the container. type: string - type: object seccompProfile: description: |- The seccomp options to use by the containers in this pod. Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type properties: localhostProfile: description: |- @@ -12084,9 +11243,6 @@ spec: RuntimeDefault - the container runtime default profile should be used. Unconfined - no profile should be applied. type: string - required: - - type - type: object supplementalGroups: description: |- A list of groups applied to the first process run in each container, in addition @@ -12096,18 +11252,22 @@ spec: defined in the container image for the uid of the container process are still effective, even if they are not included in this list. Note that this field cannot be set when spec.os.name is windows. + type: array items: - format: int64 type: integer - type: array - x-kubernetes-list-type: atomic + format: int64 sysctls: description: |- Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported sysctls (by the container runtime) might fail to launch. Note that this field cannot be set when spec.os.name is windows. + type: array items: description: Sysctl defines a kernel parameter to be set + type: object + required: + - name + - value properties: name: description: Name of a property to set @@ -12115,22 +11275,17 @@ spec: value: description: Value of a property to set type: string - required: - - name - - value - type: object - type: array - x-kubernetes-list-type: atomic - type: object serviceAccountName: description: If specified, the pod's service account type: string tolerations: description: If specified, the pod's tolerations. + type: array items: description: |- The pod this Toleration is attached to tolerates any taint that matches the triple using the matching operator . + type: object properties: effect: description: |- @@ -12145,10 +11300,9 @@ spec: operator: description: |- Operator represents a key's relationship to the value. - Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. + Valid operators are Exists and Equal. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. - Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). type: string tolerationSeconds: description: |- @@ -12156,25 +11310,18 @@ spec: of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, it is not set, which means tolerate the taint forever (do not evict). Zero and negative values will be treated as 0 (evict immediately) by the system. - format: int64 type: integer + format: int64 value: description: |- Value is the taint value the toleration matches to. If the operator is Exists, the value should be empty, otherwise just a regular string. type: string - type: object - type: array - x-kubernetes-list-type: atomic - type: object - type: object serviceType: description: |- Optional service type for Kubernetes solver service. Supported values are NodePort or ClusterIP. If unset, defaults to NodePort. type: string - type: object - type: object selector: description: |- Selector selects a set of DNSNames on the Certificate resource that @@ -12182,6 +11329,7 @@ spec: If not specified, the solver will be treated as the 'default' solver with the lowest priority, i.e. if any other solver has a more specific match, it will be used instead. + type: object properties: dnsNames: description: |- @@ -12192,10 +11340,9 @@ spec: with the most matching labels in matchLabels will be selected. If neither has more matches, the solver defined earlier in the list will be selected. + type: array items: type: string - type: array - x-kubernetes-list-type: atomic dnsZones: description: |- List of DNSZones that this solver will be used to solve. @@ -12207,67 +11354,41 @@ spec: with the most matching labels in matchLabels will be selected. If neither has more matches, the solver defined earlier in the list will be selected. + type: array items: type: string - type: array - x-kubernetes-list-type: atomic matchLabels: - additionalProperties: - type: string description: |- A label selector that is used to refine the set of certificate's that this challenge solver will apply to. type: object - type: object - waitInsteadOfSelfCheck: - description: |- - WaitInsteadOfSelfCheck, if set, skips cert-manager's self-check and - instead waits this long after presentation before asking the ACME server - to validate the challenge. - - This is an advanced escape hatch for environments where cert-manager's - self-check cannot succeed from its own network or DNS viewpoint even - though the ACME server can still validate successfully, for example due - to split-horizon DNS or NAT hairpinning. - - A value of 0 skips the self-check and asks the ACME server to validate - immediately after presentation, relying on the ACME server's own - validation retries (RFC 8555 section 8.2) to succeed once the challenge - has propagated. A negative duration is rejected. - Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration, - for example `30s` or `2m`. - type: string - type: object - type: array - x-kubernetes-list-type: atomic - required: - - privateKeySecretRef - - server - type: object + additionalProperties: + type: string ca: description: |- CA configures this issuer to sign certificates using a signing CA keypair stored in a Secret resource. This is used to build internal PKIs that are managed by cert-manager. + type: object + required: + - secretName properties: crlDistributionPoints: description: |- The CRL distribution points is an X.509 v3 certificate extension which identifies the location of the CRL from which the revocation of this certificate can be checked. If not set, certificates will be issued without distribution points set. + type: array items: type: string - type: array - x-kubernetes-list-type: atomic issuingCertificateURLs: description: |- IssuingCertificateURLs is a list of URLs which this issuer should embed into certificates it creates. See https://www.rfc-editor.org/rfc/rfc5280#section-4.2.2.1 for more details. As an example, such a URL might be "http://ca.domain.com/ca.crt". + type: array items: type: string - type: array - x-kubernetes-list-type: atomic ocspServers: description: |- The OCSP server list is an X.509 v3 extension that defines a list of @@ -12275,45 +11396,51 @@ spec: revocation status of an issued certificate. If not set, the certificate will be issued with no OCSP servers set. For example, an OCSP server URL could be "http://ocsp.int-x3.letsencrypt.org". + type: array items: type: string - type: array - x-kubernetes-list-type: atomic secretName: description: |- SecretName is the name of the secret used to sign Certificates issued by this Issuer. type: string - required: - - secretName - type: object selfSigned: description: |- SelfSigned configures this issuer to 'self sign' certificates using the private key used to create the CertificateRequest object. + type: object properties: crlDistributionPoints: description: |- The CRL distribution points is an X.509 v3 certificate extension which identifies the location of the CRL from which the revocation of this certificate can be checked. If not set certificate will be issued without CDP. Values are strings. + type: array items: type: string - type: array - x-kubernetes-list-type: atomic - type: object vault: description: |- Vault configures this issuer to sign certificates using a HashiCorp Vault PKI backend. + type: object + required: + - auth + - path + - server properties: auth: description: Auth configures how cert-manager authenticates with the Vault server. + type: object properties: appRole: description: |- AppRole authenticates with Vault using the App Role auth mechanism, with the role and secret stored in a Kubernetes Secret resource. + type: object + required: + - path + - roleId + - secretRef properties: path: description: |- @@ -12331,6 +11458,9 @@ spec: to authenticate with Vault. The `key` field must be specified and denotes which entry within the Secret resource is used as the app role secret. + type: object + required: + - name properties: key: description: |- @@ -12343,75 +11473,12 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string - required: - - name - type: object - required: - - path - - roleId - - secretRef - type: object - aws: - description: |- - AWS authenticates with Vault using AWS IAM authentication. - This allows authentication using IAM roles for service accounts (IRSA), - EKS Pod Identity (PIA), or ambient credentials (EC2 instance profiles, ECS task role). - properties: - iamRoleArn: - description: |- - The ARN of the AWS IAM role to assume using the Kubernetes service account - token. Required when using IRSA (serviceAccountRef is set). - This role must have a trust policy that allows the OIDC provider to assume it. - type: string - mountPath: - description: |- - The Vault mountPath here is the mount path to use when authenticating with - Vault. For example, setting a value to `/v1/auth/foo`, will use the path - `/v1/auth/foo/login` to authenticate with Vault. If unspecified, the - default value "/v1/auth/aws" will be used. - type: string - region: - description: |- - The AWS region to use for authentication. If not specified, the region - will be determined from AWS_REGION or AWS_DEFAULT_REGION environment - variables, falling back to "us-east-1" if not set. - type: string - role: - description: A required field containing the Vault Role to assume when authenticating. - minLength: 1 - type: string - serviceAccountRef: - description: |- - A reference to a service account that will be used to request a web identity - token for IRSA (IAM Roles for Service Accounts) authentication. - properties: - audiences: - description: |- - TokenAudiences is an optional list of extra audiences to include in the token passed to Vault. - The default audiences are always included in the token. - items: - type: string - type: array - x-kubernetes-list-type: atomic - name: - description: Name of the ServiceAccount used to request a token. - type: string - required: - - name - type: object - vaultHeaderValue: - description: |- - The Vault header value to include in the STS signing request. - This is used to prevent replay attacks. - type: string - required: - - role - type: object clientCertificate: description: |- ClientCertificate authenticates with Vault by presenting a client certificate during the request's TLS handshake. Works only when using HTTPS protocol. + type: object properties: mountPath: description: |- @@ -12431,11 +11498,13 @@ spec: tls.crt and tls.key) used to authenticate to Vault using TLS client authentication. type: string - type: object kubernetes: description: |- Kubernetes authenticates with Vault by passing the ServiceAccount token stored in the named Secret resource to the Vault server. + type: object + required: + - role properties: mountPath: description: |- @@ -12454,6 +11523,9 @@ spec: The required Secret field containing a Kubernetes ServiceAccount JWT used for authenticating with Vault. Use of 'ambient credentials' is not supported. + type: object + required: + - name properties: key: description: |- @@ -12466,9 +11538,6 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string - required: - - name - type: object serviceAccountRef: description: |- A reference to a service account that will be used to request a bound @@ -12476,26 +11545,25 @@ spec: using this field means that you don't rely on statically bound tokens. To use this field, you must configure an RBAC rule to let cert-manager request a token. + type: object + required: + - name properties: audiences: description: |- - TokenAudiences is an optional list of extra audiences to include in the token passed to Vault. - The default audiences are always included in the token. + TokenAudiences is an optional list of extra audiences to include in the token passed to Vault. The default token + consisting of the issuer's namespace and name is always included. + type: array items: type: string - type: array - x-kubernetes-list-type: atomic name: description: Name of the ServiceAccount used to request a token. type: string - required: - - name - type: object - required: - - role - type: object tokenSecretRef: description: TokenSecretRef authenticates with Vault by presenting a token. + type: object + required: + - name properties: key: description: |- @@ -12505,13 +11573,9 @@ spec: type: string name: description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - required: - - name - type: object - type: object + Name of the resource being referred to. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string caBundle: description: |- Base64-encoded bundle of PEM CAs which will be used to validate the certificate @@ -12520,8 +11584,8 @@ spec: Mutually exclusive with CABundleSecretRef. If neither CABundle nor CABundleSecretRef are defined, the certificate bundle in the cert-manager controller container is used to validate the TLS connection. - format: byte type: string + format: byte caBundleSecretRef: description: |- Reference to a Secret containing a bundle of PEM-encoded CAs to use when @@ -12530,6 +11594,9 @@ spec: If neither CABundle nor CABundleSecretRef are defined, the certificate bundle in the cert-manager controller container is used to validate the TLS connection. If no key for the Secret is specified, cert-manager will default to 'ca.crt'. + type: object + required: + - name properties: key: description: |- @@ -12542,13 +11609,13 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string - required: - - name - type: object clientCertSecretRef: description: |- Reference to a Secret containing a PEM-encoded Client Certificate to use when the Vault server requires mTLS. + type: object + required: + - name properties: key: description: |- @@ -12561,13 +11628,13 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string - required: - - name - type: object clientKeySecretRef: description: |- Reference to a Secret containing a PEM-encoded Client Private Key to use when the Vault server requires mTLS. + type: object + required: + - name properties: key: description: |- @@ -12580,9 +11647,6 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string - required: - - name - type: object namespace: description: |- Name of the vault namespace. Namespaces is a set of features within Vault Enterprise that allows Vault environments to support Secure Multi-tenancy. e.g: "ns1" @@ -12596,28 +11660,27 @@ spec: server: description: 'Server is the connection address for the Vault server, e.g: "https://vault.example.com:8200".' type: string - serverName: - description: |- - ServerName is used to verify the hostname on the returned certificates - by the Vault server. - type: string - required: - - auth - - path - - server - type: object venafi: description: |- - Venafi configures this issuer to sign certificates using a CyberArk Certificate Manager Self-Hosted - or SaaS policy zone. + Venafi configures this issuer to sign certificates using a Venafi TPP + or Venafi Cloud policy zone. + type: object + required: + - zone properties: cloud: description: |- - Cloud specifies the CyberArk Certificate Manager SaaS configuration settings. - Only one of CyberArk Certificate Manager may be specified. + Cloud specifies the Venafi cloud configuration settings. + Only one of TPP or Cloud may be specified. + type: object + required: + - apiTokenSecretRef properties: apiTokenSecretRef: - description: APITokenSecretRef is a secret key selector for the CyberArk Certificate Manager SaaS API token. + description: APITokenSecretRef is a secret key selector for the Venafi Cloud API token. + type: object + required: + - name properties: key: description: |- @@ -12630,77 +11693,38 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string - required: - - name - type: object url: description: |- - URL is the base URL for CyberArk Certificate Manager SaaS. - Defaults to "https://api.venafi.cloud/". + URL is the base URL for Venafi Cloud. + Defaults to "https://api.venafi.cloud/v1". type: string - required: - - apiTokenSecretRef - type: object - ngts: + tpp: description: |- - NGTS specifies Palo Alto Networks Next Generation Trust Services (NGTS) configuration - using OAuth 2.0 Client Credentials. Only one of tpp, cloud, or ngts may be specified. - properties: - credentialsRef: - description: |- - CredentialsRef is a reference to a Kubernetes Secret containing the OAuth 2.0 - Client ID and Client Secret. The secret must contain the keys 'client-id' and - 'client-secret'. - properties: - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - required: - - name - type: object - tokenEndpoint: - description: |- - TokenEndpoint is the OAuth 2.0 token endpoint URL used to obtain access tokens, - for example "https://auth.apps.paloaltonetworks.com/oauth2/access_token". - Defaults to "https://auth.apps.paloaltonetworks.com/oauth2/access_token" if not set. - type: string - tsgID: - description: |- - TSGID is the Tenant Service Group ID used to scope the OAuth 2.0 access token, - for example "1234567890". The tsg_id: prefix is added automatically. - This field is required. - type: string - url: - description: |- - URL is the base URL for the NGTS API endpoint. - Defaults to "https://api.strata.paloaltonetworks.com/ngts" if not set. - type: string + TPP specifies Trust Protection Platform configuration settings. + Only one of TPP or Cloud may be specified. + type: object required: - credentialsRef - - tsgID - type: object - tpp: - description: |- - TPP specifies CyberArk Certificate Manager Self-Hosted configuration settings. - Only one of CyberArk Certificate Manager may be specified. + - url properties: caBundle: description: |- Base64-encoded bundle of PEM CAs which will be used to validate the certificate - chain presented by the CyberArk Certificate Manager Self-Hosted server. Only used if using HTTPS; ignored for HTTP. + chain presented by the TPP server. Only used if using HTTPS; ignored for HTTP. If undefined, the certificate bundle in the cert-manager controller container is used to validate the chain. - format: byte type: string + format: byte caBundleSecretRef: description: |- Reference to a Secret containing a base64-encoded bundle of PEM CAs - which will be used to validate the certificate chain presented by the CyberArk Certificate Manager Self-Hosted server. + which will be used to validate the certificate chain presented by the TPP server. Only used if using HTTPS; ignored for HTTP. Mutually exclusive with CABundle. If neither CABundle nor CABundleSecretRef is defined, the certificate bundle in the cert-manager controller container is used to validate the TLS connection. + type: object + required: + - name properties: key: description: |- @@ -12713,131 +11737,385 @@ spec: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string - required: - - name - type: object credentialsRef: description: |- - CredentialsRef is a reference to a Secret containing the CyberArk Certificate Manager Self-Hosted API credentials. + CredentialsRef is a reference to a Secret containing the Venafi TPP API credentials. The secret must contain the key 'access-token' for the Access Token Authentication, or two keys, 'username' and 'password' for the API Keys Authentication. + type: object + required: + - name properties: name: description: |- Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string - required: - - name - type: object url: description: |- - URL is the base URL for the vedsdk endpoint of the CyberArk Certificate Manager Self-Hosted instance, + URL is the base URL for the vedsdk endpoint of the Venafi TPP instance, for example: "https://tpp.example.com/vedsdk". type: string - required: - - credentialsRef - - url - type: object zone: description: |- - Zone is the Certificate Manager Policy Zone to use for this issuer. - All requests made to the Certificate Manager platform will be restricted by the named + Zone is the Venafi Policy Zone to use for this issuer. + All requests made to the Venafi platform will be restricted by the named zone policy. This field is required. type: string - required: - - zone - type: object - x-kubernetes-validations: - - message: exactly one of tpp, cloud, or ngts must be configured - rule: '(has(self.tpp) ? 1 : 0) + (has(self.cloud) ? 1 : 0) + (has(self.ngts) ? 1 : 0) == 1' - type: object status: description: Status of the Issuer. This is set and managed automatically. + type: object properties: acme: description: |- - ACME specific status options. - This field should only be set if the Issuer is configured to use an ACME - server to issue certificates. + ACME specific status options. + This field should only be set if the Issuer is configured to use an ACME + server to issue certificates. + type: object + properties: + lastPrivateKeyHash: + description: |- + LastPrivateKeyHash is a hash of the private key associated with the latest + registered ACME account, in order to track changes made to registered account + associated with the Issuer + type: string + lastRegisteredEmail: + description: |- + LastRegisteredEmail is the email associated with the latest registered + ACME account, in order to track changes made to registered account + associated with the Issuer + type: string + uri: + description: |- + URI is the unique account identifier, which can also be used to retrieve + account details from the CA + type: string + conditions: + description: |- + List of status conditions to indicate the status of a CertificateRequest. + Known condition types are `Ready`. + type: array + items: + description: IssuerCondition contains condition information for an Issuer. + type: object + required: + - status + - type + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the timestamp corresponding to the last status + change of this condition. + type: string + format: date-time + message: + description: |- + Message is a human readable description of the details of the last + transition, complementing reason. + type: string + observedGeneration: + description: |- + If set, this represents the .metadata.generation that the condition was + set based upon. + For instance, if .metadata.generation is currently 12, but the + .status.condition[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the Issuer. + type: integer + format: int64 + reason: + description: |- + Reason is a brief machine readable explanation for the condition's last + transition. + type: string + status: + description: Status of the condition, one of (`True`, `False`, `Unknown`). + type: string + enum: + - "True" + - "False" + - Unknown + type: + description: Type of the condition, known values are (`Ready`). + type: string + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + served: true + storage: true + +# END crd +--- +# Source: cert-manager/templates/crds.yaml +# START crd +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: orders.acme.cert-manager.io + # START annotations + annotations: + helm.sh/resource-policy: keep + # END annotations + labels: + app: 'cert-manager' + app.kubernetes.io/name: 'cert-manager' + app.kubernetes.io/instance: 'cert-manager' + app.kubernetes.io/component: "crds" + # Generated labels + app.kubernetes.io/version: "v1.17.0" + app.kubernetes.io/managed-by: Helm + helm.sh/chart: cert-manager-v1.17.0 +spec: + group: acme.cert-manager.io + names: + kind: Order + listKind: OrderList + plural: orders + singular: order + categories: + - cert-manager + - cert-manager-acme + scope: Namespaced + versions: + - name: v1 + subresources: + status: {} + additionalPrinterColumns: + - jsonPath: .status.state + name: State + type: string + - jsonPath: .spec.issuerRef.name + name: Issuer + priority: 1 + type: string + - jsonPath: .status.reason + name: Reason + priority: 1 + type: string + - jsonPath: .metadata.creationTimestamp + description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. + name: Age + type: date + schema: + openAPIV3Schema: + description: Order is a type to represent an Order with an ACME server + type: object + required: + - metadata + - spec + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + type: object + required: + - issuerRef + - request + properties: + commonName: + description: |- + CommonName is the common name as specified on the DER encoded CSR. + If specified, this value must also be present in `dnsNames` or `ipAddresses`. + This field must match the corresponding field on the DER encoded CSR. + type: string + dnsNames: + description: |- + DNSNames is a list of DNS names that should be included as part of the Order + validation process. + This field must match the corresponding field on the DER encoded CSR. + type: array + items: + type: string + duration: + description: |- + Duration is the duration for the not after date for the requested certificate. + this is set on order creation as pe the ACME spec. + type: string + ipAddresses: + description: |- + IPAddresses is a list of IP addresses that should be included as part of the Order + validation process. + This field must match the corresponding field on the DER encoded CSR. + type: array + items: + type: string + issuerRef: + description: |- + IssuerRef references a properly configured ACME-type Issuer which should + be used to create this Order. + If the Issuer does not exist, processing will be retried. + If the Issuer is not an 'ACME' Issuer, an error will be returned and the + Order will be marked as failed. + type: object + required: + - name properties: - lastPrivateKeyHash: - description: |- - LastPrivateKeyHash is a hash of the private key associated with the latest - registered ACME account, in order to track changes made to registered account - associated with the Issuer + group: + description: Group of the resource being referred to. type: string - lastRegisteredEmail: - description: |- - LastRegisteredEmail is the email associated with the latest registered - ACME account, in order to track changes made to registered account - associated with the Issuer + kind: + description: Kind of the resource being referred to. type: string - uri: - description: |- - URI is the unique account identifier, which can also be used to retrieve - account details from the CA + name: + description: Name of the resource being referred to. type: string - type: object - conditions: + request: description: |- - List of status conditions to indicate the status of a CertificateRequest. - Known condition types are `Ready`. + Certificate signing request bytes in DER encoding. + This will be used when finalizing the order. + This field must be set on the order. + type: string + format: byte + status: + type: object + properties: + authorizations: + description: |- + Authorizations contains data returned from the ACME server on what + authorizations must be completed in order to validate the DNS names + specified on the Order. + type: array items: - description: IssuerCondition contains condition information for an Issuer. + description: |- + ACMEAuthorization contains data returned from the ACME server on an + authorization that must be completed in order validate a DNS name on an ACME + Order resource. + type: object + required: + - url properties: - lastTransitionTime: - description: |- - LastTransitionTime is the timestamp corresponding to the last status - change of this condition. - format: date-time - type: string - message: + challenges: description: |- - Message is a human readable description of the details of the last - transition, complementing reason. + Challenges specifies the challenge types offered by the ACME server. + One of these challenge types will be selected when validating the DNS + name and an appropriate Challenge resource will be created to perform + the ACME challenge process. + type: array + items: + description: |- + Challenge specifies a challenge offered by the ACME server for an Order. + An appropriate Challenge resource can be created to perform the ACME + challenge process. + type: object + required: + - token + - type + - url + properties: + token: + description: |- + Token is the token that must be presented for this challenge. + This is used to compute the 'key' that must also be presented. + type: string + type: + description: |- + Type is the type of challenge being offered, e.g. 'http-01', 'dns-01', + 'tls-sni-01', etc. + This is the raw value retrieved from the ACME server. + Only 'http-01' and 'dns-01' are supported by cert-manager, other values + will be ignored. + type: string + url: + description: |- + URL is the URL of this challenge. It can be used to retrieve additional + metadata about the Challenge from the ACME server. + type: string + identifier: + description: Identifier is the DNS name to be validated as part of this authorization type: string - observedGeneration: - description: |- - If set, this represents the .metadata.generation that the condition was - set based upon. - For instance, if .metadata.generation is currently 12, but the - .status.condition[x].observedGeneration is 9, the condition is out of date - with respect to the current state of the Issuer. - format: int64 - type: integer - reason: + initialState: description: |- - Reason is a brief machine readable explanation for the condition's last - transition. + InitialState is the initial state of the ACME authorization when first + fetched from the ACME server. + If an Authorization is already 'valid', the Order controller will not + create a Challenge resource for the authorization. This will occur when + working with an ACME server that enables 'authz reuse' (such as Let's + Encrypt's production endpoint). + If not set and 'identifier' is set, the state is assumed to be pending + and a Challenge will be created. type: string - status: - description: Status of the condition, one of (`True`, `False`, `Unknown`). enum: - - "True" - - "False" - - Unknown - type: string - type: - description: Type of the condition, known values are (`Ready`). + - valid + - ready + - pending + - processing + - invalid + - expired + - errored + url: + description: URL is the URL of the Authorization that must be completed type: string - required: - - status - - type - type: object - type: array - x-kubernetes-list-map-keys: - - type - x-kubernetes-list-type: map - type: object - required: - - spec - type: object + wildcard: + description: |- + Wildcard will be true if this authorization is for a wildcard DNS name. + If this is true, the identifier will be the *non-wildcard* version of + the DNS name. + For example, if '*.example.com' is the DNS name being validated, this + field will be 'true' and the 'identifier' field will be 'example.com'. + type: boolean + certificate: + description: |- + Certificate is a copy of the PEM encoded certificate for this Order. + This field will be populated after the order has been successfully + finalized with the ACME server, and the order has transitioned to the + 'valid' state. + type: string + format: byte + failureTime: + description: |- + FailureTime stores the time that this order failed. + This is used to influence garbage collection and back-off. + type: string + format: date-time + finalizeURL: + description: |- + FinalizeURL of the Order. + This is used to obtain certificates for this order once it has been completed. + type: string + reason: + description: |- + Reason optionally provides more information about a why the order is in + the current state. + type: string + state: + description: |- + State contains the current state of this Order resource. + States 'success' and 'expired' are 'final' + type: string + enum: + - valid + - ready + - pending + - processing + - invalid + - expired + - errored + url: + description: |- + URL of the Order. + This will initially be empty when the resource is first created. + The Order controller will populate this field when the Order is first processed. + This field will be immutable after it is initially set. + type: string served: true storage: true - subresources: - status: {} + +# END crd --- # Source: cert-manager/templates/cainjector-rbac.yaml @@ -12850,9 +12128,9 @@ metadata: app.kubernetes.io/name: cainjector app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "cainjector" - app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/version: "v1.17.0" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 + helm.sh/chart: cert-manager-v1.17.0 rules: - apiGroups: ["cert-manager.io"] resources: ["certificates"] @@ -12884,9 +12162,9 @@ metadata: app.kubernetes.io/name: cert-manager app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "controller" - app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/version: "v1.17.0" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 + helm.sh/chart: cert-manager-v1.17.0 rules: - apiGroups: ["cert-manager.io"] resources: ["issuers", "issuers/status"] @@ -12912,9 +12190,9 @@ metadata: app.kubernetes.io/name: cert-manager app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "controller" - app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/version: "v1.17.0" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 + helm.sh/chart: cert-manager-v1.17.0 rules: - apiGroups: ["cert-manager.io"] resources: ["clusterissuers", "clusterissuers/status"] @@ -12940,9 +12218,9 @@ metadata: app.kubernetes.io/name: cert-manager app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "controller" - app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/version: "v1.17.0" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 + helm.sh/chart: cert-manager-v1.17.0 rules: - apiGroups: ["cert-manager.io"] resources: ["certificates", "certificates/status", "certificaterequests", "certificaterequests/status"] @@ -12977,9 +12255,9 @@ metadata: app.kubernetes.io/name: cert-manager app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "controller" - app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/version: "v1.17.0" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 + helm.sh/chart: cert-manager-v1.17.0 rules: - apiGroups: ["acme.cert-manager.io"] resources: ["orders", "orders/status"] @@ -12999,9 +12277,6 @@ rules: - apiGroups: ["acme.cert-manager.io"] resources: ["orders/finalizers"] verbs: ["update"] - - apiGroups: ["cert-manager.io"] - resources: ["clusterissuers/finalizers", "issuers/finalizers"] - verbs: ["update"] - apiGroups: [""] resources: ["secrets"] verbs: ["get", "list", "watch"] @@ -13020,9 +12295,9 @@ metadata: app.kubernetes.io/name: cert-manager app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "controller" - app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/version: "v1.17.0" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 + helm.sh/chart: cert-manager-v1.17.0 rules: # Use to update challenge resource status - apiGroups: ["acme.cert-manager.io"] @@ -13051,8 +12326,8 @@ rules: - apiGroups: ["networking.k8s.io"] resources: ["ingresses"] verbs: ["get", "list", "watch", "create", "delete", "update"] - - apiGroups: ["gateway.networking.k8s.io"] - resources: ["httproutes"] + - apiGroups: [ "gateway.networking.k8s.io" ] + resources: [ "httproutes" ] verbs: ["get", "list", "watch", "create", "delete", "update"] # We require the ability to specify a custom hostname when we are creating # new ingress resources. @@ -13082,9 +12357,9 @@ metadata: app.kubernetes.io/name: cert-manager app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "controller" - app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/version: "v1.17.0" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 + helm.sh/chart: cert-manager-v1.17.0 rules: - apiGroups: ["cert-manager.io"] resources: ["certificates", "certificaterequests"] @@ -13102,10 +12377,10 @@ rules: resources: ["ingresses/finalizers"] verbs: ["update"] - apiGroups: ["gateway.networking.k8s.io"] - resources: ["gateways", "httproutes", "listenersets"] + resources: ["gateways", "httproutes"] verbs: ["get", "list", "watch"] - apiGroups: ["gateway.networking.k8s.io"] - resources: ["gateways/finalizers", "httproutes/finalizers", "listenersets/finalizers"] + resources: ["gateways/finalizers", "httproutes/finalizers"] verbs: ["update"] - apiGroups: [""] resources: ["events"] @@ -13121,9 +12396,9 @@ metadata: app.kubernetes.io/name: cert-manager app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "controller" - app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/version: "v1.17.0" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 + helm.sh/chart: cert-manager-v1.17.0 rbac.authorization.k8s.io/aggregate-to-cluster-reader: "true" rules: - apiGroups: ["cert-manager.io"] @@ -13140,9 +12415,9 @@ metadata: app.kubernetes.io/name: cert-manager app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "controller" - app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/version: "v1.17.0" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 + helm.sh/chart: cert-manager-v1.17.0 rbac.authorization.k8s.io/aggregate-to-view: "true" rbac.authorization.k8s.io/aggregate-to-edit: "true" rbac.authorization.k8s.io/aggregate-to-admin: "true" @@ -13165,9 +12440,9 @@ metadata: app.kubernetes.io/name: cert-manager app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "controller" - app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/version: "v1.17.0" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 + helm.sh/chart: cert-manager-v1.17.0 rbac.authorization.k8s.io/aggregate-to-edit: "true" rbac.authorization.k8s.io/aggregate-to-admin: "true" rules: @@ -13178,11 +12453,8 @@ rules: resources: ["certificates/status"] verbs: ["update"] - apiGroups: ["acme.cert-manager.io"] - resources: ["challenges"] - verbs: ["delete", "deletecollection", "patch", "update"] - - apiGroups: ["acme.cert-manager.io"] - resources: ["orders"] - verbs: ["delete", "deletecollection"] + resources: ["challenges", "orders"] + verbs: ["create", "delete", "deletecollection", "patch", "update"] --- # Source: cert-manager/templates/rbac.yaml # Permission to approve CertificateRequests referencing cert-manager.io Issuers and ClusterIssuers @@ -13195,9 +12467,9 @@ metadata: app.kubernetes.io/name: cert-manager app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "cert-manager" - app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/version: "v1.17.0" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 + helm.sh/chart: cert-manager-v1.17.0 rules: - apiGroups: ["cert-manager.io"] resources: ["signers"] @@ -13219,9 +12491,9 @@ metadata: app.kubernetes.io/name: cert-manager app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "cert-manager" - app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/version: "v1.17.0" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 + helm.sh/chart: cert-manager-v1.17.0 rules: - apiGroups: ["certificates.k8s.io"] resources: ["certificatesigningrequests"] @@ -13247,9 +12519,9 @@ metadata: app.kubernetes.io/name: webhook app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "webhook" - app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/version: "v1.17.0" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 + helm.sh/chart: cert-manager-v1.17.0 rules: - apiGroups: ["authorization.k8s.io"] resources: ["subjectaccessreviews"] @@ -13265,9 +12537,9 @@ metadata: app.kubernetes.io/name: cainjector app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "cainjector" - app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/version: "v1.17.0" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 + helm.sh/chart: cert-manager-v1.17.0 roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole @@ -13287,9 +12559,9 @@ metadata: app.kubernetes.io/name: cert-manager app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "controller" - app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/version: "v1.17.0" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 + helm.sh/chart: cert-manager-v1.17.0 roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole @@ -13309,9 +12581,9 @@ metadata: app.kubernetes.io/name: cert-manager app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "controller" - app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/version: "v1.17.0" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 + helm.sh/chart: cert-manager-v1.17.0 roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole @@ -13331,9 +12603,9 @@ metadata: app.kubernetes.io/name: cert-manager app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "controller" - app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/version: "v1.17.0" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 + helm.sh/chart: cert-manager-v1.17.0 roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole @@ -13353,9 +12625,9 @@ metadata: app.kubernetes.io/name: cert-manager app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "controller" - app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/version: "v1.17.0" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 + helm.sh/chart: cert-manager-v1.17.0 roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole @@ -13375,9 +12647,9 @@ metadata: app.kubernetes.io/name: cert-manager app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "controller" - app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/version: "v1.17.0" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 + helm.sh/chart: cert-manager-v1.17.0 roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole @@ -13397,9 +12669,9 @@ metadata: app.kubernetes.io/name: cert-manager app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "controller" - app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/version: "v1.17.0" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 + helm.sh/chart: cert-manager-v1.17.0 roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole @@ -13419,9 +12691,9 @@ metadata: app.kubernetes.io/name: cert-manager app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "cert-manager" - app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/version: "v1.17.0" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 + helm.sh/chart: cert-manager-v1.17.0 roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole @@ -13441,9 +12713,9 @@ metadata: app.kubernetes.io/name: cert-manager app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "cert-manager" - app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/version: "v1.17.0" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 + helm.sh/chart: cert-manager-v1.17.0 roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole @@ -13464,9 +12736,9 @@ metadata: app.kubernetes.io/name: webhook app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "webhook" - app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/version: "v1.17.0" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 + helm.sh/chart: cert-manager-v1.17.0 roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole @@ -13489,9 +12761,9 @@ metadata: app.kubernetes.io/name: cainjector app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "cainjector" - app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/version: "v1.17.0" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 + helm.sh/chart: cert-manager-v1.17.0 rules: # Used for leader election by the controller # cert-manager-cainjector-leader-election is used by the CertificateBased injector controller @@ -13517,9 +12789,9 @@ metadata: app.kubernetes.io/name: cert-manager app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "controller" - app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/version: "v1.17.0" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 + helm.sh/chart: cert-manager-v1.17.0 rules: - apiGroups: ["coordination.k8s.io"] resources: ["leases"] @@ -13529,6 +12801,26 @@ rules: resources: ["leases"] verbs: ["create"] --- +# Source: cert-manager/templates/rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: cert-manager-tokenrequest + namespace: cert-manager + labels: + app: cert-manager + app.kubernetes.io/name: cert-manager + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "controller" + app.kubernetes.io/version: "v1.17.0" + app.kubernetes.io/managed-by: Helm + helm.sh/chart: cert-manager-v1.17.0 +rules: + - apiGroups: [""] + resources: ["serviceaccounts/token"] + resourceNames: ["cert-manager"] + verbs: ["create"] +--- # Source: cert-manager/templates/webhook-rbac.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: Role @@ -13540,9 +12832,9 @@ metadata: app.kubernetes.io/name: webhook app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "webhook" - app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/version: "v1.17.0" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 + helm.sh/chart: cert-manager-v1.17.0 rules: - apiGroups: [""] resources: ["secrets"] @@ -13567,9 +12859,9 @@ metadata: app.kubernetes.io/name: cainjector app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "cainjector" - app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/version: "v1.17.0" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 + helm.sh/chart: cert-manager-v1.17.0 roleRef: apiGroup: rbac.authorization.k8s.io kind: Role @@ -13593,9 +12885,9 @@ metadata: app.kubernetes.io/name: cert-manager app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "controller" - app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/version: "v1.17.0" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 + helm.sh/chart: cert-manager-v1.17.0 roleRef: apiGroup: rbac.authorization.k8s.io kind: Role @@ -13605,6 +12897,30 @@ subjects: name: cert-manager namespace: cert-manager --- +# Source: cert-manager/templates/rbac.yaml +# grant cert-manager permission to create tokens for the serviceaccount +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: cert-manager-cert-manager-tokenrequest + namespace: cert-manager + labels: + app: cert-manager + app.kubernetes.io/name: cert-manager + app.kubernetes.io/instance: cert-manager + app.kubernetes.io/component: "controller" + app.kubernetes.io/version: "v1.17.0" + app.kubernetes.io/managed-by: Helm + helm.sh/chart: cert-manager-v1.17.0 +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: cert-manager-tokenrequest +subjects: + - kind: ServiceAccount + name: cert-manager + namespace: cert-manager +--- # Source: cert-manager/templates/webhook-rbac.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding @@ -13616,9 +12932,9 @@ metadata: app.kubernetes.io/name: webhook app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "webhook" - app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/version: "v1.17.0" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 + helm.sh/chart: cert-manager-v1.17.0 roleRef: apiGroup: rbac.authorization.k8s.io kind: Role @@ -13639,9 +12955,9 @@ metadata: app.kubernetes.io/name: cainjector app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "cainjector" - app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/version: "v1.17.0" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 + helm.sh/chart: cert-manager-v1.17.0 spec: type: ClusterIP ports: @@ -13665,15 +12981,16 @@ metadata: app.kubernetes.io/name: cert-manager app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "controller" - app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/version: "v1.17.0" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 + helm.sh/chart: cert-manager-v1.17.0 spec: type: ClusterIP ports: - protocol: TCP port: 9402 - name: http-metrics + name: tcp-prometheus-servicemonitor + targetPort: 9402 selector: app.kubernetes.io/name: cert-manager app.kubernetes.io/instance: cert-manager @@ -13691,9 +13008,9 @@ metadata: app.kubernetes.io/name: webhook app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "webhook" - app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/version: "v1.17.0" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 + helm.sh/chart: cert-manager-v1.17.0 spec: type: ClusterIP ports: @@ -13722,9 +13039,9 @@ metadata: app.kubernetes.io/name: cainjector app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "cainjector" - app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/version: "v1.17.0" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 + helm.sh/chart: cert-manager-v1.17.0 spec: replicas: 1 selector: @@ -13739,9 +13056,9 @@ spec: app.kubernetes.io/name: cainjector app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "cainjector" - app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/version: "v1.17.0" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 + helm.sh/chart: cert-manager-v1.17.0 annotations: prometheus.io/path: "/metrics" prometheus.io/scrape: 'true' @@ -13755,7 +13072,7 @@ spec: type: RuntimeDefault containers: - name: cert-manager-cainjector - image: "quay.io/jetstack/cert-manager-cainjector:v1.21.1" + image: "quay.io/jetstack/cert-manager-cainjector:v1.17.0" imagePullPolicy: IfNotPresent args: - --v=2 @@ -13776,7 +13093,7 @@ spec: - ALL readOnlyRootFilesystem: true nodeSelector: - kubernetes.io/os: "linux" + kubernetes.io/os: linux --- # Source: cert-manager/templates/deployment.yaml @@ -13790,9 +13107,9 @@ metadata: app.kubernetes.io/name: cert-manager app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "controller" - app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/version: "v1.17.0" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 + helm.sh/chart: cert-manager-v1.17.0 spec: replicas: 1 selector: @@ -13807,9 +13124,9 @@ spec: app.kubernetes.io/name: cert-manager app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "controller" - app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/version: "v1.17.0" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 + helm.sh/chart: cert-manager-v1.17.0 annotations: prometheus.io/path: "/metrics" prometheus.io/scrape: 'true' @@ -13823,13 +13140,13 @@ spec: type: RuntimeDefault containers: - name: cert-manager-controller - image: "quay.io/jetstack/cert-manager-controller:v1.21.1" + image: "quay.io/jetstack/cert-manager-controller:v1.17.0" imagePullPolicy: IfNotPresent args: - --v=2 - --cluster-resource-namespace=$(POD_NAMESPACE) - --leader-election-namespace=cert-manager - - --acme-http01-solver-image=quay.io/jetstack/cert-manager-acmesolver:v1.21.1 + - --acme-http01-solver-image=quay.io/jetstack/cert-manager-acmesolver:v1.17.0 - --max-concurrent-challenges=60 ports: - containerPort: 9402 @@ -13863,8 +13180,7 @@ spec: successThreshold: 1 failureThreshold: 8 nodeSelector: - kubernetes.io/os: "linux" - + kubernetes.io/os: linux --- # Source: cert-manager/templates/webhook-deployment.yaml apiVersion: apps/v1 @@ -13877,9 +13193,9 @@ metadata: app.kubernetes.io/name: webhook app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "webhook" - app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/version: "v1.17.0" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 + helm.sh/chart: cert-manager-v1.17.0 spec: replicas: 1 selector: @@ -13894,9 +13210,9 @@ spec: app.kubernetes.io/name: webhook app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "webhook" - app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/version: "v1.17.0" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 + helm.sh/chart: cert-manager-v1.17.0 annotations: prometheus.io/path: "/metrics" prometheus.io/scrape: 'true' @@ -13910,7 +13226,7 @@ spec: type: RuntimeDefault containers: - name: cert-manager-webhook - image: "quay.io/jetstack/cert-manager-webhook:v1.21.1" + image: "quay.io/jetstack/cert-manager-webhook:v1.17.0" imagePullPolicy: IfNotPresent args: - --v=2 @@ -13920,6 +13236,7 @@ spec: - --dynamic-serving-dns-names=cert-manager-webhook - --dynamic-serving-dns-names=cert-manager-webhook.$(POD_NAMESPACE) - --dynamic-serving-dns-names=cert-manager-webhook.$(POD_NAMESPACE).svc + ports: - name: https protocol: TCP @@ -13933,7 +13250,7 @@ spec: livenessProbe: httpGet: path: /livez - port: healthcheck + port: 6080 scheme: HTTP initialDelaySeconds: 60 periodSeconds: 10 @@ -13943,7 +13260,7 @@ spec: readinessProbe: httpGet: path: /healthz - port: healthcheck + port: 6080 scheme: HTTP initialDelaySeconds: 5 periodSeconds: 5 @@ -13962,7 +13279,7 @@ spec: fieldRef: fieldPath: metadata.namespace nodeSelector: - kubernetes.io/os: "linux" + kubernetes.io/os: linux --- # Source: cert-manager/templates/webhook-mutating-webhook.yaml @@ -13975,9 +13292,9 @@ metadata: app.kubernetes.io/name: webhook app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "webhook" - app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/version: "v1.17.0" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 + helm.sh/chart: cert-manager-v1.17.0 annotations: cert-manager.io/inject-ca-from-secret: "cert-manager/cert-manager-webhook-ca" webhooks: @@ -14016,9 +13333,9 @@ metadata: app.kubernetes.io/name: webhook app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "webhook" - app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/version: "v1.17.0" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 + helm.sh/chart: cert-manager-v1.17.0 annotations: cert-manager.io/inject-ca-from-secret: "cert-manager/cert-manager-webhook-ca" webhooks: @@ -14070,9 +13387,9 @@ metadata: app.kubernetes.io/name: startupapicheck app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "startupapicheck" - app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/version: "v1.17.0" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 + helm.sh/chart: cert-manager-v1.17.0 --- # Source: cert-manager/templates/startupapicheck-rbac.yaml @@ -14087,9 +13404,9 @@ metadata: app.kubernetes.io/name: startupapicheck app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "startupapicheck" - app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/version: "v1.17.0" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 + helm.sh/chart: cert-manager-v1.17.0 annotations: helm.sh/hook: post-install helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded @@ -14110,9 +13427,9 @@ metadata: app.kubernetes.io/name: startupapicheck app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "startupapicheck" - app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/version: "v1.17.0" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 + helm.sh/chart: cert-manager-v1.17.0 annotations: helm.sh/hook: post-install helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded @@ -14138,9 +13455,9 @@ metadata: app.kubernetes.io/name: startupapicheck app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "startupapicheck" - app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/version: "v1.17.0" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 + helm.sh/chart: cert-manager-v1.17.0 annotations: helm.sh/hook: post-install helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded @@ -14154,9 +13471,9 @@ spec: app.kubernetes.io/name: startupapicheck app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "startupapicheck" - app.kubernetes.io/version: "v1.21.1" + app.kubernetes.io/version: "v1.17.0" app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 + helm.sh/chart: cert-manager-v1.17.0 spec: restartPolicy: OnFailure serviceAccountName: cert-manager-startupapicheck @@ -14167,7 +13484,7 @@ spec: type: RuntimeDefault containers: - name: cert-manager-startupapicheck - image: "quay.io/jetstack/cert-manager-startupapicheck:v1.21.1" + image: "quay.io/jetstack/cert-manager-startupapicheck:v1.17.0" imagePullPolicy: IfNotPresent args: - check @@ -14186,5 +13503,5 @@ spec: fieldRef: fieldPath: metadata.namespace nodeSelector: - kubernetes.io/os: "linux" + kubernetes.io/os: linux diff --git a/packages/manifests/operators/cert-manager/v1.17.0.yaml b/packages/manifests/operators/cert-manager/v1.17.0.yaml index 5ad6d83..a0a5053 100644 --- a/packages/manifests/operators/cert-manager/v1.17.0.yaml +++ b/packages/manifests/operators/cert-manager/v1.17.0.yaml @@ -25,6 +25,7 @@ metadata: app.kubernetes.io/version: "v1.17.0" app.kubernetes.io/managed-by: Helm helm.sh/chart: cert-manager-v1.17.0 + --- # Source: cert-manager/templates/serviceaccount.yaml apiVersion: v1 @@ -41,6 +42,7 @@ metadata: app.kubernetes.io/version: "v1.17.0" app.kubernetes.io/managed-by: Helm helm.sh/chart: cert-manager-v1.17.0 + --- # Source: cert-manager/templates/webhook-serviceaccount.yaml apiVersion: v1 @@ -57,6 +59,7 @@ metadata: app.kubernetes.io/version: "v1.17.0" app.kubernetes.io/managed-by: Helm helm.sh/chart: cert-manager-v1.17.0 + --- # Source: cert-manager/templates/crds.yaml # @@ -12113,6 +12116,7 @@ spec: storage: true # END crd + --- # Source: cert-manager/templates/cainjector-rbac.yaml apiVersion: rbac.authorization.k8s.io/v1 @@ -12720,6 +12724,7 @@ subjects: - name: cert-manager namespace: cert-manager kind: ServiceAccount + --- # Source: cert-manager/templates/webhook-rbac.yaml apiVersion: rbac.authorization.k8s.io/v1 @@ -12742,6 +12747,7 @@ subjects: - kind: ServiceAccount name: cert-manager-webhook namespace: cert-manager + --- # Source: cert-manager/templates/cainjector-rbac.yaml # leader election rules @@ -12864,6 +12870,7 @@ subjects: - kind: ServiceAccount name: cert-manager-cainjector namespace: cert-manager + --- # Source: cert-manager/templates/rbac.yaml # grant cert-manager permission to manage the leaderelection configmap in the @@ -12961,6 +12968,7 @@ spec: app.kubernetes.io/name: cainjector app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "cainjector" + --- # Source: cert-manager/templates/service.yaml apiVersion: v1 @@ -12987,6 +12995,7 @@ spec: app.kubernetes.io/name: cert-manager app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "controller" + --- # Source: cert-manager/templates/webhook-service.yaml apiVersion: v1 @@ -13017,6 +13026,7 @@ spec: app.kubernetes.io/name: webhook app.kubernetes.io/instance: cert-manager app.kubernetes.io/component: "webhook" + --- # Source: cert-manager/templates/cainjector-deployment.yaml apiVersion: apps/v1 @@ -13084,6 +13094,7 @@ spec: readOnlyRootFilesystem: true nodeSelector: kubernetes.io/os: linux + --- # Source: cert-manager/templates/deployment.yaml apiVersion: apps/v1 @@ -13269,6 +13280,7 @@ spec: fieldPath: metadata.namespace nodeSelector: kubernetes.io/os: linux + --- # Source: cert-manager/templates/webhook-mutating-webhook.yaml apiVersion: admissionregistration.k8s.io/v1 @@ -13378,6 +13390,7 @@ metadata: app.kubernetes.io/version: "v1.17.0" app.kubernetes.io/managed-by: Helm helm.sh/chart: cert-manager-v1.17.0 + --- # Source: cert-manager/templates/startupapicheck-rbac.yaml # create certificate role @@ -13429,6 +13442,7 @@ subjects: - kind: ServiceAccount name: cert-manager-startupapicheck namespace: cert-manager + --- # Source: cert-manager/templates/startupapicheck-job.yaml apiVersion: batch/v1 diff --git a/packages/manifests/operators/cert-manager/v1.21.1.yaml b/packages/manifests/operators/cert-manager/v1.21.1.yaml deleted file mode 100644 index 6a83c36..0000000 --- a/packages/manifests/operators/cert-manager/v1.21.1.yaml +++ /dev/null @@ -1,14190 +0,0 @@ -# Source: jetstack/cert-manager@v1.21.1 ---- -# Added by pull-manifests.ts to ensure namespace exists -apiVersion: v1 -kind: Namespace -metadata: - name: cert-manager - labels: - app.kubernetes.io/name: cert-manager - ---- ---- -# Source: cert-manager/templates/cainjector-serviceaccount.yaml -apiVersion: v1 -kind: ServiceAccount -automountServiceAccountToken: true -metadata: - name: cert-manager-cainjector - namespace: cert-manager - labels: - app: cainjector - app.kubernetes.io/name: cainjector - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/component: "cainjector" - app.kubernetes.io/version: "v1.21.1" - app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 - ---- -# Source: cert-manager/templates/serviceaccount.yaml -apiVersion: v1 -kind: ServiceAccount -automountServiceAccountToken: true -metadata: - name: cert-manager - namespace: cert-manager - labels: - app: cert-manager - app.kubernetes.io/name: cert-manager - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/component: "controller" - app.kubernetes.io/version: "v1.21.1" - app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 - ---- -# Source: cert-manager/templates/webhook-serviceaccount.yaml -apiVersion: v1 -kind: ServiceAccount -automountServiceAccountToken: true -metadata: - name: cert-manager-webhook - namespace: cert-manager - labels: - app: webhook - app.kubernetes.io/name: webhook - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/component: "webhook" - app.kubernetes.io/version: "v1.21.1" - app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 - ---- -# Source: cert-manager/templates/crd-acme.cert-manager.io_challenges.yaml -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - name: "challenges.acme.cert-manager.io" - annotations: - helm.sh/resource-policy: keep - labels: - app: "cert-manager" - app.kubernetes.io/name: "cert-manager" - app.kubernetes.io/instance: "cert-manager" - app.kubernetes.io/component: "crds" - app.kubernetes.io/version: "v1.21.1" - app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 -spec: - group: acme.cert-manager.io - names: - categories: - - cert-manager - - cert-manager-acme - kind: Challenge - listKind: ChallengeList - plural: challenges - singular: challenge - scope: Namespaced - versions: - - additionalPrinterColumns: - - jsonPath: .status.state - name: State - type: string - - jsonPath: .spec.dnsName - name: Domain - type: string - - jsonPath: .status.reason - name: Reason - priority: 1 - type: string - - description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1 - schema: - openAPIV3Schema: - description: Challenge is a type to represent a Challenge request with an ACME server - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - properties: - authorizationURL: - description: |- - The URL to the ACME Authorization resource that this - challenge is a part of. - type: string - dnsName: - description: |- - dnsName is the identifier that this challenge is for, e.g., example.com. - If the requested DNSName is a 'wildcard', this field MUST be set to the - non-wildcard domain, e.g., for `*.example.com`, it must be `example.com`. - type: string - issuerRef: - description: |- - References a properly configured ACME-type Issuer which should - be used to create this Challenge. - If the Issuer does not exist, processing will be retried. - If the Issuer is not an 'ACME' Issuer, an error will be returned and the - Challenge will be marked as failed. - properties: - group: - description: |- - Group of the issuer being referred to. - Defaults to 'cert-manager.io'. - type: string - kind: - description: |- - Kind of the issuer being referred to. - Defaults to 'Issuer'. - type: string - name: - description: Name of the issuer being referred to. - type: string - required: - - name - type: object - key: - description: |- - The ACME challenge key for this challenge - For HTTP01 challenges, this is the value that must be responded with to - complete the HTTP01 challenge in the format: - `.`. - For DNS01 challenges, this is the base64 encoded SHA256 sum of the - `.` - text that must be set as the TXT record content. - type: string - solver: - description: |- - Contains the domain solving configuration that should be used to - solve this challenge resource. - properties: - dns01: - description: |- - Configures cert-manager to attempt to complete authorizations by - performing the DNS01 challenge flow. - properties: - acmeDNS: - description: |- - Use the 'ACME DNS' (https://github.com/joohoi/acme-dns) API to manage - DNS01 challenge records. - properties: - accountSecretRef: - description: |- - A reference to a specific 'key' within a Secret resource. - In some instances, `key` is a required field. - properties: - key: - description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. - type: string - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - required: - - name - type: object - host: - type: string - required: - - accountSecretRef - - host - type: object - akamai: - description: Use the Akamai DNS zone management API to manage DNS01 challenge records. - properties: - accessTokenSecretRef: - description: |- - A reference to a specific 'key' within a Secret resource. - In some instances, `key` is a required field. - properties: - key: - description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. - type: string - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - required: - - name - type: object - clientSecretSecretRef: - description: |- - A reference to a specific 'key' within a Secret resource. - In some instances, `key` is a required field. - properties: - key: - description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. - type: string - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - required: - - name - type: object - clientTokenSecretRef: - description: |- - A reference to a specific 'key' within a Secret resource. - In some instances, `key` is a required field. - properties: - key: - description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. - type: string - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - required: - - name - type: object - serviceConsumerDomain: - type: string - required: - - accessTokenSecretRef - - clientSecretSecretRef - - clientTokenSecretRef - - serviceConsumerDomain - type: object - azureDNS: - description: Use the Microsoft Azure DNS API to manage DNS01 challenge records. - properties: - clientID: - description: |- - Auth: Azure Service Principal: - The ClientID of the Azure Service Principal used to authenticate with Azure DNS. - If set, ClientSecret and TenantID must also be set. - type: string - clientSecretSecretRef: - description: |- - Auth: Azure Service Principal: - A reference to a Secret containing the password associated with the Service Principal. - If set, ClientID and TenantID must also be set. - properties: - key: - description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. - type: string - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - required: - - name - type: object - environment: - description: name of the Azure environment (default AzurePublicCloud) - enum: - - AzurePublicCloud - - AzureChinaCloud - - AzureGermanCloud - - AzureUSGovernmentCloud - type: string - hostedZoneName: - description: name of the DNS zone that should be used - type: string - managedIdentity: - description: |- - Auth: Azure Workload Identity or Azure Managed Service Identity: - Settings to enable Azure Workload Identity or Azure Managed Service Identity - If set, ClientID, ClientSecret and TenantID must not be set. - properties: - clientID: - description: client ID of the managed identity, cannot be used at the same time as resourceID - type: string - resourceID: - description: |- - resource ID of the managed identity, cannot be used at the same time as clientID - Cannot be used for Azure Managed Service Identity - type: string - tenantID: - description: tenant ID of the managed identity, cannot be used at the same time as resourceID - type: string - type: object - resourceGroupName: - description: resource group the DNS zone is located in - type: string - subscriptionID: - description: ID of the Azure subscription - type: string - tenantID: - description: |- - Auth: Azure Service Principal: - The TenantID of the Azure Service Principal used to authenticate with Azure DNS. - If set, ClientID and ClientSecret must also be set. - type: string - zoneType: - description: |- - ZoneType determines which type of Azure DNS zone to use. - - Valid values are: - - AzurePublicZone (default): Use a public Azure DNS zone. - - AzurePrivateZone: Use an Azure Private DNS zone. - - If not specified, AzurePublicZone is used. - - Support for Azure Private DNS zones is currently - experimental and may change in future releases. - enum: - - AzurePublicZone - - AzurePrivateZone - type: string - required: - - resourceGroupName - - subscriptionID - type: object - cloudDNS: - description: Use the Google Cloud DNS API to manage DNS01 challenge records. - properties: - hostedZoneName: - description: |- - HostedZoneName is an optional field that tells cert-manager in which - Cloud DNS zone the challenge record has to be created. - If left empty cert-manager will automatically choose a zone. - type: string - project: - type: string - serviceAccountSecretRef: - description: |- - A reference to a specific 'key' within a Secret resource. - In some instances, `key` is a required field. - properties: - key: - description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. - type: string - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - required: - - name - type: object - required: - - project - type: object - cloudflare: - description: Use the Cloudflare API to manage DNS01 challenge records. - properties: - apiKeySecretRef: - description: |- - API key to use to authenticate with Cloudflare. - Note: using an API token to authenticate is now the recommended method - as it allows greater control of permissions. - properties: - key: - description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. - type: string - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - required: - - name - type: object - apiTokenSecretRef: - description: API token used to authenticate with Cloudflare. - properties: - key: - description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. - type: string - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - required: - - name - type: object - email: - description: Email of the account, only required when using API key based authentication. - type: string - type: object - cnameStrategy: - description: |- - CNAMEStrategy configures how the DNS01 provider should handle CNAME - records when found in DNS zones. - enum: - - None - - Follow - type: string - digitalocean: - description: Use the DigitalOcean DNS API to manage DNS01 challenge records. - properties: - tokenSecretRef: - description: |- - A reference to a specific 'key' within a Secret resource. - In some instances, `key` is a required field. - properties: - key: - description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. - type: string - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - required: - - name - type: object - required: - - tokenSecretRef - type: object - rfc2136: - description: |- - Use RFC2136 ("Dynamic Updates in the Domain Name System") (https://datatracker.ietf.org/doc/rfc2136/) - to manage DNS01 challenge records. - properties: - nameserver: - description: |- - The IP address or hostname of an authoritative DNS server supporting - RFC2136 in the form host:port. If the host is an IPv6 address it must be - enclosed in square brackets (e.g [2001:db8::1]); port is optional. - This field is required. - type: string - protocol: - description: Protocol to use for dynamic DNS update queries. Valid values are (case-sensitive) ``TCP`` and ``UDP``; ``UDP`` (default). - enum: - - TCP - - UDP - type: string - tsigAlgorithm: - description: |- - The TSIG Algorithm configured in the DNS supporting RFC2136. Used only - when ``tsigSecretSecretRef`` and ``tsigKeyName`` are defined. - Supported values are (case-insensitive): ``HMACMD5`` (default), - ``HMACSHA1``, ``HMACSHA256`` or ``HMACSHA512``. - type: string - tsigKeyName: - description: |- - The TSIG Key name configured in the DNS. - If ``tsigSecretSecretRef`` is defined, this field is required. - type: string - tsigSecretSecretRef: - description: |- - The name of the secret containing the TSIG value. - If ``tsigKeyName`` is defined, this field is required. - properties: - key: - description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. - type: string - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - required: - - name - type: object - required: - - nameserver - type: object - route53: - description: Use the AWS Route53 API to manage DNS01 challenge records. - properties: - accessKeyID: - description: |- - The AccessKeyID is used for authentication. - Cannot be set when SecretAccessKeyID is set. - If neither the Access Key nor Key ID are set, we fall back to using env - vars, shared credentials file, or AWS Instance metadata, - see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials - type: string - accessKeyIDSecretRef: - description: |- - The SecretAccessKey is used for authentication. If set, pull the AWS - access key ID from a key within a Kubernetes Secret. - Cannot be set when AccessKeyID is set. - If neither the Access Key nor Key ID are set, we fall back to using env - vars, shared credentials file, or AWS Instance metadata, - see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials - properties: - key: - description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. - type: string - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - required: - - name - type: object - auth: - description: Auth configures how cert-manager authenticates. - properties: - kubernetes: - description: |- - Kubernetes authenticates with Route53 using AssumeRoleWithWebIdentity - by passing a bound ServiceAccount token. - properties: - serviceAccountRef: - description: |- - A reference to a service account that will be used to request a bound - token (also known as "projected token"). To use this field, you must - configure an RBAC rule to let cert-manager request a token. - properties: - audiences: - description: |- - TokenAudiences is an optional list of audiences to include in the - token passed to AWS. The default token consisting of the issuer's namespace - and name is always included. - If unset the audience defaults to `sts.amazonaws.com`. - items: - type: string - type: array - x-kubernetes-list-type: atomic - name: - description: Name of the ServiceAccount used to request a token. - type: string - required: - - name - type: object - required: - - serviceAccountRef - type: object - required: - - kubernetes - type: object - hostedZoneID: - description: If set, the provider will manage only this zone in Route53 and will not do a lookup using the route53:ListHostedZonesByName api call. - type: string - region: - description: |- - Override the AWS region. - - Route53 is a global service and does not have regional endpoints but the - region specified here (or via environment variables) is used as a hint to - help compute the correct AWS credential scope and partition when it - connects to Route53. See: - - [Amazon Route 53 endpoints and quotas](https://docs.aws.amazon.com/general/latest/gr/r53.html) - - [Global services](https://docs.aws.amazon.com/whitepapers/latest/aws-fault-isolation-boundaries/global-services.html) - - If you omit this region field, cert-manager will use the region from - AWS_REGION and AWS_DEFAULT_REGION environment variables, if they are set - in the cert-manager controller Pod. - - The `region` field is not needed if you use [IAM Roles for Service Accounts (IRSA)](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html). - Instead an AWS_REGION environment variable is added to the cert-manager controller Pod by: - [Amazon EKS Pod Identity Webhook](https://github.com/aws/amazon-eks-pod-identity-webhook). - In this case this `region` field value is ignored. - - The `region` field is not needed if you use [EKS Pod Identities](https://docs.aws.amazon.com/eks/latest/userguide/pod-identities.html). - Instead an AWS_REGION environment variable is added to the cert-manager controller Pod by: - [Amazon EKS Pod Identity Agent](https://github.com/aws/eks-pod-identity-agent), - In this case this `region` field value is ignored. - type: string - role: - description: |- - Role is a Role ARN which the Route53 provider will assume using either the explicit credentials AccessKeyID/SecretAccessKey - or the inferred credentials from environment variables, shared credentials file or AWS Instance metadata - type: string - secretAccessKeySecretRef: - description: |- - The SecretAccessKey is used for authentication. - If neither the Access Key nor Key ID are set, we fall back to using env - vars, shared credentials file, or AWS Instance metadata, - see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials - properties: - key: - description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. - type: string - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - required: - - name - type: object - type: object - webhook: - description: |- - Configure an external webhook based DNS01 challenge solver to manage - DNS01 challenge records. - properties: - config: - description: |- - Additional configuration that should be passed to the webhook apiserver - when challenges are processed. - This can contain arbitrary JSON data. - Secret values should not be specified in this stanza. - If secret values are needed (e.g., credentials for a DNS service), you - should use a SecretKeySelector to reference a Secret resource. - For details on the schema of this field, consult the webhook provider - implementation's documentation. - x-kubernetes-preserve-unknown-fields: true - groupName: - description: |- - The API group name that should be used when POSTing ChallengePayload - resources to the webhook apiserver. - This should be the same as the GroupName specified in the webhook - provider implementation. - type: string - solverName: - description: |- - The name of the solver to use, as defined in the webhook provider - implementation. - This will typically be the name of the provider, e.g., 'cloudflare'. - type: string - required: - - groupName - - solverName - type: object - type: object - http01: - description: |- - Configures cert-manager to attempt to complete authorizations by - performing the HTTP01 challenge flow. - It is not possible to obtain certificates for wildcard domain names - (e.g., `*.example.com`) using the HTTP01 challenge mechanism. - properties: - gatewayHTTPRoute: - description: |- - The Gateway API is a sig-network community API that models service networking - in Kubernetes (https://gateway-api.sigs.k8s.io/). The Gateway solver will - create HTTPRoutes with the specified labels in the same namespace as the challenge. - This solver is experimental, and fields / behaviour may change in the future. - properties: - labels: - additionalProperties: - type: string - description: |- - Custom labels that will be applied to HTTPRoutes created by cert-manager - while solving HTTP-01 challenges. - type: object - parentRefs: - description: |- - When solving an HTTP-01 challenge, cert-manager creates an HTTPRoute. - cert-manager needs to know which parentRefs should be used when creating - the HTTPRoute. Usually, the parentRef references a Gateway. See: - https://gateway-api.sigs.k8s.io/api-types/httproute/#attaching-to-gateways - items: - description: |- - ParentReference identifies an API object (usually a Gateway) that can be considered - a parent of this resource (usually a route). There are two kinds of parent resources - with "Core" support: - - * Gateway (Gateway conformance profile) - * Service (Mesh conformance profile, ClusterIP Services only) - - This API may be extended in the future to support additional kinds of parent - resources. - - The API object must be valid in the cluster; the Group and Kind must - be registered in the cluster for this reference to be valid. - properties: - group: - default: gateway.networking.k8s.io - description: |- - Group is the group of the referent. - When unspecified, "gateway.networking.k8s.io" is inferred. - To set the core API group (such as for a "Service" kind referent), - Group must be explicitly set to "" (empty string). - - Support: Core - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - default: Gateway - description: |- - Kind is kind of the referent. - - There are two kinds of parent resources with "Core" support: - - * Gateway (Gateway conformance profile) - * Service (Mesh conformance profile, ClusterIP Services only) - - Support for other resources is Implementation-Specific. - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: |- - Name is the name of the referent. - - Support: Core - maxLength: 253 - minLength: 1 - type: string - namespace: - description: |- - Namespace is the namespace of the referent. When unspecified, this refers - to the local namespace of the Route. - - Note that there are specific rules for ParentRefs which cross namespace - boundaries. Cross-namespace references are only valid if they are explicitly - allowed by something in the namespace they are referring to. For example: - Gateway has the AllowedRoutes field, and ReferenceGrant provides a - generic way to enable any other kind of cross-namespace reference. - - - ParentRefs from a Route to a Service in the same namespace are "producer" - routes, which apply default routing rules to inbound connections from - any namespace to the Service. - - ParentRefs from a Route to a Service in a different namespace are - "consumer" routes, and these routing rules are only applied to outbound - connections originating from the same namespace as the Route, for which - the intended destination of the connections are a Service targeted as a - ParentRef of the Route. - - - Support: Core - maxLength: 63 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ - type: string - port: - description: |- - Port is the network port this Route targets. It can be interpreted - differently based on the type of parent resource. - - When the parent resource is a Gateway, this targets all listeners - listening on the specified port that also support this kind of Route(and - select this Route). It's not recommended to set `Port` unless the - networking behaviors specified in a Route must apply to a specific port - as opposed to a listener(s) whose port(s) may be changed. When both Port - and SectionName are specified, the name and port of the selected listener - must match both specified values. - - - When the parent resource is a Service, this targets a specific port in the - Service spec. When both Port (experimental) and SectionName are specified, - the name and port of the selected port must match both specified values. - - - Implementations MAY choose to support other parent resources. - Implementations supporting other types of parent resources MUST clearly - document how/if Port is interpreted. - - For the purpose of status, an attachment is considered successful as - long as the parent resource accepts it partially. For example, Gateway - listeners can restrict which Routes can attach to them by Route kind, - namespace, or hostname. If 1 of 2 Gateway listeners accept attachment - from the referencing Route, the Route MUST be considered successfully - attached. If no Gateway listeners accept attachment from this Route, - the Route MUST be considered detached from the Gateway. - - Support: Extended - format: int32 - maximum: 65535 - minimum: 1 - type: integer - sectionName: - description: |- - SectionName is the name of a section within the target resource. In the - following resources, SectionName is interpreted as the following: - - * Gateway: Listener name. When both Port (experimental) and SectionName - are specified, the name and port of the selected listener must match - both specified values. - * Service: Port name. When both Port (experimental) and SectionName - are specified, the name and port of the selected listener must match - both specified values. - - Implementations MAY choose to support attaching Routes to other resources. - If that is the case, they MUST clearly document how SectionName is - interpreted. - - When unspecified (empty string), this will reference the entire resource. - For the purpose of status, an attachment is considered successful if at - least one section in the parent resource accepts it. For example, Gateway - listeners can restrict which Routes can attach to them by Route kind, - namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from - the referencing Route, the Route MUST be considered successfully - attached. If no Gateway listeners accept attachment from this Route, the - Route MUST be considered detached from the Gateway. - - Support: Core - maxLength: 253 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - required: - - name - type: object - type: array - x-kubernetes-list-type: atomic - podTemplate: - description: |- - Optional pod template used to configure the ACME challenge solver pods - used for HTTP01 challenges. - properties: - metadata: - description: |- - ObjectMeta overrides for the pod used to solve HTTP01 challenges. - Only the 'labels' and 'annotations' fields may be set. - If labels or annotations overlap with in-built values, the values here - will override the in-built values. - properties: - annotations: - additionalProperties: - type: string - description: Annotations that should be added to the created ACME HTTP01 solver pods. - type: object - labels: - additionalProperties: - type: string - description: Labels that should be added to the created ACME HTTP01 solver pods. - type: object - type: object - spec: - description: |- - PodSpec defines overrides for the HTTP01 challenge solver pod. - Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields. - All other fields will be ignored. - properties: - affinity: - description: If specified, the pod's scheduling constraints - properties: - nodeAffinity: - description: Describes node affinity scheduling rules for the pod. - properties: - preferredDuringSchedulingIgnoredDuringExecution: - description: |- - The scheduler will prefer to schedule pods to nodes that satisfy - the affinity expressions specified by this field, but it may choose - a node that violates one or more of the expressions. The node that is - most preferred is the one with the greatest sum of weights, i.e. - for each node that meets all of the scheduling requirements (resource - request, requiredDuringScheduling affinity expressions, etc.), - compute a sum by iterating through the elements of this field and adding - "weight" to the sum if the node matches the corresponding matchExpressions; the - node(s) with the highest sum are the most preferred. - items: - description: |- - An empty preferred scheduling term matches all objects with implicit weight 0 - (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). - properties: - preference: - description: A node selector term, associated with the corresponding weight. - properties: - matchExpressions: - description: A list of node selector requirements by node's labels. - items: - description: |- - A node selector requirement is a selector that contains values, a key, and an operator - that relates the key and values. - properties: - key: - description: The label key that the selector applies to. - type: string - operator: - description: |- - Represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. - type: string - values: - description: |- - An array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. If the operator is Gt or Lt, the values - array must have a single element, which will be interpreted as an integer. - This array is replaced during a strategic merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchFields: - description: A list of node selector requirements by node's fields. - items: - description: |- - A node selector requirement is a selector that contains values, a key, and an operator - that relates the key and values. - properties: - key: - description: The label key that the selector applies to. - type: string - operator: - description: |- - Represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. - type: string - values: - description: |- - An array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. If the operator is Gt or Lt, the values - array must have a single element, which will be interpreted as an integer. - This array is replaced during a strategic merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - type: object - x-kubernetes-map-type: atomic - weight: - description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100. - format: int32 - type: integer - required: - - preference - - weight - type: object - type: array - x-kubernetes-list-type: atomic - requiredDuringSchedulingIgnoredDuringExecution: - description: |- - If the affinity requirements specified by this field are not met at - scheduling time, the pod will not be scheduled onto the node. - If the affinity requirements specified by this field cease to be met - at some point during pod execution (e.g. due to an update), the system - may or may not try to eventually evict the pod from its node. - properties: - nodeSelectorTerms: - description: Required. A list of node selector terms. The terms are ORed. - items: - description: |- - A null or empty node selector term matches no objects. The requirements of - them are ANDed. - The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. - properties: - matchExpressions: - description: A list of node selector requirements by node's labels. - items: - description: |- - A node selector requirement is a selector that contains values, a key, and an operator - that relates the key and values. - properties: - key: - description: The label key that the selector applies to. - type: string - operator: - description: |- - Represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. - type: string - values: - description: |- - An array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. If the operator is Gt or Lt, the values - array must have a single element, which will be interpreted as an integer. - This array is replaced during a strategic merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchFields: - description: A list of node selector requirements by node's fields. - items: - description: |- - A node selector requirement is a selector that contains values, a key, and an operator - that relates the key and values. - properties: - key: - description: The label key that the selector applies to. - type: string - operator: - description: |- - Represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. - type: string - values: - description: |- - An array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. If the operator is Gt or Lt, the values - array must have a single element, which will be interpreted as an integer. - This array is replaced during a strategic merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - type: object - x-kubernetes-map-type: atomic - type: array - x-kubernetes-list-type: atomic - required: - - nodeSelectorTerms - type: object - x-kubernetes-map-type: atomic - type: object - podAffinity: - description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)). - properties: - preferredDuringSchedulingIgnoredDuringExecution: - description: |- - The scheduler will prefer to schedule pods to nodes that satisfy - the affinity expressions specified by this field, but it may choose - a node that violates one or more of the expressions. The node that is - most preferred is the one with the greatest sum of weights, i.e. - for each node that meets all of the scheduling requirements (resource - request, requiredDuringScheduling affinity expressions, etc.), - compute a sum by iterating through the elements of this field and adding - "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the - node(s) with the highest sum are the most preferred. - items: - description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) - properties: - podAffinityTerm: - description: Required. A pod affinity term, associated with the corresponding weight. - properties: - labelSelector: - description: |- - A label query over a set of resources, in this case pods. - If it's null, this PodAffinityTerm matches with no Pods. - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - matchLabelKeys: - description: |- - MatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both matchLabelKeys and labelSelector. - Also, matchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - mismatchLabelKeys: - description: |- - MismatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. - Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - namespaceSelector: - description: |- - A label query over the set of namespaces that the term applies to. - The term is applied to the union of the namespaces selected by this field - and the ones listed in the namespaces field. - null selector and null or empty namespaces list means "this pod's namespace". - An empty selector ({}) matches all namespaces. - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - namespaces: - description: |- - namespaces specifies a static list of namespace names that the term applies to. - The term is applied to the union of the namespaces listed in this field - and the ones selected by namespaceSelector. - null or empty namespaces list and null namespaceSelector means "this pod's namespace". - items: - type: string - type: array - x-kubernetes-list-type: atomic - topologyKey: - description: |- - This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching - the labelSelector in the specified namespaces, where co-located is defined as running on a node - whose value of the label with key topologyKey matches that of any node on which any of the - selected pods is running. - Empty topologyKey is not allowed. - type: string - required: - - topologyKey - type: object - weight: - description: |- - weight associated with matching the corresponding podAffinityTerm, - in the range 1-100. - format: int32 - type: integer - required: - - podAffinityTerm - - weight - type: object - type: array - x-kubernetes-list-type: atomic - requiredDuringSchedulingIgnoredDuringExecution: - description: |- - If the affinity requirements specified by this field are not met at - scheduling time, the pod will not be scheduled onto the node. - If the affinity requirements specified by this field cease to be met - at some point during pod execution (e.g. due to a pod label update), the - system may or may not try to eventually evict the pod from its node. - When there are multiple elements, the lists of nodes corresponding to each - podAffinityTerm are intersected, i.e. all terms must be satisfied. - items: - description: |- - Defines a set of pods (namely those matching the labelSelector - relative to the given namespace(s)) that this pod should be - co-located (affinity) or not co-located (anti-affinity) with, - where co-located is defined as running on a node whose value of - the label with key matches that of any node on which - a pod of the set of pods is running - properties: - labelSelector: - description: |- - A label query over a set of resources, in this case pods. - If it's null, this PodAffinityTerm matches with no Pods. - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - matchLabelKeys: - description: |- - MatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both matchLabelKeys and labelSelector. - Also, matchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - mismatchLabelKeys: - description: |- - MismatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. - Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - namespaceSelector: - description: |- - A label query over the set of namespaces that the term applies to. - The term is applied to the union of the namespaces selected by this field - and the ones listed in the namespaces field. - null selector and null or empty namespaces list means "this pod's namespace". - An empty selector ({}) matches all namespaces. - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - namespaces: - description: |- - namespaces specifies a static list of namespace names that the term applies to. - The term is applied to the union of the namespaces listed in this field - and the ones selected by namespaceSelector. - null or empty namespaces list and null namespaceSelector means "this pod's namespace". - items: - type: string - type: array - x-kubernetes-list-type: atomic - topologyKey: - description: |- - This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching - the labelSelector in the specified namespaces, where co-located is defined as running on a node - whose value of the label with key topologyKey matches that of any node on which any of the - selected pods is running. - Empty topologyKey is not allowed. - type: string - required: - - topologyKey - type: object - type: array - x-kubernetes-list-type: atomic - type: object - podAntiAffinity: - description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)). - properties: - preferredDuringSchedulingIgnoredDuringExecution: - description: |- - The scheduler will prefer to schedule pods to nodes that satisfy - the anti-affinity expressions specified by this field, but it may choose - a node that violates one or more of the expressions. The node that is - most preferred is the one with the greatest sum of weights, i.e. - for each node that meets all of the scheduling requirements (resource - request, requiredDuringScheduling anti-affinity expressions, etc.), - compute a sum by iterating through the elements of this field and subtracting - "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the - node(s) with the highest sum are the most preferred. - items: - description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) - properties: - podAffinityTerm: - description: Required. A pod affinity term, associated with the corresponding weight. - properties: - labelSelector: - description: |- - A label query over a set of resources, in this case pods. - If it's null, this PodAffinityTerm matches with no Pods. - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - matchLabelKeys: - description: |- - MatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both matchLabelKeys and labelSelector. - Also, matchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - mismatchLabelKeys: - description: |- - MismatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. - Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - namespaceSelector: - description: |- - A label query over the set of namespaces that the term applies to. - The term is applied to the union of the namespaces selected by this field - and the ones listed in the namespaces field. - null selector and null or empty namespaces list means "this pod's namespace". - An empty selector ({}) matches all namespaces. - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - namespaces: - description: |- - namespaces specifies a static list of namespace names that the term applies to. - The term is applied to the union of the namespaces listed in this field - and the ones selected by namespaceSelector. - null or empty namespaces list and null namespaceSelector means "this pod's namespace". - items: - type: string - type: array - x-kubernetes-list-type: atomic - topologyKey: - description: |- - This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching - the labelSelector in the specified namespaces, where co-located is defined as running on a node - whose value of the label with key topologyKey matches that of any node on which any of the - selected pods is running. - Empty topologyKey is not allowed. - type: string - required: - - topologyKey - type: object - weight: - description: |- - weight associated with matching the corresponding podAffinityTerm, - in the range 1-100. - format: int32 - type: integer - required: - - podAffinityTerm - - weight - type: object - type: array - x-kubernetes-list-type: atomic - requiredDuringSchedulingIgnoredDuringExecution: - description: |- - If the anti-affinity requirements specified by this field are not met at - scheduling time, the pod will not be scheduled onto the node. - If the anti-affinity requirements specified by this field cease to be met - at some point during pod execution (e.g. due to a pod label update), the - system may or may not try to eventually evict the pod from its node. - When there are multiple elements, the lists of nodes corresponding to each - podAffinityTerm are intersected, i.e. all terms must be satisfied. - items: - description: |- - Defines a set of pods (namely those matching the labelSelector - relative to the given namespace(s)) that this pod should be - co-located (affinity) or not co-located (anti-affinity) with, - where co-located is defined as running on a node whose value of - the label with key matches that of any node on which - a pod of the set of pods is running - properties: - labelSelector: - description: |- - A label query over a set of resources, in this case pods. - If it's null, this PodAffinityTerm matches with no Pods. - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - matchLabelKeys: - description: |- - MatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both matchLabelKeys and labelSelector. - Also, matchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - mismatchLabelKeys: - description: |- - MismatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. - Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - namespaceSelector: - description: |- - A label query over the set of namespaces that the term applies to. - The term is applied to the union of the namespaces selected by this field - and the ones listed in the namespaces field. - null selector and null or empty namespaces list means "this pod's namespace". - An empty selector ({}) matches all namespaces. - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - namespaces: - description: |- - namespaces specifies a static list of namespace names that the term applies to. - The term is applied to the union of the namespaces listed in this field - and the ones selected by namespaceSelector. - null or empty namespaces list and null namespaceSelector means "this pod's namespace". - items: - type: string - type: array - x-kubernetes-list-type: atomic - topologyKey: - description: |- - This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching - the labelSelector in the specified namespaces, where co-located is defined as running on a node - whose value of the label with key topologyKey matches that of any node on which any of the - selected pods is running. - Empty topologyKey is not allowed. - type: string - required: - - topologyKey - type: object - type: array - x-kubernetes-list-type: atomic - type: object - type: object - imagePullSecrets: - description: If specified, the pod's imagePullSecrets - items: - description: |- - LocalObjectReference contains enough information to let you locate the - referenced object inside the same namespace. - properties: - name: - default: "" - description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - type: object - x-kubernetes-map-type: atomic - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - nodeSelector: - additionalProperties: - type: string - description: |- - NodeSelector is a selector which must be true for the pod to fit on a node. - Selector which must match a node's labels for the pod to be scheduled on that node. - More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ - type: object - priorityClassName: - description: If specified, the pod's priorityClassName. - type: string - resources: - description: |- - If specified, the pod's resource requirements. - These values override the global resource configuration flags. - Note that when only specifying resource limits, ensure they are greater than or equal - to the corresponding global resource requests configured via controller flags - (--acme-http01-solver-resource-request-cpu, --acme-http01-solver-resource-request-memory). - Kubernetes will reject pod creation if limits are lower than requests, causing challenge failures. - properties: - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: |- - Limits describes the maximum amount of compute resources allowed. - More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: |- - Requests describes the minimum amount of compute resources required. - If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, - otherwise to the global values configured via controller flags. Requests cannot exceed Limits. - More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ - type: object - type: object - securityContext: - description: If specified, the pod's security context - properties: - fsGroup: - description: |- - A special supplemental group that applies to all containers in a pod. - Some volume types allow the Kubelet to change the ownership of that volume - to be owned by the pod: - - 1. The owning GID will be the FSGroup - 2. The setgid bit is set (new files created in the volume will be owned by FSGroup) - 3. The permission bits are OR'd with rw-rw---- - - If unset, the Kubelet will not modify the ownership and permissions of any volume. - Note that this field cannot be set when spec.os.name is windows. - format: int64 - type: integer - fsGroupChangePolicy: - description: |- - fsGroupChangePolicy defines behavior of changing ownership and permission of the volume - before being exposed inside Pod. This field will only apply to - volume types which support fsGroup based ownership(and permissions). - It will have no effect on ephemeral volume types such as: secret, configmaps - and emptydir. - Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used. - Note that this field cannot be set when spec.os.name is windows. - type: string - runAsGroup: - description: |- - The GID to run the entrypoint of the container process. - Uses runtime default if unset. - May also be set in SecurityContext. If set in both SecurityContext and - PodSecurityContext, the value specified in SecurityContext takes precedence - for that container. - Note that this field cannot be set when spec.os.name is windows. - format: int64 - type: integer - runAsNonRoot: - description: |- - Indicates that the container must run as a non-root user. - If true, the Kubelet will validate the image at runtime to ensure that it - does not run as UID 0 (root) and fail to start the container if it does. - If unset or false, no such validation will be performed. - May also be set in SecurityContext. If set in both SecurityContext and - PodSecurityContext, the value specified in SecurityContext takes precedence. - type: boolean - runAsUser: - description: |- - The UID to run the entrypoint of the container process. - Defaults to user specified in image metadata if unspecified. - May also be set in SecurityContext. If set in both SecurityContext and - PodSecurityContext, the value specified in SecurityContext takes precedence - for that container. - Note that this field cannot be set when spec.os.name is windows. - format: int64 - type: integer - seLinuxOptions: - description: |- - The SELinux context to be applied to all containers. - If unspecified, the container runtime will allocate a random SELinux context for each - container. May also be set in SecurityContext. If set in - both SecurityContext and PodSecurityContext, the value specified in SecurityContext - takes precedence for that container. - Note that this field cannot be set when spec.os.name is windows. - properties: - level: - description: Level is SELinux level label that applies to the container. - type: string - role: - description: Role is a SELinux role label that applies to the container. - type: string - type: - description: Type is a SELinux type label that applies to the container. - type: string - user: - description: User is a SELinux user label that applies to the container. - type: string - type: object - seccompProfile: - description: |- - The seccomp options to use by the containers in this pod. - Note that this field cannot be set when spec.os.name is windows. - properties: - localhostProfile: - description: |- - localhostProfile indicates a profile defined in a file on the node should be used. - The profile must be preconfigured on the node to work. - Must be a descending path, relative to the kubelet's configured seccomp profile location. - Must be set if type is "Localhost". Must NOT be set for any other type. - type: string - type: - description: |- - type indicates which kind of seccomp profile will be applied. - Valid options are: - - Localhost - a profile defined in a file on the node should be used. - RuntimeDefault - the container runtime default profile should be used. - Unconfined - no profile should be applied. - type: string - required: - - type - type: object - supplementalGroups: - description: |- - A list of groups applied to the first process run in each container, in addition - to the container's primary GID, the fsGroup (if specified), and group memberships - defined in the container image for the uid of the container process. If unspecified, - no additional groups are added to any container. Note that group memberships - defined in the container image for the uid of the container process are still effective, - even if they are not included in this list. - Note that this field cannot be set when spec.os.name is windows. - items: - format: int64 - type: integer - type: array - x-kubernetes-list-type: atomic - sysctls: - description: |- - Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported - sysctls (by the container runtime) might fail to launch. - Note that this field cannot be set when spec.os.name is windows. - items: - description: Sysctl defines a kernel parameter to be set - properties: - name: - description: Name of a property to set - type: string - value: - description: Value of a property to set - type: string - required: - - name - - value - type: object - type: array - x-kubernetes-list-type: atomic - type: object - serviceAccountName: - description: If specified, the pod's service account - type: string - tolerations: - description: If specified, the pod's tolerations. - items: - description: |- - The pod this Toleration is attached to tolerates any taint that matches - the triple using the matching operator . - properties: - effect: - description: |- - Effect indicates the taint effect to match. Empty means match all taint effects. - When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. - type: string - key: - description: |- - Key is the taint key that the toleration applies to. Empty means match all taint keys. - If the key is empty, operator must be Exists; this combination means to match all values and all keys. - type: string - operator: - description: |- - Operator represents a key's relationship to the value. - Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. - Exists is equivalent to wildcard for value, so that a pod can - tolerate all taints of a particular category. - Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). - type: string - tolerationSeconds: - description: |- - TolerationSeconds represents the period of time the toleration (which must be - of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, - it is not set, which means tolerate the taint forever (do not evict). Zero and - negative values will be treated as 0 (evict immediately) by the system. - format: int64 - type: integer - value: - description: |- - Value is the taint value the toleration matches to. - If the operator is Exists, the value should be empty, otherwise just a regular string. - type: string - type: object - type: array - x-kubernetes-list-type: atomic - type: object - type: object - serviceType: - description: |- - Optional service type for Kubernetes solver service. Supported values - are NodePort or ClusterIP. If unset, defaults to NodePort. - type: string - type: object - ingress: - description: |- - The ingress based HTTP01 challenge solver will solve challenges by - creating or modifying Ingress resources in order to route requests for - '/.well-known/acme-challenge/XYZ' to 'challenge solver' pods that are - provisioned by cert-manager for each Challenge to be completed. - properties: - class: - description: |- - This field configures the annotation `kubernetes.io/ingress.class` when - creating Ingress resources to solve ACME challenges that use this - challenge solver. Only one of `class`, `name` or `ingressClassName` may - be specified. - type: string - ingressClassName: - description: |- - This field configures the field `ingressClassName` on the created Ingress - resources used to solve ACME challenges that use this challenge solver. - This is the recommended way of configuring the ingress class. Only one of - `class`, `name` or `ingressClassName` may be specified. - type: string - ingressTemplate: - description: |- - Optional ingress template used to configure the ACME challenge solver - ingress used for HTTP01 challenges. - properties: - metadata: - description: |- - ObjectMeta overrides for the ingress used to solve HTTP01 challenges. - Only the 'labels' and 'annotations' fields may be set. - If labels or annotations overlap with in-built values, the values here - will override the in-built values. - properties: - annotations: - additionalProperties: - type: string - description: Annotations that should be added to the created ACME HTTP01 solver ingress. - type: object - labels: - additionalProperties: - type: string - description: Labels that should be added to the created ACME HTTP01 solver ingress. - type: object - type: object - type: object - name: - description: |- - The name of the ingress resource that should have ACME challenge solving - routes inserted into it in order to solve HTTP01 challenges. - This is typically used in conjunction with ingress controllers like - ingress-gce, which maintains a 1:1 mapping between external IPs and - ingress resources. Only one of `class`, `name` or `ingressClassName` may - be specified. - type: string - podTemplate: - description: |- - Optional pod template used to configure the ACME challenge solver pods - used for HTTP01 challenges. - properties: - metadata: - description: |- - ObjectMeta overrides for the pod used to solve HTTP01 challenges. - Only the 'labels' and 'annotations' fields may be set. - If labels or annotations overlap with in-built values, the values here - will override the in-built values. - properties: - annotations: - additionalProperties: - type: string - description: Annotations that should be added to the created ACME HTTP01 solver pods. - type: object - labels: - additionalProperties: - type: string - description: Labels that should be added to the created ACME HTTP01 solver pods. - type: object - type: object - spec: - description: |- - PodSpec defines overrides for the HTTP01 challenge solver pod. - Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields. - All other fields will be ignored. - properties: - affinity: - description: If specified, the pod's scheduling constraints - properties: - nodeAffinity: - description: Describes node affinity scheduling rules for the pod. - properties: - preferredDuringSchedulingIgnoredDuringExecution: - description: |- - The scheduler will prefer to schedule pods to nodes that satisfy - the affinity expressions specified by this field, but it may choose - a node that violates one or more of the expressions. The node that is - most preferred is the one with the greatest sum of weights, i.e. - for each node that meets all of the scheduling requirements (resource - request, requiredDuringScheduling affinity expressions, etc.), - compute a sum by iterating through the elements of this field and adding - "weight" to the sum if the node matches the corresponding matchExpressions; the - node(s) with the highest sum are the most preferred. - items: - description: |- - An empty preferred scheduling term matches all objects with implicit weight 0 - (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). - properties: - preference: - description: A node selector term, associated with the corresponding weight. - properties: - matchExpressions: - description: A list of node selector requirements by node's labels. - items: - description: |- - A node selector requirement is a selector that contains values, a key, and an operator - that relates the key and values. - properties: - key: - description: The label key that the selector applies to. - type: string - operator: - description: |- - Represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. - type: string - values: - description: |- - An array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. If the operator is Gt or Lt, the values - array must have a single element, which will be interpreted as an integer. - This array is replaced during a strategic merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchFields: - description: A list of node selector requirements by node's fields. - items: - description: |- - A node selector requirement is a selector that contains values, a key, and an operator - that relates the key and values. - properties: - key: - description: The label key that the selector applies to. - type: string - operator: - description: |- - Represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. - type: string - values: - description: |- - An array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. If the operator is Gt or Lt, the values - array must have a single element, which will be interpreted as an integer. - This array is replaced during a strategic merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - type: object - x-kubernetes-map-type: atomic - weight: - description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100. - format: int32 - type: integer - required: - - preference - - weight - type: object - type: array - x-kubernetes-list-type: atomic - requiredDuringSchedulingIgnoredDuringExecution: - description: |- - If the affinity requirements specified by this field are not met at - scheduling time, the pod will not be scheduled onto the node. - If the affinity requirements specified by this field cease to be met - at some point during pod execution (e.g. due to an update), the system - may or may not try to eventually evict the pod from its node. - properties: - nodeSelectorTerms: - description: Required. A list of node selector terms. The terms are ORed. - items: - description: |- - A null or empty node selector term matches no objects. The requirements of - them are ANDed. - The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. - properties: - matchExpressions: - description: A list of node selector requirements by node's labels. - items: - description: |- - A node selector requirement is a selector that contains values, a key, and an operator - that relates the key and values. - properties: - key: - description: The label key that the selector applies to. - type: string - operator: - description: |- - Represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. - type: string - values: - description: |- - An array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. If the operator is Gt or Lt, the values - array must have a single element, which will be interpreted as an integer. - This array is replaced during a strategic merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchFields: - description: A list of node selector requirements by node's fields. - items: - description: |- - A node selector requirement is a selector that contains values, a key, and an operator - that relates the key and values. - properties: - key: - description: The label key that the selector applies to. - type: string - operator: - description: |- - Represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. - type: string - values: - description: |- - An array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. If the operator is Gt or Lt, the values - array must have a single element, which will be interpreted as an integer. - This array is replaced during a strategic merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - type: object - x-kubernetes-map-type: atomic - type: array - x-kubernetes-list-type: atomic - required: - - nodeSelectorTerms - type: object - x-kubernetes-map-type: atomic - type: object - podAffinity: - description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)). - properties: - preferredDuringSchedulingIgnoredDuringExecution: - description: |- - The scheduler will prefer to schedule pods to nodes that satisfy - the affinity expressions specified by this field, but it may choose - a node that violates one or more of the expressions. The node that is - most preferred is the one with the greatest sum of weights, i.e. - for each node that meets all of the scheduling requirements (resource - request, requiredDuringScheduling affinity expressions, etc.), - compute a sum by iterating through the elements of this field and adding - "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the - node(s) with the highest sum are the most preferred. - items: - description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) - properties: - podAffinityTerm: - description: Required. A pod affinity term, associated with the corresponding weight. - properties: - labelSelector: - description: |- - A label query over a set of resources, in this case pods. - If it's null, this PodAffinityTerm matches with no Pods. - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - matchLabelKeys: - description: |- - MatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both matchLabelKeys and labelSelector. - Also, matchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - mismatchLabelKeys: - description: |- - MismatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. - Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - namespaceSelector: - description: |- - A label query over the set of namespaces that the term applies to. - The term is applied to the union of the namespaces selected by this field - and the ones listed in the namespaces field. - null selector and null or empty namespaces list means "this pod's namespace". - An empty selector ({}) matches all namespaces. - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - namespaces: - description: |- - namespaces specifies a static list of namespace names that the term applies to. - The term is applied to the union of the namespaces listed in this field - and the ones selected by namespaceSelector. - null or empty namespaces list and null namespaceSelector means "this pod's namespace". - items: - type: string - type: array - x-kubernetes-list-type: atomic - topologyKey: - description: |- - This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching - the labelSelector in the specified namespaces, where co-located is defined as running on a node - whose value of the label with key topologyKey matches that of any node on which any of the - selected pods is running. - Empty topologyKey is not allowed. - type: string - required: - - topologyKey - type: object - weight: - description: |- - weight associated with matching the corresponding podAffinityTerm, - in the range 1-100. - format: int32 - type: integer - required: - - podAffinityTerm - - weight - type: object - type: array - x-kubernetes-list-type: atomic - requiredDuringSchedulingIgnoredDuringExecution: - description: |- - If the affinity requirements specified by this field are not met at - scheduling time, the pod will not be scheduled onto the node. - If the affinity requirements specified by this field cease to be met - at some point during pod execution (e.g. due to a pod label update), the - system may or may not try to eventually evict the pod from its node. - When there are multiple elements, the lists of nodes corresponding to each - podAffinityTerm are intersected, i.e. all terms must be satisfied. - items: - description: |- - Defines a set of pods (namely those matching the labelSelector - relative to the given namespace(s)) that this pod should be - co-located (affinity) or not co-located (anti-affinity) with, - where co-located is defined as running on a node whose value of - the label with key matches that of any node on which - a pod of the set of pods is running - properties: - labelSelector: - description: |- - A label query over a set of resources, in this case pods. - If it's null, this PodAffinityTerm matches with no Pods. - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - matchLabelKeys: - description: |- - MatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both matchLabelKeys and labelSelector. - Also, matchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - mismatchLabelKeys: - description: |- - MismatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. - Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - namespaceSelector: - description: |- - A label query over the set of namespaces that the term applies to. - The term is applied to the union of the namespaces selected by this field - and the ones listed in the namespaces field. - null selector and null or empty namespaces list means "this pod's namespace". - An empty selector ({}) matches all namespaces. - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - namespaces: - description: |- - namespaces specifies a static list of namespace names that the term applies to. - The term is applied to the union of the namespaces listed in this field - and the ones selected by namespaceSelector. - null or empty namespaces list and null namespaceSelector means "this pod's namespace". - items: - type: string - type: array - x-kubernetes-list-type: atomic - topologyKey: - description: |- - This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching - the labelSelector in the specified namespaces, where co-located is defined as running on a node - whose value of the label with key topologyKey matches that of any node on which any of the - selected pods is running. - Empty topologyKey is not allowed. - type: string - required: - - topologyKey - type: object - type: array - x-kubernetes-list-type: atomic - type: object - podAntiAffinity: - description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)). - properties: - preferredDuringSchedulingIgnoredDuringExecution: - description: |- - The scheduler will prefer to schedule pods to nodes that satisfy - the anti-affinity expressions specified by this field, but it may choose - a node that violates one or more of the expressions. The node that is - most preferred is the one with the greatest sum of weights, i.e. - for each node that meets all of the scheduling requirements (resource - request, requiredDuringScheduling anti-affinity expressions, etc.), - compute a sum by iterating through the elements of this field and subtracting - "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the - node(s) with the highest sum are the most preferred. - items: - description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) - properties: - podAffinityTerm: - description: Required. A pod affinity term, associated with the corresponding weight. - properties: - labelSelector: - description: |- - A label query over a set of resources, in this case pods. - If it's null, this PodAffinityTerm matches with no Pods. - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - matchLabelKeys: - description: |- - MatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both matchLabelKeys and labelSelector. - Also, matchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - mismatchLabelKeys: - description: |- - MismatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. - Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - namespaceSelector: - description: |- - A label query over the set of namespaces that the term applies to. - The term is applied to the union of the namespaces selected by this field - and the ones listed in the namespaces field. - null selector and null or empty namespaces list means "this pod's namespace". - An empty selector ({}) matches all namespaces. - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - namespaces: - description: |- - namespaces specifies a static list of namespace names that the term applies to. - The term is applied to the union of the namespaces listed in this field - and the ones selected by namespaceSelector. - null or empty namespaces list and null namespaceSelector means "this pod's namespace". - items: - type: string - type: array - x-kubernetes-list-type: atomic - topologyKey: - description: |- - This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching - the labelSelector in the specified namespaces, where co-located is defined as running on a node - whose value of the label with key topologyKey matches that of any node on which any of the - selected pods is running. - Empty topologyKey is not allowed. - type: string - required: - - topologyKey - type: object - weight: - description: |- - weight associated with matching the corresponding podAffinityTerm, - in the range 1-100. - format: int32 - type: integer - required: - - podAffinityTerm - - weight - type: object - type: array - x-kubernetes-list-type: atomic - requiredDuringSchedulingIgnoredDuringExecution: - description: |- - If the anti-affinity requirements specified by this field are not met at - scheduling time, the pod will not be scheduled onto the node. - If the anti-affinity requirements specified by this field cease to be met - at some point during pod execution (e.g. due to a pod label update), the - system may or may not try to eventually evict the pod from its node. - When there are multiple elements, the lists of nodes corresponding to each - podAffinityTerm are intersected, i.e. all terms must be satisfied. - items: - description: |- - Defines a set of pods (namely those matching the labelSelector - relative to the given namespace(s)) that this pod should be - co-located (affinity) or not co-located (anti-affinity) with, - where co-located is defined as running on a node whose value of - the label with key matches that of any node on which - a pod of the set of pods is running - properties: - labelSelector: - description: |- - A label query over a set of resources, in this case pods. - If it's null, this PodAffinityTerm matches with no Pods. - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - matchLabelKeys: - description: |- - MatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both matchLabelKeys and labelSelector. - Also, matchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - mismatchLabelKeys: - description: |- - MismatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. - Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - namespaceSelector: - description: |- - A label query over the set of namespaces that the term applies to. - The term is applied to the union of the namespaces selected by this field - and the ones listed in the namespaces field. - null selector and null or empty namespaces list means "this pod's namespace". - An empty selector ({}) matches all namespaces. - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - namespaces: - description: |- - namespaces specifies a static list of namespace names that the term applies to. - The term is applied to the union of the namespaces listed in this field - and the ones selected by namespaceSelector. - null or empty namespaces list and null namespaceSelector means "this pod's namespace". - items: - type: string - type: array - x-kubernetes-list-type: atomic - topologyKey: - description: |- - This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching - the labelSelector in the specified namespaces, where co-located is defined as running on a node - whose value of the label with key topologyKey matches that of any node on which any of the - selected pods is running. - Empty topologyKey is not allowed. - type: string - required: - - topologyKey - type: object - type: array - x-kubernetes-list-type: atomic - type: object - type: object - imagePullSecrets: - description: If specified, the pod's imagePullSecrets - items: - description: |- - LocalObjectReference contains enough information to let you locate the - referenced object inside the same namespace. - properties: - name: - default: "" - description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - type: object - x-kubernetes-map-type: atomic - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - nodeSelector: - additionalProperties: - type: string - description: |- - NodeSelector is a selector which must be true for the pod to fit on a node. - Selector which must match a node's labels for the pod to be scheduled on that node. - More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ - type: object - priorityClassName: - description: If specified, the pod's priorityClassName. - type: string - resources: - description: |- - If specified, the pod's resource requirements. - These values override the global resource configuration flags. - Note that when only specifying resource limits, ensure they are greater than or equal - to the corresponding global resource requests configured via controller flags - (--acme-http01-solver-resource-request-cpu, --acme-http01-solver-resource-request-memory). - Kubernetes will reject pod creation if limits are lower than requests, causing challenge failures. - properties: - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: |- - Limits describes the maximum amount of compute resources allowed. - More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: |- - Requests describes the minimum amount of compute resources required. - If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, - otherwise to the global values configured via controller flags. Requests cannot exceed Limits. - More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ - type: object - type: object - securityContext: - description: If specified, the pod's security context - properties: - fsGroup: - description: |- - A special supplemental group that applies to all containers in a pod. - Some volume types allow the Kubelet to change the ownership of that volume - to be owned by the pod: - - 1. The owning GID will be the FSGroup - 2. The setgid bit is set (new files created in the volume will be owned by FSGroup) - 3. The permission bits are OR'd with rw-rw---- - - If unset, the Kubelet will not modify the ownership and permissions of any volume. - Note that this field cannot be set when spec.os.name is windows. - format: int64 - type: integer - fsGroupChangePolicy: - description: |- - fsGroupChangePolicy defines behavior of changing ownership and permission of the volume - before being exposed inside Pod. This field will only apply to - volume types which support fsGroup based ownership(and permissions). - It will have no effect on ephemeral volume types such as: secret, configmaps - and emptydir. - Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used. - Note that this field cannot be set when spec.os.name is windows. - type: string - runAsGroup: - description: |- - The GID to run the entrypoint of the container process. - Uses runtime default if unset. - May also be set in SecurityContext. If set in both SecurityContext and - PodSecurityContext, the value specified in SecurityContext takes precedence - for that container. - Note that this field cannot be set when spec.os.name is windows. - format: int64 - type: integer - runAsNonRoot: - description: |- - Indicates that the container must run as a non-root user. - If true, the Kubelet will validate the image at runtime to ensure that it - does not run as UID 0 (root) and fail to start the container if it does. - If unset or false, no such validation will be performed. - May also be set in SecurityContext. If set in both SecurityContext and - PodSecurityContext, the value specified in SecurityContext takes precedence. - type: boolean - runAsUser: - description: |- - The UID to run the entrypoint of the container process. - Defaults to user specified in image metadata if unspecified. - May also be set in SecurityContext. If set in both SecurityContext and - PodSecurityContext, the value specified in SecurityContext takes precedence - for that container. - Note that this field cannot be set when spec.os.name is windows. - format: int64 - type: integer - seLinuxOptions: - description: |- - The SELinux context to be applied to all containers. - If unspecified, the container runtime will allocate a random SELinux context for each - container. May also be set in SecurityContext. If set in - both SecurityContext and PodSecurityContext, the value specified in SecurityContext - takes precedence for that container. - Note that this field cannot be set when spec.os.name is windows. - properties: - level: - description: Level is SELinux level label that applies to the container. - type: string - role: - description: Role is a SELinux role label that applies to the container. - type: string - type: - description: Type is a SELinux type label that applies to the container. - type: string - user: - description: User is a SELinux user label that applies to the container. - type: string - type: object - seccompProfile: - description: |- - The seccomp options to use by the containers in this pod. - Note that this field cannot be set when spec.os.name is windows. - properties: - localhostProfile: - description: |- - localhostProfile indicates a profile defined in a file on the node should be used. - The profile must be preconfigured on the node to work. - Must be a descending path, relative to the kubelet's configured seccomp profile location. - Must be set if type is "Localhost". Must NOT be set for any other type. - type: string - type: - description: |- - type indicates which kind of seccomp profile will be applied. - Valid options are: - - Localhost - a profile defined in a file on the node should be used. - RuntimeDefault - the container runtime default profile should be used. - Unconfined - no profile should be applied. - type: string - required: - - type - type: object - supplementalGroups: - description: |- - A list of groups applied to the first process run in each container, in addition - to the container's primary GID, the fsGroup (if specified), and group memberships - defined in the container image for the uid of the container process. If unspecified, - no additional groups are added to any container. Note that group memberships - defined in the container image for the uid of the container process are still effective, - even if they are not included in this list. - Note that this field cannot be set when spec.os.name is windows. - items: - format: int64 - type: integer - type: array - x-kubernetes-list-type: atomic - sysctls: - description: |- - Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported - sysctls (by the container runtime) might fail to launch. - Note that this field cannot be set when spec.os.name is windows. - items: - description: Sysctl defines a kernel parameter to be set - properties: - name: - description: Name of a property to set - type: string - value: - description: Value of a property to set - type: string - required: - - name - - value - type: object - type: array - x-kubernetes-list-type: atomic - type: object - serviceAccountName: - description: If specified, the pod's service account - type: string - tolerations: - description: If specified, the pod's tolerations. - items: - description: |- - The pod this Toleration is attached to tolerates any taint that matches - the triple using the matching operator . - properties: - effect: - description: |- - Effect indicates the taint effect to match. Empty means match all taint effects. - When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. - type: string - key: - description: |- - Key is the taint key that the toleration applies to. Empty means match all taint keys. - If the key is empty, operator must be Exists; this combination means to match all values and all keys. - type: string - operator: - description: |- - Operator represents a key's relationship to the value. - Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. - Exists is equivalent to wildcard for value, so that a pod can - tolerate all taints of a particular category. - Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). - type: string - tolerationSeconds: - description: |- - TolerationSeconds represents the period of time the toleration (which must be - of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, - it is not set, which means tolerate the taint forever (do not evict). Zero and - negative values will be treated as 0 (evict immediately) by the system. - format: int64 - type: integer - value: - description: |- - Value is the taint value the toleration matches to. - If the operator is Exists, the value should be empty, otherwise just a regular string. - type: string - type: object - type: array - x-kubernetes-list-type: atomic - type: object - type: object - serviceType: - description: |- - Optional service type for Kubernetes solver service. Supported values - are NodePort or ClusterIP. If unset, defaults to NodePort. - type: string - type: object - type: object - selector: - description: |- - Selector selects a set of DNSNames on the Certificate resource that - should be solved using this challenge solver. - If not specified, the solver will be treated as the 'default' solver - with the lowest priority, i.e. if any other solver has a more specific - match, it will be used instead. - properties: - dnsNames: - description: |- - List of DNSNames that this solver will be used to solve. - If specified and a match is found, a dnsNames selector will take - precedence over a dnsZones selector. - If multiple solvers match with the same dnsNames value, the solver - with the most matching labels in matchLabels will be selected. - If neither has more matches, the solver defined earlier in the list - will be selected. - items: - type: string - type: array - x-kubernetes-list-type: atomic - dnsZones: - description: |- - List of DNSZones that this solver will be used to solve. - The most specific DNS zone match specified here will take precedence - over other DNS zone matches, so a solver specifying sys.example.com - will be selected over one specifying example.com for the domain - www.sys.example.com. - If multiple solvers match with the same dnsZones value, the solver - with the most matching labels in matchLabels will be selected. - If neither has more matches, the solver defined earlier in the list - will be selected. - items: - type: string - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - A label selector that is used to refine the set of certificate's that - this challenge solver will apply to. - type: object - type: object - waitInsteadOfSelfCheck: - description: |- - WaitInsteadOfSelfCheck, if set, skips cert-manager's self-check and - instead waits this long after presentation before asking the ACME server - to validate the challenge. - - This is an advanced escape hatch for environments where cert-manager's - self-check cannot succeed from its own network or DNS viewpoint even - though the ACME server can still validate successfully, for example due - to split-horizon DNS or NAT hairpinning. - - A value of 0 skips the self-check and asks the ACME server to validate - immediately after presentation, relying on the ACME server's own - validation retries (RFC 8555 section 8.2) to succeed once the challenge - has propagated. A negative duration is rejected. - Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration, - for example `30s` or `2m`. - type: string - type: object - token: - description: |- - The ACME challenge token for this challenge. - This is the raw value returned from the ACME server. - type: string - type: - description: |- - The type of ACME challenge this resource represents. - One of "HTTP-01" or "DNS-01". - enum: - - HTTP-01 - - DNS-01 - type: string - url: - description: |- - The URL of the ACME Challenge resource for this challenge. - This can be used to lookup details about the status of this challenge. - type: string - wildcard: - description: |- - wildcard will be true if this challenge is for a wildcard identifier, - for example '*.example.com'. - type: boolean - required: - - authorizationURL - - dnsName - - issuerRef - - key - - solver - - token - - type - - url - type: object - status: - properties: - presented: - description: |- - Presented is true once cert-manager has configured the solver resources - needed to expose this challenge's validation material. - For example, the DNS01 TXT record has been created, or the HTTP01 solver - has been configured to serve the challenge token. - This does not imply the self check is passing, that the ACME server has - validated the challenge, or that cert-manager has already accepted the - challenge with the ACME server. - type: boolean - presentedAt: - description: |- - PresentedAt records when cert-manager first configured the solver - resources for this challenge. This is used by the optional delay-based - readiness logic. - format: date-time - type: string - processing: - description: |- - Used to denote whether this challenge should be processed or not. - This field will only be set to true by the 'scheduling' component. - It will only be set to false by the 'challenges' controller, after the - challenge has reached a final state or timed out. - If this field is set to false, the challenge controller will not take - any more action. - type: boolean - reason: - description: |- - Contains human readable information on why the Challenge is in the - current state. - type: string - state: - description: |- - Contains the current 'state' of the challenge. - If not set, the state of the challenge is unknown. - enum: - - valid - - ready - - pending - - processing - - invalid - - expired - - errored - type: string - type: object - required: - - metadata - - spec - type: object - selectableFields: - - jsonPath: .spec.issuerRef.group - - jsonPath: .spec.issuerRef.kind - - jsonPath: .spec.issuerRef.name - served: true - storage: true - subresources: - status: {} - ---- -# Source: cert-manager/templates/crd-acme.cert-manager.io_orders.yaml -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - name: "orders.acme.cert-manager.io" - annotations: - helm.sh/resource-policy: keep - labels: - app: "cert-manager" - app.kubernetes.io/name: "cert-manager" - app.kubernetes.io/instance: "cert-manager" - app.kubernetes.io/component: "crds" - app.kubernetes.io/version: "v1.21.1" - app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 -spec: - group: acme.cert-manager.io - names: - categories: - - cert-manager - - cert-manager-acme - kind: Order - listKind: OrderList - plural: orders - singular: order - scope: Namespaced - versions: - - additionalPrinterColumns: - - jsonPath: .status.state - name: State - type: string - - jsonPath: .spec.issuerRef.name - name: Issuer - priority: 1 - type: string - - jsonPath: .status.reason - name: Reason - priority: 1 - type: string - - description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1 - schema: - openAPIV3Schema: - description: Order is a type to represent an Order with an ACME server - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - properties: - commonName: - description: |- - CommonName is the common name as specified on the DER encoded CSR. - If specified, this value must also be present in `dnsNames` or `ipAddresses`. - This field must match the corresponding field on the DER encoded CSR. - type: string - dnsNames: - description: |- - DNSNames is a list of DNS names that should be included as part of the Order - validation process. - This field must match the corresponding field on the DER encoded CSR. - items: - type: string - type: array - x-kubernetes-list-type: atomic - duration: - description: |- - Duration is the duration for the not after date for the requested certificate. - This is set on order creation as per the ACME spec. - type: string - ipAddresses: - description: |- - IPAddresses is a list of IP addresses that should be included as part of the Order - validation process. - This field must match the corresponding field on the DER encoded CSR. - items: - type: string - type: array - x-kubernetes-list-type: atomic - issuerRef: - description: |- - IssuerRef references a properly configured ACME-type Issuer which should - be used to create this Order. - If the Issuer does not exist, processing will be retried. - If the Issuer is not an 'ACME' Issuer, an error will be returned and the - Order will be marked as failed. - properties: - group: - description: |- - Group of the issuer being referred to. - Defaults to 'cert-manager.io'. - type: string - kind: - description: |- - Kind of the issuer being referred to. - Defaults to 'Issuer'. - type: string - name: - description: Name of the issuer being referred to. - type: string - required: - - name - type: object - profile: - description: |- - Profile allows requesting a certificate profile from the ACME server. - Supported profiles are listed by the server's ACME directory URL. - type: string - replaces: - description: |- - Replaces is the ARI CertID (RFC 9773 §4.1) of the certificate that this - Order is intended to replace. When set, cert-manager will include the - "replaces" field on the newOrder request to the ACME server if and only - if the server advertises ARI support in its directory. The CertID has - the form "base64url(AKI).base64url(serial)" and is derived locally from - the currently issued leaf certificate. - type: string - request: - description: |- - Certificate signing request bytes in DER encoding. - This will be used when finalizing the order. - This field must be set on the order. - format: byte - type: string - required: - - issuerRef - - request - type: object - status: - properties: - authorizations: - description: |- - Authorizations contains data returned from the ACME server on what - authorizations must be completed in order to validate the DNS names - specified on the Order. - items: - description: |- - ACMEAuthorization contains data returned from the ACME server on an - authorization that must be completed in order validate a DNS name on an ACME - Order resource. - properties: - challenges: - description: |- - Challenges specifies the challenge types offered by the ACME server. - One of these challenge types will be selected when validating the DNS - name and an appropriate Challenge resource will be created to perform - the ACME challenge process. - items: - description: |- - Challenge specifies a challenge offered by the ACME server for an Order. - An appropriate Challenge resource can be created to perform the ACME - challenge process. - properties: - token: - description: |- - Token is the token that must be presented for this challenge. - This is used to compute the 'key' that must also be presented. - type: string - type: - description: |- - Type is the type of challenge being offered, e.g., 'http-01', 'dns-01', - 'tls-sni-01', etc. - This is the raw value retrieved from the ACME server. - Only 'http-01' and 'dns-01' are supported by cert-manager, other values - will be ignored. - type: string - url: - description: |- - URL is the URL of this challenge. It can be used to retrieve additional - metadata about the Challenge from the ACME server. - type: string - required: - - token - - type - - url - type: object - type: array - x-kubernetes-list-type: atomic - identifier: - description: Identifier is the DNS name to be validated as part of this authorization - type: string - initialState: - description: |- - InitialState is the initial state of the ACME authorization when first - fetched from the ACME server. - If an Authorization is already 'valid', the Order controller will not - create a Challenge resource for the authorization. This will occur when - working with an ACME server that enables 'authz reuse' (such as Let's - Encrypt's production endpoint). - If not set and 'identifier' is set, the state is assumed to be pending - and a Challenge will be created. - enum: - - valid - - ready - - pending - - processing - - invalid - - expired - - errored - type: string - url: - description: URL is the URL of the Authorization that must be completed - type: string - wildcard: - description: |- - Wildcard will be true if this authorization is for a wildcard DNS name. - If this is true, the identifier will be the *non-wildcard* version of - the DNS name. - For example, if '*.example.com' is the DNS name being validated, this - field will be 'true' and the 'identifier' field will be 'example.com'. - type: boolean - required: - - url - type: object - type: array - x-kubernetes-list-type: atomic - certificate: - description: |- - Certificate is a copy of the PEM encoded certificate for this Order. - This field will be populated after the order has been successfully - finalized with the ACME server, and the order has transitioned to the - 'valid' state. - format: byte - type: string - failureTime: - description: |- - FailureTime stores the time that this order failed. - This is used to influence garbage collection and back-off. - format: date-time - type: string - finalizeURL: - description: |- - FinalizeURL of the Order. - This is used to obtain certificates for this order once it has been completed. - type: string - reason: - description: |- - Reason optionally provides more information about a why the order is in - the current state. - type: string - state: - description: |- - State contains the current state of this Order resource. - States 'success' and 'expired' are 'final' - enum: - - valid - - ready - - pending - - processing - - invalid - - expired - - errored - type: string - url: - description: |- - URL of the Order. - This will initially be empty when the resource is first created. - The Order controller will populate this field when the Order is first processed. - This field will be immutable after it is initially set. - type: string - type: object - required: - - metadata - - spec - type: object - selectableFields: - - jsonPath: .spec.issuerRef.group - - jsonPath: .spec.issuerRef.kind - - jsonPath: .spec.issuerRef.name - served: true - storage: true - subresources: - status: {} - ---- -# Source: cert-manager/templates/crd-cert-manager.io_certificaterequests.yaml -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - name: "certificaterequests.cert-manager.io" - annotations: - helm.sh/resource-policy: keep - labels: - app: "cert-manager" - app.kubernetes.io/name: "cert-manager" - app.kubernetes.io/instance: "cert-manager" - app.kubernetes.io/component: "crds" - app.kubernetes.io/version: "v1.21.1" - app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 -spec: - group: cert-manager.io - names: - categories: - - cert-manager - kind: CertificateRequest - listKind: CertificateRequestList - plural: certificaterequests - shortNames: - - cr - - crs - singular: certificaterequest - scope: Namespaced - versions: - - additionalPrinterColumns: - - jsonPath: .status.conditions[?(@.type == "Approved")].status - name: Approved - type: string - - jsonPath: .status.conditions[?(@.type == "Denied")].status - name: Denied - type: string - - jsonPath: .status.conditions[?(@.type == "Ready")].status - name: Ready - type: string - - jsonPath: .spec.issuerRef.name - name: Issuer - type: string - - jsonPath: .spec.username - name: Requester - type: string - - jsonPath: .status.conditions[?(@.type == "Ready")].message - name: Status - priority: 1 - type: string - - description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1 - schema: - openAPIV3Schema: - description: |- - A CertificateRequest is used to request a signed certificate from one of the - configured issuers. - - All fields within the CertificateRequest's `spec` are immutable after creation. - A CertificateRequest will either succeed or fail, as denoted by its `Ready` status - condition and its `status.failureTime` field. - - A CertificateRequest is a one-shot resource, meaning it represents a single - point in time request for a certificate and cannot be re-used. - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: |- - Specification of the desired state of the CertificateRequest resource. - https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status - properties: - duration: - description: |- - Requested 'duration' (i.e. lifetime) of the Certificate. Note that the - issuer may choose to ignore the requested duration, just like any other - requested attribute. - type: string - extra: - additionalProperties: - items: - type: string - type: array - description: |- - Extra contains extra attributes of the user that created the CertificateRequest. - Populated by the cert-manager webhook on creation and immutable. - type: object - groups: - description: |- - Groups contains group membership of the user that created the CertificateRequest. - Populated by the cert-manager webhook on creation and immutable. - items: - type: string - type: array - x-kubernetes-list-type: atomic - isCA: - description: |- - Requested basic constraints isCA value. Note that the issuer may choose - to ignore the requested isCA value, just like any other requested attribute. - - NOTE: If the CSR in the `Request` field has a BasicConstraints extension, - it must have the same isCA value as specified here. - - If true, this will automatically add the `cert sign` usage to the list - of requested `usages`. - type: boolean - issuerRef: - description: |- - Reference to the issuer responsible for issuing the certificate. - If the issuer is namespace-scoped, it must be in the same namespace - as the Certificate. If the issuer is cluster-scoped, it can be used - from any namespace. - - The `name` field of the reference must always be specified. - properties: - group: - description: |- - Group of the issuer being referred to. - Defaults to 'cert-manager.io'. - type: string - kind: - description: |- - Kind of the issuer being referred to. - Defaults to 'Issuer'. - type: string - name: - description: Name of the issuer being referred to. - type: string - required: - - name - type: object - request: - description: |- - The PEM-encoded X.509 certificate signing request to be submitted to the - issuer for signing. - - If the CSR has a BasicConstraints extension, its isCA attribute must - match the `isCA` value of this CertificateRequest. - If the CSR has a KeyUsage extension, its key usages must match the - key usages in the `usages` field of this CertificateRequest. - If the CSR has a ExtKeyUsage extension, its extended key usages - must match the extended key usages in the `usages` field of this - CertificateRequest. - format: byte - type: string - uid: - description: |- - UID contains the uid of the user that created the CertificateRequest. - Populated by the cert-manager webhook on creation and immutable. - type: string - usages: - description: |- - Requested key usages and extended key usages. - - NOTE: If the CSR in the `Request` field has uses the KeyUsage or - ExtKeyUsage extension, these extensions must have the same values - as specified here without any additional values. - - If unset, defaults to `digital signature` and `key encipherment`. - items: - description: |- - KeyUsage specifies valid usage contexts for keys. - See: - https://tools.ietf.org/html/rfc5280#section-4.2.1.3 - https://tools.ietf.org/html/rfc5280#section-4.2.1.12 - - Valid KeyUsage values are as follows: - "signing", - "digital signature", - "content commitment", - "key encipherment", - "key agreement", - "data encipherment", - "cert sign", - "crl sign", - "encipher only", - "decipher only", - "any", - "server auth", - "client auth", - "code signing", - "email protection", - "s/mime", - "ipsec end system", - "ipsec tunnel", - "ipsec user", - "timestamping", - "ocsp signing", - "microsoft sgc", - "netscape sgc" - enum: - - signing - - digital signature - - content commitment - - key encipherment - - key agreement - - data encipherment - - cert sign - - crl sign - - encipher only - - decipher only - - any - - server auth - - client auth - - code signing - - email protection - - s/mime - - ipsec end system - - ipsec tunnel - - ipsec user - - timestamping - - ocsp signing - - microsoft sgc - - netscape sgc - type: string - type: array - x-kubernetes-list-type: atomic - username: - description: |- - Username contains the name of the user that created the CertificateRequest. - Populated by the cert-manager webhook on creation and immutable. - type: string - required: - - issuerRef - - request - type: object - status: - description: |- - Status of the CertificateRequest. - This is set and managed automatically. - Read-only. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status - properties: - ca: - description: |- - The PEM encoded X.509 certificate of the signer, also known as the CA - (Certificate Authority). - This is set on a best-effort basis by different issuers. - If not set, the CA is assumed to be unknown/not available. - format: byte - type: string - certificate: - description: |- - The PEM encoded X.509 certificate resulting from the certificate - signing request. - If not set, the CertificateRequest has either not been completed or has - failed. More information on failure can be found by checking the - `conditions` field. - format: byte - type: string - conditions: - description: |- - List of status conditions to indicate the status of a CertificateRequest. - Known condition types are `Ready`, `InvalidRequest`, `Approved` and `Denied`. - items: - description: CertificateRequestCondition contains condition information for a CertificateRequest. - properties: - lastTransitionTime: - description: |- - LastTransitionTime is the timestamp corresponding to the last status - change of this condition. - format: date-time - type: string - message: - description: |- - Message is a human readable description of the details of the last - transition, complementing reason. - type: string - reason: - description: |- - Reason is a brief machine readable explanation for the condition's last - transition. - type: string - status: - description: Status of the condition, one of (`True`, `False`, `Unknown`). - enum: - - "True" - - "False" - - Unknown - type: string - type: - description: |- - Type of the condition, known values are (`Ready`, `InvalidRequest`, - `Approved`, `Denied`). - type: string - required: - - status - - type - type: object - type: array - x-kubernetes-list-map-keys: - - type - x-kubernetes-list-type: map - failureTime: - description: |- - FailureTime stores the time that this CertificateRequest failed. This is - used to influence garbage collection and back-off. - format: date-time - type: string - type: object - type: object - selectableFields: - - jsonPath: .spec.issuerRef.group - - jsonPath: .spec.issuerRef.kind - - jsonPath: .spec.issuerRef.name - served: true - storage: true - subresources: - status: {} - ---- -# Source: cert-manager/templates/crd-cert-manager.io_certificates.yaml -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - name: "certificates.cert-manager.io" - annotations: - helm.sh/resource-policy: keep - labels: - app: "cert-manager" - app.kubernetes.io/name: "cert-manager" - app.kubernetes.io/instance: "cert-manager" - app.kubernetes.io/component: "crds" - app.kubernetes.io/version: "v1.21.1" - app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 -spec: - group: cert-manager.io - names: - categories: - - cert-manager - kind: Certificate - listKind: CertificateList - plural: certificates - shortNames: - - cert - - certs - singular: certificate - scope: Namespaced - versions: - - additionalPrinterColumns: - - jsonPath: .status.conditions[?(@.type == "Ready")].status - name: Ready - type: string - - jsonPath: .spec.secretName - name: Secret - type: string - - jsonPath: .spec.issuerRef.name - name: Issuer - priority: 1 - type: string - - jsonPath: .status.conditions[?(@.type == "Ready")].message - name: Status - priority: 1 - type: string - - description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1 - schema: - openAPIV3Schema: - description: |- - A Certificate resource should be created to ensure an up to date and signed - X.509 certificate is stored in the Kubernetes Secret resource named in `spec.secretName`. - - The stored certificate will be renewed before it expires (as configured by `spec.renewBefore`). - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: |- - Specification of the desired state of the Certificate resource. - https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status - properties: - additionalOutputFormats: - description: |- - Defines extra output formats of the private key and signed certificate chain - to be written to this Certificate's target Secret. - items: - description: |- - CertificateAdditionalOutputFormat defines an additional output format of a - Certificate resource. These contain supplementary data formats of the signed - certificate chain and paired private key. - properties: - type: - description: |- - Type is the name of the format type that should be written to the - Certificate's target Secret. - enum: - - DER - - CombinedPEM - type: string - required: - - type - type: object - type: array - x-kubernetes-list-type: atomic - commonName: - description: |- - Requested common name X509 certificate subject attribute. - More info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.6 - NOTE: TLS clients will ignore this value when any subject alternative name is - set (see https://tools.ietf.org/html/rfc6125#section-6.4.4). - - Should have a length of 64 characters or fewer to avoid generating invalid CSRs. - Cannot be set if the `literalSubject` field is set. - type: string - dnsNames: - description: Requested DNS subject alternative names. - items: - type: string - type: array - x-kubernetes-list-type: atomic - duration: - description: |- - Requested 'duration' (i.e. lifetime) of the Certificate. Note that the - issuer may choose to ignore the requested duration, just like any other - requested attribute. - - If unset, this defaults to 90 days. - Minimum accepted duration is 1 hour. - Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration. - type: string - emailAddresses: - description: Requested email subject alternative names. - items: - type: string - type: array - x-kubernetes-list-type: atomic - encodeUsagesInRequest: - description: |- - Whether the KeyUsage and ExtKeyUsage extensions should be set in the encoded CSR. - - This option defaults to true, and should only be disabled if the target - issuer does not support CSRs with these X509 KeyUsage/ ExtKeyUsage extensions. - type: boolean - ipAddresses: - description: Requested IP address subject alternative names. - items: - type: string - type: array - x-kubernetes-list-type: atomic - isCA: - description: |- - Requested basic constraints isCA value. - The isCA value is used to set the `isCA` field on the created CertificateRequest - resources. Note that the issuer may choose to ignore the requested isCA value, just - like any other requested attribute. - - If true, this will automatically add the `cert sign` usage to the list - of requested `usages`. - type: boolean - issuerRef: - description: |- - Reference to the issuer responsible for issuing the certificate. - If the issuer is namespace-scoped, it must be in the same namespace - as the Certificate. If the issuer is cluster-scoped, it can be used - from any namespace. - - The `name` field of the reference must always be specified. - properties: - group: - description: |- - Group of the issuer being referred to. - Defaults to 'cert-manager.io'. - type: string - kind: - description: |- - Kind of the issuer being referred to. - Defaults to 'Issuer'. - type: string - name: - description: Name of the issuer being referred to. - type: string - required: - - name - type: object - keystores: - description: Additional keystore output formats to be stored in the Certificate's Secret. - properties: - jks: - description: |- - JKS configures options for storing a JKS keystore in the - `spec.secretName` Secret resource. - properties: - alias: - description: |- - Alias specifies the alias of the key in the keystore, required by the JKS format. - If not provided, the default alias `certificate` will be used. - type: string - create: - description: |- - Create enables JKS keystore creation for the Certificate. - If true, a file named `keystore.jks` will be created in the target - Secret resource, encrypted using the password stored in - `passwordSecretRef` or `password`. - The keystore file will be updated immediately. - If the issuer provided a CA certificate, a file named `truststore.jks` - will also be created in the target Secret resource, encrypted using the - password stored in `passwordSecretRef` - containing the issuing Certificate Authority - type: boolean - password: - description: |- - Password provides a literal password used to encrypt the JKS keystore. - Mutually exclusive with passwordSecretRef. - One of password or passwordSecretRef must provide a password with a non-zero length. - type: string - passwordSecretRef: - description: |- - PasswordSecretRef is a reference to a non-empty key in a Secret resource - containing the password used to encrypt the JKS keystore. - Mutually exclusive with password. - One of password or passwordSecretRef must provide a password with a non-zero length. - properties: - key: - description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. - type: string - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - required: - - name - type: object - required: - - create - type: object - pkcs12: - description: |- - PKCS12 configures options for storing a PKCS12 keystore in the - `spec.secretName` Secret resource. - properties: - create: - description: |- - Create enables PKCS12 keystore creation for the Certificate. - If true, a file named `keystore.p12` will be created in the target - Secret resource, encrypted using the password stored in - `passwordSecretRef` or in `password`. - The keystore file will be updated immediately. - If the issuer provided a CA certificate, a file named `truststore.p12` will - also be created in the target Secret resource, encrypted using the - password stored in `passwordSecretRef` containing the issuing Certificate - Authority - type: boolean - password: - description: |- - Password provides a literal password used to encrypt the PKCS#12 keystore. - Mutually exclusive with passwordSecretRef. - One of password or passwordSecretRef must provide a password with a non-zero length. - type: string - passwordSecretRef: - description: |- - PasswordSecretRef is a reference to a non-empty key in a Secret resource - containing the password used to encrypt the PKCS#12 keystore. - Mutually exclusive with password. - One of password or passwordSecretRef must provide a password with a non-zero length. - properties: - key: - description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. - type: string - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - required: - - name - type: object - profile: - description: |- - Profile specifies the key and certificate encryption algorithms and the HMAC algorithm - used to create the PKCS12 keystore. Default value is `LegacyRC2` for backward compatibility. - - If provided, allowed values are: - `LegacyRC2`: Deprecated. Not supported by default in OpenSSL 3 or Java 20. - `LegacyDES`: Less secure algorithm. Use this option for maximal compatibility. - `Modern2023`: Secure algorithm. Use this option in case you have to always use secure algorithms - (e.g., because of company policy). Please note that the security of the algorithm is not that important - in reality, because the unencrypted certificate and private key are also stored in the Secret. - `Modern2026`: Encodes PKCS#12 files using algorithms that are considered modern as of 2026. - Private keys and certificates are encrypted using PBES2 with PBKDF2-HMAC-SHA-256 and AES-256-CBC. - The MAC algorithm is PBMAC1 with PBKDF2-HMAC-SHA-256 and HMAC-SHA256. - Files produced with this profile can be read by OpenSSL 3.4.0 and higher, Java 26 and higher, - or with Java using compatible versions of Bouncy Castle. Meets FIPS 140-3 requirements. - enum: - - LegacyRC2 - - LegacyDES - - Modern2023 - - Modern2026 - type: string - required: - - create - type: object - type: object - literalSubject: - description: |- - Requested X.509 certificate subject, represented using the LDAP "String - Representation of a Distinguished Name" [1]. - Important: the LDAP string format also specifies the order of the attributes - in the subject, this is important when issuing certs for LDAP authentication. - Example: `CN=foo,DC=corp,DC=example,DC=com` - More info [1]: https://datatracker.ietf.org/doc/html/rfc4514 - More info: https://github.com/cert-manager/cert-manager/issues/3203 - More info: https://github.com/cert-manager/cert-manager/issues/4424 - - Cannot be set if the `subject` or `commonName` field is set. - type: string - nameConstraints: - description: |- - x.509 certificate NameConstraint extension which MUST NOT be used in a non-CA certificate. - More Info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.10 - - This is an Alpha Feature and is only enabled with the - `--feature-gates=NameConstraints=true` option set on both - the controller and webhook components. - properties: - critical: - description: if true then the name constraints are marked critical. - type: boolean - excluded: - description: |- - Excluded contains the constraints which must be disallowed. Any name matching a - restriction in the excluded field is invalid regardless - of information appearing in the permitted - properties: - dnsDomains: - description: DNSDomains is a list of DNS domains that are permitted or excluded. - items: - type: string - type: array - x-kubernetes-list-type: atomic - emailAddresses: - description: EmailAddresses is a list of Email Addresses that are permitted or excluded. - items: - type: string - type: array - x-kubernetes-list-type: atomic - ipRanges: - description: |- - IPRanges is a list of IP Ranges that are permitted or excluded. - This should be a valid CIDR notation. - items: - type: string - type: array - x-kubernetes-list-type: atomic - uriDomains: - description: URIDomains is a list of URI domains that are permitted or excluded. - items: - type: string - type: array - x-kubernetes-list-type: atomic - type: object - permitted: - description: Permitted contains the constraints in which the names must be located. - properties: - dnsDomains: - description: DNSDomains is a list of DNS domains that are permitted or excluded. - items: - type: string - type: array - x-kubernetes-list-type: atomic - emailAddresses: - description: EmailAddresses is a list of Email Addresses that are permitted or excluded. - items: - type: string - type: array - x-kubernetes-list-type: atomic - ipRanges: - description: |- - IPRanges is a list of IP Ranges that are permitted or excluded. - This should be a valid CIDR notation. - items: - type: string - type: array - x-kubernetes-list-type: atomic - uriDomains: - description: URIDomains is a list of URI domains that are permitted or excluded. - items: - type: string - type: array - x-kubernetes-list-type: atomic - type: object - type: object - otherNames: - description: |- - `otherNames` is an escape hatch for SAN that allows any type. We currently restrict the support to string like otherNames, cf RFC 5280 p 37 - Any UTF8 String valued otherName can be passed with by setting the keys oid: x.x.x.x and UTF8Value: somevalue for `otherName`. - Most commonly this would be UPN set with oid: 1.3.6.1.4.1.311.20.2.3 - You should ensure that any OID passed is valid for the UTF8String type as we do not explicitly validate this. - items: - properties: - oid: - description: |- - OID is the object identifier for the otherName SAN. - The object identifier must be expressed as a dotted string, for - example, "1.2.840.113556.1.4.221". - type: string - utf8Value: - description: |- - utf8Value is the string value of the otherName SAN. - The utf8Value accepts any valid UTF8 string to set as value for the otherName SAN. - type: string - type: object - type: array - x-kubernetes-list-type: atomic - privateKey: - description: |- - Private key options. These include the key algorithm and size, the used - encoding and the rotation policy. - properties: - algorithm: - description: |- - Algorithm is the private key algorithm of the corresponding private key - for this certificate. - - If provided, allowed values are either `RSA`, `ECDSA` or `Ed25519`. - If `algorithm` is specified and `size` is not provided, - key size of 2048 will be used for `RSA` key algorithm and - key size of 256 will be used for `ECDSA` key algorithm. - key size is ignored when using the `Ed25519` key algorithm. - enum: - - RSA - - ECDSA - - Ed25519 - type: string - encoding: - description: |- - The private key cryptography standards (PKCS) encoding for this - certificate's private key to be encoded in. - - If provided, allowed values are `PKCS1` and `PKCS8` standing for PKCS#1 - and PKCS#8, respectively. - Defaults to `PKCS1` if not specified. - enum: - - PKCS1 - - PKCS8 - type: string - rotationPolicy: - description: |- - RotationPolicy controls how private keys should be regenerated when a - re-issuance is being processed. - - If set to `Never`, a private key will only be generated if one does not - already exist in the target `spec.secretName`. If one does exist but it - does not have the correct algorithm or size, a warning will be raised - to await user intervention. - If set to `Always`, a private key matching the specified requirements - will be generated whenever a re-issuance occurs. - Default is `Always`. - The default was changed from `Never` to `Always` in cert-manager >=v1.18.0. - enum: - - Never - - Always - type: string - size: - description: |- - Size is the key bit size of the corresponding private key for this certificate. - - If `algorithm` is set to `RSA`, valid values are `2048`, `4096` or `8192`, - and will default to `2048` if not specified. - If `algorithm` is set to `ECDSA`, valid values are `256`, `384` or `521`, - and will default to `256` if not specified. - If `algorithm` is set to `Ed25519`, Size is ignored. - No other values are allowed. - type: integer - type: object - renewBefore: - description: |- - How long before the currently issued certificate's expiry cert-manager should - renew the certificate. For example, if a certificate is valid for 60 minutes, - and `renewBefore=10m`, cert-manager will begin to attempt to renew the certificate - 50 minutes after it was issued (i.e. when there are 10 minutes remaining until - the certificate is no longer valid). - - NOTE: The actual lifetime of the issued certificate is used to determine the - renewal time. If an issuer returns a certificate with a different lifetime than - the one requested, cert-manager will use the lifetime of the issued certificate. - - If unset, this defaults to 1/3 of the issued certificate's lifetime. - Minimum accepted value is 5 minutes. - Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration. - Cannot be set if the `renewBeforePercentage` field is set. - type: string - renewBeforePercentage: - description: |- - `renewBeforePercentage` is like `renewBefore`, except it is a relative percentage - rather than an absolute duration. For example, if a certificate is valid for 60 - minutes, and `renewBeforePercentage=25`, cert-manager will begin to attempt to - renew the certificate 45 minutes after it was issued (i.e. when there are 15 - minutes (25%) remaining until the certificate is no longer valid). - - NOTE: The actual lifetime of the issued certificate is used to determine the - renewal time. If an issuer returns a certificate with a different lifetime than - the one requested, cert-manager will use the lifetime of the issued certificate. - - Value must be an integer in the range (0,100). The minimum effective - `renewBefore` derived from the `renewBeforePercentage` and `duration` fields is 5 - minutes. - Cannot be set if the `renewBefore` field is set. - format: int32 - type: integer - renewal: - description: |- - `renewal` allows configuration of how your certificate is renewed. If the policy mentioned is - `RenewBefore` then the controller respects `renewBefore` and `renewBeforePercentage`. - properties: - policy: - description: '`policy` must be one of `Disabled`, `RenewBefore`.' - enum: - - RenewBefore - - Disabled - type: string - windows: - description: '`windows` mentions the behavior of when the renewal must happen.' - items: - description: CertificateRenewalWindows is the definition for renewal windows - properties: - cron: - description: |- - `cron` is a cron compliant string to allow when the renewal should be allowed. Format is as shown below: - * * * * * - | | | | | - | | | | day of the week (0–6) (Sunday to Saturday; - | | | month (1–12) 7 is also Sunday on some systems) - | | day of the month (1–31) - | hour (0–23) - minute (0–59) - minLength: 1 - type: string - timezone: - description: |- - `timezone` is IANA compliant timezone. For example America/Denver. - If this field is not set, timezone is treated as UTC. - minLength: 1 - type: string - windowDuration: - description: |- - `windowDuration` is how long the cron definition is active for. - Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration. - pattern: ^([0-9]+(\.[0-9]+)?(s|m|h))+$ - type: string - required: - - cron - - windowDuration - type: object - type: array - x-kubernetes-list-type: atomic - type: object - revisionHistoryLimit: - description: |- - The maximum number of CertificateRequest revisions that are maintained in - the Certificate's history. Each revision represents a single `CertificateRequest` - created by this Certificate, either when it was created, renewed, or Spec - was changed. Revisions will be removed by oldest first if the number of - revisions exceeds this number. - - If set, revisionHistoryLimit must be a value of `1` or greater. - Default value is `1`. - format: int32 - type: integer - secretName: - description: |- - Name of the Secret resource that will be automatically created and - managed by this Certificate resource. It will be populated with a - private key and certificate, signed by the denoted issuer. The Secret - resource lives in the same namespace as the Certificate resource. - type: string - secretTemplate: - description: |- - Defines annotations and labels to be copied to the Certificate's Secret. - Labels and annotations on the Secret will be changed as they appear on the - SecretTemplate when added or removed. SecretTemplate annotations are added - in conjunction with, and cannot overwrite, the base set of annotations - cert-manager sets on the Certificate's Secret. - properties: - annotations: - additionalProperties: - type: string - description: Annotations is a key value map to be copied to the target Kubernetes Secret. - type: object - labels: - additionalProperties: - type: string - description: Labels is a key value map to be copied to the target Kubernetes Secret. - type: object - type: object - signatureAlgorithm: - description: |- - Signature algorithm to use. - Allowed values for RSA keys: SHA256WithRSA, SHA384WithRSA, SHA512WithRSA. - Allowed values for ECDSA keys: ECDSAWithSHA256, ECDSAWithSHA384, ECDSAWithSHA512. - Allowed values for Ed25519 keys: PureEd25519. - enum: - - SHA256WithRSA - - SHA384WithRSA - - SHA512WithRSA - - ECDSAWithSHA256 - - ECDSAWithSHA384 - - ECDSAWithSHA512 - - PureEd25519 - type: string - subject: - description: |- - Requested set of X509 certificate subject attributes. - More info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.6 - - The common name attribute is specified separately in the `commonName` field. - Cannot be set if the `literalSubject` field is set. - properties: - countries: - description: Countries to be used on the Certificate. - items: - type: string - type: array - x-kubernetes-list-type: atomic - localities: - description: Cities to be used on the Certificate. - items: - type: string - type: array - x-kubernetes-list-type: atomic - organizationalUnits: - description: Organizational Units to be used on the Certificate. - items: - type: string - type: array - x-kubernetes-list-type: atomic - organizations: - description: Organizations to be used on the Certificate. - items: - type: string - type: array - x-kubernetes-list-type: atomic - postalCodes: - description: Postal codes to be used on the Certificate. - items: - type: string - type: array - x-kubernetes-list-type: atomic - provinces: - description: State/Provinces to be used on the Certificate. - items: - type: string - type: array - x-kubernetes-list-type: atomic - serialNumber: - description: Serial number to be used on the Certificate. - type: string - streetAddresses: - description: Street addresses to be used on the Certificate. - items: - type: string - type: array - x-kubernetes-list-type: atomic - type: object - uris: - description: Requested URI subject alternative names. - items: - type: string - type: array - x-kubernetes-list-type: atomic - usages: - description: |- - Requested key usages and extended key usages. - These usages are used to set the `usages` field on the created CertificateRequest - resources. If `encodeUsagesInRequest` is unset or set to `true`, the usages - will additionally be encoded in the `request` field which contains the CSR blob. - - If unset, defaults to `digital signature` and `key encipherment`. - items: - description: |- - KeyUsage specifies valid usage contexts for keys. - See: - https://tools.ietf.org/html/rfc5280#section-4.2.1.3 - https://tools.ietf.org/html/rfc5280#section-4.2.1.12 - - Valid KeyUsage values are as follows: - "signing", - "digital signature", - "content commitment", - "key encipherment", - "key agreement", - "data encipherment", - "cert sign", - "crl sign", - "encipher only", - "decipher only", - "any", - "server auth", - "client auth", - "code signing", - "email protection", - "s/mime", - "ipsec end system", - "ipsec tunnel", - "ipsec user", - "timestamping", - "ocsp signing", - "microsoft sgc", - "netscape sgc" - enum: - - signing - - digital signature - - content commitment - - key encipherment - - key agreement - - data encipherment - - cert sign - - crl sign - - encipher only - - decipher only - - any - - server auth - - client auth - - code signing - - email protection - - s/mime - - ipsec end system - - ipsec tunnel - - ipsec user - - timestamping - - ocsp signing - - microsoft sgc - - netscape sgc - type: string - type: array - x-kubernetes-list-type: atomic - required: - - issuerRef - - secretName - type: object - status: - description: |- - Status of the Certificate. - This is set and managed automatically. - Read-only. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status - properties: - acme: - description: ACME stores information that is fetched from the ACME CA server. - properties: - ari: - description: |- - ARI stores the ACME Renewal Information that is fetched from the ACME server - in accordance with RFC 9773. This is only populated if the ARI feature gate is enabled. - properties: - explanationURL: - description: |- - ExplanationURL is a human-readable URL that may explain why the suggested window - has its current value. - type: string - lastChecked: - description: LastChecked is the time at which the ACME server was last checked for renewal information. - format: date-time - type: string - lastError: - description: LastError is the last error encountered when checking the ACME server for renewal information, if any. - type: string - nextCheck: - description: NextCheck is the time at which the ACME server will next be checked for renewal information. - format: date-time - type: string - suggestedWindow: - description: SuggestedWindow is the suggested renewal window as returned by the ACME server in accordance with RFC 9773. - properties: - end: - description: End is the end of the suggested renewal window. - format: date-time - type: string - start: - description: Start is the start of the suggested renewal window. - format: date-time - type: string - required: - - end - - start - type: object - type: object - type: object - conditions: - description: |- - List of status conditions to indicate the status of certificates. - Known condition types are `Ready` and `Issuing`. - items: - description: CertificateCondition contains condition information for a Certificate. - properties: - lastTransitionTime: - description: |- - LastTransitionTime is the timestamp corresponding to the last status - change of this condition. - format: date-time - type: string - message: - description: |- - Message is a human readable description of the details of the last - transition, complementing reason. - type: string - observedGeneration: - description: |- - If set, this represents the .metadata.generation that the condition was - set based upon. - For instance, if .metadata.generation is currently 12, but the - .status.condition[x].observedGeneration is 9, the condition is out of date - with respect to the current state of the Certificate. - format: int64 - type: integer - reason: - description: |- - Reason is a brief machine readable explanation for the condition's last - transition. - type: string - status: - description: Status of the condition, one of (`True`, `False`, `Unknown`). - enum: - - "True" - - "False" - - Unknown - type: string - type: - description: Type of the condition, known values are (`Ready`, `Issuing`). - type: string - required: - - status - - type - type: object - type: array - x-kubernetes-list-map-keys: - - type - x-kubernetes-list-type: map - failedIssuanceAttempts: - description: |- - The number of continuous failed issuance attempts up till now. This - field gets removed (if set) on a successful issuance and gets set to - 1 if unset and an issuance has failed. If an issuance has failed, the - delay till the next issuance will be calculated using formula - time.Hour * 2 ^ (failedIssuanceAttempts - 1). - type: integer - lastFailureTime: - description: |- - LastFailureTime is set only if the latest issuance for this - Certificate failed and contains the time of the failure. If an - issuance has failed, the delay till the next issuance will be - calculated using formula time.Hour * 2 ^ (failedIssuanceAttempts - - 1). If the latest issuance has succeeded this field will be unset. - format: date-time - type: string - nextPrivateKeySecretName: - description: |- - The name of the Secret resource containing the private key to be used - for the next certificate iteration. - The keymanager controller will automatically set this field if the - `Issuing` condition is set to `True`. - It will automatically unset this field when the Issuing condition is - not set or False. - type: string - notAfter: - description: |- - The expiration time of the certificate stored in the secret named - by this resource in `spec.secretName`. - format: date-time - type: string - notBefore: - description: |- - The time after which the certificate stored in the secret named - by this resource in `spec.secretName` is valid. - format: date-time - type: string - renewalTime: - description: |- - RenewalTime is the time at which the certificate will be next - renewed. - If not set, no upcoming renewal is scheduled. - format: date-time - type: string - revision: - description: |- - The current 'revision' of the certificate as issued. - - When a CertificateRequest resource is created, it will have the - `cert-manager.io/certificate-revision` set to one greater than the - current value of this field. - - Upon issuance, this field will be set to the value of the annotation - on the CertificateRequest resource used to issue the certificate. - - Persisting the value on the CertificateRequest resource allows the - certificates controller to know whether a request is part of an old - issuance or if it is part of the ongoing revision's issuance by - checking if the revision value in the annotation is greater than this - field. - type: integer - type: object - type: object - selectableFields: - - jsonPath: .spec.issuerRef.group - - jsonPath: .spec.issuerRef.kind - - jsonPath: .spec.issuerRef.name - served: true - storage: true - subresources: - status: {} - ---- -# Source: cert-manager/templates/crd-cert-manager.io_clusterissuers.yaml -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - name: "clusterissuers.cert-manager.io" - annotations: - helm.sh/resource-policy: keep - labels: - app: "cert-manager" - app.kubernetes.io/name: "cert-manager" - app.kubernetes.io/instance: "cert-manager" - app.kubernetes.io/component: "crds" - app.kubernetes.io/version: "v1.21.1" - app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 -spec: - group: cert-manager.io - names: - categories: - - cert-manager - kind: ClusterIssuer - listKind: ClusterIssuerList - plural: clusterissuers - shortNames: - - ciss - singular: clusterissuer - scope: Cluster - versions: - - additionalPrinterColumns: - - jsonPath: .status.conditions[?(@.type == "Ready")].status - name: Ready - type: string - - jsonPath: .status.conditions[?(@.type == "Ready")].message - name: Status - priority: 1 - type: string - - description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1 - schema: - openAPIV3Schema: - description: |- - A ClusterIssuer represents a certificate issuing authority which can be - referenced as part of `issuerRef` fields. - It is similar to an Issuer, however it is cluster-scoped and therefore can - be referenced by resources that exist in *any* namespace, not just the same - namespace as the referent. - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: Desired state of the ClusterIssuer resource. - properties: - acme: - description: |- - ACME configures this issuer to communicate with a RFC8555 (ACME) server - to obtain signed x509 certificates. - properties: - caBundle: - description: |- - Base64-encoded bundle of PEM CAs which can be used to validate the certificate - chain presented by the ACME server. - Mutually exclusive with SkipTLSVerify; prefer using CABundle to prevent various - kinds of security vulnerabilities. - If CABundle and SkipTLSVerify are unset, the system certificate bundle inside - the container is used to validate the TLS connection. - format: byte - type: string - disableAccountKeyGeneration: - description: |- - Enables or disables generating a new ACME account key. - If true, the Issuer resource will *not* request a new account but will expect - the account key to be supplied via an existing secret. - If false, the cert-manager system will generate a new ACME account key - for the Issuer. - Defaults to false. - type: boolean - email: - description: |- - Email is the email address to be associated with the ACME account. - This field is optional, but it is strongly recommended to be set. - It will be used to contact you in case of issues with your account or - certificates, including expiry notification emails. - This field may be updated after the account is initially registered. - type: string - enableDurationFeature: - description: |- - Enables requesting a Not After date on certificates that matches the - duration of the certificate. This is not supported by all ACME servers - like Let's Encrypt. If set to true when the ACME server does not support - it, it will create an error on the Order. - Defaults to false. - type: boolean - externalAccountBinding: - description: |- - ExternalAccountBinding is a reference to a CA external account of the ACME - server. - If set, upon registration cert-manager will attempt to associate the given - external account credentials with the registered ACME account. - properties: - keyAlgorithm: - description: |- - Deprecated: keyAlgorithm field exists for historical compatibility - reasons and should not be used. The algorithm is now hardcoded to HS256 - in golang/x/crypto/acme. - enum: - - HS256 - - HS384 - - HS512 - type: string - keyID: - description: keyID is the ID of the CA key that the External Account is bound to. - type: string - keySecretRef: - description: |- - keySecretRef is a Secret Key Selector referencing a data item in a Kubernetes - Secret which holds the symmetric MAC key of the External Account Binding. - The `key` is the index string that is paired with the key data in the - Secret and should not be confused with the key data itself, or indeed with - the External Account Binding keyID above. - The secret key stored in the Secret **must** be un-padded, base64 URL - encoded data. - properties: - key: - description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. - type: string - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - required: - - name - type: object - required: - - keyID - - keySecretRef - type: object - preferredChain: - description: |- - PreferredChain is the chain to use if the ACME server outputs multiple. - PreferredChain is no guarantee that this one gets delivered by the ACME - endpoint. - For example, for Let's Encrypt's DST cross-sign you would use: - "DST Root CA X3" or "ISRG Root X1" for the newer Let's Encrypt root CA. - This value picks the first certificate bundle in the combined set of - ACME default and alternative chains that has a root-most certificate with - this value as its issuer's commonname. - maxLength: 64 - type: string - privateKeySecretRef: - description: |- - PrivateKey is the name of a Kubernetes Secret resource that will be used to - store the automatically generated ACME account private key. - Optionally, a `key` may be specified to select a specific entry within - the named Secret resource. - If `key` is not specified, a default of `tls.key` will be used. - properties: - key: - description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. - type: string - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - required: - - name - type: object - profile: - description: |- - Profile allows requesting a certificate profile from the ACME server. - Supported profiles are listed by the server's ACME directory URL. - type: string - server: - description: |- - Server is the URL used to access the ACME server's 'directory' endpoint. - For example, for Let's Encrypt's staging endpoint, you would use: - "https://acme-staging-v02.api.letsencrypt.org/directory". - Only ACME v2 endpoints (i.e. RFC 8555) are supported. - type: string - skipTLSVerify: - description: |- - INSECURE: Enables or disables validation of the ACME server TLS certificate. - If true, requests to the ACME server will not have the TLS certificate chain - validated. - Mutually exclusive with CABundle; prefer using CABundle to prevent various - kinds of security vulnerabilities. - Only enable this option in development environments. - If CABundle and SkipTLSVerify are unset, the system certificate bundle inside - the container is used to validate the TLS connection. - Defaults to false. - type: boolean - solvers: - description: |- - Solvers is a list of challenge solvers that will be used to solve - ACME challenges for the matching domains. - Solver configurations must be provided in order to obtain certificates - from an ACME server. - For more information, see: https://cert-manager.io/docs/configuration/acme/ - items: - description: |- - An ACMEChallengeSolver describes how to solve ACME challenges for the issuer it is part of. - A selector may be provided to use different solving strategies for different DNS names. - Only one of HTTP01 or DNS01 must be provided. - properties: - dns01: - description: |- - Configures cert-manager to attempt to complete authorizations by - performing the DNS01 challenge flow. - properties: - acmeDNS: - description: |- - Use the 'ACME DNS' (https://github.com/joohoi/acme-dns) API to manage - DNS01 challenge records. - properties: - accountSecretRef: - description: |- - A reference to a specific 'key' within a Secret resource. - In some instances, `key` is a required field. - properties: - key: - description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. - type: string - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - required: - - name - type: object - host: - type: string - required: - - accountSecretRef - - host - type: object - akamai: - description: Use the Akamai DNS zone management API to manage DNS01 challenge records. - properties: - accessTokenSecretRef: - description: |- - A reference to a specific 'key' within a Secret resource. - In some instances, `key` is a required field. - properties: - key: - description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. - type: string - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - required: - - name - type: object - clientSecretSecretRef: - description: |- - A reference to a specific 'key' within a Secret resource. - In some instances, `key` is a required field. - properties: - key: - description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. - type: string - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - required: - - name - type: object - clientTokenSecretRef: - description: |- - A reference to a specific 'key' within a Secret resource. - In some instances, `key` is a required field. - properties: - key: - description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. - type: string - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - required: - - name - type: object - serviceConsumerDomain: - type: string - required: - - accessTokenSecretRef - - clientSecretSecretRef - - clientTokenSecretRef - - serviceConsumerDomain - type: object - azureDNS: - description: Use the Microsoft Azure DNS API to manage DNS01 challenge records. - properties: - clientID: - description: |- - Auth: Azure Service Principal: - The ClientID of the Azure Service Principal used to authenticate with Azure DNS. - If set, ClientSecret and TenantID must also be set. - type: string - clientSecretSecretRef: - description: |- - Auth: Azure Service Principal: - A reference to a Secret containing the password associated with the Service Principal. - If set, ClientID and TenantID must also be set. - properties: - key: - description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. - type: string - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - required: - - name - type: object - environment: - description: name of the Azure environment (default AzurePublicCloud) - enum: - - AzurePublicCloud - - AzureChinaCloud - - AzureGermanCloud - - AzureUSGovernmentCloud - type: string - hostedZoneName: - description: name of the DNS zone that should be used - type: string - managedIdentity: - description: |- - Auth: Azure Workload Identity or Azure Managed Service Identity: - Settings to enable Azure Workload Identity or Azure Managed Service Identity - If set, ClientID, ClientSecret and TenantID must not be set. - properties: - clientID: - description: client ID of the managed identity, cannot be used at the same time as resourceID - type: string - resourceID: - description: |- - resource ID of the managed identity, cannot be used at the same time as clientID - Cannot be used for Azure Managed Service Identity - type: string - tenantID: - description: tenant ID of the managed identity, cannot be used at the same time as resourceID - type: string - type: object - resourceGroupName: - description: resource group the DNS zone is located in - type: string - subscriptionID: - description: ID of the Azure subscription - type: string - tenantID: - description: |- - Auth: Azure Service Principal: - The TenantID of the Azure Service Principal used to authenticate with Azure DNS. - If set, ClientID and ClientSecret must also be set. - type: string - zoneType: - description: |- - ZoneType determines which type of Azure DNS zone to use. - - Valid values are: - - AzurePublicZone (default): Use a public Azure DNS zone. - - AzurePrivateZone: Use an Azure Private DNS zone. - - If not specified, AzurePublicZone is used. - - Support for Azure Private DNS zones is currently - experimental and may change in future releases. - enum: - - AzurePublicZone - - AzurePrivateZone - type: string - required: - - resourceGroupName - - subscriptionID - type: object - cloudDNS: - description: Use the Google Cloud DNS API to manage DNS01 challenge records. - properties: - hostedZoneName: - description: |- - HostedZoneName is an optional field that tells cert-manager in which - Cloud DNS zone the challenge record has to be created. - If left empty cert-manager will automatically choose a zone. - type: string - project: - type: string - serviceAccountSecretRef: - description: |- - A reference to a specific 'key' within a Secret resource. - In some instances, `key` is a required field. - properties: - key: - description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. - type: string - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - required: - - name - type: object - required: - - project - type: object - cloudflare: - description: Use the Cloudflare API to manage DNS01 challenge records. - properties: - apiKeySecretRef: - description: |- - API key to use to authenticate with Cloudflare. - Note: using an API token to authenticate is now the recommended method - as it allows greater control of permissions. - properties: - key: - description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. - type: string - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - required: - - name - type: object - apiTokenSecretRef: - description: API token used to authenticate with Cloudflare. - properties: - key: - description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. - type: string - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - required: - - name - type: object - email: - description: Email of the account, only required when using API key based authentication. - type: string - type: object - cnameStrategy: - description: |- - CNAMEStrategy configures how the DNS01 provider should handle CNAME - records when found in DNS zones. - enum: - - None - - Follow - type: string - digitalocean: - description: Use the DigitalOcean DNS API to manage DNS01 challenge records. - properties: - tokenSecretRef: - description: |- - A reference to a specific 'key' within a Secret resource. - In some instances, `key` is a required field. - properties: - key: - description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. - type: string - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - required: - - name - type: object - required: - - tokenSecretRef - type: object - rfc2136: - description: |- - Use RFC2136 ("Dynamic Updates in the Domain Name System") (https://datatracker.ietf.org/doc/rfc2136/) - to manage DNS01 challenge records. - properties: - nameserver: - description: |- - The IP address or hostname of an authoritative DNS server supporting - RFC2136 in the form host:port. If the host is an IPv6 address it must be - enclosed in square brackets (e.g [2001:db8::1]); port is optional. - This field is required. - type: string - protocol: - description: Protocol to use for dynamic DNS update queries. Valid values are (case-sensitive) ``TCP`` and ``UDP``; ``UDP`` (default). - enum: - - TCP - - UDP - type: string - tsigAlgorithm: - description: |- - The TSIG Algorithm configured in the DNS supporting RFC2136. Used only - when ``tsigSecretSecretRef`` and ``tsigKeyName`` are defined. - Supported values are (case-insensitive): ``HMACMD5`` (default), - ``HMACSHA1``, ``HMACSHA256`` or ``HMACSHA512``. - type: string - tsigKeyName: - description: |- - The TSIG Key name configured in the DNS. - If ``tsigSecretSecretRef`` is defined, this field is required. - type: string - tsigSecretSecretRef: - description: |- - The name of the secret containing the TSIG value. - If ``tsigKeyName`` is defined, this field is required. - properties: - key: - description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. - type: string - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - required: - - name - type: object - required: - - nameserver - type: object - route53: - description: Use the AWS Route53 API to manage DNS01 challenge records. - properties: - accessKeyID: - description: |- - The AccessKeyID is used for authentication. - Cannot be set when SecretAccessKeyID is set. - If neither the Access Key nor Key ID are set, we fall back to using env - vars, shared credentials file, or AWS Instance metadata, - see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials - type: string - accessKeyIDSecretRef: - description: |- - The SecretAccessKey is used for authentication. If set, pull the AWS - access key ID from a key within a Kubernetes Secret. - Cannot be set when AccessKeyID is set. - If neither the Access Key nor Key ID are set, we fall back to using env - vars, shared credentials file, or AWS Instance metadata, - see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials - properties: - key: - description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. - type: string - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - required: - - name - type: object - auth: - description: Auth configures how cert-manager authenticates. - properties: - kubernetes: - description: |- - Kubernetes authenticates with Route53 using AssumeRoleWithWebIdentity - by passing a bound ServiceAccount token. - properties: - serviceAccountRef: - description: |- - A reference to a service account that will be used to request a bound - token (also known as "projected token"). To use this field, you must - configure an RBAC rule to let cert-manager request a token. - properties: - audiences: - description: |- - TokenAudiences is an optional list of audiences to include in the - token passed to AWS. The default token consisting of the issuer's namespace - and name is always included. - If unset the audience defaults to `sts.amazonaws.com`. - items: - type: string - type: array - x-kubernetes-list-type: atomic - name: - description: Name of the ServiceAccount used to request a token. - type: string - required: - - name - type: object - required: - - serviceAccountRef - type: object - required: - - kubernetes - type: object - hostedZoneID: - description: If set, the provider will manage only this zone in Route53 and will not do a lookup using the route53:ListHostedZonesByName api call. - type: string - region: - description: |- - Override the AWS region. - - Route53 is a global service and does not have regional endpoints but the - region specified here (or via environment variables) is used as a hint to - help compute the correct AWS credential scope and partition when it - connects to Route53. See: - - [Amazon Route 53 endpoints and quotas](https://docs.aws.amazon.com/general/latest/gr/r53.html) - - [Global services](https://docs.aws.amazon.com/whitepapers/latest/aws-fault-isolation-boundaries/global-services.html) - - If you omit this region field, cert-manager will use the region from - AWS_REGION and AWS_DEFAULT_REGION environment variables, if they are set - in the cert-manager controller Pod. - - The `region` field is not needed if you use [IAM Roles for Service Accounts (IRSA)](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html). - Instead an AWS_REGION environment variable is added to the cert-manager controller Pod by: - [Amazon EKS Pod Identity Webhook](https://github.com/aws/amazon-eks-pod-identity-webhook). - In this case this `region` field value is ignored. - - The `region` field is not needed if you use [EKS Pod Identities](https://docs.aws.amazon.com/eks/latest/userguide/pod-identities.html). - Instead an AWS_REGION environment variable is added to the cert-manager controller Pod by: - [Amazon EKS Pod Identity Agent](https://github.com/aws/eks-pod-identity-agent), - In this case this `region` field value is ignored. - type: string - role: - description: |- - Role is a Role ARN which the Route53 provider will assume using either the explicit credentials AccessKeyID/SecretAccessKey - or the inferred credentials from environment variables, shared credentials file or AWS Instance metadata - type: string - secretAccessKeySecretRef: - description: |- - The SecretAccessKey is used for authentication. - If neither the Access Key nor Key ID are set, we fall back to using env - vars, shared credentials file, or AWS Instance metadata, - see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials - properties: - key: - description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. - type: string - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - required: - - name - type: object - type: object - webhook: - description: |- - Configure an external webhook based DNS01 challenge solver to manage - DNS01 challenge records. - properties: - config: - description: |- - Additional configuration that should be passed to the webhook apiserver - when challenges are processed. - This can contain arbitrary JSON data. - Secret values should not be specified in this stanza. - If secret values are needed (e.g., credentials for a DNS service), you - should use a SecretKeySelector to reference a Secret resource. - For details on the schema of this field, consult the webhook provider - implementation's documentation. - x-kubernetes-preserve-unknown-fields: true - groupName: - description: |- - The API group name that should be used when POSTing ChallengePayload - resources to the webhook apiserver. - This should be the same as the GroupName specified in the webhook - provider implementation. - type: string - solverName: - description: |- - The name of the solver to use, as defined in the webhook provider - implementation. - This will typically be the name of the provider, e.g., 'cloudflare'. - type: string - required: - - groupName - - solverName - type: object - type: object - http01: - description: |- - Configures cert-manager to attempt to complete authorizations by - performing the HTTP01 challenge flow. - It is not possible to obtain certificates for wildcard domain names - (e.g., `*.example.com`) using the HTTP01 challenge mechanism. - properties: - gatewayHTTPRoute: - description: |- - The Gateway API is a sig-network community API that models service networking - in Kubernetes (https://gateway-api.sigs.k8s.io/). The Gateway solver will - create HTTPRoutes with the specified labels in the same namespace as the challenge. - This solver is experimental, and fields / behaviour may change in the future. - properties: - labels: - additionalProperties: - type: string - description: |- - Custom labels that will be applied to HTTPRoutes created by cert-manager - while solving HTTP-01 challenges. - type: object - parentRefs: - description: |- - When solving an HTTP-01 challenge, cert-manager creates an HTTPRoute. - cert-manager needs to know which parentRefs should be used when creating - the HTTPRoute. Usually, the parentRef references a Gateway. See: - https://gateway-api.sigs.k8s.io/api-types/httproute/#attaching-to-gateways - items: - description: |- - ParentReference identifies an API object (usually a Gateway) that can be considered - a parent of this resource (usually a route). There are two kinds of parent resources - with "Core" support: - - * Gateway (Gateway conformance profile) - * Service (Mesh conformance profile, ClusterIP Services only) - - This API may be extended in the future to support additional kinds of parent - resources. - - The API object must be valid in the cluster; the Group and Kind must - be registered in the cluster for this reference to be valid. - properties: - group: - default: gateway.networking.k8s.io - description: |- - Group is the group of the referent. - When unspecified, "gateway.networking.k8s.io" is inferred. - To set the core API group (such as for a "Service" kind referent), - Group must be explicitly set to "" (empty string). - - Support: Core - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - default: Gateway - description: |- - Kind is kind of the referent. - - There are two kinds of parent resources with "Core" support: - - * Gateway (Gateway conformance profile) - * Service (Mesh conformance profile, ClusterIP Services only) - - Support for other resources is Implementation-Specific. - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: |- - Name is the name of the referent. - - Support: Core - maxLength: 253 - minLength: 1 - type: string - namespace: - description: |- - Namespace is the namespace of the referent. When unspecified, this refers - to the local namespace of the Route. - - Note that there are specific rules for ParentRefs which cross namespace - boundaries. Cross-namespace references are only valid if they are explicitly - allowed by something in the namespace they are referring to. For example: - Gateway has the AllowedRoutes field, and ReferenceGrant provides a - generic way to enable any other kind of cross-namespace reference. - - - ParentRefs from a Route to a Service in the same namespace are "producer" - routes, which apply default routing rules to inbound connections from - any namespace to the Service. - - ParentRefs from a Route to a Service in a different namespace are - "consumer" routes, and these routing rules are only applied to outbound - connections originating from the same namespace as the Route, for which - the intended destination of the connections are a Service targeted as a - ParentRef of the Route. - - - Support: Core - maxLength: 63 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ - type: string - port: - description: |- - Port is the network port this Route targets. It can be interpreted - differently based on the type of parent resource. - - When the parent resource is a Gateway, this targets all listeners - listening on the specified port that also support this kind of Route(and - select this Route). It's not recommended to set `Port` unless the - networking behaviors specified in a Route must apply to a specific port - as opposed to a listener(s) whose port(s) may be changed. When both Port - and SectionName are specified, the name and port of the selected listener - must match both specified values. - - - When the parent resource is a Service, this targets a specific port in the - Service spec. When both Port (experimental) and SectionName are specified, - the name and port of the selected port must match both specified values. - - - Implementations MAY choose to support other parent resources. - Implementations supporting other types of parent resources MUST clearly - document how/if Port is interpreted. - - For the purpose of status, an attachment is considered successful as - long as the parent resource accepts it partially. For example, Gateway - listeners can restrict which Routes can attach to them by Route kind, - namespace, or hostname. If 1 of 2 Gateway listeners accept attachment - from the referencing Route, the Route MUST be considered successfully - attached. If no Gateway listeners accept attachment from this Route, - the Route MUST be considered detached from the Gateway. - - Support: Extended - format: int32 - maximum: 65535 - minimum: 1 - type: integer - sectionName: - description: |- - SectionName is the name of a section within the target resource. In the - following resources, SectionName is interpreted as the following: - - * Gateway: Listener name. When both Port (experimental) and SectionName - are specified, the name and port of the selected listener must match - both specified values. - * Service: Port name. When both Port (experimental) and SectionName - are specified, the name and port of the selected listener must match - both specified values. - - Implementations MAY choose to support attaching Routes to other resources. - If that is the case, they MUST clearly document how SectionName is - interpreted. - - When unspecified (empty string), this will reference the entire resource. - For the purpose of status, an attachment is considered successful if at - least one section in the parent resource accepts it. For example, Gateway - listeners can restrict which Routes can attach to them by Route kind, - namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from - the referencing Route, the Route MUST be considered successfully - attached. If no Gateway listeners accept attachment from this Route, the - Route MUST be considered detached from the Gateway. - - Support: Core - maxLength: 253 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - required: - - name - type: object - type: array - x-kubernetes-list-type: atomic - podTemplate: - description: |- - Optional pod template used to configure the ACME challenge solver pods - used for HTTP01 challenges. - properties: - metadata: - description: |- - ObjectMeta overrides for the pod used to solve HTTP01 challenges. - Only the 'labels' and 'annotations' fields may be set. - If labels or annotations overlap with in-built values, the values here - will override the in-built values. - properties: - annotations: - additionalProperties: - type: string - description: Annotations that should be added to the created ACME HTTP01 solver pods. - type: object - labels: - additionalProperties: - type: string - description: Labels that should be added to the created ACME HTTP01 solver pods. - type: object - type: object - spec: - description: |- - PodSpec defines overrides for the HTTP01 challenge solver pod. - Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields. - All other fields will be ignored. - properties: - affinity: - description: If specified, the pod's scheduling constraints - properties: - nodeAffinity: - description: Describes node affinity scheduling rules for the pod. - properties: - preferredDuringSchedulingIgnoredDuringExecution: - description: |- - The scheduler will prefer to schedule pods to nodes that satisfy - the affinity expressions specified by this field, but it may choose - a node that violates one or more of the expressions. The node that is - most preferred is the one with the greatest sum of weights, i.e. - for each node that meets all of the scheduling requirements (resource - request, requiredDuringScheduling affinity expressions, etc.), - compute a sum by iterating through the elements of this field and adding - "weight" to the sum if the node matches the corresponding matchExpressions; the - node(s) with the highest sum are the most preferred. - items: - description: |- - An empty preferred scheduling term matches all objects with implicit weight 0 - (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). - properties: - preference: - description: A node selector term, associated with the corresponding weight. - properties: - matchExpressions: - description: A list of node selector requirements by node's labels. - items: - description: |- - A node selector requirement is a selector that contains values, a key, and an operator - that relates the key and values. - properties: - key: - description: The label key that the selector applies to. - type: string - operator: - description: |- - Represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. - type: string - values: - description: |- - An array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. If the operator is Gt or Lt, the values - array must have a single element, which will be interpreted as an integer. - This array is replaced during a strategic merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchFields: - description: A list of node selector requirements by node's fields. - items: - description: |- - A node selector requirement is a selector that contains values, a key, and an operator - that relates the key and values. - properties: - key: - description: The label key that the selector applies to. - type: string - operator: - description: |- - Represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. - type: string - values: - description: |- - An array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. If the operator is Gt or Lt, the values - array must have a single element, which will be interpreted as an integer. - This array is replaced during a strategic merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - type: object - x-kubernetes-map-type: atomic - weight: - description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100. - format: int32 - type: integer - required: - - preference - - weight - type: object - type: array - x-kubernetes-list-type: atomic - requiredDuringSchedulingIgnoredDuringExecution: - description: |- - If the affinity requirements specified by this field are not met at - scheduling time, the pod will not be scheduled onto the node. - If the affinity requirements specified by this field cease to be met - at some point during pod execution (e.g. due to an update), the system - may or may not try to eventually evict the pod from its node. - properties: - nodeSelectorTerms: - description: Required. A list of node selector terms. The terms are ORed. - items: - description: |- - A null or empty node selector term matches no objects. The requirements of - them are ANDed. - The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. - properties: - matchExpressions: - description: A list of node selector requirements by node's labels. - items: - description: |- - A node selector requirement is a selector that contains values, a key, and an operator - that relates the key and values. - properties: - key: - description: The label key that the selector applies to. - type: string - operator: - description: |- - Represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. - type: string - values: - description: |- - An array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. If the operator is Gt or Lt, the values - array must have a single element, which will be interpreted as an integer. - This array is replaced during a strategic merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchFields: - description: A list of node selector requirements by node's fields. - items: - description: |- - A node selector requirement is a selector that contains values, a key, and an operator - that relates the key and values. - properties: - key: - description: The label key that the selector applies to. - type: string - operator: - description: |- - Represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. - type: string - values: - description: |- - An array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. If the operator is Gt or Lt, the values - array must have a single element, which will be interpreted as an integer. - This array is replaced during a strategic merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - type: object - x-kubernetes-map-type: atomic - type: array - x-kubernetes-list-type: atomic - required: - - nodeSelectorTerms - type: object - x-kubernetes-map-type: atomic - type: object - podAffinity: - description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)). - properties: - preferredDuringSchedulingIgnoredDuringExecution: - description: |- - The scheduler will prefer to schedule pods to nodes that satisfy - the affinity expressions specified by this field, but it may choose - a node that violates one or more of the expressions. The node that is - most preferred is the one with the greatest sum of weights, i.e. - for each node that meets all of the scheduling requirements (resource - request, requiredDuringScheduling affinity expressions, etc.), - compute a sum by iterating through the elements of this field and adding - "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the - node(s) with the highest sum are the most preferred. - items: - description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) - properties: - podAffinityTerm: - description: Required. A pod affinity term, associated with the corresponding weight. - properties: - labelSelector: - description: |- - A label query over a set of resources, in this case pods. - If it's null, this PodAffinityTerm matches with no Pods. - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - matchLabelKeys: - description: |- - MatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both matchLabelKeys and labelSelector. - Also, matchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - mismatchLabelKeys: - description: |- - MismatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. - Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - namespaceSelector: - description: |- - A label query over the set of namespaces that the term applies to. - The term is applied to the union of the namespaces selected by this field - and the ones listed in the namespaces field. - null selector and null or empty namespaces list means "this pod's namespace". - An empty selector ({}) matches all namespaces. - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - namespaces: - description: |- - namespaces specifies a static list of namespace names that the term applies to. - The term is applied to the union of the namespaces listed in this field - and the ones selected by namespaceSelector. - null or empty namespaces list and null namespaceSelector means "this pod's namespace". - items: - type: string - type: array - x-kubernetes-list-type: atomic - topologyKey: - description: |- - This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching - the labelSelector in the specified namespaces, where co-located is defined as running on a node - whose value of the label with key topologyKey matches that of any node on which any of the - selected pods is running. - Empty topologyKey is not allowed. - type: string - required: - - topologyKey - type: object - weight: - description: |- - weight associated with matching the corresponding podAffinityTerm, - in the range 1-100. - format: int32 - type: integer - required: - - podAffinityTerm - - weight - type: object - type: array - x-kubernetes-list-type: atomic - requiredDuringSchedulingIgnoredDuringExecution: - description: |- - If the affinity requirements specified by this field are not met at - scheduling time, the pod will not be scheduled onto the node. - If the affinity requirements specified by this field cease to be met - at some point during pod execution (e.g. due to a pod label update), the - system may or may not try to eventually evict the pod from its node. - When there are multiple elements, the lists of nodes corresponding to each - podAffinityTerm are intersected, i.e. all terms must be satisfied. - items: - description: |- - Defines a set of pods (namely those matching the labelSelector - relative to the given namespace(s)) that this pod should be - co-located (affinity) or not co-located (anti-affinity) with, - where co-located is defined as running on a node whose value of - the label with key matches that of any node on which - a pod of the set of pods is running - properties: - labelSelector: - description: |- - A label query over a set of resources, in this case pods. - If it's null, this PodAffinityTerm matches with no Pods. - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - matchLabelKeys: - description: |- - MatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both matchLabelKeys and labelSelector. - Also, matchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - mismatchLabelKeys: - description: |- - MismatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. - Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - namespaceSelector: - description: |- - A label query over the set of namespaces that the term applies to. - The term is applied to the union of the namespaces selected by this field - and the ones listed in the namespaces field. - null selector and null or empty namespaces list means "this pod's namespace". - An empty selector ({}) matches all namespaces. - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - namespaces: - description: |- - namespaces specifies a static list of namespace names that the term applies to. - The term is applied to the union of the namespaces listed in this field - and the ones selected by namespaceSelector. - null or empty namespaces list and null namespaceSelector means "this pod's namespace". - items: - type: string - type: array - x-kubernetes-list-type: atomic - topologyKey: - description: |- - This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching - the labelSelector in the specified namespaces, where co-located is defined as running on a node - whose value of the label with key topologyKey matches that of any node on which any of the - selected pods is running. - Empty topologyKey is not allowed. - type: string - required: - - topologyKey - type: object - type: array - x-kubernetes-list-type: atomic - type: object - podAntiAffinity: - description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)). - properties: - preferredDuringSchedulingIgnoredDuringExecution: - description: |- - The scheduler will prefer to schedule pods to nodes that satisfy - the anti-affinity expressions specified by this field, but it may choose - a node that violates one or more of the expressions. The node that is - most preferred is the one with the greatest sum of weights, i.e. - for each node that meets all of the scheduling requirements (resource - request, requiredDuringScheduling anti-affinity expressions, etc.), - compute a sum by iterating through the elements of this field and subtracting - "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the - node(s) with the highest sum are the most preferred. - items: - description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) - properties: - podAffinityTerm: - description: Required. A pod affinity term, associated with the corresponding weight. - properties: - labelSelector: - description: |- - A label query over a set of resources, in this case pods. - If it's null, this PodAffinityTerm matches with no Pods. - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - matchLabelKeys: - description: |- - MatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both matchLabelKeys and labelSelector. - Also, matchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - mismatchLabelKeys: - description: |- - MismatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. - Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - namespaceSelector: - description: |- - A label query over the set of namespaces that the term applies to. - The term is applied to the union of the namespaces selected by this field - and the ones listed in the namespaces field. - null selector and null or empty namespaces list means "this pod's namespace". - An empty selector ({}) matches all namespaces. - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - namespaces: - description: |- - namespaces specifies a static list of namespace names that the term applies to. - The term is applied to the union of the namespaces listed in this field - and the ones selected by namespaceSelector. - null or empty namespaces list and null namespaceSelector means "this pod's namespace". - items: - type: string - type: array - x-kubernetes-list-type: atomic - topologyKey: - description: |- - This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching - the labelSelector in the specified namespaces, where co-located is defined as running on a node - whose value of the label with key topologyKey matches that of any node on which any of the - selected pods is running. - Empty topologyKey is not allowed. - type: string - required: - - topologyKey - type: object - weight: - description: |- - weight associated with matching the corresponding podAffinityTerm, - in the range 1-100. - format: int32 - type: integer - required: - - podAffinityTerm - - weight - type: object - type: array - x-kubernetes-list-type: atomic - requiredDuringSchedulingIgnoredDuringExecution: - description: |- - If the anti-affinity requirements specified by this field are not met at - scheduling time, the pod will not be scheduled onto the node. - If the anti-affinity requirements specified by this field cease to be met - at some point during pod execution (e.g. due to a pod label update), the - system may or may not try to eventually evict the pod from its node. - When there are multiple elements, the lists of nodes corresponding to each - podAffinityTerm are intersected, i.e. all terms must be satisfied. - items: - description: |- - Defines a set of pods (namely those matching the labelSelector - relative to the given namespace(s)) that this pod should be - co-located (affinity) or not co-located (anti-affinity) with, - where co-located is defined as running on a node whose value of - the label with key matches that of any node on which - a pod of the set of pods is running - properties: - labelSelector: - description: |- - A label query over a set of resources, in this case pods. - If it's null, this PodAffinityTerm matches with no Pods. - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - matchLabelKeys: - description: |- - MatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both matchLabelKeys and labelSelector. - Also, matchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - mismatchLabelKeys: - description: |- - MismatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. - Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - namespaceSelector: - description: |- - A label query over the set of namespaces that the term applies to. - The term is applied to the union of the namespaces selected by this field - and the ones listed in the namespaces field. - null selector and null or empty namespaces list means "this pod's namespace". - An empty selector ({}) matches all namespaces. - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - namespaces: - description: |- - namespaces specifies a static list of namespace names that the term applies to. - The term is applied to the union of the namespaces listed in this field - and the ones selected by namespaceSelector. - null or empty namespaces list and null namespaceSelector means "this pod's namespace". - items: - type: string - type: array - x-kubernetes-list-type: atomic - topologyKey: - description: |- - This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching - the labelSelector in the specified namespaces, where co-located is defined as running on a node - whose value of the label with key topologyKey matches that of any node on which any of the - selected pods is running. - Empty topologyKey is not allowed. - type: string - required: - - topologyKey - type: object - type: array - x-kubernetes-list-type: atomic - type: object - type: object - imagePullSecrets: - description: If specified, the pod's imagePullSecrets - items: - description: |- - LocalObjectReference contains enough information to let you locate the - referenced object inside the same namespace. - properties: - name: - default: "" - description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - type: object - x-kubernetes-map-type: atomic - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - nodeSelector: - additionalProperties: - type: string - description: |- - NodeSelector is a selector which must be true for the pod to fit on a node. - Selector which must match a node's labels for the pod to be scheduled on that node. - More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ - type: object - priorityClassName: - description: If specified, the pod's priorityClassName. - type: string - resources: - description: |- - If specified, the pod's resource requirements. - These values override the global resource configuration flags. - Note that when only specifying resource limits, ensure they are greater than or equal - to the corresponding global resource requests configured via controller flags - (--acme-http01-solver-resource-request-cpu, --acme-http01-solver-resource-request-memory). - Kubernetes will reject pod creation if limits are lower than requests, causing challenge failures. - properties: - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: |- - Limits describes the maximum amount of compute resources allowed. - More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: |- - Requests describes the minimum amount of compute resources required. - If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, - otherwise to the global values configured via controller flags. Requests cannot exceed Limits. - More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ - type: object - type: object - securityContext: - description: If specified, the pod's security context - properties: - fsGroup: - description: |- - A special supplemental group that applies to all containers in a pod. - Some volume types allow the Kubelet to change the ownership of that volume - to be owned by the pod: - - 1. The owning GID will be the FSGroup - 2. The setgid bit is set (new files created in the volume will be owned by FSGroup) - 3. The permission bits are OR'd with rw-rw---- - - If unset, the Kubelet will not modify the ownership and permissions of any volume. - Note that this field cannot be set when spec.os.name is windows. - format: int64 - type: integer - fsGroupChangePolicy: - description: |- - fsGroupChangePolicy defines behavior of changing ownership and permission of the volume - before being exposed inside Pod. This field will only apply to - volume types which support fsGroup based ownership(and permissions). - It will have no effect on ephemeral volume types such as: secret, configmaps - and emptydir. - Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used. - Note that this field cannot be set when spec.os.name is windows. - type: string - runAsGroup: - description: |- - The GID to run the entrypoint of the container process. - Uses runtime default if unset. - May also be set in SecurityContext. If set in both SecurityContext and - PodSecurityContext, the value specified in SecurityContext takes precedence - for that container. - Note that this field cannot be set when spec.os.name is windows. - format: int64 - type: integer - runAsNonRoot: - description: |- - Indicates that the container must run as a non-root user. - If true, the Kubelet will validate the image at runtime to ensure that it - does not run as UID 0 (root) and fail to start the container if it does. - If unset or false, no such validation will be performed. - May also be set in SecurityContext. If set in both SecurityContext and - PodSecurityContext, the value specified in SecurityContext takes precedence. - type: boolean - runAsUser: - description: |- - The UID to run the entrypoint of the container process. - Defaults to user specified in image metadata if unspecified. - May also be set in SecurityContext. If set in both SecurityContext and - PodSecurityContext, the value specified in SecurityContext takes precedence - for that container. - Note that this field cannot be set when spec.os.name is windows. - format: int64 - type: integer - seLinuxOptions: - description: |- - The SELinux context to be applied to all containers. - If unspecified, the container runtime will allocate a random SELinux context for each - container. May also be set in SecurityContext. If set in - both SecurityContext and PodSecurityContext, the value specified in SecurityContext - takes precedence for that container. - Note that this field cannot be set when spec.os.name is windows. - properties: - level: - description: Level is SELinux level label that applies to the container. - type: string - role: - description: Role is a SELinux role label that applies to the container. - type: string - type: - description: Type is a SELinux type label that applies to the container. - type: string - user: - description: User is a SELinux user label that applies to the container. - type: string - type: object - seccompProfile: - description: |- - The seccomp options to use by the containers in this pod. - Note that this field cannot be set when spec.os.name is windows. - properties: - localhostProfile: - description: |- - localhostProfile indicates a profile defined in a file on the node should be used. - The profile must be preconfigured on the node to work. - Must be a descending path, relative to the kubelet's configured seccomp profile location. - Must be set if type is "Localhost". Must NOT be set for any other type. - type: string - type: - description: |- - type indicates which kind of seccomp profile will be applied. - Valid options are: - - Localhost - a profile defined in a file on the node should be used. - RuntimeDefault - the container runtime default profile should be used. - Unconfined - no profile should be applied. - type: string - required: - - type - type: object - supplementalGroups: - description: |- - A list of groups applied to the first process run in each container, in addition - to the container's primary GID, the fsGroup (if specified), and group memberships - defined in the container image for the uid of the container process. If unspecified, - no additional groups are added to any container. Note that group memberships - defined in the container image for the uid of the container process are still effective, - even if they are not included in this list. - Note that this field cannot be set when spec.os.name is windows. - items: - format: int64 - type: integer - type: array - x-kubernetes-list-type: atomic - sysctls: - description: |- - Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported - sysctls (by the container runtime) might fail to launch. - Note that this field cannot be set when spec.os.name is windows. - items: - description: Sysctl defines a kernel parameter to be set - properties: - name: - description: Name of a property to set - type: string - value: - description: Value of a property to set - type: string - required: - - name - - value - type: object - type: array - x-kubernetes-list-type: atomic - type: object - serviceAccountName: - description: If specified, the pod's service account - type: string - tolerations: - description: If specified, the pod's tolerations. - items: - description: |- - The pod this Toleration is attached to tolerates any taint that matches - the triple using the matching operator . - properties: - effect: - description: |- - Effect indicates the taint effect to match. Empty means match all taint effects. - When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. - type: string - key: - description: |- - Key is the taint key that the toleration applies to. Empty means match all taint keys. - If the key is empty, operator must be Exists; this combination means to match all values and all keys. - type: string - operator: - description: |- - Operator represents a key's relationship to the value. - Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. - Exists is equivalent to wildcard for value, so that a pod can - tolerate all taints of a particular category. - Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). - type: string - tolerationSeconds: - description: |- - TolerationSeconds represents the period of time the toleration (which must be - of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, - it is not set, which means tolerate the taint forever (do not evict). Zero and - negative values will be treated as 0 (evict immediately) by the system. - format: int64 - type: integer - value: - description: |- - Value is the taint value the toleration matches to. - If the operator is Exists, the value should be empty, otherwise just a regular string. - type: string - type: object - type: array - x-kubernetes-list-type: atomic - type: object - type: object - serviceType: - description: |- - Optional service type for Kubernetes solver service. Supported values - are NodePort or ClusterIP. If unset, defaults to NodePort. - type: string - type: object - ingress: - description: |- - The ingress based HTTP01 challenge solver will solve challenges by - creating or modifying Ingress resources in order to route requests for - '/.well-known/acme-challenge/XYZ' to 'challenge solver' pods that are - provisioned by cert-manager for each Challenge to be completed. - properties: - class: - description: |- - This field configures the annotation `kubernetes.io/ingress.class` when - creating Ingress resources to solve ACME challenges that use this - challenge solver. Only one of `class`, `name` or `ingressClassName` may - be specified. - type: string - ingressClassName: - description: |- - This field configures the field `ingressClassName` on the created Ingress - resources used to solve ACME challenges that use this challenge solver. - This is the recommended way of configuring the ingress class. Only one of - `class`, `name` or `ingressClassName` may be specified. - type: string - ingressTemplate: - description: |- - Optional ingress template used to configure the ACME challenge solver - ingress used for HTTP01 challenges. - properties: - metadata: - description: |- - ObjectMeta overrides for the ingress used to solve HTTP01 challenges. - Only the 'labels' and 'annotations' fields may be set. - If labels or annotations overlap with in-built values, the values here - will override the in-built values. - properties: - annotations: - additionalProperties: - type: string - description: Annotations that should be added to the created ACME HTTP01 solver ingress. - type: object - labels: - additionalProperties: - type: string - description: Labels that should be added to the created ACME HTTP01 solver ingress. - type: object - type: object - type: object - name: - description: |- - The name of the ingress resource that should have ACME challenge solving - routes inserted into it in order to solve HTTP01 challenges. - This is typically used in conjunction with ingress controllers like - ingress-gce, which maintains a 1:1 mapping between external IPs and - ingress resources. Only one of `class`, `name` or `ingressClassName` may - be specified. - type: string - podTemplate: - description: |- - Optional pod template used to configure the ACME challenge solver pods - used for HTTP01 challenges. - properties: - metadata: - description: |- - ObjectMeta overrides for the pod used to solve HTTP01 challenges. - Only the 'labels' and 'annotations' fields may be set. - If labels or annotations overlap with in-built values, the values here - will override the in-built values. - properties: - annotations: - additionalProperties: - type: string - description: Annotations that should be added to the created ACME HTTP01 solver pods. - type: object - labels: - additionalProperties: - type: string - description: Labels that should be added to the created ACME HTTP01 solver pods. - type: object - type: object - spec: - description: |- - PodSpec defines overrides for the HTTP01 challenge solver pod. - Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields. - All other fields will be ignored. - properties: - affinity: - description: If specified, the pod's scheduling constraints - properties: - nodeAffinity: - description: Describes node affinity scheduling rules for the pod. - properties: - preferredDuringSchedulingIgnoredDuringExecution: - description: |- - The scheduler will prefer to schedule pods to nodes that satisfy - the affinity expressions specified by this field, but it may choose - a node that violates one or more of the expressions. The node that is - most preferred is the one with the greatest sum of weights, i.e. - for each node that meets all of the scheduling requirements (resource - request, requiredDuringScheduling affinity expressions, etc.), - compute a sum by iterating through the elements of this field and adding - "weight" to the sum if the node matches the corresponding matchExpressions; the - node(s) with the highest sum are the most preferred. - items: - description: |- - An empty preferred scheduling term matches all objects with implicit weight 0 - (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). - properties: - preference: - description: A node selector term, associated with the corresponding weight. - properties: - matchExpressions: - description: A list of node selector requirements by node's labels. - items: - description: |- - A node selector requirement is a selector that contains values, a key, and an operator - that relates the key and values. - properties: - key: - description: The label key that the selector applies to. - type: string - operator: - description: |- - Represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. - type: string - values: - description: |- - An array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. If the operator is Gt or Lt, the values - array must have a single element, which will be interpreted as an integer. - This array is replaced during a strategic merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchFields: - description: A list of node selector requirements by node's fields. - items: - description: |- - A node selector requirement is a selector that contains values, a key, and an operator - that relates the key and values. - properties: - key: - description: The label key that the selector applies to. - type: string - operator: - description: |- - Represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. - type: string - values: - description: |- - An array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. If the operator is Gt or Lt, the values - array must have a single element, which will be interpreted as an integer. - This array is replaced during a strategic merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - type: object - x-kubernetes-map-type: atomic - weight: - description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100. - format: int32 - type: integer - required: - - preference - - weight - type: object - type: array - x-kubernetes-list-type: atomic - requiredDuringSchedulingIgnoredDuringExecution: - description: |- - If the affinity requirements specified by this field are not met at - scheduling time, the pod will not be scheduled onto the node. - If the affinity requirements specified by this field cease to be met - at some point during pod execution (e.g. due to an update), the system - may or may not try to eventually evict the pod from its node. - properties: - nodeSelectorTerms: - description: Required. A list of node selector terms. The terms are ORed. - items: - description: |- - A null or empty node selector term matches no objects. The requirements of - them are ANDed. - The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. - properties: - matchExpressions: - description: A list of node selector requirements by node's labels. - items: - description: |- - A node selector requirement is a selector that contains values, a key, and an operator - that relates the key and values. - properties: - key: - description: The label key that the selector applies to. - type: string - operator: - description: |- - Represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. - type: string - values: - description: |- - An array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. If the operator is Gt or Lt, the values - array must have a single element, which will be interpreted as an integer. - This array is replaced during a strategic merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchFields: - description: A list of node selector requirements by node's fields. - items: - description: |- - A node selector requirement is a selector that contains values, a key, and an operator - that relates the key and values. - properties: - key: - description: The label key that the selector applies to. - type: string - operator: - description: |- - Represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. - type: string - values: - description: |- - An array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. If the operator is Gt or Lt, the values - array must have a single element, which will be interpreted as an integer. - This array is replaced during a strategic merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - type: object - x-kubernetes-map-type: atomic - type: array - x-kubernetes-list-type: atomic - required: - - nodeSelectorTerms - type: object - x-kubernetes-map-type: atomic - type: object - podAffinity: - description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)). - properties: - preferredDuringSchedulingIgnoredDuringExecution: - description: |- - The scheduler will prefer to schedule pods to nodes that satisfy - the affinity expressions specified by this field, but it may choose - a node that violates one or more of the expressions. The node that is - most preferred is the one with the greatest sum of weights, i.e. - for each node that meets all of the scheduling requirements (resource - request, requiredDuringScheduling affinity expressions, etc.), - compute a sum by iterating through the elements of this field and adding - "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the - node(s) with the highest sum are the most preferred. - items: - description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) - properties: - podAffinityTerm: - description: Required. A pod affinity term, associated with the corresponding weight. - properties: - labelSelector: - description: |- - A label query over a set of resources, in this case pods. - If it's null, this PodAffinityTerm matches with no Pods. - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - matchLabelKeys: - description: |- - MatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both matchLabelKeys and labelSelector. - Also, matchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - mismatchLabelKeys: - description: |- - MismatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. - Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - namespaceSelector: - description: |- - A label query over the set of namespaces that the term applies to. - The term is applied to the union of the namespaces selected by this field - and the ones listed in the namespaces field. - null selector and null or empty namespaces list means "this pod's namespace". - An empty selector ({}) matches all namespaces. - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - namespaces: - description: |- - namespaces specifies a static list of namespace names that the term applies to. - The term is applied to the union of the namespaces listed in this field - and the ones selected by namespaceSelector. - null or empty namespaces list and null namespaceSelector means "this pod's namespace". - items: - type: string - type: array - x-kubernetes-list-type: atomic - topologyKey: - description: |- - This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching - the labelSelector in the specified namespaces, where co-located is defined as running on a node - whose value of the label with key topologyKey matches that of any node on which any of the - selected pods is running. - Empty topologyKey is not allowed. - type: string - required: - - topologyKey - type: object - weight: - description: |- - weight associated with matching the corresponding podAffinityTerm, - in the range 1-100. - format: int32 - type: integer - required: - - podAffinityTerm - - weight - type: object - type: array - x-kubernetes-list-type: atomic - requiredDuringSchedulingIgnoredDuringExecution: - description: |- - If the affinity requirements specified by this field are not met at - scheduling time, the pod will not be scheduled onto the node. - If the affinity requirements specified by this field cease to be met - at some point during pod execution (e.g. due to a pod label update), the - system may or may not try to eventually evict the pod from its node. - When there are multiple elements, the lists of nodes corresponding to each - podAffinityTerm are intersected, i.e. all terms must be satisfied. - items: - description: |- - Defines a set of pods (namely those matching the labelSelector - relative to the given namespace(s)) that this pod should be - co-located (affinity) or not co-located (anti-affinity) with, - where co-located is defined as running on a node whose value of - the label with key matches that of any node on which - a pod of the set of pods is running - properties: - labelSelector: - description: |- - A label query over a set of resources, in this case pods. - If it's null, this PodAffinityTerm matches with no Pods. - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - matchLabelKeys: - description: |- - MatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both matchLabelKeys and labelSelector. - Also, matchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - mismatchLabelKeys: - description: |- - MismatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. - Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - namespaceSelector: - description: |- - A label query over the set of namespaces that the term applies to. - The term is applied to the union of the namespaces selected by this field - and the ones listed in the namespaces field. - null selector and null or empty namespaces list means "this pod's namespace". - An empty selector ({}) matches all namespaces. - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - namespaces: - description: |- - namespaces specifies a static list of namespace names that the term applies to. - The term is applied to the union of the namespaces listed in this field - and the ones selected by namespaceSelector. - null or empty namespaces list and null namespaceSelector means "this pod's namespace". - items: - type: string - type: array - x-kubernetes-list-type: atomic - topologyKey: - description: |- - This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching - the labelSelector in the specified namespaces, where co-located is defined as running on a node - whose value of the label with key topologyKey matches that of any node on which any of the - selected pods is running. - Empty topologyKey is not allowed. - type: string - required: - - topologyKey - type: object - type: array - x-kubernetes-list-type: atomic - type: object - podAntiAffinity: - description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)). - properties: - preferredDuringSchedulingIgnoredDuringExecution: - description: |- - The scheduler will prefer to schedule pods to nodes that satisfy - the anti-affinity expressions specified by this field, but it may choose - a node that violates one or more of the expressions. The node that is - most preferred is the one with the greatest sum of weights, i.e. - for each node that meets all of the scheduling requirements (resource - request, requiredDuringScheduling anti-affinity expressions, etc.), - compute a sum by iterating through the elements of this field and subtracting - "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the - node(s) with the highest sum are the most preferred. - items: - description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) - properties: - podAffinityTerm: - description: Required. A pod affinity term, associated with the corresponding weight. - properties: - labelSelector: - description: |- - A label query over a set of resources, in this case pods. - If it's null, this PodAffinityTerm matches with no Pods. - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - matchLabelKeys: - description: |- - MatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both matchLabelKeys and labelSelector. - Also, matchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - mismatchLabelKeys: - description: |- - MismatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. - Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - namespaceSelector: - description: |- - A label query over the set of namespaces that the term applies to. - The term is applied to the union of the namespaces selected by this field - and the ones listed in the namespaces field. - null selector and null or empty namespaces list means "this pod's namespace". - An empty selector ({}) matches all namespaces. - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - namespaces: - description: |- - namespaces specifies a static list of namespace names that the term applies to. - The term is applied to the union of the namespaces listed in this field - and the ones selected by namespaceSelector. - null or empty namespaces list and null namespaceSelector means "this pod's namespace". - items: - type: string - type: array - x-kubernetes-list-type: atomic - topologyKey: - description: |- - This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching - the labelSelector in the specified namespaces, where co-located is defined as running on a node - whose value of the label with key topologyKey matches that of any node on which any of the - selected pods is running. - Empty topologyKey is not allowed. - type: string - required: - - topologyKey - type: object - weight: - description: |- - weight associated with matching the corresponding podAffinityTerm, - in the range 1-100. - format: int32 - type: integer - required: - - podAffinityTerm - - weight - type: object - type: array - x-kubernetes-list-type: atomic - requiredDuringSchedulingIgnoredDuringExecution: - description: |- - If the anti-affinity requirements specified by this field are not met at - scheduling time, the pod will not be scheduled onto the node. - If the anti-affinity requirements specified by this field cease to be met - at some point during pod execution (e.g. due to a pod label update), the - system may or may not try to eventually evict the pod from its node. - When there are multiple elements, the lists of nodes corresponding to each - podAffinityTerm are intersected, i.e. all terms must be satisfied. - items: - description: |- - Defines a set of pods (namely those matching the labelSelector - relative to the given namespace(s)) that this pod should be - co-located (affinity) or not co-located (anti-affinity) with, - where co-located is defined as running on a node whose value of - the label with key matches that of any node on which - a pod of the set of pods is running - properties: - labelSelector: - description: |- - A label query over a set of resources, in this case pods. - If it's null, this PodAffinityTerm matches with no Pods. - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - matchLabelKeys: - description: |- - MatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both matchLabelKeys and labelSelector. - Also, matchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - mismatchLabelKeys: - description: |- - MismatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. - Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - namespaceSelector: - description: |- - A label query over the set of namespaces that the term applies to. - The term is applied to the union of the namespaces selected by this field - and the ones listed in the namespaces field. - null selector and null or empty namespaces list means "this pod's namespace". - An empty selector ({}) matches all namespaces. - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - namespaces: - description: |- - namespaces specifies a static list of namespace names that the term applies to. - The term is applied to the union of the namespaces listed in this field - and the ones selected by namespaceSelector. - null or empty namespaces list and null namespaceSelector means "this pod's namespace". - items: - type: string - type: array - x-kubernetes-list-type: atomic - topologyKey: - description: |- - This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching - the labelSelector in the specified namespaces, where co-located is defined as running on a node - whose value of the label with key topologyKey matches that of any node on which any of the - selected pods is running. - Empty topologyKey is not allowed. - type: string - required: - - topologyKey - type: object - type: array - x-kubernetes-list-type: atomic - type: object - type: object - imagePullSecrets: - description: If specified, the pod's imagePullSecrets - items: - description: |- - LocalObjectReference contains enough information to let you locate the - referenced object inside the same namespace. - properties: - name: - default: "" - description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - type: object - x-kubernetes-map-type: atomic - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - nodeSelector: - additionalProperties: - type: string - description: |- - NodeSelector is a selector which must be true for the pod to fit on a node. - Selector which must match a node's labels for the pod to be scheduled on that node. - More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ - type: object - priorityClassName: - description: If specified, the pod's priorityClassName. - type: string - resources: - description: |- - If specified, the pod's resource requirements. - These values override the global resource configuration flags. - Note that when only specifying resource limits, ensure they are greater than or equal - to the corresponding global resource requests configured via controller flags - (--acme-http01-solver-resource-request-cpu, --acme-http01-solver-resource-request-memory). - Kubernetes will reject pod creation if limits are lower than requests, causing challenge failures. - properties: - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: |- - Limits describes the maximum amount of compute resources allowed. - More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: |- - Requests describes the minimum amount of compute resources required. - If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, - otherwise to the global values configured via controller flags. Requests cannot exceed Limits. - More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ - type: object - type: object - securityContext: - description: If specified, the pod's security context - properties: - fsGroup: - description: |- - A special supplemental group that applies to all containers in a pod. - Some volume types allow the Kubelet to change the ownership of that volume - to be owned by the pod: - - 1. The owning GID will be the FSGroup - 2. The setgid bit is set (new files created in the volume will be owned by FSGroup) - 3. The permission bits are OR'd with rw-rw---- - - If unset, the Kubelet will not modify the ownership and permissions of any volume. - Note that this field cannot be set when spec.os.name is windows. - format: int64 - type: integer - fsGroupChangePolicy: - description: |- - fsGroupChangePolicy defines behavior of changing ownership and permission of the volume - before being exposed inside Pod. This field will only apply to - volume types which support fsGroup based ownership(and permissions). - It will have no effect on ephemeral volume types such as: secret, configmaps - and emptydir. - Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used. - Note that this field cannot be set when spec.os.name is windows. - type: string - runAsGroup: - description: |- - The GID to run the entrypoint of the container process. - Uses runtime default if unset. - May also be set in SecurityContext. If set in both SecurityContext and - PodSecurityContext, the value specified in SecurityContext takes precedence - for that container. - Note that this field cannot be set when spec.os.name is windows. - format: int64 - type: integer - runAsNonRoot: - description: |- - Indicates that the container must run as a non-root user. - If true, the Kubelet will validate the image at runtime to ensure that it - does not run as UID 0 (root) and fail to start the container if it does. - If unset or false, no such validation will be performed. - May also be set in SecurityContext. If set in both SecurityContext and - PodSecurityContext, the value specified in SecurityContext takes precedence. - type: boolean - runAsUser: - description: |- - The UID to run the entrypoint of the container process. - Defaults to user specified in image metadata if unspecified. - May also be set in SecurityContext. If set in both SecurityContext and - PodSecurityContext, the value specified in SecurityContext takes precedence - for that container. - Note that this field cannot be set when spec.os.name is windows. - format: int64 - type: integer - seLinuxOptions: - description: |- - The SELinux context to be applied to all containers. - If unspecified, the container runtime will allocate a random SELinux context for each - container. May also be set in SecurityContext. If set in - both SecurityContext and PodSecurityContext, the value specified in SecurityContext - takes precedence for that container. - Note that this field cannot be set when spec.os.name is windows. - properties: - level: - description: Level is SELinux level label that applies to the container. - type: string - role: - description: Role is a SELinux role label that applies to the container. - type: string - type: - description: Type is a SELinux type label that applies to the container. - type: string - user: - description: User is a SELinux user label that applies to the container. - type: string - type: object - seccompProfile: - description: |- - The seccomp options to use by the containers in this pod. - Note that this field cannot be set when spec.os.name is windows. - properties: - localhostProfile: - description: |- - localhostProfile indicates a profile defined in a file on the node should be used. - The profile must be preconfigured on the node to work. - Must be a descending path, relative to the kubelet's configured seccomp profile location. - Must be set if type is "Localhost". Must NOT be set for any other type. - type: string - type: - description: |- - type indicates which kind of seccomp profile will be applied. - Valid options are: - - Localhost - a profile defined in a file on the node should be used. - RuntimeDefault - the container runtime default profile should be used. - Unconfined - no profile should be applied. - type: string - required: - - type - type: object - supplementalGroups: - description: |- - A list of groups applied to the first process run in each container, in addition - to the container's primary GID, the fsGroup (if specified), and group memberships - defined in the container image for the uid of the container process. If unspecified, - no additional groups are added to any container. Note that group memberships - defined in the container image for the uid of the container process are still effective, - even if they are not included in this list. - Note that this field cannot be set when spec.os.name is windows. - items: - format: int64 - type: integer - type: array - x-kubernetes-list-type: atomic - sysctls: - description: |- - Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported - sysctls (by the container runtime) might fail to launch. - Note that this field cannot be set when spec.os.name is windows. - items: - description: Sysctl defines a kernel parameter to be set - properties: - name: - description: Name of a property to set - type: string - value: - description: Value of a property to set - type: string - required: - - name - - value - type: object - type: array - x-kubernetes-list-type: atomic - type: object - serviceAccountName: - description: If specified, the pod's service account - type: string - tolerations: - description: If specified, the pod's tolerations. - items: - description: |- - The pod this Toleration is attached to tolerates any taint that matches - the triple using the matching operator . - properties: - effect: - description: |- - Effect indicates the taint effect to match. Empty means match all taint effects. - When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. - type: string - key: - description: |- - Key is the taint key that the toleration applies to. Empty means match all taint keys. - If the key is empty, operator must be Exists; this combination means to match all values and all keys. - type: string - operator: - description: |- - Operator represents a key's relationship to the value. - Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. - Exists is equivalent to wildcard for value, so that a pod can - tolerate all taints of a particular category. - Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). - type: string - tolerationSeconds: - description: |- - TolerationSeconds represents the period of time the toleration (which must be - of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, - it is not set, which means tolerate the taint forever (do not evict). Zero and - negative values will be treated as 0 (evict immediately) by the system. - format: int64 - type: integer - value: - description: |- - Value is the taint value the toleration matches to. - If the operator is Exists, the value should be empty, otherwise just a regular string. - type: string - type: object - type: array - x-kubernetes-list-type: atomic - type: object - type: object - serviceType: - description: |- - Optional service type for Kubernetes solver service. Supported values - are NodePort or ClusterIP. If unset, defaults to NodePort. - type: string - type: object - type: object - selector: - description: |- - Selector selects a set of DNSNames on the Certificate resource that - should be solved using this challenge solver. - If not specified, the solver will be treated as the 'default' solver - with the lowest priority, i.e. if any other solver has a more specific - match, it will be used instead. - properties: - dnsNames: - description: |- - List of DNSNames that this solver will be used to solve. - If specified and a match is found, a dnsNames selector will take - precedence over a dnsZones selector. - If multiple solvers match with the same dnsNames value, the solver - with the most matching labels in matchLabels will be selected. - If neither has more matches, the solver defined earlier in the list - will be selected. - items: - type: string - type: array - x-kubernetes-list-type: atomic - dnsZones: - description: |- - List of DNSZones that this solver will be used to solve. - The most specific DNS zone match specified here will take precedence - over other DNS zone matches, so a solver specifying sys.example.com - will be selected over one specifying example.com for the domain - www.sys.example.com. - If multiple solvers match with the same dnsZones value, the solver - with the most matching labels in matchLabels will be selected. - If neither has more matches, the solver defined earlier in the list - will be selected. - items: - type: string - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - A label selector that is used to refine the set of certificate's that - this challenge solver will apply to. - type: object - type: object - waitInsteadOfSelfCheck: - description: |- - WaitInsteadOfSelfCheck, if set, skips cert-manager's self-check and - instead waits this long after presentation before asking the ACME server - to validate the challenge. - - This is an advanced escape hatch for environments where cert-manager's - self-check cannot succeed from its own network or DNS viewpoint even - though the ACME server can still validate successfully, for example due - to split-horizon DNS or NAT hairpinning. - - A value of 0 skips the self-check and asks the ACME server to validate - immediately after presentation, relying on the ACME server's own - validation retries (RFC 8555 section 8.2) to succeed once the challenge - has propagated. A negative duration is rejected. - Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration, - for example `30s` or `2m`. - type: string - type: object - type: array - x-kubernetes-list-type: atomic - required: - - privateKeySecretRef - - server - type: object - ca: - description: |- - CA configures this issuer to sign certificates using a signing CA keypair - stored in a Secret resource. - This is used to build internal PKIs that are managed by cert-manager. - properties: - crlDistributionPoints: - description: |- - The CRL distribution points is an X.509 v3 certificate extension which identifies - the location of the CRL from which the revocation of this certificate can be checked. - If not set, certificates will be issued without distribution points set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - issuingCertificateURLs: - description: |- - IssuingCertificateURLs is a list of URLs which this issuer should embed into certificates - it creates. See https://www.rfc-editor.org/rfc/rfc5280#section-4.2.2.1 for more details. - As an example, such a URL might be "http://ca.domain.com/ca.crt". - items: - type: string - type: array - x-kubernetes-list-type: atomic - ocspServers: - description: |- - The OCSP server list is an X.509 v3 extension that defines a list of - URLs of OCSP responders. The OCSP responders can be queried for the - revocation status of an issued certificate. If not set, the - certificate will be issued with no OCSP servers set. For example, an - OCSP server URL could be "http://ocsp.int-x3.letsencrypt.org". - items: - type: string - type: array - x-kubernetes-list-type: atomic - secretName: - description: |- - SecretName is the name of the secret used to sign Certificates issued - by this Issuer. - type: string - required: - - secretName - type: object - selfSigned: - description: |- - SelfSigned configures this issuer to 'self sign' certificates using the - private key used to create the CertificateRequest object. - properties: - crlDistributionPoints: - description: |- - The CRL distribution points is an X.509 v3 certificate extension which identifies - the location of the CRL from which the revocation of this certificate can be checked. - If not set certificate will be issued without CDP. Values are strings. - items: - type: string - type: array - x-kubernetes-list-type: atomic - type: object - vault: - description: |- - Vault configures this issuer to sign certificates using a HashiCorp Vault - PKI backend. - properties: - auth: - description: Auth configures how cert-manager authenticates with the Vault server. - properties: - appRole: - description: |- - AppRole authenticates with Vault using the App Role auth mechanism, - with the role and secret stored in a Kubernetes Secret resource. - properties: - path: - description: |- - Path where the App Role authentication backend is mounted in Vault, e.g: - "approle" - type: string - roleId: - description: |- - RoleID configured in the App Role authentication backend when setting - up the authentication backend in Vault. - type: string - secretRef: - description: |- - Reference to a key in a Secret that contains the App Role secret used - to authenticate with Vault. - The `key` field must be specified and denotes which entry within the Secret - resource is used as the app role secret. - properties: - key: - description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. - type: string - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - required: - - name - type: object - required: - - path - - roleId - - secretRef - type: object - aws: - description: |- - AWS authenticates with Vault using AWS IAM authentication. - This allows authentication using IAM roles for service accounts (IRSA), - EKS Pod Identity (PIA), or ambient credentials (EC2 instance profiles, ECS task role). - properties: - iamRoleArn: - description: |- - The ARN of the AWS IAM role to assume using the Kubernetes service account - token. Required when using IRSA (serviceAccountRef is set). - This role must have a trust policy that allows the OIDC provider to assume it. - type: string - mountPath: - description: |- - The Vault mountPath here is the mount path to use when authenticating with - Vault. For example, setting a value to `/v1/auth/foo`, will use the path - `/v1/auth/foo/login` to authenticate with Vault. If unspecified, the - default value "/v1/auth/aws" will be used. - type: string - region: - description: |- - The AWS region to use for authentication. If not specified, the region - will be determined from AWS_REGION or AWS_DEFAULT_REGION environment - variables, falling back to "us-east-1" if not set. - type: string - role: - description: A required field containing the Vault Role to assume when authenticating. - minLength: 1 - type: string - serviceAccountRef: - description: |- - A reference to a service account that will be used to request a web identity - token for IRSA (IAM Roles for Service Accounts) authentication. - properties: - audiences: - description: |- - TokenAudiences is an optional list of extra audiences to include in the token passed to Vault. - The default audiences are always included in the token. - items: - type: string - type: array - x-kubernetes-list-type: atomic - name: - description: Name of the ServiceAccount used to request a token. - type: string - required: - - name - type: object - vaultHeaderValue: - description: |- - The Vault header value to include in the STS signing request. - This is used to prevent replay attacks. - type: string - required: - - role - type: object - clientCertificate: - description: |- - ClientCertificate authenticates with Vault by presenting a client - certificate during the request's TLS handshake. - Works only when using HTTPS protocol. - properties: - mountPath: - description: |- - The Vault mountPath here is the mount path to use when authenticating with - Vault. For example, setting a value to `/v1/auth/foo`, will use the path - `/v1/auth/foo/login` to authenticate with Vault. If unspecified, the - default value "/v1/auth/cert" will be used. - type: string - name: - description: |- - Name of the certificate role to authenticate against. - If not set, matching any certificate role, if available. - type: string - secretName: - description: |- - Reference to Kubernetes Secret of type "kubernetes.io/tls" (hence containing - tls.crt and tls.key) used to authenticate to Vault using TLS client - authentication. - type: string - type: object - kubernetes: - description: |- - Kubernetes authenticates with Vault by passing the ServiceAccount - token stored in the named Secret resource to the Vault server. - properties: - mountPath: - description: |- - The Vault mountPath here is the mount path to use when authenticating with - Vault. For example, setting a value to `/v1/auth/foo`, will use the path - `/v1/auth/foo/login` to authenticate with Vault. If unspecified, the - default value "/v1/auth/kubernetes" will be used. - type: string - role: - description: |- - A required field containing the Vault Role to assume. A Role binds a - Kubernetes ServiceAccount with a set of Vault policies. - type: string - secretRef: - description: |- - The required Secret field containing a Kubernetes ServiceAccount JWT used - for authenticating with Vault. Use of 'ambient credentials' is not - supported. - properties: - key: - description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. - type: string - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - required: - - name - type: object - serviceAccountRef: - description: |- - A reference to a service account that will be used to request a bound - token (also known as "projected token"). Compared to using "secretRef", - using this field means that you don't rely on statically bound tokens. To - use this field, you must configure an RBAC rule to let cert-manager - request a token. - properties: - audiences: - description: |- - TokenAudiences is an optional list of extra audiences to include in the token passed to Vault. - The default audiences are always included in the token. - items: - type: string - type: array - x-kubernetes-list-type: atomic - name: - description: Name of the ServiceAccount used to request a token. - type: string - required: - - name - type: object - required: - - role - type: object - tokenSecretRef: - description: TokenSecretRef authenticates with Vault by presenting a token. - properties: - key: - description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. - type: string - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - required: - - name - type: object - type: object - caBundle: - description: |- - Base64-encoded bundle of PEM CAs which will be used to validate the certificate - chain presented by Vault. Only used if using HTTPS to connect to Vault and - ignored for HTTP connections. - Mutually exclusive with CABundleSecretRef. - If neither CABundle nor CABundleSecretRef are defined, the certificate bundle in - the cert-manager controller container is used to validate the TLS connection. - format: byte - type: string - caBundleSecretRef: - description: |- - Reference to a Secret containing a bundle of PEM-encoded CAs to use when - verifying the certificate chain presented by Vault when using HTTPS. - Mutually exclusive with CABundle. - If neither CABundle nor CABundleSecretRef are defined, the certificate bundle in - the cert-manager controller container is used to validate the TLS connection. - If no key for the Secret is specified, cert-manager will default to 'ca.crt'. - properties: - key: - description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. - type: string - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - required: - - name - type: object - clientCertSecretRef: - description: |- - Reference to a Secret containing a PEM-encoded Client Certificate to use when the - Vault server requires mTLS. - properties: - key: - description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. - type: string - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - required: - - name - type: object - clientKeySecretRef: - description: |- - Reference to a Secret containing a PEM-encoded Client Private Key to use when the - Vault server requires mTLS. - properties: - key: - description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. - type: string - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - required: - - name - type: object - namespace: - description: |- - Name of the vault namespace. Namespaces is a set of features within Vault Enterprise that allows Vault environments to support Secure Multi-tenancy. e.g: "ns1" - More about namespaces can be found here https://www.vaultproject.io/docs/enterprise/namespaces - type: string - path: - description: |- - Path is the mount path of the Vault PKI backend's `sign` endpoint, e.g: - "my_pki_mount/sign/my-role-name". - type: string - server: - description: 'Server is the connection address for the Vault server, e.g: "https://vault.example.com:8200".' - type: string - serverName: - description: |- - ServerName is used to verify the hostname on the returned certificates - by the Vault server. - type: string - required: - - auth - - path - - server - type: object - venafi: - description: |- - Venafi configures this issuer to sign certificates using a CyberArk Certificate Manager Self-Hosted - or SaaS policy zone. - properties: - cloud: - description: |- - Cloud specifies the CyberArk Certificate Manager SaaS configuration settings. - Only one of CyberArk Certificate Manager may be specified. - properties: - apiTokenSecretRef: - description: APITokenSecretRef is a secret key selector for the CyberArk Certificate Manager SaaS API token. - properties: - key: - description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. - type: string - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - required: - - name - type: object - url: - description: |- - URL is the base URL for CyberArk Certificate Manager SaaS. - Defaults to "https://api.venafi.cloud/". - type: string - required: - - apiTokenSecretRef - type: object - ngts: - description: |- - NGTS specifies Palo Alto Networks Next Generation Trust Services (NGTS) configuration - using OAuth 2.0 Client Credentials. Only one of tpp, cloud, or ngts may be specified. - properties: - credentialsRef: - description: |- - CredentialsRef is a reference to a Kubernetes Secret containing the OAuth 2.0 - Client ID and Client Secret. The secret must contain the keys 'client-id' and - 'client-secret'. - properties: - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - required: - - name - type: object - tokenEndpoint: - description: |- - TokenEndpoint is the OAuth 2.0 token endpoint URL used to obtain access tokens, - for example "https://auth.apps.paloaltonetworks.com/oauth2/access_token". - Defaults to "https://auth.apps.paloaltonetworks.com/oauth2/access_token" if not set. - type: string - tsgID: - description: |- - TSGID is the Tenant Service Group ID used to scope the OAuth 2.0 access token, - for example "1234567890". The tsg_id: prefix is added automatically. - This field is required. - type: string - url: - description: |- - URL is the base URL for the NGTS API endpoint. - Defaults to "https://api.strata.paloaltonetworks.com/ngts" if not set. - type: string - required: - - credentialsRef - - tsgID - type: object - tpp: - description: |- - TPP specifies CyberArk Certificate Manager Self-Hosted configuration settings. - Only one of CyberArk Certificate Manager may be specified. - properties: - caBundle: - description: |- - Base64-encoded bundle of PEM CAs which will be used to validate the certificate - chain presented by the CyberArk Certificate Manager Self-Hosted server. Only used if using HTTPS; ignored for HTTP. - If undefined, the certificate bundle in the cert-manager controller container - is used to validate the chain. - format: byte - type: string - caBundleSecretRef: - description: |- - Reference to a Secret containing a base64-encoded bundle of PEM CAs - which will be used to validate the certificate chain presented by the CyberArk Certificate Manager Self-Hosted server. - Only used if using HTTPS; ignored for HTTP. Mutually exclusive with CABundle. - If neither CABundle nor CABundleSecretRef is defined, the certificate bundle in - the cert-manager controller container is used to validate the TLS connection. - properties: - key: - description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. - type: string - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - required: - - name - type: object - credentialsRef: - description: |- - CredentialsRef is a reference to a Secret containing the CyberArk Certificate Manager Self-Hosted API credentials. - The secret must contain the key 'access-token' for the Access Token Authentication, - or two keys, 'username' and 'password' for the API Keys Authentication. - properties: - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - required: - - name - type: object - url: - description: |- - URL is the base URL for the vedsdk endpoint of the CyberArk Certificate Manager Self-Hosted instance, - for example: "https://tpp.example.com/vedsdk". - type: string - required: - - credentialsRef - - url - type: object - zone: - description: |- - Zone is the Certificate Manager Policy Zone to use for this issuer. - All requests made to the Certificate Manager platform will be restricted by the named - zone policy. - This field is required. - type: string - required: - - zone - type: object - x-kubernetes-validations: - - message: exactly one of tpp, cloud, or ngts must be configured - rule: '(has(self.tpp) ? 1 : 0) + (has(self.cloud) ? 1 : 0) + (has(self.ngts) ? 1 : 0) == 1' - type: object - status: - description: Status of the ClusterIssuer. This is set and managed automatically. - properties: - acme: - description: |- - ACME specific status options. - This field should only be set if the Issuer is configured to use an ACME - server to issue certificates. - properties: - lastPrivateKeyHash: - description: |- - LastPrivateKeyHash is a hash of the private key associated with the latest - registered ACME account, in order to track changes made to registered account - associated with the Issuer - type: string - lastRegisteredEmail: - description: |- - LastRegisteredEmail is the email associated with the latest registered - ACME account, in order to track changes made to registered account - associated with the Issuer - type: string - uri: - description: |- - URI is the unique account identifier, which can also be used to retrieve - account details from the CA - type: string - type: object - conditions: - description: |- - List of status conditions to indicate the status of a CertificateRequest. - Known condition types are `Ready`. - items: - description: IssuerCondition contains condition information for an Issuer. - properties: - lastTransitionTime: - description: |- - LastTransitionTime is the timestamp corresponding to the last status - change of this condition. - format: date-time - type: string - message: - description: |- - Message is a human readable description of the details of the last - transition, complementing reason. - type: string - observedGeneration: - description: |- - If set, this represents the .metadata.generation that the condition was - set based upon. - For instance, if .metadata.generation is currently 12, but the - .status.condition[x].observedGeneration is 9, the condition is out of date - with respect to the current state of the Issuer. - format: int64 - type: integer - reason: - description: |- - Reason is a brief machine readable explanation for the condition's last - transition. - type: string - status: - description: Status of the condition, one of (`True`, `False`, `Unknown`). - enum: - - "True" - - "False" - - Unknown - type: string - type: - description: Type of the condition, known values are (`Ready`). - type: string - required: - - status - - type - type: object - type: array - x-kubernetes-list-map-keys: - - type - x-kubernetes-list-type: map - type: object - required: - - spec - type: object - served: true - storage: true - subresources: - status: {} - ---- -# Source: cert-manager/templates/crd-cert-manager.io_issuers.yaml -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - name: "issuers.cert-manager.io" - annotations: - helm.sh/resource-policy: keep - labels: - app: "cert-manager" - app.kubernetes.io/name: "cert-manager" - app.kubernetes.io/instance: "cert-manager" - app.kubernetes.io/component: "crds" - app.kubernetes.io/version: "v1.21.1" - app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 -spec: - group: cert-manager.io - names: - categories: - - cert-manager - kind: Issuer - listKind: IssuerList - plural: issuers - shortNames: - - iss - singular: issuer - scope: Namespaced - versions: - - additionalPrinterColumns: - - jsonPath: .status.conditions[?(@.type == "Ready")].status - name: Ready - type: string - - jsonPath: .status.conditions[?(@.type == "Ready")].message - name: Status - priority: 1 - type: string - - description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1 - schema: - openAPIV3Schema: - description: |- - An Issuer represents a certificate issuing authority which can be - referenced as part of `issuerRef` fields. - It is scoped to a single namespace and can therefore only be referenced by - resources within the same namespace. - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: Desired state of the Issuer resource. - properties: - acme: - description: |- - ACME configures this issuer to communicate with a RFC8555 (ACME) server - to obtain signed x509 certificates. - properties: - caBundle: - description: |- - Base64-encoded bundle of PEM CAs which can be used to validate the certificate - chain presented by the ACME server. - Mutually exclusive with SkipTLSVerify; prefer using CABundle to prevent various - kinds of security vulnerabilities. - If CABundle and SkipTLSVerify are unset, the system certificate bundle inside - the container is used to validate the TLS connection. - format: byte - type: string - disableAccountKeyGeneration: - description: |- - Enables or disables generating a new ACME account key. - If true, the Issuer resource will *not* request a new account but will expect - the account key to be supplied via an existing secret. - If false, the cert-manager system will generate a new ACME account key - for the Issuer. - Defaults to false. - type: boolean - email: - description: |- - Email is the email address to be associated with the ACME account. - This field is optional, but it is strongly recommended to be set. - It will be used to contact you in case of issues with your account or - certificates, including expiry notification emails. - This field may be updated after the account is initially registered. - type: string - enableDurationFeature: - description: |- - Enables requesting a Not After date on certificates that matches the - duration of the certificate. This is not supported by all ACME servers - like Let's Encrypt. If set to true when the ACME server does not support - it, it will create an error on the Order. - Defaults to false. - type: boolean - externalAccountBinding: - description: |- - ExternalAccountBinding is a reference to a CA external account of the ACME - server. - If set, upon registration cert-manager will attempt to associate the given - external account credentials with the registered ACME account. - properties: - keyAlgorithm: - description: |- - Deprecated: keyAlgorithm field exists for historical compatibility - reasons and should not be used. The algorithm is now hardcoded to HS256 - in golang/x/crypto/acme. - enum: - - HS256 - - HS384 - - HS512 - type: string - keyID: - description: keyID is the ID of the CA key that the External Account is bound to. - type: string - keySecretRef: - description: |- - keySecretRef is a Secret Key Selector referencing a data item in a Kubernetes - Secret which holds the symmetric MAC key of the External Account Binding. - The `key` is the index string that is paired with the key data in the - Secret and should not be confused with the key data itself, or indeed with - the External Account Binding keyID above. - The secret key stored in the Secret **must** be un-padded, base64 URL - encoded data. - properties: - key: - description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. - type: string - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - required: - - name - type: object - required: - - keyID - - keySecretRef - type: object - preferredChain: - description: |- - PreferredChain is the chain to use if the ACME server outputs multiple. - PreferredChain is no guarantee that this one gets delivered by the ACME - endpoint. - For example, for Let's Encrypt's DST cross-sign you would use: - "DST Root CA X3" or "ISRG Root X1" for the newer Let's Encrypt root CA. - This value picks the first certificate bundle in the combined set of - ACME default and alternative chains that has a root-most certificate with - this value as its issuer's commonname. - maxLength: 64 - type: string - privateKeySecretRef: - description: |- - PrivateKey is the name of a Kubernetes Secret resource that will be used to - store the automatically generated ACME account private key. - Optionally, a `key` may be specified to select a specific entry within - the named Secret resource. - If `key` is not specified, a default of `tls.key` will be used. - properties: - key: - description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. - type: string - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - required: - - name - type: object - profile: - description: |- - Profile allows requesting a certificate profile from the ACME server. - Supported profiles are listed by the server's ACME directory URL. - type: string - server: - description: |- - Server is the URL used to access the ACME server's 'directory' endpoint. - For example, for Let's Encrypt's staging endpoint, you would use: - "https://acme-staging-v02.api.letsencrypt.org/directory". - Only ACME v2 endpoints (i.e. RFC 8555) are supported. - type: string - skipTLSVerify: - description: |- - INSECURE: Enables or disables validation of the ACME server TLS certificate. - If true, requests to the ACME server will not have the TLS certificate chain - validated. - Mutually exclusive with CABundle; prefer using CABundle to prevent various - kinds of security vulnerabilities. - Only enable this option in development environments. - If CABundle and SkipTLSVerify are unset, the system certificate bundle inside - the container is used to validate the TLS connection. - Defaults to false. - type: boolean - solvers: - description: |- - Solvers is a list of challenge solvers that will be used to solve - ACME challenges for the matching domains. - Solver configurations must be provided in order to obtain certificates - from an ACME server. - For more information, see: https://cert-manager.io/docs/configuration/acme/ - items: - description: |- - An ACMEChallengeSolver describes how to solve ACME challenges for the issuer it is part of. - A selector may be provided to use different solving strategies for different DNS names. - Only one of HTTP01 or DNS01 must be provided. - properties: - dns01: - description: |- - Configures cert-manager to attempt to complete authorizations by - performing the DNS01 challenge flow. - properties: - acmeDNS: - description: |- - Use the 'ACME DNS' (https://github.com/joohoi/acme-dns) API to manage - DNS01 challenge records. - properties: - accountSecretRef: - description: |- - A reference to a specific 'key' within a Secret resource. - In some instances, `key` is a required field. - properties: - key: - description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. - type: string - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - required: - - name - type: object - host: - type: string - required: - - accountSecretRef - - host - type: object - akamai: - description: Use the Akamai DNS zone management API to manage DNS01 challenge records. - properties: - accessTokenSecretRef: - description: |- - A reference to a specific 'key' within a Secret resource. - In some instances, `key` is a required field. - properties: - key: - description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. - type: string - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - required: - - name - type: object - clientSecretSecretRef: - description: |- - A reference to a specific 'key' within a Secret resource. - In some instances, `key` is a required field. - properties: - key: - description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. - type: string - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - required: - - name - type: object - clientTokenSecretRef: - description: |- - A reference to a specific 'key' within a Secret resource. - In some instances, `key` is a required field. - properties: - key: - description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. - type: string - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - required: - - name - type: object - serviceConsumerDomain: - type: string - required: - - accessTokenSecretRef - - clientSecretSecretRef - - clientTokenSecretRef - - serviceConsumerDomain - type: object - azureDNS: - description: Use the Microsoft Azure DNS API to manage DNS01 challenge records. - properties: - clientID: - description: |- - Auth: Azure Service Principal: - The ClientID of the Azure Service Principal used to authenticate with Azure DNS. - If set, ClientSecret and TenantID must also be set. - type: string - clientSecretSecretRef: - description: |- - Auth: Azure Service Principal: - A reference to a Secret containing the password associated with the Service Principal. - If set, ClientID and TenantID must also be set. - properties: - key: - description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. - type: string - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - required: - - name - type: object - environment: - description: name of the Azure environment (default AzurePublicCloud) - enum: - - AzurePublicCloud - - AzureChinaCloud - - AzureGermanCloud - - AzureUSGovernmentCloud - type: string - hostedZoneName: - description: name of the DNS zone that should be used - type: string - managedIdentity: - description: |- - Auth: Azure Workload Identity or Azure Managed Service Identity: - Settings to enable Azure Workload Identity or Azure Managed Service Identity - If set, ClientID, ClientSecret and TenantID must not be set. - properties: - clientID: - description: client ID of the managed identity, cannot be used at the same time as resourceID - type: string - resourceID: - description: |- - resource ID of the managed identity, cannot be used at the same time as clientID - Cannot be used for Azure Managed Service Identity - type: string - tenantID: - description: tenant ID of the managed identity, cannot be used at the same time as resourceID - type: string - type: object - resourceGroupName: - description: resource group the DNS zone is located in - type: string - subscriptionID: - description: ID of the Azure subscription - type: string - tenantID: - description: |- - Auth: Azure Service Principal: - The TenantID of the Azure Service Principal used to authenticate with Azure DNS. - If set, ClientID and ClientSecret must also be set. - type: string - zoneType: - description: |- - ZoneType determines which type of Azure DNS zone to use. - - Valid values are: - - AzurePublicZone (default): Use a public Azure DNS zone. - - AzurePrivateZone: Use an Azure Private DNS zone. - - If not specified, AzurePublicZone is used. - - Support for Azure Private DNS zones is currently - experimental and may change in future releases. - enum: - - AzurePublicZone - - AzurePrivateZone - type: string - required: - - resourceGroupName - - subscriptionID - type: object - cloudDNS: - description: Use the Google Cloud DNS API to manage DNS01 challenge records. - properties: - hostedZoneName: - description: |- - HostedZoneName is an optional field that tells cert-manager in which - Cloud DNS zone the challenge record has to be created. - If left empty cert-manager will automatically choose a zone. - type: string - project: - type: string - serviceAccountSecretRef: - description: |- - A reference to a specific 'key' within a Secret resource. - In some instances, `key` is a required field. - properties: - key: - description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. - type: string - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - required: - - name - type: object - required: - - project - type: object - cloudflare: - description: Use the Cloudflare API to manage DNS01 challenge records. - properties: - apiKeySecretRef: - description: |- - API key to use to authenticate with Cloudflare. - Note: using an API token to authenticate is now the recommended method - as it allows greater control of permissions. - properties: - key: - description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. - type: string - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - required: - - name - type: object - apiTokenSecretRef: - description: API token used to authenticate with Cloudflare. - properties: - key: - description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. - type: string - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - required: - - name - type: object - email: - description: Email of the account, only required when using API key based authentication. - type: string - type: object - cnameStrategy: - description: |- - CNAMEStrategy configures how the DNS01 provider should handle CNAME - records when found in DNS zones. - enum: - - None - - Follow - type: string - digitalocean: - description: Use the DigitalOcean DNS API to manage DNS01 challenge records. - properties: - tokenSecretRef: - description: |- - A reference to a specific 'key' within a Secret resource. - In some instances, `key` is a required field. - properties: - key: - description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. - type: string - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - required: - - name - type: object - required: - - tokenSecretRef - type: object - rfc2136: - description: |- - Use RFC2136 ("Dynamic Updates in the Domain Name System") (https://datatracker.ietf.org/doc/rfc2136/) - to manage DNS01 challenge records. - properties: - nameserver: - description: |- - The IP address or hostname of an authoritative DNS server supporting - RFC2136 in the form host:port. If the host is an IPv6 address it must be - enclosed in square brackets (e.g [2001:db8::1]); port is optional. - This field is required. - type: string - protocol: - description: Protocol to use for dynamic DNS update queries. Valid values are (case-sensitive) ``TCP`` and ``UDP``; ``UDP`` (default). - enum: - - TCP - - UDP - type: string - tsigAlgorithm: - description: |- - The TSIG Algorithm configured in the DNS supporting RFC2136. Used only - when ``tsigSecretSecretRef`` and ``tsigKeyName`` are defined. - Supported values are (case-insensitive): ``HMACMD5`` (default), - ``HMACSHA1``, ``HMACSHA256`` or ``HMACSHA512``. - type: string - tsigKeyName: - description: |- - The TSIG Key name configured in the DNS. - If ``tsigSecretSecretRef`` is defined, this field is required. - type: string - tsigSecretSecretRef: - description: |- - The name of the secret containing the TSIG value. - If ``tsigKeyName`` is defined, this field is required. - properties: - key: - description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. - type: string - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - required: - - name - type: object - required: - - nameserver - type: object - route53: - description: Use the AWS Route53 API to manage DNS01 challenge records. - properties: - accessKeyID: - description: |- - The AccessKeyID is used for authentication. - Cannot be set when SecretAccessKeyID is set. - If neither the Access Key nor Key ID are set, we fall back to using env - vars, shared credentials file, or AWS Instance metadata, - see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials - type: string - accessKeyIDSecretRef: - description: |- - The SecretAccessKey is used for authentication. If set, pull the AWS - access key ID from a key within a Kubernetes Secret. - Cannot be set when AccessKeyID is set. - If neither the Access Key nor Key ID are set, we fall back to using env - vars, shared credentials file, or AWS Instance metadata, - see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials - properties: - key: - description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. - type: string - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - required: - - name - type: object - auth: - description: Auth configures how cert-manager authenticates. - properties: - kubernetes: - description: |- - Kubernetes authenticates with Route53 using AssumeRoleWithWebIdentity - by passing a bound ServiceAccount token. - properties: - serviceAccountRef: - description: |- - A reference to a service account that will be used to request a bound - token (also known as "projected token"). To use this field, you must - configure an RBAC rule to let cert-manager request a token. - properties: - audiences: - description: |- - TokenAudiences is an optional list of audiences to include in the - token passed to AWS. The default token consisting of the issuer's namespace - and name is always included. - If unset the audience defaults to `sts.amazonaws.com`. - items: - type: string - type: array - x-kubernetes-list-type: atomic - name: - description: Name of the ServiceAccount used to request a token. - type: string - required: - - name - type: object - required: - - serviceAccountRef - type: object - required: - - kubernetes - type: object - hostedZoneID: - description: If set, the provider will manage only this zone in Route53 and will not do a lookup using the route53:ListHostedZonesByName api call. - type: string - region: - description: |- - Override the AWS region. - - Route53 is a global service and does not have regional endpoints but the - region specified here (or via environment variables) is used as a hint to - help compute the correct AWS credential scope and partition when it - connects to Route53. See: - - [Amazon Route 53 endpoints and quotas](https://docs.aws.amazon.com/general/latest/gr/r53.html) - - [Global services](https://docs.aws.amazon.com/whitepapers/latest/aws-fault-isolation-boundaries/global-services.html) - - If you omit this region field, cert-manager will use the region from - AWS_REGION and AWS_DEFAULT_REGION environment variables, if they are set - in the cert-manager controller Pod. - - The `region` field is not needed if you use [IAM Roles for Service Accounts (IRSA)](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html). - Instead an AWS_REGION environment variable is added to the cert-manager controller Pod by: - [Amazon EKS Pod Identity Webhook](https://github.com/aws/amazon-eks-pod-identity-webhook). - In this case this `region` field value is ignored. - - The `region` field is not needed if you use [EKS Pod Identities](https://docs.aws.amazon.com/eks/latest/userguide/pod-identities.html). - Instead an AWS_REGION environment variable is added to the cert-manager controller Pod by: - [Amazon EKS Pod Identity Agent](https://github.com/aws/eks-pod-identity-agent), - In this case this `region` field value is ignored. - type: string - role: - description: |- - Role is a Role ARN which the Route53 provider will assume using either the explicit credentials AccessKeyID/SecretAccessKey - or the inferred credentials from environment variables, shared credentials file or AWS Instance metadata - type: string - secretAccessKeySecretRef: - description: |- - The SecretAccessKey is used for authentication. - If neither the Access Key nor Key ID are set, we fall back to using env - vars, shared credentials file, or AWS Instance metadata, - see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials - properties: - key: - description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. - type: string - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - required: - - name - type: object - type: object - webhook: - description: |- - Configure an external webhook based DNS01 challenge solver to manage - DNS01 challenge records. - properties: - config: - description: |- - Additional configuration that should be passed to the webhook apiserver - when challenges are processed. - This can contain arbitrary JSON data. - Secret values should not be specified in this stanza. - If secret values are needed (e.g., credentials for a DNS service), you - should use a SecretKeySelector to reference a Secret resource. - For details on the schema of this field, consult the webhook provider - implementation's documentation. - x-kubernetes-preserve-unknown-fields: true - groupName: - description: |- - The API group name that should be used when POSTing ChallengePayload - resources to the webhook apiserver. - This should be the same as the GroupName specified in the webhook - provider implementation. - type: string - solverName: - description: |- - The name of the solver to use, as defined in the webhook provider - implementation. - This will typically be the name of the provider, e.g., 'cloudflare'. - type: string - required: - - groupName - - solverName - type: object - type: object - http01: - description: |- - Configures cert-manager to attempt to complete authorizations by - performing the HTTP01 challenge flow. - It is not possible to obtain certificates for wildcard domain names - (e.g., `*.example.com`) using the HTTP01 challenge mechanism. - properties: - gatewayHTTPRoute: - description: |- - The Gateway API is a sig-network community API that models service networking - in Kubernetes (https://gateway-api.sigs.k8s.io/). The Gateway solver will - create HTTPRoutes with the specified labels in the same namespace as the challenge. - This solver is experimental, and fields / behaviour may change in the future. - properties: - labels: - additionalProperties: - type: string - description: |- - Custom labels that will be applied to HTTPRoutes created by cert-manager - while solving HTTP-01 challenges. - type: object - parentRefs: - description: |- - When solving an HTTP-01 challenge, cert-manager creates an HTTPRoute. - cert-manager needs to know which parentRefs should be used when creating - the HTTPRoute. Usually, the parentRef references a Gateway. See: - https://gateway-api.sigs.k8s.io/api-types/httproute/#attaching-to-gateways - items: - description: |- - ParentReference identifies an API object (usually a Gateway) that can be considered - a parent of this resource (usually a route). There are two kinds of parent resources - with "Core" support: - - * Gateway (Gateway conformance profile) - * Service (Mesh conformance profile, ClusterIP Services only) - - This API may be extended in the future to support additional kinds of parent - resources. - - The API object must be valid in the cluster; the Group and Kind must - be registered in the cluster for this reference to be valid. - properties: - group: - default: gateway.networking.k8s.io - description: |- - Group is the group of the referent. - When unspecified, "gateway.networking.k8s.io" is inferred. - To set the core API group (such as for a "Service" kind referent), - Group must be explicitly set to "" (empty string). - - Support: Core - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - default: Gateway - description: |- - Kind is kind of the referent. - - There are two kinds of parent resources with "Core" support: - - * Gateway (Gateway conformance profile) - * Service (Mesh conformance profile, ClusterIP Services only) - - Support for other resources is Implementation-Specific. - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: |- - Name is the name of the referent. - - Support: Core - maxLength: 253 - minLength: 1 - type: string - namespace: - description: |- - Namespace is the namespace of the referent. When unspecified, this refers - to the local namespace of the Route. - - Note that there are specific rules for ParentRefs which cross namespace - boundaries. Cross-namespace references are only valid if they are explicitly - allowed by something in the namespace they are referring to. For example: - Gateway has the AllowedRoutes field, and ReferenceGrant provides a - generic way to enable any other kind of cross-namespace reference. - - - ParentRefs from a Route to a Service in the same namespace are "producer" - routes, which apply default routing rules to inbound connections from - any namespace to the Service. - - ParentRefs from a Route to a Service in a different namespace are - "consumer" routes, and these routing rules are only applied to outbound - connections originating from the same namespace as the Route, for which - the intended destination of the connections are a Service targeted as a - ParentRef of the Route. - - - Support: Core - maxLength: 63 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ - type: string - port: - description: |- - Port is the network port this Route targets. It can be interpreted - differently based on the type of parent resource. - - When the parent resource is a Gateway, this targets all listeners - listening on the specified port that also support this kind of Route(and - select this Route). It's not recommended to set `Port` unless the - networking behaviors specified in a Route must apply to a specific port - as opposed to a listener(s) whose port(s) may be changed. When both Port - and SectionName are specified, the name and port of the selected listener - must match both specified values. - - - When the parent resource is a Service, this targets a specific port in the - Service spec. When both Port (experimental) and SectionName are specified, - the name and port of the selected port must match both specified values. - - - Implementations MAY choose to support other parent resources. - Implementations supporting other types of parent resources MUST clearly - document how/if Port is interpreted. - - For the purpose of status, an attachment is considered successful as - long as the parent resource accepts it partially. For example, Gateway - listeners can restrict which Routes can attach to them by Route kind, - namespace, or hostname. If 1 of 2 Gateway listeners accept attachment - from the referencing Route, the Route MUST be considered successfully - attached. If no Gateway listeners accept attachment from this Route, - the Route MUST be considered detached from the Gateway. - - Support: Extended - format: int32 - maximum: 65535 - minimum: 1 - type: integer - sectionName: - description: |- - SectionName is the name of a section within the target resource. In the - following resources, SectionName is interpreted as the following: - - * Gateway: Listener name. When both Port (experimental) and SectionName - are specified, the name and port of the selected listener must match - both specified values. - * Service: Port name. When both Port (experimental) and SectionName - are specified, the name and port of the selected listener must match - both specified values. - - Implementations MAY choose to support attaching Routes to other resources. - If that is the case, they MUST clearly document how SectionName is - interpreted. - - When unspecified (empty string), this will reference the entire resource. - For the purpose of status, an attachment is considered successful if at - least one section in the parent resource accepts it. For example, Gateway - listeners can restrict which Routes can attach to them by Route kind, - namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from - the referencing Route, the Route MUST be considered successfully - attached. If no Gateway listeners accept attachment from this Route, the - Route MUST be considered detached from the Gateway. - - Support: Core - maxLength: 253 - minLength: 1 - pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - required: - - name - type: object - type: array - x-kubernetes-list-type: atomic - podTemplate: - description: |- - Optional pod template used to configure the ACME challenge solver pods - used for HTTP01 challenges. - properties: - metadata: - description: |- - ObjectMeta overrides for the pod used to solve HTTP01 challenges. - Only the 'labels' and 'annotations' fields may be set. - If labels or annotations overlap with in-built values, the values here - will override the in-built values. - properties: - annotations: - additionalProperties: - type: string - description: Annotations that should be added to the created ACME HTTP01 solver pods. - type: object - labels: - additionalProperties: - type: string - description: Labels that should be added to the created ACME HTTP01 solver pods. - type: object - type: object - spec: - description: |- - PodSpec defines overrides for the HTTP01 challenge solver pod. - Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields. - All other fields will be ignored. - properties: - affinity: - description: If specified, the pod's scheduling constraints - properties: - nodeAffinity: - description: Describes node affinity scheduling rules for the pod. - properties: - preferredDuringSchedulingIgnoredDuringExecution: - description: |- - The scheduler will prefer to schedule pods to nodes that satisfy - the affinity expressions specified by this field, but it may choose - a node that violates one or more of the expressions. The node that is - most preferred is the one with the greatest sum of weights, i.e. - for each node that meets all of the scheduling requirements (resource - request, requiredDuringScheduling affinity expressions, etc.), - compute a sum by iterating through the elements of this field and adding - "weight" to the sum if the node matches the corresponding matchExpressions; the - node(s) with the highest sum are the most preferred. - items: - description: |- - An empty preferred scheduling term matches all objects with implicit weight 0 - (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). - properties: - preference: - description: A node selector term, associated with the corresponding weight. - properties: - matchExpressions: - description: A list of node selector requirements by node's labels. - items: - description: |- - A node selector requirement is a selector that contains values, a key, and an operator - that relates the key and values. - properties: - key: - description: The label key that the selector applies to. - type: string - operator: - description: |- - Represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. - type: string - values: - description: |- - An array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. If the operator is Gt or Lt, the values - array must have a single element, which will be interpreted as an integer. - This array is replaced during a strategic merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchFields: - description: A list of node selector requirements by node's fields. - items: - description: |- - A node selector requirement is a selector that contains values, a key, and an operator - that relates the key and values. - properties: - key: - description: The label key that the selector applies to. - type: string - operator: - description: |- - Represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. - type: string - values: - description: |- - An array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. If the operator is Gt or Lt, the values - array must have a single element, which will be interpreted as an integer. - This array is replaced during a strategic merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - type: object - x-kubernetes-map-type: atomic - weight: - description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100. - format: int32 - type: integer - required: - - preference - - weight - type: object - type: array - x-kubernetes-list-type: atomic - requiredDuringSchedulingIgnoredDuringExecution: - description: |- - If the affinity requirements specified by this field are not met at - scheduling time, the pod will not be scheduled onto the node. - If the affinity requirements specified by this field cease to be met - at some point during pod execution (e.g. due to an update), the system - may or may not try to eventually evict the pod from its node. - properties: - nodeSelectorTerms: - description: Required. A list of node selector terms. The terms are ORed. - items: - description: |- - A null or empty node selector term matches no objects. The requirements of - them are ANDed. - The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. - properties: - matchExpressions: - description: A list of node selector requirements by node's labels. - items: - description: |- - A node selector requirement is a selector that contains values, a key, and an operator - that relates the key and values. - properties: - key: - description: The label key that the selector applies to. - type: string - operator: - description: |- - Represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. - type: string - values: - description: |- - An array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. If the operator is Gt or Lt, the values - array must have a single element, which will be interpreted as an integer. - This array is replaced during a strategic merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchFields: - description: A list of node selector requirements by node's fields. - items: - description: |- - A node selector requirement is a selector that contains values, a key, and an operator - that relates the key and values. - properties: - key: - description: The label key that the selector applies to. - type: string - operator: - description: |- - Represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. - type: string - values: - description: |- - An array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. If the operator is Gt or Lt, the values - array must have a single element, which will be interpreted as an integer. - This array is replaced during a strategic merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - type: object - x-kubernetes-map-type: atomic - type: array - x-kubernetes-list-type: atomic - required: - - nodeSelectorTerms - type: object - x-kubernetes-map-type: atomic - type: object - podAffinity: - description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)). - properties: - preferredDuringSchedulingIgnoredDuringExecution: - description: |- - The scheduler will prefer to schedule pods to nodes that satisfy - the affinity expressions specified by this field, but it may choose - a node that violates one or more of the expressions. The node that is - most preferred is the one with the greatest sum of weights, i.e. - for each node that meets all of the scheduling requirements (resource - request, requiredDuringScheduling affinity expressions, etc.), - compute a sum by iterating through the elements of this field and adding - "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the - node(s) with the highest sum are the most preferred. - items: - description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) - properties: - podAffinityTerm: - description: Required. A pod affinity term, associated with the corresponding weight. - properties: - labelSelector: - description: |- - A label query over a set of resources, in this case pods. - If it's null, this PodAffinityTerm matches with no Pods. - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - matchLabelKeys: - description: |- - MatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both matchLabelKeys and labelSelector. - Also, matchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - mismatchLabelKeys: - description: |- - MismatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. - Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - namespaceSelector: - description: |- - A label query over the set of namespaces that the term applies to. - The term is applied to the union of the namespaces selected by this field - and the ones listed in the namespaces field. - null selector and null or empty namespaces list means "this pod's namespace". - An empty selector ({}) matches all namespaces. - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - namespaces: - description: |- - namespaces specifies a static list of namespace names that the term applies to. - The term is applied to the union of the namespaces listed in this field - and the ones selected by namespaceSelector. - null or empty namespaces list and null namespaceSelector means "this pod's namespace". - items: - type: string - type: array - x-kubernetes-list-type: atomic - topologyKey: - description: |- - This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching - the labelSelector in the specified namespaces, where co-located is defined as running on a node - whose value of the label with key topologyKey matches that of any node on which any of the - selected pods is running. - Empty topologyKey is not allowed. - type: string - required: - - topologyKey - type: object - weight: - description: |- - weight associated with matching the corresponding podAffinityTerm, - in the range 1-100. - format: int32 - type: integer - required: - - podAffinityTerm - - weight - type: object - type: array - x-kubernetes-list-type: atomic - requiredDuringSchedulingIgnoredDuringExecution: - description: |- - If the affinity requirements specified by this field are not met at - scheduling time, the pod will not be scheduled onto the node. - If the affinity requirements specified by this field cease to be met - at some point during pod execution (e.g. due to a pod label update), the - system may or may not try to eventually evict the pod from its node. - When there are multiple elements, the lists of nodes corresponding to each - podAffinityTerm are intersected, i.e. all terms must be satisfied. - items: - description: |- - Defines a set of pods (namely those matching the labelSelector - relative to the given namespace(s)) that this pod should be - co-located (affinity) or not co-located (anti-affinity) with, - where co-located is defined as running on a node whose value of - the label with key matches that of any node on which - a pod of the set of pods is running - properties: - labelSelector: - description: |- - A label query over a set of resources, in this case pods. - If it's null, this PodAffinityTerm matches with no Pods. - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - matchLabelKeys: - description: |- - MatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both matchLabelKeys and labelSelector. - Also, matchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - mismatchLabelKeys: - description: |- - MismatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. - Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - namespaceSelector: - description: |- - A label query over the set of namespaces that the term applies to. - The term is applied to the union of the namespaces selected by this field - and the ones listed in the namespaces field. - null selector and null or empty namespaces list means "this pod's namespace". - An empty selector ({}) matches all namespaces. - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - namespaces: - description: |- - namespaces specifies a static list of namespace names that the term applies to. - The term is applied to the union of the namespaces listed in this field - and the ones selected by namespaceSelector. - null or empty namespaces list and null namespaceSelector means "this pod's namespace". - items: - type: string - type: array - x-kubernetes-list-type: atomic - topologyKey: - description: |- - This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching - the labelSelector in the specified namespaces, where co-located is defined as running on a node - whose value of the label with key topologyKey matches that of any node on which any of the - selected pods is running. - Empty topologyKey is not allowed. - type: string - required: - - topologyKey - type: object - type: array - x-kubernetes-list-type: atomic - type: object - podAntiAffinity: - description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)). - properties: - preferredDuringSchedulingIgnoredDuringExecution: - description: |- - The scheduler will prefer to schedule pods to nodes that satisfy - the anti-affinity expressions specified by this field, but it may choose - a node that violates one or more of the expressions. The node that is - most preferred is the one with the greatest sum of weights, i.e. - for each node that meets all of the scheduling requirements (resource - request, requiredDuringScheduling anti-affinity expressions, etc.), - compute a sum by iterating through the elements of this field and subtracting - "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the - node(s) with the highest sum are the most preferred. - items: - description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) - properties: - podAffinityTerm: - description: Required. A pod affinity term, associated with the corresponding weight. - properties: - labelSelector: - description: |- - A label query over a set of resources, in this case pods. - If it's null, this PodAffinityTerm matches with no Pods. - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - matchLabelKeys: - description: |- - MatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both matchLabelKeys and labelSelector. - Also, matchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - mismatchLabelKeys: - description: |- - MismatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. - Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - namespaceSelector: - description: |- - A label query over the set of namespaces that the term applies to. - The term is applied to the union of the namespaces selected by this field - and the ones listed in the namespaces field. - null selector and null or empty namespaces list means "this pod's namespace". - An empty selector ({}) matches all namespaces. - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - namespaces: - description: |- - namespaces specifies a static list of namespace names that the term applies to. - The term is applied to the union of the namespaces listed in this field - and the ones selected by namespaceSelector. - null or empty namespaces list and null namespaceSelector means "this pod's namespace". - items: - type: string - type: array - x-kubernetes-list-type: atomic - topologyKey: - description: |- - This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching - the labelSelector in the specified namespaces, where co-located is defined as running on a node - whose value of the label with key topologyKey matches that of any node on which any of the - selected pods is running. - Empty topologyKey is not allowed. - type: string - required: - - topologyKey - type: object - weight: - description: |- - weight associated with matching the corresponding podAffinityTerm, - in the range 1-100. - format: int32 - type: integer - required: - - podAffinityTerm - - weight - type: object - type: array - x-kubernetes-list-type: atomic - requiredDuringSchedulingIgnoredDuringExecution: - description: |- - If the anti-affinity requirements specified by this field are not met at - scheduling time, the pod will not be scheduled onto the node. - If the anti-affinity requirements specified by this field cease to be met - at some point during pod execution (e.g. due to a pod label update), the - system may or may not try to eventually evict the pod from its node. - When there are multiple elements, the lists of nodes corresponding to each - podAffinityTerm are intersected, i.e. all terms must be satisfied. - items: - description: |- - Defines a set of pods (namely those matching the labelSelector - relative to the given namespace(s)) that this pod should be - co-located (affinity) or not co-located (anti-affinity) with, - where co-located is defined as running on a node whose value of - the label with key matches that of any node on which - a pod of the set of pods is running - properties: - labelSelector: - description: |- - A label query over a set of resources, in this case pods. - If it's null, this PodAffinityTerm matches with no Pods. - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - matchLabelKeys: - description: |- - MatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both matchLabelKeys and labelSelector. - Also, matchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - mismatchLabelKeys: - description: |- - MismatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. - Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - namespaceSelector: - description: |- - A label query over the set of namespaces that the term applies to. - The term is applied to the union of the namespaces selected by this field - and the ones listed in the namespaces field. - null selector and null or empty namespaces list means "this pod's namespace". - An empty selector ({}) matches all namespaces. - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - namespaces: - description: |- - namespaces specifies a static list of namespace names that the term applies to. - The term is applied to the union of the namespaces listed in this field - and the ones selected by namespaceSelector. - null or empty namespaces list and null namespaceSelector means "this pod's namespace". - items: - type: string - type: array - x-kubernetes-list-type: atomic - topologyKey: - description: |- - This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching - the labelSelector in the specified namespaces, where co-located is defined as running on a node - whose value of the label with key topologyKey matches that of any node on which any of the - selected pods is running. - Empty topologyKey is not allowed. - type: string - required: - - topologyKey - type: object - type: array - x-kubernetes-list-type: atomic - type: object - type: object - imagePullSecrets: - description: If specified, the pod's imagePullSecrets - items: - description: |- - LocalObjectReference contains enough information to let you locate the - referenced object inside the same namespace. - properties: - name: - default: "" - description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - type: object - x-kubernetes-map-type: atomic - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - nodeSelector: - additionalProperties: - type: string - description: |- - NodeSelector is a selector which must be true for the pod to fit on a node. - Selector which must match a node's labels for the pod to be scheduled on that node. - More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ - type: object - priorityClassName: - description: If specified, the pod's priorityClassName. - type: string - resources: - description: |- - If specified, the pod's resource requirements. - These values override the global resource configuration flags. - Note that when only specifying resource limits, ensure they are greater than or equal - to the corresponding global resource requests configured via controller flags - (--acme-http01-solver-resource-request-cpu, --acme-http01-solver-resource-request-memory). - Kubernetes will reject pod creation if limits are lower than requests, causing challenge failures. - properties: - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: |- - Limits describes the maximum amount of compute resources allowed. - More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: |- - Requests describes the minimum amount of compute resources required. - If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, - otherwise to the global values configured via controller flags. Requests cannot exceed Limits. - More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ - type: object - type: object - securityContext: - description: If specified, the pod's security context - properties: - fsGroup: - description: |- - A special supplemental group that applies to all containers in a pod. - Some volume types allow the Kubelet to change the ownership of that volume - to be owned by the pod: - - 1. The owning GID will be the FSGroup - 2. The setgid bit is set (new files created in the volume will be owned by FSGroup) - 3. The permission bits are OR'd with rw-rw---- - - If unset, the Kubelet will not modify the ownership and permissions of any volume. - Note that this field cannot be set when spec.os.name is windows. - format: int64 - type: integer - fsGroupChangePolicy: - description: |- - fsGroupChangePolicy defines behavior of changing ownership and permission of the volume - before being exposed inside Pod. This field will only apply to - volume types which support fsGroup based ownership(and permissions). - It will have no effect on ephemeral volume types such as: secret, configmaps - and emptydir. - Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used. - Note that this field cannot be set when spec.os.name is windows. - type: string - runAsGroup: - description: |- - The GID to run the entrypoint of the container process. - Uses runtime default if unset. - May also be set in SecurityContext. If set in both SecurityContext and - PodSecurityContext, the value specified in SecurityContext takes precedence - for that container. - Note that this field cannot be set when spec.os.name is windows. - format: int64 - type: integer - runAsNonRoot: - description: |- - Indicates that the container must run as a non-root user. - If true, the Kubelet will validate the image at runtime to ensure that it - does not run as UID 0 (root) and fail to start the container if it does. - If unset or false, no such validation will be performed. - May also be set in SecurityContext. If set in both SecurityContext and - PodSecurityContext, the value specified in SecurityContext takes precedence. - type: boolean - runAsUser: - description: |- - The UID to run the entrypoint of the container process. - Defaults to user specified in image metadata if unspecified. - May also be set in SecurityContext. If set in both SecurityContext and - PodSecurityContext, the value specified in SecurityContext takes precedence - for that container. - Note that this field cannot be set when spec.os.name is windows. - format: int64 - type: integer - seLinuxOptions: - description: |- - The SELinux context to be applied to all containers. - If unspecified, the container runtime will allocate a random SELinux context for each - container. May also be set in SecurityContext. If set in - both SecurityContext and PodSecurityContext, the value specified in SecurityContext - takes precedence for that container. - Note that this field cannot be set when spec.os.name is windows. - properties: - level: - description: Level is SELinux level label that applies to the container. - type: string - role: - description: Role is a SELinux role label that applies to the container. - type: string - type: - description: Type is a SELinux type label that applies to the container. - type: string - user: - description: User is a SELinux user label that applies to the container. - type: string - type: object - seccompProfile: - description: |- - The seccomp options to use by the containers in this pod. - Note that this field cannot be set when spec.os.name is windows. - properties: - localhostProfile: - description: |- - localhostProfile indicates a profile defined in a file on the node should be used. - The profile must be preconfigured on the node to work. - Must be a descending path, relative to the kubelet's configured seccomp profile location. - Must be set if type is "Localhost". Must NOT be set for any other type. - type: string - type: - description: |- - type indicates which kind of seccomp profile will be applied. - Valid options are: - - Localhost - a profile defined in a file on the node should be used. - RuntimeDefault - the container runtime default profile should be used. - Unconfined - no profile should be applied. - type: string - required: - - type - type: object - supplementalGroups: - description: |- - A list of groups applied to the first process run in each container, in addition - to the container's primary GID, the fsGroup (if specified), and group memberships - defined in the container image for the uid of the container process. If unspecified, - no additional groups are added to any container. Note that group memberships - defined in the container image for the uid of the container process are still effective, - even if they are not included in this list. - Note that this field cannot be set when spec.os.name is windows. - items: - format: int64 - type: integer - type: array - x-kubernetes-list-type: atomic - sysctls: - description: |- - Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported - sysctls (by the container runtime) might fail to launch. - Note that this field cannot be set when spec.os.name is windows. - items: - description: Sysctl defines a kernel parameter to be set - properties: - name: - description: Name of a property to set - type: string - value: - description: Value of a property to set - type: string - required: - - name - - value - type: object - type: array - x-kubernetes-list-type: atomic - type: object - serviceAccountName: - description: If specified, the pod's service account - type: string - tolerations: - description: If specified, the pod's tolerations. - items: - description: |- - The pod this Toleration is attached to tolerates any taint that matches - the triple using the matching operator . - properties: - effect: - description: |- - Effect indicates the taint effect to match. Empty means match all taint effects. - When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. - type: string - key: - description: |- - Key is the taint key that the toleration applies to. Empty means match all taint keys. - If the key is empty, operator must be Exists; this combination means to match all values and all keys. - type: string - operator: - description: |- - Operator represents a key's relationship to the value. - Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. - Exists is equivalent to wildcard for value, so that a pod can - tolerate all taints of a particular category. - Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). - type: string - tolerationSeconds: - description: |- - TolerationSeconds represents the period of time the toleration (which must be - of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, - it is not set, which means tolerate the taint forever (do not evict). Zero and - negative values will be treated as 0 (evict immediately) by the system. - format: int64 - type: integer - value: - description: |- - Value is the taint value the toleration matches to. - If the operator is Exists, the value should be empty, otherwise just a regular string. - type: string - type: object - type: array - x-kubernetes-list-type: atomic - type: object - type: object - serviceType: - description: |- - Optional service type for Kubernetes solver service. Supported values - are NodePort or ClusterIP. If unset, defaults to NodePort. - type: string - type: object - ingress: - description: |- - The ingress based HTTP01 challenge solver will solve challenges by - creating or modifying Ingress resources in order to route requests for - '/.well-known/acme-challenge/XYZ' to 'challenge solver' pods that are - provisioned by cert-manager for each Challenge to be completed. - properties: - class: - description: |- - This field configures the annotation `kubernetes.io/ingress.class` when - creating Ingress resources to solve ACME challenges that use this - challenge solver. Only one of `class`, `name` or `ingressClassName` may - be specified. - type: string - ingressClassName: - description: |- - This field configures the field `ingressClassName` on the created Ingress - resources used to solve ACME challenges that use this challenge solver. - This is the recommended way of configuring the ingress class. Only one of - `class`, `name` or `ingressClassName` may be specified. - type: string - ingressTemplate: - description: |- - Optional ingress template used to configure the ACME challenge solver - ingress used for HTTP01 challenges. - properties: - metadata: - description: |- - ObjectMeta overrides for the ingress used to solve HTTP01 challenges. - Only the 'labels' and 'annotations' fields may be set. - If labels or annotations overlap with in-built values, the values here - will override the in-built values. - properties: - annotations: - additionalProperties: - type: string - description: Annotations that should be added to the created ACME HTTP01 solver ingress. - type: object - labels: - additionalProperties: - type: string - description: Labels that should be added to the created ACME HTTP01 solver ingress. - type: object - type: object - type: object - name: - description: |- - The name of the ingress resource that should have ACME challenge solving - routes inserted into it in order to solve HTTP01 challenges. - This is typically used in conjunction with ingress controllers like - ingress-gce, which maintains a 1:1 mapping between external IPs and - ingress resources. Only one of `class`, `name` or `ingressClassName` may - be specified. - type: string - podTemplate: - description: |- - Optional pod template used to configure the ACME challenge solver pods - used for HTTP01 challenges. - properties: - metadata: - description: |- - ObjectMeta overrides for the pod used to solve HTTP01 challenges. - Only the 'labels' and 'annotations' fields may be set. - If labels or annotations overlap with in-built values, the values here - will override the in-built values. - properties: - annotations: - additionalProperties: - type: string - description: Annotations that should be added to the created ACME HTTP01 solver pods. - type: object - labels: - additionalProperties: - type: string - description: Labels that should be added to the created ACME HTTP01 solver pods. - type: object - type: object - spec: - description: |- - PodSpec defines overrides for the HTTP01 challenge solver pod. - Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields. - All other fields will be ignored. - properties: - affinity: - description: If specified, the pod's scheduling constraints - properties: - nodeAffinity: - description: Describes node affinity scheduling rules for the pod. - properties: - preferredDuringSchedulingIgnoredDuringExecution: - description: |- - The scheduler will prefer to schedule pods to nodes that satisfy - the affinity expressions specified by this field, but it may choose - a node that violates one or more of the expressions. The node that is - most preferred is the one with the greatest sum of weights, i.e. - for each node that meets all of the scheduling requirements (resource - request, requiredDuringScheduling affinity expressions, etc.), - compute a sum by iterating through the elements of this field and adding - "weight" to the sum if the node matches the corresponding matchExpressions; the - node(s) with the highest sum are the most preferred. - items: - description: |- - An empty preferred scheduling term matches all objects with implicit weight 0 - (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). - properties: - preference: - description: A node selector term, associated with the corresponding weight. - properties: - matchExpressions: - description: A list of node selector requirements by node's labels. - items: - description: |- - A node selector requirement is a selector that contains values, a key, and an operator - that relates the key and values. - properties: - key: - description: The label key that the selector applies to. - type: string - operator: - description: |- - Represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. - type: string - values: - description: |- - An array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. If the operator is Gt or Lt, the values - array must have a single element, which will be interpreted as an integer. - This array is replaced during a strategic merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchFields: - description: A list of node selector requirements by node's fields. - items: - description: |- - A node selector requirement is a selector that contains values, a key, and an operator - that relates the key and values. - properties: - key: - description: The label key that the selector applies to. - type: string - operator: - description: |- - Represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. - type: string - values: - description: |- - An array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. If the operator is Gt or Lt, the values - array must have a single element, which will be interpreted as an integer. - This array is replaced during a strategic merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - type: object - x-kubernetes-map-type: atomic - weight: - description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100. - format: int32 - type: integer - required: - - preference - - weight - type: object - type: array - x-kubernetes-list-type: atomic - requiredDuringSchedulingIgnoredDuringExecution: - description: |- - If the affinity requirements specified by this field are not met at - scheduling time, the pod will not be scheduled onto the node. - If the affinity requirements specified by this field cease to be met - at some point during pod execution (e.g. due to an update), the system - may or may not try to eventually evict the pod from its node. - properties: - nodeSelectorTerms: - description: Required. A list of node selector terms. The terms are ORed. - items: - description: |- - A null or empty node selector term matches no objects. The requirements of - them are ANDed. - The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. - properties: - matchExpressions: - description: A list of node selector requirements by node's labels. - items: - description: |- - A node selector requirement is a selector that contains values, a key, and an operator - that relates the key and values. - properties: - key: - description: The label key that the selector applies to. - type: string - operator: - description: |- - Represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. - type: string - values: - description: |- - An array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. If the operator is Gt or Lt, the values - array must have a single element, which will be interpreted as an integer. - This array is replaced during a strategic merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchFields: - description: A list of node selector requirements by node's fields. - items: - description: |- - A node selector requirement is a selector that contains values, a key, and an operator - that relates the key and values. - properties: - key: - description: The label key that the selector applies to. - type: string - operator: - description: |- - Represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. - type: string - values: - description: |- - An array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. If the operator is Gt or Lt, the values - array must have a single element, which will be interpreted as an integer. - This array is replaced during a strategic merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - type: object - x-kubernetes-map-type: atomic - type: array - x-kubernetes-list-type: atomic - required: - - nodeSelectorTerms - type: object - x-kubernetes-map-type: atomic - type: object - podAffinity: - description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)). - properties: - preferredDuringSchedulingIgnoredDuringExecution: - description: |- - The scheduler will prefer to schedule pods to nodes that satisfy - the affinity expressions specified by this field, but it may choose - a node that violates one or more of the expressions. The node that is - most preferred is the one with the greatest sum of weights, i.e. - for each node that meets all of the scheduling requirements (resource - request, requiredDuringScheduling affinity expressions, etc.), - compute a sum by iterating through the elements of this field and adding - "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the - node(s) with the highest sum are the most preferred. - items: - description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) - properties: - podAffinityTerm: - description: Required. A pod affinity term, associated with the corresponding weight. - properties: - labelSelector: - description: |- - A label query over a set of resources, in this case pods. - If it's null, this PodAffinityTerm matches with no Pods. - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - matchLabelKeys: - description: |- - MatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both matchLabelKeys and labelSelector. - Also, matchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - mismatchLabelKeys: - description: |- - MismatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. - Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - namespaceSelector: - description: |- - A label query over the set of namespaces that the term applies to. - The term is applied to the union of the namespaces selected by this field - and the ones listed in the namespaces field. - null selector and null or empty namespaces list means "this pod's namespace". - An empty selector ({}) matches all namespaces. - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - namespaces: - description: |- - namespaces specifies a static list of namespace names that the term applies to. - The term is applied to the union of the namespaces listed in this field - and the ones selected by namespaceSelector. - null or empty namespaces list and null namespaceSelector means "this pod's namespace". - items: - type: string - type: array - x-kubernetes-list-type: atomic - topologyKey: - description: |- - This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching - the labelSelector in the specified namespaces, where co-located is defined as running on a node - whose value of the label with key topologyKey matches that of any node on which any of the - selected pods is running. - Empty topologyKey is not allowed. - type: string - required: - - topologyKey - type: object - weight: - description: |- - weight associated with matching the corresponding podAffinityTerm, - in the range 1-100. - format: int32 - type: integer - required: - - podAffinityTerm - - weight - type: object - type: array - x-kubernetes-list-type: atomic - requiredDuringSchedulingIgnoredDuringExecution: - description: |- - If the affinity requirements specified by this field are not met at - scheduling time, the pod will not be scheduled onto the node. - If the affinity requirements specified by this field cease to be met - at some point during pod execution (e.g. due to a pod label update), the - system may or may not try to eventually evict the pod from its node. - When there are multiple elements, the lists of nodes corresponding to each - podAffinityTerm are intersected, i.e. all terms must be satisfied. - items: - description: |- - Defines a set of pods (namely those matching the labelSelector - relative to the given namespace(s)) that this pod should be - co-located (affinity) or not co-located (anti-affinity) with, - where co-located is defined as running on a node whose value of - the label with key matches that of any node on which - a pod of the set of pods is running - properties: - labelSelector: - description: |- - A label query over a set of resources, in this case pods. - If it's null, this PodAffinityTerm matches with no Pods. - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - matchLabelKeys: - description: |- - MatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both matchLabelKeys and labelSelector. - Also, matchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - mismatchLabelKeys: - description: |- - MismatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. - Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - namespaceSelector: - description: |- - A label query over the set of namespaces that the term applies to. - The term is applied to the union of the namespaces selected by this field - and the ones listed in the namespaces field. - null selector and null or empty namespaces list means "this pod's namespace". - An empty selector ({}) matches all namespaces. - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - namespaces: - description: |- - namespaces specifies a static list of namespace names that the term applies to. - The term is applied to the union of the namespaces listed in this field - and the ones selected by namespaceSelector. - null or empty namespaces list and null namespaceSelector means "this pod's namespace". - items: - type: string - type: array - x-kubernetes-list-type: atomic - topologyKey: - description: |- - This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching - the labelSelector in the specified namespaces, where co-located is defined as running on a node - whose value of the label with key topologyKey matches that of any node on which any of the - selected pods is running. - Empty topologyKey is not allowed. - type: string - required: - - topologyKey - type: object - type: array - x-kubernetes-list-type: atomic - type: object - podAntiAffinity: - description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)). - properties: - preferredDuringSchedulingIgnoredDuringExecution: - description: |- - The scheduler will prefer to schedule pods to nodes that satisfy - the anti-affinity expressions specified by this field, but it may choose - a node that violates one or more of the expressions. The node that is - most preferred is the one with the greatest sum of weights, i.e. - for each node that meets all of the scheduling requirements (resource - request, requiredDuringScheduling anti-affinity expressions, etc.), - compute a sum by iterating through the elements of this field and subtracting - "weight" from the sum if the node has pods which matches the corresponding podAffinityTerm; the - node(s) with the highest sum are the most preferred. - items: - description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) - properties: - podAffinityTerm: - description: Required. A pod affinity term, associated with the corresponding weight. - properties: - labelSelector: - description: |- - A label query over a set of resources, in this case pods. - If it's null, this PodAffinityTerm matches with no Pods. - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - matchLabelKeys: - description: |- - MatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both matchLabelKeys and labelSelector. - Also, matchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - mismatchLabelKeys: - description: |- - MismatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. - Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - namespaceSelector: - description: |- - A label query over the set of namespaces that the term applies to. - The term is applied to the union of the namespaces selected by this field - and the ones listed in the namespaces field. - null selector and null or empty namespaces list means "this pod's namespace". - An empty selector ({}) matches all namespaces. - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - namespaces: - description: |- - namespaces specifies a static list of namespace names that the term applies to. - The term is applied to the union of the namespaces listed in this field - and the ones selected by namespaceSelector. - null or empty namespaces list and null namespaceSelector means "this pod's namespace". - items: - type: string - type: array - x-kubernetes-list-type: atomic - topologyKey: - description: |- - This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching - the labelSelector in the specified namespaces, where co-located is defined as running on a node - whose value of the label with key topologyKey matches that of any node on which any of the - selected pods is running. - Empty topologyKey is not allowed. - type: string - required: - - topologyKey - type: object - weight: - description: |- - weight associated with matching the corresponding podAffinityTerm, - in the range 1-100. - format: int32 - type: integer - required: - - podAffinityTerm - - weight - type: object - type: array - x-kubernetes-list-type: atomic - requiredDuringSchedulingIgnoredDuringExecution: - description: |- - If the anti-affinity requirements specified by this field are not met at - scheduling time, the pod will not be scheduled onto the node. - If the anti-affinity requirements specified by this field cease to be met - at some point during pod execution (e.g. due to a pod label update), the - system may or may not try to eventually evict the pod from its node. - When there are multiple elements, the lists of nodes corresponding to each - podAffinityTerm are intersected, i.e. all terms must be satisfied. - items: - description: |- - Defines a set of pods (namely those matching the labelSelector - relative to the given namespace(s)) that this pod should be - co-located (affinity) or not co-located (anti-affinity) with, - where co-located is defined as running on a node whose value of - the label with key matches that of any node on which - a pod of the set of pods is running - properties: - labelSelector: - description: |- - A label query over a set of resources, in this case pods. - If it's null, this PodAffinityTerm matches with no Pods. - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - matchLabelKeys: - description: |- - MatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both matchLabelKeys and labelSelector. - Also, matchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - mismatchLabelKeys: - description: |- - MismatchLabelKeys is a set of pod label keys to select which pods will - be taken into consideration. The keys are used to lookup values from the - incoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)` - to select the group of existing pods which pods will be taken into consideration - for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming - pod labels will be ignored. The default value is empty. - The same key is forbidden to exist in both mismatchLabelKeys and labelSelector. - Also, mismatchLabelKeys cannot be set when labelSelector isn't set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - namespaceSelector: - description: |- - A label query over the set of namespaces that the term applies to. - The term is applied to the union of the namespaces selected by this field - and the ones listed in the namespaces field. - null selector and null or empty namespaces list means "this pod's namespace". - An empty selector ({}) matches all namespaces. - properties: - matchExpressions: - description: matchExpressions is a list of label selector requirements. The requirements are ANDed. - items: - description: |- - A label selector requirement is a selector that contains values, a key, and an operator that - relates the key and values. - properties: - key: - description: key is the label key that the selector applies to. - type: string - operator: - description: |- - operator represents a key's relationship to a set of values. - Valid operators are In, NotIn, Exists and DoesNotExist. - type: string - values: - description: |- - values is an array of string values. If the operator is In or NotIn, - the values array must be non-empty. If the operator is Exists or DoesNotExist, - the values array must be empty. This array is replaced during a strategic - merge patch. - items: - type: string - type: array - x-kubernetes-list-type: atomic - required: - - key - - operator - type: object - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels - map is equivalent to an element of matchExpressions, whose key field is "key", the - operator is "In", and the values array contains only "value". The requirements are ANDed. - type: object - type: object - x-kubernetes-map-type: atomic - namespaces: - description: |- - namespaces specifies a static list of namespace names that the term applies to. - The term is applied to the union of the namespaces listed in this field - and the ones selected by namespaceSelector. - null or empty namespaces list and null namespaceSelector means "this pod's namespace". - items: - type: string - type: array - x-kubernetes-list-type: atomic - topologyKey: - description: |- - This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching - the labelSelector in the specified namespaces, where co-located is defined as running on a node - whose value of the label with key topologyKey matches that of any node on which any of the - selected pods is running. - Empty topologyKey is not allowed. - type: string - required: - - topologyKey - type: object - type: array - x-kubernetes-list-type: atomic - type: object - type: object - imagePullSecrets: - description: If specified, the pod's imagePullSecrets - items: - description: |- - LocalObjectReference contains enough information to let you locate the - referenced object inside the same namespace. - properties: - name: - default: "" - description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - type: object - x-kubernetes-map-type: atomic - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - nodeSelector: - additionalProperties: - type: string - description: |- - NodeSelector is a selector which must be true for the pod to fit on a node. - Selector which must match a node's labels for the pod to be scheduled on that node. - More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ - type: object - priorityClassName: - description: If specified, the pod's priorityClassName. - type: string - resources: - description: |- - If specified, the pod's resource requirements. - These values override the global resource configuration flags. - Note that when only specifying resource limits, ensure they are greater than or equal - to the corresponding global resource requests configured via controller flags - (--acme-http01-solver-resource-request-cpu, --acme-http01-solver-resource-request-memory). - Kubernetes will reject pod creation if limits are lower than requests, causing challenge failures. - properties: - limits: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: |- - Limits describes the maximum amount of compute resources allowed. - More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ - type: object - requests: - additionalProperties: - anyOf: - - type: integer - - type: string - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - x-kubernetes-int-or-string: true - description: |- - Requests describes the minimum amount of compute resources required. - If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, - otherwise to the global values configured via controller flags. Requests cannot exceed Limits. - More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ - type: object - type: object - securityContext: - description: If specified, the pod's security context - properties: - fsGroup: - description: |- - A special supplemental group that applies to all containers in a pod. - Some volume types allow the Kubelet to change the ownership of that volume - to be owned by the pod: - - 1. The owning GID will be the FSGroup - 2. The setgid bit is set (new files created in the volume will be owned by FSGroup) - 3. The permission bits are OR'd with rw-rw---- - - If unset, the Kubelet will not modify the ownership and permissions of any volume. - Note that this field cannot be set when spec.os.name is windows. - format: int64 - type: integer - fsGroupChangePolicy: - description: |- - fsGroupChangePolicy defines behavior of changing ownership and permission of the volume - before being exposed inside Pod. This field will only apply to - volume types which support fsGroup based ownership(and permissions). - It will have no effect on ephemeral volume types such as: secret, configmaps - and emptydir. - Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used. - Note that this field cannot be set when spec.os.name is windows. - type: string - runAsGroup: - description: |- - The GID to run the entrypoint of the container process. - Uses runtime default if unset. - May also be set in SecurityContext. If set in both SecurityContext and - PodSecurityContext, the value specified in SecurityContext takes precedence - for that container. - Note that this field cannot be set when spec.os.name is windows. - format: int64 - type: integer - runAsNonRoot: - description: |- - Indicates that the container must run as a non-root user. - If true, the Kubelet will validate the image at runtime to ensure that it - does not run as UID 0 (root) and fail to start the container if it does. - If unset or false, no such validation will be performed. - May also be set in SecurityContext. If set in both SecurityContext and - PodSecurityContext, the value specified in SecurityContext takes precedence. - type: boolean - runAsUser: - description: |- - The UID to run the entrypoint of the container process. - Defaults to user specified in image metadata if unspecified. - May also be set in SecurityContext. If set in both SecurityContext and - PodSecurityContext, the value specified in SecurityContext takes precedence - for that container. - Note that this field cannot be set when spec.os.name is windows. - format: int64 - type: integer - seLinuxOptions: - description: |- - The SELinux context to be applied to all containers. - If unspecified, the container runtime will allocate a random SELinux context for each - container. May also be set in SecurityContext. If set in - both SecurityContext and PodSecurityContext, the value specified in SecurityContext - takes precedence for that container. - Note that this field cannot be set when spec.os.name is windows. - properties: - level: - description: Level is SELinux level label that applies to the container. - type: string - role: - description: Role is a SELinux role label that applies to the container. - type: string - type: - description: Type is a SELinux type label that applies to the container. - type: string - user: - description: User is a SELinux user label that applies to the container. - type: string - type: object - seccompProfile: - description: |- - The seccomp options to use by the containers in this pod. - Note that this field cannot be set when spec.os.name is windows. - properties: - localhostProfile: - description: |- - localhostProfile indicates a profile defined in a file on the node should be used. - The profile must be preconfigured on the node to work. - Must be a descending path, relative to the kubelet's configured seccomp profile location. - Must be set if type is "Localhost". Must NOT be set for any other type. - type: string - type: - description: |- - type indicates which kind of seccomp profile will be applied. - Valid options are: - - Localhost - a profile defined in a file on the node should be used. - RuntimeDefault - the container runtime default profile should be used. - Unconfined - no profile should be applied. - type: string - required: - - type - type: object - supplementalGroups: - description: |- - A list of groups applied to the first process run in each container, in addition - to the container's primary GID, the fsGroup (if specified), and group memberships - defined in the container image for the uid of the container process. If unspecified, - no additional groups are added to any container. Note that group memberships - defined in the container image for the uid of the container process are still effective, - even if they are not included in this list. - Note that this field cannot be set when spec.os.name is windows. - items: - format: int64 - type: integer - type: array - x-kubernetes-list-type: atomic - sysctls: - description: |- - Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported - sysctls (by the container runtime) might fail to launch. - Note that this field cannot be set when spec.os.name is windows. - items: - description: Sysctl defines a kernel parameter to be set - properties: - name: - description: Name of a property to set - type: string - value: - description: Value of a property to set - type: string - required: - - name - - value - type: object - type: array - x-kubernetes-list-type: atomic - type: object - serviceAccountName: - description: If specified, the pod's service account - type: string - tolerations: - description: If specified, the pod's tolerations. - items: - description: |- - The pod this Toleration is attached to tolerates any taint that matches - the triple using the matching operator . - properties: - effect: - description: |- - Effect indicates the taint effect to match. Empty means match all taint effects. - When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. - type: string - key: - description: |- - Key is the taint key that the toleration applies to. Empty means match all taint keys. - If the key is empty, operator must be Exists; this combination means to match all values and all keys. - type: string - operator: - description: |- - Operator represents a key's relationship to the value. - Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. - Exists is equivalent to wildcard for value, so that a pod can - tolerate all taints of a particular category. - Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). - type: string - tolerationSeconds: - description: |- - TolerationSeconds represents the period of time the toleration (which must be - of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, - it is not set, which means tolerate the taint forever (do not evict). Zero and - negative values will be treated as 0 (evict immediately) by the system. - format: int64 - type: integer - value: - description: |- - Value is the taint value the toleration matches to. - If the operator is Exists, the value should be empty, otherwise just a regular string. - type: string - type: object - type: array - x-kubernetes-list-type: atomic - type: object - type: object - serviceType: - description: |- - Optional service type for Kubernetes solver service. Supported values - are NodePort or ClusterIP. If unset, defaults to NodePort. - type: string - type: object - type: object - selector: - description: |- - Selector selects a set of DNSNames on the Certificate resource that - should be solved using this challenge solver. - If not specified, the solver will be treated as the 'default' solver - with the lowest priority, i.e. if any other solver has a more specific - match, it will be used instead. - properties: - dnsNames: - description: |- - List of DNSNames that this solver will be used to solve. - If specified and a match is found, a dnsNames selector will take - precedence over a dnsZones selector. - If multiple solvers match with the same dnsNames value, the solver - with the most matching labels in matchLabels will be selected. - If neither has more matches, the solver defined earlier in the list - will be selected. - items: - type: string - type: array - x-kubernetes-list-type: atomic - dnsZones: - description: |- - List of DNSZones that this solver will be used to solve. - The most specific DNS zone match specified here will take precedence - over other DNS zone matches, so a solver specifying sys.example.com - will be selected over one specifying example.com for the domain - www.sys.example.com. - If multiple solvers match with the same dnsZones value, the solver - with the most matching labels in matchLabels will be selected. - If neither has more matches, the solver defined earlier in the list - will be selected. - items: - type: string - type: array - x-kubernetes-list-type: atomic - matchLabels: - additionalProperties: - type: string - description: |- - A label selector that is used to refine the set of certificate's that - this challenge solver will apply to. - type: object - type: object - waitInsteadOfSelfCheck: - description: |- - WaitInsteadOfSelfCheck, if set, skips cert-manager's self-check and - instead waits this long after presentation before asking the ACME server - to validate the challenge. - - This is an advanced escape hatch for environments where cert-manager's - self-check cannot succeed from its own network or DNS viewpoint even - though the ACME server can still validate successfully, for example due - to split-horizon DNS or NAT hairpinning. - - A value of 0 skips the self-check and asks the ACME server to validate - immediately after presentation, relying on the ACME server's own - validation retries (RFC 8555 section 8.2) to succeed once the challenge - has propagated. A negative duration is rejected. - Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration, - for example `30s` or `2m`. - type: string - type: object - type: array - x-kubernetes-list-type: atomic - required: - - privateKeySecretRef - - server - type: object - ca: - description: |- - CA configures this issuer to sign certificates using a signing CA keypair - stored in a Secret resource. - This is used to build internal PKIs that are managed by cert-manager. - properties: - crlDistributionPoints: - description: |- - The CRL distribution points is an X.509 v3 certificate extension which identifies - the location of the CRL from which the revocation of this certificate can be checked. - If not set, certificates will be issued without distribution points set. - items: - type: string - type: array - x-kubernetes-list-type: atomic - issuingCertificateURLs: - description: |- - IssuingCertificateURLs is a list of URLs which this issuer should embed into certificates - it creates. See https://www.rfc-editor.org/rfc/rfc5280#section-4.2.2.1 for more details. - As an example, such a URL might be "http://ca.domain.com/ca.crt". - items: - type: string - type: array - x-kubernetes-list-type: atomic - ocspServers: - description: |- - The OCSP server list is an X.509 v3 extension that defines a list of - URLs of OCSP responders. The OCSP responders can be queried for the - revocation status of an issued certificate. If not set, the - certificate will be issued with no OCSP servers set. For example, an - OCSP server URL could be "http://ocsp.int-x3.letsencrypt.org". - items: - type: string - type: array - x-kubernetes-list-type: atomic - secretName: - description: |- - SecretName is the name of the secret used to sign Certificates issued - by this Issuer. - type: string - required: - - secretName - type: object - selfSigned: - description: |- - SelfSigned configures this issuer to 'self sign' certificates using the - private key used to create the CertificateRequest object. - properties: - crlDistributionPoints: - description: |- - The CRL distribution points is an X.509 v3 certificate extension which identifies - the location of the CRL from which the revocation of this certificate can be checked. - If not set certificate will be issued without CDP. Values are strings. - items: - type: string - type: array - x-kubernetes-list-type: atomic - type: object - vault: - description: |- - Vault configures this issuer to sign certificates using a HashiCorp Vault - PKI backend. - properties: - auth: - description: Auth configures how cert-manager authenticates with the Vault server. - properties: - appRole: - description: |- - AppRole authenticates with Vault using the App Role auth mechanism, - with the role and secret stored in a Kubernetes Secret resource. - properties: - path: - description: |- - Path where the App Role authentication backend is mounted in Vault, e.g: - "approle" - type: string - roleId: - description: |- - RoleID configured in the App Role authentication backend when setting - up the authentication backend in Vault. - type: string - secretRef: - description: |- - Reference to a key in a Secret that contains the App Role secret used - to authenticate with Vault. - The `key` field must be specified and denotes which entry within the Secret - resource is used as the app role secret. - properties: - key: - description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. - type: string - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - required: - - name - type: object - required: - - path - - roleId - - secretRef - type: object - aws: - description: |- - AWS authenticates with Vault using AWS IAM authentication. - This allows authentication using IAM roles for service accounts (IRSA), - EKS Pod Identity (PIA), or ambient credentials (EC2 instance profiles, ECS task role). - properties: - iamRoleArn: - description: |- - The ARN of the AWS IAM role to assume using the Kubernetes service account - token. Required when using IRSA (serviceAccountRef is set). - This role must have a trust policy that allows the OIDC provider to assume it. - type: string - mountPath: - description: |- - The Vault mountPath here is the mount path to use when authenticating with - Vault. For example, setting a value to `/v1/auth/foo`, will use the path - `/v1/auth/foo/login` to authenticate with Vault. If unspecified, the - default value "/v1/auth/aws" will be used. - type: string - region: - description: |- - The AWS region to use for authentication. If not specified, the region - will be determined from AWS_REGION or AWS_DEFAULT_REGION environment - variables, falling back to "us-east-1" if not set. - type: string - role: - description: A required field containing the Vault Role to assume when authenticating. - minLength: 1 - type: string - serviceAccountRef: - description: |- - A reference to a service account that will be used to request a web identity - token for IRSA (IAM Roles for Service Accounts) authentication. - properties: - audiences: - description: |- - TokenAudiences is an optional list of extra audiences to include in the token passed to Vault. - The default audiences are always included in the token. - items: - type: string - type: array - x-kubernetes-list-type: atomic - name: - description: Name of the ServiceAccount used to request a token. - type: string - required: - - name - type: object - vaultHeaderValue: - description: |- - The Vault header value to include in the STS signing request. - This is used to prevent replay attacks. - type: string - required: - - role - type: object - clientCertificate: - description: |- - ClientCertificate authenticates with Vault by presenting a client - certificate during the request's TLS handshake. - Works only when using HTTPS protocol. - properties: - mountPath: - description: |- - The Vault mountPath here is the mount path to use when authenticating with - Vault. For example, setting a value to `/v1/auth/foo`, will use the path - `/v1/auth/foo/login` to authenticate with Vault. If unspecified, the - default value "/v1/auth/cert" will be used. - type: string - name: - description: |- - Name of the certificate role to authenticate against. - If not set, matching any certificate role, if available. - type: string - secretName: - description: |- - Reference to Kubernetes Secret of type "kubernetes.io/tls" (hence containing - tls.crt and tls.key) used to authenticate to Vault using TLS client - authentication. - type: string - type: object - kubernetes: - description: |- - Kubernetes authenticates with Vault by passing the ServiceAccount - token stored in the named Secret resource to the Vault server. - properties: - mountPath: - description: |- - The Vault mountPath here is the mount path to use when authenticating with - Vault. For example, setting a value to `/v1/auth/foo`, will use the path - `/v1/auth/foo/login` to authenticate with Vault. If unspecified, the - default value "/v1/auth/kubernetes" will be used. - type: string - role: - description: |- - A required field containing the Vault Role to assume. A Role binds a - Kubernetes ServiceAccount with a set of Vault policies. - type: string - secretRef: - description: |- - The required Secret field containing a Kubernetes ServiceAccount JWT used - for authenticating with Vault. Use of 'ambient credentials' is not - supported. - properties: - key: - description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. - type: string - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - required: - - name - type: object - serviceAccountRef: - description: |- - A reference to a service account that will be used to request a bound - token (also known as "projected token"). Compared to using "secretRef", - using this field means that you don't rely on statically bound tokens. To - use this field, you must configure an RBAC rule to let cert-manager - request a token. - properties: - audiences: - description: |- - TokenAudiences is an optional list of extra audiences to include in the token passed to Vault. - The default audiences are always included in the token. - items: - type: string - type: array - x-kubernetes-list-type: atomic - name: - description: Name of the ServiceAccount used to request a token. - type: string - required: - - name - type: object - required: - - role - type: object - tokenSecretRef: - description: TokenSecretRef authenticates with Vault by presenting a token. - properties: - key: - description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. - type: string - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - required: - - name - type: object - type: object - caBundle: - description: |- - Base64-encoded bundle of PEM CAs which will be used to validate the certificate - chain presented by Vault. Only used if using HTTPS to connect to Vault and - ignored for HTTP connections. - Mutually exclusive with CABundleSecretRef. - If neither CABundle nor CABundleSecretRef are defined, the certificate bundle in - the cert-manager controller container is used to validate the TLS connection. - format: byte - type: string - caBundleSecretRef: - description: |- - Reference to a Secret containing a bundle of PEM-encoded CAs to use when - verifying the certificate chain presented by Vault when using HTTPS. - Mutually exclusive with CABundle. - If neither CABundle nor CABundleSecretRef are defined, the certificate bundle in - the cert-manager controller container is used to validate the TLS connection. - If no key for the Secret is specified, cert-manager will default to 'ca.crt'. - properties: - key: - description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. - type: string - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - required: - - name - type: object - clientCertSecretRef: - description: |- - Reference to a Secret containing a PEM-encoded Client Certificate to use when the - Vault server requires mTLS. - properties: - key: - description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. - type: string - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - required: - - name - type: object - clientKeySecretRef: - description: |- - Reference to a Secret containing a PEM-encoded Client Private Key to use when the - Vault server requires mTLS. - properties: - key: - description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. - type: string - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - required: - - name - type: object - namespace: - description: |- - Name of the vault namespace. Namespaces is a set of features within Vault Enterprise that allows Vault environments to support Secure Multi-tenancy. e.g: "ns1" - More about namespaces can be found here https://www.vaultproject.io/docs/enterprise/namespaces - type: string - path: - description: |- - Path is the mount path of the Vault PKI backend's `sign` endpoint, e.g: - "my_pki_mount/sign/my-role-name". - type: string - server: - description: 'Server is the connection address for the Vault server, e.g: "https://vault.example.com:8200".' - type: string - serverName: - description: |- - ServerName is used to verify the hostname on the returned certificates - by the Vault server. - type: string - required: - - auth - - path - - server - type: object - venafi: - description: |- - Venafi configures this issuer to sign certificates using a CyberArk Certificate Manager Self-Hosted - or SaaS policy zone. - properties: - cloud: - description: |- - Cloud specifies the CyberArk Certificate Manager SaaS configuration settings. - Only one of CyberArk Certificate Manager may be specified. - properties: - apiTokenSecretRef: - description: APITokenSecretRef is a secret key selector for the CyberArk Certificate Manager SaaS API token. - properties: - key: - description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. - type: string - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - required: - - name - type: object - url: - description: |- - URL is the base URL for CyberArk Certificate Manager SaaS. - Defaults to "https://api.venafi.cloud/". - type: string - required: - - apiTokenSecretRef - type: object - ngts: - description: |- - NGTS specifies Palo Alto Networks Next Generation Trust Services (NGTS) configuration - using OAuth 2.0 Client Credentials. Only one of tpp, cloud, or ngts may be specified. - properties: - credentialsRef: - description: |- - CredentialsRef is a reference to a Kubernetes Secret containing the OAuth 2.0 - Client ID and Client Secret. The secret must contain the keys 'client-id' and - 'client-secret'. - properties: - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - required: - - name - type: object - tokenEndpoint: - description: |- - TokenEndpoint is the OAuth 2.0 token endpoint URL used to obtain access tokens, - for example "https://auth.apps.paloaltonetworks.com/oauth2/access_token". - Defaults to "https://auth.apps.paloaltonetworks.com/oauth2/access_token" if not set. - type: string - tsgID: - description: |- - TSGID is the Tenant Service Group ID used to scope the OAuth 2.0 access token, - for example "1234567890". The tsg_id: prefix is added automatically. - This field is required. - type: string - url: - description: |- - URL is the base URL for the NGTS API endpoint. - Defaults to "https://api.strata.paloaltonetworks.com/ngts" if not set. - type: string - required: - - credentialsRef - - tsgID - type: object - tpp: - description: |- - TPP specifies CyberArk Certificate Manager Self-Hosted configuration settings. - Only one of CyberArk Certificate Manager may be specified. - properties: - caBundle: - description: |- - Base64-encoded bundle of PEM CAs which will be used to validate the certificate - chain presented by the CyberArk Certificate Manager Self-Hosted server. Only used if using HTTPS; ignored for HTTP. - If undefined, the certificate bundle in the cert-manager controller container - is used to validate the chain. - format: byte - type: string - caBundleSecretRef: - description: |- - Reference to a Secret containing a base64-encoded bundle of PEM CAs - which will be used to validate the certificate chain presented by the CyberArk Certificate Manager Self-Hosted server. - Only used if using HTTPS; ignored for HTTP. Mutually exclusive with CABundle. - If neither CABundle nor CABundleSecretRef is defined, the certificate bundle in - the cert-manager controller container is used to validate the TLS connection. - properties: - key: - description: |- - The key of the entry in the Secret resource's `data` field to be used. - Some instances of this field may be defaulted, in others it may be - required. - type: string - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - required: - - name - type: object - credentialsRef: - description: |- - CredentialsRef is a reference to a Secret containing the CyberArk Certificate Manager Self-Hosted API credentials. - The secret must contain the key 'access-token' for the Access Token Authentication, - or two keys, 'username' and 'password' for the API Keys Authentication. - properties: - name: - description: |- - Name of the resource being referred to. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - required: - - name - type: object - url: - description: |- - URL is the base URL for the vedsdk endpoint of the CyberArk Certificate Manager Self-Hosted instance, - for example: "https://tpp.example.com/vedsdk". - type: string - required: - - credentialsRef - - url - type: object - zone: - description: |- - Zone is the Certificate Manager Policy Zone to use for this issuer. - All requests made to the Certificate Manager platform will be restricted by the named - zone policy. - This field is required. - type: string - required: - - zone - type: object - x-kubernetes-validations: - - message: exactly one of tpp, cloud, or ngts must be configured - rule: '(has(self.tpp) ? 1 : 0) + (has(self.cloud) ? 1 : 0) + (has(self.ngts) ? 1 : 0) == 1' - type: object - status: - description: Status of the Issuer. This is set and managed automatically. - properties: - acme: - description: |- - ACME specific status options. - This field should only be set if the Issuer is configured to use an ACME - server to issue certificates. - properties: - lastPrivateKeyHash: - description: |- - LastPrivateKeyHash is a hash of the private key associated with the latest - registered ACME account, in order to track changes made to registered account - associated with the Issuer - type: string - lastRegisteredEmail: - description: |- - LastRegisteredEmail is the email associated with the latest registered - ACME account, in order to track changes made to registered account - associated with the Issuer - type: string - uri: - description: |- - URI is the unique account identifier, which can also be used to retrieve - account details from the CA - type: string - type: object - conditions: - description: |- - List of status conditions to indicate the status of a CertificateRequest. - Known condition types are `Ready`. - items: - description: IssuerCondition contains condition information for an Issuer. - properties: - lastTransitionTime: - description: |- - LastTransitionTime is the timestamp corresponding to the last status - change of this condition. - format: date-time - type: string - message: - description: |- - Message is a human readable description of the details of the last - transition, complementing reason. - type: string - observedGeneration: - description: |- - If set, this represents the .metadata.generation that the condition was - set based upon. - For instance, if .metadata.generation is currently 12, but the - .status.condition[x].observedGeneration is 9, the condition is out of date - with respect to the current state of the Issuer. - format: int64 - type: integer - reason: - description: |- - Reason is a brief machine readable explanation for the condition's last - transition. - type: string - status: - description: Status of the condition, one of (`True`, `False`, `Unknown`). - enum: - - "True" - - "False" - - Unknown - type: string - type: - description: Type of the condition, known values are (`Ready`). - type: string - required: - - status - - type - type: object - type: array - x-kubernetes-list-map-keys: - - type - x-kubernetes-list-type: map - type: object - required: - - spec - type: object - served: true - storage: true - subresources: - status: {} - ---- -# Source: cert-manager/templates/cainjector-rbac.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: cert-manager-cainjector - labels: - app: cainjector - app.kubernetes.io/name: cainjector - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/component: "cainjector" - app.kubernetes.io/version: "v1.21.1" - app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 -rules: - - apiGroups: ["cert-manager.io"] - resources: ["certificates"] - verbs: ["get", "list", "watch"] - - apiGroups: [""] - resources: ["secrets"] - verbs: ["get", "list", "watch"] - - apiGroups: [""] - resources: ["events"] - verbs: ["get", "create", "update", "patch"] - - apiGroups: ["admissionregistration.k8s.io"] - resources: ["validatingwebhookconfigurations", "mutatingwebhookconfigurations"] - verbs: ["get", "list", "watch", "update", "patch"] - - apiGroups: ["apiregistration.k8s.io"] - resources: ["apiservices"] - verbs: ["get", "list", "watch", "update", "patch"] - - apiGroups: ["apiextensions.k8s.io"] - resources: ["customresourcedefinitions"] - verbs: ["get", "list", "watch", "update", "patch"] ---- -# Source: cert-manager/templates/rbac.yaml -# Issuer controller role -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: cert-manager-controller-issuers - labels: - app: cert-manager - app.kubernetes.io/name: cert-manager - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/component: "controller" - app.kubernetes.io/version: "v1.21.1" - app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 -rules: - - apiGroups: ["cert-manager.io"] - resources: ["issuers", "issuers/status"] - verbs: ["update", "patch"] - - apiGroups: ["cert-manager.io"] - resources: ["issuers"] - verbs: ["get", "list", "watch"] - - apiGroups: [""] - resources: ["secrets"] - verbs: ["get", "list", "watch", "create", "update", "delete"] - - apiGroups: [""] - resources: ["events"] - verbs: ["create", "patch"] ---- -# Source: cert-manager/templates/rbac.yaml -# ClusterIssuer controller role -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: cert-manager-controller-clusterissuers - labels: - app: cert-manager - app.kubernetes.io/name: cert-manager - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/component: "controller" - app.kubernetes.io/version: "v1.21.1" - app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 -rules: - - apiGroups: ["cert-manager.io"] - resources: ["clusterissuers", "clusterissuers/status"] - verbs: ["update", "patch"] - - apiGroups: ["cert-manager.io"] - resources: ["clusterissuers"] - verbs: ["get", "list", "watch"] - - apiGroups: [""] - resources: ["secrets"] - verbs: ["get", "list", "watch", "create", "update", "delete"] - - apiGroups: [""] - resources: ["events"] - verbs: ["create", "patch"] ---- -# Source: cert-manager/templates/rbac.yaml -# Certificates controller role -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: cert-manager-controller-certificates - labels: - app: cert-manager - app.kubernetes.io/name: cert-manager - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/component: "controller" - app.kubernetes.io/version: "v1.21.1" - app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 -rules: - - apiGroups: ["cert-manager.io"] - resources: ["certificates", "certificates/status", "certificaterequests", "certificaterequests/status"] - verbs: ["update", "patch"] - - apiGroups: ["cert-manager.io"] - resources: ["certificates", "certificaterequests", "clusterissuers", "issuers"] - verbs: ["get", "list", "watch"] - # We require these rules to support users with the OwnerReferencesPermissionEnforcement - # admission controller enabled: - # https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#ownerreferencespermissionenforcement - - apiGroups: ["cert-manager.io"] - resources: ["certificates/finalizers", "certificaterequests/finalizers"] - verbs: ["update"] - - apiGroups: ["acme.cert-manager.io"] - resources: ["orders"] - verbs: ["create", "delete", "get", "list", "watch"] - - apiGroups: [""] - resources: ["secrets"] - verbs: ["get", "list", "watch", "create", "update", "delete", "patch"] - - apiGroups: [""] - resources: ["events"] - verbs: ["create", "patch"] ---- -# Source: cert-manager/templates/rbac.yaml -# Orders controller role -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: cert-manager-controller-orders - labels: - app: cert-manager - app.kubernetes.io/name: cert-manager - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/component: "controller" - app.kubernetes.io/version: "v1.21.1" - app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 -rules: - - apiGroups: ["acme.cert-manager.io"] - resources: ["orders", "orders/status"] - verbs: ["update", "patch"] - - apiGroups: ["acme.cert-manager.io"] - resources: ["orders", "challenges"] - verbs: ["get", "list", "watch"] - - apiGroups: ["cert-manager.io"] - resources: ["clusterissuers", "issuers"] - verbs: ["get", "list", "watch"] - - apiGroups: ["acme.cert-manager.io"] - resources: ["challenges"] - verbs: ["create", "delete"] - # We require these rules to support users with the OwnerReferencesPermissionEnforcement - # admission controller enabled: - # https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#ownerreferencespermissionenforcement - - apiGroups: ["acme.cert-manager.io"] - resources: ["orders/finalizers"] - verbs: ["update"] - - apiGroups: ["cert-manager.io"] - resources: ["clusterissuers/finalizers", "issuers/finalizers"] - verbs: ["update"] - - apiGroups: [""] - resources: ["secrets"] - verbs: ["get", "list", "watch"] - - apiGroups: [""] - resources: ["events"] - verbs: ["create", "patch"] ---- -# Source: cert-manager/templates/rbac.yaml -# Challenges controller role -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: cert-manager-controller-challenges - labels: - app: cert-manager - app.kubernetes.io/name: cert-manager - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/component: "controller" - app.kubernetes.io/version: "v1.21.1" - app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 -rules: - # Use to update challenge resource status - - apiGroups: ["acme.cert-manager.io"] - resources: ["challenges", "challenges/status"] - verbs: ["update", "patch"] - # Used to watch challenge resources - - apiGroups: ["acme.cert-manager.io"] - resources: ["challenges"] - verbs: ["get", "list", "watch"] - # Used to watch challenges, issuer and clusterissuer resources - - apiGroups: ["cert-manager.io"] - resources: ["issuers", "clusterissuers"] - verbs: ["get", "list", "watch"] - # Need to be able to retrieve ACME account private key to complete challenges - - apiGroups: [""] - resources: ["secrets"] - verbs: ["get", "list", "watch"] - # Used to create events - - apiGroups: [""] - resources: ["events"] - verbs: ["create", "patch"] - # HTTP01 rules - - apiGroups: [""] - resources: ["pods", "services"] - verbs: ["get", "list", "watch", "create", "delete"] - - apiGroups: ["networking.k8s.io"] - resources: ["ingresses"] - verbs: ["get", "list", "watch", "create", "delete", "update"] - - apiGroups: ["gateway.networking.k8s.io"] - resources: ["httproutes"] - verbs: ["get", "list", "watch", "create", "delete", "update"] - # We require the ability to specify a custom hostname when we are creating - # new ingress resources. - # See: https://github.com/openshift/origin/blob/21f191775636f9acadb44fa42beeb4f75b255532/pkg/route/apiserver/admission/ingress_admission.go#L84-L148 - - apiGroups: ["route.openshift.io"] - resources: ["routes/custom-host"] - verbs: ["create"] - # We require these rules to support users with the OwnerReferencesPermissionEnforcement - # admission controller enabled: - # https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#ownerreferencespermissionenforcement - - apiGroups: ["acme.cert-manager.io"] - resources: ["challenges/finalizers"] - verbs: ["update"] - # DNS01 rules (duplicated above) - - apiGroups: [""] - resources: ["secrets"] - verbs: ["get", "list", "watch"] ---- -# Source: cert-manager/templates/rbac.yaml -# ingress-shim controller role -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: cert-manager-controller-ingress-shim - labels: - app: cert-manager - app.kubernetes.io/name: cert-manager - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/component: "controller" - app.kubernetes.io/version: "v1.21.1" - app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 -rules: - - apiGroups: ["cert-manager.io"] - resources: ["certificates", "certificaterequests"] - verbs: ["create", "update", "delete"] - - apiGroups: ["cert-manager.io"] - resources: ["certificates", "certificaterequests", "issuers", "clusterissuers"] - verbs: ["get", "list", "watch"] - - apiGroups: ["networking.k8s.io"] - resources: ["ingresses"] - verbs: ["get", "list", "watch"] - # We require these rules to support users with the OwnerReferencesPermissionEnforcement - # admission controller enabled: - # https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#ownerreferencespermissionenforcement - - apiGroups: ["networking.k8s.io"] - resources: ["ingresses/finalizers"] - verbs: ["update"] - - apiGroups: ["gateway.networking.k8s.io"] - resources: ["gateways", "httproutes", "listenersets"] - verbs: ["get", "list", "watch"] - - apiGroups: ["gateway.networking.k8s.io"] - resources: ["gateways/finalizers", "httproutes/finalizers", "listenersets/finalizers"] - verbs: ["update"] - - apiGroups: [""] - resources: ["events"] - verbs: ["create", "patch"] ---- -# Source: cert-manager/templates/rbac.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: cert-manager-cluster-view - labels: - app: cert-manager - app.kubernetes.io/name: cert-manager - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/component: "controller" - app.kubernetes.io/version: "v1.21.1" - app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 - rbac.authorization.k8s.io/aggregate-to-cluster-reader: "true" -rules: - - apiGroups: ["cert-manager.io"] - resources: ["clusterissuers"] - verbs: ["get", "list", "watch"] ---- -# Source: cert-manager/templates/rbac.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: cert-manager-view - labels: - app: cert-manager - app.kubernetes.io/name: cert-manager - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/component: "controller" - app.kubernetes.io/version: "v1.21.1" - app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 - rbac.authorization.k8s.io/aggregate-to-view: "true" - rbac.authorization.k8s.io/aggregate-to-edit: "true" - rbac.authorization.k8s.io/aggregate-to-admin: "true" - rbac.authorization.k8s.io/aggregate-to-cluster-reader: "true" -rules: - - apiGroups: ["cert-manager.io"] - resources: ["certificates", "certificaterequests", "issuers"] - verbs: ["get", "list", "watch"] - - apiGroups: ["acme.cert-manager.io"] - resources: ["challenges", "orders"] - verbs: ["get", "list", "watch"] ---- -# Source: cert-manager/templates/rbac.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: cert-manager-edit - labels: - app: cert-manager - app.kubernetes.io/name: cert-manager - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/component: "controller" - app.kubernetes.io/version: "v1.21.1" - app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 - rbac.authorization.k8s.io/aggregate-to-edit: "true" - rbac.authorization.k8s.io/aggregate-to-admin: "true" -rules: - - apiGroups: ["cert-manager.io"] - resources: ["certificates", "certificaterequests", "issuers"] - verbs: ["create", "delete", "deletecollection", "patch", "update"] - - apiGroups: ["cert-manager.io"] - resources: ["certificates/status"] - verbs: ["update"] - - apiGroups: ["acme.cert-manager.io"] - resources: ["challenges"] - verbs: ["delete", "deletecollection", "patch", "update"] - - apiGroups: ["acme.cert-manager.io"] - resources: ["orders"] - verbs: ["delete", "deletecollection"] ---- -# Source: cert-manager/templates/rbac.yaml -# Permission to approve CertificateRequests referencing cert-manager.io Issuers and ClusterIssuers -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: cert-manager-controller-approve:cert-manager-io - labels: - app: cert-manager - app.kubernetes.io/name: cert-manager - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/component: "cert-manager" - app.kubernetes.io/version: "v1.21.1" - app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 -rules: - - apiGroups: ["cert-manager.io"] - resources: ["signers"] - verbs: ["approve"] - resourceNames: - - "issuers.cert-manager.io/*" - - "clusterissuers.cert-manager.io/*" ---- -# Source: cert-manager/templates/rbac.yaml -# Permission to: -# - Update and sign CertificateSigningRequests referencing cert-manager.io Issuers and ClusterIssuers -# - Perform SubjectAccessReviews to test whether users are able to reference Namespaced Issuers -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: cert-manager-controller-certificatesigningrequests - labels: - app: cert-manager - app.kubernetes.io/name: cert-manager - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/component: "cert-manager" - app.kubernetes.io/version: "v1.21.1" - app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 -rules: - - apiGroups: ["certificates.k8s.io"] - resources: ["certificatesigningrequests"] - verbs: ["get", "list", "watch", "update"] - - apiGroups: ["certificates.k8s.io"] - resources: ["certificatesigningrequests/status"] - verbs: ["update", "patch"] - - apiGroups: ["certificates.k8s.io"] - resources: ["signers"] - resourceNames: ["issuers.cert-manager.io/*", "clusterissuers.cert-manager.io/*"] - verbs: ["sign"] - - apiGroups: ["authorization.k8s.io"] - resources: ["subjectaccessreviews"] - verbs: ["create"] ---- -# Source: cert-manager/templates/webhook-rbac.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: cert-manager-webhook:subjectaccessreviews - labels: - app: webhook - app.kubernetes.io/name: webhook - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/component: "webhook" - app.kubernetes.io/version: "v1.21.1" - app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 -rules: -- apiGroups: ["authorization.k8s.io"] - resources: ["subjectaccessreviews"] - verbs: ["create"] ---- -# Source: cert-manager/templates/cainjector-rbac.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: cert-manager-cainjector - labels: - app: cainjector - app.kubernetes.io/name: cainjector - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/component: "cainjector" - app.kubernetes.io/version: "v1.21.1" - app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: cert-manager-cainjector -subjects: - - name: cert-manager-cainjector - namespace: cert-manager - kind: ServiceAccount ---- -# Source: cert-manager/templates/rbac.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: cert-manager-controller-issuers - labels: - app: cert-manager - app.kubernetes.io/name: cert-manager - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/component: "controller" - app.kubernetes.io/version: "v1.21.1" - app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: cert-manager-controller-issuers -subjects: - - name: cert-manager - namespace: cert-manager - kind: ServiceAccount ---- -# Source: cert-manager/templates/rbac.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: cert-manager-controller-clusterissuers - labels: - app: cert-manager - app.kubernetes.io/name: cert-manager - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/component: "controller" - app.kubernetes.io/version: "v1.21.1" - app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: cert-manager-controller-clusterissuers -subjects: - - name: cert-manager - namespace: cert-manager - kind: ServiceAccount ---- -# Source: cert-manager/templates/rbac.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: cert-manager-controller-certificates - labels: - app: cert-manager - app.kubernetes.io/name: cert-manager - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/component: "controller" - app.kubernetes.io/version: "v1.21.1" - app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: cert-manager-controller-certificates -subjects: - - name: cert-manager - namespace: cert-manager - kind: ServiceAccount ---- -# Source: cert-manager/templates/rbac.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: cert-manager-controller-orders - labels: - app: cert-manager - app.kubernetes.io/name: cert-manager - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/component: "controller" - app.kubernetes.io/version: "v1.21.1" - app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: cert-manager-controller-orders -subjects: - - name: cert-manager - namespace: cert-manager - kind: ServiceAccount ---- -# Source: cert-manager/templates/rbac.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: cert-manager-controller-challenges - labels: - app: cert-manager - app.kubernetes.io/name: cert-manager - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/component: "controller" - app.kubernetes.io/version: "v1.21.1" - app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: cert-manager-controller-challenges -subjects: - - name: cert-manager - namespace: cert-manager - kind: ServiceAccount ---- -# Source: cert-manager/templates/rbac.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: cert-manager-controller-ingress-shim - labels: - app: cert-manager - app.kubernetes.io/name: cert-manager - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/component: "controller" - app.kubernetes.io/version: "v1.21.1" - app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: cert-manager-controller-ingress-shim -subjects: - - name: cert-manager - namespace: cert-manager - kind: ServiceAccount ---- -# Source: cert-manager/templates/rbac.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: cert-manager-controller-approve:cert-manager-io - labels: - app: cert-manager - app.kubernetes.io/name: cert-manager - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/component: "cert-manager" - app.kubernetes.io/version: "v1.21.1" - app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: cert-manager-controller-approve:cert-manager-io -subjects: - - name: cert-manager - namespace: cert-manager - kind: ServiceAccount ---- -# Source: cert-manager/templates/rbac.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: cert-manager-controller-certificatesigningrequests - labels: - app: cert-manager - app.kubernetes.io/name: cert-manager - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/component: "cert-manager" - app.kubernetes.io/version: "v1.21.1" - app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: cert-manager-controller-certificatesigningrequests -subjects: - - name: cert-manager - namespace: cert-manager - kind: ServiceAccount - ---- -# Source: cert-manager/templates/webhook-rbac.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: cert-manager-webhook:subjectaccessreviews - labels: - app: webhook - app.kubernetes.io/name: webhook - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/component: "webhook" - app.kubernetes.io/version: "v1.21.1" - app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: cert-manager-webhook:subjectaccessreviews -subjects: -- kind: ServiceAccount - name: cert-manager-webhook - namespace: cert-manager - ---- -# Source: cert-manager/templates/cainjector-rbac.yaml -# leader election rules -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: cert-manager-cainjector:leaderelection - namespace: cert-manager - labels: - app: cainjector - app.kubernetes.io/name: cainjector - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/component: "cainjector" - app.kubernetes.io/version: "v1.21.1" - app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 -rules: - # Used for leader election by the controller - # cert-manager-cainjector-leader-election is used by the CertificateBased injector controller - # see cmd/cainjector/start.go#L113 - # cert-manager-cainjector-leader-election-core is used by the SecretBased injector controller - # see cmd/cainjector/start.go#L137 - - apiGroups: ["coordination.k8s.io"] - resources: ["leases"] - resourceNames: ["cert-manager-cainjector-leader-election", "cert-manager-cainjector-leader-election-core"] - verbs: ["get", "update", "patch"] - - apiGroups: ["coordination.k8s.io"] - resources: ["leases"] - verbs: ["create"] ---- -# Source: cert-manager/templates/rbac.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: cert-manager:leaderelection - namespace: cert-manager - labels: - app: cert-manager - app.kubernetes.io/name: cert-manager - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/component: "controller" - app.kubernetes.io/version: "v1.21.1" - app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 -rules: - - apiGroups: ["coordination.k8s.io"] - resources: ["leases"] - resourceNames: ["cert-manager-controller"] - verbs: ["get", "update", "patch"] - - apiGroups: ["coordination.k8s.io"] - resources: ["leases"] - verbs: ["create"] ---- -# Source: cert-manager/templates/webhook-rbac.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: cert-manager-webhook:dynamic-serving - namespace: cert-manager - labels: - app: webhook - app.kubernetes.io/name: webhook - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/component: "webhook" - app.kubernetes.io/version: "v1.21.1" - app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 -rules: -- apiGroups: [""] - resources: ["secrets"] - resourceNames: - - 'cert-manager-webhook-ca' - verbs: ["get", "list", "watch", "update"] -# It's not possible to grant CREATE permission on a single resourceName. -- apiGroups: [""] - resources: ["secrets"] - verbs: ["create"] ---- -# Source: cert-manager/templates/cainjector-rbac.yaml -# grant cert-manager permission to manage the leaderelection configmap in the -# leader election namespace -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: cert-manager-cainjector:leaderelection - namespace: cert-manager - labels: - app: cainjector - app.kubernetes.io/name: cainjector - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/component: "cainjector" - app.kubernetes.io/version: "v1.21.1" - app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: cert-manager-cainjector:leaderelection -subjects: - - kind: ServiceAccount - name: cert-manager-cainjector - namespace: cert-manager - ---- -# Source: cert-manager/templates/rbac.yaml -# grant cert-manager permission to manage the leaderelection configmap in the -# leader election namespace -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: cert-manager:leaderelection - namespace: cert-manager - labels: - app: cert-manager - app.kubernetes.io/name: cert-manager - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/component: "controller" - app.kubernetes.io/version: "v1.21.1" - app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: cert-manager:leaderelection -subjects: - - kind: ServiceAccount - name: cert-manager - namespace: cert-manager ---- -# Source: cert-manager/templates/webhook-rbac.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: cert-manager-webhook:dynamic-serving - namespace: cert-manager - labels: - app: webhook - app.kubernetes.io/name: webhook - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/component: "webhook" - app.kubernetes.io/version: "v1.21.1" - app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: cert-manager-webhook:dynamic-serving -subjects: -- kind: ServiceAccount - name: cert-manager-webhook - namespace: cert-manager ---- -# Source: cert-manager/templates/cainjector-service.yaml -apiVersion: v1 -kind: Service -metadata: - name: cert-manager-cainjector - namespace: cert-manager - labels: - app: cainjector - app.kubernetes.io/name: cainjector - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/component: "cainjector" - app.kubernetes.io/version: "v1.21.1" - app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 -spec: - type: ClusterIP - ports: - - protocol: TCP - port: 9402 - name: http-metrics - selector: - app.kubernetes.io/name: cainjector - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/component: "cainjector" - ---- -# Source: cert-manager/templates/service.yaml -apiVersion: v1 -kind: Service -metadata: - name: cert-manager - namespace: cert-manager - labels: - app: cert-manager - app.kubernetes.io/name: cert-manager - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/component: "controller" - app.kubernetes.io/version: "v1.21.1" - app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 -spec: - type: ClusterIP - ports: - - protocol: TCP - port: 9402 - name: http-metrics - selector: - app.kubernetes.io/name: cert-manager - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/component: "controller" - ---- -# Source: cert-manager/templates/webhook-service.yaml -apiVersion: v1 -kind: Service -metadata: - name: cert-manager-webhook - namespace: cert-manager - labels: - app: webhook - app.kubernetes.io/name: webhook - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/component: "webhook" - app.kubernetes.io/version: "v1.21.1" - app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 -spec: - type: ClusterIP - ports: - - name: https - port: 443 - protocol: TCP - targetPort: "https" - - name: metrics - port: 9402 - protocol: TCP - targetPort: "http-metrics" - selector: - app.kubernetes.io/name: webhook - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/component: "webhook" - ---- -# Source: cert-manager/templates/cainjector-deployment.yaml -apiVersion: apps/v1 -kind: Deployment -metadata: - name: cert-manager-cainjector - namespace: cert-manager - labels: - app: cainjector - app.kubernetes.io/name: cainjector - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/component: "cainjector" - app.kubernetes.io/version: "v1.21.1" - app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 -spec: - replicas: 1 - selector: - matchLabels: - app.kubernetes.io/name: cainjector - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/component: "cainjector" - template: - metadata: - labels: - app: cainjector - app.kubernetes.io/name: cainjector - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/component: "cainjector" - app.kubernetes.io/version: "v1.21.1" - app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 - annotations: - prometheus.io/path: "/metrics" - prometheus.io/scrape: 'true' - prometheus.io/port: '9402' - spec: - serviceAccountName: cert-manager-cainjector - enableServiceLinks: false - securityContext: - runAsNonRoot: true - seccompProfile: - type: RuntimeDefault - containers: - - name: cert-manager-cainjector - image: "quay.io/jetstack/cert-manager-cainjector:v1.21.1" - imagePullPolicy: IfNotPresent - args: - - --v=2 - - --leader-election-namespace=cert-manager - ports: - - containerPort: 9402 - name: http-metrics - protocol: TCP - env: - - name: POD_NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace - securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL - readOnlyRootFilesystem: true - nodeSelector: - kubernetes.io/os: "linux" - ---- -# Source: cert-manager/templates/deployment.yaml -apiVersion: apps/v1 -kind: Deployment -metadata: - name: cert-manager - namespace: cert-manager - labels: - app: cert-manager - app.kubernetes.io/name: cert-manager - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/component: "controller" - app.kubernetes.io/version: "v1.21.1" - app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 -spec: - replicas: 1 - selector: - matchLabels: - app.kubernetes.io/name: cert-manager - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/component: "controller" - template: - metadata: - labels: - app: cert-manager - app.kubernetes.io/name: cert-manager - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/component: "controller" - app.kubernetes.io/version: "v1.21.1" - app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 - annotations: - prometheus.io/path: "/metrics" - prometheus.io/scrape: 'true' - prometheus.io/port: '9402' - spec: - serviceAccountName: cert-manager - enableServiceLinks: false - securityContext: - runAsNonRoot: true - seccompProfile: - type: RuntimeDefault - containers: - - name: cert-manager-controller - image: "quay.io/jetstack/cert-manager-controller:v1.21.1" - imagePullPolicy: IfNotPresent - args: - - --v=2 - - --cluster-resource-namespace=$(POD_NAMESPACE) - - --leader-election-namespace=cert-manager - - --acme-http01-solver-image=quay.io/jetstack/cert-manager-acmesolver:v1.21.1 - - --max-concurrent-challenges=60 - ports: - - containerPort: 9402 - name: http-metrics - protocol: TCP - - containerPort: 9403 - name: http-healthz - protocol: TCP - securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL - readOnlyRootFilesystem: true - env: - - name: POD_NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace - # LivenessProbe settings are based on those used for the Kubernetes - # controller-manager. See: - # https://github.com/kubernetes/kubernetes/blob/806b30170c61a38fedd54cc9ede4cd6275a1ad3b/cmd/kubeadm/app/util/staticpod/utils.go#L241-L245 - livenessProbe: - httpGet: - port: http-healthz - path: /livez - scheme: HTTP - initialDelaySeconds: 10 - periodSeconds: 10 - timeoutSeconds: 15 - successThreshold: 1 - failureThreshold: 8 - nodeSelector: - kubernetes.io/os: "linux" - ---- -# Source: cert-manager/templates/webhook-deployment.yaml -apiVersion: apps/v1 -kind: Deployment -metadata: - name: cert-manager-webhook - namespace: cert-manager - labels: - app: webhook - app.kubernetes.io/name: webhook - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/component: "webhook" - app.kubernetes.io/version: "v1.21.1" - app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 -spec: - replicas: 1 - selector: - matchLabels: - app.kubernetes.io/name: webhook - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/component: "webhook" - template: - metadata: - labels: - app: webhook - app.kubernetes.io/name: webhook - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/component: "webhook" - app.kubernetes.io/version: "v1.21.1" - app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 - annotations: - prometheus.io/path: "/metrics" - prometheus.io/scrape: 'true' - prometheus.io/port: '9402' - spec: - serviceAccountName: cert-manager-webhook - enableServiceLinks: false - securityContext: - runAsNonRoot: true - seccompProfile: - type: RuntimeDefault - containers: - - name: cert-manager-webhook - image: "quay.io/jetstack/cert-manager-webhook:v1.21.1" - imagePullPolicy: IfNotPresent - args: - - --v=2 - - --secure-port=10250 - - --dynamic-serving-ca-secret-namespace=$(POD_NAMESPACE) - - --dynamic-serving-ca-secret-name=cert-manager-webhook-ca - - --dynamic-serving-dns-names=cert-manager-webhook - - --dynamic-serving-dns-names=cert-manager-webhook.$(POD_NAMESPACE) - - --dynamic-serving-dns-names=cert-manager-webhook.$(POD_NAMESPACE).svc - ports: - - name: https - protocol: TCP - containerPort: 10250 - - name: healthcheck - protocol: TCP - containerPort: 6080 - - containerPort: 9402 - name: http-metrics - protocol: TCP - livenessProbe: - httpGet: - path: /livez - port: healthcheck - scheme: HTTP - initialDelaySeconds: 60 - periodSeconds: 10 - timeoutSeconds: 1 - successThreshold: 1 - failureThreshold: 3 - readinessProbe: - httpGet: - path: /healthz - port: healthcheck - scheme: HTTP - initialDelaySeconds: 5 - periodSeconds: 5 - timeoutSeconds: 1 - successThreshold: 1 - failureThreshold: 3 - securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL - readOnlyRootFilesystem: true - env: - - name: POD_NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace - nodeSelector: - kubernetes.io/os: "linux" - ---- -# Source: cert-manager/templates/webhook-mutating-webhook.yaml -apiVersion: admissionregistration.k8s.io/v1 -kind: MutatingWebhookConfiguration -metadata: - name: cert-manager-webhook - labels: - app: webhook - app.kubernetes.io/name: webhook - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/component: "webhook" - app.kubernetes.io/version: "v1.21.1" - app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 - annotations: - cert-manager.io/inject-ca-from-secret: "cert-manager/cert-manager-webhook-ca" -webhooks: - - name: webhook.cert-manager.io - rules: - - apiGroups: - - "cert-manager.io" - apiVersions: - - "v1" - operations: - - CREATE - resources: - - "certificaterequests" - admissionReviewVersions: ["v1"] - # This webhook only accepts v1 cert-manager resources. - # Equivalent matchPolicy ensures that non-v1 resource requests are sent to - # this webhook (after the resources have been converted to v1). - matchPolicy: Equivalent - timeoutSeconds: 30 - failurePolicy: Fail - # Only include 'sideEffects' field in Kubernetes 1.12+ - sideEffects: None - clientConfig: - service: - name: cert-manager-webhook - namespace: cert-manager - path: /mutate ---- -# Source: cert-manager/templates/webhook-validating-webhook.yaml -apiVersion: admissionregistration.k8s.io/v1 -kind: ValidatingWebhookConfiguration -metadata: - name: cert-manager-webhook - labels: - app: webhook - app.kubernetes.io/name: webhook - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/component: "webhook" - app.kubernetes.io/version: "v1.21.1" - app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 - annotations: - cert-manager.io/inject-ca-from-secret: "cert-manager/cert-manager-webhook-ca" -webhooks: - - name: webhook.cert-manager.io - namespaceSelector: - matchExpressions: - - key: cert-manager.io/disable-validation - operator: NotIn - values: - - "true" - rules: - - apiGroups: - - "cert-manager.io" - - "acme.cert-manager.io" - apiVersions: - - "v1" - operations: - - CREATE - - UPDATE - resources: - - "*/*" - admissionReviewVersions: ["v1"] - # This webhook only accepts v1 cert-manager resources. - # Equivalent matchPolicy ensures that non-v1 resource requests are sent to - # this webhook (after the resources have been converted to v1). - matchPolicy: Equivalent - timeoutSeconds: 30 - failurePolicy: Fail - sideEffects: None - clientConfig: - service: - name: cert-manager-webhook - namespace: cert-manager - path: /validate ---- -# Source: cert-manager/templates/startupapicheck-serviceaccount.yaml -apiVersion: v1 -kind: ServiceAccount -automountServiceAccountToken: true -metadata: - name: cert-manager-startupapicheck - namespace: cert-manager - annotations: - helm.sh/hook: post-install - helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded - helm.sh/hook-weight: "-5" - labels: - app: startupapicheck - app.kubernetes.io/name: startupapicheck - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/component: "startupapicheck" - app.kubernetes.io/version: "v1.21.1" - app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 - ---- -# Source: cert-manager/templates/startupapicheck-rbac.yaml -# create certificate role -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: cert-manager-startupapicheck:create-cert - namespace: cert-manager - labels: - app: startupapicheck - app.kubernetes.io/name: startupapicheck - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/component: "startupapicheck" - app.kubernetes.io/version: "v1.21.1" - app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 - annotations: - helm.sh/hook: post-install - helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded - helm.sh/hook-weight: "-5" -rules: - - apiGroups: ["cert-manager.io"] - resources: ["certificaterequests"] - verbs: ["create"] ---- -# Source: cert-manager/templates/startupapicheck-rbac.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: cert-manager-startupapicheck:create-cert - namespace: cert-manager - labels: - app: startupapicheck - app.kubernetes.io/name: startupapicheck - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/component: "startupapicheck" - app.kubernetes.io/version: "v1.21.1" - app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 - annotations: - helm.sh/hook: post-install - helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded - helm.sh/hook-weight: "-5" -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: cert-manager-startupapicheck:create-cert -subjects: - - kind: ServiceAccount - name: cert-manager-startupapicheck - namespace: cert-manager - ---- -# Source: cert-manager/templates/startupapicheck-job.yaml -apiVersion: batch/v1 -kind: Job -metadata: - name: cert-manager-startupapicheck - namespace: cert-manager - labels: - app: startupapicheck - app.kubernetes.io/name: startupapicheck - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/component: "startupapicheck" - app.kubernetes.io/version: "v1.21.1" - app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 - annotations: - helm.sh/hook: post-install - helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded - helm.sh/hook-weight: "1" -spec: - backoffLimit: 4 - template: - metadata: - labels: - app: startupapicheck - app.kubernetes.io/name: startupapicheck - app.kubernetes.io/instance: cert-manager - app.kubernetes.io/component: "startupapicheck" - app.kubernetes.io/version: "v1.21.1" - app.kubernetes.io/managed-by: Helm - helm.sh/chart: cert-manager-v1.21.1 - spec: - restartPolicy: OnFailure - serviceAccountName: cert-manager-startupapicheck - enableServiceLinks: false - securityContext: - runAsNonRoot: true - seccompProfile: - type: RuntimeDefault - containers: - - name: cert-manager-startupapicheck - image: "quay.io/jetstack/cert-manager-startupapicheck:v1.21.1" - imagePullPolicy: IfNotPresent - args: - - check - - api - - --wait=1m - - -v - securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL - readOnlyRootFilesystem: true - env: - - name: POD_NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace - nodeSelector: - kubernetes.io/os: "linux" - diff --git a/packages/manifests/operators/cilium.yaml b/packages/manifests/operators/cilium.yaml index ec5c220..0043b7e 100644 --- a/packages/manifests/operators/cilium.yaml +++ b/packages/manifests/operators/cilium.yaml @@ -53,8 +53,8 @@ metadata: labels: cilium.io/helm-template-non-idempotent: "true" data: - ca.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURFekNDQWZ1Z0F3SUJBZ0lRVlpkb3h2NDVNSDh4WFVZQk9RME9MakFOQmdrcWhraUc5dzBCQVFzRkFEQVUKTVJJd0VBWURWUVFERXdsRGFXeHBkVzBnUTBFd0hoY05Nall3T0RFeU1qRXpOVFF5V2hjTk1qa3dPREV4TWpFegpOVFF5V2pBVU1SSXdFQVlEVlFRREV3bERhV3hwZFcwZ1EwRXdnZ0VpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElCCkR3QXdnZ0VLQW9JQkFRRE56RnYxUFZEaENUSlRFT01oaFZhR243YlB4M3hISnQ5bFIrRDhxck1qb1pleWZ5MmkKZkhOYXl4YUlSeVBkMzRselpCejJuRCtpMnhCM3VrcC9EYTU1aUNUSFdRdkJXVWhtRWgyaG5TM0ErUFVRdDVZRgpvZWV2a3Z0eEFLczB4YnBoR0hJNjlqTkRLZHFJYkxIOXl3UWdOdUZ1bGVZdWFMazIwd0F4dTJWVDFYZisvVklPClgrVlZTZkg0aEkveFUyT2F4OUtyYTlkQ1RkVDdWQ2M0SFVxRFF2SlMwQlJGeDNPaTFFVElUT2Vzd3kreklQNzYKL0dLamJsMWFobzB0VGJTWXJ5SWJqSzQweVF5cGcxNnAyb25Eeks4SkZFSHBnVG1VSy9FNE8zd1BIL05yVEdhTQpkV2lTVmZQbzduaE1OdFFsNXVHWFh3alJlVWhuQmdXU2l4a0xBZ01CQUFHallUQmZNQTRHQTFVZER3RUIvd1FFCkF3SUNwREFkQmdOVkhTVUVGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXcKQXdFQi96QWRCZ05WSFE0RUZnUVV3L0s4V1p4WU1YUGJLY2xRd1haZ3Y1LzZONTB3RFFZSktvWklodmNOQVFFTApCUUFEZ2dFQkFIRDNQNWt3SE1ycnQxSHM0TGlkS2UxbTJmQ2FmcVV3b1JiSC9BaWJZd1pTNVdXUzkwNXduNEplCkovejdmampOWnI5enRHZklCM0RZVDZqTWh0ejQ3ZkhQM0pzYVU3enNxL1RsME5HbDBSTXBLbnk4VFBYcHFvNUcKMWNNUTBxdFUvSGcrYWJuVUxJRDVUa25JWktDOWRZT1dVcGtGNHBBcEtXWTViUVMxZldPTGJ6ay8zbmVTVlNkRgp2MUIxZXpvNG9TZ0o4Q3RqOXdjOWtEVUMvTWdjNUNmdGgyNWVTZ1o3SytqaC9LUE1DK0VVRmJ5TEJTTGVsZi9rCmhjYzYwVUdNQ1FxNllPbWNiZjF6QitucTBHUDdXZUYrZHI5MnowS1BnWEZKQmVOU3U4WlN6dlgwbkRKdUM4QjEKSEdRS2hUWjlGWUJkN3V6bXFZZVBrT3huNytIbnB3QT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo= - ca.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFcEFJQkFBS0NBUUVBemN4YjlUMVE0UWt5VXhEaklZVldocCsyejhkOFJ5YmZaVWZnL0txekk2R1hzbjh0Cm9ueHpXc3NXaUVjajNkK0pjMlFjOXB3L290c1FkN3BLZncydWVZZ2t4MWtMd1ZsSVpoSWRvWjB0d1BqMUVMZVcKQmFIbnI1TDdjUUNyTk1XNllSaHlPdll6UXluYWlHeXgvY3NFSURiaGJwWG1MbWk1TnRNQU1idGxVOVYzL3YxUwpEbC9sVlVueCtJU1A4Vk5qbXNmU3EydlhRazNVKzFRbk9CMUtnMEx5VXRBVVJjZHpvdFJFeUV6bnJNTXZzeUQrCit2eGlvMjVkV29hTkxVMjBtSzhpRzR5dU5Na01xWU5lcWRxSnc4eXZDUlJCNllFNWxDdnhPRHQ4RHgvemEweG0KakhWb2tsWHo2TzU0VERiVUplYmhsMThJMFhsSVp3WUZrb3NaQ3dJREFRQUJBb0lCQUNJRTZhQ1pBYkVwZFlXdwpzWE1kbVFlSkNFM0JrcVFxWTF4WkxQSm5mMVJoQm5RTnZPdnl1WmpsSUhUbm1hQzRMbjhDS2gyRUI2cnlubjdFCkwwTmdiaHFON0ZKOXdFazJhcGJnNE1BUi9QbTh6Ym4xTnhuNFFSWFBiTHdwMmFOUUdqYXB0VnhVelhXSlNpUXEKSDZRdDlxRWlvVkpIK2pScXdFODFRdjkxbEZMdWx6OUlJSGNEOE10STQ0QnFBQ0hHVEVhUzZ2ZFR2QWl6M1pMUApzVVAwZTQweXlYKzhDcmpjdytnSkcwYUVMNytqL3YrMmhLNmVJMzJUcGc4YStqNjlQMmxPNE10eUp1UWNmKzJUCjJCQXk3Z1R1KzVmazM3Q0hvVEIrN1NWekFDQTdObW92cFkyeDJXYTJVVXBLOEZkTEdQS255cE1SbTNSRklCVFcKaWo2SzFWRUNnWUVBOEcvYm1qWTFFQVVEejRSbHJYSzlpeCtiQTM1RXFBV21KM2lkVkJGMGxoazl6d0o1OGFyRgpoZTduTFJtOUxOMmwxSW9UV1lmVlFuWWRjZ3dicHhzR3RwZ2tZUDFtMGFXbWZvR0NSN0h3TW56ZThRUFNZVCtkCjJZUkhPc3VJUERZdmdRL1dtRjZ6enVhQXpKdHJ2SFlUUUpuQW4weGx0MmVGQlJROU9BNEpCUHNDZ1lFQTJ4NkcKSkR2VXJtbWdCSlBlT0JQS0ZGY0tJWGFtbEU1QURVclNiRjM0ejhraTRrdFRhekJFOENFeFhYNjQrMjR6V2tyOApkU2hxQWsyWGlSR1hrRS9BZ2d3cFROWXh6NEpJV2VoWmJieitQcEFacFp6OUs1TUVxbEZTd1l1d0lOL1J5Mnd6CmJBS000L0NzdGNTVU1ZV3cwa2U3MkliSE5ZNTVHdFZqQTB4b1h6RUNnWUVBbWJHWE9pT3VsYmZ1OEtjY2E5eHQKeDFJRHdCN2wrbFhxR1U4am1zcXhzUVVmbW9WbHVCTEd3cyt0WFFvWUFHY0xDeXJjSlo0THQ3bFRKMFVRSkNqRgppTkVHYUMxem5VMzdlT0NHakJmMWlBQ0VicUpYeUN4blZkVVZ4MEsxcW0ra3ZDYUlzY3ZQdXRGandlY1QzbHZJCkFNS0gvQXhVOVFFcWFjMi9PR2JZWXlNQ2dZQlJaSTAvZUZvUVQzdjVOMVFjVUgySUFLenFzVUEvWnJHMFBrN2IKb2l5Q1FweUtvcUJoK0pRaS9yRnZvVnJsU3BJWXdESDI4d1F0eHRTN1BhV25IWGpNMWVlaGV3OFZuYmR5YmpTSgo1dUlxS3l6YnIrejYrcW1JK3B4YStLQjhGYWZBZ0hpNWJsa1hjcGMxRGNoZWZPS3B1YXUxU3B0RThaOWFzRmtQCktKcThnUUtCZ1FDZ2xRZzFnQ09YMzhOa2dFNEc5ak9FdHFQMGxFMFNMbmtHckYwQVJiYkJ4aGlwOTdyVFhCeWMKMkpPRHJaWTA1Z0lPVWxWdVpieU8rdXpQaDNiZERxTUpYQ3pjWm9rVjRoU1piOFlwSVVVU0hQdGhOandmazcrdwovUXlickpLUndQNS91bnVPVzFMVEtYbUg3ZjVlVGpqeDBXc0FMZWtVc3J3VnppWWNVWEJmVVE9PQotLS0tLUVORCBSU0EgUFJJVkFURSBLRVktLS0tLQo= + ca.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURFekNDQWZ1Z0F3SUJBZ0lRZWo4K0VORUJMdTBHZzZna1B1eFl5VEFOQmdrcWhraUc5dzBCQVFzRkFEQVUKTVJJd0VBWURWUVFERXdsRGFXeHBkVzBnUTBFd0hoY05Nall3T0RFeU1qSXpNREF5V2hjTk1qa3dPREV4TWpJegpNREF5V2pBVU1SSXdFQVlEVlFRREV3bERhV3hwZFcwZ1EwRXdnZ0VpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElCCkR3QXdnZ0VLQW9JQkFRRFRwSE9jNjJxM29VZ1ByRjNSRFhKY3c0WmxnRE5la1ZHc1c5TVRMdFdXS245d0tMbmUKQzZrbGxNVk5ydnVyVGptMDU3aGpDbkVkcndkOVd6YlJWNHczVXJYeWZOK0ptck04WWJyODFPMFFWcGdLQTJiTQpUQmM0OVhjcHkyUWwzSWYwaXdxMkdTek1qMjFyekZheVM2Q1Zwb1dOTVdqOWxzOFFjOFJ0eElLOG5zZ2t6cDRvCis0TmE5TkRrSldsM1NWK2NJbXJlSnVveWpSZWFlTzhNZ2J0R05NdFAwWGhweUp3ZTNSRnJWck5qV3JxcjFyMVIKLzZ6cjhrN3B1b0FyMmNaN1dkOVVuRUZqaVBNbFJZOENpdUtXTkJlYWdXV3BPaU00NTUzcFJUdmdPQmRLU3BGOQpPVE1CNXhSdldTQlNMdFVkWVVHR2ppM3pLQkJTMjBtZENrb1RBZ01CQUFHallUQmZNQTRHQTFVZER3RUIvd1FFCkF3SUNwREFkQmdOVkhTVUVGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXcKQXdFQi96QWRCZ05WSFE0RUZnUVUrMnFyZXdBejRXREptZnNBVW9MVm9wQzBXR2d3RFFZSktvWklodmNOQVFFTApCUUFEZ2dFQkFHb2xLZFljNGJ2VjR2b1RyRnNvMHF3YklBQlREc09xdU9mVURqM3NWb0VCS2hXUHQ5TUI3WVBNCnJBL2NGZTA0bTR1Zk1sT29RdDdlOWtmbVJjK2Z2VUpucFZ6aXFHQWhnZFBTVWt0eGdQOHl5Q3hLVVJVeGdPT3MKNUFoM3dWazBDdDFOY24xYVpXU3R1NDQ0SEppbko0QllESkNpQ1ZESTJaRjlQaWo5WFZlSnp5TUlUSHptSEpaSgp6MU9xV2s3aXhYZnJUYnRwTkxWekY0Z21TV1Y5cXYwNklvczVrRFVXVFZ3bUtMKzNZZ3U4elR3dk10MFl1ak5UCjROeWRaTzNVditYUnBLaTgwVE02dzlXVUIyZUtQRSs4NDVhcC8rUWZ1ZThrMzVFaVZ4NTlWWGJ0SFJuWHRBLzEKYURhLzROcmlTNVZGZjNxU0hBd2RienRta3YramtMdz0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo= + ca.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb2dJQkFBS0NBUUVBMDZSem5PdHF0NkZJRDZ4ZDBRMXlYTU9HWllBelhwRlJyRnZURXk3VmxpcC9jQ2k1CjNndXBKWlRGVGE3N3EwNDV0T2U0WXdweEhhOEhmVnMyMFZlTU4xSzE4bnpmaVpxelBHRzYvTlR0RUZhWUNnTm0KekV3WE9QVjNLY3RrSmR5SDlJc0t0aGtzekk5dGE4eFdza3VnbGFhRmpURm8vWmJQRUhQRWJjU0N2SjdJSk02ZQpLUHVEV3ZUUTVDVnBkMGxmbkNKcTNpYnFNbzBYbW5qdkRJRzdSalRMVDlGNGFjaWNIdDBSYTFhelkxcTZxOWE5ClVmK3M2L0pPNmJxQUs5bkdlMW5mVkp4Qlk0anpKVVdQQW9yaWxqUVhtb0ZscVRvak9PZWQ2VVU3NERnWFNrcVIKZlRrekFlY1ViMWtnVWk3VkhXRkJobzR0OHlnUVV0dEpuUXBLRXdJREFRQUJBb0lCQURVTzcyVVJwK2x0WjVGMgpWdmJIOWpuSFV2UXpWYTJKcFA0ZTd5WEtBZ1hwbFpWYXdHNG9ZamxudUtjbkRUVC9JWHgyODBUeEl6YWI0TGJPCm5VbVNOemJQWjRucFFHbFEvVXBQL2Y3UXFyWUQzNDN6R0Z4elh3Y0trdHRKZ0V2MW82ZnRDN3huUjFIcFN6ZFIKUFJMcDN0SmxzdW1ZejRkenZXbVVmRlJBaGI0Zlk3dmdmM0hCK2VEc21oQjF0eUE4UmFwT1RjR2FTckkxK0J1NgpyMVVqYTVpM24vMlhNRUw4OCtrNDRBOUE0elBINUVxUEFtNFdhS1ViWEtSTGYrWTUwZ29jV04rMFRpTFV2eFhBCjlFcE1WR1VGNHo2Q25SUEV2NmJGSmVZcGlaQUdBNXlYY0Fqa0lzU3VQQ1ZOS1RLLzROWEN0aVNlczJNSndjZFEKays4MHp6RUNnWUVBNlUxTmR2UkU3dExqRncvTDAvcnBmNDI1ZnNWWm4xRC85d050UEhqVGtvSmFmdXVjNjZiMwo1R1hjR1VUcEhEeXgwMDdWZ3FuaTJva3NObzhWWTdZQzUrWDlWd1RRclZhdmpCREYwa3BhblZNVndhWlpxT3I2ClFOeXdnd2lSMURWQXlJZVNncW94ckFnbS9iTkpPaWpGdjd4aEdBbm9VNnlXQTltT2I2YU9tZTBDZ1lFQTZEdXcKT0JlTjIwR2liZDZ6QnRzV05XYkJqQ1lqZzdheFJWWFhZK3pyQWhjWmxCUFJuSGJTZXR3TW9xTmYveGxHSmc0awp0VE9sTFhOQ09DVXErM2FuWjZNaEZ4ajJSZ0JtMGNYUUlzSFcyc0pCMDJCcWZtbUZlcWlzODMvRFZWSHBBbjhjCmRDamhJKzJzd1ZOTjk0MUZBUGtjcFdaQ2tadllMc3hYdlNRUDgvOENnWUJXTWRZOTdhK09JT0gvd2psSFB6dUgKZ2NBWHd5Z0NnWFdnT0diaVlhMmhRb0hXeEl2OFVIcmpxbkp2NzVMRWVQUW1Jc2tsZGtpMi90a1Q2emMyMktjbwpNRU95STdoSlltNkhMQ2M2TTNoWkNicFBDbnV6dWVUdGs5dXUvYnFMRVlXMjBNZmplS2ZUYkV1ampkcXZIeU00ClhJdnV5ckpJUDhwSTc5YjlEeWMrWFFLQmdGTXAxTkF4ZHlaV1djRjRwNm5EMlM4a2Joa3ZLemFtdk5LMGk5NkgKNEJ5dWd3VnBGMzR0ZXZCdVRzUUxOM3hWNDY0TEVKQW5QM2FJT09WOFFla3RNNFBFZ2p3UVAxa1FHY0h6VWJhdwpyYTFITldWcHVKa3VWcE4zUmdBbzk1MWRLTkV4RGRKM05UQzFrMURqOFI2K1kwQ1c5UEF5TDVLUE9acUFxTWJkCjNDeW5Bb0dBWDJiV3VoaURKTExmZVFGU3MxaVMxeEdXSDFabXVlYUZETXVqWHVHQ3d3RktwNkVtYnB4V282bHAKZi9EVHpjeEc2Nm4zWHl0d3JWVTF3WlUyR2tiN1JzaVF5amQvb0xQOHZZMEx4UkRQMTNjZWxhNHBwa3o5cXQ1Uwpndy9DaW5MZ1Erd0VVSHZYL2tCT0IwNkdTYWY2bzNUMDB0L2twcG5vV2s0cGRvMmNFVjQ9Ci0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg== --- # Source: cilium/templates/hubble/tls-helm/server-secret.yaml @@ -69,9 +69,9 @@ metadata: annotations: type: kubernetes.io/tls data: - ca.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURFekNDQWZ1Z0F3SUJBZ0lRVlpkb3h2NDVNSDh4WFVZQk9RME9MakFOQmdrcWhraUc5dzBCQVFzRkFEQVUKTVJJd0VBWURWUVFERXdsRGFXeHBkVzBnUTBFd0hoY05Nall3T0RFeU1qRXpOVFF5V2hjTk1qa3dPREV4TWpFegpOVFF5V2pBVU1SSXdFQVlEVlFRREV3bERhV3hwZFcwZ1EwRXdnZ0VpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElCCkR3QXdnZ0VLQW9JQkFRRE56RnYxUFZEaENUSlRFT01oaFZhR243YlB4M3hISnQ5bFIrRDhxck1qb1pleWZ5MmkKZkhOYXl4YUlSeVBkMzRselpCejJuRCtpMnhCM3VrcC9EYTU1aUNUSFdRdkJXVWhtRWgyaG5TM0ErUFVRdDVZRgpvZWV2a3Z0eEFLczB4YnBoR0hJNjlqTkRLZHFJYkxIOXl3UWdOdUZ1bGVZdWFMazIwd0F4dTJWVDFYZisvVklPClgrVlZTZkg0aEkveFUyT2F4OUtyYTlkQ1RkVDdWQ2M0SFVxRFF2SlMwQlJGeDNPaTFFVElUT2Vzd3kreklQNzYKL0dLamJsMWFobzB0VGJTWXJ5SWJqSzQweVF5cGcxNnAyb25Eeks4SkZFSHBnVG1VSy9FNE8zd1BIL05yVEdhTQpkV2lTVmZQbzduaE1OdFFsNXVHWFh3alJlVWhuQmdXU2l4a0xBZ01CQUFHallUQmZNQTRHQTFVZER3RUIvd1FFCkF3SUNwREFkQmdOVkhTVUVGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXcKQXdFQi96QWRCZ05WSFE0RUZnUVV3L0s4V1p4WU1YUGJLY2xRd1haZ3Y1LzZONTB3RFFZSktvWklodmNOQVFFTApCUUFEZ2dFQkFIRDNQNWt3SE1ycnQxSHM0TGlkS2UxbTJmQ2FmcVV3b1JiSC9BaWJZd1pTNVdXUzkwNXduNEplCkovejdmampOWnI5enRHZklCM0RZVDZqTWh0ejQ3ZkhQM0pzYVU3enNxL1RsME5HbDBSTXBLbnk4VFBYcHFvNUcKMWNNUTBxdFUvSGcrYWJuVUxJRDVUa25JWktDOWRZT1dVcGtGNHBBcEtXWTViUVMxZldPTGJ6ay8zbmVTVlNkRgp2MUIxZXpvNG9TZ0o4Q3RqOXdjOWtEVUMvTWdjNUNmdGgyNWVTZ1o3SytqaC9LUE1DK0VVRmJ5TEJTTGVsZi9rCmhjYzYwVUdNQ1FxNllPbWNiZjF6QitucTBHUDdXZUYrZHI5MnowS1BnWEZKQmVOU3U4WlN6dlgwbkRKdUM4QjEKSEdRS2hUWjlGWUJkN3V6bXFZZVBrT3huNytIbnB3QT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo= - tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURWekNDQWorZ0F3SUJBZ0lSQU9FVnZPc0tSQTRpM0R1akJxNlFkdHN3RFFZSktvWklodmNOQVFFTEJRQXcKRkRFU01CQUdBMVVFQXhNSlEybHNhWFZ0SUVOQk1CNFhEVEkyTURneE1qSXhNelUwTWxvWERUSTNNRGd4TWpJeApNelUwTWxvd0tqRW9NQ1lHQTFVRUF3d2ZLaTVrWldaaGRXeDBMbWgxWW1Kc1pTMW5jbkJqTG1OcGJHbDFiUzVwCmJ6Q0NBU0l3RFFZSktvWklodmNOQVFFQkJRQURnZ0VQQURDQ0FRb0NnZ0VCQU5TVVlFS1VhajZQZEZlaHF1QWIKRWpQWmJ4UmIxbDVuUTNXYkZxdDFZdThHSGJSRU1TT1k5WGFJa3Q3TGF4NHVXQXdUMGV6bVY2Vk04cTExMnM0LwovRGI5UkY3R2xVYlgxK1BaQmFCcTlDUXQrUGFNZXlKelRpbFJaUzY5VkxOL0EyRU5sQWZmaDBJdkZkeFV6cVdqCjNnNWZrTlF5ZjVZV08rQUZUWkFBaXVTRjFUN09KaEJBZEtwSlAvZVc4dVYvMzRrTlovTDFDb0xpaFhFajgxTnAKMi91SG43aU4xWjdYSHk0RzBpb1JmY214d0Z5MTBCdU5CakFxejNwR3NsTFFaU1JFbW50QTl5THc0M3RsWHZ3UApTOEEyUmJoQUZVNEs0ZlljaDBtK0Y2bEdMUVcrNDYwa2toTFk3MkVWQjdGMEFLZHNWK3BYcTJaWnFVOWdBWC9xCkdWMENBd0VBQWFPQmpUQ0JpakFPQmdOVkhROEJBZjhFQkFNQ0JhQXdIUVlEVlIwbEJCWXdGQVlJS3dZQkJRVUgKQXdFR0NDc0dBUVVGQndNQ01Bd0dBMVVkRXdFQi93UUNNQUF3SHdZRFZSMGpCQmd3Rm9BVXcvSzhXWnhZTVhQYgpLY2xRd1haZ3Y1LzZONTB3S2dZRFZSMFJCQ013SVlJZktpNWtaV1poZFd4MExtaDFZbUpzWlMxbmNuQmpMbU5wCmJHbDFiUzVwYnpBTkJna3Foa2lHOXcwQkFRc0ZBQU9DQVFFQWZEQmw5OWxWNzg1UFVqQ2VkMS9ES0k5dVljSSsKdXZlenRQRVJhNGdWelc2cEg4SkNSSEcwS1A2QW1oaEgxV2N4US84N3NWWHRyRi9YZ3VDNm1FMmxXdzY4UjBieApaRHBiZE1jRTVoM013cDkwcEJucEdMWk9SWXcrVmlkQytTY1UxZlQyZHIyMHhxS1pROW5IaGxnVTY1akRKQUowCkNEemNMVHE2ZHJZUkNPNlJDeXJQcmJrcjZRNEh3aGVjb3U3a3kxenNyRFZyMmwwNlBTbkVQM2dLUUMzdHR4RlcKOEh3cG1VdjV6MmxFVmUvajZpRmY2RlBtcWZyYTMxcWYyWG9pVkZmVXM3R05jeWZVSFk4MkR6dEMxU015Vk5aaAp6eGxseUpuQU4wQVZGSmdnYUNCcjd4a1l0MWlHS1pSbEpNUjdycTVVK3hQQjFNcGduMXkzU290aTF3PT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo= - tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb2dJQkFBS0NBUUVBMUpSZ1FwUnFQbzkwVjZHcTRCc1NNOWx2RkZ2V1htZERkWnNXcTNWaTd3WWR0RVF4Ckk1ajFkb2lTM3N0ckhpNVlEQlBSN09aWHBVenlyWFhhemovOE52MUVYc2FWUnRmWDQ5a0ZvR3IwSkMzNDlveDcKSW5OT0tWRmxMcjFVczM4RFlRMlVCOStIUWk4VjNGVE9wYVBlRGwrUTFESi9saFk3NEFWTmtBQ0s1SVhWUHM0bQpFRUIwcWtrLzk1Ynk1WC9maVExbjh2VUtndUtGY1NQelUybmIrNGVmdUkzVm50Y2ZMZ2JTS2hGOXliSEFYTFhRCkc0MEdNQ3JQZWtheVV0QmxKRVNhZTBEM0l2RGplMlZlL0E5THdEWkZ1RUFWVGdyaDloeUhTYjRYcVVZdEJiN2oKclNTU0V0anZZUlVIc1hRQXAyeFg2bGVyWmxtcFQyQUJmK29aWFFJREFRQUJBb0lCQUQwNEc3NmcwallCQng3RAplcHUrZ0EvNWdzRklyMlFSZGY1MDh1TGUwK2FGQ3VIaXI0b1NYMEpMRTR6ZzVSRFVoTnU1aTMrZldFZE04U2hlCkkreTR4WkFxZ05tUWMrWHFmQXhzYisvaVRUdnNGMklkVThxNGpSNWVCL2NkWkRxckRkU1IzZnNrZHVYcS9HOHUKNXpJUmpuM3lMSm5IanpHd1puN2QyQmZyNkJQbUpvTkxKbzZsVks1Tmx4VXhpRzdVak1nZlBwVmdUc3BQa1lEUQoxZEpaSmJQam55UGtqdXRPZVZLSnh0MUZyL21sdGVLYTk0d3dNdS9FQjlHSFVxVzlpZ2t1N2Z5MUhRLzJLSmRUCkVKYytZRlAvclhGeFBxcWlGN3FDWVNoQlRRZFVHemxYNENIVTVMeHAxR09xZmo0VFkvbGQyVFRZL24zUnBoay8KYU4vaGM5c0NnWUVBNi9xWmFKd0RTTzFaV3NNcEtnWTZrWUxrYmFZbTZnUnlIYmpVUWQzRUg0V3VHSHRJZnZLRgpnRkRCUm53anExR1NqRnloYnoybWZZYXBVbkZnT20waGRmSGs0aGFtNzJBL2EyVEZxMmhpYmlYTEljMVFwaVA3Ckptby9aVStNTi9Qeno0cy9EdmJCZDdLL3U2Z0lob3pvWUl3UDlGY1d3TkNFajI5Z1E0MXBqRThDZ1lFQTVwMk0Kd0lXMFFHRndBSU1WdWJyVXoyK1BCOG1yaENJbEVzRzJuV3FRNkhEcjdXeG82YVhJVGNJZk9vbjRXNmFoV3lETwpBMXJDc0hXWXpBZlkzamtjNkU5ZURtOHVJMzkwR3RtSGpVdUsybHMzanFheE9uRldNd3p1TlNDN0RtVFBrdHAvClJMR25KeFNubGdBMUJ6T1h4WE9yOHBQbEtIcjEwMGhZdjByKytKTUNnWUE3bVVjMWpIR244WW9ueWpLVFVvOW8KUU03QWdyNUJURzRsNDVCNE1qSmVZN3pjb2dabFNZcytKU2NyVGg4VUhiNE5oVGVnaU1tTDJuN1pPNWs2S0dYVApEQXpxclIzc1J6cTlQTzVQcEVWMzNFTzVmY2xvckoyNXpndkU0cHBmWjFXa2pWNlh3T3FMK0xGRUMrUmJWeXM1CmR5WndaNjV2ZERxR24zS0luU2FUTVFLQmdHVldDY2wzZHpOckhZbzhEOG5qWFN3aHUxb1N0am1EdjRLMGVJaEgKa1pGeVBWbkE3NERzQms2VTVLQVdqSG5KaU5IQVlvWjYxVjR3N29tSlVUU2xLQnkwODRHb1BULy8rNGJvMjNXdApJa0M5SUhhZ3JQUWZaVjlkYVRjVFFOOGNVVklZalNBa2FHejEySVpEWlFuYkUvQUIyaWJuOGlTTms0UGFJSlUrCllUZmRBb0dBU01EejBGb0dGNDBZbU1VRU9MVHRpVmMxQ1BQT21Zdks0c3ByRjQvWDh5eGYyL2luSy9UQk1sTC8KdzVhaWQ4Ym02dDhOUUErcVM5SWdNdnpTU3lFaUdmbjZsMmtDN1haWGI4UWI2SUF2SmF4ZzRLTElxN3ZIek5tegp1ZXd5YllTRWJVVjNYQVBPdlF2N0NkbGxqUWRDWHQwb3pmK2hnU0F2RjZCNTA4YkY4eUk9Ci0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg== + ca.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURFekNDQWZ1Z0F3SUJBZ0lRZWo4K0VORUJMdTBHZzZna1B1eFl5VEFOQmdrcWhraUc5dzBCQVFzRkFEQVUKTVJJd0VBWURWUVFERXdsRGFXeHBkVzBnUTBFd0hoY05Nall3T0RFeU1qSXpNREF5V2hjTk1qa3dPREV4TWpJegpNREF5V2pBVU1SSXdFQVlEVlFRREV3bERhV3hwZFcwZ1EwRXdnZ0VpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElCCkR3QXdnZ0VLQW9JQkFRRFRwSE9jNjJxM29VZ1ByRjNSRFhKY3c0WmxnRE5la1ZHc1c5TVRMdFdXS245d0tMbmUKQzZrbGxNVk5ydnVyVGptMDU3aGpDbkVkcndkOVd6YlJWNHczVXJYeWZOK0ptck04WWJyODFPMFFWcGdLQTJiTQpUQmM0OVhjcHkyUWwzSWYwaXdxMkdTek1qMjFyekZheVM2Q1Zwb1dOTVdqOWxzOFFjOFJ0eElLOG5zZ2t6cDRvCis0TmE5TkRrSldsM1NWK2NJbXJlSnVveWpSZWFlTzhNZ2J0R05NdFAwWGhweUp3ZTNSRnJWck5qV3JxcjFyMVIKLzZ6cjhrN3B1b0FyMmNaN1dkOVVuRUZqaVBNbFJZOENpdUtXTkJlYWdXV3BPaU00NTUzcFJUdmdPQmRLU3BGOQpPVE1CNXhSdldTQlNMdFVkWVVHR2ppM3pLQkJTMjBtZENrb1RBZ01CQUFHallUQmZNQTRHQTFVZER3RUIvd1FFCkF3SUNwREFkQmdOVkhTVUVGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXcKQXdFQi96QWRCZ05WSFE0RUZnUVUrMnFyZXdBejRXREptZnNBVW9MVm9wQzBXR2d3RFFZSktvWklodmNOQVFFTApCUUFEZ2dFQkFHb2xLZFljNGJ2VjR2b1RyRnNvMHF3YklBQlREc09xdU9mVURqM3NWb0VCS2hXUHQ5TUI3WVBNCnJBL2NGZTA0bTR1Zk1sT29RdDdlOWtmbVJjK2Z2VUpucFZ6aXFHQWhnZFBTVWt0eGdQOHl5Q3hLVVJVeGdPT3MKNUFoM3dWazBDdDFOY24xYVpXU3R1NDQ0SEppbko0QllESkNpQ1ZESTJaRjlQaWo5WFZlSnp5TUlUSHptSEpaSgp6MU9xV2s3aXhYZnJUYnRwTkxWekY0Z21TV1Y5cXYwNklvczVrRFVXVFZ3bUtMKzNZZ3U4elR3dk10MFl1ak5UCjROeWRaTzNVditYUnBLaTgwVE02dzlXVUIyZUtQRSs4NDVhcC8rUWZ1ZThrMzVFaVZ4NTlWWGJ0SFJuWHRBLzEKYURhLzROcmlTNVZGZjNxU0hBd2RienRta3YramtMdz0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo= + tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURWekNDQWorZ0F3SUJBZ0lSQUs1ekJsSktTQzNUcGlGRmcyNnBZbWN3RFFZSktvWklodmNOQVFFTEJRQXcKRkRFU01CQUdBMVVFQXhNSlEybHNhWFZ0SUVOQk1CNFhEVEkyTURneE1qSXlNekF3TWxvWERUSTNNRGd4TWpJeQpNekF3TWxvd0tqRW9NQ1lHQTFVRUF3d2ZLaTVrWldaaGRXeDBMbWgxWW1Kc1pTMW5jbkJqTG1OcGJHbDFiUzVwCmJ6Q0NBU0l3RFFZSktvWklodmNOQVFFQkJRQURnZ0VQQURDQ0FRb0NnZ0VCQU5NUEdPckUzR01aOGNXbUxXcGkKSVhjbkhQNnJEWTI1NFl2NW9WM3pQVU5QdzBNcFE1ZzJlK0dlL1dzdGw2T2ZoTWdlYVFaMjVaZTZLU3k1dkpvQwpqTEo3eDZaL3AxMFA2SzVWK3pBRnRTVkd2T096d29SNnQ2emtaWkpnK1dxZVZJc3REdGZXL2I3MXZpbURJTUkxCmc4dHRITTV1U1UrWEFVZlBnSngwVFJMMTQ2ZlRpU0xFN0R4emVkTWs1dHovTDZPaUlPRXN0bklyWUgyNkhNdmEKYWxzbTNMQktnK09KL001U0xDR2tVWk5TT2ROYmZuT1gvQ05uNElER2pjQnRCRG5sclpqVHVpSDhUdTdtYXpnMAp2WVJQbVRjZXdRVzJBMWlHUkhScFM5a083WkJ3RHFwTzUxSzd1VUR4QUVuajFNWnQ3ajZIblB5VVBTMFZXaUlECm4zMENBd0VBQWFPQmpUQ0JpakFPQmdOVkhROEJBZjhFQkFNQ0JhQXdIUVlEVlIwbEJCWXdGQVlJS3dZQkJRVUgKQXdFR0NDc0dBUVVGQndNQ01Bd0dBMVVkRXdFQi93UUNNQUF3SHdZRFZSMGpCQmd3Rm9BVSsycXJld0F6NFdESgptZnNBVW9MVm9wQzBXR2d3S2dZRFZSMFJCQ013SVlJZktpNWtaV1poZFd4MExtaDFZbUpzWlMxbmNuQmpMbU5wCmJHbDFiUzVwYnpBTkJna3Foa2lHOXcwQkFRc0ZBQU9DQVFFQXFsWWNNNFFtYzBsckpBb2xCbHpReisvNFJMa08KV2ZoTVR2bGFyQ0NtMUlnY3pmR1VxVG9NODU4V3MzcDgxZmZUcjlldHFIZzNEZzRWTUcrTFUxWk80d0pvYTBscApjV2Nhb1ZiSVFTSDJ3dmFJTGhqakd3aTlpR3FKYnIyUjJWdUxQMUZ2aEhyejNvR2hxMkVBV2hlOVlXZGlBM3RVCmlUTmRaWVhOdXUxZExTaWw2aEsxSkljS0lJVURhMllxUFFCNjcvRHFyN294Ri9peTF5VEpzaTV2ckdRdnlzbXAKQkg2cXptODh4bk1HTXF4OXBEUmpqN01jK2RLLzliaHplOVdUT2VxTlUzQlJNM3dIRHlDd1IxN3pXNFNQUFBDRwpVR2VEVUVXRVVVV2FUYUFnL0MrOHhhOEUvSFhZeHNVQndXQVBGM1h6QVFVY3JXYkpaN1JFNmJLRTdBPT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo= + tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb3dJQkFBS0NBUUVBMHc4WTZzVGNZeG54eGFZdGFtSWhkeWNjL3FzTmpibmhpL21oWGZNOVEwL0RReWxECm1EWjc0Wjc5YXkyWG81K0V5QjVwQm5ibGw3b3BMTG04bWdLTXNudkhwbituWFEvb3JsWDdNQVcxSlVhODQ3UEMKaEhxM3JPUmxrbUQ1YXA1VWl5ME8xOWI5dnZXK0tZTWd3aldEeTIwY3ptNUpUNWNCUjgrQW5IUk5FdlhqcDlPSgpJc1RzUEhONTB5VG0zUDh2bzZJZzRTeTJjaXRnZmJvY3k5cHFXeWJjc0VxRDQ0bjh6bElzSWFSUmsxSTUwMXQrCmM1ZjhJMmZnZ01hTndHMEVPZVd0bU5PNklmeE83dVpyT0RTOWhFK1pOeDdCQmJZRFdJWkVkR2xMMlE3dGtIQU8KcWs3blVydTVRUEVBU2VQVXhtM3VQb2VjL0pROUxSVmFJZ09mZlFJREFRQUJBb0lCQUVmSmc4MGVobU9DeUpSVQprRy8xenJJcmNKWkNjZ3E1cGJpcGdMUm03bmg5b2Ntdk9GbUdkcDVvS0lRUzd0ZnRnd2xhSnBqWFNnSlFoSDY4CjhpUmtKNXp4c3hlenBhWm1xZHJhVGVTb25GT0FldkRzRElacEF4NWdWUmZ6dWdJRXRuYmNMWWRHamVvc3hiQnkKOUdwNkwwaTY1U2hscExQWWhjdjZEU0dxQVNrb01TR29CY2VMaSt4Nno0NWEzL1dSZ1F1R0JLU09iL0VPUU1vWQpBdm80NVJVSTNvMnpUTnBsTVBBd0lvMkV5OExRaFQxNHdKeitjdEcwZldtRlpCeS9kd01nRGdJc0xUd1JxbWdqCmJvam5DSWxlcDdqOVpRTmFRVTg2R3ZLMytEZWpYZUxyc2lKRFg2SEVVZksyaVMrQnVjZWMvdzNPMmphdlBxU0EKOVBEUVVsVUNnWUVBOUllQkVmL3pPUkxoRk1QZWVJaEVuN3AycFB1Q1ZpT0IrSjZzb1JKdmhGVmU5SUs3VTJLcwpNaGJONmJJK09iUGFOTHdFQ05IVUlGbThsN0JrbURGVUxkaFBtbGFGeDhRSUI3NFhoRnhCZkUySGpESjMyaFZpClNnZCtQaGpJUStsM3RyK3VlTitGNFFmMXZWUUhSVGljajJsbHZacGUxb3dZR2trZmRUUS9ROHNDZ1lFQTNQV24KMWZmWEx4MGpJZ2pUMEFCTkc3WDF2dzAza21XVkhVOXJPdWRBNVhqZC93eG54NnBRTWpqT3krNVlEbGhsbkJQUQo1U2tOSHJxWkVaaTdNcGpsNndqeXpKZXdkS3EwdXFoYURSd3RIcS9rOGRhcXR3UmRSWGVnTnY4aVdNR3JTMTZNClR1QkhRRjRMZXRRTEtjUURFcTI1YnZWSld6YmZwVFVkUWdOUEVOY0NnWUVBd2puTExGZm5nZ0xiNHhsODRMSWsKQjljY25Bamx5ck9qYmEzaklvRTVNSng2c3E0UVNyaEtXL0svRll1dFh6bmE3UjRWK2tkb1BWWHB0WGEzUUNlVwpYRisvUXJETXpCS0o2bFJ6NjM4M3lKcndPa3h2NURvdCt1MGV1Z1lITStJQ1k1YTI1MjFyc29VWERJM3N4RytsCjgwZGRONCtoR3JybC9pTHNxTFNhTjZjQ2dZQlFFU1JVUUk3Vkg3WFBhMnQxZitaeEdDcUlwSDF5cXlTeGprbkkKK210bHU3cVY1U1RtRVMwbVJiZUo1a0E2VW9YZlhMN2hpMUtady93YmlFQ3RRUUp2ZkxxZXNJamNmYzhucEVHZApab3hqQmxIcjRHSFVGOXpFZzJpbkJTU3BET1RKVnVWNDM0UnlLcUgyVEVnUFJsdm10TlR4QkNra3lHbWFML2orCkpyekwyUUtCZ0RheDBPL0ZKcHNjVDBoV2RjZ3pVVU1iMUo1UngrQlV2eXp0SVp2ckpmdEdmRnRnUXRhZXNLaFgKS0ZwTlNXMW1yci96TmVhKzVLWnZoYTV1MWtnbVZ5YWRrR3ZZVnpkeTBWajdycTM3TXo1M01qMTJQUTZlTnhzcwo1K0NZd012WVRWR0Z1eTl5b2tDTm0zOENSZTFqSEFjanE0dFN6d2dSd3ArU2h5UDJZSFJvCi0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg== --- # Source: cilium/templates/cilium-configmap.yaml diff --git a/packages/manifests/operators/cilium/1.19.5.yaml b/packages/manifests/operators/cilium/1.19.5.yaml index ec5c220..0043b7e 100644 --- a/packages/manifests/operators/cilium/1.19.5.yaml +++ b/packages/manifests/operators/cilium/1.19.5.yaml @@ -53,8 +53,8 @@ metadata: labels: cilium.io/helm-template-non-idempotent: "true" data: - ca.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURFekNDQWZ1Z0F3SUJBZ0lRVlpkb3h2NDVNSDh4WFVZQk9RME9MakFOQmdrcWhraUc5dzBCQVFzRkFEQVUKTVJJd0VBWURWUVFERXdsRGFXeHBkVzBnUTBFd0hoY05Nall3T0RFeU1qRXpOVFF5V2hjTk1qa3dPREV4TWpFegpOVFF5V2pBVU1SSXdFQVlEVlFRREV3bERhV3hwZFcwZ1EwRXdnZ0VpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElCCkR3QXdnZ0VLQW9JQkFRRE56RnYxUFZEaENUSlRFT01oaFZhR243YlB4M3hISnQ5bFIrRDhxck1qb1pleWZ5MmkKZkhOYXl4YUlSeVBkMzRselpCejJuRCtpMnhCM3VrcC9EYTU1aUNUSFdRdkJXVWhtRWgyaG5TM0ErUFVRdDVZRgpvZWV2a3Z0eEFLczB4YnBoR0hJNjlqTkRLZHFJYkxIOXl3UWdOdUZ1bGVZdWFMazIwd0F4dTJWVDFYZisvVklPClgrVlZTZkg0aEkveFUyT2F4OUtyYTlkQ1RkVDdWQ2M0SFVxRFF2SlMwQlJGeDNPaTFFVElUT2Vzd3kreklQNzYKL0dLamJsMWFobzB0VGJTWXJ5SWJqSzQweVF5cGcxNnAyb25Eeks4SkZFSHBnVG1VSy9FNE8zd1BIL05yVEdhTQpkV2lTVmZQbzduaE1OdFFsNXVHWFh3alJlVWhuQmdXU2l4a0xBZ01CQUFHallUQmZNQTRHQTFVZER3RUIvd1FFCkF3SUNwREFkQmdOVkhTVUVGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXcKQXdFQi96QWRCZ05WSFE0RUZnUVV3L0s4V1p4WU1YUGJLY2xRd1haZ3Y1LzZONTB3RFFZSktvWklodmNOQVFFTApCUUFEZ2dFQkFIRDNQNWt3SE1ycnQxSHM0TGlkS2UxbTJmQ2FmcVV3b1JiSC9BaWJZd1pTNVdXUzkwNXduNEplCkovejdmampOWnI5enRHZklCM0RZVDZqTWh0ejQ3ZkhQM0pzYVU3enNxL1RsME5HbDBSTXBLbnk4VFBYcHFvNUcKMWNNUTBxdFUvSGcrYWJuVUxJRDVUa25JWktDOWRZT1dVcGtGNHBBcEtXWTViUVMxZldPTGJ6ay8zbmVTVlNkRgp2MUIxZXpvNG9TZ0o4Q3RqOXdjOWtEVUMvTWdjNUNmdGgyNWVTZ1o3SytqaC9LUE1DK0VVRmJ5TEJTTGVsZi9rCmhjYzYwVUdNQ1FxNllPbWNiZjF6QitucTBHUDdXZUYrZHI5MnowS1BnWEZKQmVOU3U4WlN6dlgwbkRKdUM4QjEKSEdRS2hUWjlGWUJkN3V6bXFZZVBrT3huNytIbnB3QT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo= - ca.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFcEFJQkFBS0NBUUVBemN4YjlUMVE0UWt5VXhEaklZVldocCsyejhkOFJ5YmZaVWZnL0txekk2R1hzbjh0Cm9ueHpXc3NXaUVjajNkK0pjMlFjOXB3L290c1FkN3BLZncydWVZZ2t4MWtMd1ZsSVpoSWRvWjB0d1BqMUVMZVcKQmFIbnI1TDdjUUNyTk1XNllSaHlPdll6UXluYWlHeXgvY3NFSURiaGJwWG1MbWk1TnRNQU1idGxVOVYzL3YxUwpEbC9sVlVueCtJU1A4Vk5qbXNmU3EydlhRazNVKzFRbk9CMUtnMEx5VXRBVVJjZHpvdFJFeUV6bnJNTXZzeUQrCit2eGlvMjVkV29hTkxVMjBtSzhpRzR5dU5Na01xWU5lcWRxSnc4eXZDUlJCNllFNWxDdnhPRHQ4RHgvemEweG0KakhWb2tsWHo2TzU0VERiVUplYmhsMThJMFhsSVp3WUZrb3NaQ3dJREFRQUJBb0lCQUNJRTZhQ1pBYkVwZFlXdwpzWE1kbVFlSkNFM0JrcVFxWTF4WkxQSm5mMVJoQm5RTnZPdnl1WmpsSUhUbm1hQzRMbjhDS2gyRUI2cnlubjdFCkwwTmdiaHFON0ZKOXdFazJhcGJnNE1BUi9QbTh6Ym4xTnhuNFFSWFBiTHdwMmFOUUdqYXB0VnhVelhXSlNpUXEKSDZRdDlxRWlvVkpIK2pScXdFODFRdjkxbEZMdWx6OUlJSGNEOE10STQ0QnFBQ0hHVEVhUzZ2ZFR2QWl6M1pMUApzVVAwZTQweXlYKzhDcmpjdytnSkcwYUVMNytqL3YrMmhLNmVJMzJUcGc4YStqNjlQMmxPNE10eUp1UWNmKzJUCjJCQXk3Z1R1KzVmazM3Q0hvVEIrN1NWekFDQTdObW92cFkyeDJXYTJVVXBLOEZkTEdQS255cE1SbTNSRklCVFcKaWo2SzFWRUNnWUVBOEcvYm1qWTFFQVVEejRSbHJYSzlpeCtiQTM1RXFBV21KM2lkVkJGMGxoazl6d0o1OGFyRgpoZTduTFJtOUxOMmwxSW9UV1lmVlFuWWRjZ3dicHhzR3RwZ2tZUDFtMGFXbWZvR0NSN0h3TW56ZThRUFNZVCtkCjJZUkhPc3VJUERZdmdRL1dtRjZ6enVhQXpKdHJ2SFlUUUpuQW4weGx0MmVGQlJROU9BNEpCUHNDZ1lFQTJ4NkcKSkR2VXJtbWdCSlBlT0JQS0ZGY0tJWGFtbEU1QURVclNiRjM0ejhraTRrdFRhekJFOENFeFhYNjQrMjR6V2tyOApkU2hxQWsyWGlSR1hrRS9BZ2d3cFROWXh6NEpJV2VoWmJieitQcEFacFp6OUs1TUVxbEZTd1l1d0lOL1J5Mnd6CmJBS000L0NzdGNTVU1ZV3cwa2U3MkliSE5ZNTVHdFZqQTB4b1h6RUNnWUVBbWJHWE9pT3VsYmZ1OEtjY2E5eHQKeDFJRHdCN2wrbFhxR1U4am1zcXhzUVVmbW9WbHVCTEd3cyt0WFFvWUFHY0xDeXJjSlo0THQ3bFRKMFVRSkNqRgppTkVHYUMxem5VMzdlT0NHakJmMWlBQ0VicUpYeUN4blZkVVZ4MEsxcW0ra3ZDYUlzY3ZQdXRGandlY1QzbHZJCkFNS0gvQXhVOVFFcWFjMi9PR2JZWXlNQ2dZQlJaSTAvZUZvUVQzdjVOMVFjVUgySUFLenFzVUEvWnJHMFBrN2IKb2l5Q1FweUtvcUJoK0pRaS9yRnZvVnJsU3BJWXdESDI4d1F0eHRTN1BhV25IWGpNMWVlaGV3OFZuYmR5YmpTSgo1dUlxS3l6YnIrejYrcW1JK3B4YStLQjhGYWZBZ0hpNWJsa1hjcGMxRGNoZWZPS3B1YXUxU3B0RThaOWFzRmtQCktKcThnUUtCZ1FDZ2xRZzFnQ09YMzhOa2dFNEc5ak9FdHFQMGxFMFNMbmtHckYwQVJiYkJ4aGlwOTdyVFhCeWMKMkpPRHJaWTA1Z0lPVWxWdVpieU8rdXpQaDNiZERxTUpYQ3pjWm9rVjRoU1piOFlwSVVVU0hQdGhOandmazcrdwovUXlickpLUndQNS91bnVPVzFMVEtYbUg3ZjVlVGpqeDBXc0FMZWtVc3J3VnppWWNVWEJmVVE9PQotLS0tLUVORCBSU0EgUFJJVkFURSBLRVktLS0tLQo= + ca.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURFekNDQWZ1Z0F3SUJBZ0lRZWo4K0VORUJMdTBHZzZna1B1eFl5VEFOQmdrcWhraUc5dzBCQVFzRkFEQVUKTVJJd0VBWURWUVFERXdsRGFXeHBkVzBnUTBFd0hoY05Nall3T0RFeU1qSXpNREF5V2hjTk1qa3dPREV4TWpJegpNREF5V2pBVU1SSXdFQVlEVlFRREV3bERhV3hwZFcwZ1EwRXdnZ0VpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElCCkR3QXdnZ0VLQW9JQkFRRFRwSE9jNjJxM29VZ1ByRjNSRFhKY3c0WmxnRE5la1ZHc1c5TVRMdFdXS245d0tMbmUKQzZrbGxNVk5ydnVyVGptMDU3aGpDbkVkcndkOVd6YlJWNHczVXJYeWZOK0ptck04WWJyODFPMFFWcGdLQTJiTQpUQmM0OVhjcHkyUWwzSWYwaXdxMkdTek1qMjFyekZheVM2Q1Zwb1dOTVdqOWxzOFFjOFJ0eElLOG5zZ2t6cDRvCis0TmE5TkRrSldsM1NWK2NJbXJlSnVveWpSZWFlTzhNZ2J0R05NdFAwWGhweUp3ZTNSRnJWck5qV3JxcjFyMVIKLzZ6cjhrN3B1b0FyMmNaN1dkOVVuRUZqaVBNbFJZOENpdUtXTkJlYWdXV3BPaU00NTUzcFJUdmdPQmRLU3BGOQpPVE1CNXhSdldTQlNMdFVkWVVHR2ppM3pLQkJTMjBtZENrb1RBZ01CQUFHallUQmZNQTRHQTFVZER3RUIvd1FFCkF3SUNwREFkQmdOVkhTVUVGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXcKQXdFQi96QWRCZ05WSFE0RUZnUVUrMnFyZXdBejRXREptZnNBVW9MVm9wQzBXR2d3RFFZSktvWklodmNOQVFFTApCUUFEZ2dFQkFHb2xLZFljNGJ2VjR2b1RyRnNvMHF3YklBQlREc09xdU9mVURqM3NWb0VCS2hXUHQ5TUI3WVBNCnJBL2NGZTA0bTR1Zk1sT29RdDdlOWtmbVJjK2Z2VUpucFZ6aXFHQWhnZFBTVWt0eGdQOHl5Q3hLVVJVeGdPT3MKNUFoM3dWazBDdDFOY24xYVpXU3R1NDQ0SEppbko0QllESkNpQ1ZESTJaRjlQaWo5WFZlSnp5TUlUSHptSEpaSgp6MU9xV2s3aXhYZnJUYnRwTkxWekY0Z21TV1Y5cXYwNklvczVrRFVXVFZ3bUtMKzNZZ3U4elR3dk10MFl1ak5UCjROeWRaTzNVditYUnBLaTgwVE02dzlXVUIyZUtQRSs4NDVhcC8rUWZ1ZThrMzVFaVZ4NTlWWGJ0SFJuWHRBLzEKYURhLzROcmlTNVZGZjNxU0hBd2RienRta3YramtMdz0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo= + ca.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb2dJQkFBS0NBUUVBMDZSem5PdHF0NkZJRDZ4ZDBRMXlYTU9HWllBelhwRlJyRnZURXk3VmxpcC9jQ2k1CjNndXBKWlRGVGE3N3EwNDV0T2U0WXdweEhhOEhmVnMyMFZlTU4xSzE4bnpmaVpxelBHRzYvTlR0RUZhWUNnTm0KekV3WE9QVjNLY3RrSmR5SDlJc0t0aGtzekk5dGE4eFdza3VnbGFhRmpURm8vWmJQRUhQRWJjU0N2SjdJSk02ZQpLUHVEV3ZUUTVDVnBkMGxmbkNKcTNpYnFNbzBYbW5qdkRJRzdSalRMVDlGNGFjaWNIdDBSYTFhelkxcTZxOWE5ClVmK3M2L0pPNmJxQUs5bkdlMW5mVkp4Qlk0anpKVVdQQW9yaWxqUVhtb0ZscVRvak9PZWQ2VVU3NERnWFNrcVIKZlRrekFlY1ViMWtnVWk3VkhXRkJobzR0OHlnUVV0dEpuUXBLRXdJREFRQUJBb0lCQURVTzcyVVJwK2x0WjVGMgpWdmJIOWpuSFV2UXpWYTJKcFA0ZTd5WEtBZ1hwbFpWYXdHNG9ZamxudUtjbkRUVC9JWHgyODBUeEl6YWI0TGJPCm5VbVNOemJQWjRucFFHbFEvVXBQL2Y3UXFyWUQzNDN6R0Z4elh3Y0trdHRKZ0V2MW82ZnRDN3huUjFIcFN6ZFIKUFJMcDN0SmxzdW1ZejRkenZXbVVmRlJBaGI0Zlk3dmdmM0hCK2VEc21oQjF0eUE4UmFwT1RjR2FTckkxK0J1NgpyMVVqYTVpM24vMlhNRUw4OCtrNDRBOUE0elBINUVxUEFtNFdhS1ViWEtSTGYrWTUwZ29jV04rMFRpTFV2eFhBCjlFcE1WR1VGNHo2Q25SUEV2NmJGSmVZcGlaQUdBNXlYY0Fqa0lzU3VQQ1ZOS1RLLzROWEN0aVNlczJNSndjZFEKays4MHp6RUNnWUVBNlUxTmR2UkU3dExqRncvTDAvcnBmNDI1ZnNWWm4xRC85d050UEhqVGtvSmFmdXVjNjZiMwo1R1hjR1VUcEhEeXgwMDdWZ3FuaTJva3NObzhWWTdZQzUrWDlWd1RRclZhdmpCREYwa3BhblZNVndhWlpxT3I2ClFOeXdnd2lSMURWQXlJZVNncW94ckFnbS9iTkpPaWpGdjd4aEdBbm9VNnlXQTltT2I2YU9tZTBDZ1lFQTZEdXcKT0JlTjIwR2liZDZ6QnRzV05XYkJqQ1lqZzdheFJWWFhZK3pyQWhjWmxCUFJuSGJTZXR3TW9xTmYveGxHSmc0awp0VE9sTFhOQ09DVXErM2FuWjZNaEZ4ajJSZ0JtMGNYUUlzSFcyc0pCMDJCcWZtbUZlcWlzODMvRFZWSHBBbjhjCmRDamhJKzJzd1ZOTjk0MUZBUGtjcFdaQ2tadllMc3hYdlNRUDgvOENnWUJXTWRZOTdhK09JT0gvd2psSFB6dUgKZ2NBWHd5Z0NnWFdnT0diaVlhMmhRb0hXeEl2OFVIcmpxbkp2NzVMRWVQUW1Jc2tsZGtpMi90a1Q2emMyMktjbwpNRU95STdoSlltNkhMQ2M2TTNoWkNicFBDbnV6dWVUdGs5dXUvYnFMRVlXMjBNZmplS2ZUYkV1ampkcXZIeU00ClhJdnV5ckpJUDhwSTc5YjlEeWMrWFFLQmdGTXAxTkF4ZHlaV1djRjRwNm5EMlM4a2Joa3ZLemFtdk5LMGk5NkgKNEJ5dWd3VnBGMzR0ZXZCdVRzUUxOM3hWNDY0TEVKQW5QM2FJT09WOFFla3RNNFBFZ2p3UVAxa1FHY0h6VWJhdwpyYTFITldWcHVKa3VWcE4zUmdBbzk1MWRLTkV4RGRKM05UQzFrMURqOFI2K1kwQ1c5UEF5TDVLUE9acUFxTWJkCjNDeW5Bb0dBWDJiV3VoaURKTExmZVFGU3MxaVMxeEdXSDFabXVlYUZETXVqWHVHQ3d3RktwNkVtYnB4V282bHAKZi9EVHpjeEc2Nm4zWHl0d3JWVTF3WlUyR2tiN1JzaVF5amQvb0xQOHZZMEx4UkRQMTNjZWxhNHBwa3o5cXQ1Uwpndy9DaW5MZ1Erd0VVSHZYL2tCT0IwNkdTYWY2bzNUMDB0L2twcG5vV2s0cGRvMmNFVjQ9Ci0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg== --- # Source: cilium/templates/hubble/tls-helm/server-secret.yaml @@ -69,9 +69,9 @@ metadata: annotations: type: kubernetes.io/tls data: - ca.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURFekNDQWZ1Z0F3SUJBZ0lRVlpkb3h2NDVNSDh4WFVZQk9RME9MakFOQmdrcWhraUc5dzBCQVFzRkFEQVUKTVJJd0VBWURWUVFERXdsRGFXeHBkVzBnUTBFd0hoY05Nall3T0RFeU1qRXpOVFF5V2hjTk1qa3dPREV4TWpFegpOVFF5V2pBVU1SSXdFQVlEVlFRREV3bERhV3hwZFcwZ1EwRXdnZ0VpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElCCkR3QXdnZ0VLQW9JQkFRRE56RnYxUFZEaENUSlRFT01oaFZhR243YlB4M3hISnQ5bFIrRDhxck1qb1pleWZ5MmkKZkhOYXl4YUlSeVBkMzRselpCejJuRCtpMnhCM3VrcC9EYTU1aUNUSFdRdkJXVWhtRWgyaG5TM0ErUFVRdDVZRgpvZWV2a3Z0eEFLczB4YnBoR0hJNjlqTkRLZHFJYkxIOXl3UWdOdUZ1bGVZdWFMazIwd0F4dTJWVDFYZisvVklPClgrVlZTZkg0aEkveFUyT2F4OUtyYTlkQ1RkVDdWQ2M0SFVxRFF2SlMwQlJGeDNPaTFFVElUT2Vzd3kreklQNzYKL0dLamJsMWFobzB0VGJTWXJ5SWJqSzQweVF5cGcxNnAyb25Eeks4SkZFSHBnVG1VSy9FNE8zd1BIL05yVEdhTQpkV2lTVmZQbzduaE1OdFFsNXVHWFh3alJlVWhuQmdXU2l4a0xBZ01CQUFHallUQmZNQTRHQTFVZER3RUIvd1FFCkF3SUNwREFkQmdOVkhTVUVGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXcKQXdFQi96QWRCZ05WSFE0RUZnUVV3L0s4V1p4WU1YUGJLY2xRd1haZ3Y1LzZONTB3RFFZSktvWklodmNOQVFFTApCUUFEZ2dFQkFIRDNQNWt3SE1ycnQxSHM0TGlkS2UxbTJmQ2FmcVV3b1JiSC9BaWJZd1pTNVdXUzkwNXduNEplCkovejdmampOWnI5enRHZklCM0RZVDZqTWh0ejQ3ZkhQM0pzYVU3enNxL1RsME5HbDBSTXBLbnk4VFBYcHFvNUcKMWNNUTBxdFUvSGcrYWJuVUxJRDVUa25JWktDOWRZT1dVcGtGNHBBcEtXWTViUVMxZldPTGJ6ay8zbmVTVlNkRgp2MUIxZXpvNG9TZ0o4Q3RqOXdjOWtEVUMvTWdjNUNmdGgyNWVTZ1o3SytqaC9LUE1DK0VVRmJ5TEJTTGVsZi9rCmhjYzYwVUdNQ1FxNllPbWNiZjF6QitucTBHUDdXZUYrZHI5MnowS1BnWEZKQmVOU3U4WlN6dlgwbkRKdUM4QjEKSEdRS2hUWjlGWUJkN3V6bXFZZVBrT3huNytIbnB3QT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo= - tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURWekNDQWorZ0F3SUJBZ0lSQU9FVnZPc0tSQTRpM0R1akJxNlFkdHN3RFFZSktvWklodmNOQVFFTEJRQXcKRkRFU01CQUdBMVVFQXhNSlEybHNhWFZ0SUVOQk1CNFhEVEkyTURneE1qSXhNelUwTWxvWERUSTNNRGd4TWpJeApNelUwTWxvd0tqRW9NQ1lHQTFVRUF3d2ZLaTVrWldaaGRXeDBMbWgxWW1Kc1pTMW5jbkJqTG1OcGJHbDFiUzVwCmJ6Q0NBU0l3RFFZSktvWklodmNOQVFFQkJRQURnZ0VQQURDQ0FRb0NnZ0VCQU5TVVlFS1VhajZQZEZlaHF1QWIKRWpQWmJ4UmIxbDVuUTNXYkZxdDFZdThHSGJSRU1TT1k5WGFJa3Q3TGF4NHVXQXdUMGV6bVY2Vk04cTExMnM0LwovRGI5UkY3R2xVYlgxK1BaQmFCcTlDUXQrUGFNZXlKelRpbFJaUzY5VkxOL0EyRU5sQWZmaDBJdkZkeFV6cVdqCjNnNWZrTlF5ZjVZV08rQUZUWkFBaXVTRjFUN09KaEJBZEtwSlAvZVc4dVYvMzRrTlovTDFDb0xpaFhFajgxTnAKMi91SG43aU4xWjdYSHk0RzBpb1JmY214d0Z5MTBCdU5CakFxejNwR3NsTFFaU1JFbW50QTl5THc0M3RsWHZ3UApTOEEyUmJoQUZVNEs0ZlljaDBtK0Y2bEdMUVcrNDYwa2toTFk3MkVWQjdGMEFLZHNWK3BYcTJaWnFVOWdBWC9xCkdWMENBd0VBQWFPQmpUQ0JpakFPQmdOVkhROEJBZjhFQkFNQ0JhQXdIUVlEVlIwbEJCWXdGQVlJS3dZQkJRVUgKQXdFR0NDc0dBUVVGQndNQ01Bd0dBMVVkRXdFQi93UUNNQUF3SHdZRFZSMGpCQmd3Rm9BVXcvSzhXWnhZTVhQYgpLY2xRd1haZ3Y1LzZONTB3S2dZRFZSMFJCQ013SVlJZktpNWtaV1poZFd4MExtaDFZbUpzWlMxbmNuQmpMbU5wCmJHbDFiUzVwYnpBTkJna3Foa2lHOXcwQkFRc0ZBQU9DQVFFQWZEQmw5OWxWNzg1UFVqQ2VkMS9ES0k5dVljSSsKdXZlenRQRVJhNGdWelc2cEg4SkNSSEcwS1A2QW1oaEgxV2N4US84N3NWWHRyRi9YZ3VDNm1FMmxXdzY4UjBieApaRHBiZE1jRTVoM013cDkwcEJucEdMWk9SWXcrVmlkQytTY1UxZlQyZHIyMHhxS1pROW5IaGxnVTY1akRKQUowCkNEemNMVHE2ZHJZUkNPNlJDeXJQcmJrcjZRNEh3aGVjb3U3a3kxenNyRFZyMmwwNlBTbkVQM2dLUUMzdHR4RlcKOEh3cG1VdjV6MmxFVmUvajZpRmY2RlBtcWZyYTMxcWYyWG9pVkZmVXM3R05jeWZVSFk4MkR6dEMxU015Vk5aaAp6eGxseUpuQU4wQVZGSmdnYUNCcjd4a1l0MWlHS1pSbEpNUjdycTVVK3hQQjFNcGduMXkzU290aTF3PT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo= - tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb2dJQkFBS0NBUUVBMUpSZ1FwUnFQbzkwVjZHcTRCc1NNOWx2RkZ2V1htZERkWnNXcTNWaTd3WWR0RVF4Ckk1ajFkb2lTM3N0ckhpNVlEQlBSN09aWHBVenlyWFhhemovOE52MUVYc2FWUnRmWDQ5a0ZvR3IwSkMzNDlveDcKSW5OT0tWRmxMcjFVczM4RFlRMlVCOStIUWk4VjNGVE9wYVBlRGwrUTFESi9saFk3NEFWTmtBQ0s1SVhWUHM0bQpFRUIwcWtrLzk1Ynk1WC9maVExbjh2VUtndUtGY1NQelUybmIrNGVmdUkzVm50Y2ZMZ2JTS2hGOXliSEFYTFhRCkc0MEdNQ3JQZWtheVV0QmxKRVNhZTBEM0l2RGplMlZlL0E5THdEWkZ1RUFWVGdyaDloeUhTYjRYcVVZdEJiN2oKclNTU0V0anZZUlVIc1hRQXAyeFg2bGVyWmxtcFQyQUJmK29aWFFJREFRQUJBb0lCQUQwNEc3NmcwallCQng3RAplcHUrZ0EvNWdzRklyMlFSZGY1MDh1TGUwK2FGQ3VIaXI0b1NYMEpMRTR6ZzVSRFVoTnU1aTMrZldFZE04U2hlCkkreTR4WkFxZ05tUWMrWHFmQXhzYisvaVRUdnNGMklkVThxNGpSNWVCL2NkWkRxckRkU1IzZnNrZHVYcS9HOHUKNXpJUmpuM3lMSm5IanpHd1puN2QyQmZyNkJQbUpvTkxKbzZsVks1Tmx4VXhpRzdVak1nZlBwVmdUc3BQa1lEUQoxZEpaSmJQam55UGtqdXRPZVZLSnh0MUZyL21sdGVLYTk0d3dNdS9FQjlHSFVxVzlpZ2t1N2Z5MUhRLzJLSmRUCkVKYytZRlAvclhGeFBxcWlGN3FDWVNoQlRRZFVHemxYNENIVTVMeHAxR09xZmo0VFkvbGQyVFRZL24zUnBoay8KYU4vaGM5c0NnWUVBNi9xWmFKd0RTTzFaV3NNcEtnWTZrWUxrYmFZbTZnUnlIYmpVUWQzRUg0V3VHSHRJZnZLRgpnRkRCUm53anExR1NqRnloYnoybWZZYXBVbkZnT20waGRmSGs0aGFtNzJBL2EyVEZxMmhpYmlYTEljMVFwaVA3Ckptby9aVStNTi9Qeno0cy9EdmJCZDdLL3U2Z0lob3pvWUl3UDlGY1d3TkNFajI5Z1E0MXBqRThDZ1lFQTVwMk0Kd0lXMFFHRndBSU1WdWJyVXoyK1BCOG1yaENJbEVzRzJuV3FRNkhEcjdXeG82YVhJVGNJZk9vbjRXNmFoV3lETwpBMXJDc0hXWXpBZlkzamtjNkU5ZURtOHVJMzkwR3RtSGpVdUsybHMzanFheE9uRldNd3p1TlNDN0RtVFBrdHAvClJMR25KeFNubGdBMUJ6T1h4WE9yOHBQbEtIcjEwMGhZdjByKytKTUNnWUE3bVVjMWpIR244WW9ueWpLVFVvOW8KUU03QWdyNUJURzRsNDVCNE1qSmVZN3pjb2dabFNZcytKU2NyVGg4VUhiNE5oVGVnaU1tTDJuN1pPNWs2S0dYVApEQXpxclIzc1J6cTlQTzVQcEVWMzNFTzVmY2xvckoyNXpndkU0cHBmWjFXa2pWNlh3T3FMK0xGRUMrUmJWeXM1CmR5WndaNjV2ZERxR24zS0luU2FUTVFLQmdHVldDY2wzZHpOckhZbzhEOG5qWFN3aHUxb1N0am1EdjRLMGVJaEgKa1pGeVBWbkE3NERzQms2VTVLQVdqSG5KaU5IQVlvWjYxVjR3N29tSlVUU2xLQnkwODRHb1BULy8rNGJvMjNXdApJa0M5SUhhZ3JQUWZaVjlkYVRjVFFOOGNVVklZalNBa2FHejEySVpEWlFuYkUvQUIyaWJuOGlTTms0UGFJSlUrCllUZmRBb0dBU01EejBGb0dGNDBZbU1VRU9MVHRpVmMxQ1BQT21Zdks0c3ByRjQvWDh5eGYyL2luSy9UQk1sTC8KdzVhaWQ4Ym02dDhOUUErcVM5SWdNdnpTU3lFaUdmbjZsMmtDN1haWGI4UWI2SUF2SmF4ZzRLTElxN3ZIek5tegp1ZXd5YllTRWJVVjNYQVBPdlF2N0NkbGxqUWRDWHQwb3pmK2hnU0F2RjZCNTA4YkY4eUk9Ci0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg== + ca.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURFekNDQWZ1Z0F3SUJBZ0lRZWo4K0VORUJMdTBHZzZna1B1eFl5VEFOQmdrcWhraUc5dzBCQVFzRkFEQVUKTVJJd0VBWURWUVFERXdsRGFXeHBkVzBnUTBFd0hoY05Nall3T0RFeU1qSXpNREF5V2hjTk1qa3dPREV4TWpJegpNREF5V2pBVU1SSXdFQVlEVlFRREV3bERhV3hwZFcwZ1EwRXdnZ0VpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElCCkR3QXdnZ0VLQW9JQkFRRFRwSE9jNjJxM29VZ1ByRjNSRFhKY3c0WmxnRE5la1ZHc1c5TVRMdFdXS245d0tMbmUKQzZrbGxNVk5ydnVyVGptMDU3aGpDbkVkcndkOVd6YlJWNHczVXJYeWZOK0ptck04WWJyODFPMFFWcGdLQTJiTQpUQmM0OVhjcHkyUWwzSWYwaXdxMkdTek1qMjFyekZheVM2Q1Zwb1dOTVdqOWxzOFFjOFJ0eElLOG5zZ2t6cDRvCis0TmE5TkRrSldsM1NWK2NJbXJlSnVveWpSZWFlTzhNZ2J0R05NdFAwWGhweUp3ZTNSRnJWck5qV3JxcjFyMVIKLzZ6cjhrN3B1b0FyMmNaN1dkOVVuRUZqaVBNbFJZOENpdUtXTkJlYWdXV3BPaU00NTUzcFJUdmdPQmRLU3BGOQpPVE1CNXhSdldTQlNMdFVkWVVHR2ppM3pLQkJTMjBtZENrb1RBZ01CQUFHallUQmZNQTRHQTFVZER3RUIvd1FFCkF3SUNwREFkQmdOVkhTVUVGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXcKQXdFQi96QWRCZ05WSFE0RUZnUVUrMnFyZXdBejRXREptZnNBVW9MVm9wQzBXR2d3RFFZSktvWklodmNOQVFFTApCUUFEZ2dFQkFHb2xLZFljNGJ2VjR2b1RyRnNvMHF3YklBQlREc09xdU9mVURqM3NWb0VCS2hXUHQ5TUI3WVBNCnJBL2NGZTA0bTR1Zk1sT29RdDdlOWtmbVJjK2Z2VUpucFZ6aXFHQWhnZFBTVWt0eGdQOHl5Q3hLVVJVeGdPT3MKNUFoM3dWazBDdDFOY24xYVpXU3R1NDQ0SEppbko0QllESkNpQ1ZESTJaRjlQaWo5WFZlSnp5TUlUSHptSEpaSgp6MU9xV2s3aXhYZnJUYnRwTkxWekY0Z21TV1Y5cXYwNklvczVrRFVXVFZ3bUtMKzNZZ3U4elR3dk10MFl1ak5UCjROeWRaTzNVditYUnBLaTgwVE02dzlXVUIyZUtQRSs4NDVhcC8rUWZ1ZThrMzVFaVZ4NTlWWGJ0SFJuWHRBLzEKYURhLzROcmlTNVZGZjNxU0hBd2RienRta3YramtMdz0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo= + tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURWekNDQWorZ0F3SUJBZ0lSQUs1ekJsSktTQzNUcGlGRmcyNnBZbWN3RFFZSktvWklodmNOQVFFTEJRQXcKRkRFU01CQUdBMVVFQXhNSlEybHNhWFZ0SUVOQk1CNFhEVEkyTURneE1qSXlNekF3TWxvWERUSTNNRGd4TWpJeQpNekF3TWxvd0tqRW9NQ1lHQTFVRUF3d2ZLaTVrWldaaGRXeDBMbWgxWW1Kc1pTMW5jbkJqTG1OcGJHbDFiUzVwCmJ6Q0NBU0l3RFFZSktvWklodmNOQVFFQkJRQURnZ0VQQURDQ0FRb0NnZ0VCQU5NUEdPckUzR01aOGNXbUxXcGkKSVhjbkhQNnJEWTI1NFl2NW9WM3pQVU5QdzBNcFE1ZzJlK0dlL1dzdGw2T2ZoTWdlYVFaMjVaZTZLU3k1dkpvQwpqTEo3eDZaL3AxMFA2SzVWK3pBRnRTVkd2T096d29SNnQ2emtaWkpnK1dxZVZJc3REdGZXL2I3MXZpbURJTUkxCmc4dHRITTV1U1UrWEFVZlBnSngwVFJMMTQ2ZlRpU0xFN0R4emVkTWs1dHovTDZPaUlPRXN0bklyWUgyNkhNdmEKYWxzbTNMQktnK09KL001U0xDR2tVWk5TT2ROYmZuT1gvQ05uNElER2pjQnRCRG5sclpqVHVpSDhUdTdtYXpnMAp2WVJQbVRjZXdRVzJBMWlHUkhScFM5a083WkJ3RHFwTzUxSzd1VUR4QUVuajFNWnQ3ajZIblB5VVBTMFZXaUlECm4zMENBd0VBQWFPQmpUQ0JpakFPQmdOVkhROEJBZjhFQkFNQ0JhQXdIUVlEVlIwbEJCWXdGQVlJS3dZQkJRVUgKQXdFR0NDc0dBUVVGQndNQ01Bd0dBMVVkRXdFQi93UUNNQUF3SHdZRFZSMGpCQmd3Rm9BVSsycXJld0F6NFdESgptZnNBVW9MVm9wQzBXR2d3S2dZRFZSMFJCQ013SVlJZktpNWtaV1poZFd4MExtaDFZbUpzWlMxbmNuQmpMbU5wCmJHbDFiUzVwYnpBTkJna3Foa2lHOXcwQkFRc0ZBQU9DQVFFQXFsWWNNNFFtYzBsckpBb2xCbHpReisvNFJMa08KV2ZoTVR2bGFyQ0NtMUlnY3pmR1VxVG9NODU4V3MzcDgxZmZUcjlldHFIZzNEZzRWTUcrTFUxWk80d0pvYTBscApjV2Nhb1ZiSVFTSDJ3dmFJTGhqakd3aTlpR3FKYnIyUjJWdUxQMUZ2aEhyejNvR2hxMkVBV2hlOVlXZGlBM3RVCmlUTmRaWVhOdXUxZExTaWw2aEsxSkljS0lJVURhMllxUFFCNjcvRHFyN294Ri9peTF5VEpzaTV2ckdRdnlzbXAKQkg2cXptODh4bk1HTXF4OXBEUmpqN01jK2RLLzliaHplOVdUT2VxTlUzQlJNM3dIRHlDd1IxN3pXNFNQUFBDRwpVR2VEVUVXRVVVV2FUYUFnL0MrOHhhOEUvSFhZeHNVQndXQVBGM1h6QVFVY3JXYkpaN1JFNmJLRTdBPT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo= + tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb3dJQkFBS0NBUUVBMHc4WTZzVGNZeG54eGFZdGFtSWhkeWNjL3FzTmpibmhpL21oWGZNOVEwL0RReWxECm1EWjc0Wjc5YXkyWG81K0V5QjVwQm5ibGw3b3BMTG04bWdLTXNudkhwbituWFEvb3JsWDdNQVcxSlVhODQ3UEMKaEhxM3JPUmxrbUQ1YXA1VWl5ME8xOWI5dnZXK0tZTWd3aldEeTIwY3ptNUpUNWNCUjgrQW5IUk5FdlhqcDlPSgpJc1RzUEhONTB5VG0zUDh2bzZJZzRTeTJjaXRnZmJvY3k5cHFXeWJjc0VxRDQ0bjh6bElzSWFSUmsxSTUwMXQrCmM1ZjhJMmZnZ01hTndHMEVPZVd0bU5PNklmeE83dVpyT0RTOWhFK1pOeDdCQmJZRFdJWkVkR2xMMlE3dGtIQU8KcWs3blVydTVRUEVBU2VQVXhtM3VQb2VjL0pROUxSVmFJZ09mZlFJREFRQUJBb0lCQUVmSmc4MGVobU9DeUpSVQprRy8xenJJcmNKWkNjZ3E1cGJpcGdMUm03bmg5b2Ntdk9GbUdkcDVvS0lRUzd0ZnRnd2xhSnBqWFNnSlFoSDY4CjhpUmtKNXp4c3hlenBhWm1xZHJhVGVTb25GT0FldkRzRElacEF4NWdWUmZ6dWdJRXRuYmNMWWRHamVvc3hiQnkKOUdwNkwwaTY1U2hscExQWWhjdjZEU0dxQVNrb01TR29CY2VMaSt4Nno0NWEzL1dSZ1F1R0JLU09iL0VPUU1vWQpBdm80NVJVSTNvMnpUTnBsTVBBd0lvMkV5OExRaFQxNHdKeitjdEcwZldtRlpCeS9kd01nRGdJc0xUd1JxbWdqCmJvam5DSWxlcDdqOVpRTmFRVTg2R3ZLMytEZWpYZUxyc2lKRFg2SEVVZksyaVMrQnVjZWMvdzNPMmphdlBxU0EKOVBEUVVsVUNnWUVBOUllQkVmL3pPUkxoRk1QZWVJaEVuN3AycFB1Q1ZpT0IrSjZzb1JKdmhGVmU5SUs3VTJLcwpNaGJONmJJK09iUGFOTHdFQ05IVUlGbThsN0JrbURGVUxkaFBtbGFGeDhRSUI3NFhoRnhCZkUySGpESjMyaFZpClNnZCtQaGpJUStsM3RyK3VlTitGNFFmMXZWUUhSVGljajJsbHZacGUxb3dZR2trZmRUUS9ROHNDZ1lFQTNQV24KMWZmWEx4MGpJZ2pUMEFCTkc3WDF2dzAza21XVkhVOXJPdWRBNVhqZC93eG54NnBRTWpqT3krNVlEbGhsbkJQUQo1U2tOSHJxWkVaaTdNcGpsNndqeXpKZXdkS3EwdXFoYURSd3RIcS9rOGRhcXR3UmRSWGVnTnY4aVdNR3JTMTZNClR1QkhRRjRMZXRRTEtjUURFcTI1YnZWSld6YmZwVFVkUWdOUEVOY0NnWUVBd2puTExGZm5nZ0xiNHhsODRMSWsKQjljY25Bamx5ck9qYmEzaklvRTVNSng2c3E0UVNyaEtXL0svRll1dFh6bmE3UjRWK2tkb1BWWHB0WGEzUUNlVwpYRisvUXJETXpCS0o2bFJ6NjM4M3lKcndPa3h2NURvdCt1MGV1Z1lITStJQ1k1YTI1MjFyc29VWERJM3N4RytsCjgwZGRONCtoR3JybC9pTHNxTFNhTjZjQ2dZQlFFU1JVUUk3Vkg3WFBhMnQxZitaeEdDcUlwSDF5cXlTeGprbkkKK210bHU3cVY1U1RtRVMwbVJiZUo1a0E2VW9YZlhMN2hpMUtady93YmlFQ3RRUUp2ZkxxZXNJamNmYzhucEVHZApab3hqQmxIcjRHSFVGOXpFZzJpbkJTU3BET1RKVnVWNDM0UnlLcUgyVEVnUFJsdm10TlR4QkNra3lHbWFML2orCkpyekwyUUtCZ0RheDBPL0ZKcHNjVDBoV2RjZ3pVVU1iMUo1UngrQlV2eXp0SVp2ckpmdEdmRnRnUXRhZXNLaFgKS0ZwTlNXMW1yci96TmVhKzVLWnZoYTV1MWtnbVZ5YWRrR3ZZVnpkeTBWajdycTM3TXo1M01qMTJQUTZlTnhzcwo1K0NZd012WVRWR0Z1eTl5b2tDTm0zOENSZTFqSEFjanE0dFN6d2dSd3ArU2h5UDJZSFJvCi0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg== --- # Source: cilium/templates/cilium-configmap.yaml diff --git a/packages/manifests/operators/knative-serving/v1.15.0.yaml b/packages/manifests/operators/knative-serving/v1.15.0.yaml deleted file mode 100644 index 5f49d44..0000000 --- a/packages/manifests/operators/knative-serving/v1.15.0.yaml +++ /dev/null @@ -1,9926 +0,0 @@ -# Source: https://github.com/knative/serving/releases/download/knative-v1.15.0/serving-crds.yaml ---- -# Copyright 2020 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - name: certificates.networking.internal.knative.dev - labels: - app.kubernetes.io/name: knative-serving - app.kubernetes.io/component: networking - app.kubernetes.io/version: "1.15.0" - knative.dev/crd-install: "true" -spec: - group: networking.internal.knative.dev - versions: - - name: v1alpha1 - served: true - storage: true - subresources: - status: {} - schema: - openAPIV3Schema: - description: |- - Certificate is responsible for provisioning a SSL certificate for the - given hosts. It is a Knative abstraction for various SSL certificate - provisioning solutions (such as cert-manager or self-signed SSL certificate). - type: object - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: |- - Spec is the desired state of the Certificate. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status - type: object - required: - - dnsNames - - secretName - properties: - dnsNames: - description: |- - DNSNames is a list of DNS names the Certificate could support. - The wildcard format of DNSNames (e.g. *.default.example.com) is supported. - type: array - items: - type: string - domain: - description: Domain is the top level domain of the values for DNSNames. - type: string - secretName: - description: SecretName is the name of the secret resource to store the SSL certificate in. - type: string - status: - description: |- - Status is the current state of the Certificate. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status - type: object - properties: - annotations: - description: |- - Annotations is additional Status fields for the Resource to save some - additional State as well as convey more information to the user. This is - roughly akin to Annotations on any k8s resource, just the reconciler conveying - richer information outwards. - type: object - additionalProperties: - type: string - conditions: - description: Conditions the latest available observations of a resource's current state. - type: array - items: - description: |- - Condition defines a readiness condition for a Knative resource. - See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties - type: object - required: - - status - - type - properties: - lastTransitionTime: - description: |- - LastTransitionTime is the last time the condition transitioned from one status to another. - We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic - differences (all other things held constant). - type: string - message: - description: A human readable message indicating details about the transition. - type: string - reason: - description: The reason for the condition's last transition. - type: string - severity: - description: |- - Severity with which to treat failures of this type of condition. - When this is not specified, it defaults to Error. - type: string - status: - description: Status of the condition, one of True, False, Unknown. - type: string - type: - description: Type of condition. - type: string - http01Challenges: - description: |- - HTTP01Challenges is a list of HTTP01 challenges that need to be fulfilled - in order to get the TLS certificate.. - type: array - items: - description: |- - HTTP01Challenge defines the status of a HTTP01 challenge that a certificate needs - to fulfill. - type: object - properties: - serviceName: - description: ServiceName is the name of the service to serve HTTP01 challenge requests. - type: string - serviceNamespace: - description: ServiceNamespace is the namespace of the service to serve HTTP01 challenge requests. - type: string - servicePort: - description: ServicePort is the port of the service to serve HTTP01 challenge requests. - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - url: - description: URL is the URL that the HTTP01 challenge is expected to serve on. - type: string - notAfter: - description: |- - The expiration time of the TLS certificate stored in the secret named - by this resource in spec.secretName. - type: string - format: date-time - observedGeneration: - description: |- - ObservedGeneration is the 'Generation' of the Service that - was last processed by the controller. - type: integer - format: int64 - additionalPrinterColumns: - - name: Ready - type: string - jsonPath: ".status.conditions[?(@.type==\"Ready\")].status" - - name: Reason - type: string - jsonPath: ".status.conditions[?(@.type==\"Ready\")].reason" - names: - kind: Certificate - plural: certificates - singular: certificate - categories: - - knative-internal - - networking - shortNames: - - kcert - scope: Namespaced ---- -# Copyright 2019 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -# Note: The schema part of the spec is auto-generated by hack/update-schemas.sh. - -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - name: configurations.serving.knative.dev - labels: - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.15.0" - knative.dev/crd-install: "true" - duck.knative.dev/podspecable: "true" -spec: - group: serving.knative.dev - names: - kind: Configuration - plural: configurations - singular: configuration - categories: - - all - - knative - - serving - shortNames: - - config - - cfg - scope: Namespaced - versions: - - name: v1 - served: true - storage: true - subresources: - status: {} - additionalPrinterColumns: - - name: LatestCreated - type: string - jsonPath: .status.latestCreatedRevisionName - - name: LatestReady - type: string - jsonPath: .status.latestReadyRevisionName - - name: Ready - type: string - jsonPath: ".status.conditions[?(@.type=='Ready')].status" - - name: Reason - type: string - jsonPath: ".status.conditions[?(@.type=='Ready')].reason" - schema: - openAPIV3Schema: - description: |- - Configuration represents the "floating HEAD" of a linear history of Revisions. - Users create new Revisions by updating the Configuration's spec. - The "latest created" revision's name is available under status, as is the - "latest ready" revision's name. - See also: https://github.com/knative/serving/blob/main/docs/spec/overview.md#configuration - type: object - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: ConfigurationSpec holds the desired state of the Configuration (from the client). - type: object - properties: - template: - description: Template holds the latest specification for the Revision to be stamped out. - type: object - properties: - metadata: - type: object - properties: - annotations: - type: object - additionalProperties: - type: string - finalizers: - type: array - items: - type: string - labels: - type: object - additionalProperties: - type: string - name: - type: string - namespace: - type: string - x-kubernetes-preserve-unknown-fields: true - spec: - description: RevisionSpec holds the desired state of the Revision (from the client). - type: object - required: - - containers - properties: - affinity: - description: This is accessible behind a feature flag - kubernetes.podspec-affinity - type: object - x-kubernetes-preserve-unknown-fields: true - automountServiceAccountToken: - description: AutomountServiceAccountToken indicates whether a service account token should be automatically mounted. - type: boolean - containerConcurrency: - description: |- - ContainerConcurrency specifies the maximum allowed in-flight (concurrent) - requests per container of the Revision. Defaults to `0` which means - concurrency to the application is not limited, and the system decides the - target concurrency for the autoscaler. - type: integer - format: int64 - containers: - description: |- - List of containers belonging to the pod. - Containers cannot currently be added or removed. - There must be at least one container in a Pod. - Cannot be updated. - type: array - items: - description: A single application container that you want to run within a pod. - type: object - properties: - args: - description: |- - Arguments to the entrypoint. - The container image's CMD is used if this is not provided. - Variable references $(VAR_NAME) are expanded using the container's environment. If a variable - cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced - to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will - produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless - of whether the variable exists or not. Cannot be updated. - More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell - type: array - items: - type: string - command: - description: |- - Entrypoint array. Not executed within a shell. - The container image's ENTRYPOINT is used if this is not provided. - Variable references $(VAR_NAME) are expanded using the container's environment. If a variable - cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced - to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will - produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless - of whether the variable exists or not. Cannot be updated. - More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell - type: array - items: - type: string - env: - description: |- - List of environment variables to set in the container. - Cannot be updated. - type: array - items: - description: EnvVar represents an environment variable present in a Container. - type: object - required: - - name - properties: - name: - description: Name of the environment variable. Must be a C_IDENTIFIER. - type: string - value: - description: |- - Variable references $(VAR_NAME) are expanded - using the previously defined environment variables in the container and - any service environment variables. If a variable cannot be resolved, - the reference in the input string will be unchanged. Double $$ are reduced - to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. - "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". - Escaped references will never be expanded, regardless of whether the variable - exists or not. - Defaults to "". - type: string - valueFrom: - description: Source for the environment variable's value. Cannot be used if value is not empty. - type: object - properties: - configMapKeyRef: - description: Selects a key of a ConfigMap. - type: object - required: - - key - properties: - key: - description: The key to select. - type: string - name: - description: |- - Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid? - type: string - optional: - description: Specify whether the ConfigMap or its key must be defined - type: boolean - x-kubernetes-map-type: atomic - fieldRef: - description: This is accessible behind a feature flag - kubernetes.podspec-fieldref - type: object - x-kubernetes-preserve-unknown-fields: true - x-kubernetes-map-type: atomic - resourceFieldRef: - description: This is accessible behind a feature flag - kubernetes.podspec-fieldref - type: object - x-kubernetes-preserve-unknown-fields: true - x-kubernetes-map-type: atomic - secretKeyRef: - description: Selects a key of a secret in the pod's namespace - type: object - required: - - key - properties: - key: - description: The key of the secret to select from. Must be a valid secret key. - type: string - name: - description: |- - Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid? - type: string - optional: - description: Specify whether the Secret or its key must be defined - type: boolean - x-kubernetes-map-type: atomic - envFrom: - description: |- - List of sources to populate environment variables in the container. - The keys defined within a source must be a C_IDENTIFIER. All invalid keys - will be reported as an event when the container is starting. When a key exists in multiple - sources, the value associated with the last source will take precedence. - Values defined by an Env with a duplicate key will take precedence. - Cannot be updated. - type: array - items: - description: EnvFromSource represents the source of a set of ConfigMaps - type: object - properties: - configMapRef: - description: The ConfigMap to select from - type: object - properties: - name: - description: |- - Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid? - type: string - optional: - description: Specify whether the ConfigMap must be defined - type: boolean - x-kubernetes-map-type: atomic - prefix: - description: An optional identifier to prepend to each key in the ConfigMap. Must be a C_IDENTIFIER. - type: string - secretRef: - description: The Secret to select from - type: object - properties: - name: - description: |- - Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid? - type: string - optional: - description: Specify whether the Secret must be defined - type: boolean - x-kubernetes-map-type: atomic - image: - description: |- - Container image name. - More info: https://kubernetes.io/docs/concepts/containers/images - This field is optional to allow higher level config management to default or override - container images in workload controllers like Deployments and StatefulSets. - type: string - imagePullPolicy: - description: |- - Image pull policy. - One of Always, Never, IfNotPresent. - Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. - Cannot be updated. - More info: https://kubernetes.io/docs/concepts/containers/images#updating-images - type: string - livenessProbe: - description: |- - Periodic probe of container liveness. - Container will be restarted if the probe fails. - Cannot be updated. - More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes - type: object - properties: - exec: - description: Exec specifies the action to take. - type: object - properties: - command: - description: |- - Command is the command line to execute inside the container, the working directory for the - command is root ('/') in the container's filesystem. The command is simply exec'd, it is - not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use - a shell, you need to explicitly call out to that shell. - Exit status of 0 is treated as live/healthy and non-zero is unhealthy. - type: array - items: - type: string - failureThreshold: - description: |- - Minimum consecutive failures for the probe to be considered failed after having succeeded. - Defaults to 3. Minimum value is 1. - type: integer - format: int32 - grpc: - description: GRPC specifies an action involving a GRPC port. - type: object - required: - - port - properties: - port: - description: Port number of the gRPC service. Number must be in the range 1 to 65535. - type: integer - format: int32 - service: - description: |- - Service is the name of the service to place in the gRPC HealthCheckRequest - (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). - - - If this is not specified, the default behavior is defined by gRPC. - type: string - httpGet: - description: HTTPGet specifies the http request to perform. - type: object - properties: - host: - description: |- - Host name to connect to, defaults to the pod IP. You probably want to set - "Host" in httpHeaders instead. - type: string - httpHeaders: - description: Custom headers to set in the request. HTTP allows repeated headers. - type: array - items: - description: HTTPHeader describes a custom header to be used in HTTP probes - type: object - required: - - name - - value - properties: - name: - description: |- - The header field name. - This will be canonicalized upon output, so case-variant names will be understood as the same header. - type: string - value: - description: The header field value - type: string - path: - description: Path to access on the HTTP server. - type: string - port: - description: |- - Name or number of the port to access on the container. - Number must be in the range 1 to 65535. - Name must be an IANA_SVC_NAME. - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - scheme: - description: |- - Scheme to use for connecting to the host. - Defaults to HTTP. - type: string - initialDelaySeconds: - description: |- - Number of seconds after the container has started before liveness probes are initiated. - More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes - type: integer - format: int32 - periodSeconds: - description: How often (in seconds) to perform the probe. - type: integer - format: int32 - successThreshold: - description: |- - Minimum consecutive successes for the probe to be considered successful after having failed. - Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. - type: integer - format: int32 - tcpSocket: - description: TCPSocket specifies an action involving a TCP port. - type: object - properties: - host: - description: 'Optional: Host name to connect to, defaults to the pod IP.' - type: string - port: - description: |- - Number or name of the port to access on the container. - Number must be in the range 1 to 65535. - Name must be an IANA_SVC_NAME. - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - timeoutSeconds: - description: |- - Number of seconds after which the probe times out. - Defaults to 1 second. Minimum value is 1. - More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes - type: integer - format: int32 - name: - description: |- - Name of the container specified as a DNS_LABEL. - Each container in a pod must have a unique name (DNS_LABEL). - Cannot be updated. - type: string - ports: - description: |- - List of ports to expose from the container. Not specifying a port here - DOES NOT prevent that port from being exposed. Any port which is - listening on the default "0.0.0.0" address inside a container will be - accessible from the network. - Modifying this array with strategic merge patch may corrupt the data. - For more information See https://github.com/kubernetes/kubernetes/issues/108255. - Cannot be updated. - type: array - items: - description: ContainerPort represents a network port in a single container. - type: object - required: - - containerPort - properties: - containerPort: - description: |- - Number of port to expose on the pod's IP address. - This must be a valid port number, 0 < x < 65536. - type: integer - format: int32 - name: - description: |- - If specified, this must be an IANA_SVC_NAME and unique within the pod. Each - named port in a pod must have a unique name. Name for the port that can be - referred to by services. - type: string - protocol: - description: |- - Protocol for port. Must be UDP, TCP, or SCTP. - Defaults to "TCP". - type: string - default: TCP - x-kubernetes-list-map-keys: - - containerPort - - protocol - x-kubernetes-list-type: map - readinessProbe: - description: |- - Periodic probe of container service readiness. - Container will be removed from service endpoints if the probe fails. - Cannot be updated. - More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes - type: object - properties: - exec: - description: Exec specifies the action to take. - type: object - properties: - command: - description: |- - Command is the command line to execute inside the container, the working directory for the - command is root ('/') in the container's filesystem. The command is simply exec'd, it is - not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use - a shell, you need to explicitly call out to that shell. - Exit status of 0 is treated as live/healthy and non-zero is unhealthy. - type: array - items: - type: string - failureThreshold: - description: |- - Minimum consecutive failures for the probe to be considered failed after having succeeded. - Defaults to 3. Minimum value is 1. - type: integer - format: int32 - grpc: - description: GRPC specifies an action involving a GRPC port. - type: object - required: - - port - properties: - port: - description: Port number of the gRPC service. Number must be in the range 1 to 65535. - type: integer - format: int32 - service: - description: |- - Service is the name of the service to place in the gRPC HealthCheckRequest - (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). - - - If this is not specified, the default behavior is defined by gRPC. - type: string - httpGet: - description: HTTPGet specifies the http request to perform. - type: object - properties: - host: - description: |- - Host name to connect to, defaults to the pod IP. You probably want to set - "Host" in httpHeaders instead. - type: string - httpHeaders: - description: Custom headers to set in the request. HTTP allows repeated headers. - type: array - items: - description: HTTPHeader describes a custom header to be used in HTTP probes - type: object - required: - - name - - value - properties: - name: - description: |- - The header field name. - This will be canonicalized upon output, so case-variant names will be understood as the same header. - type: string - value: - description: The header field value - type: string - path: - description: Path to access on the HTTP server. - type: string - port: - description: |- - Name or number of the port to access on the container. - Number must be in the range 1 to 65535. - Name must be an IANA_SVC_NAME. - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - scheme: - description: |- - Scheme to use for connecting to the host. - Defaults to HTTP. - type: string - initialDelaySeconds: - description: |- - Number of seconds after the container has started before liveness probes are initiated. - More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes - type: integer - format: int32 - periodSeconds: - description: How often (in seconds) to perform the probe. - type: integer - format: int32 - successThreshold: - description: |- - Minimum consecutive successes for the probe to be considered successful after having failed. - Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. - type: integer - format: int32 - tcpSocket: - description: TCPSocket specifies an action involving a TCP port. - type: object - properties: - host: - description: 'Optional: Host name to connect to, defaults to the pod IP.' - type: string - port: - description: |- - Number or name of the port to access on the container. - Number must be in the range 1 to 65535. - Name must be an IANA_SVC_NAME. - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - timeoutSeconds: - description: |- - Number of seconds after which the probe times out. - Defaults to 1 second. Minimum value is 1. - More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes - type: integer - format: int32 - resources: - description: |- - Compute Resources required by this container. - Cannot be updated. - More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ - type: object - properties: - claims: - description: |- - Claims lists the names of resources, defined in spec.resourceClaims, - that are used by this container. - - - This is an alpha field and requires enabling the - DynamicResourceAllocation feature gate. - - - This field is immutable. It can only be set for containers. - type: array - items: - description: ResourceClaim references one entry in PodSpec.ResourceClaims. - type: object - required: - - name - properties: - name: - description: |- - Name must match the name of one entry in pod.spec.resourceClaims of - the Pod where this field is used. It makes that resource available - inside a container. - type: string - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - limits: - description: |- - Limits describes the maximum amount of compute resources allowed. - More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ - type: object - additionalProperties: - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - requests: - description: |- - Requests describes the minimum amount of compute resources required. - If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, - otherwise to an implementation-defined value. Requests cannot exceed Limits. - More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ - type: object - additionalProperties: - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - securityContext: - description: |- - SecurityContext defines the security options the container should be run with. - If set, the fields of SecurityContext override the equivalent fields of PodSecurityContext. - More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ - type: object - properties: - allowPrivilegeEscalation: - description: |- - AllowPrivilegeEscalation controls whether a process can gain more - privileges than its parent process. This bool directly controls if - the no_new_privs flag will be set on the container process. - AllowPrivilegeEscalation is true always when the container is: - 1) run as Privileged - 2) has CAP_SYS_ADMIN - Note that this field cannot be set when spec.os.name is windows. - type: boolean - capabilities: - description: |- - The capabilities to add/drop when running containers. - Defaults to the default set of capabilities granted by the container runtime. - Note that this field cannot be set when spec.os.name is windows. - type: object - properties: - add: - description: This is accessible behind a feature flag - kubernetes.containerspec-addcapabilities - type: array - items: - description: Capability represent POSIX capabilities type - type: string - drop: - description: Removed capabilities - type: array - items: - description: Capability represent POSIX capabilities type - type: string - readOnlyRootFilesystem: - description: |- - Whether this container has a read-only root filesystem. - Default is false. - Note that this field cannot be set when spec.os.name is windows. - type: boolean - runAsGroup: - description: |- - The GID to run the entrypoint of the container process. - Uses runtime default if unset. - May also be set in PodSecurityContext. If set in both SecurityContext and - PodSecurityContext, the value specified in SecurityContext takes precedence. - Note that this field cannot be set when spec.os.name is windows. - type: integer - format: int64 - runAsNonRoot: - description: |- - Indicates that the container must run as a non-root user. - If true, the Kubelet will validate the image at runtime to ensure that it - does not run as UID 0 (root) and fail to start the container if it does. - If unset or false, no such validation will be performed. - May also be set in PodSecurityContext. If set in both SecurityContext and - PodSecurityContext, the value specified in SecurityContext takes precedence. - type: boolean - runAsUser: - description: |- - The UID to run the entrypoint of the container process. - Defaults to user specified in image metadata if unspecified. - May also be set in PodSecurityContext. If set in both SecurityContext and - PodSecurityContext, the value specified in SecurityContext takes precedence. - Note that this field cannot be set when spec.os.name is windows. - type: integer - format: int64 - seccompProfile: - description: |- - The seccomp options to use by this container. If seccomp options are - provided at both the pod & container level, the container options - override the pod options. - Note that this field cannot be set when spec.os.name is windows. - type: object - required: - - type - properties: - localhostProfile: - description: |- - localhostProfile indicates a profile defined in a file on the node should be used. - The profile must be preconfigured on the node to work. - Must be a descending path, relative to the kubelet's configured seccomp profile location. - Must be set if type is "Localhost". Must NOT be set for any other type. - type: string - type: - description: |- - type indicates which kind of seccomp profile will be applied. - Valid options are: - - - Localhost - a profile defined in a file on the node should be used. - RuntimeDefault - the container runtime default profile should be used. - Unconfined - no profile should be applied. - type: string - startupProbe: - description: |- - StartupProbe indicates that the Pod has successfully initialized. - If specified, no other probes are executed until this completes successfully. - If this probe fails, the Pod will be restarted, just as if the livenessProbe failed. - This can be used to provide different probe parameters at the beginning of a Pod's lifecycle, - when it might take a long time to load data or warm a cache, than during steady-state operation. - This cannot be updated. - More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes - type: object - properties: - exec: - description: Exec specifies the action to take. - type: object - properties: - command: - description: |- - Command is the command line to execute inside the container, the working directory for the - command is root ('/') in the container's filesystem. The command is simply exec'd, it is - not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use - a shell, you need to explicitly call out to that shell. - Exit status of 0 is treated as live/healthy and non-zero is unhealthy. - type: array - items: - type: string - failureThreshold: - description: |- - Minimum consecutive failures for the probe to be considered failed after having succeeded. - Defaults to 3. Minimum value is 1. - type: integer - format: int32 - grpc: - description: GRPC specifies an action involving a GRPC port. - type: object - required: - - port - properties: - port: - description: Port number of the gRPC service. Number must be in the range 1 to 65535. - type: integer - format: int32 - service: - description: |- - Service is the name of the service to place in the gRPC HealthCheckRequest - (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). - - - If this is not specified, the default behavior is defined by gRPC. - type: string - httpGet: - description: HTTPGet specifies the http request to perform. - type: object - properties: - host: - description: |- - Host name to connect to, defaults to the pod IP. You probably want to set - "Host" in httpHeaders instead. - type: string - httpHeaders: - description: Custom headers to set in the request. HTTP allows repeated headers. - type: array - items: - description: HTTPHeader describes a custom header to be used in HTTP probes - type: object - required: - - name - - value - properties: - name: - description: |- - The header field name. - This will be canonicalized upon output, so case-variant names will be understood as the same header. - type: string - value: - description: The header field value - type: string - path: - description: Path to access on the HTTP server. - type: string - port: - description: |- - Name or number of the port to access on the container. - Number must be in the range 1 to 65535. - Name must be an IANA_SVC_NAME. - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - scheme: - description: |- - Scheme to use for connecting to the host. - Defaults to HTTP. - type: string - initialDelaySeconds: - description: |- - Number of seconds after the container has started before liveness probes are initiated. - More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes - type: integer - format: int32 - periodSeconds: - description: How often (in seconds) to perform the probe. - type: integer - format: int32 - successThreshold: - description: |- - Minimum consecutive successes for the probe to be considered successful after having failed. - Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. - type: integer - format: int32 - tcpSocket: - description: TCPSocket specifies an action involving a TCP port. - type: object - properties: - host: - description: 'Optional: Host name to connect to, defaults to the pod IP.' - type: string - port: - description: |- - Number or name of the port to access on the container. - Number must be in the range 1 to 65535. - Name must be an IANA_SVC_NAME. - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - timeoutSeconds: - description: |- - Number of seconds after which the probe times out. - Defaults to 1 second. Minimum value is 1. - More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes - type: integer - format: int32 - terminationMessagePath: - description: |- - Optional: Path at which the file to which the container's termination message - will be written is mounted into the container's filesystem. - Message written is intended to be brief final status, such as an assertion failure message. - Will be truncated by the node if greater than 4096 bytes. The total message length across - all containers will be limited to 12kb. - Defaults to /dev/termination-log. - Cannot be updated. - type: string - terminationMessagePolicy: - description: |- - Indicate how the termination message should be populated. File will use the contents of - terminationMessagePath to populate the container status message on both success and failure. - FallbackToLogsOnError will use the last chunk of container log output if the termination - message file is empty and the container exited with an error. - The log output is limited to 2048 bytes or 80 lines, whichever is smaller. - Defaults to File. - Cannot be updated. - type: string - volumeMounts: - description: |- - Pod volumes to mount into the container's filesystem. - Cannot be updated. - type: array - items: - description: VolumeMount describes a mounting of a Volume within a container. - type: object - required: - - mountPath - - name - properties: - mountPath: - description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. - type: string - name: - description: This must match the Name of a Volume. - type: string - readOnly: - description: |- - Mounted read-only if true, read-write otherwise (false or unspecified). - Defaults to false. - type: boolean - subPath: - description: |- - Path within the volume from which the container's volume should be mounted. - Defaults to "" (volume's root). - type: string - workingDir: - description: |- - Container's working directory. - If not specified, the container runtime's default will be used, which - might be configured in the container image. - Cannot be updated. - type: string - dnsConfig: - description: This is accessible behind a feature flag - kubernetes.podspec-dnsconfig - type: object - x-kubernetes-preserve-unknown-fields: true - dnsPolicy: - description: This is accessible behind a feature flag - kubernetes.podspec-dnspolicy - type: string - enableServiceLinks: - description: 'EnableServiceLinks indicates whether information about services should be injected into pod''s environment variables, matching the syntax of Docker links. Optional: Knative defaults this to false.' - type: boolean - hostAliases: - description: This is accessible behind a feature flag - kubernetes.podspec-hostaliases - type: array - items: - description: This is accessible behind a feature flag - kubernetes.podspec-hostaliases - type: object - x-kubernetes-preserve-unknown-fields: true - idleTimeoutSeconds: - description: |- - IdleTimeoutSeconds is the maximum duration in seconds a request will be allowed - to stay open while not receiving any bytes from the user's application. If - unspecified, a system default will be provided. - type: integer - format: int64 - imagePullSecrets: - description: |- - ImagePullSecrets is an optional list of references to secrets in the same namespace to use for pulling any of the images used by this PodSpec. - If specified, these secrets will be passed to individual puller implementations for them to use. - More info: https://kubernetes.io/docs/concepts/containers/images#specifying-imagepullsecrets-on-a-pod - type: array - items: - description: |- - LocalObjectReference contains enough information to let you locate the - referenced object inside the same namespace. - type: object - properties: - name: - description: |- - Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid? - type: string - x-kubernetes-map-type: atomic - initContainers: - description: |- - List of initialization containers belonging to the pod. - Init containers are executed in order prior to containers being started. If any - init container fails, the pod is considered to have failed and is handled according - to its restartPolicy. The name for an init container or normal container must be - unique among all containers. - Init containers may not have Lifecycle actions, Readiness probes, Liveness probes, or Startup probes. - The resourceRequirements of an init container are taken into account during scheduling - by finding the highest request/limit for each resource type, and then using the max of - of that value or the sum of the normal containers. Limits are applied to init containers - in a similar fashion. - Init containers cannot currently be added or removed. - Cannot be updated. - More info: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/ - type: array - items: - description: This is accessible behind a feature flag - kubernetes.podspec-init-containers - type: object - x-kubernetes-preserve-unknown-fields: true - nodeSelector: - description: This is accessible behind a feature flag - kubernetes.podspec-nodeselector - type: object - x-kubernetes-preserve-unknown-fields: true - x-kubernetes-map-type: atomic - priorityClassName: - description: This is accessible behind a feature flag - kubernetes.podspec-priorityclassname - type: string - x-kubernetes-preserve-unknown-fields: true - responseStartTimeoutSeconds: - description: |- - ResponseStartTimeoutSeconds is the maximum duration in seconds that the request - routing layer will wait for a request delivered to a container to begin - sending any network traffic. - type: integer - format: int64 - runtimeClassName: - description: This is accessible behind a feature flag - kubernetes.podspec-runtimeclassname - type: string - x-kubernetes-preserve-unknown-fields: true - schedulerName: - description: This is accessible behind a feature flag - kubernetes.podspec-schedulername - type: string - x-kubernetes-preserve-unknown-fields: true - securityContext: - description: This is accessible behind a feature flag - kubernetes.podspec-securitycontext - type: object - x-kubernetes-preserve-unknown-fields: true - serviceAccountName: - description: |- - ServiceAccountName is the name of the ServiceAccount to use to run this pod. - More info: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/ - type: string - shareProcessNamespace: - description: This is accessible behind a feature flag - kubernetes.podspec-shareproccessnamespace - type: boolean - x-kubernetes-preserve-unknown-fields: true - timeoutSeconds: - description: |- - TimeoutSeconds is the maximum duration in seconds that the request instance - is allowed to respond to a request. If unspecified, a system default will - be provided. - type: integer - format: int64 - tolerations: - description: This is accessible behind a feature flag - kubernetes.podspec-tolerations - type: array - items: - description: This is accessible behind a feature flag - kubernetes.podspec-tolerations - type: object - x-kubernetes-preserve-unknown-fields: true - topologySpreadConstraints: - description: This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints - type: array - items: - description: This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints - type: object - x-kubernetes-preserve-unknown-fields: true - volumes: - description: |- - List of volumes that can be mounted by containers belonging to the pod. - More info: https://kubernetes.io/docs/concepts/storage/volumes - type: array - items: - description: Volume represents a named volume in a pod that may be accessed by any container in the pod. - type: object - required: - - name - properties: - configMap: - description: configMap represents a configMap that should populate this volume - type: object - properties: - defaultMode: - description: |- - defaultMode is optional: mode bits used to set permissions on created files by default. - Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. - YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. - Defaults to 0644. - Directories within the path are not affected by this setting. - This might be in conflict with other options that affect the file - mode, like fsGroup, and the result can be other mode bits set. - type: integer - format: int32 - items: - description: |- - items if unspecified, each key-value pair in the Data field of the referenced - ConfigMap will be projected into the volume as a file whose name is the - key and content is the value. If specified, the listed keys will be - projected into the specified paths, and unlisted keys will not be - present. If a key is specified which is not present in the ConfigMap, - the volume setup will error unless it is marked optional. Paths must be - relative and may not contain the '..' path or start with '..'. - type: array - items: - description: Maps a string key to a path within a volume. - type: object - required: - - key - - path - properties: - key: - description: key is the key to project. - type: string - mode: - description: |- - mode is Optional: mode bits used to set permissions on this file. - Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. - YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. - If not specified, the volume defaultMode will be used. - This might be in conflict with other options that affect the file - mode, like fsGroup, and the result can be other mode bits set. - type: integer - format: int32 - path: - description: |- - path is the relative path of the file to map the key to. - May not be an absolute path. - May not contain the path element '..'. - May not start with the string '..'. - type: string - name: - description: |- - Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid? - type: string - optional: - description: optional specify whether the ConfigMap or its keys must be defined - type: boolean - x-kubernetes-map-type: atomic - emptyDir: - description: This is accessible behind a feature flag - kubernetes.podspec-emptydir - type: object - x-kubernetes-preserve-unknown-fields: true - name: - description: |- - name of the volume. - Must be a DNS_LABEL and unique within the pod. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - persistentVolumeClaim: - description: This is accessible behind a feature flag - kubernetes.podspec-persistent-volume-claim - type: object - x-kubernetes-preserve-unknown-fields: true - projected: - description: projected items for all in one resources secrets, configmaps, and downward API - type: object - properties: - defaultMode: - description: |- - defaultMode are the mode bits used to set permissions on created files by default. - Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. - YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. - Directories within the path are not affected by this setting. - This might be in conflict with other options that affect the file - mode, like fsGroup, and the result can be other mode bits set. - type: integer - format: int32 - sources: - description: sources is the list of volume projections - type: array - items: - description: Projection that may be projected along with other supported volume types - type: object - properties: - configMap: - description: configMap information about the configMap data to project - type: object - properties: - items: - description: |- - items if unspecified, each key-value pair in the Data field of the referenced - ConfigMap will be projected into the volume as a file whose name is the - key and content is the value. If specified, the listed keys will be - projected into the specified paths, and unlisted keys will not be - present. If a key is specified which is not present in the ConfigMap, - the volume setup will error unless it is marked optional. Paths must be - relative and may not contain the '..' path or start with '..'. - type: array - items: - description: Maps a string key to a path within a volume. - type: object - required: - - key - - path - properties: - key: - description: key is the key to project. - type: string - mode: - description: |- - mode is Optional: mode bits used to set permissions on this file. - Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. - YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. - If not specified, the volume defaultMode will be used. - This might be in conflict with other options that affect the file - mode, like fsGroup, and the result can be other mode bits set. - type: integer - format: int32 - path: - description: |- - path is the relative path of the file to map the key to. - May not be an absolute path. - May not contain the path element '..'. - May not start with the string '..'. - type: string - name: - description: |- - Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid? - type: string - optional: - description: optional specify whether the ConfigMap or its keys must be defined - type: boolean - x-kubernetes-map-type: atomic - downwardAPI: - description: downwardAPI information about the downwardAPI data to project - type: object - properties: - items: - description: Items is a list of DownwardAPIVolume file - type: array - items: - description: DownwardAPIVolumeFile represents information to create the file containing the pod field - type: object - required: - - path - properties: - fieldRef: - description: 'Required: Selects a field of the pod: only annotations, labels, name and namespace are supported.' - type: object - required: - - fieldPath - properties: - apiVersion: - description: Version of the schema the FieldPath is written in terms of, defaults to "v1". - type: string - fieldPath: - description: Path of the field to select in the specified API version. - type: string - x-kubernetes-map-type: atomic - mode: - description: |- - Optional: mode bits used to set permissions on this file, must be an octal value - between 0000 and 0777 or a decimal value between 0 and 511. - YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. - If not specified, the volume defaultMode will be used. - This might be in conflict with other options that affect the file - mode, like fsGroup, and the result can be other mode bits set. - type: integer - format: int32 - path: - description: 'Required: Path is the relative path name of the file to be created. Must not be absolute or contain the ''..'' path. Must be utf-8 encoded. The first item of the relative path must not start with ''..''' - type: string - resourceFieldRef: - description: |- - Selects a resource of the container: only resources limits and requests - (limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported. - type: object - required: - - resource - properties: - containerName: - description: 'Container name: required for volumes, optional for env vars' - type: string - divisor: - description: Specifies the output format of the exposed resources, defaults to "1" - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - resource: - description: 'Required: resource to select' - type: string - x-kubernetes-map-type: atomic - secret: - description: secret information about the secret data to project - type: object - properties: - items: - description: |- - items if unspecified, each key-value pair in the Data field of the referenced - Secret will be projected into the volume as a file whose name is the - key and content is the value. If specified, the listed keys will be - projected into the specified paths, and unlisted keys will not be - present. If a key is specified which is not present in the Secret, - the volume setup will error unless it is marked optional. Paths must be - relative and may not contain the '..' path or start with '..'. - type: array - items: - description: Maps a string key to a path within a volume. - type: object - required: - - key - - path - properties: - key: - description: key is the key to project. - type: string - mode: - description: |- - mode is Optional: mode bits used to set permissions on this file. - Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. - YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. - If not specified, the volume defaultMode will be used. - This might be in conflict with other options that affect the file - mode, like fsGroup, and the result can be other mode bits set. - type: integer - format: int32 - path: - description: |- - path is the relative path of the file to map the key to. - May not be an absolute path. - May not contain the path element '..'. - May not start with the string '..'. - type: string - name: - description: |- - Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid? - type: string - optional: - description: optional field specify whether the Secret or its key must be defined - type: boolean - x-kubernetes-map-type: atomic - serviceAccountToken: - description: serviceAccountToken is information about the serviceAccountToken data to project - type: object - required: - - path - properties: - audience: - description: |- - audience is the intended audience of the token. A recipient of a token - must identify itself with an identifier specified in the audience of the - token, and otherwise should reject the token. The audience defaults to the - identifier of the apiserver. - type: string - expirationSeconds: - description: |- - expirationSeconds is the requested duration of validity of the service - account token. As the token approaches expiration, the kubelet volume - plugin will proactively rotate the service account token. The kubelet will - start trying to rotate the token if the token is older than 80 percent of - its time to live or if the token is older than 24 hours.Defaults to 1 hour - and must be at least 10 minutes. - type: integer - format: int64 - path: - description: |- - path is the path relative to the mount point of the file to project the - token into. - type: string - secret: - description: |- - secret represents a secret that should populate this volume. - More info: https://kubernetes.io/docs/concepts/storage/volumes#secret - type: object - properties: - defaultMode: - description: |- - defaultMode is Optional: mode bits used to set permissions on created files by default. - Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. - YAML accepts both octal and decimal values, JSON requires decimal values - for mode bits. Defaults to 0644. - Directories within the path are not affected by this setting. - This might be in conflict with other options that affect the file - mode, like fsGroup, and the result can be other mode bits set. - type: integer - format: int32 - items: - description: |- - items If unspecified, each key-value pair in the Data field of the referenced - Secret will be projected into the volume as a file whose name is the - key and content is the value. If specified, the listed keys will be - projected into the specified paths, and unlisted keys will not be - present. If a key is specified which is not present in the Secret, - the volume setup will error unless it is marked optional. Paths must be - relative and may not contain the '..' path or start with '..'. - type: array - items: - description: Maps a string key to a path within a volume. - type: object - required: - - key - - path - properties: - key: - description: key is the key to project. - type: string - mode: - description: |- - mode is Optional: mode bits used to set permissions on this file. - Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. - YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. - If not specified, the volume defaultMode will be used. - This might be in conflict with other options that affect the file - mode, like fsGroup, and the result can be other mode bits set. - type: integer - format: int32 - path: - description: |- - path is the relative path of the file to map the key to. - May not be an absolute path. - May not contain the path element '..'. - May not start with the string '..'. - type: string - optional: - description: optional field specify whether the Secret or its keys must be defined - type: boolean - secretName: - description: |- - secretName is the name of the secret in the pod's namespace to use. - More info: https://kubernetes.io/docs/concepts/storage/volumes#secret - type: string - status: - description: ConfigurationStatus communicates the observed state of the Configuration (from the controller). - type: object - properties: - annotations: - description: |- - Annotations is additional Status fields for the Resource to save some - additional State as well as convey more information to the user. This is - roughly akin to Annotations on any k8s resource, just the reconciler conveying - richer information outwards. - type: object - additionalProperties: - type: string - conditions: - description: Conditions the latest available observations of a resource's current state. - type: array - items: - description: |- - Condition defines a readiness condition for a Knative resource. - See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties - type: object - required: - - status - - type - properties: - lastTransitionTime: - description: |- - LastTransitionTime is the last time the condition transitioned from one status to another. - We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic - differences (all other things held constant). - type: string - message: - description: A human readable message indicating details about the transition. - type: string - reason: - description: The reason for the condition's last transition. - type: string - severity: - description: |- - Severity with which to treat failures of this type of condition. - When this is not specified, it defaults to Error. - type: string - status: - description: Status of the condition, one of True, False, Unknown. - type: string - type: - description: Type of condition. - type: string - latestCreatedRevisionName: - description: |- - LatestCreatedRevisionName is the last revision that was created from this - Configuration. It might not be ready yet, for that use LatestReadyRevisionName. - type: string - latestReadyRevisionName: - description: |- - LatestReadyRevisionName holds the name of the latest Revision stamped out - from this Configuration that has had its "Ready" condition become "True". - type: string - observedGeneration: - description: |- - ObservedGeneration is the 'Generation' of the Service that - was last processed by the controller. - type: integer - format: int64 ---- -# Copyright 2020 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - name: clusterdomainclaims.networking.internal.knative.dev - labels: - app.kubernetes.io/name: knative-serving - app.kubernetes.io/component: networking - app.kubernetes.io/version: "1.15.0" - knative.dev/crd-install: "true" -spec: - group: networking.internal.knative.dev - versions: - - name: v1alpha1 - served: true - storage: true - subresources: - status: {} - schema: - openAPIV3Schema: - description: ClusterDomainClaim is a cluster-wide reservation for a particular domain name. - type: object - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: |- - Spec is the desired state of the ClusterDomainClaim. - More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status - type: object - required: - - namespace - properties: - namespace: - description: |- - Namespace is the namespace which is allowed to create a DomainMapping - using this ClusterDomainClaim's name. - type: string - names: - kind: ClusterDomainClaim - plural: clusterdomainclaims - singular: clusterdomainclaim - categories: - - knative-internal - - networking - shortNames: - - cdc - scope: Cluster ---- -# Copyright 2020 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - name: domainmappings.serving.knative.dev - labels: - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.15.0" - knative.dev/crd-install: "true" -spec: - group: serving.knative.dev - versions: - - name: v1beta1 - served: true - storage: true - subresources: - status: {} - additionalPrinterColumns: - - name: URL - type: string - jsonPath: .status.url - - name: Ready - type: string - jsonPath: ".status.conditions[?(@.type=='Ready')].status" - - name: Reason - type: string - jsonPath: ".status.conditions[?(@.type=='Ready')].reason" - "schema": - "openAPIV3Schema": - description: DomainMapping is a mapping from a custom hostname to an Addressable. - type: object - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: |- - Spec is the desired state of the DomainMapping. - More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status - type: object - required: - - ref - properties: - ref: - description: |- - Ref specifies the target of the Domain Mapping. - - - The object identified by the Ref must be an Addressable with a URL of the - form `{name}.{namespace}.{domain}` where `{domain}` is the cluster domain, - and `{name}` and `{namespace}` are the name and namespace of a Kubernetes - Service. - - - This contract is satisfied by Knative types such as Knative Services and - Knative Routes, and by Kubernetes Services. - type: object - required: - - kind - - name - properties: - address: - description: Address points to a specific Address Name. - type: string - apiVersion: - description: API version of the referent. - type: string - group: - description: |- - Group of the API, without the version of the group. This can be used as an alternative to the APIVersion, and then resolved using ResolveGroup. - Note: This API is EXPERIMENTAL and might break anytime. For more details: https://github.com/knative/eventing/issues/5086 - type: string - kind: - description: |- - Kind of the referent. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - name: - description: |- - Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - namespace: - description: |- - Namespace of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ - This is optional field, it gets defaulted to the object holding it if left out. - type: string - tls: - description: TLS allows the DomainMapping to terminate TLS traffic with an existing secret. - type: object - required: - - secretName - properties: - secretName: - description: SecretName is the name of the existing secret used to terminate TLS traffic. - type: string - status: - description: |- - Status is the current state of the DomainMapping. - More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status - type: object - properties: - address: - description: Address holds the information needed for a DomainMapping to be the target of an event. - type: object - properties: - CACerts: - description: |- - CACerts is the Certification Authority (CA) certificates in PEM format - according to https://www.rfc-editor.org/rfc/rfc7468. - type: string - audience: - description: Audience is the OIDC audience for this address. - type: string - name: - description: Name is the name of the address. - type: string - url: - type: string - annotations: - description: |- - Annotations is additional Status fields for the Resource to save some - additional State as well as convey more information to the user. This is - roughly akin to Annotations on any k8s resource, just the reconciler conveying - richer information outwards. - type: object - additionalProperties: - type: string - conditions: - description: Conditions the latest available observations of a resource's current state. - type: array - items: - description: |- - Condition defines a readiness condition for a Knative resource. - See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties - type: object - required: - - status - - type - properties: - lastTransitionTime: - description: |- - LastTransitionTime is the last time the condition transitioned from one status to another. - We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic - differences (all other things held constant). - type: string - message: - description: A human readable message indicating details about the transition. - type: string - reason: - description: The reason for the condition's last transition. - type: string - severity: - description: |- - Severity with which to treat failures of this type of condition. - When this is not specified, it defaults to Error. - type: string - status: - description: Status of the condition, one of True, False, Unknown. - type: string - type: - description: Type of condition. - type: string - observedGeneration: - description: |- - ObservedGeneration is the 'Generation' of the Service that - was last processed by the controller. - type: integer - format: int64 - url: - description: URL is the URL of this DomainMapping. - type: string - names: - kind: DomainMapping - plural: domainmappings - singular: domainmapping - categories: - - all - - knative - - serving - shortNames: - - dm - scope: Namespaced ---- -# Copyright 2020 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - name: ingresses.networking.internal.knative.dev - labels: - app.kubernetes.io/name: knative-serving - app.kubernetes.io/component: networking - app.kubernetes.io/version: "1.15.0" - knative.dev/crd-install: "true" -spec: - group: networking.internal.knative.dev - versions: - - name: v1alpha1 - served: true - storage: true - subresources: - status: {} - schema: - openAPIV3Schema: - description: |- - Ingress is a collection of rules that allow inbound connections to reach the endpoints defined - by a backend. An Ingress can be configured to give services externally-reachable URLs, load - balance traffic, offer name based virtual hosting, etc. - - - This is heavily based on K8s Ingress https://godoc.org/k8s.io/api/networking/v1beta1#Ingress - which some highlighted modifications. - type: object - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: |- - Spec is the desired state of the Ingress. - More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status - type: object - properties: - httpOption: - description: |- - HTTPOption is the option of HTTP. It has the following two values: - `HTTPOptionEnabled`, `HTTPOptionRedirected` - type: string - rules: - description: A list of host rules used to configure the Ingress. - type: array - items: - description: |- - IngressRule represents the rules mapping the paths under a specified host to - the related backend services. Incoming requests are first evaluated for a host - match, then routed to the backend associated with the matching IngressRuleValue. - type: object - properties: - hosts: - description: |- - Host is the fully qualified domain name of a network host, as defined - by RFC 3986. Note the following deviations from the "host" part of the - URI as defined in the RFC: - 1. IPs are not allowed. Currently a rule value can only apply to the - IP in the Spec of the parent . - 2. The `:` delimiter is not respected because ports are not allowed. - Currently the port of an Ingress is implicitly :80 for http and - :443 for https. - Both these may change in the future. - If the host is unspecified, the Ingress routes all traffic based on the - specified IngressRuleValue. - If multiple matching Hosts were provided, the first rule will take precedent. - type: array - items: - type: string - http: - description: |- - HTTP represents a rule to apply against incoming requests. If the - rule is satisfied, the request is routed to the specified backend. - type: object - required: - - paths - properties: - paths: - description: |- - A collection of paths that map requests to backends. - - - If they are multiple matching paths, the first match takes precedence. - type: array - items: - description: |- - HTTPIngressPath associates a path regex with a backend. Incoming URLs matching - the path are forwarded to the backend. - type: object - required: - - splits - properties: - appendHeaders: - description: |- - AppendHeaders allow specifying additional HTTP headers to add - before forwarding a request to the destination service. - - - NOTE: This differs from K8s Ingress which doesn't allow header appending. - type: object - additionalProperties: - type: string - headers: - description: |- - Headers defines header matching rules which is a map from a header name - to HeaderMatch which specify a matching condition. - When a request matched with all the header matching rules, - the request is routed by the corresponding ingress rule. - If it is empty, the headers are not used for matching - type: object - additionalProperties: - description: |- - HeaderMatch represents a matching value of Headers in HTTPIngressPath. - Currently, only the exact matching is supported. - type: object - required: - - exact - properties: - exact: - type: string - path: - description: |- - Path represents a literal prefix to which this rule should apply. - Currently it can contain characters disallowed from the conventional - "path" part of a URL as defined by RFC 3986. Paths must begin with - a '/'. If unspecified, the path defaults to a catch all sending - traffic to the backend. - type: string - rewriteHost: - description: |- - RewriteHost rewrites the incoming request's host header. - - - This field is currently experimental and not supported by all Ingress - implementations. - type: string - splits: - description: |- - Splits defines the referenced service endpoints to which the traffic - will be forwarded to. - type: array - items: - description: IngressBackendSplit describes all endpoints for a given service and port. - type: object - required: - - serviceName - - serviceNamespace - - servicePort - properties: - appendHeaders: - description: |- - AppendHeaders allow specifying additional HTTP headers to add - before forwarding a request to the destination service. - - - NOTE: This differs from K8s Ingress which doesn't allow header appending. - type: object - additionalProperties: - type: string - percent: - description: |- - Specifies the split percentage, a number between 0 and 100. If - only one split is specified, we default to 100. - - - NOTE: This differs from K8s Ingress to allow percentage split. - type: integer - serviceName: - description: Specifies the name of the referenced service. - type: string - serviceNamespace: - description: |- - Specifies the namespace of the referenced service. - - - NOTE: This differs from K8s Ingress to allow routing to different namespaces. - type: string - servicePort: - description: Specifies the port of the referenced service. - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - visibility: - description: |- - Visibility signifies whether this rule should `ClusterLocal`. If it's not - specified then it defaults to `ExternalIP`. - type: string - tls: - description: |- - TLS configuration. Currently Ingress only supports a single TLS - port: 443. If multiple members of this list specify different hosts, they - will be multiplexed on the same port according to the hostname specified - through the SNI TLS extension, if the ingress controller fulfilling the - ingress supports SNI. - type: array - items: - description: IngressTLS describes the transport layer security associated with an Ingress. - type: object - properties: - hosts: - description: |- - Hosts is a list of hosts included in the TLS certificate. The values in - this list must match the name/s used in the tlsSecret. Defaults to the - wildcard host setting for the loadbalancer controller fulfilling this - Ingress, if left unspecified. - type: array - items: - type: string - secretName: - description: SecretName is the name of the secret used to terminate SSL traffic. - type: string - secretNamespace: - description: |- - SecretNamespace is the namespace of the secret used to terminate SSL traffic. - If not set the namespace should be assumed to be the same as the Ingress. - If set the secret should have the same namespace as the Ingress otherwise - the behaviour is undefined and not supported. - type: string - status: - description: |- - Status is the current state of the Ingress. - More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status - type: object - properties: - annotations: - description: |- - Annotations is additional Status fields for the Resource to save some - additional State as well as convey more information to the user. This is - roughly akin to Annotations on any k8s resource, just the reconciler conveying - richer information outwards. - type: object - additionalProperties: - type: string - conditions: - description: Conditions the latest available observations of a resource's current state. - type: array - items: - description: |- - Condition defines a readiness condition for a Knative resource. - See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties - type: object - required: - - status - - type - properties: - lastTransitionTime: - description: |- - LastTransitionTime is the last time the condition transitioned from one status to another. - We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic - differences (all other things held constant). - type: string - message: - description: A human readable message indicating details about the transition. - type: string - reason: - description: The reason for the condition's last transition. - type: string - severity: - description: |- - Severity with which to treat failures of this type of condition. - When this is not specified, it defaults to Error. - type: string - status: - description: Status of the condition, one of True, False, Unknown. - type: string - type: - description: Type of condition. - type: string - observedGeneration: - description: |- - ObservedGeneration is the 'Generation' of the Service that - was last processed by the controller. - type: integer - format: int64 - privateLoadBalancer: - description: PrivateLoadBalancer contains the current status of the load-balancer. - type: object - properties: - ingress: - description: |- - Ingress is a list containing ingress points for the load-balancer. - Traffic intended for the service should be sent to these ingress points. - type: array - items: - description: |- - LoadBalancerIngressStatus represents the status of a load-balancer ingress point: - traffic intended for the service should be sent to an ingress point. - type: object - properties: - domain: - description: |- - Domain is set for load-balancer ingress points that are DNS based - (typically AWS load-balancers) - type: string - domainInternal: - description: |- - DomainInternal is set if there is a cluster-local DNS name to access the Ingress. - - - NOTE: This differs from K8s Ingress, since we also desire to have a cluster-local - DNS name to allow routing in case of not having a mesh. - type: string - ip: - description: |- - IP is set for load-balancer ingress points that are IP based - (typically GCE or OpenStack load-balancers) - type: string - meshOnly: - description: MeshOnly is set if the Ingress is only load-balanced through a Service mesh. - type: boolean - publicLoadBalancer: - description: PublicLoadBalancer contains the current status of the load-balancer. - type: object - properties: - ingress: - description: |- - Ingress is a list containing ingress points for the load-balancer. - Traffic intended for the service should be sent to these ingress points. - type: array - items: - description: |- - LoadBalancerIngressStatus represents the status of a load-balancer ingress point: - traffic intended for the service should be sent to an ingress point. - type: object - properties: - domain: - description: |- - Domain is set for load-balancer ingress points that are DNS based - (typically AWS load-balancers) - type: string - domainInternal: - description: |- - DomainInternal is set if there is a cluster-local DNS name to access the Ingress. - - - NOTE: This differs from K8s Ingress, since we also desire to have a cluster-local - DNS name to allow routing in case of not having a mesh. - type: string - ip: - description: |- - IP is set for load-balancer ingress points that are IP based - (typically GCE or OpenStack load-balancers) - type: string - meshOnly: - description: MeshOnly is set if the Ingress is only load-balanced through a Service mesh. - type: boolean - additionalPrinterColumns: - - name: Ready - type: string - jsonPath: ".status.conditions[?(@.type=='Ready')].status" - - name: Reason - type: string - jsonPath: ".status.conditions[?(@.type=='Ready')].reason" - names: - kind: Ingress - plural: ingresses - singular: ingress - categories: - - knative-internal - - networking - shortNames: - - kingress - - king - scope: Namespaced ---- -# Copyright 2019 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -# Note: The schema part of the spec is auto-generated by hack/update-schemas.sh. - -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - name: metrics.autoscaling.internal.knative.dev - labels: - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.15.0" - knative.dev/crd-install: "true" -spec: - group: autoscaling.internal.knative.dev - names: - kind: Metric - plural: metrics - singular: metric - categories: - - knative-internal - - autoscaling - scope: Namespaced - versions: - - name: v1alpha1 - served: true - storage: true - subresources: - status: {} - additionalPrinterColumns: - - name: Ready - type: string - jsonPath: ".status.conditions[?(@.type=='Ready')].status" - - name: Reason - type: string - jsonPath: ".status.conditions[?(@.type=='Ready')].reason" - schema: - openAPIV3Schema: - description: Metric represents a resource to configure the metric collector with. - type: object - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: Spec holds the desired state of the Metric (from the client). - type: object - required: - - panicWindow - - scrapeTarget - - stableWindow - properties: - panicWindow: - description: PanicWindow is the aggregation window for metrics where quick reactions are needed. - type: integer - format: int64 - scrapeTarget: - description: ScrapeTarget is the K8s service that publishes the metric endpoint. - type: string - stableWindow: - description: StableWindow is the aggregation window for metrics in a stable state. - type: integer - format: int64 - status: - description: Status communicates the observed state of the Metric (from the controller). - type: object - properties: - annotations: - description: |- - Annotations is additional Status fields for the Resource to save some - additional State as well as convey more information to the user. This is - roughly akin to Annotations on any k8s resource, just the reconciler conveying - richer information outwards. - type: object - additionalProperties: - type: string - conditions: - description: Conditions the latest available observations of a resource's current state. - type: array - items: - description: |- - Condition defines a readiness condition for a Knative resource. - See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties - type: object - required: - - status - - type - properties: - lastTransitionTime: - description: |- - LastTransitionTime is the last time the condition transitioned from one status to another. - We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic - differences (all other things held constant). - type: string - message: - description: A human readable message indicating details about the transition. - type: string - reason: - description: The reason for the condition's last transition. - type: string - severity: - description: |- - Severity with which to treat failures of this type of condition. - When this is not specified, it defaults to Error. - type: string - status: - description: Status of the condition, one of True, False, Unknown. - type: string - type: - description: Type of condition. - type: string - observedGeneration: - description: |- - ObservedGeneration is the 'Generation' of the Service that - was last processed by the controller. - type: integer - format: int64 ---- -# Copyright 2018 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -# Note: The schema part of the spec is auto-generated by hack/update-schemas.sh. - -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - name: podautoscalers.autoscaling.internal.knative.dev - labels: - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.15.0" - knative.dev/crd-install: "true" -spec: - group: autoscaling.internal.knative.dev - names: - kind: PodAutoscaler - plural: podautoscalers - singular: podautoscaler - categories: - - knative-internal - - autoscaling - shortNames: - - kpa - - pa - scope: Namespaced - versions: - - name: v1alpha1 - served: true - storage: true - subresources: - status: {} - additionalPrinterColumns: - - name: DesiredScale - type: integer - jsonPath: ".status.desiredScale" - - name: ActualScale - type: integer - jsonPath: ".status.actualScale" - - name: Ready - type: string - jsonPath: ".status.conditions[?(@.type=='Ready')].status" - - name: Reason - type: string - jsonPath: ".status.conditions[?(@.type=='Ready')].reason" - schema: - openAPIV3Schema: - description: |- - PodAutoscaler is a Knative abstraction that encapsulates the interface by which Knative - components instantiate autoscalers. This definition is an abstraction that may be backed - by multiple definitions. For more information, see the Knative Pluggability presentation: - https://docs.google.com/presentation/d/19vW9HFZ6Puxt31biNZF3uLRejDmu82rxJIk1cWmxF7w/edit - type: object - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: Spec holds the desired state of the PodAutoscaler (from the client). - type: object - required: - - protocolType - - scaleTargetRef - properties: - containerConcurrency: - description: |- - ContainerConcurrency specifies the maximum allowed - in-flight (concurrent) requests per container of the Revision. - Defaults to `0` which means unlimited concurrency. - type: integer - format: int64 - protocolType: - description: The application-layer protocol. Matches `ProtocolType` inferred from the revision spec. - type: string - reachability: - description: |- - Reachability specifies whether or not the `ScaleTargetRef` can be reached (ie. has a route). - Defaults to `ReachabilityUnknown` - type: string - scaleTargetRef: - description: |- - ScaleTargetRef defines the /scale-able resource that this PodAutoscaler - is responsible for quickly right-sizing. - type: object - properties: - apiVersion: - description: API version of the referent. - type: string - kind: - description: |- - Kind of the referent. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - name: - description: |- - Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - x-kubernetes-map-type: atomic - status: - description: Status communicates the observed state of the PodAutoscaler (from the controller). - type: object - required: - - metricsServiceName - - serviceName - properties: - actualScale: - description: ActualScale shows the actual number of replicas for the revision. - type: integer - format: int32 - annotations: - description: |- - Annotations is additional Status fields for the Resource to save some - additional State as well as convey more information to the user. This is - roughly akin to Annotations on any k8s resource, just the reconciler conveying - richer information outwards. - type: object - additionalProperties: - type: string - conditions: - description: Conditions the latest available observations of a resource's current state. - type: array - items: - description: |- - Condition defines a readiness condition for a Knative resource. - See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties - type: object - required: - - status - - type - properties: - lastTransitionTime: - description: |- - LastTransitionTime is the last time the condition transitioned from one status to another. - We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic - differences (all other things held constant). - type: string - message: - description: A human readable message indicating details about the transition. - type: string - reason: - description: The reason for the condition's last transition. - type: string - severity: - description: |- - Severity with which to treat failures of this type of condition. - When this is not specified, it defaults to Error. - type: string - status: - description: Status of the condition, one of True, False, Unknown. - type: string - type: - description: Type of condition. - type: string - desiredScale: - description: DesiredScale shows the current desired number of replicas for the revision. - type: integer - format: int32 - metricsServiceName: - description: |- - MetricsServiceName is the K8s Service name that provides revision metrics. - The service is managed by the PA object. - type: string - observedGeneration: - description: |- - ObservedGeneration is the 'Generation' of the Service that - was last processed by the controller. - type: integer - format: int64 - serviceName: - description: |- - ServiceName is the K8s Service name that serves the revision, scaled by this PA. - The service is created and owned by the ServerlessService object owned by this PA. - type: string ---- -# Copyright 2019 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -# Note: The schema part of the spec is auto-generated by hack/update-schemas.sh. - -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - name: revisions.serving.knative.dev - labels: - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.15.0" - knative.dev/crd-install: "true" -spec: - group: serving.knative.dev - names: - kind: Revision - plural: revisions - singular: revision - categories: - - all - - knative - - serving - shortNames: - - rev - scope: Namespaced - versions: - - name: v1 - served: true - storage: true - subresources: - status: {} - additionalPrinterColumns: - - name: Config Name - type: string - jsonPath: ".metadata.labels['serving\\.knative\\.dev/configuration']" - - name: Generation - type: string # int in string form :( - jsonPath: ".metadata.labels['serving\\.knative\\.dev/configurationGeneration']" - - name: Ready - type: string - jsonPath: ".status.conditions[?(@.type=='Ready')].status" - - name: Reason - type: string - jsonPath: ".status.conditions[?(@.type=='Ready')].reason" - - name: Actual Replicas - type: integer - jsonPath: ".status.actualReplicas" - - name: Desired Replicas - type: integer - jsonPath: ".status.desiredReplicas" - schema: - openAPIV3Schema: - description: |- - Revision is an immutable snapshot of code and configuration. A revision - references a container image. Revisions are created by updates to a - Configuration. - - - See also: https://github.com/knative/serving/blob/main/docs/spec/overview.md#revision - type: object - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: RevisionSpec holds the desired state of the Revision (from the client). - type: object - required: - - containers - properties: - affinity: - description: This is accessible behind a feature flag - kubernetes.podspec-affinity - type: object - x-kubernetes-preserve-unknown-fields: true - automountServiceAccountToken: - description: AutomountServiceAccountToken indicates whether a service account token should be automatically mounted. - type: boolean - containerConcurrency: - description: |- - ContainerConcurrency specifies the maximum allowed in-flight (concurrent) - requests per container of the Revision. Defaults to `0` which means - concurrency to the application is not limited, and the system decides the - target concurrency for the autoscaler. - type: integer - format: int64 - containers: - description: |- - List of containers belonging to the pod. - Containers cannot currently be added or removed. - There must be at least one container in a Pod. - Cannot be updated. - type: array - items: - description: A single application container that you want to run within a pod. - type: object - properties: - args: - description: |- - Arguments to the entrypoint. - The container image's CMD is used if this is not provided. - Variable references $(VAR_NAME) are expanded using the container's environment. If a variable - cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced - to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will - produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless - of whether the variable exists or not. Cannot be updated. - More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell - type: array - items: - type: string - command: - description: |- - Entrypoint array. Not executed within a shell. - The container image's ENTRYPOINT is used if this is not provided. - Variable references $(VAR_NAME) are expanded using the container's environment. If a variable - cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced - to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will - produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless - of whether the variable exists or not. Cannot be updated. - More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell - type: array - items: - type: string - env: - description: |- - List of environment variables to set in the container. - Cannot be updated. - type: array - items: - description: EnvVar represents an environment variable present in a Container. - type: object - required: - - name - properties: - name: - description: Name of the environment variable. Must be a C_IDENTIFIER. - type: string - value: - description: |- - Variable references $(VAR_NAME) are expanded - using the previously defined environment variables in the container and - any service environment variables. If a variable cannot be resolved, - the reference in the input string will be unchanged. Double $$ are reduced - to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. - "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". - Escaped references will never be expanded, regardless of whether the variable - exists or not. - Defaults to "". - type: string - valueFrom: - description: Source for the environment variable's value. Cannot be used if value is not empty. - type: object - properties: - configMapKeyRef: - description: Selects a key of a ConfigMap. - type: object - required: - - key - properties: - key: - description: The key to select. - type: string - name: - description: |- - Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid? - type: string - optional: - description: Specify whether the ConfigMap or its key must be defined - type: boolean - x-kubernetes-map-type: atomic - fieldRef: - description: This is accessible behind a feature flag - kubernetes.podspec-fieldref - type: object - x-kubernetes-preserve-unknown-fields: true - x-kubernetes-map-type: atomic - resourceFieldRef: - description: This is accessible behind a feature flag - kubernetes.podspec-fieldref - type: object - x-kubernetes-preserve-unknown-fields: true - x-kubernetes-map-type: atomic - secretKeyRef: - description: Selects a key of a secret in the pod's namespace - type: object - required: - - key - properties: - key: - description: The key of the secret to select from. Must be a valid secret key. - type: string - name: - description: |- - Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid? - type: string - optional: - description: Specify whether the Secret or its key must be defined - type: boolean - x-kubernetes-map-type: atomic - envFrom: - description: |- - List of sources to populate environment variables in the container. - The keys defined within a source must be a C_IDENTIFIER. All invalid keys - will be reported as an event when the container is starting. When a key exists in multiple - sources, the value associated with the last source will take precedence. - Values defined by an Env with a duplicate key will take precedence. - Cannot be updated. - type: array - items: - description: EnvFromSource represents the source of a set of ConfigMaps - type: object - properties: - configMapRef: - description: The ConfigMap to select from - type: object - properties: - name: - description: |- - Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid? - type: string - optional: - description: Specify whether the ConfigMap must be defined - type: boolean - x-kubernetes-map-type: atomic - prefix: - description: An optional identifier to prepend to each key in the ConfigMap. Must be a C_IDENTIFIER. - type: string - secretRef: - description: The Secret to select from - type: object - properties: - name: - description: |- - Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid? - type: string - optional: - description: Specify whether the Secret must be defined - type: boolean - x-kubernetes-map-type: atomic - image: - description: |- - Container image name. - More info: https://kubernetes.io/docs/concepts/containers/images - This field is optional to allow higher level config management to default or override - container images in workload controllers like Deployments and StatefulSets. - type: string - imagePullPolicy: - description: |- - Image pull policy. - One of Always, Never, IfNotPresent. - Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. - Cannot be updated. - More info: https://kubernetes.io/docs/concepts/containers/images#updating-images - type: string - livenessProbe: - description: |- - Periodic probe of container liveness. - Container will be restarted if the probe fails. - Cannot be updated. - More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes - type: object - properties: - exec: - description: Exec specifies the action to take. - type: object - properties: - command: - description: |- - Command is the command line to execute inside the container, the working directory for the - command is root ('/') in the container's filesystem. The command is simply exec'd, it is - not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use - a shell, you need to explicitly call out to that shell. - Exit status of 0 is treated as live/healthy and non-zero is unhealthy. - type: array - items: - type: string - failureThreshold: - description: |- - Minimum consecutive failures for the probe to be considered failed after having succeeded. - Defaults to 3. Minimum value is 1. - type: integer - format: int32 - grpc: - description: GRPC specifies an action involving a GRPC port. - type: object - required: - - port - properties: - port: - description: Port number of the gRPC service. Number must be in the range 1 to 65535. - type: integer - format: int32 - service: - description: |- - Service is the name of the service to place in the gRPC HealthCheckRequest - (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). - - - If this is not specified, the default behavior is defined by gRPC. - type: string - httpGet: - description: HTTPGet specifies the http request to perform. - type: object - properties: - host: - description: |- - Host name to connect to, defaults to the pod IP. You probably want to set - "Host" in httpHeaders instead. - type: string - httpHeaders: - description: Custom headers to set in the request. HTTP allows repeated headers. - type: array - items: - description: HTTPHeader describes a custom header to be used in HTTP probes - type: object - required: - - name - - value - properties: - name: - description: |- - The header field name. - This will be canonicalized upon output, so case-variant names will be understood as the same header. - type: string - value: - description: The header field value - type: string - path: - description: Path to access on the HTTP server. - type: string - port: - description: |- - Name or number of the port to access on the container. - Number must be in the range 1 to 65535. - Name must be an IANA_SVC_NAME. - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - scheme: - description: |- - Scheme to use for connecting to the host. - Defaults to HTTP. - type: string - initialDelaySeconds: - description: |- - Number of seconds after the container has started before liveness probes are initiated. - More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes - type: integer - format: int32 - periodSeconds: - description: How often (in seconds) to perform the probe. - type: integer - format: int32 - successThreshold: - description: |- - Minimum consecutive successes for the probe to be considered successful after having failed. - Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. - type: integer - format: int32 - tcpSocket: - description: TCPSocket specifies an action involving a TCP port. - type: object - properties: - host: - description: 'Optional: Host name to connect to, defaults to the pod IP.' - type: string - port: - description: |- - Number or name of the port to access on the container. - Number must be in the range 1 to 65535. - Name must be an IANA_SVC_NAME. - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - timeoutSeconds: - description: |- - Number of seconds after which the probe times out. - Defaults to 1 second. Minimum value is 1. - More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes - type: integer - format: int32 - name: - description: |- - Name of the container specified as a DNS_LABEL. - Each container in a pod must have a unique name (DNS_LABEL). - Cannot be updated. - type: string - ports: - description: |- - List of ports to expose from the container. Not specifying a port here - DOES NOT prevent that port from being exposed. Any port which is - listening on the default "0.0.0.0" address inside a container will be - accessible from the network. - Modifying this array with strategic merge patch may corrupt the data. - For more information See https://github.com/kubernetes/kubernetes/issues/108255. - Cannot be updated. - type: array - items: - description: ContainerPort represents a network port in a single container. - type: object - required: - - containerPort - properties: - containerPort: - description: |- - Number of port to expose on the pod's IP address. - This must be a valid port number, 0 < x < 65536. - type: integer - format: int32 - name: - description: |- - If specified, this must be an IANA_SVC_NAME and unique within the pod. Each - named port in a pod must have a unique name. Name for the port that can be - referred to by services. - type: string - protocol: - description: |- - Protocol for port. Must be UDP, TCP, or SCTP. - Defaults to "TCP". - type: string - default: TCP - x-kubernetes-list-map-keys: - - containerPort - - protocol - x-kubernetes-list-type: map - readinessProbe: - description: |- - Periodic probe of container service readiness. - Container will be removed from service endpoints if the probe fails. - Cannot be updated. - More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes - type: object - properties: - exec: - description: Exec specifies the action to take. - type: object - properties: - command: - description: |- - Command is the command line to execute inside the container, the working directory for the - command is root ('/') in the container's filesystem. The command is simply exec'd, it is - not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use - a shell, you need to explicitly call out to that shell. - Exit status of 0 is treated as live/healthy and non-zero is unhealthy. - type: array - items: - type: string - failureThreshold: - description: |- - Minimum consecutive failures for the probe to be considered failed after having succeeded. - Defaults to 3. Minimum value is 1. - type: integer - format: int32 - grpc: - description: GRPC specifies an action involving a GRPC port. - type: object - required: - - port - properties: - port: - description: Port number of the gRPC service. Number must be in the range 1 to 65535. - type: integer - format: int32 - service: - description: |- - Service is the name of the service to place in the gRPC HealthCheckRequest - (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). - - - If this is not specified, the default behavior is defined by gRPC. - type: string - httpGet: - description: HTTPGet specifies the http request to perform. - type: object - properties: - host: - description: |- - Host name to connect to, defaults to the pod IP. You probably want to set - "Host" in httpHeaders instead. - type: string - httpHeaders: - description: Custom headers to set in the request. HTTP allows repeated headers. - type: array - items: - description: HTTPHeader describes a custom header to be used in HTTP probes - type: object - required: - - name - - value - properties: - name: - description: |- - The header field name. - This will be canonicalized upon output, so case-variant names will be understood as the same header. - type: string - value: - description: The header field value - type: string - path: - description: Path to access on the HTTP server. - type: string - port: - description: |- - Name or number of the port to access on the container. - Number must be in the range 1 to 65535. - Name must be an IANA_SVC_NAME. - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - scheme: - description: |- - Scheme to use for connecting to the host. - Defaults to HTTP. - type: string - initialDelaySeconds: - description: |- - Number of seconds after the container has started before liveness probes are initiated. - More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes - type: integer - format: int32 - periodSeconds: - description: How often (in seconds) to perform the probe. - type: integer - format: int32 - successThreshold: - description: |- - Minimum consecutive successes for the probe to be considered successful after having failed. - Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. - type: integer - format: int32 - tcpSocket: - description: TCPSocket specifies an action involving a TCP port. - type: object - properties: - host: - description: 'Optional: Host name to connect to, defaults to the pod IP.' - type: string - port: - description: |- - Number or name of the port to access on the container. - Number must be in the range 1 to 65535. - Name must be an IANA_SVC_NAME. - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - timeoutSeconds: - description: |- - Number of seconds after which the probe times out. - Defaults to 1 second. Minimum value is 1. - More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes - type: integer - format: int32 - resources: - description: |- - Compute Resources required by this container. - Cannot be updated. - More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ - type: object - properties: - claims: - description: |- - Claims lists the names of resources, defined in spec.resourceClaims, - that are used by this container. - - - This is an alpha field and requires enabling the - DynamicResourceAllocation feature gate. - - - This field is immutable. It can only be set for containers. - type: array - items: - description: ResourceClaim references one entry in PodSpec.ResourceClaims. - type: object - required: - - name - properties: - name: - description: |- - Name must match the name of one entry in pod.spec.resourceClaims of - the Pod where this field is used. It makes that resource available - inside a container. - type: string - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - limits: - description: |- - Limits describes the maximum amount of compute resources allowed. - More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ - type: object - additionalProperties: - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - requests: - description: |- - Requests describes the minimum amount of compute resources required. - If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, - otherwise to an implementation-defined value. Requests cannot exceed Limits. - More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ - type: object - additionalProperties: - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - securityContext: - description: |- - SecurityContext defines the security options the container should be run with. - If set, the fields of SecurityContext override the equivalent fields of PodSecurityContext. - More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ - type: object - properties: - allowPrivilegeEscalation: - description: |- - AllowPrivilegeEscalation controls whether a process can gain more - privileges than its parent process. This bool directly controls if - the no_new_privs flag will be set on the container process. - AllowPrivilegeEscalation is true always when the container is: - 1) run as Privileged - 2) has CAP_SYS_ADMIN - Note that this field cannot be set when spec.os.name is windows. - type: boolean - capabilities: - description: |- - The capabilities to add/drop when running containers. - Defaults to the default set of capabilities granted by the container runtime. - Note that this field cannot be set when spec.os.name is windows. - type: object - properties: - add: - description: This is accessible behind a feature flag - kubernetes.containerspec-addcapabilities - type: array - items: - description: Capability represent POSIX capabilities type - type: string - drop: - description: Removed capabilities - type: array - items: - description: Capability represent POSIX capabilities type - type: string - readOnlyRootFilesystem: - description: |- - Whether this container has a read-only root filesystem. - Default is false. - Note that this field cannot be set when spec.os.name is windows. - type: boolean - runAsGroup: - description: |- - The GID to run the entrypoint of the container process. - Uses runtime default if unset. - May also be set in PodSecurityContext. If set in both SecurityContext and - PodSecurityContext, the value specified in SecurityContext takes precedence. - Note that this field cannot be set when spec.os.name is windows. - type: integer - format: int64 - runAsNonRoot: - description: |- - Indicates that the container must run as a non-root user. - If true, the Kubelet will validate the image at runtime to ensure that it - does not run as UID 0 (root) and fail to start the container if it does. - If unset or false, no such validation will be performed. - May also be set in PodSecurityContext. If set in both SecurityContext and - PodSecurityContext, the value specified in SecurityContext takes precedence. - type: boolean - runAsUser: - description: |- - The UID to run the entrypoint of the container process. - Defaults to user specified in image metadata if unspecified. - May also be set in PodSecurityContext. If set in both SecurityContext and - PodSecurityContext, the value specified in SecurityContext takes precedence. - Note that this field cannot be set when spec.os.name is windows. - type: integer - format: int64 - seccompProfile: - description: |- - The seccomp options to use by this container. If seccomp options are - provided at both the pod & container level, the container options - override the pod options. - Note that this field cannot be set when spec.os.name is windows. - type: object - required: - - type - properties: - localhostProfile: - description: |- - localhostProfile indicates a profile defined in a file on the node should be used. - The profile must be preconfigured on the node to work. - Must be a descending path, relative to the kubelet's configured seccomp profile location. - Must be set if type is "Localhost". Must NOT be set for any other type. - type: string - type: - description: |- - type indicates which kind of seccomp profile will be applied. - Valid options are: - - - Localhost - a profile defined in a file on the node should be used. - RuntimeDefault - the container runtime default profile should be used. - Unconfined - no profile should be applied. - type: string - startupProbe: - description: |- - StartupProbe indicates that the Pod has successfully initialized. - If specified, no other probes are executed until this completes successfully. - If this probe fails, the Pod will be restarted, just as if the livenessProbe failed. - This can be used to provide different probe parameters at the beginning of a Pod's lifecycle, - when it might take a long time to load data or warm a cache, than during steady-state operation. - This cannot be updated. - More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes - type: object - properties: - exec: - description: Exec specifies the action to take. - type: object - properties: - command: - description: |- - Command is the command line to execute inside the container, the working directory for the - command is root ('/') in the container's filesystem. The command is simply exec'd, it is - not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use - a shell, you need to explicitly call out to that shell. - Exit status of 0 is treated as live/healthy and non-zero is unhealthy. - type: array - items: - type: string - failureThreshold: - description: |- - Minimum consecutive failures for the probe to be considered failed after having succeeded. - Defaults to 3. Minimum value is 1. - type: integer - format: int32 - grpc: - description: GRPC specifies an action involving a GRPC port. - type: object - required: - - port - properties: - port: - description: Port number of the gRPC service. Number must be in the range 1 to 65535. - type: integer - format: int32 - service: - description: |- - Service is the name of the service to place in the gRPC HealthCheckRequest - (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). - - - If this is not specified, the default behavior is defined by gRPC. - type: string - httpGet: - description: HTTPGet specifies the http request to perform. - type: object - properties: - host: - description: |- - Host name to connect to, defaults to the pod IP. You probably want to set - "Host" in httpHeaders instead. - type: string - httpHeaders: - description: Custom headers to set in the request. HTTP allows repeated headers. - type: array - items: - description: HTTPHeader describes a custom header to be used in HTTP probes - type: object - required: - - name - - value - properties: - name: - description: |- - The header field name. - This will be canonicalized upon output, so case-variant names will be understood as the same header. - type: string - value: - description: The header field value - type: string - path: - description: Path to access on the HTTP server. - type: string - port: - description: |- - Name or number of the port to access on the container. - Number must be in the range 1 to 65535. - Name must be an IANA_SVC_NAME. - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - scheme: - description: |- - Scheme to use for connecting to the host. - Defaults to HTTP. - type: string - initialDelaySeconds: - description: |- - Number of seconds after the container has started before liveness probes are initiated. - More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes - type: integer - format: int32 - periodSeconds: - description: How often (in seconds) to perform the probe. - type: integer - format: int32 - successThreshold: - description: |- - Minimum consecutive successes for the probe to be considered successful after having failed. - Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. - type: integer - format: int32 - tcpSocket: - description: TCPSocket specifies an action involving a TCP port. - type: object - properties: - host: - description: 'Optional: Host name to connect to, defaults to the pod IP.' - type: string - port: - description: |- - Number or name of the port to access on the container. - Number must be in the range 1 to 65535. - Name must be an IANA_SVC_NAME. - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - timeoutSeconds: - description: |- - Number of seconds after which the probe times out. - Defaults to 1 second. Minimum value is 1. - More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes - type: integer - format: int32 - terminationMessagePath: - description: |- - Optional: Path at which the file to which the container's termination message - will be written is mounted into the container's filesystem. - Message written is intended to be brief final status, such as an assertion failure message. - Will be truncated by the node if greater than 4096 bytes. The total message length across - all containers will be limited to 12kb. - Defaults to /dev/termination-log. - Cannot be updated. - type: string - terminationMessagePolicy: - description: |- - Indicate how the termination message should be populated. File will use the contents of - terminationMessagePath to populate the container status message on both success and failure. - FallbackToLogsOnError will use the last chunk of container log output if the termination - message file is empty and the container exited with an error. - The log output is limited to 2048 bytes or 80 lines, whichever is smaller. - Defaults to File. - Cannot be updated. - type: string - volumeMounts: - description: |- - Pod volumes to mount into the container's filesystem. - Cannot be updated. - type: array - items: - description: VolumeMount describes a mounting of a Volume within a container. - type: object - required: - - mountPath - - name - properties: - mountPath: - description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. - type: string - name: - description: This must match the Name of a Volume. - type: string - readOnly: - description: |- - Mounted read-only if true, read-write otherwise (false or unspecified). - Defaults to false. - type: boolean - subPath: - description: |- - Path within the volume from which the container's volume should be mounted. - Defaults to "" (volume's root). - type: string - workingDir: - description: |- - Container's working directory. - If not specified, the container runtime's default will be used, which - might be configured in the container image. - Cannot be updated. - type: string - dnsConfig: - description: This is accessible behind a feature flag - kubernetes.podspec-dnsconfig - type: object - x-kubernetes-preserve-unknown-fields: true - dnsPolicy: - description: This is accessible behind a feature flag - kubernetes.podspec-dnspolicy - type: string - enableServiceLinks: - description: 'EnableServiceLinks indicates whether information about services should be injected into pod''s environment variables, matching the syntax of Docker links. Optional: Knative defaults this to false.' - type: boolean - hostAliases: - description: This is accessible behind a feature flag - kubernetes.podspec-hostaliases - type: array - items: - description: This is accessible behind a feature flag - kubernetes.podspec-hostaliases - type: object - x-kubernetes-preserve-unknown-fields: true - idleTimeoutSeconds: - description: |- - IdleTimeoutSeconds is the maximum duration in seconds a request will be allowed - to stay open while not receiving any bytes from the user's application. If - unspecified, a system default will be provided. - type: integer - format: int64 - imagePullSecrets: - description: |- - ImagePullSecrets is an optional list of references to secrets in the same namespace to use for pulling any of the images used by this PodSpec. - If specified, these secrets will be passed to individual puller implementations for them to use. - More info: https://kubernetes.io/docs/concepts/containers/images#specifying-imagepullsecrets-on-a-pod - type: array - items: - description: |- - LocalObjectReference contains enough information to let you locate the - referenced object inside the same namespace. - type: object - properties: - name: - description: |- - Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid? - type: string - x-kubernetes-map-type: atomic - initContainers: - description: |- - List of initialization containers belonging to the pod. - Init containers are executed in order prior to containers being started. If any - init container fails, the pod is considered to have failed and is handled according - to its restartPolicy. The name for an init container or normal container must be - unique among all containers. - Init containers may not have Lifecycle actions, Readiness probes, Liveness probes, or Startup probes. - The resourceRequirements of an init container are taken into account during scheduling - by finding the highest request/limit for each resource type, and then using the max of - of that value or the sum of the normal containers. Limits are applied to init containers - in a similar fashion. - Init containers cannot currently be added or removed. - Cannot be updated. - More info: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/ - type: array - items: - description: This is accessible behind a feature flag - kubernetes.podspec-init-containers - type: object - x-kubernetes-preserve-unknown-fields: true - nodeSelector: - description: This is accessible behind a feature flag - kubernetes.podspec-nodeselector - type: object - x-kubernetes-preserve-unknown-fields: true - x-kubernetes-map-type: atomic - priorityClassName: - description: This is accessible behind a feature flag - kubernetes.podspec-priorityclassname - type: string - x-kubernetes-preserve-unknown-fields: true - responseStartTimeoutSeconds: - description: |- - ResponseStartTimeoutSeconds is the maximum duration in seconds that the request - routing layer will wait for a request delivered to a container to begin - sending any network traffic. - type: integer - format: int64 - runtimeClassName: - description: This is accessible behind a feature flag - kubernetes.podspec-runtimeclassname - type: string - x-kubernetes-preserve-unknown-fields: true - schedulerName: - description: This is accessible behind a feature flag - kubernetes.podspec-schedulername - type: string - x-kubernetes-preserve-unknown-fields: true - securityContext: - description: This is accessible behind a feature flag - kubernetes.podspec-securitycontext - type: object - x-kubernetes-preserve-unknown-fields: true - serviceAccountName: - description: |- - ServiceAccountName is the name of the ServiceAccount to use to run this pod. - More info: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/ - type: string - shareProcessNamespace: - description: This is accessible behind a feature flag - kubernetes.podspec-shareproccessnamespace - type: boolean - x-kubernetes-preserve-unknown-fields: true - timeoutSeconds: - description: |- - TimeoutSeconds is the maximum duration in seconds that the request instance - is allowed to respond to a request. If unspecified, a system default will - be provided. - type: integer - format: int64 - tolerations: - description: This is accessible behind a feature flag - kubernetes.podspec-tolerations - type: array - items: - description: This is accessible behind a feature flag - kubernetes.podspec-tolerations - type: object - x-kubernetes-preserve-unknown-fields: true - topologySpreadConstraints: - description: This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints - type: array - items: - description: This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints - type: object - x-kubernetes-preserve-unknown-fields: true - volumes: - description: |- - List of volumes that can be mounted by containers belonging to the pod. - More info: https://kubernetes.io/docs/concepts/storage/volumes - type: array - items: - description: Volume represents a named volume in a pod that may be accessed by any container in the pod. - type: object - required: - - name - properties: - configMap: - description: configMap represents a configMap that should populate this volume - type: object - properties: - defaultMode: - description: |- - defaultMode is optional: mode bits used to set permissions on created files by default. - Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. - YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. - Defaults to 0644. - Directories within the path are not affected by this setting. - This might be in conflict with other options that affect the file - mode, like fsGroup, and the result can be other mode bits set. - type: integer - format: int32 - items: - description: |- - items if unspecified, each key-value pair in the Data field of the referenced - ConfigMap will be projected into the volume as a file whose name is the - key and content is the value. If specified, the listed keys will be - projected into the specified paths, and unlisted keys will not be - present. If a key is specified which is not present in the ConfigMap, - the volume setup will error unless it is marked optional. Paths must be - relative and may not contain the '..' path or start with '..'. - type: array - items: - description: Maps a string key to a path within a volume. - type: object - required: - - key - - path - properties: - key: - description: key is the key to project. - type: string - mode: - description: |- - mode is Optional: mode bits used to set permissions on this file. - Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. - YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. - If not specified, the volume defaultMode will be used. - This might be in conflict with other options that affect the file - mode, like fsGroup, and the result can be other mode bits set. - type: integer - format: int32 - path: - description: |- - path is the relative path of the file to map the key to. - May not be an absolute path. - May not contain the path element '..'. - May not start with the string '..'. - type: string - name: - description: |- - Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid? - type: string - optional: - description: optional specify whether the ConfigMap or its keys must be defined - type: boolean - x-kubernetes-map-type: atomic - emptyDir: - description: This is accessible behind a feature flag - kubernetes.podspec-emptydir - type: object - x-kubernetes-preserve-unknown-fields: true - name: - description: |- - name of the volume. - Must be a DNS_LABEL and unique within the pod. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - persistentVolumeClaim: - description: This is accessible behind a feature flag - kubernetes.podspec-persistent-volume-claim - type: object - x-kubernetes-preserve-unknown-fields: true - projected: - description: projected items for all in one resources secrets, configmaps, and downward API - type: object - properties: - defaultMode: - description: |- - defaultMode are the mode bits used to set permissions on created files by default. - Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. - YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. - Directories within the path are not affected by this setting. - This might be in conflict with other options that affect the file - mode, like fsGroup, and the result can be other mode bits set. - type: integer - format: int32 - sources: - description: sources is the list of volume projections - type: array - items: - description: Projection that may be projected along with other supported volume types - type: object - properties: - configMap: - description: configMap information about the configMap data to project - type: object - properties: - items: - description: |- - items if unspecified, each key-value pair in the Data field of the referenced - ConfigMap will be projected into the volume as a file whose name is the - key and content is the value. If specified, the listed keys will be - projected into the specified paths, and unlisted keys will not be - present. If a key is specified which is not present in the ConfigMap, - the volume setup will error unless it is marked optional. Paths must be - relative and may not contain the '..' path or start with '..'. - type: array - items: - description: Maps a string key to a path within a volume. - type: object - required: - - key - - path - properties: - key: - description: key is the key to project. - type: string - mode: - description: |- - mode is Optional: mode bits used to set permissions on this file. - Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. - YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. - If not specified, the volume defaultMode will be used. - This might be in conflict with other options that affect the file - mode, like fsGroup, and the result can be other mode bits set. - type: integer - format: int32 - path: - description: |- - path is the relative path of the file to map the key to. - May not be an absolute path. - May not contain the path element '..'. - May not start with the string '..'. - type: string - name: - description: |- - Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid? - type: string - optional: - description: optional specify whether the ConfigMap or its keys must be defined - type: boolean - x-kubernetes-map-type: atomic - downwardAPI: - description: downwardAPI information about the downwardAPI data to project - type: object - properties: - items: - description: Items is a list of DownwardAPIVolume file - type: array - items: - description: DownwardAPIVolumeFile represents information to create the file containing the pod field - type: object - required: - - path - properties: - fieldRef: - description: 'Required: Selects a field of the pod: only annotations, labels, name and namespace are supported.' - type: object - required: - - fieldPath - properties: - apiVersion: - description: Version of the schema the FieldPath is written in terms of, defaults to "v1". - type: string - fieldPath: - description: Path of the field to select in the specified API version. - type: string - x-kubernetes-map-type: atomic - mode: - description: |- - Optional: mode bits used to set permissions on this file, must be an octal value - between 0000 and 0777 or a decimal value between 0 and 511. - YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. - If not specified, the volume defaultMode will be used. - This might be in conflict with other options that affect the file - mode, like fsGroup, and the result can be other mode bits set. - type: integer - format: int32 - path: - description: 'Required: Path is the relative path name of the file to be created. Must not be absolute or contain the ''..'' path. Must be utf-8 encoded. The first item of the relative path must not start with ''..''' - type: string - resourceFieldRef: - description: |- - Selects a resource of the container: only resources limits and requests - (limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported. - type: object - required: - - resource - properties: - containerName: - description: 'Container name: required for volumes, optional for env vars' - type: string - divisor: - description: Specifies the output format of the exposed resources, defaults to "1" - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - resource: - description: 'Required: resource to select' - type: string - x-kubernetes-map-type: atomic - secret: - description: secret information about the secret data to project - type: object - properties: - items: - description: |- - items if unspecified, each key-value pair in the Data field of the referenced - Secret will be projected into the volume as a file whose name is the - key and content is the value. If specified, the listed keys will be - projected into the specified paths, and unlisted keys will not be - present. If a key is specified which is not present in the Secret, - the volume setup will error unless it is marked optional. Paths must be - relative and may not contain the '..' path or start with '..'. - type: array - items: - description: Maps a string key to a path within a volume. - type: object - required: - - key - - path - properties: - key: - description: key is the key to project. - type: string - mode: - description: |- - mode is Optional: mode bits used to set permissions on this file. - Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. - YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. - If not specified, the volume defaultMode will be used. - This might be in conflict with other options that affect the file - mode, like fsGroup, and the result can be other mode bits set. - type: integer - format: int32 - path: - description: |- - path is the relative path of the file to map the key to. - May not be an absolute path. - May not contain the path element '..'. - May not start with the string '..'. - type: string - name: - description: |- - Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid? - type: string - optional: - description: optional field specify whether the Secret or its key must be defined - type: boolean - x-kubernetes-map-type: atomic - serviceAccountToken: - description: serviceAccountToken is information about the serviceAccountToken data to project - type: object - required: - - path - properties: - audience: - description: |- - audience is the intended audience of the token. A recipient of a token - must identify itself with an identifier specified in the audience of the - token, and otherwise should reject the token. The audience defaults to the - identifier of the apiserver. - type: string - expirationSeconds: - description: |- - expirationSeconds is the requested duration of validity of the service - account token. As the token approaches expiration, the kubelet volume - plugin will proactively rotate the service account token. The kubelet will - start trying to rotate the token if the token is older than 80 percent of - its time to live or if the token is older than 24 hours.Defaults to 1 hour - and must be at least 10 minutes. - type: integer - format: int64 - path: - description: |- - path is the path relative to the mount point of the file to project the - token into. - type: string - secret: - description: |- - secret represents a secret that should populate this volume. - More info: https://kubernetes.io/docs/concepts/storage/volumes#secret - type: object - properties: - defaultMode: - description: |- - defaultMode is Optional: mode bits used to set permissions on created files by default. - Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. - YAML accepts both octal and decimal values, JSON requires decimal values - for mode bits. Defaults to 0644. - Directories within the path are not affected by this setting. - This might be in conflict with other options that affect the file - mode, like fsGroup, and the result can be other mode bits set. - type: integer - format: int32 - items: - description: |- - items If unspecified, each key-value pair in the Data field of the referenced - Secret will be projected into the volume as a file whose name is the - key and content is the value. If specified, the listed keys will be - projected into the specified paths, and unlisted keys will not be - present. If a key is specified which is not present in the Secret, - the volume setup will error unless it is marked optional. Paths must be - relative and may not contain the '..' path or start with '..'. - type: array - items: - description: Maps a string key to a path within a volume. - type: object - required: - - key - - path - properties: - key: - description: key is the key to project. - type: string - mode: - description: |- - mode is Optional: mode bits used to set permissions on this file. - Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. - YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. - If not specified, the volume defaultMode will be used. - This might be in conflict with other options that affect the file - mode, like fsGroup, and the result can be other mode bits set. - type: integer - format: int32 - path: - description: |- - path is the relative path of the file to map the key to. - May not be an absolute path. - May not contain the path element '..'. - May not start with the string '..'. - type: string - optional: - description: optional field specify whether the Secret or its keys must be defined - type: boolean - secretName: - description: |- - secretName is the name of the secret in the pod's namespace to use. - More info: https://kubernetes.io/docs/concepts/storage/volumes#secret - type: string - status: - description: RevisionStatus communicates the observed state of the Revision (from the controller). - type: object - properties: - actualReplicas: - description: ActualReplicas reflects the amount of ready pods running this revision. - type: integer - format: int32 - annotations: - description: |- - Annotations is additional Status fields for the Resource to save some - additional State as well as convey more information to the user. This is - roughly akin to Annotations on any k8s resource, just the reconciler conveying - richer information outwards. - type: object - additionalProperties: - type: string - conditions: - description: Conditions the latest available observations of a resource's current state. - type: array - items: - description: |- - Condition defines a readiness condition for a Knative resource. - See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties - type: object - required: - - status - - type - properties: - lastTransitionTime: - description: |- - LastTransitionTime is the last time the condition transitioned from one status to another. - We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic - differences (all other things held constant). - type: string - message: - description: A human readable message indicating details about the transition. - type: string - reason: - description: The reason for the condition's last transition. - type: string - severity: - description: |- - Severity with which to treat failures of this type of condition. - When this is not specified, it defaults to Error. - type: string - status: - description: Status of the condition, one of True, False, Unknown. - type: string - type: - description: Type of condition. - type: string - containerStatuses: - description: |- - ContainerStatuses is a slice of images present in .Spec.Container[*].Image - to their respective digests and their container name. - The digests are resolved during the creation of Revision. - ContainerStatuses holds the container name and image digests - for both serving and non serving containers. - ref: http://bit.ly/image-digests - type: array - items: - description: ContainerStatus holds the information of container name and image digest value - type: object - properties: - imageDigest: - type: string - name: - type: string - desiredReplicas: - description: DesiredReplicas reflects the desired amount of pods running this revision. - type: integer - format: int32 - initContainerStatuses: - description: |- - InitContainerStatuses is a slice of images present in .Spec.InitContainer[*].Image - to their respective digests and their container name. - The digests are resolved during the creation of Revision. - ContainerStatuses holds the container name and image digests - for both serving and non serving containers. - ref: http://bit.ly/image-digests - type: array - items: - description: ContainerStatus holds the information of container name and image digest value - type: object - properties: - imageDigest: - type: string - name: - type: string - logUrl: - description: |- - LogURL specifies the generated logging url for this particular revision - based on the revision url template specified in the controller's config. - type: string - observedGeneration: - description: |- - ObservedGeneration is the 'Generation' of the Service that - was last processed by the controller. - type: integer - format: int64 ---- -# Copyright 2019 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -# Note: The schema part of the spec is auto-generated by hack/update-schemas.sh. - -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - name: routes.serving.knative.dev - labels: - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.15.0" - knative.dev/crd-install: "true" - duck.knative.dev/addressable: "true" -spec: - group: serving.knative.dev - names: - kind: Route - plural: routes - singular: route - categories: - - all - - knative - - serving - shortNames: - - rt - scope: Namespaced - versions: - - name: v1 - served: true - storage: true - subresources: - status: {} - additionalPrinterColumns: - - name: URL - type: string - jsonPath: .status.url - - name: Ready - type: string - jsonPath: ".status.conditions[?(@.type=='Ready')].status" - - name: Reason - type: string - jsonPath: ".status.conditions[?(@.type=='Ready')].reason" - schema: - openAPIV3Schema: - description: |- - Route is responsible for configuring ingress over a collection of Revisions. - Some of the Revisions a Route distributes traffic over may be specified by - referencing the Configuration responsible for creating them; in these cases - the Route is additionally responsible for monitoring the Configuration for - "latest ready revision" changes, and smoothly rolling out latest revisions. - See also: https://github.com/knative/serving/blob/main/docs/spec/overview.md#route - type: object - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: Spec holds the desired state of the Route (from the client). - type: object - properties: - traffic: - description: |- - Traffic specifies how to distribute traffic over a collection of - revisions and configurations. - type: array - items: - description: TrafficTarget holds a single entry of the routing table for a Route. - type: object - properties: - configurationName: - description: |- - ConfigurationName of a configuration to whose latest revision we will send - this portion of traffic. When the "status.latestReadyRevisionName" of the - referenced configuration changes, we will automatically migrate traffic - from the prior "latest ready" revision to the new one. This field is never - set in Route's status, only its spec. This is mutually exclusive with - RevisionName. - type: string - latestRevision: - description: |- - LatestRevision may be optionally provided to indicate that the latest - ready Revision of the Configuration should be used for this traffic - target. When provided LatestRevision must be true if RevisionName is - empty; it must be false when RevisionName is non-empty. - type: boolean - percent: - description: |- - Percent indicates that percentage based routing should be used and - the value indicates the percent of traffic that is be routed to this - Revision or Configuration. `0` (zero) mean no traffic, `100` means all - traffic. - When percentage based routing is being used the follow rules apply: - - the sum of all percent values must equal 100 - - when not specified, the implied value for `percent` is zero for - that particular Revision or Configuration - type: integer - format: int64 - revisionName: - description: |- - RevisionName of a specific revision to which to send this portion of - traffic. This is mutually exclusive with ConfigurationName. - type: string - tag: - description: |- - Tag is optionally used to expose a dedicated url for referencing - this target exclusively. - type: string - url: - description: |- - URL displays the URL for accessing named traffic targets. URL is displayed in - status, and is disallowed on spec. URL must contain a scheme (e.g. http://) and - a hostname, but may not contain anything else (e.g. basic auth, url path, etc.) - type: string - status: - description: Status communicates the observed state of the Route (from the controller). - type: object - properties: - address: - description: Address holds the information needed for a Route to be the target of an event. - type: object - properties: - CACerts: - description: |- - CACerts is the Certification Authority (CA) certificates in PEM format - according to https://www.rfc-editor.org/rfc/rfc7468. - type: string - audience: - description: Audience is the OIDC audience for this address. - type: string - name: - description: Name is the name of the address. - type: string - url: - type: string - annotations: - description: |- - Annotations is additional Status fields for the Resource to save some - additional State as well as convey more information to the user. This is - roughly akin to Annotations on any k8s resource, just the reconciler conveying - richer information outwards. - type: object - additionalProperties: - type: string - conditions: - description: Conditions the latest available observations of a resource's current state. - type: array - items: - description: |- - Condition defines a readiness condition for a Knative resource. - See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties - type: object - required: - - status - - type - properties: - lastTransitionTime: - description: |- - LastTransitionTime is the last time the condition transitioned from one status to another. - We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic - differences (all other things held constant). - type: string - message: - description: A human readable message indicating details about the transition. - type: string - reason: - description: The reason for the condition's last transition. - type: string - severity: - description: |- - Severity with which to treat failures of this type of condition. - When this is not specified, it defaults to Error. - type: string - status: - description: Status of the condition, one of True, False, Unknown. - type: string - type: - description: Type of condition. - type: string - observedGeneration: - description: |- - ObservedGeneration is the 'Generation' of the Service that - was last processed by the controller. - type: integer - format: int64 - traffic: - description: |- - Traffic holds the configured traffic distribution. - These entries will always contain RevisionName references. - When ConfigurationName appears in the spec, this will hold the - LatestReadyRevisionName that we last observed. - type: array - items: - description: TrafficTarget holds a single entry of the routing table for a Route. - type: object - properties: - configurationName: - description: |- - ConfigurationName of a configuration to whose latest revision we will send - this portion of traffic. When the "status.latestReadyRevisionName" of the - referenced configuration changes, we will automatically migrate traffic - from the prior "latest ready" revision to the new one. This field is never - set in Route's status, only its spec. This is mutually exclusive with - RevisionName. - type: string - latestRevision: - description: |- - LatestRevision may be optionally provided to indicate that the latest - ready Revision of the Configuration should be used for this traffic - target. When provided LatestRevision must be true if RevisionName is - empty; it must be false when RevisionName is non-empty. - type: boolean - percent: - description: |- - Percent indicates that percentage based routing should be used and - the value indicates the percent of traffic that is be routed to this - Revision or Configuration. `0` (zero) mean no traffic, `100` means all - traffic. - When percentage based routing is being used the follow rules apply: - - the sum of all percent values must equal 100 - - when not specified, the implied value for `percent` is zero for - that particular Revision or Configuration - type: integer - format: int64 - revisionName: - description: |- - RevisionName of a specific revision to which to send this portion of - traffic. This is mutually exclusive with ConfigurationName. - type: string - tag: - description: |- - Tag is optionally used to expose a dedicated url for referencing - this target exclusively. - type: string - url: - description: |- - URL displays the URL for accessing named traffic targets. URL is displayed in - status, and is disallowed on spec. URL must contain a scheme (e.g. http://) and - a hostname, but may not contain anything else (e.g. basic auth, url path, etc.) - type: string - url: - description: |- - URL holds the url that will distribute traffic over the provided traffic targets. - It generally has the form http[s]://{route-name}.{route-namespace}.{cluster-level-suffix} - type: string ---- -# Copyright 2019 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - name: serverlessservices.networking.internal.knative.dev - labels: - app.kubernetes.io/name: knative-serving - app.kubernetes.io/component: networking - app.kubernetes.io/version: "1.15.0" - knative.dev/crd-install: "true" -spec: - group: networking.internal.knative.dev - versions: - - name: v1alpha1 - served: true - storage: true - subresources: - status: {} - schema: - openAPIV3Schema: - description: |- - ServerlessService is a proxy for the K8s service objects containing the - endpoints for the revision, whether those are endpoints of the activator or - revision pods. - See: https://knative.page.link/naxz for details. - type: object - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: |- - Spec is the desired state of the ServerlessService. - More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status - type: object - required: - - objectRef - - protocolType - properties: - mode: - description: Mode describes the mode of operation of the ServerlessService. - type: string - numActivators: - description: |- - NumActivators contains number of Activators that this revision should be - assigned. - O means — assign all. - type: integer - format: int32 - objectRef: - description: |- - ObjectRef defines the resource that this ServerlessService - is responsible for making "serverless". - type: object - properties: - apiVersion: - description: API version of the referent. - type: string - fieldPath: - description: |- - If referring to a piece of an object instead of an entire object, this string - should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. - For example, if the object reference is to a container within a pod, this would take on a value like: - "spec.containers{name}" (where "name" refers to the name of the container that triggered - the event) or if no container name is specified "spec.containers[2]" (container with - index 2 in this pod). This syntax is chosen only to have some well-defined way of - referencing a part of an object. - TODO: this design is not final and this field is subject to change in the future. - type: string - kind: - description: |- - Kind of the referent. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - name: - description: |- - Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - namespace: - description: |- - Namespace of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ - type: string - resourceVersion: - description: |- - Specific resourceVersion to which this reference is made, if any. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency - type: string - uid: - description: |- - UID of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids - type: string - x-kubernetes-map-type: atomic - protocolType: - description: |- - The application-layer protocol. Matches `RevisionProtocolType` set on the owning pa/revision. - serving imports networking, so just use string. - type: string - status: - description: |- - Status is the current state of the ServerlessService. - More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status - type: object - properties: - annotations: - description: |- - Annotations is additional Status fields for the Resource to save some - additional State as well as convey more information to the user. This is - roughly akin to Annotations on any k8s resource, just the reconciler conveying - richer information outwards. - type: object - additionalProperties: - type: string - conditions: - description: Conditions the latest available observations of a resource's current state. - type: array - items: - description: |- - Condition defines a readiness condition for a Knative resource. - See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties - type: object - required: - - status - - type - properties: - lastTransitionTime: - description: |- - LastTransitionTime is the last time the condition transitioned from one status to another. - We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic - differences (all other things held constant). - type: string - message: - description: A human readable message indicating details about the transition. - type: string - reason: - description: The reason for the condition's last transition. - type: string - severity: - description: |- - Severity with which to treat failures of this type of condition. - When this is not specified, it defaults to Error. - type: string - status: - description: Status of the condition, one of True, False, Unknown. - type: string - type: - description: Type of condition. - type: string - observedGeneration: - description: |- - ObservedGeneration is the 'Generation' of the Service that - was last processed by the controller. - type: integer - format: int64 - privateServiceName: - description: |- - PrivateServiceName holds the name of a core K8s Service resource that - load balances over the user service pods backing this Revision. - type: string - serviceName: - description: |- - ServiceName holds the name of a core K8s Service resource that - load balances over the pods backing this Revision (activator or revision). - type: string - additionalPrinterColumns: - - name: Mode - type: string - jsonPath: ".spec.mode" - - name: Activators - type: integer - jsonPath: ".spec.numActivators" - - name: ServiceName - type: string - jsonPath: ".status.serviceName" - - name: PrivateServiceName - type: string - jsonPath: ".status.privateServiceName" - - name: Ready - type: string - jsonPath: ".status.conditions[?(@.type=='Ready')].status" - - name: Reason - type: string - jsonPath: ".status.conditions[?(@.type=='Ready')].reason" - names: - kind: ServerlessService - plural: serverlessservices - singular: serverlessservice - categories: - - knative-internal - - networking - shortNames: - - sks - scope: Namespaced ---- -# Copyright 2019 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -# Note: The schema part of the spec is auto-generated by hack/update-schemas.sh. - -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - name: services.serving.knative.dev - labels: - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.15.0" - knative.dev/crd-install: "true" - duck.knative.dev/addressable: "true" - duck.knative.dev/podspecable: "true" -spec: - group: serving.knative.dev - names: - kind: Service - plural: services - singular: service - categories: - - all - - knative - - serving - shortNames: - - kservice - - ksvc - scope: Namespaced - versions: - - name: v1 - served: true - storage: true - subresources: - status: {} - additionalPrinterColumns: - - name: URL - type: string - jsonPath: .status.url - - name: LatestCreated - type: string - jsonPath: .status.latestCreatedRevisionName - - name: LatestReady - type: string - jsonPath: .status.latestReadyRevisionName - - name: Ready - type: string - jsonPath: ".status.conditions[?(@.type=='Ready')].status" - - name: Reason - type: string - jsonPath: ".status.conditions[?(@.type=='Ready')].reason" - schema: - openAPIV3Schema: - description: |- - Service acts as a top-level container that manages a Route and Configuration - which implement a network service. Service exists to provide a singular - abstraction which can be access controlled, reasoned about, and which - encapsulates software lifecycle decisions such as rollout policy and - team resource ownership. Service acts only as an orchestrator of the - underlying Routes and Configurations (much as a kubernetes Deployment - orchestrates ReplicaSets), and its usage is optional but recommended. - - - The Service's controller will track the statuses of its owned Configuration - and Route, reflecting their statuses and conditions as its own. - - - See also: https://github.com/knative/serving/blob/main/docs/spec/overview.md#service - type: object - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: |- - ServiceSpec represents the configuration for the Service object. - A Service's specification is the union of the specifications for a Route - and Configuration. The Service restricts what can be expressed in these - fields, e.g. the Route must reference the provided Configuration; - however, these limitations also enable friendlier defaulting, - e.g. Route never needs a Configuration name, and may be defaulted to - the appropriate "run latest" spec. - type: object - properties: - template: - description: Template holds the latest specification for the Revision to be stamped out. - type: object - properties: - metadata: - type: object - properties: - annotations: - type: object - additionalProperties: - type: string - finalizers: - type: array - items: - type: string - labels: - type: object - additionalProperties: - type: string - name: - type: string - namespace: - type: string - x-kubernetes-preserve-unknown-fields: true - spec: - description: RevisionSpec holds the desired state of the Revision (from the client). - type: object - required: - - containers - properties: - affinity: - description: This is accessible behind a feature flag - kubernetes.podspec-affinity - type: object - x-kubernetes-preserve-unknown-fields: true - automountServiceAccountToken: - description: AutomountServiceAccountToken indicates whether a service account token should be automatically mounted. - type: boolean - containerConcurrency: - description: |- - ContainerConcurrency specifies the maximum allowed in-flight (concurrent) - requests per container of the Revision. Defaults to `0` which means - concurrency to the application is not limited, and the system decides the - target concurrency for the autoscaler. - type: integer - format: int64 - containers: - description: |- - List of containers belonging to the pod. - Containers cannot currently be added or removed. - There must be at least one container in a Pod. - Cannot be updated. - type: array - items: - description: A single application container that you want to run within a pod. - type: object - properties: - args: - description: |- - Arguments to the entrypoint. - The container image's CMD is used if this is not provided. - Variable references $(VAR_NAME) are expanded using the container's environment. If a variable - cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced - to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will - produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless - of whether the variable exists or not. Cannot be updated. - More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell - type: array - items: - type: string - command: - description: |- - Entrypoint array. Not executed within a shell. - The container image's ENTRYPOINT is used if this is not provided. - Variable references $(VAR_NAME) are expanded using the container's environment. If a variable - cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced - to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will - produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless - of whether the variable exists or not. Cannot be updated. - More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell - type: array - items: - type: string - env: - description: |- - List of environment variables to set in the container. - Cannot be updated. - type: array - items: - description: EnvVar represents an environment variable present in a Container. - type: object - required: - - name - properties: - name: - description: Name of the environment variable. Must be a C_IDENTIFIER. - type: string - value: - description: |- - Variable references $(VAR_NAME) are expanded - using the previously defined environment variables in the container and - any service environment variables. If a variable cannot be resolved, - the reference in the input string will be unchanged. Double $$ are reduced - to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. - "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". - Escaped references will never be expanded, regardless of whether the variable - exists or not. - Defaults to "". - type: string - valueFrom: - description: Source for the environment variable's value. Cannot be used if value is not empty. - type: object - properties: - configMapKeyRef: - description: Selects a key of a ConfigMap. - type: object - required: - - key - properties: - key: - description: The key to select. - type: string - name: - description: |- - Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid? - type: string - optional: - description: Specify whether the ConfigMap or its key must be defined - type: boolean - x-kubernetes-map-type: atomic - fieldRef: - description: This is accessible behind a feature flag - kubernetes.podspec-fieldref - type: object - x-kubernetes-preserve-unknown-fields: true - x-kubernetes-map-type: atomic - resourceFieldRef: - description: This is accessible behind a feature flag - kubernetes.podspec-fieldref - type: object - x-kubernetes-preserve-unknown-fields: true - x-kubernetes-map-type: atomic - secretKeyRef: - description: Selects a key of a secret in the pod's namespace - type: object - required: - - key - properties: - key: - description: The key of the secret to select from. Must be a valid secret key. - type: string - name: - description: |- - Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid? - type: string - optional: - description: Specify whether the Secret or its key must be defined - type: boolean - x-kubernetes-map-type: atomic - envFrom: - description: |- - List of sources to populate environment variables in the container. - The keys defined within a source must be a C_IDENTIFIER. All invalid keys - will be reported as an event when the container is starting. When a key exists in multiple - sources, the value associated with the last source will take precedence. - Values defined by an Env with a duplicate key will take precedence. - Cannot be updated. - type: array - items: - description: EnvFromSource represents the source of a set of ConfigMaps - type: object - properties: - configMapRef: - description: The ConfigMap to select from - type: object - properties: - name: - description: |- - Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid? - type: string - optional: - description: Specify whether the ConfigMap must be defined - type: boolean - x-kubernetes-map-type: atomic - prefix: - description: An optional identifier to prepend to each key in the ConfigMap. Must be a C_IDENTIFIER. - type: string - secretRef: - description: The Secret to select from - type: object - properties: - name: - description: |- - Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid? - type: string - optional: - description: Specify whether the Secret must be defined - type: boolean - x-kubernetes-map-type: atomic - image: - description: |- - Container image name. - More info: https://kubernetes.io/docs/concepts/containers/images - This field is optional to allow higher level config management to default or override - container images in workload controllers like Deployments and StatefulSets. - type: string - imagePullPolicy: - description: |- - Image pull policy. - One of Always, Never, IfNotPresent. - Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. - Cannot be updated. - More info: https://kubernetes.io/docs/concepts/containers/images#updating-images - type: string - livenessProbe: - description: |- - Periodic probe of container liveness. - Container will be restarted if the probe fails. - Cannot be updated. - More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes - type: object - properties: - exec: - description: Exec specifies the action to take. - type: object - properties: - command: - description: |- - Command is the command line to execute inside the container, the working directory for the - command is root ('/') in the container's filesystem. The command is simply exec'd, it is - not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use - a shell, you need to explicitly call out to that shell. - Exit status of 0 is treated as live/healthy and non-zero is unhealthy. - type: array - items: - type: string - failureThreshold: - description: |- - Minimum consecutive failures for the probe to be considered failed after having succeeded. - Defaults to 3. Minimum value is 1. - type: integer - format: int32 - grpc: - description: GRPC specifies an action involving a GRPC port. - type: object - required: - - port - properties: - port: - description: Port number of the gRPC service. Number must be in the range 1 to 65535. - type: integer - format: int32 - service: - description: |- - Service is the name of the service to place in the gRPC HealthCheckRequest - (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). - - - If this is not specified, the default behavior is defined by gRPC. - type: string - httpGet: - description: HTTPGet specifies the http request to perform. - type: object - properties: - host: - description: |- - Host name to connect to, defaults to the pod IP. You probably want to set - "Host" in httpHeaders instead. - type: string - httpHeaders: - description: Custom headers to set in the request. HTTP allows repeated headers. - type: array - items: - description: HTTPHeader describes a custom header to be used in HTTP probes - type: object - required: - - name - - value - properties: - name: - description: |- - The header field name. - This will be canonicalized upon output, so case-variant names will be understood as the same header. - type: string - value: - description: The header field value - type: string - path: - description: Path to access on the HTTP server. - type: string - port: - description: |- - Name or number of the port to access on the container. - Number must be in the range 1 to 65535. - Name must be an IANA_SVC_NAME. - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - scheme: - description: |- - Scheme to use for connecting to the host. - Defaults to HTTP. - type: string - initialDelaySeconds: - description: |- - Number of seconds after the container has started before liveness probes are initiated. - More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes - type: integer - format: int32 - periodSeconds: - description: How often (in seconds) to perform the probe. - type: integer - format: int32 - successThreshold: - description: |- - Minimum consecutive successes for the probe to be considered successful after having failed. - Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. - type: integer - format: int32 - tcpSocket: - description: TCPSocket specifies an action involving a TCP port. - type: object - properties: - host: - description: 'Optional: Host name to connect to, defaults to the pod IP.' - type: string - port: - description: |- - Number or name of the port to access on the container. - Number must be in the range 1 to 65535. - Name must be an IANA_SVC_NAME. - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - timeoutSeconds: - description: |- - Number of seconds after which the probe times out. - Defaults to 1 second. Minimum value is 1. - More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes - type: integer - format: int32 - name: - description: |- - Name of the container specified as a DNS_LABEL. - Each container in a pod must have a unique name (DNS_LABEL). - Cannot be updated. - type: string - ports: - description: |- - List of ports to expose from the container. Not specifying a port here - DOES NOT prevent that port from being exposed. Any port which is - listening on the default "0.0.0.0" address inside a container will be - accessible from the network. - Modifying this array with strategic merge patch may corrupt the data. - For more information See https://github.com/kubernetes/kubernetes/issues/108255. - Cannot be updated. - type: array - items: - description: ContainerPort represents a network port in a single container. - type: object - required: - - containerPort - properties: - containerPort: - description: |- - Number of port to expose on the pod's IP address. - This must be a valid port number, 0 < x < 65536. - type: integer - format: int32 - name: - description: |- - If specified, this must be an IANA_SVC_NAME and unique within the pod. Each - named port in a pod must have a unique name. Name for the port that can be - referred to by services. - type: string - protocol: - description: |- - Protocol for port. Must be UDP, TCP, or SCTP. - Defaults to "TCP". - type: string - default: TCP - x-kubernetes-list-map-keys: - - containerPort - - protocol - x-kubernetes-list-type: map - readinessProbe: - description: |- - Periodic probe of container service readiness. - Container will be removed from service endpoints if the probe fails. - Cannot be updated. - More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes - type: object - properties: - exec: - description: Exec specifies the action to take. - type: object - properties: - command: - description: |- - Command is the command line to execute inside the container, the working directory for the - command is root ('/') in the container's filesystem. The command is simply exec'd, it is - not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use - a shell, you need to explicitly call out to that shell. - Exit status of 0 is treated as live/healthy and non-zero is unhealthy. - type: array - items: - type: string - failureThreshold: - description: |- - Minimum consecutive failures for the probe to be considered failed after having succeeded. - Defaults to 3. Minimum value is 1. - type: integer - format: int32 - grpc: - description: GRPC specifies an action involving a GRPC port. - type: object - required: - - port - properties: - port: - description: Port number of the gRPC service. Number must be in the range 1 to 65535. - type: integer - format: int32 - service: - description: |- - Service is the name of the service to place in the gRPC HealthCheckRequest - (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). - - - If this is not specified, the default behavior is defined by gRPC. - type: string - httpGet: - description: HTTPGet specifies the http request to perform. - type: object - properties: - host: - description: |- - Host name to connect to, defaults to the pod IP. You probably want to set - "Host" in httpHeaders instead. - type: string - httpHeaders: - description: Custom headers to set in the request. HTTP allows repeated headers. - type: array - items: - description: HTTPHeader describes a custom header to be used in HTTP probes - type: object - required: - - name - - value - properties: - name: - description: |- - The header field name. - This will be canonicalized upon output, so case-variant names will be understood as the same header. - type: string - value: - description: The header field value - type: string - path: - description: Path to access on the HTTP server. - type: string - port: - description: |- - Name or number of the port to access on the container. - Number must be in the range 1 to 65535. - Name must be an IANA_SVC_NAME. - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - scheme: - description: |- - Scheme to use for connecting to the host. - Defaults to HTTP. - type: string - initialDelaySeconds: - description: |- - Number of seconds after the container has started before liveness probes are initiated. - More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes - type: integer - format: int32 - periodSeconds: - description: How often (in seconds) to perform the probe. - type: integer - format: int32 - successThreshold: - description: |- - Minimum consecutive successes for the probe to be considered successful after having failed. - Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. - type: integer - format: int32 - tcpSocket: - description: TCPSocket specifies an action involving a TCP port. - type: object - properties: - host: - description: 'Optional: Host name to connect to, defaults to the pod IP.' - type: string - port: - description: |- - Number or name of the port to access on the container. - Number must be in the range 1 to 65535. - Name must be an IANA_SVC_NAME. - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - timeoutSeconds: - description: |- - Number of seconds after which the probe times out. - Defaults to 1 second. Minimum value is 1. - More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes - type: integer - format: int32 - resources: - description: |- - Compute Resources required by this container. - Cannot be updated. - More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ - type: object - properties: - claims: - description: |- - Claims lists the names of resources, defined in spec.resourceClaims, - that are used by this container. - - - This is an alpha field and requires enabling the - DynamicResourceAllocation feature gate. - - - This field is immutable. It can only be set for containers. - type: array - items: - description: ResourceClaim references one entry in PodSpec.ResourceClaims. - type: object - required: - - name - properties: - name: - description: |- - Name must match the name of one entry in pod.spec.resourceClaims of - the Pod where this field is used. It makes that resource available - inside a container. - type: string - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - limits: - description: |- - Limits describes the maximum amount of compute resources allowed. - More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ - type: object - additionalProperties: - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - requests: - description: |- - Requests describes the minimum amount of compute resources required. - If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, - otherwise to an implementation-defined value. Requests cannot exceed Limits. - More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ - type: object - additionalProperties: - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - securityContext: - description: |- - SecurityContext defines the security options the container should be run with. - If set, the fields of SecurityContext override the equivalent fields of PodSecurityContext. - More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ - type: object - properties: - allowPrivilegeEscalation: - description: |- - AllowPrivilegeEscalation controls whether a process can gain more - privileges than its parent process. This bool directly controls if - the no_new_privs flag will be set on the container process. - AllowPrivilegeEscalation is true always when the container is: - 1) run as Privileged - 2) has CAP_SYS_ADMIN - Note that this field cannot be set when spec.os.name is windows. - type: boolean - capabilities: - description: |- - The capabilities to add/drop when running containers. - Defaults to the default set of capabilities granted by the container runtime. - Note that this field cannot be set when spec.os.name is windows. - type: object - properties: - add: - description: This is accessible behind a feature flag - kubernetes.containerspec-addcapabilities - type: array - items: - description: Capability represent POSIX capabilities type - type: string - drop: - description: Removed capabilities - type: array - items: - description: Capability represent POSIX capabilities type - type: string - readOnlyRootFilesystem: - description: |- - Whether this container has a read-only root filesystem. - Default is false. - Note that this field cannot be set when spec.os.name is windows. - type: boolean - runAsGroup: - description: |- - The GID to run the entrypoint of the container process. - Uses runtime default if unset. - May also be set in PodSecurityContext. If set in both SecurityContext and - PodSecurityContext, the value specified in SecurityContext takes precedence. - Note that this field cannot be set when spec.os.name is windows. - type: integer - format: int64 - runAsNonRoot: - description: |- - Indicates that the container must run as a non-root user. - If true, the Kubelet will validate the image at runtime to ensure that it - does not run as UID 0 (root) and fail to start the container if it does. - If unset or false, no such validation will be performed. - May also be set in PodSecurityContext. If set in both SecurityContext and - PodSecurityContext, the value specified in SecurityContext takes precedence. - type: boolean - runAsUser: - description: |- - The UID to run the entrypoint of the container process. - Defaults to user specified in image metadata if unspecified. - May also be set in PodSecurityContext. If set in both SecurityContext and - PodSecurityContext, the value specified in SecurityContext takes precedence. - Note that this field cannot be set when spec.os.name is windows. - type: integer - format: int64 - seccompProfile: - description: |- - The seccomp options to use by this container. If seccomp options are - provided at both the pod & container level, the container options - override the pod options. - Note that this field cannot be set when spec.os.name is windows. - type: object - required: - - type - properties: - localhostProfile: - description: |- - localhostProfile indicates a profile defined in a file on the node should be used. - The profile must be preconfigured on the node to work. - Must be a descending path, relative to the kubelet's configured seccomp profile location. - Must be set if type is "Localhost". Must NOT be set for any other type. - type: string - type: - description: |- - type indicates which kind of seccomp profile will be applied. - Valid options are: - - - Localhost - a profile defined in a file on the node should be used. - RuntimeDefault - the container runtime default profile should be used. - Unconfined - no profile should be applied. - type: string - startupProbe: - description: |- - StartupProbe indicates that the Pod has successfully initialized. - If specified, no other probes are executed until this completes successfully. - If this probe fails, the Pod will be restarted, just as if the livenessProbe failed. - This can be used to provide different probe parameters at the beginning of a Pod's lifecycle, - when it might take a long time to load data or warm a cache, than during steady-state operation. - This cannot be updated. - More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes - type: object - properties: - exec: - description: Exec specifies the action to take. - type: object - properties: - command: - description: |- - Command is the command line to execute inside the container, the working directory for the - command is root ('/') in the container's filesystem. The command is simply exec'd, it is - not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use - a shell, you need to explicitly call out to that shell. - Exit status of 0 is treated as live/healthy and non-zero is unhealthy. - type: array - items: - type: string - failureThreshold: - description: |- - Minimum consecutive failures for the probe to be considered failed after having succeeded. - Defaults to 3. Minimum value is 1. - type: integer - format: int32 - grpc: - description: GRPC specifies an action involving a GRPC port. - type: object - required: - - port - properties: - port: - description: Port number of the gRPC service. Number must be in the range 1 to 65535. - type: integer - format: int32 - service: - description: |- - Service is the name of the service to place in the gRPC HealthCheckRequest - (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). - - - If this is not specified, the default behavior is defined by gRPC. - type: string - httpGet: - description: HTTPGet specifies the http request to perform. - type: object - properties: - host: - description: |- - Host name to connect to, defaults to the pod IP. You probably want to set - "Host" in httpHeaders instead. - type: string - httpHeaders: - description: Custom headers to set in the request. HTTP allows repeated headers. - type: array - items: - description: HTTPHeader describes a custom header to be used in HTTP probes - type: object - required: - - name - - value - properties: - name: - description: |- - The header field name. - This will be canonicalized upon output, so case-variant names will be understood as the same header. - type: string - value: - description: The header field value - type: string - path: - description: Path to access on the HTTP server. - type: string - port: - description: |- - Name or number of the port to access on the container. - Number must be in the range 1 to 65535. - Name must be an IANA_SVC_NAME. - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - scheme: - description: |- - Scheme to use for connecting to the host. - Defaults to HTTP. - type: string - initialDelaySeconds: - description: |- - Number of seconds after the container has started before liveness probes are initiated. - More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes - type: integer - format: int32 - periodSeconds: - description: How often (in seconds) to perform the probe. - type: integer - format: int32 - successThreshold: - description: |- - Minimum consecutive successes for the probe to be considered successful after having failed. - Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. - type: integer - format: int32 - tcpSocket: - description: TCPSocket specifies an action involving a TCP port. - type: object - properties: - host: - description: 'Optional: Host name to connect to, defaults to the pod IP.' - type: string - port: - description: |- - Number or name of the port to access on the container. - Number must be in the range 1 to 65535. - Name must be an IANA_SVC_NAME. - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - timeoutSeconds: - description: |- - Number of seconds after which the probe times out. - Defaults to 1 second. Minimum value is 1. - More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes - type: integer - format: int32 - terminationMessagePath: - description: |- - Optional: Path at which the file to which the container's termination message - will be written is mounted into the container's filesystem. - Message written is intended to be brief final status, such as an assertion failure message. - Will be truncated by the node if greater than 4096 bytes. The total message length across - all containers will be limited to 12kb. - Defaults to /dev/termination-log. - Cannot be updated. - type: string - terminationMessagePolicy: - description: |- - Indicate how the termination message should be populated. File will use the contents of - terminationMessagePath to populate the container status message on both success and failure. - FallbackToLogsOnError will use the last chunk of container log output if the termination - message file is empty and the container exited with an error. - The log output is limited to 2048 bytes or 80 lines, whichever is smaller. - Defaults to File. - Cannot be updated. - type: string - volumeMounts: - description: |- - Pod volumes to mount into the container's filesystem. - Cannot be updated. - type: array - items: - description: VolumeMount describes a mounting of a Volume within a container. - type: object - required: - - mountPath - - name - properties: - mountPath: - description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. - type: string - name: - description: This must match the Name of a Volume. - type: string - readOnly: - description: |- - Mounted read-only if true, read-write otherwise (false or unspecified). - Defaults to false. - type: boolean - subPath: - description: |- - Path within the volume from which the container's volume should be mounted. - Defaults to "" (volume's root). - type: string - workingDir: - description: |- - Container's working directory. - If not specified, the container runtime's default will be used, which - might be configured in the container image. - Cannot be updated. - type: string - dnsConfig: - description: This is accessible behind a feature flag - kubernetes.podspec-dnsconfig - type: object - x-kubernetes-preserve-unknown-fields: true - dnsPolicy: - description: This is accessible behind a feature flag - kubernetes.podspec-dnspolicy - type: string - enableServiceLinks: - description: 'EnableServiceLinks indicates whether information about services should be injected into pod''s environment variables, matching the syntax of Docker links. Optional: Knative defaults this to false.' - type: boolean - hostAliases: - description: This is accessible behind a feature flag - kubernetes.podspec-hostaliases - type: array - items: - description: This is accessible behind a feature flag - kubernetes.podspec-hostaliases - type: object - x-kubernetes-preserve-unknown-fields: true - idleTimeoutSeconds: - description: |- - IdleTimeoutSeconds is the maximum duration in seconds a request will be allowed - to stay open while not receiving any bytes from the user's application. If - unspecified, a system default will be provided. - type: integer - format: int64 - imagePullSecrets: - description: |- - ImagePullSecrets is an optional list of references to secrets in the same namespace to use for pulling any of the images used by this PodSpec. - If specified, these secrets will be passed to individual puller implementations for them to use. - More info: https://kubernetes.io/docs/concepts/containers/images#specifying-imagepullsecrets-on-a-pod - type: array - items: - description: |- - LocalObjectReference contains enough information to let you locate the - referenced object inside the same namespace. - type: object - properties: - name: - description: |- - Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid? - type: string - x-kubernetes-map-type: atomic - initContainers: - description: |- - List of initialization containers belonging to the pod. - Init containers are executed in order prior to containers being started. If any - init container fails, the pod is considered to have failed and is handled according - to its restartPolicy. The name for an init container or normal container must be - unique among all containers. - Init containers may not have Lifecycle actions, Readiness probes, Liveness probes, or Startup probes. - The resourceRequirements of an init container are taken into account during scheduling - by finding the highest request/limit for each resource type, and then using the max of - of that value or the sum of the normal containers. Limits are applied to init containers - in a similar fashion. - Init containers cannot currently be added or removed. - Cannot be updated. - More info: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/ - type: array - items: - description: This is accessible behind a feature flag - kubernetes.podspec-init-containers - type: object - x-kubernetes-preserve-unknown-fields: true - nodeSelector: - description: This is accessible behind a feature flag - kubernetes.podspec-nodeselector - type: object - x-kubernetes-preserve-unknown-fields: true - x-kubernetes-map-type: atomic - priorityClassName: - description: This is accessible behind a feature flag - kubernetes.podspec-priorityclassname - type: string - x-kubernetes-preserve-unknown-fields: true - responseStartTimeoutSeconds: - description: |- - ResponseStartTimeoutSeconds is the maximum duration in seconds that the request - routing layer will wait for a request delivered to a container to begin - sending any network traffic. - type: integer - format: int64 - runtimeClassName: - description: This is accessible behind a feature flag - kubernetes.podspec-runtimeclassname - type: string - x-kubernetes-preserve-unknown-fields: true - schedulerName: - description: This is accessible behind a feature flag - kubernetes.podspec-schedulername - type: string - x-kubernetes-preserve-unknown-fields: true - securityContext: - description: This is accessible behind a feature flag - kubernetes.podspec-securitycontext - type: object - x-kubernetes-preserve-unknown-fields: true - serviceAccountName: - description: |- - ServiceAccountName is the name of the ServiceAccount to use to run this pod. - More info: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/ - type: string - shareProcessNamespace: - description: This is accessible behind a feature flag - kubernetes.podspec-shareproccessnamespace - type: boolean - x-kubernetes-preserve-unknown-fields: true - timeoutSeconds: - description: |- - TimeoutSeconds is the maximum duration in seconds that the request instance - is allowed to respond to a request. If unspecified, a system default will - be provided. - type: integer - format: int64 - tolerations: - description: This is accessible behind a feature flag - kubernetes.podspec-tolerations - type: array - items: - description: This is accessible behind a feature flag - kubernetes.podspec-tolerations - type: object - x-kubernetes-preserve-unknown-fields: true - topologySpreadConstraints: - description: This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints - type: array - items: - description: This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints - type: object - x-kubernetes-preserve-unknown-fields: true - volumes: - description: |- - List of volumes that can be mounted by containers belonging to the pod. - More info: https://kubernetes.io/docs/concepts/storage/volumes - type: array - items: - description: Volume represents a named volume in a pod that may be accessed by any container in the pod. - type: object - required: - - name - properties: - configMap: - description: configMap represents a configMap that should populate this volume - type: object - properties: - defaultMode: - description: |- - defaultMode is optional: mode bits used to set permissions on created files by default. - Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. - YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. - Defaults to 0644. - Directories within the path are not affected by this setting. - This might be in conflict with other options that affect the file - mode, like fsGroup, and the result can be other mode bits set. - type: integer - format: int32 - items: - description: |- - items if unspecified, each key-value pair in the Data field of the referenced - ConfigMap will be projected into the volume as a file whose name is the - key and content is the value. If specified, the listed keys will be - projected into the specified paths, and unlisted keys will not be - present. If a key is specified which is not present in the ConfigMap, - the volume setup will error unless it is marked optional. Paths must be - relative and may not contain the '..' path or start with '..'. - type: array - items: - description: Maps a string key to a path within a volume. - type: object - required: - - key - - path - properties: - key: - description: key is the key to project. - type: string - mode: - description: |- - mode is Optional: mode bits used to set permissions on this file. - Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. - YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. - If not specified, the volume defaultMode will be used. - This might be in conflict with other options that affect the file - mode, like fsGroup, and the result can be other mode bits set. - type: integer - format: int32 - path: - description: |- - path is the relative path of the file to map the key to. - May not be an absolute path. - May not contain the path element '..'. - May not start with the string '..'. - type: string - name: - description: |- - Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid? - type: string - optional: - description: optional specify whether the ConfigMap or its keys must be defined - type: boolean - x-kubernetes-map-type: atomic - emptyDir: - description: This is accessible behind a feature flag - kubernetes.podspec-emptydir - type: object - x-kubernetes-preserve-unknown-fields: true - name: - description: |- - name of the volume. - Must be a DNS_LABEL and unique within the pod. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - persistentVolumeClaim: - description: This is accessible behind a feature flag - kubernetes.podspec-persistent-volume-claim - type: object - x-kubernetes-preserve-unknown-fields: true - projected: - description: projected items for all in one resources secrets, configmaps, and downward API - type: object - properties: - defaultMode: - description: |- - defaultMode are the mode bits used to set permissions on created files by default. - Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. - YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. - Directories within the path are not affected by this setting. - This might be in conflict with other options that affect the file - mode, like fsGroup, and the result can be other mode bits set. - type: integer - format: int32 - sources: - description: sources is the list of volume projections - type: array - items: - description: Projection that may be projected along with other supported volume types - type: object - properties: - configMap: - description: configMap information about the configMap data to project - type: object - properties: - items: - description: |- - items if unspecified, each key-value pair in the Data field of the referenced - ConfigMap will be projected into the volume as a file whose name is the - key and content is the value. If specified, the listed keys will be - projected into the specified paths, and unlisted keys will not be - present. If a key is specified which is not present in the ConfigMap, - the volume setup will error unless it is marked optional. Paths must be - relative and may not contain the '..' path or start with '..'. - type: array - items: - description: Maps a string key to a path within a volume. - type: object - required: - - key - - path - properties: - key: - description: key is the key to project. - type: string - mode: - description: |- - mode is Optional: mode bits used to set permissions on this file. - Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. - YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. - If not specified, the volume defaultMode will be used. - This might be in conflict with other options that affect the file - mode, like fsGroup, and the result can be other mode bits set. - type: integer - format: int32 - path: - description: |- - path is the relative path of the file to map the key to. - May not be an absolute path. - May not contain the path element '..'. - May not start with the string '..'. - type: string - name: - description: |- - Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid? - type: string - optional: - description: optional specify whether the ConfigMap or its keys must be defined - type: boolean - x-kubernetes-map-type: atomic - downwardAPI: - description: downwardAPI information about the downwardAPI data to project - type: object - properties: - items: - description: Items is a list of DownwardAPIVolume file - type: array - items: - description: DownwardAPIVolumeFile represents information to create the file containing the pod field - type: object - required: - - path - properties: - fieldRef: - description: 'Required: Selects a field of the pod: only annotations, labels, name and namespace are supported.' - type: object - required: - - fieldPath - properties: - apiVersion: - description: Version of the schema the FieldPath is written in terms of, defaults to "v1". - type: string - fieldPath: - description: Path of the field to select in the specified API version. - type: string - x-kubernetes-map-type: atomic - mode: - description: |- - Optional: mode bits used to set permissions on this file, must be an octal value - between 0000 and 0777 or a decimal value between 0 and 511. - YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. - If not specified, the volume defaultMode will be used. - This might be in conflict with other options that affect the file - mode, like fsGroup, and the result can be other mode bits set. - type: integer - format: int32 - path: - description: 'Required: Path is the relative path name of the file to be created. Must not be absolute or contain the ''..'' path. Must be utf-8 encoded. The first item of the relative path must not start with ''..''' - type: string - resourceFieldRef: - description: |- - Selects a resource of the container: only resources limits and requests - (limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported. - type: object - required: - - resource - properties: - containerName: - description: 'Container name: required for volumes, optional for env vars' - type: string - divisor: - description: Specifies the output format of the exposed resources, defaults to "1" - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - resource: - description: 'Required: resource to select' - type: string - x-kubernetes-map-type: atomic - secret: - description: secret information about the secret data to project - type: object - properties: - items: - description: |- - items if unspecified, each key-value pair in the Data field of the referenced - Secret will be projected into the volume as a file whose name is the - key and content is the value. If specified, the listed keys will be - projected into the specified paths, and unlisted keys will not be - present. If a key is specified which is not present in the Secret, - the volume setup will error unless it is marked optional. Paths must be - relative and may not contain the '..' path or start with '..'. - type: array - items: - description: Maps a string key to a path within a volume. - type: object - required: - - key - - path - properties: - key: - description: key is the key to project. - type: string - mode: - description: |- - mode is Optional: mode bits used to set permissions on this file. - Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. - YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. - If not specified, the volume defaultMode will be used. - This might be in conflict with other options that affect the file - mode, like fsGroup, and the result can be other mode bits set. - type: integer - format: int32 - path: - description: |- - path is the relative path of the file to map the key to. - May not be an absolute path. - May not contain the path element '..'. - May not start with the string '..'. - type: string - name: - description: |- - Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid? - type: string - optional: - description: optional field specify whether the Secret or its key must be defined - type: boolean - x-kubernetes-map-type: atomic - serviceAccountToken: - description: serviceAccountToken is information about the serviceAccountToken data to project - type: object - required: - - path - properties: - audience: - description: |- - audience is the intended audience of the token. A recipient of a token - must identify itself with an identifier specified in the audience of the - token, and otherwise should reject the token. The audience defaults to the - identifier of the apiserver. - type: string - expirationSeconds: - description: |- - expirationSeconds is the requested duration of validity of the service - account token. As the token approaches expiration, the kubelet volume - plugin will proactively rotate the service account token. The kubelet will - start trying to rotate the token if the token is older than 80 percent of - its time to live or if the token is older than 24 hours.Defaults to 1 hour - and must be at least 10 minutes. - type: integer - format: int64 - path: - description: |- - path is the path relative to the mount point of the file to project the - token into. - type: string - secret: - description: |- - secret represents a secret that should populate this volume. - More info: https://kubernetes.io/docs/concepts/storage/volumes#secret - type: object - properties: - defaultMode: - description: |- - defaultMode is Optional: mode bits used to set permissions on created files by default. - Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. - YAML accepts both octal and decimal values, JSON requires decimal values - for mode bits. Defaults to 0644. - Directories within the path are not affected by this setting. - This might be in conflict with other options that affect the file - mode, like fsGroup, and the result can be other mode bits set. - type: integer - format: int32 - items: - description: |- - items If unspecified, each key-value pair in the Data field of the referenced - Secret will be projected into the volume as a file whose name is the - key and content is the value. If specified, the listed keys will be - projected into the specified paths, and unlisted keys will not be - present. If a key is specified which is not present in the Secret, - the volume setup will error unless it is marked optional. Paths must be - relative and may not contain the '..' path or start with '..'. - type: array - items: - description: Maps a string key to a path within a volume. - type: object - required: - - key - - path - properties: - key: - description: key is the key to project. - type: string - mode: - description: |- - mode is Optional: mode bits used to set permissions on this file. - Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. - YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. - If not specified, the volume defaultMode will be used. - This might be in conflict with other options that affect the file - mode, like fsGroup, and the result can be other mode bits set. - type: integer - format: int32 - path: - description: |- - path is the relative path of the file to map the key to. - May not be an absolute path. - May not contain the path element '..'. - May not start with the string '..'. - type: string - optional: - description: optional field specify whether the Secret or its keys must be defined - type: boolean - secretName: - description: |- - secretName is the name of the secret in the pod's namespace to use. - More info: https://kubernetes.io/docs/concepts/storage/volumes#secret - type: string - traffic: - description: |- - Traffic specifies how to distribute traffic over a collection of - revisions and configurations. - type: array - items: - description: TrafficTarget holds a single entry of the routing table for a Route. - type: object - properties: - configurationName: - description: |- - ConfigurationName of a configuration to whose latest revision we will send - this portion of traffic. When the "status.latestReadyRevisionName" of the - referenced configuration changes, we will automatically migrate traffic - from the prior "latest ready" revision to the new one. This field is never - set in Route's status, only its spec. This is mutually exclusive with - RevisionName. - type: string - latestRevision: - description: |- - LatestRevision may be optionally provided to indicate that the latest - ready Revision of the Configuration should be used for this traffic - target. When provided LatestRevision must be true if RevisionName is - empty; it must be false when RevisionName is non-empty. - type: boolean - percent: - description: |- - Percent indicates that percentage based routing should be used and - the value indicates the percent of traffic that is be routed to this - Revision or Configuration. `0` (zero) mean no traffic, `100` means all - traffic. - When percentage based routing is being used the follow rules apply: - - the sum of all percent values must equal 100 - - when not specified, the implied value for `percent` is zero for - that particular Revision or Configuration - type: integer - format: int64 - revisionName: - description: |- - RevisionName of a specific revision to which to send this portion of - traffic. This is mutually exclusive with ConfigurationName. - type: string - tag: - description: |- - Tag is optionally used to expose a dedicated url for referencing - this target exclusively. - type: string - url: - description: |- - URL displays the URL for accessing named traffic targets. URL is displayed in - status, and is disallowed on spec. URL must contain a scheme (e.g. http://) and - a hostname, but may not contain anything else (e.g. basic auth, url path, etc.) - type: string - status: - description: ServiceStatus represents the Status stanza of the Service resource. - type: object - properties: - address: - description: Address holds the information needed for a Route to be the target of an event. - type: object - properties: - CACerts: - description: |- - CACerts is the Certification Authority (CA) certificates in PEM format - according to https://www.rfc-editor.org/rfc/rfc7468. - type: string - audience: - description: Audience is the OIDC audience for this address. - type: string - name: - description: Name is the name of the address. - type: string - url: - type: string - annotations: - description: |- - Annotations is additional Status fields for the Resource to save some - additional State as well as convey more information to the user. This is - roughly akin to Annotations on any k8s resource, just the reconciler conveying - richer information outwards. - type: object - additionalProperties: - type: string - conditions: - description: Conditions the latest available observations of a resource's current state. - type: array - items: - description: |- - Condition defines a readiness condition for a Knative resource. - See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties - type: object - required: - - status - - type - properties: - lastTransitionTime: - description: |- - LastTransitionTime is the last time the condition transitioned from one status to another. - We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic - differences (all other things held constant). - type: string - message: - description: A human readable message indicating details about the transition. - type: string - reason: - description: The reason for the condition's last transition. - type: string - severity: - description: |- - Severity with which to treat failures of this type of condition. - When this is not specified, it defaults to Error. - type: string - status: - description: Status of the condition, one of True, False, Unknown. - type: string - type: - description: Type of condition. - type: string - latestCreatedRevisionName: - description: |- - LatestCreatedRevisionName is the last revision that was created from this - Configuration. It might not be ready yet, for that use LatestReadyRevisionName. - type: string - latestReadyRevisionName: - description: |- - LatestReadyRevisionName holds the name of the latest Revision stamped out - from this Configuration that has had its "Ready" condition become "True". - type: string - observedGeneration: - description: |- - ObservedGeneration is the 'Generation' of the Service that - was last processed by the controller. - type: integer - format: int64 - traffic: - description: |- - Traffic holds the configured traffic distribution. - These entries will always contain RevisionName references. - When ConfigurationName appears in the spec, this will hold the - LatestReadyRevisionName that we last observed. - type: array - items: - description: TrafficTarget holds a single entry of the routing table for a Route. - type: object - properties: - configurationName: - description: |- - ConfigurationName of a configuration to whose latest revision we will send - this portion of traffic. When the "status.latestReadyRevisionName" of the - referenced configuration changes, we will automatically migrate traffic - from the prior "latest ready" revision to the new one. This field is never - set in Route's status, only its spec. This is mutually exclusive with - RevisionName. - type: string - latestRevision: - description: |- - LatestRevision may be optionally provided to indicate that the latest - ready Revision of the Configuration should be used for this traffic - target. When provided LatestRevision must be true if RevisionName is - empty; it must be false when RevisionName is non-empty. - type: boolean - percent: - description: |- - Percent indicates that percentage based routing should be used and - the value indicates the percent of traffic that is be routed to this - Revision or Configuration. `0` (zero) mean no traffic, `100` means all - traffic. - When percentage based routing is being used the follow rules apply: - - the sum of all percent values must equal 100 - - when not specified, the implied value for `percent` is zero for - that particular Revision or Configuration - type: integer - format: int64 - revisionName: - description: |- - RevisionName of a specific revision to which to send this portion of - traffic. This is mutually exclusive with ConfigurationName. - type: string - tag: - description: |- - Tag is optionally used to expose a dedicated url for referencing - this target exclusively. - type: string - url: - description: |- - URL displays the URL for accessing named traffic targets. URL is displayed in - status, and is disallowed on spec. URL must contain a scheme (e.g. http://) and - a hostname, but may not contain anything else (e.g. basic auth, url path, etc.) - type: string - url: - description: |- - URL holds the url that will distribute traffic over the provided traffic targets. - It generally has the form http[s]://{route-name}.{route-namespace}.{cluster-level-suffix} - type: string ---- -# Copyright 2018 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - name: images.caching.internal.knative.dev - labels: - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.15.0" - knative.dev/crd-install: "true" -spec: - group: caching.internal.knative.dev - names: - kind: Image - plural: images - singular: image - categories: - - knative-internal - - caching - scope: Namespaced - versions: - - name: v1alpha1 - served: true - storage: true - subresources: - status: {} - schema: - openAPIV3Schema: - description: |- - Image is a Knative abstraction that encapsulates the interface by which Knative - components express a desire to have a particular image cached. - type: object - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: Spec holds the desired state of the Image (from the client). - type: object - required: - - image - properties: - image: - description: Image is the name of the container image url to cache across the cluster. - type: string - imagePullSecrets: - description: |- - ImagePullSecrets contains the names of the Kubernetes Secrets containing login - information used by the Pods which will run this container. - type: array - items: - description: |- - LocalObjectReference contains enough information to let you locate the - referenced object inside the same namespace. - type: object - properties: - name: - description: |- - Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - TODO: Add other useful fields. apiVersion, kind, uid? - type: string - x-kubernetes-map-type: atomic - serviceAccountName: - description: |- - ServiceAccountName is the name of the Kubernetes ServiceAccount as which the Pods - will run this container. This is potentially used to authenticate the image pull - if the service account has attached pull secrets. For more information: - https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#add-imagepullsecrets-to-a-service-account - type: string - status: - description: Status communicates the observed state of the Image (from the controller). - type: object - properties: - annotations: - description: |- - Annotations is additional Status fields for the Resource to save some - additional State as well as convey more information to the user. This is - roughly akin to Annotations on any k8s resource, just the reconciler conveying - richer information outwards. - type: object - additionalProperties: - type: string - conditions: - description: Conditions the latest available observations of a resource's current state. - type: array - items: - description: |- - Condition defines a readiness condition for a Knative resource. - See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties - type: object - required: - - status - - type - properties: - lastTransitionTime: - description: |- - LastTransitionTime is the last time the condition transitioned from one status to another. - We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic - differences (all other things held constant). - type: string - message: - description: A human readable message indicating details about the transition. - type: string - reason: - description: The reason for the condition's last transition. - type: string - severity: - description: |- - Severity with which to treat failures of this type of condition. - When this is not specified, it defaults to Error. - type: string - status: - description: Status of the condition, one of True, False, Unknown. - type: string - type: - description: Type of condition. - type: string - observedGeneration: - description: |- - ObservedGeneration is the 'Generation' of the Service that - was last processed by the controller. - type: integer - format: int64 - additionalPrinterColumns: - - name: Image - type: string - jsonPath: .spec.image ---- -# Source: https://github.com/knative/serving/releases/download/knative-v1.15.0/serving-core.yaml ---- -# Copyright 2018 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: v1 -kind: Namespace -metadata: - name: knative-serving - labels: - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.15.0" ---- -# Copyright 2023 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: knative-serving-activator - namespace: knative-serving - labels: - serving.knative.dev/controller: "true" - app.kubernetes.io/version: "1.15.0" - app.kubernetes.io/name: knative-serving -rules: - - apiGroups: [""] - resources: ["configmaps", "secrets"] - verbs: ["get", "list", "watch"] - - apiGroups: [""] - resources: ["secrets"] - verbs: ["get", "list", "watch"] - resourceNames: ["routing-serving-certs", "knative-serving-certs"] ---- -kind: ClusterRole -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: knative-serving-activator-cluster - labels: - serving.knative.dev/controller: "true" - app.kubernetes.io/version: "1.15.0" - app.kubernetes.io/name: knative-serving -rules: - - apiGroups: [""] - resources: ["services", "endpoints"] - verbs: ["get", "list", "watch"] - - apiGroups: ["serving.knative.dev"] - resources: ["revisions"] - verbs: ["get", "list", "watch"] ---- -# Copyright 2019 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -# Use this aggregated ClusterRole when you need readonly access to "Addressables" -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - # Named like this to avoid clashing with eventing's existing `addressable-resolver` role - # (which should be identical, but isn't guaranteed to be installed alongside serving). - name: knative-serving-aggregated-addressable-resolver - labels: - app.kubernetes.io/version: "1.15.0" - app.kubernetes.io/name: knative-serving -aggregationRule: - clusterRoleSelectors: - - matchLabels: - duck.knative.dev/addressable: "true" ---- -kind: ClusterRole -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: knative-serving-addressable-resolver - labels: - app.kubernetes.io/version: "1.15.0" - app.kubernetes.io/name: knative-serving - # Labeled to facilitate aggregated cluster roles that act on Addressables. - duck.knative.dev/addressable: "true" -# Do not use this role directly. These rules will be added to the "addressable-resolver" role. -rules: - - apiGroups: - - serving.knative.dev - resources: - - routes - - routes/status - - services - - services/status - verbs: - - get - - list - - watch ---- -# Copyright 2019 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -kind: ClusterRole -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: knative-serving-namespaced-admin - labels: - rbac.authorization.k8s.io/aggregate-to-admin: "true" - app.kubernetes.io/version: "1.15.0" - app.kubernetes.io/name: knative-serving -rules: - - apiGroups: ["serving.knative.dev"] - resources: ["*"] - verbs: ["*"] - - apiGroups: ["networking.internal.knative.dev", "autoscaling.internal.knative.dev", "caching.internal.knative.dev"] - resources: ["*"] - verbs: ["get", "list", "watch"] ---- -kind: ClusterRole -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: knative-serving-namespaced-edit - labels: - rbac.authorization.k8s.io/aggregate-to-edit: "true" - app.kubernetes.io/version: "1.15.0" - app.kubernetes.io/name: knative-serving -rules: - - apiGroups: ["serving.knative.dev"] - resources: ["*"] - verbs: ["create", "update", "patch", "delete"] - - apiGroups: ["networking.internal.knative.dev", "autoscaling.internal.knative.dev", "caching.internal.knative.dev"] - resources: ["*"] - verbs: ["get", "list", "watch"] ---- -kind: ClusterRole -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: knative-serving-namespaced-view - labels: - rbac.authorization.k8s.io/aggregate-to-view: "true" - app.kubernetes.io/version: "1.15.0" - app.kubernetes.io/name: knative-serving -rules: - - apiGroups: ["serving.knative.dev", "networking.internal.knative.dev", "autoscaling.internal.knative.dev", "caching.internal.knative.dev"] - resources: ["*"] - verbs: ["get", "list", "watch"] ---- -# Copyright 2019 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -kind: ClusterRole -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: knative-serving-core - labels: - serving.knative.dev/controller: "true" - app.kubernetes.io/version: "1.15.0" - app.kubernetes.io/name: knative-serving -rules: - - apiGroups: [""] - resources: ["pods", "namespaces", "secrets", "configmaps", "endpoints", "services", "events", "serviceaccounts"] - verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] - - apiGroups: [""] - resources: ["endpoints/restricted"] # Permission for RestrictedEndpointsAdmission - verbs: ["create"] - - apiGroups: [""] - resources: ["namespaces/finalizers"] # finalizers are needed for the owner reference of the webhook - verbs: ["update"] - - apiGroups: ["apps"] - resources: ["deployments", "deployments/finalizers"] # finalizers are needed for the owner reference of the webhook - verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] - - apiGroups: ["admissionregistration.k8s.io"] - resources: ["mutatingwebhookconfigurations", "validatingwebhookconfigurations"] - verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] - - apiGroups: ["apiextensions.k8s.io"] - resources: ["customresourcedefinitions", "customresourcedefinitions/status"] - verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] - - apiGroups: ["autoscaling"] - resources: ["horizontalpodautoscalers"] - verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] - - apiGroups: ["coordination.k8s.io"] - resources: ["leases"] - verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] - - apiGroups: ["serving.knative.dev", "autoscaling.internal.knative.dev", "networking.internal.knative.dev"] - resources: ["*", "*/status", "*/finalizers"] - verbs: ["get", "list", "create", "update", "delete", "deletecollection", "patch", "watch"] - - apiGroups: ["caching.internal.knative.dev"] - resources: ["images"] - verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] - - apiGroups: ["cert-manager.io"] - resources: ["certificates", "clusterissuers", "certificaterequests", "issuers"] - verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] - - apiGroups: ["acme.cert-manager.io"] - resources: ["challenges"] - verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] - - apiGroups: ["rbac.authorization.k8s.io"] - resources: ["clusterroles"] - verbs: ["delete"] - resourceNames: ["knative-serving-certmanager"] ---- -# Copyright 2019 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -kind: ClusterRole -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: knative-serving-podspecable-binding - labels: - app.kubernetes.io/version: "1.15.0" - app.kubernetes.io/name: knative-serving - # Labeled to facilitate aggregated cluster roles that act on PodSpecables. - duck.knative.dev/podspecable: "true" -# Do not use this role directly. These rules will be added to the "podspecable-binder" role. -rules: - - apiGroups: - - serving.knative.dev - resources: - - configurations - - services - verbs: - - list - - watch - - patch ---- -# Copyright 2018 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: v1 -kind: ServiceAccount -metadata: - name: controller - namespace: knative-serving - labels: - app.kubernetes.io/component: controller - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.15.0" ---- -kind: ClusterRole -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: knative-serving-admin - labels: - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.15.0" -aggregationRule: - clusterRoleSelectors: - - matchLabels: - serving.knative.dev/controller: "true" ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: knative-serving-controller-admin - labels: - app.kubernetes.io/component: controller - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.15.0" -subjects: - - kind: ServiceAccount - name: controller - namespace: knative-serving -roleRef: - kind: ClusterRole - name: knative-serving-admin - apiGroup: rbac.authorization.k8s.io ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: knative-serving-controller-addressable-resolver - labels: - app.kubernetes.io/component: controller - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.15.0" -subjects: - - kind: ServiceAccount - name: controller - namespace: knative-serving -roleRef: - kind: ClusterRole - name: knative-serving-aggregated-addressable-resolver - apiGroup: rbac.authorization.k8s.io ---- -apiVersion: v1 -kind: ServiceAccount -metadata: - name: activator - namespace: knative-serving - labels: - app.kubernetes.io/component: activator - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.15.0" ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: knative-serving-activator - namespace: knative-serving - labels: - app.kubernetes.io/component: activator - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.15.0" -subjects: - - kind: ServiceAccount - name: activator - namespace: knative-serving -roleRef: - kind: Role - name: knative-serving-activator - apiGroup: rbac.authorization.k8s.io ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: knative-serving-activator-cluster - labels: - app.kubernetes.io/component: activator - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.15.0" -subjects: - - kind: ServiceAccount - name: activator - namespace: knative-serving -roleRef: - kind: ClusterRole - name: knative-serving-activator-cluster - apiGroup: rbac.authorization.k8s.io ---- -apiVersion: networking.internal.knative.dev/v1alpha1 -kind: Certificate -metadata: - annotations: - networking.knative.dev/certificate.class: cert-manager.certificate.networking.knative.dev - labels: - networking.knative.dev/certificate-type: system-internal - name: routing-serving-certs - namespace: knative-serving -spec: - dnsNames: - - kn-routing - - data-plane.knative.dev # for reverse-compatibility with net-* implementations that do not work with multi-SANs - secretName: routing-serving-certs ---- -# Copyright 2018 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: caching.internal.knative.dev/v1alpha1 -kind: Image -metadata: - name: queue-proxy - namespace: knative-serving - labels: - app.kubernetes.io/component: queue-proxy - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.15.0" -spec: - # This is the Go import path for the binary that is containerized - # and substituted here. - image: gcr.io/knative-releases/knative.dev/serving/cmd/queue@sha256:d313c823f25a09326a7c3c2ec9833c5e005791bc3acb4036ebf33735cbb62bee ---- -# Copyright 2018 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: v1 -kind: ConfigMap -metadata: - name: config-autoscaler - namespace: knative-serving - labels: - app.kubernetes.io/component: autoscaler - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.15.0" - annotations: - knative.dev/example-checksum: "47c2487f" -data: - _example: | - ################################ - # # - # EXAMPLE CONFIGURATION # - # # - ################################ - - # This block is not actually functional configuration, - # but serves to illustrate the available configuration - # options and document them in a way that is accessible - # to users that `kubectl edit` this config map. - # - # These sample configuration options may be copied out of - # this example block and unindented to be in the data block - # to actually change the configuration. - - # The Revision ContainerConcurrency field specifies the maximum number - # of requests the Container can handle at once. Container concurrency - # target percentage is how much of that maximum to use in a stable - # state. E.g. if a Revision specifies ContainerConcurrency of 10, then - # the Autoscaler will try to maintain 7 concurrent connections per pod - # on average. - # Note: this limit will be applied to container concurrency set at every - # level (ConfigMap, Revision Spec or Annotation). - # For legacy and backwards compatibility reasons, this value also accepts - # fractional values in (0, 1] interval (i.e. 0.7 ⇒ 70%). - # Thus minimal percentage value must be greater than 1.0, or it will be - # treated as a fraction. - # NOTE: that this value does not affect actual number of concurrent requests - # the user container may receive, but only the average number of requests - # that the revision pods will receive. - container-concurrency-target-percentage: "70" - - # The container concurrency target default is what the Autoscaler will - # try to maintain when concurrency is used as the scaling metric for the - # Revision and the Revision specifies unlimited concurrency. - # When revision explicitly specifies container concurrency, that value - # will be used as a scaling target for autoscaler. - # When specifying unlimited concurrency, the autoscaler will - # horizontally scale the application based on this target concurrency. - # This is what we call "soft limit" in the documentation, i.e. it only - # affects number of pods and does not affect the number of requests - # individual pod processes. - # The value must be a positive number such that the value multiplied - # by container-concurrency-target-percentage is greater than 0.01. - # NOTE: that this value will be adjusted by application of - # container-concurrency-target-percentage, i.e. by default - # the system will target on average 70 concurrent requests - # per revision pod. - # NOTE: Only one metric can be used for autoscaling a Revision. - container-concurrency-target-default: "100" - - # The requests per second (RPS) target default is what the Autoscaler will - # try to maintain when RPS is used as the scaling metric for a Revision and - # the Revision specifies unlimited RPS. Even when specifying unlimited RPS, - # the autoscaler will horizontally scale the application based on this - # target RPS. - # Must be greater than 1.0. - # NOTE: Only one metric can be used for autoscaling a Revision. - requests-per-second-target-default: "200" - - # The target burst capacity specifies the size of burst in concurrent - # requests that the system operator expects the system will receive. - # Autoscaler will try to protect the system from queueing by introducing - # Activator in the request path if the current spare capacity of the - # service is less than this setting. - # If this setting is 0, then Activator will be in the request path only - # when the revision is scaled to 0. - # If this setting is > 0 and container-concurrency-target-percentage is - # 100% or 1.0, then activator will always be in the request path. - # -1 denotes unlimited target-burst-capacity and activator will always - # be in the request path. - # Other negative values are invalid. - target-burst-capacity: "211" - - # When operating in a stable mode, the autoscaler operates on the - # average concurrency over the stable window. - # Stable window must be in whole seconds. - stable-window: "60s" - - # When observed average concurrency during the panic window reaches - # panic-threshold-percentage the target concurrency, the autoscaler - # enters panic mode. When operating in panic mode, the autoscaler - # scales on the average concurrency over the panic window which is - # panic-window-percentage of the stable-window. - # Must be in the [1, 100] range. - # When computing the panic window it will be rounded to the closest - # whole second, at least 1s. - panic-window-percentage: "10.0" - - # The percentage of the container concurrency target at which to - # enter panic mode when reached within the panic window. - panic-threshold-percentage: "200.0" - - # Max scale up rate limits the rate at which the autoscaler will - # increase pod count. It is the maximum ratio of desired pods versus - # observed pods. - # Cannot be less or equal to 1. - # I.e with value of 2.0 the number of pods can at most go N to 2N - # over single Autoscaler period (2s), but at least N to - # N+1, if Autoscaler needs to scale up. - max-scale-up-rate: "1000.0" - - # Max scale down rate limits the rate at which the autoscaler will - # decrease pod count. It is the maximum ratio of observed pods versus - # desired pods. - # Cannot be less or equal to 1. - # I.e. with value of 2.0 the number of pods can at most go N to N/2 - # over single Autoscaler evaluation period (2s), but at - # least N to N-1, if Autoscaler needs to scale down. - max-scale-down-rate: "2.0" - - # Scale to zero feature flag. - enable-scale-to-zero: "true" - - # Scale to zero grace period is the time an inactive revision is left - # running before it is scaled to zero (must be positive, but recommended - # at least a few seconds if running with mesh networking). - # This is the upper limit and is provided not to enforce timeout after - # the revision stopped receiving requests for stable window, but to - # ensure network reprogramming to put activator in the path has completed. - # If the system determines that a shorter period is satisfactory, - # then the system will only wait that amount of time before scaling to 0. - # NOTE: this period might actually be 0, if activator has been - # in the request path sufficiently long. - # If there is necessity for the last pod to linger longer use - # scale-to-zero-pod-retention-period flag. - scale-to-zero-grace-period: "30s" - - # Scale to zero pod retention period defines the minimum amount - # of time the last pod will remain after Autoscaler has decided to - # scale to zero. - # This flag is for the situations where the pod startup is very expensive - # and the traffic is bursty (requiring smaller windows for fast action), - # but patchy. - # The larger of this flag and `scale-to-zero-grace-period` will effectively - # determine how the last pod will hang around. - scale-to-zero-pod-retention-period: "0s" - - # pod-autoscaler-class specifies the default pod autoscaler class - # that should be used if none is specified. If omitted, - # the Knative Pod Autoscaler (KPA) is used by default. - pod-autoscaler-class: "kpa.autoscaling.knative.dev" - - # The capacity of a single activator task. - # The `unit` is one concurrent request proxied by the activator. - # activator-capacity must be at least 1. - # This value is used for computation of the Activator subset size. - # See the algorithm here: http://bit.ly/38XiCZ3. - # TODO(vagababov): tune after actual benchmarking. - activator-capacity: "100.0" - - # initial-scale is the cluster-wide default value for the initial target - # scale of a revision after creation, unless overridden by the - # "autoscaling.knative.dev/initialScale" annotation. - # This value must be greater than 0 unless allow-zero-initial-scale is true. - initial-scale: "1" - - # allow-zero-initial-scale controls whether either the cluster-wide initial-scale flag, - # or the "autoscaling.knative.dev/initialScale" annotation, can be set to 0. - allow-zero-initial-scale: "false" - - # min-scale is the cluster-wide default value for the min scale of a revision, - # unless overridden by the "autoscaling.knative.dev/minScale" annotation. - min-scale: "0" - - # max-scale is the cluster-wide default value for the max scale of a revision, - # unless overridden by the "autoscaling.knative.dev/maxScale" annotation. - # If set to 0, the revision has no maximum scale. - max-scale: "0" - - # scale-down-delay is the amount of time that must pass at reduced - # concurrency before a scale down decision is applied. This can be useful, - # for example, to maintain replica count and avoid a cold start penalty if - # more requests come in within the scale down delay period. - # The default, 0s, imposes no delay at all. - scale-down-delay: "0s" - - # max-scale-limit sets the maximum permitted value for the max scale of a revision. - # When this is set to a positive value, a revision with a maxScale above that value - # (including a maxScale of "0" = unlimited) is disallowed. - # A value of zero (the default) allows any limit, including unlimited. - max-scale-limit: "0" ---- -# Copyright 2020 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: v1 -kind: ConfigMap -metadata: - name: config-certmanager - namespace: knative-serving - labels: - app.kubernetes.io/name: knative-serving - app.kubernetes.io/component: controller - app.kubernetes.io/version: "1.15.0" - networking.knative.dev/certificate-provider: cert-manager - annotations: - knative.dev/example-checksum: "b7a9a602" -data: - _example: | - ################################ - # # - # EXAMPLE CONFIGURATION # - # # - ################################ - - # This block is not actually functional configuration, - # but serves to illustrate the available configuration - # options and document them in a way that is accessible - # to users that `kubectl edit` this config map. - # - # These sample configuration options may be copied out of - # this block and unindented to actually change the configuration. - - # issuerRef is a reference to the issuer for external-domain certificates used for ingress. - # IssuerRef should be either `ClusterIssuer` or `Issuer`. - # Please refer `IssuerRef` in https://cert-manager.io/docs/concepts/issuer/ - # for more details about IssuerRef configuration. - # If the issuerRef is not specified, the self-signed `knative-selfsigned-issuer` ClusterIssuer is used. - issuerRef: | - kind: ClusterIssuer - name: letsencrypt-issuer - - # clusterLocalIssuerRef is a reference to the issuer for cluster-local-domain certificates used for ingress. - # clusterLocalIssuerRef should be either `ClusterIssuer` or `Issuer`. - # Please refer `IssuerRef` in https://cert-manager.io/docs/concepts/issuer/ - # for more details about ClusterInternalIssuerRef configuration. - # If the clusterLocalIssuerRef is not specified, the self-signed `knative-selfsigned-issuer` ClusterIssuer is used. - clusterLocalIssuerRef: | - kind: ClusterIssuer - name: your-company-issuer - - # systemInternalIssuerRef is a reference to the issuer for certificates for system-internal-tls certificates used by Knative internal components. - # systemInternalIssuerRef should be either `ClusterIssuer` or `Issuer`. - # Please refer `IssuerRef` in https://cert-manager.io/docs/concepts/issuer/ - # for more details about ClusterInternalIssuerRef configuration. - # If the systemInternalIssuerRef is not specified, the self-signed `knative-selfsigned-issuer` ClusterIssuer is used. - systemInternalIssuerRef: | - kind: ClusterIssuer - name: knative-selfsigned-issuer ---- -# Copyright 2019 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: v1 -kind: ConfigMap -metadata: - name: config-defaults - namespace: knative-serving - labels: - app.kubernetes.io/name: knative-serving - app.kubernetes.io/component: controller - app.kubernetes.io/version: "1.15.0" - annotations: - knative.dev/example-checksum: "5b64ff5c" -data: - _example: | - ################################ - # # - # EXAMPLE CONFIGURATION # - # # - ################################ - - # This block is not actually functional configuration, - # but serves to illustrate the available configuration - # options and document them in a way that is accessible - # to users that `kubectl edit` this config map. - # - # These sample configuration options may be copied out of - # this example block and unindented to be in the data block - # to actually change the configuration. - - # revision-timeout-seconds contains the default number of - # seconds to use for the revision's per-request timeout, if - # none is specified. - revision-timeout-seconds: "300" # 5 minutes - - # max-revision-timeout-seconds contains the maximum number of - # seconds that can be used for revision-timeout-seconds. - # This value must be greater than or equal to revision-timeout-seconds. - # If omitted, the system default is used (600 seconds). - # - # If this value is increased, the activator's terminationGracePeriodSeconds - # should also be increased to prevent in-flight requests being disrupted. - max-revision-timeout-seconds: "600" # 10 minutes - - # revision-response-start-timeout-seconds contains the default number of - # seconds a request will be allowed to stay open while waiting to - # receive any bytes from the user's application, if none is specified. - # - # This defaults to 'revision-timeout-seconds' - revision-response-start-timeout-seconds: "300" - - # revision-idle-timeout-seconds contains the default number of - # seconds a request will be allowed to stay open while not receiving any - # bytes from the user's application, if none is specified. - revision-idle-timeout-seconds: "0" # infinite - - # revision-cpu-request contains the cpu allocation to assign - # to revisions by default. If omitted, no value is specified - # and the system default is used. - # Below is an example of setting revision-cpu-request. - # By default, it is not set by Knative. - revision-cpu-request: "400m" # 0.4 of a CPU (aka 400 milli-CPU) - - # revision-memory-request contains the memory allocation to assign - # to revisions by default. If omitted, no value is specified - # and the system default is used. - # Below is an example of setting revision-memory-request. - # By default, it is not set by Knative. - revision-memory-request: "100M" # 100 megabytes of memory - - # revision-ephemeral-storage-request contains the ephemeral storage - # allocation to assign to revisions by default. If omitted, no value is - # specified and the system default is used. - revision-ephemeral-storage-request: "500M" # 500 megabytes of storage - - # revision-cpu-limit contains the cpu allocation to limit - # revisions to by default. If omitted, no value is specified - # and the system default is used. - # Below is an example of setting revision-cpu-limit. - # By default, it is not set by Knative. - revision-cpu-limit: "1000m" # 1 CPU (aka 1000 milli-CPU) - - # revision-memory-limit contains the memory allocation to limit - # revisions to by default. If omitted, no value is specified - # and the system default is used. - # Below is an example of setting revision-memory-limit. - # By default, it is not set by Knative. - revision-memory-limit: "200M" # 200 megabytes of memory - - # revision-ephemeral-storage-limit contains the ephemeral storage - # allocation to limit revisions to by default. If omitted, no value is - # specified and the system default is used. - revision-ephemeral-storage-limit: "750M" # 750 megabytes of storage - - # container-name-template contains a template for the default - # container name, if none is specified. This field supports - # Go templating and is supplied with the ObjectMeta of the - # enclosing Service or Configuration, so values such as - # {{.Name}} are also valid. - container-name-template: "user-container" - - # init-container-name-template contains a template for the default - # init container name, if none is specified. This field supports - # Go templating and is supplied with the ObjectMeta of the - # enclosing Service or Configuration, so values such as - # {{.Name}} are also valid. - init-container-name-template: "init-container" - - # container-concurrency specifies the maximum number - # of requests the Container can handle at once, and requests - # above this threshold are queued. Setting a value of zero - # disables this throttling and lets through as many requests as - # the pod receives. - container-concurrency: "0" - - # The container concurrency max limit is an operator setting ensuring that - # the individual revisions cannot have arbitrary large concurrency - # values, or autoscaling targets. `container-concurrency` default setting - # must be at or below this value. - # - # Must be greater than 1. - # - # Note: even with this set, a user can choose a containerConcurrency - # of 0 (i.e. unbounded) unless allow-container-concurrency-zero is - # set to "false". - container-concurrency-max-limit: "1000" - - # allow-container-concurrency-zero controls whether users can - # specify 0 (i.e. unbounded) for containerConcurrency. - allow-container-concurrency-zero: "true" - - # enable-service-links specifies the default value used for the - # enableServiceLinks field of the PodSpec, when it is omitted by the user. - # See: https://kubernetes.io/docs/concepts/services-networking/connect-applications-service/#accessing-the-service - # - # This is a tri-state flag with possible values of (true|false|default). - # - # In environments with large number of services it is suggested - # to set this value to `false`. - # See https://github.com/knative/serving/issues/8498. - enable-service-links: "false" ---- -# Copyright 2019 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: v1 -kind: ConfigMap -metadata: - name: config-deployment - namespace: knative-serving - labels: - app.kubernetes.io/name: knative-serving - app.kubernetes.io/component: controller - app.kubernetes.io/version: "1.15.0" - annotations: - knative.dev/example-checksum: "720ddb97" -data: - # This is the Go import path for the binary that is containerized - # and substituted here. - queue-sidecar-image: gcr.io/knative-releases/knative.dev/serving/cmd/queue@sha256:d313c823f25a09326a7c3c2ec9833c5e005791bc3acb4036ebf33735cbb62bee - _example: |- - ################################ - # # - # EXAMPLE CONFIGURATION # - # # - ################################ - - # This block is not actually functional configuration, - # but serves to illustrate the available configuration - # options and document them in a way that is accessible - # to users that `kubectl edit` this config map. - # - # These sample configuration options may be copied out of - # this example block and unindented to be in the data block - # to actually change the configuration. - - # List of repositories for which tag to digest resolving should be skipped - registries-skipping-tag-resolving: "kind.local,ko.local,dev.local" - - # Maximum time allowed for an image's digests to be resolved. - digest-resolution-timeout: "10s" - - # Duration we wait for the deployment to be ready before considering it failed. - progress-deadline: "600s" - - # Sets the queue proxy's CPU request. - # If omitted, a default value (currently "25m"), is used. - queue-sidecar-cpu-request: "25m" - - # Sets the queue proxy's CPU limit. - # If omitted, a default value (currently "1000m"), is used when - # `queueproxy.resource-defaults` is set to `Enabled`. - queue-sidecar-cpu-limit: "1000m" - - # Sets the queue proxy's memory request. - # If omitted, a default value (currently "400Mi"), is used when - # `queueproxy.resource-defaults` is set to `Enabled`. - queue-sidecar-memory-request: "400Mi" - - # Sets the queue proxy's memory limit. - # If omitted, a default value (currently "800Mi"), is used when - # `queueproxy.resource-defaults` is set to `Enabled`. - queue-sidecar-memory-limit: "800Mi" - - # Sets the queue proxy's ephemeral storage request. - # If omitted, no value is specified and the system default is used. - queue-sidecar-ephemeral-storage-request: "512Mi" - - # Sets the queue proxy's ephemeral storage limit. - # If omitted, no value is specified and the system default is used. - queue-sidecar-ephemeral-storage-limit: "1024Mi" - - # Sets tokens associated with specific audiences for queue proxy - used by QPOptions - # - # For example, to add the `service-x` audience: - # queue-sidecar-token-audiences: "service-x" - # Also supports a list of audiences, for example: - # queue-sidecar-token-audiences: "service-x,service-y" - # If omitted, or empty, no tokens are created - queue-sidecar-token-audiences: "" - - # Sets rootCA for the queue proxy - used by QPOptions - # If omitted, or empty, no rootCA is added to the golang rootCAs - queue-sidecar-rootca: "" - - # If set, it automatically configures pod anti-affinity requirements for all Knative services. - # It employs the `preferredDuringSchedulingIgnoredDuringExecution` weighted pod affinity term, - # aligning with the Knative revision label. It yields the configuration below in all workloads' deployments: - # ` - # affinity: - # podAntiAffinity: - # preferredDuringSchedulingIgnoredDuringExecution: - # - podAffinityTerm: - # topologyKey: kubernetes.io/hostname - # labelSelector: - # matchLabels: - # serving.knative.dev/revision: {{revision-name}} - # weight: 100 - # ` - # This may be "none" or "prefer-spread-revision-over-nodes" (default) - # default-affinity-type: "prefer-spread-revision-over-nodes" - - # runtime-class-name contains the selector for which runtimeClassName - # is selected to put in a revision. - # By default, it is not set by Knative. - # - # Example: - # runtime-class-name: | - # "": - # selector: - # use-default-runc: "yes" - # kata: {} - # gvisor: - # selector: - # use-gvisor: "please" - runtime-class-name: "" ---- -# Copyright 2018 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: v1 -kind: ConfigMap -metadata: - name: config-domain - namespace: knative-serving - labels: - app.kubernetes.io/name: knative-serving - app.kubernetes.io/component: controller - app.kubernetes.io/version: "1.15.0" - annotations: - knative.dev/example-checksum: "26c09de5" -data: - _example: | - ################################ - # # - # EXAMPLE CONFIGURATION # - # # - ################################ - - # This block is not actually functional configuration, - # but serves to illustrate the available configuration - # options and document them in a way that is accessible - # to users that `kubectl edit` this config map. - # - # These sample configuration options may be copied out of - # this example block and unindented to be in the data block - # to actually change the configuration. - - # Default value for domain. - # Routes having the cluster domain suffix (by default 'svc.cluster.local') - # will not be exposed through Ingress. You can define your own label - # selector to assign that domain suffix to your Route here, or you can set - # the label - # "networking.knative.dev/visibility=cluster-local" - # to achieve the same effect. This shows how to make routes having - # the label app=secret only exposed to the local cluster. - svc.cluster.local: | - selector: - app: secret - - # These are example settings of domain. - # example.com will be used for all routes, but it is the least-specific rule so it - # will only be used if no other domain matches. - example.com: | - - # example.org will be used for routes having app=nonprofit. - example.org: | - selector: - app: nonprofit ---- -# Copyright 2020 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: v1 -kind: ConfigMap -metadata: - name: config-features - namespace: knative-serving - labels: - app.kubernetes.io/name: knative-serving - app.kubernetes.io/component: controller - app.kubernetes.io/version: "1.15.0" - annotations: - knative.dev/example-checksum: "632d47dd" -data: - _example: |- - ################################ - # # - # EXAMPLE CONFIGURATION # - # # - ################################ - - # This block is not actually functional configuration, - # but serves to illustrate the available configuration - # options and document them in a way that is accessible - # to users that `kubectl edit` this config map. - # - # These sample configuration options may be copied out of - # this example block and unindented to be in the data block - # to actually change the configuration. - - # Default SecurityContext settings to secure-by-default values - # if unset. - # - # This value will default to "enabled" in a future release, - # probably Knative 1.10 - secure-pod-defaults: "disabled" - - # Indicates whether multi container support is enabled - # - # WARNING: Cannot safely be disabled once enabled. - # See: https://knative.dev/docs/serving/configuration/feature-flags/#multiple-containers - multi-container: "enabled" - - # Indicates whether multi container probing is enabled - # - # WARNING: Cannot safely be disabled once enabled. - # See: https://knative.dev/docs/serving/configuration/feature-flags/#multiple-container-probing - multi-container-probing: "disabled" - - # Indicates whether Kubernetes affinity support is enabled - # - # WARNING: Cannot safely be disabled once enabled. - # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-node-affinity - kubernetes.podspec-affinity: "disabled" - - # Indicates whether Kubernetes topologySpreadConstraints support is enabled - # - # WARNING: Cannot safely be disabled once enabled. - # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-topology-spread-constraints - kubernetes.podspec-topologyspreadconstraints: "disabled" - - # Indicates whether Kubernetes hostAliases support is enabled - # - # WARNING: Cannot safely be disabled once enabled. - # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-host-aliases - kubernetes.podspec-hostaliases: "disabled" - - # Indicates whether Kubernetes nodeSelector support is enabled - # - # WARNING: Cannot safely be disabled once enabled. - # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-node-selector - kubernetes.podspec-nodeselector: "disabled" - - # Indicates whether Kubernetes tolerations support is enabled - # - # WARNING: Cannot safely be disabled once enabled - # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-toleration - kubernetes.podspec-tolerations: "disabled" - - # Indicates whether Kubernetes FieldRef support is enabled - # - # WARNING: Cannot safely be disabled once enabled. - # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-fieldref - kubernetes.podspec-fieldref: "disabled" - - # Indicates whether Kubernetes RuntimeClassName support is enabled - # - # WARNING: Cannot safely be disabled once enabled. - # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-runtime-class - kubernetes.podspec-runtimeclassname: "disabled" - - # Indicates whether Kubernetes DNSPolicy support is enabled - # - # WARNING: Cannot safely be disabled once enabled. - # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-dnspolicy - kubernetes.podspec-dnspolicy: "disabled" - - # Indicates whether Kubernetes DNSConfig support is enabled - # - # WARNING: Cannot safely be disabled once enabled. - # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-dnsconfig - kubernetes.podspec-dnsconfig: "disabled" - - # This feature allows end-users to set a subset of fields on the Pod's SecurityContext - # - # When set to "enabled" or "allowed" it allows the following - # PodSecurityContext properties: - # - FSGroup - # - RunAsGroup - # - RunAsNonRoot - # - SupplementalGroups - # - RunAsUser - # - SeccompProfile - # - # This feature flag should be used with caution as the PodSecurityContext - # properties may have a side-effect on non-user sidecar containers that come - # from Knative or your service mesh - # - # WARNING: Cannot safely be disabled once enabled. - # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-security-context - kubernetes.podspec-securitycontext: "disabled" - - # Indicated whether sharing the process namespace via ShareProcessNamespace pod spec is allowed. - # This can be especially useful for sharing data from images directly between sidecars - # - # See: https://knative.dev/docs/serving/configuration/feature-flags/#kubernetes-share-process-namespace - kubernetes.podspec-shareprocessnamespace: "disabled" - - # Indicates whether Kubernetes PriorityClassName support is enabled - # - # WARNING: Cannot safely be disabled once enabled. - # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-priority-class-name - kubernetes.podspec-priorityclassname: "disabled" - - # Indicates whether Kubernetes SchedulerName support is enabled - # - # WARNING: Cannot safely be disabled once enabled. - # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-scheduler-name - kubernetes.podspec-schedulername: "disabled" - - # This feature flag allows end-users to add a subset of capabilities on the Pod's SecurityContext. - # - # When set to "enabled" or "allowed" it allows capabilities to be added to the container. - # For a list of possible capabilities, see https://man7.org/linux/man-pages/man7/capabilities.7.html - kubernetes.containerspec-addcapabilities: "disabled" - - # This feature validates PodSpecs from the validating webhook - # against the K8s API Server. - # - # When "enabled", the server will always run the extra validation. - # When "allowed", the server will not run the dry-run validation by default. - # However, clients may enable the behavior on an individual Service by - # attaching the following metadata annotation: "features.knative.dev/podspec-dryrun":"enabled". - # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-dry-run - kubernetes.podspec-dryrun: "allowed" - - # Controls whether tag header based routing feature are enabled or not. - # 1. Enabled: enabling tag header based routing - # 2. Disabled: disabling tag header based routing - # See: https://knative.dev/docs/serving/feature-flags/#tag-header-based-routing - tag-header-based-routing: "disabled" - - # Controls whether http2 auto-detection should be enabled or not. - # 1. Enabled: http2 connection will be attempted via upgrade. - # 2. Disabled: http2 connection will only be attempted when port name is set to "h2c". - autodetect-http2: "disabled" - - # Controls whether volume support for EmptyDir is enabled or not. - # 1. Enabled: enabling EmptyDir volume support - # 2. Disabled: disabling EmptyDir volume support - kubernetes.podspec-volumes-emptydir: "enabled" - - # Controls whether init containers support is enabled or not. - # 1. Enabled: enabling init containers support - # 2. Disabled: disabling init containers support - kubernetes.podspec-init-containers: "disabled" - - # Controls whether persistent volume claim support is enabled or not. - # 1. Enabled: enabling persistent volume claim support - # 2. Disabled: disabling persistent volume claim support - kubernetes.podspec-persistent-volume-claim: "disabled" - - # Controls whether write access for persistent volumes is enabled or not. - # 1. Enabled: enabling write access for persistent volumes - # 2. Disabled: disabling write access for persistent volumes - kubernetes.podspec-persistent-volume-write: "disabled" - - # Controls if the queue proxy podInfo feature is enabled, allowed or disabled - # - # This feature should be enabled/allowed when using queue proxy Options (Extensions) - # Enabling will mount a podInfo volume to the queue proxy container. - # The volume will contains an 'annotations' file (from the pod's annotation field). - # The annotations in this file include the Service annotations set by the client creating the service. - # If mounted, the annotations can be accessed by queue proxy extensions at /etc/podinfo/annnotations - # - # 1. "enabled": always mount a podInfo volume - # 2. "disabled": never mount a podInfo volume - # 3. "allowed": by default, do not mount a podInfo volume - # However, a client may mount the podInfo volume on an individual Service by attaching - # the following metadata annotation to the Service: "features.knative.dev/queueproxy-podinfo":"enabled". - # - # NOTE THAT THIS IS AN EXPERIMENTAL / ALPHA FEATURE - queueproxy.mount-podinfo: "disabled" - - # Default queue proxy resource requests and limits to good values for most cases if set. - queueproxy.resource-defaults: "disabled" ---- -# Copyright 2018 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: v1 -kind: ConfigMap -metadata: - name: config-gc - namespace: knative-serving - labels: - app.kubernetes.io/name: knative-serving - app.kubernetes.io/component: controller - app.kubernetes.io/version: "1.15.0" - annotations: - knative.dev/example-checksum: "aa3813a8" -data: - _example: | - ################################ - # # - # EXAMPLE CONFIGURATION # - # # - ################################ - - # This block is not actually functional configuration, - # but serves to illustrate the available configuration - # options and document them in a way that is accessible - # to users that `kubectl edit` this config map. - # - # These sample configuration options may be copied out of - # this example block and unindented to be in the data block - # to actually change the configuration. - - # --------------------------------------- - # Garbage Collector Settings - # --------------------------------------- - # - # Active - # * Revisions which are referenced by a Route are considered active. - # * Individual revisions may be marked with the annotation - # "serving.knative.dev/no-gc":"true" to be permanently considered active. - # * Active revisions are not considered for GC. - # Retention - # * Revisions are retained if they are any of the following: - # 1. Active - # 2. Were created within "retain-since-create-time" - # 3. Were last referenced by a route within - # "retain-since-last-active-time" - # 4. There are fewer than "min-non-active-revisions" - # If none of these conditions are met, or if the count of revisions exceed - # "max-non-active-revisions", they will be deleted by GC. - # The special value "disabled" may be used to turn off these limits. - # - # Example config to immediately collect any inactive revision: - # min-non-active-revisions: "0" - # max-non-active-revisions: "0" - # retain-since-create-time: "disabled" - # retain-since-last-active-time: "disabled" - # - # Example config to always keep around the last ten non-active revisions: - # retain-since-create-time: "disabled" - # retain-since-last-active-time: "disabled" - # max-non-active-revisions: "10" - # - # Example config to disable all garbage collection: - # retain-since-create-time: "disabled" - # retain-since-last-active-time: "disabled" - # max-non-active-revisions: "disabled" - # - # Example config to keep recently deployed or active revisions, - # always maintain the last two in case of rollback, and prevent - # burst activity from exploding the count of old revisions: - # retain-since-create-time: "48h" - # retain-since-last-active-time: "15h" - # min-non-active-revisions: "2" - # max-non-active-revisions: "1000" - - # Duration since creation before considering a revision for GC or "disabled". - retain-since-create-time: "48h" - - # Duration since active before considering a revision for GC or "disabled". - retain-since-last-active-time: "15h" - - # Minimum number of non-active revisions to retain. - min-non-active-revisions: "20" - - # Maximum number of non-active revisions to retain - # or "disabled" to disable any maximum limit. - max-non-active-revisions: "1000" ---- -# Copyright 2020 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: v1 -kind: ConfigMap -metadata: - name: config-leader-election - namespace: knative-serving - labels: - app.kubernetes.io/name: knative-serving - app.kubernetes.io/component: controller - app.kubernetes.io/version: "1.15.0" - annotations: - knative.dev/example-checksum: "f4b71f57" -data: - _example: | - ################################ - # # - # EXAMPLE CONFIGURATION # - # # - ################################ - - # This block is not actually functional configuration, - # but serves to illustrate the available configuration - # options and document them in a way that is accessible - # to users that `kubectl edit` this config map. - # - # These sample configuration options may be copied out of - # this example block and unindented to be in the data block - # to actually change the configuration. - - # lease-duration is how long non-leaders will wait to try to acquire the - # lock; 15 seconds is the value used by core kubernetes controllers. - lease-duration: "60s" - - # renew-deadline is how long a leader will try to renew the lease before - # giving up; 10 seconds is the value used by core kubernetes controllers. - renew-deadline: "40s" - - # retry-period is how long the leader election client waits between tries of - # actions; 2 seconds is the value used by core kubernetes controllers. - retry-period: "10s" - - # buckets is the number of buckets used to partition key space of each - # Reconciler. If this number is M and the replica number of the controller - # is N, the N replicas will compete for the M buckets. The owner of a - # bucket will take care of the reconciling for the keys partitioned into - # that bucket. - buckets: "1" ---- -# Copyright 2018 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: v1 -kind: ConfigMap -metadata: - name: config-logging - namespace: knative-serving - labels: - app.kubernetes.io/version: "1.15.0" - app.kubernetes.io/component: logging - app.kubernetes.io/name: knative-serving - annotations: - knative.dev/example-checksum: "9f25d429" -data: - _example: | - ################################ - # # - # EXAMPLE CONFIGURATION # - # # - ################################ - - # This block is not actually functional configuration, - # but serves to illustrate the available configuration - # options and document them in a way that is accessible - # to users that `kubectl edit` this config map. - # - # These sample configuration options may be copied out of - # this example block and unindented to be in the data block - # to actually change the configuration. - - # Common configuration for all Knative codebase - zap-logger-config: | - { - "level": "info", - "development": false, - "outputPaths": ["stdout"], - "errorOutputPaths": ["stderr"], - "encoding": "json", - "encoderConfig": { - "timeKey": "timestamp", - "levelKey": "severity", - "nameKey": "logger", - "callerKey": "caller", - "messageKey": "message", - "stacktraceKey": "stacktrace", - "lineEnding": "", - "levelEncoder": "", - "timeEncoder": "iso8601", - "durationEncoder": "", - "callerEncoder": "" - } - } - - # Log level overrides - # For all components except the queue proxy, - # changes are picked up immediately. - # For queue proxy, changes require recreation of the pods. - loglevel.controller: "info" - loglevel.autoscaler: "info" - loglevel.queueproxy: "info" - loglevel.webhook: "info" - loglevel.activator: "info" - loglevel.hpaautoscaler: "info" - loglevel.net-istio-controller: "info" - loglevel.net-contour-controller: "info" - loglevel.net-kourier-controller: "info" - loglevel.net-gateway-api-controller: "info" ---- -# Copyright 2018 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: v1 -kind: ConfigMap -metadata: - name: config-network - namespace: knative-serving - labels: - app.kubernetes.io/name: knative-serving - app.kubernetes.io/component: networking - app.kubernetes.io/version: "1.15.0" - annotations: - knative.dev/example-checksum: "0573e07d" -data: - _example: | - ################################ - # # - # EXAMPLE CONFIGURATION # - # # - ################################ - - # This block is not actually functional configuration, - # but serves to illustrate the available configuration - # options and document them in a way that is accessible - # to users that `kubectl edit` this config map. - # - # These sample configuration options may be copied out of - # this example block and unindented to be in the data block - # to actually change the configuration. - - # ingress-class specifies the default ingress class - # to use when not dictated by Route annotation. - # - # If not specified, will use the Istio ingress. - # - # Note that changing the Ingress class of an existing Route - # will result in undefined behavior. Therefore it is best to only - # update this value during the setup of Knative, to avoid getting - # undefined behavior. - ingress-class: "istio.ingress.networking.knative.dev" - - # certificate-class specifies the default Certificate class - # to use when not dictated by Route annotation. - # - # If not specified, will use the Cert-Manager Certificate. - # - # Note that changing the Certificate class of an existing Route - # will result in undefined behavior. Therefore it is best to only - # update this value during the setup of Knative, to avoid getting - # undefined behavior. - certificate-class: "cert-manager.certificate.networking.knative.dev" - - # namespace-wildcard-cert-selector specifies a LabelSelector which - # determines which namespaces should have a wildcard certificate - # provisioned. - # - # Use an empty value to disable the feature (this is the default): - # namespace-wildcard-cert-selector: "" - # - # Use an empty object to enable for all namespaces - # namespace-wildcard-cert-selector: {} - # - # Useful labels include the "kubernetes.io/metadata.name" label to - # avoid provisioning a certificate for the "kube-system" namespaces. - # Use the following selector to match pre-1.0 behavior of using - # "networking.knative.dev/disableWildcardCert" to exclude namespaces: - # - # matchExpressions: - # - key: "networking.knative.dev/disableWildcardCert" - # operator: "NotIn" - # values: ["true"] - namespace-wildcard-cert-selector: "" - - # domain-template specifies the golang text template string to use - # when constructing the Knative service's DNS name. The default - # value is "{{.Name}}.{{.Namespace}}.{{.Domain}}". - # - # Valid variables defined in the template include Name, Namespace, Domain, - # Labels, and Annotations. Name will be the result of the tag-template - # below, if a tag is specified for the route. - # - # Changing this value might be necessary when the extra levels in - # the domain name generated is problematic for wildcard certificates - # that only support a single level of domain name added to the - # certificate's domain. In those cases you might consider using a value - # of "{{.Name}}-{{.Namespace}}.{{.Domain}}", or removing the Namespace - # entirely from the template. When choosing a new value be thoughtful - # of the potential for conflicts - for example, when users choose to use - # characters such as `-` in their service, or namespace, names. - # {{.Annotations}} or {{.Labels}} can be used for any customization in the - # go template if needed. - # We strongly recommend keeping namespace part of the template to avoid - # domain name clashes: - # eg. '{{.Name}}-{{.Namespace}}.{{ index .Annotations "sub"}}.{{.Domain}}' - # and you have an annotation {"sub":"foo"}, then the generated template - # would be {Name}-{Namespace}.foo.{Domain} - domain-template: "{{.Name}}.{{.Namespace}}.{{.Domain}}" - - # tag-template specifies the golang text template string to use - # when constructing the DNS name for "tags" within the traffic blocks - # of Routes and Configuration. This is used in conjunction with the - # domain-template above to determine the full URL for the tag. - tag-template: "{{.Tag}}-{{.Name}}" - - # auto-tls is deprecated and replaced by external-domain-tls - auto-tls: "Disabled" - - # Controls whether TLS certificates are automatically provisioned and - # installed in the Knative ingress to terminate TLS connections - # for cluster external domains (like: app.example.com) - # - Enabled: enables the TLS certificate provisioning feature for cluster external domains. - # - Disabled: disables the TLS certificate provisioning feature for cluster external domains. - external-domain-tls: "Disabled" - - # Controls weather TLS certificates are automatically provisioned and - # installed in the Knative ingress to terminate TLS connections - # for cluster local domains (like: app.namespace.svc.) - # - Enabled: enables the TLS certificate provisioning feature for cluster cluster-local domains. - # - Disabled: disables the TLS certificate provisioning feature for cluster cluster local domains. - # NOTE: This flag is in an alpha state and is mostly here to enable internal testing - # for now. Use with caution. - cluster-local-domain-tls: "Disabled" - - # internal-encryption is deprecated and replaced by system-internal-tls - internal-encryption: "false" - - # system-internal-tls controls weather TLS encryption is used for connections between - # the internal components of Knative: - # - ingress to activator - # - ingress to queue-proxy - # - activator to queue-proxy - # - # Possible values for this flag are: - # - Enabled: enables the TLS certificate provisioning feature for cluster cluster-local domains. - # - Disabled: disables the TLS certificate provisioning feature for cluster cluster local domains. - # NOTE: This flag is in an alpha state and is mostly here to enable internal testing - # for now. Use with caution. - system-internal-tls: "Disabled" - - # Controls the behavior of the HTTP endpoint for the Knative ingress. - # It requires auto-tls to be enabled. - # - Enabled: The Knative ingress will be able to serve HTTP connection. - # - Redirected: The Knative ingress will send a 301 redirect for all - # http connections, asking the clients to use HTTPS. - # - # "Disabled" option is deprecated. - http-protocol: "Enabled" - - # rollout-duration contains the minimal duration in seconds over which the - # Configuration traffic targets are rolled out to the newest revision. - rollout-duration: "0" - - # autocreate-cluster-domain-claims controls whether ClusterDomainClaims should - # be automatically created (and deleted) as needed when DomainMappings are - # reconciled. - # - # If this is "false" (the default), the cluster administrator is - # responsible for creating ClusterDomainClaims and delegating them to - # namespaces via their spec.Namespace field. This setting should be used in - # multitenant environments which need to control which namespace can use a - # particular domain name in a domain mapping. - # - # If this is "true", users are able to associate arbitrary names with their - # services via the DomainMapping feature. - autocreate-cluster-domain-claims: "false" - - # If true, networking plugins can add additional information to deployed - # applications to make their pods directly accessible via their IPs even if mesh is - # enabled and thus direct-addressability is usually not possible. - # Consumers like Knative Serving can use this setting to adjust their behavior - # accordingly, i.e. to drop fallback solutions for non-pod-addressable systems. - # - # NOTE: This flag is in an alpha state and is mostly here to enable internal testing - # for now. Use with caution. - enable-mesh-pod-addressability: "false" - - # mesh-compatibility-mode indicates whether consumers of network plugins - # should directly contact Pod IPs (most efficient), or should use the - # Cluster IP (less efficient, needed when mesh is enabled unless - # `enable-mesh-pod-addressability`, above, is set). - # Permitted values are: - # - "auto" (default): automatically determine which mesh mode to use by trying Pod IP and falling back to Cluster IP as needed. - # - "enabled": always use Cluster IP and do not attempt to use Pod IPs. - # - "disabled": always use Pod IPs and do not fall back to Cluster IP on failure. - mesh-compatibility-mode: "auto" - - # Defines the scheme used for external URLs if auto-tls is not enabled. - # This can be used for making Knative report all URLs as "HTTPS" for example, if you're - # fronting Knative with an external loadbalancer that deals with TLS termination and - # Knative doesn't know about that otherwise. - default-external-scheme: "http" ---- -# Copyright 2018 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: v1 -kind: ConfigMap -metadata: - name: config-observability - namespace: knative-serving - labels: - app.kubernetes.io/name: knative-serving - app.kubernetes.io/component: observability - app.kubernetes.io/version: "1.15.0" - annotations: - knative.dev/example-checksum: "54abd711" -data: - _example: | - ################################ - # # - # EXAMPLE CONFIGURATION # - # # - ################################ - - # This block is not actually functional configuration, - # but serves to illustrate the available configuration - # options and document them in a way that is accessible - # to users that `kubectl edit` this config map. - # - # These sample configuration options may be copied out of - # this example block and unindented to be in the data block - # to actually change the configuration. - - # logging.enable-var-log-collection defaults to false. - # The fluentd daemon set will be set up to collect /var/log if - # this flag is true. - logging.enable-var-log-collection: "false" - - # logging.revision-url-template provides a template to use for producing the - # logging URL that is injected into the status of each Revision. - logging.revision-url-template: "http://logging.example.com/?revisionUID=${REVISION_UID}" - - # If non-empty, this enables queue proxy writing user request logs to stdout, excluding probe - # requests. - # NB: after 0.18 release logging.enable-request-log must be explicitly set to true - # in order for request logging to be enabled. - # - # The value determines the shape of the request logs and it must be a valid go text/template. - # It is important to keep this as a single line. Multiple lines are parsed as separate entities - # by most collection agents and will split the request logs into multiple records. - # - # The following fields and functions are available to the template: - # - # Request: An http.Request (see https://golang.org/pkg/net/http/#Request) - # representing an HTTP request received by the server. - # - # Response: - # struct { - # Code int // HTTP status code (see https://www.iana.org/assignments/http-status-codes/http-status-codes.xhtml) - # Size int // An int representing the size of the response. - # Latency float64 // A float64 representing the latency of the response in seconds. - # } - # - # Revision: - # struct { - # Name string // Knative revision name - # Namespace string // Knative revision namespace - # Service string // Knative service name - # Configuration string // Knative configuration name - # PodName string // Name of the pod hosting the revision - # PodIP string // IP of the pod hosting the revision - # } - # - logging.request-log-template: '{"httpRequest": {"requestMethod": "{{.Request.Method}}", "requestUrl": "{{js .Request.RequestURI}}", "requestSize": "{{.Request.ContentLength}}", "status": {{.Response.Code}}, "responseSize": "{{.Response.Size}}", "userAgent": "{{js .Request.UserAgent}}", "remoteIp": "{{js .Request.RemoteAddr}}", "serverIp": "{{.Revision.PodIP}}", "referer": "{{js .Request.Referer}}", "latency": "{{.Response.Latency}}s", "protocol": "{{.Request.Proto}}"}, "traceId": "{{index .Request.Header "X-B3-Traceid"}}"}' - - # If true, the request logging will be enabled. - # NB: up to and including Knative version 0.18 if logging.request-log-template is non-empty, this value - # will be ignored. - logging.enable-request-log: "false" - - # If true, this enables queue proxy writing request logs for probe requests to stdout. - # It uses the same template for user requests, i.e. logging.request-log-template. - logging.enable-probe-request-log: "false" - - # metrics.backend-destination field specifies the system metrics destination. - # It supports either prometheus (the default) or opencensus. - metrics.backend-destination: prometheus - - # metrics.reporting-period-seconds specifies the global metrics reporting period for control and data plane components. - # If a zero or negative value is passed the default reporting period is used (10 secs). - # If the attribute is not specified a default value is used per metrics backend. - # For the prometheus backend the default reporting period is 5s while for opencensus it is 60s. - metrics.reporting-period-seconds: "5" - - # metrics.request-metrics-backend-destination specifies the request metrics - # destination. It enables queue proxy to send request metrics. - # Currently supported values: prometheus (the default), opencensus. - metrics.request-metrics-backend-destination: prometheus - - # metrics.request-metrics-reporting-period-seconds specifies the request metrics reporting period in sec at queue proxy. - # If a zero or negative value is passed the default reporting period is used (10 secs). - # If the attribute is not specified, it is overridden by the value of metrics.reporting-period-seconds. - metrics.request-metrics-reporting-period-seconds: "5" - - # profiling.enable indicates whether it is allowed to retrieve runtime profiling data from - # the pods via an HTTP server in the format expected by the pprof visualization tool. When - # enabled, the Knative Serving pods expose the profiling data on an alternate HTTP port 8008. - # The HTTP context root for profiling is then /debug/pprof/. - profiling.enable: "false" ---- -# Copyright 2019 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: v1 -kind: ConfigMap -metadata: - name: config-tracing - namespace: knative-serving - labels: - app.kubernetes.io/name: knative-serving - app.kubernetes.io/component: tracing - app.kubernetes.io/version: "1.15.0" - annotations: - knative.dev/example-checksum: "26614636" -data: - _example: | - ################################ - # # - # EXAMPLE CONFIGURATION # - # # - ################################ - - # This block is not actually functional configuration, - # but serves to illustrate the available configuration - # options and document them in a way that is accessible - # to users that `kubectl edit` this config map. - # - # These sample configuration options may be copied out of - # this example block and unindented to be in the data block - # to actually change the configuration. - # - # This may be "zipkin" or "none" (default) - backend: "none" - - # URL to zipkin collector where traces are sent. - # This must be specified when backend is "zipkin" - zipkin-endpoint: "http://zipkin.istio-system.svc.cluster.local:9411/api/v2/spans" - - # Enable zipkin debug mode. This allows all spans to be sent to the server - # bypassing sampling. - debug: "false" - - # Percentage (0-1) of requests to trace - sample-rate: "0.1" ---- -# Copyright 2020 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: autoscaling/v2 -kind: HorizontalPodAutoscaler -metadata: - name: activator - namespace: knative-serving - labels: - app.kubernetes.io/component: activator - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.15.0" -spec: - minReplicas: 1 - maxReplicas: 20 - scaleTargetRef: - apiVersion: apps/v1 - kind: Deployment - name: activator - metrics: - - type: Resource - resource: - name: cpu - target: - type: Utilization - # Percentage of the requested CPU - averageUtilization: 100 ---- -# Activator PDB. Currently we permit unavailability of 20% of tasks at the same time. -# Given the subsetting and that the activators are partially stateful systems, we want -# a slow rollout of the new versions and slow migration during node upgrades. -apiVersion: policy/v1 -kind: PodDisruptionBudget -metadata: - name: activator-pdb - namespace: knative-serving - labels: - app.kubernetes.io/component: activator - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.15.0" -spec: - minAvailable: 80% - selector: - matchLabels: - app: activator ---- -# Copyright 2018 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: apps/v1 -kind: Deployment -metadata: - name: activator - namespace: knative-serving - labels: - app.kubernetes.io/component: activator - app.kubernetes.io/version: "1.15.0" - app.kubernetes.io/name: knative-serving -spec: - selector: - matchLabels: - app: activator - role: activator - template: - metadata: - labels: - app: activator - role: activator - app.kubernetes.io/component: activator - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.15.0" - spec: - # To avoid node becoming SPOF, spread our replicas to different nodes. - affinity: - podAntiAffinity: - preferredDuringSchedulingIgnoredDuringExecution: - - podAffinityTerm: - labelSelector: - matchLabels: - app: activator - topologyKey: kubernetes.io/hostname - weight: 100 - serviceAccountName: activator - containers: - - name: activator - # This is the Go import path for the binary that is containerized - # and substituted here. - image: gcr.io/knative-releases/knative.dev/serving/cmd/activator@sha256:b6d7d96edd8942d679757249f6aa07373461411104ce7c93309f23fba2884f8f - # The numbers are based on performance test results from - # https://github.com/knative/serving/issues/1625#issuecomment-511930023 - resources: - requests: - cpu: 300m - memory: 60Mi - limits: - cpu: 1000m - memory: 600Mi - env: - # Run Activator with GC collection when newly generated memory is 500%. - - name: GOGC - value: "500" - - name: POD_NAME - valueFrom: - fieldRef: - fieldPath: metadata.name - - name: POD_IP - valueFrom: - fieldRef: - fieldPath: status.podIP - - name: SYSTEM_NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace - - name: CONFIG_LOGGING_NAME - value: config-logging - - name: CONFIG_OBSERVABILITY_NAME - value: config-observability - # TODO(https://github.com/knative/pkg/pull/953): Remove stackdriver specific config - - name: METRICS_DOMAIN - value: knative.dev/internal/serving - securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: true - runAsNonRoot: true - capabilities: - drop: - - ALL - seccompProfile: - type: RuntimeDefault - ports: - - name: metrics - containerPort: 9090 - - name: profiling - containerPort: 8008 - - name: http1 - containerPort: 8012 - - name: h2c - containerPort: 8013 - readinessProbe: - httpGet: - port: 8012 - periodSeconds: 5 - failureThreshold: 5 - livenessProbe: - httpGet: - port: 8012 - periodSeconds: 10 - failureThreshold: 12 - initialDelaySeconds: 15 - # The activator (often) sits on the dataplane, and may proxy long (e.g. - # streaming, websockets) requests. We give a long grace period for the - # activator to "lame duck" and drain outstanding requests before we - # forcibly terminate the pod (and outstanding connections). This value - # should be at least as large as the upper bound on the Revision's - # timeoutSeconds property to avoid servicing events disrupting - # connections. - terminationGracePeriodSeconds: 600 ---- -apiVersion: v1 -kind: Service -metadata: - name: activator-service - namespace: knative-serving - labels: - app: activator - app.kubernetes.io/component: activator - app.kubernetes.io/version: "1.15.0" - app.kubernetes.io/name: knative-serving -spec: - selector: - app: activator - ports: - # Define metrics and profiling for them to be accessible within service meshes. - - name: http-metrics - port: 9090 - targetPort: 9090 - - name: http-profiling - port: 8008 - targetPort: 8008 - - name: http - port: 80 - targetPort: 8012 - - name: http2 - port: 81 - targetPort: 8013 - - name: https - port: 443 - targetPort: 8112 - type: ClusterIP ---- -# Copyright 2018 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: apps/v1 -kind: Deployment -metadata: - name: autoscaler - namespace: knative-serving - labels: - app.kubernetes.io/component: autoscaler - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.15.0" -spec: - replicas: 1 - selector: - matchLabels: - app: autoscaler - strategy: - type: RollingUpdate - rollingUpdate: - maxUnavailable: 0 - template: - metadata: - labels: - app: autoscaler - app.kubernetes.io/component: autoscaler - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.15.0" - spec: - # To avoid node becoming SPOF, spread our replicas to different nodes. - affinity: - podAntiAffinity: - preferredDuringSchedulingIgnoredDuringExecution: - - podAffinityTerm: - labelSelector: - matchLabels: - app: autoscaler - topologyKey: kubernetes.io/hostname - weight: 100 - serviceAccountName: controller - containers: - - name: autoscaler - # This is the Go import path for the binary that is containerized - # and substituted here. - image: gcr.io/knative-releases/knative.dev/serving/cmd/autoscaler@sha256:119157d871eb3db5a54944464d9920ad378d35292d4c12fd4a765cd016e24f0f - resources: - requests: - cpu: 100m - memory: 100Mi - limits: - cpu: 1000m - memory: 1000Mi - env: - - name: POD_NAME - valueFrom: - fieldRef: - fieldPath: metadata.name - - name: POD_IP - valueFrom: - fieldRef: - fieldPath: status.podIP - - name: SYSTEM_NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace - - name: CONFIG_LOGGING_NAME - value: config-logging - - name: CONFIG_OBSERVABILITY_NAME - value: config-observability - # TODO(https://github.com/knative/pkg/pull/953): Remove stackdriver specific config - - name: METRICS_DOMAIN - value: knative.dev/serving - securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: true - runAsNonRoot: true - capabilities: - drop: - - ALL - seccompProfile: - type: RuntimeDefault - ports: - - name: metrics - containerPort: 9090 - - name: profiling - containerPort: 8008 - - name: websocket - containerPort: 8080 - readinessProbe: - httpGet: - port: 8080 - livenessProbe: - httpGet: - port: 8080 - failureThreshold: 6 ---- -apiVersion: v1 -kind: Service -metadata: - labels: - app: autoscaler - app.kubernetes.io/component: autoscaler - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.15.0" - name: autoscaler - namespace: knative-serving -spec: - ports: - # Define metrics and profiling for them to be accessible within service meshes. - - name: http-metrics - port: 9090 - targetPort: 9090 - - name: http-profiling - port: 8008 - targetPort: 8008 - - name: http - port: 8080 - targetPort: 8080 - selector: - app: autoscaler ---- -# Copyright 2018 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: apps/v1 -kind: Deployment -metadata: - name: controller - namespace: knative-serving - labels: - app.kubernetes.io/component: controller - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.15.0" -spec: - selector: - matchLabels: - app: controller - template: - metadata: - labels: - app: controller - app.kubernetes.io/component: controller - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.15.0" - spec: - # To avoid node becoming SPOF, spread our replicas to different nodes. - affinity: - podAntiAffinity: - preferredDuringSchedulingIgnoredDuringExecution: - - podAffinityTerm: - labelSelector: - matchLabels: - app: controller - topologyKey: kubernetes.io/hostname - weight: 100 - serviceAccountName: controller - containers: - - name: controller - # This is the Go import path for the binary that is containerized - # and substituted here. - image: gcr.io/knative-releases/knative.dev/serving/cmd/controller@sha256:80b9865a585900af6cecead24babe03aa79487e9e6306da1444b04148c21c96f - resources: - requests: - cpu: 100m - memory: 100Mi - limits: - cpu: 1000m - memory: 1000Mi - env: - - name: POD_NAME - valueFrom: - fieldRef: - fieldPath: metadata.name - - name: SYSTEM_NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace - - name: CONFIG_LOGGING_NAME - value: config-logging - - name: CONFIG_OBSERVABILITY_NAME - value: config-observability - # TODO(https://github.com/knative/pkg/pull/953): Remove stackdriver specific config - - name: METRICS_DOMAIN - value: knative.dev/internal/serving - securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: true - runAsNonRoot: true - capabilities: - drop: - - ALL - seccompProfile: - type: RuntimeDefault - livenessProbe: - httpGet: - path: /health - port: probes - scheme: HTTP - periodSeconds: 5 - failureThreshold: 6 - readinessProbe: - httpGet: - path: /readiness - port: probes - scheme: HTTP - periodSeconds: 5 - failureThreshold: 3 - ports: - - name: metrics - containerPort: 9090 - - name: profiling - containerPort: 8008 - - name: probes - containerPort: 8080 ---- -apiVersion: v1 -kind: Service -metadata: - labels: - app: controller - app.kubernetes.io/component: controller - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.15.0" - name: controller - namespace: knative-serving -spec: - ports: - # Define metrics and profiling for them to be accessible within service meshes. - - name: http-metrics - port: 9090 - targetPort: 9090 - - name: http-profiling - port: 8008 - targetPort: 8008 - selector: - app: controller ---- -# Copyright 2020 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: autoscaling/v2 -kind: HorizontalPodAutoscaler -metadata: - name: webhook - namespace: knative-serving - labels: - app.kubernetes.io/component: webhook - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.15.0" -spec: - minReplicas: 1 - maxReplicas: 5 - scaleTargetRef: - apiVersion: apps/v1 - kind: Deployment - name: webhook - metrics: - - type: Resource - resource: - name: cpu - target: - type: Utilization - # Percentage of the requested CPU - averageUtilization: 100 ---- -# Webhook PDB. -apiVersion: policy/v1 -kind: PodDisruptionBudget -metadata: - name: webhook-pdb - namespace: knative-serving - labels: - app.kubernetes.io/component: webhook - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.15.0" -spec: - minAvailable: 80% - selector: - matchLabels: - app: webhook ---- -# Copyright 2018 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: apps/v1 -kind: Deployment -metadata: - name: webhook - namespace: knative-serving - labels: - app.kubernetes.io/component: webhook - app.kubernetes.io/version: "1.15.0" - app.kubernetes.io/name: knative-serving -spec: - selector: - matchLabels: - app: webhook - role: webhook - template: - metadata: - labels: - app: webhook - role: webhook - app.kubernetes.io/component: webhook - app.kubernetes.io/version: "1.15.0" - app.kubernetes.io/name: knative-serving - spec: - # To avoid node becoming SPOF, spread our replicas to different nodes. - affinity: - podAntiAffinity: - preferredDuringSchedulingIgnoredDuringExecution: - - podAffinityTerm: - labelSelector: - matchLabels: - app: webhook - topologyKey: kubernetes.io/hostname - weight: 100 - serviceAccountName: controller - containers: - - name: webhook - # This is the Go import path for the binary that is containerized - # and substituted here. - image: gcr.io/knative-releases/knative.dev/serving/cmd/webhook@sha256:732d9cdf7f5fa5c6055d26b1aa5aad40e3d74ba9f2cb76a1db0f0e4d072b7cd0 - resources: - requests: - cpu: 100m - memory: 100Mi - limits: - cpu: 500m - memory: 500Mi - env: - - name: POD_NAME - valueFrom: - fieldRef: - fieldPath: metadata.name - - name: SYSTEM_NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace - - name: CONFIG_LOGGING_NAME - value: config-logging - - name: CONFIG_OBSERVABILITY_NAME - value: config-observability - - name: WEBHOOK_NAME - value: webhook - - name: WEBHOOK_PORT - value: "8443" - # TODO(https://github.com/knative/pkg/pull/953): Remove stackdriver specific config - - name: METRICS_DOMAIN - value: knative.dev/internal/serving - securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: true - runAsNonRoot: true - capabilities: - drop: - - ALL - seccompProfile: - type: RuntimeDefault - ports: - - name: metrics - containerPort: 9090 - - name: profiling - containerPort: 8008 - - name: https-webhook - containerPort: 8443 - readinessProbe: - periodSeconds: 1 - httpGet: - scheme: HTTPS - port: 8443 - livenessProbe: - periodSeconds: 10 - httpGet: - scheme: HTTPS - port: 8443 - failureThreshold: 6 - initialDelaySeconds: 20 - # Our webhook should gracefully terminate by lame ducking first, set this to a sufficiently - # high value that we respect whatever value it has configured for the lame duck grace period. - terminationGracePeriodSeconds: 300 ---- -apiVersion: v1 -kind: Service -metadata: - labels: - app: webhook - role: webhook - app.kubernetes.io/component: webhook - app.kubernetes.io/version: "1.15.0" - app.kubernetes.io/name: knative-serving - name: webhook - namespace: knative-serving -spec: - ports: - # Define metrics and profiling for them to be accessible within service meshes. - - name: http-metrics - port: 9090 - targetPort: 9090 - - name: http-profiling - port: 8008 - targetPort: 8008 - - name: https-webhook - port: 443 - targetPort: 8443 - selector: - app: webhook - role: webhook ---- -# Copyright 2020 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: admissionregistration.k8s.io/v1 -kind: ValidatingWebhookConfiguration -metadata: - name: config.webhook.serving.knative.dev - labels: - app.kubernetes.io/component: webhook - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.15.0" -webhooks: - - admissionReviewVersions: ["v1", "v1beta1"] - clientConfig: - service: - name: webhook - namespace: knative-serving - failurePolicy: Fail - sideEffects: None - name: config.webhook.serving.knative.dev - objectSelector: - matchExpressions: - - key: app.kubernetes.io/name - operator: In - values: ["knative-serving"] - - key: app.kubernetes.io/component - operator: In - values: ["autoscaler", "controller", "logging", "networking", "observability", "tracing", "net-certmanager"] - timeoutSeconds: 10 ---- -# Copyright 2020 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: admissionregistration.k8s.io/v1 -kind: MutatingWebhookConfiguration -metadata: - name: webhook.serving.knative.dev - labels: - app.kubernetes.io/component: webhook - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.15.0" -webhooks: - - admissionReviewVersions: ["v1", "v1beta1"] - clientConfig: - service: - name: webhook - namespace: knative-serving - failurePolicy: Fail - sideEffects: None - name: webhook.serving.knative.dev - timeoutSeconds: 10 - rules: - - apiGroups: - - autoscaling.internal.knative.dev - - networking.internal.knative.dev - - serving.knative.dev - apiVersions: - - "*" - operations: - - CREATE - - UPDATE - scope: "*" - resources: - - metrics - - podautoscalers - - certificates - - ingresses - - serverlessservices - - configurations - - revisions - - routes - - services - - domainmappings - - domainmappings/status ---- -# Copyright 2020 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: admissionregistration.k8s.io/v1 -kind: ValidatingWebhookConfiguration -metadata: - name: validation.webhook.serving.knative.dev - labels: - app.kubernetes.io/component: webhook - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.15.0" -webhooks: - - admissionReviewVersions: ["v1", "v1beta1"] - clientConfig: - service: - name: webhook - namespace: knative-serving - failurePolicy: Fail - sideEffects: None - name: validation.webhook.serving.knative.dev - timeoutSeconds: 10 - rules: - - apiGroups: - - autoscaling.internal.knative.dev - - networking.internal.knative.dev - - serving.knative.dev - apiVersions: - - "*" - operations: - - CREATE - - UPDATE - - DELETE - scope: "*" - resources: - - metrics - - podautoscalers - - certificates - - ingresses - - serverlessservices - - configurations - - revisions - - routes - - services - - domainmappings - - domainmappings/status ---- -# Copyright 2020 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: v1 -kind: Secret -metadata: - name: webhook-certs - namespace: knative-serving - labels: - app.kubernetes.io/component: webhook - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.15.0" -# The data is populated at install time. ---- -# Source: https://github.com/knative/net-kourier/releases/download/knative-v1.15.0/kourier.yaml ---- -# Copyright 2020 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: v1 -kind: Namespace -metadata: - name: kourier-system - labels: - networking.knative.dev/ingress-provider: kourier - app.kubernetes.io/name: knative-serving - app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.15.0" ---- -# Copyright 2020 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: v1 -kind: ConfigMap -metadata: - name: kourier-bootstrap - namespace: kourier-system - labels: - networking.knative.dev/ingress-provider: kourier - app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.15.0" - app.kubernetes.io/name: knative-serving -data: - envoy-bootstrap.yaml: | - dynamic_resources: - ads_config: - transport_api_version: V3 - api_type: GRPC - rate_limit_settings: {} - grpc_services: - - envoy_grpc: {cluster_name: xds_cluster} - cds_config: - resource_api_version: V3 - ads: {} - lds_config: - resource_api_version: V3 - ads: {} - node: - cluster: kourier-knative - id: 3scale-kourier-gateway - static_resources: - listeners: - - name: stats_listener - address: - socket_address: - address: 0.0.0.0 - port_value: 9000 - filter_chains: - - filters: - - name: envoy.filters.network.http_connection_manager - typed_config: - "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager - stat_prefix: stats_server - http_filters: - - name: envoy.filters.http.router - typed_config: - "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router - route_config: - virtual_hosts: - - name: admin_interface - domains: - - "*" - routes: - - match: - safe_regex: - regex: '/(certs|stats(/prometheus)?|server_info|clusters|listeners|ready)?' - headers: - - name: ':method' - string_match: - exact: GET - route: - cluster: service_stats - - match: - safe_regex: - regex: '/drain_listeners' - headers: - - name: ':method' - string_match: - exact: POST - route: - cluster: service_stats - clusters: - - name: service_stats - connect_timeout: 0.250s - type: static - load_assignment: - cluster_name: service_stats - endpoints: - lb_endpoints: - endpoint: - address: - socket_address: - address: 127.0.0.1 - port_value: 9901 - - name: xds_cluster - # This keepalive is recommended by envoy docs. - # https://www.envoyproxy.io/docs/envoy/latest/api-docs/xds_protocol - typed_extension_protocol_options: - envoy.extensions.upstreams.http.v3.HttpProtocolOptions: - "@type": type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions - explicit_http_config: - http2_protocol_options: - connection_keepalive: - interval: 30s - timeout: 5s - connect_timeout: 1s - load_assignment: - cluster_name: xds_cluster - endpoints: - lb_endpoints: - endpoint: - address: - socket_address: - address: "net-kourier-controller.knative-serving" - port_value: 18000 - type: STRICT_DNS - admin: - access_log: - - name: envoy.access_loggers.stdout - typed_config: - "@type": type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog - address: - socket_address: - address: 127.0.0.1 - port_value: 9901 ---- -# Copyright 2021 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: v1 -kind: ConfigMap -metadata: - name: config-kourier - namespace: knative-serving - labels: - networking.knative.dev/ingress-provider: kourier - app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.15.0" - app.kubernetes.io/name: knative-serving -data: - _example: | - ################################ - # # - # EXAMPLE CONFIGURATION # - # # - ################################ - - # This block is not actually functional configuration, - # but serves to illustrate the available configuration - # options and document them in a way that is accessible - # to users that `kubectl edit` this config map. - # - # These sample configuration options may be copied out of - # this example block and unindented to be in the data block - # to actually change the configuration. - - # Specifies whether requests reaching the Kourier gateway - # in the context of services should be logged. Readiness - # probes etc. must be configured via the bootstrap config. - enable-service-access-logging: "true" - - # Specifies whether to use proxy-protocol in order to safely - # transport connection information such as a client's address - # across multiple layers of TCP proxies. - # NOTE THAT THIS IS AN EXPERIMENTAL / ALPHA FEATURE - enable-proxy-protocol: "false" - - # The server certificates to serve the internal TLS traffic for Kourier Gateway. - # It is specified by the secret name in controller namespace, which has - # the "tls.crt" and "tls.key" data field. - # Use an empty value to disable the feature (default). - # - # NOTE: This flag is in an alpha state and is mostly here to enable internal testing - # for now. Use with caution. - cluster-cert-secret: "" - - # Specifies the amount of time that Kourier waits for the incoming requests. - # The default, 0s, imposes no timeout at all. - stream-idle-timeout: "0s" - - # Specifies whether to use CryptoMB private key provider in order to - # acclerate the TLS handshake. - # NOTE THAT THIS IS AN EXPERIMENTAL / ALPHA FEATURE. - enable-cryptomb: "false" - - # Configures the number of additional ingress proxy hops from the - # right side of the x-forwarded-for HTTP header to trust. - trusted-hops-count: "0" - - # Specifies the cipher suites for TLS external listener. - # Use ',' separated values like "ECDHE-ECDSA-AES128-GCM-SHA256,ECDHE-ECDSA-CHACHA20-POLY1305" - # The default uses the default cipher suites of the envoy version. - cipher-suites: "" ---- -# Copyright 2020 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: v1 -kind: ServiceAccount -metadata: - name: net-kourier - namespace: knative-serving - labels: - networking.knative.dev/ingress-provider: kourier - app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.15.0" - app.kubernetes.io/name: knative-serving ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: net-kourier - labels: - networking.knative.dev/ingress-provider: kourier - app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.15.0" - app.kubernetes.io/name: knative-serving -rules: - - apiGroups: [""] - resources: ["events"] - verbs: ["create", "update", "patch"] - - apiGroups: [""] - resources: ["pods", "endpoints", "services", "secrets"] - verbs: ["get", "list", "watch"] - - apiGroups: [""] - resources: ["configmaps"] - verbs: ["get", "list", "watch"] - - apiGroups: ["coordination.k8s.io"] - resources: ["leases"] - verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] - - apiGroups: ["networking.internal.knative.dev"] - resources: ["ingresses"] - verbs: ["get", "list", "watch", "patch"] - - apiGroups: ["networking.internal.knative.dev"] - resources: ["ingresses/status"] - verbs: ["update"] ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: net-kourier - labels: - networking.knative.dev/ingress-provider: kourier - app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.15.0" - app.kubernetes.io/name: knative-serving -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: net-kourier -subjects: - - kind: ServiceAccount - name: net-kourier - namespace: knative-serving ---- -# Copyright 2020 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: apps/v1 -kind: Deployment -metadata: - name: net-kourier-controller - namespace: knative-serving - labels: - networking.knative.dev/ingress-provider: kourier - app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.15.0" - app.kubernetes.io/name: knative-serving -spec: - strategy: - type: RollingUpdate - rollingUpdate: - maxUnavailable: 0 - maxSurge: 100% - replicas: 1 - selector: - matchLabels: - app: net-kourier-controller - template: - metadata: - annotations: - prometheus.io/scrape: "true" - prometheus.io/port: "9090" - prometheus.io/path: "/metrics" - labels: - app: net-kourier-controller - spec: - containers: - - image: gcr.io/knative-releases/knative.dev/net-kourier/cmd/kourier@sha256:c9016f34165c5118373c75dcc373d1cd802fe37ffa9e1bce65960942a59bc5f1 - name: controller - env: - - name: CERTS_SECRET_NAMESPACE - value: "" - - name: CERTS_SECRET_NAME - value: "" - - name: SYSTEM_NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace - - name: METRICS_DOMAIN - value: "knative.dev/samples" - - name: KOURIER_GATEWAY_NAMESPACE - value: "kourier-system" - - name: ENABLE_SECRET_INFORMER_FILTERING_BY_CERT_UID - value: "false" - # KUBE_API_BURST and KUBE_API_QPS allows to configure maximum burst for throttle and maximum QPS to the server from the client. - # Setting these values using env vars is possible since https://github.com/knative/pkg/pull/2755. - # 200 is an arbitrary value, but it speeds up kourier startup duration, and the whole ingress reconciliation process as a whole. - - name: KUBE_API_BURST - value: "200" - - name: KUBE_API_QPS - value: "200" - ports: - - name: http2-xds - containerPort: 18000 - protocol: TCP - - name: metrics - containerPort: 9090 - protocol: TCP - readinessProbe: - grpc: - port: 18000 - periodSeconds: 10 - failureThreshold: 3 - livenessProbe: - grpc: - port: 18000 - periodSeconds: 10 - failureThreshold: 6 - securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: true - runAsNonRoot: true - capabilities: - drop: - - ALL - seccompProfile: - type: RuntimeDefault - resources: - requests: - cpu: 200m - memory: 200Mi - limits: - cpu: "1" - memory: 500Mi - restartPolicy: Always - serviceAccountName: net-kourier ---- -apiVersion: v1 -kind: Service -metadata: - name: net-kourier-controller - namespace: knative-serving - labels: - networking.knative.dev/ingress-provider: kourier - app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.15.0" - app.kubernetes.io/name: knative-serving -spec: - ports: - - name: grpc-xds - port: 18000 - protocol: TCP - targetPort: 18000 - - name: http-metrics - port: 9090 - protocol: TCP - targetPort: 9090 - selector: - app: net-kourier-controller - type: ClusterIP ---- -# Copyright 2020 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: apps/v1 -kind: Deployment -metadata: - name: 3scale-kourier-gateway - namespace: kourier-system - labels: - networking.knative.dev/ingress-provider: kourier - app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.15.0" - app.kubernetes.io/name: knative-serving -spec: - strategy: - type: RollingUpdate - rollingUpdate: - maxUnavailable: 0 - maxSurge: 100% - selector: - matchLabels: - app: 3scale-kourier-gateway - template: - metadata: - labels: - app: 3scale-kourier-gateway - annotations: - # v0.26 supports envoy v3 API, so - # adding this label to restart pod. - networking.knative.dev/poke: "v0.26" - prometheus.io/scrape: "true" - prometheus.io/port: "9000" - prometheus.io/path: "/stats/prometheus" - spec: - containers: - - args: - - --base-id 1 - - -c /tmp/config/envoy-bootstrap.yaml - - --log-level info - - --drain-time-s $(DRAIN_TIME_SECONDS) - - --drain-strategy immediate - command: - - /usr/local/bin/envoy - env: - - name: DRAIN_TIME_SECONDS - value: "15" - image: docker.io/envoyproxy/envoy:v1.26-latest - name: kourier-gateway - ports: - - name: http2-external - containerPort: 8080 - protocol: TCP - - name: http2-internal - containerPort: 8081 - protocol: TCP - - name: https-external - containerPort: 8443 - protocol: TCP - - name: http-probe - containerPort: 8090 - protocol: TCP - - name: https-probe - containerPort: 9443 - protocol: TCP - - name: metrics - containerPort: 9000 - protocol: TCP - securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: false - runAsNonRoot: true - runAsUser: 65534 - runAsGroup: 65534 - capabilities: - drop: - - ALL - seccompProfile: - type: RuntimeDefault - volumeMounts: - - name: config-volume - mountPath: /tmp/config - lifecycle: - preStop: - exec: - command: ["/bin/sh", "-c", "curl -X POST http://localhost:9901/drain_listeners?graceful; sleep $DRAIN_TIME_SECONDS"] - readinessProbe: - httpGet: - httpHeaders: - - name: Host - value: internalkourier - path: /ready - port: 8081 - scheme: HTTP - initialDelaySeconds: 10 - periodSeconds: 5 - failureThreshold: 3 - livenessProbe: - httpGet: - httpHeaders: - - name: Host - value: internalkourier - path: /ready - port: 8081 - scheme: HTTP - initialDelaySeconds: 10 - periodSeconds: 5 - failureThreshold: 6 - resources: - requests: - cpu: 200m - memory: 200Mi - limits: - cpu: "1" - memory: 800Mi - # to ensure a graceful drain, terminationGracePeriodSeconds must be greater than DRAIN_TIME_SECONDS environment variable - terminationGracePeriodSeconds: 30 - volumes: - - name: config-volume - configMap: - name: kourier-bootstrap - restartPolicy: Always ---- -apiVersion: v1 -kind: Service -metadata: - name: kourier - namespace: kourier-system - labels: - networking.knative.dev/ingress-provider: kourier - app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.15.0" - app.kubernetes.io/name: knative-serving -spec: - ports: - - name: http2 - port: 80 - protocol: TCP - targetPort: 8080 - - name: https - port: 443 - protocol: TCP - targetPort: 8443 - selector: - app: 3scale-kourier-gateway - type: LoadBalancer ---- -apiVersion: v1 -kind: Service -metadata: - name: kourier-internal - namespace: kourier-system - labels: - networking.knative.dev/ingress-provider: kourier - app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.15.0" - app.kubernetes.io/name: knative-serving -spec: - ports: - - name: http2 - port: 80 - protocol: TCP - targetPort: 8081 - - name: https - port: 443 - protocol: TCP - targetPort: 8444 - selector: - app: 3scale-kourier-gateway - type: ClusterIP ---- -apiVersion: autoscaling/v2 -kind: HorizontalPodAutoscaler -metadata: - name: 3scale-kourier-gateway - namespace: kourier-system - labels: - networking.knative.dev/ingress-provider: kourier - app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.15.0" - app.kubernetes.io/name: knative-serving -spec: - minReplicas: 1 - maxReplicas: 10 - scaleTargetRef: - apiVersion: apps/v1 - kind: Deployment - name: 3scale-kourier-gateway - metrics: - - type: Resource - resource: - name: cpu - target: - type: Utilization - # Percentage of the requested CPU - averageUtilization: 100 ---- -apiVersion: policy/v1 -kind: PodDisruptionBudget -metadata: - name: 3scale-kourier-gateway-pdb - namespace: kourier-system - labels: - networking.knative.dev/ingress-provider: kourier - app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.15.0" - app.kubernetes.io/name: knative-serving -spec: - minAvailable: 80% - selector: - matchLabels: - app: 3scale-kourier-gateway diff --git a/packages/manifests/scripts/pull-manifests.ts b/packages/manifests/scripts/pull-manifests.ts index 27836ac..02ca664 100644 --- a/packages/manifests/scripts/pull-manifests.ts +++ b/packages/manifests/scripts/pull-manifests.ts @@ -95,11 +95,14 @@ const OPERATORS: OperatorConfig[] = [ ], }, { + // Held at v1.17.0 deliberately: this is the version deployed downstream, and + // a client generated from newer CRDs would describe an API that is not + // running. Bump both together or not at all. name: 'cert-manager', sources: [ { type: 'helm', - version: 'v1.21.1', + version: 'v1.17.0', // matches what constructive-cloud deploys — see note below repo: 'https://charts.jetstack.io', repoName: 'jetstack', chart: 'cert-manager', diff --git a/packages/manifests/src/generated/cert-manager.ts b/packages/manifests/src/generated/cert-manager.ts index 746a862..7159f2b 100644 --- a/packages/manifests/src/generated/cert-manager.ts +++ b/packages/manifests/src/generated/cert-manager.ts @@ -20,8 +20,8 @@ export const ServiceAccount_CertManagerCainjector: KubernetesResource = { "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "cainjector", - "app.kubernetes.io/version": "v1.21.1", - "helm.sh/chart": "cert-manager-v1.21.1" + "app.kubernetes.io/version": "v1.17.0", + "helm.sh/chart": "cert-manager-v1.17.0" }, name: "cert-manager-cainjector", namespace: "cert-manager" @@ -38,8 +38,8 @@ export const ServiceAccount_CertManager: KubernetesResource = { "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "cert-manager", - "app.kubernetes.io/version": "v1.21.1", - "helm.sh/chart": "cert-manager-v1.21.1" + "app.kubernetes.io/version": "v1.17.0", + "helm.sh/chart": "cert-manager-v1.17.0" }, name: "cert-manager", namespace: "cert-manager" @@ -56,15 +56,15 @@ export const ServiceAccount_CertManagerWebhook: KubernetesResource = { "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "webhook", - "app.kubernetes.io/version": "v1.21.1", - "helm.sh/chart": "cert-manager-v1.21.1" + "app.kubernetes.io/version": "v1.17.0", + "helm.sh/chart": "cert-manager-v1.17.0" }, name: "cert-manager-webhook", namespace: "cert-manager" }, automountServiceAccountToken: true }; -export const CustomResourceDefinition_ChallengesAcmeCertManagerIo: KubernetesResource = { +export const CustomResourceDefinition_CertificaterequestsCertManagerIo: KubernetesResource = { apiVersion: "apiextensions.k8s.io/v1", kind: "CustomResourceDefinition", metadata: { @@ -73,37 +73,49 @@ export const CustomResourceDefinition_ChallengesAcmeCertManagerIo: KubernetesRes }, labels: { app: "cert-manager", - "app.kubernetes.io/component": "crds", "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "cert-manager", - "app.kubernetes.io/version": "v1.21.1", - "helm.sh/chart": "cert-manager-v1.21.1" + "app.kubernetes.io/version": "v1.17.0", + "helm.sh/chart": "cert-manager-v1.17.0" }, - name: "challenges.acme.cert-manager.io" + name: "certificaterequests.cert-manager.io" }, spec: { - group: "acme.cert-manager.io", + group: "cert-manager.io", names: { - categories: ["cert-manager", "cert-manager-acme"], - kind: "Challenge", - listKind: "ChallengeList", - plural: "challenges", - singular: "challenge" + categories: ["cert-manager"], + kind: "CertificateRequest", + listKind: "CertificateRequestList", + plural: "certificaterequests", + shortNames: ["cr", "crs"], + singular: "certificaterequest" }, scope: "Namespaced", versions: [{ additionalPrinterColumns: [{ - jsonPath: ".status.state", - name: "State", + jsonPath: ".status.conditions[?(@.type==\"Approved\")].status", + name: "Approved", type: "string" }, { - jsonPath: ".spec.dnsName", - name: "Domain", + jsonPath: ".status.conditions[?(@.type==\"Denied\")].status", + name: "Denied", type: "string" }, { - jsonPath: ".status.reason", - name: "Reason", + jsonPath: ".status.conditions[?(@.type==\"Ready\")].status", + name: "Ready", + type: "string" + }, { + jsonPath: ".spec.issuerRef.name", + name: "Issuer", + type: "string" + }, { + jsonPath: ".spec.username", + name: "Requester", + type: "string" + }, { + jsonPath: ".status.conditions[?(@.type==\"Ready\")].message", + name: "Status", priority: 1, type: "string" }, { @@ -115,7 +127,7 @@ export const CustomResourceDefinition_ChallengesAcmeCertManagerIo: KubernetesRes name: "v1", schema: { openAPIV3Schema: { - description: "Challenge is a type to represent a Challenge request with an ACME server", + description: "A CertificateRequest is used to request a signed certificate from one of the\nconfigured issuers.\n\nAll fields within the CertificateRequest's `spec` are immutable after creation.\nA CertificateRequest will either succeed or fail, as denoted by its `Ready` status\ncondition and its `status.failureTime` field.\n\nA CertificateRequest is a one-shot resource, meaning it represents a single\npoint in time request for a certificate and cannot be re-used.", properties: { apiVersion: { description: "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", @@ -129,2914 +141,614 @@ export const CustomResourceDefinition_ChallengesAcmeCertManagerIo: KubernetesRes type: "object" }, spec: { + description: "Specification of the desired state of the CertificateRequest resource.\nhttps://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status", properties: { - authorizationURL: { - description: "The URL to the ACME Authorization resource that this\nchallenge is a part of.", + duration: { + description: "Requested 'duration' (i.e. lifetime) of the Certificate. Note that the\nissuer may choose to ignore the requested duration, just like any other\nrequested attribute.", type: "string" }, - dnsName: { - description: "dnsName is the identifier that this challenge is for, e.g., example.com.\nIf the requested DNSName is a 'wildcard', this field MUST be set to the\nnon-wildcard domain, e.g., for `*.example.com`, it must be `example.com`.", - type: "string" + extra: { + additionalProperties: { + items: { + type: "string" + }, + type: "array" + }, + description: "Extra contains extra attributes of the user that created the CertificateRequest.\nPopulated by the cert-manager webhook on creation and immutable.", + type: "object" + }, + groups: { + description: "Groups contains group membership of the user that created the CertificateRequest.\nPopulated by the cert-manager webhook on creation and immutable.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + isCA: { + description: "Requested basic constraints isCA value. Note that the issuer may choose\nto ignore the requested isCA value, just like any other requested attribute.\n\nNOTE: If the CSR in the `Request` field has a BasicConstraints extension,\nit must have the same isCA value as specified here.\n\nIf true, this will automatically add the `cert sign` usage to the list\nof requested `usages`.", + type: "boolean" }, issuerRef: { - description: "References a properly configured ACME-type Issuer which should\nbe used to create this Challenge.\nIf the Issuer does not exist, processing will be retried.\nIf the Issuer is not an 'ACME' Issuer, an error will be returned and the\nChallenge will be marked as failed.", + description: "Reference to the issuer responsible for issuing the certificate.\nIf the issuer is namespace-scoped, it must be in the same namespace\nas the Certificate. If the issuer is cluster-scoped, it can be used\nfrom any namespace.\n\nThe `name` field of the reference must always be specified.", properties: { group: { - description: "Group of the issuer being referred to.\nDefaults to 'cert-manager.io'.", + description: "Group of the resource being referred to.", type: "string" }, kind: { - description: "Kind of the issuer being referred to.\nDefaults to 'Issuer'.", + description: "Kind of the resource being referred to.", type: "string" }, name: { - description: "Name of the issuer being referred to.", + description: "Name of the resource being referred to.", type: "string" } }, required: ["name"], type: "object" }, - key: { - description: "The ACME challenge key for this challenge\nFor HTTP01 challenges, this is the value that must be responded with to\ncomplete the HTTP01 challenge in the format:\n`.`.\nFor DNS01 challenges, this is the base64 encoded SHA256 sum of the\n`.`\ntext that must be set as the TXT record content.", + request: { + description: "The PEM-encoded X.509 certificate signing request to be submitted to the\nissuer for signing.\n\nIf the CSR has a BasicConstraints extension, its isCA attribute must\nmatch the `isCA` value of this CertificateRequest.\nIf the CSR has a KeyUsage extension, its key usages must match the\nkey usages in the `usages` field of this CertificateRequest.\nIf the CSR has a ExtKeyUsage extension, its extended key usages\nmust match the extended key usages in the `usages` field of this\nCertificateRequest.", + format: "byte", type: "string" }, - solver: { - description: "Contains the domain solving configuration that should be used to\nsolve this challenge resource.", - properties: { - dns01: { - description: "Configures cert-manager to attempt to complete authorizations by\nperforming the DNS01 challenge flow.", - properties: { - acmeDNS: { - description: "Use the 'ACME DNS' (https://github.com/joohoi/acme-dns) API to manage\nDNS01 challenge records.", - properties: { - accountSecretRef: { - description: "A reference to a specific 'key' within a Secret resource.\nIn some instances, `key` is a required field.", - properties: { - key: { - description: "The key of the entry in the Secret resource's `data` field to be used.\nSome instances of this field may be defaulted, in others it may be\nrequired.", - type: "string" - }, - name: { - description: "Name of the resource being referred to.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - type: "string" - } - }, - required: ["name"], - type: "object" - }, - host: { - type: "string" - } - }, - required: ["accountSecretRef", "host"], - type: "object" - }, - akamai: { - description: "Use the Akamai DNS zone management API to manage DNS01 challenge records.", - properties: { - accessTokenSecretRef: { - description: "A reference to a specific 'key' within a Secret resource.\nIn some instances, `key` is a required field.", - properties: { - key: { - description: "The key of the entry in the Secret resource's `data` field to be used.\nSome instances of this field may be defaulted, in others it may be\nrequired.", - type: "string" - }, - name: { - description: "Name of the resource being referred to.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - type: "string" - } - }, - required: ["name"], - type: "object" - }, - clientSecretSecretRef: { - description: "A reference to a specific 'key' within a Secret resource.\nIn some instances, `key` is a required field.", - properties: { - key: { - description: "The key of the entry in the Secret resource's `data` field to be used.\nSome instances of this field may be defaulted, in others it may be\nrequired.", - type: "string" - }, - name: { - description: "Name of the resource being referred to.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - type: "string" - } - }, - required: ["name"], - type: "object" - }, - clientTokenSecretRef: { - description: "A reference to a specific 'key' within a Secret resource.\nIn some instances, `key` is a required field.", - properties: { - key: { - description: "The key of the entry in the Secret resource's `data` field to be used.\nSome instances of this field may be defaulted, in others it may be\nrequired.", - type: "string" - }, - name: { - description: "Name of the resource being referred to.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - type: "string" - } - }, - required: ["name"], - type: "object" - }, - serviceConsumerDomain: { - type: "string" - } - }, - required: ["accessTokenSecretRef", "clientSecretSecretRef", "clientTokenSecretRef", "serviceConsumerDomain"], - type: "object" - }, - azureDNS: { - description: "Use the Microsoft Azure DNS API to manage DNS01 challenge records.", - properties: { - clientID: { - description: "Auth: Azure Service Principal:\nThe ClientID of the Azure Service Principal used to authenticate with Azure DNS.\nIf set, ClientSecret and TenantID must also be set.", - type: "string" - }, - clientSecretSecretRef: { - description: "Auth: Azure Service Principal:\nA reference to a Secret containing the password associated with the Service Principal.\nIf set, ClientID and TenantID must also be set.", - properties: { - key: { - description: "The key of the entry in the Secret resource's `data` field to be used.\nSome instances of this field may be defaulted, in others it may be\nrequired.", - type: "string" - }, - name: { - description: "Name of the resource being referred to.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - type: "string" - } - }, - required: ["name"], - type: "object" - }, - environment: { - description: "name of the Azure environment (default AzurePublicCloud)", - enum: ["AzurePublicCloud", "AzureChinaCloud", "AzureGermanCloud", "AzureUSGovernmentCloud"], - type: "string" - }, - hostedZoneName: { - description: "name of the DNS zone that should be used", - type: "string" - }, - managedIdentity: { - description: "Auth: Azure Workload Identity or Azure Managed Service Identity:\nSettings to enable Azure Workload Identity or Azure Managed Service Identity\nIf set, ClientID, ClientSecret and TenantID must not be set.", - properties: { - clientID: { - description: "client ID of the managed identity, cannot be used at the same time as resourceID", - type: "string" - }, - resourceID: { - description: "resource ID of the managed identity, cannot be used at the same time as clientID\nCannot be used for Azure Managed Service Identity", - type: "string" - }, - tenantID: { - description: "tenant ID of the managed identity, cannot be used at the same time as resourceID", - type: "string" - } - }, - type: "object" - }, - resourceGroupName: { - description: "resource group the DNS zone is located in", - type: "string" - }, - subscriptionID: { - description: "ID of the Azure subscription", - type: "string" - }, - tenantID: { - description: "Auth: Azure Service Principal:\nThe TenantID of the Azure Service Principal used to authenticate with Azure DNS.\nIf set, ClientID and ClientSecret must also be set.", - type: "string" - }, - zoneType: { - description: "ZoneType determines which type of Azure DNS zone to use.\n\nValid values are:\n - AzurePublicZone (default): Use a public Azure DNS zone.\n - AzurePrivateZone: Use an Azure Private DNS zone.\n\nIf not specified, AzurePublicZone is used.\n\nSupport for Azure Private DNS zones is currently\nexperimental and may change in future releases.", - enum: ["AzurePublicZone", "AzurePrivateZone"], - type: "string" - } - }, - required: ["resourceGroupName", "subscriptionID"], - type: "object" - }, - cloudDNS: { - description: "Use the Google Cloud DNS API to manage DNS01 challenge records.", - properties: { - hostedZoneName: { - description: "HostedZoneName is an optional field that tells cert-manager in which\nCloud DNS zone the challenge record has to be created.\nIf left empty cert-manager will automatically choose a zone.", - type: "string" - }, - project: { - type: "string" - }, - serviceAccountSecretRef: { - description: "A reference to a specific 'key' within a Secret resource.\nIn some instances, `key` is a required field.", - properties: { - key: { - description: "The key of the entry in the Secret resource's `data` field to be used.\nSome instances of this field may be defaulted, in others it may be\nrequired.", - type: "string" - }, - name: { - description: "Name of the resource being referred to.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - type: "string" - } - }, - required: ["name"], - type: "object" - } - }, - required: ["project"], - type: "object" - }, - cloudflare: { - description: "Use the Cloudflare API to manage DNS01 challenge records.", - properties: { - apiKeySecretRef: { - description: "API key to use to authenticate with Cloudflare.\nNote: using an API token to authenticate is now the recommended method\nas it allows greater control of permissions.", - properties: { - key: { - description: "The key of the entry in the Secret resource's `data` field to be used.\nSome instances of this field may be defaulted, in others it may be\nrequired.", - type: "string" - }, - name: { - description: "Name of the resource being referred to.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - type: "string" - } - }, - required: ["name"], - type: "object" - }, - apiTokenSecretRef: { - description: "API token used to authenticate with Cloudflare.", - properties: { - key: { - description: "The key of the entry in the Secret resource's `data` field to be used.\nSome instances of this field may be defaulted, in others it may be\nrequired.", - type: "string" - }, - name: { - description: "Name of the resource being referred to.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - type: "string" - } - }, - required: ["name"], - type: "object" - }, - email: { - description: "Email of the account, only required when using API key based authentication.", - type: "string" - } - }, - type: "object" - }, - cnameStrategy: { - description: "CNAMEStrategy configures how the DNS01 provider should handle CNAME\nrecords when found in DNS zones.", - enum: ["None", "Follow"], - type: "string" - }, - digitalocean: { - description: "Use the DigitalOcean DNS API to manage DNS01 challenge records.", - properties: { - tokenSecretRef: { - description: "A reference to a specific 'key' within a Secret resource.\nIn some instances, `key` is a required field.", - properties: { - key: { - description: "The key of the entry in the Secret resource's `data` field to be used.\nSome instances of this field may be defaulted, in others it may be\nrequired.", - type: "string" - }, - name: { - description: "Name of the resource being referred to.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - type: "string" - } - }, - required: ["name"], - type: "object" - } - }, - required: ["tokenSecretRef"], - type: "object" - }, - rfc2136: { - description: "Use RFC2136 (\"Dynamic Updates in the Domain Name System\") (https://datatracker.ietf.org/doc/rfc2136/)\nto manage DNS01 challenge records.", - properties: { - nameserver: { - description: "The IP address or hostname of an authoritative DNS server supporting\nRFC2136 in the form host:port. If the host is an IPv6 address it must be\nenclosed in square brackets (e.g [2001:db8::1]); port is optional.\nThis field is required.", - type: "string" - }, - protocol: { - description: "Protocol to use for dynamic DNS update queries. Valid values are (case-sensitive) ``TCP`` and ``UDP``; ``UDP`` (default).", - enum: ["TCP", "UDP"], - type: "string" - }, - tsigAlgorithm: { - description: "The TSIG Algorithm configured in the DNS supporting RFC2136. Used only\nwhen ``tsigSecretSecretRef`` and ``tsigKeyName`` are defined.\nSupported values are (case-insensitive): ``HMACMD5`` (default),\n``HMACSHA1``, ``HMACSHA256`` or ``HMACSHA512``.", - type: "string" - }, - tsigKeyName: { - description: "The TSIG Key name configured in the DNS.\nIf ``tsigSecretSecretRef`` is defined, this field is required.", - type: "string" - }, - tsigSecretSecretRef: { - description: "The name of the secret containing the TSIG value.\nIf ``tsigKeyName`` is defined, this field is required.", - properties: { - key: { - description: "The key of the entry in the Secret resource's `data` field to be used.\nSome instances of this field may be defaulted, in others it may be\nrequired.", - type: "string" - }, - name: { - description: "Name of the resource being referred to.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - type: "string" - } - }, - required: ["name"], - type: "object" - } - }, - required: ["nameserver"], - type: "object" - }, - route53: { - description: "Use the AWS Route53 API to manage DNS01 challenge records.", - properties: { - accessKeyID: { - description: "The AccessKeyID is used for authentication.\nCannot be set when SecretAccessKeyID is set.\nIf neither the Access Key nor Key ID are set, we fall back to using env\nvars, shared credentials file, or AWS Instance metadata,\nsee: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials", - type: "string" - }, - accessKeyIDSecretRef: { - description: "The SecretAccessKey is used for authentication. If set, pull the AWS\naccess key ID from a key within a Kubernetes Secret.\nCannot be set when AccessKeyID is set.\nIf neither the Access Key nor Key ID are set, we fall back to using env\nvars, shared credentials file, or AWS Instance metadata,\nsee: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials", - properties: { - key: { - description: "The key of the entry in the Secret resource's `data` field to be used.\nSome instances of this field may be defaulted, in others it may be\nrequired.", - type: "string" - }, - name: { - description: "Name of the resource being referred to.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - type: "string" - } - }, - required: ["name"], - type: "object" - }, - auth: { - description: "Auth configures how cert-manager authenticates.", - properties: { - kubernetes: { - description: "Kubernetes authenticates with Route53 using AssumeRoleWithWebIdentity\nby passing a bound ServiceAccount token.", - properties: { - serviceAccountRef: { - description: "A reference to a service account that will be used to request a bound\ntoken (also known as \"projected token\"). To use this field, you must\nconfigure an RBAC rule to let cert-manager request a token.", - properties: { - audiences: { - description: "TokenAudiences is an optional list of audiences to include in the\ntoken passed to AWS. The default token consisting of the issuer's namespace\nand name is always included.\nIf unset the audience defaults to `sts.amazonaws.com`.", - items: { - type: "string" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - }, - name: { - description: "Name of the ServiceAccount used to request a token.", - type: "string" - } - }, - required: ["name"], - type: "object" - } - }, - required: ["serviceAccountRef"], - type: "object" - } - }, - required: ["kubernetes"], - type: "object" - }, - hostedZoneID: { - description: "If set, the provider will manage only this zone in Route53 and will not do a lookup using the route53:ListHostedZonesByName api call.", - type: "string" - }, - region: { - description: "Override the AWS region.\n\nRoute53 is a global service and does not have regional endpoints but the\nregion specified here (or via environment variables) is used as a hint to\nhelp compute the correct AWS credential scope and partition when it\nconnects to Route53. See:\n- [Amazon Route 53 endpoints and quotas](https://docs.aws.amazon.com/general/latest/gr/r53.html)\n- [Global services](https://docs.aws.amazon.com/whitepapers/latest/aws-fault-isolation-boundaries/global-services.html)\n\nIf you omit this region field, cert-manager will use the region from\nAWS_REGION and AWS_DEFAULT_REGION environment variables, if they are set\nin the cert-manager controller Pod.\n\nThe `region` field is not needed if you use [IAM Roles for Service Accounts (IRSA)](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html).\nInstead an AWS_REGION environment variable is added to the cert-manager controller Pod by:\n[Amazon EKS Pod Identity Webhook](https://github.com/aws/amazon-eks-pod-identity-webhook).\nIn this case this `region` field value is ignored.\n\nThe `region` field is not needed if you use [EKS Pod Identities](https://docs.aws.amazon.com/eks/latest/userguide/pod-identities.html).\nInstead an AWS_REGION environment variable is added to the cert-manager controller Pod by:\n[Amazon EKS Pod Identity Agent](https://github.com/aws/eks-pod-identity-agent),\nIn this case this `region` field value is ignored.", - type: "string" - }, - role: { - description: "Role is a Role ARN which the Route53 provider will assume using either the explicit credentials AccessKeyID/SecretAccessKey\nor the inferred credentials from environment variables, shared credentials file or AWS Instance metadata", - type: "string" - }, - secretAccessKeySecretRef: { - description: "The SecretAccessKey is used for authentication.\nIf neither the Access Key nor Key ID are set, we fall back to using env\nvars, shared credentials file, or AWS Instance metadata,\nsee: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials", - properties: { - key: { - description: "The key of the entry in the Secret resource's `data` field to be used.\nSome instances of this field may be defaulted, in others it may be\nrequired.", - type: "string" - }, - name: { - description: "Name of the resource being referred to.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - type: "string" - } - }, - required: ["name"], - type: "object" - } - }, - type: "object" - }, - webhook: { - description: "Configure an external webhook based DNS01 challenge solver to manage\nDNS01 challenge records.", - properties: { - config: { - description: "Additional configuration that should be passed to the webhook apiserver\nwhen challenges are processed.\nThis can contain arbitrary JSON data.\nSecret values should not be specified in this stanza.\nIf secret values are needed (e.g., credentials for a DNS service), you\nshould use a SecretKeySelector to reference a Secret resource.\nFor details on the schema of this field, consult the webhook provider\nimplementation's documentation.", - "x-kubernetes-preserve-unknown-fields": true - }, - groupName: { - description: "The API group name that should be used when POSTing ChallengePayload\nresources to the webhook apiserver.\nThis should be the same as the GroupName specified in the webhook\nprovider implementation.", - type: "string" - }, - solverName: { - description: "The name of the solver to use, as defined in the webhook provider\nimplementation.\nThis will typically be the name of the provider, e.g., 'cloudflare'.", - type: "string" - } - }, - required: ["groupName", "solverName"], - type: "object" - } + uid: { + description: "UID contains the uid of the user that created the CertificateRequest.\nPopulated by the cert-manager webhook on creation and immutable.", + type: "string" + }, + usages: { + description: "Requested key usages and extended key usages.\n\nNOTE: If the CSR in the `Request` field has uses the KeyUsage or\nExtKeyUsage extension, these extensions must have the same values\nas specified here without any additional values.\n\nIf unset, defaults to `digital signature` and `key encipherment`.", + items: { + description: "KeyUsage specifies valid usage contexts for keys.\nSee:\nhttps://tools.ietf.org/html/rfc5280#section-4.2.1.3\nhttps://tools.ietf.org/html/rfc5280#section-4.2.1.12\n\nValid KeyUsage values are as follows:\n\"signing\",\n\"digital signature\",\n\"content commitment\",\n\"key encipherment\",\n\"key agreement\",\n\"data encipherment\",\n\"cert sign\",\n\"crl sign\",\n\"encipher only\",\n\"decipher only\",\n\"any\",\n\"server auth\",\n\"client auth\",\n\"code signing\",\n\"email protection\",\n\"s/mime\",\n\"ipsec end system\",\n\"ipsec tunnel\",\n\"ipsec user\",\n\"timestamping\",\n\"ocsp signing\",\n\"microsoft sgc\",\n\"netscape sgc\"", + enum: ["signing", "digital signature", "content commitment", "key encipherment", "key agreement", "data encipherment", "cert sign", "crl sign", "encipher only", "decipher only", "any", "server auth", "client auth", "code signing", "email protection", "s/mime", "ipsec end system", "ipsec tunnel", "ipsec user", "timestamping", "ocsp signing", "microsoft sgc", "netscape sgc"], + type: "string" + }, + type: "array" + }, + username: { + description: "Username contains the name of the user that created the CertificateRequest.\nPopulated by the cert-manager webhook on creation and immutable.", + type: "string" + } + }, + required: ["issuerRef", "request"], + type: "object" + }, + status: { + description: "Status of the CertificateRequest.\nThis is set and managed automatically.\nRead-only.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status", + properties: { + ca: { + description: "The PEM encoded X.509 certificate of the signer, also known as the CA\n(Certificate Authority).\nThis is set on a best-effort basis by different issuers.\nIf not set, the CA is assumed to be unknown/not available.", + format: "byte", + type: "string" + }, + certificate: { + description: "The PEM encoded X.509 certificate resulting from the certificate\nsigning request.\nIf not set, the CertificateRequest has either not been completed or has\nfailed. More information on failure can be found by checking the\n`conditions` field.", + format: "byte", + type: "string" + }, + conditions: { + description: "List of status conditions to indicate the status of a CertificateRequest.\nKnown condition types are `Ready`, `InvalidRequest`, `Approved` and `Denied`.", + items: { + description: "CertificateRequestCondition contains condition information for a CertificateRequest.", + properties: { + lastTransitionTime: { + description: "LastTransitionTime is the timestamp corresponding to the last status\nchange of this condition.", + format: "date-time", + type: "string" }, - type: "object" - }, - http01: { - description: "Configures cert-manager to attempt to complete authorizations by\nperforming the HTTP01 challenge flow.\nIt is not possible to obtain certificates for wildcard domain names\n(e.g., `*.example.com`) using the HTTP01 challenge mechanism.", - properties: { - gatewayHTTPRoute: { - description: "The Gateway API is a sig-network community API that models service networking\nin Kubernetes (https://gateway-api.sigs.k8s.io/). The Gateway solver will\ncreate HTTPRoutes with the specified labels in the same namespace as the challenge.\nThis solver is experimental, and fields / behaviour may change in the future.", - properties: { - labels: { - additionalProperties: { - type: "string" - }, - description: "Custom labels that will be applied to HTTPRoutes created by cert-manager\nwhile solving HTTP-01 challenges.", - type: "object" - }, - parentRefs: { - description: "When solving an HTTP-01 challenge, cert-manager creates an HTTPRoute.\ncert-manager needs to know which parentRefs should be used when creating\nthe HTTPRoute. Usually, the parentRef references a Gateway. See:\nhttps://gateway-api.sigs.k8s.io/api-types/httproute/#attaching-to-gateways", - items: { - description: "ParentReference identifies an API object (usually a Gateway) that can be considered\na parent of this resource (usually a route). There are two kinds of parent resources\nwith \"Core\" support:\n\n* Gateway (Gateway conformance profile)\n* Service (Mesh conformance profile, ClusterIP Services only)\n\nThis API may be extended in the future to support additional kinds of parent\nresources.\n\nThe API object must be valid in the cluster; the Group and Kind must\nbe registered in the cluster for this reference to be valid.", - properties: { - group: { - default: "gateway.networking.k8s.io", - description: "Group is the group of the referent.\nWhen unspecified, \"gateway.networking.k8s.io\" is inferred.\nTo set the core API group (such as for a \"Service\" kind referent),\nGroup must be explicitly set to \"\" (empty string).\n\nSupport: Core", - maxLength: 253, - pattern: "^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$", - type: "string" - }, - kind: { - default: "Gateway", - description: "Kind is kind of the referent.\n\nThere are two kinds of parent resources with \"Core\" support:\n\n* Gateway (Gateway conformance profile)\n* Service (Mesh conformance profile, ClusterIP Services only)\n\nSupport for other resources is Implementation-Specific.", - maxLength: 63, - minLength: 1, - pattern: "^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$", - type: "string" - }, - name: { - description: "Name is the name of the referent.\n\nSupport: Core", - maxLength: 253, - minLength: 1, - type: "string" - }, - namespace: { - description: "Namespace is the namespace of the referent. When unspecified, this refers\nto the local namespace of the Route.\n\nNote that there are specific rules for ParentRefs which cross namespace\nboundaries. Cross-namespace references are only valid if they are explicitly\nallowed by something in the namespace they are referring to. For example:\nGateway has the AllowedRoutes field, and ReferenceGrant provides a\ngeneric way to enable any other kind of cross-namespace reference.\n\n\nParentRefs from a Route to a Service in the same namespace are \"producer\"\nroutes, which apply default routing rules to inbound connections from\nany namespace to the Service.\n\nParentRefs from a Route to a Service in a different namespace are\n\"consumer\" routes, and these routing rules are only applied to outbound\nconnections originating from the same namespace as the Route, for which\nthe intended destination of the connections are a Service targeted as a\nParentRef of the Route.\n\n\nSupport: Core", - maxLength: 63, - minLength: 1, - pattern: "^[a-z0-9]([-a-z0-9]*[a-z0-9])?$", - type: "string" - }, - port: { - description: "Port is the network port this Route targets. It can be interpreted\ndifferently based on the type of parent resource.\n\nWhen the parent resource is a Gateway, this targets all listeners\nlistening on the specified port that also support this kind of Route(and\nselect this Route). It's not recommended to set `Port` unless the\nnetworking behaviors specified in a Route must apply to a specific port\nas opposed to a listener(s) whose port(s) may be changed. When both Port\nand SectionName are specified, the name and port of the selected listener\nmust match both specified values.\n\n\nWhen the parent resource is a Service, this targets a specific port in the\nService spec. When both Port (experimental) and SectionName are specified,\nthe name and port of the selected port must match both specified values.\n\n\nImplementations MAY choose to support other parent resources.\nImplementations supporting other types of parent resources MUST clearly\ndocument how/if Port is interpreted.\n\nFor the purpose of status, an attachment is considered successful as\nlong as the parent resource accepts it partially. For example, Gateway\nlisteners can restrict which Routes can attach to them by Route kind,\nnamespace, or hostname. If 1 of 2 Gateway listeners accept attachment\nfrom the referencing Route, the Route MUST be considered successfully\nattached. If no Gateway listeners accept attachment from this Route,\nthe Route MUST be considered detached from the Gateway.\n\nSupport: Extended", - format: "int32", - maximum: 65535, - minimum: 1, - type: "integer" - }, - sectionName: { - description: "SectionName is the name of a section within the target resource. In the\nfollowing resources, SectionName is interpreted as the following:\n\n* Gateway: Listener name. When both Port (experimental) and SectionName\nare specified, the name and port of the selected listener must match\nboth specified values.\n* Service: Port name. When both Port (experimental) and SectionName\nare specified, the name and port of the selected listener must match\nboth specified values.\n\nImplementations MAY choose to support attaching Routes to other resources.\nIf that is the case, they MUST clearly document how SectionName is\ninterpreted.\n\nWhen unspecified (empty string), this will reference the entire resource.\nFor the purpose of status, an attachment is considered successful if at\nleast one section in the parent resource accepts it. For example, Gateway\nlisteners can restrict which Routes can attach to them by Route kind,\nnamespace, or hostname. If 1 of 2 Gateway listeners accept attachment from\nthe referencing Route, the Route MUST be considered successfully\nattached. If no Gateway listeners accept attachment from this Route, the\nRoute MUST be considered detached from the Gateway.\n\nSupport: Core", - maxLength: 253, - minLength: 1, - pattern: "^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$", - type: "string" - } - }, - required: ["name"], - type: "object" - }, - type: "array", - "x-kubernetes-list-type": "atomic" + message: { + description: "Message is a human readable description of the details of the last\ntransition, complementing reason.", + type: "string" + }, + reason: { + description: "Reason is a brief machine readable explanation for the condition's last\ntransition.", + type: "string" + }, + status: { + description: "Status of the condition, one of (`True`, `False`, `Unknown`).", + enum: ["True", "False", "Unknown"], + type: "string" + }, + type: { + description: "Type of the condition, known values are (`Ready`, `InvalidRequest`,\n`Approved`, `Denied`).", + type: "string" + } + }, + required: ["status", "type"], + type: "object" + }, + type: "array", + "x-kubernetes-list-map-keys": ["type"], + "x-kubernetes-list-type": "map" + }, + failureTime: { + description: "FailureTime stores the time that this CertificateRequest failed. This is\nused to influence garbage collection and back-off.", + format: "date-time", + type: "string" + } + }, + type: "object" + } + }, + type: "object" + } + }, + served: true, + storage: true, + subresources: { + status: {} + } + }] + } +}; +export const CustomResourceDefinition_CertificatesCertManagerIo: KubernetesResource = { + apiVersion: "apiextensions.k8s.io/v1", + kind: "CustomResourceDefinition", + metadata: { + annotations: { + "helm.sh/resource-policy": "keep" + }, + labels: { + app: "cert-manager", + "app.kubernetes.io/instance": "cert-manager", + "app.kubernetes.io/managed-by": "Helm", + "app.kubernetes.io/name": "cert-manager", + "app.kubernetes.io/version": "v1.17.0", + "helm.sh/chart": "cert-manager-v1.17.0" + }, + name: "certificates.cert-manager.io" + }, + spec: { + group: "cert-manager.io", + names: { + categories: ["cert-manager"], + kind: "Certificate", + listKind: "CertificateList", + plural: "certificates", + shortNames: ["cert", "certs"], + singular: "certificate" + }, + scope: "Namespaced", + versions: [{ + additionalPrinterColumns: [{ + jsonPath: ".status.conditions[?(@.type==\"Ready\")].status", + name: "Ready", + type: "string" + }, { + jsonPath: ".spec.secretName", + name: "Secret", + type: "string" + }, { + jsonPath: ".spec.issuerRef.name", + name: "Issuer", + priority: 1, + type: "string" + }, { + jsonPath: ".status.conditions[?(@.type==\"Ready\")].message", + name: "Status", + priority: 1, + type: "string" + }, { + description: "CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.", + jsonPath: ".metadata.creationTimestamp", + name: "Age", + type: "date" + }], + name: "v1", + schema: { + openAPIV3Schema: { + description: "A Certificate resource should be created to ensure an up to date and signed\nX.509 certificate is stored in the Kubernetes Secret resource named in `spec.secretName`.\n\nThe stored certificate will be renewed before it expires (as configured by `spec.renewBefore`).", + properties: { + apiVersion: { + description: "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", + type: "string" + }, + kind: { + description: "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + type: "string" + }, + metadata: { + type: "object" + }, + spec: { + description: "Specification of the desired state of the Certificate resource.\nhttps://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status", + properties: { + additionalOutputFormats: { + description: "Defines extra output formats of the private key and signed certificate chain\nto be written to this Certificate's target Secret.\n\nThis is a Beta Feature enabled by default. It can be disabled with the\n`--feature-gates=AdditionalCertificateOutputFormats=false` option set on both\nthe controller and webhook components.", + items: { + description: "CertificateAdditionalOutputFormat defines an additional output format of a\nCertificate resource. These contain supplementary data formats of the signed\ncertificate chain and paired private key.", + properties: { + type: { + description: "Type is the name of the format type that should be written to the\nCertificate's target Secret.", + enum: ["DER", "CombinedPEM"], + type: "string" + } + }, + required: ["type"], + type: "object" + }, + type: "array" + }, + commonName: { + description: "Requested common name X509 certificate subject attribute.\nMore info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.6\nNOTE: TLS clients will ignore this value when any subject alternative name is\nset (see https://tools.ietf.org/html/rfc6125#section-6.4.4).\n\nShould have a length of 64 characters or fewer to avoid generating invalid CSRs.\nCannot be set if the `literalSubject` field is set.", + type: "string" + }, + dnsNames: { + description: "Requested DNS subject alternative names.", + items: { + type: "string" + }, + type: "array" + }, + duration: { + description: "Requested 'duration' (i.e. lifetime) of the Certificate. Note that the\nissuer may choose to ignore the requested duration, just like any other\nrequested attribute.\n\nIf unset, this defaults to 90 days.\nMinimum accepted duration is 1 hour.\nValue must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration.", + type: "string" + }, + emailAddresses: { + description: "Requested email subject alternative names.", + items: { + type: "string" + }, + type: "array" + }, + encodeUsagesInRequest: { + description: "Whether the KeyUsage and ExtKeyUsage extensions should be set in the encoded CSR.\n\nThis option defaults to true, and should only be disabled if the target\nissuer does not support CSRs with these X509 KeyUsage/ ExtKeyUsage extensions.", + type: "boolean" + }, + ipAddresses: { + description: "Requested IP address subject alternative names.", + items: { + type: "string" + }, + type: "array" + }, + isCA: { + description: "Requested basic constraints isCA value.\nThe isCA value is used to set the `isCA` field on the created CertificateRequest\nresources. Note that the issuer may choose to ignore the requested isCA value, just\nlike any other requested attribute.\n\nIf true, this will automatically add the `cert sign` usage to the list\nof requested `usages`.", + type: "boolean" + }, + issuerRef: { + description: "Reference to the issuer responsible for issuing the certificate.\nIf the issuer is namespace-scoped, it must be in the same namespace\nas the Certificate. If the issuer is cluster-scoped, it can be used\nfrom any namespace.\n\nThe `name` field of the reference must always be specified.", + properties: { + group: { + description: "Group of the resource being referred to.", + type: "string" + }, + kind: { + description: "Kind of the resource being referred to.", + type: "string" + }, + name: { + description: "Name of the resource being referred to.", + type: "string" + } + }, + required: ["name"], + type: "object" + }, + keystores: { + description: "Additional keystore output formats to be stored in the Certificate's Secret.", + properties: { + jks: { + description: "JKS configures options for storing a JKS keystore in the\n`spec.secretName` Secret resource.", + properties: { + alias: { + description: "Alias specifies the alias of the key in the keystore, required by the JKS format.\nIf not provided, the default alias `certificate` will be used.", + type: "string" + }, + create: { + description: "Create enables JKS keystore creation for the Certificate.\nIf true, a file named `keystore.jks` will be created in the target\nSecret resource, encrypted using the password stored in\n`passwordSecretRef` or `password`.\nThe keystore file will be updated immediately.\nIf the issuer provided a CA certificate, a file named `truststore.jks`\nwill also be created in the target Secret resource, encrypted using the\npassword stored in `passwordSecretRef`\ncontaining the issuing Certificate Authority", + type: "boolean" + }, + password: { + description: "Password provides a literal password used to encrypt the JKS keystore.\nMutually exclusive with passwordSecretRef.\nOne of password or passwordSecretRef must provide a password with a non-zero length.", + type: "string" + }, + passwordSecretRef: { + description: "PasswordSecretRef is a reference to a non-empty key in a Secret resource\ncontaining the password used to encrypt the JKS keystore.\nMutually exclusive with password.\nOne of password or passwordSecretRef must provide a password with a non-zero length.", + properties: { + key: { + description: "The key of the entry in the Secret resource's `data` field to be used.\nSome instances of this field may be defaulted, in others it may be\nrequired.", + type: "string" }, - podTemplate: { - description: "Optional pod template used to configure the ACME challenge solver pods\nused for HTTP01 challenges.", - properties: { - metadata: { - description: "ObjectMeta overrides for the pod used to solve HTTP01 challenges.\nOnly the 'labels' and 'annotations' fields may be set.\nIf labels or annotations overlap with in-built values, the values here\nwill override the in-built values.", - properties: { - annotations: { - additionalProperties: { - type: "string" - }, - description: "Annotations that should be added to the created ACME HTTP01 solver pods.", - type: "object" - }, - labels: { - additionalProperties: { - type: "string" - }, - description: "Labels that should be added to the created ACME HTTP01 solver pods.", - type: "object" - } - }, - type: "object" - }, - spec: { - description: "PodSpec defines overrides for the HTTP01 challenge solver pod.\nCheck ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields.\nAll other fields will be ignored.", - properties: { - affinity: { - description: "If specified, the pod's scheduling constraints", - properties: { - nodeAffinity: { - description: "Describes node affinity scheduling rules for the pod.", - properties: { - preferredDuringSchedulingIgnoredDuringExecution: { - description: "The scheduler will prefer to schedule pods to nodes that satisfy\nthe affinity expressions specified by this field, but it may choose\na node that violates one or more of the expressions. The node that is\nmost preferred is the one with the greatest sum of weights, i.e.\nfor each node that meets all of the scheduling requirements (resource\nrequest, requiredDuringScheduling affinity expressions, etc.),\ncompute a sum by iterating through the elements of this field and adding\n\"weight\" to the sum if the node matches the corresponding matchExpressions; the\nnode(s) with the highest sum are the most preferred.", - items: { - description: "An empty preferred scheduling term matches all objects with implicit weight 0\n(i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).", - properties: { - preference: { - description: "A node selector term, associated with the corresponding weight.", - properties: { - matchExpressions: { - description: "A list of node selector requirements by node's labels.", - items: { - description: "A node selector requirement is a selector that contains values, a key, and an operator\nthat relates the key and values.", - properties: { - key: { - description: "The label key that the selector applies to.", - type: "string" - }, - operator: { - description: "Represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.", - type: "string" - }, - values: { - description: "An array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. If the operator is Gt or Lt, the values\narray must have a single element, which will be interpreted as an integer.\nThis array is replaced during a strategic merge patch.", - items: { - type: "string" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - } - }, - required: ["key", "operator"], - type: "object" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - }, - matchFields: { - description: "A list of node selector requirements by node's fields.", - items: { - description: "A node selector requirement is a selector that contains values, a key, and an operator\nthat relates the key and values.", - properties: { - key: { - description: "The label key that the selector applies to.", - type: "string" - }, - operator: { - description: "Represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.", - type: "string" - }, - values: { - description: "An array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. If the operator is Gt or Lt, the values\narray must have a single element, which will be interpreted as an integer.\nThis array is replaced during a strategic merge patch.", - items: { - type: "string" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - } - }, - required: ["key", "operator"], - type: "object" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - } - }, - type: "object", - "x-kubernetes-map-type": "atomic" - }, - weight: { - description: "Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100.", - format: "int32", - type: "integer" - } - }, - required: ["preference", "weight"], - type: "object" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - }, - requiredDuringSchedulingIgnoredDuringExecution: { - description: "If the affinity requirements specified by this field are not met at\nscheduling time, the pod will not be scheduled onto the node.\nIf the affinity requirements specified by this field cease to be met\nat some point during pod execution (e.g. due to an update), the system\nmay or may not try to eventually evict the pod from its node.", - properties: { - nodeSelectorTerms: { - description: "Required. A list of node selector terms. The terms are ORed.", - items: { - description: "A null or empty node selector term matches no objects. The requirements of\nthem are ANDed.\nThe TopologySelectorTerm type implements a subset of the NodeSelectorTerm.", - properties: { - matchExpressions: { - description: "A list of node selector requirements by node's labels.", - items: { - description: "A node selector requirement is a selector that contains values, a key, and an operator\nthat relates the key and values.", - properties: { - key: { - description: "The label key that the selector applies to.", - type: "string" - }, - operator: { - description: "Represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.", - type: "string" - }, - values: { - description: "An array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. If the operator is Gt or Lt, the values\narray must have a single element, which will be interpreted as an integer.\nThis array is replaced during a strategic merge patch.", - items: { - type: "string" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - } - }, - required: ["key", "operator"], - type: "object" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - }, - matchFields: { - description: "A list of node selector requirements by node's fields.", - items: { - description: "A node selector requirement is a selector that contains values, a key, and an operator\nthat relates the key and values.", - properties: { - key: { - description: "The label key that the selector applies to.", - type: "string" - }, - operator: { - description: "Represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.", - type: "string" - }, - values: { - description: "An array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. If the operator is Gt or Lt, the values\narray must have a single element, which will be interpreted as an integer.\nThis array is replaced during a strategic merge patch.", - items: { - type: "string" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - } - }, - required: ["key", "operator"], - type: "object" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - } - }, - type: "object", - "x-kubernetes-map-type": "atomic" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - } - }, - required: ["nodeSelectorTerms"], - type: "object", - "x-kubernetes-map-type": "atomic" - } - }, - type: "object" - }, - podAffinity: { - description: "Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).", - properties: { - preferredDuringSchedulingIgnoredDuringExecution: { - description: "The scheduler will prefer to schedule pods to nodes that satisfy\nthe affinity expressions specified by this field, but it may choose\na node that violates one or more of the expressions. The node that is\nmost preferred is the one with the greatest sum of weights, i.e.\nfor each node that meets all of the scheduling requirements (resource\nrequest, requiredDuringScheduling affinity expressions, etc.),\ncompute a sum by iterating through the elements of this field and adding\n\"weight\" to the sum if the node has pods which matches the corresponding podAffinityTerm; the\nnode(s) with the highest sum are the most preferred.", - items: { - description: "The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)", - properties: { - podAffinityTerm: { - description: "Required. A pod affinity term, associated with the corresponding weight.", - properties: { - labelSelector: { - description: "A label query over a set of resources, in this case pods.\nIf it's null, this PodAffinityTerm matches with no Pods.", - properties: { - matchExpressions: { - description: "matchExpressions is a list of label selector requirements. The requirements are ANDed.", - items: { - description: "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", - properties: { - key: { - description: "key is the label key that the selector applies to.", - type: "string" - }, - operator: { - description: "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", - type: "string" - }, - values: { - description: "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", - items: { - type: "string" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - } - }, - required: ["key", "operator"], - type: "object" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - }, - matchLabels: { - additionalProperties: { - type: "string" - }, - description: "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", - type: "object" - } - }, - type: "object", - "x-kubernetes-map-type": "atomic" - }, - matchLabelKeys: { - description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.", - items: { - type: "string" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - }, - mismatchLabelKeys: { - description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.", - items: { - type: "string" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - }, - namespaces: { - description: "namespaces specifies a static list of namespace names that the term applies to.\nThe term is applied to the union of the namespaces listed in this field\nand the ones selected by namespaceSelector.\nnull or empty namespaces list and null namespaceSelector means \"this pod's namespace\".", - items: { - type: "string" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - }, - namespaceSelector: { - description: "A label query over the set of namespaces that the term applies to.\nThe term is applied to the union of the namespaces selected by this field\nand the ones listed in the namespaces field.\nnull selector and null or empty namespaces list means \"this pod's namespace\".\nAn empty selector ({}) matches all namespaces.", - properties: { - matchExpressions: { - description: "matchExpressions is a list of label selector requirements. The requirements are ANDed.", - items: { - description: "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", - properties: { - key: { - description: "key is the label key that the selector applies to.", - type: "string" - }, - operator: { - description: "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", - type: "string" - }, - values: { - description: "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", - items: { - type: "string" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - } - }, - required: ["key", "operator"], - type: "object" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - }, - matchLabels: { - additionalProperties: { - type: "string" - }, - description: "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", - type: "object" - } - }, - type: "object", - "x-kubernetes-map-type": "atomic" - }, - topologyKey: { - description: "This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching\nthe labelSelector in the specified namespaces, where co-located is defined as running on a node\nwhose value of the label with key topologyKey matches that of any node on which any of the\nselected pods is running.\nEmpty topologyKey is not allowed.", - type: "string" - } - }, - required: ["topologyKey"], - type: "object" - }, - weight: { - description: "weight associated with matching the corresponding podAffinityTerm,\nin the range 1-100.", - format: "int32", - type: "integer" - } - }, - required: ["podAffinityTerm", "weight"], - type: "object" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - }, - requiredDuringSchedulingIgnoredDuringExecution: { - description: "If the affinity requirements specified by this field are not met at\nscheduling time, the pod will not be scheduled onto the node.\nIf the affinity requirements specified by this field cease to be met\nat some point during pod execution (e.g. due to a pod label update), the\nsystem may or may not try to eventually evict the pod from its node.\nWhen there are multiple elements, the lists of nodes corresponding to each\npodAffinityTerm are intersected, i.e. all terms must be satisfied.", - items: { - description: "Defines a set of pods (namely those matching the labelSelector\nrelative to the given namespace(s)) that this pod should be\nco-located (affinity) or not co-located (anti-affinity) with,\nwhere co-located is defined as running on a node whose value of\nthe label with key matches that of any node on which\na pod of the set of pods is running", - properties: { - labelSelector: { - description: "A label query over a set of resources, in this case pods.\nIf it's null, this PodAffinityTerm matches with no Pods.", - properties: { - matchExpressions: { - description: "matchExpressions is a list of label selector requirements. The requirements are ANDed.", - items: { - description: "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", - properties: { - key: { - description: "key is the label key that the selector applies to.", - type: "string" - }, - operator: { - description: "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", - type: "string" - }, - values: { - description: "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", - items: { - type: "string" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - } - }, - required: ["key", "operator"], - type: "object" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - }, - matchLabels: { - additionalProperties: { - type: "string" - }, - description: "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", - type: "object" - } - }, - type: "object", - "x-kubernetes-map-type": "atomic" - }, - matchLabelKeys: { - description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.", - items: { - type: "string" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - }, - mismatchLabelKeys: { - description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.", - items: { - type: "string" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - }, - namespaces: { - description: "namespaces specifies a static list of namespace names that the term applies to.\nThe term is applied to the union of the namespaces listed in this field\nand the ones selected by namespaceSelector.\nnull or empty namespaces list and null namespaceSelector means \"this pod's namespace\".", - items: { - type: "string" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - }, - namespaceSelector: { - description: "A label query over the set of namespaces that the term applies to.\nThe term is applied to the union of the namespaces selected by this field\nand the ones listed in the namespaces field.\nnull selector and null or empty namespaces list means \"this pod's namespace\".\nAn empty selector ({}) matches all namespaces.", - properties: { - matchExpressions: { - description: "matchExpressions is a list of label selector requirements. The requirements are ANDed.", - items: { - description: "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", - properties: { - key: { - description: "key is the label key that the selector applies to.", - type: "string" - }, - operator: { - description: "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", - type: "string" - }, - values: { - description: "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", - items: { - type: "string" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - } - }, - required: ["key", "operator"], - type: "object" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - }, - matchLabels: { - additionalProperties: { - type: "string" - }, - description: "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", - type: "object" - } - }, - type: "object", - "x-kubernetes-map-type": "atomic" - }, - topologyKey: { - description: "This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching\nthe labelSelector in the specified namespaces, where co-located is defined as running on a node\nwhose value of the label with key topologyKey matches that of any node on which any of the\nselected pods is running.\nEmpty topologyKey is not allowed.", - type: "string" - } - }, - required: ["topologyKey"], - type: "object" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - } - }, - type: "object" - }, - podAntiAffinity: { - description: "Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).", - properties: { - preferredDuringSchedulingIgnoredDuringExecution: { - description: "The scheduler will prefer to schedule pods to nodes that satisfy\nthe anti-affinity expressions specified by this field, but it may choose\na node that violates one or more of the expressions. The node that is\nmost preferred is the one with the greatest sum of weights, i.e.\nfor each node that meets all of the scheduling requirements (resource\nrequest, requiredDuringScheduling anti-affinity expressions, etc.),\ncompute a sum by iterating through the elements of this field and subtracting\n\"weight\" from the sum if the node has pods which matches the corresponding podAffinityTerm; the\nnode(s) with the highest sum are the most preferred.", - items: { - description: "The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)", - properties: { - podAffinityTerm: { - description: "Required. A pod affinity term, associated with the corresponding weight.", - properties: { - labelSelector: { - description: "A label query over a set of resources, in this case pods.\nIf it's null, this PodAffinityTerm matches with no Pods.", - properties: { - matchExpressions: { - description: "matchExpressions is a list of label selector requirements. The requirements are ANDed.", - items: { - description: "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", - properties: { - key: { - description: "key is the label key that the selector applies to.", - type: "string" - }, - operator: { - description: "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", - type: "string" - }, - values: { - description: "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", - items: { - type: "string" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - } - }, - required: ["key", "operator"], - type: "object" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - }, - matchLabels: { - additionalProperties: { - type: "string" - }, - description: "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", - type: "object" - } - }, - type: "object", - "x-kubernetes-map-type": "atomic" - }, - matchLabelKeys: { - description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.", - items: { - type: "string" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - }, - mismatchLabelKeys: { - description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.", - items: { - type: "string" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - }, - namespaces: { - description: "namespaces specifies a static list of namespace names that the term applies to.\nThe term is applied to the union of the namespaces listed in this field\nand the ones selected by namespaceSelector.\nnull or empty namespaces list and null namespaceSelector means \"this pod's namespace\".", - items: { - type: "string" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - }, - namespaceSelector: { - description: "A label query over the set of namespaces that the term applies to.\nThe term is applied to the union of the namespaces selected by this field\nand the ones listed in the namespaces field.\nnull selector and null or empty namespaces list means \"this pod's namespace\".\nAn empty selector ({}) matches all namespaces.", - properties: { - matchExpressions: { - description: "matchExpressions is a list of label selector requirements. The requirements are ANDed.", - items: { - description: "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", - properties: { - key: { - description: "key is the label key that the selector applies to.", - type: "string" - }, - operator: { - description: "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", - type: "string" - }, - values: { - description: "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", - items: { - type: "string" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - } - }, - required: ["key", "operator"], - type: "object" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - }, - matchLabels: { - additionalProperties: { - type: "string" - }, - description: "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", - type: "object" - } - }, - type: "object", - "x-kubernetes-map-type": "atomic" - }, - topologyKey: { - description: "This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching\nthe labelSelector in the specified namespaces, where co-located is defined as running on a node\nwhose value of the label with key topologyKey matches that of any node on which any of the\nselected pods is running.\nEmpty topologyKey is not allowed.", - type: "string" - } - }, - required: ["topologyKey"], - type: "object" - }, - weight: { - description: "weight associated with matching the corresponding podAffinityTerm,\nin the range 1-100.", - format: "int32", - type: "integer" - } - }, - required: ["podAffinityTerm", "weight"], - type: "object" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - }, - requiredDuringSchedulingIgnoredDuringExecution: { - description: "If the anti-affinity requirements specified by this field are not met at\nscheduling time, the pod will not be scheduled onto the node.\nIf the anti-affinity requirements specified by this field cease to be met\nat some point during pod execution (e.g. due to a pod label update), the\nsystem may or may not try to eventually evict the pod from its node.\nWhen there are multiple elements, the lists of nodes corresponding to each\npodAffinityTerm are intersected, i.e. all terms must be satisfied.", - items: { - description: "Defines a set of pods (namely those matching the labelSelector\nrelative to the given namespace(s)) that this pod should be\nco-located (affinity) or not co-located (anti-affinity) with,\nwhere co-located is defined as running on a node whose value of\nthe label with key matches that of any node on which\na pod of the set of pods is running", - properties: { - labelSelector: { - description: "A label query over a set of resources, in this case pods.\nIf it's null, this PodAffinityTerm matches with no Pods.", - properties: { - matchExpressions: { - description: "matchExpressions is a list of label selector requirements. The requirements are ANDed.", - items: { - description: "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", - properties: { - key: { - description: "key is the label key that the selector applies to.", - type: "string" - }, - operator: { - description: "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", - type: "string" - }, - values: { - description: "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", - items: { - type: "string" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - } - }, - required: ["key", "operator"], - type: "object" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - }, - matchLabels: { - additionalProperties: { - type: "string" - }, - description: "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", - type: "object" - } - }, - type: "object", - "x-kubernetes-map-type": "atomic" - }, - matchLabelKeys: { - description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.", - items: { - type: "string" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - }, - mismatchLabelKeys: { - description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.", - items: { - type: "string" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - }, - namespaces: { - description: "namespaces specifies a static list of namespace names that the term applies to.\nThe term is applied to the union of the namespaces listed in this field\nand the ones selected by namespaceSelector.\nnull or empty namespaces list and null namespaceSelector means \"this pod's namespace\".", - items: { - type: "string" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - }, - namespaceSelector: { - description: "A label query over the set of namespaces that the term applies to.\nThe term is applied to the union of the namespaces selected by this field\nand the ones listed in the namespaces field.\nnull selector and null or empty namespaces list means \"this pod's namespace\".\nAn empty selector ({}) matches all namespaces.", - properties: { - matchExpressions: { - description: "matchExpressions is a list of label selector requirements. The requirements are ANDed.", - items: { - description: "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", - properties: { - key: { - description: "key is the label key that the selector applies to.", - type: "string" - }, - operator: { - description: "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", - type: "string" - }, - values: { - description: "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", - items: { - type: "string" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - } - }, - required: ["key", "operator"], - type: "object" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - }, - matchLabels: { - additionalProperties: { - type: "string" - }, - description: "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", - type: "object" - } - }, - type: "object", - "x-kubernetes-map-type": "atomic" - }, - topologyKey: { - description: "This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching\nthe labelSelector in the specified namespaces, where co-located is defined as running on a node\nwhose value of the label with key topologyKey matches that of any node on which any of the\nselected pods is running.\nEmpty topologyKey is not allowed.", - type: "string" - } - }, - required: ["topologyKey"], - type: "object" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - } - }, - type: "object" - } - }, - type: "object" - }, - imagePullSecrets: { - description: "If specified, the pod's imagePullSecrets", - items: { - description: "LocalObjectReference contains enough information to let you locate the\nreferenced object inside the same namespace.", - properties: { - name: { - default: "", - description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - type: "string" - } - }, - type: "object", - "x-kubernetes-map-type": "atomic" - }, - type: "array", - "x-kubernetes-list-map-keys": ["name"], - "x-kubernetes-list-type": "map" - }, - nodeSelector: { - additionalProperties: { - type: "string" - }, - description: "NodeSelector is a selector which must be true for the pod to fit on a node.\nSelector which must match a node's labels for the pod to be scheduled on that node.\nMore info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/", - type: "object" - }, - priorityClassName: { - description: "If specified, the pod's priorityClassName.", - type: "string" - }, - resources: { - description: "If specified, the pod's resource requirements.\nThese values override the global resource configuration flags.\nNote that when only specifying resource limits, ensure they are greater than or equal\nto the corresponding global resource requests configured via controller flags\n(--acme-http01-solver-resource-request-cpu, --acme-http01-solver-resource-request-memory).\nKubernetes will reject pod creation if limits are lower than requests, causing challenge failures.", - properties: { - limits: { - additionalProperties: { - anyOf: [{ - type: "integer" - }, { - type: "string" - }], - pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "x-kubernetes-int-or-string": true - }, - description: "Limits describes the maximum amount of compute resources allowed.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", - type: "object" - }, - requests: { - additionalProperties: { - anyOf: [{ - type: "integer" - }, { - type: "string" - }], - pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "x-kubernetes-int-or-string": true - }, - description: "Requests describes the minimum amount of compute resources required.\nIf Requests is omitted for a container, it defaults to Limits if that is explicitly specified,\notherwise to the global values configured via controller flags. Requests cannot exceed Limits.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", - type: "object" - } - }, - type: "object" - }, - securityContext: { - description: "If specified, the pod's security context", - properties: { - fsGroup: { - description: "A special supplemental group that applies to all containers in a pod.\nSome volume types allow the Kubelet to change the ownership of that volume\nto be owned by the pod:\n\n1. The owning GID will be the FSGroup\n2. The setgid bit is set (new files created in the volume will be owned by FSGroup)\n3. The permission bits are OR'd with rw-rw----\n\nIf unset, the Kubelet will not modify the ownership and permissions of any volume.\nNote that this field cannot be set when spec.os.name is windows.", - format: "int64", - type: "integer" - }, - fsGroupChangePolicy: { - description: "fsGroupChangePolicy defines behavior of changing ownership and permission of the volume\nbefore being exposed inside Pod. This field will only apply to\nvolume types which support fsGroup based ownership(and permissions).\nIt will have no effect on ephemeral volume types such as: secret, configmaps\nand emptydir.\nValid values are \"OnRootMismatch\" and \"Always\". If not specified, \"Always\" is used.\nNote that this field cannot be set when spec.os.name is windows.", - type: "string" - }, - runAsGroup: { - description: "The GID to run the entrypoint of the container process.\nUses runtime default if unset.\nMay also be set in SecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence\nfor that container.\nNote that this field cannot be set when spec.os.name is windows.", - format: "int64", - type: "integer" - }, - runAsNonRoot: { - description: "Indicates that the container must run as a non-root user.\nIf true, the Kubelet will validate the image at runtime to ensure that it\ndoes not run as UID 0 (root) and fail to start the container if it does.\nIf unset or false, no such validation will be performed.\nMay also be set in SecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.", - type: "boolean" - }, - runAsUser: { - description: "The UID to run the entrypoint of the container process.\nDefaults to user specified in image metadata if unspecified.\nMay also be set in SecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence\nfor that container.\nNote that this field cannot be set when spec.os.name is windows.", - format: "int64", - type: "integer" - }, - seccompProfile: { - description: "The seccomp options to use by the containers in this pod.\nNote that this field cannot be set when spec.os.name is windows.", - properties: { - localhostProfile: { - description: "localhostProfile indicates a profile defined in a file on the node should be used.\nThe profile must be preconfigured on the node to work.\nMust be a descending path, relative to the kubelet's configured seccomp profile location.\nMust be set if type is \"Localhost\". Must NOT be set for any other type.", - type: "string" - }, - type: { - description: "type indicates which kind of seccomp profile will be applied.\nValid options are:\n\nLocalhost - a profile defined in a file on the node should be used.\nRuntimeDefault - the container runtime default profile should be used.\nUnconfined - no profile should be applied.", - type: "string" - } - }, - required: ["type"], - type: "object" - }, - seLinuxOptions: { - description: "The SELinux context to be applied to all containers.\nIf unspecified, the container runtime will allocate a random SELinux context for each\ncontainer. May also be set in SecurityContext. If set in\nboth SecurityContext and PodSecurityContext, the value specified in SecurityContext\ntakes precedence for that container.\nNote that this field cannot be set when spec.os.name is windows.", - properties: { - level: { - description: "Level is SELinux level label that applies to the container.", - type: "string" - }, - role: { - description: "Role is a SELinux role label that applies to the container.", - type: "string" - }, - type: { - description: "Type is a SELinux type label that applies to the container.", - type: "string" - }, - user: { - description: "User is a SELinux user label that applies to the container.", - type: "string" - } - }, - type: "object" - }, - supplementalGroups: { - description: "A list of groups applied to the first process run in each container, in addition\nto the container's primary GID, the fsGroup (if specified), and group memberships\ndefined in the container image for the uid of the container process. If unspecified,\nno additional groups are added to any container. Note that group memberships\ndefined in the container image for the uid of the container process are still effective,\neven if they are not included in this list.\nNote that this field cannot be set when spec.os.name is windows.", - items: { - format: "int64", - type: "integer" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - }, - sysctls: { - description: "Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported\nsysctls (by the container runtime) might fail to launch.\nNote that this field cannot be set when spec.os.name is windows.", - items: { - description: "Sysctl defines a kernel parameter to be set", - properties: { - name: { - description: "Name of a property to set", - type: "string" - }, - value: { - description: "Value of a property to set", - type: "string" - } - }, - required: ["name", "value"], - type: "object" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - } - }, - type: "object" - }, - serviceAccountName: { - description: "If specified, the pod's service account", - type: "string" - }, - tolerations: { - description: "If specified, the pod's tolerations.", - items: { - description: "The pod this Toleration is attached to tolerates any taint that matches\nthe triple using the matching operator .", - properties: { - effect: { - description: "Effect indicates the taint effect to match. Empty means match all taint effects.\nWhen specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.", - type: "string" - }, - key: { - description: "Key is the taint key that the toleration applies to. Empty means match all taint keys.\nIf the key is empty, operator must be Exists; this combination means to match all values and all keys.", - type: "string" - }, - operator: { - description: "Operator represents a key's relationship to the value.\nValid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.\nExists is equivalent to wildcard for value, so that a pod can\ntolerate all taints of a particular category.\nLt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).", - type: "string" - }, - tolerationSeconds: { - description: "TolerationSeconds represents the period of time the toleration (which must be\nof effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,\nit is not set, which means tolerate the taint forever (do not evict). Zero and\nnegative values will be treated as 0 (evict immediately) by the system.", - format: "int64", - type: "integer" - }, - value: { - description: "Value is the taint value the toleration matches to.\nIf the operator is Exists, the value should be empty, otherwise just a regular string.", - type: "string" - } - }, - type: "object" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - } - }, - type: "object" - } - }, - type: "object" - }, - serviceType: { - description: "Optional service type for Kubernetes solver service. Supported values\nare NodePort or ClusterIP. If unset, defaults to NodePort.", - type: "string" - } - }, - type: "object" - }, - ingress: { - description: "The ingress based HTTP01 challenge solver will solve challenges by\ncreating or modifying Ingress resources in order to route requests for\n'/.well-known/acme-challenge/XYZ' to 'challenge solver' pods that are\nprovisioned by cert-manager for each Challenge to be completed.", - properties: { - class: { - description: "This field configures the annotation `kubernetes.io/ingress.class` when\ncreating Ingress resources to solve ACME challenges that use this\nchallenge solver. Only one of `class`, `name` or `ingressClassName` may\nbe specified.", - type: "string" - }, - ingressClassName: { - description: "This field configures the field `ingressClassName` on the created Ingress\nresources used to solve ACME challenges that use this challenge solver.\nThis is the recommended way of configuring the ingress class. Only one of\n`class`, `name` or `ingressClassName` may be specified.", - type: "string" - }, - ingressTemplate: { - description: "Optional ingress template used to configure the ACME challenge solver\ningress used for HTTP01 challenges.", - properties: { - metadata: { - description: "ObjectMeta overrides for the ingress used to solve HTTP01 challenges.\nOnly the 'labels' and 'annotations' fields may be set.\nIf labels or annotations overlap with in-built values, the values here\nwill override the in-built values.", - properties: { - annotations: { - additionalProperties: { - type: "string" - }, - description: "Annotations that should be added to the created ACME HTTP01 solver ingress.", - type: "object" - }, - labels: { - additionalProperties: { - type: "string" - }, - description: "Labels that should be added to the created ACME HTTP01 solver ingress.", - type: "object" - } - }, - type: "object" - } - }, - type: "object" - }, - name: { - description: "The name of the ingress resource that should have ACME challenge solving\nroutes inserted into it in order to solve HTTP01 challenges.\nThis is typically used in conjunction with ingress controllers like\ningress-gce, which maintains a 1:1 mapping between external IPs and\ningress resources. Only one of `class`, `name` or `ingressClassName` may\nbe specified.", - type: "string" - }, - podTemplate: { - description: "Optional pod template used to configure the ACME challenge solver pods\nused for HTTP01 challenges.", - properties: { - metadata: { - description: "ObjectMeta overrides for the pod used to solve HTTP01 challenges.\nOnly the 'labels' and 'annotations' fields may be set.\nIf labels or annotations overlap with in-built values, the values here\nwill override the in-built values.", - properties: { - annotations: { - additionalProperties: { - type: "string" - }, - description: "Annotations that should be added to the created ACME HTTP01 solver pods.", - type: "object" - }, - labels: { - additionalProperties: { - type: "string" - }, - description: "Labels that should be added to the created ACME HTTP01 solver pods.", - type: "object" - } - }, - type: "object" - }, - spec: { - description: "PodSpec defines overrides for the HTTP01 challenge solver pod.\nCheck ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields.\nAll other fields will be ignored.", - properties: { - affinity: { - description: "If specified, the pod's scheduling constraints", - properties: { - nodeAffinity: { - description: "Describes node affinity scheduling rules for the pod.", - properties: { - preferredDuringSchedulingIgnoredDuringExecution: { - description: "The scheduler will prefer to schedule pods to nodes that satisfy\nthe affinity expressions specified by this field, but it may choose\na node that violates one or more of the expressions. The node that is\nmost preferred is the one with the greatest sum of weights, i.e.\nfor each node that meets all of the scheduling requirements (resource\nrequest, requiredDuringScheduling affinity expressions, etc.),\ncompute a sum by iterating through the elements of this field and adding\n\"weight\" to the sum if the node matches the corresponding matchExpressions; the\nnode(s) with the highest sum are the most preferred.", - items: { - description: "An empty preferred scheduling term matches all objects with implicit weight 0\n(i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).", - properties: { - preference: { - description: "A node selector term, associated with the corresponding weight.", - properties: { - matchExpressions: { - description: "A list of node selector requirements by node's labels.", - items: { - description: "A node selector requirement is a selector that contains values, a key, and an operator\nthat relates the key and values.", - properties: { - key: { - description: "The label key that the selector applies to.", - type: "string" - }, - operator: { - description: "Represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.", - type: "string" - }, - values: { - description: "An array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. If the operator is Gt or Lt, the values\narray must have a single element, which will be interpreted as an integer.\nThis array is replaced during a strategic merge patch.", - items: { - type: "string" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - } - }, - required: ["key", "operator"], - type: "object" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - }, - matchFields: { - description: "A list of node selector requirements by node's fields.", - items: { - description: "A node selector requirement is a selector that contains values, a key, and an operator\nthat relates the key and values.", - properties: { - key: { - description: "The label key that the selector applies to.", - type: "string" - }, - operator: { - description: "Represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.", - type: "string" - }, - values: { - description: "An array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. If the operator is Gt or Lt, the values\narray must have a single element, which will be interpreted as an integer.\nThis array is replaced during a strategic merge patch.", - items: { - type: "string" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - } - }, - required: ["key", "operator"], - type: "object" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - } - }, - type: "object", - "x-kubernetes-map-type": "atomic" - }, - weight: { - description: "Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100.", - format: "int32", - type: "integer" - } - }, - required: ["preference", "weight"], - type: "object" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - }, - requiredDuringSchedulingIgnoredDuringExecution: { - description: "If the affinity requirements specified by this field are not met at\nscheduling time, the pod will not be scheduled onto the node.\nIf the affinity requirements specified by this field cease to be met\nat some point during pod execution (e.g. due to an update), the system\nmay or may not try to eventually evict the pod from its node.", - properties: { - nodeSelectorTerms: { - description: "Required. A list of node selector terms. The terms are ORed.", - items: { - description: "A null or empty node selector term matches no objects. The requirements of\nthem are ANDed.\nThe TopologySelectorTerm type implements a subset of the NodeSelectorTerm.", - properties: { - matchExpressions: { - description: "A list of node selector requirements by node's labels.", - items: { - description: "A node selector requirement is a selector that contains values, a key, and an operator\nthat relates the key and values.", - properties: { - key: { - description: "The label key that the selector applies to.", - type: "string" - }, - operator: { - description: "Represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.", - type: "string" - }, - values: { - description: "An array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. If the operator is Gt or Lt, the values\narray must have a single element, which will be interpreted as an integer.\nThis array is replaced during a strategic merge patch.", - items: { - type: "string" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - } - }, - required: ["key", "operator"], - type: "object" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - }, - matchFields: { - description: "A list of node selector requirements by node's fields.", - items: { - description: "A node selector requirement is a selector that contains values, a key, and an operator\nthat relates the key and values.", - properties: { - key: { - description: "The label key that the selector applies to.", - type: "string" - }, - operator: { - description: "Represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.", - type: "string" - }, - values: { - description: "An array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. If the operator is Gt or Lt, the values\narray must have a single element, which will be interpreted as an integer.\nThis array is replaced during a strategic merge patch.", - items: { - type: "string" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - } - }, - required: ["key", "operator"], - type: "object" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - } - }, - type: "object", - "x-kubernetes-map-type": "atomic" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - } - }, - required: ["nodeSelectorTerms"], - type: "object", - "x-kubernetes-map-type": "atomic" - } - }, - type: "object" - }, - podAffinity: { - description: "Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).", - properties: { - preferredDuringSchedulingIgnoredDuringExecution: { - description: "The scheduler will prefer to schedule pods to nodes that satisfy\nthe affinity expressions specified by this field, but it may choose\na node that violates one or more of the expressions. The node that is\nmost preferred is the one with the greatest sum of weights, i.e.\nfor each node that meets all of the scheduling requirements (resource\nrequest, requiredDuringScheduling affinity expressions, etc.),\ncompute a sum by iterating through the elements of this field and adding\n\"weight\" to the sum if the node has pods which matches the corresponding podAffinityTerm; the\nnode(s) with the highest sum are the most preferred.", - items: { - description: "The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)", - properties: { - podAffinityTerm: { - description: "Required. A pod affinity term, associated with the corresponding weight.", - properties: { - labelSelector: { - description: "A label query over a set of resources, in this case pods.\nIf it's null, this PodAffinityTerm matches with no Pods.", - properties: { - matchExpressions: { - description: "matchExpressions is a list of label selector requirements. The requirements are ANDed.", - items: { - description: "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", - properties: { - key: { - description: "key is the label key that the selector applies to.", - type: "string" - }, - operator: { - description: "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", - type: "string" - }, - values: { - description: "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", - items: { - type: "string" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - } - }, - required: ["key", "operator"], - type: "object" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - }, - matchLabels: { - additionalProperties: { - type: "string" - }, - description: "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", - type: "object" - } - }, - type: "object", - "x-kubernetes-map-type": "atomic" - }, - matchLabelKeys: { - description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.", - items: { - type: "string" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - }, - mismatchLabelKeys: { - description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.", - items: { - type: "string" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - }, - namespaces: { - description: "namespaces specifies a static list of namespace names that the term applies to.\nThe term is applied to the union of the namespaces listed in this field\nand the ones selected by namespaceSelector.\nnull or empty namespaces list and null namespaceSelector means \"this pod's namespace\".", - items: { - type: "string" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - }, - namespaceSelector: { - description: "A label query over the set of namespaces that the term applies to.\nThe term is applied to the union of the namespaces selected by this field\nand the ones listed in the namespaces field.\nnull selector and null or empty namespaces list means \"this pod's namespace\".\nAn empty selector ({}) matches all namespaces.", - properties: { - matchExpressions: { - description: "matchExpressions is a list of label selector requirements. The requirements are ANDed.", - items: { - description: "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", - properties: { - key: { - description: "key is the label key that the selector applies to.", - type: "string" - }, - operator: { - description: "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", - type: "string" - }, - values: { - description: "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", - items: { - type: "string" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - } - }, - required: ["key", "operator"], - type: "object" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - }, - matchLabels: { - additionalProperties: { - type: "string" - }, - description: "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", - type: "object" - } - }, - type: "object", - "x-kubernetes-map-type": "atomic" - }, - topologyKey: { - description: "This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching\nthe labelSelector in the specified namespaces, where co-located is defined as running on a node\nwhose value of the label with key topologyKey matches that of any node on which any of the\nselected pods is running.\nEmpty topologyKey is not allowed.", - type: "string" - } - }, - required: ["topologyKey"], - type: "object" - }, - weight: { - description: "weight associated with matching the corresponding podAffinityTerm,\nin the range 1-100.", - format: "int32", - type: "integer" - } - }, - required: ["podAffinityTerm", "weight"], - type: "object" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - }, - requiredDuringSchedulingIgnoredDuringExecution: { - description: "If the affinity requirements specified by this field are not met at\nscheduling time, the pod will not be scheduled onto the node.\nIf the affinity requirements specified by this field cease to be met\nat some point during pod execution (e.g. due to a pod label update), the\nsystem may or may not try to eventually evict the pod from its node.\nWhen there are multiple elements, the lists of nodes corresponding to each\npodAffinityTerm are intersected, i.e. all terms must be satisfied.", - items: { - description: "Defines a set of pods (namely those matching the labelSelector\nrelative to the given namespace(s)) that this pod should be\nco-located (affinity) or not co-located (anti-affinity) with,\nwhere co-located is defined as running on a node whose value of\nthe label with key matches that of any node on which\na pod of the set of pods is running", - properties: { - labelSelector: { - description: "A label query over a set of resources, in this case pods.\nIf it's null, this PodAffinityTerm matches with no Pods.", - properties: { - matchExpressions: { - description: "matchExpressions is a list of label selector requirements. The requirements are ANDed.", - items: { - description: "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", - properties: { - key: { - description: "key is the label key that the selector applies to.", - type: "string" - }, - operator: { - description: "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", - type: "string" - }, - values: { - description: "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", - items: { - type: "string" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - } - }, - required: ["key", "operator"], - type: "object" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - }, - matchLabels: { - additionalProperties: { - type: "string" - }, - description: "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", - type: "object" - } - }, - type: "object", - "x-kubernetes-map-type": "atomic" - }, - matchLabelKeys: { - description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.", - items: { - type: "string" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - }, - mismatchLabelKeys: { - description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.", - items: { - type: "string" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - }, - namespaces: { - description: "namespaces specifies a static list of namespace names that the term applies to.\nThe term is applied to the union of the namespaces listed in this field\nand the ones selected by namespaceSelector.\nnull or empty namespaces list and null namespaceSelector means \"this pod's namespace\".", - items: { - type: "string" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - }, - namespaceSelector: { - description: "A label query over the set of namespaces that the term applies to.\nThe term is applied to the union of the namespaces selected by this field\nand the ones listed in the namespaces field.\nnull selector and null or empty namespaces list means \"this pod's namespace\".\nAn empty selector ({}) matches all namespaces.", - properties: { - matchExpressions: { - description: "matchExpressions is a list of label selector requirements. The requirements are ANDed.", - items: { - description: "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", - properties: { - key: { - description: "key is the label key that the selector applies to.", - type: "string" - }, - operator: { - description: "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", - type: "string" - }, - values: { - description: "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", - items: { - type: "string" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - } - }, - required: ["key", "operator"], - type: "object" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - }, - matchLabels: { - additionalProperties: { - type: "string" - }, - description: "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", - type: "object" - } - }, - type: "object", - "x-kubernetes-map-type": "atomic" - }, - topologyKey: { - description: "This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching\nthe labelSelector in the specified namespaces, where co-located is defined as running on a node\nwhose value of the label with key topologyKey matches that of any node on which any of the\nselected pods is running.\nEmpty topologyKey is not allowed.", - type: "string" - } - }, - required: ["topologyKey"], - type: "object" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - } - }, - type: "object" - }, - podAntiAffinity: { - description: "Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).", - properties: { - preferredDuringSchedulingIgnoredDuringExecution: { - description: "The scheduler will prefer to schedule pods to nodes that satisfy\nthe anti-affinity expressions specified by this field, but it may choose\na node that violates one or more of the expressions. The node that is\nmost preferred is the one with the greatest sum of weights, i.e.\nfor each node that meets all of the scheduling requirements (resource\nrequest, requiredDuringScheduling anti-affinity expressions, etc.),\ncompute a sum by iterating through the elements of this field and subtracting\n\"weight\" from the sum if the node has pods which matches the corresponding podAffinityTerm; the\nnode(s) with the highest sum are the most preferred.", - items: { - description: "The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)", - properties: { - podAffinityTerm: { - description: "Required. A pod affinity term, associated with the corresponding weight.", - properties: { - labelSelector: { - description: "A label query over a set of resources, in this case pods.\nIf it's null, this PodAffinityTerm matches with no Pods.", - properties: { - matchExpressions: { - description: "matchExpressions is a list of label selector requirements. The requirements are ANDed.", - items: { - description: "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", - properties: { - key: { - description: "key is the label key that the selector applies to.", - type: "string" - }, - operator: { - description: "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", - type: "string" - }, - values: { - description: "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", - items: { - type: "string" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - } - }, - required: ["key", "operator"], - type: "object" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - }, - matchLabels: { - additionalProperties: { - type: "string" - }, - description: "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", - type: "object" - } - }, - type: "object", - "x-kubernetes-map-type": "atomic" - }, - matchLabelKeys: { - description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.", - items: { - type: "string" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - }, - mismatchLabelKeys: { - description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.", - items: { - type: "string" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - }, - namespaces: { - description: "namespaces specifies a static list of namespace names that the term applies to.\nThe term is applied to the union of the namespaces listed in this field\nand the ones selected by namespaceSelector.\nnull or empty namespaces list and null namespaceSelector means \"this pod's namespace\".", - items: { - type: "string" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - }, - namespaceSelector: { - description: "A label query over the set of namespaces that the term applies to.\nThe term is applied to the union of the namespaces selected by this field\nand the ones listed in the namespaces field.\nnull selector and null or empty namespaces list means \"this pod's namespace\".\nAn empty selector ({}) matches all namespaces.", - properties: { - matchExpressions: { - description: "matchExpressions is a list of label selector requirements. The requirements are ANDed.", - items: { - description: "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", - properties: { - key: { - description: "key is the label key that the selector applies to.", - type: "string" - }, - operator: { - description: "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", - type: "string" - }, - values: { - description: "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", - items: { - type: "string" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - } - }, - required: ["key", "operator"], - type: "object" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - }, - matchLabels: { - additionalProperties: { - type: "string" - }, - description: "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", - type: "object" - } - }, - type: "object", - "x-kubernetes-map-type": "atomic" - }, - topologyKey: { - description: "This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching\nthe labelSelector in the specified namespaces, where co-located is defined as running on a node\nwhose value of the label with key topologyKey matches that of any node on which any of the\nselected pods is running.\nEmpty topologyKey is not allowed.", - type: "string" - } - }, - required: ["topologyKey"], - type: "object" - }, - weight: { - description: "weight associated with matching the corresponding podAffinityTerm,\nin the range 1-100.", - format: "int32", - type: "integer" - } - }, - required: ["podAffinityTerm", "weight"], - type: "object" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - }, - requiredDuringSchedulingIgnoredDuringExecution: { - description: "If the anti-affinity requirements specified by this field are not met at\nscheduling time, the pod will not be scheduled onto the node.\nIf the anti-affinity requirements specified by this field cease to be met\nat some point during pod execution (e.g. due to a pod label update), the\nsystem may or may not try to eventually evict the pod from its node.\nWhen there are multiple elements, the lists of nodes corresponding to each\npodAffinityTerm are intersected, i.e. all terms must be satisfied.", - items: { - description: "Defines a set of pods (namely those matching the labelSelector\nrelative to the given namespace(s)) that this pod should be\nco-located (affinity) or not co-located (anti-affinity) with,\nwhere co-located is defined as running on a node whose value of\nthe label with key matches that of any node on which\na pod of the set of pods is running", - properties: { - labelSelector: { - description: "A label query over a set of resources, in this case pods.\nIf it's null, this PodAffinityTerm matches with no Pods.", - properties: { - matchExpressions: { - description: "matchExpressions is a list of label selector requirements. The requirements are ANDed.", - items: { - description: "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", - properties: { - key: { - description: "key is the label key that the selector applies to.", - type: "string" - }, - operator: { - description: "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", - type: "string" - }, - values: { - description: "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", - items: { - type: "string" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - } - }, - required: ["key", "operator"], - type: "object" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - }, - matchLabels: { - additionalProperties: { - type: "string" - }, - description: "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", - type: "object" - } - }, - type: "object", - "x-kubernetes-map-type": "atomic" - }, - matchLabelKeys: { - description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.", - items: { - type: "string" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - }, - mismatchLabelKeys: { - description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.", - items: { - type: "string" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - }, - namespaces: { - description: "namespaces specifies a static list of namespace names that the term applies to.\nThe term is applied to the union of the namespaces listed in this field\nand the ones selected by namespaceSelector.\nnull or empty namespaces list and null namespaceSelector means \"this pod's namespace\".", - items: { - type: "string" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - }, - namespaceSelector: { - description: "A label query over the set of namespaces that the term applies to.\nThe term is applied to the union of the namespaces selected by this field\nand the ones listed in the namespaces field.\nnull selector and null or empty namespaces list means \"this pod's namespace\".\nAn empty selector ({}) matches all namespaces.", - properties: { - matchExpressions: { - description: "matchExpressions is a list of label selector requirements. The requirements are ANDed.", - items: { - description: "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", - properties: { - key: { - description: "key is the label key that the selector applies to.", - type: "string" - }, - operator: { - description: "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", - type: "string" - }, - values: { - description: "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", - items: { - type: "string" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - } - }, - required: ["key", "operator"], - type: "object" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - }, - matchLabels: { - additionalProperties: { - type: "string" - }, - description: "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", - type: "object" - } - }, - type: "object", - "x-kubernetes-map-type": "atomic" - }, - topologyKey: { - description: "This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching\nthe labelSelector in the specified namespaces, where co-located is defined as running on a node\nwhose value of the label with key topologyKey matches that of any node on which any of the\nselected pods is running.\nEmpty topologyKey is not allowed.", - type: "string" - } - }, - required: ["topologyKey"], - type: "object" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - } - }, - type: "object" - } - }, - type: "object" - }, - imagePullSecrets: { - description: "If specified, the pod's imagePullSecrets", - items: { - description: "LocalObjectReference contains enough information to let you locate the\nreferenced object inside the same namespace.", - properties: { - name: { - default: "", - description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - type: "string" - } - }, - type: "object", - "x-kubernetes-map-type": "atomic" - }, - type: "array", - "x-kubernetes-list-map-keys": ["name"], - "x-kubernetes-list-type": "map" - }, - nodeSelector: { - additionalProperties: { - type: "string" - }, - description: "NodeSelector is a selector which must be true for the pod to fit on a node.\nSelector which must match a node's labels for the pod to be scheduled on that node.\nMore info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/", - type: "object" - }, - priorityClassName: { - description: "If specified, the pod's priorityClassName.", - type: "string" - }, - resources: { - description: "If specified, the pod's resource requirements.\nThese values override the global resource configuration flags.\nNote that when only specifying resource limits, ensure they are greater than or equal\nto the corresponding global resource requests configured via controller flags\n(--acme-http01-solver-resource-request-cpu, --acme-http01-solver-resource-request-memory).\nKubernetes will reject pod creation if limits are lower than requests, causing challenge failures.", - properties: { - limits: { - additionalProperties: { - anyOf: [{ - type: "integer" - }, { - type: "string" - }], - pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "x-kubernetes-int-or-string": true - }, - description: "Limits describes the maximum amount of compute resources allowed.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", - type: "object" - }, - requests: { - additionalProperties: { - anyOf: [{ - type: "integer" - }, { - type: "string" - }], - pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "x-kubernetes-int-or-string": true - }, - description: "Requests describes the minimum amount of compute resources required.\nIf Requests is omitted for a container, it defaults to Limits if that is explicitly specified,\notherwise to the global values configured via controller flags. Requests cannot exceed Limits.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", - type: "object" - } - }, - type: "object" - }, - securityContext: { - description: "If specified, the pod's security context", - properties: { - fsGroup: { - description: "A special supplemental group that applies to all containers in a pod.\nSome volume types allow the Kubelet to change the ownership of that volume\nto be owned by the pod:\n\n1. The owning GID will be the FSGroup\n2. The setgid bit is set (new files created in the volume will be owned by FSGroup)\n3. The permission bits are OR'd with rw-rw----\n\nIf unset, the Kubelet will not modify the ownership and permissions of any volume.\nNote that this field cannot be set when spec.os.name is windows.", - format: "int64", - type: "integer" - }, - fsGroupChangePolicy: { - description: "fsGroupChangePolicy defines behavior of changing ownership and permission of the volume\nbefore being exposed inside Pod. This field will only apply to\nvolume types which support fsGroup based ownership(and permissions).\nIt will have no effect on ephemeral volume types such as: secret, configmaps\nand emptydir.\nValid values are \"OnRootMismatch\" and \"Always\". If not specified, \"Always\" is used.\nNote that this field cannot be set when spec.os.name is windows.", - type: "string" - }, - runAsGroup: { - description: "The GID to run the entrypoint of the container process.\nUses runtime default if unset.\nMay also be set in SecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence\nfor that container.\nNote that this field cannot be set when spec.os.name is windows.", - format: "int64", - type: "integer" - }, - runAsNonRoot: { - description: "Indicates that the container must run as a non-root user.\nIf true, the Kubelet will validate the image at runtime to ensure that it\ndoes not run as UID 0 (root) and fail to start the container if it does.\nIf unset or false, no such validation will be performed.\nMay also be set in SecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.", - type: "boolean" - }, - runAsUser: { - description: "The UID to run the entrypoint of the container process.\nDefaults to user specified in image metadata if unspecified.\nMay also be set in SecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence\nfor that container.\nNote that this field cannot be set when spec.os.name is windows.", - format: "int64", - type: "integer" - }, - seccompProfile: { - description: "The seccomp options to use by the containers in this pod.\nNote that this field cannot be set when spec.os.name is windows.", - properties: { - localhostProfile: { - description: "localhostProfile indicates a profile defined in a file on the node should be used.\nThe profile must be preconfigured on the node to work.\nMust be a descending path, relative to the kubelet's configured seccomp profile location.\nMust be set if type is \"Localhost\". Must NOT be set for any other type.", - type: "string" - }, - type: { - description: "type indicates which kind of seccomp profile will be applied.\nValid options are:\n\nLocalhost - a profile defined in a file on the node should be used.\nRuntimeDefault - the container runtime default profile should be used.\nUnconfined - no profile should be applied.", - type: "string" - } - }, - required: ["type"], - type: "object" - }, - seLinuxOptions: { - description: "The SELinux context to be applied to all containers.\nIf unspecified, the container runtime will allocate a random SELinux context for each\ncontainer. May also be set in SecurityContext. If set in\nboth SecurityContext and PodSecurityContext, the value specified in SecurityContext\ntakes precedence for that container.\nNote that this field cannot be set when spec.os.name is windows.", - properties: { - level: { - description: "Level is SELinux level label that applies to the container.", - type: "string" - }, - role: { - description: "Role is a SELinux role label that applies to the container.", - type: "string" - }, - type: { - description: "Type is a SELinux type label that applies to the container.", - type: "string" - }, - user: { - description: "User is a SELinux user label that applies to the container.", - type: "string" - } - }, - type: "object" - }, - supplementalGroups: { - description: "A list of groups applied to the first process run in each container, in addition\nto the container's primary GID, the fsGroup (if specified), and group memberships\ndefined in the container image for the uid of the container process. If unspecified,\nno additional groups are added to any container. Note that group memberships\ndefined in the container image for the uid of the container process are still effective,\neven if they are not included in this list.\nNote that this field cannot be set when spec.os.name is windows.", - items: { - format: "int64", - type: "integer" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - }, - sysctls: { - description: "Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported\nsysctls (by the container runtime) might fail to launch.\nNote that this field cannot be set when spec.os.name is windows.", - items: { - description: "Sysctl defines a kernel parameter to be set", - properties: { - name: { - description: "Name of a property to set", - type: "string" - }, - value: { - description: "Value of a property to set", - type: "string" - } - }, - required: ["name", "value"], - type: "object" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - } - }, - type: "object" - }, - serviceAccountName: { - description: "If specified, the pod's service account", - type: "string" - }, - tolerations: { - description: "If specified, the pod's tolerations.", - items: { - description: "The pod this Toleration is attached to tolerates any taint that matches\nthe triple using the matching operator .", - properties: { - effect: { - description: "Effect indicates the taint effect to match. Empty means match all taint effects.\nWhen specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.", - type: "string" - }, - key: { - description: "Key is the taint key that the toleration applies to. Empty means match all taint keys.\nIf the key is empty, operator must be Exists; this combination means to match all values and all keys.", - type: "string" - }, - operator: { - description: "Operator represents a key's relationship to the value.\nValid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.\nExists is equivalent to wildcard for value, so that a pod can\ntolerate all taints of a particular category.\nLt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).", - type: "string" - }, - tolerationSeconds: { - description: "TolerationSeconds represents the period of time the toleration (which must be\nof effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,\nit is not set, which means tolerate the taint forever (do not evict). Zero and\nnegative values will be treated as 0 (evict immediately) by the system.", - format: "int64", - type: "integer" - }, - value: { - description: "Value is the taint value the toleration matches to.\nIf the operator is Exists, the value should be empty, otherwise just a regular string.", - type: "string" - } - }, - type: "object" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - } - }, - type: "object" - } - }, - type: "object" - }, - serviceType: { - description: "Optional service type for Kubernetes solver service. Supported values\nare NodePort or ClusterIP. If unset, defaults to NodePort.", + name: { + description: "Name of the resource being referred to.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", type: "string" } }, + required: ["name"], type: "object" } }, + required: ["create"], type: "object" }, - selector: { - description: "Selector selects a set of DNSNames on the Certificate resource that\nshould be solved using this challenge solver.\nIf not specified, the solver will be treated as the 'default' solver\nwith the lowest priority, i.e. if any other solver has a more specific\nmatch, it will be used instead.", + pkcs12: { + description: "PKCS12 configures options for storing a PKCS12 keystore in the\n`spec.secretName` Secret resource.", properties: { - dnsNames: { - description: "List of DNSNames that this solver will be used to solve.\nIf specified and a match is found, a dnsNames selector will take\nprecedence over a dnsZones selector.\nIf multiple solvers match with the same dnsNames value, the solver\nwith the most matching labels in matchLabels will be selected.\nIf neither has more matches, the solver defined earlier in the list\nwill be selected.", - items: { - type: "string" - }, - type: "array", - "x-kubernetes-list-type": "atomic" + create: { + description: "Create enables PKCS12 keystore creation for the Certificate.\nIf true, a file named `keystore.p12` will be created in the target\nSecret resource, encrypted using the password stored in\n`passwordSecretRef` or in `password`.\nThe keystore file will be updated immediately.\nIf the issuer provided a CA certificate, a file named `truststore.p12` will\nalso be created in the target Secret resource, encrypted using the\npassword stored in `passwordSecretRef` containing the issuing Certificate\nAuthority", + type: "boolean" }, - dnsZones: { - description: "List of DNSZones that this solver will be used to solve.\nThe most specific DNS zone match specified here will take precedence\nover other DNS zone matches, so a solver specifying sys.example.com\nwill be selected over one specifying example.com for the domain\nwww.sys.example.com.\nIf multiple solvers match with the same dnsZones value, the solver\nwith the most matching labels in matchLabels will be selected.\nIf neither has more matches, the solver defined earlier in the list\nwill be selected.", - items: { - type: "string" - }, - type: "array", - "x-kubernetes-list-type": "atomic" + password: { + description: "Password provides a literal password used to encrypt the PKCS#12 keystore.\nMutually exclusive with passwordSecretRef.\nOne of password or passwordSecretRef must provide a password with a non-zero length.", + type: "string" }, - matchLabels: { - additionalProperties: { - type: "string" + passwordSecretRef: { + description: "PasswordSecretRef is a reference to a non-empty key in a Secret resource\ncontaining the password used to encrypt the PKCS#12 keystore.\nMutually exclusive with password.\nOne of password or passwordSecretRef must provide a password with a non-zero length.", + properties: { + key: { + description: "The key of the entry in the Secret resource's `data` field to be used.\nSome instances of this field may be defaulted, in others it may be\nrequired.", + type: "string" + }, + name: { + description: "Name of the resource being referred to.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + } }, - description: "A label selector that is used to refine the set of certificate's that\nthis challenge solver will apply to.", + required: ["name"], type: "object" + }, + profile: { + description: "Profile specifies the key and certificate encryption algorithms and the HMAC algorithm\nused to create the PKCS12 keystore. Default value is `LegacyRC2` for backward compatibility.\n\nIf provided, allowed values are:\n`LegacyRC2`: Deprecated. Not supported by default in OpenSSL 3 or Java 20.\n`LegacyDES`: Less secure algorithm. Use this option for maximal compatibility.\n`Modern2023`: Secure algorithm. Use this option in case you have to always use secure algorithms\n(eg. because of company policy). Please note that the security of the algorithm is not that important\nin reality, because the unencrypted certificate and private key are also stored in the Secret.", + enum: ["LegacyRC2", "LegacyDES", "Modern2023"], + type: "string" } }, + required: ["create"], type: "object" - }, - waitInsteadOfSelfCheck: { - description: "WaitInsteadOfSelfCheck, if set, skips cert-manager's self-check and\ninstead waits this long after presentation before asking the ACME server\nto validate the challenge.\n\nThis is an advanced escape hatch for environments where cert-manager's\nself-check cannot succeed from its own network or DNS viewpoint even\nthough the ACME server can still validate successfully, for example due\nto split-horizon DNS or NAT hairpinning.\n\nA value of 0 skips the self-check and asks the ACME server to validate\nimmediately after presentation, relying on the ACME server's own\nvalidation retries (RFC 8555 section 8.2) to succeed once the challenge\nhas propagated. A negative duration is rejected.\nValue must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration,\nfor example `30s` or `2m`.", - type: "string" } }, type: "object" }, - token: { - description: "The ACME challenge token for this challenge.\nThis is the raw value returned from the ACME server.", - type: "string" - }, - type: { - description: "The type of ACME challenge this resource represents.\nOne of \"HTTP-01\" or \"DNS-01\".", - enum: ["HTTP-01", "DNS-01"], - type: "string" - }, - url: { - description: "The URL of the ACME Challenge resource for this challenge.\nThis can be used to lookup details about the status of this challenge.", - type: "string" - }, - wildcard: { - description: "wildcard will be true if this challenge is for a wildcard identifier,\nfor example '*.example.com'.", - type: "boolean" - } - }, - required: ["authorizationURL", "dnsName", "issuerRef", "key", "solver", "token", "type", "url"], - type: "object" - }, - status: { - properties: { - presented: { - description: "Presented is true once cert-manager has configured the solver resources\nneeded to expose this challenge's validation material.\nFor example, the DNS01 TXT record has been created, or the HTTP01 solver\nhas been configured to serve the challenge token.\nThis does not imply the self check is passing, that the ACME server has\nvalidated the challenge, or that cert-manager has already accepted the\nchallenge with the ACME server.", - type: "boolean" - }, - presentedAt: { - description: "PresentedAt records when cert-manager first configured the solver\nresources for this challenge. This is used by the optional delay-based\nreadiness logic.", - format: "date-time", - type: "string" - }, - processing: { - description: "Used to denote whether this challenge should be processed or not.\nThis field will only be set to true by the 'scheduling' component.\nIt will only be set to false by the 'challenges' controller, after the\nchallenge has reached a final state or timed out.\nIf this field is set to false, the challenge controller will not take\nany more action.", - type: "boolean" - }, - reason: { - description: "Contains human readable information on why the Challenge is in the\ncurrent state.", - type: "string" - }, - state: { - description: "Contains the current 'state' of the challenge.\nIf not set, the state of the challenge is unknown.", - enum: ["valid", "ready", "pending", "processing", "invalid", "expired", "errored"], - type: "string" - } - }, - type: "object" - } - }, - required: ["metadata", "spec"], - type: "object" - } - }, - selectableFields: [{ - jsonPath: ".spec.issuerRef.group" - }, { - jsonPath: ".spec.issuerRef.kind" - }, { - jsonPath: ".spec.issuerRef.name" - }], - served: true, - storage: true, - subresources: { - status: {} - } - }] - } -}; -export const CustomResourceDefinition_OrdersAcmeCertManagerIo: KubernetesResource = { - apiVersion: "apiextensions.k8s.io/v1", - kind: "CustomResourceDefinition", - metadata: { - annotations: { - "helm.sh/resource-policy": "keep" - }, - labels: { - app: "cert-manager", - "app.kubernetes.io/component": "crds", - "app.kubernetes.io/instance": "cert-manager", - "app.kubernetes.io/managed-by": "Helm", - "app.kubernetes.io/name": "cert-manager", - "app.kubernetes.io/version": "v1.21.1", - "helm.sh/chart": "cert-manager-v1.21.1" - }, - name: "orders.acme.cert-manager.io" - }, - spec: { - group: "acme.cert-manager.io", - names: { - categories: ["cert-manager", "cert-manager-acme"], - kind: "Order", - listKind: "OrderList", - plural: "orders", - singular: "order" - }, - scope: "Namespaced", - versions: [{ - additionalPrinterColumns: [{ - jsonPath: ".status.state", - name: "State", - type: "string" - }, { - jsonPath: ".spec.issuerRef.name", - name: "Issuer", - priority: 1, - type: "string" - }, { - jsonPath: ".status.reason", - name: "Reason", - priority: 1, - type: "string" - }, { - description: "CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.", - jsonPath: ".metadata.creationTimestamp", - name: "Age", - type: "date" - }], - name: "v1", - schema: { - openAPIV3Schema: { - description: "Order is a type to represent an Order with an ACME server", - properties: { - apiVersion: { - description: "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", - type: "string" - }, - kind: { - description: "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", - type: "string" - }, - metadata: { - type: "object" - }, - spec: { - properties: { - commonName: { - description: "CommonName is the common name as specified on the DER encoded CSR.\nIf specified, this value must also be present in `dnsNames` or `ipAddresses`.\nThis field must match the corresponding field on the DER encoded CSR.", - type: "string" - }, - dnsNames: { - description: "DNSNames is a list of DNS names that should be included as part of the Order\nvalidation process.\nThis field must match the corresponding field on the DER encoded CSR.", - items: { - type: "string" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - }, - duration: { - description: "Duration is the duration for the not after date for the requested certificate.\nThis is set on order creation as per the ACME spec.", + literalSubject: { + description: "Requested X.509 certificate subject, represented using the LDAP \"String\nRepresentation of a Distinguished Name\" [1].\nImportant: the LDAP string format also specifies the order of the attributes\nin the subject, this is important when issuing certs for LDAP authentication.\nExample: `CN=foo,DC=corp,DC=example,DC=com`\nMore info [1]: https://datatracker.ietf.org/doc/html/rfc4514\nMore info: https://github.com/cert-manager/cert-manager/issues/3203\nMore info: https://github.com/cert-manager/cert-manager/issues/4424\n\nCannot be set if the `subject` or `commonName` field is set.", type: "string" }, - ipAddresses: { - description: "IPAddresses is a list of IP addresses that should be included as part of the Order\nvalidation process.\nThis field must match the corresponding field on the DER encoded CSR.", - items: { - type: "string" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - }, - issuerRef: { - description: "IssuerRef references a properly configured ACME-type Issuer which should\nbe used to create this Order.\nIf the Issuer does not exist, processing will be retried.\nIf the Issuer is not an 'ACME' Issuer, an error will be returned and the\nOrder will be marked as failed.", + nameConstraints: { + description: "x.509 certificate NameConstraint extension which MUST NOT be used in a non-CA certificate.\nMore Info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.10\n\nThis is an Alpha Feature and is only enabled with the\n`--feature-gates=NameConstraints=true` option set on both\nthe controller and webhook components.", properties: { - group: { - description: "Group of the issuer being referred to.\nDefaults to 'cert-manager.io'.", - type: "string" + critical: { + description: "if true then the name constraints are marked critical.", + type: "boolean" }, - kind: { - description: "Kind of the issuer being referred to.\nDefaults to 'Issuer'.", - type: "string" + excluded: { + description: "Excluded contains the constraints which must be disallowed. Any name matching a\nrestriction in the excluded field is invalid regardless\nof information appearing in the permitted", + properties: { + dnsDomains: { + description: "DNSDomains is a list of DNS domains that are permitted or excluded.", + items: { + type: "string" + }, + type: "array" + }, + emailAddresses: { + description: "EmailAddresses is a list of Email Addresses that are permitted or excluded.", + items: { + type: "string" + }, + type: "array" + }, + ipRanges: { + description: "IPRanges is a list of IP Ranges that are permitted or excluded.\nThis should be a valid CIDR notation.", + items: { + type: "string" + }, + type: "array" + }, + uriDomains: { + description: "URIDomains is a list of URI domains that are permitted or excluded.", + items: { + type: "string" + }, + type: "array" + } + }, + type: "object" }, - name: { - description: "Name of the issuer being referred to.", - type: "string" + permitted: { + description: "Permitted contains the constraints in which the names must be located.", + properties: { + dnsDomains: { + description: "DNSDomains is a list of DNS domains that are permitted or excluded.", + items: { + type: "string" + }, + type: "array" + }, + emailAddresses: { + description: "EmailAddresses is a list of Email Addresses that are permitted or excluded.", + items: { + type: "string" + }, + type: "array" + }, + ipRanges: { + description: "IPRanges is a list of IP Ranges that are permitted or excluded.\nThis should be a valid CIDR notation.", + items: { + type: "string" + }, + type: "array" + }, + uriDomains: { + description: "URIDomains is a list of URI domains that are permitted or excluded.", + items: { + type: "string" + }, + type: "array" + } + }, + type: "object" } }, - required: ["name"], type: "object" }, - profile: { - description: "Profile allows requesting a certificate profile from the ACME server.\nSupported profiles are listed by the server's ACME directory URL.", - type: "string" - }, - replaces: { - description: "Replaces is the ARI CertID (RFC 9773 §4.1) of the certificate that this\nOrder is intended to replace. When set, cert-manager will include the\n\"replaces\" field on the newOrder request to the ACME server if and only\nif the server advertises ARI support in its directory. The CertID has\nthe form \"base64url(AKI).base64url(serial)\" and is derived locally from\nthe currently issued leaf certificate.", - type: "string" - }, - request: { - description: "Certificate signing request bytes in DER encoding.\nThis will be used when finalizing the order.\nThis field must be set on the order.", - format: "byte", - type: "string" - } - }, - required: ["issuerRef", "request"], - type: "object" - }, - status: { - properties: { - authorizations: { - description: "Authorizations contains data returned from the ACME server on what\nauthorizations must be completed in order to validate the DNS names\nspecified on the Order.", + otherNames: { + description: "`otherNames` is an escape hatch for SAN that allows any type. We currently restrict the support to string like otherNames, cf RFC 5280 p 37\nAny UTF8 String valued otherName can be passed with by setting the keys oid: x.x.x.x and UTF8Value: somevalue for `otherName`.\nMost commonly this would be UPN set with oid: 1.3.6.1.4.1.311.20.2.3\nYou should ensure that any OID passed is valid for the UTF8String type as we do not explicitly validate this.", items: { - description: "ACMEAuthorization contains data returned from the ACME server on an\nauthorization that must be completed in order validate a DNS name on an ACME\nOrder resource.", properties: { - challenges: { - description: "Challenges specifies the challenge types offered by the ACME server.\nOne of these challenge types will be selected when validating the DNS\nname and an appropriate Challenge resource will be created to perform\nthe ACME challenge process.", - items: { - description: "Challenge specifies a challenge offered by the ACME server for an Order.\nAn appropriate Challenge resource can be created to perform the ACME\nchallenge process.", - properties: { - token: { - description: "Token is the token that must be presented for this challenge.\nThis is used to compute the 'key' that must also be presented.", - type: "string" - }, - type: { - description: "Type is the type of challenge being offered, e.g., 'http-01', 'dns-01',\n'tls-sni-01', etc.\nThis is the raw value retrieved from the ACME server.\nOnly 'http-01' and 'dns-01' are supported by cert-manager, other values\nwill be ignored.", - type: "string" - }, - url: { - description: "URL is the URL of this challenge. It can be used to retrieve additional\nmetadata about the Challenge from the ACME server.", - type: "string" - } - }, - required: ["token", "type", "url"], - type: "object" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - }, - identifier: { - description: "Identifier is the DNS name to be validated as part of this authorization", - type: "string" - }, - initialState: { - description: "InitialState is the initial state of the ACME authorization when first\nfetched from the ACME server.\nIf an Authorization is already 'valid', the Order controller will not\ncreate a Challenge resource for the authorization. This will occur when\nworking with an ACME server that enables 'authz reuse' (such as Let's\nEncrypt's production endpoint).\nIf not set and 'identifier' is set, the state is assumed to be pending\nand a Challenge will be created.", - enum: ["valid", "ready", "pending", "processing", "invalid", "expired", "errored"], + oid: { + description: "OID is the object identifier for the otherName SAN.\nThe object identifier must be expressed as a dotted string, for\nexample, \"1.2.840.113556.1.4.221\".", type: "string" }, - url: { - description: "URL is the URL of the Authorization that must be completed", + utf8Value: { + description: "utf8Value is the string value of the otherName SAN.\nThe utf8Value accepts any valid UTF8 string to set as value for the otherName SAN.", type: "string" - }, - wildcard: { - description: "Wildcard will be true if this authorization is for a wildcard DNS name.\nIf this is true, the identifier will be the *non-wildcard* version of\nthe DNS name.\nFor example, if '*.example.com' is the DNS name being validated, this\nfield will be 'true' and the 'identifier' field will be 'example.com'.", - type: "boolean" } }, - required: ["url"], type: "object" }, - type: "array", - "x-kubernetes-list-type": "atomic" - }, - certificate: { - description: "Certificate is a copy of the PEM encoded certificate for this Order.\nThis field will be populated after the order has been successfully\nfinalized with the ACME server, and the order has transitioned to the\n'valid' state.", - format: "byte", - type: "string" + type: "array" }, - failureTime: { - description: "FailureTime stores the time that this order failed.\nThis is used to influence garbage collection and back-off.", - format: "date-time", - type: "string" + privateKey: { + description: "Private key options. These include the key algorithm and size, the used\nencoding and the rotation policy.", + properties: { + algorithm: { + description: "Algorithm is the private key algorithm of the corresponding private key\nfor this certificate.\n\nIf provided, allowed values are either `RSA`, `ECDSA` or `Ed25519`.\nIf `algorithm` is specified and `size` is not provided,\nkey size of 2048 will be used for `RSA` key algorithm and\nkey size of 256 will be used for `ECDSA` key algorithm.\nkey size is ignored when using the `Ed25519` key algorithm.", + enum: ["RSA", "ECDSA", "Ed25519"], + type: "string" + }, + encoding: { + description: "The private key cryptography standards (PKCS) encoding for this\ncertificate's private key to be encoded in.\n\nIf provided, allowed values are `PKCS1` and `PKCS8` standing for PKCS#1\nand PKCS#8, respectively.\nDefaults to `PKCS1` if not specified.", + enum: ["PKCS1", "PKCS8"], + type: "string" + }, + rotationPolicy: { + description: "RotationPolicy controls how private keys should be regenerated when a\nre-issuance is being processed.\n\nIf set to `Never`, a private key will only be generated if one does not\nalready exist in the target `spec.secretName`. If one does exist but it\ndoes not have the correct algorithm or size, a warning will be raised\nto await user intervention.\nIf set to `Always`, a private key matching the specified requirements\nwill be generated whenever a re-issuance occurs.\nDefault is `Never` for backward compatibility.", + enum: ["Never", "Always"], + type: "string" + }, + size: { + description: "Size is the key bit size of the corresponding private key for this certificate.\n\nIf `algorithm` is set to `RSA`, valid values are `2048`, `4096` or `8192`,\nand will default to `2048` if not specified.\nIf `algorithm` is set to `ECDSA`, valid values are `256`, `384` or `521`,\nand will default to `256` if not specified.\nIf `algorithm` is set to `Ed25519`, Size is ignored.\nNo other values are allowed.", + type: "integer" + } + }, + type: "object" }, - finalizeURL: { - description: "FinalizeURL of the Order.\nThis is used to obtain certificates for this order once it has been completed.", + renewBefore: { + description: "How long before the currently issued certificate's expiry cert-manager should\nrenew the certificate. For example, if a certificate is valid for 60 minutes,\nand `renewBefore=10m`, cert-manager will begin to attempt to renew the certificate\n50 minutes after it was issued (i.e. when there are 10 minutes remaining until\nthe certificate is no longer valid).\n\nNOTE: The actual lifetime of the issued certificate is used to determine the\nrenewal time. If an issuer returns a certificate with a different lifetime than\nthe one requested, cert-manager will use the lifetime of the issued certificate.\n\nIf unset, this defaults to 1/3 of the issued certificate's lifetime.\nMinimum accepted value is 5 minutes.\nValue must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration.\nCannot be set if the `renewBeforePercentage` field is set.", type: "string" }, - reason: { - description: "Reason optionally provides more information about a why the order is in\nthe current state.", - type: "string" + renewBeforePercentage: { + description: "`renewBeforePercentage` is like `renewBefore`, except it is a relative percentage\nrather than an absolute duration. For example, if a certificate is valid for 60\nminutes, and `renewBeforePercentage=25`, cert-manager will begin to attempt to\nrenew the certificate 45 minutes after it was issued (i.e. when there are 15\nminutes (25%) remaining until the certificate is no longer valid).\n\nNOTE: The actual lifetime of the issued certificate is used to determine the\nrenewal time. If an issuer returns a certificate with a different lifetime than\nthe one requested, cert-manager will use the lifetime of the issued certificate.\n\nValue must be an integer in the range (0,100). The minimum effective\n`renewBefore` derived from the `renewBeforePercentage` and `duration` fields is 5\nminutes.\nCannot be set if the `renewBefore` field is set.", + format: "int32", + type: "integer" }, - state: { - description: "State contains the current state of this Order resource.\nStates 'success' and 'expired' are 'final'", - enum: ["valid", "ready", "pending", "processing", "invalid", "expired", "errored"], - type: "string" + revisionHistoryLimit: { + description: "The maximum number of CertificateRequest revisions that are maintained in\nthe Certificate's history. Each revision represents a single `CertificateRequest`\ncreated by this Certificate, either when it was created, renewed, or Spec\nwas changed. Revisions will be removed by oldest first if the number of\nrevisions exceeds this number.\n\nIf set, revisionHistoryLimit must be a value of `1` or greater.\nIf unset (`nil`), revisions will not be garbage collected.\nDefault value is `nil`.", + format: "int32", + type: "integer" }, - url: { - description: "URL of the Order.\nThis will initially be empty when the resource is first created.\nThe Order controller will populate this field when the Order is first processed.\nThis field will be immutable after it is initially set.", - type: "string" - } - }, - type: "object" - } - }, - required: ["metadata", "spec"], - type: "object" - } - }, - selectableFields: [{ - jsonPath: ".spec.issuerRef.group" - }, { - jsonPath: ".spec.issuerRef.kind" - }, { - jsonPath: ".spec.issuerRef.name" - }], - served: true, - storage: true, - subresources: { - status: {} - } - }] - } -}; -export const CustomResourceDefinition_CertificaterequestsCertManagerIo: KubernetesResource = { - apiVersion: "apiextensions.k8s.io/v1", - kind: "CustomResourceDefinition", - metadata: { - annotations: { - "helm.sh/resource-policy": "keep" - }, - labels: { - app: "cert-manager", - "app.kubernetes.io/component": "crds", - "app.kubernetes.io/instance": "cert-manager", - "app.kubernetes.io/managed-by": "Helm", - "app.kubernetes.io/name": "cert-manager", - "app.kubernetes.io/version": "v1.21.1", - "helm.sh/chart": "cert-manager-v1.21.1" - }, - name: "certificaterequests.cert-manager.io" - }, - spec: { - group: "cert-manager.io", - names: { - categories: ["cert-manager"], - kind: "CertificateRequest", - listKind: "CertificateRequestList", - plural: "certificaterequests", - shortNames: ["cr", "crs"], - singular: "certificaterequest" - }, - scope: "Namespaced", - versions: [{ - additionalPrinterColumns: [{ - jsonPath: ".status.conditions[?(@.type == \"Approved\")].status", - name: "Approved", - type: "string" - }, { - jsonPath: ".status.conditions[?(@.type == \"Denied\")].status", - name: "Denied", - type: "string" - }, { - jsonPath: ".status.conditions[?(@.type == \"Ready\")].status", - name: "Ready", - type: "string" - }, { - jsonPath: ".spec.issuerRef.name", - name: "Issuer", - type: "string" - }, { - jsonPath: ".spec.username", - name: "Requester", - type: "string" - }, { - jsonPath: ".status.conditions[?(@.type == \"Ready\")].message", - name: "Status", - priority: 1, - type: "string" - }, { - description: "CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.", - jsonPath: ".metadata.creationTimestamp", - name: "Age", - type: "date" - }], - name: "v1", - schema: { - openAPIV3Schema: { - description: "A CertificateRequest is used to request a signed certificate from one of the\nconfigured issuers.\n\nAll fields within the CertificateRequest's `spec` are immutable after creation.\nA CertificateRequest will either succeed or fail, as denoted by its `Ready` status\ncondition and its `status.failureTime` field.\n\nA CertificateRequest is a one-shot resource, meaning it represents a single\npoint in time request for a certificate and cannot be re-used.", - properties: { - apiVersion: { - description: "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", - type: "string" - }, - kind: { - description: "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", - type: "string" - }, - metadata: { - type: "object" - }, - spec: { - description: "Specification of the desired state of the CertificateRequest resource.\nhttps://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status", - properties: { - duration: { - description: "Requested 'duration' (i.e. lifetime) of the Certificate. Note that the\nissuer may choose to ignore the requested duration, just like any other\nrequested attribute.", + secretName: { + description: "Name of the Secret resource that will be automatically created and\nmanaged by this Certificate resource. It will be populated with a\nprivate key and certificate, signed by the denoted issuer. The Secret\nresource lives in the same namespace as the Certificate resource.", type: "string" }, - extra: { - additionalProperties: { - items: { - type: "string" + secretTemplate: { + description: "Defines annotations and labels to be copied to the Certificate's Secret.\nLabels and annotations on the Secret will be changed as they appear on the\nSecretTemplate when added or removed. SecretTemplate annotations are added\nin conjunction with, and cannot overwrite, the base set of annotations\ncert-manager sets on the Certificate's Secret.", + properties: { + annotations: { + additionalProperties: { + type: "string" + }, + description: "Annotations is a key value map to be copied to the target Kubernetes Secret.", + type: "object" }, - type: "array" - }, - description: "Extra contains extra attributes of the user that created the CertificateRequest.\nPopulated by the cert-manager webhook on creation and immutable.", - type: "object" - }, - groups: { - description: "Groups contains group membership of the user that created the CertificateRequest.\nPopulated by the cert-manager webhook on creation and immutable.", - items: { - type: "string" + labels: { + additionalProperties: { + type: "string" + }, + description: "Labels is a key value map to be copied to the target Kubernetes Secret.", + type: "object" + } }, - type: "array", - "x-kubernetes-list-type": "atomic" - }, - isCA: { - description: "Requested basic constraints isCA value. Note that the issuer may choose\nto ignore the requested isCA value, just like any other requested attribute.\n\nNOTE: If the CSR in the `Request` field has a BasicConstraints extension,\nit must have the same isCA value as specified here.\n\nIf true, this will automatically add the `cert sign` usage to the list\nof requested `usages`.", - type: "boolean" + type: "object" }, - issuerRef: { - description: "Reference to the issuer responsible for issuing the certificate.\nIf the issuer is namespace-scoped, it must be in the same namespace\nas the Certificate. If the issuer is cluster-scoped, it can be used\nfrom any namespace.\n\nThe `name` field of the reference must always be specified.", + subject: { + description: "Requested set of X509 certificate subject attributes.\nMore info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.6\n\nThe common name attribute is specified separately in the `commonName` field.\nCannot be set if the `literalSubject` field is set.", properties: { - group: { - description: "Group of the issuer being referred to.\nDefaults to 'cert-manager.io'.", - type: "string" + countries: { + description: "Countries to be used on the Certificate.", + items: { + type: "string" + }, + type: "array" }, - kind: { - description: "Kind of the issuer being referred to.\nDefaults to 'Issuer'.", - type: "string" + localities: { + description: "Cities to be used on the Certificate.", + items: { + type: "string" + }, + type: "array" }, - name: { - description: "Name of the issuer being referred to.", + organizationalUnits: { + description: "Organizational Units to be used on the Certificate.", + items: { + type: "string" + }, + type: "array" + }, + organizations: { + description: "Organizations to be used on the Certificate.", + items: { + type: "string" + }, + type: "array" + }, + postalCodes: { + description: "Postal codes to be used on the Certificate.", + items: { + type: "string" + }, + type: "array" + }, + provinces: { + description: "State/Provinces to be used on the Certificate.", + items: { + type: "string" + }, + type: "array" + }, + serialNumber: { + description: "Serial number to be used on the Certificate.", type: "string" + }, + streetAddresses: { + description: "Street addresses to be used on the Certificate.", + items: { + type: "string" + }, + type: "array" } }, - required: ["name"], type: "object" }, - request: { - description: "The PEM-encoded X.509 certificate signing request to be submitted to the\nissuer for signing.\n\nIf the CSR has a BasicConstraints extension, its isCA attribute must\nmatch the `isCA` value of this CertificateRequest.\nIf the CSR has a KeyUsage extension, its key usages must match the\nkey usages in the `usages` field of this CertificateRequest.\nIf the CSR has a ExtKeyUsage extension, its extended key usages\nmust match the extended key usages in the `usages` field of this\nCertificateRequest.", - format: "byte", - type: "string" - }, - uid: { - description: "UID contains the uid of the user that created the CertificateRequest.\nPopulated by the cert-manager webhook on creation and immutable.", - type: "string" + uris: { + description: "Requested URI subject alternative names.", + items: { + type: "string" + }, + type: "array" }, usages: { - description: "Requested key usages and extended key usages.\n\nNOTE: If the CSR in the `Request` field has uses the KeyUsage or\nExtKeyUsage extension, these extensions must have the same values\nas specified here without any additional values.\n\nIf unset, defaults to `digital signature` and `key encipherment`.", + description: "Requested key usages and extended key usages.\nThese usages are used to set the `usages` field on the created CertificateRequest\nresources. If `encodeUsagesInRequest` is unset or set to `true`, the usages\nwill additionally be encoded in the `request` field which contains the CSR blob.\n\nIf unset, defaults to `digital signature` and `key encipherment`.", items: { description: "KeyUsage specifies valid usage contexts for keys.\nSee:\nhttps://tools.ietf.org/html/rfc5280#section-4.2.1.3\nhttps://tools.ietf.org/html/rfc5280#section-4.2.1.12\n\nValid KeyUsage values are as follows:\n\"signing\",\n\"digital signature\",\n\"content commitment\",\n\"key encipherment\",\n\"key agreement\",\n\"data encipherment\",\n\"cert sign\",\n\"crl sign\",\n\"encipher only\",\n\"decipher only\",\n\"any\",\n\"server auth\",\n\"client auth\",\n\"code signing\",\n\"email protection\",\n\"s/mime\",\n\"ipsec end system\",\n\"ipsec tunnel\",\n\"ipsec user\",\n\"timestamping\",\n\"ocsp signing\",\n\"microsoft sgc\",\n\"netscape sgc\"", enum: ["signing", "digital signature", "content commitment", "key encipherment", "key agreement", "data encipherment", "cert sign", "crl sign", "encipher only", "decipher only", "any", "server auth", "client auth", "code signing", "email protection", "s/mime", "ipsec end system", "ipsec tunnel", "ipsec user", "timestamping", "ocsp signing", "microsoft sgc", "netscape sgc"], type: "string" }, - type: "array", - "x-kubernetes-list-type": "atomic" - }, - username: { - description: "Username contains the name of the user that created the CertificateRequest.\nPopulated by the cert-manager webhook on creation and immutable.", - type: "string" + type: "array" } }, - required: ["issuerRef", "request"], + required: ["issuerRef", "secretName"], type: "object" }, status: { - description: "Status of the CertificateRequest.\nThis is set and managed automatically.\nRead-only.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status", + description: "Status of the Certificate.\nThis is set and managed automatically.\nRead-only.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status", properties: { - ca: { - description: "The PEM encoded X.509 certificate of the signer, also known as the CA\n(Certificate Authority).\nThis is set on a best-effort basis by different issuers.\nIf not set, the CA is assumed to be unknown/not available.", - format: "byte", - type: "string" - }, - certificate: { - description: "The PEM encoded X.509 certificate resulting from the certificate\nsigning request.\nIf not set, the CertificateRequest has either not been completed or has\nfailed. More information on failure can be found by checking the\n`conditions` field.", - format: "byte", - type: "string" - }, conditions: { - description: "List of status conditions to indicate the status of a CertificateRequest.\nKnown condition types are `Ready`, `InvalidRequest`, `Approved` and `Denied`.", + description: "List of status conditions to indicate the status of certificates.\nKnown condition types are `Ready` and `Issuing`.", items: { - description: "CertificateRequestCondition contains condition information for a CertificateRequest.", + description: "CertificateCondition contains condition information for a Certificate.", properties: { lastTransitionTime: { description: "LastTransitionTime is the timestamp corresponding to the last status\nchange of this condition.", @@ -3047,6 +759,11 @@ export const CustomResourceDefinition_CertificaterequestsCertManagerIo: Kubernet description: "Message is a human readable description of the details of the last\ntransition, complementing reason.", type: "string" }, + observedGeneration: { + description: "If set, this represents the .metadata.generation that the condition was\nset based upon.\nFor instance, if .metadata.generation is currently 12, but the\n.status.condition[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the Certificate.", + format: "int64", + type: "integer" + }, reason: { description: "Reason is a brief machine readable explanation for the condition's last\ntransition.", type: "string" @@ -3057,7 +774,7 @@ export const CustomResourceDefinition_CertificaterequestsCertManagerIo: Kubernet type: "string" }, type: { - description: "Type of the condition, known values are (`Ready`, `InvalidRequest`,\n`Approved`, `Denied`).", + description: "Type of the condition, known values are (`Ready`, `Issuing`).", type: "string" } }, @@ -3068,10 +785,37 @@ export const CustomResourceDefinition_CertificaterequestsCertManagerIo: Kubernet "x-kubernetes-list-map-keys": ["type"], "x-kubernetes-list-type": "map" }, - failureTime: { - description: "FailureTime stores the time that this CertificateRequest failed. This is\nused to influence garbage collection and back-off.", + failedIssuanceAttempts: { + description: "The number of continuous failed issuance attempts up till now. This\nfield gets removed (if set) on a successful issuance and gets set to\n1 if unset and an issuance has failed. If an issuance has failed, the\ndelay till the next issuance will be calculated using formula\ntime.Hour * 2 ^ (failedIssuanceAttempts - 1).", + type: "integer" + }, + lastFailureTime: { + description: "LastFailureTime is set only if the latest issuance for this\nCertificate failed and contains the time of the failure. If an\nissuance has failed, the delay till the next issuance will be\ncalculated using formula time.Hour * 2 ^ (failedIssuanceAttempts -\n1). If the latest issuance has succeeded this field will be unset.", + format: "date-time", + type: "string" + }, + nextPrivateKeySecretName: { + description: "The name of the Secret resource containing the private key to be used\nfor the next certificate iteration.\nThe keymanager controller will automatically set this field if the\n`Issuing` condition is set to `True`.\nIt will automatically unset this field when the Issuing condition is\nnot set or False.", + type: "string" + }, + notAfter: { + description: "The expiration time of the certificate stored in the secret named\nby this resource in `spec.secretName`.", + format: "date-time", + type: "string" + }, + notBefore: { + description: "The time after which the certificate stored in the secret named\nby this resource in `spec.secretName` is valid.", + format: "date-time", + type: "string" + }, + renewalTime: { + description: "RenewalTime is the time at which the certificate will be next\nrenewed.\nIf not set, no upcoming renewal is scheduled.", format: "date-time", type: "string" + }, + revision: { + description: "The current 'revision' of the certificate as issued.\n\nWhen a CertificateRequest resource is created, it will have the\n`cert-manager.io/certificate-revision` set to one greater than the\ncurrent value of this field.\n\nUpon issuance, this field will be set to the value of the annotation\non the CertificateRequest resource used to issue the certificate.\n\nPersisting the value on the CertificateRequest resource allows the\ncertificates controller to know whether a request is part of an old\nissuance or if it is part of the ongoing revision's issuance by\nchecking if the revision value in the annotation is greater than this\nfield.", + type: "integer" } }, type: "object" @@ -3080,13 +824,6 @@ export const CustomResourceDefinition_CertificaterequestsCertManagerIo: Kubernet type: "object" } }, - selectableFields: [{ - jsonPath: ".spec.issuerRef.group" - }, { - jsonPath: ".spec.issuerRef.kind" - }, { - jsonPath: ".spec.issuerRef.name" - }], served: true, storage: true, subresources: { @@ -3095,7 +832,7 @@ export const CustomResourceDefinition_CertificaterequestsCertManagerIo: Kubernet }] } }; -export const CustomResourceDefinition_CertificatesCertManagerIo: KubernetesResource = { +export const CustomResourceDefinition_ChallengesAcmeCertManagerIo: KubernetesResource = { apiVersion: "apiextensions.k8s.io/v1", kind: "CustomResourceDefinition", metadata: { @@ -3104,43 +841,36 @@ export const CustomResourceDefinition_CertificatesCertManagerIo: KubernetesResou }, labels: { app: "cert-manager", - "app.kubernetes.io/component": "crds", "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "cert-manager", - "app.kubernetes.io/version": "v1.21.1", - "helm.sh/chart": "cert-manager-v1.21.1" + "app.kubernetes.io/version": "v1.17.0", + "helm.sh/chart": "cert-manager-v1.17.0" }, - name: "certificates.cert-manager.io" + name: "challenges.acme.cert-manager.io" }, spec: { - group: "cert-manager.io", + group: "acme.cert-manager.io", names: { - categories: ["cert-manager"], - kind: "Certificate", - listKind: "CertificateList", - plural: "certificates", - shortNames: ["cert", "certs"], - singular: "certificate" + categories: ["cert-manager", "cert-manager-acme"], + kind: "Challenge", + listKind: "ChallengeList", + plural: "challenges", + singular: "challenge" }, scope: "Namespaced", versions: [{ additionalPrinterColumns: [{ - jsonPath: ".status.conditions[?(@.type == \"Ready\")].status", - name: "Ready", - type: "string" - }, { - jsonPath: ".spec.secretName", - name: "Secret", + jsonPath: ".status.state", + name: "State", type: "string" }, { - jsonPath: ".spec.issuerRef.name", - name: "Issuer", - priority: 1, + jsonPath: ".spec.dnsName", + name: "Domain", type: "string" }, { - jsonPath: ".status.conditions[?(@.type == \"Ready\")].message", - name: "Status", + jsonPath: ".status.reason", + name: "Reason", priority: 1, type: "string" }, { @@ -3152,7 +882,7 @@ export const CustomResourceDefinition_CertificatesCertManagerIo: KubernetesResou name: "v1", schema: { openAPIV3Schema: { - description: "A Certificate resource should be created to ensure an up to date and signed\nX.509 certificate is stored in the Kubernetes Secret resource named in `spec.secretName`.\n\nThe stored certificate will be renewed before it expires (as configured by `spec.renewBefore`).", + description: "Challenge is a type to represent a Challenge request with an ACME server", properties: { apiVersion: { description: "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", @@ -3166,597 +896,2401 @@ export const CustomResourceDefinition_CertificatesCertManagerIo: KubernetesResou type: "object" }, spec: { - description: "Specification of the desired state of the Certificate resource.\nhttps://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status", properties: { - additionalOutputFormats: { - description: "Defines extra output formats of the private key and signed certificate chain\nto be written to this Certificate's target Secret.", - items: { - description: "CertificateAdditionalOutputFormat defines an additional output format of a\nCertificate resource. These contain supplementary data formats of the signed\ncertificate chain and paired private key.", - properties: { - type: { - description: "Type is the name of the format type that should be written to the\nCertificate's target Secret.", - enum: ["DER", "CombinedPEM"], - type: "string" - } - }, - required: ["type"], - type: "object" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - }, - commonName: { - description: "Requested common name X509 certificate subject attribute.\nMore info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.6\nNOTE: TLS clients will ignore this value when any subject alternative name is\nset (see https://tools.ietf.org/html/rfc6125#section-6.4.4).\n\nShould have a length of 64 characters or fewer to avoid generating invalid CSRs.\nCannot be set if the `literalSubject` field is set.", + authorizationURL: { + description: "The URL to the ACME Authorization resource that this\nchallenge is a part of.", type: "string" }, - dnsNames: { - description: "Requested DNS subject alternative names.", - items: { - type: "string" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - }, - duration: { - description: "Requested 'duration' (i.e. lifetime) of the Certificate. Note that the\nissuer may choose to ignore the requested duration, just like any other\nrequested attribute.\n\nIf unset, this defaults to 90 days.\nMinimum accepted duration is 1 hour.\nValue must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration.", + dnsName: { + description: "dnsName is the identifier that this challenge is for, e.g. example.com.\nIf the requested DNSName is a 'wildcard', this field MUST be set to the\nnon-wildcard domain, e.g. for `*.example.com`, it must be `example.com`.", type: "string" }, - emailAddresses: { - description: "Requested email subject alternative names.", - items: { - type: "string" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - }, - encodeUsagesInRequest: { - description: "Whether the KeyUsage and ExtKeyUsage extensions should be set in the encoded CSR.\n\nThis option defaults to true, and should only be disabled if the target\nissuer does not support CSRs with these X509 KeyUsage/ ExtKeyUsage extensions.", - type: "boolean" - }, - ipAddresses: { - description: "Requested IP address subject alternative names.", - items: { - type: "string" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - }, - isCA: { - description: "Requested basic constraints isCA value.\nThe isCA value is used to set the `isCA` field on the created CertificateRequest\nresources. Note that the issuer may choose to ignore the requested isCA value, just\nlike any other requested attribute.\n\nIf true, this will automatically add the `cert sign` usage to the list\nof requested `usages`.", - type: "boolean" - }, issuerRef: { - description: "Reference to the issuer responsible for issuing the certificate.\nIf the issuer is namespace-scoped, it must be in the same namespace\nas the Certificate. If the issuer is cluster-scoped, it can be used\nfrom any namespace.\n\nThe `name` field of the reference must always be specified.", + description: "References a properly configured ACME-type Issuer which should\nbe used to create this Challenge.\nIf the Issuer does not exist, processing will be retried.\nIf the Issuer is not an 'ACME' Issuer, an error will be returned and the\nChallenge will be marked as failed.", properties: { group: { - description: "Group of the issuer being referred to.\nDefaults to 'cert-manager.io'.", + description: "Group of the resource being referred to.", type: "string" }, kind: { - description: "Kind of the issuer being referred to.\nDefaults to 'Issuer'.", + description: "Kind of the resource being referred to.", type: "string" }, name: { - description: "Name of the issuer being referred to.", + description: "Name of the resource being referred to.", type: "string" } }, required: ["name"], type: "object" }, - keystores: { - description: "Additional keystore output formats to be stored in the Certificate's Secret.", + key: { + description: "The ACME challenge key for this challenge\nFor HTTP01 challenges, this is the value that must be responded with to\ncomplete the HTTP01 challenge in the format:\n`.`.\nFor DNS01 challenges, this is the base64 encoded SHA256 sum of the\n`.`\ntext that must be set as the TXT record content.", + type: "string" + }, + solver: { + description: "Contains the domain solving configuration that should be used to\nsolve this challenge resource.", properties: { - jks: { - description: "JKS configures options for storing a JKS keystore in the\n`spec.secretName` Secret resource.", + dns01: { + description: "Configures cert-manager to attempt to complete authorizations by\nperforming the DNS01 challenge flow.", properties: { - alias: { - description: "Alias specifies the alias of the key in the keystore, required by the JKS format.\nIf not provided, the default alias `certificate` will be used.", + acmeDNS: { + description: "Use the 'ACME DNS' (https://github.com/joohoi/acme-dns) API to manage\nDNS01 challenge records.", + properties: { + accountSecretRef: { + description: "A reference to a specific 'key' within a Secret resource.\nIn some instances, `key` is a required field.", + properties: { + key: { + description: "The key of the entry in the Secret resource's `data` field to be used.\nSome instances of this field may be defaulted, in others it may be\nrequired.", + type: "string" + }, + name: { + description: "Name of the resource being referred to.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + } + }, + required: ["name"], + type: "object" + }, + host: { + type: "string" + } + }, + required: ["accountSecretRef", "host"], + type: "object" + }, + akamai: { + description: "Use the Akamai DNS zone management API to manage DNS01 challenge records.", + properties: { + accessTokenSecretRef: { + description: "A reference to a specific 'key' within a Secret resource.\nIn some instances, `key` is a required field.", + properties: { + key: { + description: "The key of the entry in the Secret resource's `data` field to be used.\nSome instances of this field may be defaulted, in others it may be\nrequired.", + type: "string" + }, + name: { + description: "Name of the resource being referred to.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + } + }, + required: ["name"], + type: "object" + }, + clientSecretSecretRef: { + description: "A reference to a specific 'key' within a Secret resource.\nIn some instances, `key` is a required field.", + properties: { + key: { + description: "The key of the entry in the Secret resource's `data` field to be used.\nSome instances of this field may be defaulted, in others it may be\nrequired.", + type: "string" + }, + name: { + description: "Name of the resource being referred to.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + } + }, + required: ["name"], + type: "object" + }, + clientTokenSecretRef: { + description: "A reference to a specific 'key' within a Secret resource.\nIn some instances, `key` is a required field.", + properties: { + key: { + description: "The key of the entry in the Secret resource's `data` field to be used.\nSome instances of this field may be defaulted, in others it may be\nrequired.", + type: "string" + }, + name: { + description: "Name of the resource being referred to.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + } + }, + required: ["name"], + type: "object" + }, + serviceConsumerDomain: { + type: "string" + } + }, + required: ["accessTokenSecretRef", "clientSecretSecretRef", "clientTokenSecretRef", "serviceConsumerDomain"], + type: "object" + }, + azureDNS: { + description: "Use the Microsoft Azure DNS API to manage DNS01 challenge records.", + properties: { + clientID: { + description: "Auth: Azure Service Principal:\nThe ClientID of the Azure Service Principal used to authenticate with Azure DNS.\nIf set, ClientSecret and TenantID must also be set.", + type: "string" + }, + clientSecretSecretRef: { + description: "Auth: Azure Service Principal:\nA reference to a Secret containing the password associated with the Service Principal.\nIf set, ClientID and TenantID must also be set.", + properties: { + key: { + description: "The key of the entry in the Secret resource's `data` field to be used.\nSome instances of this field may be defaulted, in others it may be\nrequired.", + type: "string" + }, + name: { + description: "Name of the resource being referred to.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + } + }, + required: ["name"], + type: "object" + }, + environment: { + description: "name of the Azure environment (default AzurePublicCloud)", + enum: ["AzurePublicCloud", "AzureChinaCloud", "AzureGermanCloud", "AzureUSGovernmentCloud"], + type: "string" + }, + hostedZoneName: { + description: "name of the DNS zone that should be used", + type: "string" + }, + managedIdentity: { + description: "Auth: Azure Workload Identity or Azure Managed Service Identity:\nSettings to enable Azure Workload Identity or Azure Managed Service Identity\nIf set, ClientID, ClientSecret and TenantID must not be set.", + properties: { + clientID: { + description: "client ID of the managed identity, can not be used at the same time as resourceID", + type: "string" + }, + resourceID: { + description: "resource ID of the managed identity, can not be used at the same time as clientID\nCannot be used for Azure Managed Service Identity", + type: "string" + }, + tenantID: { + description: "tenant ID of the managed identity, can not be used at the same time as resourceID", + type: "string" + } + }, + type: "object" + }, + resourceGroupName: { + description: "resource group the DNS zone is located in", + type: "string" + }, + subscriptionID: { + description: "ID of the Azure subscription", + type: "string" + }, + tenantID: { + description: "Auth: Azure Service Principal:\nThe TenantID of the Azure Service Principal used to authenticate with Azure DNS.\nIf set, ClientID and ClientSecret must also be set.", + type: "string" + } + }, + required: ["resourceGroupName", "subscriptionID"], + type: "object" + }, + cloudDNS: { + description: "Use the Google Cloud DNS API to manage DNS01 challenge records.", + properties: { + hostedZoneName: { + description: "HostedZoneName is an optional field that tells cert-manager in which\nCloud DNS zone the challenge record has to be created.\nIf left empty cert-manager will automatically choose a zone.", + type: "string" + }, + project: { + type: "string" + }, + serviceAccountSecretRef: { + description: "A reference to a specific 'key' within a Secret resource.\nIn some instances, `key` is a required field.", + properties: { + key: { + description: "The key of the entry in the Secret resource's `data` field to be used.\nSome instances of this field may be defaulted, in others it may be\nrequired.", + type: "string" + }, + name: { + description: "Name of the resource being referred to.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + } + }, + required: ["name"], + type: "object" + } + }, + required: ["project"], + type: "object" + }, + cloudflare: { + description: "Use the Cloudflare API to manage DNS01 challenge records.", + properties: { + apiKeySecretRef: { + description: "API key to use to authenticate with Cloudflare.\nNote: using an API token to authenticate is now the recommended method\nas it allows greater control of permissions.", + properties: { + key: { + description: "The key of the entry in the Secret resource's `data` field to be used.\nSome instances of this field may be defaulted, in others it may be\nrequired.", + type: "string" + }, + name: { + description: "Name of the resource being referred to.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + } + }, + required: ["name"], + type: "object" + }, + apiTokenSecretRef: { + description: "API token used to authenticate with Cloudflare.", + properties: { + key: { + description: "The key of the entry in the Secret resource's `data` field to be used.\nSome instances of this field may be defaulted, in others it may be\nrequired.", + type: "string" + }, + name: { + description: "Name of the resource being referred to.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + } + }, + required: ["name"], + type: "object" + }, + email: { + description: "Email of the account, only required when using API key based authentication.", + type: "string" + } + }, + type: "object" + }, + cnameStrategy: { + description: "CNAMEStrategy configures how the DNS01 provider should handle CNAME\nrecords when found in DNS zones.", + enum: ["None", "Follow"], type: "string" }, - create: { - description: "Create enables JKS keystore creation for the Certificate.\nIf true, a file named `keystore.jks` will be created in the target\nSecret resource, encrypted using the password stored in\n`passwordSecretRef` or `password`.\nThe keystore file will be updated immediately.\nIf the issuer provided a CA certificate, a file named `truststore.jks`\nwill also be created in the target Secret resource, encrypted using the\npassword stored in `passwordSecretRef`\ncontaining the issuing Certificate Authority", - type: "boolean" + digitalocean: { + description: "Use the DigitalOcean DNS API to manage DNS01 challenge records.", + properties: { + tokenSecretRef: { + description: "A reference to a specific 'key' within a Secret resource.\nIn some instances, `key` is a required field.", + properties: { + key: { + description: "The key of the entry in the Secret resource's `data` field to be used.\nSome instances of this field may be defaulted, in others it may be\nrequired.", + type: "string" + }, + name: { + description: "Name of the resource being referred to.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + } + }, + required: ["name"], + type: "object" + } + }, + required: ["tokenSecretRef"], + type: "object" + }, + rfc2136: { + description: "Use RFC2136 (\"Dynamic Updates in the Domain Name System\") (https://datatracker.ietf.org/doc/rfc2136/)\nto manage DNS01 challenge records.", + properties: { + nameserver: { + description: "The IP address or hostname of an authoritative DNS server supporting\nRFC2136 in the form host:port. If the host is an IPv6 address it must be\nenclosed in square brackets (e.g [2001:db8::1])\xA0; port is optional.\nThis field is required.", + type: "string" + }, + tsigAlgorithm: { + description: "The TSIG Algorithm configured in the DNS supporting RFC2136. Used only\nwhen ``tsigSecretSecretRef`` and ``tsigKeyName`` are defined.\nSupported values are (case-insensitive): ``HMACMD5`` (default),\n``HMACSHA1``, ``HMACSHA256`` or ``HMACSHA512``.", + type: "string" + }, + tsigKeyName: { + description: "The TSIG Key name configured in the DNS.\nIf ``tsigSecretSecretRef`` is defined, this field is required.", + type: "string" + }, + tsigSecretSecretRef: { + description: "The name of the secret containing the TSIG value.\nIf ``tsigKeyName`` is defined, this field is required.", + properties: { + key: { + description: "The key of the entry in the Secret resource's `data` field to be used.\nSome instances of this field may be defaulted, in others it may be\nrequired.", + type: "string" + }, + name: { + description: "Name of the resource being referred to.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + } + }, + required: ["name"], + type: "object" + } + }, + required: ["nameserver"], + type: "object" }, - password: { - description: "Password provides a literal password used to encrypt the JKS keystore.\nMutually exclusive with passwordSecretRef.\nOne of password or passwordSecretRef must provide a password with a non-zero length.", - type: "string" + route53: { + description: "Use the AWS Route53 API to manage DNS01 challenge records.", + properties: { + accessKeyID: { + description: "The AccessKeyID is used for authentication.\nCannot be set when SecretAccessKeyID is set.\nIf neither the Access Key nor Key ID are set, we fall-back to using env\nvars, shared credentials file or AWS Instance metadata,\nsee: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials", + type: "string" + }, + accessKeyIDSecretRef: { + description: "The SecretAccessKey is used for authentication. If set, pull the AWS\naccess key ID from a key within a Kubernetes Secret.\nCannot be set when AccessKeyID is set.\nIf neither the Access Key nor Key ID are set, we fall-back to using env\nvars, shared credentials file or AWS Instance metadata,\nsee: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials", + properties: { + key: { + description: "The key of the entry in the Secret resource's `data` field to be used.\nSome instances of this field may be defaulted, in others it may be\nrequired.", + type: "string" + }, + name: { + description: "Name of the resource being referred to.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + } + }, + required: ["name"], + type: "object" + }, + auth: { + description: "Auth configures how cert-manager authenticates.", + properties: { + kubernetes: { + description: "Kubernetes authenticates with Route53 using AssumeRoleWithWebIdentity\nby passing a bound ServiceAccount token.", + properties: { + serviceAccountRef: { + description: "A reference to a service account that will be used to request a bound\ntoken (also known as \"projected token\"). To use this field, you must\nconfigure an RBAC rule to let cert-manager request a token.", + properties: { + audiences: { + description: "TokenAudiences is an optional list of audiences to include in the\ntoken passed to AWS. The default token consisting of the issuer's namespace\nand name is always included.\nIf unset the audience defaults to `sts.amazonaws.com`.", + items: { + type: "string" + }, + type: "array" + }, + name: { + description: "Name of the ServiceAccount used to request a token.", + type: "string" + } + }, + required: ["name"], + type: "object" + } + }, + required: ["serviceAccountRef"], + type: "object" + } + }, + required: ["kubernetes"], + type: "object" + }, + hostedZoneID: { + description: "If set, the provider will manage only this zone in Route53 and will not do a lookup using the route53:ListHostedZonesByName api call.", + type: "string" + }, + region: { + description: "Override the AWS region.\n\nRoute53 is a global service and does not have regional endpoints but the\nregion specified here (or via environment variables) is used as a hint to\nhelp compute the correct AWS credential scope and partition when it\nconnects to Route53. See:\n- [Amazon Route 53 endpoints and quotas](https://docs.aws.amazon.com/general/latest/gr/r53.html)\n- [Global services](https://docs.aws.amazon.com/whitepapers/latest/aws-fault-isolation-boundaries/global-services.html)\n\nIf you omit this region field, cert-manager will use the region from\nAWS_REGION and AWS_DEFAULT_REGION environment variables, if they are set\nin the cert-manager controller Pod.\n\nThe `region` field is not needed if you use [IAM Roles for Service Accounts (IRSA)](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html).\nInstead an AWS_REGION environment variable is added to the cert-manager controller Pod by:\n[Amazon EKS Pod Identity Webhook](https://github.com/aws/amazon-eks-pod-identity-webhook).\nIn this case this `region` field value is ignored.\n\nThe `region` field is not needed if you use [EKS Pod Identities](https://docs.aws.amazon.com/eks/latest/userguide/pod-identities.html).\nInstead an AWS_REGION environment variable is added to the cert-manager controller Pod by:\n[Amazon EKS Pod Identity Agent](https://github.com/aws/eks-pod-identity-agent),\nIn this case this `region` field value is ignored.", + type: "string" + }, + role: { + description: "Role is a Role ARN which the Route53 provider will assume using either the explicit credentials AccessKeyID/SecretAccessKey\nor the inferred credentials from environment variables, shared credentials file or AWS Instance metadata", + type: "string" + }, + secretAccessKeySecretRef: { + description: "The SecretAccessKey is used for authentication.\nIf neither the Access Key nor Key ID are set, we fall-back to using env\nvars, shared credentials file or AWS Instance metadata,\nsee: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials", + properties: { + key: { + description: "The key of the entry in the Secret resource's `data` field to be used.\nSome instances of this field may be defaulted, in others it may be\nrequired.", + type: "string" + }, + name: { + description: "Name of the resource being referred to.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + } + }, + required: ["name"], + type: "object" + } + }, + type: "object" }, - passwordSecretRef: { - description: "PasswordSecretRef is a reference to a non-empty key in a Secret resource\ncontaining the password used to encrypt the JKS keystore.\nMutually exclusive with password.\nOne of password or passwordSecretRef must provide a password with a non-zero length.", + webhook: { + description: "Configure an external webhook based DNS01 challenge solver to manage\nDNS01 challenge records.", properties: { - key: { - description: "The key of the entry in the Secret resource's `data` field to be used.\nSome instances of this field may be defaulted, in others it may be\nrequired.", + config: { + description: "Additional configuration that should be passed to the webhook apiserver\nwhen challenges are processed.\nThis can contain arbitrary JSON data.\nSecret values should not be specified in this stanza.\nIf secret values are needed (e.g. credentials for a DNS service), you\nshould use a SecretKeySelector to reference a Secret resource.\nFor details on the schema of this field, consult the webhook provider\nimplementation's documentation.", + "x-kubernetes-preserve-unknown-fields": true + }, + groupName: { + description: "The API group name that should be used when POSTing ChallengePayload\nresources to the webhook apiserver.\nThis should be the same as the GroupName specified in the webhook\nprovider implementation.", type: "string" }, - name: { - description: "Name of the resource being referred to.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + solverName: { + description: "The name of the solver to use, as defined in the webhook provider\nimplementation.\nThis will typically be the name of the provider, e.g. 'cloudflare'.", + type: "string" + } + }, + required: ["groupName", "solverName"], + type: "object" + } + }, + type: "object" + }, + http01: { + description: "Configures cert-manager to attempt to complete authorizations by\nperforming the HTTP01 challenge flow.\nIt is not possible to obtain certificates for wildcard domain names\n(e.g. `*.example.com`) using the HTTP01 challenge mechanism.", + properties: { + gatewayHTTPRoute: { + description: "The Gateway API is a sig-network community API that models service networking\nin Kubernetes (https://gateway-api.sigs.k8s.io/). The Gateway solver will\ncreate HTTPRoutes with the specified labels in the same namespace as the challenge.\nThis solver is experimental, and fields / behaviour may change in the future.", + properties: { + labels: { + additionalProperties: { + type: "string" + }, + description: "Custom labels that will be applied to HTTPRoutes created by cert-manager\nwhile solving HTTP-01 challenges.", + type: "object" + }, + parentRefs: { + description: "When solving an HTTP-01 challenge, cert-manager creates an HTTPRoute.\ncert-manager needs to know which parentRefs should be used when creating\nthe HTTPRoute. Usually, the parentRef references a Gateway. See:\nhttps://gateway-api.sigs.k8s.io/api-types/httproute/#attaching-to-gateways", + items: { + description: "ParentReference identifies an API object (usually a Gateway) that can be considered\na parent of this resource (usually a route). There are two kinds of parent resources\nwith \"Core\" support:\n\n* Gateway (Gateway conformance profile)\n* Service (Mesh conformance profile, ClusterIP Services only)\n\nThis API may be extended in the future to support additional kinds of parent\nresources.\n\nThe API object must be valid in the cluster; the Group and Kind must\nbe registered in the cluster for this reference to be valid.", + properties: { + group: { + default: "gateway.networking.k8s.io", + description: "Group is the group of the referent.\nWhen unspecified, \"gateway.networking.k8s.io\" is inferred.\nTo set the core API group (such as for a \"Service\" kind referent),\nGroup must be explicitly set to \"\" (empty string).\n\nSupport: Core", + maxLength: 253, + pattern: "^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$", + type: "string" + }, + kind: { + default: "Gateway", + description: "Kind is kind of the referent.\n\nThere are two kinds of parent resources with \"Core\" support:\n\n* Gateway (Gateway conformance profile)\n* Service (Mesh conformance profile, ClusterIP Services only)\n\nSupport for other resources is Implementation-Specific.", + maxLength: 63, + minLength: 1, + pattern: "^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$", + type: "string" + }, + name: { + description: "Name is the name of the referent.\n\nSupport: Core", + maxLength: 253, + minLength: 1, + type: "string" + }, + namespace: { + description: "Namespace is the namespace of the referent. When unspecified, this refers\nto the local namespace of the Route.\n\nNote that there are specific rules for ParentRefs which cross namespace\nboundaries. Cross-namespace references are only valid if they are explicitly\nallowed by something in the namespace they are referring to. For example:\nGateway has the AllowedRoutes field, and ReferenceGrant provides a\ngeneric way to enable any other kind of cross-namespace reference.\n\n\nParentRefs from a Route to a Service in the same namespace are \"producer\"\nroutes, which apply default routing rules to inbound connections from\nany namespace to the Service.\n\nParentRefs from a Route to a Service in a different namespace are\n\"consumer\" routes, and these routing rules are only applied to outbound\nconnections originating from the same namespace as the Route, for which\nthe intended destination of the connections are a Service targeted as a\nParentRef of the Route.\n\n\nSupport: Core", + maxLength: 63, + minLength: 1, + pattern: "^[a-z0-9]([-a-z0-9]*[a-z0-9])?$", + type: "string" + }, + port: { + description: "Port is the network port this Route targets. It can be interpreted\ndifferently based on the type of parent resource.\n\nWhen the parent resource is a Gateway, this targets all listeners\nlistening on the specified port that also support this kind of Route(and\nselect this Route). It's not recommended to set `Port` unless the\nnetworking behaviors specified in a Route must apply to a specific port\nas opposed to a listener(s) whose port(s) may be changed. When both Port\nand SectionName are specified, the name and port of the selected listener\nmust match both specified values.\n\n\nWhen the parent resource is a Service, this targets a specific port in the\nService spec. When both Port (experimental) and SectionName are specified,\nthe name and port of the selected port must match both specified values.\n\n\nImplementations MAY choose to support other parent resources.\nImplementations supporting other types of parent resources MUST clearly\ndocument how/if Port is interpreted.\n\nFor the purpose of status, an attachment is considered successful as\nlong as the parent resource accepts it partially. For example, Gateway\nlisteners can restrict which Routes can attach to them by Route kind,\nnamespace, or hostname. If 1 of 2 Gateway listeners accept attachment\nfrom the referencing Route, the Route MUST be considered successfully\nattached. If no Gateway listeners accept attachment from this Route,\nthe Route MUST be considered detached from the Gateway.\n\nSupport: Extended", + format: "int32", + maximum: 65535, + minimum: 1, + type: "integer" + }, + sectionName: { + description: "SectionName is the name of a section within the target resource. In the\nfollowing resources, SectionName is interpreted as the following:\n\n* Gateway: Listener name. When both Port (experimental) and SectionName\nare specified, the name and port of the selected listener must match\nboth specified values.\n* Service: Port name. When both Port (experimental) and SectionName\nare specified, the name and port of the selected listener must match\nboth specified values.\n\nImplementations MAY choose to support attaching Routes to other resources.\nIf that is the case, they MUST clearly document how SectionName is\ninterpreted.\n\nWhen unspecified (empty string), this will reference the entire resource.\nFor the purpose of status, an attachment is considered successful if at\nleast one section in the parent resource accepts it. For example, Gateway\nlisteners can restrict which Routes can attach to them by Route kind,\nnamespace, or hostname. If 1 of 2 Gateway listeners accept attachment from\nthe referencing Route, the Route MUST be considered successfully\nattached. If no Gateway listeners accept attachment from this Route, the\nRoute MUST be considered detached from the Gateway.\n\nSupport: Core", + maxLength: 253, + minLength: 1, + pattern: "^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$", + type: "string" + } + }, + required: ["name"], + type: "object" + }, + type: "array" + }, + podTemplate: { + description: "Optional pod template used to configure the ACME challenge solver pods\nused for HTTP01 challenges.", + properties: { + metadata: { + description: "ObjectMeta overrides for the pod used to solve HTTP01 challenges.\nOnly the 'labels' and 'annotations' fields may be set.\nIf labels or annotations overlap with in-built values, the values here\nwill override the in-built values.", + properties: { + annotations: { + additionalProperties: { + type: "string" + }, + description: "Annotations that should be added to the created ACME HTTP01 solver pods.", + type: "object" + }, + labels: { + additionalProperties: { + type: "string" + }, + description: "Labels that should be added to the created ACME HTTP01 solver pods.", + type: "object" + } + }, + type: "object" + }, + spec: { + description: "PodSpec defines overrides for the HTTP01 challenge solver pod.\nCheck ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields.\nAll other fields will be ignored.", + properties: { + affinity: { + description: "If specified, the pod's scheduling constraints", + properties: { + nodeAffinity: { + description: "Describes node affinity scheduling rules for the pod.", + properties: { + preferredDuringSchedulingIgnoredDuringExecution: { + description: "The scheduler will prefer to schedule pods to nodes that satisfy\nthe affinity expressions specified by this field, but it may choose\na node that violates one or more of the expressions. The node that is\nmost preferred is the one with the greatest sum of weights, i.e.\nfor each node that meets all of the scheduling requirements (resource\nrequest, requiredDuringScheduling affinity expressions, etc.),\ncompute a sum by iterating through the elements of this field and adding\n\"weight\" to the sum if the node matches the corresponding matchExpressions; the\nnode(s) with the highest sum are the most preferred.", + items: { + description: "An empty preferred scheduling term matches all objects with implicit weight 0\n(i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).", + properties: { + preference: { + description: "A node selector term, associated with the corresponding weight.", + properties: { + matchExpressions: { + description: "A list of node selector requirements by node's labels.", + items: { + description: "A node selector requirement is a selector that contains values, a key, and an operator\nthat relates the key and values.", + properties: { + key: { + description: "The label key that the selector applies to.", + type: "string" + }, + operator: { + description: "Represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.", + type: "string" + }, + values: { + description: "An array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. If the operator is Gt or Lt, the values\narray must have a single element, which will be interpreted as an integer.\nThis array is replaced during a strategic merge patch.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + required: ["key", "operator"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + matchFields: { + description: "A list of node selector requirements by node's fields.", + items: { + description: "A node selector requirement is a selector that contains values, a key, and an operator\nthat relates the key and values.", + properties: { + key: { + description: "The label key that the selector applies to.", + type: "string" + }, + operator: { + description: "Represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.", + type: "string" + }, + values: { + description: "An array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. If the operator is Gt or Lt, the values\narray must have a single element, which will be interpreted as an integer.\nThis array is replaced during a strategic merge patch.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + required: ["key", "operator"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + weight: { + description: "Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100.", + format: "int32", + type: "integer" + } + }, + required: ["preference", "weight"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + requiredDuringSchedulingIgnoredDuringExecution: { + description: "If the affinity requirements specified by this field are not met at\nscheduling time, the pod will not be scheduled onto the node.\nIf the affinity requirements specified by this field cease to be met\nat some point during pod execution (e.g. due to an update), the system\nmay or may not try to eventually evict the pod from its node.", + properties: { + nodeSelectorTerms: { + description: "Required. A list of node selector terms. The terms are ORed.", + items: { + description: "A null or empty node selector term matches no objects. The requirements of\nthem are ANDed.\nThe TopologySelectorTerm type implements a subset of the NodeSelectorTerm.", + properties: { + matchExpressions: { + description: "A list of node selector requirements by node's labels.", + items: { + description: "A node selector requirement is a selector that contains values, a key, and an operator\nthat relates the key and values.", + properties: { + key: { + description: "The label key that the selector applies to.", + type: "string" + }, + operator: { + description: "Represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.", + type: "string" + }, + values: { + description: "An array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. If the operator is Gt or Lt, the values\narray must have a single element, which will be interpreted as an integer.\nThis array is replaced during a strategic merge patch.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + required: ["key", "operator"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + matchFields: { + description: "A list of node selector requirements by node's fields.", + items: { + description: "A node selector requirement is a selector that contains values, a key, and an operator\nthat relates the key and values.", + properties: { + key: { + description: "The label key that the selector applies to.", + type: "string" + }, + operator: { + description: "Represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.", + type: "string" + }, + values: { + description: "An array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. If the operator is Gt or Lt, the values\narray must have a single element, which will be interpreted as an integer.\nThis array is replaced during a strategic merge patch.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + required: ["key", "operator"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + required: ["nodeSelectorTerms"], + type: "object", + "x-kubernetes-map-type": "atomic" + } + }, + type: "object" + }, + podAffinity: { + description: "Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).", + properties: { + preferredDuringSchedulingIgnoredDuringExecution: { + description: "The scheduler will prefer to schedule pods to nodes that satisfy\nthe affinity expressions specified by this field, but it may choose\na node that violates one or more of the expressions. The node that is\nmost preferred is the one with the greatest sum of weights, i.e.\nfor each node that meets all of the scheduling requirements (resource\nrequest, requiredDuringScheduling affinity expressions, etc.),\ncompute a sum by iterating through the elements of this field and adding\n\"weight\" to the sum if the node has pods which matches the corresponding podAffinityTerm; the\nnode(s) with the highest sum are the most preferred.", + items: { + description: "The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)", + properties: { + podAffinityTerm: { + description: "Required. A pod affinity term, associated with the corresponding weight.", + properties: { + labelSelector: { + description: "A label query over a set of resources, in this case pods.\nIf it's null, this PodAffinityTerm matches with no Pods.", + properties: { + matchExpressions: { + description: "matchExpressions is a list of label selector requirements. The requirements are ANDed.", + items: { + description: "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", + properties: { + key: { + description: "key is the label key that the selector applies to.", + type: "string" + }, + operator: { + description: "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", + type: "string" + }, + values: { + description: "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + required: ["key", "operator"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + matchLabels: { + additionalProperties: { + type: "string" + }, + description: "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", + type: "object" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + matchLabelKeys: { + description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + mismatchLabelKeys: { + description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + namespaces: { + description: "namespaces specifies a static list of namespace names that the term applies to.\nThe term is applied to the union of the namespaces listed in this field\nand the ones selected by namespaceSelector.\nnull or empty namespaces list and null namespaceSelector means \"this pod's namespace\".", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + namespaceSelector: { + description: "A label query over the set of namespaces that the term applies to.\nThe term is applied to the union of the namespaces selected by this field\nand the ones listed in the namespaces field.\nnull selector and null or empty namespaces list means \"this pod's namespace\".\nAn empty selector ({}) matches all namespaces.", + properties: { + matchExpressions: { + description: "matchExpressions is a list of label selector requirements. The requirements are ANDed.", + items: { + description: "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", + properties: { + key: { + description: "key is the label key that the selector applies to.", + type: "string" + }, + operator: { + description: "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", + type: "string" + }, + values: { + description: "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + required: ["key", "operator"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + matchLabels: { + additionalProperties: { + type: "string" + }, + description: "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", + type: "object" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + topologyKey: { + description: "This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching\nthe labelSelector in the specified namespaces, where co-located is defined as running on a node\nwhose value of the label with key topologyKey matches that of any node on which any of the\nselected pods is running.\nEmpty topologyKey is not allowed.", + type: "string" + } + }, + required: ["topologyKey"], + type: "object" + }, + weight: { + description: "weight associated with matching the corresponding podAffinityTerm,\nin the range 1-100.", + format: "int32", + type: "integer" + } + }, + required: ["podAffinityTerm", "weight"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + requiredDuringSchedulingIgnoredDuringExecution: { + description: "If the affinity requirements specified by this field are not met at\nscheduling time, the pod will not be scheduled onto the node.\nIf the affinity requirements specified by this field cease to be met\nat some point during pod execution (e.g. due to a pod label update), the\nsystem may or may not try to eventually evict the pod from its node.\nWhen there are multiple elements, the lists of nodes corresponding to each\npodAffinityTerm are intersected, i.e. all terms must be satisfied.", + items: { + description: "Defines a set of pods (namely those matching the labelSelector\nrelative to the given namespace(s)) that this pod should be\nco-located (affinity) or not co-located (anti-affinity) with,\nwhere co-located is defined as running on a node whose value of\nthe label with key matches that of any node on which\na pod of the set of pods is running", + properties: { + labelSelector: { + description: "A label query over a set of resources, in this case pods.\nIf it's null, this PodAffinityTerm matches with no Pods.", + properties: { + matchExpressions: { + description: "matchExpressions is a list of label selector requirements. The requirements are ANDed.", + items: { + description: "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", + properties: { + key: { + description: "key is the label key that the selector applies to.", + type: "string" + }, + operator: { + description: "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", + type: "string" + }, + values: { + description: "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + required: ["key", "operator"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + matchLabels: { + additionalProperties: { + type: "string" + }, + description: "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", + type: "object" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + matchLabelKeys: { + description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + mismatchLabelKeys: { + description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + namespaces: { + description: "namespaces specifies a static list of namespace names that the term applies to.\nThe term is applied to the union of the namespaces listed in this field\nand the ones selected by namespaceSelector.\nnull or empty namespaces list and null namespaceSelector means \"this pod's namespace\".", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + namespaceSelector: { + description: "A label query over the set of namespaces that the term applies to.\nThe term is applied to the union of the namespaces selected by this field\nand the ones listed in the namespaces field.\nnull selector and null or empty namespaces list means \"this pod's namespace\".\nAn empty selector ({}) matches all namespaces.", + properties: { + matchExpressions: { + description: "matchExpressions is a list of label selector requirements. The requirements are ANDed.", + items: { + description: "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", + properties: { + key: { + description: "key is the label key that the selector applies to.", + type: "string" + }, + operator: { + description: "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", + type: "string" + }, + values: { + description: "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + required: ["key", "operator"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + matchLabels: { + additionalProperties: { + type: "string" + }, + description: "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", + type: "object" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + topologyKey: { + description: "This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching\nthe labelSelector in the specified namespaces, where co-located is defined as running on a node\nwhose value of the label with key topologyKey matches that of any node on which any of the\nselected pods is running.\nEmpty topologyKey is not allowed.", + type: "string" + } + }, + required: ["topologyKey"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + podAntiAffinity: { + description: "Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).", + properties: { + preferredDuringSchedulingIgnoredDuringExecution: { + description: "The scheduler will prefer to schedule pods to nodes that satisfy\nthe anti-affinity expressions specified by this field, but it may choose\na node that violates one or more of the expressions. The node that is\nmost preferred is the one with the greatest sum of weights, i.e.\nfor each node that meets all of the scheduling requirements (resource\nrequest, requiredDuringScheduling anti-affinity expressions, etc.),\ncompute a sum by iterating through the elements of this field and adding\n\"weight\" to the sum if the node has pods which matches the corresponding podAffinityTerm; the\nnode(s) with the highest sum are the most preferred.", + items: { + description: "The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)", + properties: { + podAffinityTerm: { + description: "Required. A pod affinity term, associated with the corresponding weight.", + properties: { + labelSelector: { + description: "A label query over a set of resources, in this case pods.\nIf it's null, this PodAffinityTerm matches with no Pods.", + properties: { + matchExpressions: { + description: "matchExpressions is a list of label selector requirements. The requirements are ANDed.", + items: { + description: "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", + properties: { + key: { + description: "key is the label key that the selector applies to.", + type: "string" + }, + operator: { + description: "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", + type: "string" + }, + values: { + description: "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + required: ["key", "operator"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + matchLabels: { + additionalProperties: { + type: "string" + }, + description: "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", + type: "object" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + matchLabelKeys: { + description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + mismatchLabelKeys: { + description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + namespaces: { + description: "namespaces specifies a static list of namespace names that the term applies to.\nThe term is applied to the union of the namespaces listed in this field\nand the ones selected by namespaceSelector.\nnull or empty namespaces list and null namespaceSelector means \"this pod's namespace\".", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + namespaceSelector: { + description: "A label query over the set of namespaces that the term applies to.\nThe term is applied to the union of the namespaces selected by this field\nand the ones listed in the namespaces field.\nnull selector and null or empty namespaces list means \"this pod's namespace\".\nAn empty selector ({}) matches all namespaces.", + properties: { + matchExpressions: { + description: "matchExpressions is a list of label selector requirements. The requirements are ANDed.", + items: { + description: "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", + properties: { + key: { + description: "key is the label key that the selector applies to.", + type: "string" + }, + operator: { + description: "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", + type: "string" + }, + values: { + description: "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + required: ["key", "operator"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + matchLabels: { + additionalProperties: { + type: "string" + }, + description: "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", + type: "object" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + topologyKey: { + description: "This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching\nthe labelSelector in the specified namespaces, where co-located is defined as running on a node\nwhose value of the label with key topologyKey matches that of any node on which any of the\nselected pods is running.\nEmpty topologyKey is not allowed.", + type: "string" + } + }, + required: ["topologyKey"], + type: "object" + }, + weight: { + description: "weight associated with matching the corresponding podAffinityTerm,\nin the range 1-100.", + format: "int32", + type: "integer" + } + }, + required: ["podAffinityTerm", "weight"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + requiredDuringSchedulingIgnoredDuringExecution: { + description: "If the anti-affinity requirements specified by this field are not met at\nscheduling time, the pod will not be scheduled onto the node.\nIf the anti-affinity requirements specified by this field cease to be met\nat some point during pod execution (e.g. due to a pod label update), the\nsystem may or may not try to eventually evict the pod from its node.\nWhen there are multiple elements, the lists of nodes corresponding to each\npodAffinityTerm are intersected, i.e. all terms must be satisfied.", + items: { + description: "Defines a set of pods (namely those matching the labelSelector\nrelative to the given namespace(s)) that this pod should be\nco-located (affinity) or not co-located (anti-affinity) with,\nwhere co-located is defined as running on a node whose value of\nthe label with key matches that of any node on which\na pod of the set of pods is running", + properties: { + labelSelector: { + description: "A label query over a set of resources, in this case pods.\nIf it's null, this PodAffinityTerm matches with no Pods.", + properties: { + matchExpressions: { + description: "matchExpressions is a list of label selector requirements. The requirements are ANDed.", + items: { + description: "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", + properties: { + key: { + description: "key is the label key that the selector applies to.", + type: "string" + }, + operator: { + description: "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", + type: "string" + }, + values: { + description: "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + required: ["key", "operator"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + matchLabels: { + additionalProperties: { + type: "string" + }, + description: "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", + type: "object" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + matchLabelKeys: { + description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + mismatchLabelKeys: { + description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + namespaces: { + description: "namespaces specifies a static list of namespace names that the term applies to.\nThe term is applied to the union of the namespaces listed in this field\nand the ones selected by namespaceSelector.\nnull or empty namespaces list and null namespaceSelector means \"this pod's namespace\".", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + namespaceSelector: { + description: "A label query over the set of namespaces that the term applies to.\nThe term is applied to the union of the namespaces selected by this field\nand the ones listed in the namespaces field.\nnull selector and null or empty namespaces list means \"this pod's namespace\".\nAn empty selector ({}) matches all namespaces.", + properties: { + matchExpressions: { + description: "matchExpressions is a list of label selector requirements. The requirements are ANDed.", + items: { + description: "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", + properties: { + key: { + description: "key is the label key that the selector applies to.", + type: "string" + }, + operator: { + description: "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", + type: "string" + }, + values: { + description: "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + required: ["key", "operator"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + matchLabels: { + additionalProperties: { + type: "string" + }, + description: "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", + type: "object" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + topologyKey: { + description: "This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching\nthe labelSelector in the specified namespaces, where co-located is defined as running on a node\nwhose value of the label with key topologyKey matches that of any node on which any of the\nselected pods is running.\nEmpty topologyKey is not allowed.", + type: "string" + } + }, + required: ["topologyKey"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + } + }, + type: "object" + }, + imagePullSecrets: { + description: "If specified, the pod's imagePullSecrets", + items: { + description: "LocalObjectReference contains enough information to let you locate the\nreferenced object inside the same namespace.", + properties: { + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + type: "array" + }, + nodeSelector: { + additionalProperties: { + type: "string" + }, + description: "NodeSelector is a selector which must be true for the pod to fit on a node.\nSelector which must match a node's labels for the pod to be scheduled on that node.\nMore info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/", + type: "object" + }, + priorityClassName: { + description: "If specified, the pod's priorityClassName.", + type: "string" + }, + securityContext: { + description: "If specified, the pod's security context", + properties: { + fsGroup: { + description: "A special supplemental group that applies to all containers in a pod.\nSome volume types allow the Kubelet to change the ownership of that volume\nto be owned by the pod:\n\n1. The owning GID will be the FSGroup\n2. The setgid bit is set (new files created in the volume will be owned by FSGroup)\n3. The permission bits are OR'd with rw-rw----\n\nIf unset, the Kubelet will not modify the ownership and permissions of any volume.\nNote that this field cannot be set when spec.os.name is windows.", + format: "int64", + type: "integer" + }, + fsGroupChangePolicy: { + description: "fsGroupChangePolicy defines behavior of changing ownership and permission of the volume\nbefore being exposed inside Pod. This field will only apply to\nvolume types which support fsGroup based ownership(and permissions).\nIt will have no effect on ephemeral volume types such as: secret, configmaps\nand emptydir.\nValid values are \"OnRootMismatch\" and \"Always\". If not specified, \"Always\" is used.\nNote that this field cannot be set when spec.os.name is windows.", + type: "string" + }, + runAsGroup: { + description: "The GID to run the entrypoint of the container process.\nUses runtime default if unset.\nMay also be set in SecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence\nfor that container.\nNote that this field cannot be set when spec.os.name is windows.", + format: "int64", + type: "integer" + }, + runAsNonRoot: { + description: "Indicates that the container must run as a non-root user.\nIf true, the Kubelet will validate the image at runtime to ensure that it\ndoes not run as UID 0 (root) and fail to start the container if it does.\nIf unset or false, no such validation will be performed.\nMay also be set in SecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.", + type: "boolean" + }, + runAsUser: { + description: "The UID to run the entrypoint of the container process.\nDefaults to user specified in image metadata if unspecified.\nMay also be set in SecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence\nfor that container.\nNote that this field cannot be set when spec.os.name is windows.", + format: "int64", + type: "integer" + }, + seccompProfile: { + description: "The seccomp options to use by the containers in this pod.\nNote that this field cannot be set when spec.os.name is windows.", + properties: { + localhostProfile: { + description: "localhostProfile indicates a profile defined in a file on the node should be used.\nThe profile must be preconfigured on the node to work.\nMust be a descending path, relative to the kubelet's configured seccomp profile location.\nMust be set if type is \"Localhost\". Must NOT be set for any other type.", + type: "string" + }, + type: { + description: "type indicates which kind of seccomp profile will be applied.\nValid options are:\n\nLocalhost - a profile defined in a file on the node should be used.\nRuntimeDefault - the container runtime default profile should be used.\nUnconfined - no profile should be applied.", + type: "string" + } + }, + required: ["type"], + type: "object" + }, + seLinuxOptions: { + description: "The SELinux context to be applied to all containers.\nIf unspecified, the container runtime will allocate a random SELinux context for each\ncontainer. May also be set in SecurityContext. If set in\nboth SecurityContext and PodSecurityContext, the value specified in SecurityContext\ntakes precedence for that container.\nNote that this field cannot be set when spec.os.name is windows.", + properties: { + level: { + description: "Level is SELinux level label that applies to the container.", + type: "string" + }, + role: { + description: "Role is a SELinux role label that applies to the container.", + type: "string" + }, + type: { + description: "Type is a SELinux type label that applies to the container.", + type: "string" + }, + user: { + description: "User is a SELinux user label that applies to the container.", + type: "string" + } + }, + type: "object" + }, + supplementalGroups: { + description: "A list of groups applied to the first process run in each container, in addition\nto the container's primary GID, the fsGroup (if specified), and group memberships\ndefined in the container image for the uid of the container process. If unspecified,\nno additional groups are added to any container. Note that group memberships\ndefined in the container image for the uid of the container process are still effective,\neven if they are not included in this list.\nNote that this field cannot be set when spec.os.name is windows.", + items: { + format: "int64", + type: "integer" + }, + type: "array" + }, + sysctls: { + description: "Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported\nsysctls (by the container runtime) might fail to launch.\nNote that this field cannot be set when spec.os.name is windows.", + items: { + description: "Sysctl defines a kernel parameter to be set", + properties: { + name: { + description: "Name of a property to set", + type: "string" + }, + value: { + description: "Value of a property to set", + type: "string" + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array" + } + }, + type: "object" + }, + serviceAccountName: { + description: "If specified, the pod's service account", + type: "string" + }, + tolerations: { + description: "If specified, the pod's tolerations.", + items: { + description: "The pod this Toleration is attached to tolerates any taint that matches\nthe triple using the matching operator .", + properties: { + effect: { + description: "Effect indicates the taint effect to match. Empty means match all taint effects.\nWhen specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.", + type: "string" + }, + key: { + description: "Key is the taint key that the toleration applies to. Empty means match all taint keys.\nIf the key is empty, operator must be Exists; this combination means to match all values and all keys.", + type: "string" + }, + operator: { + description: "Operator represents a key's relationship to the value.\nValid operators are Exists and Equal. Defaults to Equal.\nExists is equivalent to wildcard for value, so that a pod can\ntolerate all taints of a particular category.", + type: "string" + }, + tolerationSeconds: { + description: "TolerationSeconds represents the period of time the toleration (which must be\nof effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,\nit is not set, which means tolerate the taint forever (do not evict). Zero and\nnegative values will be treated as 0 (evict immediately) by the system.", + format: "int64", + type: "integer" + }, + value: { + description: "Value is the taint value the toleration matches to.\nIf the operator is Exists, the value should be empty, otherwise just a regular string.", + type: "string" + } + }, + type: "object" + }, + type: "array" + } + }, + type: "object" + } + }, + type: "object" + }, + serviceType: { + description: "Optional service type for Kubernetes solver service. Supported values\nare NodePort or ClusterIP. If unset, defaults to NodePort.", type: "string" } }, - required: ["name"], type: "object" - } - }, - required: ["create"], - type: "object" - }, - pkcs12: { - description: "PKCS12 configures options for storing a PKCS12 keystore in the\n`spec.secretName` Secret resource.", - properties: { - create: { - description: "Create enables PKCS12 keystore creation for the Certificate.\nIf true, a file named `keystore.p12` will be created in the target\nSecret resource, encrypted using the password stored in\n`passwordSecretRef` or in `password`.\nThe keystore file will be updated immediately.\nIf the issuer provided a CA certificate, a file named `truststore.p12` will\nalso be created in the target Secret resource, encrypted using the\npassword stored in `passwordSecretRef` containing the issuing Certificate\nAuthority", - type: "boolean" - }, - password: { - description: "Password provides a literal password used to encrypt the PKCS#12 keystore.\nMutually exclusive with passwordSecretRef.\nOne of password or passwordSecretRef must provide a password with a non-zero length.", - type: "string" }, - passwordSecretRef: { - description: "PasswordSecretRef is a reference to a non-empty key in a Secret resource\ncontaining the password used to encrypt the PKCS#12 keystore.\nMutually exclusive with password.\nOne of password or passwordSecretRef must provide a password with a non-zero length.", + ingress: { + description: "The ingress based HTTP01 challenge solver will solve challenges by\ncreating or modifying Ingress resources in order to route requests for\n'/.well-known/acme-challenge/XYZ' to 'challenge solver' pods that are\nprovisioned by cert-manager for each Challenge to be completed.", properties: { - key: { - description: "The key of the entry in the Secret resource's `data` field to be used.\nSome instances of this field may be defaulted, in others it may be\nrequired.", + class: { + description: "This field configures the annotation `kubernetes.io/ingress.class` when\ncreating Ingress resources to solve ACME challenges that use this\nchallenge solver. Only one of `class`, `name` or `ingressClassName` may\nbe specified.", + type: "string" + }, + ingressClassName: { + description: "This field configures the field `ingressClassName` on the created Ingress\nresources used to solve ACME challenges that use this challenge solver.\nThis is the recommended way of configuring the ingress class. Only one of\n`class`, `name` or `ingressClassName` may be specified.", type: "string" }, + ingressTemplate: { + description: "Optional ingress template used to configure the ACME challenge solver\ningress used for HTTP01 challenges.", + properties: { + metadata: { + description: "ObjectMeta overrides for the ingress used to solve HTTP01 challenges.\nOnly the 'labels' and 'annotations' fields may be set.\nIf labels or annotations overlap with in-built values, the values here\nwill override the in-built values.", + properties: { + annotations: { + additionalProperties: { + type: "string" + }, + description: "Annotations that should be added to the created ACME HTTP01 solver ingress.", + type: "object" + }, + labels: { + additionalProperties: { + type: "string" + }, + description: "Labels that should be added to the created ACME HTTP01 solver ingress.", + type: "object" + } + }, + type: "object" + } + }, + type: "object" + }, name: { - description: "Name of the resource being referred to.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + description: "The name of the ingress resource that should have ACME challenge solving\nroutes inserted into it in order to solve HTTP01 challenges.\nThis is typically used in conjunction with ingress controllers like\ningress-gce, which maintains a 1:1 mapping between external IPs and\ningress resources. Only one of `class`, `name` or `ingressClassName` may\nbe specified.", type: "string" - } - }, - required: ["name"], - type: "object" - }, - profile: { - description: "Profile specifies the key and certificate encryption algorithms and the HMAC algorithm\nused to create the PKCS12 keystore. Default value is `LegacyRC2` for backward compatibility.\n\nIf provided, allowed values are:\n`LegacyRC2`: Deprecated. Not supported by default in OpenSSL 3 or Java 20.\n`LegacyDES`: Less secure algorithm. Use this option for maximal compatibility.\n`Modern2023`: Secure algorithm. Use this option in case you have to always use secure algorithms\n(e.g., because of company policy). Please note that the security of the algorithm is not that important\nin reality, because the unencrypted certificate and private key are also stored in the Secret.\n`Modern2026`: Encodes PKCS#12 files using algorithms that are considered modern as of 2026.\nPrivate keys and certificates are encrypted using PBES2 with PBKDF2-HMAC-SHA-256 and AES-256-CBC.\nThe MAC algorithm is PBMAC1 with PBKDF2-HMAC-SHA-256 and HMAC-SHA256.\nFiles produced with this profile can be read by OpenSSL 3.4.0 and higher, Java 26 and higher,\nor with Java using compatible versions of Bouncy Castle. Meets FIPS 140-3 requirements.", - enum: ["LegacyRC2", "LegacyDES", "Modern2023", "Modern2026"], - type: "string" - } - }, - required: ["create"], - type: "object" - } - }, - type: "object" - }, - literalSubject: { - description: "Requested X.509 certificate subject, represented using the LDAP \"String\nRepresentation of a Distinguished Name\" [1].\nImportant: the LDAP string format also specifies the order of the attributes\nin the subject, this is important when issuing certs for LDAP authentication.\nExample: `CN=foo,DC=corp,DC=example,DC=com`\nMore info [1]: https://datatracker.ietf.org/doc/html/rfc4514\nMore info: https://github.com/cert-manager/cert-manager/issues/3203\nMore info: https://github.com/cert-manager/cert-manager/issues/4424\n\nCannot be set if the `subject` or `commonName` field is set.", - type: "string" - }, - nameConstraints: { - description: "x.509 certificate NameConstraint extension which MUST NOT be used in a non-CA certificate.\nMore Info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.10\n\nThis is an Alpha Feature and is only enabled with the\n`--feature-gates=NameConstraints=true` option set on both\nthe controller and webhook components.", - properties: { - critical: { - description: "if true then the name constraints are marked critical.", - type: "boolean" - }, - excluded: { - description: "Excluded contains the constraints which must be disallowed. Any name matching a\nrestriction in the excluded field is invalid regardless\nof information appearing in the permitted", - properties: { - dnsDomains: { - description: "DNSDomains is a list of DNS domains that are permitted or excluded.", - items: { - type: "string" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - }, - emailAddresses: { - description: "EmailAddresses is a list of Email Addresses that are permitted or excluded.", - items: { - type: "string" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - }, - ipRanges: { - description: "IPRanges is a list of IP Ranges that are permitted or excluded.\nThis should be a valid CIDR notation.", - items: { - type: "string" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - }, - uriDomains: { - description: "URIDomains is a list of URI domains that are permitted or excluded.", - items: { - type: "string" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - } - }, - type: "object" - }, - permitted: { - description: "Permitted contains the constraints in which the names must be located.", - properties: { - dnsDomains: { - description: "DNSDomains is a list of DNS domains that are permitted or excluded.", - items: { - type: "string" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - }, - emailAddresses: { - description: "EmailAddresses is a list of Email Addresses that are permitted or excluded.", - items: { - type: "string" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - }, - ipRanges: { - description: "IPRanges is a list of IP Ranges that are permitted or excluded.\nThis should be a valid CIDR notation.", - items: { - type: "string" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - }, - uriDomains: { - description: "URIDomains is a list of URI domains that are permitted or excluded.", - items: { - type: "string" + }, + podTemplate: { + description: "Optional pod template used to configure the ACME challenge solver pods\nused for HTTP01 challenges.", + properties: { + metadata: { + description: "ObjectMeta overrides for the pod used to solve HTTP01 challenges.\nOnly the 'labels' and 'annotations' fields may be set.\nIf labels or annotations overlap with in-built values, the values here\nwill override the in-built values.", + properties: { + annotations: { + additionalProperties: { + type: "string" + }, + description: "Annotations that should be added to the created ACME HTTP01 solver pods.", + type: "object" + }, + labels: { + additionalProperties: { + type: "string" + }, + description: "Labels that should be added to the created ACME HTTP01 solver pods.", + type: "object" + } + }, + type: "object" + }, + spec: { + description: "PodSpec defines overrides for the HTTP01 challenge solver pod.\nCheck ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields.\nAll other fields will be ignored.", + properties: { + affinity: { + description: "If specified, the pod's scheduling constraints", + properties: { + nodeAffinity: { + description: "Describes node affinity scheduling rules for the pod.", + properties: { + preferredDuringSchedulingIgnoredDuringExecution: { + description: "The scheduler will prefer to schedule pods to nodes that satisfy\nthe affinity expressions specified by this field, but it may choose\na node that violates one or more of the expressions. The node that is\nmost preferred is the one with the greatest sum of weights, i.e.\nfor each node that meets all of the scheduling requirements (resource\nrequest, requiredDuringScheduling affinity expressions, etc.),\ncompute a sum by iterating through the elements of this field and adding\n\"weight\" to the sum if the node matches the corresponding matchExpressions; the\nnode(s) with the highest sum are the most preferred.", + items: { + description: "An empty preferred scheduling term matches all objects with implicit weight 0\n(i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).", + properties: { + preference: { + description: "A node selector term, associated with the corresponding weight.", + properties: { + matchExpressions: { + description: "A list of node selector requirements by node's labels.", + items: { + description: "A node selector requirement is a selector that contains values, a key, and an operator\nthat relates the key and values.", + properties: { + key: { + description: "The label key that the selector applies to.", + type: "string" + }, + operator: { + description: "Represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.", + type: "string" + }, + values: { + description: "An array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. If the operator is Gt or Lt, the values\narray must have a single element, which will be interpreted as an integer.\nThis array is replaced during a strategic merge patch.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + required: ["key", "operator"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + matchFields: { + description: "A list of node selector requirements by node's fields.", + items: { + description: "A node selector requirement is a selector that contains values, a key, and an operator\nthat relates the key and values.", + properties: { + key: { + description: "The label key that the selector applies to.", + type: "string" + }, + operator: { + description: "Represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.", + type: "string" + }, + values: { + description: "An array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. If the operator is Gt or Lt, the values\narray must have a single element, which will be interpreted as an integer.\nThis array is replaced during a strategic merge patch.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + required: ["key", "operator"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + weight: { + description: "Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100.", + format: "int32", + type: "integer" + } + }, + required: ["preference", "weight"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + requiredDuringSchedulingIgnoredDuringExecution: { + description: "If the affinity requirements specified by this field are not met at\nscheduling time, the pod will not be scheduled onto the node.\nIf the affinity requirements specified by this field cease to be met\nat some point during pod execution (e.g. due to an update), the system\nmay or may not try to eventually evict the pod from its node.", + properties: { + nodeSelectorTerms: { + description: "Required. A list of node selector terms. The terms are ORed.", + items: { + description: "A null or empty node selector term matches no objects. The requirements of\nthem are ANDed.\nThe TopologySelectorTerm type implements a subset of the NodeSelectorTerm.", + properties: { + matchExpressions: { + description: "A list of node selector requirements by node's labels.", + items: { + description: "A node selector requirement is a selector that contains values, a key, and an operator\nthat relates the key and values.", + properties: { + key: { + description: "The label key that the selector applies to.", + type: "string" + }, + operator: { + description: "Represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.", + type: "string" + }, + values: { + description: "An array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. If the operator is Gt or Lt, the values\narray must have a single element, which will be interpreted as an integer.\nThis array is replaced during a strategic merge patch.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + required: ["key", "operator"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + matchFields: { + description: "A list of node selector requirements by node's fields.", + items: { + description: "A node selector requirement is a selector that contains values, a key, and an operator\nthat relates the key and values.", + properties: { + key: { + description: "The label key that the selector applies to.", + type: "string" + }, + operator: { + description: "Represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt.", + type: "string" + }, + values: { + description: "An array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. If the operator is Gt or Lt, the values\narray must have a single element, which will be interpreted as an integer.\nThis array is replaced during a strategic merge patch.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + required: ["key", "operator"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + required: ["nodeSelectorTerms"], + type: "object", + "x-kubernetes-map-type": "atomic" + } + }, + type: "object" + }, + podAffinity: { + description: "Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)).", + properties: { + preferredDuringSchedulingIgnoredDuringExecution: { + description: "The scheduler will prefer to schedule pods to nodes that satisfy\nthe affinity expressions specified by this field, but it may choose\na node that violates one or more of the expressions. The node that is\nmost preferred is the one with the greatest sum of weights, i.e.\nfor each node that meets all of the scheduling requirements (resource\nrequest, requiredDuringScheduling affinity expressions, etc.),\ncompute a sum by iterating through the elements of this field and adding\n\"weight\" to the sum if the node has pods which matches the corresponding podAffinityTerm; the\nnode(s) with the highest sum are the most preferred.", + items: { + description: "The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)", + properties: { + podAffinityTerm: { + description: "Required. A pod affinity term, associated with the corresponding weight.", + properties: { + labelSelector: { + description: "A label query over a set of resources, in this case pods.\nIf it's null, this PodAffinityTerm matches with no Pods.", + properties: { + matchExpressions: { + description: "matchExpressions is a list of label selector requirements. The requirements are ANDed.", + items: { + description: "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", + properties: { + key: { + description: "key is the label key that the selector applies to.", + type: "string" + }, + operator: { + description: "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", + type: "string" + }, + values: { + description: "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + required: ["key", "operator"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + matchLabels: { + additionalProperties: { + type: "string" + }, + description: "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", + type: "object" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + matchLabelKeys: { + description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + mismatchLabelKeys: { + description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + namespaces: { + description: "namespaces specifies a static list of namespace names that the term applies to.\nThe term is applied to the union of the namespaces listed in this field\nand the ones selected by namespaceSelector.\nnull or empty namespaces list and null namespaceSelector means \"this pod's namespace\".", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + namespaceSelector: { + description: "A label query over the set of namespaces that the term applies to.\nThe term is applied to the union of the namespaces selected by this field\nand the ones listed in the namespaces field.\nnull selector and null or empty namespaces list means \"this pod's namespace\".\nAn empty selector ({}) matches all namespaces.", + properties: { + matchExpressions: { + description: "matchExpressions is a list of label selector requirements. The requirements are ANDed.", + items: { + description: "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", + properties: { + key: { + description: "key is the label key that the selector applies to.", + type: "string" + }, + operator: { + description: "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", + type: "string" + }, + values: { + description: "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + required: ["key", "operator"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + matchLabels: { + additionalProperties: { + type: "string" + }, + description: "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", + type: "object" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + topologyKey: { + description: "This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching\nthe labelSelector in the specified namespaces, where co-located is defined as running on a node\nwhose value of the label with key topologyKey matches that of any node on which any of the\nselected pods is running.\nEmpty topologyKey is not allowed.", + type: "string" + } + }, + required: ["topologyKey"], + type: "object" + }, + weight: { + description: "weight associated with matching the corresponding podAffinityTerm,\nin the range 1-100.", + format: "int32", + type: "integer" + } + }, + required: ["podAffinityTerm", "weight"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + requiredDuringSchedulingIgnoredDuringExecution: { + description: "If the affinity requirements specified by this field are not met at\nscheduling time, the pod will not be scheduled onto the node.\nIf the affinity requirements specified by this field cease to be met\nat some point during pod execution (e.g. due to a pod label update), the\nsystem may or may not try to eventually evict the pod from its node.\nWhen there are multiple elements, the lists of nodes corresponding to each\npodAffinityTerm are intersected, i.e. all terms must be satisfied.", + items: { + description: "Defines a set of pods (namely those matching the labelSelector\nrelative to the given namespace(s)) that this pod should be\nco-located (affinity) or not co-located (anti-affinity) with,\nwhere co-located is defined as running on a node whose value of\nthe label with key matches that of any node on which\na pod of the set of pods is running", + properties: { + labelSelector: { + description: "A label query over a set of resources, in this case pods.\nIf it's null, this PodAffinityTerm matches with no Pods.", + properties: { + matchExpressions: { + description: "matchExpressions is a list of label selector requirements. The requirements are ANDed.", + items: { + description: "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", + properties: { + key: { + description: "key is the label key that the selector applies to.", + type: "string" + }, + operator: { + description: "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", + type: "string" + }, + values: { + description: "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + required: ["key", "operator"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + matchLabels: { + additionalProperties: { + type: "string" + }, + description: "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", + type: "object" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + matchLabelKeys: { + description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + mismatchLabelKeys: { + description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + namespaces: { + description: "namespaces specifies a static list of namespace names that the term applies to.\nThe term is applied to the union of the namespaces listed in this field\nand the ones selected by namespaceSelector.\nnull or empty namespaces list and null namespaceSelector means \"this pod's namespace\".", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + namespaceSelector: { + description: "A label query over the set of namespaces that the term applies to.\nThe term is applied to the union of the namespaces selected by this field\nand the ones listed in the namespaces field.\nnull selector and null or empty namespaces list means \"this pod's namespace\".\nAn empty selector ({}) matches all namespaces.", + properties: { + matchExpressions: { + description: "matchExpressions is a list of label selector requirements. The requirements are ANDed.", + items: { + description: "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", + properties: { + key: { + description: "key is the label key that the selector applies to.", + type: "string" + }, + operator: { + description: "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", + type: "string" + }, + values: { + description: "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + required: ["key", "operator"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + matchLabels: { + additionalProperties: { + type: "string" + }, + description: "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", + type: "object" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + topologyKey: { + description: "This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching\nthe labelSelector in the specified namespaces, where co-located is defined as running on a node\nwhose value of the label with key topologyKey matches that of any node on which any of the\nselected pods is running.\nEmpty topologyKey is not allowed.", + type: "string" + } + }, + required: ["topologyKey"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + podAntiAffinity: { + description: "Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).", + properties: { + preferredDuringSchedulingIgnoredDuringExecution: { + description: "The scheduler will prefer to schedule pods to nodes that satisfy\nthe anti-affinity expressions specified by this field, but it may choose\na node that violates one or more of the expressions. The node that is\nmost preferred is the one with the greatest sum of weights, i.e.\nfor each node that meets all of the scheduling requirements (resource\nrequest, requiredDuringScheduling anti-affinity expressions, etc.),\ncompute a sum by iterating through the elements of this field and adding\n\"weight\" to the sum if the node has pods which matches the corresponding podAffinityTerm; the\nnode(s) with the highest sum are the most preferred.", + items: { + description: "The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)", + properties: { + podAffinityTerm: { + description: "Required. A pod affinity term, associated with the corresponding weight.", + properties: { + labelSelector: { + description: "A label query over a set of resources, in this case pods.\nIf it's null, this PodAffinityTerm matches with no Pods.", + properties: { + matchExpressions: { + description: "matchExpressions is a list of label selector requirements. The requirements are ANDed.", + items: { + description: "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", + properties: { + key: { + description: "key is the label key that the selector applies to.", + type: "string" + }, + operator: { + description: "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", + type: "string" + }, + values: { + description: "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + required: ["key", "operator"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + matchLabels: { + additionalProperties: { + type: "string" + }, + description: "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", + type: "object" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + matchLabelKeys: { + description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + mismatchLabelKeys: { + description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + namespaces: { + description: "namespaces specifies a static list of namespace names that the term applies to.\nThe term is applied to the union of the namespaces listed in this field\nand the ones selected by namespaceSelector.\nnull or empty namespaces list and null namespaceSelector means \"this pod's namespace\".", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + namespaceSelector: { + description: "A label query over the set of namespaces that the term applies to.\nThe term is applied to the union of the namespaces selected by this field\nand the ones listed in the namespaces field.\nnull selector and null or empty namespaces list means \"this pod's namespace\".\nAn empty selector ({}) matches all namespaces.", + properties: { + matchExpressions: { + description: "matchExpressions is a list of label selector requirements. The requirements are ANDed.", + items: { + description: "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", + properties: { + key: { + description: "key is the label key that the selector applies to.", + type: "string" + }, + operator: { + description: "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", + type: "string" + }, + values: { + description: "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + required: ["key", "operator"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + matchLabels: { + additionalProperties: { + type: "string" + }, + description: "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", + type: "object" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + topologyKey: { + description: "This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching\nthe labelSelector in the specified namespaces, where co-located is defined as running on a node\nwhose value of the label with key topologyKey matches that of any node on which any of the\nselected pods is running.\nEmpty topologyKey is not allowed.", + type: "string" + } + }, + required: ["topologyKey"], + type: "object" + }, + weight: { + description: "weight associated with matching the corresponding podAffinityTerm,\nin the range 1-100.", + format: "int32", + type: "integer" + } + }, + required: ["podAffinityTerm", "weight"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + requiredDuringSchedulingIgnoredDuringExecution: { + description: "If the anti-affinity requirements specified by this field are not met at\nscheduling time, the pod will not be scheduled onto the node.\nIf the anti-affinity requirements specified by this field cease to be met\nat some point during pod execution (e.g. due to a pod label update), the\nsystem may or may not try to eventually evict the pod from its node.\nWhen there are multiple elements, the lists of nodes corresponding to each\npodAffinityTerm are intersected, i.e. all terms must be satisfied.", + items: { + description: "Defines a set of pods (namely those matching the labelSelector\nrelative to the given namespace(s)) that this pod should be\nco-located (affinity) or not co-located (anti-affinity) with,\nwhere co-located is defined as running on a node whose value of\nthe label with key matches that of any node on which\na pod of the set of pods is running", + properties: { + labelSelector: { + description: "A label query over a set of resources, in this case pods.\nIf it's null, this PodAffinityTerm matches with no Pods.", + properties: { + matchExpressions: { + description: "matchExpressions is a list of label selector requirements. The requirements are ANDed.", + items: { + description: "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", + properties: { + key: { + description: "key is the label key that the selector applies to.", + type: "string" + }, + operator: { + description: "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", + type: "string" + }, + values: { + description: "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + required: ["key", "operator"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + matchLabels: { + additionalProperties: { + type: "string" + }, + description: "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", + type: "object" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + matchLabelKeys: { + description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + mismatchLabelKeys: { + description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + namespaces: { + description: "namespaces specifies a static list of namespace names that the term applies to.\nThe term is applied to the union of the namespaces listed in this field\nand the ones selected by namespaceSelector.\nnull or empty namespaces list and null namespaceSelector means \"this pod's namespace\".", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + namespaceSelector: { + description: "A label query over the set of namespaces that the term applies to.\nThe term is applied to the union of the namespaces selected by this field\nand the ones listed in the namespaces field.\nnull selector and null or empty namespaces list means \"this pod's namespace\".\nAn empty selector ({}) matches all namespaces.", + properties: { + matchExpressions: { + description: "matchExpressions is a list of label selector requirements. The requirements are ANDed.", + items: { + description: "A label selector requirement is a selector that contains values, a key, and an operator that\nrelates the key and values.", + properties: { + key: { + description: "key is the label key that the selector applies to.", + type: "string" + }, + operator: { + description: "operator represents a key's relationship to a set of values.\nValid operators are In, NotIn, Exists and DoesNotExist.", + type: "string" + }, + values: { + description: "values is an array of string values. If the operator is In or NotIn,\nthe values array must be non-empty. If the operator is Exists or DoesNotExist,\nthe values array must be empty. This array is replaced during a strategic\nmerge patch.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + required: ["key", "operator"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + matchLabels: { + additionalProperties: { + type: "string" + }, + description: "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.", + type: "object" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + topologyKey: { + description: "This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching\nthe labelSelector in the specified namespaces, where co-located is defined as running on a node\nwhose value of the label with key topologyKey matches that of any node on which any of the\nselected pods is running.\nEmpty topologyKey is not allowed.", + type: "string" + } + }, + required: ["topologyKey"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + } + }, + type: "object" + }, + imagePullSecrets: { + description: "If specified, the pod's imagePullSecrets", + items: { + description: "LocalObjectReference contains enough information to let you locate the\nreferenced object inside the same namespace.", + properties: { + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + type: "array" + }, + nodeSelector: { + additionalProperties: { + type: "string" + }, + description: "NodeSelector is a selector which must be true for the pod to fit on a node.\nSelector which must match a node's labels for the pod to be scheduled on that node.\nMore info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/", + type: "object" + }, + priorityClassName: { + description: "If specified, the pod's priorityClassName.", + type: "string" + }, + securityContext: { + description: "If specified, the pod's security context", + properties: { + fsGroup: { + description: "A special supplemental group that applies to all containers in a pod.\nSome volume types allow the Kubelet to change the ownership of that volume\nto be owned by the pod:\n\n1. The owning GID will be the FSGroup\n2. The setgid bit is set (new files created in the volume will be owned by FSGroup)\n3. The permission bits are OR'd with rw-rw----\n\nIf unset, the Kubelet will not modify the ownership and permissions of any volume.\nNote that this field cannot be set when spec.os.name is windows.", + format: "int64", + type: "integer" + }, + fsGroupChangePolicy: { + description: "fsGroupChangePolicy defines behavior of changing ownership and permission of the volume\nbefore being exposed inside Pod. This field will only apply to\nvolume types which support fsGroup based ownership(and permissions).\nIt will have no effect on ephemeral volume types such as: secret, configmaps\nand emptydir.\nValid values are \"OnRootMismatch\" and \"Always\". If not specified, \"Always\" is used.\nNote that this field cannot be set when spec.os.name is windows.", + type: "string" + }, + runAsGroup: { + description: "The GID to run the entrypoint of the container process.\nUses runtime default if unset.\nMay also be set in SecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence\nfor that container.\nNote that this field cannot be set when spec.os.name is windows.", + format: "int64", + type: "integer" + }, + runAsNonRoot: { + description: "Indicates that the container must run as a non-root user.\nIf true, the Kubelet will validate the image at runtime to ensure that it\ndoes not run as UID 0 (root) and fail to start the container if it does.\nIf unset or false, no such validation will be performed.\nMay also be set in SecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.", + type: "boolean" + }, + runAsUser: { + description: "The UID to run the entrypoint of the container process.\nDefaults to user specified in image metadata if unspecified.\nMay also be set in SecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence\nfor that container.\nNote that this field cannot be set when spec.os.name is windows.", + format: "int64", + type: "integer" + }, + seccompProfile: { + description: "The seccomp options to use by the containers in this pod.\nNote that this field cannot be set when spec.os.name is windows.", + properties: { + localhostProfile: { + description: "localhostProfile indicates a profile defined in a file on the node should be used.\nThe profile must be preconfigured on the node to work.\nMust be a descending path, relative to the kubelet's configured seccomp profile location.\nMust be set if type is \"Localhost\". Must NOT be set for any other type.", + type: "string" + }, + type: { + description: "type indicates which kind of seccomp profile will be applied.\nValid options are:\n\nLocalhost - a profile defined in a file on the node should be used.\nRuntimeDefault - the container runtime default profile should be used.\nUnconfined - no profile should be applied.", + type: "string" + } + }, + required: ["type"], + type: "object" + }, + seLinuxOptions: { + description: "The SELinux context to be applied to all containers.\nIf unspecified, the container runtime will allocate a random SELinux context for each\ncontainer. May also be set in SecurityContext. If set in\nboth SecurityContext and PodSecurityContext, the value specified in SecurityContext\ntakes precedence for that container.\nNote that this field cannot be set when spec.os.name is windows.", + properties: { + level: { + description: "Level is SELinux level label that applies to the container.", + type: "string" + }, + role: { + description: "Role is a SELinux role label that applies to the container.", + type: "string" + }, + type: { + description: "Type is a SELinux type label that applies to the container.", + type: "string" + }, + user: { + description: "User is a SELinux user label that applies to the container.", + type: "string" + } + }, + type: "object" + }, + supplementalGroups: { + description: "A list of groups applied to the first process run in each container, in addition\nto the container's primary GID, the fsGroup (if specified), and group memberships\ndefined in the container image for the uid of the container process. If unspecified,\nno additional groups are added to any container. Note that group memberships\ndefined in the container image for the uid of the container process are still effective,\neven if they are not included in this list.\nNote that this field cannot be set when spec.os.name is windows.", + items: { + format: "int64", + type: "integer" + }, + type: "array" + }, + sysctls: { + description: "Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported\nsysctls (by the container runtime) might fail to launch.\nNote that this field cannot be set when spec.os.name is windows.", + items: { + description: "Sysctl defines a kernel parameter to be set", + properties: { + name: { + description: "Name of a property to set", + type: "string" + }, + value: { + description: "Value of a property to set", + type: "string" + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array" + } + }, + type: "object" + }, + serviceAccountName: { + description: "If specified, the pod's service account", + type: "string" + }, + tolerations: { + description: "If specified, the pod's tolerations.", + items: { + description: "The pod this Toleration is attached to tolerates any taint that matches\nthe triple using the matching operator .", + properties: { + effect: { + description: "Effect indicates the taint effect to match. Empty means match all taint effects.\nWhen specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.", + type: "string" + }, + key: { + description: "Key is the taint key that the toleration applies to. Empty means match all taint keys.\nIf the key is empty, operator must be Exists; this combination means to match all values and all keys.", + type: "string" + }, + operator: { + description: "Operator represents a key's relationship to the value.\nValid operators are Exists and Equal. Defaults to Equal.\nExists is equivalent to wildcard for value, so that a pod can\ntolerate all taints of a particular category.", + type: "string" + }, + tolerationSeconds: { + description: "TolerationSeconds represents the period of time the toleration (which must be\nof effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,\nit is not set, which means tolerate the taint forever (do not evict). Zero and\nnegative values will be treated as 0 (evict immediately) by the system.", + format: "int64", + type: "integer" + }, + value: { + description: "Value is the taint value the toleration matches to.\nIf the operator is Exists, the value should be empty, otherwise just a regular string.", + type: "string" + } + }, + type: "object" + }, + type: "array" + } + }, + type: "object" + } + }, + type: "object" + }, + serviceType: { + description: "Optional service type for Kubernetes solver service. Supported values\nare NodePort or ClusterIP. If unset, defaults to NodePort.", + type: "string" + } }, - type: "array", - "x-kubernetes-list-type": "atomic" + type: "object" } }, type: "object" - } - }, - type: "object" - }, - otherNames: { - description: "`otherNames` is an escape hatch for SAN that allows any type. We currently restrict the support to string like otherNames, cf RFC 5280 p 37\nAny UTF8 String valued otherName can be passed with by setting the keys oid: x.x.x.x and UTF8Value: somevalue for `otherName`.\nMost commonly this would be UPN set with oid: 1.3.6.1.4.1.311.20.2.3\nYou should ensure that any OID passed is valid for the UTF8String type as we do not explicitly validate this.", - items: { - properties: { - oid: { - description: "OID is the object identifier for the otherName SAN.\nThe object identifier must be expressed as a dotted string, for\nexample, \"1.2.840.113556.1.4.221\".", - type: "string" - }, - utf8Value: { - description: "utf8Value is the string value of the otherName SAN.\nThe utf8Value accepts any valid UTF8 string to set as value for the otherName SAN.", - type: "string" - } - }, - type: "object" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - }, - privateKey: { - description: "Private key options. These include the key algorithm and size, the used\nencoding and the rotation policy.", - properties: { - algorithm: { - description: "Algorithm is the private key algorithm of the corresponding private key\nfor this certificate.\n\nIf provided, allowed values are either `RSA`, `ECDSA` or `Ed25519`.\nIf `algorithm` is specified and `size` is not provided,\nkey size of 2048 will be used for `RSA` key algorithm and\nkey size of 256 will be used for `ECDSA` key algorithm.\nkey size is ignored when using the `Ed25519` key algorithm.", - enum: ["RSA", "ECDSA", "Ed25519"], - type: "string" - }, - encoding: { - description: "The private key cryptography standards (PKCS) encoding for this\ncertificate's private key to be encoded in.\n\nIf provided, allowed values are `PKCS1` and `PKCS8` standing for PKCS#1\nand PKCS#8, respectively.\nDefaults to `PKCS1` if not specified.", - enum: ["PKCS1", "PKCS8"], - type: "string" - }, - rotationPolicy: { - description: "RotationPolicy controls how private keys should be regenerated when a\nre-issuance is being processed.\n\nIf set to `Never`, a private key will only be generated if one does not\nalready exist in the target `spec.secretName`. If one does exist but it\ndoes not have the correct algorithm or size, a warning will be raised\nto await user intervention.\nIf set to `Always`, a private key matching the specified requirements\nwill be generated whenever a re-issuance occurs.\nDefault is `Always`.\nThe default was changed from `Never` to `Always` in cert-manager >=v1.18.0.", - enum: ["Never", "Always"], - type: "string" - }, - size: { - description: "Size is the key bit size of the corresponding private key for this certificate.\n\nIf `algorithm` is set to `RSA`, valid values are `2048`, `4096` or `8192`,\nand will default to `2048` if not specified.\nIf `algorithm` is set to `ECDSA`, valid values are `256`, `384` or `521`,\nand will default to `256` if not specified.\nIf `algorithm` is set to `Ed25519`, Size is ignored.\nNo other values are allowed.", - type: "integer" - } - }, - type: "object" - }, - renewal: { - description: "`renewal` allows configuration of how your certificate is renewed. If the policy mentioned is\n`RenewBefore` then the controller respects `renewBefore` and `renewBeforePercentage`.", - properties: { - policy: { - description: "`policy` must be one of `Disabled`, `RenewBefore`.", - enum: ["RenewBefore", "Disabled"], - type: "string" }, - windows: { - description: "`windows` mentions the behavior of when the renewal must happen.", - items: { - description: "CertificateRenewalWindows is the definition for renewal windows", - properties: { - cron: { - description: "`cron` is a cron compliant string to allow when the renewal should be allowed. Format is as shown below:\n* * * * *\n| | | | |\n| | | | day of the week (0–6) (Sunday to Saturday;\n| | | month (1–12) 7 is also Sunday on some systems)\n| | day of the month (1–31)\n| hour (0–23)\nminute (0–59)", - minLength: 1, + selector: { + description: "Selector selects a set of DNSNames on the Certificate resource that\nshould be solved using this challenge solver.\nIf not specified, the solver will be treated as the 'default' solver\nwith the lowest priority, i.e. if any other solver has a more specific\nmatch, it will be used instead.", + properties: { + dnsNames: { + description: "List of DNSNames that this solver will be used to solve.\nIf specified and a match is found, a dnsNames selector will take\nprecedence over a dnsZones selector.\nIf multiple solvers match with the same dnsNames value, the solver\nwith the most matching labels in matchLabels will be selected.\nIf neither has more matches, the solver defined earlier in the list\nwill be selected.", + items: { type: "string" }, - timezone: { - description: "`timezone` is IANA compliant timezone. For example America/Denver.\nIf this field is not set, timezone is treated as UTC.", - minLength: 1, + type: "array" + }, + dnsZones: { + description: "List of DNSZones that this solver will be used to solve.\nThe most specific DNS zone match specified here will take precedence\nover other DNS zone matches, so a solver specifying sys.example.com\nwill be selected over one specifying example.com for the domain\nwww.sys.example.com.\nIf multiple solvers match with the same dnsZones value, the solver\nwith the most matching labels in matchLabels will be selected.\nIf neither has more matches, the solver defined earlier in the list\nwill be selected.", + items: { type: "string" }, - windowDuration: { - description: "`windowDuration` is how long the cron definition is active for.\nValue must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration.", - pattern: "^([0-9]+(\\.[0-9]+)?(s|m|h))+$", - type: "string" - } - }, - required: ["cron", "windowDuration"], - type: "object" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - } - }, - type: "object" - }, - renewBefore: { - description: "How long before the currently issued certificate's expiry cert-manager should\nrenew the certificate. For example, if a certificate is valid for 60 minutes,\nand `renewBefore=10m`, cert-manager will begin to attempt to renew the certificate\n50 minutes after it was issued (i.e. when there are 10 minutes remaining until\nthe certificate is no longer valid).\n\nNOTE: The actual lifetime of the issued certificate is used to determine the\nrenewal time. If an issuer returns a certificate with a different lifetime than\nthe one requested, cert-manager will use the lifetime of the issued certificate.\n\nIf unset, this defaults to 1/3 of the issued certificate's lifetime.\nMinimum accepted value is 5 minutes.\nValue must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration.\nCannot be set if the `renewBeforePercentage` field is set.", - type: "string" - }, - renewBeforePercentage: { - description: "`renewBeforePercentage` is like `renewBefore`, except it is a relative percentage\nrather than an absolute duration. For example, if a certificate is valid for 60\nminutes, and `renewBeforePercentage=25`, cert-manager will begin to attempt to\nrenew the certificate 45 minutes after it was issued (i.e. when there are 15\nminutes (25%) remaining until the certificate is no longer valid).\n\nNOTE: The actual lifetime of the issued certificate is used to determine the\nrenewal time. If an issuer returns a certificate with a different lifetime than\nthe one requested, cert-manager will use the lifetime of the issued certificate.\n\nValue must be an integer in the range (0,100). The minimum effective\n`renewBefore` derived from the `renewBeforePercentage` and `duration` fields is 5\nminutes.\nCannot be set if the `renewBefore` field is set.", - format: "int32", - type: "integer" - }, - revisionHistoryLimit: { - description: "The maximum number of CertificateRequest revisions that are maintained in\nthe Certificate's history. Each revision represents a single `CertificateRequest`\ncreated by this Certificate, either when it was created, renewed, or Spec\nwas changed. Revisions will be removed by oldest first if the number of\nrevisions exceeds this number.\n\nIf set, revisionHistoryLimit must be a value of `1` or greater.\nDefault value is `1`.", - format: "int32", - type: "integer" - }, - secretName: { - description: "Name of the Secret resource that will be automatically created and\nmanaged by this Certificate resource. It will be populated with a\nprivate key and certificate, signed by the denoted issuer. The Secret\nresource lives in the same namespace as the Certificate resource.", - type: "string" - }, - secretTemplate: { - description: "Defines annotations and labels to be copied to the Certificate's Secret.\nLabels and annotations on the Secret will be changed as they appear on the\nSecretTemplate when added or removed. SecretTemplate annotations are added\nin conjunction with, and cannot overwrite, the base set of annotations\ncert-manager sets on the Certificate's Secret.", - properties: { - annotations: { - additionalProperties: { - type: "string" - }, - description: "Annotations is a key value map to be copied to the target Kubernetes Secret.", - type: "object" - }, - labels: { - additionalProperties: { - type: "string" - }, - description: "Labels is a key value map to be copied to the target Kubernetes Secret.", - type: "object" - } - }, - type: "object" - }, - signatureAlgorithm: { - description: "Signature algorithm to use.\nAllowed values for RSA keys: SHA256WithRSA, SHA384WithRSA, SHA512WithRSA.\nAllowed values for ECDSA keys: ECDSAWithSHA256, ECDSAWithSHA384, ECDSAWithSHA512.\nAllowed values for Ed25519 keys: PureEd25519.", - enum: ["SHA256WithRSA", "SHA384WithRSA", "SHA512WithRSA", "ECDSAWithSHA256", "ECDSAWithSHA384", "ECDSAWithSHA512", "PureEd25519"], - type: "string" - }, - subject: { - description: "Requested set of X509 certificate subject attributes.\nMore info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.6\n\nThe common name attribute is specified separately in the `commonName` field.\nCannot be set if the `literalSubject` field is set.", - properties: { - countries: { - description: "Countries to be used on the Certificate.", - items: { - type: "string" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - }, - localities: { - description: "Cities to be used on the Certificate.", - items: { - type: "string" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - }, - organizationalUnits: { - description: "Organizational Units to be used on the Certificate.", - items: { - type: "string" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - }, - organizations: { - description: "Organizations to be used on the Certificate.", - items: { - type: "string" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - }, - postalCodes: { - description: "Postal codes to be used on the Certificate.", - items: { - type: "string" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - }, - provinces: { - description: "State/Provinces to be used on the Certificate.", - items: { - type: "string" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - }, - serialNumber: { - description: "Serial number to be used on the Certificate.", - type: "string" - }, - streetAddresses: { - description: "Street addresses to be used on the Certificate.", - items: { - type: "string" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - } - }, - type: "object" - }, - uris: { - description: "Requested URI subject alternative names.", - items: { - type: "string" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - }, - usages: { - description: "Requested key usages and extended key usages.\nThese usages are used to set the `usages` field on the created CertificateRequest\nresources. If `encodeUsagesInRequest` is unset or set to `true`, the usages\nwill additionally be encoded in the `request` field which contains the CSR blob.\n\nIf unset, defaults to `digital signature` and `key encipherment`.", - items: { - description: "KeyUsage specifies valid usage contexts for keys.\nSee:\nhttps://tools.ietf.org/html/rfc5280#section-4.2.1.3\nhttps://tools.ietf.org/html/rfc5280#section-4.2.1.12\n\nValid KeyUsage values are as follows:\n\"signing\",\n\"digital signature\",\n\"content commitment\",\n\"key encipherment\",\n\"key agreement\",\n\"data encipherment\",\n\"cert sign\",\n\"crl sign\",\n\"encipher only\",\n\"decipher only\",\n\"any\",\n\"server auth\",\n\"client auth\",\n\"code signing\",\n\"email protection\",\n\"s/mime\",\n\"ipsec end system\",\n\"ipsec tunnel\",\n\"ipsec user\",\n\"timestamping\",\n\"ocsp signing\",\n\"microsoft sgc\",\n\"netscape sgc\"", - enum: ["signing", "digital signature", "content commitment", "key encipherment", "key agreement", "data encipherment", "cert sign", "crl sign", "encipher only", "decipher only", "any", "server auth", "client auth", "code signing", "email protection", "s/mime", "ipsec end system", "ipsec tunnel", "ipsec user", "timestamping", "ocsp signing", "microsoft sgc", "netscape sgc"], - type: "string" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - } - }, - required: ["issuerRef", "secretName"], - type: "object" - }, - status: { - description: "Status of the Certificate.\nThis is set and managed automatically.\nRead-only.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status", - properties: { - acme: { - description: "ACME stores information that is fetched from the ACME CA server.", - properties: { - ari: { - description: "ARI stores the ACME Renewal Information that is fetched from the ACME server\nin accordance with RFC 9773. This is only populated if the ARI feature gate is enabled.", - properties: { - explanationURL: { - description: "ExplanationURL is a human-readable URL that may explain why the suggested window\nhas its current value.", - type: "string" + type: "array" }, - lastChecked: { - description: "LastChecked is the time at which the ACME server was last checked for renewal information.", - format: "date-time", - type: "string" - }, - lastError: { - description: "LastError is the last error encountered when checking the ACME server for renewal information, if any.", - type: "string" - }, - nextCheck: { - description: "NextCheck is the time at which the ACME server will next be checked for renewal information.", - format: "date-time", - type: "string" - }, - suggestedWindow: { - description: "SuggestedWindow is the suggested renewal window as returned by the ACME server in accordance with RFC 9773.", - properties: { - end: { - description: "End is the end of the suggested renewal window.", - format: "date-time", - type: "string" - }, - start: { - description: "Start is the start of the suggested renewal window.", - format: "date-time", - type: "string" - } + matchLabels: { + additionalProperties: { + type: "string" }, - required: ["end", "start"], + description: "A label selector that is used to refine the set of certificate's that\nthis challenge solver will apply to.", type: "object" } }, - type: "object" - } - }, - type: "object" - }, - conditions: { - description: "List of status conditions to indicate the status of certificates.\nKnown condition types are `Ready` and `Issuing`.", - items: { - description: "CertificateCondition contains condition information for a Certificate.", - properties: { - lastTransitionTime: { - description: "LastTransitionTime is the timestamp corresponding to the last status\nchange of this condition.", - format: "date-time", - type: "string" - }, - message: { - description: "Message is a human readable description of the details of the last\ntransition, complementing reason.", - type: "string" - }, - observedGeneration: { - description: "If set, this represents the .metadata.generation that the condition was\nset based upon.\nFor instance, if .metadata.generation is currently 12, but the\n.status.condition[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the Certificate.", - format: "int64", - type: "integer" - }, - reason: { - description: "Reason is a brief machine readable explanation for the condition's last\ntransition.", - type: "string" - }, - status: { - description: "Status of the condition, one of (`True`, `False`, `Unknown`).", - enum: ["True", "False", "Unknown"], - type: "string" - }, - type: { - description: "Type of the condition, known values are (`Ready`, `Issuing`).", - type: "string" - } - }, - required: ["status", "type"], - type: "object" + type: "object" + } }, - type: "array", - "x-kubernetes-list-map-keys": ["type"], - "x-kubernetes-list-type": "map" - }, - failedIssuanceAttempts: { - description: "The number of continuous failed issuance attempts up till now. This\nfield gets removed (if set) on a successful issuance and gets set to\n1 if unset and an issuance has failed. If an issuance has failed, the\ndelay till the next issuance will be calculated using formula\ntime.Hour * 2 ^ (failedIssuanceAttempts - 1).", - type: "integer" + type: "object" }, - lastFailureTime: { - description: "LastFailureTime is set only if the latest issuance for this\nCertificate failed and contains the time of the failure. If an\nissuance has failed, the delay till the next issuance will be\ncalculated using formula time.Hour * 2 ^ (failedIssuanceAttempts -\n1). If the latest issuance has succeeded this field will be unset.", - format: "date-time", + token: { + description: "The ACME challenge token for this challenge.\nThis is the raw value returned from the ACME server.", type: "string" }, - nextPrivateKeySecretName: { - description: "The name of the Secret resource containing the private key to be used\nfor the next certificate iteration.\nThe keymanager controller will automatically set this field if the\n`Issuing` condition is set to `True`.\nIt will automatically unset this field when the Issuing condition is\nnot set or False.", + type: { + description: "The type of ACME challenge this resource represents.\nOne of \"HTTP-01\" or \"DNS-01\".", + enum: ["HTTP-01", "DNS-01"], type: "string" }, - notAfter: { - description: "The expiration time of the certificate stored in the secret named\nby this resource in `spec.secretName`.", - format: "date-time", + url: { + description: "The URL of the ACME Challenge resource for this challenge.\nThis can be used to lookup details about the status of this challenge.", type: "string" }, - notBefore: { - description: "The time after which the certificate stored in the secret named\nby this resource in `spec.secretName` is valid.", - format: "date-time", - type: "string" + wildcard: { + description: "wildcard will be true if this challenge is for a wildcard identifier,\nfor example '*.example.com'.", + type: "boolean" + } + }, + required: ["authorizationURL", "dnsName", "issuerRef", "key", "solver", "token", "type", "url"], + type: "object" + }, + status: { + properties: { + presented: { + description: "presented will be set to true if the challenge values for this challenge\nare currently 'presented'.\nThis *does not* imply the self check is passing. Only that the values\nhave been 'submitted' for the appropriate challenge mechanism (i.e. the\nDNS01 TXT record has been presented, or the HTTP01 configuration has been\nconfigured).", + type: "boolean" }, - renewalTime: { - description: "RenewalTime is the time at which the certificate will be next\nrenewed.\nIf not set, no upcoming renewal is scheduled.", - format: "date-time", + processing: { + description: "Used to denote whether this challenge should be processed or not.\nThis field will only be set to true by the 'scheduling' component.\nIt will only be set to false by the 'challenges' controller, after the\nchallenge has reached a final state or timed out.\nIf this field is set to false, the challenge controller will not take\nany more action.", + type: "boolean" + }, + reason: { + description: "Contains human readable information on why the Challenge is in the\ncurrent state.", type: "string" }, - revision: { - description: "The current 'revision' of the certificate as issued.\n\nWhen a CertificateRequest resource is created, it will have the\n`cert-manager.io/certificate-revision` set to one greater than the\ncurrent value of this field.\n\nUpon issuance, this field will be set to the value of the annotation\non the CertificateRequest resource used to issue the certificate.\n\nPersisting the value on the CertificateRequest resource allows the\ncertificates controller to know whether a request is part of an old\nissuance or if it is part of the ongoing revision's issuance by\nchecking if the revision value in the annotation is greater than this\nfield.", - type: "integer" + state: { + description: "Contains the current 'state' of the challenge.\nIf not set, the state of the challenge is unknown.", + enum: ["valid", "ready", "pending", "processing", "invalid", "expired", "errored"], + type: "string" } }, type: "object" } }, + required: ["metadata", "spec"], type: "object" } }, - selectableFields: [{ - jsonPath: ".spec.issuerRef.group" - }, { - jsonPath: ".spec.issuerRef.kind" - }, { - jsonPath: ".spec.issuerRef.name" - }], served: true, storage: true, subresources: { @@ -3774,12 +3308,11 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: KubernetesRes }, labels: { app: "cert-manager", - "app.kubernetes.io/component": "crds", "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "cert-manager", - "app.kubernetes.io/version": "v1.21.1", - "helm.sh/chart": "cert-manager-v1.21.1" + "app.kubernetes.io/version": "v1.17.0", + "helm.sh/chart": "cert-manager-v1.17.0" }, name: "clusterissuers.cert-manager.io" }, @@ -3790,17 +3323,16 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: KubernetesRes kind: "ClusterIssuer", listKind: "ClusterIssuerList", plural: "clusterissuers", - shortNames: ["ciss"], singular: "clusterissuer" }, scope: "Cluster", versions: [{ additionalPrinterColumns: [{ - jsonPath: ".status.conditions[?(@.type == \"Ready\")].status", + jsonPath: ".status.conditions[?(@.type==\"Ready\")].status", name: "Ready", type: "string" }, { - jsonPath: ".status.conditions[?(@.type == \"Ready\")].message", + jsonPath: ".status.conditions[?(@.type==\"Ready\")].message", name: "Status", priority: 1, type: "string" @@ -3881,7 +3413,7 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: KubernetesRes type: "object" }, preferredChain: { - description: "PreferredChain is the chain to use if the ACME server outputs multiple.\nPreferredChain is no guarantee that this one gets delivered by the ACME\nendpoint.\nFor example, for Let's Encrypt's DST cross-sign you would use:\n\"DST Root CA X3\" or \"ISRG Root X1\" for the newer Let's Encrypt root CA.\nThis value picks the first certificate bundle in the combined set of\nACME default and alternative chains that has a root-most certificate with\nthis value as its issuer's commonname.", + description: "PreferredChain is the chain to use if the ACME server outputs multiple.\nPreferredChain is no guarantee that this one gets delivered by the ACME\nendpoint.\nFor example, for Let's Encrypt's DST crosssign you would use:\n\"DST Root CA X3\" or \"ISRG Root X1\" for the newer Let's Encrypt root CA.\nThis value picks the first certificate bundle in the combined set of\nACME default and alternative chains that has a root-most certificate with\nthis value as its issuer's commonname.", maxLength: 64, type: "string" }, @@ -3900,10 +3432,6 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: KubernetesRes required: ["name"], type: "object" }, - profile: { - description: "Profile allows requesting a certificate profile from the ACME server.\nSupported profiles are listed by the server's ACME directory URL.", - type: "string" - }, server: { description: "Server is the URL used to access the ACME server's 'directory' endpoint.\nFor example, for Let's Encrypt's staging endpoint, you would use:\n\"https://acme-staging-v02.api.letsencrypt.org/directory\".\nOnly ACME v2 endpoints (i.e. RFC 8555) are supported.", type: "string" @@ -4035,15 +3563,15 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: KubernetesRes description: "Auth: Azure Workload Identity or Azure Managed Service Identity:\nSettings to enable Azure Workload Identity or Azure Managed Service Identity\nIf set, ClientID, ClientSecret and TenantID must not be set.", properties: { clientID: { - description: "client ID of the managed identity, cannot be used at the same time as resourceID", + description: "client ID of the managed identity, can not be used at the same time as resourceID", type: "string" }, resourceID: { - description: "resource ID of the managed identity, cannot be used at the same time as clientID\nCannot be used for Azure Managed Service Identity", + description: "resource ID of the managed identity, can not be used at the same time as clientID\nCannot be used for Azure Managed Service Identity", type: "string" }, tenantID: { - description: "tenant ID of the managed identity, cannot be used at the same time as resourceID", + description: "tenant ID of the managed identity, can not be used at the same time as resourceID", type: "string" } }, @@ -4060,11 +3588,6 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: KubernetesRes tenantID: { description: "Auth: Azure Service Principal:\nThe TenantID of the Azure Service Principal used to authenticate with Azure DNS.\nIf set, ClientID and ClientSecret must also be set.", type: "string" - }, - zoneType: { - description: "ZoneType determines which type of Azure DNS zone to use.\n\nValid values are:\n - AzurePublicZone (default): Use a public Azure DNS zone.\n - AzurePrivateZone: Use an Azure Private DNS zone.\n\nIf not specified, AzurePublicZone is used.\n\nSupport for Azure Private DNS zones is currently\nexperimental and may change in future releases.", - enum: ["AzurePublicZone", "AzurePrivateZone"], - type: "string" } }, required: ["resourceGroupName", "subscriptionID"], @@ -4170,12 +3693,7 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: KubernetesRes description: "Use RFC2136 (\"Dynamic Updates in the Domain Name System\") (https://datatracker.ietf.org/doc/rfc2136/)\nto manage DNS01 challenge records.", properties: { nameserver: { - description: "The IP address or hostname of an authoritative DNS server supporting\nRFC2136 in the form host:port. If the host is an IPv6 address it must be\nenclosed in square brackets (e.g [2001:db8::1]); port is optional.\nThis field is required.", - type: "string" - }, - protocol: { - description: "Protocol to use for dynamic DNS update queries. Valid values are (case-sensitive) ``TCP`` and ``UDP``; ``UDP`` (default).", - enum: ["TCP", "UDP"], + description: "The IP address or hostname of an authoritative DNS server supporting\nRFC2136 in the form host:port. If the host is an IPv6 address it must be\nenclosed in square brackets (e.g [2001:db8::1])\xA0; port is optional.\nThis field is required.", type: "string" }, tsigAlgorithm: { @@ -4209,11 +3727,11 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: KubernetesRes description: "Use the AWS Route53 API to manage DNS01 challenge records.", properties: { accessKeyID: { - description: "The AccessKeyID is used for authentication.\nCannot be set when SecretAccessKeyID is set.\nIf neither the Access Key nor Key ID are set, we fall back to using env\nvars, shared credentials file, or AWS Instance metadata,\nsee: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials", + description: "The AccessKeyID is used for authentication.\nCannot be set when SecretAccessKeyID is set.\nIf neither the Access Key nor Key ID are set, we fall-back to using env\nvars, shared credentials file or AWS Instance metadata,\nsee: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials", type: "string" }, accessKeyIDSecretRef: { - description: "The SecretAccessKey is used for authentication. If set, pull the AWS\naccess key ID from a key within a Kubernetes Secret.\nCannot be set when AccessKeyID is set.\nIf neither the Access Key nor Key ID are set, we fall back to using env\nvars, shared credentials file, or AWS Instance metadata,\nsee: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials", + description: "The SecretAccessKey is used for authentication. If set, pull the AWS\naccess key ID from a key within a Kubernetes Secret.\nCannot be set when AccessKeyID is set.\nIf neither the Access Key nor Key ID are set, we fall-back to using env\nvars, shared credentials file or AWS Instance metadata,\nsee: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials", properties: { key: { description: "The key of the entry in the Secret resource's `data` field to be used.\nSome instances of this field may be defaulted, in others it may be\nrequired.", @@ -4241,8 +3759,7 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: KubernetesRes items: { type: "string" }, - type: "array", - "x-kubernetes-list-type": "atomic" + type: "array" }, name: { description: "Name of the ServiceAccount used to request a token.", @@ -4273,7 +3790,7 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: KubernetesRes type: "string" }, secretAccessKeySecretRef: { - description: "The SecretAccessKey is used for authentication.\nIf neither the Access Key nor Key ID are set, we fall back to using env\nvars, shared credentials file, or AWS Instance metadata,\nsee: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials", + description: "The SecretAccessKey is used for authentication.\nIf neither the Access Key nor Key ID are set, we fall-back to using env\nvars, shared credentials file or AWS Instance metadata,\nsee: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials", properties: { key: { description: "The key of the entry in the Secret resource's `data` field to be used.\nSome instances of this field may be defaulted, in others it may be\nrequired.", @@ -4294,7 +3811,7 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: KubernetesRes description: "Configure an external webhook based DNS01 challenge solver to manage\nDNS01 challenge records.", properties: { config: { - description: "Additional configuration that should be passed to the webhook apiserver\nwhen challenges are processed.\nThis can contain arbitrary JSON data.\nSecret values should not be specified in this stanza.\nIf secret values are needed (e.g., credentials for a DNS service), you\nshould use a SecretKeySelector to reference a Secret resource.\nFor details on the schema of this field, consult the webhook provider\nimplementation's documentation.", + description: "Additional configuration that should be passed to the webhook apiserver\nwhen challenges are processed.\nThis can contain arbitrary JSON data.\nSecret values should not be specified in this stanza.\nIf secret values are needed (e.g. credentials for a DNS service), you\nshould use a SecretKeySelector to reference a Secret resource.\nFor details on the schema of this field, consult the webhook provider\nimplementation's documentation.", "x-kubernetes-preserve-unknown-fields": true }, groupName: { @@ -4302,7 +3819,7 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: KubernetesRes type: "string" }, solverName: { - description: "The name of the solver to use, as defined in the webhook provider\nimplementation.\nThis will typically be the name of the provider, e.g., 'cloudflare'.", + description: "The name of the solver to use, as defined in the webhook provider\nimplementation.\nThis will typically be the name of the provider, e.g. 'cloudflare'.", type: "string" } }, @@ -4313,7 +3830,7 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: KubernetesRes type: "object" }, http01: { - description: "Configures cert-manager to attempt to complete authorizations by\nperforming the HTTP01 challenge flow.\nIt is not possible to obtain certificates for wildcard domain names\n(e.g., `*.example.com`) using the HTTP01 challenge mechanism.", + description: "Configures cert-manager to attempt to complete authorizations by\nperforming the HTTP01 challenge flow.\nIt is not possible to obtain certificates for wildcard domain names\n(e.g. `*.example.com`) using the HTTP01 challenge mechanism.", properties: { gatewayHTTPRoute: { description: "The Gateway API is a sig-network community API that models service networking\nin Kubernetes (https://gateway-api.sigs.k8s.io/). The Gateway solver will\ncreate HTTPRoutes with the specified labels in the same namespace as the challenge.\nThis solver is experimental, and fields / behaviour may change in the future.", @@ -4376,8 +3893,7 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: KubernetesRes required: ["name"], type: "object" }, - type: "array", - "x-kubernetes-list-type": "atomic" + type: "array" }, podTemplate: { description: "Optional pod template used to configure the ACME challenge solver pods\nused for HTTP01 challenges.", @@ -4624,7 +4140,7 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: KubernetesRes "x-kubernetes-map-type": "atomic" }, matchLabelKeys: { - description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.", + description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", items: { type: "string" }, @@ -4632,7 +4148,7 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: KubernetesRes "x-kubernetes-list-type": "atomic" }, mismatchLabelKeys: { - description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.", + description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", items: { type: "string" }, @@ -4757,7 +4273,7 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: KubernetesRes "x-kubernetes-map-type": "atomic" }, matchLabelKeys: { - description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.", + description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", items: { type: "string" }, @@ -4765,7 +4281,7 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: KubernetesRes "x-kubernetes-list-type": "atomic" }, mismatchLabelKeys: { - description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.", + description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", items: { type: "string" }, @@ -4840,7 +4356,7 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: KubernetesRes description: "Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).", properties: { preferredDuringSchedulingIgnoredDuringExecution: { - description: "The scheduler will prefer to schedule pods to nodes that satisfy\nthe anti-affinity expressions specified by this field, but it may choose\na node that violates one or more of the expressions. The node that is\nmost preferred is the one with the greatest sum of weights, i.e.\nfor each node that meets all of the scheduling requirements (resource\nrequest, requiredDuringScheduling anti-affinity expressions, etc.),\ncompute a sum by iterating through the elements of this field and subtracting\n\"weight\" from the sum if the node has pods which matches the corresponding podAffinityTerm; the\nnode(s) with the highest sum are the most preferred.", + description: "The scheduler will prefer to schedule pods to nodes that satisfy\nthe anti-affinity expressions specified by this field, but it may choose\na node that violates one or more of the expressions. The node that is\nmost preferred is the one with the greatest sum of weights, i.e.\nfor each node that meets all of the scheduling requirements (resource\nrequest, requiredDuringScheduling anti-affinity expressions, etc.),\ncompute a sum by iterating through the elements of this field and adding\n\"weight\" to the sum if the node has pods which matches the corresponding podAffinityTerm; the\nnode(s) with the highest sum are the most preferred.", items: { description: "The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)", properties: { @@ -4890,7 +4406,7 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: KubernetesRes "x-kubernetes-map-type": "atomic" }, matchLabelKeys: { - description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.", + description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", items: { type: "string" }, @@ -4898,7 +4414,7 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: KubernetesRes "x-kubernetes-list-type": "atomic" }, mismatchLabelKeys: { - description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.", + description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", items: { type: "string" }, @@ -5023,7 +4539,7 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: KubernetesRes "x-kubernetes-map-type": "atomic" }, matchLabelKeys: { - description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.", + description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", items: { type: "string" }, @@ -5031,7 +4547,7 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: KubernetesRes "x-kubernetes-list-type": "atomic" }, mismatchLabelKeys: { - description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.", + description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", items: { type: "string" }, @@ -5119,9 +4635,7 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: KubernetesRes type: "object", "x-kubernetes-map-type": "atomic" }, - type: "array", - "x-kubernetes-list-map-keys": ["name"], - "x-kubernetes-list-type": "map" + type: "array" }, nodeSelector: { additionalProperties: { @@ -5134,38 +4648,6 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: KubernetesRes description: "If specified, the pod's priorityClassName.", type: "string" }, - resources: { - description: "If specified, the pod's resource requirements.\nThese values override the global resource configuration flags.\nNote that when only specifying resource limits, ensure they are greater than or equal\nto the corresponding global resource requests configured via controller flags\n(--acme-http01-solver-resource-request-cpu, --acme-http01-solver-resource-request-memory).\nKubernetes will reject pod creation if limits are lower than requests, causing challenge failures.", - properties: { - limits: { - additionalProperties: { - anyOf: [{ - type: "integer" - }, { - type: "string" - }], - pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "x-kubernetes-int-or-string": true - }, - description: "Limits describes the maximum amount of compute resources allowed.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", - type: "object" - }, - requests: { - additionalProperties: { - anyOf: [{ - type: "integer" - }, { - type: "string" - }], - pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "x-kubernetes-int-or-string": true - }, - description: "Requests describes the minimum amount of compute resources required.\nIf Requests is omitted for a container, it defaults to Limits if that is explicitly specified,\notherwise to the global values configured via controller flags. Requests cannot exceed Limits.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", - type: "object" - } - }, - type: "object" - }, securityContext: { description: "If specified, the pod's security context", properties: { @@ -5235,8 +4717,7 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: KubernetesRes format: "int64", type: "integer" }, - type: "array", - "x-kubernetes-list-type": "atomic" + type: "array" }, sysctls: { description: "Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported\nsysctls (by the container runtime) might fail to launch.\nNote that this field cannot be set when spec.os.name is windows.", @@ -5255,8 +4736,7 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: KubernetesRes required: ["name", "value"], type: "object" }, - type: "array", - "x-kubernetes-list-type": "atomic" + type: "array" } }, type: "object" @@ -5279,7 +4759,7 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: KubernetesRes type: "string" }, operator: { - description: "Operator represents a key's relationship to the value.\nValid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.\nExists is equivalent to wildcard for value, so that a pod can\ntolerate all taints of a particular category.\nLt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).", + description: "Operator represents a key's relationship to the value.\nValid operators are Exists and Equal. Defaults to Equal.\nExists is equivalent to wildcard for value, so that a pod can\ntolerate all taints of a particular category.", type: "string" }, tolerationSeconds: { @@ -5294,8 +4774,7 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: KubernetesRes }, type: "object" }, - type: "array", - "x-kubernetes-list-type": "atomic" + type: "array" } }, type: "object" @@ -5596,7 +5075,7 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: KubernetesRes "x-kubernetes-map-type": "atomic" }, matchLabelKeys: { - description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.", + description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", items: { type: "string" }, @@ -5604,7 +5083,7 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: KubernetesRes "x-kubernetes-list-type": "atomic" }, mismatchLabelKeys: { - description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.", + description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", items: { type: "string" }, @@ -5729,7 +5208,7 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: KubernetesRes "x-kubernetes-map-type": "atomic" }, matchLabelKeys: { - description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.", + description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", items: { type: "string" }, @@ -5737,7 +5216,7 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: KubernetesRes "x-kubernetes-list-type": "atomic" }, mismatchLabelKeys: { - description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.", + description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", items: { type: "string" }, @@ -5812,7 +5291,7 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: KubernetesRes description: "Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).", properties: { preferredDuringSchedulingIgnoredDuringExecution: { - description: "The scheduler will prefer to schedule pods to nodes that satisfy\nthe anti-affinity expressions specified by this field, but it may choose\na node that violates one or more of the expressions. The node that is\nmost preferred is the one with the greatest sum of weights, i.e.\nfor each node that meets all of the scheduling requirements (resource\nrequest, requiredDuringScheduling anti-affinity expressions, etc.),\ncompute a sum by iterating through the elements of this field and subtracting\n\"weight\" from the sum if the node has pods which matches the corresponding podAffinityTerm; the\nnode(s) with the highest sum are the most preferred.", + description: "The scheduler will prefer to schedule pods to nodes that satisfy\nthe anti-affinity expressions specified by this field, but it may choose\na node that violates one or more of the expressions. The node that is\nmost preferred is the one with the greatest sum of weights, i.e.\nfor each node that meets all of the scheduling requirements (resource\nrequest, requiredDuringScheduling anti-affinity expressions, etc.),\ncompute a sum by iterating through the elements of this field and adding\n\"weight\" to the sum if the node has pods which matches the corresponding podAffinityTerm; the\nnode(s) with the highest sum are the most preferred.", items: { description: "The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)", properties: { @@ -5862,7 +5341,7 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: KubernetesRes "x-kubernetes-map-type": "atomic" }, matchLabelKeys: { - description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.", + description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", items: { type: "string" }, @@ -5870,7 +5349,7 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: KubernetesRes "x-kubernetes-list-type": "atomic" }, mismatchLabelKeys: { - description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.", + description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", items: { type: "string" }, @@ -5995,7 +5474,7 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: KubernetesRes "x-kubernetes-map-type": "atomic" }, matchLabelKeys: { - description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.", + description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", items: { type: "string" }, @@ -6003,7 +5482,7 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: KubernetesRes "x-kubernetes-list-type": "atomic" }, mismatchLabelKeys: { - description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.", + description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", items: { type: "string" }, @@ -6091,9 +5570,7 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: KubernetesRes type: "object", "x-kubernetes-map-type": "atomic" }, - type: "array", - "x-kubernetes-list-map-keys": ["name"], - "x-kubernetes-list-type": "map" + type: "array" }, nodeSelector: { additionalProperties: { @@ -6106,38 +5583,6 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: KubernetesRes description: "If specified, the pod's priorityClassName.", type: "string" }, - resources: { - description: "If specified, the pod's resource requirements.\nThese values override the global resource configuration flags.\nNote that when only specifying resource limits, ensure they are greater than or equal\nto the corresponding global resource requests configured via controller flags\n(--acme-http01-solver-resource-request-cpu, --acme-http01-solver-resource-request-memory).\nKubernetes will reject pod creation if limits are lower than requests, causing challenge failures.", - properties: { - limits: { - additionalProperties: { - anyOf: [{ - type: "integer" - }, { - type: "string" - }], - pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "x-kubernetes-int-or-string": true - }, - description: "Limits describes the maximum amount of compute resources allowed.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", - type: "object" - }, - requests: { - additionalProperties: { - anyOf: [{ - type: "integer" - }, { - type: "string" - }], - pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "x-kubernetes-int-or-string": true - }, - description: "Requests describes the minimum amount of compute resources required.\nIf Requests is omitted for a container, it defaults to Limits if that is explicitly specified,\notherwise to the global values configured via controller flags. Requests cannot exceed Limits.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", - type: "object" - } - }, - type: "object" - }, securityContext: { description: "If specified, the pod's security context", properties: { @@ -6207,8 +5652,7 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: KubernetesRes format: "int64", type: "integer" }, - type: "array", - "x-kubernetes-list-type": "atomic" + type: "array" }, sysctls: { description: "Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported\nsysctls (by the container runtime) might fail to launch.\nNote that this field cannot be set when spec.os.name is windows.", @@ -6227,8 +5671,7 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: KubernetesRes required: ["name", "value"], type: "object" }, - type: "array", - "x-kubernetes-list-type": "atomic" + type: "array" } }, type: "object" @@ -6251,7 +5694,7 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: KubernetesRes type: "string" }, operator: { - description: "Operator represents a key's relationship to the value.\nValid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.\nExists is equivalent to wildcard for value, so that a pod can\ntolerate all taints of a particular category.\nLt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).", + description: "Operator represents a key's relationship to the value.\nValid operators are Exists and Equal. Defaults to Equal.\nExists is equivalent to wildcard for value, so that a pod can\ntolerate all taints of a particular category.", type: "string" }, tolerationSeconds: { @@ -6266,8 +5709,7 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: KubernetesRes }, type: "object" }, - type: "array", - "x-kubernetes-list-type": "atomic" + type: "array" } }, type: "object" @@ -6293,16 +5735,14 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: KubernetesRes items: { type: "string" }, - type: "array", - "x-kubernetes-list-type": "atomic" + type: "array" }, dnsZones: { description: "List of DNSZones that this solver will be used to solve.\nThe most specific DNS zone match specified here will take precedence\nover other DNS zone matches, so a solver specifying sys.example.com\nwill be selected over one specifying example.com for the domain\nwww.sys.example.com.\nIf multiple solvers match with the same dnsZones value, the solver\nwith the most matching labels in matchLabels will be selected.\nIf neither has more matches, the solver defined earlier in the list\nwill be selected.", items: { type: "string" }, - type: "array", - "x-kubernetes-list-type": "atomic" + type: "array" }, matchLabels: { additionalProperties: { @@ -6313,16 +5753,11 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: KubernetesRes } }, type: "object" - }, - waitInsteadOfSelfCheck: { - description: "WaitInsteadOfSelfCheck, if set, skips cert-manager's self-check and\ninstead waits this long after presentation before asking the ACME server\nto validate the challenge.\n\nThis is an advanced escape hatch for environments where cert-manager's\nself-check cannot succeed from its own network or DNS viewpoint even\nthough the ACME server can still validate successfully, for example due\nto split-horizon DNS or NAT hairpinning.\n\nA value of 0 skips the self-check and asks the ACME server to validate\nimmediately after presentation, relying on the ACME server's own\nvalidation retries (RFC 8555 section 8.2) to succeed once the challenge\nhas propagated. A negative duration is rejected.\nValue must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration,\nfor example `30s` or `2m`.", - type: "string" } }, type: "object" }, - type: "array", - "x-kubernetes-list-type": "atomic" + type: "array" } }, required: ["privateKeySecretRef", "server"], @@ -6336,24 +5771,21 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: KubernetesRes items: { type: "string" }, - type: "array", - "x-kubernetes-list-type": "atomic" + type: "array" }, issuingCertificateURLs: { description: "IssuingCertificateURLs is a list of URLs which this issuer should embed into certificates\nit creates. See https://www.rfc-editor.org/rfc/rfc5280#section-4.2.2.1 for more details.\nAs an example, such a URL might be \"http://ca.domain.com/ca.crt\".", items: { type: "string" }, - type: "array", - "x-kubernetes-list-type": "atomic" + type: "array" }, ocspServers: { description: "The OCSP server list is an X.509 v3 extension that defines a list of\nURLs of OCSP responders. The OCSP responders can be queried for the\nrevocation status of an issued certificate. If not set, the\ncertificate will be issued with no OCSP servers set. For example, an\nOCSP server URL could be \"http://ocsp.int-x3.letsencrypt.org\".", items: { type: "string" }, - type: "array", - "x-kubernetes-list-type": "atomic" + type: "array" }, secretName: { description: "SecretName is the name of the secret used to sign Certificates issued\nby this Issuer.", @@ -6371,8 +5803,7 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: KubernetesRes items: { type: "string" }, - type: "array", - "x-kubernetes-list-type": "atomic" + type: "array" } }, type: "object" @@ -6413,53 +5844,6 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: KubernetesRes required: ["path", "roleId", "secretRef"], type: "object" }, - aws: { - description: "AWS authenticates with Vault using AWS IAM authentication.\nThis allows authentication using IAM roles for service accounts (IRSA),\nEKS Pod Identity (PIA), or ambient credentials (EC2 instance profiles, ECS task role).", - properties: { - iamRoleArn: { - description: "The ARN of the AWS IAM role to assume using the Kubernetes service account\ntoken. Required when using IRSA (serviceAccountRef is set).\nThis role must have a trust policy that allows the OIDC provider to assume it.", - type: "string" - }, - mountPath: { - description: "The Vault mountPath here is the mount path to use when authenticating with\nVault. For example, setting a value to `/v1/auth/foo`, will use the path\n`/v1/auth/foo/login` to authenticate with Vault. If unspecified, the\ndefault value \"/v1/auth/aws\" will be used.", - type: "string" - }, - region: { - description: "The AWS region to use for authentication. If not specified, the region\nwill be determined from AWS_REGION or AWS_DEFAULT_REGION environment\nvariables, falling back to \"us-east-1\" if not set.", - type: "string" - }, - role: { - description: "A required field containing the Vault Role to assume when authenticating.", - minLength: 1, - type: "string" - }, - serviceAccountRef: { - description: "A reference to a service account that will be used to request a web identity\ntoken for IRSA (IAM Roles for Service Accounts) authentication.", - properties: { - audiences: { - description: "TokenAudiences is an optional list of extra audiences to include in the token passed to Vault.\nThe default audiences are always included in the token.", - items: { - type: "string" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - }, - name: { - description: "Name of the ServiceAccount used to request a token.", - type: "string" - } - }, - required: ["name"], - type: "object" - }, - vaultHeaderValue: { - description: "The Vault header value to include in the STS signing request.\nThis is used to prevent replay attacks.", - type: "string" - } - }, - required: ["role"], - type: "object" - }, clientCertificate: { description: "ClientCertificate authenticates with Vault by presenting a client\ncertificate during the request's TLS handshake.\nWorks only when using HTTPS protocol.", properties: { @@ -6508,12 +5892,11 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: KubernetesRes description: "A reference to a service account that will be used to request a bound\ntoken (also known as \"projected token\"). Compared to using \"secretRef\",\nusing this field means that you don't rely on statically bound tokens. To\nuse this field, you must configure an RBAC rule to let cert-manager\nrequest a token.", properties: { audiences: { - description: "TokenAudiences is an optional list of extra audiences to include in the token passed to Vault.\nThe default audiences are always included in the token.", + description: "TokenAudiences is an optional list of extra audiences to include in the token passed to Vault. The default token\nconsisting of the issuer's namespace and name is always included.", items: { type: "string" }, - type: "array", - "x-kubernetes-list-type": "atomic" + type: "array" }, name: { description: "Name of the ServiceAccount used to request a token.", @@ -6606,23 +5989,19 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: KubernetesRes server: { description: "Server is the connection address for the Vault server, e.g: \"https://vault.example.com:8200\".", type: "string" - }, - serverName: { - description: "ServerName is used to verify the hostname on the returned certificates\nby the Vault server.", - type: "string" } }, required: ["auth", "path", "server"], type: "object" }, venafi: { - description: "Venafi configures this issuer to sign certificates using a CyberArk Certificate Manager Self-Hosted\nor SaaS policy zone.", + description: "Venafi configures this issuer to sign certificates using a Venafi TPP\nor Venafi Cloud policy zone.", properties: { cloud: { - description: "Cloud specifies the CyberArk Certificate Manager SaaS configuration settings.\nOnly one of CyberArk Certificate Manager may be specified.", + description: "Cloud specifies the Venafi cloud configuration settings.\nOnly one of TPP or Cloud may be specified.", properties: { apiTokenSecretRef: { - description: "APITokenSecretRef is a secret key selector for the CyberArk Certificate Manager SaaS API token.", + description: "APITokenSecretRef is a secret key selector for the Venafi Cloud API token.", properties: { key: { description: "The key of the entry in the Secret resource's `data` field to be used.\nSome instances of this field may be defaulted, in others it may be\nrequired.", @@ -6637,53 +6016,23 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: KubernetesRes type: "object" }, url: { - description: "URL is the base URL for CyberArk Certificate Manager SaaS.\nDefaults to \"https://api.venafi.cloud/\".", + description: "URL is the base URL for Venafi Cloud.\nDefaults to \"https://api.venafi.cloud/v1\".", type: "string" } }, required: ["apiTokenSecretRef"], type: "object" }, - ngts: { - description: "NGTS specifies Palo Alto Networks Next Generation Trust Services (NGTS) configuration\nusing OAuth 2.0 Client Credentials. Only one of tpp, cloud, or ngts may be specified.", - properties: { - credentialsRef: { - description: "CredentialsRef is a reference to a Kubernetes Secret containing the OAuth 2.0\nClient ID and Client Secret. The secret must contain the keys 'client-id' and\n'client-secret'.", - properties: { - name: { - description: "Name of the resource being referred to.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - type: "string" - } - }, - required: ["name"], - type: "object" - }, - tokenEndpoint: { - description: "TokenEndpoint is the OAuth 2.0 token endpoint URL used to obtain access tokens,\nfor example \"https://auth.apps.paloaltonetworks.com/oauth2/access_token\".\nDefaults to \"https://auth.apps.paloaltonetworks.com/oauth2/access_token\" if not set.", - type: "string" - }, - tsgID: { - description: "TSGID is the Tenant Service Group ID used to scope the OAuth 2.0 access token,\nfor example \"1234567890\". The tsg_id: prefix is added automatically.\nThis field is required.", - type: "string" - }, - url: { - description: "URL is the base URL for the NGTS API endpoint.\nDefaults to \"https://api.strata.paloaltonetworks.com/ngts\" if not set.", - type: "string" - } - }, - required: ["credentialsRef", "tsgID"], - type: "object" - }, tpp: { - description: "TPP specifies CyberArk Certificate Manager Self-Hosted configuration settings.\nOnly one of CyberArk Certificate Manager may be specified.", + description: "TPP specifies Trust Protection Platform configuration settings.\nOnly one of TPP or Cloud may be specified.", properties: { caBundle: { - description: "Base64-encoded bundle of PEM CAs which will be used to validate the certificate\nchain presented by the CyberArk Certificate Manager Self-Hosted server. Only used if using HTTPS; ignored for HTTP.\nIf undefined, the certificate bundle in the cert-manager controller container\nis used to validate the chain.", + description: "Base64-encoded bundle of PEM CAs which will be used to validate the certificate\nchain presented by the TPP server. Only used if using HTTPS; ignored for HTTP.\nIf undefined, the certificate bundle in the cert-manager controller container\nis used to validate the chain.", format: "byte", type: "string" }, caBundleSecretRef: { - description: "Reference to a Secret containing a base64-encoded bundle of PEM CAs\nwhich will be used to validate the certificate chain presented by the CyberArk Certificate Manager Self-Hosted server.\nOnly used if using HTTPS; ignored for HTTP. Mutually exclusive with CABundle.\nIf neither CABundle nor CABundleSecretRef is defined, the certificate bundle in\nthe cert-manager controller container is used to validate the TLS connection.", + description: "Reference to a Secret containing a base64-encoded bundle of PEM CAs\nwhich will be used to validate the certificate chain presented by the TPP server.\nOnly used if using HTTPS; ignored for HTTP. Mutually exclusive with CABundle.\nIf neither CABundle nor CABundleSecretRef is defined, the certificate bundle in\nthe cert-manager controller container is used to validate the TLS connection.", properties: { key: { description: "The key of the entry in the Secret resource's `data` field to be used.\nSome instances of this field may be defaulted, in others it may be\nrequired.", @@ -6698,7 +6047,7 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: KubernetesRes type: "object" }, credentialsRef: { - description: "CredentialsRef is a reference to a Secret containing the CyberArk Certificate Manager Self-Hosted API credentials.\nThe secret must contain the key 'access-token' for the Access Token Authentication,\nor two keys, 'username' and 'password' for the API Keys Authentication.", + description: "CredentialsRef is a reference to a Secret containing the Venafi TPP API credentials.\nThe secret must contain the key 'access-token' for the Access Token Authentication,\nor two keys, 'username' and 'password' for the API Keys Authentication.", properties: { name: { description: "Name of the resource being referred to.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", @@ -6709,7 +6058,7 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: KubernetesRes type: "object" }, url: { - description: "URL is the base URL for the vedsdk endpoint of the CyberArk Certificate Manager Self-Hosted instance,\nfor example: \"https://tpp.example.com/vedsdk\".", + description: "URL is the base URL for the vedsdk endpoint of the Venafi TPP instance,\nfor example: \"https://tpp.example.com/vedsdk\".", type: "string" } }, @@ -6717,16 +6066,12 @@ export const CustomResourceDefinition_ClusterissuersCertManagerIo: KubernetesRes type: "object" }, zone: { - description: "Zone is the Certificate Manager Policy Zone to use for this issuer.\nAll requests made to the Certificate Manager platform will be restricted by the named\nzone policy.\nThis field is required.", + description: "Zone is the Venafi Policy Zone to use for this issuer.\nAll requests made to the Venafi platform will be restricted by the named\nzone policy.\nThis field is required.", type: "string" } }, required: ["zone"], - type: "object", - "x-kubernetes-validations": [{ - message: "exactly one of tpp, cloud, or ngts must be configured", - rule: "(has(self.tpp) ? 1 : 0) + (has(self.cloud) ? 1 : 0) + (has(self.ngts) ? 1 : 0) == 1" - }] + type: "object" } }, type: "object" @@ -6821,8 +6166,8 @@ export const CustomResourceDefinition_IssuersCertManagerIo: KubernetesResource = "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "cert-manager", - "app.kubernetes.io/version": "v1.21.1", - "helm.sh/chart": "cert-manager-v1.21.1" + "app.kubernetes.io/version": "v1.17.0", + "helm.sh/chart": "cert-manager-v1.17.0" }, name: "issuers.cert-manager.io" }, @@ -6833,17 +6178,16 @@ export const CustomResourceDefinition_IssuersCertManagerIo: KubernetesResource = kind: "Issuer", listKind: "IssuerList", plural: "issuers", - shortNames: ["iss"], singular: "issuer" }, scope: "Namespaced", versions: [{ additionalPrinterColumns: [{ - jsonPath: ".status.conditions[?(@.type == \"Ready\")].status", + jsonPath: ".status.conditions[?(@.type==\"Ready\")].status", name: "Ready", type: "string" }, { - jsonPath: ".status.conditions[?(@.type == \"Ready\")].message", + jsonPath: ".status.conditions[?(@.type==\"Ready\")].message", name: "Status", priority: 1, type: "string" @@ -6924,7 +6268,7 @@ export const CustomResourceDefinition_IssuersCertManagerIo: KubernetesResource = type: "object" }, preferredChain: { - description: "PreferredChain is the chain to use if the ACME server outputs multiple.\nPreferredChain is no guarantee that this one gets delivered by the ACME\nendpoint.\nFor example, for Let's Encrypt's DST cross-sign you would use:\n\"DST Root CA X3\" or \"ISRG Root X1\" for the newer Let's Encrypt root CA.\nThis value picks the first certificate bundle in the combined set of\nACME default and alternative chains that has a root-most certificate with\nthis value as its issuer's commonname.", + description: "PreferredChain is the chain to use if the ACME server outputs multiple.\nPreferredChain is no guarantee that this one gets delivered by the ACME\nendpoint.\nFor example, for Let's Encrypt's DST crosssign you would use:\n\"DST Root CA X3\" or \"ISRG Root X1\" for the newer Let's Encrypt root CA.\nThis value picks the first certificate bundle in the combined set of\nACME default and alternative chains that has a root-most certificate with\nthis value as its issuer's commonname.", maxLength: 64, type: "string" }, @@ -6943,10 +6287,6 @@ export const CustomResourceDefinition_IssuersCertManagerIo: KubernetesResource = required: ["name"], type: "object" }, - profile: { - description: "Profile allows requesting a certificate profile from the ACME server.\nSupported profiles are listed by the server's ACME directory URL.", - type: "string" - }, server: { description: "Server is the URL used to access the ACME server's 'directory' endpoint.\nFor example, for Let's Encrypt's staging endpoint, you would use:\n\"https://acme-staging-v02.api.letsencrypt.org/directory\".\nOnly ACME v2 endpoints (i.e. RFC 8555) are supported.", type: "string" @@ -7078,15 +6418,15 @@ export const CustomResourceDefinition_IssuersCertManagerIo: KubernetesResource = description: "Auth: Azure Workload Identity or Azure Managed Service Identity:\nSettings to enable Azure Workload Identity or Azure Managed Service Identity\nIf set, ClientID, ClientSecret and TenantID must not be set.", properties: { clientID: { - description: "client ID of the managed identity, cannot be used at the same time as resourceID", + description: "client ID of the managed identity, can not be used at the same time as resourceID", type: "string" }, resourceID: { - description: "resource ID of the managed identity, cannot be used at the same time as clientID\nCannot be used for Azure Managed Service Identity", + description: "resource ID of the managed identity, can not be used at the same time as clientID\nCannot be used for Azure Managed Service Identity", type: "string" }, tenantID: { - description: "tenant ID of the managed identity, cannot be used at the same time as resourceID", + description: "tenant ID of the managed identity, can not be used at the same time as resourceID", type: "string" } }, @@ -7103,11 +6443,6 @@ export const CustomResourceDefinition_IssuersCertManagerIo: KubernetesResource = tenantID: { description: "Auth: Azure Service Principal:\nThe TenantID of the Azure Service Principal used to authenticate with Azure DNS.\nIf set, ClientID and ClientSecret must also be set.", type: "string" - }, - zoneType: { - description: "ZoneType determines which type of Azure DNS zone to use.\n\nValid values are:\n - AzurePublicZone (default): Use a public Azure DNS zone.\n - AzurePrivateZone: Use an Azure Private DNS zone.\n\nIf not specified, AzurePublicZone is used.\n\nSupport for Azure Private DNS zones is currently\nexperimental and may change in future releases.", - enum: ["AzurePublicZone", "AzurePrivateZone"], - type: "string" } }, required: ["resourceGroupName", "subscriptionID"], @@ -7213,12 +6548,7 @@ export const CustomResourceDefinition_IssuersCertManagerIo: KubernetesResource = description: "Use RFC2136 (\"Dynamic Updates in the Domain Name System\") (https://datatracker.ietf.org/doc/rfc2136/)\nto manage DNS01 challenge records.", properties: { nameserver: { - description: "The IP address or hostname of an authoritative DNS server supporting\nRFC2136 in the form host:port. If the host is an IPv6 address it must be\nenclosed in square brackets (e.g [2001:db8::1]); port is optional.\nThis field is required.", - type: "string" - }, - protocol: { - description: "Protocol to use for dynamic DNS update queries. Valid values are (case-sensitive) ``TCP`` and ``UDP``; ``UDP`` (default).", - enum: ["TCP", "UDP"], + description: "The IP address or hostname of an authoritative DNS server supporting\nRFC2136 in the form host:port. If the host is an IPv6 address it must be\nenclosed in square brackets (e.g [2001:db8::1])\xA0; port is optional.\nThis field is required.", type: "string" }, tsigAlgorithm: { @@ -7252,11 +6582,11 @@ export const CustomResourceDefinition_IssuersCertManagerIo: KubernetesResource = description: "Use the AWS Route53 API to manage DNS01 challenge records.", properties: { accessKeyID: { - description: "The AccessKeyID is used for authentication.\nCannot be set when SecretAccessKeyID is set.\nIf neither the Access Key nor Key ID are set, we fall back to using env\nvars, shared credentials file, or AWS Instance metadata,\nsee: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials", + description: "The AccessKeyID is used for authentication.\nCannot be set when SecretAccessKeyID is set.\nIf neither the Access Key nor Key ID are set, we fall-back to using env\nvars, shared credentials file or AWS Instance metadata,\nsee: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials", type: "string" }, accessKeyIDSecretRef: { - description: "The SecretAccessKey is used for authentication. If set, pull the AWS\naccess key ID from a key within a Kubernetes Secret.\nCannot be set when AccessKeyID is set.\nIf neither the Access Key nor Key ID are set, we fall back to using env\nvars, shared credentials file, or AWS Instance metadata,\nsee: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials", + description: "The SecretAccessKey is used for authentication. If set, pull the AWS\naccess key ID from a key within a Kubernetes Secret.\nCannot be set when AccessKeyID is set.\nIf neither the Access Key nor Key ID are set, we fall-back to using env\nvars, shared credentials file or AWS Instance metadata,\nsee: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials", properties: { key: { description: "The key of the entry in the Secret resource's `data` field to be used.\nSome instances of this field may be defaulted, in others it may be\nrequired.", @@ -7284,8 +6614,7 @@ export const CustomResourceDefinition_IssuersCertManagerIo: KubernetesResource = items: { type: "string" }, - type: "array", - "x-kubernetes-list-type": "atomic" + type: "array" }, name: { description: "Name of the ServiceAccount used to request a token.", @@ -7316,7 +6645,7 @@ export const CustomResourceDefinition_IssuersCertManagerIo: KubernetesResource = type: "string" }, secretAccessKeySecretRef: { - description: "The SecretAccessKey is used for authentication.\nIf neither the Access Key nor Key ID are set, we fall back to using env\nvars, shared credentials file, or AWS Instance metadata,\nsee: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials", + description: "The SecretAccessKey is used for authentication.\nIf neither the Access Key nor Key ID are set, we fall-back to using env\nvars, shared credentials file or AWS Instance metadata,\nsee: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials", properties: { key: { description: "The key of the entry in the Secret resource's `data` field to be used.\nSome instances of this field may be defaulted, in others it may be\nrequired.", @@ -7337,7 +6666,7 @@ export const CustomResourceDefinition_IssuersCertManagerIo: KubernetesResource = description: "Configure an external webhook based DNS01 challenge solver to manage\nDNS01 challenge records.", properties: { config: { - description: "Additional configuration that should be passed to the webhook apiserver\nwhen challenges are processed.\nThis can contain arbitrary JSON data.\nSecret values should not be specified in this stanza.\nIf secret values are needed (e.g., credentials for a DNS service), you\nshould use a SecretKeySelector to reference a Secret resource.\nFor details on the schema of this field, consult the webhook provider\nimplementation's documentation.", + description: "Additional configuration that should be passed to the webhook apiserver\nwhen challenges are processed.\nThis can contain arbitrary JSON data.\nSecret values should not be specified in this stanza.\nIf secret values are needed (e.g. credentials for a DNS service), you\nshould use a SecretKeySelector to reference a Secret resource.\nFor details on the schema of this field, consult the webhook provider\nimplementation's documentation.", "x-kubernetes-preserve-unknown-fields": true }, groupName: { @@ -7345,7 +6674,7 @@ export const CustomResourceDefinition_IssuersCertManagerIo: KubernetesResource = type: "string" }, solverName: { - description: "The name of the solver to use, as defined in the webhook provider\nimplementation.\nThis will typically be the name of the provider, e.g., 'cloudflare'.", + description: "The name of the solver to use, as defined in the webhook provider\nimplementation.\nThis will typically be the name of the provider, e.g. 'cloudflare'.", type: "string" } }, @@ -7356,7 +6685,7 @@ export const CustomResourceDefinition_IssuersCertManagerIo: KubernetesResource = type: "object" }, http01: { - description: "Configures cert-manager to attempt to complete authorizations by\nperforming the HTTP01 challenge flow.\nIt is not possible to obtain certificates for wildcard domain names\n(e.g., `*.example.com`) using the HTTP01 challenge mechanism.", + description: "Configures cert-manager to attempt to complete authorizations by\nperforming the HTTP01 challenge flow.\nIt is not possible to obtain certificates for wildcard domain names\n(e.g. `*.example.com`) using the HTTP01 challenge mechanism.", properties: { gatewayHTTPRoute: { description: "The Gateway API is a sig-network community API that models service networking\nin Kubernetes (https://gateway-api.sigs.k8s.io/). The Gateway solver will\ncreate HTTPRoutes with the specified labels in the same namespace as the challenge.\nThis solver is experimental, and fields / behaviour may change in the future.", @@ -7419,8 +6748,7 @@ export const CustomResourceDefinition_IssuersCertManagerIo: KubernetesResource = required: ["name"], type: "object" }, - type: "array", - "x-kubernetes-list-type": "atomic" + type: "array" }, podTemplate: { description: "Optional pod template used to configure the ACME challenge solver pods\nused for HTTP01 challenges.", @@ -7667,7 +6995,7 @@ export const CustomResourceDefinition_IssuersCertManagerIo: KubernetesResource = "x-kubernetes-map-type": "atomic" }, matchLabelKeys: { - description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.", + description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", items: { type: "string" }, @@ -7675,7 +7003,7 @@ export const CustomResourceDefinition_IssuersCertManagerIo: KubernetesResource = "x-kubernetes-list-type": "atomic" }, mismatchLabelKeys: { - description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.", + description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", items: { type: "string" }, @@ -7800,7 +7128,7 @@ export const CustomResourceDefinition_IssuersCertManagerIo: KubernetesResource = "x-kubernetes-map-type": "atomic" }, matchLabelKeys: { - description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.", + description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", items: { type: "string" }, @@ -7808,7 +7136,7 @@ export const CustomResourceDefinition_IssuersCertManagerIo: KubernetesResource = "x-kubernetes-list-type": "atomic" }, mismatchLabelKeys: { - description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.", + description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", items: { type: "string" }, @@ -7883,7 +7211,7 @@ export const CustomResourceDefinition_IssuersCertManagerIo: KubernetesResource = description: "Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).", properties: { preferredDuringSchedulingIgnoredDuringExecution: { - description: "The scheduler will prefer to schedule pods to nodes that satisfy\nthe anti-affinity expressions specified by this field, but it may choose\na node that violates one or more of the expressions. The node that is\nmost preferred is the one with the greatest sum of weights, i.e.\nfor each node that meets all of the scheduling requirements (resource\nrequest, requiredDuringScheduling anti-affinity expressions, etc.),\ncompute a sum by iterating through the elements of this field and subtracting\n\"weight\" from the sum if the node has pods which matches the corresponding podAffinityTerm; the\nnode(s) with the highest sum are the most preferred.", + description: "The scheduler will prefer to schedule pods to nodes that satisfy\nthe anti-affinity expressions specified by this field, but it may choose\na node that violates one or more of the expressions. The node that is\nmost preferred is the one with the greatest sum of weights, i.e.\nfor each node that meets all of the scheduling requirements (resource\nrequest, requiredDuringScheduling anti-affinity expressions, etc.),\ncompute a sum by iterating through the elements of this field and adding\n\"weight\" to the sum if the node has pods which matches the corresponding podAffinityTerm; the\nnode(s) with the highest sum are the most preferred.", items: { description: "The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)", properties: { @@ -7933,7 +7261,7 @@ export const CustomResourceDefinition_IssuersCertManagerIo: KubernetesResource = "x-kubernetes-map-type": "atomic" }, matchLabelKeys: { - description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.", + description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", items: { type: "string" }, @@ -7941,7 +7269,7 @@ export const CustomResourceDefinition_IssuersCertManagerIo: KubernetesResource = "x-kubernetes-list-type": "atomic" }, mismatchLabelKeys: { - description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.", + description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", items: { type: "string" }, @@ -8066,7 +7394,7 @@ export const CustomResourceDefinition_IssuersCertManagerIo: KubernetesResource = "x-kubernetes-map-type": "atomic" }, matchLabelKeys: { - description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.", + description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", items: { type: "string" }, @@ -8074,7 +7402,7 @@ export const CustomResourceDefinition_IssuersCertManagerIo: KubernetesResource = "x-kubernetes-list-type": "atomic" }, mismatchLabelKeys: { - description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.", + description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", items: { type: "string" }, @@ -8162,9 +7490,7 @@ export const CustomResourceDefinition_IssuersCertManagerIo: KubernetesResource = type: "object", "x-kubernetes-map-type": "atomic" }, - type: "array", - "x-kubernetes-list-map-keys": ["name"], - "x-kubernetes-list-type": "map" + type: "array" }, nodeSelector: { additionalProperties: { @@ -8177,38 +7503,6 @@ export const CustomResourceDefinition_IssuersCertManagerIo: KubernetesResource = description: "If specified, the pod's priorityClassName.", type: "string" }, - resources: { - description: "If specified, the pod's resource requirements.\nThese values override the global resource configuration flags.\nNote that when only specifying resource limits, ensure they are greater than or equal\nto the corresponding global resource requests configured via controller flags\n(--acme-http01-solver-resource-request-cpu, --acme-http01-solver-resource-request-memory).\nKubernetes will reject pod creation if limits are lower than requests, causing challenge failures.", - properties: { - limits: { - additionalProperties: { - anyOf: [{ - type: "integer" - }, { - type: "string" - }], - pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "x-kubernetes-int-or-string": true - }, - description: "Limits describes the maximum amount of compute resources allowed.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", - type: "object" - }, - requests: { - additionalProperties: { - anyOf: [{ - type: "integer" - }, { - type: "string" - }], - pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "x-kubernetes-int-or-string": true - }, - description: "Requests describes the minimum amount of compute resources required.\nIf Requests is omitted for a container, it defaults to Limits if that is explicitly specified,\notherwise to the global values configured via controller flags. Requests cannot exceed Limits.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", - type: "object" - } - }, - type: "object" - }, securityContext: { description: "If specified, the pod's security context", properties: { @@ -8278,8 +7572,7 @@ export const CustomResourceDefinition_IssuersCertManagerIo: KubernetesResource = format: "int64", type: "integer" }, - type: "array", - "x-kubernetes-list-type": "atomic" + type: "array" }, sysctls: { description: "Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported\nsysctls (by the container runtime) might fail to launch.\nNote that this field cannot be set when spec.os.name is windows.", @@ -8298,8 +7591,7 @@ export const CustomResourceDefinition_IssuersCertManagerIo: KubernetesResource = required: ["name", "value"], type: "object" }, - type: "array", - "x-kubernetes-list-type": "atomic" + type: "array" } }, type: "object" @@ -8322,7 +7614,7 @@ export const CustomResourceDefinition_IssuersCertManagerIo: KubernetesResource = type: "string" }, operator: { - description: "Operator represents a key's relationship to the value.\nValid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.\nExists is equivalent to wildcard for value, so that a pod can\ntolerate all taints of a particular category.\nLt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).", + description: "Operator represents a key's relationship to the value.\nValid operators are Exists and Equal. Defaults to Equal.\nExists is equivalent to wildcard for value, so that a pod can\ntolerate all taints of a particular category.", type: "string" }, tolerationSeconds: { @@ -8337,8 +7629,7 @@ export const CustomResourceDefinition_IssuersCertManagerIo: KubernetesResource = }, type: "object" }, - type: "array", - "x-kubernetes-list-type": "atomic" + type: "array" } }, type: "object" @@ -8639,7 +7930,7 @@ export const CustomResourceDefinition_IssuersCertManagerIo: KubernetesResource = "x-kubernetes-map-type": "atomic" }, matchLabelKeys: { - description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.", + description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", items: { type: "string" }, @@ -8647,7 +7938,7 @@ export const CustomResourceDefinition_IssuersCertManagerIo: KubernetesResource = "x-kubernetes-list-type": "atomic" }, mismatchLabelKeys: { - description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.", + description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", items: { type: "string" }, @@ -8772,7 +8063,7 @@ export const CustomResourceDefinition_IssuersCertManagerIo: KubernetesResource = "x-kubernetes-map-type": "atomic" }, matchLabelKeys: { - description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.", + description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", items: { type: "string" }, @@ -8780,7 +8071,7 @@ export const CustomResourceDefinition_IssuersCertManagerIo: KubernetesResource = "x-kubernetes-list-type": "atomic" }, mismatchLabelKeys: { - description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.", + description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", items: { type: "string" }, @@ -8855,7 +8146,7 @@ export const CustomResourceDefinition_IssuersCertManagerIo: KubernetesResource = description: "Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)).", properties: { preferredDuringSchedulingIgnoredDuringExecution: { - description: "The scheduler will prefer to schedule pods to nodes that satisfy\nthe anti-affinity expressions specified by this field, but it may choose\na node that violates one or more of the expressions. The node that is\nmost preferred is the one with the greatest sum of weights, i.e.\nfor each node that meets all of the scheduling requirements (resource\nrequest, requiredDuringScheduling anti-affinity expressions, etc.),\ncompute a sum by iterating through the elements of this field and subtracting\n\"weight\" from the sum if the node has pods which matches the corresponding podAffinityTerm; the\nnode(s) with the highest sum are the most preferred.", + description: "The scheduler will prefer to schedule pods to nodes that satisfy\nthe anti-affinity expressions specified by this field, but it may choose\na node that violates one or more of the expressions. The node that is\nmost preferred is the one with the greatest sum of weights, i.e.\nfor each node that meets all of the scheduling requirements (resource\nrequest, requiredDuringScheduling anti-affinity expressions, etc.),\ncompute a sum by iterating through the elements of this field and adding\n\"weight\" to the sum if the node has pods which matches the corresponding podAffinityTerm; the\nnode(s) with the highest sum are the most preferred.", items: { description: "The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s)", properties: { @@ -8905,7 +8196,7 @@ export const CustomResourceDefinition_IssuersCertManagerIo: KubernetesResource = "x-kubernetes-map-type": "atomic" }, matchLabelKeys: { - description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.", + description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", items: { type: "string" }, @@ -8913,7 +8204,7 @@ export const CustomResourceDefinition_IssuersCertManagerIo: KubernetesResource = "x-kubernetes-list-type": "atomic" }, mismatchLabelKeys: { - description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.", + description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", items: { type: "string" }, @@ -9038,7 +8329,7 @@ export const CustomResourceDefinition_IssuersCertManagerIo: KubernetesResource = "x-kubernetes-map-type": "atomic" }, matchLabelKeys: { - description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.", + description: "MatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key in (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both matchLabelKeys and labelSelector.\nAlso, matchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", items: { type: "string" }, @@ -9046,7 +8337,7 @@ export const CustomResourceDefinition_IssuersCertManagerIo: KubernetesResource = "x-kubernetes-list-type": "atomic" }, mismatchLabelKeys: { - description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.", + description: "MismatchLabelKeys is a set of pod label keys to select which pods will\nbe taken into consideration. The keys are used to lookup values from the\nincoming pod labels, those key-value labels are merged with `labelSelector` as `key notin (value)`\nto select the group of existing pods which pods will be taken into consideration\nfor the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming\npod labels will be ignored. The default value is empty.\nThe same key is forbidden to exist in both mismatchLabelKeys and labelSelector.\nAlso, mismatchLabelKeys cannot be set when labelSelector isn't set.\nThis is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).", items: { type: "string" }, @@ -9134,9 +8425,7 @@ export const CustomResourceDefinition_IssuersCertManagerIo: KubernetesResource = type: "object", "x-kubernetes-map-type": "atomic" }, - type: "array", - "x-kubernetes-list-map-keys": ["name"], - "x-kubernetes-list-type": "map" + type: "array" }, nodeSelector: { additionalProperties: { @@ -9149,38 +8438,6 @@ export const CustomResourceDefinition_IssuersCertManagerIo: KubernetesResource = description: "If specified, the pod's priorityClassName.", type: "string" }, - resources: { - description: "If specified, the pod's resource requirements.\nThese values override the global resource configuration flags.\nNote that when only specifying resource limits, ensure they are greater than or equal\nto the corresponding global resource requests configured via controller flags\n(--acme-http01-solver-resource-request-cpu, --acme-http01-solver-resource-request-memory).\nKubernetes will reject pod creation if limits are lower than requests, causing challenge failures.", - properties: { - limits: { - additionalProperties: { - anyOf: [{ - type: "integer" - }, { - type: "string" - }], - pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "x-kubernetes-int-or-string": true - }, - description: "Limits describes the maximum amount of compute resources allowed.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", - type: "object" - }, - requests: { - additionalProperties: { - anyOf: [{ - type: "integer" - }, { - type: "string" - }], - pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", - "x-kubernetes-int-or-string": true - }, - description: "Requests describes the minimum amount of compute resources required.\nIf Requests is omitted for a container, it defaults to Limits if that is explicitly specified,\notherwise to the global values configured via controller flags. Requests cannot exceed Limits.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", - type: "object" - } - }, - type: "object" - }, securityContext: { description: "If specified, the pod's security context", properties: { @@ -9250,8 +8507,7 @@ export const CustomResourceDefinition_IssuersCertManagerIo: KubernetesResource = format: "int64", type: "integer" }, - type: "array", - "x-kubernetes-list-type": "atomic" + type: "array" }, sysctls: { description: "Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported\nsysctls (by the container runtime) might fail to launch.\nNote that this field cannot be set when spec.os.name is windows.", @@ -9270,8 +8526,7 @@ export const CustomResourceDefinition_IssuersCertManagerIo: KubernetesResource = required: ["name", "value"], type: "object" }, - type: "array", - "x-kubernetes-list-type": "atomic" + type: "array" } }, type: "object" @@ -9294,7 +8549,7 @@ export const CustomResourceDefinition_IssuersCertManagerIo: KubernetesResource = type: "string" }, operator: { - description: "Operator represents a key's relationship to the value.\nValid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.\nExists is equivalent to wildcard for value, so that a pod can\ntolerate all taints of a particular category.\nLt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).", + description: "Operator represents a key's relationship to the value.\nValid operators are Exists and Equal. Defaults to Equal.\nExists is equivalent to wildcard for value, so that a pod can\ntolerate all taints of a particular category.", type: "string" }, tolerationSeconds: { @@ -9309,8 +8564,7 @@ export const CustomResourceDefinition_IssuersCertManagerIo: KubernetesResource = }, type: "object" }, - type: "array", - "x-kubernetes-list-type": "atomic" + type: "array" } }, type: "object" @@ -9336,16 +8590,14 @@ export const CustomResourceDefinition_IssuersCertManagerIo: KubernetesResource = items: { type: "string" }, - type: "array", - "x-kubernetes-list-type": "atomic" + type: "array" }, dnsZones: { description: "List of DNSZones that this solver will be used to solve.\nThe most specific DNS zone match specified here will take precedence\nover other DNS zone matches, so a solver specifying sys.example.com\nwill be selected over one specifying example.com for the domain\nwww.sys.example.com.\nIf multiple solvers match with the same dnsZones value, the solver\nwith the most matching labels in matchLabels will be selected.\nIf neither has more matches, the solver defined earlier in the list\nwill be selected.", items: { type: "string" }, - type: "array", - "x-kubernetes-list-type": "atomic" + type: "array" }, matchLabels: { additionalProperties: { @@ -9356,16 +8608,11 @@ export const CustomResourceDefinition_IssuersCertManagerIo: KubernetesResource = } }, type: "object" - }, - waitInsteadOfSelfCheck: { - description: "WaitInsteadOfSelfCheck, if set, skips cert-manager's self-check and\ninstead waits this long after presentation before asking the ACME server\nto validate the challenge.\n\nThis is an advanced escape hatch for environments where cert-manager's\nself-check cannot succeed from its own network or DNS viewpoint even\nthough the ACME server can still validate successfully, for example due\nto split-horizon DNS or NAT hairpinning.\n\nA value of 0 skips the self-check and asks the ACME server to validate\nimmediately after presentation, relying on the ACME server's own\nvalidation retries (RFC 8555 section 8.2) to succeed once the challenge\nhas propagated. A negative duration is rejected.\nValue must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration,\nfor example `30s` or `2m`.", - type: "string" } }, type: "object" }, - type: "array", - "x-kubernetes-list-type": "atomic" + type: "array" } }, required: ["privateKeySecretRef", "server"], @@ -9379,24 +8626,21 @@ export const CustomResourceDefinition_IssuersCertManagerIo: KubernetesResource = items: { type: "string" }, - type: "array", - "x-kubernetes-list-type": "atomic" + type: "array" }, issuingCertificateURLs: { description: "IssuingCertificateURLs is a list of URLs which this issuer should embed into certificates\nit creates. See https://www.rfc-editor.org/rfc/rfc5280#section-4.2.2.1 for more details.\nAs an example, such a URL might be \"http://ca.domain.com/ca.crt\".", items: { type: "string" }, - type: "array", - "x-kubernetes-list-type": "atomic" + type: "array" }, ocspServers: { description: "The OCSP server list is an X.509 v3 extension that defines a list of\nURLs of OCSP responders. The OCSP responders can be queried for the\nrevocation status of an issued certificate. If not set, the\ncertificate will be issued with no OCSP servers set. For example, an\nOCSP server URL could be \"http://ocsp.int-x3.letsencrypt.org\".", items: { type: "string" }, - type: "array", - "x-kubernetes-list-type": "atomic" + type: "array" }, secretName: { description: "SecretName is the name of the secret used to sign Certificates issued\nby this Issuer.", @@ -9414,8 +8658,7 @@ export const CustomResourceDefinition_IssuersCertManagerIo: KubernetesResource = items: { type: "string" }, - type: "array", - "x-kubernetes-list-type": "atomic" + type: "array" } }, type: "object" @@ -9456,53 +8699,6 @@ export const CustomResourceDefinition_IssuersCertManagerIo: KubernetesResource = required: ["path", "roleId", "secretRef"], type: "object" }, - aws: { - description: "AWS authenticates with Vault using AWS IAM authentication.\nThis allows authentication using IAM roles for service accounts (IRSA),\nEKS Pod Identity (PIA), or ambient credentials (EC2 instance profiles, ECS task role).", - properties: { - iamRoleArn: { - description: "The ARN of the AWS IAM role to assume using the Kubernetes service account\ntoken. Required when using IRSA (serviceAccountRef is set).\nThis role must have a trust policy that allows the OIDC provider to assume it.", - type: "string" - }, - mountPath: { - description: "The Vault mountPath here is the mount path to use when authenticating with\nVault. For example, setting a value to `/v1/auth/foo`, will use the path\n`/v1/auth/foo/login` to authenticate with Vault. If unspecified, the\ndefault value \"/v1/auth/aws\" will be used.", - type: "string" - }, - region: { - description: "The AWS region to use for authentication. If not specified, the region\nwill be determined from AWS_REGION or AWS_DEFAULT_REGION environment\nvariables, falling back to \"us-east-1\" if not set.", - type: "string" - }, - role: { - description: "A required field containing the Vault Role to assume when authenticating.", - minLength: 1, - type: "string" - }, - serviceAccountRef: { - description: "A reference to a service account that will be used to request a web identity\ntoken for IRSA (IAM Roles for Service Accounts) authentication.", - properties: { - audiences: { - description: "TokenAudiences is an optional list of extra audiences to include in the token passed to Vault.\nThe default audiences are always included in the token.", - items: { - type: "string" - }, - type: "array", - "x-kubernetes-list-type": "atomic" - }, - name: { - description: "Name of the ServiceAccount used to request a token.", - type: "string" - } - }, - required: ["name"], - type: "object" - }, - vaultHeaderValue: { - description: "The Vault header value to include in the STS signing request.\nThis is used to prevent replay attacks.", - type: "string" - } - }, - required: ["role"], - type: "object" - }, clientCertificate: { description: "ClientCertificate authenticates with Vault by presenting a client\ncertificate during the request's TLS handshake.\nWorks only when using HTTPS protocol.", properties: { @@ -9551,12 +8747,11 @@ export const CustomResourceDefinition_IssuersCertManagerIo: KubernetesResource = description: "A reference to a service account that will be used to request a bound\ntoken (also known as \"projected token\"). Compared to using \"secretRef\",\nusing this field means that you don't rely on statically bound tokens. To\nuse this field, you must configure an RBAC rule to let cert-manager\nrequest a token.", properties: { audiences: { - description: "TokenAudiences is an optional list of extra audiences to include in the token passed to Vault.\nThe default audiences are always included in the token.", + description: "TokenAudiences is an optional list of extra audiences to include in the token passed to Vault. The default token\nconsisting of the issuer's namespace and name is always included.", items: { type: "string" }, - type: "array", - "x-kubernetes-list-type": "atomic" + type: "array" }, name: { description: "Name of the ServiceAccount used to request a token.", @@ -9649,23 +8844,19 @@ export const CustomResourceDefinition_IssuersCertManagerIo: KubernetesResource = server: { description: "Server is the connection address for the Vault server, e.g: \"https://vault.example.com:8200\".", type: "string" - }, - serverName: { - description: "ServerName is used to verify the hostname on the returned certificates\nby the Vault server.", - type: "string" } }, required: ["auth", "path", "server"], type: "object" }, venafi: { - description: "Venafi configures this issuer to sign certificates using a CyberArk Certificate Manager Self-Hosted\nor SaaS policy zone.", + description: "Venafi configures this issuer to sign certificates using a Venafi TPP\nor Venafi Cloud policy zone.", properties: { cloud: { - description: "Cloud specifies the CyberArk Certificate Manager SaaS configuration settings.\nOnly one of CyberArk Certificate Manager may be specified.", + description: "Cloud specifies the Venafi cloud configuration settings.\nOnly one of TPP or Cloud may be specified.", properties: { apiTokenSecretRef: { - description: "APITokenSecretRef is a secret key selector for the CyberArk Certificate Manager SaaS API token.", + description: "APITokenSecretRef is a secret key selector for the Venafi Cloud API token.", properties: { key: { description: "The key of the entry in the Secret resource's `data` field to be used.\nSome instances of this field may be defaulted, in others it may be\nrequired.", @@ -9677,56 +8868,26 @@ export const CustomResourceDefinition_IssuersCertManagerIo: KubernetesResource = } }, required: ["name"], - type: "object" - }, - url: { - description: "URL is the base URL for CyberArk Certificate Manager SaaS.\nDefaults to \"https://api.venafi.cloud/\".", - type: "string" - } - }, - required: ["apiTokenSecretRef"], - type: "object" - }, - ngts: { - description: "NGTS specifies Palo Alto Networks Next Generation Trust Services (NGTS) configuration\nusing OAuth 2.0 Client Credentials. Only one of tpp, cloud, or ngts may be specified.", - properties: { - credentialsRef: { - description: "CredentialsRef is a reference to a Kubernetes Secret containing the OAuth 2.0\nClient ID and Client Secret. The secret must contain the keys 'client-id' and\n'client-secret'.", - properties: { - name: { - description: "Name of the resource being referred to.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", - type: "string" - } - }, - required: ["name"], - type: "object" - }, - tokenEndpoint: { - description: "TokenEndpoint is the OAuth 2.0 token endpoint URL used to obtain access tokens,\nfor example \"https://auth.apps.paloaltonetworks.com/oauth2/access_token\".\nDefaults to \"https://auth.apps.paloaltonetworks.com/oauth2/access_token\" if not set.", - type: "string" - }, - tsgID: { - description: "TSGID is the Tenant Service Group ID used to scope the OAuth 2.0 access token,\nfor example \"1234567890\". The tsg_id: prefix is added automatically.\nThis field is required.", - type: "string" + type: "object" }, url: { - description: "URL is the base URL for the NGTS API endpoint.\nDefaults to \"https://api.strata.paloaltonetworks.com/ngts\" if not set.", + description: "URL is the base URL for Venafi Cloud.\nDefaults to \"https://api.venafi.cloud/v1\".", type: "string" } }, - required: ["credentialsRef", "tsgID"], + required: ["apiTokenSecretRef"], type: "object" }, tpp: { - description: "TPP specifies CyberArk Certificate Manager Self-Hosted configuration settings.\nOnly one of CyberArk Certificate Manager may be specified.", + description: "TPP specifies Trust Protection Platform configuration settings.\nOnly one of TPP or Cloud may be specified.", properties: { caBundle: { - description: "Base64-encoded bundle of PEM CAs which will be used to validate the certificate\nchain presented by the CyberArk Certificate Manager Self-Hosted server. Only used if using HTTPS; ignored for HTTP.\nIf undefined, the certificate bundle in the cert-manager controller container\nis used to validate the chain.", + description: "Base64-encoded bundle of PEM CAs which will be used to validate the certificate\nchain presented by the TPP server. Only used if using HTTPS; ignored for HTTP.\nIf undefined, the certificate bundle in the cert-manager controller container\nis used to validate the chain.", format: "byte", type: "string" }, caBundleSecretRef: { - description: "Reference to a Secret containing a base64-encoded bundle of PEM CAs\nwhich will be used to validate the certificate chain presented by the CyberArk Certificate Manager Self-Hosted server.\nOnly used if using HTTPS; ignored for HTTP. Mutually exclusive with CABundle.\nIf neither CABundle nor CABundleSecretRef is defined, the certificate bundle in\nthe cert-manager controller container is used to validate the TLS connection.", + description: "Reference to a Secret containing a base64-encoded bundle of PEM CAs\nwhich will be used to validate the certificate chain presented by the TPP server.\nOnly used if using HTTPS; ignored for HTTP. Mutually exclusive with CABundle.\nIf neither CABundle nor CABundleSecretRef is defined, the certificate bundle in\nthe cert-manager controller container is used to validate the TLS connection.", properties: { key: { description: "The key of the entry in the Secret resource's `data` field to be used.\nSome instances of this field may be defaulted, in others it may be\nrequired.", @@ -9741,7 +8902,7 @@ export const CustomResourceDefinition_IssuersCertManagerIo: KubernetesResource = type: "object" }, credentialsRef: { - description: "CredentialsRef is a reference to a Secret containing the CyberArk Certificate Manager Self-Hosted API credentials.\nThe secret must contain the key 'access-token' for the Access Token Authentication,\nor two keys, 'username' and 'password' for the API Keys Authentication.", + description: "CredentialsRef is a reference to a Secret containing the Venafi TPP API credentials.\nThe secret must contain the key 'access-token' for the Access Token Authentication,\nor two keys, 'username' and 'password' for the API Keys Authentication.", properties: { name: { description: "Name of the resource being referred to.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", @@ -9752,7 +8913,7 @@ export const CustomResourceDefinition_IssuersCertManagerIo: KubernetesResource = type: "object" }, url: { - description: "URL is the base URL for the vedsdk endpoint of the CyberArk Certificate Manager Self-Hosted instance,\nfor example: \"https://tpp.example.com/vedsdk\".", + description: "URL is the base URL for the vedsdk endpoint of the Venafi TPP instance,\nfor example: \"https://tpp.example.com/vedsdk\".", type: "string" } }, @@ -9760,16 +8921,12 @@ export const CustomResourceDefinition_IssuersCertManagerIo: KubernetesResource = type: "object" }, zone: { - description: "Zone is the Certificate Manager Policy Zone to use for this issuer.\nAll requests made to the Certificate Manager platform will be restricted by the named\nzone policy.\nThis field is required.", + description: "Zone is the Venafi Policy Zone to use for this issuer.\nAll requests made to the Venafi platform will be restricted by the named\nzone policy.\nThis field is required.", type: "string" } }, required: ["zone"], - type: "object", - "x-kubernetes-validations": [{ - message: "exactly one of tpp, cloud, or ngts must be configured", - rule: "(has(self.tpp) ? 1 : 0) + (has(self.cloud) ? 1 : 0) + (has(self.ngts) ? 1 : 0) == 1" - }] + type: "object" } }, type: "object" @@ -9851,6 +9008,219 @@ export const CustomResourceDefinition_IssuersCertManagerIo: KubernetesResource = }] } }; +export const CustomResourceDefinition_OrdersAcmeCertManagerIo: KubernetesResource = { + apiVersion: "apiextensions.k8s.io/v1", + kind: "CustomResourceDefinition", + metadata: { + annotations: { + "helm.sh/resource-policy": "keep" + }, + labels: { + app: "cert-manager", + "app.kubernetes.io/component": "crds", + "app.kubernetes.io/instance": "cert-manager", + "app.kubernetes.io/managed-by": "Helm", + "app.kubernetes.io/name": "cert-manager", + "app.kubernetes.io/version": "v1.17.0", + "helm.sh/chart": "cert-manager-v1.17.0" + }, + name: "orders.acme.cert-manager.io" + }, + spec: { + group: "acme.cert-manager.io", + names: { + categories: ["cert-manager", "cert-manager-acme"], + kind: "Order", + listKind: "OrderList", + plural: "orders", + singular: "order" + }, + scope: "Namespaced", + versions: [{ + additionalPrinterColumns: [{ + jsonPath: ".status.state", + name: "State", + type: "string" + }, { + jsonPath: ".spec.issuerRef.name", + name: "Issuer", + priority: 1, + type: "string" + }, { + jsonPath: ".status.reason", + name: "Reason", + priority: 1, + type: "string" + }, { + description: "CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.", + jsonPath: ".metadata.creationTimestamp", + name: "Age", + type: "date" + }], + name: "v1", + schema: { + openAPIV3Schema: { + description: "Order is a type to represent an Order with an ACME server", + properties: { + apiVersion: { + description: "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", + type: "string" + }, + kind: { + description: "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + type: "string" + }, + metadata: { + type: "object" + }, + spec: { + properties: { + commonName: { + description: "CommonName is the common name as specified on the DER encoded CSR.\nIf specified, this value must also be present in `dnsNames` or `ipAddresses`.\nThis field must match the corresponding field on the DER encoded CSR.", + type: "string" + }, + dnsNames: { + description: "DNSNames is a list of DNS names that should be included as part of the Order\nvalidation process.\nThis field must match the corresponding field on the DER encoded CSR.", + items: { + type: "string" + }, + type: "array" + }, + duration: { + description: "Duration is the duration for the not after date for the requested certificate.\nthis is set on order creation as pe the ACME spec.", + type: "string" + }, + ipAddresses: { + description: "IPAddresses is a list of IP addresses that should be included as part of the Order\nvalidation process.\nThis field must match the corresponding field on the DER encoded CSR.", + items: { + type: "string" + }, + type: "array" + }, + issuerRef: { + description: "IssuerRef references a properly configured ACME-type Issuer which should\nbe used to create this Order.\nIf the Issuer does not exist, processing will be retried.\nIf the Issuer is not an 'ACME' Issuer, an error will be returned and the\nOrder will be marked as failed.", + properties: { + group: { + description: "Group of the resource being referred to.", + type: "string" + }, + kind: { + description: "Kind of the resource being referred to.", + type: "string" + }, + name: { + description: "Name of the resource being referred to.", + type: "string" + } + }, + required: ["name"], + type: "object" + }, + request: { + description: "Certificate signing request bytes in DER encoding.\nThis will be used when finalizing the order.\nThis field must be set on the order.", + format: "byte", + type: "string" + } + }, + required: ["issuerRef", "request"], + type: "object" + }, + status: { + properties: { + authorizations: { + description: "Authorizations contains data returned from the ACME server on what\nauthorizations must be completed in order to validate the DNS names\nspecified on the Order.", + items: { + description: "ACMEAuthorization contains data returned from the ACME server on an\nauthorization that must be completed in order validate a DNS name on an ACME\nOrder resource.", + properties: { + challenges: { + description: "Challenges specifies the challenge types offered by the ACME server.\nOne of these challenge types will be selected when validating the DNS\nname and an appropriate Challenge resource will be created to perform\nthe ACME challenge process.", + items: { + description: "Challenge specifies a challenge offered by the ACME server for an Order.\nAn appropriate Challenge resource can be created to perform the ACME\nchallenge process.", + properties: { + token: { + description: "Token is the token that must be presented for this challenge.\nThis is used to compute the 'key' that must also be presented.", + type: "string" + }, + type: { + description: "Type is the type of challenge being offered, e.g. 'http-01', 'dns-01',\n'tls-sni-01', etc.\nThis is the raw value retrieved from the ACME server.\nOnly 'http-01' and 'dns-01' are supported by cert-manager, other values\nwill be ignored.", + type: "string" + }, + url: { + description: "URL is the URL of this challenge. It can be used to retrieve additional\nmetadata about the Challenge from the ACME server.", + type: "string" + } + }, + required: ["token", "type", "url"], + type: "object" + }, + type: "array" + }, + identifier: { + description: "Identifier is the DNS name to be validated as part of this authorization", + type: "string" + }, + initialState: { + description: "InitialState is the initial state of the ACME authorization when first\nfetched from the ACME server.\nIf an Authorization is already 'valid', the Order controller will not\ncreate a Challenge resource for the authorization. This will occur when\nworking with an ACME server that enables 'authz reuse' (such as Let's\nEncrypt's production endpoint).\nIf not set and 'identifier' is set, the state is assumed to be pending\nand a Challenge will be created.", + enum: ["valid", "ready", "pending", "processing", "invalid", "expired", "errored"], + type: "string" + }, + url: { + description: "URL is the URL of the Authorization that must be completed", + type: "string" + }, + wildcard: { + description: "Wildcard will be true if this authorization is for a wildcard DNS name.\nIf this is true, the identifier will be the *non-wildcard* version of\nthe DNS name.\nFor example, if '*.example.com' is the DNS name being validated, this\nfield will be 'true' and the 'identifier' field will be 'example.com'.", + type: "boolean" + } + }, + required: ["url"], + type: "object" + }, + type: "array" + }, + certificate: { + description: "Certificate is a copy of the PEM encoded certificate for this Order.\nThis field will be populated after the order has been successfully\nfinalized with the ACME server, and the order has transitioned to the\n'valid' state.", + format: "byte", + type: "string" + }, + failureTime: { + description: "FailureTime stores the time that this order failed.\nThis is used to influence garbage collection and back-off.", + format: "date-time", + type: "string" + }, + finalizeURL: { + description: "FinalizeURL of the Order.\nThis is used to obtain certificates for this order once it has been completed.", + type: "string" + }, + reason: { + description: "Reason optionally provides more information about a why the order is in\nthe current state.", + type: "string" + }, + state: { + description: "State contains the current state of this Order resource.\nStates 'success' and 'expired' are 'final'", + enum: ["valid", "ready", "pending", "processing", "invalid", "expired", "errored"], + type: "string" + }, + url: { + description: "URL of the Order.\nThis will initially be empty when the resource is first created.\nThe Order controller will populate this field when the Order is first processed.\nThis field will be immutable after it is initially set.", + type: "string" + } + }, + type: "object" + } + }, + required: ["metadata", "spec"], + type: "object" + } + }, + served: true, + storage: true, + subresources: { + status: {} + } + }] + } +}; export const ClusterRole_CertManagerCainjector: KubernetesResource = { apiVersion: "rbac.authorization.k8s.io/v1", kind: "ClusterRole", @@ -9861,8 +9231,8 @@ export const ClusterRole_CertManagerCainjector: KubernetesResource = { "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "cainjector", - "app.kubernetes.io/version": "v1.21.1", - "helm.sh/chart": "cert-manager-v1.21.1" + "app.kubernetes.io/version": "v1.17.0", + "helm.sh/chart": "cert-manager-v1.17.0" }, name: "cert-manager-cainjector" }, @@ -9902,8 +9272,8 @@ export const ClusterRole_CertManagerControllerIssuers: KubernetesResource = { "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "cert-manager", - "app.kubernetes.io/version": "v1.21.1", - "helm.sh/chart": "cert-manager-v1.21.1" + "app.kubernetes.io/version": "v1.17.0", + "helm.sh/chart": "cert-manager-v1.17.0" }, name: "cert-manager-controller-issuers" }, @@ -9935,8 +9305,8 @@ export const ClusterRole_CertManagerControllerClusterissuers: KubernetesResource "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "cert-manager", - "app.kubernetes.io/version": "v1.21.1", - "helm.sh/chart": "cert-manager-v1.21.1" + "app.kubernetes.io/version": "v1.17.0", + "helm.sh/chart": "cert-manager-v1.17.0" }, name: "cert-manager-controller-clusterissuers" }, @@ -9968,8 +9338,8 @@ export const ClusterRole_CertManagerControllerCertificates: KubernetesResource = "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "cert-manager", - "app.kubernetes.io/version": "v1.21.1", - "helm.sh/chart": "cert-manager-v1.21.1" + "app.kubernetes.io/version": "v1.17.0", + "helm.sh/chart": "cert-manager-v1.17.0" }, name: "cert-manager-controller-certificates" }, @@ -10009,8 +9379,8 @@ export const ClusterRole_CertManagerControllerOrders: KubernetesResource = { "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "cert-manager", - "app.kubernetes.io/version": "v1.21.1", - "helm.sh/chart": "cert-manager-v1.21.1" + "app.kubernetes.io/version": "v1.17.0", + "helm.sh/chart": "cert-manager-v1.17.0" }, name: "cert-manager-controller-orders" }, @@ -10034,10 +9404,6 @@ export const ClusterRole_CertManagerControllerOrders: KubernetesResource = { apiGroups: ["acme.cert-manager.io"], resources: ["orders/finalizers"], verbs: ["update"] - }, { - apiGroups: ["cert-manager.io"], - resources: ["clusterissuers/finalizers", "issuers/finalizers"], - verbs: ["update"] }, { apiGroups: [""], resources: ["secrets"], @@ -10058,8 +9424,8 @@ export const ClusterRole_CertManagerControllerChallenges: KubernetesResource = { "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "cert-manager", - "app.kubernetes.io/version": "v1.21.1", - "helm.sh/chart": "cert-manager-v1.21.1" + "app.kubernetes.io/version": "v1.17.0", + "helm.sh/chart": "cert-manager-v1.17.0" }, name: "cert-manager-controller-challenges" }, @@ -10119,8 +9485,8 @@ export const ClusterRole_CertManagerControllerIngressShim: KubernetesResource = "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "cert-manager", - "app.kubernetes.io/version": "v1.21.1", - "helm.sh/chart": "cert-manager-v1.21.1" + "app.kubernetes.io/version": "v1.17.0", + "helm.sh/chart": "cert-manager-v1.17.0" }, name: "cert-manager-controller-ingress-shim" }, @@ -10142,11 +9508,11 @@ export const ClusterRole_CertManagerControllerIngressShim: KubernetesResource = verbs: ["update"] }, { apiGroups: ["gateway.networking.k8s.io"], - resources: ["gateways", "httproutes", "listenersets"], + resources: ["gateways", "httproutes"], verbs: ["get", "list", "watch"] }, { apiGroups: ["gateway.networking.k8s.io"], - resources: ["gateways/finalizers", "httproutes/finalizers", "listenersets/finalizers"], + resources: ["gateways/finalizers", "httproutes/finalizers"], verbs: ["update"] }, { apiGroups: [""], @@ -10164,8 +9530,8 @@ export const ClusterRole_CertManagerClusterView: KubernetesResource = { "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "cert-manager", - "app.kubernetes.io/version": "v1.21.1", - "helm.sh/chart": "cert-manager-v1.21.1", + "app.kubernetes.io/version": "v1.17.0", + "helm.sh/chart": "cert-manager-v1.17.0", "rbac.authorization.k8s.io/aggregate-to-cluster-reader": "true" }, name: "cert-manager-cluster-view" @@ -10186,8 +9552,8 @@ export const ClusterRole_CertManagerView: KubernetesResource = { "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "cert-manager", - "app.kubernetes.io/version": "v1.21.1", - "helm.sh/chart": "cert-manager-v1.21.1", + "app.kubernetes.io/version": "v1.17.0", + "helm.sh/chart": "cert-manager-v1.17.0", "rbac.authorization.k8s.io/aggregate-to-admin": "true", "rbac.authorization.k8s.io/aggregate-to-cluster-reader": "true", "rbac.authorization.k8s.io/aggregate-to-edit": "true", @@ -10215,8 +9581,8 @@ export const ClusterRole_CertManagerEdit: KubernetesResource = { "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "cert-manager", - "app.kubernetes.io/version": "v1.21.1", - "helm.sh/chart": "cert-manager-v1.21.1", + "app.kubernetes.io/version": "v1.17.0", + "helm.sh/chart": "cert-manager-v1.17.0", "rbac.authorization.k8s.io/aggregate-to-admin": "true", "rbac.authorization.k8s.io/aggregate-to-edit": "true" }, @@ -10232,12 +9598,8 @@ export const ClusterRole_CertManagerEdit: KubernetesResource = { verbs: ["update"] }, { apiGroups: ["acme.cert-manager.io"], - resources: ["challenges"], - verbs: ["delete", "deletecollection", "patch", "update"] - }, { - apiGroups: ["acme.cert-manager.io"], - resources: ["orders"], - verbs: ["delete", "deletecollection"] + resources: ["challenges", "orders"], + verbs: ["create", "delete", "deletecollection", "patch", "update"] }] }; export const ClusterRole_CertManagerControllerApproveCertManagerIo: KubernetesResource = { @@ -10250,8 +9612,8 @@ export const ClusterRole_CertManagerControllerApproveCertManagerIo: KubernetesRe "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "cert-manager", - "app.kubernetes.io/version": "v1.21.1", - "helm.sh/chart": "cert-manager-v1.21.1" + "app.kubernetes.io/version": "v1.17.0", + "helm.sh/chart": "cert-manager-v1.17.0" }, name: "cert-manager-controller-approve:cert-manager-io" }, @@ -10272,8 +9634,8 @@ export const ClusterRole_CertManagerControllerCertificatesigningrequests: Kubern "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "cert-manager", - "app.kubernetes.io/version": "v1.21.1", - "helm.sh/chart": "cert-manager-v1.21.1" + "app.kubernetes.io/version": "v1.17.0", + "helm.sh/chart": "cert-manager-v1.17.0" }, name: "cert-manager-controller-certificatesigningrequests" }, @@ -10306,8 +9668,8 @@ export const ClusterRole_CertManagerWebhookSubjectaccessreviews: KubernetesResou "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "webhook", - "app.kubernetes.io/version": "v1.21.1", - "helm.sh/chart": "cert-manager-v1.21.1" + "app.kubernetes.io/version": "v1.17.0", + "helm.sh/chart": "cert-manager-v1.17.0" }, name: "cert-manager-webhook:subjectaccessreviews" }, @@ -10327,8 +9689,8 @@ export const ClusterRoleBinding_CertManagerCainjector: KubernetesResource = { "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "cainjector", - "app.kubernetes.io/version": "v1.21.1", - "helm.sh/chart": "cert-manager-v1.21.1" + "app.kubernetes.io/version": "v1.17.0", + "helm.sh/chart": "cert-manager-v1.17.0" }, name: "cert-manager-cainjector" }, @@ -10353,8 +9715,8 @@ export const ClusterRoleBinding_CertManagerControllerIssuers: KubernetesResource "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "cert-manager", - "app.kubernetes.io/version": "v1.21.1", - "helm.sh/chart": "cert-manager-v1.21.1" + "app.kubernetes.io/version": "v1.17.0", + "helm.sh/chart": "cert-manager-v1.17.0" }, name: "cert-manager-controller-issuers" }, @@ -10379,8 +9741,8 @@ export const ClusterRoleBinding_CertManagerControllerClusterissuers: KubernetesR "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "cert-manager", - "app.kubernetes.io/version": "v1.21.1", - "helm.sh/chart": "cert-manager-v1.21.1" + "app.kubernetes.io/version": "v1.17.0", + "helm.sh/chart": "cert-manager-v1.17.0" }, name: "cert-manager-controller-clusterissuers" }, @@ -10405,8 +9767,8 @@ export const ClusterRoleBinding_CertManagerControllerCertificates: KubernetesRes "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "cert-manager", - "app.kubernetes.io/version": "v1.21.1", - "helm.sh/chart": "cert-manager-v1.21.1" + "app.kubernetes.io/version": "v1.17.0", + "helm.sh/chart": "cert-manager-v1.17.0" }, name: "cert-manager-controller-certificates" }, @@ -10431,8 +9793,8 @@ export const ClusterRoleBinding_CertManagerControllerOrders: KubernetesResource "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "cert-manager", - "app.kubernetes.io/version": "v1.21.1", - "helm.sh/chart": "cert-manager-v1.21.1" + "app.kubernetes.io/version": "v1.17.0", + "helm.sh/chart": "cert-manager-v1.17.0" }, name: "cert-manager-controller-orders" }, @@ -10457,8 +9819,8 @@ export const ClusterRoleBinding_CertManagerControllerChallenges: KubernetesResou "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "cert-manager", - "app.kubernetes.io/version": "v1.21.1", - "helm.sh/chart": "cert-manager-v1.21.1" + "app.kubernetes.io/version": "v1.17.0", + "helm.sh/chart": "cert-manager-v1.17.0" }, name: "cert-manager-controller-challenges" }, @@ -10483,8 +9845,8 @@ export const ClusterRoleBinding_CertManagerControllerIngressShim: KubernetesReso "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "cert-manager", - "app.kubernetes.io/version": "v1.21.1", - "helm.sh/chart": "cert-manager-v1.21.1" + "app.kubernetes.io/version": "v1.17.0", + "helm.sh/chart": "cert-manager-v1.17.0" }, name: "cert-manager-controller-ingress-shim" }, @@ -10509,8 +9871,8 @@ export const ClusterRoleBinding_CertManagerControllerApproveCertManagerIo: Kuber "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "cert-manager", - "app.kubernetes.io/version": "v1.21.1", - "helm.sh/chart": "cert-manager-v1.21.1" + "app.kubernetes.io/version": "v1.17.0", + "helm.sh/chart": "cert-manager-v1.17.0" }, name: "cert-manager-controller-approve:cert-manager-io" }, @@ -10535,8 +9897,8 @@ export const ClusterRoleBinding_CertManagerControllerCertificatesigningrequests: "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "cert-manager", - "app.kubernetes.io/version": "v1.21.1", - "helm.sh/chart": "cert-manager-v1.21.1" + "app.kubernetes.io/version": "v1.17.0", + "helm.sh/chart": "cert-manager-v1.17.0" }, name: "cert-manager-controller-certificatesigningrequests" }, @@ -10561,8 +9923,8 @@ export const ClusterRoleBinding_CertManagerWebhookSubjectaccessreviews: Kubernet "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "webhook", - "app.kubernetes.io/version": "v1.21.1", - "helm.sh/chart": "cert-manager-v1.21.1" + "app.kubernetes.io/version": "v1.17.0", + "helm.sh/chart": "cert-manager-v1.17.0" }, name: "cert-manager-webhook:subjectaccessreviews" }, @@ -10587,8 +9949,8 @@ export const Role_CertManagerCainjectorLeaderelection: KubernetesResource = { "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "cainjector", - "app.kubernetes.io/version": "v1.21.1", - "helm.sh/chart": "cert-manager-v1.21.1" + "app.kubernetes.io/version": "v1.17.0", + "helm.sh/chart": "cert-manager-v1.17.0" }, name: "cert-manager-cainjector:leaderelection", namespace: "cert-manager" @@ -10614,8 +9976,8 @@ export const Role_CertManagerLeaderelection: KubernetesResource = { "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "cert-manager", - "app.kubernetes.io/version": "v1.21.1", - "helm.sh/chart": "cert-manager-v1.21.1" + "app.kubernetes.io/version": "v1.17.0", + "helm.sh/chart": "cert-manager-v1.17.0" }, name: "cert-manager:leaderelection", namespace: "cert-manager" @@ -10631,6 +9993,29 @@ export const Role_CertManagerLeaderelection: KubernetesResource = { verbs: ["create"] }] }; +export const Role_CertManagerTokenrequest: KubernetesResource = { + apiVersion: "rbac.authorization.k8s.io/v1", + kind: "Role", + metadata: { + labels: { + app: "cert-manager", + "app.kubernetes.io/component": "controller", + "app.kubernetes.io/instance": "cert-manager", + "app.kubernetes.io/managed-by": "Helm", + "app.kubernetes.io/name": "cert-manager", + "app.kubernetes.io/version": "v1.17.0", + "helm.sh/chart": "cert-manager-v1.17.0" + }, + name: "cert-manager-tokenrequest", + namespace: "cert-manager" + }, + rules: [{ + apiGroups: [""], + resourceNames: ["cert-manager"], + resources: ["serviceaccounts/token"], + verbs: ["create"] + }] +}; export const Role_CertManagerWebhookDynamicServing: KubernetesResource = { apiVersion: "rbac.authorization.k8s.io/v1", kind: "Role", @@ -10641,8 +10026,8 @@ export const Role_CertManagerWebhookDynamicServing: KubernetesResource = { "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "webhook", - "app.kubernetes.io/version": "v1.21.1", - "helm.sh/chart": "cert-manager-v1.21.1" + "app.kubernetes.io/version": "v1.17.0", + "helm.sh/chart": "cert-manager-v1.17.0" }, name: "cert-manager-webhook:dynamic-serving", namespace: "cert-manager" @@ -10668,8 +10053,8 @@ export const RoleBinding_CertManagerCainjectorLeaderelection: KubernetesResource "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "cainjector", - "app.kubernetes.io/version": "v1.21.1", - "helm.sh/chart": "cert-manager-v1.21.1" + "app.kubernetes.io/version": "v1.17.0", + "helm.sh/chart": "cert-manager-v1.17.0" }, name: "cert-manager-cainjector:leaderelection", namespace: "cert-manager" @@ -10695,8 +10080,8 @@ export const RoleBinding_CertManagerLeaderelection: KubernetesResource = { "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "cert-manager", - "app.kubernetes.io/version": "v1.21.1", - "helm.sh/chart": "cert-manager-v1.21.1" + "app.kubernetes.io/version": "v1.17.0", + "helm.sh/chart": "cert-manager-v1.17.0" }, name: "cert-manager:leaderelection", namespace: "cert-manager" @@ -10712,6 +10097,33 @@ export const RoleBinding_CertManagerLeaderelection: KubernetesResource = { namespace: "cert-manager" }] }; +export const RoleBinding_CertManagerCertManagerTokenrequest: KubernetesResource = { + apiVersion: "rbac.authorization.k8s.io/v1", + kind: "RoleBinding", + metadata: { + labels: { + app: "cert-manager", + "app.kubernetes.io/component": "controller", + "app.kubernetes.io/instance": "cert-manager", + "app.kubernetes.io/managed-by": "Helm", + "app.kubernetes.io/name": "cert-manager", + "app.kubernetes.io/version": "v1.17.0", + "helm.sh/chart": "cert-manager-v1.17.0" + }, + name: "cert-manager-cert-manager-tokenrequest", + namespace: "cert-manager" + }, + roleRef: { + apiGroup: "rbac.authorization.k8s.io", + kind: "Role", + name: "cert-manager-tokenrequest" + }, + subjects: [{ + kind: "ServiceAccount", + name: "cert-manager", + namespace: "cert-manager" + }] +}; export const RoleBinding_CertManagerWebhookDynamicServing: KubernetesResource = { apiVersion: "rbac.authorization.k8s.io/v1", kind: "RoleBinding", @@ -10722,8 +10134,8 @@ export const RoleBinding_CertManagerWebhookDynamicServing: KubernetesResource = "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "webhook", - "app.kubernetes.io/version": "v1.21.1", - "helm.sh/chart": "cert-manager-v1.21.1" + "app.kubernetes.io/version": "v1.17.0", + "helm.sh/chart": "cert-manager-v1.17.0" }, name: "cert-manager-webhook:dynamic-serving", namespace: "cert-manager" @@ -10749,8 +10161,8 @@ export const Service_CertManagerCainjector: KubernetesResource = { "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "cainjector", - "app.kubernetes.io/version": "v1.21.1", - "helm.sh/chart": "cert-manager-v1.21.1" + "app.kubernetes.io/version": "v1.17.0", + "helm.sh/chart": "cert-manager-v1.17.0" }, name: "cert-manager-cainjector", namespace: "cert-manager" @@ -10779,17 +10191,18 @@ export const Service_CertManager: KubernetesResource = { "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "cert-manager", - "app.kubernetes.io/version": "v1.21.1", - "helm.sh/chart": "cert-manager-v1.21.1" + "app.kubernetes.io/version": "v1.17.0", + "helm.sh/chart": "cert-manager-v1.17.0" }, name: "cert-manager", namespace: "cert-manager" }, spec: { ports: [{ - name: "http-metrics", + name: "tcp-prometheus-servicemonitor", port: 9402, - protocol: "TCP" + protocol: "TCP", + targetPort: 9402 }], selector: { "app.kubernetes.io/component": "controller", @@ -10809,8 +10222,8 @@ export const Service_CertManagerWebhook: KubernetesResource = { "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "webhook", - "app.kubernetes.io/version": "v1.21.1", - "helm.sh/chart": "cert-manager-v1.21.1" + "app.kubernetes.io/version": "v1.17.0", + "helm.sh/chart": "cert-manager-v1.17.0" }, name: "cert-manager-webhook", namespace: "cert-manager" @@ -10845,8 +10258,8 @@ export const Deployment_CertManagerCainjector: KubernetesResource = { "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "cainjector", - "app.kubernetes.io/version": "v1.21.1", - "helm.sh/chart": "cert-manager-v1.21.1" + "app.kubernetes.io/version": "v1.17.0", + "helm.sh/chart": "cert-manager-v1.17.0" }, name: "cert-manager-cainjector", namespace: "cert-manager" @@ -10873,8 +10286,8 @@ export const Deployment_CertManagerCainjector: KubernetesResource = { "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "cainjector", - "app.kubernetes.io/version": "v1.21.1", - "helm.sh/chart": "cert-manager-v1.21.1" + "app.kubernetes.io/version": "v1.17.0", + "helm.sh/chart": "cert-manager-v1.17.0" } }, spec: { @@ -10888,7 +10301,7 @@ export const Deployment_CertManagerCainjector: KubernetesResource = { } } }], - image: "quay.io/jetstack/cert-manager-cainjector:v1.21.1", + image: "quay.io/jetstack/cert-manager-cainjector:v1.17.0", imagePullPolicy: "IfNotPresent", name: "cert-manager-cainjector", ports: [{ @@ -10929,8 +10342,8 @@ export const Deployment_CertManager: KubernetesResource = { "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "cert-manager", - "app.kubernetes.io/version": "v1.21.1", - "helm.sh/chart": "cert-manager-v1.21.1" + "app.kubernetes.io/version": "v1.17.0", + "helm.sh/chart": "cert-manager-v1.17.0" }, name: "cert-manager", namespace: "cert-manager" @@ -10957,13 +10370,13 @@ export const Deployment_CertManager: KubernetesResource = { "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "cert-manager", - "app.kubernetes.io/version": "v1.21.1", - "helm.sh/chart": "cert-manager-v1.21.1" + "app.kubernetes.io/version": "v1.17.0", + "helm.sh/chart": "cert-manager-v1.17.0" } }, spec: { containers: [{ - args: ["--v=2", "--cluster-resource-namespace=$(POD_NAMESPACE)", "--leader-election-namespace=cert-manager", "--acme-http01-solver-image=quay.io/jetstack/cert-manager-acmesolver:v1.21.1", "--max-concurrent-challenges=60"], + args: ["--v=2", "--cluster-resource-namespace=$(POD_NAMESPACE)", "--leader-election-namespace=cert-manager", "--acme-http01-solver-image=quay.io/jetstack/cert-manager-acmesolver:v1.17.0", "--max-concurrent-challenges=60"], env: [{ name: "POD_NAMESPACE", valueFrom: { @@ -10972,7 +10385,7 @@ export const Deployment_CertManager: KubernetesResource = { } } }], - image: "quay.io/jetstack/cert-manager-controller:v1.21.1", + image: "quay.io/jetstack/cert-manager-controller:v1.17.0", imagePullPolicy: "IfNotPresent", livenessProbe: { failureThreshold: 8, @@ -11029,8 +10442,8 @@ export const Deployment_CertManagerWebhook: KubernetesResource = { "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "webhook", - "app.kubernetes.io/version": "v1.21.1", - "helm.sh/chart": "cert-manager-v1.21.1" + "app.kubernetes.io/version": "v1.17.0", + "helm.sh/chart": "cert-manager-v1.17.0" }, name: "cert-manager-webhook", namespace: "cert-manager" @@ -11057,8 +10470,8 @@ export const Deployment_CertManagerWebhook: KubernetesResource = { "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "webhook", - "app.kubernetes.io/version": "v1.21.1", - "helm.sh/chart": "cert-manager-v1.21.1" + "app.kubernetes.io/version": "v1.17.0", + "helm.sh/chart": "cert-manager-v1.17.0" } }, spec: { @@ -11072,13 +10485,13 @@ export const Deployment_CertManagerWebhook: KubernetesResource = { } } }], - image: "quay.io/jetstack/cert-manager-webhook:v1.21.1", + image: "quay.io/jetstack/cert-manager-webhook:v1.17.0", imagePullPolicy: "IfNotPresent", livenessProbe: { failureThreshold: 3, httpGet: { path: "/livez", - port: "healthcheck", + port: 6080, scheme: "HTTP" }, initialDelaySeconds: 60, @@ -11104,7 +10517,7 @@ export const Deployment_CertManagerWebhook: KubernetesResource = { failureThreshold: 3, httpGet: { path: "/healthz", - port: "healthcheck", + port: 6080, scheme: "HTTP" }, initialDelaySeconds: 5, @@ -11148,8 +10561,8 @@ export const MutatingWebhookConfiguration_CertManagerWebhook: KubernetesResource "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "webhook", - "app.kubernetes.io/version": "v1.21.1", - "helm.sh/chart": "cert-manager-v1.21.1" + "app.kubernetes.io/version": "v1.17.0", + "helm.sh/chart": "cert-manager-v1.17.0" }, name: "cert-manager-webhook" }, @@ -11188,8 +10601,8 @@ export const ValidatingWebhookConfiguration_CertManagerWebhook: KubernetesResour "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "webhook", - "app.kubernetes.io/version": "v1.21.1", - "helm.sh/chart": "cert-manager-v1.21.1" + "app.kubernetes.io/version": "v1.17.0", + "helm.sh/chart": "cert-manager-v1.17.0" }, name: "cert-manager-webhook" }, @@ -11237,8 +10650,8 @@ export const ServiceAccount_CertManagerStartupapicheck: KubernetesResource = { "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "startupapicheck", - "app.kubernetes.io/version": "v1.21.1", - "helm.sh/chart": "cert-manager-v1.21.1" + "app.kubernetes.io/version": "v1.17.0", + "helm.sh/chart": "cert-manager-v1.17.0" }, name: "cert-manager-startupapicheck", namespace: "cert-manager" @@ -11260,8 +10673,8 @@ export const Role_CertManagerStartupapicheckCreateCert: KubernetesResource = { "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "startupapicheck", - "app.kubernetes.io/version": "v1.21.1", - "helm.sh/chart": "cert-manager-v1.21.1" + "app.kubernetes.io/version": "v1.17.0", + "helm.sh/chart": "cert-manager-v1.17.0" }, name: "cert-manager-startupapicheck:create-cert", namespace: "cert-manager" @@ -11287,8 +10700,8 @@ export const RoleBinding_CertManagerStartupapicheckCreateCert: KubernetesResourc "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "startupapicheck", - "app.kubernetes.io/version": "v1.21.1", - "helm.sh/chart": "cert-manager-v1.21.1" + "app.kubernetes.io/version": "v1.17.0", + "helm.sh/chart": "cert-manager-v1.17.0" }, name: "cert-manager-startupapicheck:create-cert", namespace: "cert-manager" @@ -11319,8 +10732,8 @@ export const Job_CertManagerStartupapicheck: KubernetesResource = { "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "startupapicheck", - "app.kubernetes.io/version": "v1.21.1", - "helm.sh/chart": "cert-manager-v1.21.1" + "app.kubernetes.io/version": "v1.17.0", + "helm.sh/chart": "cert-manager-v1.17.0" }, name: "cert-manager-startupapicheck", namespace: "cert-manager" @@ -11335,8 +10748,8 @@ export const Job_CertManagerStartupapicheck: KubernetesResource = { "app.kubernetes.io/instance": "cert-manager", "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "startupapicheck", - "app.kubernetes.io/version": "v1.21.1", - "helm.sh/chart": "cert-manager-v1.21.1" + "app.kubernetes.io/version": "v1.17.0", + "helm.sh/chart": "cert-manager-v1.17.0" } }, spec: { @@ -11350,7 +10763,7 @@ export const Job_CertManagerStartupapicheck: KubernetesResource = { } } }], - image: "quay.io/jetstack/cert-manager-startupapicheck:v1.21.1", + image: "quay.io/jetstack/cert-manager-startupapicheck:v1.17.0", imagePullPolicy: "IfNotPresent", name: "cert-manager-startupapicheck", securityContext: { @@ -11377,7 +10790,7 @@ export const Job_CertManagerStartupapicheck: KubernetesResource = { } } }; -export const resources: ReadonlyArray = [Namespace_CertManager, ServiceAccount_CertManagerCainjector, ServiceAccount_CertManager, ServiceAccount_CertManagerWebhook, CustomResourceDefinition_ChallengesAcmeCertManagerIo, CustomResourceDefinition_OrdersAcmeCertManagerIo, CustomResourceDefinition_CertificaterequestsCertManagerIo, CustomResourceDefinition_CertificatesCertManagerIo, CustomResourceDefinition_ClusterissuersCertManagerIo, CustomResourceDefinition_IssuersCertManagerIo, ClusterRole_CertManagerCainjector, ClusterRole_CertManagerControllerIssuers, ClusterRole_CertManagerControllerClusterissuers, ClusterRole_CertManagerControllerCertificates, ClusterRole_CertManagerControllerOrders, ClusterRole_CertManagerControllerChallenges, ClusterRole_CertManagerControllerIngressShim, ClusterRole_CertManagerClusterView, ClusterRole_CertManagerView, ClusterRole_CertManagerEdit, ClusterRole_CertManagerControllerApproveCertManagerIo, ClusterRole_CertManagerControllerCertificatesigningrequests, ClusterRole_CertManagerWebhookSubjectaccessreviews, ClusterRoleBinding_CertManagerCainjector, ClusterRoleBinding_CertManagerControllerIssuers, ClusterRoleBinding_CertManagerControllerClusterissuers, ClusterRoleBinding_CertManagerControllerCertificates, ClusterRoleBinding_CertManagerControllerOrders, ClusterRoleBinding_CertManagerControllerChallenges, ClusterRoleBinding_CertManagerControllerIngressShim, ClusterRoleBinding_CertManagerControllerApproveCertManagerIo, ClusterRoleBinding_CertManagerControllerCertificatesigningrequests, ClusterRoleBinding_CertManagerWebhookSubjectaccessreviews, Role_CertManagerCainjectorLeaderelection, Role_CertManagerLeaderelection, Role_CertManagerWebhookDynamicServing, RoleBinding_CertManagerCainjectorLeaderelection, RoleBinding_CertManagerLeaderelection, RoleBinding_CertManagerWebhookDynamicServing, Service_CertManagerCainjector, Service_CertManager, Service_CertManagerWebhook, Deployment_CertManagerCainjector, Deployment_CertManager, Deployment_CertManagerWebhook, MutatingWebhookConfiguration_CertManagerWebhook, ValidatingWebhookConfiguration_CertManagerWebhook, ServiceAccount_CertManagerStartupapicheck, Role_CertManagerStartupapicheckCreateCert, RoleBinding_CertManagerStartupapicheckCreateCert, Job_CertManagerStartupapicheck]; +export const resources: ReadonlyArray = [Namespace_CertManager, ServiceAccount_CertManagerCainjector, ServiceAccount_CertManager, ServiceAccount_CertManagerWebhook, CustomResourceDefinition_CertificaterequestsCertManagerIo, CustomResourceDefinition_CertificatesCertManagerIo, CustomResourceDefinition_ChallengesAcmeCertManagerIo, CustomResourceDefinition_ClusterissuersCertManagerIo, CustomResourceDefinition_IssuersCertManagerIo, CustomResourceDefinition_OrdersAcmeCertManagerIo, ClusterRole_CertManagerCainjector, ClusterRole_CertManagerControllerIssuers, ClusterRole_CertManagerControllerClusterissuers, ClusterRole_CertManagerControllerCertificates, ClusterRole_CertManagerControllerOrders, ClusterRole_CertManagerControllerChallenges, ClusterRole_CertManagerControllerIngressShim, ClusterRole_CertManagerClusterView, ClusterRole_CertManagerView, ClusterRole_CertManagerEdit, ClusterRole_CertManagerControllerApproveCertManagerIo, ClusterRole_CertManagerControllerCertificatesigningrequests, ClusterRole_CertManagerWebhookSubjectaccessreviews, ClusterRoleBinding_CertManagerCainjector, ClusterRoleBinding_CertManagerControllerIssuers, ClusterRoleBinding_CertManagerControllerClusterissuers, ClusterRoleBinding_CertManagerControllerCertificates, ClusterRoleBinding_CertManagerControllerOrders, ClusterRoleBinding_CertManagerControllerChallenges, ClusterRoleBinding_CertManagerControllerIngressShim, ClusterRoleBinding_CertManagerControllerApproveCertManagerIo, ClusterRoleBinding_CertManagerControllerCertificatesigningrequests, ClusterRoleBinding_CertManagerWebhookSubjectaccessreviews, Role_CertManagerCainjectorLeaderelection, Role_CertManagerLeaderelection, Role_CertManagerTokenrequest, Role_CertManagerWebhookDynamicServing, RoleBinding_CertManagerCainjectorLeaderelection, RoleBinding_CertManagerLeaderelection, RoleBinding_CertManagerCertManagerTokenrequest, RoleBinding_CertManagerWebhookDynamicServing, Service_CertManagerCainjector, Service_CertManager, Service_CertManagerWebhook, Deployment_CertManagerCainjector, Deployment_CertManager, Deployment_CertManagerWebhook, MutatingWebhookConfiguration_CertManagerWebhook, ValidatingWebhookConfiguration_CertManagerWebhook, ServiceAccount_CertManagerStartupapicheck, Role_CertManagerStartupapicheckCreateCert, RoleBinding_CertManagerStartupapicheckCreateCert, Job_CertManagerStartupapicheck]; export default { resources: resources }; diff --git a/packages/manifests/src/generated/cilium.ts b/packages/manifests/src/generated/cilium.ts index bf1affa..a285b6f 100644 --- a/packages/manifests/src/generated/cilium.ts +++ b/packages/manifests/src/generated/cilium.ts @@ -56,8 +56,8 @@ export const Secret_CiliumCa: KubernetesResource = { namespace: "kube-system" }, data: { - "ca.crt": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURFekNDQWZ1Z0F3SUJBZ0lRVlpkb3h2NDVNSDh4WFVZQk9RME9MakFOQmdrcWhraUc5dzBCQVFzRkFEQVUKTVJJd0VBWURWUVFERXdsRGFXeHBkVzBnUTBFd0hoY05Nall3T0RFeU1qRXpOVFF5V2hjTk1qa3dPREV4TWpFegpOVFF5V2pBVU1SSXdFQVlEVlFRREV3bERhV3hwZFcwZ1EwRXdnZ0VpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElCCkR3QXdnZ0VLQW9JQkFRRE56RnYxUFZEaENUSlRFT01oaFZhR243YlB4M3hISnQ5bFIrRDhxck1qb1pleWZ5MmkKZkhOYXl4YUlSeVBkMzRselpCejJuRCtpMnhCM3VrcC9EYTU1aUNUSFdRdkJXVWhtRWgyaG5TM0ErUFVRdDVZRgpvZWV2a3Z0eEFLczB4YnBoR0hJNjlqTkRLZHFJYkxIOXl3UWdOdUZ1bGVZdWFMazIwd0F4dTJWVDFYZisvVklPClgrVlZTZkg0aEkveFUyT2F4OUtyYTlkQ1RkVDdWQ2M0SFVxRFF2SlMwQlJGeDNPaTFFVElUT2Vzd3kreklQNzYKL0dLamJsMWFobzB0VGJTWXJ5SWJqSzQweVF5cGcxNnAyb25Eeks4SkZFSHBnVG1VSy9FNE8zd1BIL05yVEdhTQpkV2lTVmZQbzduaE1OdFFsNXVHWFh3alJlVWhuQmdXU2l4a0xBZ01CQUFHallUQmZNQTRHQTFVZER3RUIvd1FFCkF3SUNwREFkQmdOVkhTVUVGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXcKQXdFQi96QWRCZ05WSFE0RUZnUVV3L0s4V1p4WU1YUGJLY2xRd1haZ3Y1LzZONTB3RFFZSktvWklodmNOQVFFTApCUUFEZ2dFQkFIRDNQNWt3SE1ycnQxSHM0TGlkS2UxbTJmQ2FmcVV3b1JiSC9BaWJZd1pTNVdXUzkwNXduNEplCkovejdmampOWnI5enRHZklCM0RZVDZqTWh0ejQ3ZkhQM0pzYVU3enNxL1RsME5HbDBSTXBLbnk4VFBYcHFvNUcKMWNNUTBxdFUvSGcrYWJuVUxJRDVUa25JWktDOWRZT1dVcGtGNHBBcEtXWTViUVMxZldPTGJ6ay8zbmVTVlNkRgp2MUIxZXpvNG9TZ0o4Q3RqOXdjOWtEVUMvTWdjNUNmdGgyNWVTZ1o3SytqaC9LUE1DK0VVRmJ5TEJTTGVsZi9rCmhjYzYwVUdNQ1FxNllPbWNiZjF6QitucTBHUDdXZUYrZHI5MnowS1BnWEZKQmVOU3U4WlN6dlgwbkRKdUM4QjEKSEdRS2hUWjlGWUJkN3V6bXFZZVBrT3huNytIbnB3QT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=", - "ca.key": "LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFcEFJQkFBS0NBUUVBemN4YjlUMVE0UWt5VXhEaklZVldocCsyejhkOFJ5YmZaVWZnL0txekk2R1hzbjh0Cm9ueHpXc3NXaUVjajNkK0pjMlFjOXB3L290c1FkN3BLZncydWVZZ2t4MWtMd1ZsSVpoSWRvWjB0d1BqMUVMZVcKQmFIbnI1TDdjUUNyTk1XNllSaHlPdll6UXluYWlHeXgvY3NFSURiaGJwWG1MbWk1TnRNQU1idGxVOVYzL3YxUwpEbC9sVlVueCtJU1A4Vk5qbXNmU3EydlhRazNVKzFRbk9CMUtnMEx5VXRBVVJjZHpvdFJFeUV6bnJNTXZzeUQrCit2eGlvMjVkV29hTkxVMjBtSzhpRzR5dU5Na01xWU5lcWRxSnc4eXZDUlJCNllFNWxDdnhPRHQ4RHgvemEweG0KakhWb2tsWHo2TzU0VERiVUplYmhsMThJMFhsSVp3WUZrb3NaQ3dJREFRQUJBb0lCQUNJRTZhQ1pBYkVwZFlXdwpzWE1kbVFlSkNFM0JrcVFxWTF4WkxQSm5mMVJoQm5RTnZPdnl1WmpsSUhUbm1hQzRMbjhDS2gyRUI2cnlubjdFCkwwTmdiaHFON0ZKOXdFazJhcGJnNE1BUi9QbTh6Ym4xTnhuNFFSWFBiTHdwMmFOUUdqYXB0VnhVelhXSlNpUXEKSDZRdDlxRWlvVkpIK2pScXdFODFRdjkxbEZMdWx6OUlJSGNEOE10STQ0QnFBQ0hHVEVhUzZ2ZFR2QWl6M1pMUApzVVAwZTQweXlYKzhDcmpjdytnSkcwYUVMNytqL3YrMmhLNmVJMzJUcGc4YStqNjlQMmxPNE10eUp1UWNmKzJUCjJCQXk3Z1R1KzVmazM3Q0hvVEIrN1NWekFDQTdObW92cFkyeDJXYTJVVXBLOEZkTEdQS255cE1SbTNSRklCVFcKaWo2SzFWRUNnWUVBOEcvYm1qWTFFQVVEejRSbHJYSzlpeCtiQTM1RXFBV21KM2lkVkJGMGxoazl6d0o1OGFyRgpoZTduTFJtOUxOMmwxSW9UV1lmVlFuWWRjZ3dicHhzR3RwZ2tZUDFtMGFXbWZvR0NSN0h3TW56ZThRUFNZVCtkCjJZUkhPc3VJUERZdmdRL1dtRjZ6enVhQXpKdHJ2SFlUUUpuQW4weGx0MmVGQlJROU9BNEpCUHNDZ1lFQTJ4NkcKSkR2VXJtbWdCSlBlT0JQS0ZGY0tJWGFtbEU1QURVclNiRjM0ejhraTRrdFRhekJFOENFeFhYNjQrMjR6V2tyOApkU2hxQWsyWGlSR1hrRS9BZ2d3cFROWXh6NEpJV2VoWmJieitQcEFacFp6OUs1TUVxbEZTd1l1d0lOL1J5Mnd6CmJBS000L0NzdGNTVU1ZV3cwa2U3MkliSE5ZNTVHdFZqQTB4b1h6RUNnWUVBbWJHWE9pT3VsYmZ1OEtjY2E5eHQKeDFJRHdCN2wrbFhxR1U4am1zcXhzUVVmbW9WbHVCTEd3cyt0WFFvWUFHY0xDeXJjSlo0THQ3bFRKMFVRSkNqRgppTkVHYUMxem5VMzdlT0NHakJmMWlBQ0VicUpYeUN4blZkVVZ4MEsxcW0ra3ZDYUlzY3ZQdXRGandlY1QzbHZJCkFNS0gvQXhVOVFFcWFjMi9PR2JZWXlNQ2dZQlJaSTAvZUZvUVQzdjVOMVFjVUgySUFLenFzVUEvWnJHMFBrN2IKb2l5Q1FweUtvcUJoK0pRaS9yRnZvVnJsU3BJWXdESDI4d1F0eHRTN1BhV25IWGpNMWVlaGV3OFZuYmR5YmpTSgo1dUlxS3l6YnIrejYrcW1JK3B4YStLQjhGYWZBZ0hpNWJsa1hjcGMxRGNoZWZPS3B1YXUxU3B0RThaOWFzRmtQCktKcThnUUtCZ1FDZ2xRZzFnQ09YMzhOa2dFNEc5ak9FdHFQMGxFMFNMbmtHckYwQVJiYkJ4aGlwOTdyVFhCeWMKMkpPRHJaWTA1Z0lPVWxWdVpieU8rdXpQaDNiZERxTUpYQ3pjWm9rVjRoU1piOFlwSVVVU0hQdGhOandmazcrdwovUXlickpLUndQNS91bnVPVzFMVEtYbUg3ZjVlVGpqeDBXc0FMZWtVc3J3VnppWWNVWEJmVVE9PQotLS0tLUVORCBSU0EgUFJJVkFURSBLRVktLS0tLQo=" + "ca.crt": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURFekNDQWZ1Z0F3SUJBZ0lRZWo4K0VORUJMdTBHZzZna1B1eFl5VEFOQmdrcWhraUc5dzBCQVFzRkFEQVUKTVJJd0VBWURWUVFERXdsRGFXeHBkVzBnUTBFd0hoY05Nall3T0RFeU1qSXpNREF5V2hjTk1qa3dPREV4TWpJegpNREF5V2pBVU1SSXdFQVlEVlFRREV3bERhV3hwZFcwZ1EwRXdnZ0VpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElCCkR3QXdnZ0VLQW9JQkFRRFRwSE9jNjJxM29VZ1ByRjNSRFhKY3c0WmxnRE5la1ZHc1c5TVRMdFdXS245d0tMbmUKQzZrbGxNVk5ydnVyVGptMDU3aGpDbkVkcndkOVd6YlJWNHczVXJYeWZOK0ptck04WWJyODFPMFFWcGdLQTJiTQpUQmM0OVhjcHkyUWwzSWYwaXdxMkdTek1qMjFyekZheVM2Q1Zwb1dOTVdqOWxzOFFjOFJ0eElLOG5zZ2t6cDRvCis0TmE5TkRrSldsM1NWK2NJbXJlSnVveWpSZWFlTzhNZ2J0R05NdFAwWGhweUp3ZTNSRnJWck5qV3JxcjFyMVIKLzZ6cjhrN3B1b0FyMmNaN1dkOVVuRUZqaVBNbFJZOENpdUtXTkJlYWdXV3BPaU00NTUzcFJUdmdPQmRLU3BGOQpPVE1CNXhSdldTQlNMdFVkWVVHR2ppM3pLQkJTMjBtZENrb1RBZ01CQUFHallUQmZNQTRHQTFVZER3RUIvd1FFCkF3SUNwREFkQmdOVkhTVUVGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXcKQXdFQi96QWRCZ05WSFE0RUZnUVUrMnFyZXdBejRXREptZnNBVW9MVm9wQzBXR2d3RFFZSktvWklodmNOQVFFTApCUUFEZ2dFQkFHb2xLZFljNGJ2VjR2b1RyRnNvMHF3YklBQlREc09xdU9mVURqM3NWb0VCS2hXUHQ5TUI3WVBNCnJBL2NGZTA0bTR1Zk1sT29RdDdlOWtmbVJjK2Z2VUpucFZ6aXFHQWhnZFBTVWt0eGdQOHl5Q3hLVVJVeGdPT3MKNUFoM3dWazBDdDFOY24xYVpXU3R1NDQ0SEppbko0QllESkNpQ1ZESTJaRjlQaWo5WFZlSnp5TUlUSHptSEpaSgp6MU9xV2s3aXhYZnJUYnRwTkxWekY0Z21TV1Y5cXYwNklvczVrRFVXVFZ3bUtMKzNZZ3U4elR3dk10MFl1ak5UCjROeWRaTzNVditYUnBLaTgwVE02dzlXVUIyZUtQRSs4NDVhcC8rUWZ1ZThrMzVFaVZ4NTlWWGJ0SFJuWHRBLzEKYURhLzROcmlTNVZGZjNxU0hBd2RienRta3YramtMdz0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=", + "ca.key": "LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb2dJQkFBS0NBUUVBMDZSem5PdHF0NkZJRDZ4ZDBRMXlYTU9HWllBelhwRlJyRnZURXk3VmxpcC9jQ2k1CjNndXBKWlRGVGE3N3EwNDV0T2U0WXdweEhhOEhmVnMyMFZlTU4xSzE4bnpmaVpxelBHRzYvTlR0RUZhWUNnTm0KekV3WE9QVjNLY3RrSmR5SDlJc0t0aGtzekk5dGE4eFdza3VnbGFhRmpURm8vWmJQRUhQRWJjU0N2SjdJSk02ZQpLUHVEV3ZUUTVDVnBkMGxmbkNKcTNpYnFNbzBYbW5qdkRJRzdSalRMVDlGNGFjaWNIdDBSYTFhelkxcTZxOWE5ClVmK3M2L0pPNmJxQUs5bkdlMW5mVkp4Qlk0anpKVVdQQW9yaWxqUVhtb0ZscVRvak9PZWQ2VVU3NERnWFNrcVIKZlRrekFlY1ViMWtnVWk3VkhXRkJobzR0OHlnUVV0dEpuUXBLRXdJREFRQUJBb0lCQURVTzcyVVJwK2x0WjVGMgpWdmJIOWpuSFV2UXpWYTJKcFA0ZTd5WEtBZ1hwbFpWYXdHNG9ZamxudUtjbkRUVC9JWHgyODBUeEl6YWI0TGJPCm5VbVNOemJQWjRucFFHbFEvVXBQL2Y3UXFyWUQzNDN6R0Z4elh3Y0trdHRKZ0V2MW82ZnRDN3huUjFIcFN6ZFIKUFJMcDN0SmxzdW1ZejRkenZXbVVmRlJBaGI0Zlk3dmdmM0hCK2VEc21oQjF0eUE4UmFwT1RjR2FTckkxK0J1NgpyMVVqYTVpM24vMlhNRUw4OCtrNDRBOUE0elBINUVxUEFtNFdhS1ViWEtSTGYrWTUwZ29jV04rMFRpTFV2eFhBCjlFcE1WR1VGNHo2Q25SUEV2NmJGSmVZcGlaQUdBNXlYY0Fqa0lzU3VQQ1ZOS1RLLzROWEN0aVNlczJNSndjZFEKays4MHp6RUNnWUVBNlUxTmR2UkU3dExqRncvTDAvcnBmNDI1ZnNWWm4xRC85d050UEhqVGtvSmFmdXVjNjZiMwo1R1hjR1VUcEhEeXgwMDdWZ3FuaTJva3NObzhWWTdZQzUrWDlWd1RRclZhdmpCREYwa3BhblZNVndhWlpxT3I2ClFOeXdnd2lSMURWQXlJZVNncW94ckFnbS9iTkpPaWpGdjd4aEdBbm9VNnlXQTltT2I2YU9tZTBDZ1lFQTZEdXcKT0JlTjIwR2liZDZ6QnRzV05XYkJqQ1lqZzdheFJWWFhZK3pyQWhjWmxCUFJuSGJTZXR3TW9xTmYveGxHSmc0awp0VE9sTFhOQ09DVXErM2FuWjZNaEZ4ajJSZ0JtMGNYUUlzSFcyc0pCMDJCcWZtbUZlcWlzODMvRFZWSHBBbjhjCmRDamhJKzJzd1ZOTjk0MUZBUGtjcFdaQ2tadllMc3hYdlNRUDgvOENnWUJXTWRZOTdhK09JT0gvd2psSFB6dUgKZ2NBWHd5Z0NnWFdnT0diaVlhMmhRb0hXeEl2OFVIcmpxbkp2NzVMRWVQUW1Jc2tsZGtpMi90a1Q2emMyMktjbwpNRU95STdoSlltNkhMQ2M2TTNoWkNicFBDbnV6dWVUdGs5dXUvYnFMRVlXMjBNZmplS2ZUYkV1ampkcXZIeU00ClhJdnV5ckpJUDhwSTc5YjlEeWMrWFFLQmdGTXAxTkF4ZHlaV1djRjRwNm5EMlM4a2Joa3ZLemFtdk5LMGk5NkgKNEJ5dWd3VnBGMzR0ZXZCdVRzUUxOM3hWNDY0TEVKQW5QM2FJT09WOFFla3RNNFBFZ2p3UVAxa1FHY0h6VWJhdwpyYTFITldWcHVKa3VWcE4zUmdBbzk1MWRLTkV4RGRKM05UQzFrMURqOFI2K1kwQ1c5UEF5TDVLUE9acUFxTWJkCjNDeW5Bb0dBWDJiV3VoaURKTExmZVFGU3MxaVMxeEdXSDFabXVlYUZETXVqWHVHQ3d3RktwNkVtYnB4V282bHAKZi9EVHpjeEc2Nm4zWHl0d3JWVTF3WlUyR2tiN1JzaVF5amQvb0xQOHZZMEx4UkRQMTNjZWxhNHBwa3o5cXQ1Uwpndy9DaW5MZ1Erd0VVSHZYL2tCT0IwNkdTYWY2bzNUMDB0L2twcG5vV2s0cGRvMmNFVjQ9Ci0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg==" } }; export const Secret_HubbleServerCerts: KubernetesResource = { @@ -72,9 +72,9 @@ export const Secret_HubbleServerCerts: KubernetesResource = { namespace: "kube-system" }, data: { - "ca.crt": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURFekNDQWZ1Z0F3SUJBZ0lRVlpkb3h2NDVNSDh4WFVZQk9RME9MakFOQmdrcWhraUc5dzBCQVFzRkFEQVUKTVJJd0VBWURWUVFERXdsRGFXeHBkVzBnUTBFd0hoY05Nall3T0RFeU1qRXpOVFF5V2hjTk1qa3dPREV4TWpFegpOVFF5V2pBVU1SSXdFQVlEVlFRREV3bERhV3hwZFcwZ1EwRXdnZ0VpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElCCkR3QXdnZ0VLQW9JQkFRRE56RnYxUFZEaENUSlRFT01oaFZhR243YlB4M3hISnQ5bFIrRDhxck1qb1pleWZ5MmkKZkhOYXl4YUlSeVBkMzRselpCejJuRCtpMnhCM3VrcC9EYTU1aUNUSFdRdkJXVWhtRWgyaG5TM0ErUFVRdDVZRgpvZWV2a3Z0eEFLczB4YnBoR0hJNjlqTkRLZHFJYkxIOXl3UWdOdUZ1bGVZdWFMazIwd0F4dTJWVDFYZisvVklPClgrVlZTZkg0aEkveFUyT2F4OUtyYTlkQ1RkVDdWQ2M0SFVxRFF2SlMwQlJGeDNPaTFFVElUT2Vzd3kreklQNzYKL0dLamJsMWFobzB0VGJTWXJ5SWJqSzQweVF5cGcxNnAyb25Eeks4SkZFSHBnVG1VSy9FNE8zd1BIL05yVEdhTQpkV2lTVmZQbzduaE1OdFFsNXVHWFh3alJlVWhuQmdXU2l4a0xBZ01CQUFHallUQmZNQTRHQTFVZER3RUIvd1FFCkF3SUNwREFkQmdOVkhTVUVGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXcKQXdFQi96QWRCZ05WSFE0RUZnUVV3L0s4V1p4WU1YUGJLY2xRd1haZ3Y1LzZONTB3RFFZSktvWklodmNOQVFFTApCUUFEZ2dFQkFIRDNQNWt3SE1ycnQxSHM0TGlkS2UxbTJmQ2FmcVV3b1JiSC9BaWJZd1pTNVdXUzkwNXduNEplCkovejdmampOWnI5enRHZklCM0RZVDZqTWh0ejQ3ZkhQM0pzYVU3enNxL1RsME5HbDBSTXBLbnk4VFBYcHFvNUcKMWNNUTBxdFUvSGcrYWJuVUxJRDVUa25JWktDOWRZT1dVcGtGNHBBcEtXWTViUVMxZldPTGJ6ay8zbmVTVlNkRgp2MUIxZXpvNG9TZ0o4Q3RqOXdjOWtEVUMvTWdjNUNmdGgyNWVTZ1o3SytqaC9LUE1DK0VVRmJ5TEJTTGVsZi9rCmhjYzYwVUdNQ1FxNllPbWNiZjF6QitucTBHUDdXZUYrZHI5MnowS1BnWEZKQmVOU3U4WlN6dlgwbkRKdUM4QjEKSEdRS2hUWjlGWUJkN3V6bXFZZVBrT3huNytIbnB3QT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=", - "tls.crt": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURWekNDQWorZ0F3SUJBZ0lSQU9FVnZPc0tSQTRpM0R1akJxNlFkdHN3RFFZSktvWklodmNOQVFFTEJRQXcKRkRFU01CQUdBMVVFQXhNSlEybHNhWFZ0SUVOQk1CNFhEVEkyTURneE1qSXhNelUwTWxvWERUSTNNRGd4TWpJeApNelUwTWxvd0tqRW9NQ1lHQTFVRUF3d2ZLaTVrWldaaGRXeDBMbWgxWW1Kc1pTMW5jbkJqTG1OcGJHbDFiUzVwCmJ6Q0NBU0l3RFFZSktvWklodmNOQVFFQkJRQURnZ0VQQURDQ0FRb0NnZ0VCQU5TVVlFS1VhajZQZEZlaHF1QWIKRWpQWmJ4UmIxbDVuUTNXYkZxdDFZdThHSGJSRU1TT1k5WGFJa3Q3TGF4NHVXQXdUMGV6bVY2Vk04cTExMnM0LwovRGI5UkY3R2xVYlgxK1BaQmFCcTlDUXQrUGFNZXlKelRpbFJaUzY5VkxOL0EyRU5sQWZmaDBJdkZkeFV6cVdqCjNnNWZrTlF5ZjVZV08rQUZUWkFBaXVTRjFUN09KaEJBZEtwSlAvZVc4dVYvMzRrTlovTDFDb0xpaFhFajgxTnAKMi91SG43aU4xWjdYSHk0RzBpb1JmY214d0Z5MTBCdU5CakFxejNwR3NsTFFaU1JFbW50QTl5THc0M3RsWHZ3UApTOEEyUmJoQUZVNEs0ZlljaDBtK0Y2bEdMUVcrNDYwa2toTFk3MkVWQjdGMEFLZHNWK3BYcTJaWnFVOWdBWC9xCkdWMENBd0VBQWFPQmpUQ0JpakFPQmdOVkhROEJBZjhFQkFNQ0JhQXdIUVlEVlIwbEJCWXdGQVlJS3dZQkJRVUgKQXdFR0NDc0dBUVVGQndNQ01Bd0dBMVVkRXdFQi93UUNNQUF3SHdZRFZSMGpCQmd3Rm9BVXcvSzhXWnhZTVhQYgpLY2xRd1haZ3Y1LzZONTB3S2dZRFZSMFJCQ013SVlJZktpNWtaV1poZFd4MExtaDFZbUpzWlMxbmNuQmpMbU5wCmJHbDFiUzVwYnpBTkJna3Foa2lHOXcwQkFRc0ZBQU9DQVFFQWZEQmw5OWxWNzg1UFVqQ2VkMS9ES0k5dVljSSsKdXZlenRQRVJhNGdWelc2cEg4SkNSSEcwS1A2QW1oaEgxV2N4US84N3NWWHRyRi9YZ3VDNm1FMmxXdzY4UjBieApaRHBiZE1jRTVoM013cDkwcEJucEdMWk9SWXcrVmlkQytTY1UxZlQyZHIyMHhxS1pROW5IaGxnVTY1akRKQUowCkNEemNMVHE2ZHJZUkNPNlJDeXJQcmJrcjZRNEh3aGVjb3U3a3kxenNyRFZyMmwwNlBTbkVQM2dLUUMzdHR4RlcKOEh3cG1VdjV6MmxFVmUvajZpRmY2RlBtcWZyYTMxcWYyWG9pVkZmVXM3R05jeWZVSFk4MkR6dEMxU015Vk5aaAp6eGxseUpuQU4wQVZGSmdnYUNCcjd4a1l0MWlHS1pSbEpNUjdycTVVK3hQQjFNcGduMXkzU290aTF3PT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=", - "tls.key": "LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb2dJQkFBS0NBUUVBMUpSZ1FwUnFQbzkwVjZHcTRCc1NNOWx2RkZ2V1htZERkWnNXcTNWaTd3WWR0RVF4Ckk1ajFkb2lTM3N0ckhpNVlEQlBSN09aWHBVenlyWFhhemovOE52MUVYc2FWUnRmWDQ5a0ZvR3IwSkMzNDlveDcKSW5OT0tWRmxMcjFVczM4RFlRMlVCOStIUWk4VjNGVE9wYVBlRGwrUTFESi9saFk3NEFWTmtBQ0s1SVhWUHM0bQpFRUIwcWtrLzk1Ynk1WC9maVExbjh2VUtndUtGY1NQelUybmIrNGVmdUkzVm50Y2ZMZ2JTS2hGOXliSEFYTFhRCkc0MEdNQ3JQZWtheVV0QmxKRVNhZTBEM0l2RGplMlZlL0E5THdEWkZ1RUFWVGdyaDloeUhTYjRYcVVZdEJiN2oKclNTU0V0anZZUlVIc1hRQXAyeFg2bGVyWmxtcFQyQUJmK29aWFFJREFRQUJBb0lCQUQwNEc3NmcwallCQng3RAplcHUrZ0EvNWdzRklyMlFSZGY1MDh1TGUwK2FGQ3VIaXI0b1NYMEpMRTR6ZzVSRFVoTnU1aTMrZldFZE04U2hlCkkreTR4WkFxZ05tUWMrWHFmQXhzYisvaVRUdnNGMklkVThxNGpSNWVCL2NkWkRxckRkU1IzZnNrZHVYcS9HOHUKNXpJUmpuM3lMSm5IanpHd1puN2QyQmZyNkJQbUpvTkxKbzZsVks1Tmx4VXhpRzdVak1nZlBwVmdUc3BQa1lEUQoxZEpaSmJQam55UGtqdXRPZVZLSnh0MUZyL21sdGVLYTk0d3dNdS9FQjlHSFVxVzlpZ2t1N2Z5MUhRLzJLSmRUCkVKYytZRlAvclhGeFBxcWlGN3FDWVNoQlRRZFVHemxYNENIVTVMeHAxR09xZmo0VFkvbGQyVFRZL24zUnBoay8KYU4vaGM5c0NnWUVBNi9xWmFKd0RTTzFaV3NNcEtnWTZrWUxrYmFZbTZnUnlIYmpVUWQzRUg0V3VHSHRJZnZLRgpnRkRCUm53anExR1NqRnloYnoybWZZYXBVbkZnT20waGRmSGs0aGFtNzJBL2EyVEZxMmhpYmlYTEljMVFwaVA3Ckptby9aVStNTi9Qeno0cy9EdmJCZDdLL3U2Z0lob3pvWUl3UDlGY1d3TkNFajI5Z1E0MXBqRThDZ1lFQTVwMk0Kd0lXMFFHRndBSU1WdWJyVXoyK1BCOG1yaENJbEVzRzJuV3FRNkhEcjdXeG82YVhJVGNJZk9vbjRXNmFoV3lETwpBMXJDc0hXWXpBZlkzamtjNkU5ZURtOHVJMzkwR3RtSGpVdUsybHMzanFheE9uRldNd3p1TlNDN0RtVFBrdHAvClJMR25KeFNubGdBMUJ6T1h4WE9yOHBQbEtIcjEwMGhZdjByKytKTUNnWUE3bVVjMWpIR244WW9ueWpLVFVvOW8KUU03QWdyNUJURzRsNDVCNE1qSmVZN3pjb2dabFNZcytKU2NyVGg4VUhiNE5oVGVnaU1tTDJuN1pPNWs2S0dYVApEQXpxclIzc1J6cTlQTzVQcEVWMzNFTzVmY2xvckoyNXpndkU0cHBmWjFXa2pWNlh3T3FMK0xGRUMrUmJWeXM1CmR5WndaNjV2ZERxR24zS0luU2FUTVFLQmdHVldDY2wzZHpOckhZbzhEOG5qWFN3aHUxb1N0am1EdjRLMGVJaEgKa1pGeVBWbkE3NERzQms2VTVLQVdqSG5KaU5IQVlvWjYxVjR3N29tSlVUU2xLQnkwODRHb1BULy8rNGJvMjNXdApJa0M5SUhhZ3JQUWZaVjlkYVRjVFFOOGNVVklZalNBa2FHejEySVpEWlFuYkUvQUIyaWJuOGlTTms0UGFJSlUrCllUZmRBb0dBU01EejBGb0dGNDBZbU1VRU9MVHRpVmMxQ1BQT21Zdks0c3ByRjQvWDh5eGYyL2luSy9UQk1sTC8KdzVhaWQ4Ym02dDhOUUErcVM5SWdNdnpTU3lFaUdmbjZsMmtDN1haWGI4UWI2SUF2SmF4ZzRLTElxN3ZIek5tegp1ZXd5YllTRWJVVjNYQVBPdlF2N0NkbGxqUWRDWHQwb3pmK2hnU0F2RjZCNTA4YkY4eUk9Ci0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg==" + "ca.crt": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURFekNDQWZ1Z0F3SUJBZ0lRZWo4K0VORUJMdTBHZzZna1B1eFl5VEFOQmdrcWhraUc5dzBCQVFzRkFEQVUKTVJJd0VBWURWUVFERXdsRGFXeHBkVzBnUTBFd0hoY05Nall3T0RFeU1qSXpNREF5V2hjTk1qa3dPREV4TWpJegpNREF5V2pBVU1SSXdFQVlEVlFRREV3bERhV3hwZFcwZ1EwRXdnZ0VpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElCCkR3QXdnZ0VLQW9JQkFRRFRwSE9jNjJxM29VZ1ByRjNSRFhKY3c0WmxnRE5la1ZHc1c5TVRMdFdXS245d0tMbmUKQzZrbGxNVk5ydnVyVGptMDU3aGpDbkVkcndkOVd6YlJWNHczVXJYeWZOK0ptck04WWJyODFPMFFWcGdLQTJiTQpUQmM0OVhjcHkyUWwzSWYwaXdxMkdTek1qMjFyekZheVM2Q1Zwb1dOTVdqOWxzOFFjOFJ0eElLOG5zZ2t6cDRvCis0TmE5TkRrSldsM1NWK2NJbXJlSnVveWpSZWFlTzhNZ2J0R05NdFAwWGhweUp3ZTNSRnJWck5qV3JxcjFyMVIKLzZ6cjhrN3B1b0FyMmNaN1dkOVVuRUZqaVBNbFJZOENpdUtXTkJlYWdXV3BPaU00NTUzcFJUdmdPQmRLU3BGOQpPVE1CNXhSdldTQlNMdFVkWVVHR2ppM3pLQkJTMjBtZENrb1RBZ01CQUFHallUQmZNQTRHQTFVZER3RUIvd1FFCkF3SUNwREFkQmdOVkhTVUVGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXcKQXdFQi96QWRCZ05WSFE0RUZnUVUrMnFyZXdBejRXREptZnNBVW9MVm9wQzBXR2d3RFFZSktvWklodmNOQVFFTApCUUFEZ2dFQkFHb2xLZFljNGJ2VjR2b1RyRnNvMHF3YklBQlREc09xdU9mVURqM3NWb0VCS2hXUHQ5TUI3WVBNCnJBL2NGZTA0bTR1Zk1sT29RdDdlOWtmbVJjK2Z2VUpucFZ6aXFHQWhnZFBTVWt0eGdQOHl5Q3hLVVJVeGdPT3MKNUFoM3dWazBDdDFOY24xYVpXU3R1NDQ0SEppbko0QllESkNpQ1ZESTJaRjlQaWo5WFZlSnp5TUlUSHptSEpaSgp6MU9xV2s3aXhYZnJUYnRwTkxWekY0Z21TV1Y5cXYwNklvczVrRFVXVFZ3bUtMKzNZZ3U4elR3dk10MFl1ak5UCjROeWRaTzNVditYUnBLaTgwVE02dzlXVUIyZUtQRSs4NDVhcC8rUWZ1ZThrMzVFaVZ4NTlWWGJ0SFJuWHRBLzEKYURhLzROcmlTNVZGZjNxU0hBd2RienRta3YramtMdz0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=", + "tls.crt": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURWekNDQWorZ0F3SUJBZ0lSQUs1ekJsSktTQzNUcGlGRmcyNnBZbWN3RFFZSktvWklodmNOQVFFTEJRQXcKRkRFU01CQUdBMVVFQXhNSlEybHNhWFZ0SUVOQk1CNFhEVEkyTURneE1qSXlNekF3TWxvWERUSTNNRGd4TWpJeQpNekF3TWxvd0tqRW9NQ1lHQTFVRUF3d2ZLaTVrWldaaGRXeDBMbWgxWW1Kc1pTMW5jbkJqTG1OcGJHbDFiUzVwCmJ6Q0NBU0l3RFFZSktvWklodmNOQVFFQkJRQURnZ0VQQURDQ0FRb0NnZ0VCQU5NUEdPckUzR01aOGNXbUxXcGkKSVhjbkhQNnJEWTI1NFl2NW9WM3pQVU5QdzBNcFE1ZzJlK0dlL1dzdGw2T2ZoTWdlYVFaMjVaZTZLU3k1dkpvQwpqTEo3eDZaL3AxMFA2SzVWK3pBRnRTVkd2T096d29SNnQ2emtaWkpnK1dxZVZJc3REdGZXL2I3MXZpbURJTUkxCmc4dHRITTV1U1UrWEFVZlBnSngwVFJMMTQ2ZlRpU0xFN0R4emVkTWs1dHovTDZPaUlPRXN0bklyWUgyNkhNdmEKYWxzbTNMQktnK09KL001U0xDR2tVWk5TT2ROYmZuT1gvQ05uNElER2pjQnRCRG5sclpqVHVpSDhUdTdtYXpnMAp2WVJQbVRjZXdRVzJBMWlHUkhScFM5a083WkJ3RHFwTzUxSzd1VUR4QUVuajFNWnQ3ajZIblB5VVBTMFZXaUlECm4zMENBd0VBQWFPQmpUQ0JpakFPQmdOVkhROEJBZjhFQkFNQ0JhQXdIUVlEVlIwbEJCWXdGQVlJS3dZQkJRVUgKQXdFR0NDc0dBUVVGQndNQ01Bd0dBMVVkRXdFQi93UUNNQUF3SHdZRFZSMGpCQmd3Rm9BVSsycXJld0F6NFdESgptZnNBVW9MVm9wQzBXR2d3S2dZRFZSMFJCQ013SVlJZktpNWtaV1poZFd4MExtaDFZbUpzWlMxbmNuQmpMbU5wCmJHbDFiUzVwYnpBTkJna3Foa2lHOXcwQkFRc0ZBQU9DQVFFQXFsWWNNNFFtYzBsckpBb2xCbHpReisvNFJMa08KV2ZoTVR2bGFyQ0NtMUlnY3pmR1VxVG9NODU4V3MzcDgxZmZUcjlldHFIZzNEZzRWTUcrTFUxWk80d0pvYTBscApjV2Nhb1ZiSVFTSDJ3dmFJTGhqakd3aTlpR3FKYnIyUjJWdUxQMUZ2aEhyejNvR2hxMkVBV2hlOVlXZGlBM3RVCmlUTmRaWVhOdXUxZExTaWw2aEsxSkljS0lJVURhMllxUFFCNjcvRHFyN294Ri9peTF5VEpzaTV2ckdRdnlzbXAKQkg2cXptODh4bk1HTXF4OXBEUmpqN01jK2RLLzliaHplOVdUT2VxTlUzQlJNM3dIRHlDd1IxN3pXNFNQUFBDRwpVR2VEVUVXRVVVV2FUYUFnL0MrOHhhOEUvSFhZeHNVQndXQVBGM1h6QVFVY3JXYkpaN1JFNmJLRTdBPT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=", + "tls.key": "LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb3dJQkFBS0NBUUVBMHc4WTZzVGNZeG54eGFZdGFtSWhkeWNjL3FzTmpibmhpL21oWGZNOVEwL0RReWxECm1EWjc0Wjc5YXkyWG81K0V5QjVwQm5ibGw3b3BMTG04bWdLTXNudkhwbituWFEvb3JsWDdNQVcxSlVhODQ3UEMKaEhxM3JPUmxrbUQ1YXA1VWl5ME8xOWI5dnZXK0tZTWd3aldEeTIwY3ptNUpUNWNCUjgrQW5IUk5FdlhqcDlPSgpJc1RzUEhONTB5VG0zUDh2bzZJZzRTeTJjaXRnZmJvY3k5cHFXeWJjc0VxRDQ0bjh6bElzSWFSUmsxSTUwMXQrCmM1ZjhJMmZnZ01hTndHMEVPZVd0bU5PNklmeE83dVpyT0RTOWhFK1pOeDdCQmJZRFdJWkVkR2xMMlE3dGtIQU8KcWs3blVydTVRUEVBU2VQVXhtM3VQb2VjL0pROUxSVmFJZ09mZlFJREFRQUJBb0lCQUVmSmc4MGVobU9DeUpSVQprRy8xenJJcmNKWkNjZ3E1cGJpcGdMUm03bmg5b2Ntdk9GbUdkcDVvS0lRUzd0ZnRnd2xhSnBqWFNnSlFoSDY4CjhpUmtKNXp4c3hlenBhWm1xZHJhVGVTb25GT0FldkRzRElacEF4NWdWUmZ6dWdJRXRuYmNMWWRHamVvc3hiQnkKOUdwNkwwaTY1U2hscExQWWhjdjZEU0dxQVNrb01TR29CY2VMaSt4Nno0NWEzL1dSZ1F1R0JLU09iL0VPUU1vWQpBdm80NVJVSTNvMnpUTnBsTVBBd0lvMkV5OExRaFQxNHdKeitjdEcwZldtRlpCeS9kd01nRGdJc0xUd1JxbWdqCmJvam5DSWxlcDdqOVpRTmFRVTg2R3ZLMytEZWpYZUxyc2lKRFg2SEVVZksyaVMrQnVjZWMvdzNPMmphdlBxU0EKOVBEUVVsVUNnWUVBOUllQkVmL3pPUkxoRk1QZWVJaEVuN3AycFB1Q1ZpT0IrSjZzb1JKdmhGVmU5SUs3VTJLcwpNaGJONmJJK09iUGFOTHdFQ05IVUlGbThsN0JrbURGVUxkaFBtbGFGeDhRSUI3NFhoRnhCZkUySGpESjMyaFZpClNnZCtQaGpJUStsM3RyK3VlTitGNFFmMXZWUUhSVGljajJsbHZacGUxb3dZR2trZmRUUS9ROHNDZ1lFQTNQV24KMWZmWEx4MGpJZ2pUMEFCTkc3WDF2dzAza21XVkhVOXJPdWRBNVhqZC93eG54NnBRTWpqT3krNVlEbGhsbkJQUQo1U2tOSHJxWkVaaTdNcGpsNndqeXpKZXdkS3EwdXFoYURSd3RIcS9rOGRhcXR3UmRSWGVnTnY4aVdNR3JTMTZNClR1QkhRRjRMZXRRTEtjUURFcTI1YnZWSld6YmZwVFVkUWdOUEVOY0NnWUVBd2puTExGZm5nZ0xiNHhsODRMSWsKQjljY25Bamx5ck9qYmEzaklvRTVNSng2c3E0UVNyaEtXL0svRll1dFh6bmE3UjRWK2tkb1BWWHB0WGEzUUNlVwpYRisvUXJETXpCS0o2bFJ6NjM4M3lKcndPa3h2NURvdCt1MGV1Z1lITStJQ1k1YTI1MjFyc29VWERJM3N4RytsCjgwZGRONCtoR3JybC9pTHNxTFNhTjZjQ2dZQlFFU1JVUUk3Vkg3WFBhMnQxZitaeEdDcUlwSDF5cXlTeGprbkkKK210bHU3cVY1U1RtRVMwbVJiZUo1a0E2VW9YZlhMN2hpMUtady93YmlFQ3RRUUp2ZkxxZXNJamNmYzhucEVHZApab3hqQmxIcjRHSFVGOXpFZzJpbkJTU3BET1RKVnVWNDM0UnlLcUgyVEVnUFJsdm10TlR4QkNra3lHbWFML2orCkpyekwyUUtCZ0RheDBPL0ZKcHNjVDBoV2RjZ3pVVU1iMUo1UngrQlV2eXp0SVp2ckpmdEdmRnRnUXRhZXNLaFgKS0ZwTlNXMW1yci96TmVhKzVLWnZoYTV1MWtnbVZ5YWRrR3ZZVnpkeTBWajdycTM3TXo1M01qMTJQUTZlTnhzcwo1K0NZd012WVRWR0Z1eTl5b2tDTm0zOENSZTFqSEFjanE0dFN6d2dSd3ArU2h5UDJZSFJvCi0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg==" }, type: "kubernetes.io/tls" }; diff --git a/packages/manifests/src/generated/index.ts b/packages/manifests/src/generated/index.ts index 9d95624..3944304 100644 --- a/packages/manifests/src/generated/index.ts +++ b/packages/manifests/src/generated/index.ts @@ -23,10 +23,10 @@ export const OPERATOR_OBJECTS: Record = { }; export const OPERATOR_IDS: ReadonlyArray = ["cert-manager", "cilium", "cloudnative-pg", "knative-serving", "kube-prometheus-stack", "minio-operator", "tekton-pipelines", "traefik"]; export const OPERATOR_VERSIONS = { - "cert-manager": ["v1.17.0", "v1.21.1"], + "cert-manager": ["v1.17.0"], cilium: ["1.19.5"], "cloudnative-pg": ["1.25.2"], - "knative-serving": ["v1.15.0", "v1.22.1"], + "knative-serving": ["v1.22.1"], "kube-prometheus-stack": ["77.5.0"], "minio-operator": ["7.1.1"], "tekton-pipelines": ["v1.15.0"], @@ -37,7 +37,7 @@ export const OPERATOR_MAP: Record; }> = { "cert-manager": { - versions: ["v1.17.0", "v1.21.1"], + versions: ["v1.17.0"], resources: CertManager.resources }, "cilium": { @@ -49,7 +49,7 @@ export const OPERATOR_MAP: Record Date: Wed, 12 Aug 2026 16:17:16 -0700 Subject: [PATCH 07/11] fix(manifests): stop concatenating Knative, drop Cilium, keep the pull idempotent Three problems, found by checking that two consecutive pulls produce identical output. Knative was concatenated into one document set. serving-crds must be applied and established before serving-core, which creates custom resources of those very kinds -- merged, a single-pass apply races them. The combineUrls option existed for exactly this and was declared but never read, so every URL source was concatenated whether or not that was safe. It is now implemented, Knative sets it false, and the parts are written numbered under the version directory: the order they must be applied in is the order they sort in. Cilium is removed. Its chart cannot be vendored safely or usefully: cilium-ca-secret.yaml emits a freshly generated CA certificate and private key on every -- unconditionally, tls.auto.enabled=false does not suppress it -- so vendoring the output would have committed a private key to a public repository and published it to npm, and would never reproduce. Filtering to CRDs yields nothing either, because Cilium's operator registers its CRDs at runtime rather than shipping them in the chart. It is installed by the workflow instead, where the CA is generated in the cluster and stays there. Two consecutive pulls now produce byte-identical output. They did not before, and the difference was that private key. The codegen understands both shapes -- .yaml and / of ordered parts -- so a split operator keeps its version rather than reporting its parts as versions. The workflow applies the parts in order, waits for CRDs to establish between them, and installs Cilium at runtime so its CRDs exist for generation. --- .github/workflows/regenerate-ops.yml | 53 +- packages/manifests/operators/cilium.yaml | 1789 --- .../manifests/operators/cilium/1.19.5.yaml | 1789 --- .../operators/knative-serving/v1.22.1.yaml | 10237 ---------------- .../v1.22.1/01-serving-crds.yaml} | 3545 ------ .../v1.22.1/02-serving-core.yaml | 2808 +++++ .../knative-serving/v1.22.1/03-kourier.yaml | 732 ++ .../manifests/scripts/codegen-operators.ts | 37 +- packages/manifests/scripts/pull-manifests.ts | 93 +- packages/manifests/src/generated/cilium.ts | 1608 --- packages/manifests/src/generated/index.ts | 11 +- .../src/generated/knative-serving.ts | 7853 +----------- 12 files changed, 3695 insertions(+), 26860 deletions(-) delete mode 100644 packages/manifests/operators/cilium.yaml delete mode 100644 packages/manifests/operators/cilium/1.19.5.yaml delete mode 100644 packages/manifests/operators/knative-serving/v1.22.1.yaml rename packages/manifests/operators/{knative-serving.yaml => knative-serving/v1.22.1/01-serving-crds.yaml} (75%) create mode 100644 packages/manifests/operators/knative-serving/v1.22.1/02-serving-core.yaml create mode 100644 packages/manifests/operators/knative-serving/v1.22.1/03-kourier.yaml delete mode 100644 packages/manifests/src/generated/cilium.ts diff --git a/.github/workflows/regenerate-ops.yml b/.github/workflows/regenerate-ops.yml index f3f9ccb..4642bc8 100644 --- a/.github/workflows/regenerate-ops.yml +++ b/.github/workflows/regenerate-ops.yml @@ -15,6 +15,13 @@ on: # # To change a version: edit pull-manifests.ts, run this workflow, review the PR. +env: + # Cilium alone is pinned here rather than in the manifests package, because it + # is the one operator that package cannot vendor -- see the note beside its + # absence in pull-manifests.ts. + CILIUM_VERSION: '1.19.5' + CILIUM_CLI_VERSION: '0.19.7' + permissions: contents: write pull-requests: write @@ -83,17 +90,51 @@ jobs: run: | set -euo pipefail shopt -s nullglob + + apply() { + # --server-side: several of these carry CRDs large enough to exceed + # the annotation limit client-side apply uses. + kubectl apply --server-side --force-conflicts -f "$1" \ + || echo "::warning::$1 did not apply cleanly" + } + for f in packages/manifests/operators/*.yaml; do name=$(basename "$f" .yaml) - echo "::group::$name" - # --server-side: several of these carry CRDs large enough to exceed - # the annotation limit that client-side apply uses. - kubectl apply --server-side --force-conflicts -f "$f" || { - echo "::warning::$name did not apply cleanly" - } + echo "::group::$name"; apply "$f"; echo "::endgroup::" + done + + # Operators vendored as ordered parts. The numeric prefixes are the + # apply order, and it matters: Knative's CRDs must be established + # before serving-core creates custom resources of those kinds. + for d in packages/manifests/operators/*/*/; do + [ -n "$(echo "$d"*.yaml)" ] || continue + echo "::group::$(basename "$(dirname "$d")") $(basename "$d")" + for f in "$d"*.yaml; do + apply "$f" + # Establish CRDs before the next part is applied against them. + if grep -q "^kind: CustomResourceDefinition" "$f"; then + kubectl wait --for=condition=established --timeout=120s \ + crd --all >/dev/null 2>&1 || true + fi + done echo "::endgroup::" done + # Cilium is not vendored: its chart mints a CA private key at template + # time, and its CRDs are registered by the operator at runtime rather + # than shipped in the chart. Installing it here is what makes those CRDs + # exist for the client to be generated from. + - name: Install Cilium + env: + GH_TOKEN: ${{ github.token }} + run: | + gh release download "v${CILIUM_CLI_VERSION}" --repo cilium/cilium-cli \ + --pattern cilium-linux-amd64.tar.gz --output /tmp/cilium.tar.gz + sudo tar xzf /tmp/cilium.tar.gz -C /usr/local/bin + cilium install --version "${CILIUM_VERSION}" --wait + kubectl wait --for=condition=established --timeout=120s \ + crd/ciliumnetworkpolicies.cilium.io + - name: Wait for all CRDs to register run: | echo "Waiting for API server to aggregate CRD schemas..." diff --git a/packages/manifests/operators/cilium.yaml b/packages/manifests/operators/cilium.yaml deleted file mode 100644 index 0043b7e..0000000 --- a/packages/manifests/operators/cilium.yaml +++ /dev/null @@ -1,1789 +0,0 @@ -# Source: cilium/cilium@1.19.5 ---- -# Added by pull-manifests.ts to ensure namespace exists -apiVersion: v1 -kind: Namespace -metadata: - name: kube-system - labels: - app.kubernetes.io/name: kube-system - ---- ---- -# Source: cilium/templates/cilium-secrets-namespace.yaml -apiVersion: v1 -kind: Namespace -metadata: - name: "cilium-secrets" - labels: - app.kubernetes.io/part-of: cilium - annotations: - ---- -# Source: cilium/templates/cilium-agent/serviceaccount.yaml -apiVersion: v1 -kind: ServiceAccount -metadata: - name: "cilium" - namespace: kube-system - ---- -# Source: cilium/templates/cilium-envoy/serviceaccount.yaml -apiVersion: v1 -kind: ServiceAccount -metadata: - name: "cilium-envoy" - namespace: kube-system - ---- -# Source: cilium/templates/cilium-operator/serviceaccount.yaml -apiVersion: v1 -kind: ServiceAccount -metadata: - name: "cilium-operator" - namespace: kube-system - ---- -# Source: cilium/templates/cilium-ca-secret.yaml -apiVersion: v1 -kind: Secret -metadata: - name: cilium-ca - namespace: kube-system - labels: - cilium.io/helm-template-non-idempotent: "true" -data: - ca.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURFekNDQWZ1Z0F3SUJBZ0lRZWo4K0VORUJMdTBHZzZna1B1eFl5VEFOQmdrcWhraUc5dzBCQVFzRkFEQVUKTVJJd0VBWURWUVFERXdsRGFXeHBkVzBnUTBFd0hoY05Nall3T0RFeU1qSXpNREF5V2hjTk1qa3dPREV4TWpJegpNREF5V2pBVU1SSXdFQVlEVlFRREV3bERhV3hwZFcwZ1EwRXdnZ0VpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElCCkR3QXdnZ0VLQW9JQkFRRFRwSE9jNjJxM29VZ1ByRjNSRFhKY3c0WmxnRE5la1ZHc1c5TVRMdFdXS245d0tMbmUKQzZrbGxNVk5ydnVyVGptMDU3aGpDbkVkcndkOVd6YlJWNHczVXJYeWZOK0ptck04WWJyODFPMFFWcGdLQTJiTQpUQmM0OVhjcHkyUWwzSWYwaXdxMkdTek1qMjFyekZheVM2Q1Zwb1dOTVdqOWxzOFFjOFJ0eElLOG5zZ2t6cDRvCis0TmE5TkRrSldsM1NWK2NJbXJlSnVveWpSZWFlTzhNZ2J0R05NdFAwWGhweUp3ZTNSRnJWck5qV3JxcjFyMVIKLzZ6cjhrN3B1b0FyMmNaN1dkOVVuRUZqaVBNbFJZOENpdUtXTkJlYWdXV3BPaU00NTUzcFJUdmdPQmRLU3BGOQpPVE1CNXhSdldTQlNMdFVkWVVHR2ppM3pLQkJTMjBtZENrb1RBZ01CQUFHallUQmZNQTRHQTFVZER3RUIvd1FFCkF3SUNwREFkQmdOVkhTVUVGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXcKQXdFQi96QWRCZ05WSFE0RUZnUVUrMnFyZXdBejRXREptZnNBVW9MVm9wQzBXR2d3RFFZSktvWklodmNOQVFFTApCUUFEZ2dFQkFHb2xLZFljNGJ2VjR2b1RyRnNvMHF3YklBQlREc09xdU9mVURqM3NWb0VCS2hXUHQ5TUI3WVBNCnJBL2NGZTA0bTR1Zk1sT29RdDdlOWtmbVJjK2Z2VUpucFZ6aXFHQWhnZFBTVWt0eGdQOHl5Q3hLVVJVeGdPT3MKNUFoM3dWazBDdDFOY24xYVpXU3R1NDQ0SEppbko0QllESkNpQ1ZESTJaRjlQaWo5WFZlSnp5TUlUSHptSEpaSgp6MU9xV2s3aXhYZnJUYnRwTkxWekY0Z21TV1Y5cXYwNklvczVrRFVXVFZ3bUtMKzNZZ3U4elR3dk10MFl1ak5UCjROeWRaTzNVditYUnBLaTgwVE02dzlXVUIyZUtQRSs4NDVhcC8rUWZ1ZThrMzVFaVZ4NTlWWGJ0SFJuWHRBLzEKYURhLzROcmlTNVZGZjNxU0hBd2RienRta3YramtMdz0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo= - ca.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb2dJQkFBS0NBUUVBMDZSem5PdHF0NkZJRDZ4ZDBRMXlYTU9HWllBelhwRlJyRnZURXk3VmxpcC9jQ2k1CjNndXBKWlRGVGE3N3EwNDV0T2U0WXdweEhhOEhmVnMyMFZlTU4xSzE4bnpmaVpxelBHRzYvTlR0RUZhWUNnTm0KekV3WE9QVjNLY3RrSmR5SDlJc0t0aGtzekk5dGE4eFdza3VnbGFhRmpURm8vWmJQRUhQRWJjU0N2SjdJSk02ZQpLUHVEV3ZUUTVDVnBkMGxmbkNKcTNpYnFNbzBYbW5qdkRJRzdSalRMVDlGNGFjaWNIdDBSYTFhelkxcTZxOWE5ClVmK3M2L0pPNmJxQUs5bkdlMW5mVkp4Qlk0anpKVVdQQW9yaWxqUVhtb0ZscVRvak9PZWQ2VVU3NERnWFNrcVIKZlRrekFlY1ViMWtnVWk3VkhXRkJobzR0OHlnUVV0dEpuUXBLRXdJREFRQUJBb0lCQURVTzcyVVJwK2x0WjVGMgpWdmJIOWpuSFV2UXpWYTJKcFA0ZTd5WEtBZ1hwbFpWYXdHNG9ZamxudUtjbkRUVC9JWHgyODBUeEl6YWI0TGJPCm5VbVNOemJQWjRucFFHbFEvVXBQL2Y3UXFyWUQzNDN6R0Z4elh3Y0trdHRKZ0V2MW82ZnRDN3huUjFIcFN6ZFIKUFJMcDN0SmxzdW1ZejRkenZXbVVmRlJBaGI0Zlk3dmdmM0hCK2VEc21oQjF0eUE4UmFwT1RjR2FTckkxK0J1NgpyMVVqYTVpM24vMlhNRUw4OCtrNDRBOUE0elBINUVxUEFtNFdhS1ViWEtSTGYrWTUwZ29jV04rMFRpTFV2eFhBCjlFcE1WR1VGNHo2Q25SUEV2NmJGSmVZcGlaQUdBNXlYY0Fqa0lzU3VQQ1ZOS1RLLzROWEN0aVNlczJNSndjZFEKays4MHp6RUNnWUVBNlUxTmR2UkU3dExqRncvTDAvcnBmNDI1ZnNWWm4xRC85d050UEhqVGtvSmFmdXVjNjZiMwo1R1hjR1VUcEhEeXgwMDdWZ3FuaTJva3NObzhWWTdZQzUrWDlWd1RRclZhdmpCREYwa3BhblZNVndhWlpxT3I2ClFOeXdnd2lSMURWQXlJZVNncW94ckFnbS9iTkpPaWpGdjd4aEdBbm9VNnlXQTltT2I2YU9tZTBDZ1lFQTZEdXcKT0JlTjIwR2liZDZ6QnRzV05XYkJqQ1lqZzdheFJWWFhZK3pyQWhjWmxCUFJuSGJTZXR3TW9xTmYveGxHSmc0awp0VE9sTFhOQ09DVXErM2FuWjZNaEZ4ajJSZ0JtMGNYUUlzSFcyc0pCMDJCcWZtbUZlcWlzODMvRFZWSHBBbjhjCmRDamhJKzJzd1ZOTjk0MUZBUGtjcFdaQ2tadllMc3hYdlNRUDgvOENnWUJXTWRZOTdhK09JT0gvd2psSFB6dUgKZ2NBWHd5Z0NnWFdnT0diaVlhMmhRb0hXeEl2OFVIcmpxbkp2NzVMRWVQUW1Jc2tsZGtpMi90a1Q2emMyMktjbwpNRU95STdoSlltNkhMQ2M2TTNoWkNicFBDbnV6dWVUdGs5dXUvYnFMRVlXMjBNZmplS2ZUYkV1ampkcXZIeU00ClhJdnV5ckpJUDhwSTc5YjlEeWMrWFFLQmdGTXAxTkF4ZHlaV1djRjRwNm5EMlM4a2Joa3ZLemFtdk5LMGk5NkgKNEJ5dWd3VnBGMzR0ZXZCdVRzUUxOM3hWNDY0TEVKQW5QM2FJT09WOFFla3RNNFBFZ2p3UVAxa1FHY0h6VWJhdwpyYTFITldWcHVKa3VWcE4zUmdBbzk1MWRLTkV4RGRKM05UQzFrMURqOFI2K1kwQ1c5UEF5TDVLUE9acUFxTWJkCjNDeW5Bb0dBWDJiV3VoaURKTExmZVFGU3MxaVMxeEdXSDFabXVlYUZETXVqWHVHQ3d3RktwNkVtYnB4V282bHAKZi9EVHpjeEc2Nm4zWHl0d3JWVTF3WlUyR2tiN1JzaVF5amQvb0xQOHZZMEx4UkRQMTNjZWxhNHBwa3o5cXQ1Uwpndy9DaW5MZ1Erd0VVSHZYL2tCT0IwNkdTYWY2bzNUMDB0L2twcG5vV2s0cGRvMmNFVjQ9Ci0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg== - ---- -# Source: cilium/templates/hubble/tls-helm/server-secret.yaml -apiVersion: v1 -kind: Secret -metadata: - name: hubble-server-certs - namespace: kube-system - labels: - cilium.io/helm-template-non-idempotent: "true" - - annotations: -type: kubernetes.io/tls -data: - ca.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURFekNDQWZ1Z0F3SUJBZ0lRZWo4K0VORUJMdTBHZzZna1B1eFl5VEFOQmdrcWhraUc5dzBCQVFzRkFEQVUKTVJJd0VBWURWUVFERXdsRGFXeHBkVzBnUTBFd0hoY05Nall3T0RFeU1qSXpNREF5V2hjTk1qa3dPREV4TWpJegpNREF5V2pBVU1SSXdFQVlEVlFRREV3bERhV3hwZFcwZ1EwRXdnZ0VpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElCCkR3QXdnZ0VLQW9JQkFRRFRwSE9jNjJxM29VZ1ByRjNSRFhKY3c0WmxnRE5la1ZHc1c5TVRMdFdXS245d0tMbmUKQzZrbGxNVk5ydnVyVGptMDU3aGpDbkVkcndkOVd6YlJWNHczVXJYeWZOK0ptck04WWJyODFPMFFWcGdLQTJiTQpUQmM0OVhjcHkyUWwzSWYwaXdxMkdTek1qMjFyekZheVM2Q1Zwb1dOTVdqOWxzOFFjOFJ0eElLOG5zZ2t6cDRvCis0TmE5TkRrSldsM1NWK2NJbXJlSnVveWpSZWFlTzhNZ2J0R05NdFAwWGhweUp3ZTNSRnJWck5qV3JxcjFyMVIKLzZ6cjhrN3B1b0FyMmNaN1dkOVVuRUZqaVBNbFJZOENpdUtXTkJlYWdXV3BPaU00NTUzcFJUdmdPQmRLU3BGOQpPVE1CNXhSdldTQlNMdFVkWVVHR2ppM3pLQkJTMjBtZENrb1RBZ01CQUFHallUQmZNQTRHQTFVZER3RUIvd1FFCkF3SUNwREFkQmdOVkhTVUVGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXcKQXdFQi96QWRCZ05WSFE0RUZnUVUrMnFyZXdBejRXREptZnNBVW9MVm9wQzBXR2d3RFFZSktvWklodmNOQVFFTApCUUFEZ2dFQkFHb2xLZFljNGJ2VjR2b1RyRnNvMHF3YklBQlREc09xdU9mVURqM3NWb0VCS2hXUHQ5TUI3WVBNCnJBL2NGZTA0bTR1Zk1sT29RdDdlOWtmbVJjK2Z2VUpucFZ6aXFHQWhnZFBTVWt0eGdQOHl5Q3hLVVJVeGdPT3MKNUFoM3dWazBDdDFOY24xYVpXU3R1NDQ0SEppbko0QllESkNpQ1ZESTJaRjlQaWo5WFZlSnp5TUlUSHptSEpaSgp6MU9xV2s3aXhYZnJUYnRwTkxWekY0Z21TV1Y5cXYwNklvczVrRFVXVFZ3bUtMKzNZZ3U4elR3dk10MFl1ak5UCjROeWRaTzNVditYUnBLaTgwVE02dzlXVUIyZUtQRSs4NDVhcC8rUWZ1ZThrMzVFaVZ4NTlWWGJ0SFJuWHRBLzEKYURhLzROcmlTNVZGZjNxU0hBd2RienRta3YramtMdz0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo= - tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURWekNDQWorZ0F3SUJBZ0lSQUs1ekJsSktTQzNUcGlGRmcyNnBZbWN3RFFZSktvWklodmNOQVFFTEJRQXcKRkRFU01CQUdBMVVFQXhNSlEybHNhWFZ0SUVOQk1CNFhEVEkyTURneE1qSXlNekF3TWxvWERUSTNNRGd4TWpJeQpNekF3TWxvd0tqRW9NQ1lHQTFVRUF3d2ZLaTVrWldaaGRXeDBMbWgxWW1Kc1pTMW5jbkJqTG1OcGJHbDFiUzVwCmJ6Q0NBU0l3RFFZSktvWklodmNOQVFFQkJRQURnZ0VQQURDQ0FRb0NnZ0VCQU5NUEdPckUzR01aOGNXbUxXcGkKSVhjbkhQNnJEWTI1NFl2NW9WM3pQVU5QdzBNcFE1ZzJlK0dlL1dzdGw2T2ZoTWdlYVFaMjVaZTZLU3k1dkpvQwpqTEo3eDZaL3AxMFA2SzVWK3pBRnRTVkd2T096d29SNnQ2emtaWkpnK1dxZVZJc3REdGZXL2I3MXZpbURJTUkxCmc4dHRITTV1U1UrWEFVZlBnSngwVFJMMTQ2ZlRpU0xFN0R4emVkTWs1dHovTDZPaUlPRXN0bklyWUgyNkhNdmEKYWxzbTNMQktnK09KL001U0xDR2tVWk5TT2ROYmZuT1gvQ05uNElER2pjQnRCRG5sclpqVHVpSDhUdTdtYXpnMAp2WVJQbVRjZXdRVzJBMWlHUkhScFM5a083WkJ3RHFwTzUxSzd1VUR4QUVuajFNWnQ3ajZIblB5VVBTMFZXaUlECm4zMENBd0VBQWFPQmpUQ0JpakFPQmdOVkhROEJBZjhFQkFNQ0JhQXdIUVlEVlIwbEJCWXdGQVlJS3dZQkJRVUgKQXdFR0NDc0dBUVVGQndNQ01Bd0dBMVVkRXdFQi93UUNNQUF3SHdZRFZSMGpCQmd3Rm9BVSsycXJld0F6NFdESgptZnNBVW9MVm9wQzBXR2d3S2dZRFZSMFJCQ013SVlJZktpNWtaV1poZFd4MExtaDFZbUpzWlMxbmNuQmpMbU5wCmJHbDFiUzVwYnpBTkJna3Foa2lHOXcwQkFRc0ZBQU9DQVFFQXFsWWNNNFFtYzBsckpBb2xCbHpReisvNFJMa08KV2ZoTVR2bGFyQ0NtMUlnY3pmR1VxVG9NODU4V3MzcDgxZmZUcjlldHFIZzNEZzRWTUcrTFUxWk80d0pvYTBscApjV2Nhb1ZiSVFTSDJ3dmFJTGhqakd3aTlpR3FKYnIyUjJWdUxQMUZ2aEhyejNvR2hxMkVBV2hlOVlXZGlBM3RVCmlUTmRaWVhOdXUxZExTaWw2aEsxSkljS0lJVURhMllxUFFCNjcvRHFyN294Ri9peTF5VEpzaTV2ckdRdnlzbXAKQkg2cXptODh4bk1HTXF4OXBEUmpqN01jK2RLLzliaHplOVdUT2VxTlUzQlJNM3dIRHlDd1IxN3pXNFNQUFBDRwpVR2VEVUVXRVVVV2FUYUFnL0MrOHhhOEUvSFhZeHNVQndXQVBGM1h6QVFVY3JXYkpaN1JFNmJLRTdBPT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo= - tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb3dJQkFBS0NBUUVBMHc4WTZzVGNZeG54eGFZdGFtSWhkeWNjL3FzTmpibmhpL21oWGZNOVEwL0RReWxECm1EWjc0Wjc5YXkyWG81K0V5QjVwQm5ibGw3b3BMTG04bWdLTXNudkhwbituWFEvb3JsWDdNQVcxSlVhODQ3UEMKaEhxM3JPUmxrbUQ1YXA1VWl5ME8xOWI5dnZXK0tZTWd3aldEeTIwY3ptNUpUNWNCUjgrQW5IUk5FdlhqcDlPSgpJc1RzUEhONTB5VG0zUDh2bzZJZzRTeTJjaXRnZmJvY3k5cHFXeWJjc0VxRDQ0bjh6bElzSWFSUmsxSTUwMXQrCmM1ZjhJMmZnZ01hTndHMEVPZVd0bU5PNklmeE83dVpyT0RTOWhFK1pOeDdCQmJZRFdJWkVkR2xMMlE3dGtIQU8KcWs3blVydTVRUEVBU2VQVXhtM3VQb2VjL0pROUxSVmFJZ09mZlFJREFRQUJBb0lCQUVmSmc4MGVobU9DeUpSVQprRy8xenJJcmNKWkNjZ3E1cGJpcGdMUm03bmg5b2Ntdk9GbUdkcDVvS0lRUzd0ZnRnd2xhSnBqWFNnSlFoSDY4CjhpUmtKNXp4c3hlenBhWm1xZHJhVGVTb25GT0FldkRzRElacEF4NWdWUmZ6dWdJRXRuYmNMWWRHamVvc3hiQnkKOUdwNkwwaTY1U2hscExQWWhjdjZEU0dxQVNrb01TR29CY2VMaSt4Nno0NWEzL1dSZ1F1R0JLU09iL0VPUU1vWQpBdm80NVJVSTNvMnpUTnBsTVBBd0lvMkV5OExRaFQxNHdKeitjdEcwZldtRlpCeS9kd01nRGdJc0xUd1JxbWdqCmJvam5DSWxlcDdqOVpRTmFRVTg2R3ZLMytEZWpYZUxyc2lKRFg2SEVVZksyaVMrQnVjZWMvdzNPMmphdlBxU0EKOVBEUVVsVUNnWUVBOUllQkVmL3pPUkxoRk1QZWVJaEVuN3AycFB1Q1ZpT0IrSjZzb1JKdmhGVmU5SUs3VTJLcwpNaGJONmJJK09iUGFOTHdFQ05IVUlGbThsN0JrbURGVUxkaFBtbGFGeDhRSUI3NFhoRnhCZkUySGpESjMyaFZpClNnZCtQaGpJUStsM3RyK3VlTitGNFFmMXZWUUhSVGljajJsbHZacGUxb3dZR2trZmRUUS9ROHNDZ1lFQTNQV24KMWZmWEx4MGpJZ2pUMEFCTkc3WDF2dzAza21XVkhVOXJPdWRBNVhqZC93eG54NnBRTWpqT3krNVlEbGhsbkJQUQo1U2tOSHJxWkVaaTdNcGpsNndqeXpKZXdkS3EwdXFoYURSd3RIcS9rOGRhcXR3UmRSWGVnTnY4aVdNR3JTMTZNClR1QkhRRjRMZXRRTEtjUURFcTI1YnZWSld6YmZwVFVkUWdOUEVOY0NnWUVBd2puTExGZm5nZ0xiNHhsODRMSWsKQjljY25Bamx5ck9qYmEzaklvRTVNSng2c3E0UVNyaEtXL0svRll1dFh6bmE3UjRWK2tkb1BWWHB0WGEzUUNlVwpYRisvUXJETXpCS0o2bFJ6NjM4M3lKcndPa3h2NURvdCt1MGV1Z1lITStJQ1k1YTI1MjFyc29VWERJM3N4RytsCjgwZGRONCtoR3JybC9pTHNxTFNhTjZjQ2dZQlFFU1JVUUk3Vkg3WFBhMnQxZitaeEdDcUlwSDF5cXlTeGprbkkKK210bHU3cVY1U1RtRVMwbVJiZUo1a0E2VW9YZlhMN2hpMUtady93YmlFQ3RRUUp2ZkxxZXNJamNmYzhucEVHZApab3hqQmxIcjRHSFVGOXpFZzJpbkJTU3BET1RKVnVWNDM0UnlLcUgyVEVnUFJsdm10TlR4QkNra3lHbWFML2orCkpyekwyUUtCZ0RheDBPL0ZKcHNjVDBoV2RjZ3pVVU1iMUo1UngrQlV2eXp0SVp2ckpmdEdmRnRnUXRhZXNLaFgKS0ZwTlNXMW1yci96TmVhKzVLWnZoYTV1MWtnbVZ5YWRrR3ZZVnpkeTBWajdycTM3TXo1M01qMTJQUTZlTnhzcwo1K0NZd012WVRWR0Z1eTl5b2tDTm0zOENSZTFqSEFjanE0dFN6d2dSd3ArU2h5UDJZSFJvCi0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg== - ---- -# Source: cilium/templates/cilium-configmap.yaml -apiVersion: v1 -kind: ConfigMap -metadata: - name: cilium-config - namespace: kube-system -data: - - # Identity allocation mode selects how identities are shared between cilium - # nodes by setting how they are stored. The options are "crd", "kvstore" or - # "doublewrite-readkvstore" / "doublewrite-readcrd". - # - "crd" stores identities in kubernetes as CRDs (custom resource definition). - # These can be queried with: - # kubectl get ciliumid - # - "kvstore" stores identities in an etcd kvstore, that is - # configured below. Cilium versions before 1.6 supported only the kvstore - # backend. Upgrades from these older cilium versions should continue using - # the kvstore by commenting out the identity-allocation-mode below, or - # setting it to "kvstore". - # - "doublewrite" modes store identities in both the kvstore and CRDs. This is useful - # for seamless migrations from the kvstore mode to the crd mode. Consult the - # documentation for more information on how to perform the migration. - identity-allocation-mode: crd - - identity-heartbeat-timeout: "30m0s" - identity-gc-interval: "15m0s" - cilium-endpoint-gc-interval: "5m0s" - nodes-gc-interval: "5m0s" - - # If you want to run cilium in debug mode change this value to true - debug: "false" - metrics-sampling-interval: "5m" - # The agent can be put into the following three policy enforcement modes - # default, always and never. - # https://docs.cilium.io/en/latest/security/policy/intro/#policy-enforcement-modes - enable-policy: "default" - # If you want metrics enabled in cilium-operator, set the port for - # which the Cilium Operator will have their metrics exposed. - # NOTE that this will open the port on the nodes where Cilium operator pod - # is scheduled. - operator-prometheus-serve-addr: ":9963" - enable-metrics: "true" - enable-policy-secrets-sync: "true" - policy-secrets-only-from-secrets-namespace: "true" - policy-secrets-namespace: "cilium-secrets" - - # Enable IPv4 addressing. If enabled, all endpoints are allocated an IPv4 - # address. - enable-ipv4: "true" - - # Enable IPv6 addressing. If enabled, all endpoints are allocated an IPv6 - # address. - enable-ipv6: "false" - # Users who wish to specify their own custom CNI configuration file must set - # custom-cni-conf to "true", otherwise Cilium may overwrite the configuration. - custom-cni-conf: "false" - enable-bpf-clock-probe: "false" - # If you want cilium monitor to aggregate tracing for packets, set this level - # to "low", "medium", or "maximum". The higher the level, the less packets - # that will be seen in monitor output. - monitor-aggregation: medium - - # The monitor aggregation interval governs the typical time between monitor - # notification events for each allowed connection. - # - # Only effective when monitor aggregation is set to "medium" or higher. - monitor-aggregation-interval: "5s" - - # The monitor aggregation flags determine which TCP flags which, upon the - # first observation, cause monitor notifications to be generated. - # - # Only effective when monitor aggregation is set to "medium" or higher. - monitor-aggregation-flags: all - # Specifies the ratio (0.0-1.0] of total system memory to use for dynamic - # sizing of the TCP CT, non-TCP CT, NAT and policy BPF maps. - bpf-map-dynamic-size-ratio: "0.0025" - # bpf-policy-map-max specifies the maximum number of entries in endpoint - # policy map (per endpoint) - bpf-policy-map-max: "16384" - # bpf-policy-stats-map-max specifies the maximum number of entries in global - # policy stats map - bpf-policy-stats-map-max: "65536" - # bpf-lb-map-max specifies the maximum number of entries in bpf lb service, - # backend and affinity maps. - bpf-lb-map-max: "65536" - bpf-lb-external-clusterip: "false" - bpf-lb-source-range-all-types: "false" - bpf-lb-algorithm-annotation: "false" - bpf-lb-mode-annotation: "false" - - bpf-distributed-lru: "false" - bpf-events-drop-enabled: "true" - bpf-events-policy-verdict-enabled: "true" - bpf-events-trace-enabled: "true" - - # Pre-allocation of map entries allows per-packet latency to be reduced, at - # the expense of up-front memory allocation for the entries in the maps. The - # default value below will minimize memory usage in the default installation; - # users who are sensitive to latency may consider setting this to "true". - # - # This option was introduced in Cilium 1.4. Cilium 1.3 and earlier ignore - # this option and behave as though it is set to "true". - # - # If this value is modified, then during the next Cilium startup the restore - # of existing endpoints and tracking of ongoing connections may be disrupted. - # As a result, reply packets may be dropped and the load-balancing decisions - # for established connections may change. - # - # If this option is set to "false" during an upgrade from 1.3 or earlier to - # 1.4 or later, then it may cause one-time disruptions during the upgrade. - preallocate-bpf-maps: "false" - - # Name of the cluster. Only relevant when building a mesh of clusters. - cluster-name: "default" - # Unique ID of the cluster. Must be unique across all connected clusters and - # in the range of 1 and 255. Only relevant when building a mesh of clusters. - cluster-id: "0" - - # Encapsulation mode for communication between nodes - # Possible values: - # - disabled - # - vxlan (default) - # - geneve - - routing-mode: "tunnel" - tunnel-protocol: "vxlan" - tunnel-source-port-range: "0-0" - service-no-backend-response: "reject" - policy-deny-response: "none" - - - # Enables L7 proxy for L7 policy enforcement and visibility - enable-l7-proxy: "true" - enable-ipv4-masquerade: "true" - enable-ipv4-big-tcp: "false" - enable-ipv6-big-tcp: "false" - enable-ipv6-masquerade: "true" - enable-tcx: "true" - datapath-mode: "veth" - enable-masquerade-to-route-source: "false" - - enable-xt-socket-fallback: "true" - install-no-conntrack-iptables-rules: "false" - iptables-random-fully: "false" - - auto-direct-node-routes: "false" - direct-routing-skip-unreachable: "false" - - - - kube-proxy-replacement: "false" - enable-no-service-endpoints-routable: "true" - bpf-lb-sock: "false" - enable-health-check-nodeport: "true" - enable-health-check-loadbalancer-ip: "false" - node-port-bind-protection: "true" - enable-auto-protect-node-port-range: "true" - bpf-lb-acceleration: "disabled" - enable-service-topology: "false" - enable-l2-neigh-discovery: "false" - k8s-require-ipv4-pod-cidr: "false" - k8s-require-ipv6-pod-cidr: "false" - enable-k8s-networkpolicy: "true" - enable-endpoint-lockdown-on-policy-overflow: "false" - # Tell the agent to generate and write a CNI configuration file - write-cni-conf-when-ready: /host/etc/cni/net.d/05-cilium.conflist - cni-exclusive: "true" - cni-log-file: "/var/run/cilium/cilium-cni.log" - enable-endpoint-health-checking: "true" - enable-health-checking: "true" - health-check-icmp-failure-threshold: "3" - enable-well-known-identities: "false" - enable-node-selector-labels: "false" - synchronize-k8s-nodes: "true" - operator-api-serve-addr: "127.0.0.1:9234" - - enable-hubble: "true" - # UNIX domain socket for Hubble server to listen to. - hubble-socket-path: "/var/run/cilium/hubble.sock" - hubble-network-policy-correlation-enabled: "true" - # An additional address for Hubble server to listen to (e.g. ":4244"). - hubble-listen-address: ":4244" - hubble-disable-tls: "false" - hubble-tls-cert-file: /var/lib/cilium/tls/hubble/server.crt - hubble-tls-key-file: /var/lib/cilium/tls/hubble/server.key - hubble-tls-client-ca-files: /var/lib/cilium/tls/hubble/client-ca.crt - ipam: "cluster-pool" - ipam-cilium-node-update-rate: "15s" - cluster-pool-ipv4-cidr: "10.0.0.0/8" - cluster-pool-ipv4-mask-size: "24" - - default-lb-service-ipam: "lbipam" - egress-gateway-reconciliation-trigger-interval: "1s" - enable-vtep: "false" - vtep-endpoint: "" - vtep-cidr: "" - vtep-mask: "" - vtep-mac: "" - - packetization-layer-pmtud-mode: "blackhole" - procfs: "/host/proc" - bpf-root: "/sys/fs/bpf" - cgroup-root: "/run/cilium/cgroupv2" - - identity-management-mode: "agent" - enable-sctp: "false" - remove-cilium-node-taints: "true" - set-cilium-node-taints: "true" - set-cilium-is-up-condition: "true" - unmanaged-pod-watcher-interval: "15s" - # default DNS proxy to transparent mode in non-chaining modes - dnsproxy-enable-transparent-mode: "true" - dnsproxy-socket-linger-timeout: "10" - tofqdns-dns-reject-response-code: "refused" - tofqdns-enable-dns-compression: "true" - tofqdns-endpoint-max-ip-per-hostname: "1000" - tofqdns-idle-connection-grace-period: "0s" - tofqdns-max-deferred-connection-deletes: "10000" - tofqdns-proxy-response-max-delay: "100ms" - tofqdns-preallocate-identities: "true" - agent-not-ready-taint-key: "node.cilium.io/agent-not-ready" - - mesh-auth-enabled: "false" - mesh-auth-queue-size: "1024" - mesh-auth-rotated-identities-queue-size: "1024" - mesh-auth-gc-interval: "5m0s" - - proxy-xff-num-trusted-hops-ingress: "0" - proxy-xff-num-trusted-hops-egress: "0" - proxy-connect-timeout: "2" - proxy-initial-fetch-timeout: "30" - proxy-max-active-downstream-connections: "50000" - proxy-max-requests-per-connection: "0" - proxy-max-connection-duration-seconds: "0" - proxy-idle-timeout-seconds: "60" - proxy-max-concurrent-retries: "128" - proxy-use-original-source-address: "true" - proxy-cluster-max-connections: "1024" - proxy-cluster-max-requests: "1024" - http-retry-count: "3" - http-stream-idle-timeout: "300" - - external-envoy-proxy: "true" - envoy-base-id: "0" - envoy-access-log-buffer-size: "4096" - envoy-keep-cap-netbindservice: "false" - max-connected-clusters: "255" - clustermesh-cache-ttl: "0s" - clustermesh-enable-endpoint-sync: "false" - clustermesh-enable-mcs-api: "false" - clustermesh-mcs-api-install-crds: "true" - policy-default-local-cluster: "true" - - nat-map-stats-entries: "32" - nat-map-stats-interval: "30s" - enable-lb-ipam: "true" - enable-non-default-deny-policies: "true" - enable-source-ip-verification: "true" - enable-dynamic-config: "true" - enable-drift-checker: "true" - -# Extra config allows adding arbitrary properties to the cilium config. -# By putting it at the end of the ConfigMap, it's also possible to override existing properties. ---- -# Source: cilium/templates/cilium-envoy/configmap.yaml -apiVersion: v1 -kind: ConfigMap -metadata: - name: cilium-envoy-config - namespace: kube-system -data: - # Keep the key name as bootstrap-config.json to avoid breaking changes - bootstrap-config.json: | - {"admin":{"address":{"pipe":{"mode":432,"path":"/var/run/cilium/envoy/sockets/admin.sock"}}},"applicationLogConfig":{"logFormat":{"textFormat":"[%Y-%m-%d %T.%e][%t][%l][%n] [%g:%#] %v"}},"bootstrapExtensions":[{"name":"envoy.bootstrap.internal_listener","typedConfig":{"@type":"type.googleapis.com/envoy.extensions.bootstrap.internal_listener.v3.InternalListener"}}],"dynamicResources":{"cdsConfig":{"apiConfigSource":{"apiType":"GRPC","grpcServices":[{"envoyGrpc":{"clusterName":"xds-grpc-cilium"}}],"setNodeOnFirstMessageOnly":true,"transportApiVersion":"V3"},"initialFetchTimeout":"30s","resourceApiVersion":"V3"},"ldsConfig":{"apiConfigSource":{"apiType":"GRPC","grpcServices":[{"envoyGrpc":{"clusterName":"xds-grpc-cilium"}}],"setNodeOnFirstMessageOnly":true,"transportApiVersion":"V3"},"initialFetchTimeout":"30s","resourceApiVersion":"V3"}},"node":{"cluster":"ingress-cluster","id":"host~127.0.0.1~no-id~localdomain"},"overloadManager":{"resourceMonitors":[{"name":"envoy.resource_monitors.global_downstream_max_connections","typedConfig":{"@type":"type.googleapis.com/envoy.extensions.resource_monitors.downstream_connections.v3.DownstreamConnectionsConfig","max_active_downstream_connections":"50000"}}]},"staticResources":{"clusters":[{"circuitBreakers":{"thresholds":[{"maxConnections":1024,"maxRequests":1024,"maxRetries":128}]},"cleanupInterval":"2.500s","connectTimeout":"2s","lbPolicy":"CLUSTER_PROVIDED","name":"ingress-cluster","type":"ORIGINAL_DST","typedExtensionProtocolOptions":{"envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{"@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions","commonHttpProtocolOptions":{"idleTimeout":"60s","maxConnectionDuration":"0s","maxRequestsPerConnection":0},"useDownstreamProtocolConfig":{}}}},{"circuitBreakers":{"thresholds":[{"maxConnections":1024,"maxRequests":1024,"maxRetries":128}]},"cleanupInterval":"2.500s","connectTimeout":"2s","lbPolicy":"CLUSTER_PROVIDED","name":"egress-cluster-tls","transportSocket":{"name":"cilium.tls_wrapper","typedConfig":{"@type":"type.googleapis.com/cilium.UpstreamTlsWrapperContext"}},"type":"ORIGINAL_DST","typedExtensionProtocolOptions":{"envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{"@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions","commonHttpProtocolOptions":{"idleTimeout":"60s","maxConnectionDuration":"0s","maxRequestsPerConnection":0},"upstreamHttpProtocolOptions":{},"useDownstreamProtocolConfig":{}}}},{"circuitBreakers":{"thresholds":[{"maxConnections":1024,"maxRequests":1024,"maxRetries":128}]},"cleanupInterval":"2.500s","connectTimeout":"2s","lbPolicy":"CLUSTER_PROVIDED","name":"egress-cluster","type":"ORIGINAL_DST","typedExtensionProtocolOptions":{"envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{"@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions","commonHttpProtocolOptions":{"idleTimeout":"60s","maxConnectionDuration":"0s","maxRequestsPerConnection":0},"useDownstreamProtocolConfig":{}}}},{"circuitBreakers":{"thresholds":[{"maxConnections":1024,"maxRequests":1024,"maxRetries":128}]},"cleanupInterval":"2.500s","connectTimeout":"2s","lbPolicy":"CLUSTER_PROVIDED","name":"ingress-cluster-tls","transportSocket":{"name":"cilium.tls_wrapper","typedConfig":{"@type":"type.googleapis.com/cilium.UpstreamTlsWrapperContext"}},"type":"ORIGINAL_DST","typedExtensionProtocolOptions":{"envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{"@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions","commonHttpProtocolOptions":{"idleTimeout":"60s","maxConnectionDuration":"0s","maxRequestsPerConnection":0},"upstreamHttpProtocolOptions":{},"useDownstreamProtocolConfig":{}}}},{"connectTimeout":"2s","loadAssignment":{"clusterName":"xds-grpc-cilium","endpoints":[{"lbEndpoints":[{"endpoint":{"address":{"pipe":{"path":"/var/run/cilium/envoy/sockets/xds.sock"}}}}]}]},"name":"xds-grpc-cilium","type":"STATIC","typedExtensionProtocolOptions":{"envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{"@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions","explicitHttpConfig":{"http2ProtocolOptions":{}}}}},{"connectTimeout":"2s","loadAssignment":{"clusterName":"/envoy-admin","endpoints":[{"lbEndpoints":[{"endpoint":{"address":{"pipe":{"path":"/var/run/cilium/envoy/sockets/admin.sock"}}}}]}]},"name":"/envoy-admin","type":"STATIC"}],"listeners":[{"address":{"socketAddress":{"address":"0.0.0.0","portValue":9964}},"filterChains":[{"filters":[{"name":"envoy.filters.network.http_connection_manager","typedConfig":{"@type":"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager","httpFilters":[{"name":"envoy.filters.http.router","typedConfig":{"@type":"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"}}],"internalAddressConfig":{"cidrRanges":[{"addressPrefix":"10.0.0.0","prefixLen":8},{"addressPrefix":"172.16.0.0","prefixLen":12},{"addressPrefix":"192.168.0.0","prefixLen":16},{"addressPrefix":"127.0.0.1","prefixLen":32}]},"routeConfig":{"virtualHosts":[{"domains":["*"],"name":"prometheus_metrics_route","routes":[{"match":{"prefix":"/metrics"},"name":"prometheus_metrics_route","route":{"cluster":"/envoy-admin","prefixRewrite":"/stats/prometheus"}}]}]},"statPrefix":"envoy-prometheus-metrics-listener","streamIdleTimeout":"300s"}}]}],"name":"envoy-prometheus-metrics-listener"},{"address":{"socketAddress":{"address":"127.0.0.1","portValue":9878}},"filterChains":[{"filters":[{"name":"envoy.filters.network.http_connection_manager","typedConfig":{"@type":"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager","httpFilters":[{"name":"envoy.filters.http.router","typedConfig":{"@type":"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"}}],"internalAddressConfig":{"cidrRanges":[{"addressPrefix":"10.0.0.0","prefixLen":8},{"addressPrefix":"172.16.0.0","prefixLen":12},{"addressPrefix":"192.168.0.0","prefixLen":16},{"addressPrefix":"127.0.0.1","prefixLen":32}]},"routeConfig":{"virtual_hosts":[{"domains":["*"],"name":"health","routes":[{"match":{"prefix":"/healthz"},"name":"health","route":{"cluster":"/envoy-admin","prefixRewrite":"/ready"}}]}]},"statPrefix":"envoy-health-listener","streamIdleTimeout":"300s"}}]}],"name":"envoy-health-listener"}]}} - ---- -# Source: cilium/templates/cilium-agent/clusterrole.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: cilium - labels: - app.kubernetes.io/part-of: cilium -rules: -- apiGroups: - - networking.k8s.io - resources: - - networkpolicies - verbs: - - get - - list - - watch -- apiGroups: - - discovery.k8s.io - resources: - - endpointslices - verbs: - - get - - list - - watch -- apiGroups: - - "" - resources: - - namespaces - - services - - pods - - endpoints - - nodes - verbs: - - get - - list - - watch -- apiGroups: - - apiextensions.k8s.io - resources: - - customresourcedefinitions - verbs: - - list - - watch - # This is used when validating policies in preflight. This will need to stay - # until we figure out how to avoid "get" inside the preflight, and then - # should be removed ideally. - - get -- apiGroups: - - cilium.io - resources: - - ciliumloadbalancerippools - - ciliumbgppeeringpolicies - - ciliumbgpnodeconfigs - - ciliumbgpadvertisements - - ciliumbgppeerconfigs - - ciliumclusterwideenvoyconfigs - - ciliumclusterwidenetworkpolicies - - ciliumegressgatewaypolicies - - ciliumendpoints - - ciliumendpointslices - - ciliumenvoyconfigs - - ciliumidentities - - ciliumlocalredirectpolicies - - ciliumnetworkpolicies - - ciliumnodes - - ciliumnodeconfigs - - ciliumcidrgroups - - ciliuml2announcementpolicies - - ciliumpodippools - verbs: - - list - - watch -- apiGroups: - - cilium.io - resources: - - ciliumidentities - - ciliumendpoints - - ciliumnodes - verbs: - - create -- apiGroups: - - cilium.io - # To synchronize garbage collection of such resources - resources: - - ciliumidentities - verbs: - - update -- apiGroups: - - cilium.io - resources: - - ciliumendpoints - verbs: - - delete - - get -- apiGroups: - - cilium.io - resources: - - ciliumnodes - - ciliumnodes/status - verbs: - - get - - update -- apiGroups: - - cilium.io - resources: - - ciliumendpoints/status - - ciliumendpoints - - ciliuml2announcementpolicies/status - - ciliumbgpnodeconfigs/status - verbs: - - patch - ---- -# Source: cilium/templates/cilium-operator/clusterrole.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: cilium-operator - labels: - app.kubernetes.io/part-of: cilium -rules: -- apiGroups: - - "" - resources: - - pods - verbs: - - get - - list - - watch - # to automatically delete [core|kube]dns pods so that are starting to being - # managed by Cilium - - delete -- apiGroups: - - "" - resources: - - configmaps - resourceNames: - - cilium-config - verbs: - # allow patching of the configmap to set annotations - - patch -- apiGroups: - - "" - resources: - - nodes - verbs: - - list - - watch -- apiGroups: - - "" - resources: - # To remove node taints - - nodes - # To set NetworkUnavailable false on startup - - nodes/status - verbs: - - patch -- apiGroups: - - discovery.k8s.io - resources: - - endpointslices - verbs: - - get - - list - - watch -- apiGroups: - - "" - resources: - # to perform LB IP allocation for BGP - - services/status - verbs: - - update - - patch -- apiGroups: - - "" - resources: - # to check apiserver connectivity - - namespaces - - secrets - verbs: - - get - - list - - watch -- apiGroups: - - "" - resources: - # to perform the translation of a CNP that contains `ToGroup` to its endpoints - - services - - endpoints - verbs: - - get - - list - - watch -- apiGroups: - - cilium.io - resources: - - ciliumnetworkpolicies - - ciliumclusterwidenetworkpolicies - verbs: - # Create auto-generated CNPs and CCNPs from Policies that have 'toGroups' - - create - - update - - deletecollection - # To update the status of the CNPs and CCNPs - - patch - - get - - list - - watch -- apiGroups: - - cilium.io - resources: - - ciliumnetworkpolicies/status - - ciliumclusterwidenetworkpolicies/status - verbs: - # Update the auto-generated CNPs and CCNPs status. - - patch - - update -- apiGroups: - - cilium.io - resources: - - ciliumendpoints - - ciliumidentities - verbs: - # To perform garbage collection of such resources - - delete - - list - - watch -- apiGroups: - - cilium.io - resources: - - ciliumidentities - verbs: - # To synchronize garbage collection of such resources - - update -- apiGroups: - - cilium.io - resources: - - ciliumnodes - verbs: - - create - - update - - get - - list - - watch - # To perform CiliumNode garbage collector - - delete -- apiGroups: - - cilium.io - resources: - - ciliumnodes/status - verbs: - - update -- apiGroups: - - cilium.io - resources: - - ciliumendpointslices - - ciliumenvoyconfigs - - ciliumbgppeerconfigs - - ciliumbgpadvertisements - - ciliumbgpnodeconfigs - verbs: - - create - - update - - get - - list - - watch - - delete - - patch -- apiGroups: - - cilium.io - resources: - - ciliumbgpclusterconfigs/status - - ciliumbgppeerconfigs/status - verbs: - - update -- apiGroups: - - apiextensions.k8s.io - resources: - - customresourcedefinitions - verbs: - - create - - get - - list - - watch -- apiGroups: - - apiextensions.k8s.io - resources: - - customresourcedefinitions - verbs: - - update - resourceNames: - - ciliumloadbalancerippools.cilium.io - - ciliumbgpclusterconfigs.cilium.io - - ciliumbgppeerconfigs.cilium.io - - ciliumbgpadvertisements.cilium.io - - ciliumbgpnodeconfigs.cilium.io - - ciliumbgpnodeconfigoverrides.cilium.io - - ciliumclusterwideenvoyconfigs.cilium.io - - ciliumclusterwidenetworkpolicies.cilium.io - - ciliumegressgatewaypolicies.cilium.io - - ciliumendpoints.cilium.io - - ciliumendpointslices.cilium.io - - ciliumenvoyconfigs.cilium.io - - ciliumidentities.cilium.io - - ciliumlocalredirectpolicies.cilium.io - - ciliumnetworkpolicies.cilium.io - - ciliumnodes.cilium.io - - ciliumnodeconfigs.cilium.io - - ciliumcidrgroups.cilium.io - - ciliuml2announcementpolicies.cilium.io - - ciliumpodippools.cilium.io - - ciliumgatewayclassconfigs.cilium.io -- apiGroups: - - cilium.io - resources: - - ciliumloadbalancerippools - - ciliumpodippools - - ciliumbgppeeringpolicies - - ciliumbgpclusterconfigs - - ciliumbgpnodeconfigoverrides - - ciliumbgppeerconfigs - verbs: - - get - - list - - watch -- apiGroups: - - cilium.io - resources: - - ciliumpodippools - verbs: - - create -- apiGroups: - - cilium.io - resources: - - ciliumloadbalancerippools/status - verbs: - - patch -# For cilium-operator running in HA mode. -# -# Cilium operator running in HA mode requires the use of ResourceLock for Leader Election -# between multiple running instances. -# The preferred way of doing this is to use LeasesResourceLock as edits to Leases are less -# common and fewer objects in the cluster watch "all Leases". -- apiGroups: - - coordination.k8s.io - resources: - - leases - verbs: - - create - - get - - update -- apiGroups: - - cilium.io - resources: - - ciliumendpointslices - verbs: - - deletecollection - ---- -# Source: cilium/templates/cilium-agent/clusterrolebinding.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: cilium - labels: - app.kubernetes.io/part-of: cilium -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: cilium -subjects: -- kind: ServiceAccount - name: "cilium" - namespace: kube-system - ---- -# Source: cilium/templates/cilium-operator/clusterrolebinding.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: cilium-operator - labels: - app.kubernetes.io/part-of: cilium -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: cilium-operator -subjects: -- kind: ServiceAccount - name: "cilium-operator" - namespace: kube-system - ---- -# Source: cilium/templates/cilium-agent/role.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: cilium-config-agent - namespace: kube-system - labels: - app.kubernetes.io/part-of: cilium -rules: -- apiGroups: - - "" - resources: - - configmaps - verbs: - - get - - list - - watch ---- -# Source: cilium/templates/cilium-agent/role.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: cilium-tlsinterception-secrets - namespace: "cilium-secrets" - labels: - app.kubernetes.io/part-of: cilium -rules: -- apiGroups: - - "" - resources: - - secrets - verbs: - - get - - list - - watch - ---- -# Source: cilium/templates/cilium-operator/role.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: cilium-operator-tlsinterception-secrets - namespace: "cilium-secrets" - labels: - app.kubernetes.io/part-of: cilium -rules: -- apiGroups: - - "" - resources: - - secrets - verbs: - - create - - delete - - update - - patch ---- -# Source: cilium/templates/cilium-operator/role.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: cilium-operator-ztunnel - namespace: kube-system - labels: - app.kubernetes.io/part-of: cilium -rules: -# ZTunnel DaemonSet management permissions -# Note: These permissions must always be granted (not conditional on encryption.type) -# because the controller needs to clean up stale DaemonSets when ztunnel is disabled. -- apiGroups: - - apps - resources: - - daemonsets - verbs: - - create - - delete - - get - - list - - watch - ---- -# Source: cilium/templates/cilium-agent/rolebinding.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: cilium-config-agent - namespace: kube-system - labels: - app.kubernetes.io/part-of: cilium -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: cilium-config-agent -subjects: - - kind: ServiceAccount - name: "cilium" - namespace: kube-system ---- -# Source: cilium/templates/cilium-agent/rolebinding.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: cilium-tlsinterception-secrets - namespace: "cilium-secrets" - labels: - app.kubernetes.io/part-of: cilium -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: cilium-tlsinterception-secrets -subjects: -- kind: ServiceAccount - name: "cilium" - namespace: kube-system - ---- -# Source: cilium/templates/cilium-operator/rolebinding.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: cilium-operator-tlsinterception-secrets - namespace: "cilium-secrets" - labels: - app.kubernetes.io/part-of: cilium -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: cilium-operator-tlsinterception-secrets -subjects: -- kind: ServiceAccount - name: "cilium-operator" - namespace: kube-system ---- -# Source: cilium/templates/cilium-operator/rolebinding.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: cilium-operator-ztunnel - namespace: kube-system - labels: - app.kubernetes.io/part-of: cilium -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: cilium-operator-ztunnel -subjects: -- kind: ServiceAccount - name: "cilium-operator" - namespace: kube-system - ---- -# Source: cilium/templates/cilium-envoy/service.yaml -apiVersion: v1 -kind: Service -metadata: - name: cilium-envoy - namespace: kube-system - annotations: - prometheus.io/scrape: "true" - prometheus.io/port: "9964" - labels: - k8s-app: cilium-envoy - app.kubernetes.io/name: cilium-envoy - app.kubernetes.io/part-of: cilium - io.cilium/app: proxy -spec: - clusterIP: None - type: ClusterIP - selector: - k8s-app: cilium-envoy - ports: - - name: envoy-metrics - port: 9964 - protocol: TCP - targetPort: 9964 - ---- -# Source: cilium/templates/hubble/peer-service.yaml -apiVersion: v1 -kind: Service -metadata: - name: hubble-peer - namespace: kube-system - labels: - k8s-app: cilium - app.kubernetes.io/part-of: cilium - app.kubernetes.io/name: hubble-peer - -spec: - selector: - k8s-app: cilium - ports: - - name: peer-service - port: 443 - protocol: TCP - targetPort: 4244 - internalTrafficPolicy: Local - ---- -# Source: cilium/templates/cilium-agent/daemonset.yaml -apiVersion: apps/v1 -kind: DaemonSet -metadata: - name: cilium - namespace: kube-system - labels: - k8s-app: cilium - app.kubernetes.io/part-of: cilium - app.kubernetes.io/name: cilium-agent -spec: - selector: - matchLabels: - k8s-app: cilium - updateStrategy: - rollingUpdate: - maxUnavailable: 2 - type: RollingUpdate - template: - metadata: - annotations: - kubectl.kubernetes.io/default-container: cilium-agent - labels: - k8s-app: cilium - app.kubernetes.io/name: cilium-agent - app.kubernetes.io/part-of: cilium - spec: - securityContext: - appArmorProfile: - type: Unconfined - seccompProfile: - type: Unconfined - containers: - - name: cilium-agent - image: "quay.io/cilium/cilium:v1.19.5@sha256:20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732" - imagePullPolicy: IfNotPresent - command: - - cilium-agent - args: - - --config-dir=/tmp/cilium/config-map - startupProbe: - httpGet: - host: "127.0.0.1" - path: /healthz - port: health - scheme: HTTP - httpHeaders: - - name: "brief" - value: "true" - failureThreshold: 300 - periodSeconds: 2 - successThreshold: 1 - initialDelaySeconds: 5 - livenessProbe: - httpGet: - host: "127.0.0.1" - path: /healthz - port: health - scheme: HTTP - httpHeaders: - - name: "brief" - value: "true" - - name: "require-k8s-connectivity" - value: "false" - periodSeconds: 30 - successThreshold: 1 - failureThreshold: 10 - timeoutSeconds: 5 - readinessProbe: - httpGet: - host: "127.0.0.1" - path: /healthz - port: health - scheme: HTTP - httpHeaders: - - name: "brief" - value: "true" - periodSeconds: 30 - successThreshold: 1 - failureThreshold: 3 - timeoutSeconds: 5 - env: - - name: K8S_NODE_NAME - valueFrom: - fieldRef: - apiVersion: v1 - fieldPath: spec.nodeName - - name: CILIUM_K8S_NAMESPACE - valueFrom: - fieldRef: - apiVersion: v1 - fieldPath: metadata.namespace - - name: CILIUM_CLUSTERMESH_CONFIG - value: /var/lib/cilium/clustermesh/ - - name: GOMEMLIMIT - valueFrom: - resourceFieldRef: - resource: limits.memory - divisor: '1' - - name: KUBE_CLIENT_BACKOFF_BASE - value: "1" - - name: KUBE_CLIENT_BACKOFF_DURATION - value: "120" - lifecycle: - postStart: - exec: - command: - - "bash" - - "-c" - - | - set -o errexit - set -o pipefail - set -o nounset - - # When running in AWS ENI mode, it's likely that 'aws-node' has - # had a chance to install SNAT iptables rules. These can result - # in dropped traffic, so we should attempt to remove them. - # We do it using a 'postStart' hook since this may need to run - # for nodes which might have already been init'ed but may still - # have dangling rules. This is safe because there are no - # dependencies on anything that is part of the startup script - # itself, and can be safely run multiple times per node (e.g. in - # case of a restart). - if [[ "$(iptables-save | grep -E -c 'AWS-SNAT-CHAIN|AWS-CONNMARK-CHAIN')" != "0" ]]; - then - echo 'Deleting iptables rules created by the AWS CNI VPC plugin' - iptables-save | grep -E -v 'AWS-SNAT-CHAIN|AWS-CONNMARK-CHAIN' | iptables-restore - fi - echo 'Done!' - - preStop: - exec: - command: - - /cni-uninstall.sh - ports: - - name: health - containerPort: 9879 - hostPort: 9879 - protocol: TCP - - name: peer-service - containerPort: 4244 - hostPort: 4244 - protocol: TCP - securityContext: - seLinuxOptions: - level: s0 - type: spc_t - capabilities: - add: - - CHOWN - - KILL - - NET_ADMIN - - NET_RAW - - IPC_LOCK - - SYS_MODULE - - SYS_ADMIN - - SYS_RESOURCE - - DAC_OVERRIDE - - FOWNER - - SETGID - - SETUID - - SYSLOG - drop: - - ALL - terminationMessagePolicy: FallbackToLogsOnError - volumeMounts: - - name: envoy-sockets - mountPath: /var/run/cilium/envoy/sockets - readOnly: false - # Unprivileged containers need to mount /proc/sys/net from the host - # to have write access - - mountPath: /host/proc/sys/net - name: host-proc-sys-net - # Unprivileged containers need to mount /proc/sys/kernel from the host - # to have write access - - mountPath: /host/proc/sys/kernel - name: host-proc-sys-kernel - - name: bpf-maps - mountPath: /sys/fs/bpf - # Unprivileged containers can't set mount propagation to bidirectional - # in this case we will mount the bpf fs from an init container that - # is privileged and set the mount propagation from host to container - # in Cilium. - mountPropagation: HostToContainer - - name: cilium-run - mountPath: /var/run/cilium - - name: cilium-netns - mountPath: /var/run/cilium/netns - mountPropagation: HostToContainer - - name: etc-cni-netd - mountPath: /host/etc/cni/net.d - - name: clustermesh-secrets - mountPath: /var/lib/cilium/clustermesh - readOnly: true - # Needed to be able to load kernel modules - - name: lib-modules - mountPath: /lib/modules - readOnly: true - - name: xtables-lock - mountPath: /run/xtables.lock - - name: hubble-tls - mountPath: /var/lib/cilium/tls/hubble - readOnly: true - - name: tmp - mountPath: /tmp - - initContainers: - - name: config - image: "quay.io/cilium/cilium:v1.19.5@sha256:20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732" - imagePullPolicy: IfNotPresent - command: - - cilium-dbg - - build-config - env: - - name: K8S_NODE_NAME - valueFrom: - fieldRef: - apiVersion: v1 - fieldPath: spec.nodeName - - name: CILIUM_K8S_NAMESPACE - valueFrom: - fieldRef: - apiVersion: v1 - fieldPath: metadata.namespace - volumeMounts: - - name: tmp - mountPath: /tmp - terminationMessagePolicy: FallbackToLogsOnError - securityContext: - capabilities: - add: - - NET_ADMIN - drop: - - ALL - # Required to mount cgroup2 filesystem on the underlying Kubernetes node. - # We use nsenter command with host's cgroup and mount namespaces enabled. - - name: mount-cgroup - image: "quay.io/cilium/cilium:v1.19.5@sha256:20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732" - imagePullPolicy: IfNotPresent - env: - - name: CGROUP_ROOT - value: /run/cilium/cgroupv2 - - name: BIN_PATH - value: /opt/cni/bin - command: - - bash - - -ec - # The statically linked Go program binary is invoked to avoid any - # dependency on utilities like sh and mount that can be missing on certain - # distros installed on the underlying host. Copy the binary to the - # same directory where we install cilium cni plugin so that exec permissions - # are available. - - | - cp /usr/bin/cilium-mount /hostbin/cilium-mount; - nsenter --cgroup=/hostproc/1/ns/cgroup --mount=/hostproc/1/ns/mnt "${BIN_PATH}/cilium-mount" $CGROUP_ROOT; - rm /hostbin/cilium-mount - volumeMounts: - - name: hostproc - mountPath: /hostproc - - name: cni-path - mountPath: /hostbin - terminationMessagePolicy: FallbackToLogsOnError - securityContext: - seLinuxOptions: - level: s0 - type: spc_t - capabilities: - add: - - SYS_ADMIN - - SYS_CHROOT - - SYS_PTRACE - drop: - - ALL - - name: apply-sysctl-overwrites - image: "quay.io/cilium/cilium:v1.19.5@sha256:20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732" - imagePullPolicy: IfNotPresent - env: - - name: BIN_PATH - value: /opt/cni/bin - command: - - bash - - -ec - # The statically linked Go program binary is invoked to avoid any - # dependency on utilities like sh that can be missing on certain - # distros installed on the underlying host. Copy the binary to the - # same directory where we install cilium cni plugin so that exec permissions - # are available. - - | - cp /usr/bin/cilium-sysctlfix /hostbin/cilium-sysctlfix; - nsenter --mount=/hostproc/1/ns/mnt "${BIN_PATH}/cilium-sysctlfix"; - rm /hostbin/cilium-sysctlfix - volumeMounts: - - name: hostproc - mountPath: /hostproc - - name: cni-path - mountPath: /hostbin - terminationMessagePolicy: FallbackToLogsOnError - securityContext: - seLinuxOptions: - level: s0 - type: spc_t - capabilities: - add: - - SYS_ADMIN - - SYS_CHROOT - - SYS_PTRACE - drop: - - ALL - # Mount the bpf fs if it is not mounted. We will perform this task - # from a privileged container because the mount propagation bidirectional - # only works from privileged containers. - - name: mount-bpf-fs - image: "quay.io/cilium/cilium:v1.19.5@sha256:20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732" - imagePullPolicy: IfNotPresent - args: - - 'mount | grep "/sys/fs/bpf type bpf" || mount -t bpf bpf /sys/fs/bpf' - command: - - /bin/bash - - -c - - -- - terminationMessagePolicy: FallbackToLogsOnError - securityContext: - privileged: true - volumeMounts: - - name: bpf-maps - mountPath: /sys/fs/bpf - mountPropagation: Bidirectional - - name: clean-cilium-state - image: "quay.io/cilium/cilium:v1.19.5@sha256:20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732" - imagePullPolicy: IfNotPresent - command: - - /init-container.sh - env: - - name: CILIUM_ALL_STATE - valueFrom: - configMapKeyRef: - name: cilium-config - key: clean-cilium-state - optional: true - - name: CILIUM_BPF_STATE - valueFrom: - configMapKeyRef: - name: cilium-config - key: clean-cilium-bpf-state - optional: true - - name: WRITE_CNI_CONF_WHEN_READY - valueFrom: - configMapKeyRef: - name: cilium-config - key: write-cni-conf-when-ready - optional: true - terminationMessagePolicy: FallbackToLogsOnError - securityContext: - seLinuxOptions: - level: s0 - type: spc_t - capabilities: - add: - - NET_ADMIN - - SYS_MODULE - - SYS_ADMIN - - SYS_RESOURCE - drop: - - ALL - volumeMounts: - - name: bpf-maps - mountPath: /sys/fs/bpf - # Required to mount cgroup filesystem from the host to cilium agent pod - - name: cilium-cgroup - mountPath: /run/cilium/cgroupv2 - mountPropagation: HostToContainer - - name: cilium-run - mountPath: /var/run/cilium # wait-for-kube-proxy - # Install the CNI binaries in an InitContainer so we don't have a writable host mount in the agent - - name: install-cni-binaries - image: "quay.io/cilium/cilium:v1.19.5@sha256:20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732" - imagePullPolicy: IfNotPresent - command: - - "/install-plugin.sh" - resources: - limits: - cpu: 1 - memory: 1Gi - requests: - cpu: 100m - memory: 10Mi - securityContext: - seLinuxOptions: - level: s0 - type: spc_t - capabilities: - drop: - - ALL - terminationMessagePolicy: FallbackToLogsOnError - volumeMounts: - - name: cni-path - mountPath: /host/opt/cni/bin # .Values.cni.install - restartPolicy: Always - priorityClassName: system-node-critical - serviceAccountName: "cilium" - automountServiceAccountToken: true - terminationGracePeriodSeconds: 1 - hostNetwork: true - - affinity: - podAntiAffinity: - requiredDuringSchedulingIgnoredDuringExecution: - - labelSelector: - matchLabels: - k8s-app: cilium - topologyKey: kubernetes.io/hostname - nodeSelector: - kubernetes.io/os: linux - tolerations: - - operator: Exists - volumes: - # For sharing configuration between the "config" initContainer and the agent - - name: tmp - emptyDir: {} - # To keep state between restarts / upgrades - - name: cilium-run - hostPath: - path: /var/run/cilium - type: DirectoryOrCreate - # To exec into pod network namespaces - - name: cilium-netns - hostPath: - path: /var/run/netns - type: DirectoryOrCreate - # To keep state between restarts / upgrades for bpf maps - - name: bpf-maps - hostPath: - path: /sys/fs/bpf - type: DirectoryOrCreate - # To mount cgroup2 filesystem on the host or apply sysctlfix - - name: hostproc - hostPath: - path: /proc - type: Directory - # To keep state between restarts / upgrades for cgroup2 filesystem - - name: cilium-cgroup - hostPath: - path: /run/cilium/cgroupv2 - type: DirectoryOrCreate - # To install cilium cni plugin in the host - - name: cni-path - hostPath: - path: /opt/cni/bin - type: DirectoryOrCreate - # To install cilium cni configuration in the host - - name: etc-cni-netd - hostPath: - path: /etc/cni/net.d - type: DirectoryOrCreate - # To be able to load kernel modules - - name: lib-modules - hostPath: - path: /lib/modules - # To access iptables concurrently with other processes (e.g. kube-proxy) - - name: xtables-lock - hostPath: - path: /run/xtables.lock - type: FileOrCreate - # Sharing socket with Cilium Envoy on the same node by using a host path - - name: envoy-sockets - hostPath: - path: "/var/run/cilium/envoy/sockets" - type: DirectoryOrCreate - # To read the clustermesh configuration - - name: clustermesh-secrets - projected: - # note: the leading zero means this number is in octal representation: do not remove it - defaultMode: 0400 - sources: - - secret: - name: cilium-clustermesh - optional: true - # note: items are not explicitly listed here, since the entries of this secret - # depend on the peers configured, and that would cause a restart of all agents - # at every addition/removal. Leaving the field empty makes each secret entry - # to be automatically projected into the volume as a file whose name is the key. - - secret: - name: clustermesh-apiserver-remote-cert - optional: true - items: - - key: tls.key - path: common-etcd-client.key - - key: tls.crt - path: common-etcd-client.crt - - key: ca.crt - path: common-etcd-client-ca.crt - # note: we configure the volume for the kvstoremesh-specific certificate - # regardless of whether KVStoreMesh is enabled or not, so that it can be - # automatically mounted in case KVStoreMesh gets subsequently enabled, - # without requiring an agent restart. - - secret: - name: clustermesh-apiserver-local-cert - optional: true - items: - - key: tls.key - path: local-etcd-client.key - - key: tls.crt - path: local-etcd-client.crt - - key: ca.crt - path: local-etcd-client-ca.crt - - name: host-proc-sys-net - hostPath: - path: /proc/sys/net - type: Directory - - name: host-proc-sys-kernel - hostPath: - path: /proc/sys/kernel - type: Directory - - name: hubble-tls - projected: - # note: the leading zero means this number is in octal representation: do not remove it - defaultMode: 0400 - sources: - - secret: - name: hubble-server-certs - optional: true - items: - - key: tls.crt - path: server.crt - - key: tls.key - path: server.key - - key: ca.crt - path: client-ca.crt - - ---- -# Source: cilium/templates/cilium-envoy/daemonset.yaml -apiVersion: apps/v1 -kind: DaemonSet -metadata: - name: cilium-envoy - namespace: kube-system - labels: - k8s-app: cilium-envoy - app.kubernetes.io/part-of: cilium - app.kubernetes.io/name: cilium-envoy - name: cilium-envoy -spec: - selector: - matchLabels: - k8s-app: cilium-envoy - - updateStrategy: - rollingUpdate: - maxUnavailable: 2 - type: RollingUpdate - template: - metadata: - annotations: - labels: - k8s-app: cilium-envoy - name: cilium-envoy - app.kubernetes.io/name: cilium-envoy - app.kubernetes.io/part-of: cilium - spec: - securityContext: - appArmorProfile: - type: Unconfined - - containers: - - name: cilium-envoy - image: "quay.io/cilium/cilium-envoy:v1.36.8-1781157951-a7f42a3390781539911b5b9107881b35ecc4e752@sha256:326f872e19ce8aa45170efbf583b3f301586ba3feead14b864676d4baf3b45ed" - imagePullPolicy: IfNotPresent - command: - - /usr/bin/cilium-envoy-starter - args: - - '--' - - '-c /var/run/cilium/envoy/bootstrap-config.json' - - '--base-id 0' - - '--log-level info' - - startupProbe: - httpGet: - host: "127.0.0.1" - path: /healthz - port: 9878 - scheme: HTTP - failureThreshold: 105 - periodSeconds: 2 - successThreshold: 1 - initialDelaySeconds: 5 - livenessProbe: - httpGet: - host: "127.0.0.1" - path: /healthz - port: 9878 - scheme: HTTP - periodSeconds: 30 - successThreshold: 1 - failureThreshold: 10 - timeoutSeconds: 5 - readinessProbe: - httpGet: - host: "127.0.0.1" - path: /healthz - port: 9878 - scheme: HTTP - periodSeconds: 30 - successThreshold: 1 - failureThreshold: 3 - timeoutSeconds: 5 - env: - - name: K8S_NODE_NAME - valueFrom: - fieldRef: - apiVersion: v1 - fieldPath: spec.nodeName - - name: CILIUM_K8S_NAMESPACE - valueFrom: - fieldRef: - apiVersion: v1 - fieldPath: metadata.namespace - - ports: - - name: envoy-metrics - containerPort: 9964 - hostPort: 9964 - protocol: TCP - securityContext: - seLinuxOptions: - level: s0 - type: spc_t - capabilities: - add: - - NET_ADMIN - - SYS_ADMIN - drop: - - ALL - terminationMessagePolicy: FallbackToLogsOnError - volumeMounts: - - name: envoy-sockets - mountPath: /var/run/cilium/envoy/sockets - readOnly: false - - name: envoy-artifacts - mountPath: /var/run/cilium/envoy/artifacts - readOnly: true - - name: envoy-config - mountPath: /var/run/cilium/envoy/ - readOnly: true - - name: bpf-maps - mountPath: /sys/fs/bpf - mountPropagation: HostToContainer - - restartPolicy: Always - priorityClassName: system-node-critical - serviceAccountName: "cilium-envoy" - automountServiceAccountToken: true - terminationGracePeriodSeconds: 1 - hostNetwork: true - - affinity: - nodeAffinity: - requiredDuringSchedulingIgnoredDuringExecution: - nodeSelectorTerms: - - matchExpressions: - - key: cilium.io/no-schedule - operator: NotIn - values: - - "true" - podAffinity: - requiredDuringSchedulingIgnoredDuringExecution: - - labelSelector: - matchLabels: - k8s-app: cilium - topologyKey: kubernetes.io/hostname - podAntiAffinity: - requiredDuringSchedulingIgnoredDuringExecution: - - labelSelector: - matchLabels: - k8s-app: cilium-envoy - topologyKey: kubernetes.io/hostname - nodeSelector: - kubernetes.io/os: linux - tolerations: - - operator: Exists - volumes: - - name: envoy-sockets - hostPath: - path: "/var/run/cilium/envoy/sockets" - type: DirectoryOrCreate - - name: envoy-artifacts - hostPath: - path: "/var/run/cilium/envoy/artifacts" - type: DirectoryOrCreate - - name: envoy-config - configMap: - name: "cilium-envoy-config" - # note: the leading zero means this number is in octal representation: do not remove it - defaultMode: 0400 - items: - - key: bootstrap-config.json - path: bootstrap-config.json - # To keep state between restarts / upgrades - # To keep state between restarts / upgrades for bpf maps - - name: bpf-maps - hostPath: - path: /sys/fs/bpf - type: DirectoryOrCreate - - ---- -# Source: cilium/templates/cilium-operator/deployment.yaml -apiVersion: apps/v1 -kind: Deployment -metadata: - name: cilium-operator - namespace: kube-system - labels: - io.cilium/app: operator - name: cilium-operator - app.kubernetes.io/part-of: cilium - app.kubernetes.io/name: cilium-operator -spec: - # See docs on ServerCapabilities.LeasesResourceLock in file pkg/k8s/version/version.go - # for more details. - replicas: 2 - selector: - matchLabels: - io.cilium/app: operator - name: cilium-operator - # ensure operator update on single node k8s clusters, by using rolling update with maxUnavailable=100% in case - # of one replica and no user configured Recreate strategy. - # otherwise an update might get stuck due to the default maxUnavailable=50% in combination with the - # podAntiAffinity which prevents deployments of multiple operator replicas on the same node. - strategy: - rollingUpdate: - maxSurge: 25% - maxUnavailable: 50% - type: RollingUpdate - template: - metadata: - annotations: - prometheus.io/port: "9963" - prometheus.io/scrape: "true" - labels: - io.cilium/app: operator - name: cilium-operator - app.kubernetes.io/part-of: cilium - app.kubernetes.io/name: cilium-operator - spec: - securityContext: - seccompProfile: - type: RuntimeDefault - containers: - - name: cilium-operator - image: "quay.io/cilium/operator-generic:v1.19.5@sha256:be848a365776e07d0c5a895eda7aec928ddc52a5a1fa2f432fd7a286609e1db4" - imagePullPolicy: IfNotPresent - command: - - cilium-operator-generic - args: - - --config-dir=/tmp/cilium/config-map - - --debug=$(CILIUM_DEBUG) - env: - - name: K8S_NODE_NAME - valueFrom: - fieldRef: - apiVersion: v1 - fieldPath: spec.nodeName - - name: CILIUM_K8S_NAMESPACE - valueFrom: - fieldRef: - apiVersion: v1 - fieldPath: metadata.namespace - - name: CILIUM_DEBUG - valueFrom: - configMapKeyRef: - key: debug - name: cilium-config - optional: true - ports: - - name: health - containerPort: 9234 - hostPort: 9234 - - name: prometheus - containerPort: 9963 - hostPort: 9963 - protocol: TCP - livenessProbe: - httpGet: - host: "127.0.0.1" - path: /healthz - port: health - scheme: HTTP - initialDelaySeconds: 60 - periodSeconds: 10 - timeoutSeconds: 3 - readinessProbe: - httpGet: - host: "127.0.0.1" - path: /healthz - port: health - scheme: HTTP - initialDelaySeconds: 0 - periodSeconds: 5 - timeoutSeconds: 3 - failureThreshold: 5 - volumeMounts: - - name: cilium-config-path - mountPath: /tmp/cilium/config-map - readOnly: true - - securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL - terminationMessagePolicy: FallbackToLogsOnError - hostNetwork: true - restartPolicy: Always - priorityClassName: system-cluster-critical - serviceAccountName: "cilium-operator" - automountServiceAccountToken: true - # In HA mode, cilium-operator pods must not be scheduled on the same - # node as they will clash with each other. - affinity: - podAntiAffinity: - requiredDuringSchedulingIgnoredDuringExecution: - - labelSelector: - matchLabels: - io.cilium/app: operator - topologyKey: kubernetes.io/hostname - nodeSelector: - kubernetes.io/os: linux - tolerations: - - key: node-role.kubernetes.io/control-plane - operator: Exists - - key: node-role.kubernetes.io/master - operator: Exists - - key: node.kubernetes.io/not-ready - operator: Exists - - key: node.cloudprovider.kubernetes.io/uninitialized - operator: Exists - - key: node.cilium.io/agent-not-ready - operator: Exists - - volumes: - # To read the configuration from the config map - - name: cilium-config-path - configMap: - name: cilium-config - diff --git a/packages/manifests/operators/cilium/1.19.5.yaml b/packages/manifests/operators/cilium/1.19.5.yaml deleted file mode 100644 index 0043b7e..0000000 --- a/packages/manifests/operators/cilium/1.19.5.yaml +++ /dev/null @@ -1,1789 +0,0 @@ -# Source: cilium/cilium@1.19.5 ---- -# Added by pull-manifests.ts to ensure namespace exists -apiVersion: v1 -kind: Namespace -metadata: - name: kube-system - labels: - app.kubernetes.io/name: kube-system - ---- ---- -# Source: cilium/templates/cilium-secrets-namespace.yaml -apiVersion: v1 -kind: Namespace -metadata: - name: "cilium-secrets" - labels: - app.kubernetes.io/part-of: cilium - annotations: - ---- -# Source: cilium/templates/cilium-agent/serviceaccount.yaml -apiVersion: v1 -kind: ServiceAccount -metadata: - name: "cilium" - namespace: kube-system - ---- -# Source: cilium/templates/cilium-envoy/serviceaccount.yaml -apiVersion: v1 -kind: ServiceAccount -metadata: - name: "cilium-envoy" - namespace: kube-system - ---- -# Source: cilium/templates/cilium-operator/serviceaccount.yaml -apiVersion: v1 -kind: ServiceAccount -metadata: - name: "cilium-operator" - namespace: kube-system - ---- -# Source: cilium/templates/cilium-ca-secret.yaml -apiVersion: v1 -kind: Secret -metadata: - name: cilium-ca - namespace: kube-system - labels: - cilium.io/helm-template-non-idempotent: "true" -data: - ca.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURFekNDQWZ1Z0F3SUJBZ0lRZWo4K0VORUJMdTBHZzZna1B1eFl5VEFOQmdrcWhraUc5dzBCQVFzRkFEQVUKTVJJd0VBWURWUVFERXdsRGFXeHBkVzBnUTBFd0hoY05Nall3T0RFeU1qSXpNREF5V2hjTk1qa3dPREV4TWpJegpNREF5V2pBVU1SSXdFQVlEVlFRREV3bERhV3hwZFcwZ1EwRXdnZ0VpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElCCkR3QXdnZ0VLQW9JQkFRRFRwSE9jNjJxM29VZ1ByRjNSRFhKY3c0WmxnRE5la1ZHc1c5TVRMdFdXS245d0tMbmUKQzZrbGxNVk5ydnVyVGptMDU3aGpDbkVkcndkOVd6YlJWNHczVXJYeWZOK0ptck04WWJyODFPMFFWcGdLQTJiTQpUQmM0OVhjcHkyUWwzSWYwaXdxMkdTek1qMjFyekZheVM2Q1Zwb1dOTVdqOWxzOFFjOFJ0eElLOG5zZ2t6cDRvCis0TmE5TkRrSldsM1NWK2NJbXJlSnVveWpSZWFlTzhNZ2J0R05NdFAwWGhweUp3ZTNSRnJWck5qV3JxcjFyMVIKLzZ6cjhrN3B1b0FyMmNaN1dkOVVuRUZqaVBNbFJZOENpdUtXTkJlYWdXV3BPaU00NTUzcFJUdmdPQmRLU3BGOQpPVE1CNXhSdldTQlNMdFVkWVVHR2ppM3pLQkJTMjBtZENrb1RBZ01CQUFHallUQmZNQTRHQTFVZER3RUIvd1FFCkF3SUNwREFkQmdOVkhTVUVGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXcKQXdFQi96QWRCZ05WSFE0RUZnUVUrMnFyZXdBejRXREptZnNBVW9MVm9wQzBXR2d3RFFZSktvWklodmNOQVFFTApCUUFEZ2dFQkFHb2xLZFljNGJ2VjR2b1RyRnNvMHF3YklBQlREc09xdU9mVURqM3NWb0VCS2hXUHQ5TUI3WVBNCnJBL2NGZTA0bTR1Zk1sT29RdDdlOWtmbVJjK2Z2VUpucFZ6aXFHQWhnZFBTVWt0eGdQOHl5Q3hLVVJVeGdPT3MKNUFoM3dWazBDdDFOY24xYVpXU3R1NDQ0SEppbko0QllESkNpQ1ZESTJaRjlQaWo5WFZlSnp5TUlUSHptSEpaSgp6MU9xV2s3aXhYZnJUYnRwTkxWekY0Z21TV1Y5cXYwNklvczVrRFVXVFZ3bUtMKzNZZ3U4elR3dk10MFl1ak5UCjROeWRaTzNVditYUnBLaTgwVE02dzlXVUIyZUtQRSs4NDVhcC8rUWZ1ZThrMzVFaVZ4NTlWWGJ0SFJuWHRBLzEKYURhLzROcmlTNVZGZjNxU0hBd2RienRta3YramtMdz0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo= - ca.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb2dJQkFBS0NBUUVBMDZSem5PdHF0NkZJRDZ4ZDBRMXlYTU9HWllBelhwRlJyRnZURXk3VmxpcC9jQ2k1CjNndXBKWlRGVGE3N3EwNDV0T2U0WXdweEhhOEhmVnMyMFZlTU4xSzE4bnpmaVpxelBHRzYvTlR0RUZhWUNnTm0KekV3WE9QVjNLY3RrSmR5SDlJc0t0aGtzekk5dGE4eFdza3VnbGFhRmpURm8vWmJQRUhQRWJjU0N2SjdJSk02ZQpLUHVEV3ZUUTVDVnBkMGxmbkNKcTNpYnFNbzBYbW5qdkRJRzdSalRMVDlGNGFjaWNIdDBSYTFhelkxcTZxOWE5ClVmK3M2L0pPNmJxQUs5bkdlMW5mVkp4Qlk0anpKVVdQQW9yaWxqUVhtb0ZscVRvak9PZWQ2VVU3NERnWFNrcVIKZlRrekFlY1ViMWtnVWk3VkhXRkJobzR0OHlnUVV0dEpuUXBLRXdJREFRQUJBb0lCQURVTzcyVVJwK2x0WjVGMgpWdmJIOWpuSFV2UXpWYTJKcFA0ZTd5WEtBZ1hwbFpWYXdHNG9ZamxudUtjbkRUVC9JWHgyODBUeEl6YWI0TGJPCm5VbVNOemJQWjRucFFHbFEvVXBQL2Y3UXFyWUQzNDN6R0Z4elh3Y0trdHRKZ0V2MW82ZnRDN3huUjFIcFN6ZFIKUFJMcDN0SmxzdW1ZejRkenZXbVVmRlJBaGI0Zlk3dmdmM0hCK2VEc21oQjF0eUE4UmFwT1RjR2FTckkxK0J1NgpyMVVqYTVpM24vMlhNRUw4OCtrNDRBOUE0elBINUVxUEFtNFdhS1ViWEtSTGYrWTUwZ29jV04rMFRpTFV2eFhBCjlFcE1WR1VGNHo2Q25SUEV2NmJGSmVZcGlaQUdBNXlYY0Fqa0lzU3VQQ1ZOS1RLLzROWEN0aVNlczJNSndjZFEKays4MHp6RUNnWUVBNlUxTmR2UkU3dExqRncvTDAvcnBmNDI1ZnNWWm4xRC85d050UEhqVGtvSmFmdXVjNjZiMwo1R1hjR1VUcEhEeXgwMDdWZ3FuaTJva3NObzhWWTdZQzUrWDlWd1RRclZhdmpCREYwa3BhblZNVndhWlpxT3I2ClFOeXdnd2lSMURWQXlJZVNncW94ckFnbS9iTkpPaWpGdjd4aEdBbm9VNnlXQTltT2I2YU9tZTBDZ1lFQTZEdXcKT0JlTjIwR2liZDZ6QnRzV05XYkJqQ1lqZzdheFJWWFhZK3pyQWhjWmxCUFJuSGJTZXR3TW9xTmYveGxHSmc0awp0VE9sTFhOQ09DVXErM2FuWjZNaEZ4ajJSZ0JtMGNYUUlzSFcyc0pCMDJCcWZtbUZlcWlzODMvRFZWSHBBbjhjCmRDamhJKzJzd1ZOTjk0MUZBUGtjcFdaQ2tadllMc3hYdlNRUDgvOENnWUJXTWRZOTdhK09JT0gvd2psSFB6dUgKZ2NBWHd5Z0NnWFdnT0diaVlhMmhRb0hXeEl2OFVIcmpxbkp2NzVMRWVQUW1Jc2tsZGtpMi90a1Q2emMyMktjbwpNRU95STdoSlltNkhMQ2M2TTNoWkNicFBDbnV6dWVUdGs5dXUvYnFMRVlXMjBNZmplS2ZUYkV1ampkcXZIeU00ClhJdnV5ckpJUDhwSTc5YjlEeWMrWFFLQmdGTXAxTkF4ZHlaV1djRjRwNm5EMlM4a2Joa3ZLemFtdk5LMGk5NkgKNEJ5dWd3VnBGMzR0ZXZCdVRzUUxOM3hWNDY0TEVKQW5QM2FJT09WOFFla3RNNFBFZ2p3UVAxa1FHY0h6VWJhdwpyYTFITldWcHVKa3VWcE4zUmdBbzk1MWRLTkV4RGRKM05UQzFrMURqOFI2K1kwQ1c5UEF5TDVLUE9acUFxTWJkCjNDeW5Bb0dBWDJiV3VoaURKTExmZVFGU3MxaVMxeEdXSDFabXVlYUZETXVqWHVHQ3d3RktwNkVtYnB4V282bHAKZi9EVHpjeEc2Nm4zWHl0d3JWVTF3WlUyR2tiN1JzaVF5amQvb0xQOHZZMEx4UkRQMTNjZWxhNHBwa3o5cXQ1Uwpndy9DaW5MZ1Erd0VVSHZYL2tCT0IwNkdTYWY2bzNUMDB0L2twcG5vV2s0cGRvMmNFVjQ9Ci0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg== - ---- -# Source: cilium/templates/hubble/tls-helm/server-secret.yaml -apiVersion: v1 -kind: Secret -metadata: - name: hubble-server-certs - namespace: kube-system - labels: - cilium.io/helm-template-non-idempotent: "true" - - annotations: -type: kubernetes.io/tls -data: - ca.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURFekNDQWZ1Z0F3SUJBZ0lRZWo4K0VORUJMdTBHZzZna1B1eFl5VEFOQmdrcWhraUc5dzBCQVFzRkFEQVUKTVJJd0VBWURWUVFERXdsRGFXeHBkVzBnUTBFd0hoY05Nall3T0RFeU1qSXpNREF5V2hjTk1qa3dPREV4TWpJegpNREF5V2pBVU1SSXdFQVlEVlFRREV3bERhV3hwZFcwZ1EwRXdnZ0VpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElCCkR3QXdnZ0VLQW9JQkFRRFRwSE9jNjJxM29VZ1ByRjNSRFhKY3c0WmxnRE5la1ZHc1c5TVRMdFdXS245d0tMbmUKQzZrbGxNVk5ydnVyVGptMDU3aGpDbkVkcndkOVd6YlJWNHczVXJYeWZOK0ptck04WWJyODFPMFFWcGdLQTJiTQpUQmM0OVhjcHkyUWwzSWYwaXdxMkdTek1qMjFyekZheVM2Q1Zwb1dOTVdqOWxzOFFjOFJ0eElLOG5zZ2t6cDRvCis0TmE5TkRrSldsM1NWK2NJbXJlSnVveWpSZWFlTzhNZ2J0R05NdFAwWGhweUp3ZTNSRnJWck5qV3JxcjFyMVIKLzZ6cjhrN3B1b0FyMmNaN1dkOVVuRUZqaVBNbFJZOENpdUtXTkJlYWdXV3BPaU00NTUzcFJUdmdPQmRLU3BGOQpPVE1CNXhSdldTQlNMdFVkWVVHR2ppM3pLQkJTMjBtZENrb1RBZ01CQUFHallUQmZNQTRHQTFVZER3RUIvd1FFCkF3SUNwREFkQmdOVkhTVUVGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXcKQXdFQi96QWRCZ05WSFE0RUZnUVUrMnFyZXdBejRXREptZnNBVW9MVm9wQzBXR2d3RFFZSktvWklodmNOQVFFTApCUUFEZ2dFQkFHb2xLZFljNGJ2VjR2b1RyRnNvMHF3YklBQlREc09xdU9mVURqM3NWb0VCS2hXUHQ5TUI3WVBNCnJBL2NGZTA0bTR1Zk1sT29RdDdlOWtmbVJjK2Z2VUpucFZ6aXFHQWhnZFBTVWt0eGdQOHl5Q3hLVVJVeGdPT3MKNUFoM3dWazBDdDFOY24xYVpXU3R1NDQ0SEppbko0QllESkNpQ1ZESTJaRjlQaWo5WFZlSnp5TUlUSHptSEpaSgp6MU9xV2s3aXhYZnJUYnRwTkxWekY0Z21TV1Y5cXYwNklvczVrRFVXVFZ3bUtMKzNZZ3U4elR3dk10MFl1ak5UCjROeWRaTzNVditYUnBLaTgwVE02dzlXVUIyZUtQRSs4NDVhcC8rUWZ1ZThrMzVFaVZ4NTlWWGJ0SFJuWHRBLzEKYURhLzROcmlTNVZGZjNxU0hBd2RienRta3YramtMdz0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo= - tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURWekNDQWorZ0F3SUJBZ0lSQUs1ekJsSktTQzNUcGlGRmcyNnBZbWN3RFFZSktvWklodmNOQVFFTEJRQXcKRkRFU01CQUdBMVVFQXhNSlEybHNhWFZ0SUVOQk1CNFhEVEkyTURneE1qSXlNekF3TWxvWERUSTNNRGd4TWpJeQpNekF3TWxvd0tqRW9NQ1lHQTFVRUF3d2ZLaTVrWldaaGRXeDBMbWgxWW1Kc1pTMW5jbkJqTG1OcGJHbDFiUzVwCmJ6Q0NBU0l3RFFZSktvWklodmNOQVFFQkJRQURnZ0VQQURDQ0FRb0NnZ0VCQU5NUEdPckUzR01aOGNXbUxXcGkKSVhjbkhQNnJEWTI1NFl2NW9WM3pQVU5QdzBNcFE1ZzJlK0dlL1dzdGw2T2ZoTWdlYVFaMjVaZTZLU3k1dkpvQwpqTEo3eDZaL3AxMFA2SzVWK3pBRnRTVkd2T096d29SNnQ2emtaWkpnK1dxZVZJc3REdGZXL2I3MXZpbURJTUkxCmc4dHRITTV1U1UrWEFVZlBnSngwVFJMMTQ2ZlRpU0xFN0R4emVkTWs1dHovTDZPaUlPRXN0bklyWUgyNkhNdmEKYWxzbTNMQktnK09KL001U0xDR2tVWk5TT2ROYmZuT1gvQ05uNElER2pjQnRCRG5sclpqVHVpSDhUdTdtYXpnMAp2WVJQbVRjZXdRVzJBMWlHUkhScFM5a083WkJ3RHFwTzUxSzd1VUR4QUVuajFNWnQ3ajZIblB5VVBTMFZXaUlECm4zMENBd0VBQWFPQmpUQ0JpakFPQmdOVkhROEJBZjhFQkFNQ0JhQXdIUVlEVlIwbEJCWXdGQVlJS3dZQkJRVUgKQXdFR0NDc0dBUVVGQndNQ01Bd0dBMVVkRXdFQi93UUNNQUF3SHdZRFZSMGpCQmd3Rm9BVSsycXJld0F6NFdESgptZnNBVW9MVm9wQzBXR2d3S2dZRFZSMFJCQ013SVlJZktpNWtaV1poZFd4MExtaDFZbUpzWlMxbmNuQmpMbU5wCmJHbDFiUzVwYnpBTkJna3Foa2lHOXcwQkFRc0ZBQU9DQVFFQXFsWWNNNFFtYzBsckpBb2xCbHpReisvNFJMa08KV2ZoTVR2bGFyQ0NtMUlnY3pmR1VxVG9NODU4V3MzcDgxZmZUcjlldHFIZzNEZzRWTUcrTFUxWk80d0pvYTBscApjV2Nhb1ZiSVFTSDJ3dmFJTGhqakd3aTlpR3FKYnIyUjJWdUxQMUZ2aEhyejNvR2hxMkVBV2hlOVlXZGlBM3RVCmlUTmRaWVhOdXUxZExTaWw2aEsxSkljS0lJVURhMllxUFFCNjcvRHFyN294Ri9peTF5VEpzaTV2ckdRdnlzbXAKQkg2cXptODh4bk1HTXF4OXBEUmpqN01jK2RLLzliaHplOVdUT2VxTlUzQlJNM3dIRHlDd1IxN3pXNFNQUFBDRwpVR2VEVUVXRVVVV2FUYUFnL0MrOHhhOEUvSFhZeHNVQndXQVBGM1h6QVFVY3JXYkpaN1JFNmJLRTdBPT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo= - tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb3dJQkFBS0NBUUVBMHc4WTZzVGNZeG54eGFZdGFtSWhkeWNjL3FzTmpibmhpL21oWGZNOVEwL0RReWxECm1EWjc0Wjc5YXkyWG81K0V5QjVwQm5ibGw3b3BMTG04bWdLTXNudkhwbituWFEvb3JsWDdNQVcxSlVhODQ3UEMKaEhxM3JPUmxrbUQ1YXA1VWl5ME8xOWI5dnZXK0tZTWd3aldEeTIwY3ptNUpUNWNCUjgrQW5IUk5FdlhqcDlPSgpJc1RzUEhONTB5VG0zUDh2bzZJZzRTeTJjaXRnZmJvY3k5cHFXeWJjc0VxRDQ0bjh6bElzSWFSUmsxSTUwMXQrCmM1ZjhJMmZnZ01hTndHMEVPZVd0bU5PNklmeE83dVpyT0RTOWhFK1pOeDdCQmJZRFdJWkVkR2xMMlE3dGtIQU8KcWs3blVydTVRUEVBU2VQVXhtM3VQb2VjL0pROUxSVmFJZ09mZlFJREFRQUJBb0lCQUVmSmc4MGVobU9DeUpSVQprRy8xenJJcmNKWkNjZ3E1cGJpcGdMUm03bmg5b2Ntdk9GbUdkcDVvS0lRUzd0ZnRnd2xhSnBqWFNnSlFoSDY4CjhpUmtKNXp4c3hlenBhWm1xZHJhVGVTb25GT0FldkRzRElacEF4NWdWUmZ6dWdJRXRuYmNMWWRHamVvc3hiQnkKOUdwNkwwaTY1U2hscExQWWhjdjZEU0dxQVNrb01TR29CY2VMaSt4Nno0NWEzL1dSZ1F1R0JLU09iL0VPUU1vWQpBdm80NVJVSTNvMnpUTnBsTVBBd0lvMkV5OExRaFQxNHdKeitjdEcwZldtRlpCeS9kd01nRGdJc0xUd1JxbWdqCmJvam5DSWxlcDdqOVpRTmFRVTg2R3ZLMytEZWpYZUxyc2lKRFg2SEVVZksyaVMrQnVjZWMvdzNPMmphdlBxU0EKOVBEUVVsVUNnWUVBOUllQkVmL3pPUkxoRk1QZWVJaEVuN3AycFB1Q1ZpT0IrSjZzb1JKdmhGVmU5SUs3VTJLcwpNaGJONmJJK09iUGFOTHdFQ05IVUlGbThsN0JrbURGVUxkaFBtbGFGeDhRSUI3NFhoRnhCZkUySGpESjMyaFZpClNnZCtQaGpJUStsM3RyK3VlTitGNFFmMXZWUUhSVGljajJsbHZacGUxb3dZR2trZmRUUS9ROHNDZ1lFQTNQV24KMWZmWEx4MGpJZ2pUMEFCTkc3WDF2dzAza21XVkhVOXJPdWRBNVhqZC93eG54NnBRTWpqT3krNVlEbGhsbkJQUQo1U2tOSHJxWkVaaTdNcGpsNndqeXpKZXdkS3EwdXFoYURSd3RIcS9rOGRhcXR3UmRSWGVnTnY4aVdNR3JTMTZNClR1QkhRRjRMZXRRTEtjUURFcTI1YnZWSld6YmZwVFVkUWdOUEVOY0NnWUVBd2puTExGZm5nZ0xiNHhsODRMSWsKQjljY25Bamx5ck9qYmEzaklvRTVNSng2c3E0UVNyaEtXL0svRll1dFh6bmE3UjRWK2tkb1BWWHB0WGEzUUNlVwpYRisvUXJETXpCS0o2bFJ6NjM4M3lKcndPa3h2NURvdCt1MGV1Z1lITStJQ1k1YTI1MjFyc29VWERJM3N4RytsCjgwZGRONCtoR3JybC9pTHNxTFNhTjZjQ2dZQlFFU1JVUUk3Vkg3WFBhMnQxZitaeEdDcUlwSDF5cXlTeGprbkkKK210bHU3cVY1U1RtRVMwbVJiZUo1a0E2VW9YZlhMN2hpMUtady93YmlFQ3RRUUp2ZkxxZXNJamNmYzhucEVHZApab3hqQmxIcjRHSFVGOXpFZzJpbkJTU3BET1RKVnVWNDM0UnlLcUgyVEVnUFJsdm10TlR4QkNra3lHbWFML2orCkpyekwyUUtCZ0RheDBPL0ZKcHNjVDBoV2RjZ3pVVU1iMUo1UngrQlV2eXp0SVp2ckpmdEdmRnRnUXRhZXNLaFgKS0ZwTlNXMW1yci96TmVhKzVLWnZoYTV1MWtnbVZ5YWRrR3ZZVnpkeTBWajdycTM3TXo1M01qMTJQUTZlTnhzcwo1K0NZd012WVRWR0Z1eTl5b2tDTm0zOENSZTFqSEFjanE0dFN6d2dSd3ArU2h5UDJZSFJvCi0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg== - ---- -# Source: cilium/templates/cilium-configmap.yaml -apiVersion: v1 -kind: ConfigMap -metadata: - name: cilium-config - namespace: kube-system -data: - - # Identity allocation mode selects how identities are shared between cilium - # nodes by setting how they are stored. The options are "crd", "kvstore" or - # "doublewrite-readkvstore" / "doublewrite-readcrd". - # - "crd" stores identities in kubernetes as CRDs (custom resource definition). - # These can be queried with: - # kubectl get ciliumid - # - "kvstore" stores identities in an etcd kvstore, that is - # configured below. Cilium versions before 1.6 supported only the kvstore - # backend. Upgrades from these older cilium versions should continue using - # the kvstore by commenting out the identity-allocation-mode below, or - # setting it to "kvstore". - # - "doublewrite" modes store identities in both the kvstore and CRDs. This is useful - # for seamless migrations from the kvstore mode to the crd mode. Consult the - # documentation for more information on how to perform the migration. - identity-allocation-mode: crd - - identity-heartbeat-timeout: "30m0s" - identity-gc-interval: "15m0s" - cilium-endpoint-gc-interval: "5m0s" - nodes-gc-interval: "5m0s" - - # If you want to run cilium in debug mode change this value to true - debug: "false" - metrics-sampling-interval: "5m" - # The agent can be put into the following three policy enforcement modes - # default, always and never. - # https://docs.cilium.io/en/latest/security/policy/intro/#policy-enforcement-modes - enable-policy: "default" - # If you want metrics enabled in cilium-operator, set the port for - # which the Cilium Operator will have their metrics exposed. - # NOTE that this will open the port on the nodes where Cilium operator pod - # is scheduled. - operator-prometheus-serve-addr: ":9963" - enable-metrics: "true" - enable-policy-secrets-sync: "true" - policy-secrets-only-from-secrets-namespace: "true" - policy-secrets-namespace: "cilium-secrets" - - # Enable IPv4 addressing. If enabled, all endpoints are allocated an IPv4 - # address. - enable-ipv4: "true" - - # Enable IPv6 addressing. If enabled, all endpoints are allocated an IPv6 - # address. - enable-ipv6: "false" - # Users who wish to specify their own custom CNI configuration file must set - # custom-cni-conf to "true", otherwise Cilium may overwrite the configuration. - custom-cni-conf: "false" - enable-bpf-clock-probe: "false" - # If you want cilium monitor to aggregate tracing for packets, set this level - # to "low", "medium", or "maximum". The higher the level, the less packets - # that will be seen in monitor output. - monitor-aggregation: medium - - # The monitor aggregation interval governs the typical time between monitor - # notification events for each allowed connection. - # - # Only effective when monitor aggregation is set to "medium" or higher. - monitor-aggregation-interval: "5s" - - # The monitor aggregation flags determine which TCP flags which, upon the - # first observation, cause monitor notifications to be generated. - # - # Only effective when monitor aggregation is set to "medium" or higher. - monitor-aggregation-flags: all - # Specifies the ratio (0.0-1.0] of total system memory to use for dynamic - # sizing of the TCP CT, non-TCP CT, NAT and policy BPF maps. - bpf-map-dynamic-size-ratio: "0.0025" - # bpf-policy-map-max specifies the maximum number of entries in endpoint - # policy map (per endpoint) - bpf-policy-map-max: "16384" - # bpf-policy-stats-map-max specifies the maximum number of entries in global - # policy stats map - bpf-policy-stats-map-max: "65536" - # bpf-lb-map-max specifies the maximum number of entries in bpf lb service, - # backend and affinity maps. - bpf-lb-map-max: "65536" - bpf-lb-external-clusterip: "false" - bpf-lb-source-range-all-types: "false" - bpf-lb-algorithm-annotation: "false" - bpf-lb-mode-annotation: "false" - - bpf-distributed-lru: "false" - bpf-events-drop-enabled: "true" - bpf-events-policy-verdict-enabled: "true" - bpf-events-trace-enabled: "true" - - # Pre-allocation of map entries allows per-packet latency to be reduced, at - # the expense of up-front memory allocation for the entries in the maps. The - # default value below will minimize memory usage in the default installation; - # users who are sensitive to latency may consider setting this to "true". - # - # This option was introduced in Cilium 1.4. Cilium 1.3 and earlier ignore - # this option and behave as though it is set to "true". - # - # If this value is modified, then during the next Cilium startup the restore - # of existing endpoints and tracking of ongoing connections may be disrupted. - # As a result, reply packets may be dropped and the load-balancing decisions - # for established connections may change. - # - # If this option is set to "false" during an upgrade from 1.3 or earlier to - # 1.4 or later, then it may cause one-time disruptions during the upgrade. - preallocate-bpf-maps: "false" - - # Name of the cluster. Only relevant when building a mesh of clusters. - cluster-name: "default" - # Unique ID of the cluster. Must be unique across all connected clusters and - # in the range of 1 and 255. Only relevant when building a mesh of clusters. - cluster-id: "0" - - # Encapsulation mode for communication between nodes - # Possible values: - # - disabled - # - vxlan (default) - # - geneve - - routing-mode: "tunnel" - tunnel-protocol: "vxlan" - tunnel-source-port-range: "0-0" - service-no-backend-response: "reject" - policy-deny-response: "none" - - - # Enables L7 proxy for L7 policy enforcement and visibility - enable-l7-proxy: "true" - enable-ipv4-masquerade: "true" - enable-ipv4-big-tcp: "false" - enable-ipv6-big-tcp: "false" - enable-ipv6-masquerade: "true" - enable-tcx: "true" - datapath-mode: "veth" - enable-masquerade-to-route-source: "false" - - enable-xt-socket-fallback: "true" - install-no-conntrack-iptables-rules: "false" - iptables-random-fully: "false" - - auto-direct-node-routes: "false" - direct-routing-skip-unreachable: "false" - - - - kube-proxy-replacement: "false" - enable-no-service-endpoints-routable: "true" - bpf-lb-sock: "false" - enable-health-check-nodeport: "true" - enable-health-check-loadbalancer-ip: "false" - node-port-bind-protection: "true" - enable-auto-protect-node-port-range: "true" - bpf-lb-acceleration: "disabled" - enable-service-topology: "false" - enable-l2-neigh-discovery: "false" - k8s-require-ipv4-pod-cidr: "false" - k8s-require-ipv6-pod-cidr: "false" - enable-k8s-networkpolicy: "true" - enable-endpoint-lockdown-on-policy-overflow: "false" - # Tell the agent to generate and write a CNI configuration file - write-cni-conf-when-ready: /host/etc/cni/net.d/05-cilium.conflist - cni-exclusive: "true" - cni-log-file: "/var/run/cilium/cilium-cni.log" - enable-endpoint-health-checking: "true" - enable-health-checking: "true" - health-check-icmp-failure-threshold: "3" - enable-well-known-identities: "false" - enable-node-selector-labels: "false" - synchronize-k8s-nodes: "true" - operator-api-serve-addr: "127.0.0.1:9234" - - enable-hubble: "true" - # UNIX domain socket for Hubble server to listen to. - hubble-socket-path: "/var/run/cilium/hubble.sock" - hubble-network-policy-correlation-enabled: "true" - # An additional address for Hubble server to listen to (e.g. ":4244"). - hubble-listen-address: ":4244" - hubble-disable-tls: "false" - hubble-tls-cert-file: /var/lib/cilium/tls/hubble/server.crt - hubble-tls-key-file: /var/lib/cilium/tls/hubble/server.key - hubble-tls-client-ca-files: /var/lib/cilium/tls/hubble/client-ca.crt - ipam: "cluster-pool" - ipam-cilium-node-update-rate: "15s" - cluster-pool-ipv4-cidr: "10.0.0.0/8" - cluster-pool-ipv4-mask-size: "24" - - default-lb-service-ipam: "lbipam" - egress-gateway-reconciliation-trigger-interval: "1s" - enable-vtep: "false" - vtep-endpoint: "" - vtep-cidr: "" - vtep-mask: "" - vtep-mac: "" - - packetization-layer-pmtud-mode: "blackhole" - procfs: "/host/proc" - bpf-root: "/sys/fs/bpf" - cgroup-root: "/run/cilium/cgroupv2" - - identity-management-mode: "agent" - enable-sctp: "false" - remove-cilium-node-taints: "true" - set-cilium-node-taints: "true" - set-cilium-is-up-condition: "true" - unmanaged-pod-watcher-interval: "15s" - # default DNS proxy to transparent mode in non-chaining modes - dnsproxy-enable-transparent-mode: "true" - dnsproxy-socket-linger-timeout: "10" - tofqdns-dns-reject-response-code: "refused" - tofqdns-enable-dns-compression: "true" - tofqdns-endpoint-max-ip-per-hostname: "1000" - tofqdns-idle-connection-grace-period: "0s" - tofqdns-max-deferred-connection-deletes: "10000" - tofqdns-proxy-response-max-delay: "100ms" - tofqdns-preallocate-identities: "true" - agent-not-ready-taint-key: "node.cilium.io/agent-not-ready" - - mesh-auth-enabled: "false" - mesh-auth-queue-size: "1024" - mesh-auth-rotated-identities-queue-size: "1024" - mesh-auth-gc-interval: "5m0s" - - proxy-xff-num-trusted-hops-ingress: "0" - proxy-xff-num-trusted-hops-egress: "0" - proxy-connect-timeout: "2" - proxy-initial-fetch-timeout: "30" - proxy-max-active-downstream-connections: "50000" - proxy-max-requests-per-connection: "0" - proxy-max-connection-duration-seconds: "0" - proxy-idle-timeout-seconds: "60" - proxy-max-concurrent-retries: "128" - proxy-use-original-source-address: "true" - proxy-cluster-max-connections: "1024" - proxy-cluster-max-requests: "1024" - http-retry-count: "3" - http-stream-idle-timeout: "300" - - external-envoy-proxy: "true" - envoy-base-id: "0" - envoy-access-log-buffer-size: "4096" - envoy-keep-cap-netbindservice: "false" - max-connected-clusters: "255" - clustermesh-cache-ttl: "0s" - clustermesh-enable-endpoint-sync: "false" - clustermesh-enable-mcs-api: "false" - clustermesh-mcs-api-install-crds: "true" - policy-default-local-cluster: "true" - - nat-map-stats-entries: "32" - nat-map-stats-interval: "30s" - enable-lb-ipam: "true" - enable-non-default-deny-policies: "true" - enable-source-ip-verification: "true" - enable-dynamic-config: "true" - enable-drift-checker: "true" - -# Extra config allows adding arbitrary properties to the cilium config. -# By putting it at the end of the ConfigMap, it's also possible to override existing properties. ---- -# Source: cilium/templates/cilium-envoy/configmap.yaml -apiVersion: v1 -kind: ConfigMap -metadata: - name: cilium-envoy-config - namespace: kube-system -data: - # Keep the key name as bootstrap-config.json to avoid breaking changes - bootstrap-config.json: | - {"admin":{"address":{"pipe":{"mode":432,"path":"/var/run/cilium/envoy/sockets/admin.sock"}}},"applicationLogConfig":{"logFormat":{"textFormat":"[%Y-%m-%d %T.%e][%t][%l][%n] [%g:%#] %v"}},"bootstrapExtensions":[{"name":"envoy.bootstrap.internal_listener","typedConfig":{"@type":"type.googleapis.com/envoy.extensions.bootstrap.internal_listener.v3.InternalListener"}}],"dynamicResources":{"cdsConfig":{"apiConfigSource":{"apiType":"GRPC","grpcServices":[{"envoyGrpc":{"clusterName":"xds-grpc-cilium"}}],"setNodeOnFirstMessageOnly":true,"transportApiVersion":"V3"},"initialFetchTimeout":"30s","resourceApiVersion":"V3"},"ldsConfig":{"apiConfigSource":{"apiType":"GRPC","grpcServices":[{"envoyGrpc":{"clusterName":"xds-grpc-cilium"}}],"setNodeOnFirstMessageOnly":true,"transportApiVersion":"V3"},"initialFetchTimeout":"30s","resourceApiVersion":"V3"}},"node":{"cluster":"ingress-cluster","id":"host~127.0.0.1~no-id~localdomain"},"overloadManager":{"resourceMonitors":[{"name":"envoy.resource_monitors.global_downstream_max_connections","typedConfig":{"@type":"type.googleapis.com/envoy.extensions.resource_monitors.downstream_connections.v3.DownstreamConnectionsConfig","max_active_downstream_connections":"50000"}}]},"staticResources":{"clusters":[{"circuitBreakers":{"thresholds":[{"maxConnections":1024,"maxRequests":1024,"maxRetries":128}]},"cleanupInterval":"2.500s","connectTimeout":"2s","lbPolicy":"CLUSTER_PROVIDED","name":"ingress-cluster","type":"ORIGINAL_DST","typedExtensionProtocolOptions":{"envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{"@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions","commonHttpProtocolOptions":{"idleTimeout":"60s","maxConnectionDuration":"0s","maxRequestsPerConnection":0},"useDownstreamProtocolConfig":{}}}},{"circuitBreakers":{"thresholds":[{"maxConnections":1024,"maxRequests":1024,"maxRetries":128}]},"cleanupInterval":"2.500s","connectTimeout":"2s","lbPolicy":"CLUSTER_PROVIDED","name":"egress-cluster-tls","transportSocket":{"name":"cilium.tls_wrapper","typedConfig":{"@type":"type.googleapis.com/cilium.UpstreamTlsWrapperContext"}},"type":"ORIGINAL_DST","typedExtensionProtocolOptions":{"envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{"@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions","commonHttpProtocolOptions":{"idleTimeout":"60s","maxConnectionDuration":"0s","maxRequestsPerConnection":0},"upstreamHttpProtocolOptions":{},"useDownstreamProtocolConfig":{}}}},{"circuitBreakers":{"thresholds":[{"maxConnections":1024,"maxRequests":1024,"maxRetries":128}]},"cleanupInterval":"2.500s","connectTimeout":"2s","lbPolicy":"CLUSTER_PROVIDED","name":"egress-cluster","type":"ORIGINAL_DST","typedExtensionProtocolOptions":{"envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{"@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions","commonHttpProtocolOptions":{"idleTimeout":"60s","maxConnectionDuration":"0s","maxRequestsPerConnection":0},"useDownstreamProtocolConfig":{}}}},{"circuitBreakers":{"thresholds":[{"maxConnections":1024,"maxRequests":1024,"maxRetries":128}]},"cleanupInterval":"2.500s","connectTimeout":"2s","lbPolicy":"CLUSTER_PROVIDED","name":"ingress-cluster-tls","transportSocket":{"name":"cilium.tls_wrapper","typedConfig":{"@type":"type.googleapis.com/cilium.UpstreamTlsWrapperContext"}},"type":"ORIGINAL_DST","typedExtensionProtocolOptions":{"envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{"@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions","commonHttpProtocolOptions":{"idleTimeout":"60s","maxConnectionDuration":"0s","maxRequestsPerConnection":0},"upstreamHttpProtocolOptions":{},"useDownstreamProtocolConfig":{}}}},{"connectTimeout":"2s","loadAssignment":{"clusterName":"xds-grpc-cilium","endpoints":[{"lbEndpoints":[{"endpoint":{"address":{"pipe":{"path":"/var/run/cilium/envoy/sockets/xds.sock"}}}}]}]},"name":"xds-grpc-cilium","type":"STATIC","typedExtensionProtocolOptions":{"envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{"@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions","explicitHttpConfig":{"http2ProtocolOptions":{}}}}},{"connectTimeout":"2s","loadAssignment":{"clusterName":"/envoy-admin","endpoints":[{"lbEndpoints":[{"endpoint":{"address":{"pipe":{"path":"/var/run/cilium/envoy/sockets/admin.sock"}}}}]}]},"name":"/envoy-admin","type":"STATIC"}],"listeners":[{"address":{"socketAddress":{"address":"0.0.0.0","portValue":9964}},"filterChains":[{"filters":[{"name":"envoy.filters.network.http_connection_manager","typedConfig":{"@type":"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager","httpFilters":[{"name":"envoy.filters.http.router","typedConfig":{"@type":"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"}}],"internalAddressConfig":{"cidrRanges":[{"addressPrefix":"10.0.0.0","prefixLen":8},{"addressPrefix":"172.16.0.0","prefixLen":12},{"addressPrefix":"192.168.0.0","prefixLen":16},{"addressPrefix":"127.0.0.1","prefixLen":32}]},"routeConfig":{"virtualHosts":[{"domains":["*"],"name":"prometheus_metrics_route","routes":[{"match":{"prefix":"/metrics"},"name":"prometheus_metrics_route","route":{"cluster":"/envoy-admin","prefixRewrite":"/stats/prometheus"}}]}]},"statPrefix":"envoy-prometheus-metrics-listener","streamIdleTimeout":"300s"}}]}],"name":"envoy-prometheus-metrics-listener"},{"address":{"socketAddress":{"address":"127.0.0.1","portValue":9878}},"filterChains":[{"filters":[{"name":"envoy.filters.network.http_connection_manager","typedConfig":{"@type":"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager","httpFilters":[{"name":"envoy.filters.http.router","typedConfig":{"@type":"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"}}],"internalAddressConfig":{"cidrRanges":[{"addressPrefix":"10.0.0.0","prefixLen":8},{"addressPrefix":"172.16.0.0","prefixLen":12},{"addressPrefix":"192.168.0.0","prefixLen":16},{"addressPrefix":"127.0.0.1","prefixLen":32}]},"routeConfig":{"virtual_hosts":[{"domains":["*"],"name":"health","routes":[{"match":{"prefix":"/healthz"},"name":"health","route":{"cluster":"/envoy-admin","prefixRewrite":"/ready"}}]}]},"statPrefix":"envoy-health-listener","streamIdleTimeout":"300s"}}]}],"name":"envoy-health-listener"}]}} - ---- -# Source: cilium/templates/cilium-agent/clusterrole.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: cilium - labels: - app.kubernetes.io/part-of: cilium -rules: -- apiGroups: - - networking.k8s.io - resources: - - networkpolicies - verbs: - - get - - list - - watch -- apiGroups: - - discovery.k8s.io - resources: - - endpointslices - verbs: - - get - - list - - watch -- apiGroups: - - "" - resources: - - namespaces - - services - - pods - - endpoints - - nodes - verbs: - - get - - list - - watch -- apiGroups: - - apiextensions.k8s.io - resources: - - customresourcedefinitions - verbs: - - list - - watch - # This is used when validating policies in preflight. This will need to stay - # until we figure out how to avoid "get" inside the preflight, and then - # should be removed ideally. - - get -- apiGroups: - - cilium.io - resources: - - ciliumloadbalancerippools - - ciliumbgppeeringpolicies - - ciliumbgpnodeconfigs - - ciliumbgpadvertisements - - ciliumbgppeerconfigs - - ciliumclusterwideenvoyconfigs - - ciliumclusterwidenetworkpolicies - - ciliumegressgatewaypolicies - - ciliumendpoints - - ciliumendpointslices - - ciliumenvoyconfigs - - ciliumidentities - - ciliumlocalredirectpolicies - - ciliumnetworkpolicies - - ciliumnodes - - ciliumnodeconfigs - - ciliumcidrgroups - - ciliuml2announcementpolicies - - ciliumpodippools - verbs: - - list - - watch -- apiGroups: - - cilium.io - resources: - - ciliumidentities - - ciliumendpoints - - ciliumnodes - verbs: - - create -- apiGroups: - - cilium.io - # To synchronize garbage collection of such resources - resources: - - ciliumidentities - verbs: - - update -- apiGroups: - - cilium.io - resources: - - ciliumendpoints - verbs: - - delete - - get -- apiGroups: - - cilium.io - resources: - - ciliumnodes - - ciliumnodes/status - verbs: - - get - - update -- apiGroups: - - cilium.io - resources: - - ciliumendpoints/status - - ciliumendpoints - - ciliuml2announcementpolicies/status - - ciliumbgpnodeconfigs/status - verbs: - - patch - ---- -# Source: cilium/templates/cilium-operator/clusterrole.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: cilium-operator - labels: - app.kubernetes.io/part-of: cilium -rules: -- apiGroups: - - "" - resources: - - pods - verbs: - - get - - list - - watch - # to automatically delete [core|kube]dns pods so that are starting to being - # managed by Cilium - - delete -- apiGroups: - - "" - resources: - - configmaps - resourceNames: - - cilium-config - verbs: - # allow patching of the configmap to set annotations - - patch -- apiGroups: - - "" - resources: - - nodes - verbs: - - list - - watch -- apiGroups: - - "" - resources: - # To remove node taints - - nodes - # To set NetworkUnavailable false on startup - - nodes/status - verbs: - - patch -- apiGroups: - - discovery.k8s.io - resources: - - endpointslices - verbs: - - get - - list - - watch -- apiGroups: - - "" - resources: - # to perform LB IP allocation for BGP - - services/status - verbs: - - update - - patch -- apiGroups: - - "" - resources: - # to check apiserver connectivity - - namespaces - - secrets - verbs: - - get - - list - - watch -- apiGroups: - - "" - resources: - # to perform the translation of a CNP that contains `ToGroup` to its endpoints - - services - - endpoints - verbs: - - get - - list - - watch -- apiGroups: - - cilium.io - resources: - - ciliumnetworkpolicies - - ciliumclusterwidenetworkpolicies - verbs: - # Create auto-generated CNPs and CCNPs from Policies that have 'toGroups' - - create - - update - - deletecollection - # To update the status of the CNPs and CCNPs - - patch - - get - - list - - watch -- apiGroups: - - cilium.io - resources: - - ciliumnetworkpolicies/status - - ciliumclusterwidenetworkpolicies/status - verbs: - # Update the auto-generated CNPs and CCNPs status. - - patch - - update -- apiGroups: - - cilium.io - resources: - - ciliumendpoints - - ciliumidentities - verbs: - # To perform garbage collection of such resources - - delete - - list - - watch -- apiGroups: - - cilium.io - resources: - - ciliumidentities - verbs: - # To synchronize garbage collection of such resources - - update -- apiGroups: - - cilium.io - resources: - - ciliumnodes - verbs: - - create - - update - - get - - list - - watch - # To perform CiliumNode garbage collector - - delete -- apiGroups: - - cilium.io - resources: - - ciliumnodes/status - verbs: - - update -- apiGroups: - - cilium.io - resources: - - ciliumendpointslices - - ciliumenvoyconfigs - - ciliumbgppeerconfigs - - ciliumbgpadvertisements - - ciliumbgpnodeconfigs - verbs: - - create - - update - - get - - list - - watch - - delete - - patch -- apiGroups: - - cilium.io - resources: - - ciliumbgpclusterconfigs/status - - ciliumbgppeerconfigs/status - verbs: - - update -- apiGroups: - - apiextensions.k8s.io - resources: - - customresourcedefinitions - verbs: - - create - - get - - list - - watch -- apiGroups: - - apiextensions.k8s.io - resources: - - customresourcedefinitions - verbs: - - update - resourceNames: - - ciliumloadbalancerippools.cilium.io - - ciliumbgpclusterconfigs.cilium.io - - ciliumbgppeerconfigs.cilium.io - - ciliumbgpadvertisements.cilium.io - - ciliumbgpnodeconfigs.cilium.io - - ciliumbgpnodeconfigoverrides.cilium.io - - ciliumclusterwideenvoyconfigs.cilium.io - - ciliumclusterwidenetworkpolicies.cilium.io - - ciliumegressgatewaypolicies.cilium.io - - ciliumendpoints.cilium.io - - ciliumendpointslices.cilium.io - - ciliumenvoyconfigs.cilium.io - - ciliumidentities.cilium.io - - ciliumlocalredirectpolicies.cilium.io - - ciliumnetworkpolicies.cilium.io - - ciliumnodes.cilium.io - - ciliumnodeconfigs.cilium.io - - ciliumcidrgroups.cilium.io - - ciliuml2announcementpolicies.cilium.io - - ciliumpodippools.cilium.io - - ciliumgatewayclassconfigs.cilium.io -- apiGroups: - - cilium.io - resources: - - ciliumloadbalancerippools - - ciliumpodippools - - ciliumbgppeeringpolicies - - ciliumbgpclusterconfigs - - ciliumbgpnodeconfigoverrides - - ciliumbgppeerconfigs - verbs: - - get - - list - - watch -- apiGroups: - - cilium.io - resources: - - ciliumpodippools - verbs: - - create -- apiGroups: - - cilium.io - resources: - - ciliumloadbalancerippools/status - verbs: - - patch -# For cilium-operator running in HA mode. -# -# Cilium operator running in HA mode requires the use of ResourceLock for Leader Election -# between multiple running instances. -# The preferred way of doing this is to use LeasesResourceLock as edits to Leases are less -# common and fewer objects in the cluster watch "all Leases". -- apiGroups: - - coordination.k8s.io - resources: - - leases - verbs: - - create - - get - - update -- apiGroups: - - cilium.io - resources: - - ciliumendpointslices - verbs: - - deletecollection - ---- -# Source: cilium/templates/cilium-agent/clusterrolebinding.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: cilium - labels: - app.kubernetes.io/part-of: cilium -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: cilium -subjects: -- kind: ServiceAccount - name: "cilium" - namespace: kube-system - ---- -# Source: cilium/templates/cilium-operator/clusterrolebinding.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: cilium-operator - labels: - app.kubernetes.io/part-of: cilium -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: cilium-operator -subjects: -- kind: ServiceAccount - name: "cilium-operator" - namespace: kube-system - ---- -# Source: cilium/templates/cilium-agent/role.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: cilium-config-agent - namespace: kube-system - labels: - app.kubernetes.io/part-of: cilium -rules: -- apiGroups: - - "" - resources: - - configmaps - verbs: - - get - - list - - watch ---- -# Source: cilium/templates/cilium-agent/role.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: cilium-tlsinterception-secrets - namespace: "cilium-secrets" - labels: - app.kubernetes.io/part-of: cilium -rules: -- apiGroups: - - "" - resources: - - secrets - verbs: - - get - - list - - watch - ---- -# Source: cilium/templates/cilium-operator/role.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: cilium-operator-tlsinterception-secrets - namespace: "cilium-secrets" - labels: - app.kubernetes.io/part-of: cilium -rules: -- apiGroups: - - "" - resources: - - secrets - verbs: - - create - - delete - - update - - patch ---- -# Source: cilium/templates/cilium-operator/role.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: cilium-operator-ztunnel - namespace: kube-system - labels: - app.kubernetes.io/part-of: cilium -rules: -# ZTunnel DaemonSet management permissions -# Note: These permissions must always be granted (not conditional on encryption.type) -# because the controller needs to clean up stale DaemonSets when ztunnel is disabled. -- apiGroups: - - apps - resources: - - daemonsets - verbs: - - create - - delete - - get - - list - - watch - ---- -# Source: cilium/templates/cilium-agent/rolebinding.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: cilium-config-agent - namespace: kube-system - labels: - app.kubernetes.io/part-of: cilium -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: cilium-config-agent -subjects: - - kind: ServiceAccount - name: "cilium" - namespace: kube-system ---- -# Source: cilium/templates/cilium-agent/rolebinding.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: cilium-tlsinterception-secrets - namespace: "cilium-secrets" - labels: - app.kubernetes.io/part-of: cilium -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: cilium-tlsinterception-secrets -subjects: -- kind: ServiceAccount - name: "cilium" - namespace: kube-system - ---- -# Source: cilium/templates/cilium-operator/rolebinding.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: cilium-operator-tlsinterception-secrets - namespace: "cilium-secrets" - labels: - app.kubernetes.io/part-of: cilium -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: cilium-operator-tlsinterception-secrets -subjects: -- kind: ServiceAccount - name: "cilium-operator" - namespace: kube-system ---- -# Source: cilium/templates/cilium-operator/rolebinding.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: cilium-operator-ztunnel - namespace: kube-system - labels: - app.kubernetes.io/part-of: cilium -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: cilium-operator-ztunnel -subjects: -- kind: ServiceAccount - name: "cilium-operator" - namespace: kube-system - ---- -# Source: cilium/templates/cilium-envoy/service.yaml -apiVersion: v1 -kind: Service -metadata: - name: cilium-envoy - namespace: kube-system - annotations: - prometheus.io/scrape: "true" - prometheus.io/port: "9964" - labels: - k8s-app: cilium-envoy - app.kubernetes.io/name: cilium-envoy - app.kubernetes.io/part-of: cilium - io.cilium/app: proxy -spec: - clusterIP: None - type: ClusterIP - selector: - k8s-app: cilium-envoy - ports: - - name: envoy-metrics - port: 9964 - protocol: TCP - targetPort: 9964 - ---- -# Source: cilium/templates/hubble/peer-service.yaml -apiVersion: v1 -kind: Service -metadata: - name: hubble-peer - namespace: kube-system - labels: - k8s-app: cilium - app.kubernetes.io/part-of: cilium - app.kubernetes.io/name: hubble-peer - -spec: - selector: - k8s-app: cilium - ports: - - name: peer-service - port: 443 - protocol: TCP - targetPort: 4244 - internalTrafficPolicy: Local - ---- -# Source: cilium/templates/cilium-agent/daemonset.yaml -apiVersion: apps/v1 -kind: DaemonSet -metadata: - name: cilium - namespace: kube-system - labels: - k8s-app: cilium - app.kubernetes.io/part-of: cilium - app.kubernetes.io/name: cilium-agent -spec: - selector: - matchLabels: - k8s-app: cilium - updateStrategy: - rollingUpdate: - maxUnavailable: 2 - type: RollingUpdate - template: - metadata: - annotations: - kubectl.kubernetes.io/default-container: cilium-agent - labels: - k8s-app: cilium - app.kubernetes.io/name: cilium-agent - app.kubernetes.io/part-of: cilium - spec: - securityContext: - appArmorProfile: - type: Unconfined - seccompProfile: - type: Unconfined - containers: - - name: cilium-agent - image: "quay.io/cilium/cilium:v1.19.5@sha256:20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732" - imagePullPolicy: IfNotPresent - command: - - cilium-agent - args: - - --config-dir=/tmp/cilium/config-map - startupProbe: - httpGet: - host: "127.0.0.1" - path: /healthz - port: health - scheme: HTTP - httpHeaders: - - name: "brief" - value: "true" - failureThreshold: 300 - periodSeconds: 2 - successThreshold: 1 - initialDelaySeconds: 5 - livenessProbe: - httpGet: - host: "127.0.0.1" - path: /healthz - port: health - scheme: HTTP - httpHeaders: - - name: "brief" - value: "true" - - name: "require-k8s-connectivity" - value: "false" - periodSeconds: 30 - successThreshold: 1 - failureThreshold: 10 - timeoutSeconds: 5 - readinessProbe: - httpGet: - host: "127.0.0.1" - path: /healthz - port: health - scheme: HTTP - httpHeaders: - - name: "brief" - value: "true" - periodSeconds: 30 - successThreshold: 1 - failureThreshold: 3 - timeoutSeconds: 5 - env: - - name: K8S_NODE_NAME - valueFrom: - fieldRef: - apiVersion: v1 - fieldPath: spec.nodeName - - name: CILIUM_K8S_NAMESPACE - valueFrom: - fieldRef: - apiVersion: v1 - fieldPath: metadata.namespace - - name: CILIUM_CLUSTERMESH_CONFIG - value: /var/lib/cilium/clustermesh/ - - name: GOMEMLIMIT - valueFrom: - resourceFieldRef: - resource: limits.memory - divisor: '1' - - name: KUBE_CLIENT_BACKOFF_BASE - value: "1" - - name: KUBE_CLIENT_BACKOFF_DURATION - value: "120" - lifecycle: - postStart: - exec: - command: - - "bash" - - "-c" - - | - set -o errexit - set -o pipefail - set -o nounset - - # When running in AWS ENI mode, it's likely that 'aws-node' has - # had a chance to install SNAT iptables rules. These can result - # in dropped traffic, so we should attempt to remove them. - # We do it using a 'postStart' hook since this may need to run - # for nodes which might have already been init'ed but may still - # have dangling rules. This is safe because there are no - # dependencies on anything that is part of the startup script - # itself, and can be safely run multiple times per node (e.g. in - # case of a restart). - if [[ "$(iptables-save | grep -E -c 'AWS-SNAT-CHAIN|AWS-CONNMARK-CHAIN')" != "0" ]]; - then - echo 'Deleting iptables rules created by the AWS CNI VPC plugin' - iptables-save | grep -E -v 'AWS-SNAT-CHAIN|AWS-CONNMARK-CHAIN' | iptables-restore - fi - echo 'Done!' - - preStop: - exec: - command: - - /cni-uninstall.sh - ports: - - name: health - containerPort: 9879 - hostPort: 9879 - protocol: TCP - - name: peer-service - containerPort: 4244 - hostPort: 4244 - protocol: TCP - securityContext: - seLinuxOptions: - level: s0 - type: spc_t - capabilities: - add: - - CHOWN - - KILL - - NET_ADMIN - - NET_RAW - - IPC_LOCK - - SYS_MODULE - - SYS_ADMIN - - SYS_RESOURCE - - DAC_OVERRIDE - - FOWNER - - SETGID - - SETUID - - SYSLOG - drop: - - ALL - terminationMessagePolicy: FallbackToLogsOnError - volumeMounts: - - name: envoy-sockets - mountPath: /var/run/cilium/envoy/sockets - readOnly: false - # Unprivileged containers need to mount /proc/sys/net from the host - # to have write access - - mountPath: /host/proc/sys/net - name: host-proc-sys-net - # Unprivileged containers need to mount /proc/sys/kernel from the host - # to have write access - - mountPath: /host/proc/sys/kernel - name: host-proc-sys-kernel - - name: bpf-maps - mountPath: /sys/fs/bpf - # Unprivileged containers can't set mount propagation to bidirectional - # in this case we will mount the bpf fs from an init container that - # is privileged and set the mount propagation from host to container - # in Cilium. - mountPropagation: HostToContainer - - name: cilium-run - mountPath: /var/run/cilium - - name: cilium-netns - mountPath: /var/run/cilium/netns - mountPropagation: HostToContainer - - name: etc-cni-netd - mountPath: /host/etc/cni/net.d - - name: clustermesh-secrets - mountPath: /var/lib/cilium/clustermesh - readOnly: true - # Needed to be able to load kernel modules - - name: lib-modules - mountPath: /lib/modules - readOnly: true - - name: xtables-lock - mountPath: /run/xtables.lock - - name: hubble-tls - mountPath: /var/lib/cilium/tls/hubble - readOnly: true - - name: tmp - mountPath: /tmp - - initContainers: - - name: config - image: "quay.io/cilium/cilium:v1.19.5@sha256:20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732" - imagePullPolicy: IfNotPresent - command: - - cilium-dbg - - build-config - env: - - name: K8S_NODE_NAME - valueFrom: - fieldRef: - apiVersion: v1 - fieldPath: spec.nodeName - - name: CILIUM_K8S_NAMESPACE - valueFrom: - fieldRef: - apiVersion: v1 - fieldPath: metadata.namespace - volumeMounts: - - name: tmp - mountPath: /tmp - terminationMessagePolicy: FallbackToLogsOnError - securityContext: - capabilities: - add: - - NET_ADMIN - drop: - - ALL - # Required to mount cgroup2 filesystem on the underlying Kubernetes node. - # We use nsenter command with host's cgroup and mount namespaces enabled. - - name: mount-cgroup - image: "quay.io/cilium/cilium:v1.19.5@sha256:20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732" - imagePullPolicy: IfNotPresent - env: - - name: CGROUP_ROOT - value: /run/cilium/cgroupv2 - - name: BIN_PATH - value: /opt/cni/bin - command: - - bash - - -ec - # The statically linked Go program binary is invoked to avoid any - # dependency on utilities like sh and mount that can be missing on certain - # distros installed on the underlying host. Copy the binary to the - # same directory where we install cilium cni plugin so that exec permissions - # are available. - - | - cp /usr/bin/cilium-mount /hostbin/cilium-mount; - nsenter --cgroup=/hostproc/1/ns/cgroup --mount=/hostproc/1/ns/mnt "${BIN_PATH}/cilium-mount" $CGROUP_ROOT; - rm /hostbin/cilium-mount - volumeMounts: - - name: hostproc - mountPath: /hostproc - - name: cni-path - mountPath: /hostbin - terminationMessagePolicy: FallbackToLogsOnError - securityContext: - seLinuxOptions: - level: s0 - type: spc_t - capabilities: - add: - - SYS_ADMIN - - SYS_CHROOT - - SYS_PTRACE - drop: - - ALL - - name: apply-sysctl-overwrites - image: "quay.io/cilium/cilium:v1.19.5@sha256:20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732" - imagePullPolicy: IfNotPresent - env: - - name: BIN_PATH - value: /opt/cni/bin - command: - - bash - - -ec - # The statically linked Go program binary is invoked to avoid any - # dependency on utilities like sh that can be missing on certain - # distros installed on the underlying host. Copy the binary to the - # same directory where we install cilium cni plugin so that exec permissions - # are available. - - | - cp /usr/bin/cilium-sysctlfix /hostbin/cilium-sysctlfix; - nsenter --mount=/hostproc/1/ns/mnt "${BIN_PATH}/cilium-sysctlfix"; - rm /hostbin/cilium-sysctlfix - volumeMounts: - - name: hostproc - mountPath: /hostproc - - name: cni-path - mountPath: /hostbin - terminationMessagePolicy: FallbackToLogsOnError - securityContext: - seLinuxOptions: - level: s0 - type: spc_t - capabilities: - add: - - SYS_ADMIN - - SYS_CHROOT - - SYS_PTRACE - drop: - - ALL - # Mount the bpf fs if it is not mounted. We will perform this task - # from a privileged container because the mount propagation bidirectional - # only works from privileged containers. - - name: mount-bpf-fs - image: "quay.io/cilium/cilium:v1.19.5@sha256:20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732" - imagePullPolicy: IfNotPresent - args: - - 'mount | grep "/sys/fs/bpf type bpf" || mount -t bpf bpf /sys/fs/bpf' - command: - - /bin/bash - - -c - - -- - terminationMessagePolicy: FallbackToLogsOnError - securityContext: - privileged: true - volumeMounts: - - name: bpf-maps - mountPath: /sys/fs/bpf - mountPropagation: Bidirectional - - name: clean-cilium-state - image: "quay.io/cilium/cilium:v1.19.5@sha256:20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732" - imagePullPolicy: IfNotPresent - command: - - /init-container.sh - env: - - name: CILIUM_ALL_STATE - valueFrom: - configMapKeyRef: - name: cilium-config - key: clean-cilium-state - optional: true - - name: CILIUM_BPF_STATE - valueFrom: - configMapKeyRef: - name: cilium-config - key: clean-cilium-bpf-state - optional: true - - name: WRITE_CNI_CONF_WHEN_READY - valueFrom: - configMapKeyRef: - name: cilium-config - key: write-cni-conf-when-ready - optional: true - terminationMessagePolicy: FallbackToLogsOnError - securityContext: - seLinuxOptions: - level: s0 - type: spc_t - capabilities: - add: - - NET_ADMIN - - SYS_MODULE - - SYS_ADMIN - - SYS_RESOURCE - drop: - - ALL - volumeMounts: - - name: bpf-maps - mountPath: /sys/fs/bpf - # Required to mount cgroup filesystem from the host to cilium agent pod - - name: cilium-cgroup - mountPath: /run/cilium/cgroupv2 - mountPropagation: HostToContainer - - name: cilium-run - mountPath: /var/run/cilium # wait-for-kube-proxy - # Install the CNI binaries in an InitContainer so we don't have a writable host mount in the agent - - name: install-cni-binaries - image: "quay.io/cilium/cilium:v1.19.5@sha256:20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732" - imagePullPolicy: IfNotPresent - command: - - "/install-plugin.sh" - resources: - limits: - cpu: 1 - memory: 1Gi - requests: - cpu: 100m - memory: 10Mi - securityContext: - seLinuxOptions: - level: s0 - type: spc_t - capabilities: - drop: - - ALL - terminationMessagePolicy: FallbackToLogsOnError - volumeMounts: - - name: cni-path - mountPath: /host/opt/cni/bin # .Values.cni.install - restartPolicy: Always - priorityClassName: system-node-critical - serviceAccountName: "cilium" - automountServiceAccountToken: true - terminationGracePeriodSeconds: 1 - hostNetwork: true - - affinity: - podAntiAffinity: - requiredDuringSchedulingIgnoredDuringExecution: - - labelSelector: - matchLabels: - k8s-app: cilium - topologyKey: kubernetes.io/hostname - nodeSelector: - kubernetes.io/os: linux - tolerations: - - operator: Exists - volumes: - # For sharing configuration between the "config" initContainer and the agent - - name: tmp - emptyDir: {} - # To keep state between restarts / upgrades - - name: cilium-run - hostPath: - path: /var/run/cilium - type: DirectoryOrCreate - # To exec into pod network namespaces - - name: cilium-netns - hostPath: - path: /var/run/netns - type: DirectoryOrCreate - # To keep state between restarts / upgrades for bpf maps - - name: bpf-maps - hostPath: - path: /sys/fs/bpf - type: DirectoryOrCreate - # To mount cgroup2 filesystem on the host or apply sysctlfix - - name: hostproc - hostPath: - path: /proc - type: Directory - # To keep state between restarts / upgrades for cgroup2 filesystem - - name: cilium-cgroup - hostPath: - path: /run/cilium/cgroupv2 - type: DirectoryOrCreate - # To install cilium cni plugin in the host - - name: cni-path - hostPath: - path: /opt/cni/bin - type: DirectoryOrCreate - # To install cilium cni configuration in the host - - name: etc-cni-netd - hostPath: - path: /etc/cni/net.d - type: DirectoryOrCreate - # To be able to load kernel modules - - name: lib-modules - hostPath: - path: /lib/modules - # To access iptables concurrently with other processes (e.g. kube-proxy) - - name: xtables-lock - hostPath: - path: /run/xtables.lock - type: FileOrCreate - # Sharing socket with Cilium Envoy on the same node by using a host path - - name: envoy-sockets - hostPath: - path: "/var/run/cilium/envoy/sockets" - type: DirectoryOrCreate - # To read the clustermesh configuration - - name: clustermesh-secrets - projected: - # note: the leading zero means this number is in octal representation: do not remove it - defaultMode: 0400 - sources: - - secret: - name: cilium-clustermesh - optional: true - # note: items are not explicitly listed here, since the entries of this secret - # depend on the peers configured, and that would cause a restart of all agents - # at every addition/removal. Leaving the field empty makes each secret entry - # to be automatically projected into the volume as a file whose name is the key. - - secret: - name: clustermesh-apiserver-remote-cert - optional: true - items: - - key: tls.key - path: common-etcd-client.key - - key: tls.crt - path: common-etcd-client.crt - - key: ca.crt - path: common-etcd-client-ca.crt - # note: we configure the volume for the kvstoremesh-specific certificate - # regardless of whether KVStoreMesh is enabled or not, so that it can be - # automatically mounted in case KVStoreMesh gets subsequently enabled, - # without requiring an agent restart. - - secret: - name: clustermesh-apiserver-local-cert - optional: true - items: - - key: tls.key - path: local-etcd-client.key - - key: tls.crt - path: local-etcd-client.crt - - key: ca.crt - path: local-etcd-client-ca.crt - - name: host-proc-sys-net - hostPath: - path: /proc/sys/net - type: Directory - - name: host-proc-sys-kernel - hostPath: - path: /proc/sys/kernel - type: Directory - - name: hubble-tls - projected: - # note: the leading zero means this number is in octal representation: do not remove it - defaultMode: 0400 - sources: - - secret: - name: hubble-server-certs - optional: true - items: - - key: tls.crt - path: server.crt - - key: tls.key - path: server.key - - key: ca.crt - path: client-ca.crt - - ---- -# Source: cilium/templates/cilium-envoy/daemonset.yaml -apiVersion: apps/v1 -kind: DaemonSet -metadata: - name: cilium-envoy - namespace: kube-system - labels: - k8s-app: cilium-envoy - app.kubernetes.io/part-of: cilium - app.kubernetes.io/name: cilium-envoy - name: cilium-envoy -spec: - selector: - matchLabels: - k8s-app: cilium-envoy - - updateStrategy: - rollingUpdate: - maxUnavailable: 2 - type: RollingUpdate - template: - metadata: - annotations: - labels: - k8s-app: cilium-envoy - name: cilium-envoy - app.kubernetes.io/name: cilium-envoy - app.kubernetes.io/part-of: cilium - spec: - securityContext: - appArmorProfile: - type: Unconfined - - containers: - - name: cilium-envoy - image: "quay.io/cilium/cilium-envoy:v1.36.8-1781157951-a7f42a3390781539911b5b9107881b35ecc4e752@sha256:326f872e19ce8aa45170efbf583b3f301586ba3feead14b864676d4baf3b45ed" - imagePullPolicy: IfNotPresent - command: - - /usr/bin/cilium-envoy-starter - args: - - '--' - - '-c /var/run/cilium/envoy/bootstrap-config.json' - - '--base-id 0' - - '--log-level info' - - startupProbe: - httpGet: - host: "127.0.0.1" - path: /healthz - port: 9878 - scheme: HTTP - failureThreshold: 105 - periodSeconds: 2 - successThreshold: 1 - initialDelaySeconds: 5 - livenessProbe: - httpGet: - host: "127.0.0.1" - path: /healthz - port: 9878 - scheme: HTTP - periodSeconds: 30 - successThreshold: 1 - failureThreshold: 10 - timeoutSeconds: 5 - readinessProbe: - httpGet: - host: "127.0.0.1" - path: /healthz - port: 9878 - scheme: HTTP - periodSeconds: 30 - successThreshold: 1 - failureThreshold: 3 - timeoutSeconds: 5 - env: - - name: K8S_NODE_NAME - valueFrom: - fieldRef: - apiVersion: v1 - fieldPath: spec.nodeName - - name: CILIUM_K8S_NAMESPACE - valueFrom: - fieldRef: - apiVersion: v1 - fieldPath: metadata.namespace - - ports: - - name: envoy-metrics - containerPort: 9964 - hostPort: 9964 - protocol: TCP - securityContext: - seLinuxOptions: - level: s0 - type: spc_t - capabilities: - add: - - NET_ADMIN - - SYS_ADMIN - drop: - - ALL - terminationMessagePolicy: FallbackToLogsOnError - volumeMounts: - - name: envoy-sockets - mountPath: /var/run/cilium/envoy/sockets - readOnly: false - - name: envoy-artifacts - mountPath: /var/run/cilium/envoy/artifacts - readOnly: true - - name: envoy-config - mountPath: /var/run/cilium/envoy/ - readOnly: true - - name: bpf-maps - mountPath: /sys/fs/bpf - mountPropagation: HostToContainer - - restartPolicy: Always - priorityClassName: system-node-critical - serviceAccountName: "cilium-envoy" - automountServiceAccountToken: true - terminationGracePeriodSeconds: 1 - hostNetwork: true - - affinity: - nodeAffinity: - requiredDuringSchedulingIgnoredDuringExecution: - nodeSelectorTerms: - - matchExpressions: - - key: cilium.io/no-schedule - operator: NotIn - values: - - "true" - podAffinity: - requiredDuringSchedulingIgnoredDuringExecution: - - labelSelector: - matchLabels: - k8s-app: cilium - topologyKey: kubernetes.io/hostname - podAntiAffinity: - requiredDuringSchedulingIgnoredDuringExecution: - - labelSelector: - matchLabels: - k8s-app: cilium-envoy - topologyKey: kubernetes.io/hostname - nodeSelector: - kubernetes.io/os: linux - tolerations: - - operator: Exists - volumes: - - name: envoy-sockets - hostPath: - path: "/var/run/cilium/envoy/sockets" - type: DirectoryOrCreate - - name: envoy-artifacts - hostPath: - path: "/var/run/cilium/envoy/artifacts" - type: DirectoryOrCreate - - name: envoy-config - configMap: - name: "cilium-envoy-config" - # note: the leading zero means this number is in octal representation: do not remove it - defaultMode: 0400 - items: - - key: bootstrap-config.json - path: bootstrap-config.json - # To keep state between restarts / upgrades - # To keep state between restarts / upgrades for bpf maps - - name: bpf-maps - hostPath: - path: /sys/fs/bpf - type: DirectoryOrCreate - - ---- -# Source: cilium/templates/cilium-operator/deployment.yaml -apiVersion: apps/v1 -kind: Deployment -metadata: - name: cilium-operator - namespace: kube-system - labels: - io.cilium/app: operator - name: cilium-operator - app.kubernetes.io/part-of: cilium - app.kubernetes.io/name: cilium-operator -spec: - # See docs on ServerCapabilities.LeasesResourceLock in file pkg/k8s/version/version.go - # for more details. - replicas: 2 - selector: - matchLabels: - io.cilium/app: operator - name: cilium-operator - # ensure operator update on single node k8s clusters, by using rolling update with maxUnavailable=100% in case - # of one replica and no user configured Recreate strategy. - # otherwise an update might get stuck due to the default maxUnavailable=50% in combination with the - # podAntiAffinity which prevents deployments of multiple operator replicas on the same node. - strategy: - rollingUpdate: - maxSurge: 25% - maxUnavailable: 50% - type: RollingUpdate - template: - metadata: - annotations: - prometheus.io/port: "9963" - prometheus.io/scrape: "true" - labels: - io.cilium/app: operator - name: cilium-operator - app.kubernetes.io/part-of: cilium - app.kubernetes.io/name: cilium-operator - spec: - securityContext: - seccompProfile: - type: RuntimeDefault - containers: - - name: cilium-operator - image: "quay.io/cilium/operator-generic:v1.19.5@sha256:be848a365776e07d0c5a895eda7aec928ddc52a5a1fa2f432fd7a286609e1db4" - imagePullPolicy: IfNotPresent - command: - - cilium-operator-generic - args: - - --config-dir=/tmp/cilium/config-map - - --debug=$(CILIUM_DEBUG) - env: - - name: K8S_NODE_NAME - valueFrom: - fieldRef: - apiVersion: v1 - fieldPath: spec.nodeName - - name: CILIUM_K8S_NAMESPACE - valueFrom: - fieldRef: - apiVersion: v1 - fieldPath: metadata.namespace - - name: CILIUM_DEBUG - valueFrom: - configMapKeyRef: - key: debug - name: cilium-config - optional: true - ports: - - name: health - containerPort: 9234 - hostPort: 9234 - - name: prometheus - containerPort: 9963 - hostPort: 9963 - protocol: TCP - livenessProbe: - httpGet: - host: "127.0.0.1" - path: /healthz - port: health - scheme: HTTP - initialDelaySeconds: 60 - periodSeconds: 10 - timeoutSeconds: 3 - readinessProbe: - httpGet: - host: "127.0.0.1" - path: /healthz - port: health - scheme: HTTP - initialDelaySeconds: 0 - periodSeconds: 5 - timeoutSeconds: 3 - failureThreshold: 5 - volumeMounts: - - name: cilium-config-path - mountPath: /tmp/cilium/config-map - readOnly: true - - securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL - terminationMessagePolicy: FallbackToLogsOnError - hostNetwork: true - restartPolicy: Always - priorityClassName: system-cluster-critical - serviceAccountName: "cilium-operator" - automountServiceAccountToken: true - # In HA mode, cilium-operator pods must not be scheduled on the same - # node as they will clash with each other. - affinity: - podAntiAffinity: - requiredDuringSchedulingIgnoredDuringExecution: - - labelSelector: - matchLabels: - io.cilium/app: operator - topologyKey: kubernetes.io/hostname - nodeSelector: - kubernetes.io/os: linux - tolerations: - - key: node-role.kubernetes.io/control-plane - operator: Exists - - key: node-role.kubernetes.io/master - operator: Exists - - key: node.kubernetes.io/not-ready - operator: Exists - - key: node.cloudprovider.kubernetes.io/uninitialized - operator: Exists - - key: node.cilium.io/agent-not-ready - operator: Exists - - volumes: - # To read the configuration from the config map - - name: cilium-config-path - configMap: - name: cilium-config - diff --git a/packages/manifests/operators/knative-serving/v1.22.1.yaml b/packages/manifests/operators/knative-serving/v1.22.1.yaml deleted file mode 100644 index bbe9e23..0000000 --- a/packages/manifests/operators/knative-serving/v1.22.1.yaml +++ /dev/null @@ -1,10237 +0,0 @@ -# Source: https://github.com/knative/serving/releases/download/knative-v1.22.1/serving-crds.yaml ---- -# Copyright 2020 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - name: certificates.networking.internal.knative.dev - labels: - app.kubernetes.io/name: knative-serving - app.kubernetes.io/component: networking - app.kubernetes.io/version: "1.22.1" - knative.dev/crd-install: "true" -spec: - group: networking.internal.knative.dev - versions: - - name: v1alpha1 - served: true - storage: true - subresources: - status: {} - schema: - openAPIV3Schema: - description: |- - Certificate is responsible for provisioning a SSL certificate for the - given hosts. It is a Knative abstraction for various SSL certificate - provisioning solutions (such as cert-manager or self-signed SSL certificate). - type: object - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: |- - Spec is the desired state of the Certificate. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status - type: object - required: - - dnsNames - - secretName - properties: - dnsNames: - description: |- - DNSNames is a list of DNS names the Certificate could support. - The wildcard format of DNSNames (e.g. *.default.example.com) is supported. - type: array - items: - type: string - domain: - description: Domain is the top level domain of the values for DNSNames. - type: string - secretName: - description: SecretName is the name of the secret resource to store the SSL certificate in. - type: string - status: - description: |- - Status is the current state of the Certificate. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status - type: object - properties: - annotations: - description: |- - Annotations is additional Status fields for the Resource to save some - additional State as well as convey more information to the user. This is - roughly akin to Annotations on any k8s resource, just the reconciler conveying - richer information outwards. - type: object - additionalProperties: - type: string - conditions: - description: Conditions the latest available observations of a resource's current state. - type: array - items: - description: |- - Condition defines a readiness condition for a Knative resource. - See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties - type: object - required: - - status - - type - properties: - lastTransitionTime: - description: |- - LastTransitionTime is the last time the condition transitioned from one status to another. - We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic - differences (all other things held constant). - type: string - message: - description: A human readable message indicating details about the transition. - type: string - reason: - description: The reason for the condition's last transition. - type: string - severity: - description: |- - Severity with which to treat failures of this type of condition. - When this is not specified, it defaults to Error. - type: string - status: - description: Status of the condition, one of True, False, Unknown. - type: string - type: - description: Type of condition. - type: string - http01Challenges: - description: |- - HTTP01Challenges is a list of HTTP01 challenges that need to be fulfilled - in order to get the TLS certificate.. - type: array - items: - description: |- - HTTP01Challenge defines the status of a HTTP01 challenge that a certificate needs - to fulfill. - type: object - properties: - serviceName: - description: ServiceName is the name of the service to serve HTTP01 challenge requests. - type: string - serviceNamespace: - description: ServiceNamespace is the namespace of the service to serve HTTP01 challenge requests. - type: string - servicePort: - description: ServicePort is the port of the service to serve HTTP01 challenge requests. - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - url: - description: URL is the URL that the HTTP01 challenge is expected to serve on. - type: string - notAfter: - description: |- - The expiration time of the TLS certificate stored in the secret named - by this resource in spec.secretName. - type: string - format: date-time - observedGeneration: - description: |- - ObservedGeneration is the 'Generation' of the Service that - was last processed by the controller. - type: integer - format: int64 - additionalPrinterColumns: - - name: Ready - type: string - jsonPath: ".status.conditions[?(@.type==\"Ready\")].status" - - name: Reason - type: string - jsonPath: ".status.conditions[?(@.type==\"Ready\")].reason" - names: - kind: Certificate - plural: certificates - singular: certificate - categories: - - knative-internal - - networking - shortNames: - - kcert - scope: Namespaced ---- -# Copyright 2019 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -# Note: The schema part of the spec is auto-generated by hack/update-schemas.sh. - -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - name: configurations.serving.knative.dev - labels: - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" - knative.dev/crd-install: "true" - duck.knative.dev/podspecable: "true" -spec: - group: serving.knative.dev - names: - kind: Configuration - plural: configurations - singular: configuration - categories: - - all - - knative - - serving - shortNames: - - config - - cfg - scope: Namespaced - versions: - - name: v1 - served: true - storage: true - subresources: - status: {} - additionalPrinterColumns: - - name: LatestCreated - type: string - jsonPath: .status.latestCreatedRevisionName - - name: LatestReady - type: string - jsonPath: .status.latestReadyRevisionName - - name: Ready - type: string - jsonPath: ".status.conditions[?(@.type=='Ready')].status" - - name: Reason - type: string - jsonPath: ".status.conditions[?(@.type=='Ready')].reason" - schema: - openAPIV3Schema: - description: |- - Configuration represents the "floating HEAD" of a linear history of Revisions. - Users create new Revisions by updating the Configuration's spec. - The "latest created" revision's name is available under status, as is the - "latest ready" revision's name. - See also: https://github.com/knative/serving/blob/main/docs/spec/overview.md#configuration - type: object - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: ConfigurationSpec holds the desired state of the Configuration (from the client). - type: object - properties: - template: - description: Template holds the latest specification for the Revision to be stamped out. - type: object - properties: - metadata: - type: object - properties: - annotations: - type: object - additionalProperties: - type: string - finalizers: - type: array - items: - type: string - labels: - type: object - additionalProperties: - type: string - name: - type: string - namespace: - type: string - x-kubernetes-preserve-unknown-fields: true - spec: - description: RevisionSpec holds the desired state of the Revision (from the client). - type: object - required: - - containers - properties: - affinity: - description: This is accessible behind a feature flag - kubernetes.podspec-affinity - type: object - x-kubernetes-preserve-unknown-fields: true - automountServiceAccountToken: - description: AutomountServiceAccountToken indicates whether a service account token should be automatically mounted. - type: boolean - containerConcurrency: - description: |- - ContainerConcurrency specifies the maximum allowed in-flight (concurrent) - requests per container of the Revision. Defaults to `0` which means - concurrency to the application is not limited, and the system decides the - target concurrency for the autoscaler. - type: integer - format: int64 - containers: - description: |- - List of containers belonging to the pod. - Containers cannot currently be added or removed. - There must be at least one container in a Pod. - Cannot be updated. - type: array - items: - description: A single application container that you want to run within a pod. - type: object - properties: - args: - description: |- - Arguments to the entrypoint. - The container image's CMD is used if this is not provided. - Variable references $(VAR_NAME) are expanded using the container's environment. If a variable - cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced - to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will - produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless - of whether the variable exists or not. Cannot be updated. - More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell - type: array - items: - type: string - x-kubernetes-list-type: atomic - command: - description: |- - Entrypoint array. Not executed within a shell. - The container image's ENTRYPOINT is used if this is not provided. - Variable references $(VAR_NAME) are expanded using the container's environment. If a variable - cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced - to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will - produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless - of whether the variable exists or not. Cannot be updated. - More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell - type: array - items: - type: string - x-kubernetes-list-type: atomic - env: - description: |- - List of environment variables to set in the container. - Cannot be updated. - type: array - items: - description: EnvVar represents an environment variable present in a Container. - type: object - required: - - name - properties: - name: - description: |- - Name of the environment variable. - May consist of any printable ASCII characters except '='. - type: string - value: - description: |- - Variable references $(VAR_NAME) are expanded - using the previously defined environment variables in the container and - any service environment variables. If a variable cannot be resolved, - the reference in the input string will be unchanged. Double $$ are reduced - to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. - "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". - Escaped references will never be expanded, regardless of whether the variable - exists or not. - Defaults to "". - type: string - valueFrom: - description: Source for the environment variable's value. Cannot be used if value is not empty. - type: object - properties: - configMapKeyRef: - description: Selects a key of a ConfigMap. - type: object - required: - - key - properties: - key: - description: The key to select. - type: string - name: - description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - default: "" - optional: - description: Specify whether the ConfigMap or its key must be defined - type: boolean - x-kubernetes-map-type: atomic - fieldRef: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-fieldref - type: object - x-kubernetes-map-type: atomic - x-kubernetes-preserve-unknown-fields: true - resourceFieldRef: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-fieldref - type: object - x-kubernetes-map-type: atomic - x-kubernetes-preserve-unknown-fields: true - secretKeyRef: - description: Selects a key of a secret in the pod's namespace - type: object - required: - - key - properties: - key: - description: The key of the secret to select from. Must be a valid secret key. - type: string - name: - description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - default: "" - optional: - description: Specify whether the Secret or its key must be defined - type: boolean - x-kubernetes-map-type: atomic - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - envFrom: - description: |- - List of sources to populate environment variables in the container. - The keys defined within a source may consist of any printable ASCII characters except '='. - When a key exists in multiple - sources, the value associated with the last source will take precedence. - Values defined by an Env with a duplicate key will take precedence. - Cannot be updated. - type: array - items: - description: EnvFromSource represents the source of a set of ConfigMaps or Secrets - type: object - properties: - configMapRef: - description: The ConfigMap to select from - type: object - properties: - name: - description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - default: "" - optional: - description: Specify whether the ConfigMap must be defined - type: boolean - x-kubernetes-map-type: atomic - prefix: - description: |- - Optional text to prepend to the name of each environment variable. - May consist of any printable ASCII characters except '='. - type: string - secretRef: - description: The Secret to select from - type: object - properties: - name: - description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - default: "" - optional: - description: Specify whether the Secret must be defined - type: boolean - x-kubernetes-map-type: atomic - x-kubernetes-list-type: atomic - image: - description: |- - Container image name. - More info: https://kubernetes.io/docs/concepts/containers/images - This field is optional to allow higher level config management to default or override - container images in workload controllers like Deployments and StatefulSets. - type: string - imagePullPolicy: - description: |- - Image pull policy. - One of Always, Never, IfNotPresent. - Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. - Cannot be updated. - More info: https://kubernetes.io/docs/concepts/containers/images#updating-images - type: string - livenessProbe: - description: |- - Periodic probe of container liveness. - Container will be restarted if the probe fails. - Cannot be updated. - More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes - type: object - properties: - exec: - description: Exec specifies a command to execute in the container. - type: object - properties: - command: - description: |- - Command is the command line to execute inside the container, the working directory for the - command is root ('/') in the container's filesystem. The command is simply exec'd, it is - not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use - a shell, you need to explicitly call out to that shell. - Exit status of 0 is treated as live/healthy and non-zero is unhealthy. - type: array - items: - type: string - x-kubernetes-list-type: atomic - failureThreshold: - description: |- - Minimum consecutive failures for the probe to be considered failed after having succeeded. - Defaults to 3. Minimum value is 1. - type: integer - format: int32 - grpc: - description: GRPC specifies a GRPC HealthCheckRequest. - type: object - properties: - port: - description: Port number of the gRPC service. Number must be in the range 1 to 65535. - type: integer - format: int32 - service: - description: |- - Service is the name of the service to place in the gRPC HealthCheckRequest - (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). - - If this is not specified, the default behavior is defined by gRPC. - type: string - default: "" - httpGet: - description: HTTPGet specifies an HTTP GET request to perform. - type: object - properties: - host: - description: |- - Host name to connect to, defaults to the pod IP. You probably want to set - "Host" in httpHeaders instead. - type: string - httpHeaders: - description: Custom headers to set in the request. HTTP allows repeated headers. - type: array - items: - description: HTTPHeader describes a custom header to be used in HTTP probes - type: object - required: - - name - - value - properties: - name: - description: |- - The header field name. - This will be canonicalized upon output, so case-variant names will be understood as the same header. - type: string - value: - description: The header field value - type: string - x-kubernetes-list-type: atomic - path: - description: Path to access on the HTTP server. - type: string - port: - description: |- - Name or number of the port to access on the container. - Number must be in the range 1 to 65535. - Name must be an IANA_SVC_NAME. - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - scheme: - description: |- - Scheme to use for connecting to the host. - Defaults to HTTP. - type: string - initialDelaySeconds: - description: |- - Number of seconds after the container has started before liveness probes are initiated. - More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes - type: integer - format: int32 - periodSeconds: - description: |- - How often (in seconds) to perform the probe. - type: integer - format: int32 - successThreshold: - description: |- - Minimum consecutive successes for the probe to be considered successful after having failed. - Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. - type: integer - format: int32 - tcpSocket: - description: TCPSocket specifies a connection to a TCP port. - type: object - properties: - host: - description: 'Optional: Host name to connect to, defaults to the pod IP.' - type: string - port: - description: |- - Number or name of the port to access on the container. - Number must be in the range 1 to 65535. - Name must be an IANA_SVC_NAME. - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - timeoutSeconds: - description: |- - Number of seconds after which the probe times out. - Defaults to 1 second. Minimum value is 1. - More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes - type: integer - format: int32 - name: - description: |- - Name of the container specified as a DNS_LABEL. - Each container in a pod must have a unique name (DNS_LABEL). - Cannot be updated. - type: string - ports: - description: |- - List of ports to expose from the container. Not specifying a port here - DOES NOT prevent that port from being exposed. Any port which is - listening on the default "0.0.0.0" address inside a container will be - accessible from the network. - Modifying this array with strategic merge patch may corrupt the data. - For more information See https://github.com/kubernetes/kubernetes/issues/108255. - Cannot be updated. - type: array - items: - description: ContainerPort represents a network port in a single container. - type: object - properties: - containerPort: - description: |- - Number of port to expose on the pod's IP address. - This must be a valid port number, 0 < x < 65536. - type: integer - format: int32 - name: - description: |- - If specified, this must be an IANA_SVC_NAME and unique within the pod. Each - named port in a pod must have a unique name. Name for the port that can be - referred to by services. - type: string - protocol: - description: |- - Protocol for port. Must be UDP, TCP, or SCTP. - Defaults to "TCP". - type: string - default: TCP - readinessProbe: - description: |- - Periodic probe of container service readiness. - Container will be removed from service endpoints if the probe fails. - Cannot be updated. - More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes - type: object - properties: - exec: - description: Exec specifies a command to execute in the container. - type: object - properties: - command: - description: |- - Command is the command line to execute inside the container, the working directory for the - command is root ('/') in the container's filesystem. The command is simply exec'd, it is - not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use - a shell, you need to explicitly call out to that shell. - Exit status of 0 is treated as live/healthy and non-zero is unhealthy. - type: array - items: - type: string - x-kubernetes-list-type: atomic - failureThreshold: - description: |- - Minimum consecutive failures for the probe to be considered failed after having succeeded. - Defaults to 3. Minimum value is 1. - type: integer - format: int32 - grpc: - description: GRPC specifies a GRPC HealthCheckRequest. - type: object - properties: - port: - description: Port number of the gRPC service. Number must be in the range 1 to 65535. - type: integer - format: int32 - service: - description: |- - Service is the name of the service to place in the gRPC HealthCheckRequest - (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). - - If this is not specified, the default behavior is defined by gRPC. - type: string - default: "" - httpGet: - description: HTTPGet specifies an HTTP GET request to perform. - type: object - properties: - host: - description: |- - Host name to connect to, defaults to the pod IP. You probably want to set - "Host" in httpHeaders instead. - type: string - httpHeaders: - description: Custom headers to set in the request. HTTP allows repeated headers. - type: array - items: - description: HTTPHeader describes a custom header to be used in HTTP probes - type: object - required: - - name - - value - properties: - name: - description: |- - The header field name. - This will be canonicalized upon output, so case-variant names will be understood as the same header. - type: string - value: - description: The header field value - type: string - x-kubernetes-list-type: atomic - path: - description: Path to access on the HTTP server. - type: string - port: - description: |- - Name or number of the port to access on the container. - Number must be in the range 1 to 65535. - Name must be an IANA_SVC_NAME. - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - scheme: - description: |- - Scheme to use for connecting to the host. - Defaults to HTTP. - type: string - initialDelaySeconds: - description: |- - Number of seconds after the container has started before liveness probes are initiated. - More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes - type: integer - format: int32 - periodSeconds: - description: |- - How often (in seconds) to perform the probe. - type: integer - format: int32 - successThreshold: - description: |- - Minimum consecutive successes for the probe to be considered successful after having failed. - Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. - type: integer - format: int32 - tcpSocket: - description: TCPSocket specifies a connection to a TCP port. - type: object - properties: - host: - description: 'Optional: Host name to connect to, defaults to the pod IP.' - type: string - port: - description: |- - Number or name of the port to access on the container. - Number must be in the range 1 to 65535. - Name must be an IANA_SVC_NAME. - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - timeoutSeconds: - description: |- - Number of seconds after which the probe times out. - Defaults to 1 second. Minimum value is 1. - More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes - type: integer - format: int32 - resources: - description: |- - Compute Resources required by this container. - Cannot be updated. - More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ - type: object - properties: - limits: - description: |- - Limits describes the maximum amount of compute resources allowed. - More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ - type: object - additionalProperties: - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - requests: - description: |- - Requests describes the minimum amount of compute resources required. - If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, - otherwise to an implementation-defined value. Requests cannot exceed Limits. - More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ - type: object - additionalProperties: - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - securityContext: - description: |- - SecurityContext defines the security options the container should be run with. - If set, the fields of SecurityContext override the equivalent fields of PodSecurityContext. - More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ - type: object - properties: - allowPrivilegeEscalation: - description: |- - AllowPrivilegeEscalation controls whether a process can gain more - privileges than its parent process. This bool directly controls if - the no_new_privs flag will be set on the container process. - AllowPrivilegeEscalation is true always when the container is: - 1) run as Privileged - 2) has CAP_SYS_ADMIN - Note that this field cannot be set when spec.os.name is windows. - type: boolean - capabilities: - description: |- - The capabilities to add/drop when running containers. - Defaults to the default set of capabilities granted by the container runtime. - Note that this field cannot be set when spec.os.name is windows. - type: object - properties: - add: - description: This is accessible behind a feature flag - kubernetes.containerspec-addcapabilities - type: array - items: - description: Capability represent POSIX capabilities type - type: string - x-kubernetes-list-type: atomic - drop: - description: Removed capabilities - type: array - items: - description: Capability represent POSIX capabilities type - type: string - x-kubernetes-list-type: atomic - privileged: - description: |- - Run container in privileged mode. This can only be set to explicitly to 'false' - type: boolean - readOnlyRootFilesystem: - description: |- - Whether this container has a read-only root filesystem. - Default is false. - Note that this field cannot be set when spec.os.name is windows. - type: boolean - runAsGroup: - description: |- - The GID to run the entrypoint of the container process. - Uses runtime default if unset. - May also be set in PodSecurityContext. If set in both SecurityContext and - PodSecurityContext, the value specified in SecurityContext takes precedence. - Note that this field cannot be set when spec.os.name is windows. - type: integer - format: int64 - runAsNonRoot: - description: |- - Indicates that the container must run as a non-root user. - If true, the Kubelet will validate the image at runtime to ensure that it - does not run as UID 0 (root) and fail to start the container if it does. - If unset or false, no such validation will be performed. - May also be set in PodSecurityContext. If set in both SecurityContext and - PodSecurityContext, the value specified in SecurityContext takes precedence. - type: boolean - runAsUser: - description: |- - The UID to run the entrypoint of the container process. - Defaults to user specified in image metadata if unspecified. - May also be set in PodSecurityContext. If set in both SecurityContext and - PodSecurityContext, the value specified in SecurityContext takes precedence. - Note that this field cannot be set when spec.os.name is windows. - type: integer - format: int64 - seccompProfile: - description: |- - The seccomp options to use by this container. If seccomp options are - provided at both the pod & container level, the container options - override the pod options. - Note that this field cannot be set when spec.os.name is windows. - type: object - required: - - type - properties: - localhostProfile: - description: |- - localhostProfile indicates a profile defined in a file on the node should be used. - The profile must be preconfigured on the node to work. - Must be a descending path, relative to the kubelet's configured seccomp profile location. - Must be set if type is "Localhost". Must NOT be set for any other type. - type: string - type: - description: |- - type indicates which kind of seccomp profile will be applied. - Valid options are: - - Localhost - a profile defined in a file on the node should be used. - RuntimeDefault - the container runtime default profile should be used. - Unconfined - no profile should be applied. - type: string - startupProbe: - description: |- - StartupProbe indicates that the Pod has successfully initialized. - If specified, no other probes are executed until this completes successfully. - If this probe fails, the Pod will be restarted, just as if the livenessProbe failed. - This can be used to provide different probe parameters at the beginning of a Pod's lifecycle, - when it might take a long time to load data or warm a cache, than during steady-state operation. - This cannot be updated. - More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes - type: object - properties: - exec: - description: Exec specifies a command to execute in the container. - type: object - properties: - command: - description: |- - Command is the command line to execute inside the container, the working directory for the - command is root ('/') in the container's filesystem. The command is simply exec'd, it is - not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use - a shell, you need to explicitly call out to that shell. - Exit status of 0 is treated as live/healthy and non-zero is unhealthy. - type: array - items: - type: string - x-kubernetes-list-type: atomic - failureThreshold: - description: |- - Minimum consecutive failures for the probe to be considered failed after having succeeded. - Defaults to 3. Minimum value is 1. - type: integer - format: int32 - grpc: - description: GRPC specifies a GRPC HealthCheckRequest. - type: object - properties: - port: - description: Port number of the gRPC service. Number must be in the range 1 to 65535. - type: integer - format: int32 - service: - description: |- - Service is the name of the service to place in the gRPC HealthCheckRequest - (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). - - If this is not specified, the default behavior is defined by gRPC. - type: string - default: "" - httpGet: - description: HTTPGet specifies an HTTP GET request to perform. - type: object - properties: - host: - description: |- - Host name to connect to, defaults to the pod IP. You probably want to set - "Host" in httpHeaders instead. - type: string - httpHeaders: - description: Custom headers to set in the request. HTTP allows repeated headers. - type: array - items: - description: HTTPHeader describes a custom header to be used in HTTP probes - type: object - required: - - name - - value - properties: - name: - description: |- - The header field name. - This will be canonicalized upon output, so case-variant names will be understood as the same header. - type: string - value: - description: The header field value - type: string - x-kubernetes-list-type: atomic - path: - description: Path to access on the HTTP server. - type: string - port: - description: |- - Name or number of the port to access on the container. - Number must be in the range 1 to 65535. - Name must be an IANA_SVC_NAME. - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - scheme: - description: |- - Scheme to use for connecting to the host. - Defaults to HTTP. - type: string - initialDelaySeconds: - description: |- - Number of seconds after the container has started before liveness probes are initiated. - More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes - type: integer - format: int32 - periodSeconds: - description: |- - How often (in seconds) to perform the probe. - type: integer - format: int32 - successThreshold: - description: |- - Minimum consecutive successes for the probe to be considered successful after having failed. - Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. - type: integer - format: int32 - tcpSocket: - description: TCPSocket specifies a connection to a TCP port. - type: object - properties: - host: - description: 'Optional: Host name to connect to, defaults to the pod IP.' - type: string - port: - description: |- - Number or name of the port to access on the container. - Number must be in the range 1 to 65535. - Name must be an IANA_SVC_NAME. - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - timeoutSeconds: - description: |- - Number of seconds after which the probe times out. - Defaults to 1 second. Minimum value is 1. - More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes - type: integer - format: int32 - terminationMessagePath: - description: |- - Optional: Path at which the file to which the container's termination message - will be written is mounted into the container's filesystem. - Message written is intended to be brief final status, such as an assertion failure message. - Will be truncated by the node if greater than 4096 bytes. The total message length across - all containers will be limited to 12kb. - Defaults to /dev/termination-log. - Cannot be updated. - type: string - terminationMessagePolicy: - description: |- - Indicate how the termination message should be populated. File will use the contents of - terminationMessagePath to populate the container status message on both success and failure. - FallbackToLogsOnError will use the last chunk of container log output if the termination - message file is empty and the container exited with an error. - The log output is limited to 2048 bytes or 80 lines, whichever is smaller. - Defaults to File. - Cannot be updated. - type: string - volumeMounts: - description: |- - Pod volumes to mount into the container's filesystem. - Cannot be updated. - type: array - items: - description: VolumeMount describes a mounting of a Volume within a container. - type: object - required: - - mountPath - - name - properties: - mountPath: - description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. - type: string - mountPropagation: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-volumes-mount-propagation - type: string - name: - description: This must match the Name of a Volume. - type: string - readOnly: - description: |- - Mounted read-only if true, read-write otherwise (false or unspecified). - Defaults to false. - type: boolean - subPath: - description: |- - Path within the volume from which the container's volume should be mounted. - Defaults to "" (volume's root). - type: string - x-kubernetes-list-map-keys: - - mountPath - x-kubernetes-list-type: map - workingDir: - description: |- - Container's working directory. - If not specified, the container runtime's default will be used, which - might be configured in the container image. - Cannot be updated. - type: string - dnsConfig: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-dnsconfig - type: object - x-kubernetes-preserve-unknown-fields: true - dnsPolicy: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-dnspolicy - type: string - enableServiceLinks: - description: |- - EnableServiceLinks indicates whether information aboutservices should be injected into pod's environment variables, matching the syntax of Docker links. Optional: Knative defaults this to false. - type: boolean - hostAliases: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-hostaliases - type: array - items: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-hostaliases - type: object - x-kubernetes-preserve-unknown-fields: true - hostIPC: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-hostipc - type: boolean - hostNetwork: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-hostnetwork - type: boolean - hostPID: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-hostpid - type: boolean - idleTimeoutSeconds: - description: |- - IdleTimeoutSeconds is the maximum duration in seconds a request will be allowed - to stay open while not receiving any bytes from the user's application. If - unspecified, a system default will be provided. - type: integer - format: int64 - imagePullSecrets: - description: |- - ImagePullSecrets is an optional list of references to secrets in the same namespace to use for pulling any of the images used by this PodSpec. - If specified, these secrets will be passed to individual puller implementations for them to use. - More info: https://kubernetes.io/docs/concepts/containers/images#specifying-imagepullsecrets-on-a-pod - type: array - items: - description: |- - LocalObjectReference contains enough information to let you locate the - referenced object inside the same namespace. - type: object - properties: - name: - description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - default: "" - x-kubernetes-map-type: atomic - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - initContainers: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-init-containers - type: array - items: - description: This is accessible behind a feature flag - kubernetes.podspec-init-containers - type: object - x-kubernetes-preserve-unknown-fields: true - nodeSelector: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-nodeselector - type: object - additionalProperties: - type: string - x-kubernetes-map-type: atomic - priorityClassName: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-priorityclassname - type: string - responseStartTimeoutSeconds: - description: |- - ResponseStartTimeoutSeconds is the maximum duration in seconds that the request - routing layer will wait for a request delivered to a container to begin - sending any network traffic. - type: integer - format: int64 - runtimeClassName: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-runtimeclassname - type: string - schedulerName: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-schedulername - type: string - securityContext: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-securitycontext - type: object - x-kubernetes-preserve-unknown-fields: true - serviceAccountName: - description: |- - ServiceAccountName is the name of the ServiceAccount to use to run this pod. - More info: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/ - type: string - shareProcessNamespace: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-shareprocessnamespace - type: boolean - timeoutSeconds: - description: |- - TimeoutSeconds is the maximum duration in seconds that the request instance - is allowed to respond to a request. If unspecified, a system default will - be provided. - type: integer - format: int64 - tolerations: - description: This is accessible behind a feature flag - kubernetes.podspec-tolerations - type: array - items: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-tolerations - type: object - x-kubernetes-preserve-unknown-fields: true - topologySpreadConstraints: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints - type: array - items: - description: This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints - type: object - x-kubernetes-preserve-unknown-fields: true - volumes: - description: |- - List of volumes that can be mounted by containers belonging to the pod. - More info: https://kubernetes.io/docs/concepts/storage/volumes - type: array - items: - description: Volume represents a named volume in a pod that may be accessed by any container in the pod. - type: object - required: - - name - properties: - configMap: - description: configMap represents a configMap that should populate this volume - type: object - properties: - defaultMode: - description: |- - defaultMode is optional: mode bits used to set permissions on created files by default. - Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. - YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. - Defaults to 0644. - Directories within the path are not affected by this setting. - This might be in conflict with other options that affect the file - mode, like fsGroup, and the result can be other mode bits set. - type: integer - format: int32 - items: - description: |- - items if unspecified, each key-value pair in the Data field of the referenced - ConfigMap will be projected into the volume as a file whose name is the - key and content is the value. If specified, the listed keys will be - projected into the specified paths, and unlisted keys will not be - present. If a key is specified which is not present in the ConfigMap, - the volume setup will error unless it is marked optional. Paths must be - relative and may not contain the '..' path or start with '..'. - type: array - items: - description: Maps a string key to a path within a volume. - type: object - required: - - key - - path - properties: - key: - description: key is the key to project. - type: string - mode: - description: |- - mode is Optional: mode bits used to set permissions on this file. - Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. - YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. - If not specified, the volume defaultMode will be used. - This might be in conflict with other options that affect the file - mode, like fsGroup, and the result can be other mode bits set. - type: integer - format: int32 - path: - description: |- - path is the relative path of the file to map the key to. - May not be an absolute path. - May not contain the path element '..'. - May not start with the string '..'. - type: string - x-kubernetes-list-type: atomic - name: - description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - default: "" - optional: - description: optional specify whether the ConfigMap or its keys must be defined - type: boolean - x-kubernetes-map-type: atomic - csi: - description: This is accessible behind a feature flag - kubernetes.podspec-volumes-csi - type: object - x-kubernetes-preserve-unknown-fields: true - emptyDir: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-volumes-emptydir - type: object - x-kubernetes-preserve-unknown-fields: true - hostPath: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-volumes-hostpath - type: object - x-kubernetes-preserve-unknown-fields: true - image: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-volumes-image - type: object - x-kubernetes-preserve-unknown-fields: true - name: - description: |- - name of the volume. - Must be a DNS_LABEL and unique within the pod. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - persistentVolumeClaim: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-persistent-volume-claim - type: object - x-kubernetes-preserve-unknown-fields: true - projected: - description: projected items for all in one resources secrets, configmaps, and downward API - type: object - properties: - defaultMode: - description: |- - defaultMode are the mode bits used to set permissions on created files by default. - Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. - YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. - Directories within the path are not affected by this setting. - This might be in conflict with other options that affect the file - mode, like fsGroup, and the result can be other mode bits set. - type: integer - format: int32 - sources: - description: |- - sources is the list of volume projections. Each entry in this list - handles one source. - type: array - items: - description: |- - Projection that may be projected along with other supported volume types. - Exactly one of these fields must be set. - type: object - properties: - configMap: - description: configMap information about the configMap data to project - type: object - properties: - items: - description: |- - items if unspecified, each key-value pair in the Data field of the referenced - ConfigMap will be projected into the volume as a file whose name is the - key and content is the value. If specified, the listed keys will be - projected into the specified paths, and unlisted keys will not be - present. If a key is specified which is not present in the ConfigMap, - the volume setup will error unless it is marked optional. Paths must be - relative and may not contain the '..' path or start with '..'. - type: array - items: - description: Maps a string key to a path within a volume. - type: object - required: - - key - - path - properties: - key: - description: key is the key to project. - type: string - mode: - description: |- - mode is Optional: mode bits used to set permissions on this file. - Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. - YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. - If not specified, the volume defaultMode will be used. - This might be in conflict with other options that affect the file - mode, like fsGroup, and the result can be other mode bits set. - type: integer - format: int32 - path: - description: |- - path is the relative path of the file to map the key to. - May not be an absolute path. - May not contain the path element '..'. - May not start with the string '..'. - type: string - x-kubernetes-list-type: atomic - name: - description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - default: "" - optional: - description: optional specify whether the ConfigMap or its keys must be defined - type: boolean - x-kubernetes-map-type: atomic - downwardAPI: - description: downwardAPI information about the downwardAPI data to project - type: object - properties: - items: - description: Items is a list of DownwardAPIVolume file - type: array - items: - description: DownwardAPIVolumeFile represents information to create the file containing the pod field - type: object - required: - - path - properties: - fieldRef: - description: 'Required: Selects a field of the pod: only annotations, labels, name, namespace and uid are supported.' - type: object - required: - - fieldPath - properties: - apiVersion: - description: Version of the schema the FieldPath is written in terms of, defaults to "v1". - type: string - fieldPath: - description: Path of the field to select in the specified API version. - type: string - x-kubernetes-map-type: atomic - mode: - description: |- - Optional: mode bits used to set permissions on this file, must be an octal value - between 0000 and 0777 or a decimal value between 0 and 511. - YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. - If not specified, the volume defaultMode will be used. - This might be in conflict with other options that affect the file - mode, like fsGroup, and the result can be other mode bits set. - type: integer - format: int32 - path: - description: 'Required: Path is the relative path name of the file to be created. Must not be absolute or contain the ''..'' path. Must be utf-8 encoded. The first item of the relative path must not start with ''..''' - type: string - resourceFieldRef: - description: |- - Selects a resource of the container: only resources limits and requests - (limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported. - type: object - required: - - resource - properties: - containerName: - description: 'Container name: required for volumes, optional for env vars' - type: string - divisor: - description: Specifies the output format of the exposed resources, defaults to "1" - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - resource: - description: 'Required: resource to select' - type: string - x-kubernetes-map-type: atomic - x-kubernetes-list-type: atomic - secret: - description: secret information about the secret data to project - type: object - properties: - items: - description: |- - items if unspecified, each key-value pair in the Data field of the referenced - Secret will be projected into the volume as a file whose name is the - key and content is the value. If specified, the listed keys will be - projected into the specified paths, and unlisted keys will not be - present. If a key is specified which is not present in the Secret, - the volume setup will error unless it is marked optional. Paths must be - relative and may not contain the '..' path or start with '..'. - type: array - items: - description: Maps a string key to a path within a volume. - type: object - required: - - key - - path - properties: - key: - description: key is the key to project. - type: string - mode: - description: |- - mode is Optional: mode bits used to set permissions on this file. - Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. - YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. - If not specified, the volume defaultMode will be used. - This might be in conflict with other options that affect the file - mode, like fsGroup, and the result can be other mode bits set. - type: integer - format: int32 - path: - description: |- - path is the relative path of the file to map the key to. - May not be an absolute path. - May not contain the path element '..'. - May not start with the string '..'. - type: string - x-kubernetes-list-type: atomic - name: - description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - default: "" - optional: - description: optional field specify whether the Secret or its key must be defined - type: boolean - x-kubernetes-map-type: atomic - serviceAccountToken: - description: serviceAccountToken is information about the serviceAccountToken data to project - type: object - required: - - path - properties: - audience: - description: |- - audience is the intended audience of the token. A recipient of a token - must identify itself with an identifier specified in the audience of the - token, and otherwise should reject the token. The audience defaults to the - identifier of the apiserver. - type: string - expirationSeconds: - description: |- - expirationSeconds is the requested duration of validity of the service - account token. As the token approaches expiration, the kubelet volume - plugin will proactively rotate the service account token. The kubelet will - start trying to rotate the token if the token is older than 80 percent of - its time to live or if the token is older than 24 hours.Defaults to 1 hour - and must be at least 10 minutes. - type: integer - format: int64 - path: - description: |- - path is the path relative to the mount point of the file to project the - token into. - type: string - x-kubernetes-list-type: atomic - secret: - description: |- - secret represents a secret that should populate this volume. - More info: https://kubernetes.io/docs/concepts/storage/volumes#secret - type: object - properties: - defaultMode: - description: |- - defaultMode is Optional: mode bits used to set permissions on created files by default. - Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. - YAML accepts both octal and decimal values, JSON requires decimal values - for mode bits. Defaults to 0644. - Directories within the path are not affected by this setting. - This might be in conflict with other options that affect the file - mode, like fsGroup, and the result can be other mode bits set. - type: integer - format: int32 - items: - description: |- - items If unspecified, each key-value pair in the Data field of the referenced - Secret will be projected into the volume as a file whose name is the - key and content is the value. If specified, the listed keys will be - projected into the specified paths, and unlisted keys will not be - present. If a key is specified which is not present in the Secret, - the volume setup will error unless it is marked optional. Paths must be - relative and may not contain the '..' path or start with '..'. - type: array - items: - description: Maps a string key to a path within a volume. - type: object - required: - - key - - path - properties: - key: - description: key is the key to project. - type: string - mode: - description: |- - mode is Optional: mode bits used to set permissions on this file. - Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. - YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. - If not specified, the volume defaultMode will be used. - This might be in conflict with other options that affect the file - mode, like fsGroup, and the result can be other mode bits set. - type: integer - format: int32 - path: - description: |- - path is the relative path of the file to map the key to. - May not be an absolute path. - May not contain the path element '..'. - May not start with the string '..'. - type: string - x-kubernetes-list-type: atomic - optional: - description: optional field specify whether the Secret or its keys must be defined - type: boolean - secretName: - description: |- - secretName is the name of the secret in the pod's namespace to use. - More info: https://kubernetes.io/docs/concepts/storage/volumes#secret - type: string - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - status: - description: ConfigurationStatus communicates the observed state of the Configuration (from the controller). - type: object - properties: - annotations: - description: |- - Annotations is additional Status fields for the Resource to save some - additional State as well as convey more information to the user. This is - roughly akin to Annotations on any k8s resource, just the reconciler conveying - richer information outwards. - type: object - additionalProperties: - type: string - conditions: - description: Conditions the latest available observations of a resource's current state. - type: array - items: - description: |- - Condition defines a readiness condition for a Knative resource. - See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties - type: object - required: - - status - - type - properties: - lastTransitionTime: - description: |- - LastTransitionTime is the last time the condition transitioned from one status to another. - We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic - differences (all other things held constant). - type: string - message: - description: A human readable message indicating details about the transition. - type: string - reason: - description: The reason for the condition's last transition. - type: string - severity: - description: |- - Severity with which to treat failures of this type of condition. - When this is not specified, it defaults to Error. - type: string - status: - description: Status of the condition, one of True, False, Unknown. - type: string - type: - description: Type of condition. - type: string - latestCreatedRevisionName: - description: |- - LatestCreatedRevisionName is the last revision that was created from this - Configuration. It might not be ready yet, for that use LatestReadyRevisionName. - type: string - latestReadyRevisionName: - description: |- - LatestReadyRevisionName holds the name of the latest Revision stamped out - from this Configuration that has had its "Ready" condition become "True". - type: string - observedGeneration: - description: |- - ObservedGeneration is the 'Generation' of the Service that - was last processed by the controller. - type: integer - format: int64 ---- -# Copyright 2020 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - name: clusterdomainclaims.networking.internal.knative.dev - labels: - app.kubernetes.io/name: knative-serving - app.kubernetes.io/component: networking - app.kubernetes.io/version: "1.22.1" - knative.dev/crd-install: "true" -spec: - group: networking.internal.knative.dev - versions: - - name: v1alpha1 - served: true - storage: true - subresources: - status: {} - schema: - openAPIV3Schema: - description: ClusterDomainClaim is a cluster-wide reservation for a particular domain name. - type: object - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: |- - Spec is the desired state of the ClusterDomainClaim. - More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status - type: object - required: - - namespace - properties: - namespace: - description: |- - Namespace is the namespace which is allowed to create a DomainMapping - using this ClusterDomainClaim's name. - type: string - names: - kind: ClusterDomainClaim - plural: clusterdomainclaims - singular: clusterdomainclaim - categories: - - knative-internal - - networking - shortNames: - - cdc - scope: Cluster ---- -# Copyright 2020 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - name: domainmappings.serving.knative.dev - labels: - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" - knative.dev/crd-install: "true" -spec: - group: serving.knative.dev - versions: - - name: v1beta1 - served: true - storage: true - subresources: - status: {} - additionalPrinterColumns: - - name: URL - type: string - jsonPath: .status.url - - name: Ready - type: string - jsonPath: ".status.conditions[?(@.type=='Ready')].status" - - name: Reason - type: string - jsonPath: ".status.conditions[?(@.type=='Ready')].reason" - "schema": - "openAPIV3Schema": - description: DomainMapping is a mapping from a custom hostname to an Addressable. - type: object - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: |- - Spec is the desired state of the DomainMapping. - More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status - type: object - required: - - ref - properties: - ref: - description: |- - Ref specifies the target of the Domain Mapping. - - The object identified by the Ref must be an Addressable with a URL of the - form `{name}.{namespace}.{domain}` where `{domain}` is the cluster domain, - and `{name}` and `{namespace}` are the name and namespace of a Kubernetes - Service. - - This contract is satisfied by Knative types such as Knative Services and - Knative Routes, and by Kubernetes Services. - type: object - required: - - kind - - name - properties: - address: - description: Address points to a specific Address Name. - type: string - apiVersion: - description: API version of the referent. - type: string - group: - description: |- - Group of the API, without the version of the group. This can be used as an alternative to the APIVersion, and then resolved using ResolveGroup. - Note: This API is EXPERIMENTAL and might break anytime. For more details: https://github.com/knative/eventing/issues/5086 - type: string - kind: - description: |- - Kind of the referent. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - name: - description: |- - Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - namespace: - description: |- - Namespace of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ - This is optional field, it gets defaulted to the object holding it if left out. - type: string - tls: - description: TLS allows the DomainMapping to terminate TLS traffic with an existing secret. - type: object - required: - - secretName - properties: - secretName: - description: SecretName is the name of the existing secret used to terminate TLS traffic. - type: string - status: - description: |- - Status is the current state of the DomainMapping. - More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status - type: object - properties: - address: - description: Address holds the information needed for a DomainMapping to be the target of an event. - type: object - properties: - CACerts: - description: |- - CACerts is the Certification Authority (CA) certificates in PEM format - according to https://www.rfc-editor.org/rfc/rfc7468. - type: string - audience: - description: Audience is the OIDC audience for this address. - type: string - name: - description: Name is the name of the address. - type: string - url: - type: string - annotations: - description: |- - Annotations is additional Status fields for the Resource to save some - additional State as well as convey more information to the user. This is - roughly akin to Annotations on any k8s resource, just the reconciler conveying - richer information outwards. - type: object - additionalProperties: - type: string - conditions: - description: Conditions the latest available observations of a resource's current state. - type: array - items: - description: |- - Condition defines a readiness condition for a Knative resource. - See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties - type: object - required: - - status - - type - properties: - lastTransitionTime: - description: |- - LastTransitionTime is the last time the condition transitioned from one status to another. - We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic - differences (all other things held constant). - type: string - message: - description: A human readable message indicating details about the transition. - type: string - reason: - description: The reason for the condition's last transition. - type: string - severity: - description: |- - Severity with which to treat failures of this type of condition. - When this is not specified, it defaults to Error. - type: string - status: - description: Status of the condition, one of True, False, Unknown. - type: string - type: - description: Type of condition. - type: string - observedGeneration: - description: |- - ObservedGeneration is the 'Generation' of the Service that - was last processed by the controller. - type: integer - format: int64 - url: - description: URL is the URL of this DomainMapping. - type: string - names: - kind: DomainMapping - plural: domainmappings - singular: domainmapping - categories: - - all - - knative - - serving - shortNames: - - dm - scope: Namespaced ---- -# Copyright 2020 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - name: ingresses.networking.internal.knative.dev - labels: - app.kubernetes.io/name: knative-serving - app.kubernetes.io/component: networking - app.kubernetes.io/version: "1.22.1" - knative.dev/crd-install: "true" -spec: - group: networking.internal.knative.dev - versions: - - name: v1alpha1 - served: true - storage: true - subresources: - status: {} - schema: - openAPIV3Schema: - description: |- - Ingress is a collection of rules that allow inbound connections to reach the endpoints defined - by a backend. An Ingress can be configured to give services externally-reachable URLs, load - balance traffic, offer name based virtual hosting, etc. - - This is heavily based on K8s Ingress https://godoc.org/k8s.io/api/networking/v1beta1#Ingress - which some highlighted modifications. - type: object - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: |- - Spec is the desired state of the Ingress. - More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status - type: object - properties: - httpOption: - description: |- - HTTPOption is the option of HTTP. It has the following two values: - `HTTPOptionEnabled`, `HTTPOptionRedirected` - type: string - rules: - description: A list of host rules used to configure the Ingress. - type: array - items: - description: |- - IngressRule represents the rules mapping the paths under a specified host to - the related backend services. Incoming requests are first evaluated for a host - match, then routed to the backend associated with the matching IngressRuleValue. - type: object - properties: - hosts: - description: |- - Host is the fully qualified domain name of a network host, as defined - by RFC 3986. Note the following deviations from the "host" part of the - URI as defined in the RFC: - 1. IPs are not allowed. Currently a rule value can only apply to the - IP in the Spec of the parent . - 2. The `:` delimiter is not respected because ports are not allowed. - Currently the port of an Ingress is implicitly :80 for http and - :443 for https. - Both these may change in the future. - If the host is unspecified, the Ingress routes all traffic based on the - specified IngressRuleValue. - If multiple matching Hosts were provided, the first rule will take precedent. - type: array - items: - type: string - http: - description: |- - HTTP represents a rule to apply against incoming requests. If the - rule is satisfied, the request is routed to the specified backend. - type: object - required: - - paths - properties: - paths: - description: |- - A collection of paths that map requests to backends. - - If they are multiple matching paths, the first match takes precedence. - type: array - items: - description: |- - HTTPIngressPath associates a path regex with a backend. Incoming URLs matching - the path are forwarded to the backend. - type: object - required: - - splits - properties: - appendHeaders: - description: |- - AppendHeaders allow specifying additional HTTP headers to add - before forwarding a request to the destination service. - - NOTE: This differs from K8s Ingress which doesn't allow header appending. - type: object - additionalProperties: - type: string - headers: - description: |- - Headers defines header matching rules which is a map from a header name - to HeaderMatch which specify a matching condition. - When a request matched with all the header matching rules, - the request is routed by the corresponding ingress rule. - If it is empty, the headers are not used for matching - type: object - additionalProperties: - description: |- - HeaderMatch represents a matching value of Headers in HTTPIngressPath. - Currently, only the exact matching is supported. - type: object - required: - - exact - properties: - exact: - type: string - path: - description: |- - Path represents a literal prefix to which this rule should apply. - Currently it can contain characters disallowed from the conventional - "path" part of a URL as defined by RFC 3986. Paths must begin with - a '/'. If unspecified, the path defaults to a catch all sending - traffic to the backend. - type: string - rewriteHost: - description: |- - RewriteHost rewrites the incoming request's host header. - - This field is currently experimental and not supported by all Ingress - implementations. - type: string - splits: - description: |- - Splits defines the referenced service endpoints to which the traffic - will be forwarded to. - type: array - items: - description: IngressBackendSplit describes all endpoints for a given service and port. - type: object - required: - - serviceName - - serviceNamespace - - servicePort - properties: - appendHeaders: - description: |- - AppendHeaders allow specifying additional HTTP headers to add - before forwarding a request to the destination service. - - NOTE: This differs from K8s Ingress which doesn't allow header appending. - type: object - additionalProperties: - type: string - percent: - description: |- - Specifies the split percentage, a number between 0 and 100. If - only one split is specified, we default to 100. - - NOTE: This differs from K8s Ingress to allow percentage split. - type: integer - serviceName: - description: Specifies the name of the referenced service. - type: string - serviceNamespace: - description: |- - Specifies the namespace of the referenced service. - - NOTE: This differs from K8s Ingress to allow routing to different namespaces. - type: string - servicePort: - description: Specifies the port of the referenced service. - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - visibility: - description: |- - Visibility signifies whether this rule should `ClusterLocal`. If it's not - specified then it defaults to `ExternalIP`. - type: string - tls: - description: |- - TLS configuration. Currently Ingress only supports a single TLS - port: 443. If multiple members of this list specify different hosts, they - will be multiplexed on the same port according to the hostname specified - through the SNI TLS extension, if the ingress controller fulfilling the - ingress supports SNI. - type: array - items: - description: IngressTLS describes the transport layer security associated with an Ingress. - type: object - properties: - hosts: - description: |- - Hosts is a list of hosts included in the TLS certificate. The values in - this list must match the name/s used in the tlsSecret. Defaults to the - wildcard host setting for the loadbalancer controller fulfilling this - Ingress, if left unspecified. - type: array - items: - type: string - secretName: - description: SecretName is the name of the secret used to terminate SSL traffic. - type: string - secretNamespace: - description: |- - SecretNamespace is the namespace of the secret used to terminate SSL traffic. - If not set the namespace should be assumed to be the same as the Ingress. - If set the secret should have the same namespace as the Ingress otherwise - the behaviour is undefined and not supported. - type: string - status: - description: |- - Status is the current state of the Ingress. - More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status - type: object - properties: - annotations: - description: |- - Annotations is additional Status fields for the Resource to save some - additional State as well as convey more information to the user. This is - roughly akin to Annotations on any k8s resource, just the reconciler conveying - richer information outwards. - type: object - additionalProperties: - type: string - conditions: - description: Conditions the latest available observations of a resource's current state. - type: array - items: - description: |- - Condition defines a readiness condition for a Knative resource. - See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties - type: object - required: - - status - - type - properties: - lastTransitionTime: - description: |- - LastTransitionTime is the last time the condition transitioned from one status to another. - We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic - differences (all other things held constant). - type: string - message: - description: A human readable message indicating details about the transition. - type: string - reason: - description: The reason for the condition's last transition. - type: string - severity: - description: |- - Severity with which to treat failures of this type of condition. - When this is not specified, it defaults to Error. - type: string - status: - description: Status of the condition, one of True, False, Unknown. - type: string - type: - description: Type of condition. - type: string - observedGeneration: - description: |- - ObservedGeneration is the 'Generation' of the Service that - was last processed by the controller. - type: integer - format: int64 - privateLoadBalancer: - description: PrivateLoadBalancer contains the current status of the load-balancer. - type: object - properties: - ingress: - description: |- - Ingress is a list containing ingress points for the load-balancer. - Traffic intended for the service should be sent to these ingress points. - type: array - items: - description: |- - LoadBalancerIngressStatus represents the status of a load-balancer ingress point: - traffic intended for the service should be sent to an ingress point. - type: object - properties: - domain: - description: |- - Domain is set for load-balancer ingress points that are DNS based - (typically AWS load-balancers) - type: string - domainInternal: - description: |- - DomainInternal is set if there is a cluster-local DNS name to access the Ingress. - - NOTE: This differs from K8s Ingress, since we also desire to have a cluster-local - DNS name to allow routing in case of not having a mesh. - type: string - ip: - description: |- - IP is set for load-balancer ingress points that are IP based - (typically GCE or OpenStack load-balancers) - type: string - meshOnly: - description: MeshOnly is set if the Ingress is only load-balanced through a Service mesh. - type: boolean - publicLoadBalancer: - description: PublicLoadBalancer contains the current status of the load-balancer. - type: object - properties: - ingress: - description: |- - Ingress is a list containing ingress points for the load-balancer. - Traffic intended for the service should be sent to these ingress points. - type: array - items: - description: |- - LoadBalancerIngressStatus represents the status of a load-balancer ingress point: - traffic intended for the service should be sent to an ingress point. - type: object - properties: - domain: - description: |- - Domain is set for load-balancer ingress points that are DNS based - (typically AWS load-balancers) - type: string - domainInternal: - description: |- - DomainInternal is set if there is a cluster-local DNS name to access the Ingress. - - NOTE: This differs from K8s Ingress, since we also desire to have a cluster-local - DNS name to allow routing in case of not having a mesh. - type: string - ip: - description: |- - IP is set for load-balancer ingress points that are IP based - (typically GCE or OpenStack load-balancers) - type: string - meshOnly: - description: MeshOnly is set if the Ingress is only load-balanced through a Service mesh. - type: boolean - additionalPrinterColumns: - - name: Ready - type: string - jsonPath: ".status.conditions[?(@.type=='Ready')].status" - - name: Reason - type: string - jsonPath: ".status.conditions[?(@.type=='Ready')].reason" - names: - kind: Ingress - plural: ingresses - singular: ingress - categories: - - knative-internal - - networking - shortNames: - - kingress - - king - scope: Namespaced ---- -# Copyright 2019 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -# Note: The schema part of the spec is auto-generated by hack/update-schemas.sh. - -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - name: metrics.autoscaling.internal.knative.dev - labels: - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" - knative.dev/crd-install: "true" -spec: - group: autoscaling.internal.knative.dev - names: - kind: Metric - plural: metrics - singular: metric - categories: - - knative-internal - - autoscaling - scope: Namespaced - versions: - - name: v1alpha1 - served: true - storage: true - subresources: - status: {} - additionalPrinterColumns: - - name: Ready - type: string - jsonPath: ".status.conditions[?(@.type=='Ready')].status" - - name: Reason - type: string - jsonPath: ".status.conditions[?(@.type=='Ready')].reason" - schema: - openAPIV3Schema: - description: Metric represents a resource to configure the metric collector with. - type: object - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: Spec holds the desired state of the Metric (from the client). - type: object - required: - - panicWindow - - scrapeTarget - - stableWindow - properties: - panicWindow: - description: PanicWindow is the aggregation window for metrics where quick reactions are needed. - type: integer - format: int64 - scrapeTarget: - description: ScrapeTarget is the K8s service that publishes the metric endpoint. - type: string - stableWindow: - description: StableWindow is the aggregation window for metrics in a stable state. - type: integer - format: int64 - status: - description: Status communicates the observed state of the Metric (from the controller). - type: object - properties: - annotations: - description: |- - Annotations is additional Status fields for the Resource to save some - additional State as well as convey more information to the user. This is - roughly akin to Annotations on any k8s resource, just the reconciler conveying - richer information outwards. - type: object - additionalProperties: - type: string - conditions: - description: Conditions the latest available observations of a resource's current state. - type: array - items: - description: |- - Condition defines a readiness condition for a Knative resource. - See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties - type: object - required: - - status - - type - properties: - lastTransitionTime: - description: |- - LastTransitionTime is the last time the condition transitioned from one status to another. - We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic - differences (all other things held constant). - type: string - message: - description: A human readable message indicating details about the transition. - type: string - reason: - description: The reason for the condition's last transition. - type: string - severity: - description: |- - Severity with which to treat failures of this type of condition. - When this is not specified, it defaults to Error. - type: string - status: - description: Status of the condition, one of True, False, Unknown. - type: string - type: - description: Type of condition. - type: string - observedGeneration: - description: |- - ObservedGeneration is the 'Generation' of the Service that - was last processed by the controller. - type: integer - format: int64 ---- -# Copyright 2018 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -# Note: The schema part of the spec is auto-generated by hack/update-schemas.sh. - -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - name: podautoscalers.autoscaling.internal.knative.dev - labels: - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" - knative.dev/crd-install: "true" -spec: - group: autoscaling.internal.knative.dev - names: - kind: PodAutoscaler - plural: podautoscalers - singular: podautoscaler - categories: - - knative-internal - - autoscaling - shortNames: - - kpa - - pa - scope: Namespaced - versions: - - name: v1alpha1 - served: true - storage: true - subresources: - status: {} - additionalPrinterColumns: - - name: DesiredScale - type: integer - jsonPath: ".status.desiredScale" - - name: ActualScale - type: integer - jsonPath: ".status.actualScale" - - name: Ready - type: string - jsonPath: ".status.conditions[?(@.type=='Ready')].status" - - name: Reason - type: string - jsonPath: ".status.conditions[?(@.type=='Ready')].reason" - schema: - openAPIV3Schema: - description: |- - PodAutoscaler is a Knative abstraction that encapsulates the interface by which Knative - components instantiate autoscalers. This definition is an abstraction that may be backed - by multiple definitions. For more information, see the Knative Pluggability presentation: - https://docs.google.com/presentation/d/19vW9HFZ6Puxt31biNZF3uLRejDmu82rxJIk1cWmxF7w/edit - type: object - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: Spec holds the desired state of the PodAutoscaler (from the client). - type: object - required: - - protocolType - - scaleTargetRef - properties: - containerConcurrency: - description: |- - ContainerConcurrency specifies the maximum allowed - in-flight (concurrent) requests per container of the Revision. - Defaults to `0` which means unlimited concurrency. - type: integer - format: int64 - protocolType: - description: The application-layer protocol. Matches `ProtocolType` inferred from the revision spec. - type: string - reachability: - description: |- - Reachability specifies whether or not the `ScaleTargetRef` can be reached (ie. has a route). - Defaults to `ReachabilityUnknown` - type: string - scaleTargetRef: - description: |- - ScaleTargetRef defines the /scale-able resource that this PodAutoscaler - is responsible for quickly right-sizing. - type: object - properties: - apiVersion: - description: API version of the referent. - type: string - kind: - description: |- - Kind of the referent. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - name: - description: |- - Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - x-kubernetes-map-type: atomic - status: - description: Status communicates the observed state of the PodAutoscaler (from the controller). - type: object - required: - - metricsServiceName - - serviceName - properties: - actualScale: - description: ActualScale shows the actual number of replicas for the revision. - type: integer - format: int32 - annotations: - description: |- - Annotations is additional Status fields for the Resource to save some - additional State as well as convey more information to the user. This is - roughly akin to Annotations on any k8s resource, just the reconciler conveying - richer information outwards. - type: object - additionalProperties: - type: string - conditions: - description: Conditions the latest available observations of a resource's current state. - type: array - items: - description: |- - Condition defines a readiness condition for a Knative resource. - See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties - type: object - required: - - status - - type - properties: - lastTransitionTime: - description: |- - LastTransitionTime is the last time the condition transitioned from one status to another. - We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic - differences (all other things held constant). - type: string - message: - description: A human readable message indicating details about the transition. - type: string - reason: - description: The reason for the condition's last transition. - type: string - severity: - description: |- - Severity with which to treat failures of this type of condition. - When this is not specified, it defaults to Error. - type: string - status: - description: Status of the condition, one of True, False, Unknown. - type: string - type: - description: Type of condition. - type: string - desiredScale: - description: DesiredScale shows the current desired number of replicas for the revision. - type: integer - format: int32 - metricsServiceName: - description: |- - MetricsServiceName is the K8s Service name that provides revision metrics. - The service is managed by the PA object. - type: string - observedGeneration: - description: |- - ObservedGeneration is the 'Generation' of the Service that - was last processed by the controller. - type: integer - format: int64 - serviceName: - description: |- - ServiceName is the K8s Service name that serves the revision, scaled by this PA. - The service is created and owned by the ServerlessService object owned by this PA. - type: string ---- -# Copyright 2019 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -# Note: The schema part of the spec is auto-generated by hack/update-schemas.sh. - -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - name: revisions.serving.knative.dev - labels: - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" - knative.dev/crd-install: "true" -spec: - group: serving.knative.dev - names: - kind: Revision - plural: revisions - singular: revision - categories: - - all - - knative - - serving - shortNames: - - rev - scope: Namespaced - versions: - - name: v1 - served: true - storage: true - subresources: - status: {} - additionalPrinterColumns: - - name: Config Name - type: string - jsonPath: ".metadata.labels['serving\\.knative\\.dev/configuration']" - - name: Generation - type: string # int in string form :( - jsonPath: ".metadata.labels['serving\\.knative\\.dev/configurationGeneration']" - - name: Ready - type: string - jsonPath: ".status.conditions[?(@.type=='Ready')].status" - - name: Reason - type: string - jsonPath: ".status.conditions[?(@.type=='Ready')].reason" - - name: Actual Replicas - type: integer - jsonPath: ".status.actualReplicas" - - name: Desired Replicas - type: integer - jsonPath: ".status.desiredReplicas" - schema: - openAPIV3Schema: - description: |- - Revision is an immutable snapshot of code and configuration. A revision - references a container image. Revisions are created by updates to a - Configuration. - - See also: https://github.com/knative/serving/blob/main/docs/spec/overview.md#revision - type: object - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: RevisionSpec holds the desired state of the Revision (from the client). - type: object - required: - - containers - properties: - affinity: - description: This is accessible behind a feature flag - kubernetes.podspec-affinity - type: object - x-kubernetes-preserve-unknown-fields: true - automountServiceAccountToken: - description: AutomountServiceAccountToken indicates whether a service account token should be automatically mounted. - type: boolean - containerConcurrency: - description: |- - ContainerConcurrency specifies the maximum allowed in-flight (concurrent) - requests per container of the Revision. Defaults to `0` which means - concurrency to the application is not limited, and the system decides the - target concurrency for the autoscaler. - type: integer - format: int64 - containers: - description: |- - List of containers belonging to the pod. - Containers cannot currently be added or removed. - There must be at least one container in a Pod. - Cannot be updated. - type: array - items: - description: A single application container that you want to run within a pod. - type: object - properties: - args: - description: |- - Arguments to the entrypoint. - The container image's CMD is used if this is not provided. - Variable references $(VAR_NAME) are expanded using the container's environment. If a variable - cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced - to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will - produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless - of whether the variable exists or not. Cannot be updated. - More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell - type: array - items: - type: string - x-kubernetes-list-type: atomic - command: - description: |- - Entrypoint array. Not executed within a shell. - The container image's ENTRYPOINT is used if this is not provided. - Variable references $(VAR_NAME) are expanded using the container's environment. If a variable - cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced - to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will - produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless - of whether the variable exists or not. Cannot be updated. - More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell - type: array - items: - type: string - x-kubernetes-list-type: atomic - env: - description: |- - List of environment variables to set in the container. - Cannot be updated. - type: array - items: - description: EnvVar represents an environment variable present in a Container. - type: object - required: - - name - properties: - name: - description: |- - Name of the environment variable. - May consist of any printable ASCII characters except '='. - type: string - value: - description: |- - Variable references $(VAR_NAME) are expanded - using the previously defined environment variables in the container and - any service environment variables. If a variable cannot be resolved, - the reference in the input string will be unchanged. Double $$ are reduced - to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. - "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". - Escaped references will never be expanded, regardless of whether the variable - exists or not. - Defaults to "". - type: string - valueFrom: - description: Source for the environment variable's value. Cannot be used if value is not empty. - type: object - properties: - configMapKeyRef: - description: Selects a key of a ConfigMap. - type: object - required: - - key - properties: - key: - description: The key to select. - type: string - name: - description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - default: "" - optional: - description: Specify whether the ConfigMap or its key must be defined - type: boolean - x-kubernetes-map-type: atomic - fieldRef: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-fieldref - type: object - x-kubernetes-map-type: atomic - x-kubernetes-preserve-unknown-fields: true - resourceFieldRef: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-fieldref - type: object - x-kubernetes-map-type: atomic - x-kubernetes-preserve-unknown-fields: true - secretKeyRef: - description: Selects a key of a secret in the pod's namespace - type: object - required: - - key - properties: - key: - description: The key of the secret to select from. Must be a valid secret key. - type: string - name: - description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - default: "" - optional: - description: Specify whether the Secret or its key must be defined - type: boolean - x-kubernetes-map-type: atomic - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - envFrom: - description: |- - List of sources to populate environment variables in the container. - The keys defined within a source may consist of any printable ASCII characters except '='. - When a key exists in multiple - sources, the value associated with the last source will take precedence. - Values defined by an Env with a duplicate key will take precedence. - Cannot be updated. - type: array - items: - description: EnvFromSource represents the source of a set of ConfigMaps or Secrets - type: object - properties: - configMapRef: - description: The ConfigMap to select from - type: object - properties: - name: - description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - default: "" - optional: - description: Specify whether the ConfigMap must be defined - type: boolean - x-kubernetes-map-type: atomic - prefix: - description: |- - Optional text to prepend to the name of each environment variable. - May consist of any printable ASCII characters except '='. - type: string - secretRef: - description: The Secret to select from - type: object - properties: - name: - description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - default: "" - optional: - description: Specify whether the Secret must be defined - type: boolean - x-kubernetes-map-type: atomic - x-kubernetes-list-type: atomic - image: - description: |- - Container image name. - More info: https://kubernetes.io/docs/concepts/containers/images - This field is optional to allow higher level config management to default or override - container images in workload controllers like Deployments and StatefulSets. - type: string - imagePullPolicy: - description: |- - Image pull policy. - One of Always, Never, IfNotPresent. - Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. - Cannot be updated. - More info: https://kubernetes.io/docs/concepts/containers/images#updating-images - type: string - livenessProbe: - description: |- - Periodic probe of container liveness. - Container will be restarted if the probe fails. - Cannot be updated. - More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes - type: object - properties: - exec: - description: Exec specifies a command to execute in the container. - type: object - properties: - command: - description: |- - Command is the command line to execute inside the container, the working directory for the - command is root ('/') in the container's filesystem. The command is simply exec'd, it is - not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use - a shell, you need to explicitly call out to that shell. - Exit status of 0 is treated as live/healthy and non-zero is unhealthy. - type: array - items: - type: string - x-kubernetes-list-type: atomic - failureThreshold: - description: |- - Minimum consecutive failures for the probe to be considered failed after having succeeded. - Defaults to 3. Minimum value is 1. - type: integer - format: int32 - grpc: - description: GRPC specifies a GRPC HealthCheckRequest. - type: object - properties: - port: - description: Port number of the gRPC service. Number must be in the range 1 to 65535. - type: integer - format: int32 - service: - description: |- - Service is the name of the service to place in the gRPC HealthCheckRequest - (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). - - If this is not specified, the default behavior is defined by gRPC. - type: string - default: "" - httpGet: - description: HTTPGet specifies an HTTP GET request to perform. - type: object - properties: - host: - description: |- - Host name to connect to, defaults to the pod IP. You probably want to set - "Host" in httpHeaders instead. - type: string - httpHeaders: - description: Custom headers to set in the request. HTTP allows repeated headers. - type: array - items: - description: HTTPHeader describes a custom header to be used in HTTP probes - type: object - required: - - name - - value - properties: - name: - description: |- - The header field name. - This will be canonicalized upon output, so case-variant names will be understood as the same header. - type: string - value: - description: The header field value - type: string - x-kubernetes-list-type: atomic - path: - description: Path to access on the HTTP server. - type: string - port: - description: |- - Name or number of the port to access on the container. - Number must be in the range 1 to 65535. - Name must be an IANA_SVC_NAME. - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - scheme: - description: |- - Scheme to use for connecting to the host. - Defaults to HTTP. - type: string - initialDelaySeconds: - description: |- - Number of seconds after the container has started before liveness probes are initiated. - More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes - type: integer - format: int32 - periodSeconds: - description: |- - How often (in seconds) to perform the probe. - type: integer - format: int32 - successThreshold: - description: |- - Minimum consecutive successes for the probe to be considered successful after having failed. - Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. - type: integer - format: int32 - tcpSocket: - description: TCPSocket specifies a connection to a TCP port. - type: object - properties: - host: - description: 'Optional: Host name to connect to, defaults to the pod IP.' - type: string - port: - description: |- - Number or name of the port to access on the container. - Number must be in the range 1 to 65535. - Name must be an IANA_SVC_NAME. - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - timeoutSeconds: - description: |- - Number of seconds after which the probe times out. - Defaults to 1 second. Minimum value is 1. - More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes - type: integer - format: int32 - name: - description: |- - Name of the container specified as a DNS_LABEL. - Each container in a pod must have a unique name (DNS_LABEL). - Cannot be updated. - type: string - ports: - description: |- - List of ports to expose from the container. Not specifying a port here - DOES NOT prevent that port from being exposed. Any port which is - listening on the default "0.0.0.0" address inside a container will be - accessible from the network. - Modifying this array with strategic merge patch may corrupt the data. - For more information See https://github.com/kubernetes/kubernetes/issues/108255. - Cannot be updated. - type: array - items: - description: ContainerPort represents a network port in a single container. - type: object - properties: - containerPort: - description: |- - Number of port to expose on the pod's IP address. - This must be a valid port number, 0 < x < 65536. - type: integer - format: int32 - name: - description: |- - If specified, this must be an IANA_SVC_NAME and unique within the pod. Each - named port in a pod must have a unique name. Name for the port that can be - referred to by services. - type: string - protocol: - description: |- - Protocol for port. Must be UDP, TCP, or SCTP. - Defaults to "TCP". - type: string - default: TCP - readinessProbe: - description: |- - Periodic probe of container service readiness. - Container will be removed from service endpoints if the probe fails. - Cannot be updated. - More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes - type: object - properties: - exec: - description: Exec specifies a command to execute in the container. - type: object - properties: - command: - description: |- - Command is the command line to execute inside the container, the working directory for the - command is root ('/') in the container's filesystem. The command is simply exec'd, it is - not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use - a shell, you need to explicitly call out to that shell. - Exit status of 0 is treated as live/healthy and non-zero is unhealthy. - type: array - items: - type: string - x-kubernetes-list-type: atomic - failureThreshold: - description: |- - Minimum consecutive failures for the probe to be considered failed after having succeeded. - Defaults to 3. Minimum value is 1. - type: integer - format: int32 - grpc: - description: GRPC specifies a GRPC HealthCheckRequest. - type: object - properties: - port: - description: Port number of the gRPC service. Number must be in the range 1 to 65535. - type: integer - format: int32 - service: - description: |- - Service is the name of the service to place in the gRPC HealthCheckRequest - (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). - - If this is not specified, the default behavior is defined by gRPC. - type: string - default: "" - httpGet: - description: HTTPGet specifies an HTTP GET request to perform. - type: object - properties: - host: - description: |- - Host name to connect to, defaults to the pod IP. You probably want to set - "Host" in httpHeaders instead. - type: string - httpHeaders: - description: Custom headers to set in the request. HTTP allows repeated headers. - type: array - items: - description: HTTPHeader describes a custom header to be used in HTTP probes - type: object - required: - - name - - value - properties: - name: - description: |- - The header field name. - This will be canonicalized upon output, so case-variant names will be understood as the same header. - type: string - value: - description: The header field value - type: string - x-kubernetes-list-type: atomic - path: - description: Path to access on the HTTP server. - type: string - port: - description: |- - Name or number of the port to access on the container. - Number must be in the range 1 to 65535. - Name must be an IANA_SVC_NAME. - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - scheme: - description: |- - Scheme to use for connecting to the host. - Defaults to HTTP. - type: string - initialDelaySeconds: - description: |- - Number of seconds after the container has started before liveness probes are initiated. - More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes - type: integer - format: int32 - periodSeconds: - description: |- - How often (in seconds) to perform the probe. - type: integer - format: int32 - successThreshold: - description: |- - Minimum consecutive successes for the probe to be considered successful after having failed. - Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. - type: integer - format: int32 - tcpSocket: - description: TCPSocket specifies a connection to a TCP port. - type: object - properties: - host: - description: 'Optional: Host name to connect to, defaults to the pod IP.' - type: string - port: - description: |- - Number or name of the port to access on the container. - Number must be in the range 1 to 65535. - Name must be an IANA_SVC_NAME. - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - timeoutSeconds: - description: |- - Number of seconds after which the probe times out. - Defaults to 1 second. Minimum value is 1. - More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes - type: integer - format: int32 - resources: - description: |- - Compute Resources required by this container. - Cannot be updated. - More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ - type: object - properties: - limits: - description: |- - Limits describes the maximum amount of compute resources allowed. - More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ - type: object - additionalProperties: - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - requests: - description: |- - Requests describes the minimum amount of compute resources required. - If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, - otherwise to an implementation-defined value. Requests cannot exceed Limits. - More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ - type: object - additionalProperties: - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - securityContext: - description: |- - SecurityContext defines the security options the container should be run with. - If set, the fields of SecurityContext override the equivalent fields of PodSecurityContext. - More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ - type: object - properties: - allowPrivilegeEscalation: - description: |- - AllowPrivilegeEscalation controls whether a process can gain more - privileges than its parent process. This bool directly controls if - the no_new_privs flag will be set on the container process. - AllowPrivilegeEscalation is true always when the container is: - 1) run as Privileged - 2) has CAP_SYS_ADMIN - Note that this field cannot be set when spec.os.name is windows. - type: boolean - capabilities: - description: |- - The capabilities to add/drop when running containers. - Defaults to the default set of capabilities granted by the container runtime. - Note that this field cannot be set when spec.os.name is windows. - type: object - properties: - add: - description: This is accessible behind a feature flag - kubernetes.containerspec-addcapabilities - type: array - items: - description: Capability represent POSIX capabilities type - type: string - x-kubernetes-list-type: atomic - drop: - description: Removed capabilities - type: array - items: - description: Capability represent POSIX capabilities type - type: string - x-kubernetes-list-type: atomic - privileged: - description: |- - Run container in privileged mode. This can only be set to explicitly to 'false' - type: boolean - readOnlyRootFilesystem: - description: |- - Whether this container has a read-only root filesystem. - Default is false. - Note that this field cannot be set when spec.os.name is windows. - type: boolean - runAsGroup: - description: |- - The GID to run the entrypoint of the container process. - Uses runtime default if unset. - May also be set in PodSecurityContext. If set in both SecurityContext and - PodSecurityContext, the value specified in SecurityContext takes precedence. - Note that this field cannot be set when spec.os.name is windows. - type: integer - format: int64 - runAsNonRoot: - description: |- - Indicates that the container must run as a non-root user. - If true, the Kubelet will validate the image at runtime to ensure that it - does not run as UID 0 (root) and fail to start the container if it does. - If unset or false, no such validation will be performed. - May also be set in PodSecurityContext. If set in both SecurityContext and - PodSecurityContext, the value specified in SecurityContext takes precedence. - type: boolean - runAsUser: - description: |- - The UID to run the entrypoint of the container process. - Defaults to user specified in image metadata if unspecified. - May also be set in PodSecurityContext. If set in both SecurityContext and - PodSecurityContext, the value specified in SecurityContext takes precedence. - Note that this field cannot be set when spec.os.name is windows. - type: integer - format: int64 - seccompProfile: - description: |- - The seccomp options to use by this container. If seccomp options are - provided at both the pod & container level, the container options - override the pod options. - Note that this field cannot be set when spec.os.name is windows. - type: object - required: - - type - properties: - localhostProfile: - description: |- - localhostProfile indicates a profile defined in a file on the node should be used. - The profile must be preconfigured on the node to work. - Must be a descending path, relative to the kubelet's configured seccomp profile location. - Must be set if type is "Localhost". Must NOT be set for any other type. - type: string - type: - description: |- - type indicates which kind of seccomp profile will be applied. - Valid options are: - - Localhost - a profile defined in a file on the node should be used. - RuntimeDefault - the container runtime default profile should be used. - Unconfined - no profile should be applied. - type: string - startupProbe: - description: |- - StartupProbe indicates that the Pod has successfully initialized. - If specified, no other probes are executed until this completes successfully. - If this probe fails, the Pod will be restarted, just as if the livenessProbe failed. - This can be used to provide different probe parameters at the beginning of a Pod's lifecycle, - when it might take a long time to load data or warm a cache, than during steady-state operation. - This cannot be updated. - More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes - type: object - properties: - exec: - description: Exec specifies a command to execute in the container. - type: object - properties: - command: - description: |- - Command is the command line to execute inside the container, the working directory for the - command is root ('/') in the container's filesystem. The command is simply exec'd, it is - not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use - a shell, you need to explicitly call out to that shell. - Exit status of 0 is treated as live/healthy and non-zero is unhealthy. - type: array - items: - type: string - x-kubernetes-list-type: atomic - failureThreshold: - description: |- - Minimum consecutive failures for the probe to be considered failed after having succeeded. - Defaults to 3. Minimum value is 1. - type: integer - format: int32 - grpc: - description: GRPC specifies a GRPC HealthCheckRequest. - type: object - properties: - port: - description: Port number of the gRPC service. Number must be in the range 1 to 65535. - type: integer - format: int32 - service: - description: |- - Service is the name of the service to place in the gRPC HealthCheckRequest - (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). - - If this is not specified, the default behavior is defined by gRPC. - type: string - default: "" - httpGet: - description: HTTPGet specifies an HTTP GET request to perform. - type: object - properties: - host: - description: |- - Host name to connect to, defaults to the pod IP. You probably want to set - "Host" in httpHeaders instead. - type: string - httpHeaders: - description: Custom headers to set in the request. HTTP allows repeated headers. - type: array - items: - description: HTTPHeader describes a custom header to be used in HTTP probes - type: object - required: - - name - - value - properties: - name: - description: |- - The header field name. - This will be canonicalized upon output, so case-variant names will be understood as the same header. - type: string - value: - description: The header field value - type: string - x-kubernetes-list-type: atomic - path: - description: Path to access on the HTTP server. - type: string - port: - description: |- - Name or number of the port to access on the container. - Number must be in the range 1 to 65535. - Name must be an IANA_SVC_NAME. - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - scheme: - description: |- - Scheme to use for connecting to the host. - Defaults to HTTP. - type: string - initialDelaySeconds: - description: |- - Number of seconds after the container has started before liveness probes are initiated. - More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes - type: integer - format: int32 - periodSeconds: - description: |- - How often (in seconds) to perform the probe. - type: integer - format: int32 - successThreshold: - description: |- - Minimum consecutive successes for the probe to be considered successful after having failed. - Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. - type: integer - format: int32 - tcpSocket: - description: TCPSocket specifies a connection to a TCP port. - type: object - properties: - host: - description: 'Optional: Host name to connect to, defaults to the pod IP.' - type: string - port: - description: |- - Number or name of the port to access on the container. - Number must be in the range 1 to 65535. - Name must be an IANA_SVC_NAME. - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - timeoutSeconds: - description: |- - Number of seconds after which the probe times out. - Defaults to 1 second. Minimum value is 1. - More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes - type: integer - format: int32 - terminationMessagePath: - description: |- - Optional: Path at which the file to which the container's termination message - will be written is mounted into the container's filesystem. - Message written is intended to be brief final status, such as an assertion failure message. - Will be truncated by the node if greater than 4096 bytes. The total message length across - all containers will be limited to 12kb. - Defaults to /dev/termination-log. - Cannot be updated. - type: string - terminationMessagePolicy: - description: |- - Indicate how the termination message should be populated. File will use the contents of - terminationMessagePath to populate the container status message on both success and failure. - FallbackToLogsOnError will use the last chunk of container log output if the termination - message file is empty and the container exited with an error. - The log output is limited to 2048 bytes or 80 lines, whichever is smaller. - Defaults to File. - Cannot be updated. - type: string - volumeMounts: - description: |- - Pod volumes to mount into the container's filesystem. - Cannot be updated. - type: array - items: - description: VolumeMount describes a mounting of a Volume within a container. - type: object - required: - - mountPath - - name - properties: - mountPath: - description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. - type: string - mountPropagation: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-volumes-mount-propagation - type: string - name: - description: This must match the Name of a Volume. - type: string - readOnly: - description: |- - Mounted read-only if true, read-write otherwise (false or unspecified). - Defaults to false. - type: boolean - subPath: - description: |- - Path within the volume from which the container's volume should be mounted. - Defaults to "" (volume's root). - type: string - x-kubernetes-list-map-keys: - - mountPath - x-kubernetes-list-type: map - workingDir: - description: |- - Container's working directory. - If not specified, the container runtime's default will be used, which - might be configured in the container image. - Cannot be updated. - type: string - dnsConfig: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-dnsconfig - type: object - x-kubernetes-preserve-unknown-fields: true - dnsPolicy: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-dnspolicy - type: string - enableServiceLinks: - description: |- - EnableServiceLinks indicates whether information aboutservices should be injected into pod's environment variables, matching the syntax of Docker links. Optional: Knative defaults this to false. - type: boolean - hostAliases: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-hostaliases - type: array - items: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-hostaliases - type: object - x-kubernetes-preserve-unknown-fields: true - hostIPC: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-hostipc - type: boolean - hostNetwork: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-hostnetwork - type: boolean - hostPID: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-hostpid - type: boolean - idleTimeoutSeconds: - description: |- - IdleTimeoutSeconds is the maximum duration in seconds a request will be allowed - to stay open while not receiving any bytes from the user's application. If - unspecified, a system default will be provided. - type: integer - format: int64 - imagePullSecrets: - description: |- - ImagePullSecrets is an optional list of references to secrets in the same namespace to use for pulling any of the images used by this PodSpec. - If specified, these secrets will be passed to individual puller implementations for them to use. - More info: https://kubernetes.io/docs/concepts/containers/images#specifying-imagepullsecrets-on-a-pod - type: array - items: - description: |- - LocalObjectReference contains enough information to let you locate the - referenced object inside the same namespace. - type: object - properties: - name: - description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - default: "" - x-kubernetes-map-type: atomic - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - initContainers: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-init-containers - type: array - items: - description: This is accessible behind a feature flag - kubernetes.podspec-init-containers - type: object - x-kubernetes-preserve-unknown-fields: true - nodeSelector: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-nodeselector - type: object - additionalProperties: - type: string - x-kubernetes-map-type: atomic - priorityClassName: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-priorityclassname - type: string - responseStartTimeoutSeconds: - description: |- - ResponseStartTimeoutSeconds is the maximum duration in seconds that the request - routing layer will wait for a request delivered to a container to begin - sending any network traffic. - type: integer - format: int64 - runtimeClassName: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-runtimeclassname - type: string - schedulerName: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-schedulername - type: string - securityContext: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-securitycontext - type: object - x-kubernetes-preserve-unknown-fields: true - serviceAccountName: - description: |- - ServiceAccountName is the name of the ServiceAccount to use to run this pod. - More info: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/ - type: string - shareProcessNamespace: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-shareprocessnamespace - type: boolean - timeoutSeconds: - description: |- - TimeoutSeconds is the maximum duration in seconds that the request instance - is allowed to respond to a request. If unspecified, a system default will - be provided. - type: integer - format: int64 - tolerations: - description: This is accessible behind a feature flag - kubernetes.podspec-tolerations - type: array - items: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-tolerations - type: object - x-kubernetes-preserve-unknown-fields: true - topologySpreadConstraints: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints - type: array - items: - description: This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints - type: object - x-kubernetes-preserve-unknown-fields: true - volumes: - description: |- - List of volumes that can be mounted by containers belonging to the pod. - More info: https://kubernetes.io/docs/concepts/storage/volumes - type: array - items: - description: Volume represents a named volume in a pod that may be accessed by any container in the pod. - type: object - required: - - name - properties: - configMap: - description: configMap represents a configMap that should populate this volume - type: object - properties: - defaultMode: - description: |- - defaultMode is optional: mode bits used to set permissions on created files by default. - Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. - YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. - Defaults to 0644. - Directories within the path are not affected by this setting. - This might be in conflict with other options that affect the file - mode, like fsGroup, and the result can be other mode bits set. - type: integer - format: int32 - items: - description: |- - items if unspecified, each key-value pair in the Data field of the referenced - ConfigMap will be projected into the volume as a file whose name is the - key and content is the value. If specified, the listed keys will be - projected into the specified paths, and unlisted keys will not be - present. If a key is specified which is not present in the ConfigMap, - the volume setup will error unless it is marked optional. Paths must be - relative and may not contain the '..' path or start with '..'. - type: array - items: - description: Maps a string key to a path within a volume. - type: object - required: - - key - - path - properties: - key: - description: key is the key to project. - type: string - mode: - description: |- - mode is Optional: mode bits used to set permissions on this file. - Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. - YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. - If not specified, the volume defaultMode will be used. - This might be in conflict with other options that affect the file - mode, like fsGroup, and the result can be other mode bits set. - type: integer - format: int32 - path: - description: |- - path is the relative path of the file to map the key to. - May not be an absolute path. - May not contain the path element '..'. - May not start with the string '..'. - type: string - x-kubernetes-list-type: atomic - name: - description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - default: "" - optional: - description: optional specify whether the ConfigMap or its keys must be defined - type: boolean - x-kubernetes-map-type: atomic - csi: - description: This is accessible behind a feature flag - kubernetes.podspec-volumes-csi - type: object - x-kubernetes-preserve-unknown-fields: true - emptyDir: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-volumes-emptydir - type: object - x-kubernetes-preserve-unknown-fields: true - hostPath: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-volumes-hostpath - type: object - x-kubernetes-preserve-unknown-fields: true - image: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-volumes-image - type: object - x-kubernetes-preserve-unknown-fields: true - name: - description: |- - name of the volume. - Must be a DNS_LABEL and unique within the pod. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - persistentVolumeClaim: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-persistent-volume-claim - type: object - x-kubernetes-preserve-unknown-fields: true - projected: - description: projected items for all in one resources secrets, configmaps, and downward API - type: object - properties: - defaultMode: - description: |- - defaultMode are the mode bits used to set permissions on created files by default. - Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. - YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. - Directories within the path are not affected by this setting. - This might be in conflict with other options that affect the file - mode, like fsGroup, and the result can be other mode bits set. - type: integer - format: int32 - sources: - description: |- - sources is the list of volume projections. Each entry in this list - handles one source. - type: array - items: - description: |- - Projection that may be projected along with other supported volume types. - Exactly one of these fields must be set. - type: object - properties: - configMap: - description: configMap information about the configMap data to project - type: object - properties: - items: - description: |- - items if unspecified, each key-value pair in the Data field of the referenced - ConfigMap will be projected into the volume as a file whose name is the - key and content is the value. If specified, the listed keys will be - projected into the specified paths, and unlisted keys will not be - present. If a key is specified which is not present in the ConfigMap, - the volume setup will error unless it is marked optional. Paths must be - relative and may not contain the '..' path or start with '..'. - type: array - items: - description: Maps a string key to a path within a volume. - type: object - required: - - key - - path - properties: - key: - description: key is the key to project. - type: string - mode: - description: |- - mode is Optional: mode bits used to set permissions on this file. - Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. - YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. - If not specified, the volume defaultMode will be used. - This might be in conflict with other options that affect the file - mode, like fsGroup, and the result can be other mode bits set. - type: integer - format: int32 - path: - description: |- - path is the relative path of the file to map the key to. - May not be an absolute path. - May not contain the path element '..'. - May not start with the string '..'. - type: string - x-kubernetes-list-type: atomic - name: - description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - default: "" - optional: - description: optional specify whether the ConfigMap or its keys must be defined - type: boolean - x-kubernetes-map-type: atomic - downwardAPI: - description: downwardAPI information about the downwardAPI data to project - type: object - properties: - items: - description: Items is a list of DownwardAPIVolume file - type: array - items: - description: DownwardAPIVolumeFile represents information to create the file containing the pod field - type: object - required: - - path - properties: - fieldRef: - description: 'Required: Selects a field of the pod: only annotations, labels, name, namespace and uid are supported.' - type: object - required: - - fieldPath - properties: - apiVersion: - description: Version of the schema the FieldPath is written in terms of, defaults to "v1". - type: string - fieldPath: - description: Path of the field to select in the specified API version. - type: string - x-kubernetes-map-type: atomic - mode: - description: |- - Optional: mode bits used to set permissions on this file, must be an octal value - between 0000 and 0777 or a decimal value between 0 and 511. - YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. - If not specified, the volume defaultMode will be used. - This might be in conflict with other options that affect the file - mode, like fsGroup, and the result can be other mode bits set. - type: integer - format: int32 - path: - description: 'Required: Path is the relative path name of the file to be created. Must not be absolute or contain the ''..'' path. Must be utf-8 encoded. The first item of the relative path must not start with ''..''' - type: string - resourceFieldRef: - description: |- - Selects a resource of the container: only resources limits and requests - (limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported. - type: object - required: - - resource - properties: - containerName: - description: 'Container name: required for volumes, optional for env vars' - type: string - divisor: - description: Specifies the output format of the exposed resources, defaults to "1" - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - resource: - description: 'Required: resource to select' - type: string - x-kubernetes-map-type: atomic - x-kubernetes-list-type: atomic - secret: - description: secret information about the secret data to project - type: object - properties: - items: - description: |- - items if unspecified, each key-value pair in the Data field of the referenced - Secret will be projected into the volume as a file whose name is the - key and content is the value. If specified, the listed keys will be - projected into the specified paths, and unlisted keys will not be - present. If a key is specified which is not present in the Secret, - the volume setup will error unless it is marked optional. Paths must be - relative and may not contain the '..' path or start with '..'. - type: array - items: - description: Maps a string key to a path within a volume. - type: object - required: - - key - - path - properties: - key: - description: key is the key to project. - type: string - mode: - description: |- - mode is Optional: mode bits used to set permissions on this file. - Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. - YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. - If not specified, the volume defaultMode will be used. - This might be in conflict with other options that affect the file - mode, like fsGroup, and the result can be other mode bits set. - type: integer - format: int32 - path: - description: |- - path is the relative path of the file to map the key to. - May not be an absolute path. - May not contain the path element '..'. - May not start with the string '..'. - type: string - x-kubernetes-list-type: atomic - name: - description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - default: "" - optional: - description: optional field specify whether the Secret or its key must be defined - type: boolean - x-kubernetes-map-type: atomic - serviceAccountToken: - description: serviceAccountToken is information about the serviceAccountToken data to project - type: object - required: - - path - properties: - audience: - description: |- - audience is the intended audience of the token. A recipient of a token - must identify itself with an identifier specified in the audience of the - token, and otherwise should reject the token. The audience defaults to the - identifier of the apiserver. - type: string - expirationSeconds: - description: |- - expirationSeconds is the requested duration of validity of the service - account token. As the token approaches expiration, the kubelet volume - plugin will proactively rotate the service account token. The kubelet will - start trying to rotate the token if the token is older than 80 percent of - its time to live or if the token is older than 24 hours.Defaults to 1 hour - and must be at least 10 minutes. - type: integer - format: int64 - path: - description: |- - path is the path relative to the mount point of the file to project the - token into. - type: string - x-kubernetes-list-type: atomic - secret: - description: |- - secret represents a secret that should populate this volume. - More info: https://kubernetes.io/docs/concepts/storage/volumes#secret - type: object - properties: - defaultMode: - description: |- - defaultMode is Optional: mode bits used to set permissions on created files by default. - Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. - YAML accepts both octal and decimal values, JSON requires decimal values - for mode bits. Defaults to 0644. - Directories within the path are not affected by this setting. - This might be in conflict with other options that affect the file - mode, like fsGroup, and the result can be other mode bits set. - type: integer - format: int32 - items: - description: |- - items If unspecified, each key-value pair in the Data field of the referenced - Secret will be projected into the volume as a file whose name is the - key and content is the value. If specified, the listed keys will be - projected into the specified paths, and unlisted keys will not be - present. If a key is specified which is not present in the Secret, - the volume setup will error unless it is marked optional. Paths must be - relative and may not contain the '..' path or start with '..'. - type: array - items: - description: Maps a string key to a path within a volume. - type: object - required: - - key - - path - properties: - key: - description: key is the key to project. - type: string - mode: - description: |- - mode is Optional: mode bits used to set permissions on this file. - Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. - YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. - If not specified, the volume defaultMode will be used. - This might be in conflict with other options that affect the file - mode, like fsGroup, and the result can be other mode bits set. - type: integer - format: int32 - path: - description: |- - path is the relative path of the file to map the key to. - May not be an absolute path. - May not contain the path element '..'. - May not start with the string '..'. - type: string - x-kubernetes-list-type: atomic - optional: - description: optional field specify whether the Secret or its keys must be defined - type: boolean - secretName: - description: |- - secretName is the name of the secret in the pod's namespace to use. - More info: https://kubernetes.io/docs/concepts/storage/volumes#secret - type: string - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - status: - description: RevisionStatus communicates the observed state of the Revision (from the controller). - type: object - properties: - actualReplicas: - description: ActualReplicas reflects the amount of ready pods running this revision. - type: integer - format: int32 - annotations: - description: |- - Annotations is additional Status fields for the Resource to save some - additional State as well as convey more information to the user. This is - roughly akin to Annotations on any k8s resource, just the reconciler conveying - richer information outwards. - type: object - additionalProperties: - type: string - conditions: - description: Conditions the latest available observations of a resource's current state. - type: array - items: - description: |- - Condition defines a readiness condition for a Knative resource. - See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties - type: object - required: - - status - - type - properties: - lastTransitionTime: - description: |- - LastTransitionTime is the last time the condition transitioned from one status to another. - We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic - differences (all other things held constant). - type: string - message: - description: A human readable message indicating details about the transition. - type: string - reason: - description: The reason for the condition's last transition. - type: string - severity: - description: |- - Severity with which to treat failures of this type of condition. - When this is not specified, it defaults to Error. - type: string - status: - description: Status of the condition, one of True, False, Unknown. - type: string - type: - description: Type of condition. - type: string - containerStatuses: - description: |- - ContainerStatuses is a slice of images present in .Spec.Container[*].Image - to their respective digests and their container name. - The digests are resolved during the creation of Revision. - ContainerStatuses holds the container name and image digests - for both serving and non serving containers. - ref: https://bit.ly/image-digests - type: array - items: - description: ContainerStatus holds the information of container name and image digest value - type: object - properties: - imageDigest: - type: string - name: - type: string - desiredReplicas: - description: DesiredReplicas reflects the desired amount of pods running this revision. - type: integer - format: int32 - initContainerStatuses: - description: |- - InitContainerStatuses is a slice of images present in .Spec.InitContainer[*].Image - to their respective digests and their container name. - The digests are resolved during the creation of Revision. - ContainerStatuses holds the container name and image digests - for both serving and non serving containers. - ref: https://bit.ly/image-digests - type: array - items: - description: ContainerStatus holds the information of container name and image digest value - type: object - properties: - imageDigest: - type: string - name: - type: string - logUrl: - description: |- - LogURL specifies the generated logging url for this particular revision - based on the revision url template specified in the controller's config. - type: string - observedGeneration: - description: |- - ObservedGeneration is the 'Generation' of the Service that - was last processed by the controller. - type: integer - format: int64 ---- -# Copyright 2019 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -# Note: The schema part of the spec is auto-generated by hack/update-schemas.sh. - -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - name: routes.serving.knative.dev - labels: - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" - knative.dev/crd-install: "true" - duck.knative.dev/addressable: "true" -spec: - group: serving.knative.dev - names: - kind: Route - plural: routes - singular: route - categories: - - all - - knative - - serving - shortNames: - - rt - scope: Namespaced - versions: - - name: v1 - served: true - storage: true - subresources: - status: {} - additionalPrinterColumns: - - name: URL - type: string - jsonPath: .status.url - - name: Ready - type: string - jsonPath: ".status.conditions[?(@.type=='Ready')].status" - - name: Reason - type: string - jsonPath: ".status.conditions[?(@.type=='Ready')].reason" - schema: - openAPIV3Schema: - description: |- - Route is responsible for configuring ingress over a collection of Revisions. - Some of the Revisions a Route distributes traffic over may be specified by - referencing the Configuration responsible for creating them; in these cases - the Route is additionally responsible for monitoring the Configuration for - "latest ready revision" changes, and smoothly rolling out latest revisions. - See also: https://github.com/knative/serving/blob/main/docs/spec/overview.md#route - type: object - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: Spec holds the desired state of the Route (from the client). - type: object - properties: - traffic: - description: |- - Traffic specifies how to distribute traffic over a collection of - revisions and configurations. - type: array - items: - description: TrafficTarget holds a single entry of the routing table for a Route. - type: object - properties: - configurationName: - description: |- - ConfigurationName of a configuration to whose latest revision we will send - this portion of traffic. When the "status.latestReadyRevisionName" of the - referenced configuration changes, we will automatically migrate traffic - from the prior "latest ready" revision to the new one. This field is never - set in Route's status, only its spec. This is mutually exclusive with - RevisionName. - type: string - latestRevision: - description: |- - LatestRevision may be optionally provided to indicate that the latest - ready Revision of the Configuration should be used for this traffic - target. When provided LatestRevision must be true if RevisionName is - empty; it must be false when RevisionName is non-empty. - type: boolean - percent: - description: |- - Percent indicates that percentage based routing should be used and - the value indicates the percent of traffic that is be routed to this - Revision or Configuration. `0` (zero) mean no traffic, `100` means all - traffic. - When percentage based routing is being used the follow rules apply: - - the sum of all percent values must equal 100 - - when not specified, the implied value for `percent` is zero for - that particular Revision or Configuration - type: integer - format: int64 - revisionName: - description: |- - RevisionName of a specific revision to which to send this portion of - traffic. This is mutually exclusive with ConfigurationName. - type: string - tag: - description: |- - Tag is optionally used to expose a dedicated url for referencing - this target exclusively. - type: string - url: - description: |- - URL displays the URL for accessing named traffic targets. URL is displayed in - status, and is disallowed on spec. URL must contain a scheme (e.g. http://) and - a hostname, but may not contain anything else (e.g. basic auth, url path, etc.) - type: string - status: - description: Status communicates the observed state of the Route (from the controller). - type: object - properties: - address: - description: Address holds the information needed for a Route to be the target of an event. - type: object - properties: - CACerts: - description: |- - CACerts is the Certification Authority (CA) certificates in PEM format - according to https://www.rfc-editor.org/rfc/rfc7468. - type: string - audience: - description: Audience is the OIDC audience for this address. - type: string - name: - description: Name is the name of the address. - type: string - url: - type: string - annotations: - description: |- - Annotations is additional Status fields for the Resource to save some - additional State as well as convey more information to the user. This is - roughly akin to Annotations on any k8s resource, just the reconciler conveying - richer information outwards. - type: object - additionalProperties: - type: string - conditions: - description: Conditions the latest available observations of a resource's current state. - type: array - items: - description: |- - Condition defines a readiness condition for a Knative resource. - See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties - type: object - required: - - status - - type - properties: - lastTransitionTime: - description: |- - LastTransitionTime is the last time the condition transitioned from one status to another. - We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic - differences (all other things held constant). - type: string - message: - description: A human readable message indicating details about the transition. - type: string - reason: - description: The reason for the condition's last transition. - type: string - severity: - description: |- - Severity with which to treat failures of this type of condition. - When this is not specified, it defaults to Error. - type: string - status: - description: Status of the condition, one of True, False, Unknown. - type: string - type: - description: Type of condition. - type: string - observedGeneration: - description: |- - ObservedGeneration is the 'Generation' of the Service that - was last processed by the controller. - type: integer - format: int64 - traffic: - description: |- - Traffic holds the configured traffic distribution. - These entries will always contain RevisionName references. - When ConfigurationName appears in the spec, this will hold the - LatestReadyRevisionName that we last observed. - type: array - items: - description: TrafficTarget holds a single entry of the routing table for a Route. - type: object - properties: - configurationName: - description: |- - ConfigurationName of a configuration to whose latest revision we will send - this portion of traffic. When the "status.latestReadyRevisionName" of the - referenced configuration changes, we will automatically migrate traffic - from the prior "latest ready" revision to the new one. This field is never - set in Route's status, only its spec. This is mutually exclusive with - RevisionName. - type: string - latestRevision: - description: |- - LatestRevision may be optionally provided to indicate that the latest - ready Revision of the Configuration should be used for this traffic - target. When provided LatestRevision must be true if RevisionName is - empty; it must be false when RevisionName is non-empty. - type: boolean - percent: - description: |- - Percent indicates that percentage based routing should be used and - the value indicates the percent of traffic that is be routed to this - Revision or Configuration. `0` (zero) mean no traffic, `100` means all - traffic. - When percentage based routing is being used the follow rules apply: - - the sum of all percent values must equal 100 - - when not specified, the implied value for `percent` is zero for - that particular Revision or Configuration - type: integer - format: int64 - revisionName: - description: |- - RevisionName of a specific revision to which to send this portion of - traffic. This is mutually exclusive with ConfigurationName. - type: string - tag: - description: |- - Tag is optionally used to expose a dedicated url for referencing - this target exclusively. - type: string - url: - description: |- - URL displays the URL for accessing named traffic targets. URL is displayed in - status, and is disallowed on spec. URL must contain a scheme (e.g. http://) and - a hostname, but may not contain anything else (e.g. basic auth, url path, etc.) - type: string - url: - description: |- - URL holds the url that will distribute traffic over the provided traffic targets. - It generally has the form http[s]://{route-name}.{route-namespace}.{cluster-level-suffix} - type: string ---- -# Copyright 2019 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - name: serverlessservices.networking.internal.knative.dev - labels: - app.kubernetes.io/name: knative-serving - app.kubernetes.io/component: networking - app.kubernetes.io/version: "1.22.1" - knative.dev/crd-install: "true" -spec: - group: networking.internal.knative.dev - versions: - - name: v1alpha1 - served: true - storage: true - subresources: - status: {} - schema: - openAPIV3Schema: - description: |- - ServerlessService is a proxy for the K8s service objects containing the - endpoints for the revision, whether those are endpoints of the activator or - revision pods. - See: https://knative.page.link/naxz for details. - type: object - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: |- - Spec is the desired state of the ServerlessService. - More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status - type: object - required: - - objectRef - - protocolType - properties: - mode: - description: Mode describes the mode of operation of the ServerlessService. - type: string - numActivators: - description: |- - NumActivators contains number of Activators that this revision should be - assigned. - O means — assign all. - type: integer - format: int32 - objectRef: - description: |- - ObjectRef defines the resource that this ServerlessService - is responsible for making "serverless". - type: object - properties: - apiVersion: - description: API version of the referent. - type: string - fieldPath: - description: |- - If referring to a piece of an object instead of an entire object, this string - should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. - For example, if the object reference is to a container within a pod, this would take on a value like: - "spec.containers{name}" (where "name" refers to the name of the container that triggered - the event) or if no container name is specified "spec.containers[2]" (container with - index 2 in this pod). This syntax is chosen only to have some well-defined way of - referencing a part of an object. - type: string - kind: - description: |- - Kind of the referent. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - name: - description: |- - Name of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - namespace: - description: |- - Namespace of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ - type: string - resourceVersion: - description: |- - Specific resourceVersion to which this reference is made, if any. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency - type: string - uid: - description: |- - UID of the referent. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids - type: string - x-kubernetes-map-type: atomic - protocolType: - description: |- - The application-layer protocol. Matches `RevisionProtocolType` set on the owning pa/revision. - serving imports networking, so just use string. - type: string - status: - description: |- - Status is the current state of the ServerlessService. - More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status - type: object - properties: - annotations: - description: |- - Annotations is additional Status fields for the Resource to save some - additional State as well as convey more information to the user. This is - roughly akin to Annotations on any k8s resource, just the reconciler conveying - richer information outwards. - type: object - additionalProperties: - type: string - conditions: - description: Conditions the latest available observations of a resource's current state. - type: array - items: - description: |- - Condition defines a readiness condition for a Knative resource. - See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties - type: object - required: - - status - - type - properties: - lastTransitionTime: - description: |- - LastTransitionTime is the last time the condition transitioned from one status to another. - We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic - differences (all other things held constant). - type: string - message: - description: A human readable message indicating details about the transition. - type: string - reason: - description: The reason for the condition's last transition. - type: string - severity: - description: |- - Severity with which to treat failures of this type of condition. - When this is not specified, it defaults to Error. - type: string - status: - description: Status of the condition, one of True, False, Unknown. - type: string - type: - description: Type of condition. - type: string - observedGeneration: - description: |- - ObservedGeneration is the 'Generation' of the Service that - was last processed by the controller. - type: integer - format: int64 - privateServiceName: - description: |- - PrivateServiceName holds the name of a core K8s Service resource that - load balances over the user service pods backing this Revision. - type: string - serviceName: - description: |- - ServiceName holds the name of a core K8s Service resource that - load balances over the pods backing this Revision (activator or revision). - type: string - additionalPrinterColumns: - - name: Mode - type: string - jsonPath: ".spec.mode" - - name: Activators - type: integer - jsonPath: ".spec.numActivators" - - name: ServiceName - type: string - jsonPath: ".status.serviceName" - - name: PrivateServiceName - type: string - jsonPath: ".status.privateServiceName" - - name: Ready - type: string - jsonPath: ".status.conditions[?(@.type=='Ready')].status" - - name: Reason - type: string - jsonPath: ".status.conditions[?(@.type=='Ready')].reason" - names: - kind: ServerlessService - plural: serverlessservices - singular: serverlessservice - categories: - - knative-internal - - networking - shortNames: - - sks - scope: Namespaced ---- -# Copyright 2019 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -# Note: The schema part of the spec is auto-generated by hack/update-schemas.sh. - -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - name: services.serving.knative.dev - labels: - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" - knative.dev/crd-install: "true" - duck.knative.dev/addressable: "true" - duck.knative.dev/podspecable: "true" -spec: - group: serving.knative.dev - names: - kind: Service - plural: services - singular: service - categories: - - all - - knative - - serving - shortNames: - - kservice - - ksvc - scope: Namespaced - versions: - - name: v1 - served: true - storage: true - subresources: - status: {} - additionalPrinterColumns: - - name: URL - type: string - jsonPath: .status.url - - name: LatestCreated - type: string - jsonPath: .status.latestCreatedRevisionName - - name: LatestReady - type: string - jsonPath: .status.latestReadyRevisionName - - name: Ready - type: string - jsonPath: ".status.conditions[?(@.type=='Ready')].status" - - name: Reason - type: string - jsonPath: ".status.conditions[?(@.type=='Ready')].reason" - schema: - openAPIV3Schema: - description: |- - Service acts as a top-level container that manages a Route and Configuration - which implement a network service. Service exists to provide a singular - abstraction which can be access controlled, reasoned about, and which - encapsulates software lifecycle decisions such as rollout policy and - team resource ownership. Service acts only as an orchestrator of the - underlying Routes and Configurations (much as a kubernetes Deployment - orchestrates ReplicaSets), and its usage is optional but recommended. - - The Service's controller will track the statuses of its owned Configuration - and Route, reflecting their statuses and conditions as its own. - - See also: https://github.com/knative/serving/blob/main/docs/spec/overview.md#service - type: object - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: |- - ServiceSpec represents the configuration for the Service object. - A Service's specification is the union of the specifications for a Route - and Configuration. The Service restricts what can be expressed in these - fields, e.g. the Route must reference the provided Configuration; - however, these limitations also enable friendlier defaulting, - e.g. Route never needs a Configuration name, and may be defaulted to - the appropriate "run latest" spec. - type: object - properties: - template: - description: Template holds the latest specification for the Revision to be stamped out. - type: object - properties: - metadata: - type: object - properties: - annotations: - type: object - additionalProperties: - type: string - finalizers: - type: array - items: - type: string - labels: - type: object - additionalProperties: - type: string - name: - type: string - namespace: - type: string - x-kubernetes-preserve-unknown-fields: true - spec: - description: RevisionSpec holds the desired state of the Revision (from the client). - type: object - required: - - containers - properties: - affinity: - description: This is accessible behind a feature flag - kubernetes.podspec-affinity - type: object - x-kubernetes-preserve-unknown-fields: true - automountServiceAccountToken: - description: AutomountServiceAccountToken indicates whether a service account token should be automatically mounted. - type: boolean - containerConcurrency: - description: |- - ContainerConcurrency specifies the maximum allowed in-flight (concurrent) - requests per container of the Revision. Defaults to `0` which means - concurrency to the application is not limited, and the system decides the - target concurrency for the autoscaler. - type: integer - format: int64 - containers: - description: |- - List of containers belonging to the pod. - Containers cannot currently be added or removed. - There must be at least one container in a Pod. - Cannot be updated. - type: array - items: - description: A single application container that you want to run within a pod. - type: object - properties: - args: - description: |- - Arguments to the entrypoint. - The container image's CMD is used if this is not provided. - Variable references $(VAR_NAME) are expanded using the container's environment. If a variable - cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced - to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will - produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless - of whether the variable exists or not. Cannot be updated. - More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell - type: array - items: - type: string - x-kubernetes-list-type: atomic - command: - description: |- - Entrypoint array. Not executed within a shell. - The container image's ENTRYPOINT is used if this is not provided. - Variable references $(VAR_NAME) are expanded using the container's environment. If a variable - cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced - to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will - produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless - of whether the variable exists or not. Cannot be updated. - More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell - type: array - items: - type: string - x-kubernetes-list-type: atomic - env: - description: |- - List of environment variables to set in the container. - Cannot be updated. - type: array - items: - description: EnvVar represents an environment variable present in a Container. - type: object - required: - - name - properties: - name: - description: |- - Name of the environment variable. - May consist of any printable ASCII characters except '='. - type: string - value: - description: |- - Variable references $(VAR_NAME) are expanded - using the previously defined environment variables in the container and - any service environment variables. If a variable cannot be resolved, - the reference in the input string will be unchanged. Double $$ are reduced - to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. - "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". - Escaped references will never be expanded, regardless of whether the variable - exists or not. - Defaults to "". - type: string - valueFrom: - description: Source for the environment variable's value. Cannot be used if value is not empty. - type: object - properties: - configMapKeyRef: - description: Selects a key of a ConfigMap. - type: object - required: - - key - properties: - key: - description: The key to select. - type: string - name: - description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - default: "" - optional: - description: Specify whether the ConfigMap or its key must be defined - type: boolean - x-kubernetes-map-type: atomic - fieldRef: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-fieldref - type: object - x-kubernetes-map-type: atomic - x-kubernetes-preserve-unknown-fields: true - resourceFieldRef: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-fieldref - type: object - x-kubernetes-map-type: atomic - x-kubernetes-preserve-unknown-fields: true - secretKeyRef: - description: Selects a key of a secret in the pod's namespace - type: object - required: - - key - properties: - key: - description: The key of the secret to select from. Must be a valid secret key. - type: string - name: - description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - default: "" - optional: - description: Specify whether the Secret or its key must be defined - type: boolean - x-kubernetes-map-type: atomic - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - envFrom: - description: |- - List of sources to populate environment variables in the container. - The keys defined within a source may consist of any printable ASCII characters except '='. - When a key exists in multiple - sources, the value associated with the last source will take precedence. - Values defined by an Env with a duplicate key will take precedence. - Cannot be updated. - type: array - items: - description: EnvFromSource represents the source of a set of ConfigMaps or Secrets - type: object - properties: - configMapRef: - description: The ConfigMap to select from - type: object - properties: - name: - description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - default: "" - optional: - description: Specify whether the ConfigMap must be defined - type: boolean - x-kubernetes-map-type: atomic - prefix: - description: |- - Optional text to prepend to the name of each environment variable. - May consist of any printable ASCII characters except '='. - type: string - secretRef: - description: The Secret to select from - type: object - properties: - name: - description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - default: "" - optional: - description: Specify whether the Secret must be defined - type: boolean - x-kubernetes-map-type: atomic - x-kubernetes-list-type: atomic - image: - description: |- - Container image name. - More info: https://kubernetes.io/docs/concepts/containers/images - This field is optional to allow higher level config management to default or override - container images in workload controllers like Deployments and StatefulSets. - type: string - imagePullPolicy: - description: |- - Image pull policy. - One of Always, Never, IfNotPresent. - Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. - Cannot be updated. - More info: https://kubernetes.io/docs/concepts/containers/images#updating-images - type: string - livenessProbe: - description: |- - Periodic probe of container liveness. - Container will be restarted if the probe fails. - Cannot be updated. - More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes - type: object - properties: - exec: - description: Exec specifies a command to execute in the container. - type: object - properties: - command: - description: |- - Command is the command line to execute inside the container, the working directory for the - command is root ('/') in the container's filesystem. The command is simply exec'd, it is - not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use - a shell, you need to explicitly call out to that shell. - Exit status of 0 is treated as live/healthy and non-zero is unhealthy. - type: array - items: - type: string - x-kubernetes-list-type: atomic - failureThreshold: - description: |- - Minimum consecutive failures for the probe to be considered failed after having succeeded. - Defaults to 3. Minimum value is 1. - type: integer - format: int32 - grpc: - description: GRPC specifies a GRPC HealthCheckRequest. - type: object - properties: - port: - description: Port number of the gRPC service. Number must be in the range 1 to 65535. - type: integer - format: int32 - service: - description: |- - Service is the name of the service to place in the gRPC HealthCheckRequest - (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). - - If this is not specified, the default behavior is defined by gRPC. - type: string - default: "" - httpGet: - description: HTTPGet specifies an HTTP GET request to perform. - type: object - properties: - host: - description: |- - Host name to connect to, defaults to the pod IP. You probably want to set - "Host" in httpHeaders instead. - type: string - httpHeaders: - description: Custom headers to set in the request. HTTP allows repeated headers. - type: array - items: - description: HTTPHeader describes a custom header to be used in HTTP probes - type: object - required: - - name - - value - properties: - name: - description: |- - The header field name. - This will be canonicalized upon output, so case-variant names will be understood as the same header. - type: string - value: - description: The header field value - type: string - x-kubernetes-list-type: atomic - path: - description: Path to access on the HTTP server. - type: string - port: - description: |- - Name or number of the port to access on the container. - Number must be in the range 1 to 65535. - Name must be an IANA_SVC_NAME. - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - scheme: - description: |- - Scheme to use for connecting to the host. - Defaults to HTTP. - type: string - initialDelaySeconds: - description: |- - Number of seconds after the container has started before liveness probes are initiated. - More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes - type: integer - format: int32 - periodSeconds: - description: |- - How often (in seconds) to perform the probe. - type: integer - format: int32 - successThreshold: - description: |- - Minimum consecutive successes for the probe to be considered successful after having failed. - Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. - type: integer - format: int32 - tcpSocket: - description: TCPSocket specifies a connection to a TCP port. - type: object - properties: - host: - description: 'Optional: Host name to connect to, defaults to the pod IP.' - type: string - port: - description: |- - Number or name of the port to access on the container. - Number must be in the range 1 to 65535. - Name must be an IANA_SVC_NAME. - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - timeoutSeconds: - description: |- - Number of seconds after which the probe times out. - Defaults to 1 second. Minimum value is 1. - More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes - type: integer - format: int32 - name: - description: |- - Name of the container specified as a DNS_LABEL. - Each container in a pod must have a unique name (DNS_LABEL). - Cannot be updated. - type: string - ports: - description: |- - List of ports to expose from the container. Not specifying a port here - DOES NOT prevent that port from being exposed. Any port which is - listening on the default "0.0.0.0" address inside a container will be - accessible from the network. - Modifying this array with strategic merge patch may corrupt the data. - For more information See https://github.com/kubernetes/kubernetes/issues/108255. - Cannot be updated. - type: array - items: - description: ContainerPort represents a network port in a single container. - type: object - properties: - containerPort: - description: |- - Number of port to expose on the pod's IP address. - This must be a valid port number, 0 < x < 65536. - type: integer - format: int32 - name: - description: |- - If specified, this must be an IANA_SVC_NAME and unique within the pod. Each - named port in a pod must have a unique name. Name for the port that can be - referred to by services. - type: string - protocol: - description: |- - Protocol for port. Must be UDP, TCP, or SCTP. - Defaults to "TCP". - type: string - default: TCP - readinessProbe: - description: |- - Periodic probe of container service readiness. - Container will be removed from service endpoints if the probe fails. - Cannot be updated. - More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes - type: object - properties: - exec: - description: Exec specifies a command to execute in the container. - type: object - properties: - command: - description: |- - Command is the command line to execute inside the container, the working directory for the - command is root ('/') in the container's filesystem. The command is simply exec'd, it is - not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use - a shell, you need to explicitly call out to that shell. - Exit status of 0 is treated as live/healthy and non-zero is unhealthy. - type: array - items: - type: string - x-kubernetes-list-type: atomic - failureThreshold: - description: |- - Minimum consecutive failures for the probe to be considered failed after having succeeded. - Defaults to 3. Minimum value is 1. - type: integer - format: int32 - grpc: - description: GRPC specifies a GRPC HealthCheckRequest. - type: object - properties: - port: - description: Port number of the gRPC service. Number must be in the range 1 to 65535. - type: integer - format: int32 - service: - description: |- - Service is the name of the service to place in the gRPC HealthCheckRequest - (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). - - If this is not specified, the default behavior is defined by gRPC. - type: string - default: "" - httpGet: - description: HTTPGet specifies an HTTP GET request to perform. - type: object - properties: - host: - description: |- - Host name to connect to, defaults to the pod IP. You probably want to set - "Host" in httpHeaders instead. - type: string - httpHeaders: - description: Custom headers to set in the request. HTTP allows repeated headers. - type: array - items: - description: HTTPHeader describes a custom header to be used in HTTP probes - type: object - required: - - name - - value - properties: - name: - description: |- - The header field name. - This will be canonicalized upon output, so case-variant names will be understood as the same header. - type: string - value: - description: The header field value - type: string - x-kubernetes-list-type: atomic - path: - description: Path to access on the HTTP server. - type: string - port: - description: |- - Name or number of the port to access on the container. - Number must be in the range 1 to 65535. - Name must be an IANA_SVC_NAME. - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - scheme: - description: |- - Scheme to use for connecting to the host. - Defaults to HTTP. - type: string - initialDelaySeconds: - description: |- - Number of seconds after the container has started before liveness probes are initiated. - More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes - type: integer - format: int32 - periodSeconds: - description: |- - How often (in seconds) to perform the probe. - type: integer - format: int32 - successThreshold: - description: |- - Minimum consecutive successes for the probe to be considered successful after having failed. - Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. - type: integer - format: int32 - tcpSocket: - description: TCPSocket specifies a connection to a TCP port. - type: object - properties: - host: - description: 'Optional: Host name to connect to, defaults to the pod IP.' - type: string - port: - description: |- - Number or name of the port to access on the container. - Number must be in the range 1 to 65535. - Name must be an IANA_SVC_NAME. - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - timeoutSeconds: - description: |- - Number of seconds after which the probe times out. - Defaults to 1 second. Minimum value is 1. - More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes - type: integer - format: int32 - resources: - description: |- - Compute Resources required by this container. - Cannot be updated. - More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ - type: object - properties: - limits: - description: |- - Limits describes the maximum amount of compute resources allowed. - More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ - type: object - additionalProperties: - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - requests: - description: |- - Requests describes the minimum amount of compute resources required. - If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, - otherwise to an implementation-defined value. Requests cannot exceed Limits. - More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ - type: object - additionalProperties: - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - securityContext: - description: |- - SecurityContext defines the security options the container should be run with. - If set, the fields of SecurityContext override the equivalent fields of PodSecurityContext. - More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ - type: object - properties: - allowPrivilegeEscalation: - description: |- - AllowPrivilegeEscalation controls whether a process can gain more - privileges than its parent process. This bool directly controls if - the no_new_privs flag will be set on the container process. - AllowPrivilegeEscalation is true always when the container is: - 1) run as Privileged - 2) has CAP_SYS_ADMIN - Note that this field cannot be set when spec.os.name is windows. - type: boolean - capabilities: - description: |- - The capabilities to add/drop when running containers. - Defaults to the default set of capabilities granted by the container runtime. - Note that this field cannot be set when spec.os.name is windows. - type: object - properties: - add: - description: This is accessible behind a feature flag - kubernetes.containerspec-addcapabilities - type: array - items: - description: Capability represent POSIX capabilities type - type: string - x-kubernetes-list-type: atomic - drop: - description: Removed capabilities - type: array - items: - description: Capability represent POSIX capabilities type - type: string - x-kubernetes-list-type: atomic - privileged: - description: |- - Run container in privileged mode. This can only be set to explicitly to 'false' - type: boolean - readOnlyRootFilesystem: - description: |- - Whether this container has a read-only root filesystem. - Default is false. - Note that this field cannot be set when spec.os.name is windows. - type: boolean - runAsGroup: - description: |- - The GID to run the entrypoint of the container process. - Uses runtime default if unset. - May also be set in PodSecurityContext. If set in both SecurityContext and - PodSecurityContext, the value specified in SecurityContext takes precedence. - Note that this field cannot be set when spec.os.name is windows. - type: integer - format: int64 - runAsNonRoot: - description: |- - Indicates that the container must run as a non-root user. - If true, the Kubelet will validate the image at runtime to ensure that it - does not run as UID 0 (root) and fail to start the container if it does. - If unset or false, no such validation will be performed. - May also be set in PodSecurityContext. If set in both SecurityContext and - PodSecurityContext, the value specified in SecurityContext takes precedence. - type: boolean - runAsUser: - description: |- - The UID to run the entrypoint of the container process. - Defaults to user specified in image metadata if unspecified. - May also be set in PodSecurityContext. If set in both SecurityContext and - PodSecurityContext, the value specified in SecurityContext takes precedence. - Note that this field cannot be set when spec.os.name is windows. - type: integer - format: int64 - seccompProfile: - description: |- - The seccomp options to use by this container. If seccomp options are - provided at both the pod & container level, the container options - override the pod options. - Note that this field cannot be set when spec.os.name is windows. - type: object - required: - - type - properties: - localhostProfile: - description: |- - localhostProfile indicates a profile defined in a file on the node should be used. - The profile must be preconfigured on the node to work. - Must be a descending path, relative to the kubelet's configured seccomp profile location. - Must be set if type is "Localhost". Must NOT be set for any other type. - type: string - type: - description: |- - type indicates which kind of seccomp profile will be applied. - Valid options are: - - Localhost - a profile defined in a file on the node should be used. - RuntimeDefault - the container runtime default profile should be used. - Unconfined - no profile should be applied. - type: string - startupProbe: - description: |- - StartupProbe indicates that the Pod has successfully initialized. - If specified, no other probes are executed until this completes successfully. - If this probe fails, the Pod will be restarted, just as if the livenessProbe failed. - This can be used to provide different probe parameters at the beginning of a Pod's lifecycle, - when it might take a long time to load data or warm a cache, than during steady-state operation. - This cannot be updated. - More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes - type: object - properties: - exec: - description: Exec specifies a command to execute in the container. - type: object - properties: - command: - description: |- - Command is the command line to execute inside the container, the working directory for the - command is root ('/') in the container's filesystem. The command is simply exec'd, it is - not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use - a shell, you need to explicitly call out to that shell. - Exit status of 0 is treated as live/healthy and non-zero is unhealthy. - type: array - items: - type: string - x-kubernetes-list-type: atomic - failureThreshold: - description: |- - Minimum consecutive failures for the probe to be considered failed after having succeeded. - Defaults to 3. Minimum value is 1. - type: integer - format: int32 - grpc: - description: GRPC specifies a GRPC HealthCheckRequest. - type: object - properties: - port: - description: Port number of the gRPC service. Number must be in the range 1 to 65535. - type: integer - format: int32 - service: - description: |- - Service is the name of the service to place in the gRPC HealthCheckRequest - (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). - - If this is not specified, the default behavior is defined by gRPC. - type: string - default: "" - httpGet: - description: HTTPGet specifies an HTTP GET request to perform. - type: object - properties: - host: - description: |- - Host name to connect to, defaults to the pod IP. You probably want to set - "Host" in httpHeaders instead. - type: string - httpHeaders: - description: Custom headers to set in the request. HTTP allows repeated headers. - type: array - items: - description: HTTPHeader describes a custom header to be used in HTTP probes - type: object - required: - - name - - value - properties: - name: - description: |- - The header field name. - This will be canonicalized upon output, so case-variant names will be understood as the same header. - type: string - value: - description: The header field value - type: string - x-kubernetes-list-type: atomic - path: - description: Path to access on the HTTP server. - type: string - port: - description: |- - Name or number of the port to access on the container. - Number must be in the range 1 to 65535. - Name must be an IANA_SVC_NAME. - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - scheme: - description: |- - Scheme to use for connecting to the host. - Defaults to HTTP. - type: string - initialDelaySeconds: - description: |- - Number of seconds after the container has started before liveness probes are initiated. - More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes - type: integer - format: int32 - periodSeconds: - description: |- - How often (in seconds) to perform the probe. - type: integer - format: int32 - successThreshold: - description: |- - Minimum consecutive successes for the probe to be considered successful after having failed. - Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. - type: integer - format: int32 - tcpSocket: - description: TCPSocket specifies a connection to a TCP port. - type: object - properties: - host: - description: 'Optional: Host name to connect to, defaults to the pod IP.' - type: string - port: - description: |- - Number or name of the port to access on the container. - Number must be in the range 1 to 65535. - Name must be an IANA_SVC_NAME. - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - timeoutSeconds: - description: |- - Number of seconds after which the probe times out. - Defaults to 1 second. Minimum value is 1. - More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes - type: integer - format: int32 - terminationMessagePath: - description: |- - Optional: Path at which the file to which the container's termination message - will be written is mounted into the container's filesystem. - Message written is intended to be brief final status, such as an assertion failure message. - Will be truncated by the node if greater than 4096 bytes. The total message length across - all containers will be limited to 12kb. - Defaults to /dev/termination-log. - Cannot be updated. - type: string - terminationMessagePolicy: - description: |- - Indicate how the termination message should be populated. File will use the contents of - terminationMessagePath to populate the container status message on both success and failure. - FallbackToLogsOnError will use the last chunk of container log output if the termination - message file is empty and the container exited with an error. - The log output is limited to 2048 bytes or 80 lines, whichever is smaller. - Defaults to File. - Cannot be updated. - type: string - volumeMounts: - description: |- - Pod volumes to mount into the container's filesystem. - Cannot be updated. - type: array - items: - description: VolumeMount describes a mounting of a Volume within a container. - type: object - required: - - mountPath - - name - properties: - mountPath: - description: |- - Path within the container at which the volume should be mounted. Must - not contain ':'. - type: string - mountPropagation: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-volumes-mount-propagation - type: string - name: - description: This must match the Name of a Volume. - type: string - readOnly: - description: |- - Mounted read-only if true, read-write otherwise (false or unspecified). - Defaults to false. - type: boolean - subPath: - description: |- - Path within the volume from which the container's volume should be mounted. - Defaults to "" (volume's root). - type: string - x-kubernetes-list-map-keys: - - mountPath - x-kubernetes-list-type: map - workingDir: - description: |- - Container's working directory. - If not specified, the container runtime's default will be used, which - might be configured in the container image. - Cannot be updated. - type: string - dnsConfig: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-dnsconfig - type: object - x-kubernetes-preserve-unknown-fields: true - dnsPolicy: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-dnspolicy - type: string - enableServiceLinks: - description: |- - EnableServiceLinks indicates whether information aboutservices should be injected into pod's environment variables, matching the syntax of Docker links. Optional: Knative defaults this to false. - type: boolean - hostAliases: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-hostaliases - type: array - items: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-hostaliases - type: object - x-kubernetes-preserve-unknown-fields: true - hostIPC: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-hostipc - type: boolean - hostNetwork: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-hostnetwork - type: boolean - hostPID: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-hostpid - type: boolean - idleTimeoutSeconds: - description: |- - IdleTimeoutSeconds is the maximum duration in seconds a request will be allowed - to stay open while not receiving any bytes from the user's application. If - unspecified, a system default will be provided. - type: integer - format: int64 - imagePullSecrets: - description: |- - ImagePullSecrets is an optional list of references to secrets in the same namespace to use for pulling any of the images used by this PodSpec. - If specified, these secrets will be passed to individual puller implementations for them to use. - More info: https://kubernetes.io/docs/concepts/containers/images#specifying-imagepullsecrets-on-a-pod - type: array - items: - description: |- - LocalObjectReference contains enough information to let you locate the - referenced object inside the same namespace. - type: object - properties: - name: - description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - default: "" - x-kubernetes-map-type: atomic - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - initContainers: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-init-containers - type: array - items: - description: This is accessible behind a feature flag - kubernetes.podspec-init-containers - type: object - x-kubernetes-preserve-unknown-fields: true - nodeSelector: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-nodeselector - type: object - additionalProperties: - type: string - x-kubernetes-map-type: atomic - priorityClassName: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-priorityclassname - type: string - responseStartTimeoutSeconds: - description: |- - ResponseStartTimeoutSeconds is the maximum duration in seconds that the request - routing layer will wait for a request delivered to a container to begin - sending any network traffic. - type: integer - format: int64 - runtimeClassName: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-runtimeclassname - type: string - schedulerName: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-schedulername - type: string - securityContext: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-securitycontext - type: object - x-kubernetes-preserve-unknown-fields: true - serviceAccountName: - description: |- - ServiceAccountName is the name of the ServiceAccount to use to run this pod. - More info: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/ - type: string - shareProcessNamespace: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-shareprocessnamespace - type: boolean - timeoutSeconds: - description: |- - TimeoutSeconds is the maximum duration in seconds that the request instance - is allowed to respond to a request. If unspecified, a system default will - be provided. - type: integer - format: int64 - tolerations: - description: This is accessible behind a feature flag - kubernetes.podspec-tolerations - type: array - items: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-tolerations - type: object - x-kubernetes-preserve-unknown-fields: true - topologySpreadConstraints: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints - type: array - items: - description: This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints - type: object - x-kubernetes-preserve-unknown-fields: true - volumes: - description: |- - List of volumes that can be mounted by containers belonging to the pod. - More info: https://kubernetes.io/docs/concepts/storage/volumes - type: array - items: - description: Volume represents a named volume in a pod that may be accessed by any container in the pod. - type: object - required: - - name - properties: - configMap: - description: configMap represents a configMap that should populate this volume - type: object - properties: - defaultMode: - description: |- - defaultMode is optional: mode bits used to set permissions on created files by default. - Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. - YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. - Defaults to 0644. - Directories within the path are not affected by this setting. - This might be in conflict with other options that affect the file - mode, like fsGroup, and the result can be other mode bits set. - type: integer - format: int32 - items: - description: |- - items if unspecified, each key-value pair in the Data field of the referenced - ConfigMap will be projected into the volume as a file whose name is the - key and content is the value. If specified, the listed keys will be - projected into the specified paths, and unlisted keys will not be - present. If a key is specified which is not present in the ConfigMap, - the volume setup will error unless it is marked optional. Paths must be - relative and may not contain the '..' path or start with '..'. - type: array - items: - description: Maps a string key to a path within a volume. - type: object - required: - - key - - path - properties: - key: - description: key is the key to project. - type: string - mode: - description: |- - mode is Optional: mode bits used to set permissions on this file. - Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. - YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. - If not specified, the volume defaultMode will be used. - This might be in conflict with other options that affect the file - mode, like fsGroup, and the result can be other mode bits set. - type: integer - format: int32 - path: - description: |- - path is the relative path of the file to map the key to. - May not be an absolute path. - May not contain the path element '..'. - May not start with the string '..'. - type: string - x-kubernetes-list-type: atomic - name: - description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - default: "" - optional: - description: optional specify whether the ConfigMap or its keys must be defined - type: boolean - x-kubernetes-map-type: atomic - csi: - description: This is accessible behind a feature flag - kubernetes.podspec-volumes-csi - type: object - x-kubernetes-preserve-unknown-fields: true - emptyDir: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-volumes-emptydir - type: object - x-kubernetes-preserve-unknown-fields: true - hostPath: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-volumes-hostpath - type: object - x-kubernetes-preserve-unknown-fields: true - image: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-volumes-image - type: object - x-kubernetes-preserve-unknown-fields: true - name: - description: |- - name of the volume. - Must be a DNS_LABEL and unique within the pod. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - persistentVolumeClaim: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-persistent-volume-claim - type: object - x-kubernetes-preserve-unknown-fields: true - projected: - description: projected items for all in one resources secrets, configmaps, and downward API - type: object - properties: - defaultMode: - description: |- - defaultMode are the mode bits used to set permissions on created files by default. - Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. - YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. - Directories within the path are not affected by this setting. - This might be in conflict with other options that affect the file - mode, like fsGroup, and the result can be other mode bits set. - type: integer - format: int32 - sources: - description: |- - sources is the list of volume projections. Each entry in this list - handles one source. - type: array - items: - description: |- - Projection that may be projected along with other supported volume types. - Exactly one of these fields must be set. - type: object - properties: - configMap: - description: configMap information about the configMap data to project - type: object - properties: - items: - description: |- - items if unspecified, each key-value pair in the Data field of the referenced - ConfigMap will be projected into the volume as a file whose name is the - key and content is the value. If specified, the listed keys will be - projected into the specified paths, and unlisted keys will not be - present. If a key is specified which is not present in the ConfigMap, - the volume setup will error unless it is marked optional. Paths must be - relative and may not contain the '..' path or start with '..'. - type: array - items: - description: Maps a string key to a path within a volume. - type: object - required: - - key - - path - properties: - key: - description: key is the key to project. - type: string - mode: - description: |- - mode is Optional: mode bits used to set permissions on this file. - Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. - YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. - If not specified, the volume defaultMode will be used. - This might be in conflict with other options that affect the file - mode, like fsGroup, and the result can be other mode bits set. - type: integer - format: int32 - path: - description: |- - path is the relative path of the file to map the key to. - May not be an absolute path. - May not contain the path element '..'. - May not start with the string '..'. - type: string - x-kubernetes-list-type: atomic - name: - description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - default: "" - optional: - description: optional specify whether the ConfigMap or its keys must be defined - type: boolean - x-kubernetes-map-type: atomic - downwardAPI: - description: downwardAPI information about the downwardAPI data to project - type: object - properties: - items: - description: Items is a list of DownwardAPIVolume file - type: array - items: - description: DownwardAPIVolumeFile represents information to create the file containing the pod field - type: object - required: - - path - properties: - fieldRef: - description: 'Required: Selects a field of the pod: only annotations, labels, name, namespace and uid are supported.' - type: object - required: - - fieldPath - properties: - apiVersion: - description: Version of the schema the FieldPath is written in terms of, defaults to "v1". - type: string - fieldPath: - description: Path of the field to select in the specified API version. - type: string - x-kubernetes-map-type: atomic - mode: - description: |- - Optional: mode bits used to set permissions on this file, must be an octal value - between 0000 and 0777 or a decimal value between 0 and 511. - YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. - If not specified, the volume defaultMode will be used. - This might be in conflict with other options that affect the file - mode, like fsGroup, and the result can be other mode bits set. - type: integer - format: int32 - path: - description: 'Required: Path is the relative path name of the file to be created. Must not be absolute or contain the ''..'' path. Must be utf-8 encoded. The first item of the relative path must not start with ''..''' - type: string - resourceFieldRef: - description: |- - Selects a resource of the container: only resources limits and requests - (limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported. - type: object - required: - - resource - properties: - containerName: - description: 'Container name: required for volumes, optional for env vars' - type: string - divisor: - description: Specifies the output format of the exposed resources, defaults to "1" - pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - resource: - description: 'Required: resource to select' - type: string - x-kubernetes-map-type: atomic - x-kubernetes-list-type: atomic - secret: - description: secret information about the secret data to project - type: object - properties: - items: - description: |- - items if unspecified, each key-value pair in the Data field of the referenced - Secret will be projected into the volume as a file whose name is the - key and content is the value. If specified, the listed keys will be - projected into the specified paths, and unlisted keys will not be - present. If a key is specified which is not present in the Secret, - the volume setup will error unless it is marked optional. Paths must be - relative and may not contain the '..' path or start with '..'. - type: array - items: - description: Maps a string key to a path within a volume. - type: object - required: - - key - - path - properties: - key: - description: key is the key to project. - type: string - mode: - description: |- - mode is Optional: mode bits used to set permissions on this file. - Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. - YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. - If not specified, the volume defaultMode will be used. - This might be in conflict with other options that affect the file - mode, like fsGroup, and the result can be other mode bits set. - type: integer - format: int32 - path: - description: |- - path is the relative path of the file to map the key to. - May not be an absolute path. - May not contain the path element '..'. - May not start with the string '..'. - type: string - x-kubernetes-list-type: atomic - name: - description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - default: "" - optional: - description: optional field specify whether the Secret or its key must be defined - type: boolean - x-kubernetes-map-type: atomic - serviceAccountToken: - description: serviceAccountToken is information about the serviceAccountToken data to project - type: object - required: - - path - properties: - audience: - description: |- - audience is the intended audience of the token. A recipient of a token - must identify itself with an identifier specified in the audience of the - token, and otherwise should reject the token. The audience defaults to the - identifier of the apiserver. - type: string - expirationSeconds: - description: |- - expirationSeconds is the requested duration of validity of the service - account token. As the token approaches expiration, the kubelet volume - plugin will proactively rotate the service account token. The kubelet will - start trying to rotate the token if the token is older than 80 percent of - its time to live or if the token is older than 24 hours.Defaults to 1 hour - and must be at least 10 minutes. - type: integer - format: int64 - path: - description: |- - path is the path relative to the mount point of the file to project the - token into. - type: string - x-kubernetes-list-type: atomic - secret: - description: |- - secret represents a secret that should populate this volume. - More info: https://kubernetes.io/docs/concepts/storage/volumes#secret - type: object - properties: - defaultMode: - description: |- - defaultMode is Optional: mode bits used to set permissions on created files by default. - Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. - YAML accepts both octal and decimal values, JSON requires decimal values - for mode bits. Defaults to 0644. - Directories within the path are not affected by this setting. - This might be in conflict with other options that affect the file - mode, like fsGroup, and the result can be other mode bits set. - type: integer - format: int32 - items: - description: |- - items If unspecified, each key-value pair in the Data field of the referenced - Secret will be projected into the volume as a file whose name is the - key and content is the value. If specified, the listed keys will be - projected into the specified paths, and unlisted keys will not be - present. If a key is specified which is not present in the Secret, - the volume setup will error unless it is marked optional. Paths must be - relative and may not contain the '..' path or start with '..'. - type: array - items: - description: Maps a string key to a path within a volume. - type: object - required: - - key - - path - properties: - key: - description: key is the key to project. - type: string - mode: - description: |- - mode is Optional: mode bits used to set permissions on this file. - Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. - YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. - If not specified, the volume defaultMode will be used. - This might be in conflict with other options that affect the file - mode, like fsGroup, and the result can be other mode bits set. - type: integer - format: int32 - path: - description: |- - path is the relative path of the file to map the key to. - May not be an absolute path. - May not contain the path element '..'. - May not start with the string '..'. - type: string - x-kubernetes-list-type: atomic - optional: - description: optional field specify whether the Secret or its keys must be defined - type: boolean - secretName: - description: |- - secretName is the name of the secret in the pod's namespace to use. - More info: https://kubernetes.io/docs/concepts/storage/volumes#secret - type: string - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - traffic: - description: |- - Traffic specifies how to distribute traffic over a collection of - revisions and configurations. - type: array - items: - description: TrafficTarget holds a single entry of the routing table for a Route. - type: object - properties: - configurationName: - description: |- - ConfigurationName of a configuration to whose latest revision we will send - this portion of traffic. When the "status.latestReadyRevisionName" of the - referenced configuration changes, we will automatically migrate traffic - from the prior "latest ready" revision to the new one. This field is never - set in Route's status, only its spec. This is mutually exclusive with - RevisionName. - type: string - latestRevision: - description: |- - LatestRevision may be optionally provided to indicate that the latest - ready Revision of the Configuration should be used for this traffic - target. When provided LatestRevision must be true if RevisionName is - empty; it must be false when RevisionName is non-empty. - type: boolean - percent: - description: |- - Percent indicates that percentage based routing should be used and - the value indicates the percent of traffic that is be routed to this - Revision or Configuration. `0` (zero) mean no traffic, `100` means all - traffic. - When percentage based routing is being used the follow rules apply: - - the sum of all percent values must equal 100 - - when not specified, the implied value for `percent` is zero for - that particular Revision or Configuration - type: integer - format: int64 - revisionName: - description: |- - RevisionName of a specific revision to which to send this portion of - traffic. This is mutually exclusive with ConfigurationName. - type: string - tag: - description: |- - Tag is optionally used to expose a dedicated url for referencing - this target exclusively. - type: string - url: - description: |- - URL displays the URL for accessing named traffic targets. URL is displayed in - status, and is disallowed on spec. URL must contain a scheme (e.g. http://) and - a hostname, but may not contain anything else (e.g. basic auth, url path, etc.) - type: string - status: - description: ServiceStatus represents the Status stanza of the Service resource. - type: object - properties: - address: - description: Address holds the information needed for a Route to be the target of an event. - type: object - properties: - CACerts: - description: |- - CACerts is the Certification Authority (CA) certificates in PEM format - according to https://www.rfc-editor.org/rfc/rfc7468. - type: string - audience: - description: Audience is the OIDC audience for this address. - type: string - name: - description: Name is the name of the address. - type: string - url: - type: string - annotations: - description: |- - Annotations is additional Status fields for the Resource to save some - additional State as well as convey more information to the user. This is - roughly akin to Annotations on any k8s resource, just the reconciler conveying - richer information outwards. - type: object - additionalProperties: - type: string - conditions: - description: Conditions the latest available observations of a resource's current state. - type: array - items: - description: |- - Condition defines a readiness condition for a Knative resource. - See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties - type: object - required: - - status - - type - properties: - lastTransitionTime: - description: |- - LastTransitionTime is the last time the condition transitioned from one status to another. - We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic - differences (all other things held constant). - type: string - message: - description: A human readable message indicating details about the transition. - type: string - reason: - description: The reason for the condition's last transition. - type: string - severity: - description: |- - Severity with which to treat failures of this type of condition. - When this is not specified, it defaults to Error. - type: string - status: - description: Status of the condition, one of True, False, Unknown. - type: string - type: - description: Type of condition. - type: string - latestCreatedRevisionName: - description: |- - LatestCreatedRevisionName is the last revision that was created from this - Configuration. It might not be ready yet, for that use LatestReadyRevisionName. - type: string - latestReadyRevisionName: - description: |- - LatestReadyRevisionName holds the name of the latest Revision stamped out - from this Configuration that has had its "Ready" condition become "True". - type: string - observedGeneration: - description: |- - ObservedGeneration is the 'Generation' of the Service that - was last processed by the controller. - type: integer - format: int64 - traffic: - description: |- - Traffic holds the configured traffic distribution. - These entries will always contain RevisionName references. - When ConfigurationName appears in the spec, this will hold the - LatestReadyRevisionName that we last observed. - type: array - items: - description: TrafficTarget holds a single entry of the routing table for a Route. - type: object - properties: - configurationName: - description: |- - ConfigurationName of a configuration to whose latest revision we will send - this portion of traffic. When the "status.latestReadyRevisionName" of the - referenced configuration changes, we will automatically migrate traffic - from the prior "latest ready" revision to the new one. This field is never - set in Route's status, only its spec. This is mutually exclusive with - RevisionName. - type: string - latestRevision: - description: |- - LatestRevision may be optionally provided to indicate that the latest - ready Revision of the Configuration should be used for this traffic - target. When provided LatestRevision must be true if RevisionName is - empty; it must be false when RevisionName is non-empty. - type: boolean - percent: - description: |- - Percent indicates that percentage based routing should be used and - the value indicates the percent of traffic that is be routed to this - Revision or Configuration. `0` (zero) mean no traffic, `100` means all - traffic. - When percentage based routing is being used the follow rules apply: - - the sum of all percent values must equal 100 - - when not specified, the implied value for `percent` is zero for - that particular Revision or Configuration - type: integer - format: int64 - revisionName: - description: |- - RevisionName of a specific revision to which to send this portion of - traffic. This is mutually exclusive with ConfigurationName. - type: string - tag: - description: |- - Tag is optionally used to expose a dedicated url for referencing - this target exclusively. - type: string - url: - description: |- - URL displays the URL for accessing named traffic targets. URL is displayed in - status, and is disallowed on spec. URL must contain a scheme (e.g. http://) and - a hostname, but may not contain anything else (e.g. basic auth, url path, etc.) - type: string - url: - description: |- - URL holds the url that will distribute traffic over the provided traffic targets. - It generally has the form http[s]://{route-name}.{route-namespace}.{cluster-level-suffix} - type: string ---- -# Copyright 2018 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - name: images.caching.internal.knative.dev - labels: - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" - knative.dev/crd-install: "true" -spec: - group: caching.internal.knative.dev - names: - kind: Image - plural: images - singular: image - categories: - - knative-internal - - caching - scope: Namespaced - versions: - - name: v1alpha1 - served: true - storage: true - subresources: - status: {} - schema: - openAPIV3Schema: - description: |- - Image is a Knative abstraction that encapsulates the interface by which Knative - components express a desire to have a particular image cached. - type: object - properties: - apiVersion: - description: |- - APIVersion defines the versioned schema of this representation of an object. - Servers should convert recognized schemas to the latest internal value, and - may reject unrecognized values. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources - type: string - kind: - description: |- - Kind is a string value representing the REST resource this object represents. - Servers may infer this from the endpoint the client submits requests to. - Cannot be updated. - In CamelCase. - More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds - type: string - metadata: - type: object - spec: - description: Spec holds the desired state of the Image (from the client). - type: object - required: - - image - properties: - image: - description: Image is the name of the container image url to cache across the cluster. - type: string - imagePullSecrets: - description: |- - ImagePullSecrets contains the names of the Kubernetes Secrets containing login - information used by the Pods which will run this container. - type: array - items: - description: |- - LocalObjectReference contains enough information to let you locate the - referenced object inside the same namespace. - type: object - properties: - name: - description: |- - Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. - More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names - type: string - default: "" - x-kubernetes-map-type: atomic - serviceAccountName: - description: |- - ServiceAccountName is the name of the Kubernetes ServiceAccount as which the Pods - will run this container. This is potentially used to authenticate the image pull - if the service account has attached pull secrets. For more information: - https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#add-imagepullsecrets-to-a-service-account - type: string - status: - description: Status communicates the observed state of the Image (from the controller). - type: object - properties: - annotations: - description: |- - Annotations is additional Status fields for the Resource to save some - additional State as well as convey more information to the user. This is - roughly akin to Annotations on any k8s resource, just the reconciler conveying - richer information outwards. - type: object - additionalProperties: - type: string - conditions: - description: Conditions the latest available observations of a resource's current state. - type: array - items: - description: |- - Condition defines a readiness condition for a Knative resource. - See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties - type: object - required: - - status - - type - properties: - lastTransitionTime: - description: |- - LastTransitionTime is the last time the condition transitioned from one status to another. - We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic - differences (all other things held constant). - type: string - message: - description: A human readable message indicating details about the transition. - type: string - reason: - description: The reason for the condition's last transition. - type: string - severity: - description: |- - Severity with which to treat failures of this type of condition. - When this is not specified, it defaults to Error. - type: string - status: - description: Status of the condition, one of True, False, Unknown. - type: string - type: - description: Type of condition. - type: string - observedGeneration: - description: |- - ObservedGeneration is the 'Generation' of the Service that - was last processed by the controller. - type: integer - format: int64 - additionalPrinterColumns: - - name: Image - type: string - jsonPath: .spec.image ---- -# Source: https://github.com/knative/serving/releases/download/knative-v1.22.1/serving-core.yaml ---- -# Copyright 2018 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: v1 -kind: Namespace -metadata: - name: knative-serving - labels: - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" ---- -# Copyright 2023 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: knative-serving-activator - namespace: knative-serving - labels: - serving.knative.dev/controller: "true" - app.kubernetes.io/version: "1.22.1" - app.kubernetes.io/name: knative-serving -rules: - - apiGroups: [""] - resources: ["configmaps", "secrets"] - verbs: ["get", "list", "watch"] - - apiGroups: [""] - resources: ["secrets"] - verbs: ["get", "list", "watch"] - resourceNames: ["routing-serving-certs", "knative-serving-certs"] ---- -kind: ClusterRole -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: knative-serving-activator-cluster - labels: - serving.knative.dev/controller: "true" - app.kubernetes.io/version: "1.22.1" - app.kubernetes.io/name: knative-serving -rules: - - apiGroups: [""] - resources: ["services", "endpoints"] - verbs: ["get", "list", "watch"] - - apiGroups: ["serving.knative.dev"] - resources: ["revisions"] - verbs: ["get", "list", "watch"] ---- -# Copyright 2019 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -# Use this aggregated ClusterRole when you need readonly access to "Addressables" -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - # Named like this to avoid clashing with eventing's existing `addressable-resolver` role - # (which should be identical, but isn't guaranteed to be installed alongside serving). - name: knative-serving-aggregated-addressable-resolver - labels: - app.kubernetes.io/version: "1.22.1" - app.kubernetes.io/name: knative-serving -aggregationRule: - clusterRoleSelectors: - - matchLabels: - duck.knative.dev/addressable: "true" ---- -kind: ClusterRole -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: knative-serving-addressable-resolver - labels: - app.kubernetes.io/version: "1.22.1" - app.kubernetes.io/name: knative-serving - # Labeled to facilitate aggregated cluster roles that act on Addressables. - duck.knative.dev/addressable: "true" -# Do not use this role directly. These rules will be added to the "addressable-resolver" role. -rules: - - apiGroups: - - serving.knative.dev - resources: - - routes - - routes/status - - services - - services/status - verbs: - - get - - list - - watch ---- -# Copyright 2019 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -kind: ClusterRole -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: knative-serving-namespaced-admin - labels: - rbac.authorization.k8s.io/aggregate-to-admin: "true" - app.kubernetes.io/version: "1.22.1" - app.kubernetes.io/name: knative-serving -rules: - - apiGroups: ["serving.knative.dev"] - resources: ["*"] - verbs: ["*"] - - apiGroups: ["networking.internal.knative.dev", "autoscaling.internal.knative.dev", "caching.internal.knative.dev"] - resources: ["*"] - verbs: ["get", "list", "watch"] ---- -kind: ClusterRole -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: knative-serving-namespaced-edit - labels: - rbac.authorization.k8s.io/aggregate-to-edit: "true" - app.kubernetes.io/version: "1.22.1" - app.kubernetes.io/name: knative-serving -rules: - - apiGroups: ["serving.knative.dev"] - resources: ["*"] - verbs: ["create", "update", "patch", "delete"] - - apiGroups: ["networking.internal.knative.dev", "autoscaling.internal.knative.dev", "caching.internal.knative.dev"] - resources: ["*"] - verbs: ["get", "list", "watch"] ---- -kind: ClusterRole -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: knative-serving-namespaced-view - labels: - rbac.authorization.k8s.io/aggregate-to-view: "true" - app.kubernetes.io/version: "1.22.1" - app.kubernetes.io/name: knative-serving -rules: - - apiGroups: ["serving.knative.dev", "networking.internal.knative.dev", "autoscaling.internal.knative.dev", "caching.internal.knative.dev"] - resources: ["*"] - verbs: ["get", "list", "watch"] ---- -# Copyright 2019 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -kind: ClusterRole -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: knative-serving-core - labels: - serving.knative.dev/controller: "true" - app.kubernetes.io/version: "1.22.1" - app.kubernetes.io/name: knative-serving -rules: - - apiGroups: [""] - resources: ["pods", "namespaces", "secrets", "configmaps", "endpoints", "services", "events", "serviceaccounts"] - verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] - - apiGroups: [""] - resources: ["endpoints/restricted"] # Permission for RestrictedEndpointsAdmission - verbs: ["create"] - - apiGroups: ["discovery.k8s.io"] - resources: ["endpointslices/restricted"] # Permission for RestrictedEndpointsAdmission - verbs: ["create"] - - apiGroups: [""] - resources: ["namespaces/finalizers"] # finalizers are needed for the owner reference of the webhook - verbs: ["update"] - - apiGroups: ["discovery.k8s.io"] - resources: ["endpointslices"] - verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] - - apiGroups: ["apps"] - resources: ["deployments", "deployments/finalizers"] # finalizers are needed for the owner reference of the webhook - verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] - - apiGroups: ["admissionregistration.k8s.io"] - resources: ["mutatingwebhookconfigurations", "validatingwebhookconfigurations"] - verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] - - apiGroups: ["apiextensions.k8s.io"] - resources: ["customresourcedefinitions", "customresourcedefinitions/status"] - verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] - - apiGroups: ["autoscaling"] - resources: ["horizontalpodautoscalers"] - verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] - - apiGroups: ["coordination.k8s.io"] - resources: ["leases"] - verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] - - apiGroups: ["serving.knative.dev", "autoscaling.internal.knative.dev", "networking.internal.knative.dev"] - resources: ["*", "*/status", "*/finalizers"] - verbs: ["get", "list", "create", "update", "delete", "deletecollection", "patch", "watch"] - - apiGroups: ["caching.internal.knative.dev"] - resources: ["images"] - verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] - - apiGroups: ["cert-manager.io"] - resources: ["certificates", "clusterissuers", "certificaterequests", "issuers"] - verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] - - apiGroups: ["acme.cert-manager.io"] - resources: ["challenges"] - verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] - - apiGroups: ["rbac.authorization.k8s.io"] - resources: ["clusterroles"] - verbs: ["delete"] - resourceNames: ["knative-serving-certmanager"] - - apiGroups: ["*"] - resources: ["*/scale"] - verbs: ["patch"] ---- -# Copyright 2019 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -kind: ClusterRole -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: knative-serving-podspecable-binding - labels: - app.kubernetes.io/version: "1.22.1" - app.kubernetes.io/name: knative-serving - # Labeled to facilitate aggregated cluster roles that act on PodSpecables. - duck.knative.dev/podspecable: "true" -# Do not use this role directly. These rules will be added to the "podspecable-binder" role. -rules: - - apiGroups: - - serving.knative.dev - resources: - - configurations - - services - verbs: - - list - - watch - - patch ---- -# Copyright 2018 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: v1 -kind: ServiceAccount -metadata: - name: controller - namespace: knative-serving - labels: - app.kubernetes.io/component: controller - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" ---- -kind: ClusterRole -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: knative-serving-admin - labels: - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" -aggregationRule: - clusterRoleSelectors: - - matchLabels: - serving.knative.dev/controller: "true" ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: knative-serving-controller-admin - labels: - app.kubernetes.io/component: controller - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" -subjects: - - kind: ServiceAccount - name: controller - namespace: knative-serving -roleRef: - kind: ClusterRole - name: knative-serving-admin - apiGroup: rbac.authorization.k8s.io ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: knative-serving-controller-addressable-resolver - labels: - app.kubernetes.io/component: controller - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" -subjects: - - kind: ServiceAccount - name: controller - namespace: knative-serving -roleRef: - kind: ClusterRole - name: knative-serving-aggregated-addressable-resolver - apiGroup: rbac.authorization.k8s.io ---- -apiVersion: v1 -kind: ServiceAccount -metadata: - name: activator - namespace: knative-serving - labels: - app.kubernetes.io/component: activator - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: knative-serving-activator - namespace: knative-serving - labels: - app.kubernetes.io/component: activator - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" -subjects: - - kind: ServiceAccount - name: activator - namespace: knative-serving -roleRef: - kind: Role - name: knative-serving-activator - apiGroup: rbac.authorization.k8s.io ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: knative-serving-activator-cluster - labels: - app.kubernetes.io/component: activator - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" -subjects: - - kind: ServiceAccount - name: activator - namespace: knative-serving -roleRef: - kind: ClusterRole - name: knative-serving-activator-cluster - apiGroup: rbac.authorization.k8s.io ---- -apiVersion: networking.internal.knative.dev/v1alpha1 -kind: Certificate -metadata: - annotations: - networking.knative.dev/certificate.class: cert-manager.certificate.networking.knative.dev - labels: - networking.knative.dev/certificate-type: system-internal - name: routing-serving-certs - namespace: knative-serving -spec: - dnsNames: - - kn-routing - - data-plane.knative.dev # for reverse-compatibility with net-* implementations that do not work with multi-SANs - secretName: routing-serving-certs ---- -# Copyright 2018 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: caching.internal.knative.dev/v1alpha1 -kind: Image -metadata: - name: queue-proxy - namespace: knative-serving - labels: - app.kubernetes.io/component: queue-proxy - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" -spec: - # This is the Go import path for the binary that is containerized - # and substituted here. - image: gcr.io/knative-releases/knative.dev/serving/cmd/queue@sha256:b1af8bda6c1d32b1cf5fbf8f1f6068c5007a5cebf091039fdea83b88b1fd87f4 ---- -# Copyright 2018 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: v1 -kind: ConfigMap -metadata: - name: config-autoscaler - namespace: knative-serving - labels: - app.kubernetes.io/component: autoscaler - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" - annotations: - knative.dev/example-checksum: "c727b3e8" -data: - _example: | - ################################ - # # - # EXAMPLE CONFIGURATION # - # # - ################################ - - # This block is not actually functional configuration, - # but serves to illustrate the available configuration - # options and document them in a way that is accessible - # to users that `kubectl edit` this config map. - # - # These sample configuration options may be copied out of - # this example block and unindented to be in the data block - # to actually change the configuration. - - # The Revision ContainerConcurrency field specifies the maximum number - # of requests the Container can handle at once. Container concurrency - # target percentage is how much of that maximum to use in a stable - # state. E.g. if a Revision specifies ContainerConcurrency of 10, then - # the Autoscaler will try to maintain 7 concurrent connections per pod - # on average. - # Note: this limit will be applied to container concurrency set at every - # level (ConfigMap, Revision Spec or Annotation). - # For legacy and backwards compatibility reasons, this value also accepts - # fractional values in (0, 1] interval (i.e. 0.7 ⇒ 70%). - # Thus minimal percentage value must be greater than 1.0, or it will be - # treated as a fraction. - # NOTE: that this value does not affect actual number of concurrent requests - # the user container may receive, but only the average number of requests - # that the revision pods will receive. - container-concurrency-target-percentage: "70" - - # The container concurrency target default is what the Autoscaler will - # try to maintain when concurrency is used as the scaling metric for the - # Revision and the Revision specifies unlimited concurrency. - # When revision explicitly specifies container concurrency, that value - # will be used as a scaling target for autoscaler. - # When specifying unlimited concurrency, the autoscaler will - # horizontally scale the application based on this target concurrency. - # This is what we call "soft limit" in the documentation, i.e. it only - # affects number of pods and does not affect the number of requests - # individual pod processes. - # The value must be a positive number such that the value multiplied - # by container-concurrency-target-percentage is greater than 0.01. - # NOTE: that this value will be adjusted by application of - # container-concurrency-target-percentage, i.e. by default - # the system will target on average 70 concurrent requests - # per revision pod. - # NOTE: Only one metric can be used for autoscaling a Revision. - container-concurrency-target-default: "100" - - # The requests per second (RPS) target default is what the Autoscaler will - # try to maintain when RPS is used as the scaling metric for a Revision and - # the Revision specifies unlimited RPS. Even when specifying unlimited RPS, - # the autoscaler will horizontally scale the application based on this - # target RPS. - # Must be greater than 1.0. - # NOTE: Only one metric can be used for autoscaling a Revision. - requests-per-second-target-default: "200" - - # The target burst capacity specifies the size of burst in concurrent - # requests that the system operator expects the system will receive. - # Autoscaler will try to protect the system from queueing by introducing - # Activator in the request path if the current spare capacity of the - # service is less than this setting. - # If this setting is 0, then Activator will be in the request path only - # when the revision is scaled to 0. - # If this setting is > 0 and container-concurrency-target-percentage is - # 100% or 1.0, then activator will always be in the request path. - # -1 denotes unlimited target-burst-capacity and activator will always - # be in the request path. - # Other negative values are invalid. - target-burst-capacity: "211" - - # When operating in a stable mode, the autoscaler operates on the - # average concurrency over the stable window. - # Stable window must be in whole seconds. - stable-window: "60s" - - # When observed average concurrency during the panic window reaches - # panic-threshold-percentage the target concurrency, the autoscaler - # enters panic mode. When operating in panic mode, the autoscaler - # scales on the average concurrency over the panic window which is - # panic-window-percentage of the stable-window. - # Must be in the [1, 100] range. - # When computing the panic window it will be rounded to the closest - # whole second, at least 1s. - panic-window-percentage: "10.0" - - # The percentage of the container concurrency target at which to - # enter panic mode when reached within the panic window. - panic-threshold-percentage: "200.0" - - # Max scale up rate limits the rate at which the autoscaler will - # increase pod count. It is the maximum ratio of desired pods versus - # observed pods. - # Cannot be less or equal to 1. - # I.e with value of 2.0 the number of pods can at most go N to 2N - # over single Autoscaler period (2s), but at least N to - # N+1, if Autoscaler needs to scale up. - max-scale-up-rate: "1000.0" - - # Max scale down rate limits the rate at which the autoscaler will - # decrease pod count. It is the maximum ratio of observed pods versus - # desired pods. - # Cannot be less or equal to 1. - # I.e. with value of 2.0 the number of pods can at most go N to N/2 - # over single Autoscaler evaluation period (2s), but at - # least N to N-1, if Autoscaler needs to scale down. - max-scale-down-rate: "2.0" - - # Scale to zero feature flag. - enable-scale-to-zero: "true" - - # Scale to zero grace period is the time an inactive revision is left - # running before it is scaled to zero (must be positive, but recommended - # at least a few seconds if running with mesh networking). - # This is the upper limit and is provided not to enforce timeout after - # the revision stopped receiving requests for stable window, but to - # ensure network reprogramming to put activator in the path has completed. - # If the system determines that a shorter period is satisfactory, - # then the system will only wait that amount of time before scaling to 0. - # NOTE: this period might actually be 0, if activator has been - # in the request path sufficiently long. - # If there is necessity for the last pod to linger longer use - # scale-to-zero-pod-retention-period flag. - scale-to-zero-grace-period: "30s" - - # Scale to zero pod retention period defines the minimum amount - # of time the last pod will remain after Autoscaler has decided to - # scale to zero. - # This flag is for the situations where the pod startup is very expensive - # and the traffic is bursty (requiring smaller windows for fast action), - # but patchy. - # The larger of this flag and `scale-to-zero-grace-period` will effectively - # determine how the last pod will hang around. - scale-to-zero-pod-retention-period: "0s" - - # pod-autoscaler-class specifies the default pod autoscaler class - # that should be used if none is specified. If omitted, - # the Knative Pod Autoscaler (KPA) is used by default. - pod-autoscaler-class: "kpa.autoscaling.knative.dev" - - # The capacity of a single activator task. - # The `unit` is one concurrent request proxied by the activator. - # activator-capacity must be at least 1. - # This value is used for computation of the Activator subset size. - # See the algorithm here: https://bit.ly/38XiCZ3. - # TODO(vagababov): tune after actual benchmarking. - activator-capacity: "100.0" - - # initial-scale is the cluster-wide default value for the initial target - # scale of a revision after creation, unless overridden by the - # "autoscaling.knative.dev/initialScale" annotation. - # This value must be greater than 0 unless allow-zero-initial-scale is true. - initial-scale: "1" - - # allow-zero-initial-scale controls whether either the cluster-wide initial-scale flag, - # or the "autoscaling.knative.dev/initialScale" annotation, can be set to 0. - allow-zero-initial-scale: "false" - - # min-scale is the cluster-wide default value for the min scale of a revision, - # unless overridden by the "autoscaling.knative.dev/minScale" annotation. - min-scale: "0" - - # max-scale is the cluster-wide default value for the max scale of a revision, - # unless overridden by the "autoscaling.knative.dev/maxScale" annotation. - # If set to 0, the revision has no maximum scale. - max-scale: "0" - - # scale-down-delay is the amount of time that must pass at reduced - # concurrency before a scale down decision is applied. This can be useful, - # for example, to maintain replica count and avoid a cold start penalty if - # more requests come in within the scale down delay period. - # The default, 0s, imposes no delay at all. - scale-down-delay: "0s" - - # max-scale-limit sets the maximum permitted value for the max scale of a revision. - # When this is set to a positive value, a revision with a maxScale above that value - # (including a maxScale of "0" = unlimited) is disallowed. - # A value of zero (the default) allows any limit, including unlimited. - max-scale-limit: "0" ---- -# Copyright 2020 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: v1 -kind: ConfigMap -metadata: - name: config-certmanager - namespace: knative-serving - labels: - app.kubernetes.io/name: knative-serving - app.kubernetes.io/component: controller - app.kubernetes.io/version: "1.22.1" - networking.knative.dev/certificate-provider: cert-manager - annotations: - knative.dev/example-checksum: "b7a9a602" -data: - _example: | - ################################ - # # - # EXAMPLE CONFIGURATION # - # # - ################################ - - # This block is not actually functional configuration, - # but serves to illustrate the available configuration - # options and document them in a way that is accessible - # to users that `kubectl edit` this config map. - # - # These sample configuration options may be copied out of - # this block and unindented to actually change the configuration. - - # issuerRef is a reference to the issuer for external-domain certificates used for ingress. - # IssuerRef should be either `ClusterIssuer` or `Issuer`. - # Please refer `IssuerRef` in https://cert-manager.io/docs/concepts/issuer/ - # for more details about IssuerRef configuration. - # If the issuerRef is not specified, the self-signed `knative-selfsigned-issuer` ClusterIssuer is used. - issuerRef: | - kind: ClusterIssuer - name: letsencrypt-issuer - - # clusterLocalIssuerRef is a reference to the issuer for cluster-local-domain certificates used for ingress. - # clusterLocalIssuerRef should be either `ClusterIssuer` or `Issuer`. - # Please refer `IssuerRef` in https://cert-manager.io/docs/concepts/issuer/ - # for more details about ClusterInternalIssuerRef configuration. - # If the clusterLocalIssuerRef is not specified, the self-signed `knative-selfsigned-issuer` ClusterIssuer is used. - clusterLocalIssuerRef: | - kind: ClusterIssuer - name: your-company-issuer - - # systemInternalIssuerRef is a reference to the issuer for certificates for system-internal-tls certificates used by Knative internal components. - # systemInternalIssuerRef should be either `ClusterIssuer` or `Issuer`. - # Please refer `IssuerRef` in https://cert-manager.io/docs/concepts/issuer/ - # for more details about ClusterInternalIssuerRef configuration. - # If the systemInternalIssuerRef is not specified, the self-signed `knative-selfsigned-issuer` ClusterIssuer is used. - systemInternalIssuerRef: | - kind: ClusterIssuer - name: knative-selfsigned-issuer ---- -# Copyright 2019 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: v1 -kind: ConfigMap -metadata: - name: config-defaults - namespace: knative-serving - labels: - app.kubernetes.io/name: knative-serving - app.kubernetes.io/component: controller - app.kubernetes.io/version: "1.22.1" - annotations: - knative.dev/example-checksum: "5b64ff5c" -data: - _example: | - ################################ - # # - # EXAMPLE CONFIGURATION # - # # - ################################ - - # This block is not actually functional configuration, - # but serves to illustrate the available configuration - # options and document them in a way that is accessible - # to users that `kubectl edit` this config map. - # - # These sample configuration options may be copied out of - # this example block and unindented to be in the data block - # to actually change the configuration. - - # revision-timeout-seconds contains the default number of - # seconds to use for the revision's per-request timeout, if - # none is specified. - revision-timeout-seconds: "300" # 5 minutes - - # max-revision-timeout-seconds contains the maximum number of - # seconds that can be used for revision-timeout-seconds. - # This value must be greater than or equal to revision-timeout-seconds. - # If omitted, the system default is used (600 seconds). - # - # If this value is increased, the activator's terminationGracePeriodSeconds - # should also be increased to prevent in-flight requests being disrupted. - max-revision-timeout-seconds: "600" # 10 minutes - - # revision-response-start-timeout-seconds contains the default number of - # seconds a request will be allowed to stay open while waiting to - # receive any bytes from the user's application, if none is specified. - # - # This defaults to 'revision-timeout-seconds' - revision-response-start-timeout-seconds: "300" - - # revision-idle-timeout-seconds contains the default number of - # seconds a request will be allowed to stay open while not receiving any - # bytes from the user's application, if none is specified. - revision-idle-timeout-seconds: "0" # infinite - - # revision-cpu-request contains the cpu allocation to assign - # to revisions by default. If omitted, no value is specified - # and the system default is used. - # Below is an example of setting revision-cpu-request. - # By default, it is not set by Knative. - revision-cpu-request: "400m" # 0.4 of a CPU (aka 400 milli-CPU) - - # revision-memory-request contains the memory allocation to assign - # to revisions by default. If omitted, no value is specified - # and the system default is used. - # Below is an example of setting revision-memory-request. - # By default, it is not set by Knative. - revision-memory-request: "100M" # 100 megabytes of memory - - # revision-ephemeral-storage-request contains the ephemeral storage - # allocation to assign to revisions by default. If omitted, no value is - # specified and the system default is used. - revision-ephemeral-storage-request: "500M" # 500 megabytes of storage - - # revision-cpu-limit contains the cpu allocation to limit - # revisions to by default. If omitted, no value is specified - # and the system default is used. - # Below is an example of setting revision-cpu-limit. - # By default, it is not set by Knative. - revision-cpu-limit: "1000m" # 1 CPU (aka 1000 milli-CPU) - - # revision-memory-limit contains the memory allocation to limit - # revisions to by default. If omitted, no value is specified - # and the system default is used. - # Below is an example of setting revision-memory-limit. - # By default, it is not set by Knative. - revision-memory-limit: "200M" # 200 megabytes of memory - - # revision-ephemeral-storage-limit contains the ephemeral storage - # allocation to limit revisions to by default. If omitted, no value is - # specified and the system default is used. - revision-ephemeral-storage-limit: "750M" # 750 megabytes of storage - - # container-name-template contains a template for the default - # container name, if none is specified. This field supports - # Go templating and is supplied with the ObjectMeta of the - # enclosing Service or Configuration, so values such as - # {{.Name}} are also valid. - container-name-template: "user-container" - - # init-container-name-template contains a template for the default - # init container name, if none is specified. This field supports - # Go templating and is supplied with the ObjectMeta of the - # enclosing Service or Configuration, so values such as - # {{.Name}} are also valid. - init-container-name-template: "init-container" - - # container-concurrency specifies the maximum number - # of requests the Container can handle at once, and requests - # above this threshold are queued. Setting a value of zero - # disables this throttling and lets through as many requests as - # the pod receives. - container-concurrency: "0" - - # The container concurrency max limit is an operator setting ensuring that - # the individual revisions cannot have arbitrary large concurrency - # values, or autoscaling targets. `container-concurrency` default setting - # must be at or below this value. - # - # Must be greater than 1. - # - # Note: even with this set, a user can choose a containerConcurrency - # of 0 (i.e. unbounded) unless allow-container-concurrency-zero is - # set to "false". - container-concurrency-max-limit: "1000" - - # allow-container-concurrency-zero controls whether users can - # specify 0 (i.e. unbounded) for containerConcurrency. - allow-container-concurrency-zero: "true" - - # enable-service-links specifies the default value used for the - # enableServiceLinks field of the PodSpec, when it is omitted by the user. - # See: https://kubernetes.io/docs/concepts/services-networking/connect-applications-service/#accessing-the-service - # - # This is a tri-state flag with possible values of (true|false|default). - # - # In environments with large number of services it is suggested - # to set this value to `false`. - # See https://github.com/knative/serving/issues/8498. - enable-service-links: "false" ---- -# Copyright 2019 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: v1 -kind: ConfigMap -metadata: - name: config-deployment - namespace: knative-serving - labels: - app.kubernetes.io/name: knative-serving - app.kubernetes.io/component: controller - app.kubernetes.io/version: "1.22.1" - annotations: - knative.dev/example-checksum: "555b4826" -data: - # This is the Go import path for the binary that is containerized - # and substituted here. - queue-sidecar-image: gcr.io/knative-releases/knative.dev/serving/cmd/queue@sha256:b1af8bda6c1d32b1cf5fbf8f1f6068c5007a5cebf091039fdea83b88b1fd87f4 - _example: |- - ################################ - # # - # EXAMPLE CONFIGURATION # - # # - ################################ - - # This block is not actually functional configuration, - # but serves to illustrate the available configuration - # options and document them in a way that is accessible - # to users that `kubectl edit` this config map. - # - # These sample configuration options may be copied out of - # this example block and unindented to be in the data block - # to actually change the configuration. - - # List of repositories for which tag to digest resolving should be skipped - registries-skipping-tag-resolving: "kind.local,ko.local,dev.local" - - # Maximum time allowed for an image's digests to be resolved. - digest-resolution-timeout: "10s" - - # Duration we wait for the deployment to be ready before considering it failed. - progress-deadline: "600s" - - # Sets the queue proxy's CPU request. - # If omitted, a default value (currently "25m"), is used. - queue-sidecar-cpu-request: "25m" - - # Sets the queue proxy's CPU limit. - # If omitted, a default value (currently "1000m"), is used when - # `queueproxy.resource-defaults` is set to `Enabled`. - queue-sidecar-cpu-limit: "1000m" - - # Sets the queue proxy's memory request. - # If omitted, a default value (currently "400Mi"), is used when - # `queueproxy.resource-defaults` is set to `Enabled`. - queue-sidecar-memory-request: "400Mi" - - # Sets the queue proxy's memory limit. - # If omitted, a default value (currently "800Mi"), is used when - # `queueproxy.resource-defaults` is set to `Enabled`. - queue-sidecar-memory-limit: "800Mi" - - # Sets the queue proxy's ephemeral storage request. - # If omitted, no value is specified and the system default is used. - queue-sidecar-ephemeral-storage-request: "512Mi" - - # Sets the queue proxy's ephemeral storage limit. - # If omitted, no value is specified and the system default is used. - queue-sidecar-ephemeral-storage-limit: "1024Mi" - - # Sets tokens associated with specific audiences for queue proxy - used by QPOptions - # - # For example, to add the `service-x` audience: - # queue-sidecar-token-audiences: "service-x" - # Also supports a list of audiences, for example: - # queue-sidecar-token-audiences: "service-x,service-y" - # If omitted, or empty, no tokens are created - queue-sidecar-token-audiences: "" - - # Sets rootCA for the queue proxy - used by QPOptions - # If omitted, or empty, no rootCA is added to the golang rootCAs - queue-sidecar-rootca: "" - - # Sets the minimum TLS version for the queue proxy sidecar's TLS server. - # Accepted values: "1.2", "1.3". Default is "1.3" if not specified. - queue-sidecar-tls-min-version: "" - - # Sets the maximum TLS version for the queue proxy sidecar's TLS server. - # Accepted values: "1.2", "1.3". If omitted, the Go default is used. - queue-sidecar-tls-max-version: "" - - # Sets the cipher suites for the queue proxy sidecar's TLS server. - # Comma-separated list of cipher suite names (e.g. "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"). - # If omitted, the Go default cipher suites are used. - # Note: cipher suites are not configurable in TLS 1.3. - queue-sidecar-tls-cipher-suites: "" - - # Sets the elliptic curve preferences for the queue proxy sidecar's TLS server. - # Comma-separated list of curve names (e.g. "X25519,CurveP256"). - # If omitted, the Go default curves are used. - queue-sidecar-tls-curve-preferences: "" - - # If set, it automatically configures pod anti-affinity requirements for all Knative services. - # It employs the `preferredDuringSchedulingIgnoredDuringExecution` weighted pod affinity term, - # aligning with the Knative revision label. It yields the configuration below in all workloads' deployments: - # ` - # affinity: - # podAntiAffinity: - # preferredDuringSchedulingIgnoredDuringExecution: - # - podAffinityTerm: - # topologyKey: kubernetes.io/hostname - # labelSelector: - # matchLabels: - # serving.knative.dev/revision: {{revision-name}} - # weight: 100 - # ` - # This may be "none" or "prefer-spread-revision-over-nodes" (default) - # default-affinity-type: "prefer-spread-revision-over-nodes" - - # runtime-class-name contains the selector for which runtimeClassName - # is selected to put in a revision. - # By default, it is not set by Knative. - # - # Example: - # runtime-class-name: | - # "": - # selector: - # use-default-runc: "yes" - # kata: {} - # gvisor: - # selector: - # use-gvisor: "please" - runtime-class-name: "" - - # pod-is-always-schedulable can be used to define that Pods in the system will always be - # scheduled, and a Revision should not be marked unschedulable. - # Setting this to `true` makes sense if you have cluster-autoscaling set up for your cluster - # where unschedulable Pods trigger the addition of a new Node and are therefore a short and - # transient state. - # - # See https://github.com/knative/serving/issues/14862 - pod-is-always-schedulable: "false" ---- -# Copyright 2018 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: v1 -kind: ConfigMap -metadata: - name: config-domain - namespace: knative-serving - labels: - app.kubernetes.io/name: knative-serving - app.kubernetes.io/component: controller - app.kubernetes.io/version: "1.22.1" - annotations: - knative.dev/example-checksum: "26c09de5" -data: - _example: | - ################################ - # # - # EXAMPLE CONFIGURATION # - # # - ################################ - - # This block is not actually functional configuration, - # but serves to illustrate the available configuration - # options and document them in a way that is accessible - # to users that `kubectl edit` this config map. - # - # These sample configuration options may be copied out of - # this example block and unindented to be in the data block - # to actually change the configuration. - - # Default value for domain. - # Routes having the cluster domain suffix (by default 'svc.cluster.local') - # will not be exposed through Ingress. You can define your own label - # selector to assign that domain suffix to your Route here, or you can set - # the label - # "networking.knative.dev/visibility=cluster-local" - # to achieve the same effect. This shows how to make routes having - # the label app=secret only exposed to the local cluster. - svc.cluster.local: | - selector: - app: secret - - # These are example settings of domain. - # example.com will be used for all routes, but it is the least-specific rule so it - # will only be used if no other domain matches. - example.com: | - - # example.org will be used for routes having app=nonprofit. - example.org: | - selector: - app: nonprofit ---- -# Copyright 2020 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: v1 -kind: ConfigMap -metadata: - name: config-features - namespace: knative-serving - labels: - app.kubernetes.io/name: knative-serving - app.kubernetes.io/component: controller - app.kubernetes.io/version: "1.22.1" - annotations: - knative.dev/example-checksum: "bee75b26" -data: - _example: |- - ################################ - # # - # EXAMPLE CONFIGURATION # - # # - ################################ - - # This block is not actually functional configuration, - # but serves to illustrate the available configuration - # options and document them in a way that is accessible - # to users that `kubectl edit` this config map. - # - # These sample configuration options may be copied out of - # this example block and unindented to be in the data block - # to actually change the configuration. - - # Default SecurityContext settings to secure-by-default values - # if unset. - # - # Disabled - do nothing; no security options are applied - # AllowRootBounded - Applies secure defaults without enforcing strict policies; sets seccompProfile - # to RuntimeDefault and drops all capabilities - # Enabled - Enforces security defaults; sets seccompProfile to RuntimeDefault, drops all capabilities, - # and sets runAsNonRoot to true if not already specified. - secure-pod-defaults: "disabled" - - # Indicates whether multi container support is enabled - # - # WARNING: Cannot safely be disabled once enabled. - # See: https://knative.dev/docs/serving/configuration/feature-flags/#multiple-containers - multi-container: "enabled" - - # Indicates whether multi container probing is enabled - # - # WARNING: Cannot safely be disabled once enabled. - # See: https://knative.dev/docs/serving/configuration/feature-flags/#multiple-container-probing - multi-container-probing: "disabled" - - # Indicates whether Kubernetes affinity support is enabled - # - # WARNING: Cannot safely be disabled once enabled. - # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-node-affinity - kubernetes.podspec-affinity: "disabled" - - # Indicates whether Kubernetes topologySpreadConstraints support is enabled - # - # WARNING: Cannot safely be disabled once enabled. - # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-topology-spread-constraints - kubernetes.podspec-topologyspreadconstraints: "disabled" - - # Indicates whether Kubernetes hostAliases support is enabled - # - # WARNING: Cannot safely be disabled once enabled. - # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-host-aliases - kubernetes.podspec-hostaliases: "disabled" - - # Indicates whether Kubernetes nodeSelector support is enabled - # - # WARNING: Cannot safely be disabled once enabled. - # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-node-selector - kubernetes.podspec-nodeselector: "disabled" - - # Indicates whether Kubernetes tolerations support is enabled - # - # WARNING: Cannot safely be disabled once enabled - # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-toleration - kubernetes.podspec-tolerations: "disabled" - - # Indicates whether Kubernetes FieldRef support is enabled - # - # WARNING: Cannot safely be disabled once enabled. - # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-fieldref - kubernetes.podspec-fieldref: "disabled" - - # Indicates whether Kubernetes RuntimeClassName support is enabled - # - # WARNING: Cannot safely be disabled once enabled. - # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-runtime-class - kubernetes.podspec-runtimeclassname: "disabled" - - # Indicates whether Kubernetes DNSPolicy support is enabled - # - # WARNING: Cannot safely be disabled once enabled. - # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-dnspolicy - kubernetes.podspec-dnspolicy: "disabled" - - # Indicates whether Kubernetes DNSConfig support is enabled - # - # WARNING: Cannot safely be disabled once enabled. - # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-dnsconfig - kubernetes.podspec-dnsconfig: "disabled" - - # This feature allows end-users to set a subset of fields on the Pod's SecurityContext - # - # When set to "enabled" or "allowed" it allows the following - # PodSecurityContext properties: - # - FSGroup - # - RunAsGroup - # - RunAsNonRoot - # - SupplementalGroups - # - RunAsUser - # - SeccompProfile - # - # This feature flag should be used with caution as the PodSecurityContext - # properties may have a side-effect on non-user sidecar containers that come - # from Knative or your service mesh - # - # WARNING: Cannot safely be disabled once enabled. - # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-security-context - kubernetes.podspec-securitycontext: "disabled" - - # Indicated whether sharing the process namespace via ShareProcessNamespace pod spec is allowed. - # This can be especially useful for sharing data from images directly between sidecars - # - # See: https://knative.dev/docs/serving/configuration/feature-flags/#kubernetes-share-process-namespace - kubernetes.podspec-shareprocessnamespace: "disabled" - - # Indicates whether hostIPC support is enabled - # - # WARNING: Cannot safely be disabled once enabled. - # See https://knative.dev/docs/serving/configuration/feature-flags/#kubernetes-host-ipc - kubernetes.podspec-hostipc: "disabled" - - # Indicates whether hostPID support is enabled - # - # WARNING: Cannot safely be disabled once enabled. - # See https://knative.dev/docs/serving/configuration/feature-flags/#kubernetes-host-pid - kubernetes.podspec-hostpid: "disabled" - - # Indicates whether hostNetwork support is enabled - # - # WARNING: Cannot safely be disabled once enabled. - # See See https://knative.dev/docs/serving/configuration/feature-flags/#kubernetes-host-network - kubernetes.podspec-hostnetwork: "disabled" - - # Indicates whether Kubernetes PriorityClassName support is enabled - # - # WARNING: Cannot safely be disabled once enabled. - # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-priority-class-name - kubernetes.podspec-priorityclassname: "disabled" - - # Indicates whether Kubernetes SchedulerName support is enabled - # - # WARNING: Cannot safely be disabled once enabled. - # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-scheduler-name - kubernetes.podspec-schedulername: "disabled" - - # This feature flag allows end-users to add a subset of capabilities on the Pod's SecurityContext. - # - # When set to "enabled" or "allowed" it allows capabilities to be added to the container. - # For a list of possible capabilities, see https://man7.org/linux/man-pages/man7/capabilities.7.html - kubernetes.containerspec-addcapabilities: "disabled" - - - # Controls whether tag header based routing feature are enabled or not. - # 1. Enabled: enabling tag header based routing - # 2. Disabled: disabling tag header based routing - # See: https://knative.dev/docs/serving/feature-flags/#tag-header-based-routing - tag-header-based-routing: "disabled" - - # Controls whether http2 auto-detection should be enabled or not. - # 1. Enabled: http2 connection will be attempted via upgrade. - # 2. Disabled: http2 connection will only be attempted when port name is set to "h2c". - autodetect-http2: "disabled" - - # Controls whether volume support for EmptyDir is enabled or not. - # 1. Enabled: enabling EmptyDir volume support - # 2. Disabled: disabling EmptyDir volume support - kubernetes.podspec-volumes-emptydir: "enabled" - - # Controls whether volume support for image is enabled or not. - # 1. Enabled: enabling image volume support - # 2. Disabled: disabling image volume support - kubernetes.podspec-volumes-image: "disabled" - - # Controls whether volume support for HostPath is enabled or not. - # WARNING: Cannot safely be disabled once enabled. - # WARNING: If you can avoid using a hostPath volume, you should. - # Please read https://kubernetes.io/docs/concepts/storage/volumes/#hostpath before enabling this feature. - # 1. Enabled: enabling HostPath volume support - # 2. Disabled: disabling HostPath volume support - kubernetes.podspec-volumes-hostpath: "disabled" - - # Controls whether volume support for CSI is enabled or not. - # 1. Enabled: enabling CSI volume support - # 2. Disabled: disabling CSI volume support - kubernetes.podspec-volumes-csi: "disabled" - - # Controls whether init containers support is enabled or not. - # 1. Enabled: enabling init containers support - # 2. Disabled: disabling init containers support - kubernetes.podspec-init-containers: "disabled" - - # Controls whether persistent volume claim support is enabled or not. - # 1. Enabled: enabling persistent volume claim support - # 2. Disabled: disabling persistent volume claim support - kubernetes.podspec-persistent-volume-claim: "disabled" - - # Controls whether write access for persistent volumes is enabled or not. - # 1. Enabled: enabling write access for persistent volumes - # 2. Disabled: disabling write access for persistent volumes - kubernetes.podspec-persistent-volume-write: "disabled" - - # Controls whether volume mount propagation support is enabled or not. - # 1. Enabled: enabling volume mount propagation support - # 2. Disabled: disabling volume mount propagation support - kubernetes.podspec-volumes-mount-propagation: "disabled" - - # Controls if the queue proxy podInfo feature is enabled, allowed or disabled - # - # This feature should be enabled/allowed when using queue proxy Options (Extensions) - # Enabling will mount a podInfo volume to the queue proxy container. - # The volume will contains an 'annotations' file (from the pod's annotation field). - # The annotations in this file include the Service annotations set by the client creating the service. - # If mounted, the annotations can be accessed by queue proxy extensions at /etc/podinfo/annotations - # - # 1. "enabled": always mount a podInfo volume - # 2. "disabled": never mount a podInfo volume - # 3. "allowed": by default, do not mount a podInfo volume - # However, a client may mount the podInfo volume on an individual Service by attaching - # the following metadata annotation to the Service: "features.knative.dev/queueproxy-podinfo":"enabled". - # - # NOTE THAT THIS IS AN EXPERIMENTAL / ALPHA FEATURE - queueproxy.mount-podinfo: "disabled" - - # Default queue proxy resource requests and limits to good values for most cases if set. - queueproxy.resource-defaults: "disabled" ---- -# Copyright 2018 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: v1 -kind: ConfigMap -metadata: - name: config-gc - namespace: knative-serving - labels: - app.kubernetes.io/name: knative-serving - app.kubernetes.io/component: controller - app.kubernetes.io/version: "1.22.1" - annotations: - knative.dev/example-checksum: "aa3813a8" -data: - _example: | - ################################ - # # - # EXAMPLE CONFIGURATION # - # # - ################################ - - # This block is not actually functional configuration, - # but serves to illustrate the available configuration - # options and document them in a way that is accessible - # to users that `kubectl edit` this config map. - # - # These sample configuration options may be copied out of - # this example block and unindented to be in the data block - # to actually change the configuration. - - # --------------------------------------- - # Garbage Collector Settings - # --------------------------------------- - # - # Active - # * Revisions which are referenced by a Route are considered active. - # * Individual revisions may be marked with the annotation - # "serving.knative.dev/no-gc":"true" to be permanently considered active. - # * Active revisions are not considered for GC. - # Retention - # * Revisions are retained if they are any of the following: - # 1. Active - # 2. Were created within "retain-since-create-time" - # 3. Were last referenced by a route within - # "retain-since-last-active-time" - # 4. There are fewer than "min-non-active-revisions" - # If none of these conditions are met, or if the count of revisions exceed - # "max-non-active-revisions", they will be deleted by GC. - # The special value "disabled" may be used to turn off these limits. - # - # Example config to immediately collect any inactive revision: - # min-non-active-revisions: "0" - # max-non-active-revisions: "0" - # retain-since-create-time: "disabled" - # retain-since-last-active-time: "disabled" - # - # Example config to always keep around the last ten non-active revisions: - # retain-since-create-time: "disabled" - # retain-since-last-active-time: "disabled" - # max-non-active-revisions: "10" - # - # Example config to disable all garbage collection: - # retain-since-create-time: "disabled" - # retain-since-last-active-time: "disabled" - # max-non-active-revisions: "disabled" - # - # Example config to keep recently deployed or active revisions, - # always maintain the last two in case of rollback, and prevent - # burst activity from exploding the count of old revisions: - # retain-since-create-time: "48h" - # retain-since-last-active-time: "15h" - # min-non-active-revisions: "2" - # max-non-active-revisions: "1000" - - # Duration since creation before considering a revision for GC or "disabled". - retain-since-create-time: "48h" - - # Duration since active before considering a revision for GC or "disabled". - retain-since-last-active-time: "15h" - - # Minimum number of non-active revisions to retain. - min-non-active-revisions: "20" - - # Maximum number of non-active revisions to retain - # or "disabled" to disable any maximum limit. - max-non-active-revisions: "1000" ---- -# Copyright 2020 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: v1 -kind: ConfigMap -metadata: - name: config-leader-election - namespace: knative-serving - labels: - app.kubernetes.io/name: knative-serving - app.kubernetes.io/component: controller - app.kubernetes.io/version: "1.22.1" - annotations: - knative.dev/example-checksum: "f4b71f57" -data: - _example: | - ################################ - # # - # EXAMPLE CONFIGURATION # - # # - ################################ - - # This block is not actually functional configuration, - # but serves to illustrate the available configuration - # options and document them in a way that is accessible - # to users that `kubectl edit` this config map. - # - # These sample configuration options may be copied out of - # this example block and unindented to be in the data block - # to actually change the configuration. - - # lease-duration is how long non-leaders will wait to try to acquire the - # lock; 15 seconds is the value used by core kubernetes controllers. - lease-duration: "60s" - - # renew-deadline is how long a leader will try to renew the lease before - # giving up; 10 seconds is the value used by core kubernetes controllers. - renew-deadline: "40s" - - # retry-period is how long the leader election client waits between tries of - # actions; 2 seconds is the value used by core kubernetes controllers. - retry-period: "10s" - - # buckets is the number of buckets used to partition key space of each - # Reconciler. If this number is M and the replica number of the controller - # is N, the N replicas will compete for the M buckets. The owner of a - # bucket will take care of the reconciling for the keys partitioned into - # that bucket. - buckets: "1" ---- -# Copyright 2018 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: v1 -kind: ConfigMap -metadata: - name: config-logging - namespace: knative-serving - labels: - app.kubernetes.io/version: "1.22.1" - app.kubernetes.io/component: logging - app.kubernetes.io/name: knative-serving - annotations: - knative.dev/example-checksum: "9f25d429" -data: - _example: | - ################################ - # # - # EXAMPLE CONFIGURATION # - # # - ################################ - - # This block is not actually functional configuration, - # but serves to illustrate the available configuration - # options and document them in a way that is accessible - # to users that `kubectl edit` this config map. - # - # These sample configuration options may be copied out of - # this example block and unindented to be in the data block - # to actually change the configuration. - - # Common configuration for all Knative codebase - zap-logger-config: | - { - "level": "info", - "development": false, - "outputPaths": ["stdout"], - "errorOutputPaths": ["stderr"], - "encoding": "json", - "encoderConfig": { - "timeKey": "timestamp", - "levelKey": "severity", - "nameKey": "logger", - "callerKey": "caller", - "messageKey": "message", - "stacktraceKey": "stacktrace", - "lineEnding": "", - "levelEncoder": "", - "timeEncoder": "iso8601", - "durationEncoder": "", - "callerEncoder": "" - } - } - - # Log level overrides - # For all components except the queue proxy, - # changes are picked up immediately. - # For queue proxy, changes require recreation of the pods. - loglevel.controller: "info" - loglevel.autoscaler: "info" - loglevel.queueproxy: "info" - loglevel.webhook: "info" - loglevel.activator: "info" - loglevel.hpaautoscaler: "info" - loglevel.net-istio-controller: "info" - loglevel.net-contour-controller: "info" - loglevel.net-kourier-controller: "info" - loglevel.net-gateway-api-controller: "info" ---- -# Copyright 2018 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: v1 -kind: ConfigMap -metadata: - name: config-network - namespace: knative-serving - labels: - app.kubernetes.io/name: knative-serving - app.kubernetes.io/component: networking - app.kubernetes.io/version: "1.22.1" - annotations: - knative.dev/example-checksum: "0573e07d" -data: - _example: | - ################################ - # # - # EXAMPLE CONFIGURATION # - # # - ################################ - - # This block is not actually functional configuration, - # but serves to illustrate the available configuration - # options and document them in a way that is accessible - # to users that `kubectl edit` this config map. - # - # These sample configuration options may be copied out of - # this example block and unindented to be in the data block - # to actually change the configuration. - - # ingress-class specifies the default ingress class - # to use when not dictated by Route annotation. - # - # If not specified, will use the Istio ingress. - # - # Note that changing the Ingress class of an existing Route - # will result in undefined behavior. Therefore it is best to only - # update this value during the setup of Knative, to avoid getting - # undefined behavior. - ingress-class: "istio.ingress.networking.knative.dev" - - # certificate-class specifies the default Certificate class - # to use when not dictated by Route annotation. - # - # If not specified, will use the Cert-Manager Certificate. - # - # Note that changing the Certificate class of an existing Route - # will result in undefined behavior. Therefore it is best to only - # update this value during the setup of Knative, to avoid getting - # undefined behavior. - certificate-class: "cert-manager.certificate.networking.knative.dev" - - # namespace-wildcard-cert-selector specifies a LabelSelector which - # determines which namespaces should have a wildcard certificate - # provisioned. - # - # Use an empty value to disable the feature (this is the default): - # namespace-wildcard-cert-selector: "" - # - # Use an empty object to enable for all namespaces - # namespace-wildcard-cert-selector: {} - # - # Useful labels include the "kubernetes.io/metadata.name" label to - # avoid provisioning a certificate for the "kube-system" namespaces. - # Use the following selector to match pre-1.0 behavior of using - # "networking.knative.dev/disableWildcardCert" to exclude namespaces: - # - # matchExpressions: - # - key: "networking.knative.dev/disableWildcardCert" - # operator: "NotIn" - # values: ["true"] - namespace-wildcard-cert-selector: "" - - # domain-template specifies the golang text template string to use - # when constructing the Knative service's DNS name. The default - # value is "{{.Name}}.{{.Namespace}}.{{.Domain}}". - # - # Valid variables defined in the template include Name, Namespace, Domain, - # Labels, and Annotations. Name will be the result of the tag-template - # below, if a tag is specified for the route. - # - # Changing this value might be necessary when the extra levels in - # the domain name generated is problematic for wildcard certificates - # that only support a single level of domain name added to the - # certificate's domain. In those cases you might consider using a value - # of "{{.Name}}-{{.Namespace}}.{{.Domain}}", or removing the Namespace - # entirely from the template. When choosing a new value be thoughtful - # of the potential for conflicts - for example, when users choose to use - # characters such as `-` in their service, or namespace, names. - # {{.Annotations}} or {{.Labels}} can be used for any customization in the - # go template if needed. - # We strongly recommend keeping namespace part of the template to avoid - # domain name clashes: - # eg. '{{.Name}}-{{.Namespace}}.{{ index .Annotations "sub"}}.{{.Domain}}' - # and you have an annotation {"sub":"foo"}, then the generated template - # would be {Name}-{Namespace}.foo.{Domain} - domain-template: "{{.Name}}.{{.Namespace}}.{{.Domain}}" - - # tag-template specifies the golang text template string to use - # when constructing the DNS name for "tags" within the traffic blocks - # of Routes and Configuration. This is used in conjunction with the - # domain-template above to determine the full URL for the tag. - tag-template: "{{.Tag}}-{{.Name}}" - - # auto-tls is deprecated and replaced by external-domain-tls - auto-tls: "Disabled" - - # Controls whether TLS certificates are automatically provisioned and - # installed in the Knative ingress to terminate TLS connections - # for cluster external domains (like: app.example.com) - # - Enabled: enables the TLS certificate provisioning feature for cluster external domains. - # - Disabled: disables the TLS certificate provisioning feature for cluster external domains. - external-domain-tls: "Disabled" - - # Controls weather TLS certificates are automatically provisioned and - # installed in the Knative ingress to terminate TLS connections - # for cluster local domains (like: app.namespace.svc.) - # - Enabled: enables the TLS certificate provisioning feature for cluster cluster-local domains. - # - Disabled: disables the TLS certificate provisioning feature for cluster cluster local domains. - # NOTE: This flag is in an alpha state and is mostly here to enable internal testing - # for now. Use with caution. - cluster-local-domain-tls: "Disabled" - - # internal-encryption is deprecated and replaced by system-internal-tls - internal-encryption: "false" - - # system-internal-tls controls weather TLS encryption is used for connections between - # the internal components of Knative: - # - ingress to activator - # - ingress to queue-proxy - # - activator to queue-proxy - # - # Possible values for this flag are: - # - Enabled: enables the TLS certificate provisioning feature for cluster cluster-local domains. - # - Disabled: disables the TLS certificate provisioning feature for cluster cluster local domains. - # NOTE: This flag is in an alpha state and is mostly here to enable internal testing - # for now. Use with caution. - system-internal-tls: "Disabled" - - # Controls the behavior of the HTTP endpoint for the Knative ingress. - # It requires auto-tls to be enabled. - # - Enabled: The Knative ingress will be able to serve HTTP connection. - # - Redirected: The Knative ingress will send a 301 redirect for all - # http connections, asking the clients to use HTTPS. - # - # "Disabled" option is deprecated. - http-protocol: "Enabled" - - # rollout-duration contains the minimal duration in seconds over which the - # Configuration traffic targets are rolled out to the newest revision. - rollout-duration: "0" - - # autocreate-cluster-domain-claims controls whether ClusterDomainClaims should - # be automatically created (and deleted) as needed when DomainMappings are - # reconciled. - # - # If this is "false" (the default), the cluster administrator is - # responsible for creating ClusterDomainClaims and delegating them to - # namespaces via their spec.Namespace field. This setting should be used in - # multitenant environments which need to control which namespace can use a - # particular domain name in a domain mapping. - # - # If this is "true", users are able to associate arbitrary names with their - # services via the DomainMapping feature. - autocreate-cluster-domain-claims: "false" - - # If true, networking plugins can add additional information to deployed - # applications to make their pods directly accessible via their IPs even if mesh is - # enabled and thus direct-addressability is usually not possible. - # Consumers like Knative Serving can use this setting to adjust their behavior - # accordingly, i.e. to drop fallback solutions for non-pod-addressable systems. - # - # NOTE: This flag is in an alpha state and is mostly here to enable internal testing - # for now. Use with caution. - enable-mesh-pod-addressability: "false" - - # mesh-compatibility-mode indicates whether consumers of network plugins - # should directly contact Pod IPs (most efficient), or should use the - # Cluster IP (less efficient, needed when mesh is enabled unless - # `enable-mesh-pod-addressability`, above, is set). - # Permitted values are: - # - "auto" (default): automatically determine which mesh mode to use by trying Pod IP and falling back to Cluster IP as needed. - # - "enabled": always use Cluster IP and do not attempt to use Pod IPs. - # - "disabled": always use Pod IPs and do not fall back to Cluster IP on failure. - mesh-compatibility-mode: "auto" - - # Defines the scheme used for external URLs if auto-tls is not enabled. - # This can be used for making Knative report all URLs as "HTTPS" for example, if you're - # fronting Knative with an external loadbalancer that deals with TLS termination and - # Knative doesn't know about that otherwise. - default-external-scheme: "http" ---- -# Copyright 2018 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: v1 -kind: ConfigMap -metadata: - name: config-observability - namespace: knative-serving - labels: - app.kubernetes.io/name: knative-serving - app.kubernetes.io/component: observability - app.kubernetes.io/version: "1.22.1" - annotations: - knative.dev/example-checksum: "59abacb5" -data: - _example: | - ################################ - # # - # EXAMPLE CONFIGURATION # - # # - ################################ - - # This block is not actually functional configuration, - # but serves to illustrate the available configuration - # options and document them in a way that is accessible - # to users that `kubectl edit` this config map. - # - # These sample configuration options may be copied out of - # this example block and unindented to be in the data block - # to actually change the configuration. - - # logging.enable-var-log-collection defaults to false. - # The fluentd daemon set will be set up to collect /var/log if - # this flag is true. - logging.enable-var-log-collection: "false" - - # logging.revision-url-template provides a template to use for producing the - # logging URL that is injected into the status of each Revision. - logging.revision-url-template: "http://logging.example.com/?revisionUID=${REVISION_UID}" - - # If non-empty, this enables queue proxy writing user request logs to stdout, excluding probe - # requests. - # NB: after 0.18 release logging.enable-request-log must be explicitly set to true - # in order for request logging to be enabled. - # - # The value determines the shape of the request logs and it must be a valid go text/template. - # It is important to keep this as a single line. Multiple lines are parsed as separate entities - # by most collection agents and will split the request logs into multiple records. - # - # The following fields and functions are available to the template: - # - # Request: An http.Request (see https://golang.org/pkg/net/http/#Request) - # representing an HTTP request received by the server. - # - # Response: - # struct { - # Code int // HTTP status code (see https://www.iana.org/assignments/http-status-codes/http-status-codes.xhtml) - # Size int // An int representing the size of the response. - # Latency float64 // A float64 representing the latency of the response in seconds. - # } - # - # Revision: - # struct { - # Name string // Knative revision name - # Namespace string // Knative revision namespace - # Service string // Knative service name - # Configuration string // Knative configuration name - # PodName string // Name of the pod hosting the revision - # PodIP string // IP of the pod hosting the revision - # } - # - logging.request-log-template: '{"httpRequest": {"requestMethod": "{{.Request.Method}}", "requestUrl": "{{js .Request.RequestURI}}", "requestSize": "{{.Request.ContentLength}}", "status": {{.Response.Code}}, "responseSize": "{{.Response.Size}}", "userAgent": "{{js .Request.UserAgent}}", "remoteIp": "{{js .Request.RemoteAddr}}", "serverIp": "{{.Revision.PodIP}}", "referer": "{{js .Request.Referer}}", "latency": "{{.Response.Latency}}s", "protocol": "{{.Request.Proto}}"}, "traceId": "{{.TraceID}}"}' - - # If true, the request logging will be enabled. - logging.enable-request-log: "false" - - # If true, this enables queue proxy writing request logs for probe requests to stdout. - # It uses the same template for user requests, i.e. logging.request-log-template. - logging.enable-probe-request-log: "false" - - # metrics-protocol field specifies the protocol used when exporting metrics - # It supports either 'none' (the default), 'prometheus', 'http/protobuf' (OTLP HTTP), 'grpc' (OTLP gRPC) - metrics-protocol: http/protobuf - - # metrics-endpoint field specifies the destination metrics should be exporter to. - # - # The endpoint MUST be set when the protocol is http/protobuf or grpc. - # The endpoint MUST NOT be set when the protocol is none. - # - # When the protocol is prometheus the endpoint can accept a 'host:port' string to customize the - # listening host interface and port. - metrics-endpoint: http://example.com/v1/traces - - # metrics-export-interval specifies the global metrics reporting period for control and data plane components. - # If a zero or negative value is passed the default reporting OTel period is used (60 secs). - metrics-export-interval: 60s - - # request-metrics-protocol field specifies the protocol used when exporting queue-proxy metrics - # It supports either 'none' (the default), 'prometheus', 'http/protobuf' (OTLP HTTP), 'grpc' (OTLP gRPC) - request-metrics-protocol: http/protobuf - - # request-metrics-endpoint field specifies the destination metrics from the queue proxy should be exporter to. - # - # The endpoint MUST be set when the protocol is http/protobuf or grpc. - # The endpoint MUST NOT be set when the protocol is none. - # - # When the protocol is prometheus the endpoint can accept a 'host:port' string to customize the - # listening host interface and port. - request-metrics-endpoint: http://promstack-kube-prometheus-prometheus.observability:9090/api/v1/otlp/v1/metrics - - # request-metrics-export-interval specifies the global metrics reporting period for the queue-proxy. - # - # If a zero or negative value is passed the default reporting OTel period is used (60 secs). - request-metrics-export-interval: 60s - - # runtime-profiling indicates whether it is allowed to retrieve runtime profiling data from - # the pods via an HTTP server in the format expected by the pprof visualization tool. When - # enabled, the Knative Serving pods expose the profiling data on an alternate HTTP port 8008. - # The HTTP context root for profiling is then /debug/pprof/. - runtime-profiling: enabled - - # tracing-protocol field specifies the protocol used when exporting traces - # It supports either 'none' (the default), 'http/protobuf' (OTLP HTTP), 'grpc' (OTLP gRPC) - # or `stdout` for debugging purposes - tracing-protocol: http/protobuf - - # tracing-endpoint field specifies the destination traces should be exporter to. - # - # The endpoint MUST be set when the protocol is http/protobuf or grpc. - # The endpoint MUST NOT be set when the protocol is none. - tracing-endpoint: http://jaeger-collector.observability:4318/v1/traces - - # tracing-sampling-rate allows the user to specify what percentage of all traces should be exported - # The value should be between 0 (never sample) to 1 (always sample) - tracing-sampling-rate: "1" ---- -# Copyright 2019 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: v1 -kind: ConfigMap -metadata: - name: config-tracing - namespace: knative-serving - labels: - app.kubernetes.io/name: knative-serving - app.kubernetes.io/component: tracing - app.kubernetes.io/version: "1.22.1" - annotations: - knative.dev/example-checksum: "04c7e9a3" -data: - _example: | - ########################################################### - # # - # This config is deprecated - use config-observability # - # # - ########################################################### ---- -# Copyright 2020 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: autoscaling/v2 -kind: HorizontalPodAutoscaler -metadata: - name: activator - namespace: knative-serving - labels: - app.kubernetes.io/component: activator - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" -spec: - minReplicas: 1 - maxReplicas: 20 - scaleTargetRef: - apiVersion: apps/v1 - kind: Deployment - name: activator - metrics: - - type: Resource - resource: - name: cpu - target: - type: Utilization - # Percentage of the requested CPU - averageUtilization: 100 ---- -# Activator PDB. Currently we permit unavailability of 20% of tasks at the same time. -# Given the subsetting and that the activators are partially stateful systems, we want -# a slow rollout of the new versions and slow migration during node upgrades. -apiVersion: policy/v1 -kind: PodDisruptionBudget -metadata: - name: activator-pdb - namespace: knative-serving - labels: - app.kubernetes.io/component: activator - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" -spec: - minAvailable: 80% - selector: - matchLabels: - app: activator ---- -# Copyright 2018 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: apps/v1 -kind: Deployment -metadata: - name: activator - namespace: knative-serving - labels: - app.kubernetes.io/component: activator - app.kubernetes.io/version: "1.22.1" - app.kubernetes.io/name: knative-serving -spec: - selector: - matchLabels: - app: activator - role: activator - template: - metadata: - labels: - app: activator - role: activator - app.kubernetes.io/component: activator - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" - spec: - # To avoid node becoming SPOF, spread our replicas to different nodes. - affinity: - podAntiAffinity: - preferredDuringSchedulingIgnoredDuringExecution: - - podAffinityTerm: - labelSelector: - matchLabels: - app: activator - topologyKey: kubernetes.io/hostname - weight: 100 - serviceAccountName: activator - containers: - - name: activator - # This is the Go import path for the binary that is containerized - # and substituted here. - image: gcr.io/knative-releases/knative.dev/serving/cmd/activator@sha256:5deaef961fef8d1417f6d4a4dfae2fc338f2d30d72c4ad58c3ab392b2c04705b - # The numbers are based on performance test results from - # https://github.com/knative/serving/issues/1625#issuecomment-511930023 - resources: - requests: - cpu: 300m - memory: 60Mi - limits: - cpu: 1000m - memory: 600Mi - env: - # Run Activator with GC collection when newly generated memory is 500%. - - name: GOGC - value: "500" - - name: POD_NAME - valueFrom: - fieldRef: - fieldPath: metadata.name - - name: POD_IP - valueFrom: - fieldRef: - fieldPath: status.podIP - - name: SYSTEM_NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace - - name: CONFIG_LOGGING_NAME - value: config-logging - - name: CONFIG_OBSERVABILITY_NAME - value: config-observability - securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: true - runAsNonRoot: true - capabilities: - drop: - - ALL - seccompProfile: - type: RuntimeDefault - ports: - - name: metrics - containerPort: 9090 - - name: profiling - containerPort: 8008 - - name: http1 - containerPort: 8012 - - name: h2c - containerPort: 8013 - readinessProbe: - httpGet: - port: 8012 - periodSeconds: 5 - failureThreshold: 5 - livenessProbe: - httpGet: - port: 8012 - periodSeconds: 10 - failureThreshold: 12 - initialDelaySeconds: 15 - # The activator (often) sits on the dataplane, and may proxy long (e.g. - # streaming, websockets) requests. We give a long grace period for the - # activator to "lame duck" and drain outstanding requests before we - # forcibly terminate the pod (and outstanding connections). This value - # should be at least as large as the upper bound on the Revision's - # timeoutSeconds property to avoid servicing events disrupting - # connections. - terminationGracePeriodSeconds: 600 ---- -apiVersion: v1 -kind: Service -metadata: - name: activator-service - namespace: knative-serving - labels: - app: activator - app.kubernetes.io/component: activator - app.kubernetes.io/version: "1.22.1" - app.kubernetes.io/name: knative-serving -spec: - selector: - app: activator - ports: - # Define metrics and profiling for them to be accessible within service meshes. - - name: http-metrics - port: 9090 - targetPort: 9090 - - name: http-profiling - port: 8008 - targetPort: 8008 - - name: http - port: 80 - targetPort: 8012 - - name: http2 - port: 81 - targetPort: 8013 - - name: https - port: 443 - targetPort: 8112 - type: ClusterIP ---- -# Copyright 2018 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: apps/v1 -kind: Deployment -metadata: - name: autoscaler - namespace: knative-serving - labels: - app.kubernetes.io/component: autoscaler - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" -spec: - replicas: 1 - selector: - matchLabels: - app: autoscaler - strategy: - type: RollingUpdate - rollingUpdate: - maxUnavailable: 0 - template: - metadata: - labels: - app: autoscaler - app.kubernetes.io/component: autoscaler - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" - spec: - # To avoid node becoming SPOF, spread our replicas to different nodes. - affinity: - podAntiAffinity: - preferredDuringSchedulingIgnoredDuringExecution: - - podAffinityTerm: - labelSelector: - matchLabels: - app: autoscaler - topologyKey: kubernetes.io/hostname - weight: 100 - serviceAccountName: controller - containers: - - name: autoscaler - # This is the Go import path for the binary that is containerized - # and substituted here. - image: gcr.io/knative-releases/knative.dev/serving/cmd/autoscaler@sha256:5bae38655d87df86b041083fbe51791816473245f752432ba9b85a7b12f73cd5 - resources: - requests: - cpu: 100m - memory: 100Mi - limits: - cpu: 1000m - memory: 1000Mi - env: - - name: POD_NAME - valueFrom: - fieldRef: - fieldPath: metadata.name - - name: POD_IP - valueFrom: - fieldRef: - fieldPath: status.podIP - - name: SYSTEM_NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace - - name: CONFIG_LOGGING_NAME - value: config-logging - - name: CONFIG_OBSERVABILITY_NAME - value: config-observability - securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: true - runAsNonRoot: true - capabilities: - drop: - - ALL - seccompProfile: - type: RuntimeDefault - ports: - - name: metrics - containerPort: 9090 - - name: profiling - containerPort: 8008 - - name: websocket - containerPort: 8080 - readinessProbe: - httpGet: - port: 8080 - livenessProbe: - httpGet: - port: 8080 - failureThreshold: 6 ---- -apiVersion: v1 -kind: Service -metadata: - labels: - app: autoscaler - app.kubernetes.io/component: autoscaler - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" - name: autoscaler - namespace: knative-serving -spec: - ports: - # Define metrics and profiling for them to be accessible within service meshes. - - name: http-metrics - port: 9090 - targetPort: 9090 - - name: http-profiling - port: 8008 - targetPort: 8008 - - name: http - port: 8080 - targetPort: 8080 - selector: - app: autoscaler ---- -# Copyright 2018 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: apps/v1 -kind: Deployment -metadata: - name: controller - namespace: knative-serving - labels: - app.kubernetes.io/component: controller - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" -spec: - selector: - matchLabels: - app: controller - template: - metadata: - labels: - app: controller - app.kubernetes.io/component: controller - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" - spec: - # To avoid node becoming SPOF, spread our replicas to different nodes. - affinity: - podAntiAffinity: - preferredDuringSchedulingIgnoredDuringExecution: - - podAffinityTerm: - labelSelector: - matchLabels: - app: controller - topologyKey: kubernetes.io/hostname - weight: 100 - serviceAccountName: controller - containers: - - name: controller - # This is the Go import path for the binary that is containerized - # and substituted here. - image: gcr.io/knative-releases/knative.dev/serving/cmd/controller@sha256:94329d85200c2fc31ed1166a26568ca1357376c149c147e71f400cf28be3c816 - resources: - requests: - cpu: 100m - memory: 100Mi - limits: - cpu: 1000m - memory: 1000Mi - env: - - name: POD_NAME - valueFrom: - fieldRef: - fieldPath: metadata.name - - name: SYSTEM_NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace - - name: CONFIG_LOGGING_NAME - value: config-logging - - name: CONFIG_OBSERVABILITY_NAME - value: config-observability - securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: true - runAsNonRoot: true - capabilities: - drop: - - ALL - seccompProfile: - type: RuntimeDefault - livenessProbe: - httpGet: - path: /health - port: probes - scheme: HTTP - periodSeconds: 5 - failureThreshold: 6 - readinessProbe: - httpGet: - path: /readiness - port: probes - scheme: HTTP - periodSeconds: 5 - failureThreshold: 3 - ports: - - name: metrics - containerPort: 9090 - - name: profiling - containerPort: 8008 - - name: probes - containerPort: 8080 ---- -apiVersion: v1 -kind: Service -metadata: - labels: - app: controller - app.kubernetes.io/component: controller - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" - name: controller - namespace: knative-serving -spec: - ports: - # Define metrics and profiling for them to be accessible within service meshes. - - name: http-metrics - port: 9090 - targetPort: 9090 - - name: http-profiling - port: 8008 - targetPort: 8008 - selector: - app: controller ---- -# Copyright 2020 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: autoscaling/v2 -kind: HorizontalPodAutoscaler -metadata: - name: webhook - namespace: knative-serving - labels: - app.kubernetes.io/component: webhook - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" -spec: - minReplicas: 1 - maxReplicas: 5 - scaleTargetRef: - apiVersion: apps/v1 - kind: Deployment - name: webhook - metrics: - - type: Resource - resource: - name: cpu - target: - type: Utilization - # Percentage of the requested CPU - averageUtilization: 100 ---- -# Webhook PDB. -apiVersion: policy/v1 -kind: PodDisruptionBudget -metadata: - name: webhook-pdb - namespace: knative-serving - labels: - app.kubernetes.io/component: webhook - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" -spec: - minAvailable: 80% - selector: - matchLabels: - app: webhook ---- -# Copyright 2018 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: apps/v1 -kind: Deployment -metadata: - name: webhook - namespace: knative-serving - labels: - app.kubernetes.io/component: webhook - app.kubernetes.io/version: "1.22.1" - app.kubernetes.io/name: knative-serving -spec: - selector: - matchLabels: - app: webhook - role: webhook - template: - metadata: - labels: - app: webhook - role: webhook - app.kubernetes.io/component: webhook - app.kubernetes.io/version: "1.22.1" - app.kubernetes.io/name: knative-serving - spec: - # To avoid node becoming SPOF, spread our replicas to different nodes. - affinity: - podAntiAffinity: - preferredDuringSchedulingIgnoredDuringExecution: - - podAffinityTerm: - labelSelector: - matchLabels: - app: webhook - topologyKey: kubernetes.io/hostname - weight: 100 - serviceAccountName: controller - containers: - - name: webhook - # This is the Go import path for the binary that is containerized - # and substituted here. - image: gcr.io/knative-releases/knative.dev/serving/cmd/webhook@sha256:8470456be214e93a84e3c7b79a632aa9978bd8ecda553feaa47878a2c24ab84d - resources: - requests: - cpu: 100m - memory: 100Mi - limits: - cpu: 500m - memory: 500Mi - env: - - name: POD_NAME - valueFrom: - fieldRef: - fieldPath: metadata.name - - name: SYSTEM_NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace - - name: CONFIG_LOGGING_NAME - value: config-logging - - name: CONFIG_OBSERVABILITY_NAME - value: config-observability - - name: WEBHOOK_NAME - value: webhook - - name: WEBHOOK_PORT - value: "8443" - securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: true - runAsNonRoot: true - capabilities: - drop: - - ALL - seccompProfile: - type: RuntimeDefault - ports: - - name: metrics - containerPort: 9090 - - name: profiling - containerPort: 8008 - - name: https-webhook - containerPort: 8443 - readinessProbe: - periodSeconds: 1 - httpGet: - scheme: HTTPS - port: 8443 - livenessProbe: - periodSeconds: 10 - httpGet: - scheme: HTTPS - port: 8443 - failureThreshold: 6 - initialDelaySeconds: 20 - # Our webhook should gracefully terminate by lame ducking first, set this to a sufficiently - # high value that we respect whatever value it has configured for the lame duck grace period. - terminationGracePeriodSeconds: 300 ---- -apiVersion: v1 -kind: Service -metadata: - labels: - app: webhook - role: webhook - app.kubernetes.io/component: webhook - app.kubernetes.io/version: "1.22.1" - app.kubernetes.io/name: knative-serving - name: webhook - namespace: knative-serving -spec: - ports: - # Define metrics and profiling for them to be accessible within service meshes. - - name: http-metrics - port: 9090 - targetPort: 9090 - - name: http-profiling - port: 8008 - targetPort: 8008 - - name: https-webhook - port: 443 - targetPort: 8443 - selector: - app: webhook - role: webhook ---- -# Copyright 2020 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: admissionregistration.k8s.io/v1 -kind: ValidatingWebhookConfiguration -metadata: - name: config.webhook.serving.knative.dev - labels: - app.kubernetes.io/component: webhook - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" -webhooks: - - admissionReviewVersions: ["v1", "v1beta1"] - clientConfig: - service: - name: webhook - namespace: knative-serving - failurePolicy: Fail - sideEffects: None - name: config.webhook.serving.knative.dev - objectSelector: - matchExpressions: - - key: app.kubernetes.io/name - operator: In - values: ["knative-serving"] - - key: app.kubernetes.io/component - operator: In - values: ["autoscaler", "controller", "logging", "networking", "observability", "tracing", "net-certmanager"] - timeoutSeconds: 10 ---- -# Copyright 2020 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: admissionregistration.k8s.io/v1 -kind: MutatingWebhookConfiguration -metadata: - name: webhook.serving.knative.dev - labels: - app.kubernetes.io/component: webhook - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" -webhooks: - - admissionReviewVersions: ["v1", "v1beta1"] - clientConfig: - service: - name: webhook - namespace: knative-serving - failurePolicy: Fail - sideEffects: None - name: webhook.serving.knative.dev - timeoutSeconds: 10 - rules: - - apiGroups: - - autoscaling.internal.knative.dev - - networking.internal.knative.dev - - serving.knative.dev - apiVersions: - - "*" - operations: - - CREATE - - UPDATE - scope: "*" - resources: - - metrics - - podautoscalers - - certificates - - ingresses - - serverlessservices - - configurations - - revisions - - routes - - services - - domainmappings - - domainmappings/status ---- -# Copyright 2020 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: admissionregistration.k8s.io/v1 -kind: ValidatingWebhookConfiguration -metadata: - name: validation.webhook.serving.knative.dev - labels: - app.kubernetes.io/component: webhook - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" -webhooks: - - admissionReviewVersions: ["v1", "v1beta1"] - clientConfig: - service: - name: webhook - namespace: knative-serving - failurePolicy: Fail - sideEffects: None - name: validation.webhook.serving.knative.dev - timeoutSeconds: 10 - rules: - - apiGroups: - - autoscaling.internal.knative.dev - - networking.internal.knative.dev - - serving.knative.dev - apiVersions: - - "*" - operations: - - CREATE - - UPDATE - - DELETE - scope: "*" - resources: - - metrics - - podautoscalers - - certificates - - ingresses - - serverlessservices - - configurations - - revisions - - routes - - services - - domainmappings - - domainmappings/status ---- -# Copyright 2020 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: v1 -kind: Secret -metadata: - name: webhook-certs - namespace: knative-serving - labels: - app.kubernetes.io/component: webhook - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" -# The data is populated at install time. ---- -# Source: https://github.com/knative-extensions/net-kourier/releases/download/knative-v1.22.1/kourier.yaml ---- -# Copyright 2020 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: v1 -kind: Namespace -metadata: - name: kourier-system - labels: - networking.knative.dev/ingress-provider: kourier - app.kubernetes.io/name: knative-serving - app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.22.1" ---- -# Copyright 2020 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: v1 -kind: ConfigMap -metadata: - name: kourier-bootstrap - namespace: kourier-system - labels: - networking.knative.dev/ingress-provider: kourier - app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.22.1" - app.kubernetes.io/name: knative-serving -data: - envoy-bootstrap.yaml: | - dynamic_resources: - ads_config: - transport_api_version: V3 - api_type: GRPC - rate_limit_settings: {} - grpc_services: - - envoy_grpc: {cluster_name: xds_cluster} - cds_config: - resource_api_version: V3 - ads: {} - lds_config: - resource_api_version: V3 - ads: {} - node: - cluster: kourier-knative - id: 3scale-kourier-gateway - static_resources: - listeners: - - name: stats_listener - address: - socket_address: - address: 0.0.0.0 - port_value: 9000 - filter_chains: - - filters: - - name: envoy.filters.network.http_connection_manager - typed_config: - "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager - stat_prefix: stats_server - http_filters: - - name: envoy.filters.http.router - typed_config: - "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router - route_config: - virtual_hosts: - - name: admin_interface - domains: - - "*" - routes: - - match: - safe_regex: - regex: '/(certs|stats(/prometheus)?|server_info|clusters|listeners|ready)?' - headers: - - name: ':method' - string_match: - exact: GET - route: - cluster: service_stats - - match: - safe_regex: - regex: '/drain_listeners' - headers: - - name: ':method' - string_match: - exact: POST - route: - cluster: service_stats - clusters: - - name: service_stats - connect_timeout: 0.250s - type: static - load_assignment: - cluster_name: service_stats - endpoints: - lb_endpoints: - endpoint: - address: - socket_address: - address: 127.0.0.1 - port_value: 9901 - - name: xds_cluster - # This keepalive is recommended by envoy docs. - # https://www.envoyproxy.io/docs/envoy/latest/api-docs/xds_protocol - typed_extension_protocol_options: - envoy.extensions.upstreams.http.v3.HttpProtocolOptions: - "@type": type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions - explicit_http_config: - http2_protocol_options: - connection_keepalive: - interval: 30s - timeout: 5s - connect_timeout: 1s - load_assignment: - cluster_name: xds_cluster - endpoints: - lb_endpoints: - endpoint: - address: - socket_address: - address: "net-kourier-controller.knative-serving" - port_value: 18000 - type: STRICT_DNS - admin: - access_log: - - name: envoy.access_loggers.stdout - typed_config: - "@type": type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog - address: - socket_address: - address: 127.0.0.1 - port_value: 9901 ---- -# Copyright 2021 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: v1 -kind: ConfigMap -metadata: - name: config-kourier - namespace: knative-serving - labels: - networking.knative.dev/ingress-provider: kourier - app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.22.1" - app.kubernetes.io/name: knative-serving -data: - _example: | - ################################ - # # - # EXAMPLE CONFIGURATION # - # # - ################################ - - # This block is not actually functional configuration, - # but serves to illustrate the available configuration - # options and document them in a way that is accessible - # to users that `kubectl edit` this config map. - # - # These sample configuration options may be copied out of - # this example block and unindented to be in the data block - # to actually change the configuration. - - # Specifies whether requests reaching the Kourier gateway - # in the context of services should be logged. Readiness - # probes etc. must be configured via the bootstrap config. - enable-service-access-logging: "true" - - # Specifies the format of the access log used by the Kourier gateway. - # This template follows the envoy format. - # see: https://www.envoyproxy.io/docs/envoy/latest/configuration/observability/access_log/usage#access-logging - service-access-log-template: "" - - # Specifies whether to use proxy-protocol in order to safely - # transport connection information such as a client's address - # across multiple layers of TCP proxies. - # NOTE THAT THIS IS AN EXPERIMENTAL / ALPHA FEATURE - enable-proxy-protocol: "false" - - # The server certificates to serve the internal TLS traffic for Kourier Gateway. - # It is specified by the secret name in controller namespace, which has - # the "tls.crt" and "tls.key" data field. - # Use an empty value to disable the feature (default). - # - # NOTE: This flag is in an alpha state and is mostly here to enable internal testing - # for now. Use with caution. - cluster-cert-secret: "" - - # Specifies the amount of time that Kourier waits for the incoming requests. - # The default, 0s, imposes no timeout at all. - stream-idle-timeout: "0s" - - # Specifies whether to use CryptoMB private key provider in order to - # acclerate the TLS handshake. - # NOTE THAT THIS IS AN EXPERIMENTAL / ALPHA FEATURE. - enable-cryptomb: "false" - - # Configures the number of additional ingress proxy hops from the - # right side of the x-forwarded-for HTTP header to trust. - trusted-hops-count: "0" - - # Configures the connection manager to use the real remote address - # of the client connection when determining internal versus external origin and manipulating various headers. - use-remote-address: "false" - - # Specifies the cipher suites for TLS external listener. - # Use ',' separated values like "ECDHE-ECDSA-AES128-GCM-SHA256,ECDHE-ECDSA-CHACHA20-POLY1305" - # The default uses the default cipher suites of the envoy version. - cipher-suites: "" - - # Disable the Envoy server header injection in the response when response has no such header. - disable-envoy-server-header: "false" - - # The external authorization service and port, my-auth:2222. - # This value overrides environment variable if defined. - extauthz-host: "" - - # The protocol used to query the ext auth service. Can be one of : grpc, http, https. Defaults to grpc - # This value overrides environment variable if defined. - extauthz-protocol: "grpc" - - # Allow traffic to go through if the ext auth service is down. Accepts true/false. - # This value overrides environment variable if defined. - extauthz-failure-mode-allow: "" - - # Max request bytes, if not set, defaults to 8192 Bytes. More info Envoy Docs - # see: https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/http/ext_authz/v3/ext_authz.proto.html#extensions-filters-http-ext-authz-v3-buffersettings - # This value overrides environment variable if defined. - extauthz-max-request-body-bytes: 8192 - - # Max time in ms to wait for the ext authz service. Defaults to 2000 ms - # This value overrides environment variable if defined. - extauthz-timeout: 2000 - - # If extauthz-protocol is equal to http or https, path to query the ext auth service. - # Example : if set to /verify, it will query /verify/ (notice the trailing /). If not set, it will query / - # This value overrides environment variable if defined. - extauthz-path-prefix: "" - - # If extauthz-protocol is equal to grpc, sends the body as raw bytes instead of a UTF-8 string. - # Accepts only true/false, t/f or 1/0. Attempting to set another value will throw an error. - # Defaults to false. More info Envoy Docs. - # see: https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/http/ext_authz/v3/ext_authz.proto.html#extensions-filters-http-ext-authz-v3-buffersettings - # This value overrides environment variable if defined. - extauthz-pack-as-byte: "false" - - # Specifies the secret that contains the TLS certificate and key pair when using HTTPS communication with Kourier Ingress. - # This value overrides environment variable if defined. - certs-secret-name: "" - certs-secret-namespace: "" - - # Specifies the OTLP collector endpoint for distributed tracing. - # The endpoint format depends on the protocol (see tracing-protocol). - # Examples: - # - For HTTP: "http://otel-collector.observability.svc:4318/v1/traces" - # - For gRPC: "http://otel-collector.observability.svc:4317" - # Use an empty value to disable distributed tracing (default). - tracing-endpoint: "" - - # Protocol for tracing collector communication. - # Valid values: http/protobuf, grpc - tracing-protocol: "grpc" - - # Tracing sampling rate (0.0 to 1.0) - # Controls the percentage of requests that are traced. - # Example: "1.0" traces 100% of requests. - tracing-sampling-rate: "1.0" - - # Service name for traces - # This identifies the Kourier gateway in your tracing system. - tracing-service-name: "kourier-knative" ---- -# Copyright 2020 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: v1 -kind: ServiceAccount -metadata: - name: net-kourier - namespace: knative-serving - labels: - networking.knative.dev/ingress-provider: kourier - app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.22.1" - app.kubernetes.io/name: knative-serving ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: net-kourier - labels: - networking.knative.dev/ingress-provider: kourier - app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.22.1" - app.kubernetes.io/name: knative-serving -rules: - - apiGroups: [""] - resources: ["events"] - verbs: ["create", "update", "patch"] - - apiGroups: [""] - resources: ["pods", "services", "secrets"] - verbs: ["get", "list", "watch"] - - apiGroups: [""] - resources: ["configmaps"] - verbs: ["get", "list", "watch"] - - apiGroups: ["discovery.k8s.io"] - resources: ["endpointslices"] - verbs: ["get", "list", "watch"] - - apiGroups: ["coordination.k8s.io"] - resources: ["leases"] - verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] - - apiGroups: ["networking.internal.knative.dev"] - resources: ["ingresses"] - verbs: ["get", "list", "watch", "patch"] - - apiGroups: ["networking.internal.knative.dev"] - resources: ["ingresses/status"] - verbs: ["update"] ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: net-kourier - labels: - networking.knative.dev/ingress-provider: kourier - app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.22.1" - app.kubernetes.io/name: knative-serving -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: net-kourier -subjects: - - kind: ServiceAccount - name: net-kourier - namespace: knative-serving ---- -# Copyright 2020 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: apps/v1 -kind: Deployment -metadata: - name: net-kourier-controller - namespace: knative-serving - labels: - networking.knative.dev/ingress-provider: kourier - app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.22.1" - app.kubernetes.io/name: knative-serving -spec: - strategy: - type: RollingUpdate - rollingUpdate: - maxUnavailable: 0 - maxSurge: 100% - replicas: 1 - selector: - matchLabels: - app: net-kourier-controller - template: - metadata: - annotations: - prometheus.io/scrape: "true" - prometheus.io/port: "9090" - prometheus.io/path: "/metrics" - labels: - app: net-kourier-controller - spec: - containers: - - image: gcr.io/knative-releases/knative.dev/net-kourier/cmd/kourier@sha256:01abd2070ccf8680885c47990e42c05c09e30bc8595d9246f4dcd37f2220a2a2 - name: controller - env: - # CERTS_SECRET_NAMESPACE and CERTS_SECRET_NAME can also be configured from a ConfigMap. - # Settings configured in a configmap take precedence over environment variable settings. - - name: CERTS_SECRET_NAMESPACE - value: "" - - name: CERTS_SECRET_NAME - value: "" - - name: SYSTEM_NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace - - name: METRICS_DOMAIN - value: "knative.dev/samples" - - name: KOURIER_GATEWAY_NAMESPACE - value: "kourier-system" - - name: ENABLE_SECRET_INFORMER_FILTERING_BY_CERT_UID - value: "false" - # KUBE_API_BURST and KUBE_API_QPS allows to configure maximum burst for throttle and maximum QPS to the server from the client. - # Setting these values using env vars is possible since https://github.com/knative/pkg/pull/2755. - # 200 is an arbitrary value, but it speeds up kourier startup duration, and the whole ingress reconciliation process as a whole. - - name: KUBE_API_BURST - value: "200" - - name: KUBE_API_QPS - value: "200" - ports: - - name: http2-xds - containerPort: 18000 - protocol: TCP - - name: metrics - containerPort: 9090 - protocol: TCP - readinessProbe: - grpc: - port: 18000 - periodSeconds: 10 - failureThreshold: 3 - livenessProbe: - grpc: - port: 18000 - periodSeconds: 10 - failureThreshold: 6 - securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: true - runAsNonRoot: true - capabilities: - drop: - - ALL - seccompProfile: - type: RuntimeDefault - resources: - requests: - cpu: 200m - memory: 200Mi - limits: - cpu: "1" - memory: 500Mi - restartPolicy: Always - serviceAccountName: net-kourier ---- -apiVersion: v1 -kind: Service -metadata: - name: net-kourier-controller - namespace: knative-serving - labels: - networking.knative.dev/ingress-provider: kourier - app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.22.1" - app.kubernetes.io/name: knative-serving -spec: - ports: - - name: grpc-xds - port: 18000 - protocol: TCP - targetPort: 18000 - - name: http-metrics - port: 9090 - protocol: TCP - targetPort: 9090 - selector: - app: net-kourier-controller - type: ClusterIP ---- -# Copyright 2020 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: apps/v1 -kind: Deployment -metadata: - name: 3scale-kourier-gateway - namespace: kourier-system - labels: - networking.knative.dev/ingress-provider: kourier - app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.22.1" - app.kubernetes.io/name: knative-serving -spec: - strategy: - type: RollingUpdate - rollingUpdate: - maxUnavailable: 0 - maxSurge: 100% - selector: - matchLabels: - app: 3scale-kourier-gateway - template: - metadata: - labels: - app: 3scale-kourier-gateway - annotations: - # v0.26 supports envoy v3 API, so - # adding this label to restart pod. - networking.knative.dev/poke: "v0.26" - prometheus.io/scrape: "true" - prometheus.io/port: "9000" - prometheus.io/path: "/stats/prometheus" - spec: - containers: - - args: - - --base-id 1 - - -c /tmp/config/envoy-bootstrap.yaml - - --log-level info - - --drain-time-s $(DRAIN_TIME_SECONDS) - - --drain-strategy immediate - command: - - /usr/local/bin/envoy - env: - - name: DRAIN_TIME_SECONDS - value: "15" - image: docker.io/envoyproxy/envoy:v1.37-latest - name: kourier-gateway - ports: - - name: http2-external - containerPort: 8080 - protocol: TCP - - name: http2-internal - containerPort: 8081 - protocol: TCP - - name: https-external - containerPort: 8443 - protocol: TCP - - name: http-probe - containerPort: 8090 - protocol: TCP - - name: https-probe - containerPort: 9443 - protocol: TCP - - name: metrics - containerPort: 9000 - protocol: TCP - securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: false - runAsNonRoot: true - runAsUser: 65534 - runAsGroup: 65534 - capabilities: - drop: - - ALL - seccompProfile: - type: RuntimeDefault - volumeMounts: - - name: config-volume - mountPath: /tmp/config - lifecycle: - preStop: - exec: - command: ["/bin/sh", "-c", "curl -X POST http://localhost:9901/drain_listeners?graceful; sleep $DRAIN_TIME_SECONDS"] - readinessProbe: - httpGet: - httpHeaders: - - name: Host - value: internalkourier - path: /ready - port: 8081 - scheme: HTTP - initialDelaySeconds: 10 - periodSeconds: 5 - failureThreshold: 3 - timeoutSeconds: 3 - livenessProbe: - httpGet: - httpHeaders: - - name: Host - value: internalkourier - path: /ready - port: 8081 - scheme: HTTP - initialDelaySeconds: 10 - periodSeconds: 5 - failureThreshold: 6 - timeoutSeconds: 3 - resources: - requests: - cpu: 200m - memory: 200Mi - limits: - cpu: "1" - memory: 800Mi - # to ensure a graceful drain, terminationGracePeriodSeconds must be greater than DRAIN_TIME_SECONDS environment variable - terminationGracePeriodSeconds: 30 - volumes: - - name: config-volume - configMap: - name: kourier-bootstrap - restartPolicy: Always ---- -apiVersion: v1 -kind: Service -metadata: - name: kourier - namespace: kourier-system - labels: - networking.knative.dev/ingress-provider: kourier - app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.22.1" - app.kubernetes.io/name: knative-serving -spec: - ports: - - name: http2 - port: 80 - protocol: TCP - targetPort: 8080 - - name: https - port: 443 - protocol: TCP - targetPort: 8443 - selector: - app: 3scale-kourier-gateway - type: LoadBalancer ---- -apiVersion: v1 -kind: Service -metadata: - name: kourier-internal - namespace: kourier-system - labels: - networking.knative.dev/ingress-provider: kourier - app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.22.1" - app.kubernetes.io/name: knative-serving -spec: - ports: - - name: http2 - port: 80 - protocol: TCP - targetPort: 8081 - - name: https - port: 443 - protocol: TCP - targetPort: 8444 - selector: - app: 3scale-kourier-gateway - type: ClusterIP ---- -apiVersion: autoscaling/v2 -kind: HorizontalPodAutoscaler -metadata: - name: 3scale-kourier-gateway - namespace: kourier-system - labels: - networking.knative.dev/ingress-provider: kourier - app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.22.1" - app.kubernetes.io/name: knative-serving -spec: - minReplicas: 1 - maxReplicas: 10 - scaleTargetRef: - apiVersion: apps/v1 - kind: Deployment - name: 3scale-kourier-gateway - metrics: - - type: Resource - resource: - name: cpu - target: - type: Utilization - # Percentage of the requested CPU - averageUtilization: 100 ---- -apiVersion: policy/v1 -kind: PodDisruptionBudget -metadata: - name: 3scale-kourier-gateway-pdb - namespace: kourier-system - labels: - networking.knative.dev/ingress-provider: kourier - app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.22.1" - app.kubernetes.io/name: knative-serving -spec: - minAvailable: 80% - selector: - matchLabels: - app: 3scale-kourier-gateway diff --git a/packages/manifests/operators/knative-serving.yaml b/packages/manifests/operators/knative-serving/v1.22.1/01-serving-crds.yaml similarity index 75% rename from packages/manifests/operators/knative-serving.yaml rename to packages/manifests/operators/knative-serving/v1.22.1/01-serving-crds.yaml index bbe9e23..fabc647 100644 --- a/packages/manifests/operators/knative-serving.yaml +++ b/packages/manifests/operators/knative-serving/v1.22.1/01-serving-crds.yaml @@ -1,5 +1,4 @@ # Source: https://github.com/knative/serving/releases/download/knative-v1.22.1/serving-crds.yaml ---- # Copyright 2020 The Knative Authors # # Licensed under the Apache License, Version 2.0 (the "License"); @@ -6691,3547 +6690,3 @@ spec: - name: Image type: string jsonPath: .spec.image ---- -# Source: https://github.com/knative/serving/releases/download/knative-v1.22.1/serving-core.yaml ---- -# Copyright 2018 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: v1 -kind: Namespace -metadata: - name: knative-serving - labels: - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" ---- -# Copyright 2023 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: knative-serving-activator - namespace: knative-serving - labels: - serving.knative.dev/controller: "true" - app.kubernetes.io/version: "1.22.1" - app.kubernetes.io/name: knative-serving -rules: - - apiGroups: [""] - resources: ["configmaps", "secrets"] - verbs: ["get", "list", "watch"] - - apiGroups: [""] - resources: ["secrets"] - verbs: ["get", "list", "watch"] - resourceNames: ["routing-serving-certs", "knative-serving-certs"] ---- -kind: ClusterRole -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: knative-serving-activator-cluster - labels: - serving.knative.dev/controller: "true" - app.kubernetes.io/version: "1.22.1" - app.kubernetes.io/name: knative-serving -rules: - - apiGroups: [""] - resources: ["services", "endpoints"] - verbs: ["get", "list", "watch"] - - apiGroups: ["serving.knative.dev"] - resources: ["revisions"] - verbs: ["get", "list", "watch"] ---- -# Copyright 2019 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -# Use this aggregated ClusterRole when you need readonly access to "Addressables" -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - # Named like this to avoid clashing with eventing's existing `addressable-resolver` role - # (which should be identical, but isn't guaranteed to be installed alongside serving). - name: knative-serving-aggregated-addressable-resolver - labels: - app.kubernetes.io/version: "1.22.1" - app.kubernetes.io/name: knative-serving -aggregationRule: - clusterRoleSelectors: - - matchLabels: - duck.knative.dev/addressable: "true" ---- -kind: ClusterRole -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: knative-serving-addressable-resolver - labels: - app.kubernetes.io/version: "1.22.1" - app.kubernetes.io/name: knative-serving - # Labeled to facilitate aggregated cluster roles that act on Addressables. - duck.knative.dev/addressable: "true" -# Do not use this role directly. These rules will be added to the "addressable-resolver" role. -rules: - - apiGroups: - - serving.knative.dev - resources: - - routes - - routes/status - - services - - services/status - verbs: - - get - - list - - watch ---- -# Copyright 2019 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -kind: ClusterRole -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: knative-serving-namespaced-admin - labels: - rbac.authorization.k8s.io/aggregate-to-admin: "true" - app.kubernetes.io/version: "1.22.1" - app.kubernetes.io/name: knative-serving -rules: - - apiGroups: ["serving.knative.dev"] - resources: ["*"] - verbs: ["*"] - - apiGroups: ["networking.internal.knative.dev", "autoscaling.internal.knative.dev", "caching.internal.knative.dev"] - resources: ["*"] - verbs: ["get", "list", "watch"] ---- -kind: ClusterRole -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: knative-serving-namespaced-edit - labels: - rbac.authorization.k8s.io/aggregate-to-edit: "true" - app.kubernetes.io/version: "1.22.1" - app.kubernetes.io/name: knative-serving -rules: - - apiGroups: ["serving.knative.dev"] - resources: ["*"] - verbs: ["create", "update", "patch", "delete"] - - apiGroups: ["networking.internal.knative.dev", "autoscaling.internal.knative.dev", "caching.internal.knative.dev"] - resources: ["*"] - verbs: ["get", "list", "watch"] ---- -kind: ClusterRole -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: knative-serving-namespaced-view - labels: - rbac.authorization.k8s.io/aggregate-to-view: "true" - app.kubernetes.io/version: "1.22.1" - app.kubernetes.io/name: knative-serving -rules: - - apiGroups: ["serving.knative.dev", "networking.internal.knative.dev", "autoscaling.internal.knative.dev", "caching.internal.knative.dev"] - resources: ["*"] - verbs: ["get", "list", "watch"] ---- -# Copyright 2019 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -kind: ClusterRole -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: knative-serving-core - labels: - serving.knative.dev/controller: "true" - app.kubernetes.io/version: "1.22.1" - app.kubernetes.io/name: knative-serving -rules: - - apiGroups: [""] - resources: ["pods", "namespaces", "secrets", "configmaps", "endpoints", "services", "events", "serviceaccounts"] - verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] - - apiGroups: [""] - resources: ["endpoints/restricted"] # Permission for RestrictedEndpointsAdmission - verbs: ["create"] - - apiGroups: ["discovery.k8s.io"] - resources: ["endpointslices/restricted"] # Permission for RestrictedEndpointsAdmission - verbs: ["create"] - - apiGroups: [""] - resources: ["namespaces/finalizers"] # finalizers are needed for the owner reference of the webhook - verbs: ["update"] - - apiGroups: ["discovery.k8s.io"] - resources: ["endpointslices"] - verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] - - apiGroups: ["apps"] - resources: ["deployments", "deployments/finalizers"] # finalizers are needed for the owner reference of the webhook - verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] - - apiGroups: ["admissionregistration.k8s.io"] - resources: ["mutatingwebhookconfigurations", "validatingwebhookconfigurations"] - verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] - - apiGroups: ["apiextensions.k8s.io"] - resources: ["customresourcedefinitions", "customresourcedefinitions/status"] - verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] - - apiGroups: ["autoscaling"] - resources: ["horizontalpodautoscalers"] - verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] - - apiGroups: ["coordination.k8s.io"] - resources: ["leases"] - verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] - - apiGroups: ["serving.knative.dev", "autoscaling.internal.knative.dev", "networking.internal.knative.dev"] - resources: ["*", "*/status", "*/finalizers"] - verbs: ["get", "list", "create", "update", "delete", "deletecollection", "patch", "watch"] - - apiGroups: ["caching.internal.knative.dev"] - resources: ["images"] - verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] - - apiGroups: ["cert-manager.io"] - resources: ["certificates", "clusterissuers", "certificaterequests", "issuers"] - verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] - - apiGroups: ["acme.cert-manager.io"] - resources: ["challenges"] - verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] - - apiGroups: ["rbac.authorization.k8s.io"] - resources: ["clusterroles"] - verbs: ["delete"] - resourceNames: ["knative-serving-certmanager"] - - apiGroups: ["*"] - resources: ["*/scale"] - verbs: ["patch"] ---- -# Copyright 2019 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -kind: ClusterRole -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: knative-serving-podspecable-binding - labels: - app.kubernetes.io/version: "1.22.1" - app.kubernetes.io/name: knative-serving - # Labeled to facilitate aggregated cluster roles that act on PodSpecables. - duck.knative.dev/podspecable: "true" -# Do not use this role directly. These rules will be added to the "podspecable-binder" role. -rules: - - apiGroups: - - serving.knative.dev - resources: - - configurations - - services - verbs: - - list - - watch - - patch ---- -# Copyright 2018 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: v1 -kind: ServiceAccount -metadata: - name: controller - namespace: knative-serving - labels: - app.kubernetes.io/component: controller - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" ---- -kind: ClusterRole -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: knative-serving-admin - labels: - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" -aggregationRule: - clusterRoleSelectors: - - matchLabels: - serving.knative.dev/controller: "true" ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: knative-serving-controller-admin - labels: - app.kubernetes.io/component: controller - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" -subjects: - - kind: ServiceAccount - name: controller - namespace: knative-serving -roleRef: - kind: ClusterRole - name: knative-serving-admin - apiGroup: rbac.authorization.k8s.io ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: knative-serving-controller-addressable-resolver - labels: - app.kubernetes.io/component: controller - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" -subjects: - - kind: ServiceAccount - name: controller - namespace: knative-serving -roleRef: - kind: ClusterRole - name: knative-serving-aggregated-addressable-resolver - apiGroup: rbac.authorization.k8s.io ---- -apiVersion: v1 -kind: ServiceAccount -metadata: - name: activator - namespace: knative-serving - labels: - app.kubernetes.io/component: activator - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: knative-serving-activator - namespace: knative-serving - labels: - app.kubernetes.io/component: activator - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" -subjects: - - kind: ServiceAccount - name: activator - namespace: knative-serving -roleRef: - kind: Role - name: knative-serving-activator - apiGroup: rbac.authorization.k8s.io ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: knative-serving-activator-cluster - labels: - app.kubernetes.io/component: activator - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" -subjects: - - kind: ServiceAccount - name: activator - namespace: knative-serving -roleRef: - kind: ClusterRole - name: knative-serving-activator-cluster - apiGroup: rbac.authorization.k8s.io ---- -apiVersion: networking.internal.knative.dev/v1alpha1 -kind: Certificate -metadata: - annotations: - networking.knative.dev/certificate.class: cert-manager.certificate.networking.knative.dev - labels: - networking.knative.dev/certificate-type: system-internal - name: routing-serving-certs - namespace: knative-serving -spec: - dnsNames: - - kn-routing - - data-plane.knative.dev # for reverse-compatibility with net-* implementations that do not work with multi-SANs - secretName: routing-serving-certs ---- -# Copyright 2018 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: caching.internal.knative.dev/v1alpha1 -kind: Image -metadata: - name: queue-proxy - namespace: knative-serving - labels: - app.kubernetes.io/component: queue-proxy - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" -spec: - # This is the Go import path for the binary that is containerized - # and substituted here. - image: gcr.io/knative-releases/knative.dev/serving/cmd/queue@sha256:b1af8bda6c1d32b1cf5fbf8f1f6068c5007a5cebf091039fdea83b88b1fd87f4 ---- -# Copyright 2018 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: v1 -kind: ConfigMap -metadata: - name: config-autoscaler - namespace: knative-serving - labels: - app.kubernetes.io/component: autoscaler - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" - annotations: - knative.dev/example-checksum: "c727b3e8" -data: - _example: | - ################################ - # # - # EXAMPLE CONFIGURATION # - # # - ################################ - - # This block is not actually functional configuration, - # but serves to illustrate the available configuration - # options and document them in a way that is accessible - # to users that `kubectl edit` this config map. - # - # These sample configuration options may be copied out of - # this example block and unindented to be in the data block - # to actually change the configuration. - - # The Revision ContainerConcurrency field specifies the maximum number - # of requests the Container can handle at once. Container concurrency - # target percentage is how much of that maximum to use in a stable - # state. E.g. if a Revision specifies ContainerConcurrency of 10, then - # the Autoscaler will try to maintain 7 concurrent connections per pod - # on average. - # Note: this limit will be applied to container concurrency set at every - # level (ConfigMap, Revision Spec or Annotation). - # For legacy and backwards compatibility reasons, this value also accepts - # fractional values in (0, 1] interval (i.e. 0.7 ⇒ 70%). - # Thus minimal percentage value must be greater than 1.0, or it will be - # treated as a fraction. - # NOTE: that this value does not affect actual number of concurrent requests - # the user container may receive, but only the average number of requests - # that the revision pods will receive. - container-concurrency-target-percentage: "70" - - # The container concurrency target default is what the Autoscaler will - # try to maintain when concurrency is used as the scaling metric for the - # Revision and the Revision specifies unlimited concurrency. - # When revision explicitly specifies container concurrency, that value - # will be used as a scaling target for autoscaler. - # When specifying unlimited concurrency, the autoscaler will - # horizontally scale the application based on this target concurrency. - # This is what we call "soft limit" in the documentation, i.e. it only - # affects number of pods and does not affect the number of requests - # individual pod processes. - # The value must be a positive number such that the value multiplied - # by container-concurrency-target-percentage is greater than 0.01. - # NOTE: that this value will be adjusted by application of - # container-concurrency-target-percentage, i.e. by default - # the system will target on average 70 concurrent requests - # per revision pod. - # NOTE: Only one metric can be used for autoscaling a Revision. - container-concurrency-target-default: "100" - - # The requests per second (RPS) target default is what the Autoscaler will - # try to maintain when RPS is used as the scaling metric for a Revision and - # the Revision specifies unlimited RPS. Even when specifying unlimited RPS, - # the autoscaler will horizontally scale the application based on this - # target RPS. - # Must be greater than 1.0. - # NOTE: Only one metric can be used for autoscaling a Revision. - requests-per-second-target-default: "200" - - # The target burst capacity specifies the size of burst in concurrent - # requests that the system operator expects the system will receive. - # Autoscaler will try to protect the system from queueing by introducing - # Activator in the request path if the current spare capacity of the - # service is less than this setting. - # If this setting is 0, then Activator will be in the request path only - # when the revision is scaled to 0. - # If this setting is > 0 and container-concurrency-target-percentage is - # 100% or 1.0, then activator will always be in the request path. - # -1 denotes unlimited target-burst-capacity and activator will always - # be in the request path. - # Other negative values are invalid. - target-burst-capacity: "211" - - # When operating in a stable mode, the autoscaler operates on the - # average concurrency over the stable window. - # Stable window must be in whole seconds. - stable-window: "60s" - - # When observed average concurrency during the panic window reaches - # panic-threshold-percentage the target concurrency, the autoscaler - # enters panic mode. When operating in panic mode, the autoscaler - # scales on the average concurrency over the panic window which is - # panic-window-percentage of the stable-window. - # Must be in the [1, 100] range. - # When computing the panic window it will be rounded to the closest - # whole second, at least 1s. - panic-window-percentage: "10.0" - - # The percentage of the container concurrency target at which to - # enter panic mode when reached within the panic window. - panic-threshold-percentage: "200.0" - - # Max scale up rate limits the rate at which the autoscaler will - # increase pod count. It is the maximum ratio of desired pods versus - # observed pods. - # Cannot be less or equal to 1. - # I.e with value of 2.0 the number of pods can at most go N to 2N - # over single Autoscaler period (2s), but at least N to - # N+1, if Autoscaler needs to scale up. - max-scale-up-rate: "1000.0" - - # Max scale down rate limits the rate at which the autoscaler will - # decrease pod count. It is the maximum ratio of observed pods versus - # desired pods. - # Cannot be less or equal to 1. - # I.e. with value of 2.0 the number of pods can at most go N to N/2 - # over single Autoscaler evaluation period (2s), but at - # least N to N-1, if Autoscaler needs to scale down. - max-scale-down-rate: "2.0" - - # Scale to zero feature flag. - enable-scale-to-zero: "true" - - # Scale to zero grace period is the time an inactive revision is left - # running before it is scaled to zero (must be positive, but recommended - # at least a few seconds if running with mesh networking). - # This is the upper limit and is provided not to enforce timeout after - # the revision stopped receiving requests for stable window, but to - # ensure network reprogramming to put activator in the path has completed. - # If the system determines that a shorter period is satisfactory, - # then the system will only wait that amount of time before scaling to 0. - # NOTE: this period might actually be 0, if activator has been - # in the request path sufficiently long. - # If there is necessity for the last pod to linger longer use - # scale-to-zero-pod-retention-period flag. - scale-to-zero-grace-period: "30s" - - # Scale to zero pod retention period defines the minimum amount - # of time the last pod will remain after Autoscaler has decided to - # scale to zero. - # This flag is for the situations where the pod startup is very expensive - # and the traffic is bursty (requiring smaller windows for fast action), - # but patchy. - # The larger of this flag and `scale-to-zero-grace-period` will effectively - # determine how the last pod will hang around. - scale-to-zero-pod-retention-period: "0s" - - # pod-autoscaler-class specifies the default pod autoscaler class - # that should be used if none is specified. If omitted, - # the Knative Pod Autoscaler (KPA) is used by default. - pod-autoscaler-class: "kpa.autoscaling.knative.dev" - - # The capacity of a single activator task. - # The `unit` is one concurrent request proxied by the activator. - # activator-capacity must be at least 1. - # This value is used for computation of the Activator subset size. - # See the algorithm here: https://bit.ly/38XiCZ3. - # TODO(vagababov): tune after actual benchmarking. - activator-capacity: "100.0" - - # initial-scale is the cluster-wide default value for the initial target - # scale of a revision after creation, unless overridden by the - # "autoscaling.knative.dev/initialScale" annotation. - # This value must be greater than 0 unless allow-zero-initial-scale is true. - initial-scale: "1" - - # allow-zero-initial-scale controls whether either the cluster-wide initial-scale flag, - # or the "autoscaling.knative.dev/initialScale" annotation, can be set to 0. - allow-zero-initial-scale: "false" - - # min-scale is the cluster-wide default value for the min scale of a revision, - # unless overridden by the "autoscaling.knative.dev/minScale" annotation. - min-scale: "0" - - # max-scale is the cluster-wide default value for the max scale of a revision, - # unless overridden by the "autoscaling.knative.dev/maxScale" annotation. - # If set to 0, the revision has no maximum scale. - max-scale: "0" - - # scale-down-delay is the amount of time that must pass at reduced - # concurrency before a scale down decision is applied. This can be useful, - # for example, to maintain replica count and avoid a cold start penalty if - # more requests come in within the scale down delay period. - # The default, 0s, imposes no delay at all. - scale-down-delay: "0s" - - # max-scale-limit sets the maximum permitted value for the max scale of a revision. - # When this is set to a positive value, a revision with a maxScale above that value - # (including a maxScale of "0" = unlimited) is disallowed. - # A value of zero (the default) allows any limit, including unlimited. - max-scale-limit: "0" ---- -# Copyright 2020 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: v1 -kind: ConfigMap -metadata: - name: config-certmanager - namespace: knative-serving - labels: - app.kubernetes.io/name: knative-serving - app.kubernetes.io/component: controller - app.kubernetes.io/version: "1.22.1" - networking.knative.dev/certificate-provider: cert-manager - annotations: - knative.dev/example-checksum: "b7a9a602" -data: - _example: | - ################################ - # # - # EXAMPLE CONFIGURATION # - # # - ################################ - - # This block is not actually functional configuration, - # but serves to illustrate the available configuration - # options and document them in a way that is accessible - # to users that `kubectl edit` this config map. - # - # These sample configuration options may be copied out of - # this block and unindented to actually change the configuration. - - # issuerRef is a reference to the issuer for external-domain certificates used for ingress. - # IssuerRef should be either `ClusterIssuer` or `Issuer`. - # Please refer `IssuerRef` in https://cert-manager.io/docs/concepts/issuer/ - # for more details about IssuerRef configuration. - # If the issuerRef is not specified, the self-signed `knative-selfsigned-issuer` ClusterIssuer is used. - issuerRef: | - kind: ClusterIssuer - name: letsencrypt-issuer - - # clusterLocalIssuerRef is a reference to the issuer for cluster-local-domain certificates used for ingress. - # clusterLocalIssuerRef should be either `ClusterIssuer` or `Issuer`. - # Please refer `IssuerRef` in https://cert-manager.io/docs/concepts/issuer/ - # for more details about ClusterInternalIssuerRef configuration. - # If the clusterLocalIssuerRef is not specified, the self-signed `knative-selfsigned-issuer` ClusterIssuer is used. - clusterLocalIssuerRef: | - kind: ClusterIssuer - name: your-company-issuer - - # systemInternalIssuerRef is a reference to the issuer for certificates for system-internal-tls certificates used by Knative internal components. - # systemInternalIssuerRef should be either `ClusterIssuer` or `Issuer`. - # Please refer `IssuerRef` in https://cert-manager.io/docs/concepts/issuer/ - # for more details about ClusterInternalIssuerRef configuration. - # If the systemInternalIssuerRef is not specified, the self-signed `knative-selfsigned-issuer` ClusterIssuer is used. - systemInternalIssuerRef: | - kind: ClusterIssuer - name: knative-selfsigned-issuer ---- -# Copyright 2019 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: v1 -kind: ConfigMap -metadata: - name: config-defaults - namespace: knative-serving - labels: - app.kubernetes.io/name: knative-serving - app.kubernetes.io/component: controller - app.kubernetes.io/version: "1.22.1" - annotations: - knative.dev/example-checksum: "5b64ff5c" -data: - _example: | - ################################ - # # - # EXAMPLE CONFIGURATION # - # # - ################################ - - # This block is not actually functional configuration, - # but serves to illustrate the available configuration - # options and document them in a way that is accessible - # to users that `kubectl edit` this config map. - # - # These sample configuration options may be copied out of - # this example block and unindented to be in the data block - # to actually change the configuration. - - # revision-timeout-seconds contains the default number of - # seconds to use for the revision's per-request timeout, if - # none is specified. - revision-timeout-seconds: "300" # 5 minutes - - # max-revision-timeout-seconds contains the maximum number of - # seconds that can be used for revision-timeout-seconds. - # This value must be greater than or equal to revision-timeout-seconds. - # If omitted, the system default is used (600 seconds). - # - # If this value is increased, the activator's terminationGracePeriodSeconds - # should also be increased to prevent in-flight requests being disrupted. - max-revision-timeout-seconds: "600" # 10 minutes - - # revision-response-start-timeout-seconds contains the default number of - # seconds a request will be allowed to stay open while waiting to - # receive any bytes from the user's application, if none is specified. - # - # This defaults to 'revision-timeout-seconds' - revision-response-start-timeout-seconds: "300" - - # revision-idle-timeout-seconds contains the default number of - # seconds a request will be allowed to stay open while not receiving any - # bytes from the user's application, if none is specified. - revision-idle-timeout-seconds: "0" # infinite - - # revision-cpu-request contains the cpu allocation to assign - # to revisions by default. If omitted, no value is specified - # and the system default is used. - # Below is an example of setting revision-cpu-request. - # By default, it is not set by Knative. - revision-cpu-request: "400m" # 0.4 of a CPU (aka 400 milli-CPU) - - # revision-memory-request contains the memory allocation to assign - # to revisions by default. If omitted, no value is specified - # and the system default is used. - # Below is an example of setting revision-memory-request. - # By default, it is not set by Knative. - revision-memory-request: "100M" # 100 megabytes of memory - - # revision-ephemeral-storage-request contains the ephemeral storage - # allocation to assign to revisions by default. If omitted, no value is - # specified and the system default is used. - revision-ephemeral-storage-request: "500M" # 500 megabytes of storage - - # revision-cpu-limit contains the cpu allocation to limit - # revisions to by default. If omitted, no value is specified - # and the system default is used. - # Below is an example of setting revision-cpu-limit. - # By default, it is not set by Knative. - revision-cpu-limit: "1000m" # 1 CPU (aka 1000 milli-CPU) - - # revision-memory-limit contains the memory allocation to limit - # revisions to by default. If omitted, no value is specified - # and the system default is used. - # Below is an example of setting revision-memory-limit. - # By default, it is not set by Knative. - revision-memory-limit: "200M" # 200 megabytes of memory - - # revision-ephemeral-storage-limit contains the ephemeral storage - # allocation to limit revisions to by default. If omitted, no value is - # specified and the system default is used. - revision-ephemeral-storage-limit: "750M" # 750 megabytes of storage - - # container-name-template contains a template for the default - # container name, if none is specified. This field supports - # Go templating and is supplied with the ObjectMeta of the - # enclosing Service or Configuration, so values such as - # {{.Name}} are also valid. - container-name-template: "user-container" - - # init-container-name-template contains a template for the default - # init container name, if none is specified. This field supports - # Go templating and is supplied with the ObjectMeta of the - # enclosing Service or Configuration, so values such as - # {{.Name}} are also valid. - init-container-name-template: "init-container" - - # container-concurrency specifies the maximum number - # of requests the Container can handle at once, and requests - # above this threshold are queued. Setting a value of zero - # disables this throttling and lets through as many requests as - # the pod receives. - container-concurrency: "0" - - # The container concurrency max limit is an operator setting ensuring that - # the individual revisions cannot have arbitrary large concurrency - # values, or autoscaling targets. `container-concurrency` default setting - # must be at or below this value. - # - # Must be greater than 1. - # - # Note: even with this set, a user can choose a containerConcurrency - # of 0 (i.e. unbounded) unless allow-container-concurrency-zero is - # set to "false". - container-concurrency-max-limit: "1000" - - # allow-container-concurrency-zero controls whether users can - # specify 0 (i.e. unbounded) for containerConcurrency. - allow-container-concurrency-zero: "true" - - # enable-service-links specifies the default value used for the - # enableServiceLinks field of the PodSpec, when it is omitted by the user. - # See: https://kubernetes.io/docs/concepts/services-networking/connect-applications-service/#accessing-the-service - # - # This is a tri-state flag with possible values of (true|false|default). - # - # In environments with large number of services it is suggested - # to set this value to `false`. - # See https://github.com/knative/serving/issues/8498. - enable-service-links: "false" ---- -# Copyright 2019 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: v1 -kind: ConfigMap -metadata: - name: config-deployment - namespace: knative-serving - labels: - app.kubernetes.io/name: knative-serving - app.kubernetes.io/component: controller - app.kubernetes.io/version: "1.22.1" - annotations: - knative.dev/example-checksum: "555b4826" -data: - # This is the Go import path for the binary that is containerized - # and substituted here. - queue-sidecar-image: gcr.io/knative-releases/knative.dev/serving/cmd/queue@sha256:b1af8bda6c1d32b1cf5fbf8f1f6068c5007a5cebf091039fdea83b88b1fd87f4 - _example: |- - ################################ - # # - # EXAMPLE CONFIGURATION # - # # - ################################ - - # This block is not actually functional configuration, - # but serves to illustrate the available configuration - # options and document them in a way that is accessible - # to users that `kubectl edit` this config map. - # - # These sample configuration options may be copied out of - # this example block and unindented to be in the data block - # to actually change the configuration. - - # List of repositories for which tag to digest resolving should be skipped - registries-skipping-tag-resolving: "kind.local,ko.local,dev.local" - - # Maximum time allowed for an image's digests to be resolved. - digest-resolution-timeout: "10s" - - # Duration we wait for the deployment to be ready before considering it failed. - progress-deadline: "600s" - - # Sets the queue proxy's CPU request. - # If omitted, a default value (currently "25m"), is used. - queue-sidecar-cpu-request: "25m" - - # Sets the queue proxy's CPU limit. - # If omitted, a default value (currently "1000m"), is used when - # `queueproxy.resource-defaults` is set to `Enabled`. - queue-sidecar-cpu-limit: "1000m" - - # Sets the queue proxy's memory request. - # If omitted, a default value (currently "400Mi"), is used when - # `queueproxy.resource-defaults` is set to `Enabled`. - queue-sidecar-memory-request: "400Mi" - - # Sets the queue proxy's memory limit. - # If omitted, a default value (currently "800Mi"), is used when - # `queueproxy.resource-defaults` is set to `Enabled`. - queue-sidecar-memory-limit: "800Mi" - - # Sets the queue proxy's ephemeral storage request. - # If omitted, no value is specified and the system default is used. - queue-sidecar-ephemeral-storage-request: "512Mi" - - # Sets the queue proxy's ephemeral storage limit. - # If omitted, no value is specified and the system default is used. - queue-sidecar-ephemeral-storage-limit: "1024Mi" - - # Sets tokens associated with specific audiences for queue proxy - used by QPOptions - # - # For example, to add the `service-x` audience: - # queue-sidecar-token-audiences: "service-x" - # Also supports a list of audiences, for example: - # queue-sidecar-token-audiences: "service-x,service-y" - # If omitted, or empty, no tokens are created - queue-sidecar-token-audiences: "" - - # Sets rootCA for the queue proxy - used by QPOptions - # If omitted, or empty, no rootCA is added to the golang rootCAs - queue-sidecar-rootca: "" - - # Sets the minimum TLS version for the queue proxy sidecar's TLS server. - # Accepted values: "1.2", "1.3". Default is "1.3" if not specified. - queue-sidecar-tls-min-version: "" - - # Sets the maximum TLS version for the queue proxy sidecar's TLS server. - # Accepted values: "1.2", "1.3". If omitted, the Go default is used. - queue-sidecar-tls-max-version: "" - - # Sets the cipher suites for the queue proxy sidecar's TLS server. - # Comma-separated list of cipher suite names (e.g. "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"). - # If omitted, the Go default cipher suites are used. - # Note: cipher suites are not configurable in TLS 1.3. - queue-sidecar-tls-cipher-suites: "" - - # Sets the elliptic curve preferences for the queue proxy sidecar's TLS server. - # Comma-separated list of curve names (e.g. "X25519,CurveP256"). - # If omitted, the Go default curves are used. - queue-sidecar-tls-curve-preferences: "" - - # If set, it automatically configures pod anti-affinity requirements for all Knative services. - # It employs the `preferredDuringSchedulingIgnoredDuringExecution` weighted pod affinity term, - # aligning with the Knative revision label. It yields the configuration below in all workloads' deployments: - # ` - # affinity: - # podAntiAffinity: - # preferredDuringSchedulingIgnoredDuringExecution: - # - podAffinityTerm: - # topologyKey: kubernetes.io/hostname - # labelSelector: - # matchLabels: - # serving.knative.dev/revision: {{revision-name}} - # weight: 100 - # ` - # This may be "none" or "prefer-spread-revision-over-nodes" (default) - # default-affinity-type: "prefer-spread-revision-over-nodes" - - # runtime-class-name contains the selector for which runtimeClassName - # is selected to put in a revision. - # By default, it is not set by Knative. - # - # Example: - # runtime-class-name: | - # "": - # selector: - # use-default-runc: "yes" - # kata: {} - # gvisor: - # selector: - # use-gvisor: "please" - runtime-class-name: "" - - # pod-is-always-schedulable can be used to define that Pods in the system will always be - # scheduled, and a Revision should not be marked unschedulable. - # Setting this to `true` makes sense if you have cluster-autoscaling set up for your cluster - # where unschedulable Pods trigger the addition of a new Node and are therefore a short and - # transient state. - # - # See https://github.com/knative/serving/issues/14862 - pod-is-always-schedulable: "false" ---- -# Copyright 2018 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: v1 -kind: ConfigMap -metadata: - name: config-domain - namespace: knative-serving - labels: - app.kubernetes.io/name: knative-serving - app.kubernetes.io/component: controller - app.kubernetes.io/version: "1.22.1" - annotations: - knative.dev/example-checksum: "26c09de5" -data: - _example: | - ################################ - # # - # EXAMPLE CONFIGURATION # - # # - ################################ - - # This block is not actually functional configuration, - # but serves to illustrate the available configuration - # options and document them in a way that is accessible - # to users that `kubectl edit` this config map. - # - # These sample configuration options may be copied out of - # this example block and unindented to be in the data block - # to actually change the configuration. - - # Default value for domain. - # Routes having the cluster domain suffix (by default 'svc.cluster.local') - # will not be exposed through Ingress. You can define your own label - # selector to assign that domain suffix to your Route here, or you can set - # the label - # "networking.knative.dev/visibility=cluster-local" - # to achieve the same effect. This shows how to make routes having - # the label app=secret only exposed to the local cluster. - svc.cluster.local: | - selector: - app: secret - - # These are example settings of domain. - # example.com will be used for all routes, but it is the least-specific rule so it - # will only be used if no other domain matches. - example.com: | - - # example.org will be used for routes having app=nonprofit. - example.org: | - selector: - app: nonprofit ---- -# Copyright 2020 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: v1 -kind: ConfigMap -metadata: - name: config-features - namespace: knative-serving - labels: - app.kubernetes.io/name: knative-serving - app.kubernetes.io/component: controller - app.kubernetes.io/version: "1.22.1" - annotations: - knative.dev/example-checksum: "bee75b26" -data: - _example: |- - ################################ - # # - # EXAMPLE CONFIGURATION # - # # - ################################ - - # This block is not actually functional configuration, - # but serves to illustrate the available configuration - # options and document them in a way that is accessible - # to users that `kubectl edit` this config map. - # - # These sample configuration options may be copied out of - # this example block and unindented to be in the data block - # to actually change the configuration. - - # Default SecurityContext settings to secure-by-default values - # if unset. - # - # Disabled - do nothing; no security options are applied - # AllowRootBounded - Applies secure defaults without enforcing strict policies; sets seccompProfile - # to RuntimeDefault and drops all capabilities - # Enabled - Enforces security defaults; sets seccompProfile to RuntimeDefault, drops all capabilities, - # and sets runAsNonRoot to true if not already specified. - secure-pod-defaults: "disabled" - - # Indicates whether multi container support is enabled - # - # WARNING: Cannot safely be disabled once enabled. - # See: https://knative.dev/docs/serving/configuration/feature-flags/#multiple-containers - multi-container: "enabled" - - # Indicates whether multi container probing is enabled - # - # WARNING: Cannot safely be disabled once enabled. - # See: https://knative.dev/docs/serving/configuration/feature-flags/#multiple-container-probing - multi-container-probing: "disabled" - - # Indicates whether Kubernetes affinity support is enabled - # - # WARNING: Cannot safely be disabled once enabled. - # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-node-affinity - kubernetes.podspec-affinity: "disabled" - - # Indicates whether Kubernetes topologySpreadConstraints support is enabled - # - # WARNING: Cannot safely be disabled once enabled. - # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-topology-spread-constraints - kubernetes.podspec-topologyspreadconstraints: "disabled" - - # Indicates whether Kubernetes hostAliases support is enabled - # - # WARNING: Cannot safely be disabled once enabled. - # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-host-aliases - kubernetes.podspec-hostaliases: "disabled" - - # Indicates whether Kubernetes nodeSelector support is enabled - # - # WARNING: Cannot safely be disabled once enabled. - # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-node-selector - kubernetes.podspec-nodeselector: "disabled" - - # Indicates whether Kubernetes tolerations support is enabled - # - # WARNING: Cannot safely be disabled once enabled - # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-toleration - kubernetes.podspec-tolerations: "disabled" - - # Indicates whether Kubernetes FieldRef support is enabled - # - # WARNING: Cannot safely be disabled once enabled. - # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-fieldref - kubernetes.podspec-fieldref: "disabled" - - # Indicates whether Kubernetes RuntimeClassName support is enabled - # - # WARNING: Cannot safely be disabled once enabled. - # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-runtime-class - kubernetes.podspec-runtimeclassname: "disabled" - - # Indicates whether Kubernetes DNSPolicy support is enabled - # - # WARNING: Cannot safely be disabled once enabled. - # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-dnspolicy - kubernetes.podspec-dnspolicy: "disabled" - - # Indicates whether Kubernetes DNSConfig support is enabled - # - # WARNING: Cannot safely be disabled once enabled. - # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-dnsconfig - kubernetes.podspec-dnsconfig: "disabled" - - # This feature allows end-users to set a subset of fields on the Pod's SecurityContext - # - # When set to "enabled" or "allowed" it allows the following - # PodSecurityContext properties: - # - FSGroup - # - RunAsGroup - # - RunAsNonRoot - # - SupplementalGroups - # - RunAsUser - # - SeccompProfile - # - # This feature flag should be used with caution as the PodSecurityContext - # properties may have a side-effect on non-user sidecar containers that come - # from Knative or your service mesh - # - # WARNING: Cannot safely be disabled once enabled. - # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-security-context - kubernetes.podspec-securitycontext: "disabled" - - # Indicated whether sharing the process namespace via ShareProcessNamespace pod spec is allowed. - # This can be especially useful for sharing data from images directly between sidecars - # - # See: https://knative.dev/docs/serving/configuration/feature-flags/#kubernetes-share-process-namespace - kubernetes.podspec-shareprocessnamespace: "disabled" - - # Indicates whether hostIPC support is enabled - # - # WARNING: Cannot safely be disabled once enabled. - # See https://knative.dev/docs/serving/configuration/feature-flags/#kubernetes-host-ipc - kubernetes.podspec-hostipc: "disabled" - - # Indicates whether hostPID support is enabled - # - # WARNING: Cannot safely be disabled once enabled. - # See https://knative.dev/docs/serving/configuration/feature-flags/#kubernetes-host-pid - kubernetes.podspec-hostpid: "disabled" - - # Indicates whether hostNetwork support is enabled - # - # WARNING: Cannot safely be disabled once enabled. - # See See https://knative.dev/docs/serving/configuration/feature-flags/#kubernetes-host-network - kubernetes.podspec-hostnetwork: "disabled" - - # Indicates whether Kubernetes PriorityClassName support is enabled - # - # WARNING: Cannot safely be disabled once enabled. - # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-priority-class-name - kubernetes.podspec-priorityclassname: "disabled" - - # Indicates whether Kubernetes SchedulerName support is enabled - # - # WARNING: Cannot safely be disabled once enabled. - # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-scheduler-name - kubernetes.podspec-schedulername: "disabled" - - # This feature flag allows end-users to add a subset of capabilities on the Pod's SecurityContext. - # - # When set to "enabled" or "allowed" it allows capabilities to be added to the container. - # For a list of possible capabilities, see https://man7.org/linux/man-pages/man7/capabilities.7.html - kubernetes.containerspec-addcapabilities: "disabled" - - - # Controls whether tag header based routing feature are enabled or not. - # 1. Enabled: enabling tag header based routing - # 2. Disabled: disabling tag header based routing - # See: https://knative.dev/docs/serving/feature-flags/#tag-header-based-routing - tag-header-based-routing: "disabled" - - # Controls whether http2 auto-detection should be enabled or not. - # 1. Enabled: http2 connection will be attempted via upgrade. - # 2. Disabled: http2 connection will only be attempted when port name is set to "h2c". - autodetect-http2: "disabled" - - # Controls whether volume support for EmptyDir is enabled or not. - # 1. Enabled: enabling EmptyDir volume support - # 2. Disabled: disabling EmptyDir volume support - kubernetes.podspec-volumes-emptydir: "enabled" - - # Controls whether volume support for image is enabled or not. - # 1. Enabled: enabling image volume support - # 2. Disabled: disabling image volume support - kubernetes.podspec-volumes-image: "disabled" - - # Controls whether volume support for HostPath is enabled or not. - # WARNING: Cannot safely be disabled once enabled. - # WARNING: If you can avoid using a hostPath volume, you should. - # Please read https://kubernetes.io/docs/concepts/storage/volumes/#hostpath before enabling this feature. - # 1. Enabled: enabling HostPath volume support - # 2. Disabled: disabling HostPath volume support - kubernetes.podspec-volumes-hostpath: "disabled" - - # Controls whether volume support for CSI is enabled or not. - # 1. Enabled: enabling CSI volume support - # 2. Disabled: disabling CSI volume support - kubernetes.podspec-volumes-csi: "disabled" - - # Controls whether init containers support is enabled or not. - # 1. Enabled: enabling init containers support - # 2. Disabled: disabling init containers support - kubernetes.podspec-init-containers: "disabled" - - # Controls whether persistent volume claim support is enabled or not. - # 1. Enabled: enabling persistent volume claim support - # 2. Disabled: disabling persistent volume claim support - kubernetes.podspec-persistent-volume-claim: "disabled" - - # Controls whether write access for persistent volumes is enabled or not. - # 1. Enabled: enabling write access for persistent volumes - # 2. Disabled: disabling write access for persistent volumes - kubernetes.podspec-persistent-volume-write: "disabled" - - # Controls whether volume mount propagation support is enabled or not. - # 1. Enabled: enabling volume mount propagation support - # 2. Disabled: disabling volume mount propagation support - kubernetes.podspec-volumes-mount-propagation: "disabled" - - # Controls if the queue proxy podInfo feature is enabled, allowed or disabled - # - # This feature should be enabled/allowed when using queue proxy Options (Extensions) - # Enabling will mount a podInfo volume to the queue proxy container. - # The volume will contains an 'annotations' file (from the pod's annotation field). - # The annotations in this file include the Service annotations set by the client creating the service. - # If mounted, the annotations can be accessed by queue proxy extensions at /etc/podinfo/annotations - # - # 1. "enabled": always mount a podInfo volume - # 2. "disabled": never mount a podInfo volume - # 3. "allowed": by default, do not mount a podInfo volume - # However, a client may mount the podInfo volume on an individual Service by attaching - # the following metadata annotation to the Service: "features.knative.dev/queueproxy-podinfo":"enabled". - # - # NOTE THAT THIS IS AN EXPERIMENTAL / ALPHA FEATURE - queueproxy.mount-podinfo: "disabled" - - # Default queue proxy resource requests and limits to good values for most cases if set. - queueproxy.resource-defaults: "disabled" ---- -# Copyright 2018 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: v1 -kind: ConfigMap -metadata: - name: config-gc - namespace: knative-serving - labels: - app.kubernetes.io/name: knative-serving - app.kubernetes.io/component: controller - app.kubernetes.io/version: "1.22.1" - annotations: - knative.dev/example-checksum: "aa3813a8" -data: - _example: | - ################################ - # # - # EXAMPLE CONFIGURATION # - # # - ################################ - - # This block is not actually functional configuration, - # but serves to illustrate the available configuration - # options and document them in a way that is accessible - # to users that `kubectl edit` this config map. - # - # These sample configuration options may be copied out of - # this example block and unindented to be in the data block - # to actually change the configuration. - - # --------------------------------------- - # Garbage Collector Settings - # --------------------------------------- - # - # Active - # * Revisions which are referenced by a Route are considered active. - # * Individual revisions may be marked with the annotation - # "serving.knative.dev/no-gc":"true" to be permanently considered active. - # * Active revisions are not considered for GC. - # Retention - # * Revisions are retained if they are any of the following: - # 1. Active - # 2. Were created within "retain-since-create-time" - # 3. Were last referenced by a route within - # "retain-since-last-active-time" - # 4. There are fewer than "min-non-active-revisions" - # If none of these conditions are met, or if the count of revisions exceed - # "max-non-active-revisions", they will be deleted by GC. - # The special value "disabled" may be used to turn off these limits. - # - # Example config to immediately collect any inactive revision: - # min-non-active-revisions: "0" - # max-non-active-revisions: "0" - # retain-since-create-time: "disabled" - # retain-since-last-active-time: "disabled" - # - # Example config to always keep around the last ten non-active revisions: - # retain-since-create-time: "disabled" - # retain-since-last-active-time: "disabled" - # max-non-active-revisions: "10" - # - # Example config to disable all garbage collection: - # retain-since-create-time: "disabled" - # retain-since-last-active-time: "disabled" - # max-non-active-revisions: "disabled" - # - # Example config to keep recently deployed or active revisions, - # always maintain the last two in case of rollback, and prevent - # burst activity from exploding the count of old revisions: - # retain-since-create-time: "48h" - # retain-since-last-active-time: "15h" - # min-non-active-revisions: "2" - # max-non-active-revisions: "1000" - - # Duration since creation before considering a revision for GC or "disabled". - retain-since-create-time: "48h" - - # Duration since active before considering a revision for GC or "disabled". - retain-since-last-active-time: "15h" - - # Minimum number of non-active revisions to retain. - min-non-active-revisions: "20" - - # Maximum number of non-active revisions to retain - # or "disabled" to disable any maximum limit. - max-non-active-revisions: "1000" ---- -# Copyright 2020 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: v1 -kind: ConfigMap -metadata: - name: config-leader-election - namespace: knative-serving - labels: - app.kubernetes.io/name: knative-serving - app.kubernetes.io/component: controller - app.kubernetes.io/version: "1.22.1" - annotations: - knative.dev/example-checksum: "f4b71f57" -data: - _example: | - ################################ - # # - # EXAMPLE CONFIGURATION # - # # - ################################ - - # This block is not actually functional configuration, - # but serves to illustrate the available configuration - # options and document them in a way that is accessible - # to users that `kubectl edit` this config map. - # - # These sample configuration options may be copied out of - # this example block and unindented to be in the data block - # to actually change the configuration. - - # lease-duration is how long non-leaders will wait to try to acquire the - # lock; 15 seconds is the value used by core kubernetes controllers. - lease-duration: "60s" - - # renew-deadline is how long a leader will try to renew the lease before - # giving up; 10 seconds is the value used by core kubernetes controllers. - renew-deadline: "40s" - - # retry-period is how long the leader election client waits between tries of - # actions; 2 seconds is the value used by core kubernetes controllers. - retry-period: "10s" - - # buckets is the number of buckets used to partition key space of each - # Reconciler. If this number is M and the replica number of the controller - # is N, the N replicas will compete for the M buckets. The owner of a - # bucket will take care of the reconciling for the keys partitioned into - # that bucket. - buckets: "1" ---- -# Copyright 2018 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: v1 -kind: ConfigMap -metadata: - name: config-logging - namespace: knative-serving - labels: - app.kubernetes.io/version: "1.22.1" - app.kubernetes.io/component: logging - app.kubernetes.io/name: knative-serving - annotations: - knative.dev/example-checksum: "9f25d429" -data: - _example: | - ################################ - # # - # EXAMPLE CONFIGURATION # - # # - ################################ - - # This block is not actually functional configuration, - # but serves to illustrate the available configuration - # options and document them in a way that is accessible - # to users that `kubectl edit` this config map. - # - # These sample configuration options may be copied out of - # this example block and unindented to be in the data block - # to actually change the configuration. - - # Common configuration for all Knative codebase - zap-logger-config: | - { - "level": "info", - "development": false, - "outputPaths": ["stdout"], - "errorOutputPaths": ["stderr"], - "encoding": "json", - "encoderConfig": { - "timeKey": "timestamp", - "levelKey": "severity", - "nameKey": "logger", - "callerKey": "caller", - "messageKey": "message", - "stacktraceKey": "stacktrace", - "lineEnding": "", - "levelEncoder": "", - "timeEncoder": "iso8601", - "durationEncoder": "", - "callerEncoder": "" - } - } - - # Log level overrides - # For all components except the queue proxy, - # changes are picked up immediately. - # For queue proxy, changes require recreation of the pods. - loglevel.controller: "info" - loglevel.autoscaler: "info" - loglevel.queueproxy: "info" - loglevel.webhook: "info" - loglevel.activator: "info" - loglevel.hpaautoscaler: "info" - loglevel.net-istio-controller: "info" - loglevel.net-contour-controller: "info" - loglevel.net-kourier-controller: "info" - loglevel.net-gateway-api-controller: "info" ---- -# Copyright 2018 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: v1 -kind: ConfigMap -metadata: - name: config-network - namespace: knative-serving - labels: - app.kubernetes.io/name: knative-serving - app.kubernetes.io/component: networking - app.kubernetes.io/version: "1.22.1" - annotations: - knative.dev/example-checksum: "0573e07d" -data: - _example: | - ################################ - # # - # EXAMPLE CONFIGURATION # - # # - ################################ - - # This block is not actually functional configuration, - # but serves to illustrate the available configuration - # options and document them in a way that is accessible - # to users that `kubectl edit` this config map. - # - # These sample configuration options may be copied out of - # this example block and unindented to be in the data block - # to actually change the configuration. - - # ingress-class specifies the default ingress class - # to use when not dictated by Route annotation. - # - # If not specified, will use the Istio ingress. - # - # Note that changing the Ingress class of an existing Route - # will result in undefined behavior. Therefore it is best to only - # update this value during the setup of Knative, to avoid getting - # undefined behavior. - ingress-class: "istio.ingress.networking.knative.dev" - - # certificate-class specifies the default Certificate class - # to use when not dictated by Route annotation. - # - # If not specified, will use the Cert-Manager Certificate. - # - # Note that changing the Certificate class of an existing Route - # will result in undefined behavior. Therefore it is best to only - # update this value during the setup of Knative, to avoid getting - # undefined behavior. - certificate-class: "cert-manager.certificate.networking.knative.dev" - - # namespace-wildcard-cert-selector specifies a LabelSelector which - # determines which namespaces should have a wildcard certificate - # provisioned. - # - # Use an empty value to disable the feature (this is the default): - # namespace-wildcard-cert-selector: "" - # - # Use an empty object to enable for all namespaces - # namespace-wildcard-cert-selector: {} - # - # Useful labels include the "kubernetes.io/metadata.name" label to - # avoid provisioning a certificate for the "kube-system" namespaces. - # Use the following selector to match pre-1.0 behavior of using - # "networking.knative.dev/disableWildcardCert" to exclude namespaces: - # - # matchExpressions: - # - key: "networking.knative.dev/disableWildcardCert" - # operator: "NotIn" - # values: ["true"] - namespace-wildcard-cert-selector: "" - - # domain-template specifies the golang text template string to use - # when constructing the Knative service's DNS name. The default - # value is "{{.Name}}.{{.Namespace}}.{{.Domain}}". - # - # Valid variables defined in the template include Name, Namespace, Domain, - # Labels, and Annotations. Name will be the result of the tag-template - # below, if a tag is specified for the route. - # - # Changing this value might be necessary when the extra levels in - # the domain name generated is problematic for wildcard certificates - # that only support a single level of domain name added to the - # certificate's domain. In those cases you might consider using a value - # of "{{.Name}}-{{.Namespace}}.{{.Domain}}", or removing the Namespace - # entirely from the template. When choosing a new value be thoughtful - # of the potential for conflicts - for example, when users choose to use - # characters such as `-` in their service, or namespace, names. - # {{.Annotations}} or {{.Labels}} can be used for any customization in the - # go template if needed. - # We strongly recommend keeping namespace part of the template to avoid - # domain name clashes: - # eg. '{{.Name}}-{{.Namespace}}.{{ index .Annotations "sub"}}.{{.Domain}}' - # and you have an annotation {"sub":"foo"}, then the generated template - # would be {Name}-{Namespace}.foo.{Domain} - domain-template: "{{.Name}}.{{.Namespace}}.{{.Domain}}" - - # tag-template specifies the golang text template string to use - # when constructing the DNS name for "tags" within the traffic blocks - # of Routes and Configuration. This is used in conjunction with the - # domain-template above to determine the full URL for the tag. - tag-template: "{{.Tag}}-{{.Name}}" - - # auto-tls is deprecated and replaced by external-domain-tls - auto-tls: "Disabled" - - # Controls whether TLS certificates are automatically provisioned and - # installed in the Knative ingress to terminate TLS connections - # for cluster external domains (like: app.example.com) - # - Enabled: enables the TLS certificate provisioning feature for cluster external domains. - # - Disabled: disables the TLS certificate provisioning feature for cluster external domains. - external-domain-tls: "Disabled" - - # Controls weather TLS certificates are automatically provisioned and - # installed in the Knative ingress to terminate TLS connections - # for cluster local domains (like: app.namespace.svc.) - # - Enabled: enables the TLS certificate provisioning feature for cluster cluster-local domains. - # - Disabled: disables the TLS certificate provisioning feature for cluster cluster local domains. - # NOTE: This flag is in an alpha state and is mostly here to enable internal testing - # for now. Use with caution. - cluster-local-domain-tls: "Disabled" - - # internal-encryption is deprecated and replaced by system-internal-tls - internal-encryption: "false" - - # system-internal-tls controls weather TLS encryption is used for connections between - # the internal components of Knative: - # - ingress to activator - # - ingress to queue-proxy - # - activator to queue-proxy - # - # Possible values for this flag are: - # - Enabled: enables the TLS certificate provisioning feature for cluster cluster-local domains. - # - Disabled: disables the TLS certificate provisioning feature for cluster cluster local domains. - # NOTE: This flag is in an alpha state and is mostly here to enable internal testing - # for now. Use with caution. - system-internal-tls: "Disabled" - - # Controls the behavior of the HTTP endpoint for the Knative ingress. - # It requires auto-tls to be enabled. - # - Enabled: The Knative ingress will be able to serve HTTP connection. - # - Redirected: The Knative ingress will send a 301 redirect for all - # http connections, asking the clients to use HTTPS. - # - # "Disabled" option is deprecated. - http-protocol: "Enabled" - - # rollout-duration contains the minimal duration in seconds over which the - # Configuration traffic targets are rolled out to the newest revision. - rollout-duration: "0" - - # autocreate-cluster-domain-claims controls whether ClusterDomainClaims should - # be automatically created (and deleted) as needed when DomainMappings are - # reconciled. - # - # If this is "false" (the default), the cluster administrator is - # responsible for creating ClusterDomainClaims and delegating them to - # namespaces via their spec.Namespace field. This setting should be used in - # multitenant environments which need to control which namespace can use a - # particular domain name in a domain mapping. - # - # If this is "true", users are able to associate arbitrary names with their - # services via the DomainMapping feature. - autocreate-cluster-domain-claims: "false" - - # If true, networking plugins can add additional information to deployed - # applications to make their pods directly accessible via their IPs even if mesh is - # enabled and thus direct-addressability is usually not possible. - # Consumers like Knative Serving can use this setting to adjust their behavior - # accordingly, i.e. to drop fallback solutions for non-pod-addressable systems. - # - # NOTE: This flag is in an alpha state and is mostly here to enable internal testing - # for now. Use with caution. - enable-mesh-pod-addressability: "false" - - # mesh-compatibility-mode indicates whether consumers of network plugins - # should directly contact Pod IPs (most efficient), or should use the - # Cluster IP (less efficient, needed when mesh is enabled unless - # `enable-mesh-pod-addressability`, above, is set). - # Permitted values are: - # - "auto" (default): automatically determine which mesh mode to use by trying Pod IP and falling back to Cluster IP as needed. - # - "enabled": always use Cluster IP and do not attempt to use Pod IPs. - # - "disabled": always use Pod IPs and do not fall back to Cluster IP on failure. - mesh-compatibility-mode: "auto" - - # Defines the scheme used for external URLs if auto-tls is not enabled. - # This can be used for making Knative report all URLs as "HTTPS" for example, if you're - # fronting Knative with an external loadbalancer that deals with TLS termination and - # Knative doesn't know about that otherwise. - default-external-scheme: "http" ---- -# Copyright 2018 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: v1 -kind: ConfigMap -metadata: - name: config-observability - namespace: knative-serving - labels: - app.kubernetes.io/name: knative-serving - app.kubernetes.io/component: observability - app.kubernetes.io/version: "1.22.1" - annotations: - knative.dev/example-checksum: "59abacb5" -data: - _example: | - ################################ - # # - # EXAMPLE CONFIGURATION # - # # - ################################ - - # This block is not actually functional configuration, - # but serves to illustrate the available configuration - # options and document them in a way that is accessible - # to users that `kubectl edit` this config map. - # - # These sample configuration options may be copied out of - # this example block and unindented to be in the data block - # to actually change the configuration. - - # logging.enable-var-log-collection defaults to false. - # The fluentd daemon set will be set up to collect /var/log if - # this flag is true. - logging.enable-var-log-collection: "false" - - # logging.revision-url-template provides a template to use for producing the - # logging URL that is injected into the status of each Revision. - logging.revision-url-template: "http://logging.example.com/?revisionUID=${REVISION_UID}" - - # If non-empty, this enables queue proxy writing user request logs to stdout, excluding probe - # requests. - # NB: after 0.18 release logging.enable-request-log must be explicitly set to true - # in order for request logging to be enabled. - # - # The value determines the shape of the request logs and it must be a valid go text/template. - # It is important to keep this as a single line. Multiple lines are parsed as separate entities - # by most collection agents and will split the request logs into multiple records. - # - # The following fields and functions are available to the template: - # - # Request: An http.Request (see https://golang.org/pkg/net/http/#Request) - # representing an HTTP request received by the server. - # - # Response: - # struct { - # Code int // HTTP status code (see https://www.iana.org/assignments/http-status-codes/http-status-codes.xhtml) - # Size int // An int representing the size of the response. - # Latency float64 // A float64 representing the latency of the response in seconds. - # } - # - # Revision: - # struct { - # Name string // Knative revision name - # Namespace string // Knative revision namespace - # Service string // Knative service name - # Configuration string // Knative configuration name - # PodName string // Name of the pod hosting the revision - # PodIP string // IP of the pod hosting the revision - # } - # - logging.request-log-template: '{"httpRequest": {"requestMethod": "{{.Request.Method}}", "requestUrl": "{{js .Request.RequestURI}}", "requestSize": "{{.Request.ContentLength}}", "status": {{.Response.Code}}, "responseSize": "{{.Response.Size}}", "userAgent": "{{js .Request.UserAgent}}", "remoteIp": "{{js .Request.RemoteAddr}}", "serverIp": "{{.Revision.PodIP}}", "referer": "{{js .Request.Referer}}", "latency": "{{.Response.Latency}}s", "protocol": "{{.Request.Proto}}"}, "traceId": "{{.TraceID}}"}' - - # If true, the request logging will be enabled. - logging.enable-request-log: "false" - - # If true, this enables queue proxy writing request logs for probe requests to stdout. - # It uses the same template for user requests, i.e. logging.request-log-template. - logging.enable-probe-request-log: "false" - - # metrics-protocol field specifies the protocol used when exporting metrics - # It supports either 'none' (the default), 'prometheus', 'http/protobuf' (OTLP HTTP), 'grpc' (OTLP gRPC) - metrics-protocol: http/protobuf - - # metrics-endpoint field specifies the destination metrics should be exporter to. - # - # The endpoint MUST be set when the protocol is http/protobuf or grpc. - # The endpoint MUST NOT be set when the protocol is none. - # - # When the protocol is prometheus the endpoint can accept a 'host:port' string to customize the - # listening host interface and port. - metrics-endpoint: http://example.com/v1/traces - - # metrics-export-interval specifies the global metrics reporting period for control and data plane components. - # If a zero or negative value is passed the default reporting OTel period is used (60 secs). - metrics-export-interval: 60s - - # request-metrics-protocol field specifies the protocol used when exporting queue-proxy metrics - # It supports either 'none' (the default), 'prometheus', 'http/protobuf' (OTLP HTTP), 'grpc' (OTLP gRPC) - request-metrics-protocol: http/protobuf - - # request-metrics-endpoint field specifies the destination metrics from the queue proxy should be exporter to. - # - # The endpoint MUST be set when the protocol is http/protobuf or grpc. - # The endpoint MUST NOT be set when the protocol is none. - # - # When the protocol is prometheus the endpoint can accept a 'host:port' string to customize the - # listening host interface and port. - request-metrics-endpoint: http://promstack-kube-prometheus-prometheus.observability:9090/api/v1/otlp/v1/metrics - - # request-metrics-export-interval specifies the global metrics reporting period for the queue-proxy. - # - # If a zero or negative value is passed the default reporting OTel period is used (60 secs). - request-metrics-export-interval: 60s - - # runtime-profiling indicates whether it is allowed to retrieve runtime profiling data from - # the pods via an HTTP server in the format expected by the pprof visualization tool. When - # enabled, the Knative Serving pods expose the profiling data on an alternate HTTP port 8008. - # The HTTP context root for profiling is then /debug/pprof/. - runtime-profiling: enabled - - # tracing-protocol field specifies the protocol used when exporting traces - # It supports either 'none' (the default), 'http/protobuf' (OTLP HTTP), 'grpc' (OTLP gRPC) - # or `stdout` for debugging purposes - tracing-protocol: http/protobuf - - # tracing-endpoint field specifies the destination traces should be exporter to. - # - # The endpoint MUST be set when the protocol is http/protobuf or grpc. - # The endpoint MUST NOT be set when the protocol is none. - tracing-endpoint: http://jaeger-collector.observability:4318/v1/traces - - # tracing-sampling-rate allows the user to specify what percentage of all traces should be exported - # The value should be between 0 (never sample) to 1 (always sample) - tracing-sampling-rate: "1" ---- -# Copyright 2019 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: v1 -kind: ConfigMap -metadata: - name: config-tracing - namespace: knative-serving - labels: - app.kubernetes.io/name: knative-serving - app.kubernetes.io/component: tracing - app.kubernetes.io/version: "1.22.1" - annotations: - knative.dev/example-checksum: "04c7e9a3" -data: - _example: | - ########################################################### - # # - # This config is deprecated - use config-observability # - # # - ########################################################### ---- -# Copyright 2020 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: autoscaling/v2 -kind: HorizontalPodAutoscaler -metadata: - name: activator - namespace: knative-serving - labels: - app.kubernetes.io/component: activator - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" -spec: - minReplicas: 1 - maxReplicas: 20 - scaleTargetRef: - apiVersion: apps/v1 - kind: Deployment - name: activator - metrics: - - type: Resource - resource: - name: cpu - target: - type: Utilization - # Percentage of the requested CPU - averageUtilization: 100 ---- -# Activator PDB. Currently we permit unavailability of 20% of tasks at the same time. -# Given the subsetting and that the activators are partially stateful systems, we want -# a slow rollout of the new versions and slow migration during node upgrades. -apiVersion: policy/v1 -kind: PodDisruptionBudget -metadata: - name: activator-pdb - namespace: knative-serving - labels: - app.kubernetes.io/component: activator - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" -spec: - minAvailable: 80% - selector: - matchLabels: - app: activator ---- -# Copyright 2018 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: apps/v1 -kind: Deployment -metadata: - name: activator - namespace: knative-serving - labels: - app.kubernetes.io/component: activator - app.kubernetes.io/version: "1.22.1" - app.kubernetes.io/name: knative-serving -spec: - selector: - matchLabels: - app: activator - role: activator - template: - metadata: - labels: - app: activator - role: activator - app.kubernetes.io/component: activator - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" - spec: - # To avoid node becoming SPOF, spread our replicas to different nodes. - affinity: - podAntiAffinity: - preferredDuringSchedulingIgnoredDuringExecution: - - podAffinityTerm: - labelSelector: - matchLabels: - app: activator - topologyKey: kubernetes.io/hostname - weight: 100 - serviceAccountName: activator - containers: - - name: activator - # This is the Go import path for the binary that is containerized - # and substituted here. - image: gcr.io/knative-releases/knative.dev/serving/cmd/activator@sha256:5deaef961fef8d1417f6d4a4dfae2fc338f2d30d72c4ad58c3ab392b2c04705b - # The numbers are based on performance test results from - # https://github.com/knative/serving/issues/1625#issuecomment-511930023 - resources: - requests: - cpu: 300m - memory: 60Mi - limits: - cpu: 1000m - memory: 600Mi - env: - # Run Activator with GC collection when newly generated memory is 500%. - - name: GOGC - value: "500" - - name: POD_NAME - valueFrom: - fieldRef: - fieldPath: metadata.name - - name: POD_IP - valueFrom: - fieldRef: - fieldPath: status.podIP - - name: SYSTEM_NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace - - name: CONFIG_LOGGING_NAME - value: config-logging - - name: CONFIG_OBSERVABILITY_NAME - value: config-observability - securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: true - runAsNonRoot: true - capabilities: - drop: - - ALL - seccompProfile: - type: RuntimeDefault - ports: - - name: metrics - containerPort: 9090 - - name: profiling - containerPort: 8008 - - name: http1 - containerPort: 8012 - - name: h2c - containerPort: 8013 - readinessProbe: - httpGet: - port: 8012 - periodSeconds: 5 - failureThreshold: 5 - livenessProbe: - httpGet: - port: 8012 - periodSeconds: 10 - failureThreshold: 12 - initialDelaySeconds: 15 - # The activator (often) sits on the dataplane, and may proxy long (e.g. - # streaming, websockets) requests. We give a long grace period for the - # activator to "lame duck" and drain outstanding requests before we - # forcibly terminate the pod (and outstanding connections). This value - # should be at least as large as the upper bound on the Revision's - # timeoutSeconds property to avoid servicing events disrupting - # connections. - terminationGracePeriodSeconds: 600 ---- -apiVersion: v1 -kind: Service -metadata: - name: activator-service - namespace: knative-serving - labels: - app: activator - app.kubernetes.io/component: activator - app.kubernetes.io/version: "1.22.1" - app.kubernetes.io/name: knative-serving -spec: - selector: - app: activator - ports: - # Define metrics and profiling for them to be accessible within service meshes. - - name: http-metrics - port: 9090 - targetPort: 9090 - - name: http-profiling - port: 8008 - targetPort: 8008 - - name: http - port: 80 - targetPort: 8012 - - name: http2 - port: 81 - targetPort: 8013 - - name: https - port: 443 - targetPort: 8112 - type: ClusterIP ---- -# Copyright 2018 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: apps/v1 -kind: Deployment -metadata: - name: autoscaler - namespace: knative-serving - labels: - app.kubernetes.io/component: autoscaler - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" -spec: - replicas: 1 - selector: - matchLabels: - app: autoscaler - strategy: - type: RollingUpdate - rollingUpdate: - maxUnavailable: 0 - template: - metadata: - labels: - app: autoscaler - app.kubernetes.io/component: autoscaler - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" - spec: - # To avoid node becoming SPOF, spread our replicas to different nodes. - affinity: - podAntiAffinity: - preferredDuringSchedulingIgnoredDuringExecution: - - podAffinityTerm: - labelSelector: - matchLabels: - app: autoscaler - topologyKey: kubernetes.io/hostname - weight: 100 - serviceAccountName: controller - containers: - - name: autoscaler - # This is the Go import path for the binary that is containerized - # and substituted here. - image: gcr.io/knative-releases/knative.dev/serving/cmd/autoscaler@sha256:5bae38655d87df86b041083fbe51791816473245f752432ba9b85a7b12f73cd5 - resources: - requests: - cpu: 100m - memory: 100Mi - limits: - cpu: 1000m - memory: 1000Mi - env: - - name: POD_NAME - valueFrom: - fieldRef: - fieldPath: metadata.name - - name: POD_IP - valueFrom: - fieldRef: - fieldPath: status.podIP - - name: SYSTEM_NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace - - name: CONFIG_LOGGING_NAME - value: config-logging - - name: CONFIG_OBSERVABILITY_NAME - value: config-observability - securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: true - runAsNonRoot: true - capabilities: - drop: - - ALL - seccompProfile: - type: RuntimeDefault - ports: - - name: metrics - containerPort: 9090 - - name: profiling - containerPort: 8008 - - name: websocket - containerPort: 8080 - readinessProbe: - httpGet: - port: 8080 - livenessProbe: - httpGet: - port: 8080 - failureThreshold: 6 ---- -apiVersion: v1 -kind: Service -metadata: - labels: - app: autoscaler - app.kubernetes.io/component: autoscaler - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" - name: autoscaler - namespace: knative-serving -spec: - ports: - # Define metrics and profiling for them to be accessible within service meshes. - - name: http-metrics - port: 9090 - targetPort: 9090 - - name: http-profiling - port: 8008 - targetPort: 8008 - - name: http - port: 8080 - targetPort: 8080 - selector: - app: autoscaler ---- -# Copyright 2018 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: apps/v1 -kind: Deployment -metadata: - name: controller - namespace: knative-serving - labels: - app.kubernetes.io/component: controller - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" -spec: - selector: - matchLabels: - app: controller - template: - metadata: - labels: - app: controller - app.kubernetes.io/component: controller - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" - spec: - # To avoid node becoming SPOF, spread our replicas to different nodes. - affinity: - podAntiAffinity: - preferredDuringSchedulingIgnoredDuringExecution: - - podAffinityTerm: - labelSelector: - matchLabels: - app: controller - topologyKey: kubernetes.io/hostname - weight: 100 - serviceAccountName: controller - containers: - - name: controller - # This is the Go import path for the binary that is containerized - # and substituted here. - image: gcr.io/knative-releases/knative.dev/serving/cmd/controller@sha256:94329d85200c2fc31ed1166a26568ca1357376c149c147e71f400cf28be3c816 - resources: - requests: - cpu: 100m - memory: 100Mi - limits: - cpu: 1000m - memory: 1000Mi - env: - - name: POD_NAME - valueFrom: - fieldRef: - fieldPath: metadata.name - - name: SYSTEM_NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace - - name: CONFIG_LOGGING_NAME - value: config-logging - - name: CONFIG_OBSERVABILITY_NAME - value: config-observability - securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: true - runAsNonRoot: true - capabilities: - drop: - - ALL - seccompProfile: - type: RuntimeDefault - livenessProbe: - httpGet: - path: /health - port: probes - scheme: HTTP - periodSeconds: 5 - failureThreshold: 6 - readinessProbe: - httpGet: - path: /readiness - port: probes - scheme: HTTP - periodSeconds: 5 - failureThreshold: 3 - ports: - - name: metrics - containerPort: 9090 - - name: profiling - containerPort: 8008 - - name: probes - containerPort: 8080 ---- -apiVersion: v1 -kind: Service -metadata: - labels: - app: controller - app.kubernetes.io/component: controller - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" - name: controller - namespace: knative-serving -spec: - ports: - # Define metrics and profiling for them to be accessible within service meshes. - - name: http-metrics - port: 9090 - targetPort: 9090 - - name: http-profiling - port: 8008 - targetPort: 8008 - selector: - app: controller ---- -# Copyright 2020 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: autoscaling/v2 -kind: HorizontalPodAutoscaler -metadata: - name: webhook - namespace: knative-serving - labels: - app.kubernetes.io/component: webhook - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" -spec: - minReplicas: 1 - maxReplicas: 5 - scaleTargetRef: - apiVersion: apps/v1 - kind: Deployment - name: webhook - metrics: - - type: Resource - resource: - name: cpu - target: - type: Utilization - # Percentage of the requested CPU - averageUtilization: 100 ---- -# Webhook PDB. -apiVersion: policy/v1 -kind: PodDisruptionBudget -metadata: - name: webhook-pdb - namespace: knative-serving - labels: - app.kubernetes.io/component: webhook - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" -spec: - minAvailable: 80% - selector: - matchLabels: - app: webhook ---- -# Copyright 2018 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: apps/v1 -kind: Deployment -metadata: - name: webhook - namespace: knative-serving - labels: - app.kubernetes.io/component: webhook - app.kubernetes.io/version: "1.22.1" - app.kubernetes.io/name: knative-serving -spec: - selector: - matchLabels: - app: webhook - role: webhook - template: - metadata: - labels: - app: webhook - role: webhook - app.kubernetes.io/component: webhook - app.kubernetes.io/version: "1.22.1" - app.kubernetes.io/name: knative-serving - spec: - # To avoid node becoming SPOF, spread our replicas to different nodes. - affinity: - podAntiAffinity: - preferredDuringSchedulingIgnoredDuringExecution: - - podAffinityTerm: - labelSelector: - matchLabels: - app: webhook - topologyKey: kubernetes.io/hostname - weight: 100 - serviceAccountName: controller - containers: - - name: webhook - # This is the Go import path for the binary that is containerized - # and substituted here. - image: gcr.io/knative-releases/knative.dev/serving/cmd/webhook@sha256:8470456be214e93a84e3c7b79a632aa9978bd8ecda553feaa47878a2c24ab84d - resources: - requests: - cpu: 100m - memory: 100Mi - limits: - cpu: 500m - memory: 500Mi - env: - - name: POD_NAME - valueFrom: - fieldRef: - fieldPath: metadata.name - - name: SYSTEM_NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace - - name: CONFIG_LOGGING_NAME - value: config-logging - - name: CONFIG_OBSERVABILITY_NAME - value: config-observability - - name: WEBHOOK_NAME - value: webhook - - name: WEBHOOK_PORT - value: "8443" - securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: true - runAsNonRoot: true - capabilities: - drop: - - ALL - seccompProfile: - type: RuntimeDefault - ports: - - name: metrics - containerPort: 9090 - - name: profiling - containerPort: 8008 - - name: https-webhook - containerPort: 8443 - readinessProbe: - periodSeconds: 1 - httpGet: - scheme: HTTPS - port: 8443 - livenessProbe: - periodSeconds: 10 - httpGet: - scheme: HTTPS - port: 8443 - failureThreshold: 6 - initialDelaySeconds: 20 - # Our webhook should gracefully terminate by lame ducking first, set this to a sufficiently - # high value that we respect whatever value it has configured for the lame duck grace period. - terminationGracePeriodSeconds: 300 ---- -apiVersion: v1 -kind: Service -metadata: - labels: - app: webhook - role: webhook - app.kubernetes.io/component: webhook - app.kubernetes.io/version: "1.22.1" - app.kubernetes.io/name: knative-serving - name: webhook - namespace: knative-serving -spec: - ports: - # Define metrics and profiling for them to be accessible within service meshes. - - name: http-metrics - port: 9090 - targetPort: 9090 - - name: http-profiling - port: 8008 - targetPort: 8008 - - name: https-webhook - port: 443 - targetPort: 8443 - selector: - app: webhook - role: webhook ---- -# Copyright 2020 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: admissionregistration.k8s.io/v1 -kind: ValidatingWebhookConfiguration -metadata: - name: config.webhook.serving.knative.dev - labels: - app.kubernetes.io/component: webhook - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" -webhooks: - - admissionReviewVersions: ["v1", "v1beta1"] - clientConfig: - service: - name: webhook - namespace: knative-serving - failurePolicy: Fail - sideEffects: None - name: config.webhook.serving.knative.dev - objectSelector: - matchExpressions: - - key: app.kubernetes.io/name - operator: In - values: ["knative-serving"] - - key: app.kubernetes.io/component - operator: In - values: ["autoscaler", "controller", "logging", "networking", "observability", "tracing", "net-certmanager"] - timeoutSeconds: 10 ---- -# Copyright 2020 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: admissionregistration.k8s.io/v1 -kind: MutatingWebhookConfiguration -metadata: - name: webhook.serving.knative.dev - labels: - app.kubernetes.io/component: webhook - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" -webhooks: - - admissionReviewVersions: ["v1", "v1beta1"] - clientConfig: - service: - name: webhook - namespace: knative-serving - failurePolicy: Fail - sideEffects: None - name: webhook.serving.knative.dev - timeoutSeconds: 10 - rules: - - apiGroups: - - autoscaling.internal.knative.dev - - networking.internal.knative.dev - - serving.knative.dev - apiVersions: - - "*" - operations: - - CREATE - - UPDATE - scope: "*" - resources: - - metrics - - podautoscalers - - certificates - - ingresses - - serverlessservices - - configurations - - revisions - - routes - - services - - domainmappings - - domainmappings/status ---- -# Copyright 2020 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: admissionregistration.k8s.io/v1 -kind: ValidatingWebhookConfiguration -metadata: - name: validation.webhook.serving.knative.dev - labels: - app.kubernetes.io/component: webhook - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" -webhooks: - - admissionReviewVersions: ["v1", "v1beta1"] - clientConfig: - service: - name: webhook - namespace: knative-serving - failurePolicy: Fail - sideEffects: None - name: validation.webhook.serving.knative.dev - timeoutSeconds: 10 - rules: - - apiGroups: - - autoscaling.internal.knative.dev - - networking.internal.knative.dev - - serving.knative.dev - apiVersions: - - "*" - operations: - - CREATE - - UPDATE - - DELETE - scope: "*" - resources: - - metrics - - podautoscalers - - certificates - - ingresses - - serverlessservices - - configurations - - revisions - - routes - - services - - domainmappings - - domainmappings/status ---- -# Copyright 2020 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: v1 -kind: Secret -metadata: - name: webhook-certs - namespace: knative-serving - labels: - app.kubernetes.io/component: webhook - app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" -# The data is populated at install time. ---- -# Source: https://github.com/knative-extensions/net-kourier/releases/download/knative-v1.22.1/kourier.yaml ---- -# Copyright 2020 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: v1 -kind: Namespace -metadata: - name: kourier-system - labels: - networking.knative.dev/ingress-provider: kourier - app.kubernetes.io/name: knative-serving - app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.22.1" ---- -# Copyright 2020 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: v1 -kind: ConfigMap -metadata: - name: kourier-bootstrap - namespace: kourier-system - labels: - networking.knative.dev/ingress-provider: kourier - app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.22.1" - app.kubernetes.io/name: knative-serving -data: - envoy-bootstrap.yaml: | - dynamic_resources: - ads_config: - transport_api_version: V3 - api_type: GRPC - rate_limit_settings: {} - grpc_services: - - envoy_grpc: {cluster_name: xds_cluster} - cds_config: - resource_api_version: V3 - ads: {} - lds_config: - resource_api_version: V3 - ads: {} - node: - cluster: kourier-knative - id: 3scale-kourier-gateway - static_resources: - listeners: - - name: stats_listener - address: - socket_address: - address: 0.0.0.0 - port_value: 9000 - filter_chains: - - filters: - - name: envoy.filters.network.http_connection_manager - typed_config: - "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager - stat_prefix: stats_server - http_filters: - - name: envoy.filters.http.router - typed_config: - "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router - route_config: - virtual_hosts: - - name: admin_interface - domains: - - "*" - routes: - - match: - safe_regex: - regex: '/(certs|stats(/prometheus)?|server_info|clusters|listeners|ready)?' - headers: - - name: ':method' - string_match: - exact: GET - route: - cluster: service_stats - - match: - safe_regex: - regex: '/drain_listeners' - headers: - - name: ':method' - string_match: - exact: POST - route: - cluster: service_stats - clusters: - - name: service_stats - connect_timeout: 0.250s - type: static - load_assignment: - cluster_name: service_stats - endpoints: - lb_endpoints: - endpoint: - address: - socket_address: - address: 127.0.0.1 - port_value: 9901 - - name: xds_cluster - # This keepalive is recommended by envoy docs. - # https://www.envoyproxy.io/docs/envoy/latest/api-docs/xds_protocol - typed_extension_protocol_options: - envoy.extensions.upstreams.http.v3.HttpProtocolOptions: - "@type": type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions - explicit_http_config: - http2_protocol_options: - connection_keepalive: - interval: 30s - timeout: 5s - connect_timeout: 1s - load_assignment: - cluster_name: xds_cluster - endpoints: - lb_endpoints: - endpoint: - address: - socket_address: - address: "net-kourier-controller.knative-serving" - port_value: 18000 - type: STRICT_DNS - admin: - access_log: - - name: envoy.access_loggers.stdout - typed_config: - "@type": type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog - address: - socket_address: - address: 127.0.0.1 - port_value: 9901 ---- -# Copyright 2021 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: v1 -kind: ConfigMap -metadata: - name: config-kourier - namespace: knative-serving - labels: - networking.knative.dev/ingress-provider: kourier - app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.22.1" - app.kubernetes.io/name: knative-serving -data: - _example: | - ################################ - # # - # EXAMPLE CONFIGURATION # - # # - ################################ - - # This block is not actually functional configuration, - # but serves to illustrate the available configuration - # options and document them in a way that is accessible - # to users that `kubectl edit` this config map. - # - # These sample configuration options may be copied out of - # this example block and unindented to be in the data block - # to actually change the configuration. - - # Specifies whether requests reaching the Kourier gateway - # in the context of services should be logged. Readiness - # probes etc. must be configured via the bootstrap config. - enable-service-access-logging: "true" - - # Specifies the format of the access log used by the Kourier gateway. - # This template follows the envoy format. - # see: https://www.envoyproxy.io/docs/envoy/latest/configuration/observability/access_log/usage#access-logging - service-access-log-template: "" - - # Specifies whether to use proxy-protocol in order to safely - # transport connection information such as a client's address - # across multiple layers of TCP proxies. - # NOTE THAT THIS IS AN EXPERIMENTAL / ALPHA FEATURE - enable-proxy-protocol: "false" - - # The server certificates to serve the internal TLS traffic for Kourier Gateway. - # It is specified by the secret name in controller namespace, which has - # the "tls.crt" and "tls.key" data field. - # Use an empty value to disable the feature (default). - # - # NOTE: This flag is in an alpha state and is mostly here to enable internal testing - # for now. Use with caution. - cluster-cert-secret: "" - - # Specifies the amount of time that Kourier waits for the incoming requests. - # The default, 0s, imposes no timeout at all. - stream-idle-timeout: "0s" - - # Specifies whether to use CryptoMB private key provider in order to - # acclerate the TLS handshake. - # NOTE THAT THIS IS AN EXPERIMENTAL / ALPHA FEATURE. - enable-cryptomb: "false" - - # Configures the number of additional ingress proxy hops from the - # right side of the x-forwarded-for HTTP header to trust. - trusted-hops-count: "0" - - # Configures the connection manager to use the real remote address - # of the client connection when determining internal versus external origin and manipulating various headers. - use-remote-address: "false" - - # Specifies the cipher suites for TLS external listener. - # Use ',' separated values like "ECDHE-ECDSA-AES128-GCM-SHA256,ECDHE-ECDSA-CHACHA20-POLY1305" - # The default uses the default cipher suites of the envoy version. - cipher-suites: "" - - # Disable the Envoy server header injection in the response when response has no such header. - disable-envoy-server-header: "false" - - # The external authorization service and port, my-auth:2222. - # This value overrides environment variable if defined. - extauthz-host: "" - - # The protocol used to query the ext auth service. Can be one of : grpc, http, https. Defaults to grpc - # This value overrides environment variable if defined. - extauthz-protocol: "grpc" - - # Allow traffic to go through if the ext auth service is down. Accepts true/false. - # This value overrides environment variable if defined. - extauthz-failure-mode-allow: "" - - # Max request bytes, if not set, defaults to 8192 Bytes. More info Envoy Docs - # see: https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/http/ext_authz/v3/ext_authz.proto.html#extensions-filters-http-ext-authz-v3-buffersettings - # This value overrides environment variable if defined. - extauthz-max-request-body-bytes: 8192 - - # Max time in ms to wait for the ext authz service. Defaults to 2000 ms - # This value overrides environment variable if defined. - extauthz-timeout: 2000 - - # If extauthz-protocol is equal to http or https, path to query the ext auth service. - # Example : if set to /verify, it will query /verify/ (notice the trailing /). If not set, it will query / - # This value overrides environment variable if defined. - extauthz-path-prefix: "" - - # If extauthz-protocol is equal to grpc, sends the body as raw bytes instead of a UTF-8 string. - # Accepts only true/false, t/f or 1/0. Attempting to set another value will throw an error. - # Defaults to false. More info Envoy Docs. - # see: https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/http/ext_authz/v3/ext_authz.proto.html#extensions-filters-http-ext-authz-v3-buffersettings - # This value overrides environment variable if defined. - extauthz-pack-as-byte: "false" - - # Specifies the secret that contains the TLS certificate and key pair when using HTTPS communication with Kourier Ingress. - # This value overrides environment variable if defined. - certs-secret-name: "" - certs-secret-namespace: "" - - # Specifies the OTLP collector endpoint for distributed tracing. - # The endpoint format depends on the protocol (see tracing-protocol). - # Examples: - # - For HTTP: "http://otel-collector.observability.svc:4318/v1/traces" - # - For gRPC: "http://otel-collector.observability.svc:4317" - # Use an empty value to disable distributed tracing (default). - tracing-endpoint: "" - - # Protocol for tracing collector communication. - # Valid values: http/protobuf, grpc - tracing-protocol: "grpc" - - # Tracing sampling rate (0.0 to 1.0) - # Controls the percentage of requests that are traced. - # Example: "1.0" traces 100% of requests. - tracing-sampling-rate: "1.0" - - # Service name for traces - # This identifies the Kourier gateway in your tracing system. - tracing-service-name: "kourier-knative" ---- -# Copyright 2020 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: v1 -kind: ServiceAccount -metadata: - name: net-kourier - namespace: knative-serving - labels: - networking.knative.dev/ingress-provider: kourier - app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.22.1" - app.kubernetes.io/name: knative-serving ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: net-kourier - labels: - networking.knative.dev/ingress-provider: kourier - app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.22.1" - app.kubernetes.io/name: knative-serving -rules: - - apiGroups: [""] - resources: ["events"] - verbs: ["create", "update", "patch"] - - apiGroups: [""] - resources: ["pods", "services", "secrets"] - verbs: ["get", "list", "watch"] - - apiGroups: [""] - resources: ["configmaps"] - verbs: ["get", "list", "watch"] - - apiGroups: ["discovery.k8s.io"] - resources: ["endpointslices"] - verbs: ["get", "list", "watch"] - - apiGroups: ["coordination.k8s.io"] - resources: ["leases"] - verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] - - apiGroups: ["networking.internal.knative.dev"] - resources: ["ingresses"] - verbs: ["get", "list", "watch", "patch"] - - apiGroups: ["networking.internal.knative.dev"] - resources: ["ingresses/status"] - verbs: ["update"] ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: net-kourier - labels: - networking.knative.dev/ingress-provider: kourier - app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.22.1" - app.kubernetes.io/name: knative-serving -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: net-kourier -subjects: - - kind: ServiceAccount - name: net-kourier - namespace: knative-serving ---- -# Copyright 2020 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: apps/v1 -kind: Deployment -metadata: - name: net-kourier-controller - namespace: knative-serving - labels: - networking.knative.dev/ingress-provider: kourier - app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.22.1" - app.kubernetes.io/name: knative-serving -spec: - strategy: - type: RollingUpdate - rollingUpdate: - maxUnavailable: 0 - maxSurge: 100% - replicas: 1 - selector: - matchLabels: - app: net-kourier-controller - template: - metadata: - annotations: - prometheus.io/scrape: "true" - prometheus.io/port: "9090" - prometheus.io/path: "/metrics" - labels: - app: net-kourier-controller - spec: - containers: - - image: gcr.io/knative-releases/knative.dev/net-kourier/cmd/kourier@sha256:01abd2070ccf8680885c47990e42c05c09e30bc8595d9246f4dcd37f2220a2a2 - name: controller - env: - # CERTS_SECRET_NAMESPACE and CERTS_SECRET_NAME can also be configured from a ConfigMap. - # Settings configured in a configmap take precedence over environment variable settings. - - name: CERTS_SECRET_NAMESPACE - value: "" - - name: CERTS_SECRET_NAME - value: "" - - name: SYSTEM_NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace - - name: METRICS_DOMAIN - value: "knative.dev/samples" - - name: KOURIER_GATEWAY_NAMESPACE - value: "kourier-system" - - name: ENABLE_SECRET_INFORMER_FILTERING_BY_CERT_UID - value: "false" - # KUBE_API_BURST and KUBE_API_QPS allows to configure maximum burst for throttle and maximum QPS to the server from the client. - # Setting these values using env vars is possible since https://github.com/knative/pkg/pull/2755. - # 200 is an arbitrary value, but it speeds up kourier startup duration, and the whole ingress reconciliation process as a whole. - - name: KUBE_API_BURST - value: "200" - - name: KUBE_API_QPS - value: "200" - ports: - - name: http2-xds - containerPort: 18000 - protocol: TCP - - name: metrics - containerPort: 9090 - protocol: TCP - readinessProbe: - grpc: - port: 18000 - periodSeconds: 10 - failureThreshold: 3 - livenessProbe: - grpc: - port: 18000 - periodSeconds: 10 - failureThreshold: 6 - securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: true - runAsNonRoot: true - capabilities: - drop: - - ALL - seccompProfile: - type: RuntimeDefault - resources: - requests: - cpu: 200m - memory: 200Mi - limits: - cpu: "1" - memory: 500Mi - restartPolicy: Always - serviceAccountName: net-kourier ---- -apiVersion: v1 -kind: Service -metadata: - name: net-kourier-controller - namespace: knative-serving - labels: - networking.knative.dev/ingress-provider: kourier - app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.22.1" - app.kubernetes.io/name: knative-serving -spec: - ports: - - name: grpc-xds - port: 18000 - protocol: TCP - targetPort: 18000 - - name: http-metrics - port: 9090 - protocol: TCP - targetPort: 9090 - selector: - app: net-kourier-controller - type: ClusterIP ---- -# Copyright 2020 The Knative Authors -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: apps/v1 -kind: Deployment -metadata: - name: 3scale-kourier-gateway - namespace: kourier-system - labels: - networking.knative.dev/ingress-provider: kourier - app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.22.1" - app.kubernetes.io/name: knative-serving -spec: - strategy: - type: RollingUpdate - rollingUpdate: - maxUnavailable: 0 - maxSurge: 100% - selector: - matchLabels: - app: 3scale-kourier-gateway - template: - metadata: - labels: - app: 3scale-kourier-gateway - annotations: - # v0.26 supports envoy v3 API, so - # adding this label to restart pod. - networking.knative.dev/poke: "v0.26" - prometheus.io/scrape: "true" - prometheus.io/port: "9000" - prometheus.io/path: "/stats/prometheus" - spec: - containers: - - args: - - --base-id 1 - - -c /tmp/config/envoy-bootstrap.yaml - - --log-level info - - --drain-time-s $(DRAIN_TIME_SECONDS) - - --drain-strategy immediate - command: - - /usr/local/bin/envoy - env: - - name: DRAIN_TIME_SECONDS - value: "15" - image: docker.io/envoyproxy/envoy:v1.37-latest - name: kourier-gateway - ports: - - name: http2-external - containerPort: 8080 - protocol: TCP - - name: http2-internal - containerPort: 8081 - protocol: TCP - - name: https-external - containerPort: 8443 - protocol: TCP - - name: http-probe - containerPort: 8090 - protocol: TCP - - name: https-probe - containerPort: 9443 - protocol: TCP - - name: metrics - containerPort: 9000 - protocol: TCP - securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: false - runAsNonRoot: true - runAsUser: 65534 - runAsGroup: 65534 - capabilities: - drop: - - ALL - seccompProfile: - type: RuntimeDefault - volumeMounts: - - name: config-volume - mountPath: /tmp/config - lifecycle: - preStop: - exec: - command: ["/bin/sh", "-c", "curl -X POST http://localhost:9901/drain_listeners?graceful; sleep $DRAIN_TIME_SECONDS"] - readinessProbe: - httpGet: - httpHeaders: - - name: Host - value: internalkourier - path: /ready - port: 8081 - scheme: HTTP - initialDelaySeconds: 10 - periodSeconds: 5 - failureThreshold: 3 - timeoutSeconds: 3 - livenessProbe: - httpGet: - httpHeaders: - - name: Host - value: internalkourier - path: /ready - port: 8081 - scheme: HTTP - initialDelaySeconds: 10 - periodSeconds: 5 - failureThreshold: 6 - timeoutSeconds: 3 - resources: - requests: - cpu: 200m - memory: 200Mi - limits: - cpu: "1" - memory: 800Mi - # to ensure a graceful drain, terminationGracePeriodSeconds must be greater than DRAIN_TIME_SECONDS environment variable - terminationGracePeriodSeconds: 30 - volumes: - - name: config-volume - configMap: - name: kourier-bootstrap - restartPolicy: Always ---- -apiVersion: v1 -kind: Service -metadata: - name: kourier - namespace: kourier-system - labels: - networking.knative.dev/ingress-provider: kourier - app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.22.1" - app.kubernetes.io/name: knative-serving -spec: - ports: - - name: http2 - port: 80 - protocol: TCP - targetPort: 8080 - - name: https - port: 443 - protocol: TCP - targetPort: 8443 - selector: - app: 3scale-kourier-gateway - type: LoadBalancer ---- -apiVersion: v1 -kind: Service -metadata: - name: kourier-internal - namespace: kourier-system - labels: - networking.knative.dev/ingress-provider: kourier - app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.22.1" - app.kubernetes.io/name: knative-serving -spec: - ports: - - name: http2 - port: 80 - protocol: TCP - targetPort: 8081 - - name: https - port: 443 - protocol: TCP - targetPort: 8444 - selector: - app: 3scale-kourier-gateway - type: ClusterIP ---- -apiVersion: autoscaling/v2 -kind: HorizontalPodAutoscaler -metadata: - name: 3scale-kourier-gateway - namespace: kourier-system - labels: - networking.knative.dev/ingress-provider: kourier - app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.22.1" - app.kubernetes.io/name: knative-serving -spec: - minReplicas: 1 - maxReplicas: 10 - scaleTargetRef: - apiVersion: apps/v1 - kind: Deployment - name: 3scale-kourier-gateway - metrics: - - type: Resource - resource: - name: cpu - target: - type: Utilization - # Percentage of the requested CPU - averageUtilization: 100 ---- -apiVersion: policy/v1 -kind: PodDisruptionBudget -metadata: - name: 3scale-kourier-gateway-pdb - namespace: kourier-system - labels: - networking.knative.dev/ingress-provider: kourier - app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.22.1" - app.kubernetes.io/name: knative-serving -spec: - minAvailable: 80% - selector: - matchLabels: - app: 3scale-kourier-gateway diff --git a/packages/manifests/operators/knative-serving/v1.22.1/02-serving-core.yaml b/packages/manifests/operators/knative-serving/v1.22.1/02-serving-core.yaml new file mode 100644 index 0000000..ed066c7 --- /dev/null +++ b/packages/manifests/operators/knative-serving/v1.22.1/02-serving-core.yaml @@ -0,0 +1,2808 @@ +# Source: https://github.com/knative/serving/releases/download/knative-v1.22.1/serving-core.yaml +# Copyright 2018 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: Namespace +metadata: + name: knative-serving + labels: + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" +--- +# Copyright 2023 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +kind: Role +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: knative-serving-activator + namespace: knative-serving + labels: + serving.knative.dev/controller: "true" + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +rules: + - apiGroups: [""] + resources: ["configmaps", "secrets"] + verbs: ["get", "list", "watch"] + - apiGroups: [""] + resources: ["secrets"] + verbs: ["get", "list", "watch"] + resourceNames: ["routing-serving-certs", "knative-serving-certs"] +--- +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: knative-serving-activator-cluster + labels: + serving.knative.dev/controller: "true" + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +rules: + - apiGroups: [""] + resources: ["services", "endpoints"] + verbs: ["get", "list", "watch"] + - apiGroups: ["serving.knative.dev"] + resources: ["revisions"] + verbs: ["get", "list", "watch"] +--- +# Copyright 2019 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# Use this aggregated ClusterRole when you need readonly access to "Addressables" +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + # Named like this to avoid clashing with eventing's existing `addressable-resolver` role + # (which should be identical, but isn't guaranteed to be installed alongside serving). + name: knative-serving-aggregated-addressable-resolver + labels: + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +aggregationRule: + clusterRoleSelectors: + - matchLabels: + duck.knative.dev/addressable: "true" +--- +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: knative-serving-addressable-resolver + labels: + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving + # Labeled to facilitate aggregated cluster roles that act on Addressables. + duck.knative.dev/addressable: "true" +# Do not use this role directly. These rules will be added to the "addressable-resolver" role. +rules: + - apiGroups: + - serving.knative.dev + resources: + - routes + - routes/status + - services + - services/status + verbs: + - get + - list + - watch +--- +# Copyright 2019 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: knative-serving-namespaced-admin + labels: + rbac.authorization.k8s.io/aggregate-to-admin: "true" + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +rules: + - apiGroups: ["serving.knative.dev"] + resources: ["*"] + verbs: ["*"] + - apiGroups: ["networking.internal.knative.dev", "autoscaling.internal.knative.dev", "caching.internal.knative.dev"] + resources: ["*"] + verbs: ["get", "list", "watch"] +--- +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: knative-serving-namespaced-edit + labels: + rbac.authorization.k8s.io/aggregate-to-edit: "true" + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +rules: + - apiGroups: ["serving.knative.dev"] + resources: ["*"] + verbs: ["create", "update", "patch", "delete"] + - apiGroups: ["networking.internal.knative.dev", "autoscaling.internal.knative.dev", "caching.internal.knative.dev"] + resources: ["*"] + verbs: ["get", "list", "watch"] +--- +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: knative-serving-namespaced-view + labels: + rbac.authorization.k8s.io/aggregate-to-view: "true" + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +rules: + - apiGroups: ["serving.knative.dev", "networking.internal.knative.dev", "autoscaling.internal.knative.dev", "caching.internal.knative.dev"] + resources: ["*"] + verbs: ["get", "list", "watch"] +--- +# Copyright 2019 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: knative-serving-core + labels: + serving.knative.dev/controller: "true" + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +rules: + - apiGroups: [""] + resources: ["pods", "namespaces", "secrets", "configmaps", "endpoints", "services", "events", "serviceaccounts"] + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] + - apiGroups: [""] + resources: ["endpoints/restricted"] # Permission for RestrictedEndpointsAdmission + verbs: ["create"] + - apiGroups: ["discovery.k8s.io"] + resources: ["endpointslices/restricted"] # Permission for RestrictedEndpointsAdmission + verbs: ["create"] + - apiGroups: [""] + resources: ["namespaces/finalizers"] # finalizers are needed for the owner reference of the webhook + verbs: ["update"] + - apiGroups: ["discovery.k8s.io"] + resources: ["endpointslices"] + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] + - apiGroups: ["apps"] + resources: ["deployments", "deployments/finalizers"] # finalizers are needed for the owner reference of the webhook + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] + - apiGroups: ["admissionregistration.k8s.io"] + resources: ["mutatingwebhookconfigurations", "validatingwebhookconfigurations"] + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] + - apiGroups: ["apiextensions.k8s.io"] + resources: ["customresourcedefinitions", "customresourcedefinitions/status"] + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] + - apiGroups: ["autoscaling"] + resources: ["horizontalpodautoscalers"] + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] + - apiGroups: ["coordination.k8s.io"] + resources: ["leases"] + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] + - apiGroups: ["serving.knative.dev", "autoscaling.internal.knative.dev", "networking.internal.knative.dev"] + resources: ["*", "*/status", "*/finalizers"] + verbs: ["get", "list", "create", "update", "delete", "deletecollection", "patch", "watch"] + - apiGroups: ["caching.internal.knative.dev"] + resources: ["images"] + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] + - apiGroups: ["cert-manager.io"] + resources: ["certificates", "clusterissuers", "certificaterequests", "issuers"] + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] + - apiGroups: ["acme.cert-manager.io"] + resources: ["challenges"] + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] + - apiGroups: ["rbac.authorization.k8s.io"] + resources: ["clusterroles"] + verbs: ["delete"] + resourceNames: ["knative-serving-certmanager"] + - apiGroups: ["*"] + resources: ["*/scale"] + verbs: ["patch"] +--- +# Copyright 2019 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: knative-serving-podspecable-binding + labels: + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving + # Labeled to facilitate aggregated cluster roles that act on PodSpecables. + duck.knative.dev/podspecable: "true" +# Do not use this role directly. These rules will be added to the "podspecable-binder" role. +rules: + - apiGroups: + - serving.knative.dev + resources: + - configurations + - services + verbs: + - list + - watch + - patch +--- +# Copyright 2018 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ServiceAccount +metadata: + name: controller + namespace: knative-serving + labels: + app.kubernetes.io/component: controller + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" +--- +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: knative-serving-admin + labels: + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" +aggregationRule: + clusterRoleSelectors: + - matchLabels: + serving.knative.dev/controller: "true" +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: knative-serving-controller-admin + labels: + app.kubernetes.io/component: controller + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" +subjects: + - kind: ServiceAccount + name: controller + namespace: knative-serving +roleRef: + kind: ClusterRole + name: knative-serving-admin + apiGroup: rbac.authorization.k8s.io +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: knative-serving-controller-addressable-resolver + labels: + app.kubernetes.io/component: controller + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" +subjects: + - kind: ServiceAccount + name: controller + namespace: knative-serving +roleRef: + kind: ClusterRole + name: knative-serving-aggregated-addressable-resolver + apiGroup: rbac.authorization.k8s.io +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: activator + namespace: knative-serving + labels: + app.kubernetes.io/component: activator + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: knative-serving-activator + namespace: knative-serving + labels: + app.kubernetes.io/component: activator + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" +subjects: + - kind: ServiceAccount + name: activator + namespace: knative-serving +roleRef: + kind: Role + name: knative-serving-activator + apiGroup: rbac.authorization.k8s.io +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: knative-serving-activator-cluster + labels: + app.kubernetes.io/component: activator + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" +subjects: + - kind: ServiceAccount + name: activator + namespace: knative-serving +roleRef: + kind: ClusterRole + name: knative-serving-activator-cluster + apiGroup: rbac.authorization.k8s.io +--- +apiVersion: networking.internal.knative.dev/v1alpha1 +kind: Certificate +metadata: + annotations: + networking.knative.dev/certificate.class: cert-manager.certificate.networking.knative.dev + labels: + networking.knative.dev/certificate-type: system-internal + name: routing-serving-certs + namespace: knative-serving +spec: + dnsNames: + - kn-routing + - data-plane.knative.dev # for reverse-compatibility with net-* implementations that do not work with multi-SANs + secretName: routing-serving-certs +--- +# Copyright 2018 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: caching.internal.knative.dev/v1alpha1 +kind: Image +metadata: + name: queue-proxy + namespace: knative-serving + labels: + app.kubernetes.io/component: queue-proxy + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" +spec: + # This is the Go import path for the binary that is containerized + # and substituted here. + image: gcr.io/knative-releases/knative.dev/serving/cmd/queue@sha256:b1af8bda6c1d32b1cf5fbf8f1f6068c5007a5cebf091039fdea83b88b1fd87f4 +--- +# Copyright 2018 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-autoscaler + namespace: knative-serving + labels: + app.kubernetes.io/component: autoscaler + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" + annotations: + knative.dev/example-checksum: "c727b3e8" +data: + _example: | + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this example block and unindented to be in the data block + # to actually change the configuration. + + # The Revision ContainerConcurrency field specifies the maximum number + # of requests the Container can handle at once. Container concurrency + # target percentage is how much of that maximum to use in a stable + # state. E.g. if a Revision specifies ContainerConcurrency of 10, then + # the Autoscaler will try to maintain 7 concurrent connections per pod + # on average. + # Note: this limit will be applied to container concurrency set at every + # level (ConfigMap, Revision Spec or Annotation). + # For legacy and backwards compatibility reasons, this value also accepts + # fractional values in (0, 1] interval (i.e. 0.7 ⇒ 70%). + # Thus minimal percentage value must be greater than 1.0, or it will be + # treated as a fraction. + # NOTE: that this value does not affect actual number of concurrent requests + # the user container may receive, but only the average number of requests + # that the revision pods will receive. + container-concurrency-target-percentage: "70" + + # The container concurrency target default is what the Autoscaler will + # try to maintain when concurrency is used as the scaling metric for the + # Revision and the Revision specifies unlimited concurrency. + # When revision explicitly specifies container concurrency, that value + # will be used as a scaling target for autoscaler. + # When specifying unlimited concurrency, the autoscaler will + # horizontally scale the application based on this target concurrency. + # This is what we call "soft limit" in the documentation, i.e. it only + # affects number of pods and does not affect the number of requests + # individual pod processes. + # The value must be a positive number such that the value multiplied + # by container-concurrency-target-percentage is greater than 0.01. + # NOTE: that this value will be adjusted by application of + # container-concurrency-target-percentage, i.e. by default + # the system will target on average 70 concurrent requests + # per revision pod. + # NOTE: Only one metric can be used for autoscaling a Revision. + container-concurrency-target-default: "100" + + # The requests per second (RPS) target default is what the Autoscaler will + # try to maintain when RPS is used as the scaling metric for a Revision and + # the Revision specifies unlimited RPS. Even when specifying unlimited RPS, + # the autoscaler will horizontally scale the application based on this + # target RPS. + # Must be greater than 1.0. + # NOTE: Only one metric can be used for autoscaling a Revision. + requests-per-second-target-default: "200" + + # The target burst capacity specifies the size of burst in concurrent + # requests that the system operator expects the system will receive. + # Autoscaler will try to protect the system from queueing by introducing + # Activator in the request path if the current spare capacity of the + # service is less than this setting. + # If this setting is 0, then Activator will be in the request path only + # when the revision is scaled to 0. + # If this setting is > 0 and container-concurrency-target-percentage is + # 100% or 1.0, then activator will always be in the request path. + # -1 denotes unlimited target-burst-capacity and activator will always + # be in the request path. + # Other negative values are invalid. + target-burst-capacity: "211" + + # When operating in a stable mode, the autoscaler operates on the + # average concurrency over the stable window. + # Stable window must be in whole seconds. + stable-window: "60s" + + # When observed average concurrency during the panic window reaches + # panic-threshold-percentage the target concurrency, the autoscaler + # enters panic mode. When operating in panic mode, the autoscaler + # scales on the average concurrency over the panic window which is + # panic-window-percentage of the stable-window. + # Must be in the [1, 100] range. + # When computing the panic window it will be rounded to the closest + # whole second, at least 1s. + panic-window-percentage: "10.0" + + # The percentage of the container concurrency target at which to + # enter panic mode when reached within the panic window. + panic-threshold-percentage: "200.0" + + # Max scale up rate limits the rate at which the autoscaler will + # increase pod count. It is the maximum ratio of desired pods versus + # observed pods. + # Cannot be less or equal to 1. + # I.e with value of 2.0 the number of pods can at most go N to 2N + # over single Autoscaler period (2s), but at least N to + # N+1, if Autoscaler needs to scale up. + max-scale-up-rate: "1000.0" + + # Max scale down rate limits the rate at which the autoscaler will + # decrease pod count. It is the maximum ratio of observed pods versus + # desired pods. + # Cannot be less or equal to 1. + # I.e. with value of 2.0 the number of pods can at most go N to N/2 + # over single Autoscaler evaluation period (2s), but at + # least N to N-1, if Autoscaler needs to scale down. + max-scale-down-rate: "2.0" + + # Scale to zero feature flag. + enable-scale-to-zero: "true" + + # Scale to zero grace period is the time an inactive revision is left + # running before it is scaled to zero (must be positive, but recommended + # at least a few seconds if running with mesh networking). + # This is the upper limit and is provided not to enforce timeout after + # the revision stopped receiving requests for stable window, but to + # ensure network reprogramming to put activator in the path has completed. + # If the system determines that a shorter period is satisfactory, + # then the system will only wait that amount of time before scaling to 0. + # NOTE: this period might actually be 0, if activator has been + # in the request path sufficiently long. + # If there is necessity for the last pod to linger longer use + # scale-to-zero-pod-retention-period flag. + scale-to-zero-grace-period: "30s" + + # Scale to zero pod retention period defines the minimum amount + # of time the last pod will remain after Autoscaler has decided to + # scale to zero. + # This flag is for the situations where the pod startup is very expensive + # and the traffic is bursty (requiring smaller windows for fast action), + # but patchy. + # The larger of this flag and `scale-to-zero-grace-period` will effectively + # determine how the last pod will hang around. + scale-to-zero-pod-retention-period: "0s" + + # pod-autoscaler-class specifies the default pod autoscaler class + # that should be used if none is specified. If omitted, + # the Knative Pod Autoscaler (KPA) is used by default. + pod-autoscaler-class: "kpa.autoscaling.knative.dev" + + # The capacity of a single activator task. + # The `unit` is one concurrent request proxied by the activator. + # activator-capacity must be at least 1. + # This value is used for computation of the Activator subset size. + # See the algorithm here: https://bit.ly/38XiCZ3. + # TODO(vagababov): tune after actual benchmarking. + activator-capacity: "100.0" + + # initial-scale is the cluster-wide default value for the initial target + # scale of a revision after creation, unless overridden by the + # "autoscaling.knative.dev/initialScale" annotation. + # This value must be greater than 0 unless allow-zero-initial-scale is true. + initial-scale: "1" + + # allow-zero-initial-scale controls whether either the cluster-wide initial-scale flag, + # or the "autoscaling.knative.dev/initialScale" annotation, can be set to 0. + allow-zero-initial-scale: "false" + + # min-scale is the cluster-wide default value for the min scale of a revision, + # unless overridden by the "autoscaling.knative.dev/minScale" annotation. + min-scale: "0" + + # max-scale is the cluster-wide default value for the max scale of a revision, + # unless overridden by the "autoscaling.knative.dev/maxScale" annotation. + # If set to 0, the revision has no maximum scale. + max-scale: "0" + + # scale-down-delay is the amount of time that must pass at reduced + # concurrency before a scale down decision is applied. This can be useful, + # for example, to maintain replica count and avoid a cold start penalty if + # more requests come in within the scale down delay period. + # The default, 0s, imposes no delay at all. + scale-down-delay: "0s" + + # max-scale-limit sets the maximum permitted value for the max scale of a revision. + # When this is set to a positive value, a revision with a maxScale above that value + # (including a maxScale of "0" = unlimited) is disallowed. + # A value of zero (the default) allows any limit, including unlimited. + max-scale-limit: "0" +--- +# Copyright 2020 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-certmanager + namespace: knative-serving + labels: + app.kubernetes.io/name: knative-serving + app.kubernetes.io/component: controller + app.kubernetes.io/version: "1.22.1" + networking.knative.dev/certificate-provider: cert-manager + annotations: + knative.dev/example-checksum: "b7a9a602" +data: + _example: | + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this block and unindented to actually change the configuration. + + # issuerRef is a reference to the issuer for external-domain certificates used for ingress. + # IssuerRef should be either `ClusterIssuer` or `Issuer`. + # Please refer `IssuerRef` in https://cert-manager.io/docs/concepts/issuer/ + # for more details about IssuerRef configuration. + # If the issuerRef is not specified, the self-signed `knative-selfsigned-issuer` ClusterIssuer is used. + issuerRef: | + kind: ClusterIssuer + name: letsencrypt-issuer + + # clusterLocalIssuerRef is a reference to the issuer for cluster-local-domain certificates used for ingress. + # clusterLocalIssuerRef should be either `ClusterIssuer` or `Issuer`. + # Please refer `IssuerRef` in https://cert-manager.io/docs/concepts/issuer/ + # for more details about ClusterInternalIssuerRef configuration. + # If the clusterLocalIssuerRef is not specified, the self-signed `knative-selfsigned-issuer` ClusterIssuer is used. + clusterLocalIssuerRef: | + kind: ClusterIssuer + name: your-company-issuer + + # systemInternalIssuerRef is a reference to the issuer for certificates for system-internal-tls certificates used by Knative internal components. + # systemInternalIssuerRef should be either `ClusterIssuer` or `Issuer`. + # Please refer `IssuerRef` in https://cert-manager.io/docs/concepts/issuer/ + # for more details about ClusterInternalIssuerRef configuration. + # If the systemInternalIssuerRef is not specified, the self-signed `knative-selfsigned-issuer` ClusterIssuer is used. + systemInternalIssuerRef: | + kind: ClusterIssuer + name: knative-selfsigned-issuer +--- +# Copyright 2019 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-defaults + namespace: knative-serving + labels: + app.kubernetes.io/name: knative-serving + app.kubernetes.io/component: controller + app.kubernetes.io/version: "1.22.1" + annotations: + knative.dev/example-checksum: "5b64ff5c" +data: + _example: | + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this example block and unindented to be in the data block + # to actually change the configuration. + + # revision-timeout-seconds contains the default number of + # seconds to use for the revision's per-request timeout, if + # none is specified. + revision-timeout-seconds: "300" # 5 minutes + + # max-revision-timeout-seconds contains the maximum number of + # seconds that can be used for revision-timeout-seconds. + # This value must be greater than or equal to revision-timeout-seconds. + # If omitted, the system default is used (600 seconds). + # + # If this value is increased, the activator's terminationGracePeriodSeconds + # should also be increased to prevent in-flight requests being disrupted. + max-revision-timeout-seconds: "600" # 10 minutes + + # revision-response-start-timeout-seconds contains the default number of + # seconds a request will be allowed to stay open while waiting to + # receive any bytes from the user's application, if none is specified. + # + # This defaults to 'revision-timeout-seconds' + revision-response-start-timeout-seconds: "300" + + # revision-idle-timeout-seconds contains the default number of + # seconds a request will be allowed to stay open while not receiving any + # bytes from the user's application, if none is specified. + revision-idle-timeout-seconds: "0" # infinite + + # revision-cpu-request contains the cpu allocation to assign + # to revisions by default. If omitted, no value is specified + # and the system default is used. + # Below is an example of setting revision-cpu-request. + # By default, it is not set by Knative. + revision-cpu-request: "400m" # 0.4 of a CPU (aka 400 milli-CPU) + + # revision-memory-request contains the memory allocation to assign + # to revisions by default. If omitted, no value is specified + # and the system default is used. + # Below is an example of setting revision-memory-request. + # By default, it is not set by Knative. + revision-memory-request: "100M" # 100 megabytes of memory + + # revision-ephemeral-storage-request contains the ephemeral storage + # allocation to assign to revisions by default. If omitted, no value is + # specified and the system default is used. + revision-ephemeral-storage-request: "500M" # 500 megabytes of storage + + # revision-cpu-limit contains the cpu allocation to limit + # revisions to by default. If omitted, no value is specified + # and the system default is used. + # Below is an example of setting revision-cpu-limit. + # By default, it is not set by Knative. + revision-cpu-limit: "1000m" # 1 CPU (aka 1000 milli-CPU) + + # revision-memory-limit contains the memory allocation to limit + # revisions to by default. If omitted, no value is specified + # and the system default is used. + # Below is an example of setting revision-memory-limit. + # By default, it is not set by Knative. + revision-memory-limit: "200M" # 200 megabytes of memory + + # revision-ephemeral-storage-limit contains the ephemeral storage + # allocation to limit revisions to by default. If omitted, no value is + # specified and the system default is used. + revision-ephemeral-storage-limit: "750M" # 750 megabytes of storage + + # container-name-template contains a template for the default + # container name, if none is specified. This field supports + # Go templating and is supplied with the ObjectMeta of the + # enclosing Service or Configuration, so values such as + # {{.Name}} are also valid. + container-name-template: "user-container" + + # init-container-name-template contains a template for the default + # init container name, if none is specified. This field supports + # Go templating and is supplied with the ObjectMeta of the + # enclosing Service or Configuration, so values such as + # {{.Name}} are also valid. + init-container-name-template: "init-container" + + # container-concurrency specifies the maximum number + # of requests the Container can handle at once, and requests + # above this threshold are queued. Setting a value of zero + # disables this throttling and lets through as many requests as + # the pod receives. + container-concurrency: "0" + + # The container concurrency max limit is an operator setting ensuring that + # the individual revisions cannot have arbitrary large concurrency + # values, or autoscaling targets. `container-concurrency` default setting + # must be at or below this value. + # + # Must be greater than 1. + # + # Note: even with this set, a user can choose a containerConcurrency + # of 0 (i.e. unbounded) unless allow-container-concurrency-zero is + # set to "false". + container-concurrency-max-limit: "1000" + + # allow-container-concurrency-zero controls whether users can + # specify 0 (i.e. unbounded) for containerConcurrency. + allow-container-concurrency-zero: "true" + + # enable-service-links specifies the default value used for the + # enableServiceLinks field of the PodSpec, when it is omitted by the user. + # See: https://kubernetes.io/docs/concepts/services-networking/connect-applications-service/#accessing-the-service + # + # This is a tri-state flag with possible values of (true|false|default). + # + # In environments with large number of services it is suggested + # to set this value to `false`. + # See https://github.com/knative/serving/issues/8498. + enable-service-links: "false" +--- +# Copyright 2019 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-deployment + namespace: knative-serving + labels: + app.kubernetes.io/name: knative-serving + app.kubernetes.io/component: controller + app.kubernetes.io/version: "1.22.1" + annotations: + knative.dev/example-checksum: "555b4826" +data: + # This is the Go import path for the binary that is containerized + # and substituted here. + queue-sidecar-image: gcr.io/knative-releases/knative.dev/serving/cmd/queue@sha256:b1af8bda6c1d32b1cf5fbf8f1f6068c5007a5cebf091039fdea83b88b1fd87f4 + _example: |- + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this example block and unindented to be in the data block + # to actually change the configuration. + + # List of repositories for which tag to digest resolving should be skipped + registries-skipping-tag-resolving: "kind.local,ko.local,dev.local" + + # Maximum time allowed for an image's digests to be resolved. + digest-resolution-timeout: "10s" + + # Duration we wait for the deployment to be ready before considering it failed. + progress-deadline: "600s" + + # Sets the queue proxy's CPU request. + # If omitted, a default value (currently "25m"), is used. + queue-sidecar-cpu-request: "25m" + + # Sets the queue proxy's CPU limit. + # If omitted, a default value (currently "1000m"), is used when + # `queueproxy.resource-defaults` is set to `Enabled`. + queue-sidecar-cpu-limit: "1000m" + + # Sets the queue proxy's memory request. + # If omitted, a default value (currently "400Mi"), is used when + # `queueproxy.resource-defaults` is set to `Enabled`. + queue-sidecar-memory-request: "400Mi" + + # Sets the queue proxy's memory limit. + # If omitted, a default value (currently "800Mi"), is used when + # `queueproxy.resource-defaults` is set to `Enabled`. + queue-sidecar-memory-limit: "800Mi" + + # Sets the queue proxy's ephemeral storage request. + # If omitted, no value is specified and the system default is used. + queue-sidecar-ephemeral-storage-request: "512Mi" + + # Sets the queue proxy's ephemeral storage limit. + # If omitted, no value is specified and the system default is used. + queue-sidecar-ephemeral-storage-limit: "1024Mi" + + # Sets tokens associated with specific audiences for queue proxy - used by QPOptions + # + # For example, to add the `service-x` audience: + # queue-sidecar-token-audiences: "service-x" + # Also supports a list of audiences, for example: + # queue-sidecar-token-audiences: "service-x,service-y" + # If omitted, or empty, no tokens are created + queue-sidecar-token-audiences: "" + + # Sets rootCA for the queue proxy - used by QPOptions + # If omitted, or empty, no rootCA is added to the golang rootCAs + queue-sidecar-rootca: "" + + # Sets the minimum TLS version for the queue proxy sidecar's TLS server. + # Accepted values: "1.2", "1.3". Default is "1.3" if not specified. + queue-sidecar-tls-min-version: "" + + # Sets the maximum TLS version for the queue proxy sidecar's TLS server. + # Accepted values: "1.2", "1.3". If omitted, the Go default is used. + queue-sidecar-tls-max-version: "" + + # Sets the cipher suites for the queue proxy sidecar's TLS server. + # Comma-separated list of cipher suite names (e.g. "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"). + # If omitted, the Go default cipher suites are used. + # Note: cipher suites are not configurable in TLS 1.3. + queue-sidecar-tls-cipher-suites: "" + + # Sets the elliptic curve preferences for the queue proxy sidecar's TLS server. + # Comma-separated list of curve names (e.g. "X25519,CurveP256"). + # If omitted, the Go default curves are used. + queue-sidecar-tls-curve-preferences: "" + + # If set, it automatically configures pod anti-affinity requirements for all Knative services. + # It employs the `preferredDuringSchedulingIgnoredDuringExecution` weighted pod affinity term, + # aligning with the Knative revision label. It yields the configuration below in all workloads' deployments: + # ` + # affinity: + # podAntiAffinity: + # preferredDuringSchedulingIgnoredDuringExecution: + # - podAffinityTerm: + # topologyKey: kubernetes.io/hostname + # labelSelector: + # matchLabels: + # serving.knative.dev/revision: {{revision-name}} + # weight: 100 + # ` + # This may be "none" or "prefer-spread-revision-over-nodes" (default) + # default-affinity-type: "prefer-spread-revision-over-nodes" + + # runtime-class-name contains the selector for which runtimeClassName + # is selected to put in a revision. + # By default, it is not set by Knative. + # + # Example: + # runtime-class-name: | + # "": + # selector: + # use-default-runc: "yes" + # kata: {} + # gvisor: + # selector: + # use-gvisor: "please" + runtime-class-name: "" + + # pod-is-always-schedulable can be used to define that Pods in the system will always be + # scheduled, and a Revision should not be marked unschedulable. + # Setting this to `true` makes sense if you have cluster-autoscaling set up for your cluster + # where unschedulable Pods trigger the addition of a new Node and are therefore a short and + # transient state. + # + # See https://github.com/knative/serving/issues/14862 + pod-is-always-schedulable: "false" +--- +# Copyright 2018 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-domain + namespace: knative-serving + labels: + app.kubernetes.io/name: knative-serving + app.kubernetes.io/component: controller + app.kubernetes.io/version: "1.22.1" + annotations: + knative.dev/example-checksum: "26c09de5" +data: + _example: | + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this example block and unindented to be in the data block + # to actually change the configuration. + + # Default value for domain. + # Routes having the cluster domain suffix (by default 'svc.cluster.local') + # will not be exposed through Ingress. You can define your own label + # selector to assign that domain suffix to your Route here, or you can set + # the label + # "networking.knative.dev/visibility=cluster-local" + # to achieve the same effect. This shows how to make routes having + # the label app=secret only exposed to the local cluster. + svc.cluster.local: | + selector: + app: secret + + # These are example settings of domain. + # example.com will be used for all routes, but it is the least-specific rule so it + # will only be used if no other domain matches. + example.com: | + + # example.org will be used for routes having app=nonprofit. + example.org: | + selector: + app: nonprofit +--- +# Copyright 2020 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-features + namespace: knative-serving + labels: + app.kubernetes.io/name: knative-serving + app.kubernetes.io/component: controller + app.kubernetes.io/version: "1.22.1" + annotations: + knative.dev/example-checksum: "bee75b26" +data: + _example: |- + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this example block and unindented to be in the data block + # to actually change the configuration. + + # Default SecurityContext settings to secure-by-default values + # if unset. + # + # Disabled - do nothing; no security options are applied + # AllowRootBounded - Applies secure defaults without enforcing strict policies; sets seccompProfile + # to RuntimeDefault and drops all capabilities + # Enabled - Enforces security defaults; sets seccompProfile to RuntimeDefault, drops all capabilities, + # and sets runAsNonRoot to true if not already specified. + secure-pod-defaults: "disabled" + + # Indicates whether multi container support is enabled + # + # WARNING: Cannot safely be disabled once enabled. + # See: https://knative.dev/docs/serving/configuration/feature-flags/#multiple-containers + multi-container: "enabled" + + # Indicates whether multi container probing is enabled + # + # WARNING: Cannot safely be disabled once enabled. + # See: https://knative.dev/docs/serving/configuration/feature-flags/#multiple-container-probing + multi-container-probing: "disabled" + + # Indicates whether Kubernetes affinity support is enabled + # + # WARNING: Cannot safely be disabled once enabled. + # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-node-affinity + kubernetes.podspec-affinity: "disabled" + + # Indicates whether Kubernetes topologySpreadConstraints support is enabled + # + # WARNING: Cannot safely be disabled once enabled. + # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-topology-spread-constraints + kubernetes.podspec-topologyspreadconstraints: "disabled" + + # Indicates whether Kubernetes hostAliases support is enabled + # + # WARNING: Cannot safely be disabled once enabled. + # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-host-aliases + kubernetes.podspec-hostaliases: "disabled" + + # Indicates whether Kubernetes nodeSelector support is enabled + # + # WARNING: Cannot safely be disabled once enabled. + # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-node-selector + kubernetes.podspec-nodeselector: "disabled" + + # Indicates whether Kubernetes tolerations support is enabled + # + # WARNING: Cannot safely be disabled once enabled + # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-toleration + kubernetes.podspec-tolerations: "disabled" + + # Indicates whether Kubernetes FieldRef support is enabled + # + # WARNING: Cannot safely be disabled once enabled. + # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-fieldref + kubernetes.podspec-fieldref: "disabled" + + # Indicates whether Kubernetes RuntimeClassName support is enabled + # + # WARNING: Cannot safely be disabled once enabled. + # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-runtime-class + kubernetes.podspec-runtimeclassname: "disabled" + + # Indicates whether Kubernetes DNSPolicy support is enabled + # + # WARNING: Cannot safely be disabled once enabled. + # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-dnspolicy + kubernetes.podspec-dnspolicy: "disabled" + + # Indicates whether Kubernetes DNSConfig support is enabled + # + # WARNING: Cannot safely be disabled once enabled. + # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-dnsconfig + kubernetes.podspec-dnsconfig: "disabled" + + # This feature allows end-users to set a subset of fields on the Pod's SecurityContext + # + # When set to "enabled" or "allowed" it allows the following + # PodSecurityContext properties: + # - FSGroup + # - RunAsGroup + # - RunAsNonRoot + # - SupplementalGroups + # - RunAsUser + # - SeccompProfile + # + # This feature flag should be used with caution as the PodSecurityContext + # properties may have a side-effect on non-user sidecar containers that come + # from Knative or your service mesh + # + # WARNING: Cannot safely be disabled once enabled. + # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-security-context + kubernetes.podspec-securitycontext: "disabled" + + # Indicated whether sharing the process namespace via ShareProcessNamespace pod spec is allowed. + # This can be especially useful for sharing data from images directly between sidecars + # + # See: https://knative.dev/docs/serving/configuration/feature-flags/#kubernetes-share-process-namespace + kubernetes.podspec-shareprocessnamespace: "disabled" + + # Indicates whether hostIPC support is enabled + # + # WARNING: Cannot safely be disabled once enabled. + # See https://knative.dev/docs/serving/configuration/feature-flags/#kubernetes-host-ipc + kubernetes.podspec-hostipc: "disabled" + + # Indicates whether hostPID support is enabled + # + # WARNING: Cannot safely be disabled once enabled. + # See https://knative.dev/docs/serving/configuration/feature-flags/#kubernetes-host-pid + kubernetes.podspec-hostpid: "disabled" + + # Indicates whether hostNetwork support is enabled + # + # WARNING: Cannot safely be disabled once enabled. + # See See https://knative.dev/docs/serving/configuration/feature-flags/#kubernetes-host-network + kubernetes.podspec-hostnetwork: "disabled" + + # Indicates whether Kubernetes PriorityClassName support is enabled + # + # WARNING: Cannot safely be disabled once enabled. + # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-priority-class-name + kubernetes.podspec-priorityclassname: "disabled" + + # Indicates whether Kubernetes SchedulerName support is enabled + # + # WARNING: Cannot safely be disabled once enabled. + # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-scheduler-name + kubernetes.podspec-schedulername: "disabled" + + # This feature flag allows end-users to add a subset of capabilities on the Pod's SecurityContext. + # + # When set to "enabled" or "allowed" it allows capabilities to be added to the container. + # For a list of possible capabilities, see https://man7.org/linux/man-pages/man7/capabilities.7.html + kubernetes.containerspec-addcapabilities: "disabled" + + + # Controls whether tag header based routing feature are enabled or not. + # 1. Enabled: enabling tag header based routing + # 2. Disabled: disabling tag header based routing + # See: https://knative.dev/docs/serving/feature-flags/#tag-header-based-routing + tag-header-based-routing: "disabled" + + # Controls whether http2 auto-detection should be enabled or not. + # 1. Enabled: http2 connection will be attempted via upgrade. + # 2. Disabled: http2 connection will only be attempted when port name is set to "h2c". + autodetect-http2: "disabled" + + # Controls whether volume support for EmptyDir is enabled or not. + # 1. Enabled: enabling EmptyDir volume support + # 2. Disabled: disabling EmptyDir volume support + kubernetes.podspec-volumes-emptydir: "enabled" + + # Controls whether volume support for image is enabled or not. + # 1. Enabled: enabling image volume support + # 2. Disabled: disabling image volume support + kubernetes.podspec-volumes-image: "disabled" + + # Controls whether volume support for HostPath is enabled or not. + # WARNING: Cannot safely be disabled once enabled. + # WARNING: If you can avoid using a hostPath volume, you should. + # Please read https://kubernetes.io/docs/concepts/storage/volumes/#hostpath before enabling this feature. + # 1. Enabled: enabling HostPath volume support + # 2. Disabled: disabling HostPath volume support + kubernetes.podspec-volumes-hostpath: "disabled" + + # Controls whether volume support for CSI is enabled or not. + # 1. Enabled: enabling CSI volume support + # 2. Disabled: disabling CSI volume support + kubernetes.podspec-volumes-csi: "disabled" + + # Controls whether init containers support is enabled or not. + # 1. Enabled: enabling init containers support + # 2. Disabled: disabling init containers support + kubernetes.podspec-init-containers: "disabled" + + # Controls whether persistent volume claim support is enabled or not. + # 1. Enabled: enabling persistent volume claim support + # 2. Disabled: disabling persistent volume claim support + kubernetes.podspec-persistent-volume-claim: "disabled" + + # Controls whether write access for persistent volumes is enabled or not. + # 1. Enabled: enabling write access for persistent volumes + # 2. Disabled: disabling write access for persistent volumes + kubernetes.podspec-persistent-volume-write: "disabled" + + # Controls whether volume mount propagation support is enabled or not. + # 1. Enabled: enabling volume mount propagation support + # 2. Disabled: disabling volume mount propagation support + kubernetes.podspec-volumes-mount-propagation: "disabled" + + # Controls if the queue proxy podInfo feature is enabled, allowed or disabled + # + # This feature should be enabled/allowed when using queue proxy Options (Extensions) + # Enabling will mount a podInfo volume to the queue proxy container. + # The volume will contains an 'annotations' file (from the pod's annotation field). + # The annotations in this file include the Service annotations set by the client creating the service. + # If mounted, the annotations can be accessed by queue proxy extensions at /etc/podinfo/annotations + # + # 1. "enabled": always mount a podInfo volume + # 2. "disabled": never mount a podInfo volume + # 3. "allowed": by default, do not mount a podInfo volume + # However, a client may mount the podInfo volume on an individual Service by attaching + # the following metadata annotation to the Service: "features.knative.dev/queueproxy-podinfo":"enabled". + # + # NOTE THAT THIS IS AN EXPERIMENTAL / ALPHA FEATURE + queueproxy.mount-podinfo: "disabled" + + # Default queue proxy resource requests and limits to good values for most cases if set. + queueproxy.resource-defaults: "disabled" +--- +# Copyright 2018 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-gc + namespace: knative-serving + labels: + app.kubernetes.io/name: knative-serving + app.kubernetes.io/component: controller + app.kubernetes.io/version: "1.22.1" + annotations: + knative.dev/example-checksum: "aa3813a8" +data: + _example: | + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this example block and unindented to be in the data block + # to actually change the configuration. + + # --------------------------------------- + # Garbage Collector Settings + # --------------------------------------- + # + # Active + # * Revisions which are referenced by a Route are considered active. + # * Individual revisions may be marked with the annotation + # "serving.knative.dev/no-gc":"true" to be permanently considered active. + # * Active revisions are not considered for GC. + # Retention + # * Revisions are retained if they are any of the following: + # 1. Active + # 2. Were created within "retain-since-create-time" + # 3. Were last referenced by a route within + # "retain-since-last-active-time" + # 4. There are fewer than "min-non-active-revisions" + # If none of these conditions are met, or if the count of revisions exceed + # "max-non-active-revisions", they will be deleted by GC. + # The special value "disabled" may be used to turn off these limits. + # + # Example config to immediately collect any inactive revision: + # min-non-active-revisions: "0" + # max-non-active-revisions: "0" + # retain-since-create-time: "disabled" + # retain-since-last-active-time: "disabled" + # + # Example config to always keep around the last ten non-active revisions: + # retain-since-create-time: "disabled" + # retain-since-last-active-time: "disabled" + # max-non-active-revisions: "10" + # + # Example config to disable all garbage collection: + # retain-since-create-time: "disabled" + # retain-since-last-active-time: "disabled" + # max-non-active-revisions: "disabled" + # + # Example config to keep recently deployed or active revisions, + # always maintain the last two in case of rollback, and prevent + # burst activity from exploding the count of old revisions: + # retain-since-create-time: "48h" + # retain-since-last-active-time: "15h" + # min-non-active-revisions: "2" + # max-non-active-revisions: "1000" + + # Duration since creation before considering a revision for GC or "disabled". + retain-since-create-time: "48h" + + # Duration since active before considering a revision for GC or "disabled". + retain-since-last-active-time: "15h" + + # Minimum number of non-active revisions to retain. + min-non-active-revisions: "20" + + # Maximum number of non-active revisions to retain + # or "disabled" to disable any maximum limit. + max-non-active-revisions: "1000" +--- +# Copyright 2020 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-leader-election + namespace: knative-serving + labels: + app.kubernetes.io/name: knative-serving + app.kubernetes.io/component: controller + app.kubernetes.io/version: "1.22.1" + annotations: + knative.dev/example-checksum: "f4b71f57" +data: + _example: | + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this example block and unindented to be in the data block + # to actually change the configuration. + + # lease-duration is how long non-leaders will wait to try to acquire the + # lock; 15 seconds is the value used by core kubernetes controllers. + lease-duration: "60s" + + # renew-deadline is how long a leader will try to renew the lease before + # giving up; 10 seconds is the value used by core kubernetes controllers. + renew-deadline: "40s" + + # retry-period is how long the leader election client waits between tries of + # actions; 2 seconds is the value used by core kubernetes controllers. + retry-period: "10s" + + # buckets is the number of buckets used to partition key space of each + # Reconciler. If this number is M and the replica number of the controller + # is N, the N replicas will compete for the M buckets. The owner of a + # bucket will take care of the reconciling for the keys partitioned into + # that bucket. + buckets: "1" +--- +# Copyright 2018 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-logging + namespace: knative-serving + labels: + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/component: logging + app.kubernetes.io/name: knative-serving + annotations: + knative.dev/example-checksum: "9f25d429" +data: + _example: | + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this example block and unindented to be in the data block + # to actually change the configuration. + + # Common configuration for all Knative codebase + zap-logger-config: | + { + "level": "info", + "development": false, + "outputPaths": ["stdout"], + "errorOutputPaths": ["stderr"], + "encoding": "json", + "encoderConfig": { + "timeKey": "timestamp", + "levelKey": "severity", + "nameKey": "logger", + "callerKey": "caller", + "messageKey": "message", + "stacktraceKey": "stacktrace", + "lineEnding": "", + "levelEncoder": "", + "timeEncoder": "iso8601", + "durationEncoder": "", + "callerEncoder": "" + } + } + + # Log level overrides + # For all components except the queue proxy, + # changes are picked up immediately. + # For queue proxy, changes require recreation of the pods. + loglevel.controller: "info" + loglevel.autoscaler: "info" + loglevel.queueproxy: "info" + loglevel.webhook: "info" + loglevel.activator: "info" + loglevel.hpaautoscaler: "info" + loglevel.net-istio-controller: "info" + loglevel.net-contour-controller: "info" + loglevel.net-kourier-controller: "info" + loglevel.net-gateway-api-controller: "info" +--- +# Copyright 2018 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-network + namespace: knative-serving + labels: + app.kubernetes.io/name: knative-serving + app.kubernetes.io/component: networking + app.kubernetes.io/version: "1.22.1" + annotations: + knative.dev/example-checksum: "0573e07d" +data: + _example: | + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this example block and unindented to be in the data block + # to actually change the configuration. + + # ingress-class specifies the default ingress class + # to use when not dictated by Route annotation. + # + # If not specified, will use the Istio ingress. + # + # Note that changing the Ingress class of an existing Route + # will result in undefined behavior. Therefore it is best to only + # update this value during the setup of Knative, to avoid getting + # undefined behavior. + ingress-class: "istio.ingress.networking.knative.dev" + + # certificate-class specifies the default Certificate class + # to use when not dictated by Route annotation. + # + # If not specified, will use the Cert-Manager Certificate. + # + # Note that changing the Certificate class of an existing Route + # will result in undefined behavior. Therefore it is best to only + # update this value during the setup of Knative, to avoid getting + # undefined behavior. + certificate-class: "cert-manager.certificate.networking.knative.dev" + + # namespace-wildcard-cert-selector specifies a LabelSelector which + # determines which namespaces should have a wildcard certificate + # provisioned. + # + # Use an empty value to disable the feature (this is the default): + # namespace-wildcard-cert-selector: "" + # + # Use an empty object to enable for all namespaces + # namespace-wildcard-cert-selector: {} + # + # Useful labels include the "kubernetes.io/metadata.name" label to + # avoid provisioning a certificate for the "kube-system" namespaces. + # Use the following selector to match pre-1.0 behavior of using + # "networking.knative.dev/disableWildcardCert" to exclude namespaces: + # + # matchExpressions: + # - key: "networking.knative.dev/disableWildcardCert" + # operator: "NotIn" + # values: ["true"] + namespace-wildcard-cert-selector: "" + + # domain-template specifies the golang text template string to use + # when constructing the Knative service's DNS name. The default + # value is "{{.Name}}.{{.Namespace}}.{{.Domain}}". + # + # Valid variables defined in the template include Name, Namespace, Domain, + # Labels, and Annotations. Name will be the result of the tag-template + # below, if a tag is specified for the route. + # + # Changing this value might be necessary when the extra levels in + # the domain name generated is problematic for wildcard certificates + # that only support a single level of domain name added to the + # certificate's domain. In those cases you might consider using a value + # of "{{.Name}}-{{.Namespace}}.{{.Domain}}", or removing the Namespace + # entirely from the template. When choosing a new value be thoughtful + # of the potential for conflicts - for example, when users choose to use + # characters such as `-` in their service, or namespace, names. + # {{.Annotations}} or {{.Labels}} can be used for any customization in the + # go template if needed. + # We strongly recommend keeping namespace part of the template to avoid + # domain name clashes: + # eg. '{{.Name}}-{{.Namespace}}.{{ index .Annotations "sub"}}.{{.Domain}}' + # and you have an annotation {"sub":"foo"}, then the generated template + # would be {Name}-{Namespace}.foo.{Domain} + domain-template: "{{.Name}}.{{.Namespace}}.{{.Domain}}" + + # tag-template specifies the golang text template string to use + # when constructing the DNS name for "tags" within the traffic blocks + # of Routes and Configuration. This is used in conjunction with the + # domain-template above to determine the full URL for the tag. + tag-template: "{{.Tag}}-{{.Name}}" + + # auto-tls is deprecated and replaced by external-domain-tls + auto-tls: "Disabled" + + # Controls whether TLS certificates are automatically provisioned and + # installed in the Knative ingress to terminate TLS connections + # for cluster external domains (like: app.example.com) + # - Enabled: enables the TLS certificate provisioning feature for cluster external domains. + # - Disabled: disables the TLS certificate provisioning feature for cluster external domains. + external-domain-tls: "Disabled" + + # Controls weather TLS certificates are automatically provisioned and + # installed in the Knative ingress to terminate TLS connections + # for cluster local domains (like: app.namespace.svc.) + # - Enabled: enables the TLS certificate provisioning feature for cluster cluster-local domains. + # - Disabled: disables the TLS certificate provisioning feature for cluster cluster local domains. + # NOTE: This flag is in an alpha state and is mostly here to enable internal testing + # for now. Use with caution. + cluster-local-domain-tls: "Disabled" + + # internal-encryption is deprecated and replaced by system-internal-tls + internal-encryption: "false" + + # system-internal-tls controls weather TLS encryption is used for connections between + # the internal components of Knative: + # - ingress to activator + # - ingress to queue-proxy + # - activator to queue-proxy + # + # Possible values for this flag are: + # - Enabled: enables the TLS certificate provisioning feature for cluster cluster-local domains. + # - Disabled: disables the TLS certificate provisioning feature for cluster cluster local domains. + # NOTE: This flag is in an alpha state and is mostly here to enable internal testing + # for now. Use with caution. + system-internal-tls: "Disabled" + + # Controls the behavior of the HTTP endpoint for the Knative ingress. + # It requires auto-tls to be enabled. + # - Enabled: The Knative ingress will be able to serve HTTP connection. + # - Redirected: The Knative ingress will send a 301 redirect for all + # http connections, asking the clients to use HTTPS. + # + # "Disabled" option is deprecated. + http-protocol: "Enabled" + + # rollout-duration contains the minimal duration in seconds over which the + # Configuration traffic targets are rolled out to the newest revision. + rollout-duration: "0" + + # autocreate-cluster-domain-claims controls whether ClusterDomainClaims should + # be automatically created (and deleted) as needed when DomainMappings are + # reconciled. + # + # If this is "false" (the default), the cluster administrator is + # responsible for creating ClusterDomainClaims and delegating them to + # namespaces via their spec.Namespace field. This setting should be used in + # multitenant environments which need to control which namespace can use a + # particular domain name in a domain mapping. + # + # If this is "true", users are able to associate arbitrary names with their + # services via the DomainMapping feature. + autocreate-cluster-domain-claims: "false" + + # If true, networking plugins can add additional information to deployed + # applications to make their pods directly accessible via their IPs even if mesh is + # enabled and thus direct-addressability is usually not possible. + # Consumers like Knative Serving can use this setting to adjust their behavior + # accordingly, i.e. to drop fallback solutions for non-pod-addressable systems. + # + # NOTE: This flag is in an alpha state and is mostly here to enable internal testing + # for now. Use with caution. + enable-mesh-pod-addressability: "false" + + # mesh-compatibility-mode indicates whether consumers of network plugins + # should directly contact Pod IPs (most efficient), or should use the + # Cluster IP (less efficient, needed when mesh is enabled unless + # `enable-mesh-pod-addressability`, above, is set). + # Permitted values are: + # - "auto" (default): automatically determine which mesh mode to use by trying Pod IP and falling back to Cluster IP as needed. + # - "enabled": always use Cluster IP and do not attempt to use Pod IPs. + # - "disabled": always use Pod IPs and do not fall back to Cluster IP on failure. + mesh-compatibility-mode: "auto" + + # Defines the scheme used for external URLs if auto-tls is not enabled. + # This can be used for making Knative report all URLs as "HTTPS" for example, if you're + # fronting Knative with an external loadbalancer that deals with TLS termination and + # Knative doesn't know about that otherwise. + default-external-scheme: "http" +--- +# Copyright 2018 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-observability + namespace: knative-serving + labels: + app.kubernetes.io/name: knative-serving + app.kubernetes.io/component: observability + app.kubernetes.io/version: "1.22.1" + annotations: + knative.dev/example-checksum: "59abacb5" +data: + _example: | + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this example block and unindented to be in the data block + # to actually change the configuration. + + # logging.enable-var-log-collection defaults to false. + # The fluentd daemon set will be set up to collect /var/log if + # this flag is true. + logging.enable-var-log-collection: "false" + + # logging.revision-url-template provides a template to use for producing the + # logging URL that is injected into the status of each Revision. + logging.revision-url-template: "http://logging.example.com/?revisionUID=${REVISION_UID}" + + # If non-empty, this enables queue proxy writing user request logs to stdout, excluding probe + # requests. + # NB: after 0.18 release logging.enable-request-log must be explicitly set to true + # in order for request logging to be enabled. + # + # The value determines the shape of the request logs and it must be a valid go text/template. + # It is important to keep this as a single line. Multiple lines are parsed as separate entities + # by most collection agents and will split the request logs into multiple records. + # + # The following fields and functions are available to the template: + # + # Request: An http.Request (see https://golang.org/pkg/net/http/#Request) + # representing an HTTP request received by the server. + # + # Response: + # struct { + # Code int // HTTP status code (see https://www.iana.org/assignments/http-status-codes/http-status-codes.xhtml) + # Size int // An int representing the size of the response. + # Latency float64 // A float64 representing the latency of the response in seconds. + # } + # + # Revision: + # struct { + # Name string // Knative revision name + # Namespace string // Knative revision namespace + # Service string // Knative service name + # Configuration string // Knative configuration name + # PodName string // Name of the pod hosting the revision + # PodIP string // IP of the pod hosting the revision + # } + # + logging.request-log-template: '{"httpRequest": {"requestMethod": "{{.Request.Method}}", "requestUrl": "{{js .Request.RequestURI}}", "requestSize": "{{.Request.ContentLength}}", "status": {{.Response.Code}}, "responseSize": "{{.Response.Size}}", "userAgent": "{{js .Request.UserAgent}}", "remoteIp": "{{js .Request.RemoteAddr}}", "serverIp": "{{.Revision.PodIP}}", "referer": "{{js .Request.Referer}}", "latency": "{{.Response.Latency}}s", "protocol": "{{.Request.Proto}}"}, "traceId": "{{.TraceID}}"}' + + # If true, the request logging will be enabled. + logging.enable-request-log: "false" + + # If true, this enables queue proxy writing request logs for probe requests to stdout. + # It uses the same template for user requests, i.e. logging.request-log-template. + logging.enable-probe-request-log: "false" + + # metrics-protocol field specifies the protocol used when exporting metrics + # It supports either 'none' (the default), 'prometheus', 'http/protobuf' (OTLP HTTP), 'grpc' (OTLP gRPC) + metrics-protocol: http/protobuf + + # metrics-endpoint field specifies the destination metrics should be exporter to. + # + # The endpoint MUST be set when the protocol is http/protobuf or grpc. + # The endpoint MUST NOT be set when the protocol is none. + # + # When the protocol is prometheus the endpoint can accept a 'host:port' string to customize the + # listening host interface and port. + metrics-endpoint: http://example.com/v1/traces + + # metrics-export-interval specifies the global metrics reporting period for control and data plane components. + # If a zero or negative value is passed the default reporting OTel period is used (60 secs). + metrics-export-interval: 60s + + # request-metrics-protocol field specifies the protocol used when exporting queue-proxy metrics + # It supports either 'none' (the default), 'prometheus', 'http/protobuf' (OTLP HTTP), 'grpc' (OTLP gRPC) + request-metrics-protocol: http/protobuf + + # request-metrics-endpoint field specifies the destination metrics from the queue proxy should be exporter to. + # + # The endpoint MUST be set when the protocol is http/protobuf or grpc. + # The endpoint MUST NOT be set when the protocol is none. + # + # When the protocol is prometheus the endpoint can accept a 'host:port' string to customize the + # listening host interface and port. + request-metrics-endpoint: http://promstack-kube-prometheus-prometheus.observability:9090/api/v1/otlp/v1/metrics + + # request-metrics-export-interval specifies the global metrics reporting period for the queue-proxy. + # + # If a zero or negative value is passed the default reporting OTel period is used (60 secs). + request-metrics-export-interval: 60s + + # runtime-profiling indicates whether it is allowed to retrieve runtime profiling data from + # the pods via an HTTP server in the format expected by the pprof visualization tool. When + # enabled, the Knative Serving pods expose the profiling data on an alternate HTTP port 8008. + # The HTTP context root for profiling is then /debug/pprof/. + runtime-profiling: enabled + + # tracing-protocol field specifies the protocol used when exporting traces + # It supports either 'none' (the default), 'http/protobuf' (OTLP HTTP), 'grpc' (OTLP gRPC) + # or `stdout` for debugging purposes + tracing-protocol: http/protobuf + + # tracing-endpoint field specifies the destination traces should be exporter to. + # + # The endpoint MUST be set when the protocol is http/protobuf or grpc. + # The endpoint MUST NOT be set when the protocol is none. + tracing-endpoint: http://jaeger-collector.observability:4318/v1/traces + + # tracing-sampling-rate allows the user to specify what percentage of all traces should be exported + # The value should be between 0 (never sample) to 1 (always sample) + tracing-sampling-rate: "1" +--- +# Copyright 2019 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-tracing + namespace: knative-serving + labels: + app.kubernetes.io/name: knative-serving + app.kubernetes.io/component: tracing + app.kubernetes.io/version: "1.22.1" + annotations: + knative.dev/example-checksum: "04c7e9a3" +data: + _example: | + ########################################################### + # # + # This config is deprecated - use config-observability # + # # + ########################################################### +--- +# Copyright 2020 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: autoscaling/v2 +kind: HorizontalPodAutoscaler +metadata: + name: activator + namespace: knative-serving + labels: + app.kubernetes.io/component: activator + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" +spec: + minReplicas: 1 + maxReplicas: 20 + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: activator + metrics: + - type: Resource + resource: + name: cpu + target: + type: Utilization + # Percentage of the requested CPU + averageUtilization: 100 +--- +# Activator PDB. Currently we permit unavailability of 20% of tasks at the same time. +# Given the subsetting and that the activators are partially stateful systems, we want +# a slow rollout of the new versions and slow migration during node upgrades. +apiVersion: policy/v1 +kind: PodDisruptionBudget +metadata: + name: activator-pdb + namespace: knative-serving + labels: + app.kubernetes.io/component: activator + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" +spec: + minAvailable: 80% + selector: + matchLabels: + app: activator +--- +# Copyright 2018 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: activator + namespace: knative-serving + labels: + app.kubernetes.io/component: activator + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +spec: + selector: + matchLabels: + app: activator + role: activator + template: + metadata: + labels: + app: activator + role: activator + app.kubernetes.io/component: activator + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" + spec: + # To avoid node becoming SPOF, spread our replicas to different nodes. + affinity: + podAntiAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchLabels: + app: activator + topologyKey: kubernetes.io/hostname + weight: 100 + serviceAccountName: activator + containers: + - name: activator + # This is the Go import path for the binary that is containerized + # and substituted here. + image: gcr.io/knative-releases/knative.dev/serving/cmd/activator@sha256:5deaef961fef8d1417f6d4a4dfae2fc338f2d30d72c4ad58c3ab392b2c04705b + # The numbers are based on performance test results from + # https://github.com/knative/serving/issues/1625#issuecomment-511930023 + resources: + requests: + cpu: 300m + memory: 60Mi + limits: + cpu: 1000m + memory: 600Mi + env: + # Run Activator with GC collection when newly generated memory is 500%. + - name: GOGC + value: "500" + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: POD_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + - name: SYSTEM_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: CONFIG_LOGGING_NAME + value: config-logging + - name: CONFIG_OBSERVABILITY_NAME + value: config-observability + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + runAsNonRoot: true + capabilities: + drop: + - ALL + seccompProfile: + type: RuntimeDefault + ports: + - name: metrics + containerPort: 9090 + - name: profiling + containerPort: 8008 + - name: http1 + containerPort: 8012 + - name: h2c + containerPort: 8013 + readinessProbe: + httpGet: + port: 8012 + periodSeconds: 5 + failureThreshold: 5 + livenessProbe: + httpGet: + port: 8012 + periodSeconds: 10 + failureThreshold: 12 + initialDelaySeconds: 15 + # The activator (often) sits on the dataplane, and may proxy long (e.g. + # streaming, websockets) requests. We give a long grace period for the + # activator to "lame duck" and drain outstanding requests before we + # forcibly terminate the pod (and outstanding connections). This value + # should be at least as large as the upper bound on the Revision's + # timeoutSeconds property to avoid servicing events disrupting + # connections. + terminationGracePeriodSeconds: 600 +--- +apiVersion: v1 +kind: Service +metadata: + name: activator-service + namespace: knative-serving + labels: + app: activator + app.kubernetes.io/component: activator + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +spec: + selector: + app: activator + ports: + # Define metrics and profiling for them to be accessible within service meshes. + - name: http-metrics + port: 9090 + targetPort: 9090 + - name: http-profiling + port: 8008 + targetPort: 8008 + - name: http + port: 80 + targetPort: 8012 + - name: http2 + port: 81 + targetPort: 8013 + - name: https + port: 443 + targetPort: 8112 + type: ClusterIP +--- +# Copyright 2018 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: autoscaler + namespace: knative-serving + labels: + app.kubernetes.io/component: autoscaler + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" +spec: + replicas: 1 + selector: + matchLabels: + app: autoscaler + strategy: + type: RollingUpdate + rollingUpdate: + maxUnavailable: 0 + template: + metadata: + labels: + app: autoscaler + app.kubernetes.io/component: autoscaler + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" + spec: + # To avoid node becoming SPOF, spread our replicas to different nodes. + affinity: + podAntiAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchLabels: + app: autoscaler + topologyKey: kubernetes.io/hostname + weight: 100 + serviceAccountName: controller + containers: + - name: autoscaler + # This is the Go import path for the binary that is containerized + # and substituted here. + image: gcr.io/knative-releases/knative.dev/serving/cmd/autoscaler@sha256:5bae38655d87df86b041083fbe51791816473245f752432ba9b85a7b12f73cd5 + resources: + requests: + cpu: 100m + memory: 100Mi + limits: + cpu: 1000m + memory: 1000Mi + env: + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: POD_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + - name: SYSTEM_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: CONFIG_LOGGING_NAME + value: config-logging + - name: CONFIG_OBSERVABILITY_NAME + value: config-observability + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + runAsNonRoot: true + capabilities: + drop: + - ALL + seccompProfile: + type: RuntimeDefault + ports: + - name: metrics + containerPort: 9090 + - name: profiling + containerPort: 8008 + - name: websocket + containerPort: 8080 + readinessProbe: + httpGet: + port: 8080 + livenessProbe: + httpGet: + port: 8080 + failureThreshold: 6 +--- +apiVersion: v1 +kind: Service +metadata: + labels: + app: autoscaler + app.kubernetes.io/component: autoscaler + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" + name: autoscaler + namespace: knative-serving +spec: + ports: + # Define metrics and profiling for them to be accessible within service meshes. + - name: http-metrics + port: 9090 + targetPort: 9090 + - name: http-profiling + port: 8008 + targetPort: 8008 + - name: http + port: 8080 + targetPort: 8080 + selector: + app: autoscaler +--- +# Copyright 2018 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: controller + namespace: knative-serving + labels: + app.kubernetes.io/component: controller + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" +spec: + selector: + matchLabels: + app: controller + template: + metadata: + labels: + app: controller + app.kubernetes.io/component: controller + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" + spec: + # To avoid node becoming SPOF, spread our replicas to different nodes. + affinity: + podAntiAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchLabels: + app: controller + topologyKey: kubernetes.io/hostname + weight: 100 + serviceAccountName: controller + containers: + - name: controller + # This is the Go import path for the binary that is containerized + # and substituted here. + image: gcr.io/knative-releases/knative.dev/serving/cmd/controller@sha256:94329d85200c2fc31ed1166a26568ca1357376c149c147e71f400cf28be3c816 + resources: + requests: + cpu: 100m + memory: 100Mi + limits: + cpu: 1000m + memory: 1000Mi + env: + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: SYSTEM_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: CONFIG_LOGGING_NAME + value: config-logging + - name: CONFIG_OBSERVABILITY_NAME + value: config-observability + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + runAsNonRoot: true + capabilities: + drop: + - ALL + seccompProfile: + type: RuntimeDefault + livenessProbe: + httpGet: + path: /health + port: probes + scheme: HTTP + periodSeconds: 5 + failureThreshold: 6 + readinessProbe: + httpGet: + path: /readiness + port: probes + scheme: HTTP + periodSeconds: 5 + failureThreshold: 3 + ports: + - name: metrics + containerPort: 9090 + - name: profiling + containerPort: 8008 + - name: probes + containerPort: 8080 +--- +apiVersion: v1 +kind: Service +metadata: + labels: + app: controller + app.kubernetes.io/component: controller + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" + name: controller + namespace: knative-serving +spec: + ports: + # Define metrics and profiling for them to be accessible within service meshes. + - name: http-metrics + port: 9090 + targetPort: 9090 + - name: http-profiling + port: 8008 + targetPort: 8008 + selector: + app: controller +--- +# Copyright 2020 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: autoscaling/v2 +kind: HorizontalPodAutoscaler +metadata: + name: webhook + namespace: knative-serving + labels: + app.kubernetes.io/component: webhook + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" +spec: + minReplicas: 1 + maxReplicas: 5 + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: webhook + metrics: + - type: Resource + resource: + name: cpu + target: + type: Utilization + # Percentage of the requested CPU + averageUtilization: 100 +--- +# Webhook PDB. +apiVersion: policy/v1 +kind: PodDisruptionBudget +metadata: + name: webhook-pdb + namespace: knative-serving + labels: + app.kubernetes.io/component: webhook + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" +spec: + minAvailable: 80% + selector: + matchLabels: + app: webhook +--- +# Copyright 2018 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: webhook + namespace: knative-serving + labels: + app.kubernetes.io/component: webhook + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +spec: + selector: + matchLabels: + app: webhook + role: webhook + template: + metadata: + labels: + app: webhook + role: webhook + app.kubernetes.io/component: webhook + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving + spec: + # To avoid node becoming SPOF, spread our replicas to different nodes. + affinity: + podAntiAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchLabels: + app: webhook + topologyKey: kubernetes.io/hostname + weight: 100 + serviceAccountName: controller + containers: + - name: webhook + # This is the Go import path for the binary that is containerized + # and substituted here. + image: gcr.io/knative-releases/knative.dev/serving/cmd/webhook@sha256:8470456be214e93a84e3c7b79a632aa9978bd8ecda553feaa47878a2c24ab84d + resources: + requests: + cpu: 100m + memory: 100Mi + limits: + cpu: 500m + memory: 500Mi + env: + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: SYSTEM_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: CONFIG_LOGGING_NAME + value: config-logging + - name: CONFIG_OBSERVABILITY_NAME + value: config-observability + - name: WEBHOOK_NAME + value: webhook + - name: WEBHOOK_PORT + value: "8443" + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + runAsNonRoot: true + capabilities: + drop: + - ALL + seccompProfile: + type: RuntimeDefault + ports: + - name: metrics + containerPort: 9090 + - name: profiling + containerPort: 8008 + - name: https-webhook + containerPort: 8443 + readinessProbe: + periodSeconds: 1 + httpGet: + scheme: HTTPS + port: 8443 + livenessProbe: + periodSeconds: 10 + httpGet: + scheme: HTTPS + port: 8443 + failureThreshold: 6 + initialDelaySeconds: 20 + # Our webhook should gracefully terminate by lame ducking first, set this to a sufficiently + # high value that we respect whatever value it has configured for the lame duck grace period. + terminationGracePeriodSeconds: 300 +--- +apiVersion: v1 +kind: Service +metadata: + labels: + app: webhook + role: webhook + app.kubernetes.io/component: webhook + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving + name: webhook + namespace: knative-serving +spec: + ports: + # Define metrics and profiling for them to be accessible within service meshes. + - name: http-metrics + port: 9090 + targetPort: 9090 + - name: http-profiling + port: 8008 + targetPort: 8008 + - name: https-webhook + port: 443 + targetPort: 8443 + selector: + app: webhook + role: webhook +--- +# Copyright 2020 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingWebhookConfiguration +metadata: + name: config.webhook.serving.knative.dev + labels: + app.kubernetes.io/component: webhook + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" +webhooks: + - admissionReviewVersions: ["v1", "v1beta1"] + clientConfig: + service: + name: webhook + namespace: knative-serving + failurePolicy: Fail + sideEffects: None + name: config.webhook.serving.knative.dev + objectSelector: + matchExpressions: + - key: app.kubernetes.io/name + operator: In + values: ["knative-serving"] + - key: app.kubernetes.io/component + operator: In + values: ["autoscaler", "controller", "logging", "networking", "observability", "tracing", "net-certmanager"] + timeoutSeconds: 10 +--- +# Copyright 2020 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: admissionregistration.k8s.io/v1 +kind: MutatingWebhookConfiguration +metadata: + name: webhook.serving.knative.dev + labels: + app.kubernetes.io/component: webhook + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" +webhooks: + - admissionReviewVersions: ["v1", "v1beta1"] + clientConfig: + service: + name: webhook + namespace: knative-serving + failurePolicy: Fail + sideEffects: None + name: webhook.serving.knative.dev + timeoutSeconds: 10 + rules: + - apiGroups: + - autoscaling.internal.knative.dev + - networking.internal.knative.dev + - serving.knative.dev + apiVersions: + - "*" + operations: + - CREATE + - UPDATE + scope: "*" + resources: + - metrics + - podautoscalers + - certificates + - ingresses + - serverlessservices + - configurations + - revisions + - routes + - services + - domainmappings + - domainmappings/status +--- +# Copyright 2020 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingWebhookConfiguration +metadata: + name: validation.webhook.serving.knative.dev + labels: + app.kubernetes.io/component: webhook + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" +webhooks: + - admissionReviewVersions: ["v1", "v1beta1"] + clientConfig: + service: + name: webhook + namespace: knative-serving + failurePolicy: Fail + sideEffects: None + name: validation.webhook.serving.knative.dev + timeoutSeconds: 10 + rules: + - apiGroups: + - autoscaling.internal.knative.dev + - networking.internal.knative.dev + - serving.knative.dev + apiVersions: + - "*" + operations: + - CREATE + - UPDATE + - DELETE + scope: "*" + resources: + - metrics + - podautoscalers + - certificates + - ingresses + - serverlessservices + - configurations + - revisions + - routes + - services + - domainmappings + - domainmappings/status +--- +# Copyright 2020 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: Secret +metadata: + name: webhook-certs + namespace: knative-serving + labels: + app.kubernetes.io/component: webhook + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" +# The data is populated at install time. diff --git a/packages/manifests/operators/knative-serving/v1.22.1/03-kourier.yaml b/packages/manifests/operators/knative-serving/v1.22.1/03-kourier.yaml new file mode 100644 index 0000000..d38be35 --- /dev/null +++ b/packages/manifests/operators/knative-serving/v1.22.1/03-kourier.yaml @@ -0,0 +1,732 @@ +# Source: https://github.com/knative-extensions/net-kourier/releases/download/knative-v1.22.1/kourier.yaml +# Copyright 2020 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: Namespace +metadata: + name: kourier-system + labels: + networking.knative.dev/ingress-provider: kourier + app.kubernetes.io/name: knative-serving + app.kubernetes.io/component: net-kourier + app.kubernetes.io/version: "1.22.1" +--- +# Copyright 2020 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: kourier-bootstrap + namespace: kourier-system + labels: + networking.knative.dev/ingress-provider: kourier + app.kubernetes.io/component: net-kourier + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +data: + envoy-bootstrap.yaml: | + dynamic_resources: + ads_config: + transport_api_version: V3 + api_type: GRPC + rate_limit_settings: {} + grpc_services: + - envoy_grpc: {cluster_name: xds_cluster} + cds_config: + resource_api_version: V3 + ads: {} + lds_config: + resource_api_version: V3 + ads: {} + node: + cluster: kourier-knative + id: 3scale-kourier-gateway + static_resources: + listeners: + - name: stats_listener + address: + socket_address: + address: 0.0.0.0 + port_value: 9000 + filter_chains: + - filters: + - name: envoy.filters.network.http_connection_manager + typed_config: + "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager + stat_prefix: stats_server + http_filters: + - name: envoy.filters.http.router + typed_config: + "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router + route_config: + virtual_hosts: + - name: admin_interface + domains: + - "*" + routes: + - match: + safe_regex: + regex: '/(certs|stats(/prometheus)?|server_info|clusters|listeners|ready)?' + headers: + - name: ':method' + string_match: + exact: GET + route: + cluster: service_stats + - match: + safe_regex: + regex: '/drain_listeners' + headers: + - name: ':method' + string_match: + exact: POST + route: + cluster: service_stats + clusters: + - name: service_stats + connect_timeout: 0.250s + type: static + load_assignment: + cluster_name: service_stats + endpoints: + lb_endpoints: + endpoint: + address: + socket_address: + address: 127.0.0.1 + port_value: 9901 + - name: xds_cluster + # This keepalive is recommended by envoy docs. + # https://www.envoyproxy.io/docs/envoy/latest/api-docs/xds_protocol + typed_extension_protocol_options: + envoy.extensions.upstreams.http.v3.HttpProtocolOptions: + "@type": type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions + explicit_http_config: + http2_protocol_options: + connection_keepalive: + interval: 30s + timeout: 5s + connect_timeout: 1s + load_assignment: + cluster_name: xds_cluster + endpoints: + lb_endpoints: + endpoint: + address: + socket_address: + address: "net-kourier-controller.knative-serving" + port_value: 18000 + type: STRICT_DNS + admin: + access_log: + - name: envoy.access_loggers.stdout + typed_config: + "@type": type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog + address: + socket_address: + address: 127.0.0.1 + port_value: 9901 +--- +# Copyright 2021 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-kourier + namespace: knative-serving + labels: + networking.knative.dev/ingress-provider: kourier + app.kubernetes.io/component: net-kourier + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +data: + _example: | + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this example block and unindented to be in the data block + # to actually change the configuration. + + # Specifies whether requests reaching the Kourier gateway + # in the context of services should be logged. Readiness + # probes etc. must be configured via the bootstrap config. + enable-service-access-logging: "true" + + # Specifies the format of the access log used by the Kourier gateway. + # This template follows the envoy format. + # see: https://www.envoyproxy.io/docs/envoy/latest/configuration/observability/access_log/usage#access-logging + service-access-log-template: "" + + # Specifies whether to use proxy-protocol in order to safely + # transport connection information such as a client's address + # across multiple layers of TCP proxies. + # NOTE THAT THIS IS AN EXPERIMENTAL / ALPHA FEATURE + enable-proxy-protocol: "false" + + # The server certificates to serve the internal TLS traffic for Kourier Gateway. + # It is specified by the secret name in controller namespace, which has + # the "tls.crt" and "tls.key" data field. + # Use an empty value to disable the feature (default). + # + # NOTE: This flag is in an alpha state and is mostly here to enable internal testing + # for now. Use with caution. + cluster-cert-secret: "" + + # Specifies the amount of time that Kourier waits for the incoming requests. + # The default, 0s, imposes no timeout at all. + stream-idle-timeout: "0s" + + # Specifies whether to use CryptoMB private key provider in order to + # acclerate the TLS handshake. + # NOTE THAT THIS IS AN EXPERIMENTAL / ALPHA FEATURE. + enable-cryptomb: "false" + + # Configures the number of additional ingress proxy hops from the + # right side of the x-forwarded-for HTTP header to trust. + trusted-hops-count: "0" + + # Configures the connection manager to use the real remote address + # of the client connection when determining internal versus external origin and manipulating various headers. + use-remote-address: "false" + + # Specifies the cipher suites for TLS external listener. + # Use ',' separated values like "ECDHE-ECDSA-AES128-GCM-SHA256,ECDHE-ECDSA-CHACHA20-POLY1305" + # The default uses the default cipher suites of the envoy version. + cipher-suites: "" + + # Disable the Envoy server header injection in the response when response has no such header. + disable-envoy-server-header: "false" + + # The external authorization service and port, my-auth:2222. + # This value overrides environment variable if defined. + extauthz-host: "" + + # The protocol used to query the ext auth service. Can be one of : grpc, http, https. Defaults to grpc + # This value overrides environment variable if defined. + extauthz-protocol: "grpc" + + # Allow traffic to go through if the ext auth service is down. Accepts true/false. + # This value overrides environment variable if defined. + extauthz-failure-mode-allow: "" + + # Max request bytes, if not set, defaults to 8192 Bytes. More info Envoy Docs + # see: https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/http/ext_authz/v3/ext_authz.proto.html#extensions-filters-http-ext-authz-v3-buffersettings + # This value overrides environment variable if defined. + extauthz-max-request-body-bytes: 8192 + + # Max time in ms to wait for the ext authz service. Defaults to 2000 ms + # This value overrides environment variable if defined. + extauthz-timeout: 2000 + + # If extauthz-protocol is equal to http or https, path to query the ext auth service. + # Example : if set to /verify, it will query /verify/ (notice the trailing /). If not set, it will query / + # This value overrides environment variable if defined. + extauthz-path-prefix: "" + + # If extauthz-protocol is equal to grpc, sends the body as raw bytes instead of a UTF-8 string. + # Accepts only true/false, t/f or 1/0. Attempting to set another value will throw an error. + # Defaults to false. More info Envoy Docs. + # see: https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/http/ext_authz/v3/ext_authz.proto.html#extensions-filters-http-ext-authz-v3-buffersettings + # This value overrides environment variable if defined. + extauthz-pack-as-byte: "false" + + # Specifies the secret that contains the TLS certificate and key pair when using HTTPS communication with Kourier Ingress. + # This value overrides environment variable if defined. + certs-secret-name: "" + certs-secret-namespace: "" + + # Specifies the OTLP collector endpoint for distributed tracing. + # The endpoint format depends on the protocol (see tracing-protocol). + # Examples: + # - For HTTP: "http://otel-collector.observability.svc:4318/v1/traces" + # - For gRPC: "http://otel-collector.observability.svc:4317" + # Use an empty value to disable distributed tracing (default). + tracing-endpoint: "" + + # Protocol for tracing collector communication. + # Valid values: http/protobuf, grpc + tracing-protocol: "grpc" + + # Tracing sampling rate (0.0 to 1.0) + # Controls the percentage of requests that are traced. + # Example: "1.0" traces 100% of requests. + tracing-sampling-rate: "1.0" + + # Service name for traces + # This identifies the Kourier gateway in your tracing system. + tracing-service-name: "kourier-knative" +--- +# Copyright 2020 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ServiceAccount +metadata: + name: net-kourier + namespace: knative-serving + labels: + networking.knative.dev/ingress-provider: kourier + app.kubernetes.io/component: net-kourier + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: net-kourier + labels: + networking.knative.dev/ingress-provider: kourier + app.kubernetes.io/component: net-kourier + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +rules: + - apiGroups: [""] + resources: ["events"] + verbs: ["create", "update", "patch"] + - apiGroups: [""] + resources: ["pods", "services", "secrets"] + verbs: ["get", "list", "watch"] + - apiGroups: [""] + resources: ["configmaps"] + verbs: ["get", "list", "watch"] + - apiGroups: ["discovery.k8s.io"] + resources: ["endpointslices"] + verbs: ["get", "list", "watch"] + - apiGroups: ["coordination.k8s.io"] + resources: ["leases"] + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] + - apiGroups: ["networking.internal.knative.dev"] + resources: ["ingresses"] + verbs: ["get", "list", "watch", "patch"] + - apiGroups: ["networking.internal.knative.dev"] + resources: ["ingresses/status"] + verbs: ["update"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: net-kourier + labels: + networking.knative.dev/ingress-provider: kourier + app.kubernetes.io/component: net-kourier + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: net-kourier +subjects: + - kind: ServiceAccount + name: net-kourier + namespace: knative-serving +--- +# Copyright 2020 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: net-kourier-controller + namespace: knative-serving + labels: + networking.knative.dev/ingress-provider: kourier + app.kubernetes.io/component: net-kourier + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +spec: + strategy: + type: RollingUpdate + rollingUpdate: + maxUnavailable: 0 + maxSurge: 100% + replicas: 1 + selector: + matchLabels: + app: net-kourier-controller + template: + metadata: + annotations: + prometheus.io/scrape: "true" + prometheus.io/port: "9090" + prometheus.io/path: "/metrics" + labels: + app: net-kourier-controller + spec: + containers: + - image: gcr.io/knative-releases/knative.dev/net-kourier/cmd/kourier@sha256:01abd2070ccf8680885c47990e42c05c09e30bc8595d9246f4dcd37f2220a2a2 + name: controller + env: + # CERTS_SECRET_NAMESPACE and CERTS_SECRET_NAME can also be configured from a ConfigMap. + # Settings configured in a configmap take precedence over environment variable settings. + - name: CERTS_SECRET_NAMESPACE + value: "" + - name: CERTS_SECRET_NAME + value: "" + - name: SYSTEM_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: METRICS_DOMAIN + value: "knative.dev/samples" + - name: KOURIER_GATEWAY_NAMESPACE + value: "kourier-system" + - name: ENABLE_SECRET_INFORMER_FILTERING_BY_CERT_UID + value: "false" + # KUBE_API_BURST and KUBE_API_QPS allows to configure maximum burst for throttle and maximum QPS to the server from the client. + # Setting these values using env vars is possible since https://github.com/knative/pkg/pull/2755. + # 200 is an arbitrary value, but it speeds up kourier startup duration, and the whole ingress reconciliation process as a whole. + - name: KUBE_API_BURST + value: "200" + - name: KUBE_API_QPS + value: "200" + ports: + - name: http2-xds + containerPort: 18000 + protocol: TCP + - name: metrics + containerPort: 9090 + protocol: TCP + readinessProbe: + grpc: + port: 18000 + periodSeconds: 10 + failureThreshold: 3 + livenessProbe: + grpc: + port: 18000 + periodSeconds: 10 + failureThreshold: 6 + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + runAsNonRoot: true + capabilities: + drop: + - ALL + seccompProfile: + type: RuntimeDefault + resources: + requests: + cpu: 200m + memory: 200Mi + limits: + cpu: "1" + memory: 500Mi + restartPolicy: Always + serviceAccountName: net-kourier +--- +apiVersion: v1 +kind: Service +metadata: + name: net-kourier-controller + namespace: knative-serving + labels: + networking.knative.dev/ingress-provider: kourier + app.kubernetes.io/component: net-kourier + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +spec: + ports: + - name: grpc-xds + port: 18000 + protocol: TCP + targetPort: 18000 + - name: http-metrics + port: 9090 + protocol: TCP + targetPort: 9090 + selector: + app: net-kourier-controller + type: ClusterIP +--- +# Copyright 2020 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: 3scale-kourier-gateway + namespace: kourier-system + labels: + networking.knative.dev/ingress-provider: kourier + app.kubernetes.io/component: net-kourier + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +spec: + strategy: + type: RollingUpdate + rollingUpdate: + maxUnavailable: 0 + maxSurge: 100% + selector: + matchLabels: + app: 3scale-kourier-gateway + template: + metadata: + labels: + app: 3scale-kourier-gateway + annotations: + # v0.26 supports envoy v3 API, so + # adding this label to restart pod. + networking.knative.dev/poke: "v0.26" + prometheus.io/scrape: "true" + prometheus.io/port: "9000" + prometheus.io/path: "/stats/prometheus" + spec: + containers: + - args: + - --base-id 1 + - -c /tmp/config/envoy-bootstrap.yaml + - --log-level info + - --drain-time-s $(DRAIN_TIME_SECONDS) + - --drain-strategy immediate + command: + - /usr/local/bin/envoy + env: + - name: DRAIN_TIME_SECONDS + value: "15" + image: docker.io/envoyproxy/envoy:v1.37-latest + name: kourier-gateway + ports: + - name: http2-external + containerPort: 8080 + protocol: TCP + - name: http2-internal + containerPort: 8081 + protocol: TCP + - name: https-external + containerPort: 8443 + protocol: TCP + - name: http-probe + containerPort: 8090 + protocol: TCP + - name: https-probe + containerPort: 9443 + protocol: TCP + - name: metrics + containerPort: 9000 + protocol: TCP + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: false + runAsNonRoot: true + runAsUser: 65534 + runAsGroup: 65534 + capabilities: + drop: + - ALL + seccompProfile: + type: RuntimeDefault + volumeMounts: + - name: config-volume + mountPath: /tmp/config + lifecycle: + preStop: + exec: + command: ["/bin/sh", "-c", "curl -X POST http://localhost:9901/drain_listeners?graceful; sleep $DRAIN_TIME_SECONDS"] + readinessProbe: + httpGet: + httpHeaders: + - name: Host + value: internalkourier + path: /ready + port: 8081 + scheme: HTTP + initialDelaySeconds: 10 + periodSeconds: 5 + failureThreshold: 3 + timeoutSeconds: 3 + livenessProbe: + httpGet: + httpHeaders: + - name: Host + value: internalkourier + path: /ready + port: 8081 + scheme: HTTP + initialDelaySeconds: 10 + periodSeconds: 5 + failureThreshold: 6 + timeoutSeconds: 3 + resources: + requests: + cpu: 200m + memory: 200Mi + limits: + cpu: "1" + memory: 800Mi + # to ensure a graceful drain, terminationGracePeriodSeconds must be greater than DRAIN_TIME_SECONDS environment variable + terminationGracePeriodSeconds: 30 + volumes: + - name: config-volume + configMap: + name: kourier-bootstrap + restartPolicy: Always +--- +apiVersion: v1 +kind: Service +metadata: + name: kourier + namespace: kourier-system + labels: + networking.knative.dev/ingress-provider: kourier + app.kubernetes.io/component: net-kourier + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +spec: + ports: + - name: http2 + port: 80 + protocol: TCP + targetPort: 8080 + - name: https + port: 443 + protocol: TCP + targetPort: 8443 + selector: + app: 3scale-kourier-gateway + type: LoadBalancer +--- +apiVersion: v1 +kind: Service +metadata: + name: kourier-internal + namespace: kourier-system + labels: + networking.knative.dev/ingress-provider: kourier + app.kubernetes.io/component: net-kourier + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +spec: + ports: + - name: http2 + port: 80 + protocol: TCP + targetPort: 8081 + - name: https + port: 443 + protocol: TCP + targetPort: 8444 + selector: + app: 3scale-kourier-gateway + type: ClusterIP +--- +apiVersion: autoscaling/v2 +kind: HorizontalPodAutoscaler +metadata: + name: 3scale-kourier-gateway + namespace: kourier-system + labels: + networking.knative.dev/ingress-provider: kourier + app.kubernetes.io/component: net-kourier + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +spec: + minReplicas: 1 + maxReplicas: 10 + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: 3scale-kourier-gateway + metrics: + - type: Resource + resource: + name: cpu + target: + type: Utilization + # Percentage of the requested CPU + averageUtilization: 100 +--- +apiVersion: policy/v1 +kind: PodDisruptionBudget +metadata: + name: 3scale-kourier-gateway-pdb + namespace: kourier-system + labels: + networking.knative.dev/ingress-provider: kourier + app.kubernetes.io/component: net-kourier + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +spec: + minAvailable: 80% + selector: + matchLabels: + app: 3scale-kourier-gateway diff --git a/packages/manifests/scripts/codegen-operators.ts b/packages/manifests/scripts/codegen-operators.ts index 80a7b2d..48c0937 100755 --- a/packages/manifests/scripts/codegen-operators.ts +++ b/packages/manifests/scripts/codegen-operators.ts @@ -118,16 +118,39 @@ function scanOperators(): OperatorModel[] { if (entry.isDirectory()) { const id = entry.name; const dir = path.join(OPERATORS_DIR, id); - const versionFiles = fs - .readdirSync(dir, { withFileTypes: true }) + const entries = fs.readdirSync(dir, { withFileTypes: true }); + + // A version is either a single .yaml, or a / directory + // of numbered parts that must be applied in order. Knative is the second + // shape: serving-crds has to be established before serving-core creates + // custom resources of those kinds, so merging them into one document set + // races the CRDs against the resources that need them. + const versionFiles = entries .filter((f) => f.isFile() && f.name.endsWith('.yaml')) - .sort((a, b) => a.name.localeCompare(b.name)); - if (versionFiles.length === 0) continue; + .map((f) => ({ version: f.name.replace(/\.yaml$/i, ''), paths: [path.join(dir, f.name)] })); + + const versionDirs = entries + .filter((f) => f.isDirectory()) + .map((d) => ({ + version: d.name, + paths: fs + .readdirSync(path.join(dir, d.name)) + .filter((n) => n.endsWith('.yaml')) + // Lexical order is the apply order — that is what the numeric + // prefixes are for. + .sort((a, b) => a.localeCompare(b)) + .map((n) => path.join(dir, d.name, n)), + })) + .filter((v) => v.paths.length > 0); + + const allVersions = [...versionFiles, ...versionDirs] + .sort((a, b) => a.version.localeCompare(b.version)); + if (allVersions.length === 0) continue; const model = byId.get(id) || { id }; model.versions = model.versions || {}; - for (const f of versionFiles) { - const version = f.name.replace(/\.yaml$/i, ''); - const docs = readYaml(path.join(dir, f.name)); + for (const f of allVersions) { + const version = f.version; + const docs = f.paths.flatMap((fp) => readYaml(fp)); const gvk = uniqSorted( docs.map(toGVKRef).filter(Boolean) as GVKRef[], (x) => x.gvk diff --git a/packages/manifests/scripts/pull-manifests.ts b/packages/manifests/scripts/pull-manifests.ts index 02ca664..621664c 100644 --- a/packages/manifests/scripts/pull-manifests.ts +++ b/packages/manifests/scripts/pull-manifests.ts @@ -27,6 +27,19 @@ type OperatorConfig = { name: string; sources: Source[]; // multiple versions allowed combineUrls?: boolean; // for urls type: concatenate into single file (default true) + // Vendor only CustomResourceDefinitions from this operator's output. + // + // For charts that mint secrets at template time. Cilium's + // cilium-ca-secret.yaml emits a freshly generated CA certificate and private + // key on every `helm template`, unconditionally — `tls.auto.enabled=false` + // does not suppress it. Vendoring that output would commit a private key to + // a public repository and publish it to npm, and would never be reproducible + // since the key changes on every run. + // + // The CRDs carry no secrets and are all the generated client needs. Installing + // such an operator stays a deploy-time action, where the CA is generated in + // the target cluster and stays there. + crdsOnly?: boolean; }; // Configure supported operators and versions. @@ -79,6 +92,9 @@ const OPERATORS: OperatorConfig[] = [ }, { name: 'knative-serving', + // Applied in three ordered parts, never merged: the CRDs have to be + // established before serving-core's custom resources of those kinds exist. + combineUrls: false, sources: [ { type: 'urls', @@ -138,22 +154,19 @@ const OPERATORS: OperatorConfig[] = [ }, ], }, - { - // Cilium's CRDs are what a NetworkPolicy-based isolation model is written - // against, so a client generated without them cannot describe that surface - // at all. - name: 'cilium', - sources: [ - { - type: 'helm', - version: '1.19.5', - repo: 'https://helm.cilium.io', - repoName: 'cilium', - chart: 'cilium', - namespace: 'kube-system', - }, - ], - }, + // Cilium is deliberately absent. + // + // Its chart cannot be vendored safely or usefully. cilium-ca-secret.yaml + // emits a freshly generated CA certificate and private key on every + // `helm template` -- unconditionally; `tls.auto.enabled=false` does not + // suppress it -- so vendoring the output would commit a private key to a + // public repository and would never reproduce across runs. Filtering to CRDs + // yields nothing either, because Cilium's operator registers its CRDs at + // runtime rather than shipping them in the chart. + // + // So Cilium is installed into the cluster by the regenerate workflow, where + // the operator creates the CRDs the client is generated from, and the CA is + // generated in that cluster and stays there. { name: 'traefik', sources: [ @@ -319,6 +332,7 @@ async function pullOperator(op: OperatorConfig, version?: string, outDir = path. // Preserve original formatting/comments by NOT re-serializing via js-yaml. const seen = new Set(); const outPieces: string[] = []; + const partContents: string[] = []; for (const url of src.urls) { // eslint-disable-next-line no-await-in-loop @@ -328,6 +342,7 @@ async function pullOperator(op: OperatorConfig, version?: string, outDir = path. .map((s) => s.trim()) .filter((s) => s.length > 0); + const thisPart: string[] = []; let wroteHeaderForSource = false; for (const raw of docsRaw) { let key = ''; @@ -346,11 +361,39 @@ async function pullOperator(op: OperatorConfig, version?: string, outDir = path. wroteHeaderForSource = true; } outPieces.push(raw); + thisPart.push(raw); } + partContents.push(`# Source: ${url}\n` + thisPart.join('\n---\n') + '\n'); } const combined = outPieces.join('\n---\n') + '\n'; - writeFile(targetFile, combined); + + // combineUrls was declared but never read, so every URL source was + // concatenated whether or not that was safe. It is not safe for Knative: + // serving-crds.yaml must be applied and *established* before + // serving-core.yaml, which contains custom resources of those very kinds. + // Merged into one document set, a single-pass apply races the CRDs + // against the resources that need them. + // + // With combineUrls false the parts are written separately and numbered, + // so the order they must be applied in is the order they sort in — and a + // consumer cannot get it wrong by reading the directory. + if (op.combineUrls === false) { + // Nested under the version, not beside it: the parts are one version + // applied in sequence, and writing them as siblings of the versioned + // files made the codegen read `01-serving-crds` as a version name. + src.urls.forEach((url, i) => { + const part = url.split('/').pop() || `part-${i}.yaml`; + const partFile = path.join( + targetDir, + src.version, + `${String(i + 1).padStart(2, '0')}-${part}` + ); + writeFile(partFile, partContents[i]); + }); + } else { + writeFile(targetFile, combined); + } // Also update unversioned latest pointer (copy) if this is highest version } else if (src.type === 'helm') { // Ensure repo @@ -378,6 +421,22 @@ async function pullOperator(op: OperatorConfig, version?: string, outDir = path. // No post-render mutations: rely on Helm values overrides above. + if (op.crdsOnly) { + rendered = rendered + .split(/\n---\s*\n/gm) + .map((d) => d.trim()) + .filter((d) => { + if (!d) return false; + try { + const parsed = yaml.load(d) as any; + return parsed?.kind === 'CustomResourceDefinition'; + } catch { + return false; + } + }) + .join('\n---\n'); + } + writeFile( targetFile, `# Source: ${src.repoName}/${src.chart}@${src.version}\n${rendered}\n` diff --git a/packages/manifests/src/generated/cilium.ts b/packages/manifests/src/generated/cilium.ts deleted file mode 100644 index a285b6f..0000000 --- a/packages/manifests/src/generated/cilium.ts +++ /dev/null @@ -1,1608 +0,0 @@ -/** Auto-generated typed resources for operator: cilium*/ -import type { KubernetesResource } from "@kubernetesjs/ops"; -export const Namespace_KubeSystem: KubernetesResource = { - apiVersion: "v1", - kind: "Namespace", - metadata: { - labels: { - "app.kubernetes.io/name": "kube-system" - }, - name: "kube-system" - } -}; -export const Namespace_CiliumSecrets: KubernetesResource = { - apiVersion: "v1", - kind: "Namespace", - metadata: { - annotations: null, - labels: { - "app.kubernetes.io/part-of": "cilium" - }, - name: "cilium-secrets" - } -}; -export const ServiceAccount_Cilium: KubernetesResource = { - apiVersion: "v1", - kind: "ServiceAccount", - metadata: { - name: "cilium", - namespace: "kube-system" - } -}; -export const ServiceAccount_CiliumEnvoy: KubernetesResource = { - apiVersion: "v1", - kind: "ServiceAccount", - metadata: { - name: "cilium-envoy", - namespace: "kube-system" - } -}; -export const ServiceAccount_CiliumOperator: KubernetesResource = { - apiVersion: "v1", - kind: "ServiceAccount", - metadata: { - name: "cilium-operator", - namespace: "kube-system" - } -}; -export const Secret_CiliumCa: KubernetesResource = { - apiVersion: "v1", - kind: "Secret", - metadata: { - labels: { - "cilium.io/helm-template-non-idempotent": "true" - }, - name: "cilium-ca", - namespace: "kube-system" - }, - data: { - "ca.crt": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURFekNDQWZ1Z0F3SUJBZ0lRZWo4K0VORUJMdTBHZzZna1B1eFl5VEFOQmdrcWhraUc5dzBCQVFzRkFEQVUKTVJJd0VBWURWUVFERXdsRGFXeHBkVzBnUTBFd0hoY05Nall3T0RFeU1qSXpNREF5V2hjTk1qa3dPREV4TWpJegpNREF5V2pBVU1SSXdFQVlEVlFRREV3bERhV3hwZFcwZ1EwRXdnZ0VpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElCCkR3QXdnZ0VLQW9JQkFRRFRwSE9jNjJxM29VZ1ByRjNSRFhKY3c0WmxnRE5la1ZHc1c5TVRMdFdXS245d0tMbmUKQzZrbGxNVk5ydnVyVGptMDU3aGpDbkVkcndkOVd6YlJWNHczVXJYeWZOK0ptck04WWJyODFPMFFWcGdLQTJiTQpUQmM0OVhjcHkyUWwzSWYwaXdxMkdTek1qMjFyekZheVM2Q1Zwb1dOTVdqOWxzOFFjOFJ0eElLOG5zZ2t6cDRvCis0TmE5TkRrSldsM1NWK2NJbXJlSnVveWpSZWFlTzhNZ2J0R05NdFAwWGhweUp3ZTNSRnJWck5qV3JxcjFyMVIKLzZ6cjhrN3B1b0FyMmNaN1dkOVVuRUZqaVBNbFJZOENpdUtXTkJlYWdXV3BPaU00NTUzcFJUdmdPQmRLU3BGOQpPVE1CNXhSdldTQlNMdFVkWVVHR2ppM3pLQkJTMjBtZENrb1RBZ01CQUFHallUQmZNQTRHQTFVZER3RUIvd1FFCkF3SUNwREFkQmdOVkhTVUVGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXcKQXdFQi96QWRCZ05WSFE0RUZnUVUrMnFyZXdBejRXREptZnNBVW9MVm9wQzBXR2d3RFFZSktvWklodmNOQVFFTApCUUFEZ2dFQkFHb2xLZFljNGJ2VjR2b1RyRnNvMHF3YklBQlREc09xdU9mVURqM3NWb0VCS2hXUHQ5TUI3WVBNCnJBL2NGZTA0bTR1Zk1sT29RdDdlOWtmbVJjK2Z2VUpucFZ6aXFHQWhnZFBTVWt0eGdQOHl5Q3hLVVJVeGdPT3MKNUFoM3dWazBDdDFOY24xYVpXU3R1NDQ0SEppbko0QllESkNpQ1ZESTJaRjlQaWo5WFZlSnp5TUlUSHptSEpaSgp6MU9xV2s3aXhYZnJUYnRwTkxWekY0Z21TV1Y5cXYwNklvczVrRFVXVFZ3bUtMKzNZZ3U4elR3dk10MFl1ak5UCjROeWRaTzNVditYUnBLaTgwVE02dzlXVUIyZUtQRSs4NDVhcC8rUWZ1ZThrMzVFaVZ4NTlWWGJ0SFJuWHRBLzEKYURhLzROcmlTNVZGZjNxU0hBd2RienRta3YramtMdz0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=", - "ca.key": "LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb2dJQkFBS0NBUUVBMDZSem5PdHF0NkZJRDZ4ZDBRMXlYTU9HWllBelhwRlJyRnZURXk3VmxpcC9jQ2k1CjNndXBKWlRGVGE3N3EwNDV0T2U0WXdweEhhOEhmVnMyMFZlTU4xSzE4bnpmaVpxelBHRzYvTlR0RUZhWUNnTm0KekV3WE9QVjNLY3RrSmR5SDlJc0t0aGtzekk5dGE4eFdza3VnbGFhRmpURm8vWmJQRUhQRWJjU0N2SjdJSk02ZQpLUHVEV3ZUUTVDVnBkMGxmbkNKcTNpYnFNbzBYbW5qdkRJRzdSalRMVDlGNGFjaWNIdDBSYTFhelkxcTZxOWE5ClVmK3M2L0pPNmJxQUs5bkdlMW5mVkp4Qlk0anpKVVdQQW9yaWxqUVhtb0ZscVRvak9PZWQ2VVU3NERnWFNrcVIKZlRrekFlY1ViMWtnVWk3VkhXRkJobzR0OHlnUVV0dEpuUXBLRXdJREFRQUJBb0lCQURVTzcyVVJwK2x0WjVGMgpWdmJIOWpuSFV2UXpWYTJKcFA0ZTd5WEtBZ1hwbFpWYXdHNG9ZamxudUtjbkRUVC9JWHgyODBUeEl6YWI0TGJPCm5VbVNOemJQWjRucFFHbFEvVXBQL2Y3UXFyWUQzNDN6R0Z4elh3Y0trdHRKZ0V2MW82ZnRDN3huUjFIcFN6ZFIKUFJMcDN0SmxzdW1ZejRkenZXbVVmRlJBaGI0Zlk3dmdmM0hCK2VEc21oQjF0eUE4UmFwT1RjR2FTckkxK0J1NgpyMVVqYTVpM24vMlhNRUw4OCtrNDRBOUE0elBINUVxUEFtNFdhS1ViWEtSTGYrWTUwZ29jV04rMFRpTFV2eFhBCjlFcE1WR1VGNHo2Q25SUEV2NmJGSmVZcGlaQUdBNXlYY0Fqa0lzU3VQQ1ZOS1RLLzROWEN0aVNlczJNSndjZFEKays4MHp6RUNnWUVBNlUxTmR2UkU3dExqRncvTDAvcnBmNDI1ZnNWWm4xRC85d050UEhqVGtvSmFmdXVjNjZiMwo1R1hjR1VUcEhEeXgwMDdWZ3FuaTJva3NObzhWWTdZQzUrWDlWd1RRclZhdmpCREYwa3BhblZNVndhWlpxT3I2ClFOeXdnd2lSMURWQXlJZVNncW94ckFnbS9iTkpPaWpGdjd4aEdBbm9VNnlXQTltT2I2YU9tZTBDZ1lFQTZEdXcKT0JlTjIwR2liZDZ6QnRzV05XYkJqQ1lqZzdheFJWWFhZK3pyQWhjWmxCUFJuSGJTZXR3TW9xTmYveGxHSmc0awp0VE9sTFhOQ09DVXErM2FuWjZNaEZ4ajJSZ0JtMGNYUUlzSFcyc0pCMDJCcWZtbUZlcWlzODMvRFZWSHBBbjhjCmRDamhJKzJzd1ZOTjk0MUZBUGtjcFdaQ2tadllMc3hYdlNRUDgvOENnWUJXTWRZOTdhK09JT0gvd2psSFB6dUgKZ2NBWHd5Z0NnWFdnT0diaVlhMmhRb0hXeEl2OFVIcmpxbkp2NzVMRWVQUW1Jc2tsZGtpMi90a1Q2emMyMktjbwpNRU95STdoSlltNkhMQ2M2TTNoWkNicFBDbnV6dWVUdGs5dXUvYnFMRVlXMjBNZmplS2ZUYkV1ampkcXZIeU00ClhJdnV5ckpJUDhwSTc5YjlEeWMrWFFLQmdGTXAxTkF4ZHlaV1djRjRwNm5EMlM4a2Joa3ZLemFtdk5LMGk5NkgKNEJ5dWd3VnBGMzR0ZXZCdVRzUUxOM3hWNDY0TEVKQW5QM2FJT09WOFFla3RNNFBFZ2p3UVAxa1FHY0h6VWJhdwpyYTFITldWcHVKa3VWcE4zUmdBbzk1MWRLTkV4RGRKM05UQzFrMURqOFI2K1kwQ1c5UEF5TDVLUE9acUFxTWJkCjNDeW5Bb0dBWDJiV3VoaURKTExmZVFGU3MxaVMxeEdXSDFabXVlYUZETXVqWHVHQ3d3RktwNkVtYnB4V282bHAKZi9EVHpjeEc2Nm4zWHl0d3JWVTF3WlUyR2tiN1JzaVF5amQvb0xQOHZZMEx4UkRQMTNjZWxhNHBwa3o5cXQ1Uwpndy9DaW5MZ1Erd0VVSHZYL2tCT0IwNkdTYWY2bzNUMDB0L2twcG5vV2s0cGRvMmNFVjQ9Ci0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg==" - } -}; -export const Secret_HubbleServerCerts: KubernetesResource = { - apiVersion: "v1", - kind: "Secret", - metadata: { - annotations: null, - labels: { - "cilium.io/helm-template-non-idempotent": "true" - }, - name: "hubble-server-certs", - namespace: "kube-system" - }, - data: { - "ca.crt": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURFekNDQWZ1Z0F3SUJBZ0lRZWo4K0VORUJMdTBHZzZna1B1eFl5VEFOQmdrcWhraUc5dzBCQVFzRkFEQVUKTVJJd0VBWURWUVFERXdsRGFXeHBkVzBnUTBFd0hoY05Nall3T0RFeU1qSXpNREF5V2hjTk1qa3dPREV4TWpJegpNREF5V2pBVU1SSXdFQVlEVlFRREV3bERhV3hwZFcwZ1EwRXdnZ0VpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElCCkR3QXdnZ0VLQW9JQkFRRFRwSE9jNjJxM29VZ1ByRjNSRFhKY3c0WmxnRE5la1ZHc1c5TVRMdFdXS245d0tMbmUKQzZrbGxNVk5ydnVyVGptMDU3aGpDbkVkcndkOVd6YlJWNHczVXJYeWZOK0ptck04WWJyODFPMFFWcGdLQTJiTQpUQmM0OVhjcHkyUWwzSWYwaXdxMkdTek1qMjFyekZheVM2Q1Zwb1dOTVdqOWxzOFFjOFJ0eElLOG5zZ2t6cDRvCis0TmE5TkRrSldsM1NWK2NJbXJlSnVveWpSZWFlTzhNZ2J0R05NdFAwWGhweUp3ZTNSRnJWck5qV3JxcjFyMVIKLzZ6cjhrN3B1b0FyMmNaN1dkOVVuRUZqaVBNbFJZOENpdUtXTkJlYWdXV3BPaU00NTUzcFJUdmdPQmRLU3BGOQpPVE1CNXhSdldTQlNMdFVkWVVHR2ppM3pLQkJTMjBtZENrb1RBZ01CQUFHallUQmZNQTRHQTFVZER3RUIvd1FFCkF3SUNwREFkQmdOVkhTVUVGakFVQmdnckJnRUZCUWNEQVFZSUt3WUJCUVVIQXdJd0R3WURWUjBUQVFIL0JBVXcKQXdFQi96QWRCZ05WSFE0RUZnUVUrMnFyZXdBejRXREptZnNBVW9MVm9wQzBXR2d3RFFZSktvWklodmNOQVFFTApCUUFEZ2dFQkFHb2xLZFljNGJ2VjR2b1RyRnNvMHF3YklBQlREc09xdU9mVURqM3NWb0VCS2hXUHQ5TUI3WVBNCnJBL2NGZTA0bTR1Zk1sT29RdDdlOWtmbVJjK2Z2VUpucFZ6aXFHQWhnZFBTVWt0eGdQOHl5Q3hLVVJVeGdPT3MKNUFoM3dWazBDdDFOY24xYVpXU3R1NDQ0SEppbko0QllESkNpQ1ZESTJaRjlQaWo5WFZlSnp5TUlUSHptSEpaSgp6MU9xV2s3aXhYZnJUYnRwTkxWekY0Z21TV1Y5cXYwNklvczVrRFVXVFZ3bUtMKzNZZ3U4elR3dk10MFl1ak5UCjROeWRaTzNVditYUnBLaTgwVE02dzlXVUIyZUtQRSs4NDVhcC8rUWZ1ZThrMzVFaVZ4NTlWWGJ0SFJuWHRBLzEKYURhLzROcmlTNVZGZjNxU0hBd2RienRta3YramtMdz0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=", - "tls.crt": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURWekNDQWorZ0F3SUJBZ0lSQUs1ekJsSktTQzNUcGlGRmcyNnBZbWN3RFFZSktvWklodmNOQVFFTEJRQXcKRkRFU01CQUdBMVVFQXhNSlEybHNhWFZ0SUVOQk1CNFhEVEkyTURneE1qSXlNekF3TWxvWERUSTNNRGd4TWpJeQpNekF3TWxvd0tqRW9NQ1lHQTFVRUF3d2ZLaTVrWldaaGRXeDBMbWgxWW1Kc1pTMW5jbkJqTG1OcGJHbDFiUzVwCmJ6Q0NBU0l3RFFZSktvWklodmNOQVFFQkJRQURnZ0VQQURDQ0FRb0NnZ0VCQU5NUEdPckUzR01aOGNXbUxXcGkKSVhjbkhQNnJEWTI1NFl2NW9WM3pQVU5QdzBNcFE1ZzJlK0dlL1dzdGw2T2ZoTWdlYVFaMjVaZTZLU3k1dkpvQwpqTEo3eDZaL3AxMFA2SzVWK3pBRnRTVkd2T096d29SNnQ2emtaWkpnK1dxZVZJc3REdGZXL2I3MXZpbURJTUkxCmc4dHRITTV1U1UrWEFVZlBnSngwVFJMMTQ2ZlRpU0xFN0R4emVkTWs1dHovTDZPaUlPRXN0bklyWUgyNkhNdmEKYWxzbTNMQktnK09KL001U0xDR2tVWk5TT2ROYmZuT1gvQ05uNElER2pjQnRCRG5sclpqVHVpSDhUdTdtYXpnMAp2WVJQbVRjZXdRVzJBMWlHUkhScFM5a083WkJ3RHFwTzUxSzd1VUR4QUVuajFNWnQ3ajZIblB5VVBTMFZXaUlECm4zMENBd0VBQWFPQmpUQ0JpakFPQmdOVkhROEJBZjhFQkFNQ0JhQXdIUVlEVlIwbEJCWXdGQVlJS3dZQkJRVUgKQXdFR0NDc0dBUVVGQndNQ01Bd0dBMVVkRXdFQi93UUNNQUF3SHdZRFZSMGpCQmd3Rm9BVSsycXJld0F6NFdESgptZnNBVW9MVm9wQzBXR2d3S2dZRFZSMFJCQ013SVlJZktpNWtaV1poZFd4MExtaDFZbUpzWlMxbmNuQmpMbU5wCmJHbDFiUzVwYnpBTkJna3Foa2lHOXcwQkFRc0ZBQU9DQVFFQXFsWWNNNFFtYzBsckpBb2xCbHpReisvNFJMa08KV2ZoTVR2bGFyQ0NtMUlnY3pmR1VxVG9NODU4V3MzcDgxZmZUcjlldHFIZzNEZzRWTUcrTFUxWk80d0pvYTBscApjV2Nhb1ZiSVFTSDJ3dmFJTGhqakd3aTlpR3FKYnIyUjJWdUxQMUZ2aEhyejNvR2hxMkVBV2hlOVlXZGlBM3RVCmlUTmRaWVhOdXUxZExTaWw2aEsxSkljS0lJVURhMllxUFFCNjcvRHFyN294Ri9peTF5VEpzaTV2ckdRdnlzbXAKQkg2cXptODh4bk1HTXF4OXBEUmpqN01jK2RLLzliaHplOVdUT2VxTlUzQlJNM3dIRHlDd1IxN3pXNFNQUFBDRwpVR2VEVUVXRVVVV2FUYUFnL0MrOHhhOEUvSFhZeHNVQndXQVBGM1h6QVFVY3JXYkpaN1JFNmJLRTdBPT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=", - "tls.key": "LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb3dJQkFBS0NBUUVBMHc4WTZzVGNZeG54eGFZdGFtSWhkeWNjL3FzTmpibmhpL21oWGZNOVEwL0RReWxECm1EWjc0Wjc5YXkyWG81K0V5QjVwQm5ibGw3b3BMTG04bWdLTXNudkhwbituWFEvb3JsWDdNQVcxSlVhODQ3UEMKaEhxM3JPUmxrbUQ1YXA1VWl5ME8xOWI5dnZXK0tZTWd3aldEeTIwY3ptNUpUNWNCUjgrQW5IUk5FdlhqcDlPSgpJc1RzUEhONTB5VG0zUDh2bzZJZzRTeTJjaXRnZmJvY3k5cHFXeWJjc0VxRDQ0bjh6bElzSWFSUmsxSTUwMXQrCmM1ZjhJMmZnZ01hTndHMEVPZVd0bU5PNklmeE83dVpyT0RTOWhFK1pOeDdCQmJZRFdJWkVkR2xMMlE3dGtIQU8KcWs3blVydTVRUEVBU2VQVXhtM3VQb2VjL0pROUxSVmFJZ09mZlFJREFRQUJBb0lCQUVmSmc4MGVobU9DeUpSVQprRy8xenJJcmNKWkNjZ3E1cGJpcGdMUm03bmg5b2Ntdk9GbUdkcDVvS0lRUzd0ZnRnd2xhSnBqWFNnSlFoSDY4CjhpUmtKNXp4c3hlenBhWm1xZHJhVGVTb25GT0FldkRzRElacEF4NWdWUmZ6dWdJRXRuYmNMWWRHamVvc3hiQnkKOUdwNkwwaTY1U2hscExQWWhjdjZEU0dxQVNrb01TR29CY2VMaSt4Nno0NWEzL1dSZ1F1R0JLU09iL0VPUU1vWQpBdm80NVJVSTNvMnpUTnBsTVBBd0lvMkV5OExRaFQxNHdKeitjdEcwZldtRlpCeS9kd01nRGdJc0xUd1JxbWdqCmJvam5DSWxlcDdqOVpRTmFRVTg2R3ZLMytEZWpYZUxyc2lKRFg2SEVVZksyaVMrQnVjZWMvdzNPMmphdlBxU0EKOVBEUVVsVUNnWUVBOUllQkVmL3pPUkxoRk1QZWVJaEVuN3AycFB1Q1ZpT0IrSjZzb1JKdmhGVmU5SUs3VTJLcwpNaGJONmJJK09iUGFOTHdFQ05IVUlGbThsN0JrbURGVUxkaFBtbGFGeDhRSUI3NFhoRnhCZkUySGpESjMyaFZpClNnZCtQaGpJUStsM3RyK3VlTitGNFFmMXZWUUhSVGljajJsbHZacGUxb3dZR2trZmRUUS9ROHNDZ1lFQTNQV24KMWZmWEx4MGpJZ2pUMEFCTkc3WDF2dzAza21XVkhVOXJPdWRBNVhqZC93eG54NnBRTWpqT3krNVlEbGhsbkJQUQo1U2tOSHJxWkVaaTdNcGpsNndqeXpKZXdkS3EwdXFoYURSd3RIcS9rOGRhcXR3UmRSWGVnTnY4aVdNR3JTMTZNClR1QkhRRjRMZXRRTEtjUURFcTI1YnZWSld6YmZwVFVkUWdOUEVOY0NnWUVBd2puTExGZm5nZ0xiNHhsODRMSWsKQjljY25Bamx5ck9qYmEzaklvRTVNSng2c3E0UVNyaEtXL0svRll1dFh6bmE3UjRWK2tkb1BWWHB0WGEzUUNlVwpYRisvUXJETXpCS0o2bFJ6NjM4M3lKcndPa3h2NURvdCt1MGV1Z1lITStJQ1k1YTI1MjFyc29VWERJM3N4RytsCjgwZGRONCtoR3JybC9pTHNxTFNhTjZjQ2dZQlFFU1JVUUk3Vkg3WFBhMnQxZitaeEdDcUlwSDF5cXlTeGprbkkKK210bHU3cVY1U1RtRVMwbVJiZUo1a0E2VW9YZlhMN2hpMUtady93YmlFQ3RRUUp2ZkxxZXNJamNmYzhucEVHZApab3hqQmxIcjRHSFVGOXpFZzJpbkJTU3BET1RKVnVWNDM0UnlLcUgyVEVnUFJsdm10TlR4QkNra3lHbWFML2orCkpyekwyUUtCZ0RheDBPL0ZKcHNjVDBoV2RjZ3pVVU1iMUo1UngrQlV2eXp0SVp2ckpmdEdmRnRnUXRhZXNLaFgKS0ZwTlNXMW1yci96TmVhKzVLWnZoYTV1MWtnbVZ5YWRrR3ZZVnpkeTBWajdycTM3TXo1M01qMTJQUTZlTnhzcwo1K0NZd012WVRWR0Z1eTl5b2tDTm0zOENSZTFqSEFjanE0dFN6d2dSd3ArU2h5UDJZSFJvCi0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg==" - }, - type: "kubernetes.io/tls" -}; -export const ConfigMap_CiliumConfig: KubernetesResource = { - apiVersion: "v1", - kind: "ConfigMap", - metadata: { - name: "cilium-config", - namespace: "kube-system" - }, - data: { - "agent-not-ready-taint-key": "node.cilium.io/agent-not-ready", - "auto-direct-node-routes": "false", - "bpf-distributed-lru": "false", - "bpf-events-drop-enabled": "true", - "bpf-events-policy-verdict-enabled": "true", - "bpf-events-trace-enabled": "true", - "bpf-lb-acceleration": "disabled", - "bpf-lb-algorithm-annotation": "false", - "bpf-lb-external-clusterip": "false", - "bpf-lb-map-max": "65536", - "bpf-lb-mode-annotation": "false", - "bpf-lb-sock": "false", - "bpf-lb-source-range-all-types": "false", - "bpf-map-dynamic-size-ratio": "0.0025", - "bpf-policy-map-max": "16384", - "bpf-policy-stats-map-max": "65536", - "bpf-root": "/sys/fs/bpf", - "cgroup-root": "/run/cilium/cgroupv2", - "cilium-endpoint-gc-interval": "5m0s", - "cluster-id": "0", - "cluster-name": "default", - "cluster-pool-ipv4-cidr": "10.0.0.0/8", - "cluster-pool-ipv4-mask-size": "24", - "clustermesh-cache-ttl": "0s", - "clustermesh-enable-endpoint-sync": "false", - "clustermesh-enable-mcs-api": "false", - "clustermesh-mcs-api-install-crds": "true", - "cni-exclusive": "true", - "cni-log-file": "/var/run/cilium/cilium-cni.log", - "custom-cni-conf": "false", - "datapath-mode": "veth", - debug: "false", - "default-lb-service-ipam": "lbipam", - "direct-routing-skip-unreachable": "false", - "dnsproxy-enable-transparent-mode": "true", - "dnsproxy-socket-linger-timeout": "10", - "egress-gateway-reconciliation-trigger-interval": "1s", - "enable-auto-protect-node-port-range": "true", - "enable-bpf-clock-probe": "false", - "enable-drift-checker": "true", - "enable-dynamic-config": "true", - "enable-endpoint-health-checking": "true", - "enable-endpoint-lockdown-on-policy-overflow": "false", - "enable-health-check-loadbalancer-ip": "false", - "enable-health-check-nodeport": "true", - "enable-health-checking": "true", - "enable-hubble": "true", - "enable-ipv4": "true", - "enable-ipv4-big-tcp": "false", - "enable-ipv4-masquerade": "true", - "enable-ipv6": "false", - "enable-ipv6-big-tcp": "false", - "enable-ipv6-masquerade": "true", - "enable-k8s-networkpolicy": "true", - "enable-l2-neigh-discovery": "false", - "enable-l7-proxy": "true", - "enable-lb-ipam": "true", - "enable-masquerade-to-route-source": "false", - "enable-metrics": "true", - "enable-no-service-endpoints-routable": "true", - "enable-node-selector-labels": "false", - "enable-non-default-deny-policies": "true", - "enable-policy": "default", - "enable-policy-secrets-sync": "true", - "enable-sctp": "false", - "enable-service-topology": "false", - "enable-source-ip-verification": "true", - "enable-tcx": "true", - "enable-vtep": "false", - "enable-well-known-identities": "false", - "enable-xt-socket-fallback": "true", - "envoy-access-log-buffer-size": "4096", - "envoy-base-id": "0", - "envoy-keep-cap-netbindservice": "false", - "external-envoy-proxy": "true", - "health-check-icmp-failure-threshold": "3", - "http-retry-count": "3", - "http-stream-idle-timeout": "300", - "hubble-disable-tls": "false", - "hubble-listen-address": ":4244", - "hubble-network-policy-correlation-enabled": "true", - "hubble-socket-path": "/var/run/cilium/hubble.sock", - "hubble-tls-cert-file": "/var/lib/cilium/tls/hubble/server.crt", - "hubble-tls-client-ca-files": "/var/lib/cilium/tls/hubble/client-ca.crt", - "hubble-tls-key-file": "/var/lib/cilium/tls/hubble/server.key", - "identity-allocation-mode": "crd", - "identity-gc-interval": "15m0s", - "identity-heartbeat-timeout": "30m0s", - "identity-management-mode": "agent", - "install-no-conntrack-iptables-rules": "false", - ipam: "cluster-pool", - "ipam-cilium-node-update-rate": "15s", - "iptables-random-fully": "false", - "k8s-require-ipv4-pod-cidr": "false", - "k8s-require-ipv6-pod-cidr": "false", - "kube-proxy-replacement": "false", - "max-connected-clusters": "255", - "mesh-auth-enabled": "false", - "mesh-auth-gc-interval": "5m0s", - "mesh-auth-queue-size": "1024", - "mesh-auth-rotated-identities-queue-size": "1024", - "metrics-sampling-interval": "5m", - "monitor-aggregation": "medium", - "monitor-aggregation-flags": "all", - "monitor-aggregation-interval": "5s", - "nat-map-stats-entries": "32", - "nat-map-stats-interval": "30s", - "node-port-bind-protection": "true", - "nodes-gc-interval": "5m0s", - "operator-api-serve-addr": "127.0.0.1:9234", - "operator-prometheus-serve-addr": ":9963", - "packetization-layer-pmtud-mode": "blackhole", - "policy-default-local-cluster": "true", - "policy-deny-response": "none", - "policy-secrets-namespace": "cilium-secrets", - "policy-secrets-only-from-secrets-namespace": "true", - "preallocate-bpf-maps": "false", - procfs: "/host/proc", - "proxy-cluster-max-connections": "1024", - "proxy-cluster-max-requests": "1024", - "proxy-connect-timeout": "2", - "proxy-idle-timeout-seconds": "60", - "proxy-initial-fetch-timeout": "30", - "proxy-max-active-downstream-connections": "50000", - "proxy-max-concurrent-retries": "128", - "proxy-max-connection-duration-seconds": "0", - "proxy-max-requests-per-connection": "0", - "proxy-use-original-source-address": "true", - "proxy-xff-num-trusted-hops-egress": "0", - "proxy-xff-num-trusted-hops-ingress": "0", - "remove-cilium-node-taints": "true", - "routing-mode": "tunnel", - "service-no-backend-response": "reject", - "set-cilium-is-up-condition": "true", - "set-cilium-node-taints": "true", - "synchronize-k8s-nodes": "true", - "tofqdns-dns-reject-response-code": "refused", - "tofqdns-enable-dns-compression": "true", - "tofqdns-endpoint-max-ip-per-hostname": "1000", - "tofqdns-idle-connection-grace-period": "0s", - "tofqdns-max-deferred-connection-deletes": "10000", - "tofqdns-preallocate-identities": "true", - "tofqdns-proxy-response-max-delay": "100ms", - "tunnel-protocol": "vxlan", - "tunnel-source-port-range": "0-0", - "unmanaged-pod-watcher-interval": "15s", - "vtep-cidr": "", - "vtep-endpoint": "", - "vtep-mac": "", - "vtep-mask": "", - "write-cni-conf-when-ready": "/host/etc/cni/net.d/05-cilium.conflist" - } -}; -export const ConfigMap_CiliumEnvoyConfig: KubernetesResource = { - apiVersion: "v1", - kind: "ConfigMap", - metadata: { - name: "cilium-envoy-config", - namespace: "kube-system" - }, - data: { - "bootstrap-config.json": "{\"admin\":{\"address\":{\"pipe\":{\"mode\":432,\"path\":\"/var/run/cilium/envoy/sockets/admin.sock\"}}},\"applicationLogConfig\":{\"logFormat\":{\"textFormat\":\"[%Y-%m-%d %T.%e][%t][%l][%n] [%g:%#] %v\"}},\"bootstrapExtensions\":[{\"name\":\"envoy.bootstrap.internal_listener\",\"typedConfig\":{\"@type\":\"type.googleapis.com/envoy.extensions.bootstrap.internal_listener.v3.InternalListener\"}}],\"dynamicResources\":{\"cdsConfig\":{\"apiConfigSource\":{\"apiType\":\"GRPC\",\"grpcServices\":[{\"envoyGrpc\":{\"clusterName\":\"xds-grpc-cilium\"}}],\"setNodeOnFirstMessageOnly\":true,\"transportApiVersion\":\"V3\"},\"initialFetchTimeout\":\"30s\",\"resourceApiVersion\":\"V3\"},\"ldsConfig\":{\"apiConfigSource\":{\"apiType\":\"GRPC\",\"grpcServices\":[{\"envoyGrpc\":{\"clusterName\":\"xds-grpc-cilium\"}}],\"setNodeOnFirstMessageOnly\":true,\"transportApiVersion\":\"V3\"},\"initialFetchTimeout\":\"30s\",\"resourceApiVersion\":\"V3\"}},\"node\":{\"cluster\":\"ingress-cluster\",\"id\":\"host~127.0.0.1~no-id~localdomain\"},\"overloadManager\":{\"resourceMonitors\":[{\"name\":\"envoy.resource_monitors.global_downstream_max_connections\",\"typedConfig\":{\"@type\":\"type.googleapis.com/envoy.extensions.resource_monitors.downstream_connections.v3.DownstreamConnectionsConfig\",\"max_active_downstream_connections\":\"50000\"}}]},\"staticResources\":{\"clusters\":[{\"circuitBreakers\":{\"thresholds\":[{\"maxConnections\":1024,\"maxRequests\":1024,\"maxRetries\":128}]},\"cleanupInterval\":\"2.500s\",\"connectTimeout\":\"2s\",\"lbPolicy\":\"CLUSTER_PROVIDED\",\"name\":\"ingress-cluster\",\"type\":\"ORIGINAL_DST\",\"typedExtensionProtocolOptions\":{\"envoy.extensions.upstreams.http.v3.HttpProtocolOptions\":{\"@type\":\"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\",\"commonHttpProtocolOptions\":{\"idleTimeout\":\"60s\",\"maxConnectionDuration\":\"0s\",\"maxRequestsPerConnection\":0},\"useDownstreamProtocolConfig\":{}}}},{\"circuitBreakers\":{\"thresholds\":[{\"maxConnections\":1024,\"maxRequests\":1024,\"maxRetries\":128}]},\"cleanupInterval\":\"2.500s\",\"connectTimeout\":\"2s\",\"lbPolicy\":\"CLUSTER_PROVIDED\",\"name\":\"egress-cluster-tls\",\"transportSocket\":{\"name\":\"cilium.tls_wrapper\",\"typedConfig\":{\"@type\":\"type.googleapis.com/cilium.UpstreamTlsWrapperContext\"}},\"type\":\"ORIGINAL_DST\",\"typedExtensionProtocolOptions\":{\"envoy.extensions.upstreams.http.v3.HttpProtocolOptions\":{\"@type\":\"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\",\"commonHttpProtocolOptions\":{\"idleTimeout\":\"60s\",\"maxConnectionDuration\":\"0s\",\"maxRequestsPerConnection\":0},\"upstreamHttpProtocolOptions\":{},\"useDownstreamProtocolConfig\":{}}}},{\"circuitBreakers\":{\"thresholds\":[{\"maxConnections\":1024,\"maxRequests\":1024,\"maxRetries\":128}]},\"cleanupInterval\":\"2.500s\",\"connectTimeout\":\"2s\",\"lbPolicy\":\"CLUSTER_PROVIDED\",\"name\":\"egress-cluster\",\"type\":\"ORIGINAL_DST\",\"typedExtensionProtocolOptions\":{\"envoy.extensions.upstreams.http.v3.HttpProtocolOptions\":{\"@type\":\"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\",\"commonHttpProtocolOptions\":{\"idleTimeout\":\"60s\",\"maxConnectionDuration\":\"0s\",\"maxRequestsPerConnection\":0},\"useDownstreamProtocolConfig\":{}}}},{\"circuitBreakers\":{\"thresholds\":[{\"maxConnections\":1024,\"maxRequests\":1024,\"maxRetries\":128}]},\"cleanupInterval\":\"2.500s\",\"connectTimeout\":\"2s\",\"lbPolicy\":\"CLUSTER_PROVIDED\",\"name\":\"ingress-cluster-tls\",\"transportSocket\":{\"name\":\"cilium.tls_wrapper\",\"typedConfig\":{\"@type\":\"type.googleapis.com/cilium.UpstreamTlsWrapperContext\"}},\"type\":\"ORIGINAL_DST\",\"typedExtensionProtocolOptions\":{\"envoy.extensions.upstreams.http.v3.HttpProtocolOptions\":{\"@type\":\"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\",\"commonHttpProtocolOptions\":{\"idleTimeout\":\"60s\",\"maxConnectionDuration\":\"0s\",\"maxRequestsPerConnection\":0},\"upstreamHttpProtocolOptions\":{},\"useDownstreamProtocolConfig\":{}}}},{\"connectTimeout\":\"2s\",\"loadAssignment\":{\"clusterName\":\"xds-grpc-cilium\",\"endpoints\":[{\"lbEndpoints\":[{\"endpoint\":{\"address\":{\"pipe\":{\"path\":\"/var/run/cilium/envoy/sockets/xds.sock\"}}}}]}]},\"name\":\"xds-grpc-cilium\",\"type\":\"STATIC\",\"typedExtensionProtocolOptions\":{\"envoy.extensions.upstreams.http.v3.HttpProtocolOptions\":{\"@type\":\"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\",\"explicitHttpConfig\":{\"http2ProtocolOptions\":{}}}}},{\"connectTimeout\":\"2s\",\"loadAssignment\":{\"clusterName\":\"/envoy-admin\",\"endpoints\":[{\"lbEndpoints\":[{\"endpoint\":{\"address\":{\"pipe\":{\"path\":\"/var/run/cilium/envoy/sockets/admin.sock\"}}}}]}]},\"name\":\"/envoy-admin\",\"type\":\"STATIC\"}],\"listeners\":[{\"address\":{\"socketAddress\":{\"address\":\"0.0.0.0\",\"portValue\":9964}},\"filterChains\":[{\"filters\":[{\"name\":\"envoy.filters.network.http_connection_manager\",\"typedConfig\":{\"@type\":\"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\",\"httpFilters\":[{\"name\":\"envoy.filters.http.router\",\"typedConfig\":{\"@type\":\"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\"}}],\"internalAddressConfig\":{\"cidrRanges\":[{\"addressPrefix\":\"10.0.0.0\",\"prefixLen\":8},{\"addressPrefix\":\"172.16.0.0\",\"prefixLen\":12},{\"addressPrefix\":\"192.168.0.0\",\"prefixLen\":16},{\"addressPrefix\":\"127.0.0.1\",\"prefixLen\":32}]},\"routeConfig\":{\"virtualHosts\":[{\"domains\":[\"*\"],\"name\":\"prometheus_metrics_route\",\"routes\":[{\"match\":{\"prefix\":\"/metrics\"},\"name\":\"prometheus_metrics_route\",\"route\":{\"cluster\":\"/envoy-admin\",\"prefixRewrite\":\"/stats/prometheus\"}}]}]},\"statPrefix\":\"envoy-prometheus-metrics-listener\",\"streamIdleTimeout\":\"300s\"}}]}],\"name\":\"envoy-prometheus-metrics-listener\"},{\"address\":{\"socketAddress\":{\"address\":\"127.0.0.1\",\"portValue\":9878}},\"filterChains\":[{\"filters\":[{\"name\":\"envoy.filters.network.http_connection_manager\",\"typedConfig\":{\"@type\":\"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\",\"httpFilters\":[{\"name\":\"envoy.filters.http.router\",\"typedConfig\":{\"@type\":\"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\"}}],\"internalAddressConfig\":{\"cidrRanges\":[{\"addressPrefix\":\"10.0.0.0\",\"prefixLen\":8},{\"addressPrefix\":\"172.16.0.0\",\"prefixLen\":12},{\"addressPrefix\":\"192.168.0.0\",\"prefixLen\":16},{\"addressPrefix\":\"127.0.0.1\",\"prefixLen\":32}]},\"routeConfig\":{\"virtual_hosts\":[{\"domains\":[\"*\"],\"name\":\"health\",\"routes\":[{\"match\":{\"prefix\":\"/healthz\"},\"name\":\"health\",\"route\":{\"cluster\":\"/envoy-admin\",\"prefixRewrite\":\"/ready\"}}]}]},\"statPrefix\":\"envoy-health-listener\",\"streamIdleTimeout\":\"300s\"}}]}],\"name\":\"envoy-health-listener\"}]}}\n" - } -}; -export const ClusterRole_Cilium: KubernetesResource = { - apiVersion: "rbac.authorization.k8s.io/v1", - kind: "ClusterRole", - metadata: { - labels: { - "app.kubernetes.io/part-of": "cilium" - }, - name: "cilium" - }, - rules: [{ - apiGroups: ["networking.k8s.io"], - resources: ["networkpolicies"], - verbs: ["get", "list", "watch"] - }, { - apiGroups: ["discovery.k8s.io"], - resources: ["endpointslices"], - verbs: ["get", "list", "watch"] - }, { - apiGroups: [""], - resources: ["namespaces", "services", "pods", "endpoints", "nodes"], - verbs: ["get", "list", "watch"] - }, { - apiGroups: ["apiextensions.k8s.io"], - resources: ["customresourcedefinitions"], - verbs: ["list", "watch", "get"] - }, { - apiGroups: ["cilium.io"], - resources: ["ciliumloadbalancerippools", "ciliumbgppeeringpolicies", "ciliumbgpnodeconfigs", "ciliumbgpadvertisements", "ciliumbgppeerconfigs", "ciliumclusterwideenvoyconfigs", "ciliumclusterwidenetworkpolicies", "ciliumegressgatewaypolicies", "ciliumendpoints", "ciliumendpointslices", "ciliumenvoyconfigs", "ciliumidentities", "ciliumlocalredirectpolicies", "ciliumnetworkpolicies", "ciliumnodes", "ciliumnodeconfigs", "ciliumcidrgroups", "ciliuml2announcementpolicies", "ciliumpodippools"], - verbs: ["list", "watch"] - }, { - apiGroups: ["cilium.io"], - resources: ["ciliumidentities", "ciliumendpoints", "ciliumnodes"], - verbs: ["create"] - }, { - apiGroups: ["cilium.io"], - resources: ["ciliumidentities"], - verbs: ["update"] - }, { - apiGroups: ["cilium.io"], - resources: ["ciliumendpoints"], - verbs: ["delete", "get"] - }, { - apiGroups: ["cilium.io"], - resources: ["ciliumnodes", "ciliumnodes/status"], - verbs: ["get", "update"] - }, { - apiGroups: ["cilium.io"], - resources: ["ciliumendpoints/status", "ciliumendpoints", "ciliuml2announcementpolicies/status", "ciliumbgpnodeconfigs/status"], - verbs: ["patch"] - }] -}; -export const ClusterRole_CiliumOperator: KubernetesResource = { - apiVersion: "rbac.authorization.k8s.io/v1", - kind: "ClusterRole", - metadata: { - labels: { - "app.kubernetes.io/part-of": "cilium" - }, - name: "cilium-operator" - }, - rules: [{ - apiGroups: [""], - resources: ["pods"], - verbs: ["get", "list", "watch", "delete"] - }, { - apiGroups: [""], - resourceNames: ["cilium-config"], - resources: ["configmaps"], - verbs: ["patch"] - }, { - apiGroups: [""], - resources: ["nodes"], - verbs: ["list", "watch"] - }, { - apiGroups: [""], - resources: ["nodes", "nodes/status"], - verbs: ["patch"] - }, { - apiGroups: ["discovery.k8s.io"], - resources: ["endpointslices"], - verbs: ["get", "list", "watch"] - }, { - apiGroups: [""], - resources: ["services/status"], - verbs: ["update", "patch"] - }, { - apiGroups: [""], - resources: ["namespaces", "secrets"], - verbs: ["get", "list", "watch"] - }, { - apiGroups: [""], - resources: ["services", "endpoints"], - verbs: ["get", "list", "watch"] - }, { - apiGroups: ["cilium.io"], - resources: ["ciliumnetworkpolicies", "ciliumclusterwidenetworkpolicies"], - verbs: ["create", "update", "deletecollection", "patch", "get", "list", "watch"] - }, { - apiGroups: ["cilium.io"], - resources: ["ciliumnetworkpolicies/status", "ciliumclusterwidenetworkpolicies/status"], - verbs: ["patch", "update"] - }, { - apiGroups: ["cilium.io"], - resources: ["ciliumendpoints", "ciliumidentities"], - verbs: ["delete", "list", "watch"] - }, { - apiGroups: ["cilium.io"], - resources: ["ciliumidentities"], - verbs: ["update"] - }, { - apiGroups: ["cilium.io"], - resources: ["ciliumnodes"], - verbs: ["create", "update", "get", "list", "watch", "delete"] - }, { - apiGroups: ["cilium.io"], - resources: ["ciliumnodes/status"], - verbs: ["update"] - }, { - apiGroups: ["cilium.io"], - resources: ["ciliumendpointslices", "ciliumenvoyconfigs", "ciliumbgppeerconfigs", "ciliumbgpadvertisements", "ciliumbgpnodeconfigs"], - verbs: ["create", "update", "get", "list", "watch", "delete", "patch"] - }, { - apiGroups: ["cilium.io"], - resources: ["ciliumbgpclusterconfigs/status", "ciliumbgppeerconfigs/status"], - verbs: ["update"] - }, { - apiGroups: ["apiextensions.k8s.io"], - resources: ["customresourcedefinitions"], - verbs: ["create", "get", "list", "watch"] - }, { - apiGroups: ["apiextensions.k8s.io"], - resourceNames: ["ciliumloadbalancerippools.cilium.io", "ciliumbgpclusterconfigs.cilium.io", "ciliumbgppeerconfigs.cilium.io", "ciliumbgpadvertisements.cilium.io", "ciliumbgpnodeconfigs.cilium.io", "ciliumbgpnodeconfigoverrides.cilium.io", "ciliumclusterwideenvoyconfigs.cilium.io", "ciliumclusterwidenetworkpolicies.cilium.io", "ciliumegressgatewaypolicies.cilium.io", "ciliumendpoints.cilium.io", "ciliumendpointslices.cilium.io", "ciliumenvoyconfigs.cilium.io", "ciliumidentities.cilium.io", "ciliumlocalredirectpolicies.cilium.io", "ciliumnetworkpolicies.cilium.io", "ciliumnodes.cilium.io", "ciliumnodeconfigs.cilium.io", "ciliumcidrgroups.cilium.io", "ciliuml2announcementpolicies.cilium.io", "ciliumpodippools.cilium.io", "ciliumgatewayclassconfigs.cilium.io"], - resources: ["customresourcedefinitions"], - verbs: ["update"] - }, { - apiGroups: ["cilium.io"], - resources: ["ciliumloadbalancerippools", "ciliumpodippools", "ciliumbgppeeringpolicies", "ciliumbgpclusterconfigs", "ciliumbgpnodeconfigoverrides", "ciliumbgppeerconfigs"], - verbs: ["get", "list", "watch"] - }, { - apiGroups: ["cilium.io"], - resources: ["ciliumpodippools"], - verbs: ["create"] - }, { - apiGroups: ["cilium.io"], - resources: ["ciliumloadbalancerippools/status"], - verbs: ["patch"] - }, { - apiGroups: ["coordination.k8s.io"], - resources: ["leases"], - verbs: ["create", "get", "update"] - }, { - apiGroups: ["cilium.io"], - resources: ["ciliumendpointslices"], - verbs: ["deletecollection"] - }] -}; -export const ClusterRoleBinding_Cilium: KubernetesResource = { - apiVersion: "rbac.authorization.k8s.io/v1", - kind: "ClusterRoleBinding", - metadata: { - labels: { - "app.kubernetes.io/part-of": "cilium" - }, - name: "cilium" - }, - roleRef: { - apiGroup: "rbac.authorization.k8s.io", - kind: "ClusterRole", - name: "cilium" - }, - subjects: [{ - kind: "ServiceAccount", - name: "cilium", - namespace: "kube-system" - }] -}; -export const ClusterRoleBinding_CiliumOperator: KubernetesResource = { - apiVersion: "rbac.authorization.k8s.io/v1", - kind: "ClusterRoleBinding", - metadata: { - labels: { - "app.kubernetes.io/part-of": "cilium" - }, - name: "cilium-operator" - }, - roleRef: { - apiGroup: "rbac.authorization.k8s.io", - kind: "ClusterRole", - name: "cilium-operator" - }, - subjects: [{ - kind: "ServiceAccount", - name: "cilium-operator", - namespace: "kube-system" - }] -}; -export const Role_CiliumConfigAgent: KubernetesResource = { - apiVersion: "rbac.authorization.k8s.io/v1", - kind: "Role", - metadata: { - labels: { - "app.kubernetes.io/part-of": "cilium" - }, - name: "cilium-config-agent", - namespace: "kube-system" - }, - rules: [{ - apiGroups: [""], - resources: ["configmaps"], - verbs: ["get", "list", "watch"] - }] -}; -export const Role_CiliumTlsinterceptionSecrets: KubernetesResource = { - apiVersion: "rbac.authorization.k8s.io/v1", - kind: "Role", - metadata: { - labels: { - "app.kubernetes.io/part-of": "cilium" - }, - name: "cilium-tlsinterception-secrets", - namespace: "cilium-secrets" - }, - rules: [{ - apiGroups: [""], - resources: ["secrets"], - verbs: ["get", "list", "watch"] - }] -}; -export const Role_CiliumOperatorTlsinterceptionSecrets: KubernetesResource = { - apiVersion: "rbac.authorization.k8s.io/v1", - kind: "Role", - metadata: { - labels: { - "app.kubernetes.io/part-of": "cilium" - }, - name: "cilium-operator-tlsinterception-secrets", - namespace: "cilium-secrets" - }, - rules: [{ - apiGroups: [""], - resources: ["secrets"], - verbs: ["create", "delete", "update", "patch"] - }] -}; -export const Role_CiliumOperatorZtunnel: KubernetesResource = { - apiVersion: "rbac.authorization.k8s.io/v1", - kind: "Role", - metadata: { - labels: { - "app.kubernetes.io/part-of": "cilium" - }, - name: "cilium-operator-ztunnel", - namespace: "kube-system" - }, - rules: [{ - apiGroups: ["apps"], - resources: ["daemonsets"], - verbs: ["create", "delete", "get", "list", "watch"] - }] -}; -export const RoleBinding_CiliumConfigAgent: KubernetesResource = { - apiVersion: "rbac.authorization.k8s.io/v1", - kind: "RoleBinding", - metadata: { - labels: { - "app.kubernetes.io/part-of": "cilium" - }, - name: "cilium-config-agent", - namespace: "kube-system" - }, - roleRef: { - apiGroup: "rbac.authorization.k8s.io", - kind: "Role", - name: "cilium-config-agent" - }, - subjects: [{ - kind: "ServiceAccount", - name: "cilium", - namespace: "kube-system" - }] -}; -export const RoleBinding_CiliumTlsinterceptionSecrets: KubernetesResource = { - apiVersion: "rbac.authorization.k8s.io/v1", - kind: "RoleBinding", - metadata: { - labels: { - "app.kubernetes.io/part-of": "cilium" - }, - name: "cilium-tlsinterception-secrets", - namespace: "cilium-secrets" - }, - roleRef: { - apiGroup: "rbac.authorization.k8s.io", - kind: "Role", - name: "cilium-tlsinterception-secrets" - }, - subjects: [{ - kind: "ServiceAccount", - name: "cilium", - namespace: "kube-system" - }] -}; -export const RoleBinding_CiliumOperatorTlsinterceptionSecrets: KubernetesResource = { - apiVersion: "rbac.authorization.k8s.io/v1", - kind: "RoleBinding", - metadata: { - labels: { - "app.kubernetes.io/part-of": "cilium" - }, - name: "cilium-operator-tlsinterception-secrets", - namespace: "cilium-secrets" - }, - roleRef: { - apiGroup: "rbac.authorization.k8s.io", - kind: "Role", - name: "cilium-operator-tlsinterception-secrets" - }, - subjects: [{ - kind: "ServiceAccount", - name: "cilium-operator", - namespace: "kube-system" - }] -}; -export const RoleBinding_CiliumOperatorZtunnel: KubernetesResource = { - apiVersion: "rbac.authorization.k8s.io/v1", - kind: "RoleBinding", - metadata: { - labels: { - "app.kubernetes.io/part-of": "cilium" - }, - name: "cilium-operator-ztunnel", - namespace: "kube-system" - }, - roleRef: { - apiGroup: "rbac.authorization.k8s.io", - kind: "Role", - name: "cilium-operator-ztunnel" - }, - subjects: [{ - kind: "ServiceAccount", - name: "cilium-operator", - namespace: "kube-system" - }] -}; -export const Service_CiliumEnvoy: KubernetesResource = { - apiVersion: "v1", - kind: "Service", - metadata: { - annotations: { - "prometheus.io/port": "9964", - "prometheus.io/scrape": "true" - }, - labels: { - "app.kubernetes.io/name": "cilium-envoy", - "app.kubernetes.io/part-of": "cilium", - "io.cilium/app": "proxy", - "k8s-app": "cilium-envoy" - }, - name: "cilium-envoy", - namespace: "kube-system" - }, - spec: { - clusterIP: "None", - ports: [{ - name: "envoy-metrics", - port: 9964, - protocol: "TCP", - targetPort: 9964 - }], - selector: { - "k8s-app": "cilium-envoy" - }, - type: "ClusterIP" - } -}; -export const Service_HubblePeer: KubernetesResource = { - apiVersion: "v1", - kind: "Service", - metadata: { - labels: { - "app.kubernetes.io/name": "hubble-peer", - "app.kubernetes.io/part-of": "cilium", - "k8s-app": "cilium" - }, - name: "hubble-peer", - namespace: "kube-system" - }, - spec: { - internalTrafficPolicy: "Local", - ports: [{ - name: "peer-service", - port: 443, - protocol: "TCP", - targetPort: 4244 - }], - selector: { - "k8s-app": "cilium" - } - } -}; -export const DaemonSet_Cilium: KubernetesResource = { - apiVersion: "apps/v1", - kind: "DaemonSet", - metadata: { - labels: { - "app.kubernetes.io/name": "cilium-agent", - "app.kubernetes.io/part-of": "cilium", - "k8s-app": "cilium" - }, - name: "cilium", - namespace: "kube-system" - }, - spec: { - selector: { - matchLabels: { - "k8s-app": "cilium" - } - }, - template: { - metadata: { - annotations: { - "kubectl.kubernetes.io/default-container": "cilium-agent" - }, - labels: { - "app.kubernetes.io/name": "cilium-agent", - "app.kubernetes.io/part-of": "cilium", - "k8s-app": "cilium" - } - }, - spec: { - affinity: { - podAntiAffinity: { - requiredDuringSchedulingIgnoredDuringExecution: [{ - labelSelector: { - matchLabels: { - "k8s-app": "cilium" - } - }, - topologyKey: "kubernetes.io/hostname" - }] - } - }, - automountServiceAccountToken: true, - containers: [{ - args: ["--config-dir=/tmp/cilium/config-map"], - command: ["cilium-agent"], - env: [{ - name: "K8S_NODE_NAME", - valueFrom: { - fieldRef: { - apiVersion: "v1", - fieldPath: "spec.nodeName" - } - } - }, { - name: "CILIUM_K8S_NAMESPACE", - valueFrom: { - fieldRef: { - apiVersion: "v1", - fieldPath: "metadata.namespace" - } - } - }, { - name: "CILIUM_CLUSTERMESH_CONFIG", - value: "/var/lib/cilium/clustermesh/" - }, { - name: "GOMEMLIMIT", - valueFrom: { - resourceFieldRef: { - divisor: "1", - resource: "limits.memory" - } - } - }, { - name: "KUBE_CLIENT_BACKOFF_BASE", - value: "1" - }, { - name: "KUBE_CLIENT_BACKOFF_DURATION", - value: "120" - }], - image: "quay.io/cilium/cilium:v1.19.5@sha256:20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732", - imagePullPolicy: "IfNotPresent", - lifecycle: { - postStart: { - exec: { - command: ["bash", "-c", "set -o errexit\nset -o pipefail\nset -o nounset\n\n# When running in AWS ENI mode, it's likely that 'aws-node' has\n# had a chance to install SNAT iptables rules. These can result\n# in dropped traffic, so we should attempt to remove them.\n# We do it using a 'postStart' hook since this may need to run\n# for nodes which might have already been init'ed but may still\n# have dangling rules. This is safe because there are no\n# dependencies on anything that is part of the startup script\n# itself, and can be safely run multiple times per node (e.g. in\n# case of a restart).\nif [[ \"$(iptables-save | grep -E -c 'AWS-SNAT-CHAIN|AWS-CONNMARK-CHAIN')\" != \"0\" ]];\nthen\n echo 'Deleting iptables rules created by the AWS CNI VPC plugin'\n iptables-save | grep -E -v 'AWS-SNAT-CHAIN|AWS-CONNMARK-CHAIN' | iptables-restore\nfi\necho 'Done!'\n"] - } - }, - preStop: { - exec: { - command: ["/cni-uninstall.sh"] - } - } - }, - livenessProbe: { - failureThreshold: 10, - httpGet: { - host: "127.0.0.1", - httpHeaders: [{ - name: "brief", - value: "true" - }, { - name: "require-k8s-connectivity", - value: "false" - }], - path: "/healthz", - port: "health", - scheme: "HTTP" - }, - periodSeconds: 30, - successThreshold: 1, - timeoutSeconds: 5 - }, - name: "cilium-agent", - ports: [{ - containerPort: 9879, - hostPort: 9879, - name: "health", - protocol: "TCP" - }, { - containerPort: 4244, - hostPort: 4244, - name: "peer-service", - protocol: "TCP" - }], - readinessProbe: { - failureThreshold: 3, - httpGet: { - host: "127.0.0.1", - httpHeaders: [{ - name: "brief", - value: "true" - }], - path: "/healthz", - port: "health", - scheme: "HTTP" - }, - periodSeconds: 30, - successThreshold: 1, - timeoutSeconds: 5 - }, - securityContext: { - capabilities: { - add: ["CHOWN", "KILL", "NET_ADMIN", "NET_RAW", "IPC_LOCK", "SYS_MODULE", "SYS_ADMIN", "SYS_RESOURCE", "DAC_OVERRIDE", "FOWNER", "SETGID", "SETUID", "SYSLOG"], - drop: ["ALL"] - }, - seLinuxOptions: { - level: "s0", - type: "spc_t" - } - }, - startupProbe: { - failureThreshold: 300, - httpGet: { - host: "127.0.0.1", - httpHeaders: [{ - name: "brief", - value: "true" - }], - path: "/healthz", - port: "health", - scheme: "HTTP" - }, - initialDelaySeconds: 5, - periodSeconds: 2, - successThreshold: 1 - }, - terminationMessagePolicy: "FallbackToLogsOnError", - volumeMounts: [{ - mountPath: "/var/run/cilium/envoy/sockets", - name: "envoy-sockets", - readOnly: false - }, { - mountPath: "/host/proc/sys/net", - name: "host-proc-sys-net" - }, { - mountPath: "/host/proc/sys/kernel", - name: "host-proc-sys-kernel" - }, { - mountPath: "/sys/fs/bpf", - mountPropagation: "HostToContainer", - name: "bpf-maps" - }, { - mountPath: "/var/run/cilium", - name: "cilium-run" - }, { - mountPath: "/var/run/cilium/netns", - mountPropagation: "HostToContainer", - name: "cilium-netns" - }, { - mountPath: "/host/etc/cni/net.d", - name: "etc-cni-netd" - }, { - mountPath: "/var/lib/cilium/clustermesh", - name: "clustermesh-secrets", - readOnly: true - }, { - mountPath: "/lib/modules", - name: "lib-modules", - readOnly: true - }, { - mountPath: "/run/xtables.lock", - name: "xtables-lock" - }, { - mountPath: "/var/lib/cilium/tls/hubble", - name: "hubble-tls", - readOnly: true - }, { - mountPath: "/tmp", - name: "tmp" - }] - }], - hostNetwork: true, - initContainers: [{ - command: ["cilium-dbg", "build-config"], - env: [{ - name: "K8S_NODE_NAME", - valueFrom: { - fieldRef: { - apiVersion: "v1", - fieldPath: "spec.nodeName" - } - } - }, { - name: "CILIUM_K8S_NAMESPACE", - valueFrom: { - fieldRef: { - apiVersion: "v1", - fieldPath: "metadata.namespace" - } - } - }], - image: "quay.io/cilium/cilium:v1.19.5@sha256:20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732", - imagePullPolicy: "IfNotPresent", - name: "config", - securityContext: { - capabilities: { - add: ["NET_ADMIN"], - drop: ["ALL"] - } - }, - terminationMessagePolicy: "FallbackToLogsOnError", - volumeMounts: [{ - mountPath: "/tmp", - name: "tmp" - }] - }, { - command: ["bash", "-ec", "cp /usr/bin/cilium-mount /hostbin/cilium-mount;\nnsenter --cgroup=/hostproc/1/ns/cgroup --mount=/hostproc/1/ns/mnt \"${BIN_PATH}/cilium-mount\" $CGROUP_ROOT;\nrm /hostbin/cilium-mount\n"], - env: [{ - name: "CGROUP_ROOT", - value: "/run/cilium/cgroupv2" - }, { - name: "BIN_PATH", - value: "/opt/cni/bin" - }], - image: "quay.io/cilium/cilium:v1.19.5@sha256:20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732", - imagePullPolicy: "IfNotPresent", - name: "mount-cgroup", - securityContext: { - capabilities: { - add: ["SYS_ADMIN", "SYS_CHROOT", "SYS_PTRACE"], - drop: ["ALL"] - }, - seLinuxOptions: { - level: "s0", - type: "spc_t" - } - }, - terminationMessagePolicy: "FallbackToLogsOnError", - volumeMounts: [{ - mountPath: "/hostproc", - name: "hostproc" - }, { - mountPath: "/hostbin", - name: "cni-path" - }] - }, { - command: ["bash", "-ec", "cp /usr/bin/cilium-sysctlfix /hostbin/cilium-sysctlfix;\nnsenter --mount=/hostproc/1/ns/mnt \"${BIN_PATH}/cilium-sysctlfix\";\nrm /hostbin/cilium-sysctlfix\n"], - env: [{ - name: "BIN_PATH", - value: "/opt/cni/bin" - }], - image: "quay.io/cilium/cilium:v1.19.5@sha256:20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732", - imagePullPolicy: "IfNotPresent", - name: "apply-sysctl-overwrites", - securityContext: { - capabilities: { - add: ["SYS_ADMIN", "SYS_CHROOT", "SYS_PTRACE"], - drop: ["ALL"] - }, - seLinuxOptions: { - level: "s0", - type: "spc_t" - } - }, - terminationMessagePolicy: "FallbackToLogsOnError", - volumeMounts: [{ - mountPath: "/hostproc", - name: "hostproc" - }, { - mountPath: "/hostbin", - name: "cni-path" - }] - }, { - args: ["mount | grep \"/sys/fs/bpf type bpf\" || mount -t bpf bpf /sys/fs/bpf"], - command: ["/bin/bash", "-c", "--"], - image: "quay.io/cilium/cilium:v1.19.5@sha256:20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732", - imagePullPolicy: "IfNotPresent", - name: "mount-bpf-fs", - securityContext: { - privileged: true - }, - terminationMessagePolicy: "FallbackToLogsOnError", - volumeMounts: [{ - mountPath: "/sys/fs/bpf", - mountPropagation: "Bidirectional", - name: "bpf-maps" - }] - }, { - command: ["/init-container.sh"], - env: [{ - name: "CILIUM_ALL_STATE", - valueFrom: { - configMapKeyRef: { - key: "clean-cilium-state", - name: "cilium-config", - optional: true - } - } - }, { - name: "CILIUM_BPF_STATE", - valueFrom: { - configMapKeyRef: { - key: "clean-cilium-bpf-state", - name: "cilium-config", - optional: true - } - } - }, { - name: "WRITE_CNI_CONF_WHEN_READY", - valueFrom: { - configMapKeyRef: { - key: "write-cni-conf-when-ready", - name: "cilium-config", - optional: true - } - } - }], - image: "quay.io/cilium/cilium:v1.19.5@sha256:20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732", - imagePullPolicy: "IfNotPresent", - name: "clean-cilium-state", - securityContext: { - capabilities: { - add: ["NET_ADMIN", "SYS_MODULE", "SYS_ADMIN", "SYS_RESOURCE"], - drop: ["ALL"] - }, - seLinuxOptions: { - level: "s0", - type: "spc_t" - } - }, - terminationMessagePolicy: "FallbackToLogsOnError", - volumeMounts: [{ - mountPath: "/sys/fs/bpf", - name: "bpf-maps" - }, { - mountPath: "/run/cilium/cgroupv2", - mountPropagation: "HostToContainer", - name: "cilium-cgroup" - }, { - mountPath: "/var/run/cilium", - name: "cilium-run" - }] - }, { - command: ["/install-plugin.sh"], - image: "quay.io/cilium/cilium:v1.19.5@sha256:20fbbc14ac20b55a292c0dcda5571bf31cde30a7dbc68c29db3e709390ab0732", - imagePullPolicy: "IfNotPresent", - name: "install-cni-binaries", - resources: { - limits: { - cpu: 1, - memory: "1Gi" - }, - requests: { - cpu: "100m", - memory: "10Mi" - } - }, - securityContext: { - capabilities: { - drop: ["ALL"] - }, - seLinuxOptions: { - level: "s0", - type: "spc_t" - } - }, - terminationMessagePolicy: "FallbackToLogsOnError", - volumeMounts: [{ - mountPath: "/host/opt/cni/bin", - name: "cni-path" - }] - }], - nodeSelector: { - "kubernetes.io/os": "linux" - }, - priorityClassName: "system-node-critical", - restartPolicy: "Always", - securityContext: { - appArmorProfile: { - type: "Unconfined" - }, - seccompProfile: { - type: "Unconfined" - } - }, - serviceAccountName: "cilium", - terminationGracePeriodSeconds: 1, - tolerations: [{ - operator: "Exists" - }], - volumes: [{ - emptyDir: {}, - name: "tmp" - }, { - hostPath: { - path: "/var/run/cilium", - type: "DirectoryOrCreate" - }, - name: "cilium-run" - }, { - hostPath: { - path: "/var/run/netns", - type: "DirectoryOrCreate" - }, - name: "cilium-netns" - }, { - hostPath: { - path: "/sys/fs/bpf", - type: "DirectoryOrCreate" - }, - name: "bpf-maps" - }, { - hostPath: { - path: "/proc", - type: "Directory" - }, - name: "hostproc" - }, { - hostPath: { - path: "/run/cilium/cgroupv2", - type: "DirectoryOrCreate" - }, - name: "cilium-cgroup" - }, { - hostPath: { - path: "/opt/cni/bin", - type: "DirectoryOrCreate" - }, - name: "cni-path" - }, { - hostPath: { - path: "/etc/cni/net.d", - type: "DirectoryOrCreate" - }, - name: "etc-cni-netd" - }, { - hostPath: { - path: "/lib/modules" - }, - name: "lib-modules" - }, { - hostPath: { - path: "/run/xtables.lock", - type: "FileOrCreate" - }, - name: "xtables-lock" - }, { - hostPath: { - path: "/var/run/cilium/envoy/sockets", - type: "DirectoryOrCreate" - }, - name: "envoy-sockets" - }, { - name: "clustermesh-secrets", - projected: { - defaultMode: 400, - sources: [{ - secret: { - name: "cilium-clustermesh", - optional: true - } - }, { - secret: { - items: [{ - key: "tls.key", - path: "common-etcd-client.key" - }, { - key: "tls.crt", - path: "common-etcd-client.crt" - }, { - key: "ca.crt", - path: "common-etcd-client-ca.crt" - }], - name: "clustermesh-apiserver-remote-cert", - optional: true - } - }, { - secret: { - items: [{ - key: "tls.key", - path: "local-etcd-client.key" - }, { - key: "tls.crt", - path: "local-etcd-client.crt" - }, { - key: "ca.crt", - path: "local-etcd-client-ca.crt" - }], - name: "clustermesh-apiserver-local-cert", - optional: true - } - }] - } - }, { - hostPath: { - path: "/proc/sys/net", - type: "Directory" - }, - name: "host-proc-sys-net" - }, { - hostPath: { - path: "/proc/sys/kernel", - type: "Directory" - }, - name: "host-proc-sys-kernel" - }, { - name: "hubble-tls", - projected: { - defaultMode: 400, - sources: [{ - secret: { - items: [{ - key: "tls.crt", - path: "server.crt" - }, { - key: "tls.key", - path: "server.key" - }, { - key: "ca.crt", - path: "client-ca.crt" - }], - name: "hubble-server-certs", - optional: true - } - }] - } - }] - } - }, - updateStrategy: { - rollingUpdate: { - maxUnavailable: 2 - }, - type: "RollingUpdate" - } - } -}; -export const DaemonSet_CiliumEnvoy: KubernetesResource = { - apiVersion: "apps/v1", - kind: "DaemonSet", - metadata: { - labels: { - "app.kubernetes.io/name": "cilium-envoy", - "app.kubernetes.io/part-of": "cilium", - "k8s-app": "cilium-envoy", - name: "cilium-envoy" - }, - name: "cilium-envoy", - namespace: "kube-system" - }, - spec: { - selector: { - matchLabels: { - "k8s-app": "cilium-envoy" - } - }, - template: { - metadata: { - annotations: null, - labels: { - "app.kubernetes.io/name": "cilium-envoy", - "app.kubernetes.io/part-of": "cilium", - "k8s-app": "cilium-envoy", - name: "cilium-envoy" - } - }, - spec: { - affinity: { - nodeAffinity: { - requiredDuringSchedulingIgnoredDuringExecution: { - nodeSelectorTerms: [{ - matchExpressions: [{ - key: "cilium.io/no-schedule", - operator: "NotIn", - values: ["true"] - }] - }] - } - }, - podAffinity: { - requiredDuringSchedulingIgnoredDuringExecution: [{ - labelSelector: { - matchLabels: { - "k8s-app": "cilium" - } - }, - topologyKey: "kubernetes.io/hostname" - }] - }, - podAntiAffinity: { - requiredDuringSchedulingIgnoredDuringExecution: [{ - labelSelector: { - matchLabels: { - "k8s-app": "cilium-envoy" - } - }, - topologyKey: "kubernetes.io/hostname" - }] - } - }, - automountServiceAccountToken: true, - containers: [{ - args: ["--", "-c /var/run/cilium/envoy/bootstrap-config.json", "--base-id 0", "--log-level info"], - command: ["/usr/bin/cilium-envoy-starter"], - env: [{ - name: "K8S_NODE_NAME", - valueFrom: { - fieldRef: { - apiVersion: "v1", - fieldPath: "spec.nodeName" - } - } - }, { - name: "CILIUM_K8S_NAMESPACE", - valueFrom: { - fieldRef: { - apiVersion: "v1", - fieldPath: "metadata.namespace" - } - } - }], - image: "quay.io/cilium/cilium-envoy:v1.36.8-1781157951-a7f42a3390781539911b5b9107881b35ecc4e752@sha256:326f872e19ce8aa45170efbf583b3f301586ba3feead14b864676d4baf3b45ed", - imagePullPolicy: "IfNotPresent", - livenessProbe: { - failureThreshold: 10, - httpGet: { - host: "127.0.0.1", - path: "/healthz", - port: 9878, - scheme: "HTTP" - }, - periodSeconds: 30, - successThreshold: 1, - timeoutSeconds: 5 - }, - name: "cilium-envoy", - ports: [{ - containerPort: 9964, - hostPort: 9964, - name: "envoy-metrics", - protocol: "TCP" - }], - readinessProbe: { - failureThreshold: 3, - httpGet: { - host: "127.0.0.1", - path: "/healthz", - port: 9878, - scheme: "HTTP" - }, - periodSeconds: 30, - successThreshold: 1, - timeoutSeconds: 5 - }, - securityContext: { - capabilities: { - add: ["NET_ADMIN", "SYS_ADMIN"], - drop: ["ALL"] - }, - seLinuxOptions: { - level: "s0", - type: "spc_t" - } - }, - startupProbe: { - failureThreshold: 105, - httpGet: { - host: "127.0.0.1", - path: "/healthz", - port: 9878, - scheme: "HTTP" - }, - initialDelaySeconds: 5, - periodSeconds: 2, - successThreshold: 1 - }, - terminationMessagePolicy: "FallbackToLogsOnError", - volumeMounts: [{ - mountPath: "/var/run/cilium/envoy/sockets", - name: "envoy-sockets", - readOnly: false - }, { - mountPath: "/var/run/cilium/envoy/artifacts", - name: "envoy-artifacts", - readOnly: true - }, { - mountPath: "/var/run/cilium/envoy/", - name: "envoy-config", - readOnly: true - }, { - mountPath: "/sys/fs/bpf", - mountPropagation: "HostToContainer", - name: "bpf-maps" - }] - }], - hostNetwork: true, - nodeSelector: { - "kubernetes.io/os": "linux" - }, - priorityClassName: "system-node-critical", - restartPolicy: "Always", - securityContext: { - appArmorProfile: { - type: "Unconfined" - } - }, - serviceAccountName: "cilium-envoy", - terminationGracePeriodSeconds: 1, - tolerations: [{ - operator: "Exists" - }], - volumes: [{ - hostPath: { - path: "/var/run/cilium/envoy/sockets", - type: "DirectoryOrCreate" - }, - name: "envoy-sockets" - }, { - hostPath: { - path: "/var/run/cilium/envoy/artifacts", - type: "DirectoryOrCreate" - }, - name: "envoy-artifacts" - }, { - configMap: { - defaultMode: 400, - items: [{ - key: "bootstrap-config.json", - path: "bootstrap-config.json" - }], - name: "cilium-envoy-config" - }, - name: "envoy-config" - }, { - hostPath: { - path: "/sys/fs/bpf", - type: "DirectoryOrCreate" - }, - name: "bpf-maps" - }] - } - }, - updateStrategy: { - rollingUpdate: { - maxUnavailable: 2 - }, - type: "RollingUpdate" - } - } -}; -export const Deployment_CiliumOperator: KubernetesResource = { - apiVersion: "apps/v1", - kind: "Deployment", - metadata: { - labels: { - "app.kubernetes.io/name": "cilium-operator", - "app.kubernetes.io/part-of": "cilium", - "io.cilium/app": "operator", - name: "cilium-operator" - }, - name: "cilium-operator", - namespace: "kube-system" - }, - spec: { - replicas: 2, - selector: { - matchLabels: { - "io.cilium/app": "operator", - name: "cilium-operator" - } - }, - strategy: { - rollingUpdate: { - maxSurge: "25%", - maxUnavailable: "50%" - }, - type: "RollingUpdate" - }, - template: { - metadata: { - annotations: { - "prometheus.io/port": "9963", - "prometheus.io/scrape": "true" - }, - labels: { - "app.kubernetes.io/name": "cilium-operator", - "app.kubernetes.io/part-of": "cilium", - "io.cilium/app": "operator", - name: "cilium-operator" - } - }, - spec: { - affinity: { - podAntiAffinity: { - requiredDuringSchedulingIgnoredDuringExecution: [{ - labelSelector: { - matchLabels: { - "io.cilium/app": "operator" - } - }, - topologyKey: "kubernetes.io/hostname" - }] - } - }, - automountServiceAccountToken: true, - containers: [{ - args: ["--config-dir=/tmp/cilium/config-map", "--debug=$(CILIUM_DEBUG)"], - command: ["cilium-operator-generic"], - env: [{ - name: "K8S_NODE_NAME", - valueFrom: { - fieldRef: { - apiVersion: "v1", - fieldPath: "spec.nodeName" - } - } - }, { - name: "CILIUM_K8S_NAMESPACE", - valueFrom: { - fieldRef: { - apiVersion: "v1", - fieldPath: "metadata.namespace" - } - } - }, { - name: "CILIUM_DEBUG", - valueFrom: { - configMapKeyRef: { - key: "debug", - name: "cilium-config", - optional: true - } - } - }], - image: "quay.io/cilium/operator-generic:v1.19.5@sha256:be848a365776e07d0c5a895eda7aec928ddc52a5a1fa2f432fd7a286609e1db4", - imagePullPolicy: "IfNotPresent", - livenessProbe: { - httpGet: { - host: "127.0.0.1", - path: "/healthz", - port: "health", - scheme: "HTTP" - }, - initialDelaySeconds: 60, - periodSeconds: 10, - timeoutSeconds: 3 - }, - name: "cilium-operator", - ports: [{ - containerPort: 9234, - hostPort: 9234, - name: "health" - }, { - containerPort: 9963, - hostPort: 9963, - name: "prometheus", - protocol: "TCP" - }], - readinessProbe: { - failureThreshold: 5, - httpGet: { - host: "127.0.0.1", - path: "/healthz", - port: "health", - scheme: "HTTP" - }, - initialDelaySeconds: 0, - periodSeconds: 5, - timeoutSeconds: 3 - }, - securityContext: { - allowPrivilegeEscalation: false, - capabilities: { - drop: ["ALL"] - } - }, - terminationMessagePolicy: "FallbackToLogsOnError", - volumeMounts: [{ - mountPath: "/tmp/cilium/config-map", - name: "cilium-config-path", - readOnly: true - }] - }], - hostNetwork: true, - nodeSelector: { - "kubernetes.io/os": "linux" - }, - priorityClassName: "system-cluster-critical", - restartPolicy: "Always", - securityContext: { - seccompProfile: { - type: "RuntimeDefault" - } - }, - serviceAccountName: "cilium-operator", - tolerations: [{ - key: "node-role.kubernetes.io/control-plane", - operator: "Exists" - }, { - key: "node-role.kubernetes.io/master", - operator: "Exists" - }, { - key: "node.kubernetes.io/not-ready", - operator: "Exists" - }, { - key: "node.cloudprovider.kubernetes.io/uninitialized", - operator: "Exists" - }, { - key: "node.cilium.io/agent-not-ready", - operator: "Exists" - }], - volumes: [{ - configMap: { - name: "cilium-config" - }, - name: "cilium-config-path" - }] - } - } - } -}; -export const resources: ReadonlyArray = [Namespace_KubeSystem, Namespace_CiliumSecrets, ServiceAccount_Cilium, ServiceAccount_CiliumEnvoy, ServiceAccount_CiliumOperator, Secret_CiliumCa, Secret_HubbleServerCerts, ConfigMap_CiliumConfig, ConfigMap_CiliumEnvoyConfig, ClusterRole_Cilium, ClusterRole_CiliumOperator, ClusterRoleBinding_Cilium, ClusterRoleBinding_CiliumOperator, Role_CiliumConfigAgent, Role_CiliumTlsinterceptionSecrets, Role_CiliumOperatorTlsinterceptionSecrets, Role_CiliumOperatorZtunnel, RoleBinding_CiliumConfigAgent, RoleBinding_CiliumTlsinterceptionSecrets, RoleBinding_CiliumOperatorTlsinterceptionSecrets, RoleBinding_CiliumOperatorZtunnel, Service_CiliumEnvoy, Service_HubblePeer, DaemonSet_Cilium, DaemonSet_CiliumEnvoy, Deployment_CiliumOperator]; -export default { - resources: resources -}; diff --git a/packages/manifests/src/generated/index.ts b/packages/manifests/src/generated/index.ts index 3944304..d58695e 100644 --- a/packages/manifests/src/generated/index.ts +++ b/packages/manifests/src/generated/index.ts @@ -1,9 +1,7 @@ /** Auto-generated aggregator of operator objects*/ import type { KubernetesResource } from "@kubernetesjs/ops"; import CertManager from "./cert-manager"; -import Cilium from "./cilium"; import CloudnativePg from "./cloudnative-pg"; -import KnativeServing from "./knative-serving"; import KubePrometheusStack from "./kube-prometheus-stack"; import MinioOperator from "./minio-operator"; import TektonPipelines from "./tekton-pipelines"; @@ -13,18 +11,15 @@ export interface OperatorObjectModule { } export const OPERATOR_OBJECTS: Record = { "cert-manager": CertManager, - "cilium": Cilium, "cloudnative-pg": CloudnativePg, - "knative-serving": KnativeServing, "kube-prometheus-stack": KubePrometheusStack, "minio-operator": MinioOperator, "tekton-pipelines": TektonPipelines, "traefik": Traefik }; -export const OPERATOR_IDS: ReadonlyArray = ["cert-manager", "cilium", "cloudnative-pg", "knative-serving", "kube-prometheus-stack", "minio-operator", "tekton-pipelines", "traefik"]; +export const OPERATOR_IDS: ReadonlyArray = ["cert-manager", "cloudnative-pg", "knative-serving", "kube-prometheus-stack", "minio-operator", "tekton-pipelines", "traefik"]; export const OPERATOR_VERSIONS = { "cert-manager": ["v1.17.0"], - cilium: ["1.19.5"], "cloudnative-pg": ["1.25.2"], "knative-serving": ["v1.22.1"], "kube-prometheus-stack": ["77.5.0"], @@ -40,10 +35,6 @@ export const OPERATOR_MAP: Record 0 and container-concurrency-target-percentage is\n# 100% or 1.0, then activator will always be in the request path.\n# -1 denotes unlimited target-burst-capacity and activator will always\n# be in the request path.\n# Other negative values are invalid.\ntarget-burst-capacity: \"211\"\n\n# When operating in a stable mode, the autoscaler operates on the\n# average concurrency over the stable window.\n# Stable window must be in whole seconds.\nstable-window: \"60s\"\n\n# When observed average concurrency during the panic window reaches\n# panic-threshold-percentage the target concurrency, the autoscaler\n# enters panic mode. When operating in panic mode, the autoscaler\n# scales on the average concurrency over the panic window which is\n# panic-window-percentage of the stable-window.\n# Must be in the [1, 100] range.\n# When computing the panic window it will be rounded to the closest\n# whole second, at least 1s.\npanic-window-percentage: \"10.0\"\n\n# The percentage of the container concurrency target at which to\n# enter panic mode when reached within the panic window.\npanic-threshold-percentage: \"200.0\"\n\n# Max scale up rate limits the rate at which the autoscaler will\n# increase pod count. It is the maximum ratio of desired pods versus\n# observed pods.\n# Cannot be less or equal to 1.\n# I.e with value of 2.0 the number of pods can at most go N to 2N\n# over single Autoscaler period (2s), but at least N to\n# N+1, if Autoscaler needs to scale up.\nmax-scale-up-rate: \"1000.0\"\n\n# Max scale down rate limits the rate at which the autoscaler will\n# decrease pod count. It is the maximum ratio of observed pods versus\n# desired pods.\n# Cannot be less or equal to 1.\n# I.e. with value of 2.0 the number of pods can at most go N to N/2\n# over single Autoscaler evaluation period (2s), but at\n# least N to N-1, if Autoscaler needs to scale down.\nmax-scale-down-rate: \"2.0\"\n\n# Scale to zero feature flag.\nenable-scale-to-zero: \"true\"\n\n# Scale to zero grace period is the time an inactive revision is left\n# running before it is scaled to zero (must be positive, but recommended\n# at least a few seconds if running with mesh networking).\n# This is the upper limit and is provided not to enforce timeout after\n# the revision stopped receiving requests for stable window, but to\n# ensure network reprogramming to put activator in the path has completed.\n# If the system determines that a shorter period is satisfactory,\n# then the system will only wait that amount of time before scaling to 0.\n# NOTE: this period might actually be 0, if activator has been\n# in the request path sufficiently long.\n# If there is necessity for the last pod to linger longer use\n# scale-to-zero-pod-retention-period flag.\nscale-to-zero-grace-period: \"30s\"\n\n# Scale to zero pod retention period defines the minimum amount\n# of time the last pod will remain after Autoscaler has decided to\n# scale to zero.\n# This flag is for the situations where the pod startup is very expensive\n# and the traffic is bursty (requiring smaller windows for fast action),\n# but patchy.\n# The larger of this flag and `scale-to-zero-grace-period` will effectively\n# determine how the last pod will hang around.\nscale-to-zero-pod-retention-period: \"0s\"\n\n# pod-autoscaler-class specifies the default pod autoscaler class\n# that should be used if none is specified. If omitted,\n# the Knative Pod Autoscaler (KPA) is used by default.\npod-autoscaler-class: \"kpa.autoscaling.knative.dev\"\n\n# The capacity of a single activator task.\n# The `unit` is one concurrent request proxied by the activator.\n# activator-capacity must be at least 1.\n# This value is used for computation of the Activator subset size.\n# See the algorithm here: https://bit.ly/38XiCZ3.\n# TODO(vagababov): tune after actual benchmarking.\nactivator-capacity: \"100.0\"\n\n# initial-scale is the cluster-wide default value for the initial target\n# scale of a revision after creation, unless overridden by the\n# \"autoscaling.knative.dev/initialScale\" annotation.\n# This value must be greater than 0 unless allow-zero-initial-scale is true.\ninitial-scale: \"1\"\n\n# allow-zero-initial-scale controls whether either the cluster-wide initial-scale flag,\n# or the \"autoscaling.knative.dev/initialScale\" annotation, can be set to 0.\nallow-zero-initial-scale: \"false\"\n\n# min-scale is the cluster-wide default value for the min scale of a revision,\n# unless overridden by the \"autoscaling.knative.dev/minScale\" annotation.\nmin-scale: \"0\"\n\n# max-scale is the cluster-wide default value for the max scale of a revision,\n# unless overridden by the \"autoscaling.knative.dev/maxScale\" annotation.\n# If set to 0, the revision has no maximum scale.\nmax-scale: \"0\"\n\n# scale-down-delay is the amount of time that must pass at reduced\n# concurrency before a scale down decision is applied. This can be useful,\n# for example, to maintain replica count and avoid a cold start penalty if\n# more requests come in within the scale down delay period.\n# The default, 0s, imposes no delay at all.\nscale-down-delay: \"0s\"\n\n# max-scale-limit sets the maximum permitted value for the max scale of a revision.\n# When this is set to a positive value, a revision with a maxScale above that value\n# (including a maxScale of \"0\" = unlimited) is disallowed.\n# A value of zero (the default) allows any limit, including unlimited.\nmax-scale-limit: \"0\"\n" - } -}; -export const ConfigMap_ConfigCertmanager: KubernetesResource = { - apiVersion: "v1", - kind: "ConfigMap", - metadata: { - annotations: { - "knative.dev/example-checksum": "b7a9a602" - }, - labels: { - "app.kubernetes.io/component": "controller", - "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1", - "networking.knative.dev/certificate-provider": "cert-manager" - }, - name: "config-certmanager", - namespace: "knative-serving" - }, - data: { - _example: "################################\n# #\n# EXAMPLE CONFIGURATION #\n# #\n################################\n\n# This block is not actually functional configuration,\n# but serves to illustrate the available configuration\n# options and document them in a way that is accessible\n# to users that `kubectl edit` this config map.\n#\n# These sample configuration options may be copied out of\n# this block and unindented to actually change the configuration.\n\n# issuerRef is a reference to the issuer for external-domain certificates used for ingress.\n# IssuerRef should be either `ClusterIssuer` or `Issuer`.\n# Please refer `IssuerRef` in https://cert-manager.io/docs/concepts/issuer/\n# for more details about IssuerRef configuration.\n# If the issuerRef is not specified, the self-signed `knative-selfsigned-issuer` ClusterIssuer is used.\nissuerRef: |\n kind: ClusterIssuer\n name: letsencrypt-issuer\n\n# clusterLocalIssuerRef is a reference to the issuer for cluster-local-domain certificates used for ingress.\n# clusterLocalIssuerRef should be either `ClusterIssuer` or `Issuer`.\n# Please refer `IssuerRef` in https://cert-manager.io/docs/concepts/issuer/\n# for more details about ClusterInternalIssuerRef configuration.\n# If the clusterLocalIssuerRef is not specified, the self-signed `knative-selfsigned-issuer` ClusterIssuer is used.\nclusterLocalIssuerRef: |\n kind: ClusterIssuer\n name: your-company-issuer\n\n# systemInternalIssuerRef is a reference to the issuer for certificates for system-internal-tls certificates used by Knative internal components.\n# systemInternalIssuerRef should be either `ClusterIssuer` or `Issuer`.\n# Please refer `IssuerRef` in https://cert-manager.io/docs/concepts/issuer/\n# for more details about ClusterInternalIssuerRef configuration.\n# If the systemInternalIssuerRef is not specified, the self-signed `knative-selfsigned-issuer` ClusterIssuer is used.\nsystemInternalIssuerRef: |\n kind: ClusterIssuer\n name: knative-selfsigned-issuer\n" - } -}; -export const ConfigMap_ConfigDefaults: KubernetesResource = { - apiVersion: "v1", - kind: "ConfigMap", - metadata: { - annotations: { - "knative.dev/example-checksum": "5b64ff5c" - }, - labels: { - "app.kubernetes.io/component": "controller", - "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1" - }, - name: "config-defaults", - namespace: "knative-serving" - }, - data: { - _example: "################################\n# #\n# EXAMPLE CONFIGURATION #\n# #\n################################\n\n# This block is not actually functional configuration,\n# but serves to illustrate the available configuration\n# options and document them in a way that is accessible\n# to users that `kubectl edit` this config map.\n#\n# These sample configuration options may be copied out of\n# this example block and unindented to be in the data block\n# to actually change the configuration.\n\n# revision-timeout-seconds contains the default number of\n# seconds to use for the revision's per-request timeout, if\n# none is specified.\nrevision-timeout-seconds: \"300\" # 5 minutes\n\n# max-revision-timeout-seconds contains the maximum number of\n# seconds that can be used for revision-timeout-seconds.\n# This value must be greater than or equal to revision-timeout-seconds.\n# If omitted, the system default is used (600 seconds).\n#\n# If this value is increased, the activator's terminationGracePeriodSeconds\n# should also be increased to prevent in-flight requests being disrupted.\nmax-revision-timeout-seconds: \"600\" # 10 minutes\n\n# revision-response-start-timeout-seconds contains the default number of\n# seconds a request will be allowed to stay open while waiting to\n# receive any bytes from the user's application, if none is specified.\n#\n# This defaults to 'revision-timeout-seconds'\nrevision-response-start-timeout-seconds: \"300\"\n\n# revision-idle-timeout-seconds contains the default number of\n# seconds a request will be allowed to stay open while not receiving any\n# bytes from the user's application, if none is specified.\nrevision-idle-timeout-seconds: \"0\" # infinite\n\n# revision-cpu-request contains the cpu allocation to assign\n# to revisions by default. If omitted, no value is specified\n# and the system default is used.\n# Below is an example of setting revision-cpu-request.\n# By default, it is not set by Knative.\nrevision-cpu-request: \"400m\" # 0.4 of a CPU (aka 400 milli-CPU)\n\n# revision-memory-request contains the memory allocation to assign\n# to revisions by default. If omitted, no value is specified\n# and the system default is used.\n# Below is an example of setting revision-memory-request.\n# By default, it is not set by Knative.\nrevision-memory-request: \"100M\" # 100 megabytes of memory\n\n# revision-ephemeral-storage-request contains the ephemeral storage\n# allocation to assign to revisions by default. If omitted, no value is\n# specified and the system default is used.\nrevision-ephemeral-storage-request: \"500M\" # 500 megabytes of storage\n\n# revision-cpu-limit contains the cpu allocation to limit\n# revisions to by default. If omitted, no value is specified\n# and the system default is used.\n# Below is an example of setting revision-cpu-limit.\n# By default, it is not set by Knative.\nrevision-cpu-limit: \"1000m\" # 1 CPU (aka 1000 milli-CPU)\n\n# revision-memory-limit contains the memory allocation to limit\n# revisions to by default. If omitted, no value is specified\n# and the system default is used.\n# Below is an example of setting revision-memory-limit.\n# By default, it is not set by Knative.\nrevision-memory-limit: \"200M\" # 200 megabytes of memory\n\n# revision-ephemeral-storage-limit contains the ephemeral storage\n# allocation to limit revisions to by default. If omitted, no value is\n# specified and the system default is used.\nrevision-ephemeral-storage-limit: \"750M\" # 750 megabytes of storage\n\n# container-name-template contains a template for the default\n# container name, if none is specified. This field supports\n# Go templating and is supplied with the ObjectMeta of the\n# enclosing Service or Configuration, so values such as\n# {{.Name}} are also valid.\ncontainer-name-template: \"user-container\"\n\n# init-container-name-template contains a template for the default\n# init container name, if none is specified. This field supports\n# Go templating and is supplied with the ObjectMeta of the\n# enclosing Service or Configuration, so values such as\n# {{.Name}} are also valid.\ninit-container-name-template: \"init-container\"\n\n# container-concurrency specifies the maximum number\n# of requests the Container can handle at once, and requests\n# above this threshold are queued. Setting a value of zero\n# disables this throttling and lets through as many requests as\n# the pod receives.\ncontainer-concurrency: \"0\"\n\n# The container concurrency max limit is an operator setting ensuring that\n# the individual revisions cannot have arbitrary large concurrency\n# values, or autoscaling targets. `container-concurrency` default setting\n# must be at or below this value.\n#\n# Must be greater than 1.\n#\n# Note: even with this set, a user can choose a containerConcurrency\n# of 0 (i.e. unbounded) unless allow-container-concurrency-zero is\n# set to \"false\".\ncontainer-concurrency-max-limit: \"1000\"\n\n# allow-container-concurrency-zero controls whether users can\n# specify 0 (i.e. unbounded) for containerConcurrency.\nallow-container-concurrency-zero: \"true\"\n\n# enable-service-links specifies the default value used for the\n# enableServiceLinks field of the PodSpec, when it is omitted by the user.\n# See: https://kubernetes.io/docs/concepts/services-networking/connect-applications-service/#accessing-the-service\n#\n# This is a tri-state flag with possible values of (true|false|default).\n#\n# In environments with large number of services it is suggested\n# to set this value to `false`.\n# See https://github.com/knative/serving/issues/8498.\nenable-service-links: \"false\"\n" - } -}; -export const ConfigMap_ConfigDeployment: KubernetesResource = { - apiVersion: "v1", - kind: "ConfigMap", - metadata: { - annotations: { - "knative.dev/example-checksum": "555b4826" - }, - labels: { - "app.kubernetes.io/component": "controller", - "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1" - }, - name: "config-deployment", - namespace: "knative-serving" - }, - data: { - _example: "################################\n# #\n# EXAMPLE CONFIGURATION #\n# #\n################################\n\n# This block is not actually functional configuration,\n# but serves to illustrate the available configuration\n# options and document them in a way that is accessible\n# to users that `kubectl edit` this config map.\n#\n# These sample configuration options may be copied out of\n# this example block and unindented to be in the data block\n# to actually change the configuration.\n\n# List of repositories for which tag to digest resolving should be skipped\nregistries-skipping-tag-resolving: \"kind.local,ko.local,dev.local\"\n\n# Maximum time allowed for an image's digests to be resolved.\ndigest-resolution-timeout: \"10s\"\n\n# Duration we wait for the deployment to be ready before considering it failed.\nprogress-deadline: \"600s\"\n\n# Sets the queue proxy's CPU request.\n# If omitted, a default value (currently \"25m\"), is used.\nqueue-sidecar-cpu-request: \"25m\"\n\n# Sets the queue proxy's CPU limit.\n# If omitted, a default value (currently \"1000m\"), is used when\n# `queueproxy.resource-defaults` is set to `Enabled`.\nqueue-sidecar-cpu-limit: \"1000m\"\n\n# Sets the queue proxy's memory request.\n# If omitted, a default value (currently \"400Mi\"), is used when\n# `queueproxy.resource-defaults` is set to `Enabled`.\nqueue-sidecar-memory-request: \"400Mi\"\n\n# Sets the queue proxy's memory limit.\n# If omitted, a default value (currently \"800Mi\"), is used when\n# `queueproxy.resource-defaults` is set to `Enabled`.\nqueue-sidecar-memory-limit: \"800Mi\"\n\n# Sets the queue proxy's ephemeral storage request.\n# If omitted, no value is specified and the system default is used.\nqueue-sidecar-ephemeral-storage-request: \"512Mi\"\n\n# Sets the queue proxy's ephemeral storage limit.\n# If omitted, no value is specified and the system default is used.\nqueue-sidecar-ephemeral-storage-limit: \"1024Mi\"\n\n# Sets tokens associated with specific audiences for queue proxy - used by QPOptions\n#\n# For example, to add the `service-x` audience:\n# queue-sidecar-token-audiences: \"service-x\"\n# Also supports a list of audiences, for example:\n# queue-sidecar-token-audiences: \"service-x,service-y\"\n# If omitted, or empty, no tokens are created\nqueue-sidecar-token-audiences: \"\"\n\n# Sets rootCA for the queue proxy - used by QPOptions\n# If omitted, or empty, no rootCA is added to the golang rootCAs\nqueue-sidecar-rootca: \"\"\n\n# Sets the minimum TLS version for the queue proxy sidecar's TLS server.\n# Accepted values: \"1.2\", \"1.3\". Default is \"1.3\" if not specified.\nqueue-sidecar-tls-min-version: \"\"\n\n# Sets the maximum TLS version for the queue proxy sidecar's TLS server.\n# Accepted values: \"1.2\", \"1.3\". If omitted, the Go default is used.\nqueue-sidecar-tls-max-version: \"\"\n\n# Sets the cipher suites for the queue proxy sidecar's TLS server.\n# Comma-separated list of cipher suite names (e.g. \"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256\").\n# If omitted, the Go default cipher suites are used.\n# Note: cipher suites are not configurable in TLS 1.3.\nqueue-sidecar-tls-cipher-suites: \"\"\n\n# Sets the elliptic curve preferences for the queue proxy sidecar's TLS server.\n# Comma-separated list of curve names (e.g. \"X25519,CurveP256\").\n# If omitted, the Go default curves are used.\nqueue-sidecar-tls-curve-preferences: \"\"\n\n# If set, it automatically configures pod anti-affinity requirements for all Knative services.\n# It employs the `preferredDuringSchedulingIgnoredDuringExecution` weighted pod affinity term,\n# aligning with the Knative revision label. It yields the configuration below in all workloads' deployments:\n# `\n# affinity:\n# podAntiAffinity:\n# preferredDuringSchedulingIgnoredDuringExecution:\n# - podAffinityTerm:\n# topologyKey: kubernetes.io/hostname\n# labelSelector:\n# matchLabels:\n# serving.knative.dev/revision: {{revision-name}}\n# weight: 100\n# `\n# This may be \"none\" or \"prefer-spread-revision-over-nodes\" (default)\n# default-affinity-type: \"prefer-spread-revision-over-nodes\"\n\n# runtime-class-name contains the selector for which runtimeClassName\n# is selected to put in a revision.\n# By default, it is not set by Knative.\n#\n# Example:\n# runtime-class-name: |\n# \"\":\n# selector:\n# use-default-runc: \"yes\"\n# kata: {}\n# gvisor:\n# selector:\n# use-gvisor: \"please\"\nruntime-class-name: \"\"\n\n# pod-is-always-schedulable can be used to define that Pods in the system will always be\n# scheduled, and a Revision should not be marked unschedulable.\n# Setting this to `true` makes sense if you have cluster-autoscaling set up for your cluster\n# where unschedulable Pods trigger the addition of a new Node and are therefore a short and\n# transient state.\n#\n# See https://github.com/knative/serving/issues/14862\npod-is-always-schedulable: \"false\"", - "queue-sidecar-image": "gcr.io/knative-releases/knative.dev/serving/cmd/queue@sha256:b1af8bda6c1d32b1cf5fbf8f1f6068c5007a5cebf091039fdea83b88b1fd87f4" - } -}; -export const ConfigMap_ConfigDomain: KubernetesResource = { - apiVersion: "v1", - kind: "ConfigMap", - metadata: { - annotations: { - "knative.dev/example-checksum": "26c09de5" - }, - labels: { - "app.kubernetes.io/component": "controller", - "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1" - }, - name: "config-domain", - namespace: "knative-serving" - }, - data: { - _example: "################################\n# #\n# EXAMPLE CONFIGURATION #\n# #\n################################\n\n# This block is not actually functional configuration,\n# but serves to illustrate the available configuration\n# options and document them in a way that is accessible\n# to users that `kubectl edit` this config map.\n#\n# These sample configuration options may be copied out of\n# this example block and unindented to be in the data block\n# to actually change the configuration.\n\n# Default value for domain.\n# Routes having the cluster domain suffix (by default 'svc.cluster.local')\n# will not be exposed through Ingress. You can define your own label\n# selector to assign that domain suffix to your Route here, or you can set\n# the label\n# \"networking.knative.dev/visibility=cluster-local\"\n# to achieve the same effect. This shows how to make routes having\n# the label app=secret only exposed to the local cluster.\nsvc.cluster.local: |\n selector:\n app: secret\n\n# These are example settings of domain.\n# example.com will be used for all routes, but it is the least-specific rule so it\n# will only be used if no other domain matches.\nexample.com: |\n\n# example.org will be used for routes having app=nonprofit.\nexample.org: |\n selector:\n app: nonprofit\n" - } -}; -export const ConfigMap_ConfigFeatures: KubernetesResource = { - apiVersion: "v1", - kind: "ConfigMap", - metadata: { - annotations: { - "knative.dev/example-checksum": "bee75b26" - }, - labels: { - "app.kubernetes.io/component": "controller", - "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1" - }, - name: "config-features", - namespace: "knative-serving" - }, - data: { - _example: "################################\n# #\n# EXAMPLE CONFIGURATION #\n# #\n################################\n\n# This block is not actually functional configuration,\n# but serves to illustrate the available configuration\n# options and document them in a way that is accessible\n# to users that `kubectl edit` this config map.\n#\n# These sample configuration options may be copied out of\n# this example block and unindented to be in the data block\n# to actually change the configuration.\n\n# Default SecurityContext settings to secure-by-default values\n# if unset.\n#\n# Disabled - do nothing; no security options are applied\n# AllowRootBounded - Applies secure defaults without enforcing strict policies; sets seccompProfile\n# to RuntimeDefault and drops all capabilities\n# Enabled - Enforces security defaults; sets seccompProfile to RuntimeDefault, drops all capabilities,\n# and sets runAsNonRoot to true if not already specified.\nsecure-pod-defaults: \"disabled\"\n\n# Indicates whether multi container support is enabled\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See: https://knative.dev/docs/serving/configuration/feature-flags/#multiple-containers\nmulti-container: \"enabled\"\n\n# Indicates whether multi container probing is enabled\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See: https://knative.dev/docs/serving/configuration/feature-flags/#multiple-container-probing\nmulti-container-probing: \"disabled\"\n\n# Indicates whether Kubernetes affinity support is enabled\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See: https://knative.dev/docs/serving/feature-flags/#kubernetes-node-affinity\nkubernetes.podspec-affinity: \"disabled\"\n\n# Indicates whether Kubernetes topologySpreadConstraints support is enabled\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See: https://knative.dev/docs/serving/feature-flags/#kubernetes-topology-spread-constraints\nkubernetes.podspec-topologyspreadconstraints: \"disabled\"\n\n# Indicates whether Kubernetes hostAliases support is enabled\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See: https://knative.dev/docs/serving/feature-flags/#kubernetes-host-aliases\nkubernetes.podspec-hostaliases: \"disabled\"\n\n# Indicates whether Kubernetes nodeSelector support is enabled\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See: https://knative.dev/docs/serving/feature-flags/#kubernetes-node-selector\nkubernetes.podspec-nodeselector: \"disabled\"\n\n# Indicates whether Kubernetes tolerations support is enabled\n#\n# WARNING: Cannot safely be disabled once enabled\n# See: https://knative.dev/docs/serving/feature-flags/#kubernetes-toleration\nkubernetes.podspec-tolerations: \"disabled\"\n\n# Indicates whether Kubernetes FieldRef support is enabled\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See: https://knative.dev/docs/serving/feature-flags/#kubernetes-fieldref\nkubernetes.podspec-fieldref: \"disabled\"\n\n# Indicates whether Kubernetes RuntimeClassName support is enabled\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See: https://knative.dev/docs/serving/feature-flags/#kubernetes-runtime-class\nkubernetes.podspec-runtimeclassname: \"disabled\"\n\n# Indicates whether Kubernetes DNSPolicy support is enabled\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See: https://knative.dev/docs/serving/feature-flags/#kubernetes-dnspolicy\nkubernetes.podspec-dnspolicy: \"disabled\"\n\n# Indicates whether Kubernetes DNSConfig support is enabled\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See: https://knative.dev/docs/serving/feature-flags/#kubernetes-dnsconfig\nkubernetes.podspec-dnsconfig: \"disabled\"\n\n# This feature allows end-users to set a subset of fields on the Pod's SecurityContext\n#\n# When set to \"enabled\" or \"allowed\" it allows the following\n# PodSecurityContext properties:\n# - FSGroup\n# - RunAsGroup\n# - RunAsNonRoot\n# - SupplementalGroups\n# - RunAsUser\n# - SeccompProfile\n#\n# This feature flag should be used with caution as the PodSecurityContext\n# properties may have a side-effect on non-user sidecar containers that come\n# from Knative or your service mesh\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See: https://knative.dev/docs/serving/feature-flags/#kubernetes-security-context\nkubernetes.podspec-securitycontext: \"disabled\"\n\n# Indicated whether sharing the process namespace via ShareProcessNamespace pod spec is allowed.\n# This can be especially useful for sharing data from images directly between sidecars\n#\n# See: https://knative.dev/docs/serving/configuration/feature-flags/#kubernetes-share-process-namespace\nkubernetes.podspec-shareprocessnamespace: \"disabled\"\n\n# Indicates whether hostIPC support is enabled\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See https://knative.dev/docs/serving/configuration/feature-flags/#kubernetes-host-ipc\nkubernetes.podspec-hostipc: \"disabled\"\n\n# Indicates whether hostPID support is enabled\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See https://knative.dev/docs/serving/configuration/feature-flags/#kubernetes-host-pid\nkubernetes.podspec-hostpid: \"disabled\"\n\n# Indicates whether hostNetwork support is enabled\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See See https://knative.dev/docs/serving/configuration/feature-flags/#kubernetes-host-network\nkubernetes.podspec-hostnetwork: \"disabled\"\n\n# Indicates whether Kubernetes PriorityClassName support is enabled\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See: https://knative.dev/docs/serving/feature-flags/#kubernetes-priority-class-name\nkubernetes.podspec-priorityclassname: \"disabled\"\n\n# Indicates whether Kubernetes SchedulerName support is enabled\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See: https://knative.dev/docs/serving/feature-flags/#kubernetes-scheduler-name\nkubernetes.podspec-schedulername: \"disabled\"\n\n# This feature flag allows end-users to add a subset of capabilities on the Pod's SecurityContext.\n#\n# When set to \"enabled\" or \"allowed\" it allows capabilities to be added to the container.\n# For a list of possible capabilities, see https://man7.org/linux/man-pages/man7/capabilities.7.html\nkubernetes.containerspec-addcapabilities: \"disabled\"\n\n\n# Controls whether tag header based routing feature are enabled or not.\n# 1. Enabled: enabling tag header based routing\n# 2. Disabled: disabling tag header based routing\n# See: https://knative.dev/docs/serving/feature-flags/#tag-header-based-routing\ntag-header-based-routing: \"disabled\"\n\n# Controls whether http2 auto-detection should be enabled or not.\n# 1. Enabled: http2 connection will be attempted via upgrade.\n# 2. Disabled: http2 connection will only be attempted when port name is set to \"h2c\".\nautodetect-http2: \"disabled\"\n\n# Controls whether volume support for EmptyDir is enabled or not.\n# 1. Enabled: enabling EmptyDir volume support\n# 2. Disabled: disabling EmptyDir volume support\nkubernetes.podspec-volumes-emptydir: \"enabled\"\n\n# Controls whether volume support for image is enabled or not.\n# 1. Enabled: enabling image volume support\n# 2. Disabled: disabling image volume support\nkubernetes.podspec-volumes-image: \"disabled\"\n\n# Controls whether volume support for HostPath is enabled or not.\n# WARNING: Cannot safely be disabled once enabled.\n# WARNING: If you can avoid using a hostPath volume, you should.\n# Please read https://kubernetes.io/docs/concepts/storage/volumes/#hostpath before enabling this feature.\n# 1. Enabled: enabling HostPath volume support\n# 2. Disabled: disabling HostPath volume support\nkubernetes.podspec-volumes-hostpath: \"disabled\"\n\n# Controls whether volume support for CSI is enabled or not.\n# 1. Enabled: enabling CSI volume support\n# 2. Disabled: disabling CSI volume support\nkubernetes.podspec-volumes-csi: \"disabled\"\n\n# Controls whether init containers support is enabled or not.\n# 1. Enabled: enabling init containers support\n# 2. Disabled: disabling init containers support\nkubernetes.podspec-init-containers: \"disabled\"\n\n# Controls whether persistent volume claim support is enabled or not.\n# 1. Enabled: enabling persistent volume claim support\n# 2. Disabled: disabling persistent volume claim support\nkubernetes.podspec-persistent-volume-claim: \"disabled\"\n\n# Controls whether write access for persistent volumes is enabled or not.\n# 1. Enabled: enabling write access for persistent volumes\n# 2. Disabled: disabling write access for persistent volumes\nkubernetes.podspec-persistent-volume-write: \"disabled\"\n\n# Controls whether volume mount propagation support is enabled or not.\n# 1. Enabled: enabling volume mount propagation support\n# 2. Disabled: disabling volume mount propagation support\nkubernetes.podspec-volumes-mount-propagation: \"disabled\"\n\n# Controls if the queue proxy podInfo feature is enabled, allowed or disabled\n#\n# This feature should be enabled/allowed when using queue proxy Options (Extensions)\n# Enabling will mount a podInfo volume to the queue proxy container.\n# The volume will contains an 'annotations' file (from the pod's annotation field).\n# The annotations in this file include the Service annotations set by the client creating the service.\n# If mounted, the annotations can be accessed by queue proxy extensions at /etc/podinfo/annotations\n#\n# 1. \"enabled\": always mount a podInfo volume\n# 2. \"disabled\": never mount a podInfo volume\n# 3. \"allowed\": by default, do not mount a podInfo volume\n# However, a client may mount the podInfo volume on an individual Service by attaching\n# the following metadata annotation to the Service: \"features.knative.dev/queueproxy-podinfo\":\"enabled\".\n#\n# NOTE THAT THIS IS AN EXPERIMENTAL / ALPHA FEATURE\nqueueproxy.mount-podinfo: \"disabled\"\n\n# Default queue proxy resource requests and limits to good values for most cases if set.\nqueueproxy.resource-defaults: \"disabled\"" - } -}; -export const ConfigMap_ConfigGc: KubernetesResource = { - apiVersion: "v1", - kind: "ConfigMap", - metadata: { - annotations: { - "knative.dev/example-checksum": "aa3813a8" - }, - labels: { - "app.kubernetes.io/component": "controller", - "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1" - }, - name: "config-gc", - namespace: "knative-serving" - }, - data: { - _example: "################################\n# #\n# EXAMPLE CONFIGURATION #\n# #\n################################\n\n# This block is not actually functional configuration,\n# but serves to illustrate the available configuration\n# options and document them in a way that is accessible\n# to users that `kubectl edit` this config map.\n#\n# These sample configuration options may be copied out of\n# this example block and unindented to be in the data block\n# to actually change the configuration.\n\n# ---------------------------------------\n# Garbage Collector Settings\n# ---------------------------------------\n#\n# Active\n# * Revisions which are referenced by a Route are considered active.\n# * Individual revisions may be marked with the annotation\n# \"serving.knative.dev/no-gc\":\"true\" to be permanently considered active.\n# * Active revisions are not considered for GC.\n# Retention\n# * Revisions are retained if they are any of the following:\n# 1. Active\n# 2. Were created within \"retain-since-create-time\"\n# 3. Were last referenced by a route within\n# \"retain-since-last-active-time\"\n# 4. There are fewer than \"min-non-active-revisions\"\n# If none of these conditions are met, or if the count of revisions exceed\n# \"max-non-active-revisions\", they will be deleted by GC.\n# The special value \"disabled\" may be used to turn off these limits.\n#\n# Example config to immediately collect any inactive revision:\n# min-non-active-revisions: \"0\"\n# max-non-active-revisions: \"0\"\n# retain-since-create-time: \"disabled\"\n# retain-since-last-active-time: \"disabled\"\n#\n# Example config to always keep around the last ten non-active revisions:\n# retain-since-create-time: \"disabled\"\n# retain-since-last-active-time: \"disabled\"\n# max-non-active-revisions: \"10\"\n#\n# Example config to disable all garbage collection:\n# retain-since-create-time: \"disabled\"\n# retain-since-last-active-time: \"disabled\"\n# max-non-active-revisions: \"disabled\"\n#\n# Example config to keep recently deployed or active revisions,\n# always maintain the last two in case of rollback, and prevent\n# burst activity from exploding the count of old revisions:\n# retain-since-create-time: \"48h\"\n# retain-since-last-active-time: \"15h\"\n# min-non-active-revisions: \"2\"\n# max-non-active-revisions: \"1000\"\n\n# Duration since creation before considering a revision for GC or \"disabled\".\nretain-since-create-time: \"48h\"\n\n# Duration since active before considering a revision for GC or \"disabled\".\nretain-since-last-active-time: \"15h\"\n\n# Minimum number of non-active revisions to retain.\nmin-non-active-revisions: \"20\"\n\n# Maximum number of non-active revisions to retain\n# or \"disabled\" to disable any maximum limit.\nmax-non-active-revisions: \"1000\"\n" - } -}; -export const ConfigMap_ConfigLeaderElection: KubernetesResource = { - apiVersion: "v1", - kind: "ConfigMap", - metadata: { - annotations: { - "knative.dev/example-checksum": "f4b71f57" - }, - labels: { - "app.kubernetes.io/component": "controller", - "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1" - }, - name: "config-leader-election", - namespace: "knative-serving" - }, - data: { - _example: "################################\n# #\n# EXAMPLE CONFIGURATION #\n# #\n################################\n\n# This block is not actually functional configuration,\n# but serves to illustrate the available configuration\n# options and document them in a way that is accessible\n# to users that `kubectl edit` this config map.\n#\n# These sample configuration options may be copied out of\n# this example block and unindented to be in the data block\n# to actually change the configuration.\n\n# lease-duration is how long non-leaders will wait to try to acquire the\n# lock; 15 seconds is the value used by core kubernetes controllers.\nlease-duration: \"60s\"\n\n# renew-deadline is how long a leader will try to renew the lease before\n# giving up; 10 seconds is the value used by core kubernetes controllers.\nrenew-deadline: \"40s\"\n\n# retry-period is how long the leader election client waits between tries of\n# actions; 2 seconds is the value used by core kubernetes controllers.\nretry-period: \"10s\"\n\n# buckets is the number of buckets used to partition key space of each\n# Reconciler. If this number is M and the replica number of the controller\n# is N, the N replicas will compete for the M buckets. The owner of a\n# bucket will take care of the reconciling for the keys partitioned into\n# that bucket.\nbuckets: \"1\"\n" - } -}; -export const ConfigMap_ConfigLogging: KubernetesResource = { - apiVersion: "v1", - kind: "ConfigMap", - metadata: { - annotations: { - "knative.dev/example-checksum": "9f25d429" - }, - labels: { - "app.kubernetes.io/component": "logging", - "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1" - }, - name: "config-logging", - namespace: "knative-serving" - }, - data: { - _example: "################################\n# #\n# EXAMPLE CONFIGURATION #\n# #\n################################\n\n# This block is not actually functional configuration,\n# but serves to illustrate the available configuration\n# options and document them in a way that is accessible\n# to users that `kubectl edit` this config map.\n#\n# These sample configuration options may be copied out of\n# this example block and unindented to be in the data block\n# to actually change the configuration.\n\n# Common configuration for all Knative codebase\nzap-logger-config: |\n {\n \"level\": \"info\",\n \"development\": false,\n \"outputPaths\": [\"stdout\"],\n \"errorOutputPaths\": [\"stderr\"],\n \"encoding\": \"json\",\n \"encoderConfig\": {\n \"timeKey\": \"timestamp\",\n \"levelKey\": \"severity\",\n \"nameKey\": \"logger\",\n \"callerKey\": \"caller\",\n \"messageKey\": \"message\",\n \"stacktraceKey\": \"stacktrace\",\n \"lineEnding\": \"\",\n \"levelEncoder\": \"\",\n \"timeEncoder\": \"iso8601\",\n \"durationEncoder\": \"\",\n \"callerEncoder\": \"\"\n }\n }\n\n# Log level overrides\n# For all components except the queue proxy,\n# changes are picked up immediately.\n# For queue proxy, changes require recreation of the pods.\nloglevel.controller: \"info\"\nloglevel.autoscaler: \"info\"\nloglevel.queueproxy: \"info\"\nloglevel.webhook: \"info\"\nloglevel.activator: \"info\"\nloglevel.hpaautoscaler: \"info\"\nloglevel.net-istio-controller: \"info\"\nloglevel.net-contour-controller: \"info\"\nloglevel.net-kourier-controller: \"info\"\nloglevel.net-gateway-api-controller: \"info\"\n" - } -}; -export const ConfigMap_ConfigNetwork: KubernetesResource = { - apiVersion: "v1", - kind: "ConfigMap", - metadata: { - annotations: { - "knative.dev/example-checksum": "0573e07d" - }, - labels: { - "app.kubernetes.io/component": "networking", - "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1" - }, - name: "config-network", - namespace: "knative-serving" - }, - data: { - _example: "################################\n# #\n# EXAMPLE CONFIGURATION #\n# #\n################################\n\n# This block is not actually functional configuration,\n# but serves to illustrate the available configuration\n# options and document them in a way that is accessible\n# to users that `kubectl edit` this config map.\n#\n# These sample configuration options may be copied out of\n# this example block and unindented to be in the data block\n# to actually change the configuration.\n\n# ingress-class specifies the default ingress class\n# to use when not dictated by Route annotation.\n#\n# If not specified, will use the Istio ingress.\n#\n# Note that changing the Ingress class of an existing Route\n# will result in undefined behavior. Therefore it is best to only\n# update this value during the setup of Knative, to avoid getting\n# undefined behavior.\ningress-class: \"istio.ingress.networking.knative.dev\"\n\n# certificate-class specifies the default Certificate class\n# to use when not dictated by Route annotation.\n#\n# If not specified, will use the Cert-Manager Certificate.\n#\n# Note that changing the Certificate class of an existing Route\n# will result in undefined behavior. Therefore it is best to only\n# update this value during the setup of Knative, to avoid getting\n# undefined behavior.\ncertificate-class: \"cert-manager.certificate.networking.knative.dev\"\n\n# namespace-wildcard-cert-selector specifies a LabelSelector which\n# determines which namespaces should have a wildcard certificate\n# provisioned.\n#\n# Use an empty value to disable the feature (this is the default):\n# namespace-wildcard-cert-selector: \"\"\n#\n# Use an empty object to enable for all namespaces\n# namespace-wildcard-cert-selector: {}\n#\n# Useful labels include the \"kubernetes.io/metadata.name\" label to\n# avoid provisioning a certificate for the \"kube-system\" namespaces.\n# Use the following selector to match pre-1.0 behavior of using\n# \"networking.knative.dev/disableWildcardCert\" to exclude namespaces:\n#\n# matchExpressions:\n# - key: \"networking.knative.dev/disableWildcardCert\"\n# operator: \"NotIn\"\n# values: [\"true\"]\nnamespace-wildcard-cert-selector: \"\"\n\n# domain-template specifies the golang text template string to use\n# when constructing the Knative service's DNS name. The default\n# value is \"{{.Name}}.{{.Namespace}}.{{.Domain}}\".\n#\n# Valid variables defined in the template include Name, Namespace, Domain,\n# Labels, and Annotations. Name will be the result of the tag-template\n# below, if a tag is specified for the route.\n#\n# Changing this value might be necessary when the extra levels in\n# the domain name generated is problematic for wildcard certificates\n# that only support a single level of domain name added to the\n# certificate's domain. In those cases you might consider using a value\n# of \"{{.Name}}-{{.Namespace}}.{{.Domain}}\", or removing the Namespace\n# entirely from the template. When choosing a new value be thoughtful\n# of the potential for conflicts - for example, when users choose to use\n# characters such as `-` in their service, or namespace, names.\n# {{.Annotations}} or {{.Labels}} can be used for any customization in the\n# go template if needed.\n# We strongly recommend keeping namespace part of the template to avoid\n# domain name clashes:\n# eg. '{{.Name}}-{{.Namespace}}.{{ index .Annotations \"sub\"}}.{{.Domain}}'\n# and you have an annotation {\"sub\":\"foo\"}, then the generated template\n# would be {Name}-{Namespace}.foo.{Domain}\ndomain-template: \"{{.Name}}.{{.Namespace}}.{{.Domain}}\"\n\n# tag-template specifies the golang text template string to use\n# when constructing the DNS name for \"tags\" within the traffic blocks\n# of Routes and Configuration. This is used in conjunction with the\n# domain-template above to determine the full URL for the tag.\ntag-template: \"{{.Tag}}-{{.Name}}\"\n\n# auto-tls is deprecated and replaced by external-domain-tls\nauto-tls: \"Disabled\"\n\n# Controls whether TLS certificates are automatically provisioned and\n# installed in the Knative ingress to terminate TLS connections\n# for cluster external domains (like: app.example.com)\n# - Enabled: enables the TLS certificate provisioning feature for cluster external domains.\n# - Disabled: disables the TLS certificate provisioning feature for cluster external domains.\nexternal-domain-tls: \"Disabled\"\n\n# Controls weather TLS certificates are automatically provisioned and\n# installed in the Knative ingress to terminate TLS connections\n# for cluster local domains (like: app.namespace.svc.)\n# - Enabled: enables the TLS certificate provisioning feature for cluster cluster-local domains.\n# - Disabled: disables the TLS certificate provisioning feature for cluster cluster local domains.\n# NOTE: This flag is in an alpha state and is mostly here to enable internal testing\n# for now. Use with caution.\ncluster-local-domain-tls: \"Disabled\"\n\n# internal-encryption is deprecated and replaced by system-internal-tls\ninternal-encryption: \"false\"\n\n# system-internal-tls controls weather TLS encryption is used for connections between\n# the internal components of Knative:\n# - ingress to activator\n# - ingress to queue-proxy\n# - activator to queue-proxy\n#\n# Possible values for this flag are:\n# - Enabled: enables the TLS certificate provisioning feature for cluster cluster-local domains.\n# - Disabled: disables the TLS certificate provisioning feature for cluster cluster local domains.\n# NOTE: This flag is in an alpha state and is mostly here to enable internal testing\n# for now. Use with caution.\nsystem-internal-tls: \"Disabled\"\n\n# Controls the behavior of the HTTP endpoint for the Knative ingress.\n# It requires auto-tls to be enabled.\n# - Enabled: The Knative ingress will be able to serve HTTP connection.\n# - Redirected: The Knative ingress will send a 301 redirect for all\n# http connections, asking the clients to use HTTPS.\n#\n# \"Disabled\" option is deprecated.\nhttp-protocol: \"Enabled\"\n\n# rollout-duration contains the minimal duration in seconds over which the\n# Configuration traffic targets are rolled out to the newest revision.\nrollout-duration: \"0\"\n\n# autocreate-cluster-domain-claims controls whether ClusterDomainClaims should\n# be automatically created (and deleted) as needed when DomainMappings are\n# reconciled.\n#\n# If this is \"false\" (the default), the cluster administrator is\n# responsible for creating ClusterDomainClaims and delegating them to\n# namespaces via their spec.Namespace field. This setting should be used in\n# multitenant environments which need to control which namespace can use a\n# particular domain name in a domain mapping.\n#\n# If this is \"true\", users are able to associate arbitrary names with their\n# services via the DomainMapping feature.\nautocreate-cluster-domain-claims: \"false\"\n\n# If true, networking plugins can add additional information to deployed\n# applications to make their pods directly accessible via their IPs even if mesh is\n# enabled and thus direct-addressability is usually not possible.\n# Consumers like Knative Serving can use this setting to adjust their behavior\n# accordingly, i.e. to drop fallback solutions for non-pod-addressable systems.\n#\n# NOTE: This flag is in an alpha state and is mostly here to enable internal testing\n# for now. Use with caution.\nenable-mesh-pod-addressability: \"false\"\n\n# mesh-compatibility-mode indicates whether consumers of network plugins\n# should directly contact Pod IPs (most efficient), or should use the\n# Cluster IP (less efficient, needed when mesh is enabled unless\n# `enable-mesh-pod-addressability`, above, is set).\n# Permitted values are:\n# - \"auto\" (default): automatically determine which mesh mode to use by trying Pod IP and falling back to Cluster IP as needed.\n# - \"enabled\": always use Cluster IP and do not attempt to use Pod IPs.\n# - \"disabled\": always use Pod IPs and do not fall back to Cluster IP on failure.\nmesh-compatibility-mode: \"auto\"\n\n# Defines the scheme used for external URLs if auto-tls is not enabled.\n# This can be used for making Knative report all URLs as \"HTTPS\" for example, if you're\n# fronting Knative with an external loadbalancer that deals with TLS termination and\n# Knative doesn't know about that otherwise.\ndefault-external-scheme: \"http\"\n" - } -}; -export const ConfigMap_ConfigObservability: KubernetesResource = { - apiVersion: "v1", - kind: "ConfigMap", - metadata: { - annotations: { - "knative.dev/example-checksum": "59abacb5" - }, - labels: { - "app.kubernetes.io/component": "observability", - "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1" - }, - name: "config-observability", - namespace: "knative-serving" - }, - data: { - _example: "################################\n# #\n# EXAMPLE CONFIGURATION #\n# #\n################################\n\n# This block is not actually functional configuration,\n# but serves to illustrate the available configuration\n# options and document them in a way that is accessible\n# to users that `kubectl edit` this config map.\n#\n# These sample configuration options may be copied out of\n# this example block and unindented to be in the data block\n# to actually change the configuration.\n\n# logging.enable-var-log-collection defaults to false.\n# The fluentd daemon set will be set up to collect /var/log if\n# this flag is true.\nlogging.enable-var-log-collection: \"false\"\n\n# logging.revision-url-template provides a template to use for producing the\n# logging URL that is injected into the status of each Revision.\nlogging.revision-url-template: \"http://logging.example.com/?revisionUID=${REVISION_UID}\"\n\n# If non-empty, this enables queue proxy writing user request logs to stdout, excluding probe\n# requests.\n# NB: after 0.18 release logging.enable-request-log must be explicitly set to true\n# in order for request logging to be enabled.\n#\n# The value determines the shape of the request logs and it must be a valid go text/template.\n# It is important to keep this as a single line. Multiple lines are parsed as separate entities\n# by most collection agents and will split the request logs into multiple records.\n#\n# The following fields and functions are available to the template:\n#\n# Request: An http.Request (see https://golang.org/pkg/net/http/#Request)\n# representing an HTTP request received by the server.\n#\n# Response:\n# struct {\n# Code int // HTTP status code (see https://www.iana.org/assignments/http-status-codes/http-status-codes.xhtml)\n# Size int // An int representing the size of the response.\n# Latency float64 // A float64 representing the latency of the response in seconds.\n# }\n#\n# Revision:\n# struct {\n# Name string // Knative revision name\n# Namespace string // Knative revision namespace\n# Service string // Knative service name\n# Configuration string // Knative configuration name\n# PodName string // Name of the pod hosting the revision\n# PodIP string // IP of the pod hosting the revision\n# }\n#\nlogging.request-log-template: '{\"httpRequest\": {\"requestMethod\": \"{{.Request.Method}}\", \"requestUrl\": \"{{js .Request.RequestURI}}\", \"requestSize\": \"{{.Request.ContentLength}}\", \"status\": {{.Response.Code}}, \"responseSize\": \"{{.Response.Size}}\", \"userAgent\": \"{{js .Request.UserAgent}}\", \"remoteIp\": \"{{js .Request.RemoteAddr}}\", \"serverIp\": \"{{.Revision.PodIP}}\", \"referer\": \"{{js .Request.Referer}}\", \"latency\": \"{{.Response.Latency}}s\", \"protocol\": \"{{.Request.Proto}}\"}, \"traceId\": \"{{.TraceID}}\"}'\n\n# If true, the request logging will be enabled.\nlogging.enable-request-log: \"false\"\n\n# If true, this enables queue proxy writing request logs for probe requests to stdout.\n# It uses the same template for user requests, i.e. logging.request-log-template.\nlogging.enable-probe-request-log: \"false\"\n\n# metrics-protocol field specifies the protocol used when exporting metrics\n# It supports either 'none' (the default), 'prometheus', 'http/protobuf' (OTLP HTTP), 'grpc' (OTLP gRPC)\nmetrics-protocol: http/protobuf\n\n# metrics-endpoint field specifies the destination metrics should be exporter to.\n#\n# The endpoint MUST be set when the protocol is http/protobuf or grpc.\n# The endpoint MUST NOT be set when the protocol is none.\n#\n# When the protocol is prometheus the endpoint can accept a 'host:port' string to customize the\n# listening host interface and port.\nmetrics-endpoint: http://example.com/v1/traces\n\n# metrics-export-interval specifies the global metrics reporting period for control and data plane components.\n# If a zero or negative value is passed the default reporting OTel period is used (60 secs).\nmetrics-export-interval: 60s\n\n# request-metrics-protocol field specifies the protocol used when exporting queue-proxy metrics\n# It supports either 'none' (the default), 'prometheus', 'http/protobuf' (OTLP HTTP), 'grpc' (OTLP gRPC)\nrequest-metrics-protocol: http/protobuf\n\n# request-metrics-endpoint field specifies the destination metrics from the queue proxy should be exporter to.\n#\n# The endpoint MUST be set when the protocol is http/protobuf or grpc.\n# The endpoint MUST NOT be set when the protocol is none.\n#\n# When the protocol is prometheus the endpoint can accept a 'host:port' string to customize the\n# listening host interface and port.\nrequest-metrics-endpoint: http://promstack-kube-prometheus-prometheus.observability:9090/api/v1/otlp/v1/metrics\n\n# request-metrics-export-interval specifies the global metrics reporting period for the queue-proxy.\n#\n# If a zero or negative value is passed the default reporting OTel period is used (60 secs).\nrequest-metrics-export-interval: 60s\n\n# runtime-profiling indicates whether it is allowed to retrieve runtime profiling data from\n# the pods via an HTTP server in the format expected by the pprof visualization tool. When\n# enabled, the Knative Serving pods expose the profiling data on an alternate HTTP port 8008.\n# The HTTP context root for profiling is then /debug/pprof/.\nruntime-profiling: enabled\n\n# tracing-protocol field specifies the protocol used when exporting traces\n# It supports either 'none' (the default), 'http/protobuf' (OTLP HTTP), 'grpc' (OTLP gRPC)\n# or `stdout` for debugging purposes\ntracing-protocol: http/protobuf\n\n# tracing-endpoint field specifies the destination traces should be exporter to.\n#\n# The endpoint MUST be set when the protocol is http/protobuf or grpc.\n# The endpoint MUST NOT be set when the protocol is none.\ntracing-endpoint: http://jaeger-collector.observability:4318/v1/traces\n\n# tracing-sampling-rate allows the user to specify what percentage of all traces should be exported\n# The value should be between 0 (never sample) to 1 (always sample)\ntracing-sampling-rate: \"1\"\n" - } -}; -export const ConfigMap_ConfigTracing: KubernetesResource = { - apiVersion: "v1", - kind: "ConfigMap", - metadata: { - annotations: { - "knative.dev/example-checksum": "04c7e9a3" - }, - labels: { - "app.kubernetes.io/component": "tracing", - "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1" - }, - name: "config-tracing", - namespace: "knative-serving" - }, - data: { - _example: "###########################################################\n# #\n# This config is deprecated - use config-observability #\n# #\n###########################################################\n" - } -}; -export const HorizontalPodAutoscaler_Activator: KubernetesResource = { - apiVersion: "autoscaling/v2", - kind: "HorizontalPodAutoscaler", - metadata: { - labels: { - "app.kubernetes.io/component": "activator", - "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1" - }, - name: "activator", - namespace: "knative-serving" - }, - spec: { - maxReplicas: 20, - metrics: [{ - resource: { - name: "cpu", - target: { - averageUtilization: 100, - type: "Utilization" - } - }, - type: "Resource" - }], - minReplicas: 1, - scaleTargetRef: { - apiVersion: "apps/v1", - kind: "Deployment", - name: "activator" - } - } -}; -export const PodDisruptionBudget_ActivatorPdb: KubernetesResource = { - apiVersion: "policy/v1", - kind: "PodDisruptionBudget", - metadata: { - labels: { - "app.kubernetes.io/component": "activator", - "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1" - }, - name: "activator-pdb", - namespace: "knative-serving" - }, - spec: { - minAvailable: "80%", - selector: { - matchLabels: { - app: "activator" - } - } - } -}; -export const Deployment_Activator: KubernetesResource = { - apiVersion: "apps/v1", - kind: "Deployment", - metadata: { - labels: { - "app.kubernetes.io/component": "activator", - "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1" - }, - name: "activator", - namespace: "knative-serving" - }, - spec: { - selector: { - matchLabels: { - app: "activator", - role: "activator" - } - }, - template: { - metadata: { - labels: { - app: "activator", - "app.kubernetes.io/component": "activator", - "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1", - role: "activator" - } - }, - spec: { - affinity: { - podAntiAffinity: { - preferredDuringSchedulingIgnoredDuringExecution: [{ - podAffinityTerm: { - labelSelector: { - matchLabels: { - app: "activator" - } - }, - topologyKey: "kubernetes.io/hostname" - }, - weight: 100 - }] - } - }, - containers: [{ - env: [{ - name: "GOGC", - value: "500" - }, { - name: "POD_NAME", - valueFrom: { - fieldRef: { - fieldPath: "metadata.name" - } - } - }, { - name: "POD_IP", - valueFrom: { - fieldRef: { - fieldPath: "status.podIP" - } - } - }, { - name: "SYSTEM_NAMESPACE", - valueFrom: { - fieldRef: { - fieldPath: "metadata.namespace" - } - } - }, { - name: "CONFIG_LOGGING_NAME", - value: "config-logging" - }, { - name: "CONFIG_OBSERVABILITY_NAME", - value: "config-observability" - }], - image: "gcr.io/knative-releases/knative.dev/serving/cmd/activator@sha256:5deaef961fef8d1417f6d4a4dfae2fc338f2d30d72c4ad58c3ab392b2c04705b", - livenessProbe: { - failureThreshold: 12, - httpGet: { - port: 8012 - }, - initialDelaySeconds: 15, - periodSeconds: 10 - }, - name: "activator", - ports: [{ - containerPort: 9090, - name: "metrics" - }, { - containerPort: 8008, - name: "profiling" - }, { - containerPort: 8012, - name: "http1" - }, { - containerPort: 8013, - name: "h2c" - }], - readinessProbe: { - failureThreshold: 5, - httpGet: { - port: 8012 - }, - periodSeconds: 5 - }, - resources: { - limits: { - cpu: "1000m", - memory: "600Mi" - }, - requests: { - cpu: "300m", - memory: "60Mi" - } - }, - securityContext: { - allowPrivilegeEscalation: false, - capabilities: { - drop: ["ALL"] - }, - readOnlyRootFilesystem: true, - runAsNonRoot: true, - seccompProfile: { - type: "RuntimeDefault" - } - } - }], - serviceAccountName: "activator", - terminationGracePeriodSeconds: 600 - } - } - } -}; -export const Service_ActivatorService: KubernetesResource = { - apiVersion: "v1", - kind: "Service", - metadata: { - labels: { - app: "activator", - "app.kubernetes.io/component": "activator", - "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1" - }, - name: "activator-service", - namespace: "knative-serving" - }, - spec: { - ports: [{ - name: "http-metrics", - port: 9090, - targetPort: 9090 - }, { - name: "http-profiling", - port: 8008, - targetPort: 8008 - }, { - name: "http", - port: 80, - targetPort: 8012 - }, { - name: "http2", - port: 81, - targetPort: 8013 - }, { - name: "https", - port: 443, - targetPort: 8112 - }], - selector: { - app: "activator" - }, - type: "ClusterIP" - } -}; -export const Deployment_Autoscaler: KubernetesResource = { - apiVersion: "apps/v1", - kind: "Deployment", - metadata: { - labels: { - "app.kubernetes.io/component": "autoscaler", - "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1" - }, - name: "autoscaler", - namespace: "knative-serving" - }, - spec: { - replicas: 1, - selector: { - matchLabels: { - app: "autoscaler" - } - }, - strategy: { - rollingUpdate: { - maxUnavailable: 0 - }, - type: "RollingUpdate" - }, - template: { - metadata: { - labels: { - app: "autoscaler", - "app.kubernetes.io/component": "autoscaler", - "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1" - } - }, - spec: { - affinity: { - podAntiAffinity: { - preferredDuringSchedulingIgnoredDuringExecution: [{ - podAffinityTerm: { - labelSelector: { - matchLabels: { - app: "autoscaler" - } - }, - topologyKey: "kubernetes.io/hostname" - }, - weight: 100 - }] - } - }, - containers: [{ - env: [{ - name: "POD_NAME", - valueFrom: { - fieldRef: { - fieldPath: "metadata.name" - } - } - }, { - name: "POD_IP", - valueFrom: { - fieldRef: { - fieldPath: "status.podIP" - } - } - }, { - name: "SYSTEM_NAMESPACE", - valueFrom: { - fieldRef: { - fieldPath: "metadata.namespace" - } - } - }, { - name: "CONFIG_LOGGING_NAME", - value: "config-logging" - }, { - name: "CONFIG_OBSERVABILITY_NAME", - value: "config-observability" - }], - image: "gcr.io/knative-releases/knative.dev/serving/cmd/autoscaler@sha256:5bae38655d87df86b041083fbe51791816473245f752432ba9b85a7b12f73cd5", - livenessProbe: { - failureThreshold: 6, - httpGet: { - port: 8080 - } - }, - name: "autoscaler", - ports: [{ - containerPort: 9090, - name: "metrics" - }, { - containerPort: 8008, - name: "profiling" - }, { - containerPort: 8080, - name: "websocket" - }], - readinessProbe: { - httpGet: { - port: 8080 - } - }, - resources: { - limits: { - cpu: "1000m", - memory: "1000Mi" - }, - requests: { - cpu: "100m", - memory: "100Mi" - } - }, - securityContext: { - allowPrivilegeEscalation: false, - capabilities: { - drop: ["ALL"] - }, - readOnlyRootFilesystem: true, - runAsNonRoot: true, - seccompProfile: { - type: "RuntimeDefault" - } - } - }], - serviceAccountName: "controller" - } - } - } -}; -export const Service_Autoscaler: KubernetesResource = { - apiVersion: "v1", - kind: "Service", - metadata: { - labels: { - app: "autoscaler", - "app.kubernetes.io/component": "autoscaler", - "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1" - }, - name: "autoscaler", - namespace: "knative-serving" - }, - spec: { - ports: [{ - name: "http-metrics", - port: 9090, - targetPort: 9090 - }, { - name: "http-profiling", - port: 8008, - targetPort: 8008 - }, { - name: "http", - port: 8080, - targetPort: 8080 - }], - selector: { - app: "autoscaler" - } - } -}; -export const Deployment_Controller: KubernetesResource = { - apiVersion: "apps/v1", - kind: "Deployment", - metadata: { - labels: { - "app.kubernetes.io/component": "controller", - "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1" - }, - name: "controller", - namespace: "knative-serving" - }, - spec: { - selector: { - matchLabels: { - app: "controller" - } - }, - template: { - metadata: { - labels: { - app: "controller", - "app.kubernetes.io/component": "controller", - "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1" - } - }, - spec: { - affinity: { - podAntiAffinity: { - preferredDuringSchedulingIgnoredDuringExecution: [{ - podAffinityTerm: { - labelSelector: { - matchLabels: { - app: "controller" - } - }, - topologyKey: "kubernetes.io/hostname" - }, - weight: 100 - }] - } - }, - containers: [{ - env: [{ - name: "POD_NAME", - valueFrom: { - fieldRef: { - fieldPath: "metadata.name" - } - } - }, { - name: "SYSTEM_NAMESPACE", - valueFrom: { - fieldRef: { - fieldPath: "metadata.namespace" - } - } - }, { - name: "CONFIG_LOGGING_NAME", - value: "config-logging" - }, { - name: "CONFIG_OBSERVABILITY_NAME", - value: "config-observability" - }], - image: "gcr.io/knative-releases/knative.dev/serving/cmd/controller@sha256:94329d85200c2fc31ed1166a26568ca1357376c149c147e71f400cf28be3c816", - livenessProbe: { - failureThreshold: 6, - httpGet: { - path: "/health", - port: "probes", - scheme: "HTTP" - }, - periodSeconds: 5 - }, - name: "controller", - ports: [{ - containerPort: 9090, - name: "metrics" - }, { - containerPort: 8008, - name: "profiling" - }, { - containerPort: 8080, - name: "probes" - }], - readinessProbe: { - failureThreshold: 3, - httpGet: { - path: "/readiness", - port: "probes", - scheme: "HTTP" - }, - periodSeconds: 5 - }, - resources: { - limits: { - cpu: "1000m", - memory: "1000Mi" - }, - requests: { - cpu: "100m", - memory: "100Mi" - } - }, - securityContext: { - allowPrivilegeEscalation: false, - capabilities: { - drop: ["ALL"] - }, - readOnlyRootFilesystem: true, - runAsNonRoot: true, - seccompProfile: { - type: "RuntimeDefault" - } - } - }], - serviceAccountName: "controller" - } - } - } -}; -export const Service_Controller: KubernetesResource = { - apiVersion: "v1", - kind: "Service", - metadata: { - labels: { - app: "controller", - "app.kubernetes.io/component": "controller", - "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1" - }, - name: "controller", - namespace: "knative-serving" - }, - spec: { - ports: [{ - name: "http-metrics", - port: 9090, - targetPort: 9090 - }, { - name: "http-profiling", - port: 8008, - targetPort: 8008 - }], - selector: { - app: "controller" - } - } -}; -export const HorizontalPodAutoscaler_Webhook: KubernetesResource = { - apiVersion: "autoscaling/v2", - kind: "HorizontalPodAutoscaler", - metadata: { - labels: { - "app.kubernetes.io/component": "webhook", - "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1" - }, - name: "webhook", - namespace: "knative-serving" - }, - spec: { - maxReplicas: 5, - metrics: [{ - resource: { - name: "cpu", - target: { - averageUtilization: 100, - type: "Utilization" - } - }, - type: "Resource" - }], - minReplicas: 1, - scaleTargetRef: { - apiVersion: "apps/v1", - kind: "Deployment", - name: "webhook" - } - } -}; -export const PodDisruptionBudget_WebhookPdb: KubernetesResource = { - apiVersion: "policy/v1", - kind: "PodDisruptionBudget", - metadata: { - labels: { - "app.kubernetes.io/component": "webhook", - "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1" - }, - name: "webhook-pdb", - namespace: "knative-serving" - }, - spec: { - minAvailable: "80%", - selector: { - matchLabels: { - app: "webhook" - } - } - } -}; -export const Deployment_Webhook: KubernetesResource = { - apiVersion: "apps/v1", - kind: "Deployment", - metadata: { - labels: { - "app.kubernetes.io/component": "webhook", - "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1" - }, - name: "webhook", - namespace: "knative-serving" - }, - spec: { - selector: { - matchLabels: { - app: "webhook", - role: "webhook" - } - }, - template: { - metadata: { - labels: { - app: "webhook", - "app.kubernetes.io/component": "webhook", - "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1", - role: "webhook" - } - }, - spec: { - affinity: { - podAntiAffinity: { - preferredDuringSchedulingIgnoredDuringExecution: [{ - podAffinityTerm: { - labelSelector: { - matchLabels: { - app: "webhook" - } - }, - topologyKey: "kubernetes.io/hostname" - }, - weight: 100 - }] - } - }, - containers: [{ - env: [{ - name: "POD_NAME", - valueFrom: { - fieldRef: { - fieldPath: "metadata.name" - } - } - }, { - name: "SYSTEM_NAMESPACE", - valueFrom: { - fieldRef: { - fieldPath: "metadata.namespace" - } - } - }, { - name: "CONFIG_LOGGING_NAME", - value: "config-logging" - }, { - name: "CONFIG_OBSERVABILITY_NAME", - value: "config-observability" - }, { - name: "WEBHOOK_NAME", - value: "webhook" - }, { - name: "WEBHOOK_PORT", - value: "8443" - }], - image: "gcr.io/knative-releases/knative.dev/serving/cmd/webhook@sha256:8470456be214e93a84e3c7b79a632aa9978bd8ecda553feaa47878a2c24ab84d", - livenessProbe: { - failureThreshold: 6, - httpGet: { - port: 8443, - scheme: "HTTPS" - }, - initialDelaySeconds: 20, - periodSeconds: 10 - }, - name: "webhook", - ports: [{ - containerPort: 9090, - name: "metrics" - }, { - containerPort: 8008, - name: "profiling" - }, { - containerPort: 8443, - name: "https-webhook" - }], - readinessProbe: { - httpGet: { - port: 8443, - scheme: "HTTPS" - }, - periodSeconds: 1 - }, - resources: { - limits: { - cpu: "500m", - memory: "500Mi" - }, - requests: { - cpu: "100m", - memory: "100Mi" - } - }, - securityContext: { - allowPrivilegeEscalation: false, - capabilities: { - drop: ["ALL"] - }, - readOnlyRootFilesystem: true, - runAsNonRoot: true, - seccompProfile: { - type: "RuntimeDefault" - } - } - }], - serviceAccountName: "controller", - terminationGracePeriodSeconds: 300 - } - } - } -}; -export const Service_Webhook: KubernetesResource = { - apiVersion: "v1", - kind: "Service", - metadata: { - labels: { - app: "webhook", - "app.kubernetes.io/component": "webhook", - "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1", - role: "webhook" - }, - name: "webhook", - namespace: "knative-serving" - }, - spec: { - ports: [{ - name: "http-metrics", - port: 9090, - targetPort: 9090 - }, { - name: "http-profiling", - port: 8008, - targetPort: 8008 - }, { - name: "https-webhook", - port: 443, - targetPort: 8443 - }], - selector: { - app: "webhook", - role: "webhook" - } - } -}; -export const ValidatingWebhookConfiguration_ConfigWebhookServingKnativeDev: KubernetesResource = { - apiVersion: "admissionregistration.k8s.io/v1", - kind: "ValidatingWebhookConfiguration", - metadata: { - labels: { - "app.kubernetes.io/component": "webhook", - "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1" - }, - name: "config.webhook.serving.knative.dev" - }, - webhooks: [{ - admissionReviewVersions: ["v1", "v1beta1"], - clientConfig: { - service: { - name: "webhook", - namespace: "knative-serving" - } - }, - failurePolicy: "Fail", - name: "config.webhook.serving.knative.dev", - objectSelector: { - matchExpressions: [{ - key: "app.kubernetes.io/name", - operator: "In", - values: ["knative-serving"] - }, { - key: "app.kubernetes.io/component", - operator: "In", - values: ["autoscaler", "controller", "logging", "networking", "observability", "tracing", "net-certmanager"] - }] - }, - sideEffects: "None", - timeoutSeconds: 10 - }] -}; -export const MutatingWebhookConfiguration_WebhookServingKnativeDev: KubernetesResource = { - apiVersion: "admissionregistration.k8s.io/v1", - kind: "MutatingWebhookConfiguration", - metadata: { - labels: { - "app.kubernetes.io/component": "webhook", - "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1" - }, - name: "webhook.serving.knative.dev" - }, - webhooks: [{ - admissionReviewVersions: ["v1", "v1beta1"], - clientConfig: { - service: { - name: "webhook", - namespace: "knative-serving" - } - }, - failurePolicy: "Fail", - name: "webhook.serving.knative.dev", - rules: [{ - apiGroups: ["autoscaling.internal.knative.dev", "networking.internal.knative.dev", "serving.knative.dev"], - apiVersions: ["*"], - operations: ["CREATE", "UPDATE"], - resources: ["metrics", "podautoscalers", "certificates", "ingresses", "serverlessservices", "configurations", "revisions", "routes", "services", "domainmappings", "domainmappings/status"], - scope: "*" - }], - sideEffects: "None", - timeoutSeconds: 10 - }] -}; -export const ValidatingWebhookConfiguration_ValidationWebhookServingKnativeDev: KubernetesResource = { - apiVersion: "admissionregistration.k8s.io/v1", - kind: "ValidatingWebhookConfiguration", - metadata: { - labels: { - "app.kubernetes.io/component": "webhook", - "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1" - }, - name: "validation.webhook.serving.knative.dev" - }, - webhooks: [{ - admissionReviewVersions: ["v1", "v1beta1"], - clientConfig: { - service: { - name: "webhook", - namespace: "knative-serving" - } - }, - failurePolicy: "Fail", - name: "validation.webhook.serving.knative.dev", - rules: [{ - apiGroups: ["autoscaling.internal.knative.dev", "networking.internal.knative.dev", "serving.knative.dev"], - apiVersions: ["*"], - operations: ["CREATE", "UPDATE", "DELETE"], - resources: ["metrics", "podautoscalers", "certificates", "ingresses", "serverlessservices", "configurations", "revisions", "routes", "services", "domainmappings", "domainmappings/status"], - scope: "*" - }], - sideEffects: "None", - timeoutSeconds: 10 - }] -}; -export const Secret_WebhookCerts: KubernetesResource = { - apiVersion: "v1", - kind: "Secret", - metadata: { - labels: { - "app.kubernetes.io/component": "webhook", - "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1" - }, - name: "webhook-certs", - namespace: "knative-serving" - } -}; -export const Namespace_KourierSystem: KubernetesResource = { - apiVersion: "v1", - kind: "Namespace", - metadata: { - labels: { - "app.kubernetes.io/component": "net-kourier", - "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1", - "networking.knative.dev/ingress-provider": "kourier" - }, - name: "kourier-system" - } -}; -export const ConfigMap_KourierBootstrap: KubernetesResource = { - apiVersion: "v1", - kind: "ConfigMap", - metadata: { - labels: { - "app.kubernetes.io/component": "net-kourier", - "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1", - "networking.knative.dev/ingress-provider": "kourier" - }, - name: "kourier-bootstrap", - namespace: "kourier-system" - }, - data: { - "envoy-bootstrap.yaml": "dynamic_resources:\n ads_config:\n transport_api_version: V3\n api_type: GRPC\n rate_limit_settings: {}\n grpc_services:\n - envoy_grpc: {cluster_name: xds_cluster}\n cds_config:\n resource_api_version: V3\n ads: {}\n lds_config:\n resource_api_version: V3\n ads: {}\nnode:\n cluster: kourier-knative\n id: 3scale-kourier-gateway\nstatic_resources:\n listeners:\n - name: stats_listener\n address:\n socket_address:\n address: 0.0.0.0\n port_value: 9000\n filter_chains:\n - filters:\n - name: envoy.filters.network.http_connection_manager\n typed_config:\n \"@type\": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\n stat_prefix: stats_server\n http_filters:\n - name: envoy.filters.http.router\n typed_config:\n \"@type\": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\n route_config:\n virtual_hosts:\n - name: admin_interface\n domains:\n - \"*\"\n routes:\n - match:\n safe_regex:\n regex: '/(certs|stats(/prometheus)?|server_info|clusters|listeners|ready)?'\n headers:\n - name: ':method'\n string_match:\n exact: GET\n route:\n cluster: service_stats\n - match:\n safe_regex:\n regex: '/drain_listeners'\n headers:\n - name: ':method'\n string_match:\n exact: POST\n route:\n cluster: service_stats\n clusters:\n - name: service_stats\n connect_timeout: 0.250s\n type: static\n load_assignment:\n cluster_name: service_stats\n endpoints:\n lb_endpoints:\n endpoint:\n address:\n socket_address:\n address: 127.0.0.1\n port_value: 9901\n - name: xds_cluster\n # This keepalive is recommended by envoy docs.\n # https://www.envoyproxy.io/docs/envoy/latest/api-docs/xds_protocol\n typed_extension_protocol_options:\n envoy.extensions.upstreams.http.v3.HttpProtocolOptions:\n \"@type\": type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\n explicit_http_config:\n http2_protocol_options:\n connection_keepalive:\n interval: 30s\n timeout: 5s\n connect_timeout: 1s\n load_assignment:\n cluster_name: xds_cluster\n endpoints:\n lb_endpoints:\n endpoint:\n address:\n socket_address:\n address: \"net-kourier-controller.knative-serving\"\n port_value: 18000\n type: STRICT_DNS\nadmin:\n access_log:\n - name: envoy.access_loggers.stdout\n typed_config:\n \"@type\": type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog\n address:\n socket_address:\n address: 127.0.0.1\n port_value: 9901\n" - } -}; -export const ConfigMap_ConfigKourier: KubernetesResource = { - apiVersion: "v1", - kind: "ConfigMap", - metadata: { - labels: { - "app.kubernetes.io/component": "net-kourier", - "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1", - "networking.knative.dev/ingress-provider": "kourier" - }, - name: "config-kourier", - namespace: "knative-serving" - }, - data: { - _example: "################################\n# #\n# EXAMPLE CONFIGURATION #\n# #\n################################\n\n# This block is not actually functional configuration,\n# but serves to illustrate the available configuration\n# options and document them in a way that is accessible\n# to users that `kubectl edit` this config map.\n#\n# These sample configuration options may be copied out of\n# this example block and unindented to be in the data block\n# to actually change the configuration.\n\n# Specifies whether requests reaching the Kourier gateway\n# in the context of services should be logged. Readiness\n# probes etc. must be configured via the bootstrap config.\nenable-service-access-logging: \"true\"\n\n# Specifies the format of the access log used by the Kourier gateway.\n# This template follows the envoy format.\n# see: https://www.envoyproxy.io/docs/envoy/latest/configuration/observability/access_log/usage#access-logging\nservice-access-log-template: \"\"\n\n# Specifies whether to use proxy-protocol in order to safely\n# transport connection information such as a client's address\n# across multiple layers of TCP proxies.\n# NOTE THAT THIS IS AN EXPERIMENTAL / ALPHA FEATURE\nenable-proxy-protocol: \"false\"\n\n# The server certificates to serve the internal TLS traffic for Kourier Gateway.\n# It is specified by the secret name in controller namespace, which has\n# the \"tls.crt\" and \"tls.key\" data field.\n# Use an empty value to disable the feature (default).\n#\n# NOTE: This flag is in an alpha state and is mostly here to enable internal testing\n# for now. Use with caution.\ncluster-cert-secret: \"\"\n\n# Specifies the amount of time that Kourier waits for the incoming requests.\n# The default, 0s, imposes no timeout at all.\nstream-idle-timeout: \"0s\"\n\n# Specifies whether to use CryptoMB private key provider in order to\n# acclerate the TLS handshake.\n# NOTE THAT THIS IS AN EXPERIMENTAL / ALPHA FEATURE.\nenable-cryptomb: \"false\"\n\n# Configures the number of additional ingress proxy hops from the\n# right side of the x-forwarded-for HTTP header to trust.\ntrusted-hops-count: \"0\"\n\n# Configures the connection manager to use the real remote address\n# of the client connection when determining internal versus external origin and manipulating various headers.\nuse-remote-address: \"false\"\n\n# Specifies the cipher suites for TLS external listener.\n# Use ',' separated values like \"ECDHE-ECDSA-AES128-GCM-SHA256,ECDHE-ECDSA-CHACHA20-POLY1305\"\n# The default uses the default cipher suites of the envoy version.\ncipher-suites: \"\"\n\n# Disable the Envoy server header injection in the response when response has no such header.\ndisable-envoy-server-header: \"false\"\n\n# The external authorization service and port, my-auth:2222.\n# This value overrides environment variable if defined.\nextauthz-host: \"\"\n\n# The protocol used to query the ext auth service. Can be one of : grpc, http, https. Defaults to grpc\n# This value overrides environment variable if defined.\nextauthz-protocol: \"grpc\"\n\n# Allow traffic to go through if the ext auth service is down. Accepts true/false.\n# This value overrides environment variable if defined.\nextauthz-failure-mode-allow: \"\"\n\n# Max request bytes, if not set, defaults to 8192 Bytes. More info Envoy Docs\n# see: https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/http/ext_authz/v3/ext_authz.proto.html#extensions-filters-http-ext-authz-v3-buffersettings\n# This value overrides environment variable if defined.\nextauthz-max-request-body-bytes: 8192\n\n# Max time in ms to wait for the ext authz service. Defaults to 2000 ms\n# This value overrides environment variable if defined.\nextauthz-timeout: 2000\n\n# If extauthz-protocol is equal to http or https, path to query the ext auth service.\n# Example : if set to /verify, it will query /verify/ (notice the trailing /). If not set, it will query /\n# This value overrides environment variable if defined.\nextauthz-path-prefix: \"\"\n\n# If extauthz-protocol is equal to grpc, sends the body as raw bytes instead of a UTF-8 string.\n# Accepts only true/false, t/f or 1/0. Attempting to set another value will throw an error.\n# Defaults to false. More info Envoy Docs.\n# see: https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/http/ext_authz/v3/ext_authz.proto.html#extensions-filters-http-ext-authz-v3-buffersettings\n# This value overrides environment variable if defined.\nextauthz-pack-as-byte: \"false\"\n\n# Specifies the secret that contains the TLS certificate and key pair when using HTTPS communication with Kourier Ingress.\n# This value overrides environment variable if defined.\ncerts-secret-name: \"\"\ncerts-secret-namespace: \"\"\n\n# Specifies the OTLP collector endpoint for distributed tracing.\n# The endpoint format depends on the protocol (see tracing-protocol).\n# Examples:\n# - For HTTP: \"http://otel-collector.observability.svc:4318/v1/traces\"\n# - For gRPC: \"http://otel-collector.observability.svc:4317\"\n# Use an empty value to disable distributed tracing (default).\ntracing-endpoint: \"\"\n\n# Protocol for tracing collector communication.\n# Valid values: http/protobuf, grpc\ntracing-protocol: \"grpc\"\n\n# Tracing sampling rate (0.0 to 1.0)\n# Controls the percentage of requests that are traced.\n# Example: \"1.0\" traces 100% of requests.\ntracing-sampling-rate: \"1.0\"\n\n# Service name for traces\n# This identifies the Kourier gateway in your tracing system.\ntracing-service-name: \"kourier-knative\"\n" - } -}; -export const ServiceAccount_NetKourier: KubernetesResource = { - apiVersion: "v1", - kind: "ServiceAccount", - metadata: { - labels: { - "app.kubernetes.io/component": "net-kourier", - "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1", - "networking.knative.dev/ingress-provider": "kourier" - }, - name: "net-kourier", - namespace: "knative-serving" - } -}; -export const ClusterRole_NetKourier: KubernetesResource = { - apiVersion: "rbac.authorization.k8s.io/v1", - kind: "ClusterRole", - metadata: { - labels: { - "app.kubernetes.io/component": "net-kourier", - "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1", - "networking.knative.dev/ingress-provider": "kourier" - }, - name: "net-kourier" - }, - rules: [{ - apiGroups: [""], - resources: ["events"], - verbs: ["create", "update", "patch"] - }, { - apiGroups: [""], - resources: ["pods", "services", "secrets"], - verbs: ["get", "list", "watch"] - }, { - apiGroups: [""], - resources: ["configmaps"], - verbs: ["get", "list", "watch"] - }, { - apiGroups: ["discovery.k8s.io"], - resources: ["endpointslices"], - verbs: ["get", "list", "watch"] - }, { - apiGroups: ["coordination.k8s.io"], - resources: ["leases"], - verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] - }, { - apiGroups: ["networking.internal.knative.dev"], - resources: ["ingresses"], - verbs: ["get", "list", "watch", "patch"] - }, { - apiGroups: ["networking.internal.knative.dev"], - resources: ["ingresses/status"], - verbs: ["update"] - }] -}; -export const ClusterRoleBinding_NetKourier: KubernetesResource = { - apiVersion: "rbac.authorization.k8s.io/v1", - kind: "ClusterRoleBinding", - metadata: { - labels: { - "app.kubernetes.io/component": "net-kourier", - "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1", - "networking.knative.dev/ingress-provider": "kourier" - }, - name: "net-kourier" - }, - roleRef: { - apiGroup: "rbac.authorization.k8s.io", - kind: "ClusterRole", - name: "net-kourier" - }, - subjects: [{ - kind: "ServiceAccount", - name: "net-kourier", - namespace: "knative-serving" - }] -}; -export const Deployment_NetKourierController: KubernetesResource = { - apiVersion: "apps/v1", - kind: "Deployment", - metadata: { - labels: { - "app.kubernetes.io/component": "net-kourier", - "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1", - "networking.knative.dev/ingress-provider": "kourier" - }, - name: "net-kourier-controller", - namespace: "knative-serving" - }, - spec: { - replicas: 1, - selector: { - matchLabels: { - app: "net-kourier-controller" - } - }, - strategy: { - rollingUpdate: { - maxSurge: "100%", - maxUnavailable: 0 - }, - type: "RollingUpdate" - }, - template: { - metadata: { - annotations: { - "prometheus.io/path": "/metrics", - "prometheus.io/port": "9090", - "prometheus.io/scrape": "true" - }, - labels: { - app: "net-kourier-controller" - } - }, - spec: { - containers: [{ - env: [{ - name: "CERTS_SECRET_NAMESPACE", - value: "" - }, { - name: "CERTS_SECRET_NAME", - value: "" - }, { - name: "SYSTEM_NAMESPACE", - valueFrom: { - fieldRef: { - fieldPath: "metadata.namespace" - } - } - }, { - name: "METRICS_DOMAIN", - value: "knative.dev/samples" - }, { - name: "KOURIER_GATEWAY_NAMESPACE", - value: "kourier-system" - }, { - name: "ENABLE_SECRET_INFORMER_FILTERING_BY_CERT_UID", - value: "false" - }, { - name: "KUBE_API_BURST", - value: "200" - }, { - name: "KUBE_API_QPS", - value: "200" - }], - image: "gcr.io/knative-releases/knative.dev/net-kourier/cmd/kourier@sha256:01abd2070ccf8680885c47990e42c05c09e30bc8595d9246f4dcd37f2220a2a2", - livenessProbe: { - failureThreshold: 6, - grpc: { - port: 18000 - }, - periodSeconds: 10 - }, - name: "controller", - ports: [{ - containerPort: 18000, - name: "http2-xds", - protocol: "TCP" - }, { - containerPort: 9090, - name: "metrics", - protocol: "TCP" - }], - readinessProbe: { - failureThreshold: 3, - grpc: { - port: 18000 - }, - periodSeconds: 10 - }, - resources: { - limits: { - cpu: "1", - memory: "500Mi" - }, - requests: { - cpu: "200m", - memory: "200Mi" - } - }, - securityContext: { - allowPrivilegeEscalation: false, - capabilities: { - drop: ["ALL"] - }, - readOnlyRootFilesystem: true, - runAsNonRoot: true, - seccompProfile: { - type: "RuntimeDefault" - } - } - }], - restartPolicy: "Always", - serviceAccountName: "net-kourier" - } - } - } -}; -export const Service_NetKourierController: KubernetesResource = { - apiVersion: "v1", - kind: "Service", - metadata: { - labels: { - "app.kubernetes.io/component": "net-kourier", - "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1", - "networking.knative.dev/ingress-provider": "kourier" - }, - name: "net-kourier-controller", - namespace: "knative-serving" - }, - spec: { - ports: [{ - name: "grpc-xds", - port: 18000, - protocol: "TCP", - targetPort: 18000 - }, { - name: "http-metrics", - port: 9090, - protocol: "TCP", - targetPort: 9090 - }], - selector: { - app: "net-kourier-controller" - }, - type: "ClusterIP" - } -}; -export const Deployment_3scaleKourierGateway: KubernetesResource = { - apiVersion: "apps/v1", - kind: "Deployment", - metadata: { - labels: { - "app.kubernetes.io/component": "net-kourier", - "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1", - "networking.knative.dev/ingress-provider": "kourier" - }, - name: "3scale-kourier-gateway", - namespace: "kourier-system" - }, - spec: { - selector: { - matchLabels: { - app: "3scale-kourier-gateway" - } - }, - strategy: { - rollingUpdate: { - maxSurge: "100%", - maxUnavailable: 0 - }, - type: "RollingUpdate" - }, - template: { - metadata: { - annotations: { - "networking.knative.dev/poke": "v0.26", - "prometheus.io/path": "/stats/prometheus", - "prometheus.io/port": "9000", - "prometheus.io/scrape": "true" - }, - labels: { - app: "3scale-kourier-gateway" - } - }, - spec: { - containers: [{ - args: ["--base-id 1", "-c /tmp/config/envoy-bootstrap.yaml", "--log-level info", "--drain-time-s $(DRAIN_TIME_SECONDS)", "--drain-strategy immediate"], - command: ["/usr/local/bin/envoy"], - env: [{ - name: "DRAIN_TIME_SECONDS", - value: "15" - }], - image: "docker.io/envoyproxy/envoy:v1.37-latest", - lifecycle: { - preStop: { - exec: { - command: ["/bin/sh", "-c", "curl -X POST http://localhost:9901/drain_listeners?graceful; sleep $DRAIN_TIME_SECONDS"] - } - } - }, - livenessProbe: { - failureThreshold: 6, - httpGet: { - httpHeaders: [{ - name: "Host", - value: "internalkourier" - }], - path: "/ready", - port: 8081, - scheme: "HTTP" - }, - initialDelaySeconds: 10, - periodSeconds: 5, - timeoutSeconds: 3 - }, - name: "kourier-gateway", - ports: [{ - containerPort: 8080, - name: "http2-external", - protocol: "TCP" - }, { - containerPort: 8081, - name: "http2-internal", - protocol: "TCP" - }, { - containerPort: 8443, - name: "https-external", - protocol: "TCP" - }, { - containerPort: 8090, - name: "http-probe", - protocol: "TCP" - }, { - containerPort: 9443, - name: "https-probe", - protocol: "TCP" - }, { - containerPort: 9000, - name: "metrics", - protocol: "TCP" - }], - readinessProbe: { - failureThreshold: 3, - httpGet: { - httpHeaders: [{ - name: "Host", - value: "internalkourier" - }], - path: "/ready", - port: 8081, - scheme: "HTTP" - }, - initialDelaySeconds: 10, - periodSeconds: 5, - timeoutSeconds: 3 - }, - resources: { - limits: { - cpu: "1", - memory: "800Mi" - }, - requests: { - cpu: "200m", - memory: "200Mi" - } - }, - securityContext: { - allowPrivilegeEscalation: false, - capabilities: { - drop: ["ALL"] - }, - readOnlyRootFilesystem: false, - runAsGroup: 65534, - runAsNonRoot: true, - runAsUser: 65534, - seccompProfile: { - type: "RuntimeDefault" - } - }, - volumeMounts: [{ - mountPath: "/tmp/config", - name: "config-volume" - }] - }], - restartPolicy: "Always", - terminationGracePeriodSeconds: 30, - volumes: [{ - configMap: { - name: "kourier-bootstrap" - }, - name: "config-volume" - }] - } - } - } -}; -export const Service_Kourier: KubernetesResource = { - apiVersion: "v1", - kind: "Service", - metadata: { - labels: { - "app.kubernetes.io/component": "net-kourier", - "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1", - "networking.knative.dev/ingress-provider": "kourier" - }, - name: "kourier", - namespace: "kourier-system" - }, - spec: { - ports: [{ - name: "http2", - port: 80, - protocol: "TCP", - targetPort: 8080 - }, { - name: "https", - port: 443, - protocol: "TCP", - targetPort: 8443 - }], - selector: { - app: "3scale-kourier-gateway" - }, - type: "LoadBalancer" - } -}; -export const Service_KourierInternal: KubernetesResource = { - apiVersion: "v1", - kind: "Service", - metadata: { - labels: { - "app.kubernetes.io/component": "net-kourier", - "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1", - "networking.knative.dev/ingress-provider": "kourier" - }, - name: "kourier-internal", - namespace: "kourier-system" - }, - spec: { - ports: [{ - name: "http2", - port: 80, - protocol: "TCP", - targetPort: 8081 - }, { - name: "https", - port: 443, - protocol: "TCP", - targetPort: 8444 - }], - selector: { - app: "3scale-kourier-gateway" - }, - type: "ClusterIP" - } -}; -export const HorizontalPodAutoscaler_3scaleKourierGateway: KubernetesResource = { - apiVersion: "autoscaling/v2", - kind: "HorizontalPodAutoscaler", - metadata: { - labels: { - "app.kubernetes.io/component": "net-kourier", - "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1", - "networking.knative.dev/ingress-provider": "kourier" - }, - name: "3scale-kourier-gateway", - namespace: "kourier-system" - }, - spec: { - maxReplicas: 10, - metrics: [{ - resource: { - name: "cpu", - target: { - averageUtilization: 100, - type: "Utilization" - } - }, - type: "Resource" - }], - minReplicas: 1, - scaleTargetRef: { - apiVersion: "apps/v1", - kind: "Deployment", - name: "3scale-kourier-gateway" - } - } -}; -export const PodDisruptionBudget_3scaleKourierGatewayPdb: KubernetesResource = { - apiVersion: "policy/v1", - kind: "PodDisruptionBudget", - metadata: { - labels: { - "app.kubernetes.io/component": "net-kourier", - "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1", - "networking.knative.dev/ingress-provider": "kourier" - }, - name: "3scale-kourier-gateway-pdb", - namespace: "kourier-system" - }, - spec: { - minAvailable: "80%", - selector: { - matchLabels: { - app: "3scale-kourier-gateway" - } - } - } -}; -export const resources: ReadonlyArray = [CustomResourceDefinition_CertificatesNetworkingInternalKnativeDev, CustomResourceDefinition_ConfigurationsServingKnativeDev, CustomResourceDefinition_ClusterdomainclaimsNetworkingInternalKnativeDev, CustomResourceDefinition_DomainmappingsServingKnativeDev, CustomResourceDefinition_IngressesNetworkingInternalKnativeDev, CustomResourceDefinition_MetricsAutoscalingInternalKnativeDev, CustomResourceDefinition_PodautoscalersAutoscalingInternalKnativeDev, CustomResourceDefinition_RevisionsServingKnativeDev, CustomResourceDefinition_RoutesServingKnativeDev, CustomResourceDefinition_ServerlessservicesNetworkingInternalKnativeDev, CustomResourceDefinition_ServicesServingKnativeDev, CustomResourceDefinition_ImagesCachingInternalKnativeDev, Namespace_KnativeServing, Role_KnativeServingActivator, ClusterRole_KnativeServingActivatorCluster, ClusterRole_KnativeServingAggregatedAddressableResolver, ClusterRole_KnativeServingAddressableResolver, ClusterRole_KnativeServingNamespacedAdmin, ClusterRole_KnativeServingNamespacedEdit, ClusterRole_KnativeServingNamespacedView, ClusterRole_KnativeServingCore, ClusterRole_KnativeServingPodspecableBinding, ServiceAccount_Controller, ClusterRole_KnativeServingAdmin, ClusterRoleBinding_KnativeServingControllerAdmin, ClusterRoleBinding_KnativeServingControllerAddressableResolver, ServiceAccount_Activator, RoleBinding_KnativeServingActivator, ClusterRoleBinding_KnativeServingActivatorCluster, Certificate_RoutingServingCerts, Image_QueueProxy, ConfigMap_ConfigAutoscaler, ConfigMap_ConfigCertmanager, ConfigMap_ConfigDefaults, ConfigMap_ConfigDeployment, ConfigMap_ConfigDomain, ConfigMap_ConfigFeatures, ConfigMap_ConfigGc, ConfigMap_ConfigLeaderElection, ConfigMap_ConfigLogging, ConfigMap_ConfigNetwork, ConfigMap_ConfigObservability, ConfigMap_ConfigTracing, HorizontalPodAutoscaler_Activator, PodDisruptionBudget_ActivatorPdb, Deployment_Activator, Service_ActivatorService, Deployment_Autoscaler, Service_Autoscaler, Deployment_Controller, Service_Controller, HorizontalPodAutoscaler_Webhook, PodDisruptionBudget_WebhookPdb, Deployment_Webhook, Service_Webhook, ValidatingWebhookConfiguration_ConfigWebhookServingKnativeDev, MutatingWebhookConfiguration_WebhookServingKnativeDev, ValidatingWebhookConfiguration_ValidationWebhookServingKnativeDev, Secret_WebhookCerts, Namespace_KourierSystem, ConfigMap_KourierBootstrap, ConfigMap_ConfigKourier, ServiceAccount_NetKourier, ClusterRole_NetKourier, ClusterRoleBinding_NetKourier, Deployment_NetKourierController, Service_NetKourierController, Deployment_3scaleKourierGateway, Service_Kourier, Service_KourierInternal, HorizontalPodAutoscaler_3scaleKourierGateway, PodDisruptionBudget_3scaleKourierGatewayPdb]; -export default { - resources: resources -}; +export default {}; From 76da4bbd46f3d329f3b889ba8cf9f15720f0b776 Mon Sep 17 00:00:00 2001 From: Dan Lynch Date: Wed, 12 Aug 2026 16:32:32 -0700 Subject: [PATCH 08/11] fix: keep the combined manifest for codegen alongside the ordered parts The split broke the build. codegen discovers an operator's kinds from its top-level .yaml, and writing only the numbered parts removed that file -- so knative-serving.ts was generated but never imported by the aggregator, and OPERATOR_MAP referenced an identifier that did not exist: src/generated/index.ts: error TS2304: Cannot find name 'KnativeServing' Both shapes are now written, because they serve different consumers: knative-serving.yaml read by codegen; never applied, so the ordering problem does not arise knative-serving//NN-* applied in order by the workflow The ordering hazard is on the apply path only. Conflating the two is what made this look like a choice between them. Verified locally: build clean, 7 unit tests pass, two consecutive pulls byte-identical, no key material vendored. --- .../manifests/operators/knative-serving.yaml | 10237 ++++++++++++++++ .../operators/knative-serving/v1.22.1.yaml | 10237 ++++++++++++++++ packages/manifests/scripts/pull-manifests.ts | 8 +- packages/manifests/src/generated/index.ts | 2 + .../src/generated/knative-serving.ts | 7853 +++++++++++- 5 files changed, 28334 insertions(+), 3 deletions(-) create mode 100644 packages/manifests/operators/knative-serving.yaml create mode 100644 packages/manifests/operators/knative-serving/v1.22.1.yaml diff --git a/packages/manifests/operators/knative-serving.yaml b/packages/manifests/operators/knative-serving.yaml new file mode 100644 index 0000000..bbe9e23 --- /dev/null +++ b/packages/manifests/operators/knative-serving.yaml @@ -0,0 +1,10237 @@ +# Source: https://github.com/knative/serving/releases/download/knative-v1.22.1/serving-crds.yaml +--- +# Copyright 2020 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: certificates.networking.internal.knative.dev + labels: + app.kubernetes.io/name: knative-serving + app.kubernetes.io/component: networking + app.kubernetes.io/version: "1.22.1" + knative.dev/crd-install: "true" +spec: + group: networking.internal.knative.dev + versions: + - name: v1alpha1 + served: true + storage: true + subresources: + status: {} + schema: + openAPIV3Schema: + description: |- + Certificate is responsible for provisioning a SSL certificate for the + given hosts. It is a Knative abstraction for various SSL certificate + provisioning solutions (such as cert-manager or self-signed SSL certificate). + type: object + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: |- + Spec is the desired state of the Certificate. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status + type: object + required: + - dnsNames + - secretName + properties: + dnsNames: + description: |- + DNSNames is a list of DNS names the Certificate could support. + The wildcard format of DNSNames (e.g. *.default.example.com) is supported. + type: array + items: + type: string + domain: + description: Domain is the top level domain of the values for DNSNames. + type: string + secretName: + description: SecretName is the name of the secret resource to store the SSL certificate in. + type: string + status: + description: |- + Status is the current state of the Certificate. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status + type: object + properties: + annotations: + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + additionalProperties: + type: string + conditions: + description: Conditions the latest available observations of a resource's current state. + type: array + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + type: object + required: + - status + - type + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating details about the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, False, Unknown. + type: string + type: + description: Type of condition. + type: string + http01Challenges: + description: |- + HTTP01Challenges is a list of HTTP01 challenges that need to be fulfilled + in order to get the TLS certificate.. + type: array + items: + description: |- + HTTP01Challenge defines the status of a HTTP01 challenge that a certificate needs + to fulfill. + type: object + properties: + serviceName: + description: ServiceName is the name of the service to serve HTTP01 challenge requests. + type: string + serviceNamespace: + description: ServiceNamespace is the namespace of the service to serve HTTP01 challenge requests. + type: string + servicePort: + description: ServicePort is the port of the service to serve HTTP01 challenge requests. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + url: + description: URL is the URL that the HTTP01 challenge is expected to serve on. + type: string + notAfter: + description: |- + The expiration time of the TLS certificate stored in the secret named + by this resource in spec.secretName. + type: string + format: date-time + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + type: integer + format: int64 + additionalPrinterColumns: + - name: Ready + type: string + jsonPath: ".status.conditions[?(@.type==\"Ready\")].status" + - name: Reason + type: string + jsonPath: ".status.conditions[?(@.type==\"Ready\")].reason" + names: + kind: Certificate + plural: certificates + singular: certificate + categories: + - knative-internal + - networking + shortNames: + - kcert + scope: Namespaced +--- +# Copyright 2019 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# Note: The schema part of the spec is auto-generated by hack/update-schemas.sh. + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: configurations.serving.knative.dev + labels: + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" + knative.dev/crd-install: "true" + duck.knative.dev/podspecable: "true" +spec: + group: serving.knative.dev + names: + kind: Configuration + plural: configurations + singular: configuration + categories: + - all + - knative + - serving + shortNames: + - config + - cfg + scope: Namespaced + versions: + - name: v1 + served: true + storage: true + subresources: + status: {} + additionalPrinterColumns: + - name: LatestCreated + type: string + jsonPath: .status.latestCreatedRevisionName + - name: LatestReady + type: string + jsonPath: .status.latestReadyRevisionName + - name: Ready + type: string + jsonPath: ".status.conditions[?(@.type=='Ready')].status" + - name: Reason + type: string + jsonPath: ".status.conditions[?(@.type=='Ready')].reason" + schema: + openAPIV3Schema: + description: |- + Configuration represents the "floating HEAD" of a linear history of Revisions. + Users create new Revisions by updating the Configuration's spec. + The "latest created" revision's name is available under status, as is the + "latest ready" revision's name. + See also: https://github.com/knative/serving/blob/main/docs/spec/overview.md#configuration + type: object + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: ConfigurationSpec holds the desired state of the Configuration (from the client). + type: object + properties: + template: + description: Template holds the latest specification for the Revision to be stamped out. + type: object + properties: + metadata: + type: object + properties: + annotations: + type: object + additionalProperties: + type: string + finalizers: + type: array + items: + type: string + labels: + type: object + additionalProperties: + type: string + name: + type: string + namespace: + type: string + x-kubernetes-preserve-unknown-fields: true + spec: + description: RevisionSpec holds the desired state of the Revision (from the client). + type: object + required: + - containers + properties: + affinity: + description: This is accessible behind a feature flag - kubernetes.podspec-affinity + type: object + x-kubernetes-preserve-unknown-fields: true + automountServiceAccountToken: + description: AutomountServiceAccountToken indicates whether a service account token should be automatically mounted. + type: boolean + containerConcurrency: + description: |- + ContainerConcurrency specifies the maximum allowed in-flight (concurrent) + requests per container of the Revision. Defaults to `0` which means + concurrency to the application is not limited, and the system decides the + target concurrency for the autoscaler. + type: integer + format: int64 + containers: + description: |- + List of containers belonging to the pod. + Containers cannot currently be added or removed. + There must be at least one container in a Pod. + Cannot be updated. + type: array + items: + description: A single application container that you want to run within a pod. + type: object + properties: + args: + description: |- + Arguments to the entrypoint. + The container image's CMD is used if this is not provided. + Variable references $(VAR_NAME) are expanded using the container's environment. If a variable + cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will + produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless + of whether the variable exists or not. Cannot be updated. + More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell + type: array + items: + type: string + x-kubernetes-list-type: atomic + command: + description: |- + Entrypoint array. Not executed within a shell. + The container image's ENTRYPOINT is used if this is not provided. + Variable references $(VAR_NAME) are expanded using the container's environment. If a variable + cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will + produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless + of whether the variable exists or not. Cannot be updated. + More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell + type: array + items: + type: string + x-kubernetes-list-type: atomic + env: + description: |- + List of environment variables to set in the container. + Cannot be updated. + type: array + items: + description: EnvVar represents an environment variable present in a Container. + type: object + required: + - name + properties: + name: + description: |- + Name of the environment variable. + May consist of any printable ASCII characters except '='. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's value. Cannot be used if value is not empty. + type: object + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + type: object + required: + - key + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap or its key must be defined + type: boolean + x-kubernetes-map-type: atomic + fieldRef: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-fieldref + type: object + x-kubernetes-map-type: atomic + x-kubernetes-preserve-unknown-fields: true + resourceFieldRef: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-fieldref + type: object + x-kubernetes-map-type: atomic + x-kubernetes-preserve-unknown-fields: true + secretKeyRef: + description: Selects a key of a secret in the pod's namespace + type: object + required: + - key + properties: + key: + description: The key of the secret to select from. Must be a valid secret key. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret or its key must be defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + envFrom: + description: |- + List of sources to populate environment variables in the container. + The keys defined within a source may consist of any printable ASCII characters except '='. + When a key exists in multiple + sources, the value associated with the last source will take precedence. + Values defined by an Env with a duplicate key will take precedence. + Cannot be updated. + type: array + items: + description: EnvFromSource represents the source of a set of ConfigMaps or Secrets + type: object + properties: + configMapRef: + description: The ConfigMap to select from + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap must be defined + type: boolean + x-kubernetes-map-type: atomic + prefix: + description: |- + Optional text to prepend to the name of each environment variable. + May consist of any printable ASCII characters except '='. + type: string + secretRef: + description: The Secret to select from + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret must be defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + image: + description: |- + Container image name. + More info: https://kubernetes.io/docs/concepts/containers/images + This field is optional to allow higher level config management to default or override + container images in workload controllers like Deployments and StatefulSets. + type: string + imagePullPolicy: + description: |- + Image pull policy. + One of Always, Never, IfNotPresent. + Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/containers/images#updating-images + type: string + livenessProbe: + description: |- + Periodic probe of container liveness. + Container will be restarted if the probe fails. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: object + properties: + exec: + description: Exec specifies a command to execute in the container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + failureThreshold: + description: |- + Minimum consecutive failures for the probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. + type: integer + format: int32 + grpc: + description: GRPC specifies a GRPC HealthCheckRequest. + type: object + properties: + port: + description: Port number of the gRPC service. Number must be in the range 1 to 65535. + type: integer + format: int32 + service: + description: |- + Service is the name of the service to place in the gRPC HealthCheckRequest + (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + + If this is not specified, the default behavior is defined by gRPC. + type: string + default: "" + httpGet: + description: HTTPGet specifies an HTTP GET request to perform. + type: object + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + initialDelaySeconds: + description: |- + Number of seconds after the container has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + periodSeconds: + description: |- + How often (in seconds) to perform the probe. + type: integer + format: int32 + successThreshold: + description: |- + Minimum consecutive successes for the probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. + type: integer + format: int32 + tcpSocket: + description: TCPSocket specifies a connection to a TCP port. + type: object + properties: + host: + description: 'Optional: Host name to connect to, defaults to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + timeoutSeconds: + description: |- + Number of seconds after which the probe times out. + Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + name: + description: |- + Name of the container specified as a DNS_LABEL. + Each container in a pod must have a unique name (DNS_LABEL). + Cannot be updated. + type: string + ports: + description: |- + List of ports to expose from the container. Not specifying a port here + DOES NOT prevent that port from being exposed. Any port which is + listening on the default "0.0.0.0" address inside a container will be + accessible from the network. + Modifying this array with strategic merge patch may corrupt the data. + For more information See https://github.com/kubernetes/kubernetes/issues/108255. + Cannot be updated. + type: array + items: + description: ContainerPort represents a network port in a single container. + type: object + properties: + containerPort: + description: |- + Number of port to expose on the pod's IP address. + This must be a valid port number, 0 < x < 65536. + type: integer + format: int32 + name: + description: |- + If specified, this must be an IANA_SVC_NAME and unique within the pod. Each + named port in a pod must have a unique name. Name for the port that can be + referred to by services. + type: string + protocol: + description: |- + Protocol for port. Must be UDP, TCP, or SCTP. + Defaults to "TCP". + type: string + default: TCP + readinessProbe: + description: |- + Periodic probe of container service readiness. + Container will be removed from service endpoints if the probe fails. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: object + properties: + exec: + description: Exec specifies a command to execute in the container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + failureThreshold: + description: |- + Minimum consecutive failures for the probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. + type: integer + format: int32 + grpc: + description: GRPC specifies a GRPC HealthCheckRequest. + type: object + properties: + port: + description: Port number of the gRPC service. Number must be in the range 1 to 65535. + type: integer + format: int32 + service: + description: |- + Service is the name of the service to place in the gRPC HealthCheckRequest + (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + + If this is not specified, the default behavior is defined by gRPC. + type: string + default: "" + httpGet: + description: HTTPGet specifies an HTTP GET request to perform. + type: object + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + initialDelaySeconds: + description: |- + Number of seconds after the container has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + periodSeconds: + description: |- + How often (in seconds) to perform the probe. + type: integer + format: int32 + successThreshold: + description: |- + Minimum consecutive successes for the probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. + type: integer + format: int32 + tcpSocket: + description: TCPSocket specifies a connection to a TCP port. + type: object + properties: + host: + description: 'Optional: Host name to connect to, defaults to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + timeoutSeconds: + description: |- + Number of seconds after which the probe times out. + Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + resources: + description: |- + Compute Resources required by this container. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + properties: + limits: + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + requests: + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + securityContext: + description: |- + SecurityContext defines the security options the container should be run with. + If set, the fields of SecurityContext override the equivalent fields of PodSecurityContext. + More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ + type: object + properties: + allowPrivilegeEscalation: + description: |- + AllowPrivilegeEscalation controls whether a process can gain more + privileges than its parent process. This bool directly controls if + the no_new_privs flag will be set on the container process. + AllowPrivilegeEscalation is true always when the container is: + 1) run as Privileged + 2) has CAP_SYS_ADMIN + Note that this field cannot be set when spec.os.name is windows. + type: boolean + capabilities: + description: |- + The capabilities to add/drop when running containers. + Defaults to the default set of capabilities granted by the container runtime. + Note that this field cannot be set when spec.os.name is windows. + type: object + properties: + add: + description: This is accessible behind a feature flag - kubernetes.containerspec-addcapabilities + type: array + items: + description: Capability represent POSIX capabilities type + type: string + x-kubernetes-list-type: atomic + drop: + description: Removed capabilities + type: array + items: + description: Capability represent POSIX capabilities type + type: string + x-kubernetes-list-type: atomic + privileged: + description: |- + Run container in privileged mode. This can only be set to explicitly to 'false' + type: boolean + readOnlyRootFilesystem: + description: |- + Whether this container has a read-only root filesystem. + Default is false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + runAsGroup: + description: |- + The GID to run the entrypoint of the container process. + Uses runtime default if unset. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + runAsNonRoot: + description: |- + Indicates that the container must run as a non-root user. + If true, the Kubelet will validate the image at runtime to ensure that it + does not run as UID 0 (root) and fail to start the container if it does. + If unset or false, no such validation will be performed. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: boolean + runAsUser: + description: |- + The UID to run the entrypoint of the container process. + Defaults to user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + seccompProfile: + description: |- + The seccomp options to use by this container. If seccomp options are + provided at both the pod & container level, the container options + override the pod options. + Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile defined in a file on the node should be used. + The profile must be preconfigured on the node to work. + Must be a descending path, relative to the kubelet's configured seccomp profile location. + Must be set if type is "Localhost". Must NOT be set for any other type. + type: string + type: + description: |- + type indicates which kind of seccomp profile will be applied. + Valid options are: + + Localhost - a profile defined in a file on the node should be used. + RuntimeDefault - the container runtime default profile should be used. + Unconfined - no profile should be applied. + type: string + startupProbe: + description: |- + StartupProbe indicates that the Pod has successfully initialized. + If specified, no other probes are executed until this completes successfully. + If this probe fails, the Pod will be restarted, just as if the livenessProbe failed. + This can be used to provide different probe parameters at the beginning of a Pod's lifecycle, + when it might take a long time to load data or warm a cache, than during steady-state operation. + This cannot be updated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: object + properties: + exec: + description: Exec specifies a command to execute in the container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + failureThreshold: + description: |- + Minimum consecutive failures for the probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. + type: integer + format: int32 + grpc: + description: GRPC specifies a GRPC HealthCheckRequest. + type: object + properties: + port: + description: Port number of the gRPC service. Number must be in the range 1 to 65535. + type: integer + format: int32 + service: + description: |- + Service is the name of the service to place in the gRPC HealthCheckRequest + (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + + If this is not specified, the default behavior is defined by gRPC. + type: string + default: "" + httpGet: + description: HTTPGet specifies an HTTP GET request to perform. + type: object + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + initialDelaySeconds: + description: |- + Number of seconds after the container has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + periodSeconds: + description: |- + How often (in seconds) to perform the probe. + type: integer + format: int32 + successThreshold: + description: |- + Minimum consecutive successes for the probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. + type: integer + format: int32 + tcpSocket: + description: TCPSocket specifies a connection to a TCP port. + type: object + properties: + host: + description: 'Optional: Host name to connect to, defaults to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + timeoutSeconds: + description: |- + Number of seconds after which the probe times out. + Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + terminationMessagePath: + description: |- + Optional: Path at which the file to which the container's termination message + will be written is mounted into the container's filesystem. + Message written is intended to be brief final status, such as an assertion failure message. + Will be truncated by the node if greater than 4096 bytes. The total message length across + all containers will be limited to 12kb. + Defaults to /dev/termination-log. + Cannot be updated. + type: string + terminationMessagePolicy: + description: |- + Indicate how the termination message should be populated. File will use the contents of + terminationMessagePath to populate the container status message on both success and failure. + FallbackToLogsOnError will use the last chunk of container log output if the termination + message file is empty and the container exited with an error. + The log output is limited to 2048 bytes or 80 lines, whichever is smaller. + Defaults to File. + Cannot be updated. + type: string + volumeMounts: + description: |- + Pod volumes to mount into the container's filesystem. + Cannot be updated. + type: array + items: + description: VolumeMount describes a mounting of a Volume within a container. + type: object + required: + - mountPath + - name + properties: + mountPath: + description: |- + Path within the container at which the volume should be mounted. Must + not contain ':'. + type: string + mountPropagation: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-volumes-mount-propagation + type: string + name: + description: This must match the Name of a Volume. + type: string + readOnly: + description: |- + Mounted read-only if true, read-write otherwise (false or unspecified). + Defaults to false. + type: boolean + subPath: + description: |- + Path within the volume from which the container's volume should be mounted. + Defaults to "" (volume's root). + type: string + x-kubernetes-list-map-keys: + - mountPath + x-kubernetes-list-type: map + workingDir: + description: |- + Container's working directory. + If not specified, the container runtime's default will be used, which + might be configured in the container image. + Cannot be updated. + type: string + dnsConfig: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-dnsconfig + type: object + x-kubernetes-preserve-unknown-fields: true + dnsPolicy: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-dnspolicy + type: string + enableServiceLinks: + description: |- + EnableServiceLinks indicates whether information aboutservices should be injected into pod's environment variables, matching the syntax of Docker links. Optional: Knative defaults this to false. + type: boolean + hostAliases: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-hostaliases + type: array + items: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-hostaliases + type: object + x-kubernetes-preserve-unknown-fields: true + hostIPC: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-hostipc + type: boolean + hostNetwork: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-hostnetwork + type: boolean + hostPID: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-hostpid + type: boolean + idleTimeoutSeconds: + description: |- + IdleTimeoutSeconds is the maximum duration in seconds a request will be allowed + to stay open while not receiving any bytes from the user's application. If + unspecified, a system default will be provided. + type: integer + format: int64 + imagePullSecrets: + description: |- + ImagePullSecrets is an optional list of references to secrets in the same namespace to use for pulling any of the images used by this PodSpec. + If specified, these secrets will be passed to individual puller implementations for them to use. + More info: https://kubernetes.io/docs/concepts/containers/images#specifying-imagepullsecrets-on-a-pod + type: array + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + x-kubernetes-map-type: atomic + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + initContainers: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-init-containers + type: array + items: + description: This is accessible behind a feature flag - kubernetes.podspec-init-containers + type: object + x-kubernetes-preserve-unknown-fields: true + nodeSelector: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-nodeselector + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + priorityClassName: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-priorityclassname + type: string + responseStartTimeoutSeconds: + description: |- + ResponseStartTimeoutSeconds is the maximum duration in seconds that the request + routing layer will wait for a request delivered to a container to begin + sending any network traffic. + type: integer + format: int64 + runtimeClassName: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-runtimeclassname + type: string + schedulerName: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-schedulername + type: string + securityContext: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-securitycontext + type: object + x-kubernetes-preserve-unknown-fields: true + serviceAccountName: + description: |- + ServiceAccountName is the name of the ServiceAccount to use to run this pod. + More info: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/ + type: string + shareProcessNamespace: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-shareprocessnamespace + type: boolean + timeoutSeconds: + description: |- + TimeoutSeconds is the maximum duration in seconds that the request instance + is allowed to respond to a request. If unspecified, a system default will + be provided. + type: integer + format: int64 + tolerations: + description: This is accessible behind a feature flag - kubernetes.podspec-tolerations + type: array + items: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-tolerations + type: object + x-kubernetes-preserve-unknown-fields: true + topologySpreadConstraints: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints + type: array + items: + description: This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints + type: object + x-kubernetes-preserve-unknown-fields: true + volumes: + description: |- + List of volumes that can be mounted by containers belonging to the pod. + More info: https://kubernetes.io/docs/concepts/storage/volumes + type: array + items: + description: Volume represents a named volume in a pod that may be accessed by any container in the pod. + type: object + required: + - name + properties: + configMap: + description: configMap represents a configMap that should populate this volume + type: object + properties: + defaultMode: + description: |- + defaultMode is optional: mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + Defaults to 0644. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + ConfigMap will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the ConfigMap, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: optional specify whether the ConfigMap or its keys must be defined + type: boolean + x-kubernetes-map-type: atomic + csi: + description: This is accessible behind a feature flag - kubernetes.podspec-volumes-csi + type: object + x-kubernetes-preserve-unknown-fields: true + emptyDir: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-volumes-emptydir + type: object + x-kubernetes-preserve-unknown-fields: true + hostPath: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-volumes-hostpath + type: object + x-kubernetes-preserve-unknown-fields: true + image: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-volumes-image + type: object + x-kubernetes-preserve-unknown-fields: true + name: + description: |- + name of the volume. + Must be a DNS_LABEL and unique within the pod. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + persistentVolumeClaim: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-persistent-volume-claim + type: object + x-kubernetes-preserve-unknown-fields: true + projected: + description: projected items for all in one resources secrets, configmaps, and downward API + type: object + properties: + defaultMode: + description: |- + defaultMode are the mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + sources: + description: |- + sources is the list of volume projections. Each entry in this list + handles one source. + type: array + items: + description: |- + Projection that may be projected along with other supported volume types. + Exactly one of these fields must be set. + type: object + properties: + configMap: + description: configMap information about the configMap data to project + type: object + properties: + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + ConfigMap will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the ConfigMap, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: optional specify whether the ConfigMap or its keys must be defined + type: boolean + x-kubernetes-map-type: atomic + downwardAPI: + description: downwardAPI information about the downwardAPI data to project + type: object + properties: + items: + description: Items is a list of DownwardAPIVolume file + type: array + items: + description: DownwardAPIVolumeFile represents information to create the file containing the pod field + type: object + required: + - path + properties: + fieldRef: + description: 'Required: Selects a field of the pod: only annotations, labels, name, namespace and uid are supported.' + type: object + required: + - fieldPath + properties: + apiVersion: + description: Version of the schema the FieldPath is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in the specified API version. + type: string + x-kubernetes-map-type: atomic + mode: + description: |- + Optional: mode bits used to set permissions on this file, must be an octal value + between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: 'Required: Path is the relative path name of the file to be created. Must not be absolute or contain the ''..'' path. Must be utf-8 encoded. The first item of the relative path must not start with ''..''' + type: string + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported. + type: object + required: + - resource + properties: + containerName: + description: 'Container name: required for volumes, optional for env vars' + type: string + divisor: + description: Specifies the output format of the exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + secret: + description: secret information about the secret data to project + type: object + properties: + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + Secret will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the Secret, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: optional field specify whether the Secret or its key must be defined + type: boolean + x-kubernetes-map-type: atomic + serviceAccountToken: + description: serviceAccountToken is information about the serviceAccountToken data to project + type: object + required: + - path + properties: + audience: + description: |- + audience is the intended audience of the token. A recipient of a token + must identify itself with an identifier specified in the audience of the + token, and otherwise should reject the token. The audience defaults to the + identifier of the apiserver. + type: string + expirationSeconds: + description: |- + expirationSeconds is the requested duration of validity of the service + account token. As the token approaches expiration, the kubelet volume + plugin will proactively rotate the service account token. The kubelet will + start trying to rotate the token if the token is older than 80 percent of + its time to live or if the token is older than 24 hours.Defaults to 1 hour + and must be at least 10 minutes. + type: integer + format: int64 + path: + description: |- + path is the path relative to the mount point of the file to project the + token into. + type: string + x-kubernetes-list-type: atomic + secret: + description: |- + secret represents a secret that should populate this volume. + More info: https://kubernetes.io/docs/concepts/storage/volumes#secret + type: object + properties: + defaultMode: + description: |- + defaultMode is Optional: mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values + for mode bits. Defaults to 0644. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + items: + description: |- + items If unspecified, each key-value pair in the Data field of the referenced + Secret will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the Secret, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + optional: + description: optional field specify whether the Secret or its keys must be defined + type: boolean + secretName: + description: |- + secretName is the name of the secret in the pod's namespace to use. + More info: https://kubernetes.io/docs/concepts/storage/volumes#secret + type: string + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + status: + description: ConfigurationStatus communicates the observed state of the Configuration (from the controller). + type: object + properties: + annotations: + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + additionalProperties: + type: string + conditions: + description: Conditions the latest available observations of a resource's current state. + type: array + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + type: object + required: + - status + - type + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating details about the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, False, Unknown. + type: string + type: + description: Type of condition. + type: string + latestCreatedRevisionName: + description: |- + LatestCreatedRevisionName is the last revision that was created from this + Configuration. It might not be ready yet, for that use LatestReadyRevisionName. + type: string + latestReadyRevisionName: + description: |- + LatestReadyRevisionName holds the name of the latest Revision stamped out + from this Configuration that has had its "Ready" condition become "True". + type: string + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + type: integer + format: int64 +--- +# Copyright 2020 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: clusterdomainclaims.networking.internal.knative.dev + labels: + app.kubernetes.io/name: knative-serving + app.kubernetes.io/component: networking + app.kubernetes.io/version: "1.22.1" + knative.dev/crd-install: "true" +spec: + group: networking.internal.knative.dev + versions: + - name: v1alpha1 + served: true + storage: true + subresources: + status: {} + schema: + openAPIV3Schema: + description: ClusterDomainClaim is a cluster-wide reservation for a particular domain name. + type: object + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: |- + Spec is the desired state of the ClusterDomainClaim. + More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status + type: object + required: + - namespace + properties: + namespace: + description: |- + Namespace is the namespace which is allowed to create a DomainMapping + using this ClusterDomainClaim's name. + type: string + names: + kind: ClusterDomainClaim + plural: clusterdomainclaims + singular: clusterdomainclaim + categories: + - knative-internal + - networking + shortNames: + - cdc + scope: Cluster +--- +# Copyright 2020 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: domainmappings.serving.knative.dev + labels: + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" + knative.dev/crd-install: "true" +spec: + group: serving.knative.dev + versions: + - name: v1beta1 + served: true + storage: true + subresources: + status: {} + additionalPrinterColumns: + - name: URL + type: string + jsonPath: .status.url + - name: Ready + type: string + jsonPath: ".status.conditions[?(@.type=='Ready')].status" + - name: Reason + type: string + jsonPath: ".status.conditions[?(@.type=='Ready')].reason" + "schema": + "openAPIV3Schema": + description: DomainMapping is a mapping from a custom hostname to an Addressable. + type: object + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: |- + Spec is the desired state of the DomainMapping. + More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status + type: object + required: + - ref + properties: + ref: + description: |- + Ref specifies the target of the Domain Mapping. + + The object identified by the Ref must be an Addressable with a URL of the + form `{name}.{namespace}.{domain}` where `{domain}` is the cluster domain, + and `{name}` and `{namespace}` are the name and namespace of a Kubernetes + Service. + + This contract is satisfied by Knative types such as Knative Services and + Knative Routes, and by Kubernetes Services. + type: object + required: + - kind + - name + properties: + address: + description: Address points to a specific Address Name. + type: string + apiVersion: + description: API version of the referent. + type: string + group: + description: |- + Group of the API, without the version of the group. This can be used as an alternative to the APIVersion, and then resolved using ResolveGroup. + Note: This API is EXPERIMENTAL and might break anytime. For more details: https://github.com/knative/eventing/issues/5086 + type: string + kind: + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + namespace: + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ + This is optional field, it gets defaulted to the object holding it if left out. + type: string + tls: + description: TLS allows the DomainMapping to terminate TLS traffic with an existing secret. + type: object + required: + - secretName + properties: + secretName: + description: SecretName is the name of the existing secret used to terminate TLS traffic. + type: string + status: + description: |- + Status is the current state of the DomainMapping. + More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status + type: object + properties: + address: + description: Address holds the information needed for a DomainMapping to be the target of an event. + type: object + properties: + CACerts: + description: |- + CACerts is the Certification Authority (CA) certificates in PEM format + according to https://www.rfc-editor.org/rfc/rfc7468. + type: string + audience: + description: Audience is the OIDC audience for this address. + type: string + name: + description: Name is the name of the address. + type: string + url: + type: string + annotations: + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + additionalProperties: + type: string + conditions: + description: Conditions the latest available observations of a resource's current state. + type: array + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + type: object + required: + - status + - type + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating details about the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, False, Unknown. + type: string + type: + description: Type of condition. + type: string + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + type: integer + format: int64 + url: + description: URL is the URL of this DomainMapping. + type: string + names: + kind: DomainMapping + plural: domainmappings + singular: domainmapping + categories: + - all + - knative + - serving + shortNames: + - dm + scope: Namespaced +--- +# Copyright 2020 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: ingresses.networking.internal.knative.dev + labels: + app.kubernetes.io/name: knative-serving + app.kubernetes.io/component: networking + app.kubernetes.io/version: "1.22.1" + knative.dev/crd-install: "true" +spec: + group: networking.internal.knative.dev + versions: + - name: v1alpha1 + served: true + storage: true + subresources: + status: {} + schema: + openAPIV3Schema: + description: |- + Ingress is a collection of rules that allow inbound connections to reach the endpoints defined + by a backend. An Ingress can be configured to give services externally-reachable URLs, load + balance traffic, offer name based virtual hosting, etc. + + This is heavily based on K8s Ingress https://godoc.org/k8s.io/api/networking/v1beta1#Ingress + which some highlighted modifications. + type: object + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: |- + Spec is the desired state of the Ingress. + More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status + type: object + properties: + httpOption: + description: |- + HTTPOption is the option of HTTP. It has the following two values: + `HTTPOptionEnabled`, `HTTPOptionRedirected` + type: string + rules: + description: A list of host rules used to configure the Ingress. + type: array + items: + description: |- + IngressRule represents the rules mapping the paths under a specified host to + the related backend services. Incoming requests are first evaluated for a host + match, then routed to the backend associated with the matching IngressRuleValue. + type: object + properties: + hosts: + description: |- + Host is the fully qualified domain name of a network host, as defined + by RFC 3986. Note the following deviations from the "host" part of the + URI as defined in the RFC: + 1. IPs are not allowed. Currently a rule value can only apply to the + IP in the Spec of the parent . + 2. The `:` delimiter is not respected because ports are not allowed. + Currently the port of an Ingress is implicitly :80 for http and + :443 for https. + Both these may change in the future. + If the host is unspecified, the Ingress routes all traffic based on the + specified IngressRuleValue. + If multiple matching Hosts were provided, the first rule will take precedent. + type: array + items: + type: string + http: + description: |- + HTTP represents a rule to apply against incoming requests. If the + rule is satisfied, the request is routed to the specified backend. + type: object + required: + - paths + properties: + paths: + description: |- + A collection of paths that map requests to backends. + + If they are multiple matching paths, the first match takes precedence. + type: array + items: + description: |- + HTTPIngressPath associates a path regex with a backend. Incoming URLs matching + the path are forwarded to the backend. + type: object + required: + - splits + properties: + appendHeaders: + description: |- + AppendHeaders allow specifying additional HTTP headers to add + before forwarding a request to the destination service. + + NOTE: This differs from K8s Ingress which doesn't allow header appending. + type: object + additionalProperties: + type: string + headers: + description: |- + Headers defines header matching rules which is a map from a header name + to HeaderMatch which specify a matching condition. + When a request matched with all the header matching rules, + the request is routed by the corresponding ingress rule. + If it is empty, the headers are not used for matching + type: object + additionalProperties: + description: |- + HeaderMatch represents a matching value of Headers in HTTPIngressPath. + Currently, only the exact matching is supported. + type: object + required: + - exact + properties: + exact: + type: string + path: + description: |- + Path represents a literal prefix to which this rule should apply. + Currently it can contain characters disallowed from the conventional + "path" part of a URL as defined by RFC 3986. Paths must begin with + a '/'. If unspecified, the path defaults to a catch all sending + traffic to the backend. + type: string + rewriteHost: + description: |- + RewriteHost rewrites the incoming request's host header. + + This field is currently experimental and not supported by all Ingress + implementations. + type: string + splits: + description: |- + Splits defines the referenced service endpoints to which the traffic + will be forwarded to. + type: array + items: + description: IngressBackendSplit describes all endpoints for a given service and port. + type: object + required: + - serviceName + - serviceNamespace + - servicePort + properties: + appendHeaders: + description: |- + AppendHeaders allow specifying additional HTTP headers to add + before forwarding a request to the destination service. + + NOTE: This differs from K8s Ingress which doesn't allow header appending. + type: object + additionalProperties: + type: string + percent: + description: |- + Specifies the split percentage, a number between 0 and 100. If + only one split is specified, we default to 100. + + NOTE: This differs from K8s Ingress to allow percentage split. + type: integer + serviceName: + description: Specifies the name of the referenced service. + type: string + serviceNamespace: + description: |- + Specifies the namespace of the referenced service. + + NOTE: This differs from K8s Ingress to allow routing to different namespaces. + type: string + servicePort: + description: Specifies the port of the referenced service. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + visibility: + description: |- + Visibility signifies whether this rule should `ClusterLocal`. If it's not + specified then it defaults to `ExternalIP`. + type: string + tls: + description: |- + TLS configuration. Currently Ingress only supports a single TLS + port: 443. If multiple members of this list specify different hosts, they + will be multiplexed on the same port according to the hostname specified + through the SNI TLS extension, if the ingress controller fulfilling the + ingress supports SNI. + type: array + items: + description: IngressTLS describes the transport layer security associated with an Ingress. + type: object + properties: + hosts: + description: |- + Hosts is a list of hosts included in the TLS certificate. The values in + this list must match the name/s used in the tlsSecret. Defaults to the + wildcard host setting for the loadbalancer controller fulfilling this + Ingress, if left unspecified. + type: array + items: + type: string + secretName: + description: SecretName is the name of the secret used to terminate SSL traffic. + type: string + secretNamespace: + description: |- + SecretNamespace is the namespace of the secret used to terminate SSL traffic. + If not set the namespace should be assumed to be the same as the Ingress. + If set the secret should have the same namespace as the Ingress otherwise + the behaviour is undefined and not supported. + type: string + status: + description: |- + Status is the current state of the Ingress. + More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status + type: object + properties: + annotations: + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + additionalProperties: + type: string + conditions: + description: Conditions the latest available observations of a resource's current state. + type: array + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + type: object + required: + - status + - type + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating details about the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, False, Unknown. + type: string + type: + description: Type of condition. + type: string + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + type: integer + format: int64 + privateLoadBalancer: + description: PrivateLoadBalancer contains the current status of the load-balancer. + type: object + properties: + ingress: + description: |- + Ingress is a list containing ingress points for the load-balancer. + Traffic intended for the service should be sent to these ingress points. + type: array + items: + description: |- + LoadBalancerIngressStatus represents the status of a load-balancer ingress point: + traffic intended for the service should be sent to an ingress point. + type: object + properties: + domain: + description: |- + Domain is set for load-balancer ingress points that are DNS based + (typically AWS load-balancers) + type: string + domainInternal: + description: |- + DomainInternal is set if there is a cluster-local DNS name to access the Ingress. + + NOTE: This differs from K8s Ingress, since we also desire to have a cluster-local + DNS name to allow routing in case of not having a mesh. + type: string + ip: + description: |- + IP is set for load-balancer ingress points that are IP based + (typically GCE or OpenStack load-balancers) + type: string + meshOnly: + description: MeshOnly is set if the Ingress is only load-balanced through a Service mesh. + type: boolean + publicLoadBalancer: + description: PublicLoadBalancer contains the current status of the load-balancer. + type: object + properties: + ingress: + description: |- + Ingress is a list containing ingress points for the load-balancer. + Traffic intended for the service should be sent to these ingress points. + type: array + items: + description: |- + LoadBalancerIngressStatus represents the status of a load-balancer ingress point: + traffic intended for the service should be sent to an ingress point. + type: object + properties: + domain: + description: |- + Domain is set for load-balancer ingress points that are DNS based + (typically AWS load-balancers) + type: string + domainInternal: + description: |- + DomainInternal is set if there is a cluster-local DNS name to access the Ingress. + + NOTE: This differs from K8s Ingress, since we also desire to have a cluster-local + DNS name to allow routing in case of not having a mesh. + type: string + ip: + description: |- + IP is set for load-balancer ingress points that are IP based + (typically GCE or OpenStack load-balancers) + type: string + meshOnly: + description: MeshOnly is set if the Ingress is only load-balanced through a Service mesh. + type: boolean + additionalPrinterColumns: + - name: Ready + type: string + jsonPath: ".status.conditions[?(@.type=='Ready')].status" + - name: Reason + type: string + jsonPath: ".status.conditions[?(@.type=='Ready')].reason" + names: + kind: Ingress + plural: ingresses + singular: ingress + categories: + - knative-internal + - networking + shortNames: + - kingress + - king + scope: Namespaced +--- +# Copyright 2019 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# Note: The schema part of the spec is auto-generated by hack/update-schemas.sh. + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: metrics.autoscaling.internal.knative.dev + labels: + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" + knative.dev/crd-install: "true" +spec: + group: autoscaling.internal.knative.dev + names: + kind: Metric + plural: metrics + singular: metric + categories: + - knative-internal + - autoscaling + scope: Namespaced + versions: + - name: v1alpha1 + served: true + storage: true + subresources: + status: {} + additionalPrinterColumns: + - name: Ready + type: string + jsonPath: ".status.conditions[?(@.type=='Ready')].status" + - name: Reason + type: string + jsonPath: ".status.conditions[?(@.type=='Ready')].reason" + schema: + openAPIV3Schema: + description: Metric represents a resource to configure the metric collector with. + type: object + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: Spec holds the desired state of the Metric (from the client). + type: object + required: + - panicWindow + - scrapeTarget + - stableWindow + properties: + panicWindow: + description: PanicWindow is the aggregation window for metrics where quick reactions are needed. + type: integer + format: int64 + scrapeTarget: + description: ScrapeTarget is the K8s service that publishes the metric endpoint. + type: string + stableWindow: + description: StableWindow is the aggregation window for metrics in a stable state. + type: integer + format: int64 + status: + description: Status communicates the observed state of the Metric (from the controller). + type: object + properties: + annotations: + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + additionalProperties: + type: string + conditions: + description: Conditions the latest available observations of a resource's current state. + type: array + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + type: object + required: + - status + - type + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating details about the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, False, Unknown. + type: string + type: + description: Type of condition. + type: string + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + type: integer + format: int64 +--- +# Copyright 2018 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# Note: The schema part of the spec is auto-generated by hack/update-schemas.sh. + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: podautoscalers.autoscaling.internal.knative.dev + labels: + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" + knative.dev/crd-install: "true" +spec: + group: autoscaling.internal.knative.dev + names: + kind: PodAutoscaler + plural: podautoscalers + singular: podautoscaler + categories: + - knative-internal + - autoscaling + shortNames: + - kpa + - pa + scope: Namespaced + versions: + - name: v1alpha1 + served: true + storage: true + subresources: + status: {} + additionalPrinterColumns: + - name: DesiredScale + type: integer + jsonPath: ".status.desiredScale" + - name: ActualScale + type: integer + jsonPath: ".status.actualScale" + - name: Ready + type: string + jsonPath: ".status.conditions[?(@.type=='Ready')].status" + - name: Reason + type: string + jsonPath: ".status.conditions[?(@.type=='Ready')].reason" + schema: + openAPIV3Schema: + description: |- + PodAutoscaler is a Knative abstraction that encapsulates the interface by which Knative + components instantiate autoscalers. This definition is an abstraction that may be backed + by multiple definitions. For more information, see the Knative Pluggability presentation: + https://docs.google.com/presentation/d/19vW9HFZ6Puxt31biNZF3uLRejDmu82rxJIk1cWmxF7w/edit + type: object + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: Spec holds the desired state of the PodAutoscaler (from the client). + type: object + required: + - protocolType + - scaleTargetRef + properties: + containerConcurrency: + description: |- + ContainerConcurrency specifies the maximum allowed + in-flight (concurrent) requests per container of the Revision. + Defaults to `0` which means unlimited concurrency. + type: integer + format: int64 + protocolType: + description: The application-layer protocol. Matches `ProtocolType` inferred from the revision spec. + type: string + reachability: + description: |- + Reachability specifies whether or not the `ScaleTargetRef` can be reached (ie. has a route). + Defaults to `ReachabilityUnknown` + type: string + scaleTargetRef: + description: |- + ScaleTargetRef defines the /scale-able resource that this PodAutoscaler + is responsible for quickly right-sizing. + type: object + properties: + apiVersion: + description: API version of the referent. + type: string + kind: + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + x-kubernetes-map-type: atomic + status: + description: Status communicates the observed state of the PodAutoscaler (from the controller). + type: object + required: + - metricsServiceName + - serviceName + properties: + actualScale: + description: ActualScale shows the actual number of replicas for the revision. + type: integer + format: int32 + annotations: + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + additionalProperties: + type: string + conditions: + description: Conditions the latest available observations of a resource's current state. + type: array + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + type: object + required: + - status + - type + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating details about the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, False, Unknown. + type: string + type: + description: Type of condition. + type: string + desiredScale: + description: DesiredScale shows the current desired number of replicas for the revision. + type: integer + format: int32 + metricsServiceName: + description: |- + MetricsServiceName is the K8s Service name that provides revision metrics. + The service is managed by the PA object. + type: string + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + type: integer + format: int64 + serviceName: + description: |- + ServiceName is the K8s Service name that serves the revision, scaled by this PA. + The service is created and owned by the ServerlessService object owned by this PA. + type: string +--- +# Copyright 2019 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# Note: The schema part of the spec is auto-generated by hack/update-schemas.sh. + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: revisions.serving.knative.dev + labels: + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" + knative.dev/crd-install: "true" +spec: + group: serving.knative.dev + names: + kind: Revision + plural: revisions + singular: revision + categories: + - all + - knative + - serving + shortNames: + - rev + scope: Namespaced + versions: + - name: v1 + served: true + storage: true + subresources: + status: {} + additionalPrinterColumns: + - name: Config Name + type: string + jsonPath: ".metadata.labels['serving\\.knative\\.dev/configuration']" + - name: Generation + type: string # int in string form :( + jsonPath: ".metadata.labels['serving\\.knative\\.dev/configurationGeneration']" + - name: Ready + type: string + jsonPath: ".status.conditions[?(@.type=='Ready')].status" + - name: Reason + type: string + jsonPath: ".status.conditions[?(@.type=='Ready')].reason" + - name: Actual Replicas + type: integer + jsonPath: ".status.actualReplicas" + - name: Desired Replicas + type: integer + jsonPath: ".status.desiredReplicas" + schema: + openAPIV3Schema: + description: |- + Revision is an immutable snapshot of code and configuration. A revision + references a container image. Revisions are created by updates to a + Configuration. + + See also: https://github.com/knative/serving/blob/main/docs/spec/overview.md#revision + type: object + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: RevisionSpec holds the desired state of the Revision (from the client). + type: object + required: + - containers + properties: + affinity: + description: This is accessible behind a feature flag - kubernetes.podspec-affinity + type: object + x-kubernetes-preserve-unknown-fields: true + automountServiceAccountToken: + description: AutomountServiceAccountToken indicates whether a service account token should be automatically mounted. + type: boolean + containerConcurrency: + description: |- + ContainerConcurrency specifies the maximum allowed in-flight (concurrent) + requests per container of the Revision. Defaults to `0` which means + concurrency to the application is not limited, and the system decides the + target concurrency for the autoscaler. + type: integer + format: int64 + containers: + description: |- + List of containers belonging to the pod. + Containers cannot currently be added or removed. + There must be at least one container in a Pod. + Cannot be updated. + type: array + items: + description: A single application container that you want to run within a pod. + type: object + properties: + args: + description: |- + Arguments to the entrypoint. + The container image's CMD is used if this is not provided. + Variable references $(VAR_NAME) are expanded using the container's environment. If a variable + cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will + produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless + of whether the variable exists or not. Cannot be updated. + More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell + type: array + items: + type: string + x-kubernetes-list-type: atomic + command: + description: |- + Entrypoint array. Not executed within a shell. + The container image's ENTRYPOINT is used if this is not provided. + Variable references $(VAR_NAME) are expanded using the container's environment. If a variable + cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will + produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless + of whether the variable exists or not. Cannot be updated. + More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell + type: array + items: + type: string + x-kubernetes-list-type: atomic + env: + description: |- + List of environment variables to set in the container. + Cannot be updated. + type: array + items: + description: EnvVar represents an environment variable present in a Container. + type: object + required: + - name + properties: + name: + description: |- + Name of the environment variable. + May consist of any printable ASCII characters except '='. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's value. Cannot be used if value is not empty. + type: object + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + type: object + required: + - key + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap or its key must be defined + type: boolean + x-kubernetes-map-type: atomic + fieldRef: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-fieldref + type: object + x-kubernetes-map-type: atomic + x-kubernetes-preserve-unknown-fields: true + resourceFieldRef: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-fieldref + type: object + x-kubernetes-map-type: atomic + x-kubernetes-preserve-unknown-fields: true + secretKeyRef: + description: Selects a key of a secret in the pod's namespace + type: object + required: + - key + properties: + key: + description: The key of the secret to select from. Must be a valid secret key. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret or its key must be defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + envFrom: + description: |- + List of sources to populate environment variables in the container. + The keys defined within a source may consist of any printable ASCII characters except '='. + When a key exists in multiple + sources, the value associated with the last source will take precedence. + Values defined by an Env with a duplicate key will take precedence. + Cannot be updated. + type: array + items: + description: EnvFromSource represents the source of a set of ConfigMaps or Secrets + type: object + properties: + configMapRef: + description: The ConfigMap to select from + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap must be defined + type: boolean + x-kubernetes-map-type: atomic + prefix: + description: |- + Optional text to prepend to the name of each environment variable. + May consist of any printable ASCII characters except '='. + type: string + secretRef: + description: The Secret to select from + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret must be defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + image: + description: |- + Container image name. + More info: https://kubernetes.io/docs/concepts/containers/images + This field is optional to allow higher level config management to default or override + container images in workload controllers like Deployments and StatefulSets. + type: string + imagePullPolicy: + description: |- + Image pull policy. + One of Always, Never, IfNotPresent. + Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/containers/images#updating-images + type: string + livenessProbe: + description: |- + Periodic probe of container liveness. + Container will be restarted if the probe fails. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: object + properties: + exec: + description: Exec specifies a command to execute in the container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + failureThreshold: + description: |- + Minimum consecutive failures for the probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. + type: integer + format: int32 + grpc: + description: GRPC specifies a GRPC HealthCheckRequest. + type: object + properties: + port: + description: Port number of the gRPC service. Number must be in the range 1 to 65535. + type: integer + format: int32 + service: + description: |- + Service is the name of the service to place in the gRPC HealthCheckRequest + (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + + If this is not specified, the default behavior is defined by gRPC. + type: string + default: "" + httpGet: + description: HTTPGet specifies an HTTP GET request to perform. + type: object + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + initialDelaySeconds: + description: |- + Number of seconds after the container has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + periodSeconds: + description: |- + How often (in seconds) to perform the probe. + type: integer + format: int32 + successThreshold: + description: |- + Minimum consecutive successes for the probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. + type: integer + format: int32 + tcpSocket: + description: TCPSocket specifies a connection to a TCP port. + type: object + properties: + host: + description: 'Optional: Host name to connect to, defaults to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + timeoutSeconds: + description: |- + Number of seconds after which the probe times out. + Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + name: + description: |- + Name of the container specified as a DNS_LABEL. + Each container in a pod must have a unique name (DNS_LABEL). + Cannot be updated. + type: string + ports: + description: |- + List of ports to expose from the container. Not specifying a port here + DOES NOT prevent that port from being exposed. Any port which is + listening on the default "0.0.0.0" address inside a container will be + accessible from the network. + Modifying this array with strategic merge patch may corrupt the data. + For more information See https://github.com/kubernetes/kubernetes/issues/108255. + Cannot be updated. + type: array + items: + description: ContainerPort represents a network port in a single container. + type: object + properties: + containerPort: + description: |- + Number of port to expose on the pod's IP address. + This must be a valid port number, 0 < x < 65536. + type: integer + format: int32 + name: + description: |- + If specified, this must be an IANA_SVC_NAME and unique within the pod. Each + named port in a pod must have a unique name. Name for the port that can be + referred to by services. + type: string + protocol: + description: |- + Protocol for port. Must be UDP, TCP, or SCTP. + Defaults to "TCP". + type: string + default: TCP + readinessProbe: + description: |- + Periodic probe of container service readiness. + Container will be removed from service endpoints if the probe fails. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: object + properties: + exec: + description: Exec specifies a command to execute in the container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + failureThreshold: + description: |- + Minimum consecutive failures for the probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. + type: integer + format: int32 + grpc: + description: GRPC specifies a GRPC HealthCheckRequest. + type: object + properties: + port: + description: Port number of the gRPC service. Number must be in the range 1 to 65535. + type: integer + format: int32 + service: + description: |- + Service is the name of the service to place in the gRPC HealthCheckRequest + (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + + If this is not specified, the default behavior is defined by gRPC. + type: string + default: "" + httpGet: + description: HTTPGet specifies an HTTP GET request to perform. + type: object + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + initialDelaySeconds: + description: |- + Number of seconds after the container has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + periodSeconds: + description: |- + How often (in seconds) to perform the probe. + type: integer + format: int32 + successThreshold: + description: |- + Minimum consecutive successes for the probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. + type: integer + format: int32 + tcpSocket: + description: TCPSocket specifies a connection to a TCP port. + type: object + properties: + host: + description: 'Optional: Host name to connect to, defaults to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + timeoutSeconds: + description: |- + Number of seconds after which the probe times out. + Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + resources: + description: |- + Compute Resources required by this container. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + properties: + limits: + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + requests: + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + securityContext: + description: |- + SecurityContext defines the security options the container should be run with. + If set, the fields of SecurityContext override the equivalent fields of PodSecurityContext. + More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ + type: object + properties: + allowPrivilegeEscalation: + description: |- + AllowPrivilegeEscalation controls whether a process can gain more + privileges than its parent process. This bool directly controls if + the no_new_privs flag will be set on the container process. + AllowPrivilegeEscalation is true always when the container is: + 1) run as Privileged + 2) has CAP_SYS_ADMIN + Note that this field cannot be set when spec.os.name is windows. + type: boolean + capabilities: + description: |- + The capabilities to add/drop when running containers. + Defaults to the default set of capabilities granted by the container runtime. + Note that this field cannot be set when spec.os.name is windows. + type: object + properties: + add: + description: This is accessible behind a feature flag - kubernetes.containerspec-addcapabilities + type: array + items: + description: Capability represent POSIX capabilities type + type: string + x-kubernetes-list-type: atomic + drop: + description: Removed capabilities + type: array + items: + description: Capability represent POSIX capabilities type + type: string + x-kubernetes-list-type: atomic + privileged: + description: |- + Run container in privileged mode. This can only be set to explicitly to 'false' + type: boolean + readOnlyRootFilesystem: + description: |- + Whether this container has a read-only root filesystem. + Default is false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + runAsGroup: + description: |- + The GID to run the entrypoint of the container process. + Uses runtime default if unset. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + runAsNonRoot: + description: |- + Indicates that the container must run as a non-root user. + If true, the Kubelet will validate the image at runtime to ensure that it + does not run as UID 0 (root) and fail to start the container if it does. + If unset or false, no such validation will be performed. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: boolean + runAsUser: + description: |- + The UID to run the entrypoint of the container process. + Defaults to user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + seccompProfile: + description: |- + The seccomp options to use by this container. If seccomp options are + provided at both the pod & container level, the container options + override the pod options. + Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile defined in a file on the node should be used. + The profile must be preconfigured on the node to work. + Must be a descending path, relative to the kubelet's configured seccomp profile location. + Must be set if type is "Localhost". Must NOT be set for any other type. + type: string + type: + description: |- + type indicates which kind of seccomp profile will be applied. + Valid options are: + + Localhost - a profile defined in a file on the node should be used. + RuntimeDefault - the container runtime default profile should be used. + Unconfined - no profile should be applied. + type: string + startupProbe: + description: |- + StartupProbe indicates that the Pod has successfully initialized. + If specified, no other probes are executed until this completes successfully. + If this probe fails, the Pod will be restarted, just as if the livenessProbe failed. + This can be used to provide different probe parameters at the beginning of a Pod's lifecycle, + when it might take a long time to load data or warm a cache, than during steady-state operation. + This cannot be updated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: object + properties: + exec: + description: Exec specifies a command to execute in the container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + failureThreshold: + description: |- + Minimum consecutive failures for the probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. + type: integer + format: int32 + grpc: + description: GRPC specifies a GRPC HealthCheckRequest. + type: object + properties: + port: + description: Port number of the gRPC service. Number must be in the range 1 to 65535. + type: integer + format: int32 + service: + description: |- + Service is the name of the service to place in the gRPC HealthCheckRequest + (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + + If this is not specified, the default behavior is defined by gRPC. + type: string + default: "" + httpGet: + description: HTTPGet specifies an HTTP GET request to perform. + type: object + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + initialDelaySeconds: + description: |- + Number of seconds after the container has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + periodSeconds: + description: |- + How often (in seconds) to perform the probe. + type: integer + format: int32 + successThreshold: + description: |- + Minimum consecutive successes for the probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. + type: integer + format: int32 + tcpSocket: + description: TCPSocket specifies a connection to a TCP port. + type: object + properties: + host: + description: 'Optional: Host name to connect to, defaults to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + timeoutSeconds: + description: |- + Number of seconds after which the probe times out. + Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + terminationMessagePath: + description: |- + Optional: Path at which the file to which the container's termination message + will be written is mounted into the container's filesystem. + Message written is intended to be brief final status, such as an assertion failure message. + Will be truncated by the node if greater than 4096 bytes. The total message length across + all containers will be limited to 12kb. + Defaults to /dev/termination-log. + Cannot be updated. + type: string + terminationMessagePolicy: + description: |- + Indicate how the termination message should be populated. File will use the contents of + terminationMessagePath to populate the container status message on both success and failure. + FallbackToLogsOnError will use the last chunk of container log output if the termination + message file is empty and the container exited with an error. + The log output is limited to 2048 bytes or 80 lines, whichever is smaller. + Defaults to File. + Cannot be updated. + type: string + volumeMounts: + description: |- + Pod volumes to mount into the container's filesystem. + Cannot be updated. + type: array + items: + description: VolumeMount describes a mounting of a Volume within a container. + type: object + required: + - mountPath + - name + properties: + mountPath: + description: |- + Path within the container at which the volume should be mounted. Must + not contain ':'. + type: string + mountPropagation: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-volumes-mount-propagation + type: string + name: + description: This must match the Name of a Volume. + type: string + readOnly: + description: |- + Mounted read-only if true, read-write otherwise (false or unspecified). + Defaults to false. + type: boolean + subPath: + description: |- + Path within the volume from which the container's volume should be mounted. + Defaults to "" (volume's root). + type: string + x-kubernetes-list-map-keys: + - mountPath + x-kubernetes-list-type: map + workingDir: + description: |- + Container's working directory. + If not specified, the container runtime's default will be used, which + might be configured in the container image. + Cannot be updated. + type: string + dnsConfig: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-dnsconfig + type: object + x-kubernetes-preserve-unknown-fields: true + dnsPolicy: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-dnspolicy + type: string + enableServiceLinks: + description: |- + EnableServiceLinks indicates whether information aboutservices should be injected into pod's environment variables, matching the syntax of Docker links. Optional: Knative defaults this to false. + type: boolean + hostAliases: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-hostaliases + type: array + items: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-hostaliases + type: object + x-kubernetes-preserve-unknown-fields: true + hostIPC: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-hostipc + type: boolean + hostNetwork: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-hostnetwork + type: boolean + hostPID: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-hostpid + type: boolean + idleTimeoutSeconds: + description: |- + IdleTimeoutSeconds is the maximum duration in seconds a request will be allowed + to stay open while not receiving any bytes from the user's application. If + unspecified, a system default will be provided. + type: integer + format: int64 + imagePullSecrets: + description: |- + ImagePullSecrets is an optional list of references to secrets in the same namespace to use for pulling any of the images used by this PodSpec. + If specified, these secrets will be passed to individual puller implementations for them to use. + More info: https://kubernetes.io/docs/concepts/containers/images#specifying-imagepullsecrets-on-a-pod + type: array + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + x-kubernetes-map-type: atomic + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + initContainers: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-init-containers + type: array + items: + description: This is accessible behind a feature flag - kubernetes.podspec-init-containers + type: object + x-kubernetes-preserve-unknown-fields: true + nodeSelector: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-nodeselector + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + priorityClassName: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-priorityclassname + type: string + responseStartTimeoutSeconds: + description: |- + ResponseStartTimeoutSeconds is the maximum duration in seconds that the request + routing layer will wait for a request delivered to a container to begin + sending any network traffic. + type: integer + format: int64 + runtimeClassName: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-runtimeclassname + type: string + schedulerName: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-schedulername + type: string + securityContext: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-securitycontext + type: object + x-kubernetes-preserve-unknown-fields: true + serviceAccountName: + description: |- + ServiceAccountName is the name of the ServiceAccount to use to run this pod. + More info: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/ + type: string + shareProcessNamespace: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-shareprocessnamespace + type: boolean + timeoutSeconds: + description: |- + TimeoutSeconds is the maximum duration in seconds that the request instance + is allowed to respond to a request. If unspecified, a system default will + be provided. + type: integer + format: int64 + tolerations: + description: This is accessible behind a feature flag - kubernetes.podspec-tolerations + type: array + items: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-tolerations + type: object + x-kubernetes-preserve-unknown-fields: true + topologySpreadConstraints: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints + type: array + items: + description: This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints + type: object + x-kubernetes-preserve-unknown-fields: true + volumes: + description: |- + List of volumes that can be mounted by containers belonging to the pod. + More info: https://kubernetes.io/docs/concepts/storage/volumes + type: array + items: + description: Volume represents a named volume in a pod that may be accessed by any container in the pod. + type: object + required: + - name + properties: + configMap: + description: configMap represents a configMap that should populate this volume + type: object + properties: + defaultMode: + description: |- + defaultMode is optional: mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + Defaults to 0644. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + ConfigMap will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the ConfigMap, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: optional specify whether the ConfigMap or its keys must be defined + type: boolean + x-kubernetes-map-type: atomic + csi: + description: This is accessible behind a feature flag - kubernetes.podspec-volumes-csi + type: object + x-kubernetes-preserve-unknown-fields: true + emptyDir: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-volumes-emptydir + type: object + x-kubernetes-preserve-unknown-fields: true + hostPath: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-volumes-hostpath + type: object + x-kubernetes-preserve-unknown-fields: true + image: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-volumes-image + type: object + x-kubernetes-preserve-unknown-fields: true + name: + description: |- + name of the volume. + Must be a DNS_LABEL and unique within the pod. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + persistentVolumeClaim: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-persistent-volume-claim + type: object + x-kubernetes-preserve-unknown-fields: true + projected: + description: projected items for all in one resources secrets, configmaps, and downward API + type: object + properties: + defaultMode: + description: |- + defaultMode are the mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + sources: + description: |- + sources is the list of volume projections. Each entry in this list + handles one source. + type: array + items: + description: |- + Projection that may be projected along with other supported volume types. + Exactly one of these fields must be set. + type: object + properties: + configMap: + description: configMap information about the configMap data to project + type: object + properties: + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + ConfigMap will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the ConfigMap, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: optional specify whether the ConfigMap or its keys must be defined + type: boolean + x-kubernetes-map-type: atomic + downwardAPI: + description: downwardAPI information about the downwardAPI data to project + type: object + properties: + items: + description: Items is a list of DownwardAPIVolume file + type: array + items: + description: DownwardAPIVolumeFile represents information to create the file containing the pod field + type: object + required: + - path + properties: + fieldRef: + description: 'Required: Selects a field of the pod: only annotations, labels, name, namespace and uid are supported.' + type: object + required: + - fieldPath + properties: + apiVersion: + description: Version of the schema the FieldPath is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in the specified API version. + type: string + x-kubernetes-map-type: atomic + mode: + description: |- + Optional: mode bits used to set permissions on this file, must be an octal value + between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: 'Required: Path is the relative path name of the file to be created. Must not be absolute or contain the ''..'' path. Must be utf-8 encoded. The first item of the relative path must not start with ''..''' + type: string + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported. + type: object + required: + - resource + properties: + containerName: + description: 'Container name: required for volumes, optional for env vars' + type: string + divisor: + description: Specifies the output format of the exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + secret: + description: secret information about the secret data to project + type: object + properties: + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + Secret will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the Secret, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: optional field specify whether the Secret or its key must be defined + type: boolean + x-kubernetes-map-type: atomic + serviceAccountToken: + description: serviceAccountToken is information about the serviceAccountToken data to project + type: object + required: + - path + properties: + audience: + description: |- + audience is the intended audience of the token. A recipient of a token + must identify itself with an identifier specified in the audience of the + token, and otherwise should reject the token. The audience defaults to the + identifier of the apiserver. + type: string + expirationSeconds: + description: |- + expirationSeconds is the requested duration of validity of the service + account token. As the token approaches expiration, the kubelet volume + plugin will proactively rotate the service account token. The kubelet will + start trying to rotate the token if the token is older than 80 percent of + its time to live or if the token is older than 24 hours.Defaults to 1 hour + and must be at least 10 minutes. + type: integer + format: int64 + path: + description: |- + path is the path relative to the mount point of the file to project the + token into. + type: string + x-kubernetes-list-type: atomic + secret: + description: |- + secret represents a secret that should populate this volume. + More info: https://kubernetes.io/docs/concepts/storage/volumes#secret + type: object + properties: + defaultMode: + description: |- + defaultMode is Optional: mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values + for mode bits. Defaults to 0644. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + items: + description: |- + items If unspecified, each key-value pair in the Data field of the referenced + Secret will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the Secret, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + optional: + description: optional field specify whether the Secret or its keys must be defined + type: boolean + secretName: + description: |- + secretName is the name of the secret in the pod's namespace to use. + More info: https://kubernetes.io/docs/concepts/storage/volumes#secret + type: string + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + status: + description: RevisionStatus communicates the observed state of the Revision (from the controller). + type: object + properties: + actualReplicas: + description: ActualReplicas reflects the amount of ready pods running this revision. + type: integer + format: int32 + annotations: + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + additionalProperties: + type: string + conditions: + description: Conditions the latest available observations of a resource's current state. + type: array + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + type: object + required: + - status + - type + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating details about the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, False, Unknown. + type: string + type: + description: Type of condition. + type: string + containerStatuses: + description: |- + ContainerStatuses is a slice of images present in .Spec.Container[*].Image + to their respective digests and their container name. + The digests are resolved during the creation of Revision. + ContainerStatuses holds the container name and image digests + for both serving and non serving containers. + ref: https://bit.ly/image-digests + type: array + items: + description: ContainerStatus holds the information of container name and image digest value + type: object + properties: + imageDigest: + type: string + name: + type: string + desiredReplicas: + description: DesiredReplicas reflects the desired amount of pods running this revision. + type: integer + format: int32 + initContainerStatuses: + description: |- + InitContainerStatuses is a slice of images present in .Spec.InitContainer[*].Image + to their respective digests and their container name. + The digests are resolved during the creation of Revision. + ContainerStatuses holds the container name and image digests + for both serving and non serving containers. + ref: https://bit.ly/image-digests + type: array + items: + description: ContainerStatus holds the information of container name and image digest value + type: object + properties: + imageDigest: + type: string + name: + type: string + logUrl: + description: |- + LogURL specifies the generated logging url for this particular revision + based on the revision url template specified in the controller's config. + type: string + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + type: integer + format: int64 +--- +# Copyright 2019 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# Note: The schema part of the spec is auto-generated by hack/update-schemas.sh. + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: routes.serving.knative.dev + labels: + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" + knative.dev/crd-install: "true" + duck.knative.dev/addressable: "true" +spec: + group: serving.knative.dev + names: + kind: Route + plural: routes + singular: route + categories: + - all + - knative + - serving + shortNames: + - rt + scope: Namespaced + versions: + - name: v1 + served: true + storage: true + subresources: + status: {} + additionalPrinterColumns: + - name: URL + type: string + jsonPath: .status.url + - name: Ready + type: string + jsonPath: ".status.conditions[?(@.type=='Ready')].status" + - name: Reason + type: string + jsonPath: ".status.conditions[?(@.type=='Ready')].reason" + schema: + openAPIV3Schema: + description: |- + Route is responsible for configuring ingress over a collection of Revisions. + Some of the Revisions a Route distributes traffic over may be specified by + referencing the Configuration responsible for creating them; in these cases + the Route is additionally responsible for monitoring the Configuration for + "latest ready revision" changes, and smoothly rolling out latest revisions. + See also: https://github.com/knative/serving/blob/main/docs/spec/overview.md#route + type: object + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: Spec holds the desired state of the Route (from the client). + type: object + properties: + traffic: + description: |- + Traffic specifies how to distribute traffic over a collection of + revisions and configurations. + type: array + items: + description: TrafficTarget holds a single entry of the routing table for a Route. + type: object + properties: + configurationName: + description: |- + ConfigurationName of a configuration to whose latest revision we will send + this portion of traffic. When the "status.latestReadyRevisionName" of the + referenced configuration changes, we will automatically migrate traffic + from the prior "latest ready" revision to the new one. This field is never + set in Route's status, only its spec. This is mutually exclusive with + RevisionName. + type: string + latestRevision: + description: |- + LatestRevision may be optionally provided to indicate that the latest + ready Revision of the Configuration should be used for this traffic + target. When provided LatestRevision must be true if RevisionName is + empty; it must be false when RevisionName is non-empty. + type: boolean + percent: + description: |- + Percent indicates that percentage based routing should be used and + the value indicates the percent of traffic that is be routed to this + Revision or Configuration. `0` (zero) mean no traffic, `100` means all + traffic. + When percentage based routing is being used the follow rules apply: + - the sum of all percent values must equal 100 + - when not specified, the implied value for `percent` is zero for + that particular Revision or Configuration + type: integer + format: int64 + revisionName: + description: |- + RevisionName of a specific revision to which to send this portion of + traffic. This is mutually exclusive with ConfigurationName. + type: string + tag: + description: |- + Tag is optionally used to expose a dedicated url for referencing + this target exclusively. + type: string + url: + description: |- + URL displays the URL for accessing named traffic targets. URL is displayed in + status, and is disallowed on spec. URL must contain a scheme (e.g. http://) and + a hostname, but may not contain anything else (e.g. basic auth, url path, etc.) + type: string + status: + description: Status communicates the observed state of the Route (from the controller). + type: object + properties: + address: + description: Address holds the information needed for a Route to be the target of an event. + type: object + properties: + CACerts: + description: |- + CACerts is the Certification Authority (CA) certificates in PEM format + according to https://www.rfc-editor.org/rfc/rfc7468. + type: string + audience: + description: Audience is the OIDC audience for this address. + type: string + name: + description: Name is the name of the address. + type: string + url: + type: string + annotations: + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + additionalProperties: + type: string + conditions: + description: Conditions the latest available observations of a resource's current state. + type: array + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + type: object + required: + - status + - type + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating details about the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, False, Unknown. + type: string + type: + description: Type of condition. + type: string + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + type: integer + format: int64 + traffic: + description: |- + Traffic holds the configured traffic distribution. + These entries will always contain RevisionName references. + When ConfigurationName appears in the spec, this will hold the + LatestReadyRevisionName that we last observed. + type: array + items: + description: TrafficTarget holds a single entry of the routing table for a Route. + type: object + properties: + configurationName: + description: |- + ConfigurationName of a configuration to whose latest revision we will send + this portion of traffic. When the "status.latestReadyRevisionName" of the + referenced configuration changes, we will automatically migrate traffic + from the prior "latest ready" revision to the new one. This field is never + set in Route's status, only its spec. This is mutually exclusive with + RevisionName. + type: string + latestRevision: + description: |- + LatestRevision may be optionally provided to indicate that the latest + ready Revision of the Configuration should be used for this traffic + target. When provided LatestRevision must be true if RevisionName is + empty; it must be false when RevisionName is non-empty. + type: boolean + percent: + description: |- + Percent indicates that percentage based routing should be used and + the value indicates the percent of traffic that is be routed to this + Revision or Configuration. `0` (zero) mean no traffic, `100` means all + traffic. + When percentage based routing is being used the follow rules apply: + - the sum of all percent values must equal 100 + - when not specified, the implied value for `percent` is zero for + that particular Revision or Configuration + type: integer + format: int64 + revisionName: + description: |- + RevisionName of a specific revision to which to send this portion of + traffic. This is mutually exclusive with ConfigurationName. + type: string + tag: + description: |- + Tag is optionally used to expose a dedicated url for referencing + this target exclusively. + type: string + url: + description: |- + URL displays the URL for accessing named traffic targets. URL is displayed in + status, and is disallowed on spec. URL must contain a scheme (e.g. http://) and + a hostname, but may not contain anything else (e.g. basic auth, url path, etc.) + type: string + url: + description: |- + URL holds the url that will distribute traffic over the provided traffic targets. + It generally has the form http[s]://{route-name}.{route-namespace}.{cluster-level-suffix} + type: string +--- +# Copyright 2019 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: serverlessservices.networking.internal.knative.dev + labels: + app.kubernetes.io/name: knative-serving + app.kubernetes.io/component: networking + app.kubernetes.io/version: "1.22.1" + knative.dev/crd-install: "true" +spec: + group: networking.internal.knative.dev + versions: + - name: v1alpha1 + served: true + storage: true + subresources: + status: {} + schema: + openAPIV3Schema: + description: |- + ServerlessService is a proxy for the K8s service objects containing the + endpoints for the revision, whether those are endpoints of the activator or + revision pods. + See: https://knative.page.link/naxz for details. + type: object + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: |- + Spec is the desired state of the ServerlessService. + More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status + type: object + required: + - objectRef + - protocolType + properties: + mode: + description: Mode describes the mode of operation of the ServerlessService. + type: string + numActivators: + description: |- + NumActivators contains number of Activators that this revision should be + assigned. + O means — assign all. + type: integer + format: int32 + objectRef: + description: |- + ObjectRef defines the resource that this ServerlessService + is responsible for making "serverless". + type: object + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: |- + If referring to a piece of an object instead of an entire object, this string + should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within a pod, this would take on a value like: + "spec.containers{name}" (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" (container with + index 2 in this pod). This syntax is chosen only to have some well-defined way of + referencing a part of an object. + type: string + kind: + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + namespace: + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ + type: string + resourceVersion: + description: |- + Specific resourceVersion to which this reference is made, if any. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency + type: string + uid: + description: |- + UID of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids + type: string + x-kubernetes-map-type: atomic + protocolType: + description: |- + The application-layer protocol. Matches `RevisionProtocolType` set on the owning pa/revision. + serving imports networking, so just use string. + type: string + status: + description: |- + Status is the current state of the ServerlessService. + More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status + type: object + properties: + annotations: + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + additionalProperties: + type: string + conditions: + description: Conditions the latest available observations of a resource's current state. + type: array + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + type: object + required: + - status + - type + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating details about the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, False, Unknown. + type: string + type: + description: Type of condition. + type: string + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + type: integer + format: int64 + privateServiceName: + description: |- + PrivateServiceName holds the name of a core K8s Service resource that + load balances over the user service pods backing this Revision. + type: string + serviceName: + description: |- + ServiceName holds the name of a core K8s Service resource that + load balances over the pods backing this Revision (activator or revision). + type: string + additionalPrinterColumns: + - name: Mode + type: string + jsonPath: ".spec.mode" + - name: Activators + type: integer + jsonPath: ".spec.numActivators" + - name: ServiceName + type: string + jsonPath: ".status.serviceName" + - name: PrivateServiceName + type: string + jsonPath: ".status.privateServiceName" + - name: Ready + type: string + jsonPath: ".status.conditions[?(@.type=='Ready')].status" + - name: Reason + type: string + jsonPath: ".status.conditions[?(@.type=='Ready')].reason" + names: + kind: ServerlessService + plural: serverlessservices + singular: serverlessservice + categories: + - knative-internal + - networking + shortNames: + - sks + scope: Namespaced +--- +# Copyright 2019 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# Note: The schema part of the spec is auto-generated by hack/update-schemas.sh. + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: services.serving.knative.dev + labels: + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" + knative.dev/crd-install: "true" + duck.knative.dev/addressable: "true" + duck.knative.dev/podspecable: "true" +spec: + group: serving.knative.dev + names: + kind: Service + plural: services + singular: service + categories: + - all + - knative + - serving + shortNames: + - kservice + - ksvc + scope: Namespaced + versions: + - name: v1 + served: true + storage: true + subresources: + status: {} + additionalPrinterColumns: + - name: URL + type: string + jsonPath: .status.url + - name: LatestCreated + type: string + jsonPath: .status.latestCreatedRevisionName + - name: LatestReady + type: string + jsonPath: .status.latestReadyRevisionName + - name: Ready + type: string + jsonPath: ".status.conditions[?(@.type=='Ready')].status" + - name: Reason + type: string + jsonPath: ".status.conditions[?(@.type=='Ready')].reason" + schema: + openAPIV3Schema: + description: |- + Service acts as a top-level container that manages a Route and Configuration + which implement a network service. Service exists to provide a singular + abstraction which can be access controlled, reasoned about, and which + encapsulates software lifecycle decisions such as rollout policy and + team resource ownership. Service acts only as an orchestrator of the + underlying Routes and Configurations (much as a kubernetes Deployment + orchestrates ReplicaSets), and its usage is optional but recommended. + + The Service's controller will track the statuses of its owned Configuration + and Route, reflecting their statuses and conditions as its own. + + See also: https://github.com/knative/serving/blob/main/docs/spec/overview.md#service + type: object + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: |- + ServiceSpec represents the configuration for the Service object. + A Service's specification is the union of the specifications for a Route + and Configuration. The Service restricts what can be expressed in these + fields, e.g. the Route must reference the provided Configuration; + however, these limitations also enable friendlier defaulting, + e.g. Route never needs a Configuration name, and may be defaulted to + the appropriate "run latest" spec. + type: object + properties: + template: + description: Template holds the latest specification for the Revision to be stamped out. + type: object + properties: + metadata: + type: object + properties: + annotations: + type: object + additionalProperties: + type: string + finalizers: + type: array + items: + type: string + labels: + type: object + additionalProperties: + type: string + name: + type: string + namespace: + type: string + x-kubernetes-preserve-unknown-fields: true + spec: + description: RevisionSpec holds the desired state of the Revision (from the client). + type: object + required: + - containers + properties: + affinity: + description: This is accessible behind a feature flag - kubernetes.podspec-affinity + type: object + x-kubernetes-preserve-unknown-fields: true + automountServiceAccountToken: + description: AutomountServiceAccountToken indicates whether a service account token should be automatically mounted. + type: boolean + containerConcurrency: + description: |- + ContainerConcurrency specifies the maximum allowed in-flight (concurrent) + requests per container of the Revision. Defaults to `0` which means + concurrency to the application is not limited, and the system decides the + target concurrency for the autoscaler. + type: integer + format: int64 + containers: + description: |- + List of containers belonging to the pod. + Containers cannot currently be added or removed. + There must be at least one container in a Pod. + Cannot be updated. + type: array + items: + description: A single application container that you want to run within a pod. + type: object + properties: + args: + description: |- + Arguments to the entrypoint. + The container image's CMD is used if this is not provided. + Variable references $(VAR_NAME) are expanded using the container's environment. If a variable + cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will + produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless + of whether the variable exists or not. Cannot be updated. + More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell + type: array + items: + type: string + x-kubernetes-list-type: atomic + command: + description: |- + Entrypoint array. Not executed within a shell. + The container image's ENTRYPOINT is used if this is not provided. + Variable references $(VAR_NAME) are expanded using the container's environment. If a variable + cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will + produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless + of whether the variable exists or not. Cannot be updated. + More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell + type: array + items: + type: string + x-kubernetes-list-type: atomic + env: + description: |- + List of environment variables to set in the container. + Cannot be updated. + type: array + items: + description: EnvVar represents an environment variable present in a Container. + type: object + required: + - name + properties: + name: + description: |- + Name of the environment variable. + May consist of any printable ASCII characters except '='. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's value. Cannot be used if value is not empty. + type: object + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + type: object + required: + - key + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap or its key must be defined + type: boolean + x-kubernetes-map-type: atomic + fieldRef: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-fieldref + type: object + x-kubernetes-map-type: atomic + x-kubernetes-preserve-unknown-fields: true + resourceFieldRef: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-fieldref + type: object + x-kubernetes-map-type: atomic + x-kubernetes-preserve-unknown-fields: true + secretKeyRef: + description: Selects a key of a secret in the pod's namespace + type: object + required: + - key + properties: + key: + description: The key of the secret to select from. Must be a valid secret key. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret or its key must be defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + envFrom: + description: |- + List of sources to populate environment variables in the container. + The keys defined within a source may consist of any printable ASCII characters except '='. + When a key exists in multiple + sources, the value associated with the last source will take precedence. + Values defined by an Env with a duplicate key will take precedence. + Cannot be updated. + type: array + items: + description: EnvFromSource represents the source of a set of ConfigMaps or Secrets + type: object + properties: + configMapRef: + description: The ConfigMap to select from + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap must be defined + type: boolean + x-kubernetes-map-type: atomic + prefix: + description: |- + Optional text to prepend to the name of each environment variable. + May consist of any printable ASCII characters except '='. + type: string + secretRef: + description: The Secret to select from + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret must be defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + image: + description: |- + Container image name. + More info: https://kubernetes.io/docs/concepts/containers/images + This field is optional to allow higher level config management to default or override + container images in workload controllers like Deployments and StatefulSets. + type: string + imagePullPolicy: + description: |- + Image pull policy. + One of Always, Never, IfNotPresent. + Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/containers/images#updating-images + type: string + livenessProbe: + description: |- + Periodic probe of container liveness. + Container will be restarted if the probe fails. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: object + properties: + exec: + description: Exec specifies a command to execute in the container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + failureThreshold: + description: |- + Minimum consecutive failures for the probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. + type: integer + format: int32 + grpc: + description: GRPC specifies a GRPC HealthCheckRequest. + type: object + properties: + port: + description: Port number of the gRPC service. Number must be in the range 1 to 65535. + type: integer + format: int32 + service: + description: |- + Service is the name of the service to place in the gRPC HealthCheckRequest + (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + + If this is not specified, the default behavior is defined by gRPC. + type: string + default: "" + httpGet: + description: HTTPGet specifies an HTTP GET request to perform. + type: object + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + initialDelaySeconds: + description: |- + Number of seconds after the container has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + periodSeconds: + description: |- + How often (in seconds) to perform the probe. + type: integer + format: int32 + successThreshold: + description: |- + Minimum consecutive successes for the probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. + type: integer + format: int32 + tcpSocket: + description: TCPSocket specifies a connection to a TCP port. + type: object + properties: + host: + description: 'Optional: Host name to connect to, defaults to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + timeoutSeconds: + description: |- + Number of seconds after which the probe times out. + Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + name: + description: |- + Name of the container specified as a DNS_LABEL. + Each container in a pod must have a unique name (DNS_LABEL). + Cannot be updated. + type: string + ports: + description: |- + List of ports to expose from the container. Not specifying a port here + DOES NOT prevent that port from being exposed. Any port which is + listening on the default "0.0.0.0" address inside a container will be + accessible from the network. + Modifying this array with strategic merge patch may corrupt the data. + For more information See https://github.com/kubernetes/kubernetes/issues/108255. + Cannot be updated. + type: array + items: + description: ContainerPort represents a network port in a single container. + type: object + properties: + containerPort: + description: |- + Number of port to expose on the pod's IP address. + This must be a valid port number, 0 < x < 65536. + type: integer + format: int32 + name: + description: |- + If specified, this must be an IANA_SVC_NAME and unique within the pod. Each + named port in a pod must have a unique name. Name for the port that can be + referred to by services. + type: string + protocol: + description: |- + Protocol for port. Must be UDP, TCP, or SCTP. + Defaults to "TCP". + type: string + default: TCP + readinessProbe: + description: |- + Periodic probe of container service readiness. + Container will be removed from service endpoints if the probe fails. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: object + properties: + exec: + description: Exec specifies a command to execute in the container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + failureThreshold: + description: |- + Minimum consecutive failures for the probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. + type: integer + format: int32 + grpc: + description: GRPC specifies a GRPC HealthCheckRequest. + type: object + properties: + port: + description: Port number of the gRPC service. Number must be in the range 1 to 65535. + type: integer + format: int32 + service: + description: |- + Service is the name of the service to place in the gRPC HealthCheckRequest + (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + + If this is not specified, the default behavior is defined by gRPC. + type: string + default: "" + httpGet: + description: HTTPGet specifies an HTTP GET request to perform. + type: object + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + initialDelaySeconds: + description: |- + Number of seconds after the container has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + periodSeconds: + description: |- + How often (in seconds) to perform the probe. + type: integer + format: int32 + successThreshold: + description: |- + Minimum consecutive successes for the probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. + type: integer + format: int32 + tcpSocket: + description: TCPSocket specifies a connection to a TCP port. + type: object + properties: + host: + description: 'Optional: Host name to connect to, defaults to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + timeoutSeconds: + description: |- + Number of seconds after which the probe times out. + Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + resources: + description: |- + Compute Resources required by this container. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + properties: + limits: + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + requests: + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + securityContext: + description: |- + SecurityContext defines the security options the container should be run with. + If set, the fields of SecurityContext override the equivalent fields of PodSecurityContext. + More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ + type: object + properties: + allowPrivilegeEscalation: + description: |- + AllowPrivilegeEscalation controls whether a process can gain more + privileges than its parent process. This bool directly controls if + the no_new_privs flag will be set on the container process. + AllowPrivilegeEscalation is true always when the container is: + 1) run as Privileged + 2) has CAP_SYS_ADMIN + Note that this field cannot be set when spec.os.name is windows. + type: boolean + capabilities: + description: |- + The capabilities to add/drop when running containers. + Defaults to the default set of capabilities granted by the container runtime. + Note that this field cannot be set when spec.os.name is windows. + type: object + properties: + add: + description: This is accessible behind a feature flag - kubernetes.containerspec-addcapabilities + type: array + items: + description: Capability represent POSIX capabilities type + type: string + x-kubernetes-list-type: atomic + drop: + description: Removed capabilities + type: array + items: + description: Capability represent POSIX capabilities type + type: string + x-kubernetes-list-type: atomic + privileged: + description: |- + Run container in privileged mode. This can only be set to explicitly to 'false' + type: boolean + readOnlyRootFilesystem: + description: |- + Whether this container has a read-only root filesystem. + Default is false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + runAsGroup: + description: |- + The GID to run the entrypoint of the container process. + Uses runtime default if unset. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + runAsNonRoot: + description: |- + Indicates that the container must run as a non-root user. + If true, the Kubelet will validate the image at runtime to ensure that it + does not run as UID 0 (root) and fail to start the container if it does. + If unset or false, no such validation will be performed. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: boolean + runAsUser: + description: |- + The UID to run the entrypoint of the container process. + Defaults to user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + seccompProfile: + description: |- + The seccomp options to use by this container. If seccomp options are + provided at both the pod & container level, the container options + override the pod options. + Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile defined in a file on the node should be used. + The profile must be preconfigured on the node to work. + Must be a descending path, relative to the kubelet's configured seccomp profile location. + Must be set if type is "Localhost". Must NOT be set for any other type. + type: string + type: + description: |- + type indicates which kind of seccomp profile will be applied. + Valid options are: + + Localhost - a profile defined in a file on the node should be used. + RuntimeDefault - the container runtime default profile should be used. + Unconfined - no profile should be applied. + type: string + startupProbe: + description: |- + StartupProbe indicates that the Pod has successfully initialized. + If specified, no other probes are executed until this completes successfully. + If this probe fails, the Pod will be restarted, just as if the livenessProbe failed. + This can be used to provide different probe parameters at the beginning of a Pod's lifecycle, + when it might take a long time to load data or warm a cache, than during steady-state operation. + This cannot be updated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: object + properties: + exec: + description: Exec specifies a command to execute in the container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + failureThreshold: + description: |- + Minimum consecutive failures for the probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. + type: integer + format: int32 + grpc: + description: GRPC specifies a GRPC HealthCheckRequest. + type: object + properties: + port: + description: Port number of the gRPC service. Number must be in the range 1 to 65535. + type: integer + format: int32 + service: + description: |- + Service is the name of the service to place in the gRPC HealthCheckRequest + (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + + If this is not specified, the default behavior is defined by gRPC. + type: string + default: "" + httpGet: + description: HTTPGet specifies an HTTP GET request to perform. + type: object + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + initialDelaySeconds: + description: |- + Number of seconds after the container has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + periodSeconds: + description: |- + How often (in seconds) to perform the probe. + type: integer + format: int32 + successThreshold: + description: |- + Minimum consecutive successes for the probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. + type: integer + format: int32 + tcpSocket: + description: TCPSocket specifies a connection to a TCP port. + type: object + properties: + host: + description: 'Optional: Host name to connect to, defaults to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + timeoutSeconds: + description: |- + Number of seconds after which the probe times out. + Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + terminationMessagePath: + description: |- + Optional: Path at which the file to which the container's termination message + will be written is mounted into the container's filesystem. + Message written is intended to be brief final status, such as an assertion failure message. + Will be truncated by the node if greater than 4096 bytes. The total message length across + all containers will be limited to 12kb. + Defaults to /dev/termination-log. + Cannot be updated. + type: string + terminationMessagePolicy: + description: |- + Indicate how the termination message should be populated. File will use the contents of + terminationMessagePath to populate the container status message on both success and failure. + FallbackToLogsOnError will use the last chunk of container log output if the termination + message file is empty and the container exited with an error. + The log output is limited to 2048 bytes or 80 lines, whichever is smaller. + Defaults to File. + Cannot be updated. + type: string + volumeMounts: + description: |- + Pod volumes to mount into the container's filesystem. + Cannot be updated. + type: array + items: + description: VolumeMount describes a mounting of a Volume within a container. + type: object + required: + - mountPath + - name + properties: + mountPath: + description: |- + Path within the container at which the volume should be mounted. Must + not contain ':'. + type: string + mountPropagation: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-volumes-mount-propagation + type: string + name: + description: This must match the Name of a Volume. + type: string + readOnly: + description: |- + Mounted read-only if true, read-write otherwise (false or unspecified). + Defaults to false. + type: boolean + subPath: + description: |- + Path within the volume from which the container's volume should be mounted. + Defaults to "" (volume's root). + type: string + x-kubernetes-list-map-keys: + - mountPath + x-kubernetes-list-type: map + workingDir: + description: |- + Container's working directory. + If not specified, the container runtime's default will be used, which + might be configured in the container image. + Cannot be updated. + type: string + dnsConfig: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-dnsconfig + type: object + x-kubernetes-preserve-unknown-fields: true + dnsPolicy: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-dnspolicy + type: string + enableServiceLinks: + description: |- + EnableServiceLinks indicates whether information aboutservices should be injected into pod's environment variables, matching the syntax of Docker links. Optional: Knative defaults this to false. + type: boolean + hostAliases: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-hostaliases + type: array + items: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-hostaliases + type: object + x-kubernetes-preserve-unknown-fields: true + hostIPC: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-hostipc + type: boolean + hostNetwork: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-hostnetwork + type: boolean + hostPID: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-hostpid + type: boolean + idleTimeoutSeconds: + description: |- + IdleTimeoutSeconds is the maximum duration in seconds a request will be allowed + to stay open while not receiving any bytes from the user's application. If + unspecified, a system default will be provided. + type: integer + format: int64 + imagePullSecrets: + description: |- + ImagePullSecrets is an optional list of references to secrets in the same namespace to use for pulling any of the images used by this PodSpec. + If specified, these secrets will be passed to individual puller implementations for them to use. + More info: https://kubernetes.io/docs/concepts/containers/images#specifying-imagepullsecrets-on-a-pod + type: array + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + x-kubernetes-map-type: atomic + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + initContainers: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-init-containers + type: array + items: + description: This is accessible behind a feature flag - kubernetes.podspec-init-containers + type: object + x-kubernetes-preserve-unknown-fields: true + nodeSelector: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-nodeselector + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + priorityClassName: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-priorityclassname + type: string + responseStartTimeoutSeconds: + description: |- + ResponseStartTimeoutSeconds is the maximum duration in seconds that the request + routing layer will wait for a request delivered to a container to begin + sending any network traffic. + type: integer + format: int64 + runtimeClassName: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-runtimeclassname + type: string + schedulerName: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-schedulername + type: string + securityContext: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-securitycontext + type: object + x-kubernetes-preserve-unknown-fields: true + serviceAccountName: + description: |- + ServiceAccountName is the name of the ServiceAccount to use to run this pod. + More info: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/ + type: string + shareProcessNamespace: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-shareprocessnamespace + type: boolean + timeoutSeconds: + description: |- + TimeoutSeconds is the maximum duration in seconds that the request instance + is allowed to respond to a request. If unspecified, a system default will + be provided. + type: integer + format: int64 + tolerations: + description: This is accessible behind a feature flag - kubernetes.podspec-tolerations + type: array + items: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-tolerations + type: object + x-kubernetes-preserve-unknown-fields: true + topologySpreadConstraints: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints + type: array + items: + description: This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints + type: object + x-kubernetes-preserve-unknown-fields: true + volumes: + description: |- + List of volumes that can be mounted by containers belonging to the pod. + More info: https://kubernetes.io/docs/concepts/storage/volumes + type: array + items: + description: Volume represents a named volume in a pod that may be accessed by any container in the pod. + type: object + required: + - name + properties: + configMap: + description: configMap represents a configMap that should populate this volume + type: object + properties: + defaultMode: + description: |- + defaultMode is optional: mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + Defaults to 0644. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + ConfigMap will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the ConfigMap, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: optional specify whether the ConfigMap or its keys must be defined + type: boolean + x-kubernetes-map-type: atomic + csi: + description: This is accessible behind a feature flag - kubernetes.podspec-volumes-csi + type: object + x-kubernetes-preserve-unknown-fields: true + emptyDir: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-volumes-emptydir + type: object + x-kubernetes-preserve-unknown-fields: true + hostPath: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-volumes-hostpath + type: object + x-kubernetes-preserve-unknown-fields: true + image: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-volumes-image + type: object + x-kubernetes-preserve-unknown-fields: true + name: + description: |- + name of the volume. + Must be a DNS_LABEL and unique within the pod. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + persistentVolumeClaim: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-persistent-volume-claim + type: object + x-kubernetes-preserve-unknown-fields: true + projected: + description: projected items for all in one resources secrets, configmaps, and downward API + type: object + properties: + defaultMode: + description: |- + defaultMode are the mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + sources: + description: |- + sources is the list of volume projections. Each entry in this list + handles one source. + type: array + items: + description: |- + Projection that may be projected along with other supported volume types. + Exactly one of these fields must be set. + type: object + properties: + configMap: + description: configMap information about the configMap data to project + type: object + properties: + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + ConfigMap will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the ConfigMap, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: optional specify whether the ConfigMap or its keys must be defined + type: boolean + x-kubernetes-map-type: atomic + downwardAPI: + description: downwardAPI information about the downwardAPI data to project + type: object + properties: + items: + description: Items is a list of DownwardAPIVolume file + type: array + items: + description: DownwardAPIVolumeFile represents information to create the file containing the pod field + type: object + required: + - path + properties: + fieldRef: + description: 'Required: Selects a field of the pod: only annotations, labels, name, namespace and uid are supported.' + type: object + required: + - fieldPath + properties: + apiVersion: + description: Version of the schema the FieldPath is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in the specified API version. + type: string + x-kubernetes-map-type: atomic + mode: + description: |- + Optional: mode bits used to set permissions on this file, must be an octal value + between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: 'Required: Path is the relative path name of the file to be created. Must not be absolute or contain the ''..'' path. Must be utf-8 encoded. The first item of the relative path must not start with ''..''' + type: string + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported. + type: object + required: + - resource + properties: + containerName: + description: 'Container name: required for volumes, optional for env vars' + type: string + divisor: + description: Specifies the output format of the exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + secret: + description: secret information about the secret data to project + type: object + properties: + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + Secret will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the Secret, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: optional field specify whether the Secret or its key must be defined + type: boolean + x-kubernetes-map-type: atomic + serviceAccountToken: + description: serviceAccountToken is information about the serviceAccountToken data to project + type: object + required: + - path + properties: + audience: + description: |- + audience is the intended audience of the token. A recipient of a token + must identify itself with an identifier specified in the audience of the + token, and otherwise should reject the token. The audience defaults to the + identifier of the apiserver. + type: string + expirationSeconds: + description: |- + expirationSeconds is the requested duration of validity of the service + account token. As the token approaches expiration, the kubelet volume + plugin will proactively rotate the service account token. The kubelet will + start trying to rotate the token if the token is older than 80 percent of + its time to live or if the token is older than 24 hours.Defaults to 1 hour + and must be at least 10 minutes. + type: integer + format: int64 + path: + description: |- + path is the path relative to the mount point of the file to project the + token into. + type: string + x-kubernetes-list-type: atomic + secret: + description: |- + secret represents a secret that should populate this volume. + More info: https://kubernetes.io/docs/concepts/storage/volumes#secret + type: object + properties: + defaultMode: + description: |- + defaultMode is Optional: mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values + for mode bits. Defaults to 0644. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + items: + description: |- + items If unspecified, each key-value pair in the Data field of the referenced + Secret will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the Secret, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + optional: + description: optional field specify whether the Secret or its keys must be defined + type: boolean + secretName: + description: |- + secretName is the name of the secret in the pod's namespace to use. + More info: https://kubernetes.io/docs/concepts/storage/volumes#secret + type: string + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + traffic: + description: |- + Traffic specifies how to distribute traffic over a collection of + revisions and configurations. + type: array + items: + description: TrafficTarget holds a single entry of the routing table for a Route. + type: object + properties: + configurationName: + description: |- + ConfigurationName of a configuration to whose latest revision we will send + this portion of traffic. When the "status.latestReadyRevisionName" of the + referenced configuration changes, we will automatically migrate traffic + from the prior "latest ready" revision to the new one. This field is never + set in Route's status, only its spec. This is mutually exclusive with + RevisionName. + type: string + latestRevision: + description: |- + LatestRevision may be optionally provided to indicate that the latest + ready Revision of the Configuration should be used for this traffic + target. When provided LatestRevision must be true if RevisionName is + empty; it must be false when RevisionName is non-empty. + type: boolean + percent: + description: |- + Percent indicates that percentage based routing should be used and + the value indicates the percent of traffic that is be routed to this + Revision or Configuration. `0` (zero) mean no traffic, `100` means all + traffic. + When percentage based routing is being used the follow rules apply: + - the sum of all percent values must equal 100 + - when not specified, the implied value for `percent` is zero for + that particular Revision or Configuration + type: integer + format: int64 + revisionName: + description: |- + RevisionName of a specific revision to which to send this portion of + traffic. This is mutually exclusive with ConfigurationName. + type: string + tag: + description: |- + Tag is optionally used to expose a dedicated url for referencing + this target exclusively. + type: string + url: + description: |- + URL displays the URL for accessing named traffic targets. URL is displayed in + status, and is disallowed on spec. URL must contain a scheme (e.g. http://) and + a hostname, but may not contain anything else (e.g. basic auth, url path, etc.) + type: string + status: + description: ServiceStatus represents the Status stanza of the Service resource. + type: object + properties: + address: + description: Address holds the information needed for a Route to be the target of an event. + type: object + properties: + CACerts: + description: |- + CACerts is the Certification Authority (CA) certificates in PEM format + according to https://www.rfc-editor.org/rfc/rfc7468. + type: string + audience: + description: Audience is the OIDC audience for this address. + type: string + name: + description: Name is the name of the address. + type: string + url: + type: string + annotations: + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + additionalProperties: + type: string + conditions: + description: Conditions the latest available observations of a resource's current state. + type: array + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + type: object + required: + - status + - type + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating details about the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, False, Unknown. + type: string + type: + description: Type of condition. + type: string + latestCreatedRevisionName: + description: |- + LatestCreatedRevisionName is the last revision that was created from this + Configuration. It might not be ready yet, for that use LatestReadyRevisionName. + type: string + latestReadyRevisionName: + description: |- + LatestReadyRevisionName holds the name of the latest Revision stamped out + from this Configuration that has had its "Ready" condition become "True". + type: string + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + type: integer + format: int64 + traffic: + description: |- + Traffic holds the configured traffic distribution. + These entries will always contain RevisionName references. + When ConfigurationName appears in the spec, this will hold the + LatestReadyRevisionName that we last observed. + type: array + items: + description: TrafficTarget holds a single entry of the routing table for a Route. + type: object + properties: + configurationName: + description: |- + ConfigurationName of a configuration to whose latest revision we will send + this portion of traffic. When the "status.latestReadyRevisionName" of the + referenced configuration changes, we will automatically migrate traffic + from the prior "latest ready" revision to the new one. This field is never + set in Route's status, only its spec. This is mutually exclusive with + RevisionName. + type: string + latestRevision: + description: |- + LatestRevision may be optionally provided to indicate that the latest + ready Revision of the Configuration should be used for this traffic + target. When provided LatestRevision must be true if RevisionName is + empty; it must be false when RevisionName is non-empty. + type: boolean + percent: + description: |- + Percent indicates that percentage based routing should be used and + the value indicates the percent of traffic that is be routed to this + Revision or Configuration. `0` (zero) mean no traffic, `100` means all + traffic. + When percentage based routing is being used the follow rules apply: + - the sum of all percent values must equal 100 + - when not specified, the implied value for `percent` is zero for + that particular Revision or Configuration + type: integer + format: int64 + revisionName: + description: |- + RevisionName of a specific revision to which to send this portion of + traffic. This is mutually exclusive with ConfigurationName. + type: string + tag: + description: |- + Tag is optionally used to expose a dedicated url for referencing + this target exclusively. + type: string + url: + description: |- + URL displays the URL for accessing named traffic targets. URL is displayed in + status, and is disallowed on spec. URL must contain a scheme (e.g. http://) and + a hostname, but may not contain anything else (e.g. basic auth, url path, etc.) + type: string + url: + description: |- + URL holds the url that will distribute traffic over the provided traffic targets. + It generally has the form http[s]://{route-name}.{route-namespace}.{cluster-level-suffix} + type: string +--- +# Copyright 2018 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: images.caching.internal.knative.dev + labels: + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" + knative.dev/crd-install: "true" +spec: + group: caching.internal.knative.dev + names: + kind: Image + plural: images + singular: image + categories: + - knative-internal + - caching + scope: Namespaced + versions: + - name: v1alpha1 + served: true + storage: true + subresources: + status: {} + schema: + openAPIV3Schema: + description: |- + Image is a Knative abstraction that encapsulates the interface by which Knative + components express a desire to have a particular image cached. + type: object + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: Spec holds the desired state of the Image (from the client). + type: object + required: + - image + properties: + image: + description: Image is the name of the container image url to cache across the cluster. + type: string + imagePullSecrets: + description: |- + ImagePullSecrets contains the names of the Kubernetes Secrets containing login + information used by the Pods which will run this container. + type: array + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + x-kubernetes-map-type: atomic + serviceAccountName: + description: |- + ServiceAccountName is the name of the Kubernetes ServiceAccount as which the Pods + will run this container. This is potentially used to authenticate the image pull + if the service account has attached pull secrets. For more information: + https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#add-imagepullsecrets-to-a-service-account + type: string + status: + description: Status communicates the observed state of the Image (from the controller). + type: object + properties: + annotations: + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + additionalProperties: + type: string + conditions: + description: Conditions the latest available observations of a resource's current state. + type: array + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + type: object + required: + - status + - type + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating details about the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, False, Unknown. + type: string + type: + description: Type of condition. + type: string + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + type: integer + format: int64 + additionalPrinterColumns: + - name: Image + type: string + jsonPath: .spec.image +--- +# Source: https://github.com/knative/serving/releases/download/knative-v1.22.1/serving-core.yaml +--- +# Copyright 2018 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: Namespace +metadata: + name: knative-serving + labels: + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" +--- +# Copyright 2023 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +kind: Role +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: knative-serving-activator + namespace: knative-serving + labels: + serving.knative.dev/controller: "true" + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +rules: + - apiGroups: [""] + resources: ["configmaps", "secrets"] + verbs: ["get", "list", "watch"] + - apiGroups: [""] + resources: ["secrets"] + verbs: ["get", "list", "watch"] + resourceNames: ["routing-serving-certs", "knative-serving-certs"] +--- +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: knative-serving-activator-cluster + labels: + serving.knative.dev/controller: "true" + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +rules: + - apiGroups: [""] + resources: ["services", "endpoints"] + verbs: ["get", "list", "watch"] + - apiGroups: ["serving.knative.dev"] + resources: ["revisions"] + verbs: ["get", "list", "watch"] +--- +# Copyright 2019 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# Use this aggregated ClusterRole when you need readonly access to "Addressables" +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + # Named like this to avoid clashing with eventing's existing `addressable-resolver` role + # (which should be identical, but isn't guaranteed to be installed alongside serving). + name: knative-serving-aggregated-addressable-resolver + labels: + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +aggregationRule: + clusterRoleSelectors: + - matchLabels: + duck.knative.dev/addressable: "true" +--- +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: knative-serving-addressable-resolver + labels: + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving + # Labeled to facilitate aggregated cluster roles that act on Addressables. + duck.knative.dev/addressable: "true" +# Do not use this role directly. These rules will be added to the "addressable-resolver" role. +rules: + - apiGroups: + - serving.knative.dev + resources: + - routes + - routes/status + - services + - services/status + verbs: + - get + - list + - watch +--- +# Copyright 2019 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: knative-serving-namespaced-admin + labels: + rbac.authorization.k8s.io/aggregate-to-admin: "true" + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +rules: + - apiGroups: ["serving.knative.dev"] + resources: ["*"] + verbs: ["*"] + - apiGroups: ["networking.internal.knative.dev", "autoscaling.internal.knative.dev", "caching.internal.knative.dev"] + resources: ["*"] + verbs: ["get", "list", "watch"] +--- +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: knative-serving-namespaced-edit + labels: + rbac.authorization.k8s.io/aggregate-to-edit: "true" + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +rules: + - apiGroups: ["serving.knative.dev"] + resources: ["*"] + verbs: ["create", "update", "patch", "delete"] + - apiGroups: ["networking.internal.knative.dev", "autoscaling.internal.knative.dev", "caching.internal.knative.dev"] + resources: ["*"] + verbs: ["get", "list", "watch"] +--- +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: knative-serving-namespaced-view + labels: + rbac.authorization.k8s.io/aggregate-to-view: "true" + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +rules: + - apiGroups: ["serving.knative.dev", "networking.internal.knative.dev", "autoscaling.internal.knative.dev", "caching.internal.knative.dev"] + resources: ["*"] + verbs: ["get", "list", "watch"] +--- +# Copyright 2019 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: knative-serving-core + labels: + serving.knative.dev/controller: "true" + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +rules: + - apiGroups: [""] + resources: ["pods", "namespaces", "secrets", "configmaps", "endpoints", "services", "events", "serviceaccounts"] + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] + - apiGroups: [""] + resources: ["endpoints/restricted"] # Permission for RestrictedEndpointsAdmission + verbs: ["create"] + - apiGroups: ["discovery.k8s.io"] + resources: ["endpointslices/restricted"] # Permission for RestrictedEndpointsAdmission + verbs: ["create"] + - apiGroups: [""] + resources: ["namespaces/finalizers"] # finalizers are needed for the owner reference of the webhook + verbs: ["update"] + - apiGroups: ["discovery.k8s.io"] + resources: ["endpointslices"] + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] + - apiGroups: ["apps"] + resources: ["deployments", "deployments/finalizers"] # finalizers are needed for the owner reference of the webhook + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] + - apiGroups: ["admissionregistration.k8s.io"] + resources: ["mutatingwebhookconfigurations", "validatingwebhookconfigurations"] + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] + - apiGroups: ["apiextensions.k8s.io"] + resources: ["customresourcedefinitions", "customresourcedefinitions/status"] + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] + - apiGroups: ["autoscaling"] + resources: ["horizontalpodautoscalers"] + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] + - apiGroups: ["coordination.k8s.io"] + resources: ["leases"] + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] + - apiGroups: ["serving.knative.dev", "autoscaling.internal.knative.dev", "networking.internal.knative.dev"] + resources: ["*", "*/status", "*/finalizers"] + verbs: ["get", "list", "create", "update", "delete", "deletecollection", "patch", "watch"] + - apiGroups: ["caching.internal.knative.dev"] + resources: ["images"] + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] + - apiGroups: ["cert-manager.io"] + resources: ["certificates", "clusterissuers", "certificaterequests", "issuers"] + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] + - apiGroups: ["acme.cert-manager.io"] + resources: ["challenges"] + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] + - apiGroups: ["rbac.authorization.k8s.io"] + resources: ["clusterroles"] + verbs: ["delete"] + resourceNames: ["knative-serving-certmanager"] + - apiGroups: ["*"] + resources: ["*/scale"] + verbs: ["patch"] +--- +# Copyright 2019 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: knative-serving-podspecable-binding + labels: + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving + # Labeled to facilitate aggregated cluster roles that act on PodSpecables. + duck.knative.dev/podspecable: "true" +# Do not use this role directly. These rules will be added to the "podspecable-binder" role. +rules: + - apiGroups: + - serving.knative.dev + resources: + - configurations + - services + verbs: + - list + - watch + - patch +--- +# Copyright 2018 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ServiceAccount +metadata: + name: controller + namespace: knative-serving + labels: + app.kubernetes.io/component: controller + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" +--- +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: knative-serving-admin + labels: + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" +aggregationRule: + clusterRoleSelectors: + - matchLabels: + serving.knative.dev/controller: "true" +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: knative-serving-controller-admin + labels: + app.kubernetes.io/component: controller + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" +subjects: + - kind: ServiceAccount + name: controller + namespace: knative-serving +roleRef: + kind: ClusterRole + name: knative-serving-admin + apiGroup: rbac.authorization.k8s.io +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: knative-serving-controller-addressable-resolver + labels: + app.kubernetes.io/component: controller + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" +subjects: + - kind: ServiceAccount + name: controller + namespace: knative-serving +roleRef: + kind: ClusterRole + name: knative-serving-aggregated-addressable-resolver + apiGroup: rbac.authorization.k8s.io +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: activator + namespace: knative-serving + labels: + app.kubernetes.io/component: activator + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: knative-serving-activator + namespace: knative-serving + labels: + app.kubernetes.io/component: activator + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" +subjects: + - kind: ServiceAccount + name: activator + namespace: knative-serving +roleRef: + kind: Role + name: knative-serving-activator + apiGroup: rbac.authorization.k8s.io +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: knative-serving-activator-cluster + labels: + app.kubernetes.io/component: activator + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" +subjects: + - kind: ServiceAccount + name: activator + namespace: knative-serving +roleRef: + kind: ClusterRole + name: knative-serving-activator-cluster + apiGroup: rbac.authorization.k8s.io +--- +apiVersion: networking.internal.knative.dev/v1alpha1 +kind: Certificate +metadata: + annotations: + networking.knative.dev/certificate.class: cert-manager.certificate.networking.knative.dev + labels: + networking.knative.dev/certificate-type: system-internal + name: routing-serving-certs + namespace: knative-serving +spec: + dnsNames: + - kn-routing + - data-plane.knative.dev # for reverse-compatibility with net-* implementations that do not work with multi-SANs + secretName: routing-serving-certs +--- +# Copyright 2018 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: caching.internal.knative.dev/v1alpha1 +kind: Image +metadata: + name: queue-proxy + namespace: knative-serving + labels: + app.kubernetes.io/component: queue-proxy + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" +spec: + # This is the Go import path for the binary that is containerized + # and substituted here. + image: gcr.io/knative-releases/knative.dev/serving/cmd/queue@sha256:b1af8bda6c1d32b1cf5fbf8f1f6068c5007a5cebf091039fdea83b88b1fd87f4 +--- +# Copyright 2018 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-autoscaler + namespace: knative-serving + labels: + app.kubernetes.io/component: autoscaler + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" + annotations: + knative.dev/example-checksum: "c727b3e8" +data: + _example: | + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this example block and unindented to be in the data block + # to actually change the configuration. + + # The Revision ContainerConcurrency field specifies the maximum number + # of requests the Container can handle at once. Container concurrency + # target percentage is how much of that maximum to use in a stable + # state. E.g. if a Revision specifies ContainerConcurrency of 10, then + # the Autoscaler will try to maintain 7 concurrent connections per pod + # on average. + # Note: this limit will be applied to container concurrency set at every + # level (ConfigMap, Revision Spec or Annotation). + # For legacy and backwards compatibility reasons, this value also accepts + # fractional values in (0, 1] interval (i.e. 0.7 ⇒ 70%). + # Thus minimal percentage value must be greater than 1.0, or it will be + # treated as a fraction. + # NOTE: that this value does not affect actual number of concurrent requests + # the user container may receive, but only the average number of requests + # that the revision pods will receive. + container-concurrency-target-percentage: "70" + + # The container concurrency target default is what the Autoscaler will + # try to maintain when concurrency is used as the scaling metric for the + # Revision and the Revision specifies unlimited concurrency. + # When revision explicitly specifies container concurrency, that value + # will be used as a scaling target for autoscaler. + # When specifying unlimited concurrency, the autoscaler will + # horizontally scale the application based on this target concurrency. + # This is what we call "soft limit" in the documentation, i.e. it only + # affects number of pods and does not affect the number of requests + # individual pod processes. + # The value must be a positive number such that the value multiplied + # by container-concurrency-target-percentage is greater than 0.01. + # NOTE: that this value will be adjusted by application of + # container-concurrency-target-percentage, i.e. by default + # the system will target on average 70 concurrent requests + # per revision pod. + # NOTE: Only one metric can be used for autoscaling a Revision. + container-concurrency-target-default: "100" + + # The requests per second (RPS) target default is what the Autoscaler will + # try to maintain when RPS is used as the scaling metric for a Revision and + # the Revision specifies unlimited RPS. Even when specifying unlimited RPS, + # the autoscaler will horizontally scale the application based on this + # target RPS. + # Must be greater than 1.0. + # NOTE: Only one metric can be used for autoscaling a Revision. + requests-per-second-target-default: "200" + + # The target burst capacity specifies the size of burst in concurrent + # requests that the system operator expects the system will receive. + # Autoscaler will try to protect the system from queueing by introducing + # Activator in the request path if the current spare capacity of the + # service is less than this setting. + # If this setting is 0, then Activator will be in the request path only + # when the revision is scaled to 0. + # If this setting is > 0 and container-concurrency-target-percentage is + # 100% or 1.0, then activator will always be in the request path. + # -1 denotes unlimited target-burst-capacity and activator will always + # be in the request path. + # Other negative values are invalid. + target-burst-capacity: "211" + + # When operating in a stable mode, the autoscaler operates on the + # average concurrency over the stable window. + # Stable window must be in whole seconds. + stable-window: "60s" + + # When observed average concurrency during the panic window reaches + # panic-threshold-percentage the target concurrency, the autoscaler + # enters panic mode. When operating in panic mode, the autoscaler + # scales on the average concurrency over the panic window which is + # panic-window-percentage of the stable-window. + # Must be in the [1, 100] range. + # When computing the panic window it will be rounded to the closest + # whole second, at least 1s. + panic-window-percentage: "10.0" + + # The percentage of the container concurrency target at which to + # enter panic mode when reached within the panic window. + panic-threshold-percentage: "200.0" + + # Max scale up rate limits the rate at which the autoscaler will + # increase pod count. It is the maximum ratio of desired pods versus + # observed pods. + # Cannot be less or equal to 1. + # I.e with value of 2.0 the number of pods can at most go N to 2N + # over single Autoscaler period (2s), but at least N to + # N+1, if Autoscaler needs to scale up. + max-scale-up-rate: "1000.0" + + # Max scale down rate limits the rate at which the autoscaler will + # decrease pod count. It is the maximum ratio of observed pods versus + # desired pods. + # Cannot be less or equal to 1. + # I.e. with value of 2.0 the number of pods can at most go N to N/2 + # over single Autoscaler evaluation period (2s), but at + # least N to N-1, if Autoscaler needs to scale down. + max-scale-down-rate: "2.0" + + # Scale to zero feature flag. + enable-scale-to-zero: "true" + + # Scale to zero grace period is the time an inactive revision is left + # running before it is scaled to zero (must be positive, but recommended + # at least a few seconds if running with mesh networking). + # This is the upper limit and is provided not to enforce timeout after + # the revision stopped receiving requests for stable window, but to + # ensure network reprogramming to put activator in the path has completed. + # If the system determines that a shorter period is satisfactory, + # then the system will only wait that amount of time before scaling to 0. + # NOTE: this period might actually be 0, if activator has been + # in the request path sufficiently long. + # If there is necessity for the last pod to linger longer use + # scale-to-zero-pod-retention-period flag. + scale-to-zero-grace-period: "30s" + + # Scale to zero pod retention period defines the minimum amount + # of time the last pod will remain after Autoscaler has decided to + # scale to zero. + # This flag is for the situations where the pod startup is very expensive + # and the traffic is bursty (requiring smaller windows for fast action), + # but patchy. + # The larger of this flag and `scale-to-zero-grace-period` will effectively + # determine how the last pod will hang around. + scale-to-zero-pod-retention-period: "0s" + + # pod-autoscaler-class specifies the default pod autoscaler class + # that should be used if none is specified. If omitted, + # the Knative Pod Autoscaler (KPA) is used by default. + pod-autoscaler-class: "kpa.autoscaling.knative.dev" + + # The capacity of a single activator task. + # The `unit` is one concurrent request proxied by the activator. + # activator-capacity must be at least 1. + # This value is used for computation of the Activator subset size. + # See the algorithm here: https://bit.ly/38XiCZ3. + # TODO(vagababov): tune after actual benchmarking. + activator-capacity: "100.0" + + # initial-scale is the cluster-wide default value for the initial target + # scale of a revision after creation, unless overridden by the + # "autoscaling.knative.dev/initialScale" annotation. + # This value must be greater than 0 unless allow-zero-initial-scale is true. + initial-scale: "1" + + # allow-zero-initial-scale controls whether either the cluster-wide initial-scale flag, + # or the "autoscaling.knative.dev/initialScale" annotation, can be set to 0. + allow-zero-initial-scale: "false" + + # min-scale is the cluster-wide default value for the min scale of a revision, + # unless overridden by the "autoscaling.knative.dev/minScale" annotation. + min-scale: "0" + + # max-scale is the cluster-wide default value for the max scale of a revision, + # unless overridden by the "autoscaling.knative.dev/maxScale" annotation. + # If set to 0, the revision has no maximum scale. + max-scale: "0" + + # scale-down-delay is the amount of time that must pass at reduced + # concurrency before a scale down decision is applied. This can be useful, + # for example, to maintain replica count and avoid a cold start penalty if + # more requests come in within the scale down delay period. + # The default, 0s, imposes no delay at all. + scale-down-delay: "0s" + + # max-scale-limit sets the maximum permitted value for the max scale of a revision. + # When this is set to a positive value, a revision with a maxScale above that value + # (including a maxScale of "0" = unlimited) is disallowed. + # A value of zero (the default) allows any limit, including unlimited. + max-scale-limit: "0" +--- +# Copyright 2020 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-certmanager + namespace: knative-serving + labels: + app.kubernetes.io/name: knative-serving + app.kubernetes.io/component: controller + app.kubernetes.io/version: "1.22.1" + networking.knative.dev/certificate-provider: cert-manager + annotations: + knative.dev/example-checksum: "b7a9a602" +data: + _example: | + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this block and unindented to actually change the configuration. + + # issuerRef is a reference to the issuer for external-domain certificates used for ingress. + # IssuerRef should be either `ClusterIssuer` or `Issuer`. + # Please refer `IssuerRef` in https://cert-manager.io/docs/concepts/issuer/ + # for more details about IssuerRef configuration. + # If the issuerRef is not specified, the self-signed `knative-selfsigned-issuer` ClusterIssuer is used. + issuerRef: | + kind: ClusterIssuer + name: letsencrypt-issuer + + # clusterLocalIssuerRef is a reference to the issuer for cluster-local-domain certificates used for ingress. + # clusterLocalIssuerRef should be either `ClusterIssuer` or `Issuer`. + # Please refer `IssuerRef` in https://cert-manager.io/docs/concepts/issuer/ + # for more details about ClusterInternalIssuerRef configuration. + # If the clusterLocalIssuerRef is not specified, the self-signed `knative-selfsigned-issuer` ClusterIssuer is used. + clusterLocalIssuerRef: | + kind: ClusterIssuer + name: your-company-issuer + + # systemInternalIssuerRef is a reference to the issuer for certificates for system-internal-tls certificates used by Knative internal components. + # systemInternalIssuerRef should be either `ClusterIssuer` or `Issuer`. + # Please refer `IssuerRef` in https://cert-manager.io/docs/concepts/issuer/ + # for more details about ClusterInternalIssuerRef configuration. + # If the systemInternalIssuerRef is not specified, the self-signed `knative-selfsigned-issuer` ClusterIssuer is used. + systemInternalIssuerRef: | + kind: ClusterIssuer + name: knative-selfsigned-issuer +--- +# Copyright 2019 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-defaults + namespace: knative-serving + labels: + app.kubernetes.io/name: knative-serving + app.kubernetes.io/component: controller + app.kubernetes.io/version: "1.22.1" + annotations: + knative.dev/example-checksum: "5b64ff5c" +data: + _example: | + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this example block and unindented to be in the data block + # to actually change the configuration. + + # revision-timeout-seconds contains the default number of + # seconds to use for the revision's per-request timeout, if + # none is specified. + revision-timeout-seconds: "300" # 5 minutes + + # max-revision-timeout-seconds contains the maximum number of + # seconds that can be used for revision-timeout-seconds. + # This value must be greater than or equal to revision-timeout-seconds. + # If omitted, the system default is used (600 seconds). + # + # If this value is increased, the activator's terminationGracePeriodSeconds + # should also be increased to prevent in-flight requests being disrupted. + max-revision-timeout-seconds: "600" # 10 minutes + + # revision-response-start-timeout-seconds contains the default number of + # seconds a request will be allowed to stay open while waiting to + # receive any bytes from the user's application, if none is specified. + # + # This defaults to 'revision-timeout-seconds' + revision-response-start-timeout-seconds: "300" + + # revision-idle-timeout-seconds contains the default number of + # seconds a request will be allowed to stay open while not receiving any + # bytes from the user's application, if none is specified. + revision-idle-timeout-seconds: "0" # infinite + + # revision-cpu-request contains the cpu allocation to assign + # to revisions by default. If omitted, no value is specified + # and the system default is used. + # Below is an example of setting revision-cpu-request. + # By default, it is not set by Knative. + revision-cpu-request: "400m" # 0.4 of a CPU (aka 400 milli-CPU) + + # revision-memory-request contains the memory allocation to assign + # to revisions by default. If omitted, no value is specified + # and the system default is used. + # Below is an example of setting revision-memory-request. + # By default, it is not set by Knative. + revision-memory-request: "100M" # 100 megabytes of memory + + # revision-ephemeral-storage-request contains the ephemeral storage + # allocation to assign to revisions by default. If omitted, no value is + # specified and the system default is used. + revision-ephemeral-storage-request: "500M" # 500 megabytes of storage + + # revision-cpu-limit contains the cpu allocation to limit + # revisions to by default. If omitted, no value is specified + # and the system default is used. + # Below is an example of setting revision-cpu-limit. + # By default, it is not set by Knative. + revision-cpu-limit: "1000m" # 1 CPU (aka 1000 milli-CPU) + + # revision-memory-limit contains the memory allocation to limit + # revisions to by default. If omitted, no value is specified + # and the system default is used. + # Below is an example of setting revision-memory-limit. + # By default, it is not set by Knative. + revision-memory-limit: "200M" # 200 megabytes of memory + + # revision-ephemeral-storage-limit contains the ephemeral storage + # allocation to limit revisions to by default. If omitted, no value is + # specified and the system default is used. + revision-ephemeral-storage-limit: "750M" # 750 megabytes of storage + + # container-name-template contains a template for the default + # container name, if none is specified. This field supports + # Go templating and is supplied with the ObjectMeta of the + # enclosing Service or Configuration, so values such as + # {{.Name}} are also valid. + container-name-template: "user-container" + + # init-container-name-template contains a template for the default + # init container name, if none is specified. This field supports + # Go templating and is supplied with the ObjectMeta of the + # enclosing Service or Configuration, so values such as + # {{.Name}} are also valid. + init-container-name-template: "init-container" + + # container-concurrency specifies the maximum number + # of requests the Container can handle at once, and requests + # above this threshold are queued. Setting a value of zero + # disables this throttling and lets through as many requests as + # the pod receives. + container-concurrency: "0" + + # The container concurrency max limit is an operator setting ensuring that + # the individual revisions cannot have arbitrary large concurrency + # values, or autoscaling targets. `container-concurrency` default setting + # must be at or below this value. + # + # Must be greater than 1. + # + # Note: even with this set, a user can choose a containerConcurrency + # of 0 (i.e. unbounded) unless allow-container-concurrency-zero is + # set to "false". + container-concurrency-max-limit: "1000" + + # allow-container-concurrency-zero controls whether users can + # specify 0 (i.e. unbounded) for containerConcurrency. + allow-container-concurrency-zero: "true" + + # enable-service-links specifies the default value used for the + # enableServiceLinks field of the PodSpec, when it is omitted by the user. + # See: https://kubernetes.io/docs/concepts/services-networking/connect-applications-service/#accessing-the-service + # + # This is a tri-state flag with possible values of (true|false|default). + # + # In environments with large number of services it is suggested + # to set this value to `false`. + # See https://github.com/knative/serving/issues/8498. + enable-service-links: "false" +--- +# Copyright 2019 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-deployment + namespace: knative-serving + labels: + app.kubernetes.io/name: knative-serving + app.kubernetes.io/component: controller + app.kubernetes.io/version: "1.22.1" + annotations: + knative.dev/example-checksum: "555b4826" +data: + # This is the Go import path for the binary that is containerized + # and substituted here. + queue-sidecar-image: gcr.io/knative-releases/knative.dev/serving/cmd/queue@sha256:b1af8bda6c1d32b1cf5fbf8f1f6068c5007a5cebf091039fdea83b88b1fd87f4 + _example: |- + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this example block and unindented to be in the data block + # to actually change the configuration. + + # List of repositories for which tag to digest resolving should be skipped + registries-skipping-tag-resolving: "kind.local,ko.local,dev.local" + + # Maximum time allowed for an image's digests to be resolved. + digest-resolution-timeout: "10s" + + # Duration we wait for the deployment to be ready before considering it failed. + progress-deadline: "600s" + + # Sets the queue proxy's CPU request. + # If omitted, a default value (currently "25m"), is used. + queue-sidecar-cpu-request: "25m" + + # Sets the queue proxy's CPU limit. + # If omitted, a default value (currently "1000m"), is used when + # `queueproxy.resource-defaults` is set to `Enabled`. + queue-sidecar-cpu-limit: "1000m" + + # Sets the queue proxy's memory request. + # If omitted, a default value (currently "400Mi"), is used when + # `queueproxy.resource-defaults` is set to `Enabled`. + queue-sidecar-memory-request: "400Mi" + + # Sets the queue proxy's memory limit. + # If omitted, a default value (currently "800Mi"), is used when + # `queueproxy.resource-defaults` is set to `Enabled`. + queue-sidecar-memory-limit: "800Mi" + + # Sets the queue proxy's ephemeral storage request. + # If omitted, no value is specified and the system default is used. + queue-sidecar-ephemeral-storage-request: "512Mi" + + # Sets the queue proxy's ephemeral storage limit. + # If omitted, no value is specified and the system default is used. + queue-sidecar-ephemeral-storage-limit: "1024Mi" + + # Sets tokens associated with specific audiences for queue proxy - used by QPOptions + # + # For example, to add the `service-x` audience: + # queue-sidecar-token-audiences: "service-x" + # Also supports a list of audiences, for example: + # queue-sidecar-token-audiences: "service-x,service-y" + # If omitted, or empty, no tokens are created + queue-sidecar-token-audiences: "" + + # Sets rootCA for the queue proxy - used by QPOptions + # If omitted, or empty, no rootCA is added to the golang rootCAs + queue-sidecar-rootca: "" + + # Sets the minimum TLS version for the queue proxy sidecar's TLS server. + # Accepted values: "1.2", "1.3". Default is "1.3" if not specified. + queue-sidecar-tls-min-version: "" + + # Sets the maximum TLS version for the queue proxy sidecar's TLS server. + # Accepted values: "1.2", "1.3". If omitted, the Go default is used. + queue-sidecar-tls-max-version: "" + + # Sets the cipher suites for the queue proxy sidecar's TLS server. + # Comma-separated list of cipher suite names (e.g. "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"). + # If omitted, the Go default cipher suites are used. + # Note: cipher suites are not configurable in TLS 1.3. + queue-sidecar-tls-cipher-suites: "" + + # Sets the elliptic curve preferences for the queue proxy sidecar's TLS server. + # Comma-separated list of curve names (e.g. "X25519,CurveP256"). + # If omitted, the Go default curves are used. + queue-sidecar-tls-curve-preferences: "" + + # If set, it automatically configures pod anti-affinity requirements for all Knative services. + # It employs the `preferredDuringSchedulingIgnoredDuringExecution` weighted pod affinity term, + # aligning with the Knative revision label. It yields the configuration below in all workloads' deployments: + # ` + # affinity: + # podAntiAffinity: + # preferredDuringSchedulingIgnoredDuringExecution: + # - podAffinityTerm: + # topologyKey: kubernetes.io/hostname + # labelSelector: + # matchLabels: + # serving.knative.dev/revision: {{revision-name}} + # weight: 100 + # ` + # This may be "none" or "prefer-spread-revision-over-nodes" (default) + # default-affinity-type: "prefer-spread-revision-over-nodes" + + # runtime-class-name contains the selector for which runtimeClassName + # is selected to put in a revision. + # By default, it is not set by Knative. + # + # Example: + # runtime-class-name: | + # "": + # selector: + # use-default-runc: "yes" + # kata: {} + # gvisor: + # selector: + # use-gvisor: "please" + runtime-class-name: "" + + # pod-is-always-schedulable can be used to define that Pods in the system will always be + # scheduled, and a Revision should not be marked unschedulable. + # Setting this to `true` makes sense if you have cluster-autoscaling set up for your cluster + # where unschedulable Pods trigger the addition of a new Node and are therefore a short and + # transient state. + # + # See https://github.com/knative/serving/issues/14862 + pod-is-always-schedulable: "false" +--- +# Copyright 2018 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-domain + namespace: knative-serving + labels: + app.kubernetes.io/name: knative-serving + app.kubernetes.io/component: controller + app.kubernetes.io/version: "1.22.1" + annotations: + knative.dev/example-checksum: "26c09de5" +data: + _example: | + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this example block and unindented to be in the data block + # to actually change the configuration. + + # Default value for domain. + # Routes having the cluster domain suffix (by default 'svc.cluster.local') + # will not be exposed through Ingress. You can define your own label + # selector to assign that domain suffix to your Route here, or you can set + # the label + # "networking.knative.dev/visibility=cluster-local" + # to achieve the same effect. This shows how to make routes having + # the label app=secret only exposed to the local cluster. + svc.cluster.local: | + selector: + app: secret + + # These are example settings of domain. + # example.com will be used for all routes, but it is the least-specific rule so it + # will only be used if no other domain matches. + example.com: | + + # example.org will be used for routes having app=nonprofit. + example.org: | + selector: + app: nonprofit +--- +# Copyright 2020 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-features + namespace: knative-serving + labels: + app.kubernetes.io/name: knative-serving + app.kubernetes.io/component: controller + app.kubernetes.io/version: "1.22.1" + annotations: + knative.dev/example-checksum: "bee75b26" +data: + _example: |- + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this example block and unindented to be in the data block + # to actually change the configuration. + + # Default SecurityContext settings to secure-by-default values + # if unset. + # + # Disabled - do nothing; no security options are applied + # AllowRootBounded - Applies secure defaults without enforcing strict policies; sets seccompProfile + # to RuntimeDefault and drops all capabilities + # Enabled - Enforces security defaults; sets seccompProfile to RuntimeDefault, drops all capabilities, + # and sets runAsNonRoot to true if not already specified. + secure-pod-defaults: "disabled" + + # Indicates whether multi container support is enabled + # + # WARNING: Cannot safely be disabled once enabled. + # See: https://knative.dev/docs/serving/configuration/feature-flags/#multiple-containers + multi-container: "enabled" + + # Indicates whether multi container probing is enabled + # + # WARNING: Cannot safely be disabled once enabled. + # See: https://knative.dev/docs/serving/configuration/feature-flags/#multiple-container-probing + multi-container-probing: "disabled" + + # Indicates whether Kubernetes affinity support is enabled + # + # WARNING: Cannot safely be disabled once enabled. + # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-node-affinity + kubernetes.podspec-affinity: "disabled" + + # Indicates whether Kubernetes topologySpreadConstraints support is enabled + # + # WARNING: Cannot safely be disabled once enabled. + # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-topology-spread-constraints + kubernetes.podspec-topologyspreadconstraints: "disabled" + + # Indicates whether Kubernetes hostAliases support is enabled + # + # WARNING: Cannot safely be disabled once enabled. + # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-host-aliases + kubernetes.podspec-hostaliases: "disabled" + + # Indicates whether Kubernetes nodeSelector support is enabled + # + # WARNING: Cannot safely be disabled once enabled. + # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-node-selector + kubernetes.podspec-nodeselector: "disabled" + + # Indicates whether Kubernetes tolerations support is enabled + # + # WARNING: Cannot safely be disabled once enabled + # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-toleration + kubernetes.podspec-tolerations: "disabled" + + # Indicates whether Kubernetes FieldRef support is enabled + # + # WARNING: Cannot safely be disabled once enabled. + # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-fieldref + kubernetes.podspec-fieldref: "disabled" + + # Indicates whether Kubernetes RuntimeClassName support is enabled + # + # WARNING: Cannot safely be disabled once enabled. + # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-runtime-class + kubernetes.podspec-runtimeclassname: "disabled" + + # Indicates whether Kubernetes DNSPolicy support is enabled + # + # WARNING: Cannot safely be disabled once enabled. + # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-dnspolicy + kubernetes.podspec-dnspolicy: "disabled" + + # Indicates whether Kubernetes DNSConfig support is enabled + # + # WARNING: Cannot safely be disabled once enabled. + # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-dnsconfig + kubernetes.podspec-dnsconfig: "disabled" + + # This feature allows end-users to set a subset of fields on the Pod's SecurityContext + # + # When set to "enabled" or "allowed" it allows the following + # PodSecurityContext properties: + # - FSGroup + # - RunAsGroup + # - RunAsNonRoot + # - SupplementalGroups + # - RunAsUser + # - SeccompProfile + # + # This feature flag should be used with caution as the PodSecurityContext + # properties may have a side-effect on non-user sidecar containers that come + # from Knative or your service mesh + # + # WARNING: Cannot safely be disabled once enabled. + # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-security-context + kubernetes.podspec-securitycontext: "disabled" + + # Indicated whether sharing the process namespace via ShareProcessNamespace pod spec is allowed. + # This can be especially useful for sharing data from images directly between sidecars + # + # See: https://knative.dev/docs/serving/configuration/feature-flags/#kubernetes-share-process-namespace + kubernetes.podspec-shareprocessnamespace: "disabled" + + # Indicates whether hostIPC support is enabled + # + # WARNING: Cannot safely be disabled once enabled. + # See https://knative.dev/docs/serving/configuration/feature-flags/#kubernetes-host-ipc + kubernetes.podspec-hostipc: "disabled" + + # Indicates whether hostPID support is enabled + # + # WARNING: Cannot safely be disabled once enabled. + # See https://knative.dev/docs/serving/configuration/feature-flags/#kubernetes-host-pid + kubernetes.podspec-hostpid: "disabled" + + # Indicates whether hostNetwork support is enabled + # + # WARNING: Cannot safely be disabled once enabled. + # See See https://knative.dev/docs/serving/configuration/feature-flags/#kubernetes-host-network + kubernetes.podspec-hostnetwork: "disabled" + + # Indicates whether Kubernetes PriorityClassName support is enabled + # + # WARNING: Cannot safely be disabled once enabled. + # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-priority-class-name + kubernetes.podspec-priorityclassname: "disabled" + + # Indicates whether Kubernetes SchedulerName support is enabled + # + # WARNING: Cannot safely be disabled once enabled. + # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-scheduler-name + kubernetes.podspec-schedulername: "disabled" + + # This feature flag allows end-users to add a subset of capabilities on the Pod's SecurityContext. + # + # When set to "enabled" or "allowed" it allows capabilities to be added to the container. + # For a list of possible capabilities, see https://man7.org/linux/man-pages/man7/capabilities.7.html + kubernetes.containerspec-addcapabilities: "disabled" + + + # Controls whether tag header based routing feature are enabled or not. + # 1. Enabled: enabling tag header based routing + # 2. Disabled: disabling tag header based routing + # See: https://knative.dev/docs/serving/feature-flags/#tag-header-based-routing + tag-header-based-routing: "disabled" + + # Controls whether http2 auto-detection should be enabled or not. + # 1. Enabled: http2 connection will be attempted via upgrade. + # 2. Disabled: http2 connection will only be attempted when port name is set to "h2c". + autodetect-http2: "disabled" + + # Controls whether volume support for EmptyDir is enabled or not. + # 1. Enabled: enabling EmptyDir volume support + # 2. Disabled: disabling EmptyDir volume support + kubernetes.podspec-volumes-emptydir: "enabled" + + # Controls whether volume support for image is enabled or not. + # 1. Enabled: enabling image volume support + # 2. Disabled: disabling image volume support + kubernetes.podspec-volumes-image: "disabled" + + # Controls whether volume support for HostPath is enabled or not. + # WARNING: Cannot safely be disabled once enabled. + # WARNING: If you can avoid using a hostPath volume, you should. + # Please read https://kubernetes.io/docs/concepts/storage/volumes/#hostpath before enabling this feature. + # 1. Enabled: enabling HostPath volume support + # 2. Disabled: disabling HostPath volume support + kubernetes.podspec-volumes-hostpath: "disabled" + + # Controls whether volume support for CSI is enabled or not. + # 1. Enabled: enabling CSI volume support + # 2. Disabled: disabling CSI volume support + kubernetes.podspec-volumes-csi: "disabled" + + # Controls whether init containers support is enabled or not. + # 1. Enabled: enabling init containers support + # 2. Disabled: disabling init containers support + kubernetes.podspec-init-containers: "disabled" + + # Controls whether persistent volume claim support is enabled or not. + # 1. Enabled: enabling persistent volume claim support + # 2. Disabled: disabling persistent volume claim support + kubernetes.podspec-persistent-volume-claim: "disabled" + + # Controls whether write access for persistent volumes is enabled or not. + # 1. Enabled: enabling write access for persistent volumes + # 2. Disabled: disabling write access for persistent volumes + kubernetes.podspec-persistent-volume-write: "disabled" + + # Controls whether volume mount propagation support is enabled or not. + # 1. Enabled: enabling volume mount propagation support + # 2. Disabled: disabling volume mount propagation support + kubernetes.podspec-volumes-mount-propagation: "disabled" + + # Controls if the queue proxy podInfo feature is enabled, allowed or disabled + # + # This feature should be enabled/allowed when using queue proxy Options (Extensions) + # Enabling will mount a podInfo volume to the queue proxy container. + # The volume will contains an 'annotations' file (from the pod's annotation field). + # The annotations in this file include the Service annotations set by the client creating the service. + # If mounted, the annotations can be accessed by queue proxy extensions at /etc/podinfo/annotations + # + # 1. "enabled": always mount a podInfo volume + # 2. "disabled": never mount a podInfo volume + # 3. "allowed": by default, do not mount a podInfo volume + # However, a client may mount the podInfo volume on an individual Service by attaching + # the following metadata annotation to the Service: "features.knative.dev/queueproxy-podinfo":"enabled". + # + # NOTE THAT THIS IS AN EXPERIMENTAL / ALPHA FEATURE + queueproxy.mount-podinfo: "disabled" + + # Default queue proxy resource requests and limits to good values for most cases if set. + queueproxy.resource-defaults: "disabled" +--- +# Copyright 2018 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-gc + namespace: knative-serving + labels: + app.kubernetes.io/name: knative-serving + app.kubernetes.io/component: controller + app.kubernetes.io/version: "1.22.1" + annotations: + knative.dev/example-checksum: "aa3813a8" +data: + _example: | + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this example block and unindented to be in the data block + # to actually change the configuration. + + # --------------------------------------- + # Garbage Collector Settings + # --------------------------------------- + # + # Active + # * Revisions which are referenced by a Route are considered active. + # * Individual revisions may be marked with the annotation + # "serving.knative.dev/no-gc":"true" to be permanently considered active. + # * Active revisions are not considered for GC. + # Retention + # * Revisions are retained if they are any of the following: + # 1. Active + # 2. Were created within "retain-since-create-time" + # 3. Were last referenced by a route within + # "retain-since-last-active-time" + # 4. There are fewer than "min-non-active-revisions" + # If none of these conditions are met, or if the count of revisions exceed + # "max-non-active-revisions", they will be deleted by GC. + # The special value "disabled" may be used to turn off these limits. + # + # Example config to immediately collect any inactive revision: + # min-non-active-revisions: "0" + # max-non-active-revisions: "0" + # retain-since-create-time: "disabled" + # retain-since-last-active-time: "disabled" + # + # Example config to always keep around the last ten non-active revisions: + # retain-since-create-time: "disabled" + # retain-since-last-active-time: "disabled" + # max-non-active-revisions: "10" + # + # Example config to disable all garbage collection: + # retain-since-create-time: "disabled" + # retain-since-last-active-time: "disabled" + # max-non-active-revisions: "disabled" + # + # Example config to keep recently deployed or active revisions, + # always maintain the last two in case of rollback, and prevent + # burst activity from exploding the count of old revisions: + # retain-since-create-time: "48h" + # retain-since-last-active-time: "15h" + # min-non-active-revisions: "2" + # max-non-active-revisions: "1000" + + # Duration since creation before considering a revision for GC or "disabled". + retain-since-create-time: "48h" + + # Duration since active before considering a revision for GC or "disabled". + retain-since-last-active-time: "15h" + + # Minimum number of non-active revisions to retain. + min-non-active-revisions: "20" + + # Maximum number of non-active revisions to retain + # or "disabled" to disable any maximum limit. + max-non-active-revisions: "1000" +--- +# Copyright 2020 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-leader-election + namespace: knative-serving + labels: + app.kubernetes.io/name: knative-serving + app.kubernetes.io/component: controller + app.kubernetes.io/version: "1.22.1" + annotations: + knative.dev/example-checksum: "f4b71f57" +data: + _example: | + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this example block and unindented to be in the data block + # to actually change the configuration. + + # lease-duration is how long non-leaders will wait to try to acquire the + # lock; 15 seconds is the value used by core kubernetes controllers. + lease-duration: "60s" + + # renew-deadline is how long a leader will try to renew the lease before + # giving up; 10 seconds is the value used by core kubernetes controllers. + renew-deadline: "40s" + + # retry-period is how long the leader election client waits between tries of + # actions; 2 seconds is the value used by core kubernetes controllers. + retry-period: "10s" + + # buckets is the number of buckets used to partition key space of each + # Reconciler. If this number is M and the replica number of the controller + # is N, the N replicas will compete for the M buckets. The owner of a + # bucket will take care of the reconciling for the keys partitioned into + # that bucket. + buckets: "1" +--- +# Copyright 2018 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-logging + namespace: knative-serving + labels: + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/component: logging + app.kubernetes.io/name: knative-serving + annotations: + knative.dev/example-checksum: "9f25d429" +data: + _example: | + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this example block and unindented to be in the data block + # to actually change the configuration. + + # Common configuration for all Knative codebase + zap-logger-config: | + { + "level": "info", + "development": false, + "outputPaths": ["stdout"], + "errorOutputPaths": ["stderr"], + "encoding": "json", + "encoderConfig": { + "timeKey": "timestamp", + "levelKey": "severity", + "nameKey": "logger", + "callerKey": "caller", + "messageKey": "message", + "stacktraceKey": "stacktrace", + "lineEnding": "", + "levelEncoder": "", + "timeEncoder": "iso8601", + "durationEncoder": "", + "callerEncoder": "" + } + } + + # Log level overrides + # For all components except the queue proxy, + # changes are picked up immediately. + # For queue proxy, changes require recreation of the pods. + loglevel.controller: "info" + loglevel.autoscaler: "info" + loglevel.queueproxy: "info" + loglevel.webhook: "info" + loglevel.activator: "info" + loglevel.hpaautoscaler: "info" + loglevel.net-istio-controller: "info" + loglevel.net-contour-controller: "info" + loglevel.net-kourier-controller: "info" + loglevel.net-gateway-api-controller: "info" +--- +# Copyright 2018 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-network + namespace: knative-serving + labels: + app.kubernetes.io/name: knative-serving + app.kubernetes.io/component: networking + app.kubernetes.io/version: "1.22.1" + annotations: + knative.dev/example-checksum: "0573e07d" +data: + _example: | + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this example block and unindented to be in the data block + # to actually change the configuration. + + # ingress-class specifies the default ingress class + # to use when not dictated by Route annotation. + # + # If not specified, will use the Istio ingress. + # + # Note that changing the Ingress class of an existing Route + # will result in undefined behavior. Therefore it is best to only + # update this value during the setup of Knative, to avoid getting + # undefined behavior. + ingress-class: "istio.ingress.networking.knative.dev" + + # certificate-class specifies the default Certificate class + # to use when not dictated by Route annotation. + # + # If not specified, will use the Cert-Manager Certificate. + # + # Note that changing the Certificate class of an existing Route + # will result in undefined behavior. Therefore it is best to only + # update this value during the setup of Knative, to avoid getting + # undefined behavior. + certificate-class: "cert-manager.certificate.networking.knative.dev" + + # namespace-wildcard-cert-selector specifies a LabelSelector which + # determines which namespaces should have a wildcard certificate + # provisioned. + # + # Use an empty value to disable the feature (this is the default): + # namespace-wildcard-cert-selector: "" + # + # Use an empty object to enable for all namespaces + # namespace-wildcard-cert-selector: {} + # + # Useful labels include the "kubernetes.io/metadata.name" label to + # avoid provisioning a certificate for the "kube-system" namespaces. + # Use the following selector to match pre-1.0 behavior of using + # "networking.knative.dev/disableWildcardCert" to exclude namespaces: + # + # matchExpressions: + # - key: "networking.knative.dev/disableWildcardCert" + # operator: "NotIn" + # values: ["true"] + namespace-wildcard-cert-selector: "" + + # domain-template specifies the golang text template string to use + # when constructing the Knative service's DNS name. The default + # value is "{{.Name}}.{{.Namespace}}.{{.Domain}}". + # + # Valid variables defined in the template include Name, Namespace, Domain, + # Labels, and Annotations. Name will be the result of the tag-template + # below, if a tag is specified for the route. + # + # Changing this value might be necessary when the extra levels in + # the domain name generated is problematic for wildcard certificates + # that only support a single level of domain name added to the + # certificate's domain. In those cases you might consider using a value + # of "{{.Name}}-{{.Namespace}}.{{.Domain}}", or removing the Namespace + # entirely from the template. When choosing a new value be thoughtful + # of the potential for conflicts - for example, when users choose to use + # characters such as `-` in their service, or namespace, names. + # {{.Annotations}} or {{.Labels}} can be used for any customization in the + # go template if needed. + # We strongly recommend keeping namespace part of the template to avoid + # domain name clashes: + # eg. '{{.Name}}-{{.Namespace}}.{{ index .Annotations "sub"}}.{{.Domain}}' + # and you have an annotation {"sub":"foo"}, then the generated template + # would be {Name}-{Namespace}.foo.{Domain} + domain-template: "{{.Name}}.{{.Namespace}}.{{.Domain}}" + + # tag-template specifies the golang text template string to use + # when constructing the DNS name for "tags" within the traffic blocks + # of Routes and Configuration. This is used in conjunction with the + # domain-template above to determine the full URL for the tag. + tag-template: "{{.Tag}}-{{.Name}}" + + # auto-tls is deprecated and replaced by external-domain-tls + auto-tls: "Disabled" + + # Controls whether TLS certificates are automatically provisioned and + # installed in the Knative ingress to terminate TLS connections + # for cluster external domains (like: app.example.com) + # - Enabled: enables the TLS certificate provisioning feature for cluster external domains. + # - Disabled: disables the TLS certificate provisioning feature for cluster external domains. + external-domain-tls: "Disabled" + + # Controls weather TLS certificates are automatically provisioned and + # installed in the Knative ingress to terminate TLS connections + # for cluster local domains (like: app.namespace.svc.) + # - Enabled: enables the TLS certificate provisioning feature for cluster cluster-local domains. + # - Disabled: disables the TLS certificate provisioning feature for cluster cluster local domains. + # NOTE: This flag is in an alpha state and is mostly here to enable internal testing + # for now. Use with caution. + cluster-local-domain-tls: "Disabled" + + # internal-encryption is deprecated and replaced by system-internal-tls + internal-encryption: "false" + + # system-internal-tls controls weather TLS encryption is used for connections between + # the internal components of Knative: + # - ingress to activator + # - ingress to queue-proxy + # - activator to queue-proxy + # + # Possible values for this flag are: + # - Enabled: enables the TLS certificate provisioning feature for cluster cluster-local domains. + # - Disabled: disables the TLS certificate provisioning feature for cluster cluster local domains. + # NOTE: This flag is in an alpha state and is mostly here to enable internal testing + # for now. Use with caution. + system-internal-tls: "Disabled" + + # Controls the behavior of the HTTP endpoint for the Knative ingress. + # It requires auto-tls to be enabled. + # - Enabled: The Knative ingress will be able to serve HTTP connection. + # - Redirected: The Knative ingress will send a 301 redirect for all + # http connections, asking the clients to use HTTPS. + # + # "Disabled" option is deprecated. + http-protocol: "Enabled" + + # rollout-duration contains the minimal duration in seconds over which the + # Configuration traffic targets are rolled out to the newest revision. + rollout-duration: "0" + + # autocreate-cluster-domain-claims controls whether ClusterDomainClaims should + # be automatically created (and deleted) as needed when DomainMappings are + # reconciled. + # + # If this is "false" (the default), the cluster administrator is + # responsible for creating ClusterDomainClaims and delegating them to + # namespaces via their spec.Namespace field. This setting should be used in + # multitenant environments which need to control which namespace can use a + # particular domain name in a domain mapping. + # + # If this is "true", users are able to associate arbitrary names with their + # services via the DomainMapping feature. + autocreate-cluster-domain-claims: "false" + + # If true, networking plugins can add additional information to deployed + # applications to make their pods directly accessible via their IPs even if mesh is + # enabled and thus direct-addressability is usually not possible. + # Consumers like Knative Serving can use this setting to adjust their behavior + # accordingly, i.e. to drop fallback solutions for non-pod-addressable systems. + # + # NOTE: This flag is in an alpha state and is mostly here to enable internal testing + # for now. Use with caution. + enable-mesh-pod-addressability: "false" + + # mesh-compatibility-mode indicates whether consumers of network plugins + # should directly contact Pod IPs (most efficient), or should use the + # Cluster IP (less efficient, needed when mesh is enabled unless + # `enable-mesh-pod-addressability`, above, is set). + # Permitted values are: + # - "auto" (default): automatically determine which mesh mode to use by trying Pod IP and falling back to Cluster IP as needed. + # - "enabled": always use Cluster IP and do not attempt to use Pod IPs. + # - "disabled": always use Pod IPs and do not fall back to Cluster IP on failure. + mesh-compatibility-mode: "auto" + + # Defines the scheme used for external URLs if auto-tls is not enabled. + # This can be used for making Knative report all URLs as "HTTPS" for example, if you're + # fronting Knative with an external loadbalancer that deals with TLS termination and + # Knative doesn't know about that otherwise. + default-external-scheme: "http" +--- +# Copyright 2018 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-observability + namespace: knative-serving + labels: + app.kubernetes.io/name: knative-serving + app.kubernetes.io/component: observability + app.kubernetes.io/version: "1.22.1" + annotations: + knative.dev/example-checksum: "59abacb5" +data: + _example: | + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this example block and unindented to be in the data block + # to actually change the configuration. + + # logging.enable-var-log-collection defaults to false. + # The fluentd daemon set will be set up to collect /var/log if + # this flag is true. + logging.enable-var-log-collection: "false" + + # logging.revision-url-template provides a template to use for producing the + # logging URL that is injected into the status of each Revision. + logging.revision-url-template: "http://logging.example.com/?revisionUID=${REVISION_UID}" + + # If non-empty, this enables queue proxy writing user request logs to stdout, excluding probe + # requests. + # NB: after 0.18 release logging.enable-request-log must be explicitly set to true + # in order for request logging to be enabled. + # + # The value determines the shape of the request logs and it must be a valid go text/template. + # It is important to keep this as a single line. Multiple lines are parsed as separate entities + # by most collection agents and will split the request logs into multiple records. + # + # The following fields and functions are available to the template: + # + # Request: An http.Request (see https://golang.org/pkg/net/http/#Request) + # representing an HTTP request received by the server. + # + # Response: + # struct { + # Code int // HTTP status code (see https://www.iana.org/assignments/http-status-codes/http-status-codes.xhtml) + # Size int // An int representing the size of the response. + # Latency float64 // A float64 representing the latency of the response in seconds. + # } + # + # Revision: + # struct { + # Name string // Knative revision name + # Namespace string // Knative revision namespace + # Service string // Knative service name + # Configuration string // Knative configuration name + # PodName string // Name of the pod hosting the revision + # PodIP string // IP of the pod hosting the revision + # } + # + logging.request-log-template: '{"httpRequest": {"requestMethod": "{{.Request.Method}}", "requestUrl": "{{js .Request.RequestURI}}", "requestSize": "{{.Request.ContentLength}}", "status": {{.Response.Code}}, "responseSize": "{{.Response.Size}}", "userAgent": "{{js .Request.UserAgent}}", "remoteIp": "{{js .Request.RemoteAddr}}", "serverIp": "{{.Revision.PodIP}}", "referer": "{{js .Request.Referer}}", "latency": "{{.Response.Latency}}s", "protocol": "{{.Request.Proto}}"}, "traceId": "{{.TraceID}}"}' + + # If true, the request logging will be enabled. + logging.enable-request-log: "false" + + # If true, this enables queue proxy writing request logs for probe requests to stdout. + # It uses the same template for user requests, i.e. logging.request-log-template. + logging.enable-probe-request-log: "false" + + # metrics-protocol field specifies the protocol used when exporting metrics + # It supports either 'none' (the default), 'prometheus', 'http/protobuf' (OTLP HTTP), 'grpc' (OTLP gRPC) + metrics-protocol: http/protobuf + + # metrics-endpoint field specifies the destination metrics should be exporter to. + # + # The endpoint MUST be set when the protocol is http/protobuf or grpc. + # The endpoint MUST NOT be set when the protocol is none. + # + # When the protocol is prometheus the endpoint can accept a 'host:port' string to customize the + # listening host interface and port. + metrics-endpoint: http://example.com/v1/traces + + # metrics-export-interval specifies the global metrics reporting period for control and data plane components. + # If a zero or negative value is passed the default reporting OTel period is used (60 secs). + metrics-export-interval: 60s + + # request-metrics-protocol field specifies the protocol used when exporting queue-proxy metrics + # It supports either 'none' (the default), 'prometheus', 'http/protobuf' (OTLP HTTP), 'grpc' (OTLP gRPC) + request-metrics-protocol: http/protobuf + + # request-metrics-endpoint field specifies the destination metrics from the queue proxy should be exporter to. + # + # The endpoint MUST be set when the protocol is http/protobuf or grpc. + # The endpoint MUST NOT be set when the protocol is none. + # + # When the protocol is prometheus the endpoint can accept a 'host:port' string to customize the + # listening host interface and port. + request-metrics-endpoint: http://promstack-kube-prometheus-prometheus.observability:9090/api/v1/otlp/v1/metrics + + # request-metrics-export-interval specifies the global metrics reporting period for the queue-proxy. + # + # If a zero or negative value is passed the default reporting OTel period is used (60 secs). + request-metrics-export-interval: 60s + + # runtime-profiling indicates whether it is allowed to retrieve runtime profiling data from + # the pods via an HTTP server in the format expected by the pprof visualization tool. When + # enabled, the Knative Serving pods expose the profiling data on an alternate HTTP port 8008. + # The HTTP context root for profiling is then /debug/pprof/. + runtime-profiling: enabled + + # tracing-protocol field specifies the protocol used when exporting traces + # It supports either 'none' (the default), 'http/protobuf' (OTLP HTTP), 'grpc' (OTLP gRPC) + # or `stdout` for debugging purposes + tracing-protocol: http/protobuf + + # tracing-endpoint field specifies the destination traces should be exporter to. + # + # The endpoint MUST be set when the protocol is http/protobuf or grpc. + # The endpoint MUST NOT be set when the protocol is none. + tracing-endpoint: http://jaeger-collector.observability:4318/v1/traces + + # tracing-sampling-rate allows the user to specify what percentage of all traces should be exported + # The value should be between 0 (never sample) to 1 (always sample) + tracing-sampling-rate: "1" +--- +# Copyright 2019 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-tracing + namespace: knative-serving + labels: + app.kubernetes.io/name: knative-serving + app.kubernetes.io/component: tracing + app.kubernetes.io/version: "1.22.1" + annotations: + knative.dev/example-checksum: "04c7e9a3" +data: + _example: | + ########################################################### + # # + # This config is deprecated - use config-observability # + # # + ########################################################### +--- +# Copyright 2020 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: autoscaling/v2 +kind: HorizontalPodAutoscaler +metadata: + name: activator + namespace: knative-serving + labels: + app.kubernetes.io/component: activator + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" +spec: + minReplicas: 1 + maxReplicas: 20 + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: activator + metrics: + - type: Resource + resource: + name: cpu + target: + type: Utilization + # Percentage of the requested CPU + averageUtilization: 100 +--- +# Activator PDB. Currently we permit unavailability of 20% of tasks at the same time. +# Given the subsetting and that the activators are partially stateful systems, we want +# a slow rollout of the new versions and slow migration during node upgrades. +apiVersion: policy/v1 +kind: PodDisruptionBudget +metadata: + name: activator-pdb + namespace: knative-serving + labels: + app.kubernetes.io/component: activator + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" +spec: + minAvailable: 80% + selector: + matchLabels: + app: activator +--- +# Copyright 2018 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: activator + namespace: knative-serving + labels: + app.kubernetes.io/component: activator + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +spec: + selector: + matchLabels: + app: activator + role: activator + template: + metadata: + labels: + app: activator + role: activator + app.kubernetes.io/component: activator + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" + spec: + # To avoid node becoming SPOF, spread our replicas to different nodes. + affinity: + podAntiAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchLabels: + app: activator + topologyKey: kubernetes.io/hostname + weight: 100 + serviceAccountName: activator + containers: + - name: activator + # This is the Go import path for the binary that is containerized + # and substituted here. + image: gcr.io/knative-releases/knative.dev/serving/cmd/activator@sha256:5deaef961fef8d1417f6d4a4dfae2fc338f2d30d72c4ad58c3ab392b2c04705b + # The numbers are based on performance test results from + # https://github.com/knative/serving/issues/1625#issuecomment-511930023 + resources: + requests: + cpu: 300m + memory: 60Mi + limits: + cpu: 1000m + memory: 600Mi + env: + # Run Activator with GC collection when newly generated memory is 500%. + - name: GOGC + value: "500" + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: POD_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + - name: SYSTEM_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: CONFIG_LOGGING_NAME + value: config-logging + - name: CONFIG_OBSERVABILITY_NAME + value: config-observability + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + runAsNonRoot: true + capabilities: + drop: + - ALL + seccompProfile: + type: RuntimeDefault + ports: + - name: metrics + containerPort: 9090 + - name: profiling + containerPort: 8008 + - name: http1 + containerPort: 8012 + - name: h2c + containerPort: 8013 + readinessProbe: + httpGet: + port: 8012 + periodSeconds: 5 + failureThreshold: 5 + livenessProbe: + httpGet: + port: 8012 + periodSeconds: 10 + failureThreshold: 12 + initialDelaySeconds: 15 + # The activator (often) sits on the dataplane, and may proxy long (e.g. + # streaming, websockets) requests. We give a long grace period for the + # activator to "lame duck" and drain outstanding requests before we + # forcibly terminate the pod (and outstanding connections). This value + # should be at least as large as the upper bound on the Revision's + # timeoutSeconds property to avoid servicing events disrupting + # connections. + terminationGracePeriodSeconds: 600 +--- +apiVersion: v1 +kind: Service +metadata: + name: activator-service + namespace: knative-serving + labels: + app: activator + app.kubernetes.io/component: activator + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +spec: + selector: + app: activator + ports: + # Define metrics and profiling for them to be accessible within service meshes. + - name: http-metrics + port: 9090 + targetPort: 9090 + - name: http-profiling + port: 8008 + targetPort: 8008 + - name: http + port: 80 + targetPort: 8012 + - name: http2 + port: 81 + targetPort: 8013 + - name: https + port: 443 + targetPort: 8112 + type: ClusterIP +--- +# Copyright 2018 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: autoscaler + namespace: knative-serving + labels: + app.kubernetes.io/component: autoscaler + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" +spec: + replicas: 1 + selector: + matchLabels: + app: autoscaler + strategy: + type: RollingUpdate + rollingUpdate: + maxUnavailable: 0 + template: + metadata: + labels: + app: autoscaler + app.kubernetes.io/component: autoscaler + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" + spec: + # To avoid node becoming SPOF, spread our replicas to different nodes. + affinity: + podAntiAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchLabels: + app: autoscaler + topologyKey: kubernetes.io/hostname + weight: 100 + serviceAccountName: controller + containers: + - name: autoscaler + # This is the Go import path for the binary that is containerized + # and substituted here. + image: gcr.io/knative-releases/knative.dev/serving/cmd/autoscaler@sha256:5bae38655d87df86b041083fbe51791816473245f752432ba9b85a7b12f73cd5 + resources: + requests: + cpu: 100m + memory: 100Mi + limits: + cpu: 1000m + memory: 1000Mi + env: + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: POD_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + - name: SYSTEM_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: CONFIG_LOGGING_NAME + value: config-logging + - name: CONFIG_OBSERVABILITY_NAME + value: config-observability + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + runAsNonRoot: true + capabilities: + drop: + - ALL + seccompProfile: + type: RuntimeDefault + ports: + - name: metrics + containerPort: 9090 + - name: profiling + containerPort: 8008 + - name: websocket + containerPort: 8080 + readinessProbe: + httpGet: + port: 8080 + livenessProbe: + httpGet: + port: 8080 + failureThreshold: 6 +--- +apiVersion: v1 +kind: Service +metadata: + labels: + app: autoscaler + app.kubernetes.io/component: autoscaler + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" + name: autoscaler + namespace: knative-serving +spec: + ports: + # Define metrics and profiling for them to be accessible within service meshes. + - name: http-metrics + port: 9090 + targetPort: 9090 + - name: http-profiling + port: 8008 + targetPort: 8008 + - name: http + port: 8080 + targetPort: 8080 + selector: + app: autoscaler +--- +# Copyright 2018 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: controller + namespace: knative-serving + labels: + app.kubernetes.io/component: controller + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" +spec: + selector: + matchLabels: + app: controller + template: + metadata: + labels: + app: controller + app.kubernetes.io/component: controller + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" + spec: + # To avoid node becoming SPOF, spread our replicas to different nodes. + affinity: + podAntiAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchLabels: + app: controller + topologyKey: kubernetes.io/hostname + weight: 100 + serviceAccountName: controller + containers: + - name: controller + # This is the Go import path for the binary that is containerized + # and substituted here. + image: gcr.io/knative-releases/knative.dev/serving/cmd/controller@sha256:94329d85200c2fc31ed1166a26568ca1357376c149c147e71f400cf28be3c816 + resources: + requests: + cpu: 100m + memory: 100Mi + limits: + cpu: 1000m + memory: 1000Mi + env: + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: SYSTEM_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: CONFIG_LOGGING_NAME + value: config-logging + - name: CONFIG_OBSERVABILITY_NAME + value: config-observability + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + runAsNonRoot: true + capabilities: + drop: + - ALL + seccompProfile: + type: RuntimeDefault + livenessProbe: + httpGet: + path: /health + port: probes + scheme: HTTP + periodSeconds: 5 + failureThreshold: 6 + readinessProbe: + httpGet: + path: /readiness + port: probes + scheme: HTTP + periodSeconds: 5 + failureThreshold: 3 + ports: + - name: metrics + containerPort: 9090 + - name: profiling + containerPort: 8008 + - name: probes + containerPort: 8080 +--- +apiVersion: v1 +kind: Service +metadata: + labels: + app: controller + app.kubernetes.io/component: controller + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" + name: controller + namespace: knative-serving +spec: + ports: + # Define metrics and profiling for them to be accessible within service meshes. + - name: http-metrics + port: 9090 + targetPort: 9090 + - name: http-profiling + port: 8008 + targetPort: 8008 + selector: + app: controller +--- +# Copyright 2020 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: autoscaling/v2 +kind: HorizontalPodAutoscaler +metadata: + name: webhook + namespace: knative-serving + labels: + app.kubernetes.io/component: webhook + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" +spec: + minReplicas: 1 + maxReplicas: 5 + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: webhook + metrics: + - type: Resource + resource: + name: cpu + target: + type: Utilization + # Percentage of the requested CPU + averageUtilization: 100 +--- +# Webhook PDB. +apiVersion: policy/v1 +kind: PodDisruptionBudget +metadata: + name: webhook-pdb + namespace: knative-serving + labels: + app.kubernetes.io/component: webhook + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" +spec: + minAvailable: 80% + selector: + matchLabels: + app: webhook +--- +# Copyright 2018 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: webhook + namespace: knative-serving + labels: + app.kubernetes.io/component: webhook + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +spec: + selector: + matchLabels: + app: webhook + role: webhook + template: + metadata: + labels: + app: webhook + role: webhook + app.kubernetes.io/component: webhook + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving + spec: + # To avoid node becoming SPOF, spread our replicas to different nodes. + affinity: + podAntiAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchLabels: + app: webhook + topologyKey: kubernetes.io/hostname + weight: 100 + serviceAccountName: controller + containers: + - name: webhook + # This is the Go import path for the binary that is containerized + # and substituted here. + image: gcr.io/knative-releases/knative.dev/serving/cmd/webhook@sha256:8470456be214e93a84e3c7b79a632aa9978bd8ecda553feaa47878a2c24ab84d + resources: + requests: + cpu: 100m + memory: 100Mi + limits: + cpu: 500m + memory: 500Mi + env: + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: SYSTEM_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: CONFIG_LOGGING_NAME + value: config-logging + - name: CONFIG_OBSERVABILITY_NAME + value: config-observability + - name: WEBHOOK_NAME + value: webhook + - name: WEBHOOK_PORT + value: "8443" + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + runAsNonRoot: true + capabilities: + drop: + - ALL + seccompProfile: + type: RuntimeDefault + ports: + - name: metrics + containerPort: 9090 + - name: profiling + containerPort: 8008 + - name: https-webhook + containerPort: 8443 + readinessProbe: + periodSeconds: 1 + httpGet: + scheme: HTTPS + port: 8443 + livenessProbe: + periodSeconds: 10 + httpGet: + scheme: HTTPS + port: 8443 + failureThreshold: 6 + initialDelaySeconds: 20 + # Our webhook should gracefully terminate by lame ducking first, set this to a sufficiently + # high value that we respect whatever value it has configured for the lame duck grace period. + terminationGracePeriodSeconds: 300 +--- +apiVersion: v1 +kind: Service +metadata: + labels: + app: webhook + role: webhook + app.kubernetes.io/component: webhook + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving + name: webhook + namespace: knative-serving +spec: + ports: + # Define metrics and profiling for them to be accessible within service meshes. + - name: http-metrics + port: 9090 + targetPort: 9090 + - name: http-profiling + port: 8008 + targetPort: 8008 + - name: https-webhook + port: 443 + targetPort: 8443 + selector: + app: webhook + role: webhook +--- +# Copyright 2020 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingWebhookConfiguration +metadata: + name: config.webhook.serving.knative.dev + labels: + app.kubernetes.io/component: webhook + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" +webhooks: + - admissionReviewVersions: ["v1", "v1beta1"] + clientConfig: + service: + name: webhook + namespace: knative-serving + failurePolicy: Fail + sideEffects: None + name: config.webhook.serving.knative.dev + objectSelector: + matchExpressions: + - key: app.kubernetes.io/name + operator: In + values: ["knative-serving"] + - key: app.kubernetes.io/component + operator: In + values: ["autoscaler", "controller", "logging", "networking", "observability", "tracing", "net-certmanager"] + timeoutSeconds: 10 +--- +# Copyright 2020 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: admissionregistration.k8s.io/v1 +kind: MutatingWebhookConfiguration +metadata: + name: webhook.serving.knative.dev + labels: + app.kubernetes.io/component: webhook + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" +webhooks: + - admissionReviewVersions: ["v1", "v1beta1"] + clientConfig: + service: + name: webhook + namespace: knative-serving + failurePolicy: Fail + sideEffects: None + name: webhook.serving.knative.dev + timeoutSeconds: 10 + rules: + - apiGroups: + - autoscaling.internal.knative.dev + - networking.internal.knative.dev + - serving.knative.dev + apiVersions: + - "*" + operations: + - CREATE + - UPDATE + scope: "*" + resources: + - metrics + - podautoscalers + - certificates + - ingresses + - serverlessservices + - configurations + - revisions + - routes + - services + - domainmappings + - domainmappings/status +--- +# Copyright 2020 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingWebhookConfiguration +metadata: + name: validation.webhook.serving.knative.dev + labels: + app.kubernetes.io/component: webhook + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" +webhooks: + - admissionReviewVersions: ["v1", "v1beta1"] + clientConfig: + service: + name: webhook + namespace: knative-serving + failurePolicy: Fail + sideEffects: None + name: validation.webhook.serving.knative.dev + timeoutSeconds: 10 + rules: + - apiGroups: + - autoscaling.internal.knative.dev + - networking.internal.knative.dev + - serving.knative.dev + apiVersions: + - "*" + operations: + - CREATE + - UPDATE + - DELETE + scope: "*" + resources: + - metrics + - podautoscalers + - certificates + - ingresses + - serverlessservices + - configurations + - revisions + - routes + - services + - domainmappings + - domainmappings/status +--- +# Copyright 2020 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: Secret +metadata: + name: webhook-certs + namespace: knative-serving + labels: + app.kubernetes.io/component: webhook + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" +# The data is populated at install time. +--- +# Source: https://github.com/knative-extensions/net-kourier/releases/download/knative-v1.22.1/kourier.yaml +--- +# Copyright 2020 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: Namespace +metadata: + name: kourier-system + labels: + networking.knative.dev/ingress-provider: kourier + app.kubernetes.io/name: knative-serving + app.kubernetes.io/component: net-kourier + app.kubernetes.io/version: "1.22.1" +--- +# Copyright 2020 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: kourier-bootstrap + namespace: kourier-system + labels: + networking.knative.dev/ingress-provider: kourier + app.kubernetes.io/component: net-kourier + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +data: + envoy-bootstrap.yaml: | + dynamic_resources: + ads_config: + transport_api_version: V3 + api_type: GRPC + rate_limit_settings: {} + grpc_services: + - envoy_grpc: {cluster_name: xds_cluster} + cds_config: + resource_api_version: V3 + ads: {} + lds_config: + resource_api_version: V3 + ads: {} + node: + cluster: kourier-knative + id: 3scale-kourier-gateway + static_resources: + listeners: + - name: stats_listener + address: + socket_address: + address: 0.0.0.0 + port_value: 9000 + filter_chains: + - filters: + - name: envoy.filters.network.http_connection_manager + typed_config: + "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager + stat_prefix: stats_server + http_filters: + - name: envoy.filters.http.router + typed_config: + "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router + route_config: + virtual_hosts: + - name: admin_interface + domains: + - "*" + routes: + - match: + safe_regex: + regex: '/(certs|stats(/prometheus)?|server_info|clusters|listeners|ready)?' + headers: + - name: ':method' + string_match: + exact: GET + route: + cluster: service_stats + - match: + safe_regex: + regex: '/drain_listeners' + headers: + - name: ':method' + string_match: + exact: POST + route: + cluster: service_stats + clusters: + - name: service_stats + connect_timeout: 0.250s + type: static + load_assignment: + cluster_name: service_stats + endpoints: + lb_endpoints: + endpoint: + address: + socket_address: + address: 127.0.0.1 + port_value: 9901 + - name: xds_cluster + # This keepalive is recommended by envoy docs. + # https://www.envoyproxy.io/docs/envoy/latest/api-docs/xds_protocol + typed_extension_protocol_options: + envoy.extensions.upstreams.http.v3.HttpProtocolOptions: + "@type": type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions + explicit_http_config: + http2_protocol_options: + connection_keepalive: + interval: 30s + timeout: 5s + connect_timeout: 1s + load_assignment: + cluster_name: xds_cluster + endpoints: + lb_endpoints: + endpoint: + address: + socket_address: + address: "net-kourier-controller.knative-serving" + port_value: 18000 + type: STRICT_DNS + admin: + access_log: + - name: envoy.access_loggers.stdout + typed_config: + "@type": type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog + address: + socket_address: + address: 127.0.0.1 + port_value: 9901 +--- +# Copyright 2021 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-kourier + namespace: knative-serving + labels: + networking.knative.dev/ingress-provider: kourier + app.kubernetes.io/component: net-kourier + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +data: + _example: | + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this example block and unindented to be in the data block + # to actually change the configuration. + + # Specifies whether requests reaching the Kourier gateway + # in the context of services should be logged. Readiness + # probes etc. must be configured via the bootstrap config. + enable-service-access-logging: "true" + + # Specifies the format of the access log used by the Kourier gateway. + # This template follows the envoy format. + # see: https://www.envoyproxy.io/docs/envoy/latest/configuration/observability/access_log/usage#access-logging + service-access-log-template: "" + + # Specifies whether to use proxy-protocol in order to safely + # transport connection information such as a client's address + # across multiple layers of TCP proxies. + # NOTE THAT THIS IS AN EXPERIMENTAL / ALPHA FEATURE + enable-proxy-protocol: "false" + + # The server certificates to serve the internal TLS traffic for Kourier Gateway. + # It is specified by the secret name in controller namespace, which has + # the "tls.crt" and "tls.key" data field. + # Use an empty value to disable the feature (default). + # + # NOTE: This flag is in an alpha state and is mostly here to enable internal testing + # for now. Use with caution. + cluster-cert-secret: "" + + # Specifies the amount of time that Kourier waits for the incoming requests. + # The default, 0s, imposes no timeout at all. + stream-idle-timeout: "0s" + + # Specifies whether to use CryptoMB private key provider in order to + # acclerate the TLS handshake. + # NOTE THAT THIS IS AN EXPERIMENTAL / ALPHA FEATURE. + enable-cryptomb: "false" + + # Configures the number of additional ingress proxy hops from the + # right side of the x-forwarded-for HTTP header to trust. + trusted-hops-count: "0" + + # Configures the connection manager to use the real remote address + # of the client connection when determining internal versus external origin and manipulating various headers. + use-remote-address: "false" + + # Specifies the cipher suites for TLS external listener. + # Use ',' separated values like "ECDHE-ECDSA-AES128-GCM-SHA256,ECDHE-ECDSA-CHACHA20-POLY1305" + # The default uses the default cipher suites of the envoy version. + cipher-suites: "" + + # Disable the Envoy server header injection in the response when response has no such header. + disable-envoy-server-header: "false" + + # The external authorization service and port, my-auth:2222. + # This value overrides environment variable if defined. + extauthz-host: "" + + # The protocol used to query the ext auth service. Can be one of : grpc, http, https. Defaults to grpc + # This value overrides environment variable if defined. + extauthz-protocol: "grpc" + + # Allow traffic to go through if the ext auth service is down. Accepts true/false. + # This value overrides environment variable if defined. + extauthz-failure-mode-allow: "" + + # Max request bytes, if not set, defaults to 8192 Bytes. More info Envoy Docs + # see: https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/http/ext_authz/v3/ext_authz.proto.html#extensions-filters-http-ext-authz-v3-buffersettings + # This value overrides environment variable if defined. + extauthz-max-request-body-bytes: 8192 + + # Max time in ms to wait for the ext authz service. Defaults to 2000 ms + # This value overrides environment variable if defined. + extauthz-timeout: 2000 + + # If extauthz-protocol is equal to http or https, path to query the ext auth service. + # Example : if set to /verify, it will query /verify/ (notice the trailing /). If not set, it will query / + # This value overrides environment variable if defined. + extauthz-path-prefix: "" + + # If extauthz-protocol is equal to grpc, sends the body as raw bytes instead of a UTF-8 string. + # Accepts only true/false, t/f or 1/0. Attempting to set another value will throw an error. + # Defaults to false. More info Envoy Docs. + # see: https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/http/ext_authz/v3/ext_authz.proto.html#extensions-filters-http-ext-authz-v3-buffersettings + # This value overrides environment variable if defined. + extauthz-pack-as-byte: "false" + + # Specifies the secret that contains the TLS certificate and key pair when using HTTPS communication with Kourier Ingress. + # This value overrides environment variable if defined. + certs-secret-name: "" + certs-secret-namespace: "" + + # Specifies the OTLP collector endpoint for distributed tracing. + # The endpoint format depends on the protocol (see tracing-protocol). + # Examples: + # - For HTTP: "http://otel-collector.observability.svc:4318/v1/traces" + # - For gRPC: "http://otel-collector.observability.svc:4317" + # Use an empty value to disable distributed tracing (default). + tracing-endpoint: "" + + # Protocol for tracing collector communication. + # Valid values: http/protobuf, grpc + tracing-protocol: "grpc" + + # Tracing sampling rate (0.0 to 1.0) + # Controls the percentage of requests that are traced. + # Example: "1.0" traces 100% of requests. + tracing-sampling-rate: "1.0" + + # Service name for traces + # This identifies the Kourier gateway in your tracing system. + tracing-service-name: "kourier-knative" +--- +# Copyright 2020 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ServiceAccount +metadata: + name: net-kourier + namespace: knative-serving + labels: + networking.knative.dev/ingress-provider: kourier + app.kubernetes.io/component: net-kourier + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: net-kourier + labels: + networking.knative.dev/ingress-provider: kourier + app.kubernetes.io/component: net-kourier + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +rules: + - apiGroups: [""] + resources: ["events"] + verbs: ["create", "update", "patch"] + - apiGroups: [""] + resources: ["pods", "services", "secrets"] + verbs: ["get", "list", "watch"] + - apiGroups: [""] + resources: ["configmaps"] + verbs: ["get", "list", "watch"] + - apiGroups: ["discovery.k8s.io"] + resources: ["endpointslices"] + verbs: ["get", "list", "watch"] + - apiGroups: ["coordination.k8s.io"] + resources: ["leases"] + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] + - apiGroups: ["networking.internal.knative.dev"] + resources: ["ingresses"] + verbs: ["get", "list", "watch", "patch"] + - apiGroups: ["networking.internal.knative.dev"] + resources: ["ingresses/status"] + verbs: ["update"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: net-kourier + labels: + networking.knative.dev/ingress-provider: kourier + app.kubernetes.io/component: net-kourier + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: net-kourier +subjects: + - kind: ServiceAccount + name: net-kourier + namespace: knative-serving +--- +# Copyright 2020 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: net-kourier-controller + namespace: knative-serving + labels: + networking.knative.dev/ingress-provider: kourier + app.kubernetes.io/component: net-kourier + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +spec: + strategy: + type: RollingUpdate + rollingUpdate: + maxUnavailable: 0 + maxSurge: 100% + replicas: 1 + selector: + matchLabels: + app: net-kourier-controller + template: + metadata: + annotations: + prometheus.io/scrape: "true" + prometheus.io/port: "9090" + prometheus.io/path: "/metrics" + labels: + app: net-kourier-controller + spec: + containers: + - image: gcr.io/knative-releases/knative.dev/net-kourier/cmd/kourier@sha256:01abd2070ccf8680885c47990e42c05c09e30bc8595d9246f4dcd37f2220a2a2 + name: controller + env: + # CERTS_SECRET_NAMESPACE and CERTS_SECRET_NAME can also be configured from a ConfigMap. + # Settings configured in a configmap take precedence over environment variable settings. + - name: CERTS_SECRET_NAMESPACE + value: "" + - name: CERTS_SECRET_NAME + value: "" + - name: SYSTEM_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: METRICS_DOMAIN + value: "knative.dev/samples" + - name: KOURIER_GATEWAY_NAMESPACE + value: "kourier-system" + - name: ENABLE_SECRET_INFORMER_FILTERING_BY_CERT_UID + value: "false" + # KUBE_API_BURST and KUBE_API_QPS allows to configure maximum burst for throttle and maximum QPS to the server from the client. + # Setting these values using env vars is possible since https://github.com/knative/pkg/pull/2755. + # 200 is an arbitrary value, but it speeds up kourier startup duration, and the whole ingress reconciliation process as a whole. + - name: KUBE_API_BURST + value: "200" + - name: KUBE_API_QPS + value: "200" + ports: + - name: http2-xds + containerPort: 18000 + protocol: TCP + - name: metrics + containerPort: 9090 + protocol: TCP + readinessProbe: + grpc: + port: 18000 + periodSeconds: 10 + failureThreshold: 3 + livenessProbe: + grpc: + port: 18000 + periodSeconds: 10 + failureThreshold: 6 + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + runAsNonRoot: true + capabilities: + drop: + - ALL + seccompProfile: + type: RuntimeDefault + resources: + requests: + cpu: 200m + memory: 200Mi + limits: + cpu: "1" + memory: 500Mi + restartPolicy: Always + serviceAccountName: net-kourier +--- +apiVersion: v1 +kind: Service +metadata: + name: net-kourier-controller + namespace: knative-serving + labels: + networking.knative.dev/ingress-provider: kourier + app.kubernetes.io/component: net-kourier + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +spec: + ports: + - name: grpc-xds + port: 18000 + protocol: TCP + targetPort: 18000 + - name: http-metrics + port: 9090 + protocol: TCP + targetPort: 9090 + selector: + app: net-kourier-controller + type: ClusterIP +--- +# Copyright 2020 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: 3scale-kourier-gateway + namespace: kourier-system + labels: + networking.knative.dev/ingress-provider: kourier + app.kubernetes.io/component: net-kourier + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +spec: + strategy: + type: RollingUpdate + rollingUpdate: + maxUnavailable: 0 + maxSurge: 100% + selector: + matchLabels: + app: 3scale-kourier-gateway + template: + metadata: + labels: + app: 3scale-kourier-gateway + annotations: + # v0.26 supports envoy v3 API, so + # adding this label to restart pod. + networking.knative.dev/poke: "v0.26" + prometheus.io/scrape: "true" + prometheus.io/port: "9000" + prometheus.io/path: "/stats/prometheus" + spec: + containers: + - args: + - --base-id 1 + - -c /tmp/config/envoy-bootstrap.yaml + - --log-level info + - --drain-time-s $(DRAIN_TIME_SECONDS) + - --drain-strategy immediate + command: + - /usr/local/bin/envoy + env: + - name: DRAIN_TIME_SECONDS + value: "15" + image: docker.io/envoyproxy/envoy:v1.37-latest + name: kourier-gateway + ports: + - name: http2-external + containerPort: 8080 + protocol: TCP + - name: http2-internal + containerPort: 8081 + protocol: TCP + - name: https-external + containerPort: 8443 + protocol: TCP + - name: http-probe + containerPort: 8090 + protocol: TCP + - name: https-probe + containerPort: 9443 + protocol: TCP + - name: metrics + containerPort: 9000 + protocol: TCP + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: false + runAsNonRoot: true + runAsUser: 65534 + runAsGroup: 65534 + capabilities: + drop: + - ALL + seccompProfile: + type: RuntimeDefault + volumeMounts: + - name: config-volume + mountPath: /tmp/config + lifecycle: + preStop: + exec: + command: ["/bin/sh", "-c", "curl -X POST http://localhost:9901/drain_listeners?graceful; sleep $DRAIN_TIME_SECONDS"] + readinessProbe: + httpGet: + httpHeaders: + - name: Host + value: internalkourier + path: /ready + port: 8081 + scheme: HTTP + initialDelaySeconds: 10 + periodSeconds: 5 + failureThreshold: 3 + timeoutSeconds: 3 + livenessProbe: + httpGet: + httpHeaders: + - name: Host + value: internalkourier + path: /ready + port: 8081 + scheme: HTTP + initialDelaySeconds: 10 + periodSeconds: 5 + failureThreshold: 6 + timeoutSeconds: 3 + resources: + requests: + cpu: 200m + memory: 200Mi + limits: + cpu: "1" + memory: 800Mi + # to ensure a graceful drain, terminationGracePeriodSeconds must be greater than DRAIN_TIME_SECONDS environment variable + terminationGracePeriodSeconds: 30 + volumes: + - name: config-volume + configMap: + name: kourier-bootstrap + restartPolicy: Always +--- +apiVersion: v1 +kind: Service +metadata: + name: kourier + namespace: kourier-system + labels: + networking.knative.dev/ingress-provider: kourier + app.kubernetes.io/component: net-kourier + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +spec: + ports: + - name: http2 + port: 80 + protocol: TCP + targetPort: 8080 + - name: https + port: 443 + protocol: TCP + targetPort: 8443 + selector: + app: 3scale-kourier-gateway + type: LoadBalancer +--- +apiVersion: v1 +kind: Service +metadata: + name: kourier-internal + namespace: kourier-system + labels: + networking.knative.dev/ingress-provider: kourier + app.kubernetes.io/component: net-kourier + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +spec: + ports: + - name: http2 + port: 80 + protocol: TCP + targetPort: 8081 + - name: https + port: 443 + protocol: TCP + targetPort: 8444 + selector: + app: 3scale-kourier-gateway + type: ClusterIP +--- +apiVersion: autoscaling/v2 +kind: HorizontalPodAutoscaler +metadata: + name: 3scale-kourier-gateway + namespace: kourier-system + labels: + networking.knative.dev/ingress-provider: kourier + app.kubernetes.io/component: net-kourier + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +spec: + minReplicas: 1 + maxReplicas: 10 + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: 3scale-kourier-gateway + metrics: + - type: Resource + resource: + name: cpu + target: + type: Utilization + # Percentage of the requested CPU + averageUtilization: 100 +--- +apiVersion: policy/v1 +kind: PodDisruptionBudget +metadata: + name: 3scale-kourier-gateway-pdb + namespace: kourier-system + labels: + networking.knative.dev/ingress-provider: kourier + app.kubernetes.io/component: net-kourier + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +spec: + minAvailable: 80% + selector: + matchLabels: + app: 3scale-kourier-gateway diff --git a/packages/manifests/operators/knative-serving/v1.22.1.yaml b/packages/manifests/operators/knative-serving/v1.22.1.yaml new file mode 100644 index 0000000..bbe9e23 --- /dev/null +++ b/packages/manifests/operators/knative-serving/v1.22.1.yaml @@ -0,0 +1,10237 @@ +# Source: https://github.com/knative/serving/releases/download/knative-v1.22.1/serving-crds.yaml +--- +# Copyright 2020 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: certificates.networking.internal.knative.dev + labels: + app.kubernetes.io/name: knative-serving + app.kubernetes.io/component: networking + app.kubernetes.io/version: "1.22.1" + knative.dev/crd-install: "true" +spec: + group: networking.internal.knative.dev + versions: + - name: v1alpha1 + served: true + storage: true + subresources: + status: {} + schema: + openAPIV3Schema: + description: |- + Certificate is responsible for provisioning a SSL certificate for the + given hosts. It is a Knative abstraction for various SSL certificate + provisioning solutions (such as cert-manager or self-signed SSL certificate). + type: object + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: |- + Spec is the desired state of the Certificate. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status + type: object + required: + - dnsNames + - secretName + properties: + dnsNames: + description: |- + DNSNames is a list of DNS names the Certificate could support. + The wildcard format of DNSNames (e.g. *.default.example.com) is supported. + type: array + items: + type: string + domain: + description: Domain is the top level domain of the values for DNSNames. + type: string + secretName: + description: SecretName is the name of the secret resource to store the SSL certificate in. + type: string + status: + description: |- + Status is the current state of the Certificate. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status + type: object + properties: + annotations: + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + additionalProperties: + type: string + conditions: + description: Conditions the latest available observations of a resource's current state. + type: array + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + type: object + required: + - status + - type + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating details about the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, False, Unknown. + type: string + type: + description: Type of condition. + type: string + http01Challenges: + description: |- + HTTP01Challenges is a list of HTTP01 challenges that need to be fulfilled + in order to get the TLS certificate.. + type: array + items: + description: |- + HTTP01Challenge defines the status of a HTTP01 challenge that a certificate needs + to fulfill. + type: object + properties: + serviceName: + description: ServiceName is the name of the service to serve HTTP01 challenge requests. + type: string + serviceNamespace: + description: ServiceNamespace is the namespace of the service to serve HTTP01 challenge requests. + type: string + servicePort: + description: ServicePort is the port of the service to serve HTTP01 challenge requests. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + url: + description: URL is the URL that the HTTP01 challenge is expected to serve on. + type: string + notAfter: + description: |- + The expiration time of the TLS certificate stored in the secret named + by this resource in spec.secretName. + type: string + format: date-time + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + type: integer + format: int64 + additionalPrinterColumns: + - name: Ready + type: string + jsonPath: ".status.conditions[?(@.type==\"Ready\")].status" + - name: Reason + type: string + jsonPath: ".status.conditions[?(@.type==\"Ready\")].reason" + names: + kind: Certificate + plural: certificates + singular: certificate + categories: + - knative-internal + - networking + shortNames: + - kcert + scope: Namespaced +--- +# Copyright 2019 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# Note: The schema part of the spec is auto-generated by hack/update-schemas.sh. + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: configurations.serving.knative.dev + labels: + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" + knative.dev/crd-install: "true" + duck.knative.dev/podspecable: "true" +spec: + group: serving.knative.dev + names: + kind: Configuration + plural: configurations + singular: configuration + categories: + - all + - knative + - serving + shortNames: + - config + - cfg + scope: Namespaced + versions: + - name: v1 + served: true + storage: true + subresources: + status: {} + additionalPrinterColumns: + - name: LatestCreated + type: string + jsonPath: .status.latestCreatedRevisionName + - name: LatestReady + type: string + jsonPath: .status.latestReadyRevisionName + - name: Ready + type: string + jsonPath: ".status.conditions[?(@.type=='Ready')].status" + - name: Reason + type: string + jsonPath: ".status.conditions[?(@.type=='Ready')].reason" + schema: + openAPIV3Schema: + description: |- + Configuration represents the "floating HEAD" of a linear history of Revisions. + Users create new Revisions by updating the Configuration's spec. + The "latest created" revision's name is available under status, as is the + "latest ready" revision's name. + See also: https://github.com/knative/serving/blob/main/docs/spec/overview.md#configuration + type: object + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: ConfigurationSpec holds the desired state of the Configuration (from the client). + type: object + properties: + template: + description: Template holds the latest specification for the Revision to be stamped out. + type: object + properties: + metadata: + type: object + properties: + annotations: + type: object + additionalProperties: + type: string + finalizers: + type: array + items: + type: string + labels: + type: object + additionalProperties: + type: string + name: + type: string + namespace: + type: string + x-kubernetes-preserve-unknown-fields: true + spec: + description: RevisionSpec holds the desired state of the Revision (from the client). + type: object + required: + - containers + properties: + affinity: + description: This is accessible behind a feature flag - kubernetes.podspec-affinity + type: object + x-kubernetes-preserve-unknown-fields: true + automountServiceAccountToken: + description: AutomountServiceAccountToken indicates whether a service account token should be automatically mounted. + type: boolean + containerConcurrency: + description: |- + ContainerConcurrency specifies the maximum allowed in-flight (concurrent) + requests per container of the Revision. Defaults to `0` which means + concurrency to the application is not limited, and the system decides the + target concurrency for the autoscaler. + type: integer + format: int64 + containers: + description: |- + List of containers belonging to the pod. + Containers cannot currently be added or removed. + There must be at least one container in a Pod. + Cannot be updated. + type: array + items: + description: A single application container that you want to run within a pod. + type: object + properties: + args: + description: |- + Arguments to the entrypoint. + The container image's CMD is used if this is not provided. + Variable references $(VAR_NAME) are expanded using the container's environment. If a variable + cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will + produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless + of whether the variable exists or not. Cannot be updated. + More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell + type: array + items: + type: string + x-kubernetes-list-type: atomic + command: + description: |- + Entrypoint array. Not executed within a shell. + The container image's ENTRYPOINT is used if this is not provided. + Variable references $(VAR_NAME) are expanded using the container's environment. If a variable + cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will + produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless + of whether the variable exists or not. Cannot be updated. + More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell + type: array + items: + type: string + x-kubernetes-list-type: atomic + env: + description: |- + List of environment variables to set in the container. + Cannot be updated. + type: array + items: + description: EnvVar represents an environment variable present in a Container. + type: object + required: + - name + properties: + name: + description: |- + Name of the environment variable. + May consist of any printable ASCII characters except '='. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's value. Cannot be used if value is not empty. + type: object + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + type: object + required: + - key + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap or its key must be defined + type: boolean + x-kubernetes-map-type: atomic + fieldRef: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-fieldref + type: object + x-kubernetes-map-type: atomic + x-kubernetes-preserve-unknown-fields: true + resourceFieldRef: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-fieldref + type: object + x-kubernetes-map-type: atomic + x-kubernetes-preserve-unknown-fields: true + secretKeyRef: + description: Selects a key of a secret in the pod's namespace + type: object + required: + - key + properties: + key: + description: The key of the secret to select from. Must be a valid secret key. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret or its key must be defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + envFrom: + description: |- + List of sources to populate environment variables in the container. + The keys defined within a source may consist of any printable ASCII characters except '='. + When a key exists in multiple + sources, the value associated with the last source will take precedence. + Values defined by an Env with a duplicate key will take precedence. + Cannot be updated. + type: array + items: + description: EnvFromSource represents the source of a set of ConfigMaps or Secrets + type: object + properties: + configMapRef: + description: The ConfigMap to select from + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap must be defined + type: boolean + x-kubernetes-map-type: atomic + prefix: + description: |- + Optional text to prepend to the name of each environment variable. + May consist of any printable ASCII characters except '='. + type: string + secretRef: + description: The Secret to select from + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret must be defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + image: + description: |- + Container image name. + More info: https://kubernetes.io/docs/concepts/containers/images + This field is optional to allow higher level config management to default or override + container images in workload controllers like Deployments and StatefulSets. + type: string + imagePullPolicy: + description: |- + Image pull policy. + One of Always, Never, IfNotPresent. + Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/containers/images#updating-images + type: string + livenessProbe: + description: |- + Periodic probe of container liveness. + Container will be restarted if the probe fails. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: object + properties: + exec: + description: Exec specifies a command to execute in the container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + failureThreshold: + description: |- + Minimum consecutive failures for the probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. + type: integer + format: int32 + grpc: + description: GRPC specifies a GRPC HealthCheckRequest. + type: object + properties: + port: + description: Port number of the gRPC service. Number must be in the range 1 to 65535. + type: integer + format: int32 + service: + description: |- + Service is the name of the service to place in the gRPC HealthCheckRequest + (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + + If this is not specified, the default behavior is defined by gRPC. + type: string + default: "" + httpGet: + description: HTTPGet specifies an HTTP GET request to perform. + type: object + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + initialDelaySeconds: + description: |- + Number of seconds after the container has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + periodSeconds: + description: |- + How often (in seconds) to perform the probe. + type: integer + format: int32 + successThreshold: + description: |- + Minimum consecutive successes for the probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. + type: integer + format: int32 + tcpSocket: + description: TCPSocket specifies a connection to a TCP port. + type: object + properties: + host: + description: 'Optional: Host name to connect to, defaults to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + timeoutSeconds: + description: |- + Number of seconds after which the probe times out. + Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + name: + description: |- + Name of the container specified as a DNS_LABEL. + Each container in a pod must have a unique name (DNS_LABEL). + Cannot be updated. + type: string + ports: + description: |- + List of ports to expose from the container. Not specifying a port here + DOES NOT prevent that port from being exposed. Any port which is + listening on the default "0.0.0.0" address inside a container will be + accessible from the network. + Modifying this array with strategic merge patch may corrupt the data. + For more information See https://github.com/kubernetes/kubernetes/issues/108255. + Cannot be updated. + type: array + items: + description: ContainerPort represents a network port in a single container. + type: object + properties: + containerPort: + description: |- + Number of port to expose on the pod's IP address. + This must be a valid port number, 0 < x < 65536. + type: integer + format: int32 + name: + description: |- + If specified, this must be an IANA_SVC_NAME and unique within the pod. Each + named port in a pod must have a unique name. Name for the port that can be + referred to by services. + type: string + protocol: + description: |- + Protocol for port. Must be UDP, TCP, or SCTP. + Defaults to "TCP". + type: string + default: TCP + readinessProbe: + description: |- + Periodic probe of container service readiness. + Container will be removed from service endpoints if the probe fails. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: object + properties: + exec: + description: Exec specifies a command to execute in the container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + failureThreshold: + description: |- + Minimum consecutive failures for the probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. + type: integer + format: int32 + grpc: + description: GRPC specifies a GRPC HealthCheckRequest. + type: object + properties: + port: + description: Port number of the gRPC service. Number must be in the range 1 to 65535. + type: integer + format: int32 + service: + description: |- + Service is the name of the service to place in the gRPC HealthCheckRequest + (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + + If this is not specified, the default behavior is defined by gRPC. + type: string + default: "" + httpGet: + description: HTTPGet specifies an HTTP GET request to perform. + type: object + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + initialDelaySeconds: + description: |- + Number of seconds after the container has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + periodSeconds: + description: |- + How often (in seconds) to perform the probe. + type: integer + format: int32 + successThreshold: + description: |- + Minimum consecutive successes for the probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. + type: integer + format: int32 + tcpSocket: + description: TCPSocket specifies a connection to a TCP port. + type: object + properties: + host: + description: 'Optional: Host name to connect to, defaults to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + timeoutSeconds: + description: |- + Number of seconds after which the probe times out. + Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + resources: + description: |- + Compute Resources required by this container. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + properties: + limits: + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + requests: + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + securityContext: + description: |- + SecurityContext defines the security options the container should be run with. + If set, the fields of SecurityContext override the equivalent fields of PodSecurityContext. + More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ + type: object + properties: + allowPrivilegeEscalation: + description: |- + AllowPrivilegeEscalation controls whether a process can gain more + privileges than its parent process. This bool directly controls if + the no_new_privs flag will be set on the container process. + AllowPrivilegeEscalation is true always when the container is: + 1) run as Privileged + 2) has CAP_SYS_ADMIN + Note that this field cannot be set when spec.os.name is windows. + type: boolean + capabilities: + description: |- + The capabilities to add/drop when running containers. + Defaults to the default set of capabilities granted by the container runtime. + Note that this field cannot be set when spec.os.name is windows. + type: object + properties: + add: + description: This is accessible behind a feature flag - kubernetes.containerspec-addcapabilities + type: array + items: + description: Capability represent POSIX capabilities type + type: string + x-kubernetes-list-type: atomic + drop: + description: Removed capabilities + type: array + items: + description: Capability represent POSIX capabilities type + type: string + x-kubernetes-list-type: atomic + privileged: + description: |- + Run container in privileged mode. This can only be set to explicitly to 'false' + type: boolean + readOnlyRootFilesystem: + description: |- + Whether this container has a read-only root filesystem. + Default is false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + runAsGroup: + description: |- + The GID to run the entrypoint of the container process. + Uses runtime default if unset. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + runAsNonRoot: + description: |- + Indicates that the container must run as a non-root user. + If true, the Kubelet will validate the image at runtime to ensure that it + does not run as UID 0 (root) and fail to start the container if it does. + If unset or false, no such validation will be performed. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: boolean + runAsUser: + description: |- + The UID to run the entrypoint of the container process. + Defaults to user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + seccompProfile: + description: |- + The seccomp options to use by this container. If seccomp options are + provided at both the pod & container level, the container options + override the pod options. + Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile defined in a file on the node should be used. + The profile must be preconfigured on the node to work. + Must be a descending path, relative to the kubelet's configured seccomp profile location. + Must be set if type is "Localhost". Must NOT be set for any other type. + type: string + type: + description: |- + type indicates which kind of seccomp profile will be applied. + Valid options are: + + Localhost - a profile defined in a file on the node should be used. + RuntimeDefault - the container runtime default profile should be used. + Unconfined - no profile should be applied. + type: string + startupProbe: + description: |- + StartupProbe indicates that the Pod has successfully initialized. + If specified, no other probes are executed until this completes successfully. + If this probe fails, the Pod will be restarted, just as if the livenessProbe failed. + This can be used to provide different probe parameters at the beginning of a Pod's lifecycle, + when it might take a long time to load data or warm a cache, than during steady-state operation. + This cannot be updated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: object + properties: + exec: + description: Exec specifies a command to execute in the container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + failureThreshold: + description: |- + Minimum consecutive failures for the probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. + type: integer + format: int32 + grpc: + description: GRPC specifies a GRPC HealthCheckRequest. + type: object + properties: + port: + description: Port number of the gRPC service. Number must be in the range 1 to 65535. + type: integer + format: int32 + service: + description: |- + Service is the name of the service to place in the gRPC HealthCheckRequest + (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + + If this is not specified, the default behavior is defined by gRPC. + type: string + default: "" + httpGet: + description: HTTPGet specifies an HTTP GET request to perform. + type: object + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + initialDelaySeconds: + description: |- + Number of seconds after the container has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + periodSeconds: + description: |- + How often (in seconds) to perform the probe. + type: integer + format: int32 + successThreshold: + description: |- + Minimum consecutive successes for the probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. + type: integer + format: int32 + tcpSocket: + description: TCPSocket specifies a connection to a TCP port. + type: object + properties: + host: + description: 'Optional: Host name to connect to, defaults to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + timeoutSeconds: + description: |- + Number of seconds after which the probe times out. + Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + terminationMessagePath: + description: |- + Optional: Path at which the file to which the container's termination message + will be written is mounted into the container's filesystem. + Message written is intended to be brief final status, such as an assertion failure message. + Will be truncated by the node if greater than 4096 bytes. The total message length across + all containers will be limited to 12kb. + Defaults to /dev/termination-log. + Cannot be updated. + type: string + terminationMessagePolicy: + description: |- + Indicate how the termination message should be populated. File will use the contents of + terminationMessagePath to populate the container status message on both success and failure. + FallbackToLogsOnError will use the last chunk of container log output if the termination + message file is empty and the container exited with an error. + The log output is limited to 2048 bytes or 80 lines, whichever is smaller. + Defaults to File. + Cannot be updated. + type: string + volumeMounts: + description: |- + Pod volumes to mount into the container's filesystem. + Cannot be updated. + type: array + items: + description: VolumeMount describes a mounting of a Volume within a container. + type: object + required: + - mountPath + - name + properties: + mountPath: + description: |- + Path within the container at which the volume should be mounted. Must + not contain ':'. + type: string + mountPropagation: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-volumes-mount-propagation + type: string + name: + description: This must match the Name of a Volume. + type: string + readOnly: + description: |- + Mounted read-only if true, read-write otherwise (false or unspecified). + Defaults to false. + type: boolean + subPath: + description: |- + Path within the volume from which the container's volume should be mounted. + Defaults to "" (volume's root). + type: string + x-kubernetes-list-map-keys: + - mountPath + x-kubernetes-list-type: map + workingDir: + description: |- + Container's working directory. + If not specified, the container runtime's default will be used, which + might be configured in the container image. + Cannot be updated. + type: string + dnsConfig: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-dnsconfig + type: object + x-kubernetes-preserve-unknown-fields: true + dnsPolicy: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-dnspolicy + type: string + enableServiceLinks: + description: |- + EnableServiceLinks indicates whether information aboutservices should be injected into pod's environment variables, matching the syntax of Docker links. Optional: Knative defaults this to false. + type: boolean + hostAliases: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-hostaliases + type: array + items: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-hostaliases + type: object + x-kubernetes-preserve-unknown-fields: true + hostIPC: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-hostipc + type: boolean + hostNetwork: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-hostnetwork + type: boolean + hostPID: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-hostpid + type: boolean + idleTimeoutSeconds: + description: |- + IdleTimeoutSeconds is the maximum duration in seconds a request will be allowed + to stay open while not receiving any bytes from the user's application. If + unspecified, a system default will be provided. + type: integer + format: int64 + imagePullSecrets: + description: |- + ImagePullSecrets is an optional list of references to secrets in the same namespace to use for pulling any of the images used by this PodSpec. + If specified, these secrets will be passed to individual puller implementations for them to use. + More info: https://kubernetes.io/docs/concepts/containers/images#specifying-imagepullsecrets-on-a-pod + type: array + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + x-kubernetes-map-type: atomic + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + initContainers: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-init-containers + type: array + items: + description: This is accessible behind a feature flag - kubernetes.podspec-init-containers + type: object + x-kubernetes-preserve-unknown-fields: true + nodeSelector: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-nodeselector + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + priorityClassName: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-priorityclassname + type: string + responseStartTimeoutSeconds: + description: |- + ResponseStartTimeoutSeconds is the maximum duration in seconds that the request + routing layer will wait for a request delivered to a container to begin + sending any network traffic. + type: integer + format: int64 + runtimeClassName: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-runtimeclassname + type: string + schedulerName: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-schedulername + type: string + securityContext: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-securitycontext + type: object + x-kubernetes-preserve-unknown-fields: true + serviceAccountName: + description: |- + ServiceAccountName is the name of the ServiceAccount to use to run this pod. + More info: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/ + type: string + shareProcessNamespace: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-shareprocessnamespace + type: boolean + timeoutSeconds: + description: |- + TimeoutSeconds is the maximum duration in seconds that the request instance + is allowed to respond to a request. If unspecified, a system default will + be provided. + type: integer + format: int64 + tolerations: + description: This is accessible behind a feature flag - kubernetes.podspec-tolerations + type: array + items: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-tolerations + type: object + x-kubernetes-preserve-unknown-fields: true + topologySpreadConstraints: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints + type: array + items: + description: This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints + type: object + x-kubernetes-preserve-unknown-fields: true + volumes: + description: |- + List of volumes that can be mounted by containers belonging to the pod. + More info: https://kubernetes.io/docs/concepts/storage/volumes + type: array + items: + description: Volume represents a named volume in a pod that may be accessed by any container in the pod. + type: object + required: + - name + properties: + configMap: + description: configMap represents a configMap that should populate this volume + type: object + properties: + defaultMode: + description: |- + defaultMode is optional: mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + Defaults to 0644. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + ConfigMap will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the ConfigMap, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: optional specify whether the ConfigMap or its keys must be defined + type: boolean + x-kubernetes-map-type: atomic + csi: + description: This is accessible behind a feature flag - kubernetes.podspec-volumes-csi + type: object + x-kubernetes-preserve-unknown-fields: true + emptyDir: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-volumes-emptydir + type: object + x-kubernetes-preserve-unknown-fields: true + hostPath: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-volumes-hostpath + type: object + x-kubernetes-preserve-unknown-fields: true + image: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-volumes-image + type: object + x-kubernetes-preserve-unknown-fields: true + name: + description: |- + name of the volume. + Must be a DNS_LABEL and unique within the pod. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + persistentVolumeClaim: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-persistent-volume-claim + type: object + x-kubernetes-preserve-unknown-fields: true + projected: + description: projected items for all in one resources secrets, configmaps, and downward API + type: object + properties: + defaultMode: + description: |- + defaultMode are the mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + sources: + description: |- + sources is the list of volume projections. Each entry in this list + handles one source. + type: array + items: + description: |- + Projection that may be projected along with other supported volume types. + Exactly one of these fields must be set. + type: object + properties: + configMap: + description: configMap information about the configMap data to project + type: object + properties: + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + ConfigMap will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the ConfigMap, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: optional specify whether the ConfigMap or its keys must be defined + type: boolean + x-kubernetes-map-type: atomic + downwardAPI: + description: downwardAPI information about the downwardAPI data to project + type: object + properties: + items: + description: Items is a list of DownwardAPIVolume file + type: array + items: + description: DownwardAPIVolumeFile represents information to create the file containing the pod field + type: object + required: + - path + properties: + fieldRef: + description: 'Required: Selects a field of the pod: only annotations, labels, name, namespace and uid are supported.' + type: object + required: + - fieldPath + properties: + apiVersion: + description: Version of the schema the FieldPath is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in the specified API version. + type: string + x-kubernetes-map-type: atomic + mode: + description: |- + Optional: mode bits used to set permissions on this file, must be an octal value + between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: 'Required: Path is the relative path name of the file to be created. Must not be absolute or contain the ''..'' path. Must be utf-8 encoded. The first item of the relative path must not start with ''..''' + type: string + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported. + type: object + required: + - resource + properties: + containerName: + description: 'Container name: required for volumes, optional for env vars' + type: string + divisor: + description: Specifies the output format of the exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + secret: + description: secret information about the secret data to project + type: object + properties: + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + Secret will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the Secret, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: optional field specify whether the Secret or its key must be defined + type: boolean + x-kubernetes-map-type: atomic + serviceAccountToken: + description: serviceAccountToken is information about the serviceAccountToken data to project + type: object + required: + - path + properties: + audience: + description: |- + audience is the intended audience of the token. A recipient of a token + must identify itself with an identifier specified in the audience of the + token, and otherwise should reject the token. The audience defaults to the + identifier of the apiserver. + type: string + expirationSeconds: + description: |- + expirationSeconds is the requested duration of validity of the service + account token. As the token approaches expiration, the kubelet volume + plugin will proactively rotate the service account token. The kubelet will + start trying to rotate the token if the token is older than 80 percent of + its time to live or if the token is older than 24 hours.Defaults to 1 hour + and must be at least 10 minutes. + type: integer + format: int64 + path: + description: |- + path is the path relative to the mount point of the file to project the + token into. + type: string + x-kubernetes-list-type: atomic + secret: + description: |- + secret represents a secret that should populate this volume. + More info: https://kubernetes.io/docs/concepts/storage/volumes#secret + type: object + properties: + defaultMode: + description: |- + defaultMode is Optional: mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values + for mode bits. Defaults to 0644. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + items: + description: |- + items If unspecified, each key-value pair in the Data field of the referenced + Secret will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the Secret, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + optional: + description: optional field specify whether the Secret or its keys must be defined + type: boolean + secretName: + description: |- + secretName is the name of the secret in the pod's namespace to use. + More info: https://kubernetes.io/docs/concepts/storage/volumes#secret + type: string + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + status: + description: ConfigurationStatus communicates the observed state of the Configuration (from the controller). + type: object + properties: + annotations: + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + additionalProperties: + type: string + conditions: + description: Conditions the latest available observations of a resource's current state. + type: array + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + type: object + required: + - status + - type + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating details about the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, False, Unknown. + type: string + type: + description: Type of condition. + type: string + latestCreatedRevisionName: + description: |- + LatestCreatedRevisionName is the last revision that was created from this + Configuration. It might not be ready yet, for that use LatestReadyRevisionName. + type: string + latestReadyRevisionName: + description: |- + LatestReadyRevisionName holds the name of the latest Revision stamped out + from this Configuration that has had its "Ready" condition become "True". + type: string + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + type: integer + format: int64 +--- +# Copyright 2020 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: clusterdomainclaims.networking.internal.knative.dev + labels: + app.kubernetes.io/name: knative-serving + app.kubernetes.io/component: networking + app.kubernetes.io/version: "1.22.1" + knative.dev/crd-install: "true" +spec: + group: networking.internal.knative.dev + versions: + - name: v1alpha1 + served: true + storage: true + subresources: + status: {} + schema: + openAPIV3Schema: + description: ClusterDomainClaim is a cluster-wide reservation for a particular domain name. + type: object + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: |- + Spec is the desired state of the ClusterDomainClaim. + More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status + type: object + required: + - namespace + properties: + namespace: + description: |- + Namespace is the namespace which is allowed to create a DomainMapping + using this ClusterDomainClaim's name. + type: string + names: + kind: ClusterDomainClaim + plural: clusterdomainclaims + singular: clusterdomainclaim + categories: + - knative-internal + - networking + shortNames: + - cdc + scope: Cluster +--- +# Copyright 2020 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: domainmappings.serving.knative.dev + labels: + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" + knative.dev/crd-install: "true" +spec: + group: serving.knative.dev + versions: + - name: v1beta1 + served: true + storage: true + subresources: + status: {} + additionalPrinterColumns: + - name: URL + type: string + jsonPath: .status.url + - name: Ready + type: string + jsonPath: ".status.conditions[?(@.type=='Ready')].status" + - name: Reason + type: string + jsonPath: ".status.conditions[?(@.type=='Ready')].reason" + "schema": + "openAPIV3Schema": + description: DomainMapping is a mapping from a custom hostname to an Addressable. + type: object + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: |- + Spec is the desired state of the DomainMapping. + More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status + type: object + required: + - ref + properties: + ref: + description: |- + Ref specifies the target of the Domain Mapping. + + The object identified by the Ref must be an Addressable with a URL of the + form `{name}.{namespace}.{domain}` where `{domain}` is the cluster domain, + and `{name}` and `{namespace}` are the name and namespace of a Kubernetes + Service. + + This contract is satisfied by Knative types such as Knative Services and + Knative Routes, and by Kubernetes Services. + type: object + required: + - kind + - name + properties: + address: + description: Address points to a specific Address Name. + type: string + apiVersion: + description: API version of the referent. + type: string + group: + description: |- + Group of the API, without the version of the group. This can be used as an alternative to the APIVersion, and then resolved using ResolveGroup. + Note: This API is EXPERIMENTAL and might break anytime. For more details: https://github.com/knative/eventing/issues/5086 + type: string + kind: + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + namespace: + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ + This is optional field, it gets defaulted to the object holding it if left out. + type: string + tls: + description: TLS allows the DomainMapping to terminate TLS traffic with an existing secret. + type: object + required: + - secretName + properties: + secretName: + description: SecretName is the name of the existing secret used to terminate TLS traffic. + type: string + status: + description: |- + Status is the current state of the DomainMapping. + More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status + type: object + properties: + address: + description: Address holds the information needed for a DomainMapping to be the target of an event. + type: object + properties: + CACerts: + description: |- + CACerts is the Certification Authority (CA) certificates in PEM format + according to https://www.rfc-editor.org/rfc/rfc7468. + type: string + audience: + description: Audience is the OIDC audience for this address. + type: string + name: + description: Name is the name of the address. + type: string + url: + type: string + annotations: + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + additionalProperties: + type: string + conditions: + description: Conditions the latest available observations of a resource's current state. + type: array + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + type: object + required: + - status + - type + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating details about the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, False, Unknown. + type: string + type: + description: Type of condition. + type: string + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + type: integer + format: int64 + url: + description: URL is the URL of this DomainMapping. + type: string + names: + kind: DomainMapping + plural: domainmappings + singular: domainmapping + categories: + - all + - knative + - serving + shortNames: + - dm + scope: Namespaced +--- +# Copyright 2020 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: ingresses.networking.internal.knative.dev + labels: + app.kubernetes.io/name: knative-serving + app.kubernetes.io/component: networking + app.kubernetes.io/version: "1.22.1" + knative.dev/crd-install: "true" +spec: + group: networking.internal.knative.dev + versions: + - name: v1alpha1 + served: true + storage: true + subresources: + status: {} + schema: + openAPIV3Schema: + description: |- + Ingress is a collection of rules that allow inbound connections to reach the endpoints defined + by a backend. An Ingress can be configured to give services externally-reachable URLs, load + balance traffic, offer name based virtual hosting, etc. + + This is heavily based on K8s Ingress https://godoc.org/k8s.io/api/networking/v1beta1#Ingress + which some highlighted modifications. + type: object + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: |- + Spec is the desired state of the Ingress. + More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status + type: object + properties: + httpOption: + description: |- + HTTPOption is the option of HTTP. It has the following two values: + `HTTPOptionEnabled`, `HTTPOptionRedirected` + type: string + rules: + description: A list of host rules used to configure the Ingress. + type: array + items: + description: |- + IngressRule represents the rules mapping the paths under a specified host to + the related backend services. Incoming requests are first evaluated for a host + match, then routed to the backend associated with the matching IngressRuleValue. + type: object + properties: + hosts: + description: |- + Host is the fully qualified domain name of a network host, as defined + by RFC 3986. Note the following deviations from the "host" part of the + URI as defined in the RFC: + 1. IPs are not allowed. Currently a rule value can only apply to the + IP in the Spec of the parent . + 2. The `:` delimiter is not respected because ports are not allowed. + Currently the port of an Ingress is implicitly :80 for http and + :443 for https. + Both these may change in the future. + If the host is unspecified, the Ingress routes all traffic based on the + specified IngressRuleValue. + If multiple matching Hosts were provided, the first rule will take precedent. + type: array + items: + type: string + http: + description: |- + HTTP represents a rule to apply against incoming requests. If the + rule is satisfied, the request is routed to the specified backend. + type: object + required: + - paths + properties: + paths: + description: |- + A collection of paths that map requests to backends. + + If they are multiple matching paths, the first match takes precedence. + type: array + items: + description: |- + HTTPIngressPath associates a path regex with a backend. Incoming URLs matching + the path are forwarded to the backend. + type: object + required: + - splits + properties: + appendHeaders: + description: |- + AppendHeaders allow specifying additional HTTP headers to add + before forwarding a request to the destination service. + + NOTE: This differs from K8s Ingress which doesn't allow header appending. + type: object + additionalProperties: + type: string + headers: + description: |- + Headers defines header matching rules which is a map from a header name + to HeaderMatch which specify a matching condition. + When a request matched with all the header matching rules, + the request is routed by the corresponding ingress rule. + If it is empty, the headers are not used for matching + type: object + additionalProperties: + description: |- + HeaderMatch represents a matching value of Headers in HTTPIngressPath. + Currently, only the exact matching is supported. + type: object + required: + - exact + properties: + exact: + type: string + path: + description: |- + Path represents a literal prefix to which this rule should apply. + Currently it can contain characters disallowed from the conventional + "path" part of a URL as defined by RFC 3986. Paths must begin with + a '/'. If unspecified, the path defaults to a catch all sending + traffic to the backend. + type: string + rewriteHost: + description: |- + RewriteHost rewrites the incoming request's host header. + + This field is currently experimental and not supported by all Ingress + implementations. + type: string + splits: + description: |- + Splits defines the referenced service endpoints to which the traffic + will be forwarded to. + type: array + items: + description: IngressBackendSplit describes all endpoints for a given service and port. + type: object + required: + - serviceName + - serviceNamespace + - servicePort + properties: + appendHeaders: + description: |- + AppendHeaders allow specifying additional HTTP headers to add + before forwarding a request to the destination service. + + NOTE: This differs from K8s Ingress which doesn't allow header appending. + type: object + additionalProperties: + type: string + percent: + description: |- + Specifies the split percentage, a number between 0 and 100. If + only one split is specified, we default to 100. + + NOTE: This differs from K8s Ingress to allow percentage split. + type: integer + serviceName: + description: Specifies the name of the referenced service. + type: string + serviceNamespace: + description: |- + Specifies the namespace of the referenced service. + + NOTE: This differs from K8s Ingress to allow routing to different namespaces. + type: string + servicePort: + description: Specifies the port of the referenced service. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + visibility: + description: |- + Visibility signifies whether this rule should `ClusterLocal`. If it's not + specified then it defaults to `ExternalIP`. + type: string + tls: + description: |- + TLS configuration. Currently Ingress only supports a single TLS + port: 443. If multiple members of this list specify different hosts, they + will be multiplexed on the same port according to the hostname specified + through the SNI TLS extension, if the ingress controller fulfilling the + ingress supports SNI. + type: array + items: + description: IngressTLS describes the transport layer security associated with an Ingress. + type: object + properties: + hosts: + description: |- + Hosts is a list of hosts included in the TLS certificate. The values in + this list must match the name/s used in the tlsSecret. Defaults to the + wildcard host setting for the loadbalancer controller fulfilling this + Ingress, if left unspecified. + type: array + items: + type: string + secretName: + description: SecretName is the name of the secret used to terminate SSL traffic. + type: string + secretNamespace: + description: |- + SecretNamespace is the namespace of the secret used to terminate SSL traffic. + If not set the namespace should be assumed to be the same as the Ingress. + If set the secret should have the same namespace as the Ingress otherwise + the behaviour is undefined and not supported. + type: string + status: + description: |- + Status is the current state of the Ingress. + More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status + type: object + properties: + annotations: + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + additionalProperties: + type: string + conditions: + description: Conditions the latest available observations of a resource's current state. + type: array + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + type: object + required: + - status + - type + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating details about the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, False, Unknown. + type: string + type: + description: Type of condition. + type: string + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + type: integer + format: int64 + privateLoadBalancer: + description: PrivateLoadBalancer contains the current status of the load-balancer. + type: object + properties: + ingress: + description: |- + Ingress is a list containing ingress points for the load-balancer. + Traffic intended for the service should be sent to these ingress points. + type: array + items: + description: |- + LoadBalancerIngressStatus represents the status of a load-balancer ingress point: + traffic intended for the service should be sent to an ingress point. + type: object + properties: + domain: + description: |- + Domain is set for load-balancer ingress points that are DNS based + (typically AWS load-balancers) + type: string + domainInternal: + description: |- + DomainInternal is set if there is a cluster-local DNS name to access the Ingress. + + NOTE: This differs from K8s Ingress, since we also desire to have a cluster-local + DNS name to allow routing in case of not having a mesh. + type: string + ip: + description: |- + IP is set for load-balancer ingress points that are IP based + (typically GCE or OpenStack load-balancers) + type: string + meshOnly: + description: MeshOnly is set if the Ingress is only load-balanced through a Service mesh. + type: boolean + publicLoadBalancer: + description: PublicLoadBalancer contains the current status of the load-balancer. + type: object + properties: + ingress: + description: |- + Ingress is a list containing ingress points for the load-balancer. + Traffic intended for the service should be sent to these ingress points. + type: array + items: + description: |- + LoadBalancerIngressStatus represents the status of a load-balancer ingress point: + traffic intended for the service should be sent to an ingress point. + type: object + properties: + domain: + description: |- + Domain is set for load-balancer ingress points that are DNS based + (typically AWS load-balancers) + type: string + domainInternal: + description: |- + DomainInternal is set if there is a cluster-local DNS name to access the Ingress. + + NOTE: This differs from K8s Ingress, since we also desire to have a cluster-local + DNS name to allow routing in case of not having a mesh. + type: string + ip: + description: |- + IP is set for load-balancer ingress points that are IP based + (typically GCE or OpenStack load-balancers) + type: string + meshOnly: + description: MeshOnly is set if the Ingress is only load-balanced through a Service mesh. + type: boolean + additionalPrinterColumns: + - name: Ready + type: string + jsonPath: ".status.conditions[?(@.type=='Ready')].status" + - name: Reason + type: string + jsonPath: ".status.conditions[?(@.type=='Ready')].reason" + names: + kind: Ingress + plural: ingresses + singular: ingress + categories: + - knative-internal + - networking + shortNames: + - kingress + - king + scope: Namespaced +--- +# Copyright 2019 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# Note: The schema part of the spec is auto-generated by hack/update-schemas.sh. + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: metrics.autoscaling.internal.knative.dev + labels: + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" + knative.dev/crd-install: "true" +spec: + group: autoscaling.internal.knative.dev + names: + kind: Metric + plural: metrics + singular: metric + categories: + - knative-internal + - autoscaling + scope: Namespaced + versions: + - name: v1alpha1 + served: true + storage: true + subresources: + status: {} + additionalPrinterColumns: + - name: Ready + type: string + jsonPath: ".status.conditions[?(@.type=='Ready')].status" + - name: Reason + type: string + jsonPath: ".status.conditions[?(@.type=='Ready')].reason" + schema: + openAPIV3Schema: + description: Metric represents a resource to configure the metric collector with. + type: object + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: Spec holds the desired state of the Metric (from the client). + type: object + required: + - panicWindow + - scrapeTarget + - stableWindow + properties: + panicWindow: + description: PanicWindow is the aggregation window for metrics where quick reactions are needed. + type: integer + format: int64 + scrapeTarget: + description: ScrapeTarget is the K8s service that publishes the metric endpoint. + type: string + stableWindow: + description: StableWindow is the aggregation window for metrics in a stable state. + type: integer + format: int64 + status: + description: Status communicates the observed state of the Metric (from the controller). + type: object + properties: + annotations: + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + additionalProperties: + type: string + conditions: + description: Conditions the latest available observations of a resource's current state. + type: array + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + type: object + required: + - status + - type + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating details about the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, False, Unknown. + type: string + type: + description: Type of condition. + type: string + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + type: integer + format: int64 +--- +# Copyright 2018 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# Note: The schema part of the spec is auto-generated by hack/update-schemas.sh. + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: podautoscalers.autoscaling.internal.knative.dev + labels: + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" + knative.dev/crd-install: "true" +spec: + group: autoscaling.internal.knative.dev + names: + kind: PodAutoscaler + plural: podautoscalers + singular: podautoscaler + categories: + - knative-internal + - autoscaling + shortNames: + - kpa + - pa + scope: Namespaced + versions: + - name: v1alpha1 + served: true + storage: true + subresources: + status: {} + additionalPrinterColumns: + - name: DesiredScale + type: integer + jsonPath: ".status.desiredScale" + - name: ActualScale + type: integer + jsonPath: ".status.actualScale" + - name: Ready + type: string + jsonPath: ".status.conditions[?(@.type=='Ready')].status" + - name: Reason + type: string + jsonPath: ".status.conditions[?(@.type=='Ready')].reason" + schema: + openAPIV3Schema: + description: |- + PodAutoscaler is a Knative abstraction that encapsulates the interface by which Knative + components instantiate autoscalers. This definition is an abstraction that may be backed + by multiple definitions. For more information, see the Knative Pluggability presentation: + https://docs.google.com/presentation/d/19vW9HFZ6Puxt31biNZF3uLRejDmu82rxJIk1cWmxF7w/edit + type: object + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: Spec holds the desired state of the PodAutoscaler (from the client). + type: object + required: + - protocolType + - scaleTargetRef + properties: + containerConcurrency: + description: |- + ContainerConcurrency specifies the maximum allowed + in-flight (concurrent) requests per container of the Revision. + Defaults to `0` which means unlimited concurrency. + type: integer + format: int64 + protocolType: + description: The application-layer protocol. Matches `ProtocolType` inferred from the revision spec. + type: string + reachability: + description: |- + Reachability specifies whether or not the `ScaleTargetRef` can be reached (ie. has a route). + Defaults to `ReachabilityUnknown` + type: string + scaleTargetRef: + description: |- + ScaleTargetRef defines the /scale-able resource that this PodAutoscaler + is responsible for quickly right-sizing. + type: object + properties: + apiVersion: + description: API version of the referent. + type: string + kind: + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + x-kubernetes-map-type: atomic + status: + description: Status communicates the observed state of the PodAutoscaler (from the controller). + type: object + required: + - metricsServiceName + - serviceName + properties: + actualScale: + description: ActualScale shows the actual number of replicas for the revision. + type: integer + format: int32 + annotations: + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + additionalProperties: + type: string + conditions: + description: Conditions the latest available observations of a resource's current state. + type: array + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + type: object + required: + - status + - type + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating details about the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, False, Unknown. + type: string + type: + description: Type of condition. + type: string + desiredScale: + description: DesiredScale shows the current desired number of replicas for the revision. + type: integer + format: int32 + metricsServiceName: + description: |- + MetricsServiceName is the K8s Service name that provides revision metrics. + The service is managed by the PA object. + type: string + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + type: integer + format: int64 + serviceName: + description: |- + ServiceName is the K8s Service name that serves the revision, scaled by this PA. + The service is created and owned by the ServerlessService object owned by this PA. + type: string +--- +# Copyright 2019 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# Note: The schema part of the spec is auto-generated by hack/update-schemas.sh. + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: revisions.serving.knative.dev + labels: + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" + knative.dev/crd-install: "true" +spec: + group: serving.knative.dev + names: + kind: Revision + plural: revisions + singular: revision + categories: + - all + - knative + - serving + shortNames: + - rev + scope: Namespaced + versions: + - name: v1 + served: true + storage: true + subresources: + status: {} + additionalPrinterColumns: + - name: Config Name + type: string + jsonPath: ".metadata.labels['serving\\.knative\\.dev/configuration']" + - name: Generation + type: string # int in string form :( + jsonPath: ".metadata.labels['serving\\.knative\\.dev/configurationGeneration']" + - name: Ready + type: string + jsonPath: ".status.conditions[?(@.type=='Ready')].status" + - name: Reason + type: string + jsonPath: ".status.conditions[?(@.type=='Ready')].reason" + - name: Actual Replicas + type: integer + jsonPath: ".status.actualReplicas" + - name: Desired Replicas + type: integer + jsonPath: ".status.desiredReplicas" + schema: + openAPIV3Schema: + description: |- + Revision is an immutable snapshot of code and configuration. A revision + references a container image. Revisions are created by updates to a + Configuration. + + See also: https://github.com/knative/serving/blob/main/docs/spec/overview.md#revision + type: object + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: RevisionSpec holds the desired state of the Revision (from the client). + type: object + required: + - containers + properties: + affinity: + description: This is accessible behind a feature flag - kubernetes.podspec-affinity + type: object + x-kubernetes-preserve-unknown-fields: true + automountServiceAccountToken: + description: AutomountServiceAccountToken indicates whether a service account token should be automatically mounted. + type: boolean + containerConcurrency: + description: |- + ContainerConcurrency specifies the maximum allowed in-flight (concurrent) + requests per container of the Revision. Defaults to `0` which means + concurrency to the application is not limited, and the system decides the + target concurrency for the autoscaler. + type: integer + format: int64 + containers: + description: |- + List of containers belonging to the pod. + Containers cannot currently be added or removed. + There must be at least one container in a Pod. + Cannot be updated. + type: array + items: + description: A single application container that you want to run within a pod. + type: object + properties: + args: + description: |- + Arguments to the entrypoint. + The container image's CMD is used if this is not provided. + Variable references $(VAR_NAME) are expanded using the container's environment. If a variable + cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will + produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless + of whether the variable exists or not. Cannot be updated. + More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell + type: array + items: + type: string + x-kubernetes-list-type: atomic + command: + description: |- + Entrypoint array. Not executed within a shell. + The container image's ENTRYPOINT is used if this is not provided. + Variable references $(VAR_NAME) are expanded using the container's environment. If a variable + cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will + produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless + of whether the variable exists or not. Cannot be updated. + More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell + type: array + items: + type: string + x-kubernetes-list-type: atomic + env: + description: |- + List of environment variables to set in the container. + Cannot be updated. + type: array + items: + description: EnvVar represents an environment variable present in a Container. + type: object + required: + - name + properties: + name: + description: |- + Name of the environment variable. + May consist of any printable ASCII characters except '='. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's value. Cannot be used if value is not empty. + type: object + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + type: object + required: + - key + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap or its key must be defined + type: boolean + x-kubernetes-map-type: atomic + fieldRef: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-fieldref + type: object + x-kubernetes-map-type: atomic + x-kubernetes-preserve-unknown-fields: true + resourceFieldRef: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-fieldref + type: object + x-kubernetes-map-type: atomic + x-kubernetes-preserve-unknown-fields: true + secretKeyRef: + description: Selects a key of a secret in the pod's namespace + type: object + required: + - key + properties: + key: + description: The key of the secret to select from. Must be a valid secret key. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret or its key must be defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + envFrom: + description: |- + List of sources to populate environment variables in the container. + The keys defined within a source may consist of any printable ASCII characters except '='. + When a key exists in multiple + sources, the value associated with the last source will take precedence. + Values defined by an Env with a duplicate key will take precedence. + Cannot be updated. + type: array + items: + description: EnvFromSource represents the source of a set of ConfigMaps or Secrets + type: object + properties: + configMapRef: + description: The ConfigMap to select from + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap must be defined + type: boolean + x-kubernetes-map-type: atomic + prefix: + description: |- + Optional text to prepend to the name of each environment variable. + May consist of any printable ASCII characters except '='. + type: string + secretRef: + description: The Secret to select from + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret must be defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + image: + description: |- + Container image name. + More info: https://kubernetes.io/docs/concepts/containers/images + This field is optional to allow higher level config management to default or override + container images in workload controllers like Deployments and StatefulSets. + type: string + imagePullPolicy: + description: |- + Image pull policy. + One of Always, Never, IfNotPresent. + Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/containers/images#updating-images + type: string + livenessProbe: + description: |- + Periodic probe of container liveness. + Container will be restarted if the probe fails. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: object + properties: + exec: + description: Exec specifies a command to execute in the container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + failureThreshold: + description: |- + Minimum consecutive failures for the probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. + type: integer + format: int32 + grpc: + description: GRPC specifies a GRPC HealthCheckRequest. + type: object + properties: + port: + description: Port number of the gRPC service. Number must be in the range 1 to 65535. + type: integer + format: int32 + service: + description: |- + Service is the name of the service to place in the gRPC HealthCheckRequest + (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + + If this is not specified, the default behavior is defined by gRPC. + type: string + default: "" + httpGet: + description: HTTPGet specifies an HTTP GET request to perform. + type: object + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + initialDelaySeconds: + description: |- + Number of seconds after the container has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + periodSeconds: + description: |- + How often (in seconds) to perform the probe. + type: integer + format: int32 + successThreshold: + description: |- + Minimum consecutive successes for the probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. + type: integer + format: int32 + tcpSocket: + description: TCPSocket specifies a connection to a TCP port. + type: object + properties: + host: + description: 'Optional: Host name to connect to, defaults to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + timeoutSeconds: + description: |- + Number of seconds after which the probe times out. + Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + name: + description: |- + Name of the container specified as a DNS_LABEL. + Each container in a pod must have a unique name (DNS_LABEL). + Cannot be updated. + type: string + ports: + description: |- + List of ports to expose from the container. Not specifying a port here + DOES NOT prevent that port from being exposed. Any port which is + listening on the default "0.0.0.0" address inside a container will be + accessible from the network. + Modifying this array with strategic merge patch may corrupt the data. + For more information See https://github.com/kubernetes/kubernetes/issues/108255. + Cannot be updated. + type: array + items: + description: ContainerPort represents a network port in a single container. + type: object + properties: + containerPort: + description: |- + Number of port to expose on the pod's IP address. + This must be a valid port number, 0 < x < 65536. + type: integer + format: int32 + name: + description: |- + If specified, this must be an IANA_SVC_NAME and unique within the pod. Each + named port in a pod must have a unique name. Name for the port that can be + referred to by services. + type: string + protocol: + description: |- + Protocol for port. Must be UDP, TCP, or SCTP. + Defaults to "TCP". + type: string + default: TCP + readinessProbe: + description: |- + Periodic probe of container service readiness. + Container will be removed from service endpoints if the probe fails. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: object + properties: + exec: + description: Exec specifies a command to execute in the container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + failureThreshold: + description: |- + Minimum consecutive failures for the probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. + type: integer + format: int32 + grpc: + description: GRPC specifies a GRPC HealthCheckRequest. + type: object + properties: + port: + description: Port number of the gRPC service. Number must be in the range 1 to 65535. + type: integer + format: int32 + service: + description: |- + Service is the name of the service to place in the gRPC HealthCheckRequest + (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + + If this is not specified, the default behavior is defined by gRPC. + type: string + default: "" + httpGet: + description: HTTPGet specifies an HTTP GET request to perform. + type: object + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + initialDelaySeconds: + description: |- + Number of seconds after the container has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + periodSeconds: + description: |- + How often (in seconds) to perform the probe. + type: integer + format: int32 + successThreshold: + description: |- + Minimum consecutive successes for the probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. + type: integer + format: int32 + tcpSocket: + description: TCPSocket specifies a connection to a TCP port. + type: object + properties: + host: + description: 'Optional: Host name to connect to, defaults to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + timeoutSeconds: + description: |- + Number of seconds after which the probe times out. + Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + resources: + description: |- + Compute Resources required by this container. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + properties: + limits: + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + requests: + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + securityContext: + description: |- + SecurityContext defines the security options the container should be run with. + If set, the fields of SecurityContext override the equivalent fields of PodSecurityContext. + More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ + type: object + properties: + allowPrivilegeEscalation: + description: |- + AllowPrivilegeEscalation controls whether a process can gain more + privileges than its parent process. This bool directly controls if + the no_new_privs flag will be set on the container process. + AllowPrivilegeEscalation is true always when the container is: + 1) run as Privileged + 2) has CAP_SYS_ADMIN + Note that this field cannot be set when spec.os.name is windows. + type: boolean + capabilities: + description: |- + The capabilities to add/drop when running containers. + Defaults to the default set of capabilities granted by the container runtime. + Note that this field cannot be set when spec.os.name is windows. + type: object + properties: + add: + description: This is accessible behind a feature flag - kubernetes.containerspec-addcapabilities + type: array + items: + description: Capability represent POSIX capabilities type + type: string + x-kubernetes-list-type: atomic + drop: + description: Removed capabilities + type: array + items: + description: Capability represent POSIX capabilities type + type: string + x-kubernetes-list-type: atomic + privileged: + description: |- + Run container in privileged mode. This can only be set to explicitly to 'false' + type: boolean + readOnlyRootFilesystem: + description: |- + Whether this container has a read-only root filesystem. + Default is false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + runAsGroup: + description: |- + The GID to run the entrypoint of the container process. + Uses runtime default if unset. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + runAsNonRoot: + description: |- + Indicates that the container must run as a non-root user. + If true, the Kubelet will validate the image at runtime to ensure that it + does not run as UID 0 (root) and fail to start the container if it does. + If unset or false, no such validation will be performed. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: boolean + runAsUser: + description: |- + The UID to run the entrypoint of the container process. + Defaults to user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + seccompProfile: + description: |- + The seccomp options to use by this container. If seccomp options are + provided at both the pod & container level, the container options + override the pod options. + Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile defined in a file on the node should be used. + The profile must be preconfigured on the node to work. + Must be a descending path, relative to the kubelet's configured seccomp profile location. + Must be set if type is "Localhost". Must NOT be set for any other type. + type: string + type: + description: |- + type indicates which kind of seccomp profile will be applied. + Valid options are: + + Localhost - a profile defined in a file on the node should be used. + RuntimeDefault - the container runtime default profile should be used. + Unconfined - no profile should be applied. + type: string + startupProbe: + description: |- + StartupProbe indicates that the Pod has successfully initialized. + If specified, no other probes are executed until this completes successfully. + If this probe fails, the Pod will be restarted, just as if the livenessProbe failed. + This can be used to provide different probe parameters at the beginning of a Pod's lifecycle, + when it might take a long time to load data or warm a cache, than during steady-state operation. + This cannot be updated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: object + properties: + exec: + description: Exec specifies a command to execute in the container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + failureThreshold: + description: |- + Minimum consecutive failures for the probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. + type: integer + format: int32 + grpc: + description: GRPC specifies a GRPC HealthCheckRequest. + type: object + properties: + port: + description: Port number of the gRPC service. Number must be in the range 1 to 65535. + type: integer + format: int32 + service: + description: |- + Service is the name of the service to place in the gRPC HealthCheckRequest + (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + + If this is not specified, the default behavior is defined by gRPC. + type: string + default: "" + httpGet: + description: HTTPGet specifies an HTTP GET request to perform. + type: object + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + initialDelaySeconds: + description: |- + Number of seconds after the container has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + periodSeconds: + description: |- + How often (in seconds) to perform the probe. + type: integer + format: int32 + successThreshold: + description: |- + Minimum consecutive successes for the probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. + type: integer + format: int32 + tcpSocket: + description: TCPSocket specifies a connection to a TCP port. + type: object + properties: + host: + description: 'Optional: Host name to connect to, defaults to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + timeoutSeconds: + description: |- + Number of seconds after which the probe times out. + Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + terminationMessagePath: + description: |- + Optional: Path at which the file to which the container's termination message + will be written is mounted into the container's filesystem. + Message written is intended to be brief final status, such as an assertion failure message. + Will be truncated by the node if greater than 4096 bytes. The total message length across + all containers will be limited to 12kb. + Defaults to /dev/termination-log. + Cannot be updated. + type: string + terminationMessagePolicy: + description: |- + Indicate how the termination message should be populated. File will use the contents of + terminationMessagePath to populate the container status message on both success and failure. + FallbackToLogsOnError will use the last chunk of container log output if the termination + message file is empty and the container exited with an error. + The log output is limited to 2048 bytes or 80 lines, whichever is smaller. + Defaults to File. + Cannot be updated. + type: string + volumeMounts: + description: |- + Pod volumes to mount into the container's filesystem. + Cannot be updated. + type: array + items: + description: VolumeMount describes a mounting of a Volume within a container. + type: object + required: + - mountPath + - name + properties: + mountPath: + description: |- + Path within the container at which the volume should be mounted. Must + not contain ':'. + type: string + mountPropagation: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-volumes-mount-propagation + type: string + name: + description: This must match the Name of a Volume. + type: string + readOnly: + description: |- + Mounted read-only if true, read-write otherwise (false or unspecified). + Defaults to false. + type: boolean + subPath: + description: |- + Path within the volume from which the container's volume should be mounted. + Defaults to "" (volume's root). + type: string + x-kubernetes-list-map-keys: + - mountPath + x-kubernetes-list-type: map + workingDir: + description: |- + Container's working directory. + If not specified, the container runtime's default will be used, which + might be configured in the container image. + Cannot be updated. + type: string + dnsConfig: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-dnsconfig + type: object + x-kubernetes-preserve-unknown-fields: true + dnsPolicy: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-dnspolicy + type: string + enableServiceLinks: + description: |- + EnableServiceLinks indicates whether information aboutservices should be injected into pod's environment variables, matching the syntax of Docker links. Optional: Knative defaults this to false. + type: boolean + hostAliases: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-hostaliases + type: array + items: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-hostaliases + type: object + x-kubernetes-preserve-unknown-fields: true + hostIPC: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-hostipc + type: boolean + hostNetwork: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-hostnetwork + type: boolean + hostPID: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-hostpid + type: boolean + idleTimeoutSeconds: + description: |- + IdleTimeoutSeconds is the maximum duration in seconds a request will be allowed + to stay open while not receiving any bytes from the user's application. If + unspecified, a system default will be provided. + type: integer + format: int64 + imagePullSecrets: + description: |- + ImagePullSecrets is an optional list of references to secrets in the same namespace to use for pulling any of the images used by this PodSpec. + If specified, these secrets will be passed to individual puller implementations for them to use. + More info: https://kubernetes.io/docs/concepts/containers/images#specifying-imagepullsecrets-on-a-pod + type: array + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + x-kubernetes-map-type: atomic + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + initContainers: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-init-containers + type: array + items: + description: This is accessible behind a feature flag - kubernetes.podspec-init-containers + type: object + x-kubernetes-preserve-unknown-fields: true + nodeSelector: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-nodeselector + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + priorityClassName: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-priorityclassname + type: string + responseStartTimeoutSeconds: + description: |- + ResponseStartTimeoutSeconds is the maximum duration in seconds that the request + routing layer will wait for a request delivered to a container to begin + sending any network traffic. + type: integer + format: int64 + runtimeClassName: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-runtimeclassname + type: string + schedulerName: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-schedulername + type: string + securityContext: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-securitycontext + type: object + x-kubernetes-preserve-unknown-fields: true + serviceAccountName: + description: |- + ServiceAccountName is the name of the ServiceAccount to use to run this pod. + More info: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/ + type: string + shareProcessNamespace: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-shareprocessnamespace + type: boolean + timeoutSeconds: + description: |- + TimeoutSeconds is the maximum duration in seconds that the request instance + is allowed to respond to a request. If unspecified, a system default will + be provided. + type: integer + format: int64 + tolerations: + description: This is accessible behind a feature flag - kubernetes.podspec-tolerations + type: array + items: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-tolerations + type: object + x-kubernetes-preserve-unknown-fields: true + topologySpreadConstraints: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints + type: array + items: + description: This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints + type: object + x-kubernetes-preserve-unknown-fields: true + volumes: + description: |- + List of volumes that can be mounted by containers belonging to the pod. + More info: https://kubernetes.io/docs/concepts/storage/volumes + type: array + items: + description: Volume represents a named volume in a pod that may be accessed by any container in the pod. + type: object + required: + - name + properties: + configMap: + description: configMap represents a configMap that should populate this volume + type: object + properties: + defaultMode: + description: |- + defaultMode is optional: mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + Defaults to 0644. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + ConfigMap will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the ConfigMap, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: optional specify whether the ConfigMap or its keys must be defined + type: boolean + x-kubernetes-map-type: atomic + csi: + description: This is accessible behind a feature flag - kubernetes.podspec-volumes-csi + type: object + x-kubernetes-preserve-unknown-fields: true + emptyDir: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-volumes-emptydir + type: object + x-kubernetes-preserve-unknown-fields: true + hostPath: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-volumes-hostpath + type: object + x-kubernetes-preserve-unknown-fields: true + image: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-volumes-image + type: object + x-kubernetes-preserve-unknown-fields: true + name: + description: |- + name of the volume. + Must be a DNS_LABEL and unique within the pod. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + persistentVolumeClaim: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-persistent-volume-claim + type: object + x-kubernetes-preserve-unknown-fields: true + projected: + description: projected items for all in one resources secrets, configmaps, and downward API + type: object + properties: + defaultMode: + description: |- + defaultMode are the mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + sources: + description: |- + sources is the list of volume projections. Each entry in this list + handles one source. + type: array + items: + description: |- + Projection that may be projected along with other supported volume types. + Exactly one of these fields must be set. + type: object + properties: + configMap: + description: configMap information about the configMap data to project + type: object + properties: + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + ConfigMap will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the ConfigMap, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: optional specify whether the ConfigMap or its keys must be defined + type: boolean + x-kubernetes-map-type: atomic + downwardAPI: + description: downwardAPI information about the downwardAPI data to project + type: object + properties: + items: + description: Items is a list of DownwardAPIVolume file + type: array + items: + description: DownwardAPIVolumeFile represents information to create the file containing the pod field + type: object + required: + - path + properties: + fieldRef: + description: 'Required: Selects a field of the pod: only annotations, labels, name, namespace and uid are supported.' + type: object + required: + - fieldPath + properties: + apiVersion: + description: Version of the schema the FieldPath is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in the specified API version. + type: string + x-kubernetes-map-type: atomic + mode: + description: |- + Optional: mode bits used to set permissions on this file, must be an octal value + between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: 'Required: Path is the relative path name of the file to be created. Must not be absolute or contain the ''..'' path. Must be utf-8 encoded. The first item of the relative path must not start with ''..''' + type: string + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported. + type: object + required: + - resource + properties: + containerName: + description: 'Container name: required for volumes, optional for env vars' + type: string + divisor: + description: Specifies the output format of the exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + secret: + description: secret information about the secret data to project + type: object + properties: + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + Secret will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the Secret, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: optional field specify whether the Secret or its key must be defined + type: boolean + x-kubernetes-map-type: atomic + serviceAccountToken: + description: serviceAccountToken is information about the serviceAccountToken data to project + type: object + required: + - path + properties: + audience: + description: |- + audience is the intended audience of the token. A recipient of a token + must identify itself with an identifier specified in the audience of the + token, and otherwise should reject the token. The audience defaults to the + identifier of the apiserver. + type: string + expirationSeconds: + description: |- + expirationSeconds is the requested duration of validity of the service + account token. As the token approaches expiration, the kubelet volume + plugin will proactively rotate the service account token. The kubelet will + start trying to rotate the token if the token is older than 80 percent of + its time to live or if the token is older than 24 hours.Defaults to 1 hour + and must be at least 10 minutes. + type: integer + format: int64 + path: + description: |- + path is the path relative to the mount point of the file to project the + token into. + type: string + x-kubernetes-list-type: atomic + secret: + description: |- + secret represents a secret that should populate this volume. + More info: https://kubernetes.io/docs/concepts/storage/volumes#secret + type: object + properties: + defaultMode: + description: |- + defaultMode is Optional: mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values + for mode bits. Defaults to 0644. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + items: + description: |- + items If unspecified, each key-value pair in the Data field of the referenced + Secret will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the Secret, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + optional: + description: optional field specify whether the Secret or its keys must be defined + type: boolean + secretName: + description: |- + secretName is the name of the secret in the pod's namespace to use. + More info: https://kubernetes.io/docs/concepts/storage/volumes#secret + type: string + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + status: + description: RevisionStatus communicates the observed state of the Revision (from the controller). + type: object + properties: + actualReplicas: + description: ActualReplicas reflects the amount of ready pods running this revision. + type: integer + format: int32 + annotations: + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + additionalProperties: + type: string + conditions: + description: Conditions the latest available observations of a resource's current state. + type: array + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + type: object + required: + - status + - type + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating details about the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, False, Unknown. + type: string + type: + description: Type of condition. + type: string + containerStatuses: + description: |- + ContainerStatuses is a slice of images present in .Spec.Container[*].Image + to their respective digests and their container name. + The digests are resolved during the creation of Revision. + ContainerStatuses holds the container name and image digests + for both serving and non serving containers. + ref: https://bit.ly/image-digests + type: array + items: + description: ContainerStatus holds the information of container name and image digest value + type: object + properties: + imageDigest: + type: string + name: + type: string + desiredReplicas: + description: DesiredReplicas reflects the desired amount of pods running this revision. + type: integer + format: int32 + initContainerStatuses: + description: |- + InitContainerStatuses is a slice of images present in .Spec.InitContainer[*].Image + to their respective digests and their container name. + The digests are resolved during the creation of Revision. + ContainerStatuses holds the container name and image digests + for both serving and non serving containers. + ref: https://bit.ly/image-digests + type: array + items: + description: ContainerStatus holds the information of container name and image digest value + type: object + properties: + imageDigest: + type: string + name: + type: string + logUrl: + description: |- + LogURL specifies the generated logging url for this particular revision + based on the revision url template specified in the controller's config. + type: string + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + type: integer + format: int64 +--- +# Copyright 2019 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# Note: The schema part of the spec is auto-generated by hack/update-schemas.sh. + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: routes.serving.knative.dev + labels: + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" + knative.dev/crd-install: "true" + duck.knative.dev/addressable: "true" +spec: + group: serving.knative.dev + names: + kind: Route + plural: routes + singular: route + categories: + - all + - knative + - serving + shortNames: + - rt + scope: Namespaced + versions: + - name: v1 + served: true + storage: true + subresources: + status: {} + additionalPrinterColumns: + - name: URL + type: string + jsonPath: .status.url + - name: Ready + type: string + jsonPath: ".status.conditions[?(@.type=='Ready')].status" + - name: Reason + type: string + jsonPath: ".status.conditions[?(@.type=='Ready')].reason" + schema: + openAPIV3Schema: + description: |- + Route is responsible for configuring ingress over a collection of Revisions. + Some of the Revisions a Route distributes traffic over may be specified by + referencing the Configuration responsible for creating them; in these cases + the Route is additionally responsible for monitoring the Configuration for + "latest ready revision" changes, and smoothly rolling out latest revisions. + See also: https://github.com/knative/serving/blob/main/docs/spec/overview.md#route + type: object + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: Spec holds the desired state of the Route (from the client). + type: object + properties: + traffic: + description: |- + Traffic specifies how to distribute traffic over a collection of + revisions and configurations. + type: array + items: + description: TrafficTarget holds a single entry of the routing table for a Route. + type: object + properties: + configurationName: + description: |- + ConfigurationName of a configuration to whose latest revision we will send + this portion of traffic. When the "status.latestReadyRevisionName" of the + referenced configuration changes, we will automatically migrate traffic + from the prior "latest ready" revision to the new one. This field is never + set in Route's status, only its spec. This is mutually exclusive with + RevisionName. + type: string + latestRevision: + description: |- + LatestRevision may be optionally provided to indicate that the latest + ready Revision of the Configuration should be used for this traffic + target. When provided LatestRevision must be true if RevisionName is + empty; it must be false when RevisionName is non-empty. + type: boolean + percent: + description: |- + Percent indicates that percentage based routing should be used and + the value indicates the percent of traffic that is be routed to this + Revision or Configuration. `0` (zero) mean no traffic, `100` means all + traffic. + When percentage based routing is being used the follow rules apply: + - the sum of all percent values must equal 100 + - when not specified, the implied value for `percent` is zero for + that particular Revision or Configuration + type: integer + format: int64 + revisionName: + description: |- + RevisionName of a specific revision to which to send this portion of + traffic. This is mutually exclusive with ConfigurationName. + type: string + tag: + description: |- + Tag is optionally used to expose a dedicated url for referencing + this target exclusively. + type: string + url: + description: |- + URL displays the URL for accessing named traffic targets. URL is displayed in + status, and is disallowed on spec. URL must contain a scheme (e.g. http://) and + a hostname, but may not contain anything else (e.g. basic auth, url path, etc.) + type: string + status: + description: Status communicates the observed state of the Route (from the controller). + type: object + properties: + address: + description: Address holds the information needed for a Route to be the target of an event. + type: object + properties: + CACerts: + description: |- + CACerts is the Certification Authority (CA) certificates in PEM format + according to https://www.rfc-editor.org/rfc/rfc7468. + type: string + audience: + description: Audience is the OIDC audience for this address. + type: string + name: + description: Name is the name of the address. + type: string + url: + type: string + annotations: + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + additionalProperties: + type: string + conditions: + description: Conditions the latest available observations of a resource's current state. + type: array + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + type: object + required: + - status + - type + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating details about the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, False, Unknown. + type: string + type: + description: Type of condition. + type: string + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + type: integer + format: int64 + traffic: + description: |- + Traffic holds the configured traffic distribution. + These entries will always contain RevisionName references. + When ConfigurationName appears in the spec, this will hold the + LatestReadyRevisionName that we last observed. + type: array + items: + description: TrafficTarget holds a single entry of the routing table for a Route. + type: object + properties: + configurationName: + description: |- + ConfigurationName of a configuration to whose latest revision we will send + this portion of traffic. When the "status.latestReadyRevisionName" of the + referenced configuration changes, we will automatically migrate traffic + from the prior "latest ready" revision to the new one. This field is never + set in Route's status, only its spec. This is mutually exclusive with + RevisionName. + type: string + latestRevision: + description: |- + LatestRevision may be optionally provided to indicate that the latest + ready Revision of the Configuration should be used for this traffic + target. When provided LatestRevision must be true if RevisionName is + empty; it must be false when RevisionName is non-empty. + type: boolean + percent: + description: |- + Percent indicates that percentage based routing should be used and + the value indicates the percent of traffic that is be routed to this + Revision or Configuration. `0` (zero) mean no traffic, `100` means all + traffic. + When percentage based routing is being used the follow rules apply: + - the sum of all percent values must equal 100 + - when not specified, the implied value for `percent` is zero for + that particular Revision or Configuration + type: integer + format: int64 + revisionName: + description: |- + RevisionName of a specific revision to which to send this portion of + traffic. This is mutually exclusive with ConfigurationName. + type: string + tag: + description: |- + Tag is optionally used to expose a dedicated url for referencing + this target exclusively. + type: string + url: + description: |- + URL displays the URL for accessing named traffic targets. URL is displayed in + status, and is disallowed on spec. URL must contain a scheme (e.g. http://) and + a hostname, but may not contain anything else (e.g. basic auth, url path, etc.) + type: string + url: + description: |- + URL holds the url that will distribute traffic over the provided traffic targets. + It generally has the form http[s]://{route-name}.{route-namespace}.{cluster-level-suffix} + type: string +--- +# Copyright 2019 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: serverlessservices.networking.internal.knative.dev + labels: + app.kubernetes.io/name: knative-serving + app.kubernetes.io/component: networking + app.kubernetes.io/version: "1.22.1" + knative.dev/crd-install: "true" +spec: + group: networking.internal.knative.dev + versions: + - name: v1alpha1 + served: true + storage: true + subresources: + status: {} + schema: + openAPIV3Schema: + description: |- + ServerlessService is a proxy for the K8s service objects containing the + endpoints for the revision, whether those are endpoints of the activator or + revision pods. + See: https://knative.page.link/naxz for details. + type: object + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: |- + Spec is the desired state of the ServerlessService. + More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status + type: object + required: + - objectRef + - protocolType + properties: + mode: + description: Mode describes the mode of operation of the ServerlessService. + type: string + numActivators: + description: |- + NumActivators contains number of Activators that this revision should be + assigned. + O means — assign all. + type: integer + format: int32 + objectRef: + description: |- + ObjectRef defines the resource that this ServerlessService + is responsible for making "serverless". + type: object + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: |- + If referring to a piece of an object instead of an entire object, this string + should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within a pod, this would take on a value like: + "spec.containers{name}" (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" (container with + index 2 in this pod). This syntax is chosen only to have some well-defined way of + referencing a part of an object. + type: string + kind: + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + namespace: + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ + type: string + resourceVersion: + description: |- + Specific resourceVersion to which this reference is made, if any. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency + type: string + uid: + description: |- + UID of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids + type: string + x-kubernetes-map-type: atomic + protocolType: + description: |- + The application-layer protocol. Matches `RevisionProtocolType` set on the owning pa/revision. + serving imports networking, so just use string. + type: string + status: + description: |- + Status is the current state of the ServerlessService. + More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status + type: object + properties: + annotations: + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + additionalProperties: + type: string + conditions: + description: Conditions the latest available observations of a resource's current state. + type: array + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + type: object + required: + - status + - type + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating details about the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, False, Unknown. + type: string + type: + description: Type of condition. + type: string + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + type: integer + format: int64 + privateServiceName: + description: |- + PrivateServiceName holds the name of a core K8s Service resource that + load balances over the user service pods backing this Revision. + type: string + serviceName: + description: |- + ServiceName holds the name of a core K8s Service resource that + load balances over the pods backing this Revision (activator or revision). + type: string + additionalPrinterColumns: + - name: Mode + type: string + jsonPath: ".spec.mode" + - name: Activators + type: integer + jsonPath: ".spec.numActivators" + - name: ServiceName + type: string + jsonPath: ".status.serviceName" + - name: PrivateServiceName + type: string + jsonPath: ".status.privateServiceName" + - name: Ready + type: string + jsonPath: ".status.conditions[?(@.type=='Ready')].status" + - name: Reason + type: string + jsonPath: ".status.conditions[?(@.type=='Ready')].reason" + names: + kind: ServerlessService + plural: serverlessservices + singular: serverlessservice + categories: + - knative-internal + - networking + shortNames: + - sks + scope: Namespaced +--- +# Copyright 2019 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# Note: The schema part of the spec is auto-generated by hack/update-schemas.sh. + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: services.serving.knative.dev + labels: + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" + knative.dev/crd-install: "true" + duck.knative.dev/addressable: "true" + duck.knative.dev/podspecable: "true" +spec: + group: serving.knative.dev + names: + kind: Service + plural: services + singular: service + categories: + - all + - knative + - serving + shortNames: + - kservice + - ksvc + scope: Namespaced + versions: + - name: v1 + served: true + storage: true + subresources: + status: {} + additionalPrinterColumns: + - name: URL + type: string + jsonPath: .status.url + - name: LatestCreated + type: string + jsonPath: .status.latestCreatedRevisionName + - name: LatestReady + type: string + jsonPath: .status.latestReadyRevisionName + - name: Ready + type: string + jsonPath: ".status.conditions[?(@.type=='Ready')].status" + - name: Reason + type: string + jsonPath: ".status.conditions[?(@.type=='Ready')].reason" + schema: + openAPIV3Schema: + description: |- + Service acts as a top-level container that manages a Route and Configuration + which implement a network service. Service exists to provide a singular + abstraction which can be access controlled, reasoned about, and which + encapsulates software lifecycle decisions such as rollout policy and + team resource ownership. Service acts only as an orchestrator of the + underlying Routes and Configurations (much as a kubernetes Deployment + orchestrates ReplicaSets), and its usage is optional but recommended. + + The Service's controller will track the statuses of its owned Configuration + and Route, reflecting their statuses and conditions as its own. + + See also: https://github.com/knative/serving/blob/main/docs/spec/overview.md#service + type: object + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: |- + ServiceSpec represents the configuration for the Service object. + A Service's specification is the union of the specifications for a Route + and Configuration. The Service restricts what can be expressed in these + fields, e.g. the Route must reference the provided Configuration; + however, these limitations also enable friendlier defaulting, + e.g. Route never needs a Configuration name, and may be defaulted to + the appropriate "run latest" spec. + type: object + properties: + template: + description: Template holds the latest specification for the Revision to be stamped out. + type: object + properties: + metadata: + type: object + properties: + annotations: + type: object + additionalProperties: + type: string + finalizers: + type: array + items: + type: string + labels: + type: object + additionalProperties: + type: string + name: + type: string + namespace: + type: string + x-kubernetes-preserve-unknown-fields: true + spec: + description: RevisionSpec holds the desired state of the Revision (from the client). + type: object + required: + - containers + properties: + affinity: + description: This is accessible behind a feature flag - kubernetes.podspec-affinity + type: object + x-kubernetes-preserve-unknown-fields: true + automountServiceAccountToken: + description: AutomountServiceAccountToken indicates whether a service account token should be automatically mounted. + type: boolean + containerConcurrency: + description: |- + ContainerConcurrency specifies the maximum allowed in-flight (concurrent) + requests per container of the Revision. Defaults to `0` which means + concurrency to the application is not limited, and the system decides the + target concurrency for the autoscaler. + type: integer + format: int64 + containers: + description: |- + List of containers belonging to the pod. + Containers cannot currently be added or removed. + There must be at least one container in a Pod. + Cannot be updated. + type: array + items: + description: A single application container that you want to run within a pod. + type: object + properties: + args: + description: |- + Arguments to the entrypoint. + The container image's CMD is used if this is not provided. + Variable references $(VAR_NAME) are expanded using the container's environment. If a variable + cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will + produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless + of whether the variable exists or not. Cannot be updated. + More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell + type: array + items: + type: string + x-kubernetes-list-type: atomic + command: + description: |- + Entrypoint array. Not executed within a shell. + The container image's ENTRYPOINT is used if this is not provided. + Variable references $(VAR_NAME) are expanded using the container's environment. If a variable + cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will + produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless + of whether the variable exists or not. Cannot be updated. + More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell + type: array + items: + type: string + x-kubernetes-list-type: atomic + env: + description: |- + List of environment variables to set in the container. + Cannot be updated. + type: array + items: + description: EnvVar represents an environment variable present in a Container. + type: object + required: + - name + properties: + name: + description: |- + Name of the environment variable. + May consist of any printable ASCII characters except '='. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's value. Cannot be used if value is not empty. + type: object + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + type: object + required: + - key + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap or its key must be defined + type: boolean + x-kubernetes-map-type: atomic + fieldRef: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-fieldref + type: object + x-kubernetes-map-type: atomic + x-kubernetes-preserve-unknown-fields: true + resourceFieldRef: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-fieldref + type: object + x-kubernetes-map-type: atomic + x-kubernetes-preserve-unknown-fields: true + secretKeyRef: + description: Selects a key of a secret in the pod's namespace + type: object + required: + - key + properties: + key: + description: The key of the secret to select from. Must be a valid secret key. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret or its key must be defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + envFrom: + description: |- + List of sources to populate environment variables in the container. + The keys defined within a source may consist of any printable ASCII characters except '='. + When a key exists in multiple + sources, the value associated with the last source will take precedence. + Values defined by an Env with a duplicate key will take precedence. + Cannot be updated. + type: array + items: + description: EnvFromSource represents the source of a set of ConfigMaps or Secrets + type: object + properties: + configMapRef: + description: The ConfigMap to select from + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap must be defined + type: boolean + x-kubernetes-map-type: atomic + prefix: + description: |- + Optional text to prepend to the name of each environment variable. + May consist of any printable ASCII characters except '='. + type: string + secretRef: + description: The Secret to select from + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret must be defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + image: + description: |- + Container image name. + More info: https://kubernetes.io/docs/concepts/containers/images + This field is optional to allow higher level config management to default or override + container images in workload controllers like Deployments and StatefulSets. + type: string + imagePullPolicy: + description: |- + Image pull policy. + One of Always, Never, IfNotPresent. + Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/containers/images#updating-images + type: string + livenessProbe: + description: |- + Periodic probe of container liveness. + Container will be restarted if the probe fails. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: object + properties: + exec: + description: Exec specifies a command to execute in the container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + failureThreshold: + description: |- + Minimum consecutive failures for the probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. + type: integer + format: int32 + grpc: + description: GRPC specifies a GRPC HealthCheckRequest. + type: object + properties: + port: + description: Port number of the gRPC service. Number must be in the range 1 to 65535. + type: integer + format: int32 + service: + description: |- + Service is the name of the service to place in the gRPC HealthCheckRequest + (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + + If this is not specified, the default behavior is defined by gRPC. + type: string + default: "" + httpGet: + description: HTTPGet specifies an HTTP GET request to perform. + type: object + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + initialDelaySeconds: + description: |- + Number of seconds after the container has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + periodSeconds: + description: |- + How often (in seconds) to perform the probe. + type: integer + format: int32 + successThreshold: + description: |- + Minimum consecutive successes for the probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. + type: integer + format: int32 + tcpSocket: + description: TCPSocket specifies a connection to a TCP port. + type: object + properties: + host: + description: 'Optional: Host name to connect to, defaults to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + timeoutSeconds: + description: |- + Number of seconds after which the probe times out. + Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + name: + description: |- + Name of the container specified as a DNS_LABEL. + Each container in a pod must have a unique name (DNS_LABEL). + Cannot be updated. + type: string + ports: + description: |- + List of ports to expose from the container. Not specifying a port here + DOES NOT prevent that port from being exposed. Any port which is + listening on the default "0.0.0.0" address inside a container will be + accessible from the network. + Modifying this array with strategic merge patch may corrupt the data. + For more information See https://github.com/kubernetes/kubernetes/issues/108255. + Cannot be updated. + type: array + items: + description: ContainerPort represents a network port in a single container. + type: object + properties: + containerPort: + description: |- + Number of port to expose on the pod's IP address. + This must be a valid port number, 0 < x < 65536. + type: integer + format: int32 + name: + description: |- + If specified, this must be an IANA_SVC_NAME and unique within the pod. Each + named port in a pod must have a unique name. Name for the port that can be + referred to by services. + type: string + protocol: + description: |- + Protocol for port. Must be UDP, TCP, or SCTP. + Defaults to "TCP". + type: string + default: TCP + readinessProbe: + description: |- + Periodic probe of container service readiness. + Container will be removed from service endpoints if the probe fails. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: object + properties: + exec: + description: Exec specifies a command to execute in the container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + failureThreshold: + description: |- + Minimum consecutive failures for the probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. + type: integer + format: int32 + grpc: + description: GRPC specifies a GRPC HealthCheckRequest. + type: object + properties: + port: + description: Port number of the gRPC service. Number must be in the range 1 to 65535. + type: integer + format: int32 + service: + description: |- + Service is the name of the service to place in the gRPC HealthCheckRequest + (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + + If this is not specified, the default behavior is defined by gRPC. + type: string + default: "" + httpGet: + description: HTTPGet specifies an HTTP GET request to perform. + type: object + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + initialDelaySeconds: + description: |- + Number of seconds after the container has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + periodSeconds: + description: |- + How often (in seconds) to perform the probe. + type: integer + format: int32 + successThreshold: + description: |- + Minimum consecutive successes for the probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. + type: integer + format: int32 + tcpSocket: + description: TCPSocket specifies a connection to a TCP port. + type: object + properties: + host: + description: 'Optional: Host name to connect to, defaults to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + timeoutSeconds: + description: |- + Number of seconds after which the probe times out. + Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + resources: + description: |- + Compute Resources required by this container. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + properties: + limits: + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + requests: + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + securityContext: + description: |- + SecurityContext defines the security options the container should be run with. + If set, the fields of SecurityContext override the equivalent fields of PodSecurityContext. + More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ + type: object + properties: + allowPrivilegeEscalation: + description: |- + AllowPrivilegeEscalation controls whether a process can gain more + privileges than its parent process. This bool directly controls if + the no_new_privs flag will be set on the container process. + AllowPrivilegeEscalation is true always when the container is: + 1) run as Privileged + 2) has CAP_SYS_ADMIN + Note that this field cannot be set when spec.os.name is windows. + type: boolean + capabilities: + description: |- + The capabilities to add/drop when running containers. + Defaults to the default set of capabilities granted by the container runtime. + Note that this field cannot be set when spec.os.name is windows. + type: object + properties: + add: + description: This is accessible behind a feature flag - kubernetes.containerspec-addcapabilities + type: array + items: + description: Capability represent POSIX capabilities type + type: string + x-kubernetes-list-type: atomic + drop: + description: Removed capabilities + type: array + items: + description: Capability represent POSIX capabilities type + type: string + x-kubernetes-list-type: atomic + privileged: + description: |- + Run container in privileged mode. This can only be set to explicitly to 'false' + type: boolean + readOnlyRootFilesystem: + description: |- + Whether this container has a read-only root filesystem. + Default is false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + runAsGroup: + description: |- + The GID to run the entrypoint of the container process. + Uses runtime default if unset. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + runAsNonRoot: + description: |- + Indicates that the container must run as a non-root user. + If true, the Kubelet will validate the image at runtime to ensure that it + does not run as UID 0 (root) and fail to start the container if it does. + If unset or false, no such validation will be performed. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: boolean + runAsUser: + description: |- + The UID to run the entrypoint of the container process. + Defaults to user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + seccompProfile: + description: |- + The seccomp options to use by this container. If seccomp options are + provided at both the pod & container level, the container options + override the pod options. + Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile defined in a file on the node should be used. + The profile must be preconfigured on the node to work. + Must be a descending path, relative to the kubelet's configured seccomp profile location. + Must be set if type is "Localhost". Must NOT be set for any other type. + type: string + type: + description: |- + type indicates which kind of seccomp profile will be applied. + Valid options are: + + Localhost - a profile defined in a file on the node should be used. + RuntimeDefault - the container runtime default profile should be used. + Unconfined - no profile should be applied. + type: string + startupProbe: + description: |- + StartupProbe indicates that the Pod has successfully initialized. + If specified, no other probes are executed until this completes successfully. + If this probe fails, the Pod will be restarted, just as if the livenessProbe failed. + This can be used to provide different probe parameters at the beginning of a Pod's lifecycle, + when it might take a long time to load data or warm a cache, than during steady-state operation. + This cannot be updated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: object + properties: + exec: + description: Exec specifies a command to execute in the container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + failureThreshold: + description: |- + Minimum consecutive failures for the probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. + type: integer + format: int32 + grpc: + description: GRPC specifies a GRPC HealthCheckRequest. + type: object + properties: + port: + description: Port number of the gRPC service. Number must be in the range 1 to 65535. + type: integer + format: int32 + service: + description: |- + Service is the name of the service to place in the gRPC HealthCheckRequest + (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + + If this is not specified, the default behavior is defined by gRPC. + type: string + default: "" + httpGet: + description: HTTPGet specifies an HTTP GET request to perform. + type: object + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + initialDelaySeconds: + description: |- + Number of seconds after the container has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + periodSeconds: + description: |- + How often (in seconds) to perform the probe. + type: integer + format: int32 + successThreshold: + description: |- + Minimum consecutive successes for the probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. + type: integer + format: int32 + tcpSocket: + description: TCPSocket specifies a connection to a TCP port. + type: object + properties: + host: + description: 'Optional: Host name to connect to, defaults to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + timeoutSeconds: + description: |- + Number of seconds after which the probe times out. + Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + terminationMessagePath: + description: |- + Optional: Path at which the file to which the container's termination message + will be written is mounted into the container's filesystem. + Message written is intended to be brief final status, such as an assertion failure message. + Will be truncated by the node if greater than 4096 bytes. The total message length across + all containers will be limited to 12kb. + Defaults to /dev/termination-log. + Cannot be updated. + type: string + terminationMessagePolicy: + description: |- + Indicate how the termination message should be populated. File will use the contents of + terminationMessagePath to populate the container status message on both success and failure. + FallbackToLogsOnError will use the last chunk of container log output if the termination + message file is empty and the container exited with an error. + The log output is limited to 2048 bytes or 80 lines, whichever is smaller. + Defaults to File. + Cannot be updated. + type: string + volumeMounts: + description: |- + Pod volumes to mount into the container's filesystem. + Cannot be updated. + type: array + items: + description: VolumeMount describes a mounting of a Volume within a container. + type: object + required: + - mountPath + - name + properties: + mountPath: + description: |- + Path within the container at which the volume should be mounted. Must + not contain ':'. + type: string + mountPropagation: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-volumes-mount-propagation + type: string + name: + description: This must match the Name of a Volume. + type: string + readOnly: + description: |- + Mounted read-only if true, read-write otherwise (false or unspecified). + Defaults to false. + type: boolean + subPath: + description: |- + Path within the volume from which the container's volume should be mounted. + Defaults to "" (volume's root). + type: string + x-kubernetes-list-map-keys: + - mountPath + x-kubernetes-list-type: map + workingDir: + description: |- + Container's working directory. + If not specified, the container runtime's default will be used, which + might be configured in the container image. + Cannot be updated. + type: string + dnsConfig: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-dnsconfig + type: object + x-kubernetes-preserve-unknown-fields: true + dnsPolicy: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-dnspolicy + type: string + enableServiceLinks: + description: |- + EnableServiceLinks indicates whether information aboutservices should be injected into pod's environment variables, matching the syntax of Docker links. Optional: Knative defaults this to false. + type: boolean + hostAliases: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-hostaliases + type: array + items: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-hostaliases + type: object + x-kubernetes-preserve-unknown-fields: true + hostIPC: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-hostipc + type: boolean + hostNetwork: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-hostnetwork + type: boolean + hostPID: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-hostpid + type: boolean + idleTimeoutSeconds: + description: |- + IdleTimeoutSeconds is the maximum duration in seconds a request will be allowed + to stay open while not receiving any bytes from the user's application. If + unspecified, a system default will be provided. + type: integer + format: int64 + imagePullSecrets: + description: |- + ImagePullSecrets is an optional list of references to secrets in the same namespace to use for pulling any of the images used by this PodSpec. + If specified, these secrets will be passed to individual puller implementations for them to use. + More info: https://kubernetes.io/docs/concepts/containers/images#specifying-imagepullsecrets-on-a-pod + type: array + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + x-kubernetes-map-type: atomic + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + initContainers: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-init-containers + type: array + items: + description: This is accessible behind a feature flag - kubernetes.podspec-init-containers + type: object + x-kubernetes-preserve-unknown-fields: true + nodeSelector: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-nodeselector + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + priorityClassName: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-priorityclassname + type: string + responseStartTimeoutSeconds: + description: |- + ResponseStartTimeoutSeconds is the maximum duration in seconds that the request + routing layer will wait for a request delivered to a container to begin + sending any network traffic. + type: integer + format: int64 + runtimeClassName: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-runtimeclassname + type: string + schedulerName: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-schedulername + type: string + securityContext: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-securitycontext + type: object + x-kubernetes-preserve-unknown-fields: true + serviceAccountName: + description: |- + ServiceAccountName is the name of the ServiceAccount to use to run this pod. + More info: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/ + type: string + shareProcessNamespace: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-shareprocessnamespace + type: boolean + timeoutSeconds: + description: |- + TimeoutSeconds is the maximum duration in seconds that the request instance + is allowed to respond to a request. If unspecified, a system default will + be provided. + type: integer + format: int64 + tolerations: + description: This is accessible behind a feature flag - kubernetes.podspec-tolerations + type: array + items: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-tolerations + type: object + x-kubernetes-preserve-unknown-fields: true + topologySpreadConstraints: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints + type: array + items: + description: This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints + type: object + x-kubernetes-preserve-unknown-fields: true + volumes: + description: |- + List of volumes that can be mounted by containers belonging to the pod. + More info: https://kubernetes.io/docs/concepts/storage/volumes + type: array + items: + description: Volume represents a named volume in a pod that may be accessed by any container in the pod. + type: object + required: + - name + properties: + configMap: + description: configMap represents a configMap that should populate this volume + type: object + properties: + defaultMode: + description: |- + defaultMode is optional: mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + Defaults to 0644. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + ConfigMap will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the ConfigMap, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: optional specify whether the ConfigMap or its keys must be defined + type: boolean + x-kubernetes-map-type: atomic + csi: + description: This is accessible behind a feature flag - kubernetes.podspec-volumes-csi + type: object + x-kubernetes-preserve-unknown-fields: true + emptyDir: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-volumes-emptydir + type: object + x-kubernetes-preserve-unknown-fields: true + hostPath: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-volumes-hostpath + type: object + x-kubernetes-preserve-unknown-fields: true + image: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-volumes-image + type: object + x-kubernetes-preserve-unknown-fields: true + name: + description: |- + name of the volume. + Must be a DNS_LABEL and unique within the pod. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + persistentVolumeClaim: + description: |- + This is accessible behind a feature flag - kubernetes.podspec-persistent-volume-claim + type: object + x-kubernetes-preserve-unknown-fields: true + projected: + description: projected items for all in one resources secrets, configmaps, and downward API + type: object + properties: + defaultMode: + description: |- + defaultMode are the mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + sources: + description: |- + sources is the list of volume projections. Each entry in this list + handles one source. + type: array + items: + description: |- + Projection that may be projected along with other supported volume types. + Exactly one of these fields must be set. + type: object + properties: + configMap: + description: configMap information about the configMap data to project + type: object + properties: + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + ConfigMap will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the ConfigMap, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: optional specify whether the ConfigMap or its keys must be defined + type: boolean + x-kubernetes-map-type: atomic + downwardAPI: + description: downwardAPI information about the downwardAPI data to project + type: object + properties: + items: + description: Items is a list of DownwardAPIVolume file + type: array + items: + description: DownwardAPIVolumeFile represents information to create the file containing the pod field + type: object + required: + - path + properties: + fieldRef: + description: 'Required: Selects a field of the pod: only annotations, labels, name, namespace and uid are supported.' + type: object + required: + - fieldPath + properties: + apiVersion: + description: Version of the schema the FieldPath is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in the specified API version. + type: string + x-kubernetes-map-type: atomic + mode: + description: |- + Optional: mode bits used to set permissions on this file, must be an octal value + between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: 'Required: Path is the relative path name of the file to be created. Must not be absolute or contain the ''..'' path. Must be utf-8 encoded. The first item of the relative path must not start with ''..''' + type: string + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported. + type: object + required: + - resource + properties: + containerName: + description: 'Container name: required for volumes, optional for env vars' + type: string + divisor: + description: Specifies the output format of the exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + secret: + description: secret information about the secret data to project + type: object + properties: + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + Secret will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the Secret, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: optional field specify whether the Secret or its key must be defined + type: boolean + x-kubernetes-map-type: atomic + serviceAccountToken: + description: serviceAccountToken is information about the serviceAccountToken data to project + type: object + required: + - path + properties: + audience: + description: |- + audience is the intended audience of the token. A recipient of a token + must identify itself with an identifier specified in the audience of the + token, and otherwise should reject the token. The audience defaults to the + identifier of the apiserver. + type: string + expirationSeconds: + description: |- + expirationSeconds is the requested duration of validity of the service + account token. As the token approaches expiration, the kubelet volume + plugin will proactively rotate the service account token. The kubelet will + start trying to rotate the token if the token is older than 80 percent of + its time to live or if the token is older than 24 hours.Defaults to 1 hour + and must be at least 10 minutes. + type: integer + format: int64 + path: + description: |- + path is the path relative to the mount point of the file to project the + token into. + type: string + x-kubernetes-list-type: atomic + secret: + description: |- + secret represents a secret that should populate this volume. + More info: https://kubernetes.io/docs/concepts/storage/volumes#secret + type: object + properties: + defaultMode: + description: |- + defaultMode is Optional: mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values + for mode bits. Defaults to 0644. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + items: + description: |- + items If unspecified, each key-value pair in the Data field of the referenced + Secret will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the Secret, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + optional: + description: optional field specify whether the Secret or its keys must be defined + type: boolean + secretName: + description: |- + secretName is the name of the secret in the pod's namespace to use. + More info: https://kubernetes.io/docs/concepts/storage/volumes#secret + type: string + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + traffic: + description: |- + Traffic specifies how to distribute traffic over a collection of + revisions and configurations. + type: array + items: + description: TrafficTarget holds a single entry of the routing table for a Route. + type: object + properties: + configurationName: + description: |- + ConfigurationName of a configuration to whose latest revision we will send + this portion of traffic. When the "status.latestReadyRevisionName" of the + referenced configuration changes, we will automatically migrate traffic + from the prior "latest ready" revision to the new one. This field is never + set in Route's status, only its spec. This is mutually exclusive with + RevisionName. + type: string + latestRevision: + description: |- + LatestRevision may be optionally provided to indicate that the latest + ready Revision of the Configuration should be used for this traffic + target. When provided LatestRevision must be true if RevisionName is + empty; it must be false when RevisionName is non-empty. + type: boolean + percent: + description: |- + Percent indicates that percentage based routing should be used and + the value indicates the percent of traffic that is be routed to this + Revision or Configuration. `0` (zero) mean no traffic, `100` means all + traffic. + When percentage based routing is being used the follow rules apply: + - the sum of all percent values must equal 100 + - when not specified, the implied value for `percent` is zero for + that particular Revision or Configuration + type: integer + format: int64 + revisionName: + description: |- + RevisionName of a specific revision to which to send this portion of + traffic. This is mutually exclusive with ConfigurationName. + type: string + tag: + description: |- + Tag is optionally used to expose a dedicated url for referencing + this target exclusively. + type: string + url: + description: |- + URL displays the URL for accessing named traffic targets. URL is displayed in + status, and is disallowed on spec. URL must contain a scheme (e.g. http://) and + a hostname, but may not contain anything else (e.g. basic auth, url path, etc.) + type: string + status: + description: ServiceStatus represents the Status stanza of the Service resource. + type: object + properties: + address: + description: Address holds the information needed for a Route to be the target of an event. + type: object + properties: + CACerts: + description: |- + CACerts is the Certification Authority (CA) certificates in PEM format + according to https://www.rfc-editor.org/rfc/rfc7468. + type: string + audience: + description: Audience is the OIDC audience for this address. + type: string + name: + description: Name is the name of the address. + type: string + url: + type: string + annotations: + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + additionalProperties: + type: string + conditions: + description: Conditions the latest available observations of a resource's current state. + type: array + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + type: object + required: + - status + - type + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating details about the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, False, Unknown. + type: string + type: + description: Type of condition. + type: string + latestCreatedRevisionName: + description: |- + LatestCreatedRevisionName is the last revision that was created from this + Configuration. It might not be ready yet, for that use LatestReadyRevisionName. + type: string + latestReadyRevisionName: + description: |- + LatestReadyRevisionName holds the name of the latest Revision stamped out + from this Configuration that has had its "Ready" condition become "True". + type: string + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + type: integer + format: int64 + traffic: + description: |- + Traffic holds the configured traffic distribution. + These entries will always contain RevisionName references. + When ConfigurationName appears in the spec, this will hold the + LatestReadyRevisionName that we last observed. + type: array + items: + description: TrafficTarget holds a single entry of the routing table for a Route. + type: object + properties: + configurationName: + description: |- + ConfigurationName of a configuration to whose latest revision we will send + this portion of traffic. When the "status.latestReadyRevisionName" of the + referenced configuration changes, we will automatically migrate traffic + from the prior "latest ready" revision to the new one. This field is never + set in Route's status, only its spec. This is mutually exclusive with + RevisionName. + type: string + latestRevision: + description: |- + LatestRevision may be optionally provided to indicate that the latest + ready Revision of the Configuration should be used for this traffic + target. When provided LatestRevision must be true if RevisionName is + empty; it must be false when RevisionName is non-empty. + type: boolean + percent: + description: |- + Percent indicates that percentage based routing should be used and + the value indicates the percent of traffic that is be routed to this + Revision or Configuration. `0` (zero) mean no traffic, `100` means all + traffic. + When percentage based routing is being used the follow rules apply: + - the sum of all percent values must equal 100 + - when not specified, the implied value for `percent` is zero for + that particular Revision or Configuration + type: integer + format: int64 + revisionName: + description: |- + RevisionName of a specific revision to which to send this portion of + traffic. This is mutually exclusive with ConfigurationName. + type: string + tag: + description: |- + Tag is optionally used to expose a dedicated url for referencing + this target exclusively. + type: string + url: + description: |- + URL displays the URL for accessing named traffic targets. URL is displayed in + status, and is disallowed on spec. URL must contain a scheme (e.g. http://) and + a hostname, but may not contain anything else (e.g. basic auth, url path, etc.) + type: string + url: + description: |- + URL holds the url that will distribute traffic over the provided traffic targets. + It generally has the form http[s]://{route-name}.{route-namespace}.{cluster-level-suffix} + type: string +--- +# Copyright 2018 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: images.caching.internal.knative.dev + labels: + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" + knative.dev/crd-install: "true" +spec: + group: caching.internal.knative.dev + names: + kind: Image + plural: images + singular: image + categories: + - knative-internal + - caching + scope: Namespaced + versions: + - name: v1alpha1 + served: true + storage: true + subresources: + status: {} + schema: + openAPIV3Schema: + description: |- + Image is a Knative abstraction that encapsulates the interface by which Knative + components express a desire to have a particular image cached. + type: object + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: Spec holds the desired state of the Image (from the client). + type: object + required: + - image + properties: + image: + description: Image is the name of the container image url to cache across the cluster. + type: string + imagePullSecrets: + description: |- + ImagePullSecrets contains the names of the Kubernetes Secrets containing login + information used by the Pods which will run this container. + type: array + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + x-kubernetes-map-type: atomic + serviceAccountName: + description: |- + ServiceAccountName is the name of the Kubernetes ServiceAccount as which the Pods + will run this container. This is potentially used to authenticate the image pull + if the service account has attached pull secrets. For more information: + https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#add-imagepullsecrets-to-a-service-account + type: string + status: + description: Status communicates the observed state of the Image (from the controller). + type: object + properties: + annotations: + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + additionalProperties: + type: string + conditions: + description: Conditions the latest available observations of a resource's current state. + type: array + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + type: object + required: + - status + - type + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating details about the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, False, Unknown. + type: string + type: + description: Type of condition. + type: string + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + type: integer + format: int64 + additionalPrinterColumns: + - name: Image + type: string + jsonPath: .spec.image +--- +# Source: https://github.com/knative/serving/releases/download/knative-v1.22.1/serving-core.yaml +--- +# Copyright 2018 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: Namespace +metadata: + name: knative-serving + labels: + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" +--- +# Copyright 2023 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +kind: Role +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: knative-serving-activator + namespace: knative-serving + labels: + serving.knative.dev/controller: "true" + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +rules: + - apiGroups: [""] + resources: ["configmaps", "secrets"] + verbs: ["get", "list", "watch"] + - apiGroups: [""] + resources: ["secrets"] + verbs: ["get", "list", "watch"] + resourceNames: ["routing-serving-certs", "knative-serving-certs"] +--- +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: knative-serving-activator-cluster + labels: + serving.knative.dev/controller: "true" + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +rules: + - apiGroups: [""] + resources: ["services", "endpoints"] + verbs: ["get", "list", "watch"] + - apiGroups: ["serving.knative.dev"] + resources: ["revisions"] + verbs: ["get", "list", "watch"] +--- +# Copyright 2019 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# Use this aggregated ClusterRole when you need readonly access to "Addressables" +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + # Named like this to avoid clashing with eventing's existing `addressable-resolver` role + # (which should be identical, but isn't guaranteed to be installed alongside serving). + name: knative-serving-aggregated-addressable-resolver + labels: + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +aggregationRule: + clusterRoleSelectors: + - matchLabels: + duck.knative.dev/addressable: "true" +--- +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: knative-serving-addressable-resolver + labels: + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving + # Labeled to facilitate aggregated cluster roles that act on Addressables. + duck.knative.dev/addressable: "true" +# Do not use this role directly. These rules will be added to the "addressable-resolver" role. +rules: + - apiGroups: + - serving.knative.dev + resources: + - routes + - routes/status + - services + - services/status + verbs: + - get + - list + - watch +--- +# Copyright 2019 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: knative-serving-namespaced-admin + labels: + rbac.authorization.k8s.io/aggregate-to-admin: "true" + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +rules: + - apiGroups: ["serving.knative.dev"] + resources: ["*"] + verbs: ["*"] + - apiGroups: ["networking.internal.knative.dev", "autoscaling.internal.knative.dev", "caching.internal.knative.dev"] + resources: ["*"] + verbs: ["get", "list", "watch"] +--- +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: knative-serving-namespaced-edit + labels: + rbac.authorization.k8s.io/aggregate-to-edit: "true" + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +rules: + - apiGroups: ["serving.knative.dev"] + resources: ["*"] + verbs: ["create", "update", "patch", "delete"] + - apiGroups: ["networking.internal.knative.dev", "autoscaling.internal.knative.dev", "caching.internal.knative.dev"] + resources: ["*"] + verbs: ["get", "list", "watch"] +--- +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: knative-serving-namespaced-view + labels: + rbac.authorization.k8s.io/aggregate-to-view: "true" + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +rules: + - apiGroups: ["serving.knative.dev", "networking.internal.knative.dev", "autoscaling.internal.knative.dev", "caching.internal.knative.dev"] + resources: ["*"] + verbs: ["get", "list", "watch"] +--- +# Copyright 2019 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: knative-serving-core + labels: + serving.knative.dev/controller: "true" + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +rules: + - apiGroups: [""] + resources: ["pods", "namespaces", "secrets", "configmaps", "endpoints", "services", "events", "serviceaccounts"] + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] + - apiGroups: [""] + resources: ["endpoints/restricted"] # Permission for RestrictedEndpointsAdmission + verbs: ["create"] + - apiGroups: ["discovery.k8s.io"] + resources: ["endpointslices/restricted"] # Permission for RestrictedEndpointsAdmission + verbs: ["create"] + - apiGroups: [""] + resources: ["namespaces/finalizers"] # finalizers are needed for the owner reference of the webhook + verbs: ["update"] + - apiGroups: ["discovery.k8s.io"] + resources: ["endpointslices"] + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] + - apiGroups: ["apps"] + resources: ["deployments", "deployments/finalizers"] # finalizers are needed for the owner reference of the webhook + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] + - apiGroups: ["admissionregistration.k8s.io"] + resources: ["mutatingwebhookconfigurations", "validatingwebhookconfigurations"] + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] + - apiGroups: ["apiextensions.k8s.io"] + resources: ["customresourcedefinitions", "customresourcedefinitions/status"] + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] + - apiGroups: ["autoscaling"] + resources: ["horizontalpodautoscalers"] + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] + - apiGroups: ["coordination.k8s.io"] + resources: ["leases"] + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] + - apiGroups: ["serving.knative.dev", "autoscaling.internal.knative.dev", "networking.internal.knative.dev"] + resources: ["*", "*/status", "*/finalizers"] + verbs: ["get", "list", "create", "update", "delete", "deletecollection", "patch", "watch"] + - apiGroups: ["caching.internal.knative.dev"] + resources: ["images"] + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] + - apiGroups: ["cert-manager.io"] + resources: ["certificates", "clusterissuers", "certificaterequests", "issuers"] + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] + - apiGroups: ["acme.cert-manager.io"] + resources: ["challenges"] + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] + - apiGroups: ["rbac.authorization.k8s.io"] + resources: ["clusterroles"] + verbs: ["delete"] + resourceNames: ["knative-serving-certmanager"] + - apiGroups: ["*"] + resources: ["*/scale"] + verbs: ["patch"] +--- +# Copyright 2019 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: knative-serving-podspecable-binding + labels: + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving + # Labeled to facilitate aggregated cluster roles that act on PodSpecables. + duck.knative.dev/podspecable: "true" +# Do not use this role directly. These rules will be added to the "podspecable-binder" role. +rules: + - apiGroups: + - serving.knative.dev + resources: + - configurations + - services + verbs: + - list + - watch + - patch +--- +# Copyright 2018 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ServiceAccount +metadata: + name: controller + namespace: knative-serving + labels: + app.kubernetes.io/component: controller + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" +--- +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: knative-serving-admin + labels: + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" +aggregationRule: + clusterRoleSelectors: + - matchLabels: + serving.knative.dev/controller: "true" +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: knative-serving-controller-admin + labels: + app.kubernetes.io/component: controller + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" +subjects: + - kind: ServiceAccount + name: controller + namespace: knative-serving +roleRef: + kind: ClusterRole + name: knative-serving-admin + apiGroup: rbac.authorization.k8s.io +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: knative-serving-controller-addressable-resolver + labels: + app.kubernetes.io/component: controller + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" +subjects: + - kind: ServiceAccount + name: controller + namespace: knative-serving +roleRef: + kind: ClusterRole + name: knative-serving-aggregated-addressable-resolver + apiGroup: rbac.authorization.k8s.io +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: activator + namespace: knative-serving + labels: + app.kubernetes.io/component: activator + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: knative-serving-activator + namespace: knative-serving + labels: + app.kubernetes.io/component: activator + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" +subjects: + - kind: ServiceAccount + name: activator + namespace: knative-serving +roleRef: + kind: Role + name: knative-serving-activator + apiGroup: rbac.authorization.k8s.io +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: knative-serving-activator-cluster + labels: + app.kubernetes.io/component: activator + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" +subjects: + - kind: ServiceAccount + name: activator + namespace: knative-serving +roleRef: + kind: ClusterRole + name: knative-serving-activator-cluster + apiGroup: rbac.authorization.k8s.io +--- +apiVersion: networking.internal.knative.dev/v1alpha1 +kind: Certificate +metadata: + annotations: + networking.knative.dev/certificate.class: cert-manager.certificate.networking.knative.dev + labels: + networking.knative.dev/certificate-type: system-internal + name: routing-serving-certs + namespace: knative-serving +spec: + dnsNames: + - kn-routing + - data-plane.knative.dev # for reverse-compatibility with net-* implementations that do not work with multi-SANs + secretName: routing-serving-certs +--- +# Copyright 2018 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: caching.internal.knative.dev/v1alpha1 +kind: Image +metadata: + name: queue-proxy + namespace: knative-serving + labels: + app.kubernetes.io/component: queue-proxy + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" +spec: + # This is the Go import path for the binary that is containerized + # and substituted here. + image: gcr.io/knative-releases/knative.dev/serving/cmd/queue@sha256:b1af8bda6c1d32b1cf5fbf8f1f6068c5007a5cebf091039fdea83b88b1fd87f4 +--- +# Copyright 2018 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-autoscaler + namespace: knative-serving + labels: + app.kubernetes.io/component: autoscaler + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" + annotations: + knative.dev/example-checksum: "c727b3e8" +data: + _example: | + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this example block and unindented to be in the data block + # to actually change the configuration. + + # The Revision ContainerConcurrency field specifies the maximum number + # of requests the Container can handle at once. Container concurrency + # target percentage is how much of that maximum to use in a stable + # state. E.g. if a Revision specifies ContainerConcurrency of 10, then + # the Autoscaler will try to maintain 7 concurrent connections per pod + # on average. + # Note: this limit will be applied to container concurrency set at every + # level (ConfigMap, Revision Spec or Annotation). + # For legacy and backwards compatibility reasons, this value also accepts + # fractional values in (0, 1] interval (i.e. 0.7 ⇒ 70%). + # Thus minimal percentage value must be greater than 1.0, or it will be + # treated as a fraction. + # NOTE: that this value does not affect actual number of concurrent requests + # the user container may receive, but only the average number of requests + # that the revision pods will receive. + container-concurrency-target-percentage: "70" + + # The container concurrency target default is what the Autoscaler will + # try to maintain when concurrency is used as the scaling metric for the + # Revision and the Revision specifies unlimited concurrency. + # When revision explicitly specifies container concurrency, that value + # will be used as a scaling target for autoscaler. + # When specifying unlimited concurrency, the autoscaler will + # horizontally scale the application based on this target concurrency. + # This is what we call "soft limit" in the documentation, i.e. it only + # affects number of pods and does not affect the number of requests + # individual pod processes. + # The value must be a positive number such that the value multiplied + # by container-concurrency-target-percentage is greater than 0.01. + # NOTE: that this value will be adjusted by application of + # container-concurrency-target-percentage, i.e. by default + # the system will target on average 70 concurrent requests + # per revision pod. + # NOTE: Only one metric can be used for autoscaling a Revision. + container-concurrency-target-default: "100" + + # The requests per second (RPS) target default is what the Autoscaler will + # try to maintain when RPS is used as the scaling metric for a Revision and + # the Revision specifies unlimited RPS. Even when specifying unlimited RPS, + # the autoscaler will horizontally scale the application based on this + # target RPS. + # Must be greater than 1.0. + # NOTE: Only one metric can be used for autoscaling a Revision. + requests-per-second-target-default: "200" + + # The target burst capacity specifies the size of burst in concurrent + # requests that the system operator expects the system will receive. + # Autoscaler will try to protect the system from queueing by introducing + # Activator in the request path if the current spare capacity of the + # service is less than this setting. + # If this setting is 0, then Activator will be in the request path only + # when the revision is scaled to 0. + # If this setting is > 0 and container-concurrency-target-percentage is + # 100% or 1.0, then activator will always be in the request path. + # -1 denotes unlimited target-burst-capacity and activator will always + # be in the request path. + # Other negative values are invalid. + target-burst-capacity: "211" + + # When operating in a stable mode, the autoscaler operates on the + # average concurrency over the stable window. + # Stable window must be in whole seconds. + stable-window: "60s" + + # When observed average concurrency during the panic window reaches + # panic-threshold-percentage the target concurrency, the autoscaler + # enters panic mode. When operating in panic mode, the autoscaler + # scales on the average concurrency over the panic window which is + # panic-window-percentage of the stable-window. + # Must be in the [1, 100] range. + # When computing the panic window it will be rounded to the closest + # whole second, at least 1s. + panic-window-percentage: "10.0" + + # The percentage of the container concurrency target at which to + # enter panic mode when reached within the panic window. + panic-threshold-percentage: "200.0" + + # Max scale up rate limits the rate at which the autoscaler will + # increase pod count. It is the maximum ratio of desired pods versus + # observed pods. + # Cannot be less or equal to 1. + # I.e with value of 2.0 the number of pods can at most go N to 2N + # over single Autoscaler period (2s), but at least N to + # N+1, if Autoscaler needs to scale up. + max-scale-up-rate: "1000.0" + + # Max scale down rate limits the rate at which the autoscaler will + # decrease pod count. It is the maximum ratio of observed pods versus + # desired pods. + # Cannot be less or equal to 1. + # I.e. with value of 2.0 the number of pods can at most go N to N/2 + # over single Autoscaler evaluation period (2s), but at + # least N to N-1, if Autoscaler needs to scale down. + max-scale-down-rate: "2.0" + + # Scale to zero feature flag. + enable-scale-to-zero: "true" + + # Scale to zero grace period is the time an inactive revision is left + # running before it is scaled to zero (must be positive, but recommended + # at least a few seconds if running with mesh networking). + # This is the upper limit and is provided not to enforce timeout after + # the revision stopped receiving requests for stable window, but to + # ensure network reprogramming to put activator in the path has completed. + # If the system determines that a shorter period is satisfactory, + # then the system will only wait that amount of time before scaling to 0. + # NOTE: this period might actually be 0, if activator has been + # in the request path sufficiently long. + # If there is necessity for the last pod to linger longer use + # scale-to-zero-pod-retention-period flag. + scale-to-zero-grace-period: "30s" + + # Scale to zero pod retention period defines the minimum amount + # of time the last pod will remain after Autoscaler has decided to + # scale to zero. + # This flag is for the situations where the pod startup is very expensive + # and the traffic is bursty (requiring smaller windows for fast action), + # but patchy. + # The larger of this flag and `scale-to-zero-grace-period` will effectively + # determine how the last pod will hang around. + scale-to-zero-pod-retention-period: "0s" + + # pod-autoscaler-class specifies the default pod autoscaler class + # that should be used if none is specified. If omitted, + # the Knative Pod Autoscaler (KPA) is used by default. + pod-autoscaler-class: "kpa.autoscaling.knative.dev" + + # The capacity of a single activator task. + # The `unit` is one concurrent request proxied by the activator. + # activator-capacity must be at least 1. + # This value is used for computation of the Activator subset size. + # See the algorithm here: https://bit.ly/38XiCZ3. + # TODO(vagababov): tune after actual benchmarking. + activator-capacity: "100.0" + + # initial-scale is the cluster-wide default value for the initial target + # scale of a revision after creation, unless overridden by the + # "autoscaling.knative.dev/initialScale" annotation. + # This value must be greater than 0 unless allow-zero-initial-scale is true. + initial-scale: "1" + + # allow-zero-initial-scale controls whether either the cluster-wide initial-scale flag, + # or the "autoscaling.knative.dev/initialScale" annotation, can be set to 0. + allow-zero-initial-scale: "false" + + # min-scale is the cluster-wide default value for the min scale of a revision, + # unless overridden by the "autoscaling.knative.dev/minScale" annotation. + min-scale: "0" + + # max-scale is the cluster-wide default value for the max scale of a revision, + # unless overridden by the "autoscaling.knative.dev/maxScale" annotation. + # If set to 0, the revision has no maximum scale. + max-scale: "0" + + # scale-down-delay is the amount of time that must pass at reduced + # concurrency before a scale down decision is applied. This can be useful, + # for example, to maintain replica count and avoid a cold start penalty if + # more requests come in within the scale down delay period. + # The default, 0s, imposes no delay at all. + scale-down-delay: "0s" + + # max-scale-limit sets the maximum permitted value for the max scale of a revision. + # When this is set to a positive value, a revision with a maxScale above that value + # (including a maxScale of "0" = unlimited) is disallowed. + # A value of zero (the default) allows any limit, including unlimited. + max-scale-limit: "0" +--- +# Copyright 2020 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-certmanager + namespace: knative-serving + labels: + app.kubernetes.io/name: knative-serving + app.kubernetes.io/component: controller + app.kubernetes.io/version: "1.22.1" + networking.knative.dev/certificate-provider: cert-manager + annotations: + knative.dev/example-checksum: "b7a9a602" +data: + _example: | + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this block and unindented to actually change the configuration. + + # issuerRef is a reference to the issuer for external-domain certificates used for ingress. + # IssuerRef should be either `ClusterIssuer` or `Issuer`. + # Please refer `IssuerRef` in https://cert-manager.io/docs/concepts/issuer/ + # for more details about IssuerRef configuration. + # If the issuerRef is not specified, the self-signed `knative-selfsigned-issuer` ClusterIssuer is used. + issuerRef: | + kind: ClusterIssuer + name: letsencrypt-issuer + + # clusterLocalIssuerRef is a reference to the issuer for cluster-local-domain certificates used for ingress. + # clusterLocalIssuerRef should be either `ClusterIssuer` or `Issuer`. + # Please refer `IssuerRef` in https://cert-manager.io/docs/concepts/issuer/ + # for more details about ClusterInternalIssuerRef configuration. + # If the clusterLocalIssuerRef is not specified, the self-signed `knative-selfsigned-issuer` ClusterIssuer is used. + clusterLocalIssuerRef: | + kind: ClusterIssuer + name: your-company-issuer + + # systemInternalIssuerRef is a reference to the issuer for certificates for system-internal-tls certificates used by Knative internal components. + # systemInternalIssuerRef should be either `ClusterIssuer` or `Issuer`. + # Please refer `IssuerRef` in https://cert-manager.io/docs/concepts/issuer/ + # for more details about ClusterInternalIssuerRef configuration. + # If the systemInternalIssuerRef is not specified, the self-signed `knative-selfsigned-issuer` ClusterIssuer is used. + systemInternalIssuerRef: | + kind: ClusterIssuer + name: knative-selfsigned-issuer +--- +# Copyright 2019 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-defaults + namespace: knative-serving + labels: + app.kubernetes.io/name: knative-serving + app.kubernetes.io/component: controller + app.kubernetes.io/version: "1.22.1" + annotations: + knative.dev/example-checksum: "5b64ff5c" +data: + _example: | + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this example block and unindented to be in the data block + # to actually change the configuration. + + # revision-timeout-seconds contains the default number of + # seconds to use for the revision's per-request timeout, if + # none is specified. + revision-timeout-seconds: "300" # 5 minutes + + # max-revision-timeout-seconds contains the maximum number of + # seconds that can be used for revision-timeout-seconds. + # This value must be greater than or equal to revision-timeout-seconds. + # If omitted, the system default is used (600 seconds). + # + # If this value is increased, the activator's terminationGracePeriodSeconds + # should also be increased to prevent in-flight requests being disrupted. + max-revision-timeout-seconds: "600" # 10 minutes + + # revision-response-start-timeout-seconds contains the default number of + # seconds a request will be allowed to stay open while waiting to + # receive any bytes from the user's application, if none is specified. + # + # This defaults to 'revision-timeout-seconds' + revision-response-start-timeout-seconds: "300" + + # revision-idle-timeout-seconds contains the default number of + # seconds a request will be allowed to stay open while not receiving any + # bytes from the user's application, if none is specified. + revision-idle-timeout-seconds: "0" # infinite + + # revision-cpu-request contains the cpu allocation to assign + # to revisions by default. If omitted, no value is specified + # and the system default is used. + # Below is an example of setting revision-cpu-request. + # By default, it is not set by Knative. + revision-cpu-request: "400m" # 0.4 of a CPU (aka 400 milli-CPU) + + # revision-memory-request contains the memory allocation to assign + # to revisions by default. If omitted, no value is specified + # and the system default is used. + # Below is an example of setting revision-memory-request. + # By default, it is not set by Knative. + revision-memory-request: "100M" # 100 megabytes of memory + + # revision-ephemeral-storage-request contains the ephemeral storage + # allocation to assign to revisions by default. If omitted, no value is + # specified and the system default is used. + revision-ephemeral-storage-request: "500M" # 500 megabytes of storage + + # revision-cpu-limit contains the cpu allocation to limit + # revisions to by default. If omitted, no value is specified + # and the system default is used. + # Below is an example of setting revision-cpu-limit. + # By default, it is not set by Knative. + revision-cpu-limit: "1000m" # 1 CPU (aka 1000 milli-CPU) + + # revision-memory-limit contains the memory allocation to limit + # revisions to by default. If omitted, no value is specified + # and the system default is used. + # Below is an example of setting revision-memory-limit. + # By default, it is not set by Knative. + revision-memory-limit: "200M" # 200 megabytes of memory + + # revision-ephemeral-storage-limit contains the ephemeral storage + # allocation to limit revisions to by default. If omitted, no value is + # specified and the system default is used. + revision-ephemeral-storage-limit: "750M" # 750 megabytes of storage + + # container-name-template contains a template for the default + # container name, if none is specified. This field supports + # Go templating and is supplied with the ObjectMeta of the + # enclosing Service or Configuration, so values such as + # {{.Name}} are also valid. + container-name-template: "user-container" + + # init-container-name-template contains a template for the default + # init container name, if none is specified. This field supports + # Go templating and is supplied with the ObjectMeta of the + # enclosing Service or Configuration, so values such as + # {{.Name}} are also valid. + init-container-name-template: "init-container" + + # container-concurrency specifies the maximum number + # of requests the Container can handle at once, and requests + # above this threshold are queued. Setting a value of zero + # disables this throttling and lets through as many requests as + # the pod receives. + container-concurrency: "0" + + # The container concurrency max limit is an operator setting ensuring that + # the individual revisions cannot have arbitrary large concurrency + # values, or autoscaling targets. `container-concurrency` default setting + # must be at or below this value. + # + # Must be greater than 1. + # + # Note: even with this set, a user can choose a containerConcurrency + # of 0 (i.e. unbounded) unless allow-container-concurrency-zero is + # set to "false". + container-concurrency-max-limit: "1000" + + # allow-container-concurrency-zero controls whether users can + # specify 0 (i.e. unbounded) for containerConcurrency. + allow-container-concurrency-zero: "true" + + # enable-service-links specifies the default value used for the + # enableServiceLinks field of the PodSpec, when it is omitted by the user. + # See: https://kubernetes.io/docs/concepts/services-networking/connect-applications-service/#accessing-the-service + # + # This is a tri-state flag with possible values of (true|false|default). + # + # In environments with large number of services it is suggested + # to set this value to `false`. + # See https://github.com/knative/serving/issues/8498. + enable-service-links: "false" +--- +# Copyright 2019 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-deployment + namespace: knative-serving + labels: + app.kubernetes.io/name: knative-serving + app.kubernetes.io/component: controller + app.kubernetes.io/version: "1.22.1" + annotations: + knative.dev/example-checksum: "555b4826" +data: + # This is the Go import path for the binary that is containerized + # and substituted here. + queue-sidecar-image: gcr.io/knative-releases/knative.dev/serving/cmd/queue@sha256:b1af8bda6c1d32b1cf5fbf8f1f6068c5007a5cebf091039fdea83b88b1fd87f4 + _example: |- + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this example block and unindented to be in the data block + # to actually change the configuration. + + # List of repositories for which tag to digest resolving should be skipped + registries-skipping-tag-resolving: "kind.local,ko.local,dev.local" + + # Maximum time allowed for an image's digests to be resolved. + digest-resolution-timeout: "10s" + + # Duration we wait for the deployment to be ready before considering it failed. + progress-deadline: "600s" + + # Sets the queue proxy's CPU request. + # If omitted, a default value (currently "25m"), is used. + queue-sidecar-cpu-request: "25m" + + # Sets the queue proxy's CPU limit. + # If omitted, a default value (currently "1000m"), is used when + # `queueproxy.resource-defaults` is set to `Enabled`. + queue-sidecar-cpu-limit: "1000m" + + # Sets the queue proxy's memory request. + # If omitted, a default value (currently "400Mi"), is used when + # `queueproxy.resource-defaults` is set to `Enabled`. + queue-sidecar-memory-request: "400Mi" + + # Sets the queue proxy's memory limit. + # If omitted, a default value (currently "800Mi"), is used when + # `queueproxy.resource-defaults` is set to `Enabled`. + queue-sidecar-memory-limit: "800Mi" + + # Sets the queue proxy's ephemeral storage request. + # If omitted, no value is specified and the system default is used. + queue-sidecar-ephemeral-storage-request: "512Mi" + + # Sets the queue proxy's ephemeral storage limit. + # If omitted, no value is specified and the system default is used. + queue-sidecar-ephemeral-storage-limit: "1024Mi" + + # Sets tokens associated with specific audiences for queue proxy - used by QPOptions + # + # For example, to add the `service-x` audience: + # queue-sidecar-token-audiences: "service-x" + # Also supports a list of audiences, for example: + # queue-sidecar-token-audiences: "service-x,service-y" + # If omitted, or empty, no tokens are created + queue-sidecar-token-audiences: "" + + # Sets rootCA for the queue proxy - used by QPOptions + # If omitted, or empty, no rootCA is added to the golang rootCAs + queue-sidecar-rootca: "" + + # Sets the minimum TLS version for the queue proxy sidecar's TLS server. + # Accepted values: "1.2", "1.3". Default is "1.3" if not specified. + queue-sidecar-tls-min-version: "" + + # Sets the maximum TLS version for the queue proxy sidecar's TLS server. + # Accepted values: "1.2", "1.3". If omitted, the Go default is used. + queue-sidecar-tls-max-version: "" + + # Sets the cipher suites for the queue proxy sidecar's TLS server. + # Comma-separated list of cipher suite names (e.g. "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"). + # If omitted, the Go default cipher suites are used. + # Note: cipher suites are not configurable in TLS 1.3. + queue-sidecar-tls-cipher-suites: "" + + # Sets the elliptic curve preferences for the queue proxy sidecar's TLS server. + # Comma-separated list of curve names (e.g. "X25519,CurveP256"). + # If omitted, the Go default curves are used. + queue-sidecar-tls-curve-preferences: "" + + # If set, it automatically configures pod anti-affinity requirements for all Knative services. + # It employs the `preferredDuringSchedulingIgnoredDuringExecution` weighted pod affinity term, + # aligning with the Knative revision label. It yields the configuration below in all workloads' deployments: + # ` + # affinity: + # podAntiAffinity: + # preferredDuringSchedulingIgnoredDuringExecution: + # - podAffinityTerm: + # topologyKey: kubernetes.io/hostname + # labelSelector: + # matchLabels: + # serving.knative.dev/revision: {{revision-name}} + # weight: 100 + # ` + # This may be "none" or "prefer-spread-revision-over-nodes" (default) + # default-affinity-type: "prefer-spread-revision-over-nodes" + + # runtime-class-name contains the selector for which runtimeClassName + # is selected to put in a revision. + # By default, it is not set by Knative. + # + # Example: + # runtime-class-name: | + # "": + # selector: + # use-default-runc: "yes" + # kata: {} + # gvisor: + # selector: + # use-gvisor: "please" + runtime-class-name: "" + + # pod-is-always-schedulable can be used to define that Pods in the system will always be + # scheduled, and a Revision should not be marked unschedulable. + # Setting this to `true` makes sense if you have cluster-autoscaling set up for your cluster + # where unschedulable Pods trigger the addition of a new Node and are therefore a short and + # transient state. + # + # See https://github.com/knative/serving/issues/14862 + pod-is-always-schedulable: "false" +--- +# Copyright 2018 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-domain + namespace: knative-serving + labels: + app.kubernetes.io/name: knative-serving + app.kubernetes.io/component: controller + app.kubernetes.io/version: "1.22.1" + annotations: + knative.dev/example-checksum: "26c09de5" +data: + _example: | + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this example block and unindented to be in the data block + # to actually change the configuration. + + # Default value for domain. + # Routes having the cluster domain suffix (by default 'svc.cluster.local') + # will not be exposed through Ingress. You can define your own label + # selector to assign that domain suffix to your Route here, or you can set + # the label + # "networking.knative.dev/visibility=cluster-local" + # to achieve the same effect. This shows how to make routes having + # the label app=secret only exposed to the local cluster. + svc.cluster.local: | + selector: + app: secret + + # These are example settings of domain. + # example.com will be used for all routes, but it is the least-specific rule so it + # will only be used if no other domain matches. + example.com: | + + # example.org will be used for routes having app=nonprofit. + example.org: | + selector: + app: nonprofit +--- +# Copyright 2020 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-features + namespace: knative-serving + labels: + app.kubernetes.io/name: knative-serving + app.kubernetes.io/component: controller + app.kubernetes.io/version: "1.22.1" + annotations: + knative.dev/example-checksum: "bee75b26" +data: + _example: |- + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this example block and unindented to be in the data block + # to actually change the configuration. + + # Default SecurityContext settings to secure-by-default values + # if unset. + # + # Disabled - do nothing; no security options are applied + # AllowRootBounded - Applies secure defaults without enforcing strict policies; sets seccompProfile + # to RuntimeDefault and drops all capabilities + # Enabled - Enforces security defaults; sets seccompProfile to RuntimeDefault, drops all capabilities, + # and sets runAsNonRoot to true if not already specified. + secure-pod-defaults: "disabled" + + # Indicates whether multi container support is enabled + # + # WARNING: Cannot safely be disabled once enabled. + # See: https://knative.dev/docs/serving/configuration/feature-flags/#multiple-containers + multi-container: "enabled" + + # Indicates whether multi container probing is enabled + # + # WARNING: Cannot safely be disabled once enabled. + # See: https://knative.dev/docs/serving/configuration/feature-flags/#multiple-container-probing + multi-container-probing: "disabled" + + # Indicates whether Kubernetes affinity support is enabled + # + # WARNING: Cannot safely be disabled once enabled. + # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-node-affinity + kubernetes.podspec-affinity: "disabled" + + # Indicates whether Kubernetes topologySpreadConstraints support is enabled + # + # WARNING: Cannot safely be disabled once enabled. + # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-topology-spread-constraints + kubernetes.podspec-topologyspreadconstraints: "disabled" + + # Indicates whether Kubernetes hostAliases support is enabled + # + # WARNING: Cannot safely be disabled once enabled. + # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-host-aliases + kubernetes.podspec-hostaliases: "disabled" + + # Indicates whether Kubernetes nodeSelector support is enabled + # + # WARNING: Cannot safely be disabled once enabled. + # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-node-selector + kubernetes.podspec-nodeselector: "disabled" + + # Indicates whether Kubernetes tolerations support is enabled + # + # WARNING: Cannot safely be disabled once enabled + # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-toleration + kubernetes.podspec-tolerations: "disabled" + + # Indicates whether Kubernetes FieldRef support is enabled + # + # WARNING: Cannot safely be disabled once enabled. + # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-fieldref + kubernetes.podspec-fieldref: "disabled" + + # Indicates whether Kubernetes RuntimeClassName support is enabled + # + # WARNING: Cannot safely be disabled once enabled. + # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-runtime-class + kubernetes.podspec-runtimeclassname: "disabled" + + # Indicates whether Kubernetes DNSPolicy support is enabled + # + # WARNING: Cannot safely be disabled once enabled. + # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-dnspolicy + kubernetes.podspec-dnspolicy: "disabled" + + # Indicates whether Kubernetes DNSConfig support is enabled + # + # WARNING: Cannot safely be disabled once enabled. + # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-dnsconfig + kubernetes.podspec-dnsconfig: "disabled" + + # This feature allows end-users to set a subset of fields on the Pod's SecurityContext + # + # When set to "enabled" or "allowed" it allows the following + # PodSecurityContext properties: + # - FSGroup + # - RunAsGroup + # - RunAsNonRoot + # - SupplementalGroups + # - RunAsUser + # - SeccompProfile + # + # This feature flag should be used with caution as the PodSecurityContext + # properties may have a side-effect on non-user sidecar containers that come + # from Knative or your service mesh + # + # WARNING: Cannot safely be disabled once enabled. + # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-security-context + kubernetes.podspec-securitycontext: "disabled" + + # Indicated whether sharing the process namespace via ShareProcessNamespace pod spec is allowed. + # This can be especially useful for sharing data from images directly between sidecars + # + # See: https://knative.dev/docs/serving/configuration/feature-flags/#kubernetes-share-process-namespace + kubernetes.podspec-shareprocessnamespace: "disabled" + + # Indicates whether hostIPC support is enabled + # + # WARNING: Cannot safely be disabled once enabled. + # See https://knative.dev/docs/serving/configuration/feature-flags/#kubernetes-host-ipc + kubernetes.podspec-hostipc: "disabled" + + # Indicates whether hostPID support is enabled + # + # WARNING: Cannot safely be disabled once enabled. + # See https://knative.dev/docs/serving/configuration/feature-flags/#kubernetes-host-pid + kubernetes.podspec-hostpid: "disabled" + + # Indicates whether hostNetwork support is enabled + # + # WARNING: Cannot safely be disabled once enabled. + # See See https://knative.dev/docs/serving/configuration/feature-flags/#kubernetes-host-network + kubernetes.podspec-hostnetwork: "disabled" + + # Indicates whether Kubernetes PriorityClassName support is enabled + # + # WARNING: Cannot safely be disabled once enabled. + # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-priority-class-name + kubernetes.podspec-priorityclassname: "disabled" + + # Indicates whether Kubernetes SchedulerName support is enabled + # + # WARNING: Cannot safely be disabled once enabled. + # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-scheduler-name + kubernetes.podspec-schedulername: "disabled" + + # This feature flag allows end-users to add a subset of capabilities on the Pod's SecurityContext. + # + # When set to "enabled" or "allowed" it allows capabilities to be added to the container. + # For a list of possible capabilities, see https://man7.org/linux/man-pages/man7/capabilities.7.html + kubernetes.containerspec-addcapabilities: "disabled" + + + # Controls whether tag header based routing feature are enabled or not. + # 1. Enabled: enabling tag header based routing + # 2. Disabled: disabling tag header based routing + # See: https://knative.dev/docs/serving/feature-flags/#tag-header-based-routing + tag-header-based-routing: "disabled" + + # Controls whether http2 auto-detection should be enabled or not. + # 1. Enabled: http2 connection will be attempted via upgrade. + # 2. Disabled: http2 connection will only be attempted when port name is set to "h2c". + autodetect-http2: "disabled" + + # Controls whether volume support for EmptyDir is enabled or not. + # 1. Enabled: enabling EmptyDir volume support + # 2. Disabled: disabling EmptyDir volume support + kubernetes.podspec-volumes-emptydir: "enabled" + + # Controls whether volume support for image is enabled or not. + # 1. Enabled: enabling image volume support + # 2. Disabled: disabling image volume support + kubernetes.podspec-volumes-image: "disabled" + + # Controls whether volume support for HostPath is enabled or not. + # WARNING: Cannot safely be disabled once enabled. + # WARNING: If you can avoid using a hostPath volume, you should. + # Please read https://kubernetes.io/docs/concepts/storage/volumes/#hostpath before enabling this feature. + # 1. Enabled: enabling HostPath volume support + # 2. Disabled: disabling HostPath volume support + kubernetes.podspec-volumes-hostpath: "disabled" + + # Controls whether volume support for CSI is enabled or not. + # 1. Enabled: enabling CSI volume support + # 2. Disabled: disabling CSI volume support + kubernetes.podspec-volumes-csi: "disabled" + + # Controls whether init containers support is enabled or not. + # 1. Enabled: enabling init containers support + # 2. Disabled: disabling init containers support + kubernetes.podspec-init-containers: "disabled" + + # Controls whether persistent volume claim support is enabled or not. + # 1. Enabled: enabling persistent volume claim support + # 2. Disabled: disabling persistent volume claim support + kubernetes.podspec-persistent-volume-claim: "disabled" + + # Controls whether write access for persistent volumes is enabled or not. + # 1. Enabled: enabling write access for persistent volumes + # 2. Disabled: disabling write access for persistent volumes + kubernetes.podspec-persistent-volume-write: "disabled" + + # Controls whether volume mount propagation support is enabled or not. + # 1. Enabled: enabling volume mount propagation support + # 2. Disabled: disabling volume mount propagation support + kubernetes.podspec-volumes-mount-propagation: "disabled" + + # Controls if the queue proxy podInfo feature is enabled, allowed or disabled + # + # This feature should be enabled/allowed when using queue proxy Options (Extensions) + # Enabling will mount a podInfo volume to the queue proxy container. + # The volume will contains an 'annotations' file (from the pod's annotation field). + # The annotations in this file include the Service annotations set by the client creating the service. + # If mounted, the annotations can be accessed by queue proxy extensions at /etc/podinfo/annotations + # + # 1. "enabled": always mount a podInfo volume + # 2. "disabled": never mount a podInfo volume + # 3. "allowed": by default, do not mount a podInfo volume + # However, a client may mount the podInfo volume on an individual Service by attaching + # the following metadata annotation to the Service: "features.knative.dev/queueproxy-podinfo":"enabled". + # + # NOTE THAT THIS IS AN EXPERIMENTAL / ALPHA FEATURE + queueproxy.mount-podinfo: "disabled" + + # Default queue proxy resource requests and limits to good values for most cases if set. + queueproxy.resource-defaults: "disabled" +--- +# Copyright 2018 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-gc + namespace: knative-serving + labels: + app.kubernetes.io/name: knative-serving + app.kubernetes.io/component: controller + app.kubernetes.io/version: "1.22.1" + annotations: + knative.dev/example-checksum: "aa3813a8" +data: + _example: | + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this example block and unindented to be in the data block + # to actually change the configuration. + + # --------------------------------------- + # Garbage Collector Settings + # --------------------------------------- + # + # Active + # * Revisions which are referenced by a Route are considered active. + # * Individual revisions may be marked with the annotation + # "serving.knative.dev/no-gc":"true" to be permanently considered active. + # * Active revisions are not considered for GC. + # Retention + # * Revisions are retained if they are any of the following: + # 1. Active + # 2. Were created within "retain-since-create-time" + # 3. Were last referenced by a route within + # "retain-since-last-active-time" + # 4. There are fewer than "min-non-active-revisions" + # If none of these conditions are met, or if the count of revisions exceed + # "max-non-active-revisions", they will be deleted by GC. + # The special value "disabled" may be used to turn off these limits. + # + # Example config to immediately collect any inactive revision: + # min-non-active-revisions: "0" + # max-non-active-revisions: "0" + # retain-since-create-time: "disabled" + # retain-since-last-active-time: "disabled" + # + # Example config to always keep around the last ten non-active revisions: + # retain-since-create-time: "disabled" + # retain-since-last-active-time: "disabled" + # max-non-active-revisions: "10" + # + # Example config to disable all garbage collection: + # retain-since-create-time: "disabled" + # retain-since-last-active-time: "disabled" + # max-non-active-revisions: "disabled" + # + # Example config to keep recently deployed or active revisions, + # always maintain the last two in case of rollback, and prevent + # burst activity from exploding the count of old revisions: + # retain-since-create-time: "48h" + # retain-since-last-active-time: "15h" + # min-non-active-revisions: "2" + # max-non-active-revisions: "1000" + + # Duration since creation before considering a revision for GC or "disabled". + retain-since-create-time: "48h" + + # Duration since active before considering a revision for GC or "disabled". + retain-since-last-active-time: "15h" + + # Minimum number of non-active revisions to retain. + min-non-active-revisions: "20" + + # Maximum number of non-active revisions to retain + # or "disabled" to disable any maximum limit. + max-non-active-revisions: "1000" +--- +# Copyright 2020 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-leader-election + namespace: knative-serving + labels: + app.kubernetes.io/name: knative-serving + app.kubernetes.io/component: controller + app.kubernetes.io/version: "1.22.1" + annotations: + knative.dev/example-checksum: "f4b71f57" +data: + _example: | + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this example block and unindented to be in the data block + # to actually change the configuration. + + # lease-duration is how long non-leaders will wait to try to acquire the + # lock; 15 seconds is the value used by core kubernetes controllers. + lease-duration: "60s" + + # renew-deadline is how long a leader will try to renew the lease before + # giving up; 10 seconds is the value used by core kubernetes controllers. + renew-deadline: "40s" + + # retry-period is how long the leader election client waits between tries of + # actions; 2 seconds is the value used by core kubernetes controllers. + retry-period: "10s" + + # buckets is the number of buckets used to partition key space of each + # Reconciler. If this number is M and the replica number of the controller + # is N, the N replicas will compete for the M buckets. The owner of a + # bucket will take care of the reconciling for the keys partitioned into + # that bucket. + buckets: "1" +--- +# Copyright 2018 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-logging + namespace: knative-serving + labels: + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/component: logging + app.kubernetes.io/name: knative-serving + annotations: + knative.dev/example-checksum: "9f25d429" +data: + _example: | + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this example block and unindented to be in the data block + # to actually change the configuration. + + # Common configuration for all Knative codebase + zap-logger-config: | + { + "level": "info", + "development": false, + "outputPaths": ["stdout"], + "errorOutputPaths": ["stderr"], + "encoding": "json", + "encoderConfig": { + "timeKey": "timestamp", + "levelKey": "severity", + "nameKey": "logger", + "callerKey": "caller", + "messageKey": "message", + "stacktraceKey": "stacktrace", + "lineEnding": "", + "levelEncoder": "", + "timeEncoder": "iso8601", + "durationEncoder": "", + "callerEncoder": "" + } + } + + # Log level overrides + # For all components except the queue proxy, + # changes are picked up immediately. + # For queue proxy, changes require recreation of the pods. + loglevel.controller: "info" + loglevel.autoscaler: "info" + loglevel.queueproxy: "info" + loglevel.webhook: "info" + loglevel.activator: "info" + loglevel.hpaautoscaler: "info" + loglevel.net-istio-controller: "info" + loglevel.net-contour-controller: "info" + loglevel.net-kourier-controller: "info" + loglevel.net-gateway-api-controller: "info" +--- +# Copyright 2018 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-network + namespace: knative-serving + labels: + app.kubernetes.io/name: knative-serving + app.kubernetes.io/component: networking + app.kubernetes.io/version: "1.22.1" + annotations: + knative.dev/example-checksum: "0573e07d" +data: + _example: | + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this example block and unindented to be in the data block + # to actually change the configuration. + + # ingress-class specifies the default ingress class + # to use when not dictated by Route annotation. + # + # If not specified, will use the Istio ingress. + # + # Note that changing the Ingress class of an existing Route + # will result in undefined behavior. Therefore it is best to only + # update this value during the setup of Knative, to avoid getting + # undefined behavior. + ingress-class: "istio.ingress.networking.knative.dev" + + # certificate-class specifies the default Certificate class + # to use when not dictated by Route annotation. + # + # If not specified, will use the Cert-Manager Certificate. + # + # Note that changing the Certificate class of an existing Route + # will result in undefined behavior. Therefore it is best to only + # update this value during the setup of Knative, to avoid getting + # undefined behavior. + certificate-class: "cert-manager.certificate.networking.knative.dev" + + # namespace-wildcard-cert-selector specifies a LabelSelector which + # determines which namespaces should have a wildcard certificate + # provisioned. + # + # Use an empty value to disable the feature (this is the default): + # namespace-wildcard-cert-selector: "" + # + # Use an empty object to enable for all namespaces + # namespace-wildcard-cert-selector: {} + # + # Useful labels include the "kubernetes.io/metadata.name" label to + # avoid provisioning a certificate for the "kube-system" namespaces. + # Use the following selector to match pre-1.0 behavior of using + # "networking.knative.dev/disableWildcardCert" to exclude namespaces: + # + # matchExpressions: + # - key: "networking.knative.dev/disableWildcardCert" + # operator: "NotIn" + # values: ["true"] + namespace-wildcard-cert-selector: "" + + # domain-template specifies the golang text template string to use + # when constructing the Knative service's DNS name. The default + # value is "{{.Name}}.{{.Namespace}}.{{.Domain}}". + # + # Valid variables defined in the template include Name, Namespace, Domain, + # Labels, and Annotations. Name will be the result of the tag-template + # below, if a tag is specified for the route. + # + # Changing this value might be necessary when the extra levels in + # the domain name generated is problematic for wildcard certificates + # that only support a single level of domain name added to the + # certificate's domain. In those cases you might consider using a value + # of "{{.Name}}-{{.Namespace}}.{{.Domain}}", or removing the Namespace + # entirely from the template. When choosing a new value be thoughtful + # of the potential for conflicts - for example, when users choose to use + # characters such as `-` in their service, or namespace, names. + # {{.Annotations}} or {{.Labels}} can be used for any customization in the + # go template if needed. + # We strongly recommend keeping namespace part of the template to avoid + # domain name clashes: + # eg. '{{.Name}}-{{.Namespace}}.{{ index .Annotations "sub"}}.{{.Domain}}' + # and you have an annotation {"sub":"foo"}, then the generated template + # would be {Name}-{Namespace}.foo.{Domain} + domain-template: "{{.Name}}.{{.Namespace}}.{{.Domain}}" + + # tag-template specifies the golang text template string to use + # when constructing the DNS name for "tags" within the traffic blocks + # of Routes and Configuration. This is used in conjunction with the + # domain-template above to determine the full URL for the tag. + tag-template: "{{.Tag}}-{{.Name}}" + + # auto-tls is deprecated and replaced by external-domain-tls + auto-tls: "Disabled" + + # Controls whether TLS certificates are automatically provisioned and + # installed in the Knative ingress to terminate TLS connections + # for cluster external domains (like: app.example.com) + # - Enabled: enables the TLS certificate provisioning feature for cluster external domains. + # - Disabled: disables the TLS certificate provisioning feature for cluster external domains. + external-domain-tls: "Disabled" + + # Controls weather TLS certificates are automatically provisioned and + # installed in the Knative ingress to terminate TLS connections + # for cluster local domains (like: app.namespace.svc.) + # - Enabled: enables the TLS certificate provisioning feature for cluster cluster-local domains. + # - Disabled: disables the TLS certificate provisioning feature for cluster cluster local domains. + # NOTE: This flag is in an alpha state and is mostly here to enable internal testing + # for now. Use with caution. + cluster-local-domain-tls: "Disabled" + + # internal-encryption is deprecated and replaced by system-internal-tls + internal-encryption: "false" + + # system-internal-tls controls weather TLS encryption is used for connections between + # the internal components of Knative: + # - ingress to activator + # - ingress to queue-proxy + # - activator to queue-proxy + # + # Possible values for this flag are: + # - Enabled: enables the TLS certificate provisioning feature for cluster cluster-local domains. + # - Disabled: disables the TLS certificate provisioning feature for cluster cluster local domains. + # NOTE: This flag is in an alpha state and is mostly here to enable internal testing + # for now. Use with caution. + system-internal-tls: "Disabled" + + # Controls the behavior of the HTTP endpoint for the Knative ingress. + # It requires auto-tls to be enabled. + # - Enabled: The Knative ingress will be able to serve HTTP connection. + # - Redirected: The Knative ingress will send a 301 redirect for all + # http connections, asking the clients to use HTTPS. + # + # "Disabled" option is deprecated. + http-protocol: "Enabled" + + # rollout-duration contains the minimal duration in seconds over which the + # Configuration traffic targets are rolled out to the newest revision. + rollout-duration: "0" + + # autocreate-cluster-domain-claims controls whether ClusterDomainClaims should + # be automatically created (and deleted) as needed when DomainMappings are + # reconciled. + # + # If this is "false" (the default), the cluster administrator is + # responsible for creating ClusterDomainClaims and delegating them to + # namespaces via their spec.Namespace field. This setting should be used in + # multitenant environments which need to control which namespace can use a + # particular domain name in a domain mapping. + # + # If this is "true", users are able to associate arbitrary names with their + # services via the DomainMapping feature. + autocreate-cluster-domain-claims: "false" + + # If true, networking plugins can add additional information to deployed + # applications to make their pods directly accessible via their IPs even if mesh is + # enabled and thus direct-addressability is usually not possible. + # Consumers like Knative Serving can use this setting to adjust their behavior + # accordingly, i.e. to drop fallback solutions for non-pod-addressable systems. + # + # NOTE: This flag is in an alpha state and is mostly here to enable internal testing + # for now. Use with caution. + enable-mesh-pod-addressability: "false" + + # mesh-compatibility-mode indicates whether consumers of network plugins + # should directly contact Pod IPs (most efficient), or should use the + # Cluster IP (less efficient, needed when mesh is enabled unless + # `enable-mesh-pod-addressability`, above, is set). + # Permitted values are: + # - "auto" (default): automatically determine which mesh mode to use by trying Pod IP and falling back to Cluster IP as needed. + # - "enabled": always use Cluster IP and do not attempt to use Pod IPs. + # - "disabled": always use Pod IPs and do not fall back to Cluster IP on failure. + mesh-compatibility-mode: "auto" + + # Defines the scheme used for external URLs if auto-tls is not enabled. + # This can be used for making Knative report all URLs as "HTTPS" for example, if you're + # fronting Knative with an external loadbalancer that deals with TLS termination and + # Knative doesn't know about that otherwise. + default-external-scheme: "http" +--- +# Copyright 2018 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-observability + namespace: knative-serving + labels: + app.kubernetes.io/name: knative-serving + app.kubernetes.io/component: observability + app.kubernetes.io/version: "1.22.1" + annotations: + knative.dev/example-checksum: "59abacb5" +data: + _example: | + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this example block and unindented to be in the data block + # to actually change the configuration. + + # logging.enable-var-log-collection defaults to false. + # The fluentd daemon set will be set up to collect /var/log if + # this flag is true. + logging.enable-var-log-collection: "false" + + # logging.revision-url-template provides a template to use for producing the + # logging URL that is injected into the status of each Revision. + logging.revision-url-template: "http://logging.example.com/?revisionUID=${REVISION_UID}" + + # If non-empty, this enables queue proxy writing user request logs to stdout, excluding probe + # requests. + # NB: after 0.18 release logging.enable-request-log must be explicitly set to true + # in order for request logging to be enabled. + # + # The value determines the shape of the request logs and it must be a valid go text/template. + # It is important to keep this as a single line. Multiple lines are parsed as separate entities + # by most collection agents and will split the request logs into multiple records. + # + # The following fields and functions are available to the template: + # + # Request: An http.Request (see https://golang.org/pkg/net/http/#Request) + # representing an HTTP request received by the server. + # + # Response: + # struct { + # Code int // HTTP status code (see https://www.iana.org/assignments/http-status-codes/http-status-codes.xhtml) + # Size int // An int representing the size of the response. + # Latency float64 // A float64 representing the latency of the response in seconds. + # } + # + # Revision: + # struct { + # Name string // Knative revision name + # Namespace string // Knative revision namespace + # Service string // Knative service name + # Configuration string // Knative configuration name + # PodName string // Name of the pod hosting the revision + # PodIP string // IP of the pod hosting the revision + # } + # + logging.request-log-template: '{"httpRequest": {"requestMethod": "{{.Request.Method}}", "requestUrl": "{{js .Request.RequestURI}}", "requestSize": "{{.Request.ContentLength}}", "status": {{.Response.Code}}, "responseSize": "{{.Response.Size}}", "userAgent": "{{js .Request.UserAgent}}", "remoteIp": "{{js .Request.RemoteAddr}}", "serverIp": "{{.Revision.PodIP}}", "referer": "{{js .Request.Referer}}", "latency": "{{.Response.Latency}}s", "protocol": "{{.Request.Proto}}"}, "traceId": "{{.TraceID}}"}' + + # If true, the request logging will be enabled. + logging.enable-request-log: "false" + + # If true, this enables queue proxy writing request logs for probe requests to stdout. + # It uses the same template for user requests, i.e. logging.request-log-template. + logging.enable-probe-request-log: "false" + + # metrics-protocol field specifies the protocol used when exporting metrics + # It supports either 'none' (the default), 'prometheus', 'http/protobuf' (OTLP HTTP), 'grpc' (OTLP gRPC) + metrics-protocol: http/protobuf + + # metrics-endpoint field specifies the destination metrics should be exporter to. + # + # The endpoint MUST be set when the protocol is http/protobuf or grpc. + # The endpoint MUST NOT be set when the protocol is none. + # + # When the protocol is prometheus the endpoint can accept a 'host:port' string to customize the + # listening host interface and port. + metrics-endpoint: http://example.com/v1/traces + + # metrics-export-interval specifies the global metrics reporting period for control and data plane components. + # If a zero or negative value is passed the default reporting OTel period is used (60 secs). + metrics-export-interval: 60s + + # request-metrics-protocol field specifies the protocol used when exporting queue-proxy metrics + # It supports either 'none' (the default), 'prometheus', 'http/protobuf' (OTLP HTTP), 'grpc' (OTLP gRPC) + request-metrics-protocol: http/protobuf + + # request-metrics-endpoint field specifies the destination metrics from the queue proxy should be exporter to. + # + # The endpoint MUST be set when the protocol is http/protobuf or grpc. + # The endpoint MUST NOT be set when the protocol is none. + # + # When the protocol is prometheus the endpoint can accept a 'host:port' string to customize the + # listening host interface and port. + request-metrics-endpoint: http://promstack-kube-prometheus-prometheus.observability:9090/api/v1/otlp/v1/metrics + + # request-metrics-export-interval specifies the global metrics reporting period for the queue-proxy. + # + # If a zero or negative value is passed the default reporting OTel period is used (60 secs). + request-metrics-export-interval: 60s + + # runtime-profiling indicates whether it is allowed to retrieve runtime profiling data from + # the pods via an HTTP server in the format expected by the pprof visualization tool. When + # enabled, the Knative Serving pods expose the profiling data on an alternate HTTP port 8008. + # The HTTP context root for profiling is then /debug/pprof/. + runtime-profiling: enabled + + # tracing-protocol field specifies the protocol used when exporting traces + # It supports either 'none' (the default), 'http/protobuf' (OTLP HTTP), 'grpc' (OTLP gRPC) + # or `stdout` for debugging purposes + tracing-protocol: http/protobuf + + # tracing-endpoint field specifies the destination traces should be exporter to. + # + # The endpoint MUST be set when the protocol is http/protobuf or grpc. + # The endpoint MUST NOT be set when the protocol is none. + tracing-endpoint: http://jaeger-collector.observability:4318/v1/traces + + # tracing-sampling-rate allows the user to specify what percentage of all traces should be exported + # The value should be between 0 (never sample) to 1 (always sample) + tracing-sampling-rate: "1" +--- +# Copyright 2019 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-tracing + namespace: knative-serving + labels: + app.kubernetes.io/name: knative-serving + app.kubernetes.io/component: tracing + app.kubernetes.io/version: "1.22.1" + annotations: + knative.dev/example-checksum: "04c7e9a3" +data: + _example: | + ########################################################### + # # + # This config is deprecated - use config-observability # + # # + ########################################################### +--- +# Copyright 2020 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: autoscaling/v2 +kind: HorizontalPodAutoscaler +metadata: + name: activator + namespace: knative-serving + labels: + app.kubernetes.io/component: activator + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" +spec: + minReplicas: 1 + maxReplicas: 20 + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: activator + metrics: + - type: Resource + resource: + name: cpu + target: + type: Utilization + # Percentage of the requested CPU + averageUtilization: 100 +--- +# Activator PDB. Currently we permit unavailability of 20% of tasks at the same time. +# Given the subsetting and that the activators are partially stateful systems, we want +# a slow rollout of the new versions and slow migration during node upgrades. +apiVersion: policy/v1 +kind: PodDisruptionBudget +metadata: + name: activator-pdb + namespace: knative-serving + labels: + app.kubernetes.io/component: activator + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" +spec: + minAvailable: 80% + selector: + matchLabels: + app: activator +--- +# Copyright 2018 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: activator + namespace: knative-serving + labels: + app.kubernetes.io/component: activator + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +spec: + selector: + matchLabels: + app: activator + role: activator + template: + metadata: + labels: + app: activator + role: activator + app.kubernetes.io/component: activator + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" + spec: + # To avoid node becoming SPOF, spread our replicas to different nodes. + affinity: + podAntiAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchLabels: + app: activator + topologyKey: kubernetes.io/hostname + weight: 100 + serviceAccountName: activator + containers: + - name: activator + # This is the Go import path for the binary that is containerized + # and substituted here. + image: gcr.io/knative-releases/knative.dev/serving/cmd/activator@sha256:5deaef961fef8d1417f6d4a4dfae2fc338f2d30d72c4ad58c3ab392b2c04705b + # The numbers are based on performance test results from + # https://github.com/knative/serving/issues/1625#issuecomment-511930023 + resources: + requests: + cpu: 300m + memory: 60Mi + limits: + cpu: 1000m + memory: 600Mi + env: + # Run Activator with GC collection when newly generated memory is 500%. + - name: GOGC + value: "500" + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: POD_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + - name: SYSTEM_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: CONFIG_LOGGING_NAME + value: config-logging + - name: CONFIG_OBSERVABILITY_NAME + value: config-observability + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + runAsNonRoot: true + capabilities: + drop: + - ALL + seccompProfile: + type: RuntimeDefault + ports: + - name: metrics + containerPort: 9090 + - name: profiling + containerPort: 8008 + - name: http1 + containerPort: 8012 + - name: h2c + containerPort: 8013 + readinessProbe: + httpGet: + port: 8012 + periodSeconds: 5 + failureThreshold: 5 + livenessProbe: + httpGet: + port: 8012 + periodSeconds: 10 + failureThreshold: 12 + initialDelaySeconds: 15 + # The activator (often) sits on the dataplane, and may proxy long (e.g. + # streaming, websockets) requests. We give a long grace period for the + # activator to "lame duck" and drain outstanding requests before we + # forcibly terminate the pod (and outstanding connections). This value + # should be at least as large as the upper bound on the Revision's + # timeoutSeconds property to avoid servicing events disrupting + # connections. + terminationGracePeriodSeconds: 600 +--- +apiVersion: v1 +kind: Service +metadata: + name: activator-service + namespace: knative-serving + labels: + app: activator + app.kubernetes.io/component: activator + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +spec: + selector: + app: activator + ports: + # Define metrics and profiling for them to be accessible within service meshes. + - name: http-metrics + port: 9090 + targetPort: 9090 + - name: http-profiling + port: 8008 + targetPort: 8008 + - name: http + port: 80 + targetPort: 8012 + - name: http2 + port: 81 + targetPort: 8013 + - name: https + port: 443 + targetPort: 8112 + type: ClusterIP +--- +# Copyright 2018 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: autoscaler + namespace: knative-serving + labels: + app.kubernetes.io/component: autoscaler + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" +spec: + replicas: 1 + selector: + matchLabels: + app: autoscaler + strategy: + type: RollingUpdate + rollingUpdate: + maxUnavailable: 0 + template: + metadata: + labels: + app: autoscaler + app.kubernetes.io/component: autoscaler + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" + spec: + # To avoid node becoming SPOF, spread our replicas to different nodes. + affinity: + podAntiAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchLabels: + app: autoscaler + topologyKey: kubernetes.io/hostname + weight: 100 + serviceAccountName: controller + containers: + - name: autoscaler + # This is the Go import path for the binary that is containerized + # and substituted here. + image: gcr.io/knative-releases/knative.dev/serving/cmd/autoscaler@sha256:5bae38655d87df86b041083fbe51791816473245f752432ba9b85a7b12f73cd5 + resources: + requests: + cpu: 100m + memory: 100Mi + limits: + cpu: 1000m + memory: 1000Mi + env: + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: POD_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + - name: SYSTEM_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: CONFIG_LOGGING_NAME + value: config-logging + - name: CONFIG_OBSERVABILITY_NAME + value: config-observability + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + runAsNonRoot: true + capabilities: + drop: + - ALL + seccompProfile: + type: RuntimeDefault + ports: + - name: metrics + containerPort: 9090 + - name: profiling + containerPort: 8008 + - name: websocket + containerPort: 8080 + readinessProbe: + httpGet: + port: 8080 + livenessProbe: + httpGet: + port: 8080 + failureThreshold: 6 +--- +apiVersion: v1 +kind: Service +metadata: + labels: + app: autoscaler + app.kubernetes.io/component: autoscaler + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" + name: autoscaler + namespace: knative-serving +spec: + ports: + # Define metrics and profiling for them to be accessible within service meshes. + - name: http-metrics + port: 9090 + targetPort: 9090 + - name: http-profiling + port: 8008 + targetPort: 8008 + - name: http + port: 8080 + targetPort: 8080 + selector: + app: autoscaler +--- +# Copyright 2018 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: controller + namespace: knative-serving + labels: + app.kubernetes.io/component: controller + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" +spec: + selector: + matchLabels: + app: controller + template: + metadata: + labels: + app: controller + app.kubernetes.io/component: controller + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" + spec: + # To avoid node becoming SPOF, spread our replicas to different nodes. + affinity: + podAntiAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchLabels: + app: controller + topologyKey: kubernetes.io/hostname + weight: 100 + serviceAccountName: controller + containers: + - name: controller + # This is the Go import path for the binary that is containerized + # and substituted here. + image: gcr.io/knative-releases/knative.dev/serving/cmd/controller@sha256:94329d85200c2fc31ed1166a26568ca1357376c149c147e71f400cf28be3c816 + resources: + requests: + cpu: 100m + memory: 100Mi + limits: + cpu: 1000m + memory: 1000Mi + env: + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: SYSTEM_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: CONFIG_LOGGING_NAME + value: config-logging + - name: CONFIG_OBSERVABILITY_NAME + value: config-observability + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + runAsNonRoot: true + capabilities: + drop: + - ALL + seccompProfile: + type: RuntimeDefault + livenessProbe: + httpGet: + path: /health + port: probes + scheme: HTTP + periodSeconds: 5 + failureThreshold: 6 + readinessProbe: + httpGet: + path: /readiness + port: probes + scheme: HTTP + periodSeconds: 5 + failureThreshold: 3 + ports: + - name: metrics + containerPort: 9090 + - name: profiling + containerPort: 8008 + - name: probes + containerPort: 8080 +--- +apiVersion: v1 +kind: Service +metadata: + labels: + app: controller + app.kubernetes.io/component: controller + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" + name: controller + namespace: knative-serving +spec: + ports: + # Define metrics and profiling for them to be accessible within service meshes. + - name: http-metrics + port: 9090 + targetPort: 9090 + - name: http-profiling + port: 8008 + targetPort: 8008 + selector: + app: controller +--- +# Copyright 2020 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: autoscaling/v2 +kind: HorizontalPodAutoscaler +metadata: + name: webhook + namespace: knative-serving + labels: + app.kubernetes.io/component: webhook + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" +spec: + minReplicas: 1 + maxReplicas: 5 + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: webhook + metrics: + - type: Resource + resource: + name: cpu + target: + type: Utilization + # Percentage of the requested CPU + averageUtilization: 100 +--- +# Webhook PDB. +apiVersion: policy/v1 +kind: PodDisruptionBudget +metadata: + name: webhook-pdb + namespace: knative-serving + labels: + app.kubernetes.io/component: webhook + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" +spec: + minAvailable: 80% + selector: + matchLabels: + app: webhook +--- +# Copyright 2018 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: webhook + namespace: knative-serving + labels: + app.kubernetes.io/component: webhook + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +spec: + selector: + matchLabels: + app: webhook + role: webhook + template: + metadata: + labels: + app: webhook + role: webhook + app.kubernetes.io/component: webhook + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving + spec: + # To avoid node becoming SPOF, spread our replicas to different nodes. + affinity: + podAntiAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchLabels: + app: webhook + topologyKey: kubernetes.io/hostname + weight: 100 + serviceAccountName: controller + containers: + - name: webhook + # This is the Go import path for the binary that is containerized + # and substituted here. + image: gcr.io/knative-releases/knative.dev/serving/cmd/webhook@sha256:8470456be214e93a84e3c7b79a632aa9978bd8ecda553feaa47878a2c24ab84d + resources: + requests: + cpu: 100m + memory: 100Mi + limits: + cpu: 500m + memory: 500Mi + env: + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: SYSTEM_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: CONFIG_LOGGING_NAME + value: config-logging + - name: CONFIG_OBSERVABILITY_NAME + value: config-observability + - name: WEBHOOK_NAME + value: webhook + - name: WEBHOOK_PORT + value: "8443" + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + runAsNonRoot: true + capabilities: + drop: + - ALL + seccompProfile: + type: RuntimeDefault + ports: + - name: metrics + containerPort: 9090 + - name: profiling + containerPort: 8008 + - name: https-webhook + containerPort: 8443 + readinessProbe: + periodSeconds: 1 + httpGet: + scheme: HTTPS + port: 8443 + livenessProbe: + periodSeconds: 10 + httpGet: + scheme: HTTPS + port: 8443 + failureThreshold: 6 + initialDelaySeconds: 20 + # Our webhook should gracefully terminate by lame ducking first, set this to a sufficiently + # high value that we respect whatever value it has configured for the lame duck grace period. + terminationGracePeriodSeconds: 300 +--- +apiVersion: v1 +kind: Service +metadata: + labels: + app: webhook + role: webhook + app.kubernetes.io/component: webhook + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving + name: webhook + namespace: knative-serving +spec: + ports: + # Define metrics and profiling for them to be accessible within service meshes. + - name: http-metrics + port: 9090 + targetPort: 9090 + - name: http-profiling + port: 8008 + targetPort: 8008 + - name: https-webhook + port: 443 + targetPort: 8443 + selector: + app: webhook + role: webhook +--- +# Copyright 2020 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingWebhookConfiguration +metadata: + name: config.webhook.serving.knative.dev + labels: + app.kubernetes.io/component: webhook + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" +webhooks: + - admissionReviewVersions: ["v1", "v1beta1"] + clientConfig: + service: + name: webhook + namespace: knative-serving + failurePolicy: Fail + sideEffects: None + name: config.webhook.serving.knative.dev + objectSelector: + matchExpressions: + - key: app.kubernetes.io/name + operator: In + values: ["knative-serving"] + - key: app.kubernetes.io/component + operator: In + values: ["autoscaler", "controller", "logging", "networking", "observability", "tracing", "net-certmanager"] + timeoutSeconds: 10 +--- +# Copyright 2020 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: admissionregistration.k8s.io/v1 +kind: MutatingWebhookConfiguration +metadata: + name: webhook.serving.knative.dev + labels: + app.kubernetes.io/component: webhook + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" +webhooks: + - admissionReviewVersions: ["v1", "v1beta1"] + clientConfig: + service: + name: webhook + namespace: knative-serving + failurePolicy: Fail + sideEffects: None + name: webhook.serving.knative.dev + timeoutSeconds: 10 + rules: + - apiGroups: + - autoscaling.internal.knative.dev + - networking.internal.knative.dev + - serving.knative.dev + apiVersions: + - "*" + operations: + - CREATE + - UPDATE + scope: "*" + resources: + - metrics + - podautoscalers + - certificates + - ingresses + - serverlessservices + - configurations + - revisions + - routes + - services + - domainmappings + - domainmappings/status +--- +# Copyright 2020 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingWebhookConfiguration +metadata: + name: validation.webhook.serving.knative.dev + labels: + app.kubernetes.io/component: webhook + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" +webhooks: + - admissionReviewVersions: ["v1", "v1beta1"] + clientConfig: + service: + name: webhook + namespace: knative-serving + failurePolicy: Fail + sideEffects: None + name: validation.webhook.serving.knative.dev + timeoutSeconds: 10 + rules: + - apiGroups: + - autoscaling.internal.knative.dev + - networking.internal.knative.dev + - serving.knative.dev + apiVersions: + - "*" + operations: + - CREATE + - UPDATE + - DELETE + scope: "*" + resources: + - metrics + - podautoscalers + - certificates + - ingresses + - serverlessservices + - configurations + - revisions + - routes + - services + - domainmappings + - domainmappings/status +--- +# Copyright 2020 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: Secret +metadata: + name: webhook-certs + namespace: knative-serving + labels: + app.kubernetes.io/component: webhook + app.kubernetes.io/name: knative-serving + app.kubernetes.io/version: "1.22.1" +# The data is populated at install time. +--- +# Source: https://github.com/knative-extensions/net-kourier/releases/download/knative-v1.22.1/kourier.yaml +--- +# Copyright 2020 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: Namespace +metadata: + name: kourier-system + labels: + networking.knative.dev/ingress-provider: kourier + app.kubernetes.io/name: knative-serving + app.kubernetes.io/component: net-kourier + app.kubernetes.io/version: "1.22.1" +--- +# Copyright 2020 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: kourier-bootstrap + namespace: kourier-system + labels: + networking.knative.dev/ingress-provider: kourier + app.kubernetes.io/component: net-kourier + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +data: + envoy-bootstrap.yaml: | + dynamic_resources: + ads_config: + transport_api_version: V3 + api_type: GRPC + rate_limit_settings: {} + grpc_services: + - envoy_grpc: {cluster_name: xds_cluster} + cds_config: + resource_api_version: V3 + ads: {} + lds_config: + resource_api_version: V3 + ads: {} + node: + cluster: kourier-knative + id: 3scale-kourier-gateway + static_resources: + listeners: + - name: stats_listener + address: + socket_address: + address: 0.0.0.0 + port_value: 9000 + filter_chains: + - filters: + - name: envoy.filters.network.http_connection_manager + typed_config: + "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager + stat_prefix: stats_server + http_filters: + - name: envoy.filters.http.router + typed_config: + "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router + route_config: + virtual_hosts: + - name: admin_interface + domains: + - "*" + routes: + - match: + safe_regex: + regex: '/(certs|stats(/prometheus)?|server_info|clusters|listeners|ready)?' + headers: + - name: ':method' + string_match: + exact: GET + route: + cluster: service_stats + - match: + safe_regex: + regex: '/drain_listeners' + headers: + - name: ':method' + string_match: + exact: POST + route: + cluster: service_stats + clusters: + - name: service_stats + connect_timeout: 0.250s + type: static + load_assignment: + cluster_name: service_stats + endpoints: + lb_endpoints: + endpoint: + address: + socket_address: + address: 127.0.0.1 + port_value: 9901 + - name: xds_cluster + # This keepalive is recommended by envoy docs. + # https://www.envoyproxy.io/docs/envoy/latest/api-docs/xds_protocol + typed_extension_protocol_options: + envoy.extensions.upstreams.http.v3.HttpProtocolOptions: + "@type": type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions + explicit_http_config: + http2_protocol_options: + connection_keepalive: + interval: 30s + timeout: 5s + connect_timeout: 1s + load_assignment: + cluster_name: xds_cluster + endpoints: + lb_endpoints: + endpoint: + address: + socket_address: + address: "net-kourier-controller.knative-serving" + port_value: 18000 + type: STRICT_DNS + admin: + access_log: + - name: envoy.access_loggers.stdout + typed_config: + "@type": type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog + address: + socket_address: + address: 127.0.0.1 + port_value: 9901 +--- +# Copyright 2021 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-kourier + namespace: knative-serving + labels: + networking.knative.dev/ingress-provider: kourier + app.kubernetes.io/component: net-kourier + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +data: + _example: | + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this example block and unindented to be in the data block + # to actually change the configuration. + + # Specifies whether requests reaching the Kourier gateway + # in the context of services should be logged. Readiness + # probes etc. must be configured via the bootstrap config. + enable-service-access-logging: "true" + + # Specifies the format of the access log used by the Kourier gateway. + # This template follows the envoy format. + # see: https://www.envoyproxy.io/docs/envoy/latest/configuration/observability/access_log/usage#access-logging + service-access-log-template: "" + + # Specifies whether to use proxy-protocol in order to safely + # transport connection information such as a client's address + # across multiple layers of TCP proxies. + # NOTE THAT THIS IS AN EXPERIMENTAL / ALPHA FEATURE + enable-proxy-protocol: "false" + + # The server certificates to serve the internal TLS traffic for Kourier Gateway. + # It is specified by the secret name in controller namespace, which has + # the "tls.crt" and "tls.key" data field. + # Use an empty value to disable the feature (default). + # + # NOTE: This flag is in an alpha state and is mostly here to enable internal testing + # for now. Use with caution. + cluster-cert-secret: "" + + # Specifies the amount of time that Kourier waits for the incoming requests. + # The default, 0s, imposes no timeout at all. + stream-idle-timeout: "0s" + + # Specifies whether to use CryptoMB private key provider in order to + # acclerate the TLS handshake. + # NOTE THAT THIS IS AN EXPERIMENTAL / ALPHA FEATURE. + enable-cryptomb: "false" + + # Configures the number of additional ingress proxy hops from the + # right side of the x-forwarded-for HTTP header to trust. + trusted-hops-count: "0" + + # Configures the connection manager to use the real remote address + # of the client connection when determining internal versus external origin and manipulating various headers. + use-remote-address: "false" + + # Specifies the cipher suites for TLS external listener. + # Use ',' separated values like "ECDHE-ECDSA-AES128-GCM-SHA256,ECDHE-ECDSA-CHACHA20-POLY1305" + # The default uses the default cipher suites of the envoy version. + cipher-suites: "" + + # Disable the Envoy server header injection in the response when response has no such header. + disable-envoy-server-header: "false" + + # The external authorization service and port, my-auth:2222. + # This value overrides environment variable if defined. + extauthz-host: "" + + # The protocol used to query the ext auth service. Can be one of : grpc, http, https. Defaults to grpc + # This value overrides environment variable if defined. + extauthz-protocol: "grpc" + + # Allow traffic to go through if the ext auth service is down. Accepts true/false. + # This value overrides environment variable if defined. + extauthz-failure-mode-allow: "" + + # Max request bytes, if not set, defaults to 8192 Bytes. More info Envoy Docs + # see: https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/http/ext_authz/v3/ext_authz.proto.html#extensions-filters-http-ext-authz-v3-buffersettings + # This value overrides environment variable if defined. + extauthz-max-request-body-bytes: 8192 + + # Max time in ms to wait for the ext authz service. Defaults to 2000 ms + # This value overrides environment variable if defined. + extauthz-timeout: 2000 + + # If extauthz-protocol is equal to http or https, path to query the ext auth service. + # Example : if set to /verify, it will query /verify/ (notice the trailing /). If not set, it will query / + # This value overrides environment variable if defined. + extauthz-path-prefix: "" + + # If extauthz-protocol is equal to grpc, sends the body as raw bytes instead of a UTF-8 string. + # Accepts only true/false, t/f or 1/0. Attempting to set another value will throw an error. + # Defaults to false. More info Envoy Docs. + # see: https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/http/ext_authz/v3/ext_authz.proto.html#extensions-filters-http-ext-authz-v3-buffersettings + # This value overrides environment variable if defined. + extauthz-pack-as-byte: "false" + + # Specifies the secret that contains the TLS certificate and key pair when using HTTPS communication with Kourier Ingress. + # This value overrides environment variable if defined. + certs-secret-name: "" + certs-secret-namespace: "" + + # Specifies the OTLP collector endpoint for distributed tracing. + # The endpoint format depends on the protocol (see tracing-protocol). + # Examples: + # - For HTTP: "http://otel-collector.observability.svc:4318/v1/traces" + # - For gRPC: "http://otel-collector.observability.svc:4317" + # Use an empty value to disable distributed tracing (default). + tracing-endpoint: "" + + # Protocol for tracing collector communication. + # Valid values: http/protobuf, grpc + tracing-protocol: "grpc" + + # Tracing sampling rate (0.0 to 1.0) + # Controls the percentage of requests that are traced. + # Example: "1.0" traces 100% of requests. + tracing-sampling-rate: "1.0" + + # Service name for traces + # This identifies the Kourier gateway in your tracing system. + tracing-service-name: "kourier-knative" +--- +# Copyright 2020 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ServiceAccount +metadata: + name: net-kourier + namespace: knative-serving + labels: + networking.knative.dev/ingress-provider: kourier + app.kubernetes.io/component: net-kourier + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: net-kourier + labels: + networking.knative.dev/ingress-provider: kourier + app.kubernetes.io/component: net-kourier + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +rules: + - apiGroups: [""] + resources: ["events"] + verbs: ["create", "update", "patch"] + - apiGroups: [""] + resources: ["pods", "services", "secrets"] + verbs: ["get", "list", "watch"] + - apiGroups: [""] + resources: ["configmaps"] + verbs: ["get", "list", "watch"] + - apiGroups: ["discovery.k8s.io"] + resources: ["endpointslices"] + verbs: ["get", "list", "watch"] + - apiGroups: ["coordination.k8s.io"] + resources: ["leases"] + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] + - apiGroups: ["networking.internal.knative.dev"] + resources: ["ingresses"] + verbs: ["get", "list", "watch", "patch"] + - apiGroups: ["networking.internal.knative.dev"] + resources: ["ingresses/status"] + verbs: ["update"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: net-kourier + labels: + networking.knative.dev/ingress-provider: kourier + app.kubernetes.io/component: net-kourier + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: net-kourier +subjects: + - kind: ServiceAccount + name: net-kourier + namespace: knative-serving +--- +# Copyright 2020 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: net-kourier-controller + namespace: knative-serving + labels: + networking.knative.dev/ingress-provider: kourier + app.kubernetes.io/component: net-kourier + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +spec: + strategy: + type: RollingUpdate + rollingUpdate: + maxUnavailable: 0 + maxSurge: 100% + replicas: 1 + selector: + matchLabels: + app: net-kourier-controller + template: + metadata: + annotations: + prometheus.io/scrape: "true" + prometheus.io/port: "9090" + prometheus.io/path: "/metrics" + labels: + app: net-kourier-controller + spec: + containers: + - image: gcr.io/knative-releases/knative.dev/net-kourier/cmd/kourier@sha256:01abd2070ccf8680885c47990e42c05c09e30bc8595d9246f4dcd37f2220a2a2 + name: controller + env: + # CERTS_SECRET_NAMESPACE and CERTS_SECRET_NAME can also be configured from a ConfigMap. + # Settings configured in a configmap take precedence over environment variable settings. + - name: CERTS_SECRET_NAMESPACE + value: "" + - name: CERTS_SECRET_NAME + value: "" + - name: SYSTEM_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: METRICS_DOMAIN + value: "knative.dev/samples" + - name: KOURIER_GATEWAY_NAMESPACE + value: "kourier-system" + - name: ENABLE_SECRET_INFORMER_FILTERING_BY_CERT_UID + value: "false" + # KUBE_API_BURST and KUBE_API_QPS allows to configure maximum burst for throttle and maximum QPS to the server from the client. + # Setting these values using env vars is possible since https://github.com/knative/pkg/pull/2755. + # 200 is an arbitrary value, but it speeds up kourier startup duration, and the whole ingress reconciliation process as a whole. + - name: KUBE_API_BURST + value: "200" + - name: KUBE_API_QPS + value: "200" + ports: + - name: http2-xds + containerPort: 18000 + protocol: TCP + - name: metrics + containerPort: 9090 + protocol: TCP + readinessProbe: + grpc: + port: 18000 + periodSeconds: 10 + failureThreshold: 3 + livenessProbe: + grpc: + port: 18000 + periodSeconds: 10 + failureThreshold: 6 + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + runAsNonRoot: true + capabilities: + drop: + - ALL + seccompProfile: + type: RuntimeDefault + resources: + requests: + cpu: 200m + memory: 200Mi + limits: + cpu: "1" + memory: 500Mi + restartPolicy: Always + serviceAccountName: net-kourier +--- +apiVersion: v1 +kind: Service +metadata: + name: net-kourier-controller + namespace: knative-serving + labels: + networking.knative.dev/ingress-provider: kourier + app.kubernetes.io/component: net-kourier + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +spec: + ports: + - name: grpc-xds + port: 18000 + protocol: TCP + targetPort: 18000 + - name: http-metrics + port: 9090 + protocol: TCP + targetPort: 9090 + selector: + app: net-kourier-controller + type: ClusterIP +--- +# Copyright 2020 The Knative Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: 3scale-kourier-gateway + namespace: kourier-system + labels: + networking.knative.dev/ingress-provider: kourier + app.kubernetes.io/component: net-kourier + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +spec: + strategy: + type: RollingUpdate + rollingUpdate: + maxUnavailable: 0 + maxSurge: 100% + selector: + matchLabels: + app: 3scale-kourier-gateway + template: + metadata: + labels: + app: 3scale-kourier-gateway + annotations: + # v0.26 supports envoy v3 API, so + # adding this label to restart pod. + networking.knative.dev/poke: "v0.26" + prometheus.io/scrape: "true" + prometheus.io/port: "9000" + prometheus.io/path: "/stats/prometheus" + spec: + containers: + - args: + - --base-id 1 + - -c /tmp/config/envoy-bootstrap.yaml + - --log-level info + - --drain-time-s $(DRAIN_TIME_SECONDS) + - --drain-strategy immediate + command: + - /usr/local/bin/envoy + env: + - name: DRAIN_TIME_SECONDS + value: "15" + image: docker.io/envoyproxy/envoy:v1.37-latest + name: kourier-gateway + ports: + - name: http2-external + containerPort: 8080 + protocol: TCP + - name: http2-internal + containerPort: 8081 + protocol: TCP + - name: https-external + containerPort: 8443 + protocol: TCP + - name: http-probe + containerPort: 8090 + protocol: TCP + - name: https-probe + containerPort: 9443 + protocol: TCP + - name: metrics + containerPort: 9000 + protocol: TCP + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: false + runAsNonRoot: true + runAsUser: 65534 + runAsGroup: 65534 + capabilities: + drop: + - ALL + seccompProfile: + type: RuntimeDefault + volumeMounts: + - name: config-volume + mountPath: /tmp/config + lifecycle: + preStop: + exec: + command: ["/bin/sh", "-c", "curl -X POST http://localhost:9901/drain_listeners?graceful; sleep $DRAIN_TIME_SECONDS"] + readinessProbe: + httpGet: + httpHeaders: + - name: Host + value: internalkourier + path: /ready + port: 8081 + scheme: HTTP + initialDelaySeconds: 10 + periodSeconds: 5 + failureThreshold: 3 + timeoutSeconds: 3 + livenessProbe: + httpGet: + httpHeaders: + - name: Host + value: internalkourier + path: /ready + port: 8081 + scheme: HTTP + initialDelaySeconds: 10 + periodSeconds: 5 + failureThreshold: 6 + timeoutSeconds: 3 + resources: + requests: + cpu: 200m + memory: 200Mi + limits: + cpu: "1" + memory: 800Mi + # to ensure a graceful drain, terminationGracePeriodSeconds must be greater than DRAIN_TIME_SECONDS environment variable + terminationGracePeriodSeconds: 30 + volumes: + - name: config-volume + configMap: + name: kourier-bootstrap + restartPolicy: Always +--- +apiVersion: v1 +kind: Service +metadata: + name: kourier + namespace: kourier-system + labels: + networking.knative.dev/ingress-provider: kourier + app.kubernetes.io/component: net-kourier + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +spec: + ports: + - name: http2 + port: 80 + protocol: TCP + targetPort: 8080 + - name: https + port: 443 + protocol: TCP + targetPort: 8443 + selector: + app: 3scale-kourier-gateway + type: LoadBalancer +--- +apiVersion: v1 +kind: Service +metadata: + name: kourier-internal + namespace: kourier-system + labels: + networking.knative.dev/ingress-provider: kourier + app.kubernetes.io/component: net-kourier + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +spec: + ports: + - name: http2 + port: 80 + protocol: TCP + targetPort: 8081 + - name: https + port: 443 + protocol: TCP + targetPort: 8444 + selector: + app: 3scale-kourier-gateway + type: ClusterIP +--- +apiVersion: autoscaling/v2 +kind: HorizontalPodAutoscaler +metadata: + name: 3scale-kourier-gateway + namespace: kourier-system + labels: + networking.knative.dev/ingress-provider: kourier + app.kubernetes.io/component: net-kourier + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +spec: + minReplicas: 1 + maxReplicas: 10 + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: 3scale-kourier-gateway + metrics: + - type: Resource + resource: + name: cpu + target: + type: Utilization + # Percentage of the requested CPU + averageUtilization: 100 +--- +apiVersion: policy/v1 +kind: PodDisruptionBudget +metadata: + name: 3scale-kourier-gateway-pdb + namespace: kourier-system + labels: + networking.knative.dev/ingress-provider: kourier + app.kubernetes.io/component: net-kourier + app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/name: knative-serving +spec: + minAvailable: 80% + selector: + matchLabels: + app: 3scale-kourier-gateway diff --git a/packages/manifests/scripts/pull-manifests.ts b/packages/manifests/scripts/pull-manifests.ts index 621664c..43e668f 100644 --- a/packages/manifests/scripts/pull-manifests.ts +++ b/packages/manifests/scripts/pull-manifests.ts @@ -378,6 +378,12 @@ async function pullOperator(op: OperatorConfig, version?: string, outDir = path. // With combineUrls false the parts are written separately and numbered, // so the order they must be applied in is the order they sort in — and a // consumer cannot get it wrong by reading the directory. + // The combined file is always written: it is what codegen reads to + // discover kinds, and type generation never applies anything so the + // ordering problem does not arise there. It is the *apply* path that must + // not use it. + writeFile(targetFile, combined); + if (op.combineUrls === false) { // Nested under the version, not beside it: the parts are one version // applied in sequence, and writing them as siblings of the versioned @@ -391,8 +397,6 @@ async function pullOperator(op: OperatorConfig, version?: string, outDir = path. ); writeFile(partFile, partContents[i]); }); - } else { - writeFile(targetFile, combined); } // Also update unversioned latest pointer (copy) if this is highest version } else if (src.type === 'helm') { diff --git a/packages/manifests/src/generated/index.ts b/packages/manifests/src/generated/index.ts index d58695e..5c50fd5 100644 --- a/packages/manifests/src/generated/index.ts +++ b/packages/manifests/src/generated/index.ts @@ -2,6 +2,7 @@ import type { KubernetesResource } from "@kubernetesjs/ops"; import CertManager from "./cert-manager"; import CloudnativePg from "./cloudnative-pg"; +import KnativeServing from "./knative-serving"; import KubePrometheusStack from "./kube-prometheus-stack"; import MinioOperator from "./minio-operator"; import TektonPipelines from "./tekton-pipelines"; @@ -12,6 +13,7 @@ export interface OperatorObjectModule { export const OPERATOR_OBJECTS: Record = { "cert-manager": CertManager, "cloudnative-pg": CloudnativePg, + "knative-serving": KnativeServing, "kube-prometheus-stack": KubePrometheusStack, "minio-operator": MinioOperator, "tekton-pipelines": TektonPipelines, diff --git a/packages/manifests/src/generated/knative-serving.ts b/packages/manifests/src/generated/knative-serving.ts index e2874b8..7347793 100644 --- a/packages/manifests/src/generated/knative-serving.ts +++ b/packages/manifests/src/generated/knative-serving.ts @@ -1,3 +1,7854 @@ /** Auto-generated typed resources for operator: knative-serving*/ import type { KubernetesResource } from "@kubernetesjs/ops"; -export default {}; +export const CustomResourceDefinition_CertificatesNetworkingInternalKnativeDev: KubernetesResource = { + apiVersion: "apiextensions.k8s.io/v1", + kind: "CustomResourceDefinition", + metadata: { + labels: { + "app.kubernetes.io/component": "networking", + "app.kubernetes.io/name": "knative-serving", + "app.kubernetes.io/version": "1.22.1", + "knative.dev/crd-install": "true" + }, + name: "certificates.networking.internal.knative.dev" + }, + spec: { + group: "networking.internal.knative.dev", + names: { + categories: ["knative-internal", "networking"], + kind: "Certificate", + plural: "certificates", + shortNames: ["kcert"], + singular: "certificate" + }, + scope: "Namespaced", + versions: [{ + additionalPrinterColumns: [{ + jsonPath: ".status.conditions[?(@.type==\"Ready\")].status", + name: "Ready", + type: "string" + }, { + jsonPath: ".status.conditions[?(@.type==\"Ready\")].reason", + name: "Reason", + type: "string" + }], + name: "v1alpha1", + schema: { + openAPIV3Schema: { + description: "Certificate is responsible for provisioning a SSL certificate for the\ngiven hosts. It is a Knative abstraction for various SSL certificate\nprovisioning solutions (such as cert-manager or self-signed SSL certificate).", + properties: { + apiVersion: { + description: "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", + type: "string" + }, + kind: { + description: "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + type: "string" + }, + metadata: { + type: "object" + }, + spec: { + description: "Spec is the desired state of the Certificate.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status", + properties: { + dnsNames: { + description: "DNSNames is a list of DNS names the Certificate could support.\nThe wildcard format of DNSNames (e.g. *.default.example.com) is supported.", + items: { + type: "string" + }, + type: "array" + }, + domain: { + description: "Domain is the top level domain of the values for DNSNames.", + type: "string" + }, + secretName: { + description: "SecretName is the name of the secret resource to store the SSL certificate in.", + type: "string" + } + }, + required: ["dnsNames", "secretName"], + type: "object" + }, + status: { + description: "Status is the current state of the Certificate.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status", + properties: { + annotations: { + additionalProperties: { + type: "string" + }, + description: "Annotations is additional Status fields for the Resource to save some\nadditional State as well as convey more information to the user. This is\nroughly akin to Annotations on any k8s resource, just the reconciler conveying\nricher information outwards.", + type: "object" + }, + conditions: { + description: "Conditions the latest available observations of a resource's current state.", + items: { + description: "Condition defines a readiness condition for a Knative resource.\nSee: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties", + properties: { + lastTransitionTime: { + description: "LastTransitionTime is the last time the condition transitioned from one status to another.\nWe use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic\ndifferences (all other things held constant).", + type: "string" + }, + message: { + description: "A human readable message indicating details about the transition.", + type: "string" + }, + reason: { + description: "The reason for the condition's last transition.", + type: "string" + }, + severity: { + description: "Severity with which to treat failures of this type of condition.\nWhen this is not specified, it defaults to Error.", + type: "string" + }, + status: { + description: "Status of the condition, one of True, False, Unknown.", + type: "string" + }, + type: { + description: "Type of condition.", + type: "string" + } + }, + required: ["status", "type"], + type: "object" + }, + type: "array" + }, + http01Challenges: { + description: "HTTP01Challenges is a list of HTTP01 challenges that need to be fulfilled\nin order to get the TLS certificate..", + items: { + description: "HTTP01Challenge defines the status of a HTTP01 challenge that a certificate needs\nto fulfill.", + properties: { + serviceName: { + description: "ServiceName is the name of the service to serve HTTP01 challenge requests.", + type: "string" + }, + serviceNamespace: { + description: "ServiceNamespace is the namespace of the service to serve HTTP01 challenge requests.", + type: "string" + }, + servicePort: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "ServicePort is the port of the service to serve HTTP01 challenge requests.", + "x-kubernetes-int-or-string": true + }, + url: { + description: "URL is the URL that the HTTP01 challenge is expected to serve on.", + type: "string" + } + }, + type: "object" + }, + type: "array" + }, + notAfter: { + description: "The expiration time of the TLS certificate stored in the secret named\nby this resource in spec.secretName.", + format: "date-time", + type: "string" + }, + observedGeneration: { + description: "ObservedGeneration is the 'Generation' of the Service that\nwas last processed by the controller.", + format: "int64", + type: "integer" + } + }, + type: "object" + } + }, + type: "object" + } + }, + served: true, + storage: true, + subresources: { + status: {} + } + }] + } +}; +export const CustomResourceDefinition_ConfigurationsServingKnativeDev: KubernetesResource = { + apiVersion: "apiextensions.k8s.io/v1", + kind: "CustomResourceDefinition", + metadata: { + labels: { + "app.kubernetes.io/name": "knative-serving", + "app.kubernetes.io/version": "1.22.1", + "duck.knative.dev/podspecable": "true", + "knative.dev/crd-install": "true" + }, + name: "configurations.serving.knative.dev" + }, + spec: { + group: "serving.knative.dev", + names: { + categories: ["all", "knative", "serving"], + kind: "Configuration", + plural: "configurations", + shortNames: ["config", "cfg"], + singular: "configuration" + }, + scope: "Namespaced", + versions: [{ + additionalPrinterColumns: [{ + jsonPath: ".status.latestCreatedRevisionName", + name: "LatestCreated", + type: "string" + }, { + jsonPath: ".status.latestReadyRevisionName", + name: "LatestReady", + type: "string" + }, { + jsonPath: ".status.conditions[?(@.type=='Ready')].status", + name: "Ready", + type: "string" + }, { + jsonPath: ".status.conditions[?(@.type=='Ready')].reason", + name: "Reason", + type: "string" + }], + name: "v1", + schema: { + openAPIV3Schema: { + description: "Configuration represents the \"floating HEAD\" of a linear history of Revisions.\nUsers create new Revisions by updating the Configuration's spec.\nThe \"latest created\" revision's name is available under status, as is the\n\"latest ready\" revision's name.\nSee also: https://github.com/knative/serving/blob/main/docs/spec/overview.md#configuration", + properties: { + apiVersion: { + description: "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", + type: "string" + }, + kind: { + description: "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + type: "string" + }, + metadata: { + type: "object" + }, + spec: { + description: "ConfigurationSpec holds the desired state of the Configuration (from the client).", + properties: { + template: { + description: "Template holds the latest specification for the Revision to be stamped out.", + properties: { + metadata: { + properties: { + annotations: { + additionalProperties: { + type: "string" + }, + type: "object" + }, + finalizers: { + items: { + type: "string" + }, + type: "array" + }, + labels: { + additionalProperties: { + type: "string" + }, + type: "object" + }, + name: { + type: "string" + }, + namespace: { + type: "string" + } + }, + type: "object", + "x-kubernetes-preserve-unknown-fields": true + }, + spec: { + description: "RevisionSpec holds the desired state of the Revision (from the client).", + properties: { + affinity: { + description: "This is accessible behind a feature flag - kubernetes.podspec-affinity", + type: "object", + "x-kubernetes-preserve-unknown-fields": true + }, + automountServiceAccountToken: { + description: "AutomountServiceAccountToken indicates whether a service account token should be automatically mounted.", + type: "boolean" + }, + containerConcurrency: { + description: "ContainerConcurrency specifies the maximum allowed in-flight (concurrent)\nrequests per container of the Revision. Defaults to `0` which means\nconcurrency to the application is not limited, and the system decides the\ntarget concurrency for the autoscaler.", + format: "int64", + type: "integer" + }, + containers: { + description: "List of containers belonging to the pod.\nContainers cannot currently be added or removed.\nThere must be at least one container in a Pod.\nCannot be updated.", + items: { + description: "A single application container that you want to run within a pod.", + properties: { + args: { + description: "Arguments to the entrypoint.\nThe container image's CMD is used if this is not provided.\nVariable references $(VAR_NAME) are expanded using the container's environment. If a variable\ncannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced\nto a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. \"$$(VAR_NAME)\" will\nproduce the string literal \"$(VAR_NAME)\". Escaped references will never be expanded, regardless\nof whether the variable exists or not. Cannot be updated.\nMore info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + command: { + description: "Entrypoint array. Not executed within a shell.\nThe container image's ENTRYPOINT is used if this is not provided.\nVariable references $(VAR_NAME) are expanded using the container's environment. If a variable\ncannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced\nto a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. \"$$(VAR_NAME)\" will\nproduce the string literal \"$(VAR_NAME)\". Escaped references will never be expanded, regardless\nof whether the variable exists or not. Cannot be updated.\nMore info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + env: { + description: "List of environment variables to set in the container.\nCannot be updated.", + items: { + description: "EnvVar represents an environment variable present in a Container.", + properties: { + name: { + description: "Name of the environment variable.\nMay consist of any printable ASCII characters except '='.", + type: "string" + }, + value: { + description: "Variable references $(VAR_NAME) are expanded\nusing the previously defined environment variables in the container and\nany service environment variables. If a variable cannot be resolved,\nthe reference in the input string will be unchanged. Double $$ are reduced\nto a single $, which allows for escaping the $(VAR_NAME) syntax: i.e.\n\"$$(VAR_NAME)\" will produce the string literal \"$(VAR_NAME)\".\nEscaped references will never be expanded, regardless of whether the variable\nexists or not.\nDefaults to \"\".", + type: "string" + }, + valueFrom: { + description: "Source for the environment variable's value. Cannot be used if value is not empty.", + properties: { + configMapKeyRef: { + description: "Selects a key of a ConfigMap.", + properties: { + key: { + description: "The key to select.", + type: "string" + }, + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "Specify whether the ConfigMap or its key must be defined", + type: "boolean" + } + }, + required: ["key"], + type: "object", + "x-kubernetes-map-type": "atomic" + }, + fieldRef: { + description: "This is accessible behind a feature flag - kubernetes.podspec-fieldref", + type: "object", + "x-kubernetes-map-type": "atomic", + "x-kubernetes-preserve-unknown-fields": true + }, + resourceFieldRef: { + description: "This is accessible behind a feature flag - kubernetes.podspec-fieldref", + type: "object", + "x-kubernetes-map-type": "atomic", + "x-kubernetes-preserve-unknown-fields": true + }, + secretKeyRef: { + description: "Selects a key of a secret in the pod's namespace", + properties: { + key: { + description: "The key of the secret to select from. Must be a valid secret key.", + type: "string" + }, + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "Specify whether the Secret or its key must be defined", + type: "boolean" + } + }, + required: ["key"], + type: "object", + "x-kubernetes-map-type": "atomic" + } + }, + type: "object" + } + }, + required: ["name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-map-keys": ["name"], + "x-kubernetes-list-type": "map" + }, + envFrom: { + description: "List of sources to populate environment variables in the container.\nThe keys defined within a source may consist of any printable ASCII characters except '='.\nWhen a key exists in multiple\nsources, the value associated with the last source will take precedence.\nValues defined by an Env with a duplicate key will take precedence.\nCannot be updated.", + items: { + description: "EnvFromSource represents the source of a set of ConfigMaps or Secrets", + properties: { + configMapRef: { + description: "The ConfigMap to select from", + properties: { + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "Specify whether the ConfigMap must be defined", + type: "boolean" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + prefix: { + description: "Optional text to prepend to the name of each environment variable.\nMay consist of any printable ASCII characters except '='.", + type: "string" + }, + secretRef: { + description: "The Secret to select from", + properties: { + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "Specify whether the Secret must be defined", + type: "boolean" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + } + }, + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + image: { + description: "Container image name.\nMore info: https://kubernetes.io/docs/concepts/containers/images\nThis field is optional to allow higher level config management to default or override\ncontainer images in workload controllers like Deployments and StatefulSets.", + type: "string" + }, + imagePullPolicy: { + description: "Image pull policy.\nOne of Always, Never, IfNotPresent.\nDefaults to Always if :latest tag is specified, or IfNotPresent otherwise.\nCannot be updated.\nMore info: https://kubernetes.io/docs/concepts/containers/images#updating-images", + type: "string" + }, + livenessProbe: { + description: "Periodic probe of container liveness.\nContainer will be restarted if the probe fails.\nCannot be updated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + properties: { + exec: { + description: "Exec specifies a command to execute in the container.", + properties: { + command: { + description: "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + failureThreshold: { + description: "Minimum consecutive failures for the probe to be considered failed after having succeeded.\nDefaults to 3. Minimum value is 1.", + format: "int32", + type: "integer" + }, + grpc: { + description: "GRPC specifies a GRPC HealthCheckRequest.", + properties: { + port: { + description: "Port number of the gRPC service. Number must be in the range 1 to 65535.", + format: "int32", + type: "integer" + }, + service: { + default: "", + description: "Service is the name of the service to place in the gRPC HealthCheckRequest\n(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).\n\nIf this is not specified, the default behavior is defined by gRPC.", + type: "string" + } + }, + type: "object" + }, + httpGet: { + description: "HTTPGet specifies an HTTP GET request to perform.", + properties: { + host: { + description: "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", + type: "string" + }, + httpHeaders: { + description: "Custom headers to set in the request. HTTP allows repeated headers.", + items: { + description: "HTTPHeader describes a custom header to be used in HTTP probes", + properties: { + name: { + description: "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", + type: "string" + }, + value: { + description: "The header field value", + type: "string" + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + path: { + description: "Path to access on the HTTP server.", + type: "string" + }, + port: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true + }, + scheme: { + description: "Scheme to use for connecting to the host.\nDefaults to HTTP.", + type: "string" + } + }, + type: "object" + }, + initialDelaySeconds: { + description: "Number of seconds after the container has started before liveness probes are initiated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + format: "int32", + type: "integer" + }, + periodSeconds: { + description: "How often (in seconds) to perform the probe.", + format: "int32", + type: "integer" + }, + successThreshold: { + description: "Minimum consecutive successes for the probe to be considered successful after having failed.\nDefaults to 1. Must be 1 for liveness and startup. Minimum value is 1.", + format: "int32", + type: "integer" + }, + tcpSocket: { + description: "TCPSocket specifies a connection to a TCP port.", + properties: { + host: { + description: "Optional: Host name to connect to, defaults to the pod IP.", + type: "string" + }, + port: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true + } + }, + type: "object" + }, + timeoutSeconds: { + description: "Number of seconds after which the probe times out.\nDefaults to 1 second. Minimum value is 1.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + format: "int32", + type: "integer" + } + }, + type: "object" + }, + name: { + description: "Name of the container specified as a DNS_LABEL.\nEach container in a pod must have a unique name (DNS_LABEL).\nCannot be updated.", + type: "string" + }, + ports: { + description: "List of ports to expose from the container. Not specifying a port here\nDOES NOT prevent that port from being exposed. Any port which is\nlistening on the default \"0.0.0.0\" address inside a container will be\naccessible from the network.\nModifying this array with strategic merge patch may corrupt the data.\nFor more information See https://github.com/kubernetes/kubernetes/issues/108255.\nCannot be updated.", + items: { + description: "ContainerPort represents a network port in a single container.", + properties: { + containerPort: { + description: "Number of port to expose on the pod's IP address.\nThis must be a valid port number, 0 < x < 65536.", + format: "int32", + type: "integer" + }, + name: { + description: "If specified, this must be an IANA_SVC_NAME and unique within the pod. Each\nnamed port in a pod must have a unique name. Name for the port that can be\nreferred to by services.", + type: "string" + }, + protocol: { + default: "TCP", + description: "Protocol for port. Must be UDP, TCP, or SCTP.\nDefaults to \"TCP\".", + type: "string" + } + }, + type: "object" + }, + type: "array" + }, + readinessProbe: { + description: "Periodic probe of container service readiness.\nContainer will be removed from service endpoints if the probe fails.\nCannot be updated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + properties: { + exec: { + description: "Exec specifies a command to execute in the container.", + properties: { + command: { + description: "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + failureThreshold: { + description: "Minimum consecutive failures for the probe to be considered failed after having succeeded.\nDefaults to 3. Minimum value is 1.", + format: "int32", + type: "integer" + }, + grpc: { + description: "GRPC specifies a GRPC HealthCheckRequest.", + properties: { + port: { + description: "Port number of the gRPC service. Number must be in the range 1 to 65535.", + format: "int32", + type: "integer" + }, + service: { + default: "", + description: "Service is the name of the service to place in the gRPC HealthCheckRequest\n(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).\n\nIf this is not specified, the default behavior is defined by gRPC.", + type: "string" + } + }, + type: "object" + }, + httpGet: { + description: "HTTPGet specifies an HTTP GET request to perform.", + properties: { + host: { + description: "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", + type: "string" + }, + httpHeaders: { + description: "Custom headers to set in the request. HTTP allows repeated headers.", + items: { + description: "HTTPHeader describes a custom header to be used in HTTP probes", + properties: { + name: { + description: "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", + type: "string" + }, + value: { + description: "The header field value", + type: "string" + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + path: { + description: "Path to access on the HTTP server.", + type: "string" + }, + port: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true + }, + scheme: { + description: "Scheme to use for connecting to the host.\nDefaults to HTTP.", + type: "string" + } + }, + type: "object" + }, + initialDelaySeconds: { + description: "Number of seconds after the container has started before liveness probes are initiated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + format: "int32", + type: "integer" + }, + periodSeconds: { + description: "How often (in seconds) to perform the probe.", + format: "int32", + type: "integer" + }, + successThreshold: { + description: "Minimum consecutive successes for the probe to be considered successful after having failed.\nDefaults to 1. Must be 1 for liveness and startup. Minimum value is 1.", + format: "int32", + type: "integer" + }, + tcpSocket: { + description: "TCPSocket specifies a connection to a TCP port.", + properties: { + host: { + description: "Optional: Host name to connect to, defaults to the pod IP.", + type: "string" + }, + port: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true + } + }, + type: "object" + }, + timeoutSeconds: { + description: "Number of seconds after which the probe times out.\nDefaults to 1 second. Minimum value is 1.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + format: "int32", + type: "integer" + } + }, + type: "object" + }, + resources: { + description: "Compute Resources required by this container.\nCannot be updated.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + properties: { + limits: { + additionalProperties: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + }, + description: "Limits describes the maximum amount of compute resources allowed.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + type: "object" + }, + requests: { + additionalProperties: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + }, + description: "Requests describes the minimum amount of compute resources required.\nIf Requests is omitted for a container, it defaults to Limits if that is explicitly specified,\notherwise to an implementation-defined value. Requests cannot exceed Limits.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + type: "object" + } + }, + type: "object" + }, + securityContext: { + description: "SecurityContext defines the security options the container should be run with.\nIf set, the fields of SecurityContext override the equivalent fields of PodSecurityContext.\nMore info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/", + properties: { + allowPrivilegeEscalation: { + description: "AllowPrivilegeEscalation controls whether a process can gain more\nprivileges than its parent process. This bool directly controls if\nthe no_new_privs flag will be set on the container process.\nAllowPrivilegeEscalation is true always when the container is:\n1) run as Privileged\n2) has CAP_SYS_ADMIN\nNote that this field cannot be set when spec.os.name is windows.", + type: "boolean" + }, + capabilities: { + description: "The capabilities to add/drop when running containers.\nDefaults to the default set of capabilities granted by the container runtime.\nNote that this field cannot be set when spec.os.name is windows.", + properties: { + add: { + description: "This is accessible behind a feature flag - kubernetes.containerspec-addcapabilities", + items: { + description: "Capability represent POSIX capabilities type", + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + drop: { + description: "Removed capabilities", + items: { + description: "Capability represent POSIX capabilities type", + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + privileged: { + description: "Run container in privileged mode. This can only be set to explicitly to 'false'", + type: "boolean" + }, + readOnlyRootFilesystem: { + description: "Whether this container has a read-only root filesystem.\nDefault is false.\nNote that this field cannot be set when spec.os.name is windows.", + type: "boolean" + }, + runAsGroup: { + description: "The GID to run the entrypoint of the container process.\nUses runtime default if unset.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is windows.", + format: "int64", + type: "integer" + }, + runAsNonRoot: { + description: "Indicates that the container must run as a non-root user.\nIf true, the Kubelet will validate the image at runtime to ensure that it\ndoes not run as UID 0 (root) and fail to start the container if it does.\nIf unset or false, no such validation will be performed.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.", + type: "boolean" + }, + runAsUser: { + description: "The UID to run the entrypoint of the container process.\nDefaults to user specified in image metadata if unspecified.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is windows.", + format: "int64", + type: "integer" + }, + seccompProfile: { + description: "The seccomp options to use by this container. If seccomp options are\nprovided at both the pod & container level, the container options\noverride the pod options.\nNote that this field cannot be set when spec.os.name is windows.", + properties: { + localhostProfile: { + description: "localhostProfile indicates a profile defined in a file on the node should be used.\nThe profile must be preconfigured on the node to work.\nMust be a descending path, relative to the kubelet's configured seccomp profile location.\nMust be set if type is \"Localhost\". Must NOT be set for any other type.", + type: "string" + }, + type: { + description: "type indicates which kind of seccomp profile will be applied.\nValid options are:\n\nLocalhost - a profile defined in a file on the node should be used.\nRuntimeDefault - the container runtime default profile should be used.\nUnconfined - no profile should be applied.", + type: "string" + } + }, + required: ["type"], + type: "object" + } + }, + type: "object" + }, + startupProbe: { + description: "StartupProbe indicates that the Pod has successfully initialized.\nIf specified, no other probes are executed until this completes successfully.\nIf this probe fails, the Pod will be restarted, just as if the livenessProbe failed.\nThis can be used to provide different probe parameters at the beginning of a Pod's lifecycle,\nwhen it might take a long time to load data or warm a cache, than during steady-state operation.\nThis cannot be updated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + properties: { + exec: { + description: "Exec specifies a command to execute in the container.", + properties: { + command: { + description: "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + failureThreshold: { + description: "Minimum consecutive failures for the probe to be considered failed after having succeeded.\nDefaults to 3. Minimum value is 1.", + format: "int32", + type: "integer" + }, + grpc: { + description: "GRPC specifies a GRPC HealthCheckRequest.", + properties: { + port: { + description: "Port number of the gRPC service. Number must be in the range 1 to 65535.", + format: "int32", + type: "integer" + }, + service: { + default: "", + description: "Service is the name of the service to place in the gRPC HealthCheckRequest\n(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).\n\nIf this is not specified, the default behavior is defined by gRPC.", + type: "string" + } + }, + type: "object" + }, + httpGet: { + description: "HTTPGet specifies an HTTP GET request to perform.", + properties: { + host: { + description: "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", + type: "string" + }, + httpHeaders: { + description: "Custom headers to set in the request. HTTP allows repeated headers.", + items: { + description: "HTTPHeader describes a custom header to be used in HTTP probes", + properties: { + name: { + description: "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", + type: "string" + }, + value: { + description: "The header field value", + type: "string" + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + path: { + description: "Path to access on the HTTP server.", + type: "string" + }, + port: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true + }, + scheme: { + description: "Scheme to use for connecting to the host.\nDefaults to HTTP.", + type: "string" + } + }, + type: "object" + }, + initialDelaySeconds: { + description: "Number of seconds after the container has started before liveness probes are initiated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + format: "int32", + type: "integer" + }, + periodSeconds: { + description: "How often (in seconds) to perform the probe.", + format: "int32", + type: "integer" + }, + successThreshold: { + description: "Minimum consecutive successes for the probe to be considered successful after having failed.\nDefaults to 1. Must be 1 for liveness and startup. Minimum value is 1.", + format: "int32", + type: "integer" + }, + tcpSocket: { + description: "TCPSocket specifies a connection to a TCP port.", + properties: { + host: { + description: "Optional: Host name to connect to, defaults to the pod IP.", + type: "string" + }, + port: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true + } + }, + type: "object" + }, + timeoutSeconds: { + description: "Number of seconds after which the probe times out.\nDefaults to 1 second. Minimum value is 1.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + format: "int32", + type: "integer" + } + }, + type: "object" + }, + terminationMessagePath: { + description: "Optional: Path at which the file to which the container's termination message\nwill be written is mounted into the container's filesystem.\nMessage written is intended to be brief final status, such as an assertion failure message.\nWill be truncated by the node if greater than 4096 bytes. The total message length across\nall containers will be limited to 12kb.\nDefaults to /dev/termination-log.\nCannot be updated.", + type: "string" + }, + terminationMessagePolicy: { + description: "Indicate how the termination message should be populated. File will use the contents of\nterminationMessagePath to populate the container status message on both success and failure.\nFallbackToLogsOnError will use the last chunk of container log output if the termination\nmessage file is empty and the container exited with an error.\nThe log output is limited to 2048 bytes or 80 lines, whichever is smaller.\nDefaults to File.\nCannot be updated.", + type: "string" + }, + volumeMounts: { + description: "Pod volumes to mount into the container's filesystem.\nCannot be updated.", + items: { + description: "VolumeMount describes a mounting of a Volume within a container.", + properties: { + mountPath: { + description: "Path within the container at which the volume should be mounted. Must\nnot contain ':'.", + type: "string" + }, + mountPropagation: { + description: "This is accessible behind a feature flag - kubernetes.podspec-volumes-mount-propagation", + type: "string" + }, + name: { + description: "This must match the Name of a Volume.", + type: "string" + }, + readOnly: { + description: "Mounted read-only if true, read-write otherwise (false or unspecified).\nDefaults to false.", + type: "boolean" + }, + subPath: { + description: "Path within the volume from which the container's volume should be mounted.\nDefaults to \"\" (volume's root).", + type: "string" + } + }, + required: ["mountPath", "name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-map-keys": ["mountPath"], + "x-kubernetes-list-type": "map" + }, + workingDir: { + description: "Container's working directory.\nIf not specified, the container runtime's default will be used, which\nmight be configured in the container image.\nCannot be updated.", + type: "string" + } + }, + type: "object" + }, + type: "array" + }, + dnsConfig: { + description: "This is accessible behind a feature flag - kubernetes.podspec-dnsconfig", + type: "object", + "x-kubernetes-preserve-unknown-fields": true + }, + dnsPolicy: { + description: "This is accessible behind a feature flag - kubernetes.podspec-dnspolicy", + type: "string" + }, + enableServiceLinks: { + description: "EnableServiceLinks indicates whether information aboutservices should be injected into pod's environment variables, matching the syntax of Docker links. Optional: Knative defaults this to false.", + type: "boolean" + }, + hostAliases: { + description: "This is accessible behind a feature flag - kubernetes.podspec-hostaliases", + items: { + description: "This is accessible behind a feature flag - kubernetes.podspec-hostaliases", + type: "object", + "x-kubernetes-preserve-unknown-fields": true + }, + type: "array" + }, + hostIPC: { + description: "This is accessible behind a feature flag - kubernetes.podspec-hostipc", + type: "boolean" + }, + hostNetwork: { + description: "This is accessible behind a feature flag - kubernetes.podspec-hostnetwork", + type: "boolean" + }, + hostPID: { + description: "This is accessible behind a feature flag - kubernetes.podspec-hostpid", + type: "boolean" + }, + idleTimeoutSeconds: { + description: "IdleTimeoutSeconds is the maximum duration in seconds a request will be allowed\nto stay open while not receiving any bytes from the user's application. If\nunspecified, a system default will be provided.", + format: "int64", + type: "integer" + }, + imagePullSecrets: { + description: "ImagePullSecrets is an optional list of references to secrets in the same namespace to use for pulling any of the images used by this PodSpec.\nIf specified, these secrets will be passed to individual puller implementations for them to use.\nMore info: https://kubernetes.io/docs/concepts/containers/images#specifying-imagepullsecrets-on-a-pod", + items: { + description: "LocalObjectReference contains enough information to let you locate the\nreferenced object inside the same namespace.", + properties: { + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + type: "array", + "x-kubernetes-list-map-keys": ["name"], + "x-kubernetes-list-type": "map" + }, + initContainers: { + description: "This is accessible behind a feature flag - kubernetes.podspec-init-containers", + items: { + description: "This is accessible behind a feature flag - kubernetes.podspec-init-containers", + type: "object", + "x-kubernetes-preserve-unknown-fields": true + }, + type: "array" + }, + nodeSelector: { + additionalProperties: { + type: "string" + }, + description: "This is accessible behind a feature flag - kubernetes.podspec-nodeselector", + type: "object", + "x-kubernetes-map-type": "atomic" + }, + priorityClassName: { + description: "This is accessible behind a feature flag - kubernetes.podspec-priorityclassname", + type: "string" + }, + responseStartTimeoutSeconds: { + description: "ResponseStartTimeoutSeconds is the maximum duration in seconds that the request\nrouting layer will wait for a request delivered to a container to begin\nsending any network traffic.", + format: "int64", + type: "integer" + }, + runtimeClassName: { + description: "This is accessible behind a feature flag - kubernetes.podspec-runtimeclassname", + type: "string" + }, + schedulerName: { + description: "This is accessible behind a feature flag - kubernetes.podspec-schedulername", + type: "string" + }, + securityContext: { + description: "This is accessible behind a feature flag - kubernetes.podspec-securitycontext", + type: "object", + "x-kubernetes-preserve-unknown-fields": true + }, + serviceAccountName: { + description: "ServiceAccountName is the name of the ServiceAccount to use to run this pod.\nMore info: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/", + type: "string" + }, + shareProcessNamespace: { + description: "This is accessible behind a feature flag - kubernetes.podspec-shareprocessnamespace", + type: "boolean" + }, + timeoutSeconds: { + description: "TimeoutSeconds is the maximum duration in seconds that the request instance\nis allowed to respond to a request. If unspecified, a system default will\nbe provided.", + format: "int64", + type: "integer" + }, + tolerations: { + description: "This is accessible behind a feature flag - kubernetes.podspec-tolerations", + items: { + description: "This is accessible behind a feature flag - kubernetes.podspec-tolerations", + type: "object", + "x-kubernetes-preserve-unknown-fields": true + }, + type: "array" + }, + topologySpreadConstraints: { + description: "This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints", + items: { + description: "This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints", + type: "object", + "x-kubernetes-preserve-unknown-fields": true + }, + type: "array" + }, + volumes: { + description: "List of volumes that can be mounted by containers belonging to the pod.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes", + items: { + description: "Volume represents a named volume in a pod that may be accessed by any container in the pod.", + properties: { + configMap: { + description: "configMap represents a configMap that should populate this volume", + properties: { + defaultMode: { + description: "defaultMode is optional: mode bits used to set permissions on created files by default.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nDefaults to 0644.\nDirectories within the path are not affected by this setting.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", + format: "int32", + type: "integer" + }, + items: { + description: "items if unspecified, each key-value pair in the Data field of the referenced\nConfigMap will be projected into the volume as a file whose name is the\nkey and content is the value. If specified, the listed keys will be\nprojected into the specified paths, and unlisted keys will not be\npresent. If a key is specified which is not present in the ConfigMap,\nthe volume setup will error unless it is marked optional. Paths must be\nrelative and may not contain the '..' path or start with '..'.", + items: { + description: "Maps a string key to a path within a volume.", + properties: { + key: { + description: "key is the key to project.", + type: "string" + }, + mode: { + description: "mode is Optional: mode bits used to set permissions on this file.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nIf not specified, the volume defaultMode will be used.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", + format: "int32", + type: "integer" + }, + path: { + description: "path is the relative path of the file to map the key to.\nMay not be an absolute path.\nMay not contain the path element '..'.\nMay not start with the string '..'.", + type: "string" + } + }, + required: ["key", "path"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "optional specify whether the ConfigMap or its keys must be defined", + type: "boolean" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + csi: { + description: "This is accessible behind a feature flag - kubernetes.podspec-volumes-csi", + type: "object", + "x-kubernetes-preserve-unknown-fields": true + }, + emptyDir: { + description: "This is accessible behind a feature flag - kubernetes.podspec-volumes-emptydir", + type: "object", + "x-kubernetes-preserve-unknown-fields": true + }, + hostPath: { + description: "This is accessible behind a feature flag - kubernetes.podspec-volumes-hostpath", + type: "object", + "x-kubernetes-preserve-unknown-fields": true + }, + image: { + description: "This is accessible behind a feature flag - kubernetes.podspec-volumes-image", + type: "object", + "x-kubernetes-preserve-unknown-fields": true + }, + name: { + description: "name of the volume.\nMust be a DNS_LABEL and unique within the pod.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + persistentVolumeClaim: { + description: "This is accessible behind a feature flag - kubernetes.podspec-persistent-volume-claim", + type: "object", + "x-kubernetes-preserve-unknown-fields": true + }, + projected: { + description: "projected items for all in one resources secrets, configmaps, and downward API", + properties: { + defaultMode: { + description: "defaultMode are the mode bits used to set permissions on created files by default.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nDirectories within the path are not affected by this setting.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", + format: "int32", + type: "integer" + }, + sources: { + description: "sources is the list of volume projections. Each entry in this list\nhandles one source.", + items: { + description: "Projection that may be projected along with other supported volume types.\nExactly one of these fields must be set.", + properties: { + configMap: { + description: "configMap information about the configMap data to project", + properties: { + items: { + description: "items if unspecified, each key-value pair in the Data field of the referenced\nConfigMap will be projected into the volume as a file whose name is the\nkey and content is the value. If specified, the listed keys will be\nprojected into the specified paths, and unlisted keys will not be\npresent. If a key is specified which is not present in the ConfigMap,\nthe volume setup will error unless it is marked optional. Paths must be\nrelative and may not contain the '..' path or start with '..'.", + items: { + description: "Maps a string key to a path within a volume.", + properties: { + key: { + description: "key is the key to project.", + type: "string" + }, + mode: { + description: "mode is Optional: mode bits used to set permissions on this file.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nIf not specified, the volume defaultMode will be used.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", + format: "int32", + type: "integer" + }, + path: { + description: "path is the relative path of the file to map the key to.\nMay not be an absolute path.\nMay not contain the path element '..'.\nMay not start with the string '..'.", + type: "string" + } + }, + required: ["key", "path"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "optional specify whether the ConfigMap or its keys must be defined", + type: "boolean" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + downwardAPI: { + description: "downwardAPI information about the downwardAPI data to project", + properties: { + items: { + description: "Items is a list of DownwardAPIVolume file", + items: { + description: "DownwardAPIVolumeFile represents information to create the file containing the pod field", + properties: { + fieldRef: { + description: "Required: Selects a field of the pod: only annotations, labels, name, namespace and uid are supported.", + properties: { + apiVersion: { + description: "Version of the schema the FieldPath is written in terms of, defaults to \"v1\".", + type: "string" + }, + fieldPath: { + description: "Path of the field to select in the specified API version.", + type: "string" + } + }, + required: ["fieldPath"], + type: "object", + "x-kubernetes-map-type": "atomic" + }, + mode: { + description: "Optional: mode bits used to set permissions on this file, must be an octal value\nbetween 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nIf not specified, the volume defaultMode will be used.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", + format: "int32", + type: "integer" + }, + path: { + description: "Required: Path is the relative path name of the file to be created. Must not be absolute or contain the '..' path. Must be utf-8 encoded. The first item of the relative path must not start with '..'", + type: "string" + }, + resourceFieldRef: { + description: "Selects a resource of the container: only resources limits and requests\n(limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported.", + properties: { + containerName: { + description: "Container name: required for volumes, optional for env vars", + type: "string" + }, + divisor: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Specifies the output format of the exposed resources, defaults to \"1\"", + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + }, + resource: { + description: "Required: resource to select", + type: "string" + } + }, + required: ["resource"], + type: "object", + "x-kubernetes-map-type": "atomic" + } + }, + required: ["path"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + secret: { + description: "secret information about the secret data to project", + properties: { + items: { + description: "items if unspecified, each key-value pair in the Data field of the referenced\nSecret will be projected into the volume as a file whose name is the\nkey and content is the value. If specified, the listed keys will be\nprojected into the specified paths, and unlisted keys will not be\npresent. If a key is specified which is not present in the Secret,\nthe volume setup will error unless it is marked optional. Paths must be\nrelative and may not contain the '..' path or start with '..'.", + items: { + description: "Maps a string key to a path within a volume.", + properties: { + key: { + description: "key is the key to project.", + type: "string" + }, + mode: { + description: "mode is Optional: mode bits used to set permissions on this file.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nIf not specified, the volume defaultMode will be used.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", + format: "int32", + type: "integer" + }, + path: { + description: "path is the relative path of the file to map the key to.\nMay not be an absolute path.\nMay not contain the path element '..'.\nMay not start with the string '..'.", + type: "string" + } + }, + required: ["key", "path"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "optional field specify whether the Secret or its key must be defined", + type: "boolean" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + serviceAccountToken: { + description: "serviceAccountToken is information about the serviceAccountToken data to project", + properties: { + audience: { + description: "audience is the intended audience of the token. A recipient of a token\nmust identify itself with an identifier specified in the audience of the\ntoken, and otherwise should reject the token. The audience defaults to the\nidentifier of the apiserver.", + type: "string" + }, + expirationSeconds: { + description: "expirationSeconds is the requested duration of validity of the service\naccount token. As the token approaches expiration, the kubelet volume\nplugin will proactively rotate the service account token. The kubelet will\nstart trying to rotate the token if the token is older than 80 percent of\nits time to live or if the token is older than 24 hours.Defaults to 1 hour\nand must be at least 10 minutes.", + format: "int64", + type: "integer" + }, + path: { + description: "path is the path relative to the mount point of the file to project the\ntoken into.", + type: "string" + } + }, + required: ["path"], + type: "object" + } + }, + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + secret: { + description: "secret represents a secret that should populate this volume.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#secret", + properties: { + defaultMode: { + description: "defaultMode is Optional: mode bits used to set permissions on created files by default.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values\nfor mode bits. Defaults to 0644.\nDirectories within the path are not affected by this setting.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", + format: "int32", + type: "integer" + }, + items: { + description: "items If unspecified, each key-value pair in the Data field of the referenced\nSecret will be projected into the volume as a file whose name is the\nkey and content is the value. If specified, the listed keys will be\nprojected into the specified paths, and unlisted keys will not be\npresent. If a key is specified which is not present in the Secret,\nthe volume setup will error unless it is marked optional. Paths must be\nrelative and may not contain the '..' path or start with '..'.", + items: { + description: "Maps a string key to a path within a volume.", + properties: { + key: { + description: "key is the key to project.", + type: "string" + }, + mode: { + description: "mode is Optional: mode bits used to set permissions on this file.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nIf not specified, the volume defaultMode will be used.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", + format: "int32", + type: "integer" + }, + path: { + description: "path is the relative path of the file to map the key to.\nMay not be an absolute path.\nMay not contain the path element '..'.\nMay not start with the string '..'.", + type: "string" + } + }, + required: ["key", "path"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + optional: { + description: "optional field specify whether the Secret or its keys must be defined", + type: "boolean" + }, + secretName: { + description: "secretName is the name of the secret in the pod's namespace to use.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#secret", + type: "string" + } + }, + type: "object" + } + }, + required: ["name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-map-keys": ["name"], + "x-kubernetes-list-type": "map" + } + }, + required: ["containers"], + type: "object" + } + }, + type: "object" + } + }, + type: "object" + }, + status: { + description: "ConfigurationStatus communicates the observed state of the Configuration (from the controller).", + properties: { + annotations: { + additionalProperties: { + type: "string" + }, + description: "Annotations is additional Status fields for the Resource to save some\nadditional State as well as convey more information to the user. This is\nroughly akin to Annotations on any k8s resource, just the reconciler conveying\nricher information outwards.", + type: "object" + }, + conditions: { + description: "Conditions the latest available observations of a resource's current state.", + items: { + description: "Condition defines a readiness condition for a Knative resource.\nSee: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties", + properties: { + lastTransitionTime: { + description: "LastTransitionTime is the last time the condition transitioned from one status to another.\nWe use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic\ndifferences (all other things held constant).", + type: "string" + }, + message: { + description: "A human readable message indicating details about the transition.", + type: "string" + }, + reason: { + description: "The reason for the condition's last transition.", + type: "string" + }, + severity: { + description: "Severity with which to treat failures of this type of condition.\nWhen this is not specified, it defaults to Error.", + type: "string" + }, + status: { + description: "Status of the condition, one of True, False, Unknown.", + type: "string" + }, + type: { + description: "Type of condition.", + type: "string" + } + }, + required: ["status", "type"], + type: "object" + }, + type: "array" + }, + latestCreatedRevisionName: { + description: "LatestCreatedRevisionName is the last revision that was created from this\nConfiguration. It might not be ready yet, for that use LatestReadyRevisionName.", + type: "string" + }, + latestReadyRevisionName: { + description: "LatestReadyRevisionName holds the name of the latest Revision stamped out\nfrom this Configuration that has had its \"Ready\" condition become \"True\".", + type: "string" + }, + observedGeneration: { + description: "ObservedGeneration is the 'Generation' of the Service that\nwas last processed by the controller.", + format: "int64", + type: "integer" + } + }, + type: "object" + } + }, + type: "object" + } + }, + served: true, + storage: true, + subresources: { + status: {} + } + }] + } +}; +export const CustomResourceDefinition_ClusterdomainclaimsNetworkingInternalKnativeDev: KubernetesResource = { + apiVersion: "apiextensions.k8s.io/v1", + kind: "CustomResourceDefinition", + metadata: { + labels: { + "app.kubernetes.io/component": "networking", + "app.kubernetes.io/name": "knative-serving", + "app.kubernetes.io/version": "1.22.1", + "knative.dev/crd-install": "true" + }, + name: "clusterdomainclaims.networking.internal.knative.dev" + }, + spec: { + group: "networking.internal.knative.dev", + names: { + categories: ["knative-internal", "networking"], + kind: "ClusterDomainClaim", + plural: "clusterdomainclaims", + shortNames: ["cdc"], + singular: "clusterdomainclaim" + }, + scope: "Cluster", + versions: [{ + name: "v1alpha1", + schema: { + openAPIV3Schema: { + description: "ClusterDomainClaim is a cluster-wide reservation for a particular domain name.", + properties: { + apiVersion: { + description: "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", + type: "string" + }, + kind: { + description: "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + type: "string" + }, + metadata: { + type: "object" + }, + spec: { + description: "Spec is the desired state of the ClusterDomainClaim.\nMore info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status", + properties: { + namespace: { + description: "Namespace is the namespace which is allowed to create a DomainMapping\nusing this ClusterDomainClaim's name.", + type: "string" + } + }, + required: ["namespace"], + type: "object" + } + }, + type: "object" + } + }, + served: true, + storage: true, + subresources: { + status: {} + } + }] + } +}; +export const CustomResourceDefinition_DomainmappingsServingKnativeDev: KubernetesResource = { + apiVersion: "apiextensions.k8s.io/v1", + kind: "CustomResourceDefinition", + metadata: { + labels: { + "app.kubernetes.io/name": "knative-serving", + "app.kubernetes.io/version": "1.22.1", + "knative.dev/crd-install": "true" + }, + name: "domainmappings.serving.knative.dev" + }, + spec: { + group: "serving.knative.dev", + names: { + categories: ["all", "knative", "serving"], + kind: "DomainMapping", + plural: "domainmappings", + shortNames: ["dm"], + singular: "domainmapping" + }, + scope: "Namespaced", + versions: [{ + additionalPrinterColumns: [{ + jsonPath: ".status.url", + name: "URL", + type: "string" + }, { + jsonPath: ".status.conditions[?(@.type=='Ready')].status", + name: "Ready", + type: "string" + }, { + jsonPath: ".status.conditions[?(@.type=='Ready')].reason", + name: "Reason", + type: "string" + }], + name: "v1beta1", + schema: { + openAPIV3Schema: { + description: "DomainMapping is a mapping from a custom hostname to an Addressable.", + properties: { + apiVersion: { + description: "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", + type: "string" + }, + kind: { + description: "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + type: "string" + }, + metadata: { + type: "object" + }, + spec: { + description: "Spec is the desired state of the DomainMapping.\nMore info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status", + properties: { + ref: { + description: "Ref specifies the target of the Domain Mapping.\n\nThe object identified by the Ref must be an Addressable with a URL of the\nform `{name}.{namespace}.{domain}` where `{domain}` is the cluster domain,\nand `{name}` and `{namespace}` are the name and namespace of a Kubernetes\nService.\n\nThis contract is satisfied by Knative types such as Knative Services and\nKnative Routes, and by Kubernetes Services.", + properties: { + address: { + description: "Address points to a specific Address Name.", + type: "string" + }, + apiVersion: { + description: "API version of the referent.", + type: "string" + }, + group: { + description: "Group of the API, without the version of the group. This can be used as an alternative to the APIVersion, and then resolved using ResolveGroup.\nNote: This API is EXPERIMENTAL and might break anytime. For more details: https://github.com/knative/eventing/issues/5086", + type: "string" + }, + kind: { + description: "Kind of the referent.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + type: "string" + }, + name: { + description: "Name of the referent.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + namespace: { + description: "Namespace of the referent.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/\nThis is optional field, it gets defaulted to the object holding it if left out.", + type: "string" + } + }, + required: ["kind", "name"], + type: "object" + }, + tls: { + description: "TLS allows the DomainMapping to terminate TLS traffic with an existing secret.", + properties: { + secretName: { + description: "SecretName is the name of the existing secret used to terminate TLS traffic.", + type: "string" + } + }, + required: ["secretName"], + type: "object" + } + }, + required: ["ref"], + type: "object" + }, + status: { + description: "Status is the current state of the DomainMapping.\nMore info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status", + properties: { + address: { + description: "Address holds the information needed for a DomainMapping to be the target of an event.", + properties: { + audience: { + description: "Audience is the OIDC audience for this address.", + type: "string" + }, + CACerts: { + description: "CACerts is the Certification Authority (CA) certificates in PEM format\naccording to https://www.rfc-editor.org/rfc/rfc7468.", + type: "string" + }, + name: { + description: "Name is the name of the address.", + type: "string" + }, + url: { + type: "string" + } + }, + type: "object" + }, + annotations: { + additionalProperties: { + type: "string" + }, + description: "Annotations is additional Status fields for the Resource to save some\nadditional State as well as convey more information to the user. This is\nroughly akin to Annotations on any k8s resource, just the reconciler conveying\nricher information outwards.", + type: "object" + }, + conditions: { + description: "Conditions the latest available observations of a resource's current state.", + items: { + description: "Condition defines a readiness condition for a Knative resource.\nSee: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties", + properties: { + lastTransitionTime: { + description: "LastTransitionTime is the last time the condition transitioned from one status to another.\nWe use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic\ndifferences (all other things held constant).", + type: "string" + }, + message: { + description: "A human readable message indicating details about the transition.", + type: "string" + }, + reason: { + description: "The reason for the condition's last transition.", + type: "string" + }, + severity: { + description: "Severity with which to treat failures of this type of condition.\nWhen this is not specified, it defaults to Error.", + type: "string" + }, + status: { + description: "Status of the condition, one of True, False, Unknown.", + type: "string" + }, + type: { + description: "Type of condition.", + type: "string" + } + }, + required: ["status", "type"], + type: "object" + }, + type: "array" + }, + observedGeneration: { + description: "ObservedGeneration is the 'Generation' of the Service that\nwas last processed by the controller.", + format: "int64", + type: "integer" + }, + url: { + description: "URL is the URL of this DomainMapping.", + type: "string" + } + }, + type: "object" + } + }, + type: "object" + } + }, + served: true, + storage: true, + subresources: { + status: {} + } + }] + } +}; +export const CustomResourceDefinition_IngressesNetworkingInternalKnativeDev: KubernetesResource = { + apiVersion: "apiextensions.k8s.io/v1", + kind: "CustomResourceDefinition", + metadata: { + labels: { + "app.kubernetes.io/component": "networking", + "app.kubernetes.io/name": "knative-serving", + "app.kubernetes.io/version": "1.22.1", + "knative.dev/crd-install": "true" + }, + name: "ingresses.networking.internal.knative.dev" + }, + spec: { + group: "networking.internal.knative.dev", + names: { + categories: ["knative-internal", "networking"], + kind: "Ingress", + plural: "ingresses", + shortNames: ["kingress", "king"], + singular: "ingress" + }, + scope: "Namespaced", + versions: [{ + additionalPrinterColumns: [{ + jsonPath: ".status.conditions[?(@.type=='Ready')].status", + name: "Ready", + type: "string" + }, { + jsonPath: ".status.conditions[?(@.type=='Ready')].reason", + name: "Reason", + type: "string" + }], + name: "v1alpha1", + schema: { + openAPIV3Schema: { + description: "Ingress is a collection of rules that allow inbound connections to reach the endpoints defined\nby a backend. An Ingress can be configured to give services externally-reachable URLs, load\nbalance traffic, offer name based virtual hosting, etc.\n\nThis is heavily based on K8s Ingress https://godoc.org/k8s.io/api/networking/v1beta1#Ingress\nwhich some highlighted modifications.", + properties: { + apiVersion: { + description: "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", + type: "string" + }, + kind: { + description: "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + type: "string" + }, + metadata: { + type: "object" + }, + spec: { + description: "Spec is the desired state of the Ingress.\nMore info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status", + properties: { + httpOption: { + description: "HTTPOption is the option of HTTP. It has the following two values:\n`HTTPOptionEnabled`, `HTTPOptionRedirected`", + type: "string" + }, + rules: { + description: "A list of host rules used to configure the Ingress.", + items: { + description: "IngressRule represents the rules mapping the paths under a specified host to\nthe related backend services. Incoming requests are first evaluated for a host\nmatch, then routed to the backend associated with the matching IngressRuleValue.", + properties: { + hosts: { + description: "Host is the fully qualified domain name of a network host, as defined\nby RFC 3986. Note the following deviations from the \"host\" part of the\nURI as defined in the RFC:\n1. IPs are not allowed. Currently a rule value can only apply to the\n\t IP in the Spec of the parent .\n2. The `:` delimiter is not respected because ports are not allowed.\n\t Currently the port of an Ingress is implicitly :80 for http and\n\t :443 for https.\nBoth these may change in the future.\nIf the host is unspecified, the Ingress routes all traffic based on the\nspecified IngressRuleValue.\nIf multiple matching Hosts were provided, the first rule will take precedent.", + items: { + type: "string" + }, + type: "array" + }, + http: { + description: "HTTP represents a rule to apply against incoming requests. If the\nrule is satisfied, the request is routed to the specified backend.", + properties: { + paths: { + description: "A collection of paths that map requests to backends.\n\nIf they are multiple matching paths, the first match takes precedence.", + items: { + description: "HTTPIngressPath associates a path regex with a backend. Incoming URLs matching\nthe path are forwarded to the backend.", + properties: { + appendHeaders: { + additionalProperties: { + type: "string" + }, + description: "AppendHeaders allow specifying additional HTTP headers to add\nbefore forwarding a request to the destination service.\n\nNOTE: This differs from K8s Ingress which doesn't allow header appending.", + type: "object" + }, + headers: { + additionalProperties: { + description: "HeaderMatch represents a matching value of Headers in HTTPIngressPath.\nCurrently, only the exact matching is supported.", + properties: { + exact: { + type: "string" + } + }, + required: ["exact"], + type: "object" + }, + description: "Headers defines header matching rules which is a map from a header name\nto HeaderMatch which specify a matching condition.\nWhen a request matched with all the header matching rules,\nthe request is routed by the corresponding ingress rule.\nIf it is empty, the headers are not used for matching", + type: "object" + }, + path: { + description: "Path represents a literal prefix to which this rule should apply.\nCurrently it can contain characters disallowed from the conventional\n\"path\" part of a URL as defined by RFC 3986. Paths must begin with\na '/'. If unspecified, the path defaults to a catch all sending\ntraffic to the backend.", + type: "string" + }, + rewriteHost: { + description: "RewriteHost rewrites the incoming request's host header.\n\nThis field is currently experimental and not supported by all Ingress\nimplementations.", + type: "string" + }, + splits: { + description: "Splits defines the referenced service endpoints to which the traffic\nwill be forwarded to.", + items: { + description: "IngressBackendSplit describes all endpoints for a given service and port.", + properties: { + appendHeaders: { + additionalProperties: { + type: "string" + }, + description: "AppendHeaders allow specifying additional HTTP headers to add\nbefore forwarding a request to the destination service.\n\nNOTE: This differs from K8s Ingress which doesn't allow header appending.", + type: "object" + }, + percent: { + description: "Specifies the split percentage, a number between 0 and 100. If\nonly one split is specified, we default to 100.\n\nNOTE: This differs from K8s Ingress to allow percentage split.", + type: "integer" + }, + serviceName: { + description: "Specifies the name of the referenced service.", + type: "string" + }, + serviceNamespace: { + description: "Specifies the namespace of the referenced service.\n\nNOTE: This differs from K8s Ingress to allow routing to different namespaces.", + type: "string" + }, + servicePort: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Specifies the port of the referenced service.", + "x-kubernetes-int-or-string": true + } + }, + required: ["serviceName", "serviceNamespace", "servicePort"], + type: "object" + }, + type: "array" + } + }, + required: ["splits"], + type: "object" + }, + type: "array" + } + }, + required: ["paths"], + type: "object" + }, + visibility: { + description: "Visibility signifies whether this rule should `ClusterLocal`. If it's not\nspecified then it defaults to `ExternalIP`.", + type: "string" + } + }, + type: "object" + }, + type: "array" + }, + tls: { + description: "TLS configuration. Currently Ingress only supports a single TLS\nport: 443. If multiple members of this list specify different hosts, they\nwill be multiplexed on the same port according to the hostname specified\nthrough the SNI TLS extension, if the ingress controller fulfilling the\ningress supports SNI.", + items: { + description: "IngressTLS describes the transport layer security associated with an Ingress.", + properties: { + hosts: { + description: "Hosts is a list of hosts included in the TLS certificate. The values in\nthis list must match the name/s used in the tlsSecret. Defaults to the\nwildcard host setting for the loadbalancer controller fulfilling this\nIngress, if left unspecified.", + items: { + type: "string" + }, + type: "array" + }, + secretName: { + description: "SecretName is the name of the secret used to terminate SSL traffic.", + type: "string" + }, + secretNamespace: { + description: "SecretNamespace is the namespace of the secret used to terminate SSL traffic.\nIf not set the namespace should be assumed to be the same as the Ingress.\nIf set the secret should have the same namespace as the Ingress otherwise\nthe behaviour is undefined and not supported.", + type: "string" + } + }, + type: "object" + }, + type: "array" + } + }, + type: "object" + }, + status: { + description: "Status is the current state of the Ingress.\nMore info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status", + properties: { + annotations: { + additionalProperties: { + type: "string" + }, + description: "Annotations is additional Status fields for the Resource to save some\nadditional State as well as convey more information to the user. This is\nroughly akin to Annotations on any k8s resource, just the reconciler conveying\nricher information outwards.", + type: "object" + }, + conditions: { + description: "Conditions the latest available observations of a resource's current state.", + items: { + description: "Condition defines a readiness condition for a Knative resource.\nSee: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties", + properties: { + lastTransitionTime: { + description: "LastTransitionTime is the last time the condition transitioned from one status to another.\nWe use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic\ndifferences (all other things held constant).", + type: "string" + }, + message: { + description: "A human readable message indicating details about the transition.", + type: "string" + }, + reason: { + description: "The reason for the condition's last transition.", + type: "string" + }, + severity: { + description: "Severity with which to treat failures of this type of condition.\nWhen this is not specified, it defaults to Error.", + type: "string" + }, + status: { + description: "Status of the condition, one of True, False, Unknown.", + type: "string" + }, + type: { + description: "Type of condition.", + type: "string" + } + }, + required: ["status", "type"], + type: "object" + }, + type: "array" + }, + observedGeneration: { + description: "ObservedGeneration is the 'Generation' of the Service that\nwas last processed by the controller.", + format: "int64", + type: "integer" + }, + privateLoadBalancer: { + description: "PrivateLoadBalancer contains the current status of the load-balancer.", + properties: { + ingress: { + description: "Ingress is a list containing ingress points for the load-balancer.\nTraffic intended for the service should be sent to these ingress points.", + items: { + description: "LoadBalancerIngressStatus represents the status of a load-balancer ingress point:\ntraffic intended for the service should be sent to an ingress point.", + properties: { + domain: { + description: "Domain is set for load-balancer ingress points that are DNS based\n(typically AWS load-balancers)", + type: "string" + }, + domainInternal: { + description: "DomainInternal is set if there is a cluster-local DNS name to access the Ingress.\n\nNOTE: This differs from K8s Ingress, since we also desire to have a cluster-local\n DNS name to allow routing in case of not having a mesh.", + type: "string" + }, + ip: { + description: "IP is set for load-balancer ingress points that are IP based\n(typically GCE or OpenStack load-balancers)", + type: "string" + }, + meshOnly: { + description: "MeshOnly is set if the Ingress is only load-balanced through a Service mesh.", + type: "boolean" + } + }, + type: "object" + }, + type: "array" + } + }, + type: "object" + }, + publicLoadBalancer: { + description: "PublicLoadBalancer contains the current status of the load-balancer.", + properties: { + ingress: { + description: "Ingress is a list containing ingress points for the load-balancer.\nTraffic intended for the service should be sent to these ingress points.", + items: { + description: "LoadBalancerIngressStatus represents the status of a load-balancer ingress point:\ntraffic intended for the service should be sent to an ingress point.", + properties: { + domain: { + description: "Domain is set for load-balancer ingress points that are DNS based\n(typically AWS load-balancers)", + type: "string" + }, + domainInternal: { + description: "DomainInternal is set if there is a cluster-local DNS name to access the Ingress.\n\nNOTE: This differs from K8s Ingress, since we also desire to have a cluster-local\n DNS name to allow routing in case of not having a mesh.", + type: "string" + }, + ip: { + description: "IP is set for load-balancer ingress points that are IP based\n(typically GCE or OpenStack load-balancers)", + type: "string" + }, + meshOnly: { + description: "MeshOnly is set if the Ingress is only load-balanced through a Service mesh.", + type: "boolean" + } + }, + type: "object" + }, + type: "array" + } + }, + type: "object" + } + }, + type: "object" + } + }, + type: "object" + } + }, + served: true, + storage: true, + subresources: { + status: {} + } + }] + } +}; +export const CustomResourceDefinition_MetricsAutoscalingInternalKnativeDev: KubernetesResource = { + apiVersion: "apiextensions.k8s.io/v1", + kind: "CustomResourceDefinition", + metadata: { + labels: { + "app.kubernetes.io/name": "knative-serving", + "app.kubernetes.io/version": "1.22.1", + "knative.dev/crd-install": "true" + }, + name: "metrics.autoscaling.internal.knative.dev" + }, + spec: { + group: "autoscaling.internal.knative.dev", + names: { + categories: ["knative-internal", "autoscaling"], + kind: "Metric", + plural: "metrics", + singular: "metric" + }, + scope: "Namespaced", + versions: [{ + additionalPrinterColumns: [{ + jsonPath: ".status.conditions[?(@.type=='Ready')].status", + name: "Ready", + type: "string" + }, { + jsonPath: ".status.conditions[?(@.type=='Ready')].reason", + name: "Reason", + type: "string" + }], + name: "v1alpha1", + schema: { + openAPIV3Schema: { + description: "Metric represents a resource to configure the metric collector with.", + properties: { + apiVersion: { + description: "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", + type: "string" + }, + kind: { + description: "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + type: "string" + }, + metadata: { + type: "object" + }, + spec: { + description: "Spec holds the desired state of the Metric (from the client).", + properties: { + panicWindow: { + description: "PanicWindow is the aggregation window for metrics where quick reactions are needed.", + format: "int64", + type: "integer" + }, + scrapeTarget: { + description: "ScrapeTarget is the K8s service that publishes the metric endpoint.", + type: "string" + }, + stableWindow: { + description: "StableWindow is the aggregation window for metrics in a stable state.", + format: "int64", + type: "integer" + } + }, + required: ["panicWindow", "scrapeTarget", "stableWindow"], + type: "object" + }, + status: { + description: "Status communicates the observed state of the Metric (from the controller).", + properties: { + annotations: { + additionalProperties: { + type: "string" + }, + description: "Annotations is additional Status fields for the Resource to save some\nadditional State as well as convey more information to the user. This is\nroughly akin to Annotations on any k8s resource, just the reconciler conveying\nricher information outwards.", + type: "object" + }, + conditions: { + description: "Conditions the latest available observations of a resource's current state.", + items: { + description: "Condition defines a readiness condition for a Knative resource.\nSee: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties", + properties: { + lastTransitionTime: { + description: "LastTransitionTime is the last time the condition transitioned from one status to another.\nWe use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic\ndifferences (all other things held constant).", + type: "string" + }, + message: { + description: "A human readable message indicating details about the transition.", + type: "string" + }, + reason: { + description: "The reason for the condition's last transition.", + type: "string" + }, + severity: { + description: "Severity with which to treat failures of this type of condition.\nWhen this is not specified, it defaults to Error.", + type: "string" + }, + status: { + description: "Status of the condition, one of True, False, Unknown.", + type: "string" + }, + type: { + description: "Type of condition.", + type: "string" + } + }, + required: ["status", "type"], + type: "object" + }, + type: "array" + }, + observedGeneration: { + description: "ObservedGeneration is the 'Generation' of the Service that\nwas last processed by the controller.", + format: "int64", + type: "integer" + } + }, + type: "object" + } + }, + type: "object" + } + }, + served: true, + storage: true, + subresources: { + status: {} + } + }] + } +}; +export const CustomResourceDefinition_PodautoscalersAutoscalingInternalKnativeDev: KubernetesResource = { + apiVersion: "apiextensions.k8s.io/v1", + kind: "CustomResourceDefinition", + metadata: { + labels: { + "app.kubernetes.io/name": "knative-serving", + "app.kubernetes.io/version": "1.22.1", + "knative.dev/crd-install": "true" + }, + name: "podautoscalers.autoscaling.internal.knative.dev" + }, + spec: { + group: "autoscaling.internal.knative.dev", + names: { + categories: ["knative-internal", "autoscaling"], + kind: "PodAutoscaler", + plural: "podautoscalers", + shortNames: ["kpa", "pa"], + singular: "podautoscaler" + }, + scope: "Namespaced", + versions: [{ + additionalPrinterColumns: [{ + jsonPath: ".status.desiredScale", + name: "DesiredScale", + type: "integer" + }, { + jsonPath: ".status.actualScale", + name: "ActualScale", + type: "integer" + }, { + jsonPath: ".status.conditions[?(@.type=='Ready')].status", + name: "Ready", + type: "string" + }, { + jsonPath: ".status.conditions[?(@.type=='Ready')].reason", + name: "Reason", + type: "string" + }], + name: "v1alpha1", + schema: { + openAPIV3Schema: { + description: "PodAutoscaler is a Knative abstraction that encapsulates the interface by which Knative\ncomponents instantiate autoscalers. This definition is an abstraction that may be backed\nby multiple definitions. For more information, see the Knative Pluggability presentation:\nhttps://docs.google.com/presentation/d/19vW9HFZ6Puxt31biNZF3uLRejDmu82rxJIk1cWmxF7w/edit", + properties: { + apiVersion: { + description: "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", + type: "string" + }, + kind: { + description: "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + type: "string" + }, + metadata: { + type: "object" + }, + spec: { + description: "Spec holds the desired state of the PodAutoscaler (from the client).", + properties: { + containerConcurrency: { + description: "ContainerConcurrency specifies the maximum allowed\nin-flight (concurrent) requests per container of the Revision.\nDefaults to `0` which means unlimited concurrency.", + format: "int64", + type: "integer" + }, + protocolType: { + description: "The application-layer protocol. Matches `ProtocolType` inferred from the revision spec.", + type: "string" + }, + reachability: { + description: "Reachability specifies whether or not the `ScaleTargetRef` can be reached (ie. has a route).\nDefaults to `ReachabilityUnknown`", + type: "string" + }, + scaleTargetRef: { + description: "ScaleTargetRef defines the /scale-able resource that this PodAutoscaler\nis responsible for quickly right-sizing.", + properties: { + apiVersion: { + description: "API version of the referent.", + type: "string" + }, + kind: { + description: "Kind of the referent.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + type: "string" + }, + name: { + description: "Name of the referent.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + } + }, + required: ["protocolType", "scaleTargetRef"], + type: "object" + }, + status: { + description: "Status communicates the observed state of the PodAutoscaler (from the controller).", + properties: { + actualScale: { + description: "ActualScale shows the actual number of replicas for the revision.", + format: "int32", + type: "integer" + }, + annotations: { + additionalProperties: { + type: "string" + }, + description: "Annotations is additional Status fields for the Resource to save some\nadditional State as well as convey more information to the user. This is\nroughly akin to Annotations on any k8s resource, just the reconciler conveying\nricher information outwards.", + type: "object" + }, + conditions: { + description: "Conditions the latest available observations of a resource's current state.", + items: { + description: "Condition defines a readiness condition for a Knative resource.\nSee: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties", + properties: { + lastTransitionTime: { + description: "LastTransitionTime is the last time the condition transitioned from one status to another.\nWe use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic\ndifferences (all other things held constant).", + type: "string" + }, + message: { + description: "A human readable message indicating details about the transition.", + type: "string" + }, + reason: { + description: "The reason for the condition's last transition.", + type: "string" + }, + severity: { + description: "Severity with which to treat failures of this type of condition.\nWhen this is not specified, it defaults to Error.", + type: "string" + }, + status: { + description: "Status of the condition, one of True, False, Unknown.", + type: "string" + }, + type: { + description: "Type of condition.", + type: "string" + } + }, + required: ["status", "type"], + type: "object" + }, + type: "array" + }, + desiredScale: { + description: "DesiredScale shows the current desired number of replicas for the revision.", + format: "int32", + type: "integer" + }, + metricsServiceName: { + description: "MetricsServiceName is the K8s Service name that provides revision metrics.\nThe service is managed by the PA object.", + type: "string" + }, + observedGeneration: { + description: "ObservedGeneration is the 'Generation' of the Service that\nwas last processed by the controller.", + format: "int64", + type: "integer" + }, + serviceName: { + description: "ServiceName is the K8s Service name that serves the revision, scaled by this PA.\nThe service is created and owned by the ServerlessService object owned by this PA.", + type: "string" + } + }, + required: ["metricsServiceName", "serviceName"], + type: "object" + } + }, + type: "object" + } + }, + served: true, + storage: true, + subresources: { + status: {} + } + }] + } +}; +export const CustomResourceDefinition_RevisionsServingKnativeDev: KubernetesResource = { + apiVersion: "apiextensions.k8s.io/v1", + kind: "CustomResourceDefinition", + metadata: { + labels: { + "app.kubernetes.io/name": "knative-serving", + "app.kubernetes.io/version": "1.22.1", + "knative.dev/crd-install": "true" + }, + name: "revisions.serving.knative.dev" + }, + spec: { + group: "serving.knative.dev", + names: { + categories: ["all", "knative", "serving"], + kind: "Revision", + plural: "revisions", + shortNames: ["rev"], + singular: "revision" + }, + scope: "Namespaced", + versions: [{ + additionalPrinterColumns: [{ + jsonPath: ".metadata.labels['serving\\.knative\\.dev/configuration']", + name: "Config Name", + type: "string" + }, { + jsonPath: ".metadata.labels['serving\\.knative\\.dev/configurationGeneration']", + name: "Generation", + type: "string" + }, { + jsonPath: ".status.conditions[?(@.type=='Ready')].status", + name: "Ready", + type: "string" + }, { + jsonPath: ".status.conditions[?(@.type=='Ready')].reason", + name: "Reason", + type: "string" + }, { + jsonPath: ".status.actualReplicas", + name: "Actual Replicas", + type: "integer" + }, { + jsonPath: ".status.desiredReplicas", + name: "Desired Replicas", + type: "integer" + }], + name: "v1", + schema: { + openAPIV3Schema: { + description: "Revision is an immutable snapshot of code and configuration. A revision\nreferences a container image. Revisions are created by updates to a\nConfiguration.\n\nSee also: https://github.com/knative/serving/blob/main/docs/spec/overview.md#revision", + properties: { + apiVersion: { + description: "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", + type: "string" + }, + kind: { + description: "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + type: "string" + }, + metadata: { + type: "object" + }, + spec: { + description: "RevisionSpec holds the desired state of the Revision (from the client).", + properties: { + affinity: { + description: "This is accessible behind a feature flag - kubernetes.podspec-affinity", + type: "object", + "x-kubernetes-preserve-unknown-fields": true + }, + automountServiceAccountToken: { + description: "AutomountServiceAccountToken indicates whether a service account token should be automatically mounted.", + type: "boolean" + }, + containerConcurrency: { + description: "ContainerConcurrency specifies the maximum allowed in-flight (concurrent)\nrequests per container of the Revision. Defaults to `0` which means\nconcurrency to the application is not limited, and the system decides the\ntarget concurrency for the autoscaler.", + format: "int64", + type: "integer" + }, + containers: { + description: "List of containers belonging to the pod.\nContainers cannot currently be added or removed.\nThere must be at least one container in a Pod.\nCannot be updated.", + items: { + description: "A single application container that you want to run within a pod.", + properties: { + args: { + description: "Arguments to the entrypoint.\nThe container image's CMD is used if this is not provided.\nVariable references $(VAR_NAME) are expanded using the container's environment. If a variable\ncannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced\nto a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. \"$$(VAR_NAME)\" will\nproduce the string literal \"$(VAR_NAME)\". Escaped references will never be expanded, regardless\nof whether the variable exists or not. Cannot be updated.\nMore info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + command: { + description: "Entrypoint array. Not executed within a shell.\nThe container image's ENTRYPOINT is used if this is not provided.\nVariable references $(VAR_NAME) are expanded using the container's environment. If a variable\ncannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced\nto a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. \"$$(VAR_NAME)\" will\nproduce the string literal \"$(VAR_NAME)\". Escaped references will never be expanded, regardless\nof whether the variable exists or not. Cannot be updated.\nMore info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + env: { + description: "List of environment variables to set in the container.\nCannot be updated.", + items: { + description: "EnvVar represents an environment variable present in a Container.", + properties: { + name: { + description: "Name of the environment variable.\nMay consist of any printable ASCII characters except '='.", + type: "string" + }, + value: { + description: "Variable references $(VAR_NAME) are expanded\nusing the previously defined environment variables in the container and\nany service environment variables. If a variable cannot be resolved,\nthe reference in the input string will be unchanged. Double $$ are reduced\nto a single $, which allows for escaping the $(VAR_NAME) syntax: i.e.\n\"$$(VAR_NAME)\" will produce the string literal \"$(VAR_NAME)\".\nEscaped references will never be expanded, regardless of whether the variable\nexists or not.\nDefaults to \"\".", + type: "string" + }, + valueFrom: { + description: "Source for the environment variable's value. Cannot be used if value is not empty.", + properties: { + configMapKeyRef: { + description: "Selects a key of a ConfigMap.", + properties: { + key: { + description: "The key to select.", + type: "string" + }, + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "Specify whether the ConfigMap or its key must be defined", + type: "boolean" + } + }, + required: ["key"], + type: "object", + "x-kubernetes-map-type": "atomic" + }, + fieldRef: { + description: "This is accessible behind a feature flag - kubernetes.podspec-fieldref", + type: "object", + "x-kubernetes-map-type": "atomic", + "x-kubernetes-preserve-unknown-fields": true + }, + resourceFieldRef: { + description: "This is accessible behind a feature flag - kubernetes.podspec-fieldref", + type: "object", + "x-kubernetes-map-type": "atomic", + "x-kubernetes-preserve-unknown-fields": true + }, + secretKeyRef: { + description: "Selects a key of a secret in the pod's namespace", + properties: { + key: { + description: "The key of the secret to select from. Must be a valid secret key.", + type: "string" + }, + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "Specify whether the Secret or its key must be defined", + type: "boolean" + } + }, + required: ["key"], + type: "object", + "x-kubernetes-map-type": "atomic" + } + }, + type: "object" + } + }, + required: ["name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-map-keys": ["name"], + "x-kubernetes-list-type": "map" + }, + envFrom: { + description: "List of sources to populate environment variables in the container.\nThe keys defined within a source may consist of any printable ASCII characters except '='.\nWhen a key exists in multiple\nsources, the value associated with the last source will take precedence.\nValues defined by an Env with a duplicate key will take precedence.\nCannot be updated.", + items: { + description: "EnvFromSource represents the source of a set of ConfigMaps or Secrets", + properties: { + configMapRef: { + description: "The ConfigMap to select from", + properties: { + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "Specify whether the ConfigMap must be defined", + type: "boolean" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + prefix: { + description: "Optional text to prepend to the name of each environment variable.\nMay consist of any printable ASCII characters except '='.", + type: "string" + }, + secretRef: { + description: "The Secret to select from", + properties: { + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "Specify whether the Secret must be defined", + type: "boolean" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + } + }, + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + image: { + description: "Container image name.\nMore info: https://kubernetes.io/docs/concepts/containers/images\nThis field is optional to allow higher level config management to default or override\ncontainer images in workload controllers like Deployments and StatefulSets.", + type: "string" + }, + imagePullPolicy: { + description: "Image pull policy.\nOne of Always, Never, IfNotPresent.\nDefaults to Always if :latest tag is specified, or IfNotPresent otherwise.\nCannot be updated.\nMore info: https://kubernetes.io/docs/concepts/containers/images#updating-images", + type: "string" + }, + livenessProbe: { + description: "Periodic probe of container liveness.\nContainer will be restarted if the probe fails.\nCannot be updated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + properties: { + exec: { + description: "Exec specifies a command to execute in the container.", + properties: { + command: { + description: "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + failureThreshold: { + description: "Minimum consecutive failures for the probe to be considered failed after having succeeded.\nDefaults to 3. Minimum value is 1.", + format: "int32", + type: "integer" + }, + grpc: { + description: "GRPC specifies a GRPC HealthCheckRequest.", + properties: { + port: { + description: "Port number of the gRPC service. Number must be in the range 1 to 65535.", + format: "int32", + type: "integer" + }, + service: { + default: "", + description: "Service is the name of the service to place in the gRPC HealthCheckRequest\n(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).\n\nIf this is not specified, the default behavior is defined by gRPC.", + type: "string" + } + }, + type: "object" + }, + httpGet: { + description: "HTTPGet specifies an HTTP GET request to perform.", + properties: { + host: { + description: "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", + type: "string" + }, + httpHeaders: { + description: "Custom headers to set in the request. HTTP allows repeated headers.", + items: { + description: "HTTPHeader describes a custom header to be used in HTTP probes", + properties: { + name: { + description: "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", + type: "string" + }, + value: { + description: "The header field value", + type: "string" + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + path: { + description: "Path to access on the HTTP server.", + type: "string" + }, + port: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true + }, + scheme: { + description: "Scheme to use for connecting to the host.\nDefaults to HTTP.", + type: "string" + } + }, + type: "object" + }, + initialDelaySeconds: { + description: "Number of seconds after the container has started before liveness probes are initiated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + format: "int32", + type: "integer" + }, + periodSeconds: { + description: "How often (in seconds) to perform the probe.", + format: "int32", + type: "integer" + }, + successThreshold: { + description: "Minimum consecutive successes for the probe to be considered successful after having failed.\nDefaults to 1. Must be 1 for liveness and startup. Minimum value is 1.", + format: "int32", + type: "integer" + }, + tcpSocket: { + description: "TCPSocket specifies a connection to a TCP port.", + properties: { + host: { + description: "Optional: Host name to connect to, defaults to the pod IP.", + type: "string" + }, + port: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true + } + }, + type: "object" + }, + timeoutSeconds: { + description: "Number of seconds after which the probe times out.\nDefaults to 1 second. Minimum value is 1.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + format: "int32", + type: "integer" + } + }, + type: "object" + }, + name: { + description: "Name of the container specified as a DNS_LABEL.\nEach container in a pod must have a unique name (DNS_LABEL).\nCannot be updated.", + type: "string" + }, + ports: { + description: "List of ports to expose from the container. Not specifying a port here\nDOES NOT prevent that port from being exposed. Any port which is\nlistening on the default \"0.0.0.0\" address inside a container will be\naccessible from the network.\nModifying this array with strategic merge patch may corrupt the data.\nFor more information See https://github.com/kubernetes/kubernetes/issues/108255.\nCannot be updated.", + items: { + description: "ContainerPort represents a network port in a single container.", + properties: { + containerPort: { + description: "Number of port to expose on the pod's IP address.\nThis must be a valid port number, 0 < x < 65536.", + format: "int32", + type: "integer" + }, + name: { + description: "If specified, this must be an IANA_SVC_NAME and unique within the pod. Each\nnamed port in a pod must have a unique name. Name for the port that can be\nreferred to by services.", + type: "string" + }, + protocol: { + default: "TCP", + description: "Protocol for port. Must be UDP, TCP, or SCTP.\nDefaults to \"TCP\".", + type: "string" + } + }, + type: "object" + }, + type: "array" + }, + readinessProbe: { + description: "Periodic probe of container service readiness.\nContainer will be removed from service endpoints if the probe fails.\nCannot be updated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + properties: { + exec: { + description: "Exec specifies a command to execute in the container.", + properties: { + command: { + description: "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + failureThreshold: { + description: "Minimum consecutive failures for the probe to be considered failed after having succeeded.\nDefaults to 3. Minimum value is 1.", + format: "int32", + type: "integer" + }, + grpc: { + description: "GRPC specifies a GRPC HealthCheckRequest.", + properties: { + port: { + description: "Port number of the gRPC service. Number must be in the range 1 to 65535.", + format: "int32", + type: "integer" + }, + service: { + default: "", + description: "Service is the name of the service to place in the gRPC HealthCheckRequest\n(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).\n\nIf this is not specified, the default behavior is defined by gRPC.", + type: "string" + } + }, + type: "object" + }, + httpGet: { + description: "HTTPGet specifies an HTTP GET request to perform.", + properties: { + host: { + description: "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", + type: "string" + }, + httpHeaders: { + description: "Custom headers to set in the request. HTTP allows repeated headers.", + items: { + description: "HTTPHeader describes a custom header to be used in HTTP probes", + properties: { + name: { + description: "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", + type: "string" + }, + value: { + description: "The header field value", + type: "string" + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + path: { + description: "Path to access on the HTTP server.", + type: "string" + }, + port: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true + }, + scheme: { + description: "Scheme to use for connecting to the host.\nDefaults to HTTP.", + type: "string" + } + }, + type: "object" + }, + initialDelaySeconds: { + description: "Number of seconds after the container has started before liveness probes are initiated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + format: "int32", + type: "integer" + }, + periodSeconds: { + description: "How often (in seconds) to perform the probe.", + format: "int32", + type: "integer" + }, + successThreshold: { + description: "Minimum consecutive successes for the probe to be considered successful after having failed.\nDefaults to 1. Must be 1 for liveness and startup. Minimum value is 1.", + format: "int32", + type: "integer" + }, + tcpSocket: { + description: "TCPSocket specifies a connection to a TCP port.", + properties: { + host: { + description: "Optional: Host name to connect to, defaults to the pod IP.", + type: "string" + }, + port: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true + } + }, + type: "object" + }, + timeoutSeconds: { + description: "Number of seconds after which the probe times out.\nDefaults to 1 second. Minimum value is 1.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + format: "int32", + type: "integer" + } + }, + type: "object" + }, + resources: { + description: "Compute Resources required by this container.\nCannot be updated.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + properties: { + limits: { + additionalProperties: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + }, + description: "Limits describes the maximum amount of compute resources allowed.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + type: "object" + }, + requests: { + additionalProperties: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + }, + description: "Requests describes the minimum amount of compute resources required.\nIf Requests is omitted for a container, it defaults to Limits if that is explicitly specified,\notherwise to an implementation-defined value. Requests cannot exceed Limits.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + type: "object" + } + }, + type: "object" + }, + securityContext: { + description: "SecurityContext defines the security options the container should be run with.\nIf set, the fields of SecurityContext override the equivalent fields of PodSecurityContext.\nMore info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/", + properties: { + allowPrivilegeEscalation: { + description: "AllowPrivilegeEscalation controls whether a process can gain more\nprivileges than its parent process. This bool directly controls if\nthe no_new_privs flag will be set on the container process.\nAllowPrivilegeEscalation is true always when the container is:\n1) run as Privileged\n2) has CAP_SYS_ADMIN\nNote that this field cannot be set when spec.os.name is windows.", + type: "boolean" + }, + capabilities: { + description: "The capabilities to add/drop when running containers.\nDefaults to the default set of capabilities granted by the container runtime.\nNote that this field cannot be set when spec.os.name is windows.", + properties: { + add: { + description: "This is accessible behind a feature flag - kubernetes.containerspec-addcapabilities", + items: { + description: "Capability represent POSIX capabilities type", + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + drop: { + description: "Removed capabilities", + items: { + description: "Capability represent POSIX capabilities type", + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + privileged: { + description: "Run container in privileged mode. This can only be set to explicitly to 'false'", + type: "boolean" + }, + readOnlyRootFilesystem: { + description: "Whether this container has a read-only root filesystem.\nDefault is false.\nNote that this field cannot be set when spec.os.name is windows.", + type: "boolean" + }, + runAsGroup: { + description: "The GID to run the entrypoint of the container process.\nUses runtime default if unset.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is windows.", + format: "int64", + type: "integer" + }, + runAsNonRoot: { + description: "Indicates that the container must run as a non-root user.\nIf true, the Kubelet will validate the image at runtime to ensure that it\ndoes not run as UID 0 (root) and fail to start the container if it does.\nIf unset or false, no such validation will be performed.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.", + type: "boolean" + }, + runAsUser: { + description: "The UID to run the entrypoint of the container process.\nDefaults to user specified in image metadata if unspecified.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is windows.", + format: "int64", + type: "integer" + }, + seccompProfile: { + description: "The seccomp options to use by this container. If seccomp options are\nprovided at both the pod & container level, the container options\noverride the pod options.\nNote that this field cannot be set when spec.os.name is windows.", + properties: { + localhostProfile: { + description: "localhostProfile indicates a profile defined in a file on the node should be used.\nThe profile must be preconfigured on the node to work.\nMust be a descending path, relative to the kubelet's configured seccomp profile location.\nMust be set if type is \"Localhost\". Must NOT be set for any other type.", + type: "string" + }, + type: { + description: "type indicates which kind of seccomp profile will be applied.\nValid options are:\n\nLocalhost - a profile defined in a file on the node should be used.\nRuntimeDefault - the container runtime default profile should be used.\nUnconfined - no profile should be applied.", + type: "string" + } + }, + required: ["type"], + type: "object" + } + }, + type: "object" + }, + startupProbe: { + description: "StartupProbe indicates that the Pod has successfully initialized.\nIf specified, no other probes are executed until this completes successfully.\nIf this probe fails, the Pod will be restarted, just as if the livenessProbe failed.\nThis can be used to provide different probe parameters at the beginning of a Pod's lifecycle,\nwhen it might take a long time to load data or warm a cache, than during steady-state operation.\nThis cannot be updated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + properties: { + exec: { + description: "Exec specifies a command to execute in the container.", + properties: { + command: { + description: "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + failureThreshold: { + description: "Minimum consecutive failures for the probe to be considered failed after having succeeded.\nDefaults to 3. Minimum value is 1.", + format: "int32", + type: "integer" + }, + grpc: { + description: "GRPC specifies a GRPC HealthCheckRequest.", + properties: { + port: { + description: "Port number of the gRPC service. Number must be in the range 1 to 65535.", + format: "int32", + type: "integer" + }, + service: { + default: "", + description: "Service is the name of the service to place in the gRPC HealthCheckRequest\n(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).\n\nIf this is not specified, the default behavior is defined by gRPC.", + type: "string" + } + }, + type: "object" + }, + httpGet: { + description: "HTTPGet specifies an HTTP GET request to perform.", + properties: { + host: { + description: "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", + type: "string" + }, + httpHeaders: { + description: "Custom headers to set in the request. HTTP allows repeated headers.", + items: { + description: "HTTPHeader describes a custom header to be used in HTTP probes", + properties: { + name: { + description: "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", + type: "string" + }, + value: { + description: "The header field value", + type: "string" + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + path: { + description: "Path to access on the HTTP server.", + type: "string" + }, + port: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true + }, + scheme: { + description: "Scheme to use for connecting to the host.\nDefaults to HTTP.", + type: "string" + } + }, + type: "object" + }, + initialDelaySeconds: { + description: "Number of seconds after the container has started before liveness probes are initiated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + format: "int32", + type: "integer" + }, + periodSeconds: { + description: "How often (in seconds) to perform the probe.", + format: "int32", + type: "integer" + }, + successThreshold: { + description: "Minimum consecutive successes for the probe to be considered successful after having failed.\nDefaults to 1. Must be 1 for liveness and startup. Minimum value is 1.", + format: "int32", + type: "integer" + }, + tcpSocket: { + description: "TCPSocket specifies a connection to a TCP port.", + properties: { + host: { + description: "Optional: Host name to connect to, defaults to the pod IP.", + type: "string" + }, + port: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true + } + }, + type: "object" + }, + timeoutSeconds: { + description: "Number of seconds after which the probe times out.\nDefaults to 1 second. Minimum value is 1.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + format: "int32", + type: "integer" + } + }, + type: "object" + }, + terminationMessagePath: { + description: "Optional: Path at which the file to which the container's termination message\nwill be written is mounted into the container's filesystem.\nMessage written is intended to be brief final status, such as an assertion failure message.\nWill be truncated by the node if greater than 4096 bytes. The total message length across\nall containers will be limited to 12kb.\nDefaults to /dev/termination-log.\nCannot be updated.", + type: "string" + }, + terminationMessagePolicy: { + description: "Indicate how the termination message should be populated. File will use the contents of\nterminationMessagePath to populate the container status message on both success and failure.\nFallbackToLogsOnError will use the last chunk of container log output if the termination\nmessage file is empty and the container exited with an error.\nThe log output is limited to 2048 bytes or 80 lines, whichever is smaller.\nDefaults to File.\nCannot be updated.", + type: "string" + }, + volumeMounts: { + description: "Pod volumes to mount into the container's filesystem.\nCannot be updated.", + items: { + description: "VolumeMount describes a mounting of a Volume within a container.", + properties: { + mountPath: { + description: "Path within the container at which the volume should be mounted. Must\nnot contain ':'.", + type: "string" + }, + mountPropagation: { + description: "This is accessible behind a feature flag - kubernetes.podspec-volumes-mount-propagation", + type: "string" + }, + name: { + description: "This must match the Name of a Volume.", + type: "string" + }, + readOnly: { + description: "Mounted read-only if true, read-write otherwise (false or unspecified).\nDefaults to false.", + type: "boolean" + }, + subPath: { + description: "Path within the volume from which the container's volume should be mounted.\nDefaults to \"\" (volume's root).", + type: "string" + } + }, + required: ["mountPath", "name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-map-keys": ["mountPath"], + "x-kubernetes-list-type": "map" + }, + workingDir: { + description: "Container's working directory.\nIf not specified, the container runtime's default will be used, which\nmight be configured in the container image.\nCannot be updated.", + type: "string" + } + }, + type: "object" + }, + type: "array" + }, + dnsConfig: { + description: "This is accessible behind a feature flag - kubernetes.podspec-dnsconfig", + type: "object", + "x-kubernetes-preserve-unknown-fields": true + }, + dnsPolicy: { + description: "This is accessible behind a feature flag - kubernetes.podspec-dnspolicy", + type: "string" + }, + enableServiceLinks: { + description: "EnableServiceLinks indicates whether information aboutservices should be injected into pod's environment variables, matching the syntax of Docker links. Optional: Knative defaults this to false.", + type: "boolean" + }, + hostAliases: { + description: "This is accessible behind a feature flag - kubernetes.podspec-hostaliases", + items: { + description: "This is accessible behind a feature flag - kubernetes.podspec-hostaliases", + type: "object", + "x-kubernetes-preserve-unknown-fields": true + }, + type: "array" + }, + hostIPC: { + description: "This is accessible behind a feature flag - kubernetes.podspec-hostipc", + type: "boolean" + }, + hostNetwork: { + description: "This is accessible behind a feature flag - kubernetes.podspec-hostnetwork", + type: "boolean" + }, + hostPID: { + description: "This is accessible behind a feature flag - kubernetes.podspec-hostpid", + type: "boolean" + }, + idleTimeoutSeconds: { + description: "IdleTimeoutSeconds is the maximum duration in seconds a request will be allowed\nto stay open while not receiving any bytes from the user's application. If\nunspecified, a system default will be provided.", + format: "int64", + type: "integer" + }, + imagePullSecrets: { + description: "ImagePullSecrets is an optional list of references to secrets in the same namespace to use for pulling any of the images used by this PodSpec.\nIf specified, these secrets will be passed to individual puller implementations for them to use.\nMore info: https://kubernetes.io/docs/concepts/containers/images#specifying-imagepullsecrets-on-a-pod", + items: { + description: "LocalObjectReference contains enough information to let you locate the\nreferenced object inside the same namespace.", + properties: { + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + type: "array", + "x-kubernetes-list-map-keys": ["name"], + "x-kubernetes-list-type": "map" + }, + initContainers: { + description: "This is accessible behind a feature flag - kubernetes.podspec-init-containers", + items: { + description: "This is accessible behind a feature flag - kubernetes.podspec-init-containers", + type: "object", + "x-kubernetes-preserve-unknown-fields": true + }, + type: "array" + }, + nodeSelector: { + additionalProperties: { + type: "string" + }, + description: "This is accessible behind a feature flag - kubernetes.podspec-nodeselector", + type: "object", + "x-kubernetes-map-type": "atomic" + }, + priorityClassName: { + description: "This is accessible behind a feature flag - kubernetes.podspec-priorityclassname", + type: "string" + }, + responseStartTimeoutSeconds: { + description: "ResponseStartTimeoutSeconds is the maximum duration in seconds that the request\nrouting layer will wait for a request delivered to a container to begin\nsending any network traffic.", + format: "int64", + type: "integer" + }, + runtimeClassName: { + description: "This is accessible behind a feature flag - kubernetes.podspec-runtimeclassname", + type: "string" + }, + schedulerName: { + description: "This is accessible behind a feature flag - kubernetes.podspec-schedulername", + type: "string" + }, + securityContext: { + description: "This is accessible behind a feature flag - kubernetes.podspec-securitycontext", + type: "object", + "x-kubernetes-preserve-unknown-fields": true + }, + serviceAccountName: { + description: "ServiceAccountName is the name of the ServiceAccount to use to run this pod.\nMore info: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/", + type: "string" + }, + shareProcessNamespace: { + description: "This is accessible behind a feature flag - kubernetes.podspec-shareprocessnamespace", + type: "boolean" + }, + timeoutSeconds: { + description: "TimeoutSeconds is the maximum duration in seconds that the request instance\nis allowed to respond to a request. If unspecified, a system default will\nbe provided.", + format: "int64", + type: "integer" + }, + tolerations: { + description: "This is accessible behind a feature flag - kubernetes.podspec-tolerations", + items: { + description: "This is accessible behind a feature flag - kubernetes.podspec-tolerations", + type: "object", + "x-kubernetes-preserve-unknown-fields": true + }, + type: "array" + }, + topologySpreadConstraints: { + description: "This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints", + items: { + description: "This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints", + type: "object", + "x-kubernetes-preserve-unknown-fields": true + }, + type: "array" + }, + volumes: { + description: "List of volumes that can be mounted by containers belonging to the pod.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes", + items: { + description: "Volume represents a named volume in a pod that may be accessed by any container in the pod.", + properties: { + configMap: { + description: "configMap represents a configMap that should populate this volume", + properties: { + defaultMode: { + description: "defaultMode is optional: mode bits used to set permissions on created files by default.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nDefaults to 0644.\nDirectories within the path are not affected by this setting.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", + format: "int32", + type: "integer" + }, + items: { + description: "items if unspecified, each key-value pair in the Data field of the referenced\nConfigMap will be projected into the volume as a file whose name is the\nkey and content is the value. If specified, the listed keys will be\nprojected into the specified paths, and unlisted keys will not be\npresent. If a key is specified which is not present in the ConfigMap,\nthe volume setup will error unless it is marked optional. Paths must be\nrelative and may not contain the '..' path or start with '..'.", + items: { + description: "Maps a string key to a path within a volume.", + properties: { + key: { + description: "key is the key to project.", + type: "string" + }, + mode: { + description: "mode is Optional: mode bits used to set permissions on this file.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nIf not specified, the volume defaultMode will be used.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", + format: "int32", + type: "integer" + }, + path: { + description: "path is the relative path of the file to map the key to.\nMay not be an absolute path.\nMay not contain the path element '..'.\nMay not start with the string '..'.", + type: "string" + } + }, + required: ["key", "path"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "optional specify whether the ConfigMap or its keys must be defined", + type: "boolean" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + csi: { + description: "This is accessible behind a feature flag - kubernetes.podspec-volumes-csi", + type: "object", + "x-kubernetes-preserve-unknown-fields": true + }, + emptyDir: { + description: "This is accessible behind a feature flag - kubernetes.podspec-volumes-emptydir", + type: "object", + "x-kubernetes-preserve-unknown-fields": true + }, + hostPath: { + description: "This is accessible behind a feature flag - kubernetes.podspec-volumes-hostpath", + type: "object", + "x-kubernetes-preserve-unknown-fields": true + }, + image: { + description: "This is accessible behind a feature flag - kubernetes.podspec-volumes-image", + type: "object", + "x-kubernetes-preserve-unknown-fields": true + }, + name: { + description: "name of the volume.\nMust be a DNS_LABEL and unique within the pod.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + persistentVolumeClaim: { + description: "This is accessible behind a feature flag - kubernetes.podspec-persistent-volume-claim", + type: "object", + "x-kubernetes-preserve-unknown-fields": true + }, + projected: { + description: "projected items for all in one resources secrets, configmaps, and downward API", + properties: { + defaultMode: { + description: "defaultMode are the mode bits used to set permissions on created files by default.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nDirectories within the path are not affected by this setting.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", + format: "int32", + type: "integer" + }, + sources: { + description: "sources is the list of volume projections. Each entry in this list\nhandles one source.", + items: { + description: "Projection that may be projected along with other supported volume types.\nExactly one of these fields must be set.", + properties: { + configMap: { + description: "configMap information about the configMap data to project", + properties: { + items: { + description: "items if unspecified, each key-value pair in the Data field of the referenced\nConfigMap will be projected into the volume as a file whose name is the\nkey and content is the value. If specified, the listed keys will be\nprojected into the specified paths, and unlisted keys will not be\npresent. If a key is specified which is not present in the ConfigMap,\nthe volume setup will error unless it is marked optional. Paths must be\nrelative and may not contain the '..' path or start with '..'.", + items: { + description: "Maps a string key to a path within a volume.", + properties: { + key: { + description: "key is the key to project.", + type: "string" + }, + mode: { + description: "mode is Optional: mode bits used to set permissions on this file.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nIf not specified, the volume defaultMode will be used.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", + format: "int32", + type: "integer" + }, + path: { + description: "path is the relative path of the file to map the key to.\nMay not be an absolute path.\nMay not contain the path element '..'.\nMay not start with the string '..'.", + type: "string" + } + }, + required: ["key", "path"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "optional specify whether the ConfigMap or its keys must be defined", + type: "boolean" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + downwardAPI: { + description: "downwardAPI information about the downwardAPI data to project", + properties: { + items: { + description: "Items is a list of DownwardAPIVolume file", + items: { + description: "DownwardAPIVolumeFile represents information to create the file containing the pod field", + properties: { + fieldRef: { + description: "Required: Selects a field of the pod: only annotations, labels, name, namespace and uid are supported.", + properties: { + apiVersion: { + description: "Version of the schema the FieldPath is written in terms of, defaults to \"v1\".", + type: "string" + }, + fieldPath: { + description: "Path of the field to select in the specified API version.", + type: "string" + } + }, + required: ["fieldPath"], + type: "object", + "x-kubernetes-map-type": "atomic" + }, + mode: { + description: "Optional: mode bits used to set permissions on this file, must be an octal value\nbetween 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nIf not specified, the volume defaultMode will be used.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", + format: "int32", + type: "integer" + }, + path: { + description: "Required: Path is the relative path name of the file to be created. Must not be absolute or contain the '..' path. Must be utf-8 encoded. The first item of the relative path must not start with '..'", + type: "string" + }, + resourceFieldRef: { + description: "Selects a resource of the container: only resources limits and requests\n(limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported.", + properties: { + containerName: { + description: "Container name: required for volumes, optional for env vars", + type: "string" + }, + divisor: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Specifies the output format of the exposed resources, defaults to \"1\"", + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + }, + resource: { + description: "Required: resource to select", + type: "string" + } + }, + required: ["resource"], + type: "object", + "x-kubernetes-map-type": "atomic" + } + }, + required: ["path"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + secret: { + description: "secret information about the secret data to project", + properties: { + items: { + description: "items if unspecified, each key-value pair in the Data field of the referenced\nSecret will be projected into the volume as a file whose name is the\nkey and content is the value. If specified, the listed keys will be\nprojected into the specified paths, and unlisted keys will not be\npresent. If a key is specified which is not present in the Secret,\nthe volume setup will error unless it is marked optional. Paths must be\nrelative and may not contain the '..' path or start with '..'.", + items: { + description: "Maps a string key to a path within a volume.", + properties: { + key: { + description: "key is the key to project.", + type: "string" + }, + mode: { + description: "mode is Optional: mode bits used to set permissions on this file.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nIf not specified, the volume defaultMode will be used.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", + format: "int32", + type: "integer" + }, + path: { + description: "path is the relative path of the file to map the key to.\nMay not be an absolute path.\nMay not contain the path element '..'.\nMay not start with the string '..'.", + type: "string" + } + }, + required: ["key", "path"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "optional field specify whether the Secret or its key must be defined", + type: "boolean" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + serviceAccountToken: { + description: "serviceAccountToken is information about the serviceAccountToken data to project", + properties: { + audience: { + description: "audience is the intended audience of the token. A recipient of a token\nmust identify itself with an identifier specified in the audience of the\ntoken, and otherwise should reject the token. The audience defaults to the\nidentifier of the apiserver.", + type: "string" + }, + expirationSeconds: { + description: "expirationSeconds is the requested duration of validity of the service\naccount token. As the token approaches expiration, the kubelet volume\nplugin will proactively rotate the service account token. The kubelet will\nstart trying to rotate the token if the token is older than 80 percent of\nits time to live or if the token is older than 24 hours.Defaults to 1 hour\nand must be at least 10 minutes.", + format: "int64", + type: "integer" + }, + path: { + description: "path is the path relative to the mount point of the file to project the\ntoken into.", + type: "string" + } + }, + required: ["path"], + type: "object" + } + }, + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + secret: { + description: "secret represents a secret that should populate this volume.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#secret", + properties: { + defaultMode: { + description: "defaultMode is Optional: mode bits used to set permissions on created files by default.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values\nfor mode bits. Defaults to 0644.\nDirectories within the path are not affected by this setting.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", + format: "int32", + type: "integer" + }, + items: { + description: "items If unspecified, each key-value pair in the Data field of the referenced\nSecret will be projected into the volume as a file whose name is the\nkey and content is the value. If specified, the listed keys will be\nprojected into the specified paths, and unlisted keys will not be\npresent. If a key is specified which is not present in the Secret,\nthe volume setup will error unless it is marked optional. Paths must be\nrelative and may not contain the '..' path or start with '..'.", + items: { + description: "Maps a string key to a path within a volume.", + properties: { + key: { + description: "key is the key to project.", + type: "string" + }, + mode: { + description: "mode is Optional: mode bits used to set permissions on this file.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nIf not specified, the volume defaultMode will be used.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", + format: "int32", + type: "integer" + }, + path: { + description: "path is the relative path of the file to map the key to.\nMay not be an absolute path.\nMay not contain the path element '..'.\nMay not start with the string '..'.", + type: "string" + } + }, + required: ["key", "path"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + optional: { + description: "optional field specify whether the Secret or its keys must be defined", + type: "boolean" + }, + secretName: { + description: "secretName is the name of the secret in the pod's namespace to use.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#secret", + type: "string" + } + }, + type: "object" + } + }, + required: ["name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-map-keys": ["name"], + "x-kubernetes-list-type": "map" + } + }, + required: ["containers"], + type: "object" + }, + status: { + description: "RevisionStatus communicates the observed state of the Revision (from the controller).", + properties: { + actualReplicas: { + description: "ActualReplicas reflects the amount of ready pods running this revision.", + format: "int32", + type: "integer" + }, + annotations: { + additionalProperties: { + type: "string" + }, + description: "Annotations is additional Status fields for the Resource to save some\nadditional State as well as convey more information to the user. This is\nroughly akin to Annotations on any k8s resource, just the reconciler conveying\nricher information outwards.", + type: "object" + }, + conditions: { + description: "Conditions the latest available observations of a resource's current state.", + items: { + description: "Condition defines a readiness condition for a Knative resource.\nSee: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties", + properties: { + lastTransitionTime: { + description: "LastTransitionTime is the last time the condition transitioned from one status to another.\nWe use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic\ndifferences (all other things held constant).", + type: "string" + }, + message: { + description: "A human readable message indicating details about the transition.", + type: "string" + }, + reason: { + description: "The reason for the condition's last transition.", + type: "string" + }, + severity: { + description: "Severity with which to treat failures of this type of condition.\nWhen this is not specified, it defaults to Error.", + type: "string" + }, + status: { + description: "Status of the condition, one of True, False, Unknown.", + type: "string" + }, + type: { + description: "Type of condition.", + type: "string" + } + }, + required: ["status", "type"], + type: "object" + }, + type: "array" + }, + containerStatuses: { + description: "ContainerStatuses is a slice of images present in .Spec.Container[*].Image\nto their respective digests and their container name.\nThe digests are resolved during the creation of Revision.\nContainerStatuses holds the container name and image digests\nfor both serving and non serving containers.\nref: https://bit.ly/image-digests", + items: { + description: "ContainerStatus holds the information of container name and image digest value", + properties: { + imageDigest: { + type: "string" + }, + name: { + type: "string" + } + }, + type: "object" + }, + type: "array" + }, + desiredReplicas: { + description: "DesiredReplicas reflects the desired amount of pods running this revision.", + format: "int32", + type: "integer" + }, + initContainerStatuses: { + description: "InitContainerStatuses is a slice of images present in .Spec.InitContainer[*].Image\nto their respective digests and their container name.\nThe digests are resolved during the creation of Revision.\nContainerStatuses holds the container name and image digests\nfor both serving and non serving containers.\nref: https://bit.ly/image-digests", + items: { + description: "ContainerStatus holds the information of container name and image digest value", + properties: { + imageDigest: { + type: "string" + }, + name: { + type: "string" + } + }, + type: "object" + }, + type: "array" + }, + logUrl: { + description: "LogURL specifies the generated logging url for this particular revision\nbased on the revision url template specified in the controller's config.", + type: "string" + }, + observedGeneration: { + description: "ObservedGeneration is the 'Generation' of the Service that\nwas last processed by the controller.", + format: "int64", + type: "integer" + } + }, + type: "object" + } + }, + type: "object" + } + }, + served: true, + storage: true, + subresources: { + status: {} + } + }] + } +}; +export const CustomResourceDefinition_RoutesServingKnativeDev: KubernetesResource = { + apiVersion: "apiextensions.k8s.io/v1", + kind: "CustomResourceDefinition", + metadata: { + labels: { + "app.kubernetes.io/name": "knative-serving", + "app.kubernetes.io/version": "1.22.1", + "duck.knative.dev/addressable": "true", + "knative.dev/crd-install": "true" + }, + name: "routes.serving.knative.dev" + }, + spec: { + group: "serving.knative.dev", + names: { + categories: ["all", "knative", "serving"], + kind: "Route", + plural: "routes", + shortNames: ["rt"], + singular: "route" + }, + scope: "Namespaced", + versions: [{ + additionalPrinterColumns: [{ + jsonPath: ".status.url", + name: "URL", + type: "string" + }, { + jsonPath: ".status.conditions[?(@.type=='Ready')].status", + name: "Ready", + type: "string" + }, { + jsonPath: ".status.conditions[?(@.type=='Ready')].reason", + name: "Reason", + type: "string" + }], + name: "v1", + schema: { + openAPIV3Schema: { + description: "Route is responsible for configuring ingress over a collection of Revisions.\nSome of the Revisions a Route distributes traffic over may be specified by\nreferencing the Configuration responsible for creating them; in these cases\nthe Route is additionally responsible for monitoring the Configuration for\n\"latest ready revision\" changes, and smoothly rolling out latest revisions.\nSee also: https://github.com/knative/serving/blob/main/docs/spec/overview.md#route", + properties: { + apiVersion: { + description: "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", + type: "string" + }, + kind: { + description: "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + type: "string" + }, + metadata: { + type: "object" + }, + spec: { + description: "Spec holds the desired state of the Route (from the client).", + properties: { + traffic: { + description: "Traffic specifies how to distribute traffic over a collection of\nrevisions and configurations.", + items: { + description: "TrafficTarget holds a single entry of the routing table for a Route.", + properties: { + configurationName: { + description: "ConfigurationName of a configuration to whose latest revision we will send\nthis portion of traffic. When the \"status.latestReadyRevisionName\" of the\nreferenced configuration changes, we will automatically migrate traffic\nfrom the prior \"latest ready\" revision to the new one. This field is never\nset in Route's status, only its spec. This is mutually exclusive with\nRevisionName.", + type: "string" + }, + latestRevision: { + description: "LatestRevision may be optionally provided to indicate that the latest\nready Revision of the Configuration should be used for this traffic\ntarget. When provided LatestRevision must be true if RevisionName is\nempty; it must be false when RevisionName is non-empty.", + type: "boolean" + }, + percent: { + description: "Percent indicates that percentage based routing should be used and\nthe value indicates the percent of traffic that is be routed to this\nRevision or Configuration. `0` (zero) mean no traffic, `100` means all\ntraffic.\nWhen percentage based routing is being used the follow rules apply:\n- the sum of all percent values must equal 100\n- when not specified, the implied value for `percent` is zero for\n that particular Revision or Configuration", + format: "int64", + type: "integer" + }, + revisionName: { + description: "RevisionName of a specific revision to which to send this portion of\ntraffic. This is mutually exclusive with ConfigurationName.", + type: "string" + }, + tag: { + description: "Tag is optionally used to expose a dedicated url for referencing\nthis target exclusively.", + type: "string" + }, + url: { + description: "URL displays the URL for accessing named traffic targets. URL is displayed in\nstatus, and is disallowed on spec. URL must contain a scheme (e.g. http://) and\na hostname, but may not contain anything else (e.g. basic auth, url path, etc.)", + type: "string" + } + }, + type: "object" + }, + type: "array" + } + }, + type: "object" + }, + status: { + description: "Status communicates the observed state of the Route (from the controller).", + properties: { + address: { + description: "Address holds the information needed for a Route to be the target of an event.", + properties: { + audience: { + description: "Audience is the OIDC audience for this address.", + type: "string" + }, + CACerts: { + description: "CACerts is the Certification Authority (CA) certificates in PEM format\naccording to https://www.rfc-editor.org/rfc/rfc7468.", + type: "string" + }, + name: { + description: "Name is the name of the address.", + type: "string" + }, + url: { + type: "string" + } + }, + type: "object" + }, + annotations: { + additionalProperties: { + type: "string" + }, + description: "Annotations is additional Status fields for the Resource to save some\nadditional State as well as convey more information to the user. This is\nroughly akin to Annotations on any k8s resource, just the reconciler conveying\nricher information outwards.", + type: "object" + }, + conditions: { + description: "Conditions the latest available observations of a resource's current state.", + items: { + description: "Condition defines a readiness condition for a Knative resource.\nSee: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties", + properties: { + lastTransitionTime: { + description: "LastTransitionTime is the last time the condition transitioned from one status to another.\nWe use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic\ndifferences (all other things held constant).", + type: "string" + }, + message: { + description: "A human readable message indicating details about the transition.", + type: "string" + }, + reason: { + description: "The reason for the condition's last transition.", + type: "string" + }, + severity: { + description: "Severity with which to treat failures of this type of condition.\nWhen this is not specified, it defaults to Error.", + type: "string" + }, + status: { + description: "Status of the condition, one of True, False, Unknown.", + type: "string" + }, + type: { + description: "Type of condition.", + type: "string" + } + }, + required: ["status", "type"], + type: "object" + }, + type: "array" + }, + observedGeneration: { + description: "ObservedGeneration is the 'Generation' of the Service that\nwas last processed by the controller.", + format: "int64", + type: "integer" + }, + traffic: { + description: "Traffic holds the configured traffic distribution.\nThese entries will always contain RevisionName references.\nWhen ConfigurationName appears in the spec, this will hold the\nLatestReadyRevisionName that we last observed.", + items: { + description: "TrafficTarget holds a single entry of the routing table for a Route.", + properties: { + configurationName: { + description: "ConfigurationName of a configuration to whose latest revision we will send\nthis portion of traffic. When the \"status.latestReadyRevisionName\" of the\nreferenced configuration changes, we will automatically migrate traffic\nfrom the prior \"latest ready\" revision to the new one. This field is never\nset in Route's status, only its spec. This is mutually exclusive with\nRevisionName.", + type: "string" + }, + latestRevision: { + description: "LatestRevision may be optionally provided to indicate that the latest\nready Revision of the Configuration should be used for this traffic\ntarget. When provided LatestRevision must be true if RevisionName is\nempty; it must be false when RevisionName is non-empty.", + type: "boolean" + }, + percent: { + description: "Percent indicates that percentage based routing should be used and\nthe value indicates the percent of traffic that is be routed to this\nRevision or Configuration. `0` (zero) mean no traffic, `100` means all\ntraffic.\nWhen percentage based routing is being used the follow rules apply:\n- the sum of all percent values must equal 100\n- when not specified, the implied value for `percent` is zero for\n that particular Revision or Configuration", + format: "int64", + type: "integer" + }, + revisionName: { + description: "RevisionName of a specific revision to which to send this portion of\ntraffic. This is mutually exclusive with ConfigurationName.", + type: "string" + }, + tag: { + description: "Tag is optionally used to expose a dedicated url for referencing\nthis target exclusively.", + type: "string" + }, + url: { + description: "URL displays the URL for accessing named traffic targets. URL is displayed in\nstatus, and is disallowed on spec. URL must contain a scheme (e.g. http://) and\na hostname, but may not contain anything else (e.g. basic auth, url path, etc.)", + type: "string" + } + }, + type: "object" + }, + type: "array" + }, + url: { + description: "URL holds the url that will distribute traffic over the provided traffic targets.\nIt generally has the form http[s]://{route-name}.{route-namespace}.{cluster-level-suffix}", + type: "string" + } + }, + type: "object" + } + }, + type: "object" + } + }, + served: true, + storage: true, + subresources: { + status: {} + } + }] + } +}; +export const CustomResourceDefinition_ServerlessservicesNetworkingInternalKnativeDev: KubernetesResource = { + apiVersion: "apiextensions.k8s.io/v1", + kind: "CustomResourceDefinition", + metadata: { + labels: { + "app.kubernetes.io/component": "networking", + "app.kubernetes.io/name": "knative-serving", + "app.kubernetes.io/version": "1.22.1", + "knative.dev/crd-install": "true" + }, + name: "serverlessservices.networking.internal.knative.dev" + }, + spec: { + group: "networking.internal.knative.dev", + names: { + categories: ["knative-internal", "networking"], + kind: "ServerlessService", + plural: "serverlessservices", + shortNames: ["sks"], + singular: "serverlessservice" + }, + scope: "Namespaced", + versions: [{ + additionalPrinterColumns: [{ + jsonPath: ".spec.mode", + name: "Mode", + type: "string" + }, { + jsonPath: ".spec.numActivators", + name: "Activators", + type: "integer" + }, { + jsonPath: ".status.serviceName", + name: "ServiceName", + type: "string" + }, { + jsonPath: ".status.privateServiceName", + name: "PrivateServiceName", + type: "string" + }, { + jsonPath: ".status.conditions[?(@.type=='Ready')].status", + name: "Ready", + type: "string" + }, { + jsonPath: ".status.conditions[?(@.type=='Ready')].reason", + name: "Reason", + type: "string" + }], + name: "v1alpha1", + schema: { + openAPIV3Schema: { + description: "ServerlessService is a proxy for the K8s service objects containing the\nendpoints for the revision, whether those are endpoints of the activator or\nrevision pods.\nSee: https://knative.page.link/naxz for details.", + properties: { + apiVersion: { + description: "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", + type: "string" + }, + kind: { + description: "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + type: "string" + }, + metadata: { + type: "object" + }, + spec: { + description: "Spec is the desired state of the ServerlessService.\nMore info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status", + properties: { + mode: { + description: "Mode describes the mode of operation of the ServerlessService.", + type: "string" + }, + numActivators: { + description: "NumActivators contains number of Activators that this revision should be\nassigned.\nO means — assign all.", + format: "int32", + type: "integer" + }, + objectRef: { + description: "ObjectRef defines the resource that this ServerlessService\nis responsible for making \"serverless\".", + properties: { + apiVersion: { + description: "API version of the referent.", + type: "string" + }, + fieldPath: { + description: "If referring to a piece of an object instead of an entire object, this string\nshould contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2].\nFor example, if the object reference is to a container within a pod, this would take on a value like:\n\"spec.containers{name}\" (where \"name\" refers to the name of the container that triggered\nthe event) or if no container name is specified \"spec.containers[2]\" (container with\nindex 2 in this pod). This syntax is chosen only to have some well-defined way of\nreferencing a part of an object.", + type: "string" + }, + kind: { + description: "Kind of the referent.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + type: "string" + }, + name: { + description: "Name of the referent.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + namespace: { + description: "Namespace of the referent.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/", + type: "string" + }, + resourceVersion: { + description: "Specific resourceVersion to which this reference is made, if any.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency", + type: "string" + }, + uid: { + description: "UID of the referent.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids", + type: "string" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + protocolType: { + description: "The application-layer protocol. Matches `RevisionProtocolType` set on the owning pa/revision.\nserving imports networking, so just use string.", + type: "string" + } + }, + required: ["objectRef", "protocolType"], + type: "object" + }, + status: { + description: "Status is the current state of the ServerlessService.\nMore info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status", + properties: { + annotations: { + additionalProperties: { + type: "string" + }, + description: "Annotations is additional Status fields for the Resource to save some\nadditional State as well as convey more information to the user. This is\nroughly akin to Annotations on any k8s resource, just the reconciler conveying\nricher information outwards.", + type: "object" + }, + conditions: { + description: "Conditions the latest available observations of a resource's current state.", + items: { + description: "Condition defines a readiness condition for a Knative resource.\nSee: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties", + properties: { + lastTransitionTime: { + description: "LastTransitionTime is the last time the condition transitioned from one status to another.\nWe use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic\ndifferences (all other things held constant).", + type: "string" + }, + message: { + description: "A human readable message indicating details about the transition.", + type: "string" + }, + reason: { + description: "The reason for the condition's last transition.", + type: "string" + }, + severity: { + description: "Severity with which to treat failures of this type of condition.\nWhen this is not specified, it defaults to Error.", + type: "string" + }, + status: { + description: "Status of the condition, one of True, False, Unknown.", + type: "string" + }, + type: { + description: "Type of condition.", + type: "string" + } + }, + required: ["status", "type"], + type: "object" + }, + type: "array" + }, + observedGeneration: { + description: "ObservedGeneration is the 'Generation' of the Service that\nwas last processed by the controller.", + format: "int64", + type: "integer" + }, + privateServiceName: { + description: "PrivateServiceName holds the name of a core K8s Service resource that\nload balances over the user service pods backing this Revision.", + type: "string" + }, + serviceName: { + description: "ServiceName holds the name of a core K8s Service resource that\nload balances over the pods backing this Revision (activator or revision).", + type: "string" + } + }, + type: "object" + } + }, + type: "object" + } + }, + served: true, + storage: true, + subresources: { + status: {} + } + }] + } +}; +export const CustomResourceDefinition_ServicesServingKnativeDev: KubernetesResource = { + apiVersion: "apiextensions.k8s.io/v1", + kind: "CustomResourceDefinition", + metadata: { + labels: { + "app.kubernetes.io/name": "knative-serving", + "app.kubernetes.io/version": "1.22.1", + "duck.knative.dev/addressable": "true", + "duck.knative.dev/podspecable": "true", + "knative.dev/crd-install": "true" + }, + name: "services.serving.knative.dev" + }, + spec: { + group: "serving.knative.dev", + names: { + categories: ["all", "knative", "serving"], + kind: "Service", + plural: "services", + shortNames: ["kservice", "ksvc"], + singular: "service" + }, + scope: "Namespaced", + versions: [{ + additionalPrinterColumns: [{ + jsonPath: ".status.url", + name: "URL", + type: "string" + }, { + jsonPath: ".status.latestCreatedRevisionName", + name: "LatestCreated", + type: "string" + }, { + jsonPath: ".status.latestReadyRevisionName", + name: "LatestReady", + type: "string" + }, { + jsonPath: ".status.conditions[?(@.type=='Ready')].status", + name: "Ready", + type: "string" + }, { + jsonPath: ".status.conditions[?(@.type=='Ready')].reason", + name: "Reason", + type: "string" + }], + name: "v1", + schema: { + openAPIV3Schema: { + description: "Service acts as a top-level container that manages a Route and Configuration\nwhich implement a network service. Service exists to provide a singular\nabstraction which can be access controlled, reasoned about, and which\nencapsulates software lifecycle decisions such as rollout policy and\nteam resource ownership. Service acts only as an orchestrator of the\nunderlying Routes and Configurations (much as a kubernetes Deployment\norchestrates ReplicaSets), and its usage is optional but recommended.\n\nThe Service's controller will track the statuses of its owned Configuration\nand Route, reflecting their statuses and conditions as its own.\n\nSee also: https://github.com/knative/serving/blob/main/docs/spec/overview.md#service", + properties: { + apiVersion: { + description: "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", + type: "string" + }, + kind: { + description: "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + type: "string" + }, + metadata: { + type: "object" + }, + spec: { + description: "ServiceSpec represents the configuration for the Service object.\nA Service's specification is the union of the specifications for a Route\nand Configuration. The Service restricts what can be expressed in these\nfields, e.g. the Route must reference the provided Configuration;\nhowever, these limitations also enable friendlier defaulting,\ne.g. Route never needs a Configuration name, and may be defaulted to\nthe appropriate \"run latest\" spec.", + properties: { + template: { + description: "Template holds the latest specification for the Revision to be stamped out.", + properties: { + metadata: { + properties: { + annotations: { + additionalProperties: { + type: "string" + }, + type: "object" + }, + finalizers: { + items: { + type: "string" + }, + type: "array" + }, + labels: { + additionalProperties: { + type: "string" + }, + type: "object" + }, + name: { + type: "string" + }, + namespace: { + type: "string" + } + }, + type: "object", + "x-kubernetes-preserve-unknown-fields": true + }, + spec: { + description: "RevisionSpec holds the desired state of the Revision (from the client).", + properties: { + affinity: { + description: "This is accessible behind a feature flag - kubernetes.podspec-affinity", + type: "object", + "x-kubernetes-preserve-unknown-fields": true + }, + automountServiceAccountToken: { + description: "AutomountServiceAccountToken indicates whether a service account token should be automatically mounted.", + type: "boolean" + }, + containerConcurrency: { + description: "ContainerConcurrency specifies the maximum allowed in-flight (concurrent)\nrequests per container of the Revision. Defaults to `0` which means\nconcurrency to the application is not limited, and the system decides the\ntarget concurrency for the autoscaler.", + format: "int64", + type: "integer" + }, + containers: { + description: "List of containers belonging to the pod.\nContainers cannot currently be added or removed.\nThere must be at least one container in a Pod.\nCannot be updated.", + items: { + description: "A single application container that you want to run within a pod.", + properties: { + args: { + description: "Arguments to the entrypoint.\nThe container image's CMD is used if this is not provided.\nVariable references $(VAR_NAME) are expanded using the container's environment. If a variable\ncannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced\nto a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. \"$$(VAR_NAME)\" will\nproduce the string literal \"$(VAR_NAME)\". Escaped references will never be expanded, regardless\nof whether the variable exists or not. Cannot be updated.\nMore info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + command: { + description: "Entrypoint array. Not executed within a shell.\nThe container image's ENTRYPOINT is used if this is not provided.\nVariable references $(VAR_NAME) are expanded using the container's environment. If a variable\ncannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced\nto a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. \"$$(VAR_NAME)\" will\nproduce the string literal \"$(VAR_NAME)\". Escaped references will never be expanded, regardless\nof whether the variable exists or not. Cannot be updated.\nMore info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + env: { + description: "List of environment variables to set in the container.\nCannot be updated.", + items: { + description: "EnvVar represents an environment variable present in a Container.", + properties: { + name: { + description: "Name of the environment variable.\nMay consist of any printable ASCII characters except '='.", + type: "string" + }, + value: { + description: "Variable references $(VAR_NAME) are expanded\nusing the previously defined environment variables in the container and\nany service environment variables. If a variable cannot be resolved,\nthe reference in the input string will be unchanged. Double $$ are reduced\nto a single $, which allows for escaping the $(VAR_NAME) syntax: i.e.\n\"$$(VAR_NAME)\" will produce the string literal \"$(VAR_NAME)\".\nEscaped references will never be expanded, regardless of whether the variable\nexists or not.\nDefaults to \"\".", + type: "string" + }, + valueFrom: { + description: "Source for the environment variable's value. Cannot be used if value is not empty.", + properties: { + configMapKeyRef: { + description: "Selects a key of a ConfigMap.", + properties: { + key: { + description: "The key to select.", + type: "string" + }, + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "Specify whether the ConfigMap or its key must be defined", + type: "boolean" + } + }, + required: ["key"], + type: "object", + "x-kubernetes-map-type": "atomic" + }, + fieldRef: { + description: "This is accessible behind a feature flag - kubernetes.podspec-fieldref", + type: "object", + "x-kubernetes-map-type": "atomic", + "x-kubernetes-preserve-unknown-fields": true + }, + resourceFieldRef: { + description: "This is accessible behind a feature flag - kubernetes.podspec-fieldref", + type: "object", + "x-kubernetes-map-type": "atomic", + "x-kubernetes-preserve-unknown-fields": true + }, + secretKeyRef: { + description: "Selects a key of a secret in the pod's namespace", + properties: { + key: { + description: "The key of the secret to select from. Must be a valid secret key.", + type: "string" + }, + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "Specify whether the Secret or its key must be defined", + type: "boolean" + } + }, + required: ["key"], + type: "object", + "x-kubernetes-map-type": "atomic" + } + }, + type: "object" + } + }, + required: ["name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-map-keys": ["name"], + "x-kubernetes-list-type": "map" + }, + envFrom: { + description: "List of sources to populate environment variables in the container.\nThe keys defined within a source may consist of any printable ASCII characters except '='.\nWhen a key exists in multiple\nsources, the value associated with the last source will take precedence.\nValues defined by an Env with a duplicate key will take precedence.\nCannot be updated.", + items: { + description: "EnvFromSource represents the source of a set of ConfigMaps or Secrets", + properties: { + configMapRef: { + description: "The ConfigMap to select from", + properties: { + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "Specify whether the ConfigMap must be defined", + type: "boolean" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + prefix: { + description: "Optional text to prepend to the name of each environment variable.\nMay consist of any printable ASCII characters except '='.", + type: "string" + }, + secretRef: { + description: "The Secret to select from", + properties: { + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "Specify whether the Secret must be defined", + type: "boolean" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + } + }, + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + image: { + description: "Container image name.\nMore info: https://kubernetes.io/docs/concepts/containers/images\nThis field is optional to allow higher level config management to default or override\ncontainer images in workload controllers like Deployments and StatefulSets.", + type: "string" + }, + imagePullPolicy: { + description: "Image pull policy.\nOne of Always, Never, IfNotPresent.\nDefaults to Always if :latest tag is specified, or IfNotPresent otherwise.\nCannot be updated.\nMore info: https://kubernetes.io/docs/concepts/containers/images#updating-images", + type: "string" + }, + livenessProbe: { + description: "Periodic probe of container liveness.\nContainer will be restarted if the probe fails.\nCannot be updated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + properties: { + exec: { + description: "Exec specifies a command to execute in the container.", + properties: { + command: { + description: "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + failureThreshold: { + description: "Minimum consecutive failures for the probe to be considered failed after having succeeded.\nDefaults to 3. Minimum value is 1.", + format: "int32", + type: "integer" + }, + grpc: { + description: "GRPC specifies a GRPC HealthCheckRequest.", + properties: { + port: { + description: "Port number of the gRPC service. Number must be in the range 1 to 65535.", + format: "int32", + type: "integer" + }, + service: { + default: "", + description: "Service is the name of the service to place in the gRPC HealthCheckRequest\n(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).\n\nIf this is not specified, the default behavior is defined by gRPC.", + type: "string" + } + }, + type: "object" + }, + httpGet: { + description: "HTTPGet specifies an HTTP GET request to perform.", + properties: { + host: { + description: "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", + type: "string" + }, + httpHeaders: { + description: "Custom headers to set in the request. HTTP allows repeated headers.", + items: { + description: "HTTPHeader describes a custom header to be used in HTTP probes", + properties: { + name: { + description: "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", + type: "string" + }, + value: { + description: "The header field value", + type: "string" + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + path: { + description: "Path to access on the HTTP server.", + type: "string" + }, + port: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true + }, + scheme: { + description: "Scheme to use for connecting to the host.\nDefaults to HTTP.", + type: "string" + } + }, + type: "object" + }, + initialDelaySeconds: { + description: "Number of seconds after the container has started before liveness probes are initiated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + format: "int32", + type: "integer" + }, + periodSeconds: { + description: "How often (in seconds) to perform the probe.", + format: "int32", + type: "integer" + }, + successThreshold: { + description: "Minimum consecutive successes for the probe to be considered successful after having failed.\nDefaults to 1. Must be 1 for liveness and startup. Minimum value is 1.", + format: "int32", + type: "integer" + }, + tcpSocket: { + description: "TCPSocket specifies a connection to a TCP port.", + properties: { + host: { + description: "Optional: Host name to connect to, defaults to the pod IP.", + type: "string" + }, + port: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true + } + }, + type: "object" + }, + timeoutSeconds: { + description: "Number of seconds after which the probe times out.\nDefaults to 1 second. Minimum value is 1.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + format: "int32", + type: "integer" + } + }, + type: "object" + }, + name: { + description: "Name of the container specified as a DNS_LABEL.\nEach container in a pod must have a unique name (DNS_LABEL).\nCannot be updated.", + type: "string" + }, + ports: { + description: "List of ports to expose from the container. Not specifying a port here\nDOES NOT prevent that port from being exposed. Any port which is\nlistening on the default \"0.0.0.0\" address inside a container will be\naccessible from the network.\nModifying this array with strategic merge patch may corrupt the data.\nFor more information See https://github.com/kubernetes/kubernetes/issues/108255.\nCannot be updated.", + items: { + description: "ContainerPort represents a network port in a single container.", + properties: { + containerPort: { + description: "Number of port to expose on the pod's IP address.\nThis must be a valid port number, 0 < x < 65536.", + format: "int32", + type: "integer" + }, + name: { + description: "If specified, this must be an IANA_SVC_NAME and unique within the pod. Each\nnamed port in a pod must have a unique name. Name for the port that can be\nreferred to by services.", + type: "string" + }, + protocol: { + default: "TCP", + description: "Protocol for port. Must be UDP, TCP, or SCTP.\nDefaults to \"TCP\".", + type: "string" + } + }, + type: "object" + }, + type: "array" + }, + readinessProbe: { + description: "Periodic probe of container service readiness.\nContainer will be removed from service endpoints if the probe fails.\nCannot be updated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + properties: { + exec: { + description: "Exec specifies a command to execute in the container.", + properties: { + command: { + description: "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + failureThreshold: { + description: "Minimum consecutive failures for the probe to be considered failed after having succeeded.\nDefaults to 3. Minimum value is 1.", + format: "int32", + type: "integer" + }, + grpc: { + description: "GRPC specifies a GRPC HealthCheckRequest.", + properties: { + port: { + description: "Port number of the gRPC service. Number must be in the range 1 to 65535.", + format: "int32", + type: "integer" + }, + service: { + default: "", + description: "Service is the name of the service to place in the gRPC HealthCheckRequest\n(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).\n\nIf this is not specified, the default behavior is defined by gRPC.", + type: "string" + } + }, + type: "object" + }, + httpGet: { + description: "HTTPGet specifies an HTTP GET request to perform.", + properties: { + host: { + description: "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", + type: "string" + }, + httpHeaders: { + description: "Custom headers to set in the request. HTTP allows repeated headers.", + items: { + description: "HTTPHeader describes a custom header to be used in HTTP probes", + properties: { + name: { + description: "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", + type: "string" + }, + value: { + description: "The header field value", + type: "string" + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + path: { + description: "Path to access on the HTTP server.", + type: "string" + }, + port: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true + }, + scheme: { + description: "Scheme to use for connecting to the host.\nDefaults to HTTP.", + type: "string" + } + }, + type: "object" + }, + initialDelaySeconds: { + description: "Number of seconds after the container has started before liveness probes are initiated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + format: "int32", + type: "integer" + }, + periodSeconds: { + description: "How often (in seconds) to perform the probe.", + format: "int32", + type: "integer" + }, + successThreshold: { + description: "Minimum consecutive successes for the probe to be considered successful after having failed.\nDefaults to 1. Must be 1 for liveness and startup. Minimum value is 1.", + format: "int32", + type: "integer" + }, + tcpSocket: { + description: "TCPSocket specifies a connection to a TCP port.", + properties: { + host: { + description: "Optional: Host name to connect to, defaults to the pod IP.", + type: "string" + }, + port: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true + } + }, + type: "object" + }, + timeoutSeconds: { + description: "Number of seconds after which the probe times out.\nDefaults to 1 second. Minimum value is 1.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + format: "int32", + type: "integer" + } + }, + type: "object" + }, + resources: { + description: "Compute Resources required by this container.\nCannot be updated.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + properties: { + limits: { + additionalProperties: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + }, + description: "Limits describes the maximum amount of compute resources allowed.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + type: "object" + }, + requests: { + additionalProperties: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + }, + description: "Requests describes the minimum amount of compute resources required.\nIf Requests is omitted for a container, it defaults to Limits if that is explicitly specified,\notherwise to an implementation-defined value. Requests cannot exceed Limits.\nMore info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/", + type: "object" + } + }, + type: "object" + }, + securityContext: { + description: "SecurityContext defines the security options the container should be run with.\nIf set, the fields of SecurityContext override the equivalent fields of PodSecurityContext.\nMore info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/", + properties: { + allowPrivilegeEscalation: { + description: "AllowPrivilegeEscalation controls whether a process can gain more\nprivileges than its parent process. This bool directly controls if\nthe no_new_privs flag will be set on the container process.\nAllowPrivilegeEscalation is true always when the container is:\n1) run as Privileged\n2) has CAP_SYS_ADMIN\nNote that this field cannot be set when spec.os.name is windows.", + type: "boolean" + }, + capabilities: { + description: "The capabilities to add/drop when running containers.\nDefaults to the default set of capabilities granted by the container runtime.\nNote that this field cannot be set when spec.os.name is windows.", + properties: { + add: { + description: "This is accessible behind a feature flag - kubernetes.containerspec-addcapabilities", + items: { + description: "Capability represent POSIX capabilities type", + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + drop: { + description: "Removed capabilities", + items: { + description: "Capability represent POSIX capabilities type", + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + privileged: { + description: "Run container in privileged mode. This can only be set to explicitly to 'false'", + type: "boolean" + }, + readOnlyRootFilesystem: { + description: "Whether this container has a read-only root filesystem.\nDefault is false.\nNote that this field cannot be set when spec.os.name is windows.", + type: "boolean" + }, + runAsGroup: { + description: "The GID to run the entrypoint of the container process.\nUses runtime default if unset.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is windows.", + format: "int64", + type: "integer" + }, + runAsNonRoot: { + description: "Indicates that the container must run as a non-root user.\nIf true, the Kubelet will validate the image at runtime to ensure that it\ndoes not run as UID 0 (root) and fail to start the container if it does.\nIf unset or false, no such validation will be performed.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.", + type: "boolean" + }, + runAsUser: { + description: "The UID to run the entrypoint of the container process.\nDefaults to user specified in image metadata if unspecified.\nMay also be set in PodSecurityContext. If set in both SecurityContext and\nPodSecurityContext, the value specified in SecurityContext takes precedence.\nNote that this field cannot be set when spec.os.name is windows.", + format: "int64", + type: "integer" + }, + seccompProfile: { + description: "The seccomp options to use by this container. If seccomp options are\nprovided at both the pod & container level, the container options\noverride the pod options.\nNote that this field cannot be set when spec.os.name is windows.", + properties: { + localhostProfile: { + description: "localhostProfile indicates a profile defined in a file on the node should be used.\nThe profile must be preconfigured on the node to work.\nMust be a descending path, relative to the kubelet's configured seccomp profile location.\nMust be set if type is \"Localhost\". Must NOT be set for any other type.", + type: "string" + }, + type: { + description: "type indicates which kind of seccomp profile will be applied.\nValid options are:\n\nLocalhost - a profile defined in a file on the node should be used.\nRuntimeDefault - the container runtime default profile should be used.\nUnconfined - no profile should be applied.", + type: "string" + } + }, + required: ["type"], + type: "object" + } + }, + type: "object" + }, + startupProbe: { + description: "StartupProbe indicates that the Pod has successfully initialized.\nIf specified, no other probes are executed until this completes successfully.\nIf this probe fails, the Pod will be restarted, just as if the livenessProbe failed.\nThis can be used to provide different probe parameters at the beginning of a Pod's lifecycle,\nwhen it might take a long time to load data or warm a cache, than during steady-state operation.\nThis cannot be updated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + properties: { + exec: { + description: "Exec specifies a command to execute in the container.", + properties: { + command: { + description: "Command is the command line to execute inside the container, the working directory for the\ncommand is root ('/') in the container's filesystem. The command is simply exec'd, it is\nnot run inside a shell, so traditional shell instructions ('|', etc) won't work. To use\na shell, you need to explicitly call out to that shell.\nExit status of 0 is treated as live/healthy and non-zero is unhealthy.", + items: { + type: "string" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + failureThreshold: { + description: "Minimum consecutive failures for the probe to be considered failed after having succeeded.\nDefaults to 3. Minimum value is 1.", + format: "int32", + type: "integer" + }, + grpc: { + description: "GRPC specifies a GRPC HealthCheckRequest.", + properties: { + port: { + description: "Port number of the gRPC service. Number must be in the range 1 to 65535.", + format: "int32", + type: "integer" + }, + service: { + default: "", + description: "Service is the name of the service to place in the gRPC HealthCheckRequest\n(see https://github.com/grpc/grpc/blob/master/doc/health-checking.md).\n\nIf this is not specified, the default behavior is defined by gRPC.", + type: "string" + } + }, + type: "object" + }, + httpGet: { + description: "HTTPGet specifies an HTTP GET request to perform.", + properties: { + host: { + description: "Host name to connect to, defaults to the pod IP. You probably want to set\n\"Host\" in httpHeaders instead.", + type: "string" + }, + httpHeaders: { + description: "Custom headers to set in the request. HTTP allows repeated headers.", + items: { + description: "HTTPHeader describes a custom header to be used in HTTP probes", + properties: { + name: { + description: "The header field name.\nThis will be canonicalized upon output, so case-variant names will be understood as the same header.", + type: "string" + }, + value: { + description: "The header field value", + type: "string" + } + }, + required: ["name", "value"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + path: { + description: "Path to access on the HTTP server.", + type: "string" + }, + port: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Name or number of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true + }, + scheme: { + description: "Scheme to use for connecting to the host.\nDefaults to HTTP.", + type: "string" + } + }, + type: "object" + }, + initialDelaySeconds: { + description: "Number of seconds after the container has started before liveness probes are initiated.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + format: "int32", + type: "integer" + }, + periodSeconds: { + description: "How often (in seconds) to perform the probe.", + format: "int32", + type: "integer" + }, + successThreshold: { + description: "Minimum consecutive successes for the probe to be considered successful after having failed.\nDefaults to 1. Must be 1 for liveness and startup. Minimum value is 1.", + format: "int32", + type: "integer" + }, + tcpSocket: { + description: "TCPSocket specifies a connection to a TCP port.", + properties: { + host: { + description: "Optional: Host name to connect to, defaults to the pod IP.", + type: "string" + }, + port: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Number or name of the port to access on the container.\nNumber must be in the range 1 to 65535.\nName must be an IANA_SVC_NAME.", + "x-kubernetes-int-or-string": true + } + }, + type: "object" + }, + timeoutSeconds: { + description: "Number of seconds after which the probe times out.\nDefaults to 1 second. Minimum value is 1.\nMore info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes", + format: "int32", + type: "integer" + } + }, + type: "object" + }, + terminationMessagePath: { + description: "Optional: Path at which the file to which the container's termination message\nwill be written is mounted into the container's filesystem.\nMessage written is intended to be brief final status, such as an assertion failure message.\nWill be truncated by the node if greater than 4096 bytes. The total message length across\nall containers will be limited to 12kb.\nDefaults to /dev/termination-log.\nCannot be updated.", + type: "string" + }, + terminationMessagePolicy: { + description: "Indicate how the termination message should be populated. File will use the contents of\nterminationMessagePath to populate the container status message on both success and failure.\nFallbackToLogsOnError will use the last chunk of container log output if the termination\nmessage file is empty and the container exited with an error.\nThe log output is limited to 2048 bytes or 80 lines, whichever is smaller.\nDefaults to File.\nCannot be updated.", + type: "string" + }, + volumeMounts: { + description: "Pod volumes to mount into the container's filesystem.\nCannot be updated.", + items: { + description: "VolumeMount describes a mounting of a Volume within a container.", + properties: { + mountPath: { + description: "Path within the container at which the volume should be mounted. Must\nnot contain ':'.", + type: "string" + }, + mountPropagation: { + description: "This is accessible behind a feature flag - kubernetes.podspec-volumes-mount-propagation", + type: "string" + }, + name: { + description: "This must match the Name of a Volume.", + type: "string" + }, + readOnly: { + description: "Mounted read-only if true, read-write otherwise (false or unspecified).\nDefaults to false.", + type: "boolean" + }, + subPath: { + description: "Path within the volume from which the container's volume should be mounted.\nDefaults to \"\" (volume's root).", + type: "string" + } + }, + required: ["mountPath", "name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-map-keys": ["mountPath"], + "x-kubernetes-list-type": "map" + }, + workingDir: { + description: "Container's working directory.\nIf not specified, the container runtime's default will be used, which\nmight be configured in the container image.\nCannot be updated.", + type: "string" + } + }, + type: "object" + }, + type: "array" + }, + dnsConfig: { + description: "This is accessible behind a feature flag - kubernetes.podspec-dnsconfig", + type: "object", + "x-kubernetes-preserve-unknown-fields": true + }, + dnsPolicy: { + description: "This is accessible behind a feature flag - kubernetes.podspec-dnspolicy", + type: "string" + }, + enableServiceLinks: { + description: "EnableServiceLinks indicates whether information aboutservices should be injected into pod's environment variables, matching the syntax of Docker links. Optional: Knative defaults this to false.", + type: "boolean" + }, + hostAliases: { + description: "This is accessible behind a feature flag - kubernetes.podspec-hostaliases", + items: { + description: "This is accessible behind a feature flag - kubernetes.podspec-hostaliases", + type: "object", + "x-kubernetes-preserve-unknown-fields": true + }, + type: "array" + }, + hostIPC: { + description: "This is accessible behind a feature flag - kubernetes.podspec-hostipc", + type: "boolean" + }, + hostNetwork: { + description: "This is accessible behind a feature flag - kubernetes.podspec-hostnetwork", + type: "boolean" + }, + hostPID: { + description: "This is accessible behind a feature flag - kubernetes.podspec-hostpid", + type: "boolean" + }, + idleTimeoutSeconds: { + description: "IdleTimeoutSeconds is the maximum duration in seconds a request will be allowed\nto stay open while not receiving any bytes from the user's application. If\nunspecified, a system default will be provided.", + format: "int64", + type: "integer" + }, + imagePullSecrets: { + description: "ImagePullSecrets is an optional list of references to secrets in the same namespace to use for pulling any of the images used by this PodSpec.\nIf specified, these secrets will be passed to individual puller implementations for them to use.\nMore info: https://kubernetes.io/docs/concepts/containers/images#specifying-imagepullsecrets-on-a-pod", + items: { + description: "LocalObjectReference contains enough information to let you locate the\nreferenced object inside the same namespace.", + properties: { + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + type: "array", + "x-kubernetes-list-map-keys": ["name"], + "x-kubernetes-list-type": "map" + }, + initContainers: { + description: "This is accessible behind a feature flag - kubernetes.podspec-init-containers", + items: { + description: "This is accessible behind a feature flag - kubernetes.podspec-init-containers", + type: "object", + "x-kubernetes-preserve-unknown-fields": true + }, + type: "array" + }, + nodeSelector: { + additionalProperties: { + type: "string" + }, + description: "This is accessible behind a feature flag - kubernetes.podspec-nodeselector", + type: "object", + "x-kubernetes-map-type": "atomic" + }, + priorityClassName: { + description: "This is accessible behind a feature flag - kubernetes.podspec-priorityclassname", + type: "string" + }, + responseStartTimeoutSeconds: { + description: "ResponseStartTimeoutSeconds is the maximum duration in seconds that the request\nrouting layer will wait for a request delivered to a container to begin\nsending any network traffic.", + format: "int64", + type: "integer" + }, + runtimeClassName: { + description: "This is accessible behind a feature flag - kubernetes.podspec-runtimeclassname", + type: "string" + }, + schedulerName: { + description: "This is accessible behind a feature flag - kubernetes.podspec-schedulername", + type: "string" + }, + securityContext: { + description: "This is accessible behind a feature flag - kubernetes.podspec-securitycontext", + type: "object", + "x-kubernetes-preserve-unknown-fields": true + }, + serviceAccountName: { + description: "ServiceAccountName is the name of the ServiceAccount to use to run this pod.\nMore info: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/", + type: "string" + }, + shareProcessNamespace: { + description: "This is accessible behind a feature flag - kubernetes.podspec-shareprocessnamespace", + type: "boolean" + }, + timeoutSeconds: { + description: "TimeoutSeconds is the maximum duration in seconds that the request instance\nis allowed to respond to a request. If unspecified, a system default will\nbe provided.", + format: "int64", + type: "integer" + }, + tolerations: { + description: "This is accessible behind a feature flag - kubernetes.podspec-tolerations", + items: { + description: "This is accessible behind a feature flag - kubernetes.podspec-tolerations", + type: "object", + "x-kubernetes-preserve-unknown-fields": true + }, + type: "array" + }, + topologySpreadConstraints: { + description: "This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints", + items: { + description: "This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints", + type: "object", + "x-kubernetes-preserve-unknown-fields": true + }, + type: "array" + }, + volumes: { + description: "List of volumes that can be mounted by containers belonging to the pod.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes", + items: { + description: "Volume represents a named volume in a pod that may be accessed by any container in the pod.", + properties: { + configMap: { + description: "configMap represents a configMap that should populate this volume", + properties: { + defaultMode: { + description: "defaultMode is optional: mode bits used to set permissions on created files by default.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nDefaults to 0644.\nDirectories within the path are not affected by this setting.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", + format: "int32", + type: "integer" + }, + items: { + description: "items if unspecified, each key-value pair in the Data field of the referenced\nConfigMap will be projected into the volume as a file whose name is the\nkey and content is the value. If specified, the listed keys will be\nprojected into the specified paths, and unlisted keys will not be\npresent. If a key is specified which is not present in the ConfigMap,\nthe volume setup will error unless it is marked optional. Paths must be\nrelative and may not contain the '..' path or start with '..'.", + items: { + description: "Maps a string key to a path within a volume.", + properties: { + key: { + description: "key is the key to project.", + type: "string" + }, + mode: { + description: "mode is Optional: mode bits used to set permissions on this file.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nIf not specified, the volume defaultMode will be used.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", + format: "int32", + type: "integer" + }, + path: { + description: "path is the relative path of the file to map the key to.\nMay not be an absolute path.\nMay not contain the path element '..'.\nMay not start with the string '..'.", + type: "string" + } + }, + required: ["key", "path"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "optional specify whether the ConfigMap or its keys must be defined", + type: "boolean" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + csi: { + description: "This is accessible behind a feature flag - kubernetes.podspec-volumes-csi", + type: "object", + "x-kubernetes-preserve-unknown-fields": true + }, + emptyDir: { + description: "This is accessible behind a feature flag - kubernetes.podspec-volumes-emptydir", + type: "object", + "x-kubernetes-preserve-unknown-fields": true + }, + hostPath: { + description: "This is accessible behind a feature flag - kubernetes.podspec-volumes-hostpath", + type: "object", + "x-kubernetes-preserve-unknown-fields": true + }, + image: { + description: "This is accessible behind a feature flag - kubernetes.podspec-volumes-image", + type: "object", + "x-kubernetes-preserve-unknown-fields": true + }, + name: { + description: "name of the volume.\nMust be a DNS_LABEL and unique within the pod.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + persistentVolumeClaim: { + description: "This is accessible behind a feature flag - kubernetes.podspec-persistent-volume-claim", + type: "object", + "x-kubernetes-preserve-unknown-fields": true + }, + projected: { + description: "projected items for all in one resources secrets, configmaps, and downward API", + properties: { + defaultMode: { + description: "defaultMode are the mode bits used to set permissions on created files by default.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nDirectories within the path are not affected by this setting.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", + format: "int32", + type: "integer" + }, + sources: { + description: "sources is the list of volume projections. Each entry in this list\nhandles one source.", + items: { + description: "Projection that may be projected along with other supported volume types.\nExactly one of these fields must be set.", + properties: { + configMap: { + description: "configMap information about the configMap data to project", + properties: { + items: { + description: "items if unspecified, each key-value pair in the Data field of the referenced\nConfigMap will be projected into the volume as a file whose name is the\nkey and content is the value. If specified, the listed keys will be\nprojected into the specified paths, and unlisted keys will not be\npresent. If a key is specified which is not present in the ConfigMap,\nthe volume setup will error unless it is marked optional. Paths must be\nrelative and may not contain the '..' path or start with '..'.", + items: { + description: "Maps a string key to a path within a volume.", + properties: { + key: { + description: "key is the key to project.", + type: "string" + }, + mode: { + description: "mode is Optional: mode bits used to set permissions on this file.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nIf not specified, the volume defaultMode will be used.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", + format: "int32", + type: "integer" + }, + path: { + description: "path is the relative path of the file to map the key to.\nMay not be an absolute path.\nMay not contain the path element '..'.\nMay not start with the string '..'.", + type: "string" + } + }, + required: ["key", "path"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "optional specify whether the ConfigMap or its keys must be defined", + type: "boolean" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + downwardAPI: { + description: "downwardAPI information about the downwardAPI data to project", + properties: { + items: { + description: "Items is a list of DownwardAPIVolume file", + items: { + description: "DownwardAPIVolumeFile represents information to create the file containing the pod field", + properties: { + fieldRef: { + description: "Required: Selects a field of the pod: only annotations, labels, name, namespace and uid are supported.", + properties: { + apiVersion: { + description: "Version of the schema the FieldPath is written in terms of, defaults to \"v1\".", + type: "string" + }, + fieldPath: { + description: "Path of the field to select in the specified API version.", + type: "string" + } + }, + required: ["fieldPath"], + type: "object", + "x-kubernetes-map-type": "atomic" + }, + mode: { + description: "Optional: mode bits used to set permissions on this file, must be an octal value\nbetween 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nIf not specified, the volume defaultMode will be used.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", + format: "int32", + type: "integer" + }, + path: { + description: "Required: Path is the relative path name of the file to be created. Must not be absolute or contain the '..' path. Must be utf-8 encoded. The first item of the relative path must not start with '..'", + type: "string" + }, + resourceFieldRef: { + description: "Selects a resource of the container: only resources limits and requests\n(limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported.", + properties: { + containerName: { + description: "Container name: required for volumes, optional for env vars", + type: "string" + }, + divisor: { + anyOf: [{ + type: "integer" + }, { + type: "string" + }], + description: "Specifies the output format of the exposed resources, defaults to \"1\"", + pattern: "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$", + "x-kubernetes-int-or-string": true + }, + resource: { + description: "Required: resource to select", + type: "string" + } + }, + required: ["resource"], + type: "object", + "x-kubernetes-map-type": "atomic" + } + }, + required: ["path"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + secret: { + description: "secret information about the secret data to project", + properties: { + items: { + description: "items if unspecified, each key-value pair in the Data field of the referenced\nSecret will be projected into the volume as a file whose name is the\nkey and content is the value. If specified, the listed keys will be\nprojected into the specified paths, and unlisted keys will not be\npresent. If a key is specified which is not present in the Secret,\nthe volume setup will error unless it is marked optional. Paths must be\nrelative and may not contain the '..' path or start with '..'.", + items: { + description: "Maps a string key to a path within a volume.", + properties: { + key: { + description: "key is the key to project.", + type: "string" + }, + mode: { + description: "mode is Optional: mode bits used to set permissions on this file.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nIf not specified, the volume defaultMode will be used.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", + format: "int32", + type: "integer" + }, + path: { + description: "path is the relative path of the file to map the key to.\nMay not be an absolute path.\nMay not contain the path element '..'.\nMay not start with the string '..'.", + type: "string" + } + }, + required: ["key", "path"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + }, + optional: { + description: "optional field specify whether the Secret or its key must be defined", + type: "boolean" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + serviceAccountToken: { + description: "serviceAccountToken is information about the serviceAccountToken data to project", + properties: { + audience: { + description: "audience is the intended audience of the token. A recipient of a token\nmust identify itself with an identifier specified in the audience of the\ntoken, and otherwise should reject the token. The audience defaults to the\nidentifier of the apiserver.", + type: "string" + }, + expirationSeconds: { + description: "expirationSeconds is the requested duration of validity of the service\naccount token. As the token approaches expiration, the kubelet volume\nplugin will proactively rotate the service account token. The kubelet will\nstart trying to rotate the token if the token is older than 80 percent of\nits time to live or if the token is older than 24 hours.Defaults to 1 hour\nand must be at least 10 minutes.", + format: "int64", + type: "integer" + }, + path: { + description: "path is the path relative to the mount point of the file to project the\ntoken into.", + type: "string" + } + }, + required: ["path"], + type: "object" + } + }, + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + } + }, + type: "object" + }, + secret: { + description: "secret represents a secret that should populate this volume.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#secret", + properties: { + defaultMode: { + description: "defaultMode is Optional: mode bits used to set permissions on created files by default.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values\nfor mode bits. Defaults to 0644.\nDirectories within the path are not affected by this setting.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", + format: "int32", + type: "integer" + }, + items: { + description: "items If unspecified, each key-value pair in the Data field of the referenced\nSecret will be projected into the volume as a file whose name is the\nkey and content is the value. If specified, the listed keys will be\nprojected into the specified paths, and unlisted keys will not be\npresent. If a key is specified which is not present in the Secret,\nthe volume setup will error unless it is marked optional. Paths must be\nrelative and may not contain the '..' path or start with '..'.", + items: { + description: "Maps a string key to a path within a volume.", + properties: { + key: { + description: "key is the key to project.", + type: "string" + }, + mode: { + description: "mode is Optional: mode bits used to set permissions on this file.\nMust be an octal value between 0000 and 0777 or a decimal value between 0 and 511.\nYAML accepts both octal and decimal values, JSON requires decimal values for mode bits.\nIf not specified, the volume defaultMode will be used.\nThis might be in conflict with other options that affect the file\nmode, like fsGroup, and the result can be other mode bits set.", + format: "int32", + type: "integer" + }, + path: { + description: "path is the relative path of the file to map the key to.\nMay not be an absolute path.\nMay not contain the path element '..'.\nMay not start with the string '..'.", + type: "string" + } + }, + required: ["key", "path"], + type: "object" + }, + type: "array", + "x-kubernetes-list-type": "atomic" + }, + optional: { + description: "optional field specify whether the Secret or its keys must be defined", + type: "boolean" + }, + secretName: { + description: "secretName is the name of the secret in the pod's namespace to use.\nMore info: https://kubernetes.io/docs/concepts/storage/volumes#secret", + type: "string" + } + }, + type: "object" + } + }, + required: ["name"], + type: "object" + }, + type: "array", + "x-kubernetes-list-map-keys": ["name"], + "x-kubernetes-list-type": "map" + } + }, + required: ["containers"], + type: "object" + } + }, + type: "object" + }, + traffic: { + description: "Traffic specifies how to distribute traffic over a collection of\nrevisions and configurations.", + items: { + description: "TrafficTarget holds a single entry of the routing table for a Route.", + properties: { + configurationName: { + description: "ConfigurationName of a configuration to whose latest revision we will send\nthis portion of traffic. When the \"status.latestReadyRevisionName\" of the\nreferenced configuration changes, we will automatically migrate traffic\nfrom the prior \"latest ready\" revision to the new one. This field is never\nset in Route's status, only its spec. This is mutually exclusive with\nRevisionName.", + type: "string" + }, + latestRevision: { + description: "LatestRevision may be optionally provided to indicate that the latest\nready Revision of the Configuration should be used for this traffic\ntarget. When provided LatestRevision must be true if RevisionName is\nempty; it must be false when RevisionName is non-empty.", + type: "boolean" + }, + percent: { + description: "Percent indicates that percentage based routing should be used and\nthe value indicates the percent of traffic that is be routed to this\nRevision or Configuration. `0` (zero) mean no traffic, `100` means all\ntraffic.\nWhen percentage based routing is being used the follow rules apply:\n- the sum of all percent values must equal 100\n- when not specified, the implied value for `percent` is zero for\n that particular Revision or Configuration", + format: "int64", + type: "integer" + }, + revisionName: { + description: "RevisionName of a specific revision to which to send this portion of\ntraffic. This is mutually exclusive with ConfigurationName.", + type: "string" + }, + tag: { + description: "Tag is optionally used to expose a dedicated url for referencing\nthis target exclusively.", + type: "string" + }, + url: { + description: "URL displays the URL for accessing named traffic targets. URL is displayed in\nstatus, and is disallowed on spec. URL must contain a scheme (e.g. http://) and\na hostname, but may not contain anything else (e.g. basic auth, url path, etc.)", + type: "string" + } + }, + type: "object" + }, + type: "array" + } + }, + type: "object" + }, + status: { + description: "ServiceStatus represents the Status stanza of the Service resource.", + properties: { + address: { + description: "Address holds the information needed for a Route to be the target of an event.", + properties: { + audience: { + description: "Audience is the OIDC audience for this address.", + type: "string" + }, + CACerts: { + description: "CACerts is the Certification Authority (CA) certificates in PEM format\naccording to https://www.rfc-editor.org/rfc/rfc7468.", + type: "string" + }, + name: { + description: "Name is the name of the address.", + type: "string" + }, + url: { + type: "string" + } + }, + type: "object" + }, + annotations: { + additionalProperties: { + type: "string" + }, + description: "Annotations is additional Status fields for the Resource to save some\nadditional State as well as convey more information to the user. This is\nroughly akin to Annotations on any k8s resource, just the reconciler conveying\nricher information outwards.", + type: "object" + }, + conditions: { + description: "Conditions the latest available observations of a resource's current state.", + items: { + description: "Condition defines a readiness condition for a Knative resource.\nSee: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties", + properties: { + lastTransitionTime: { + description: "LastTransitionTime is the last time the condition transitioned from one status to another.\nWe use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic\ndifferences (all other things held constant).", + type: "string" + }, + message: { + description: "A human readable message indicating details about the transition.", + type: "string" + }, + reason: { + description: "The reason for the condition's last transition.", + type: "string" + }, + severity: { + description: "Severity with which to treat failures of this type of condition.\nWhen this is not specified, it defaults to Error.", + type: "string" + }, + status: { + description: "Status of the condition, one of True, False, Unknown.", + type: "string" + }, + type: { + description: "Type of condition.", + type: "string" + } + }, + required: ["status", "type"], + type: "object" + }, + type: "array" + }, + latestCreatedRevisionName: { + description: "LatestCreatedRevisionName is the last revision that was created from this\nConfiguration. It might not be ready yet, for that use LatestReadyRevisionName.", + type: "string" + }, + latestReadyRevisionName: { + description: "LatestReadyRevisionName holds the name of the latest Revision stamped out\nfrom this Configuration that has had its \"Ready\" condition become \"True\".", + type: "string" + }, + observedGeneration: { + description: "ObservedGeneration is the 'Generation' of the Service that\nwas last processed by the controller.", + format: "int64", + type: "integer" + }, + traffic: { + description: "Traffic holds the configured traffic distribution.\nThese entries will always contain RevisionName references.\nWhen ConfigurationName appears in the spec, this will hold the\nLatestReadyRevisionName that we last observed.", + items: { + description: "TrafficTarget holds a single entry of the routing table for a Route.", + properties: { + configurationName: { + description: "ConfigurationName of a configuration to whose latest revision we will send\nthis portion of traffic. When the \"status.latestReadyRevisionName\" of the\nreferenced configuration changes, we will automatically migrate traffic\nfrom the prior \"latest ready\" revision to the new one. This field is never\nset in Route's status, only its spec. This is mutually exclusive with\nRevisionName.", + type: "string" + }, + latestRevision: { + description: "LatestRevision may be optionally provided to indicate that the latest\nready Revision of the Configuration should be used for this traffic\ntarget. When provided LatestRevision must be true if RevisionName is\nempty; it must be false when RevisionName is non-empty.", + type: "boolean" + }, + percent: { + description: "Percent indicates that percentage based routing should be used and\nthe value indicates the percent of traffic that is be routed to this\nRevision or Configuration. `0` (zero) mean no traffic, `100` means all\ntraffic.\nWhen percentage based routing is being used the follow rules apply:\n- the sum of all percent values must equal 100\n- when not specified, the implied value for `percent` is zero for\n that particular Revision or Configuration", + format: "int64", + type: "integer" + }, + revisionName: { + description: "RevisionName of a specific revision to which to send this portion of\ntraffic. This is mutually exclusive with ConfigurationName.", + type: "string" + }, + tag: { + description: "Tag is optionally used to expose a dedicated url for referencing\nthis target exclusively.", + type: "string" + }, + url: { + description: "URL displays the URL for accessing named traffic targets. URL is displayed in\nstatus, and is disallowed on spec. URL must contain a scheme (e.g. http://) and\na hostname, but may not contain anything else (e.g. basic auth, url path, etc.)", + type: "string" + } + }, + type: "object" + }, + type: "array" + }, + url: { + description: "URL holds the url that will distribute traffic over the provided traffic targets.\nIt generally has the form http[s]://{route-name}.{route-namespace}.{cluster-level-suffix}", + type: "string" + } + }, + type: "object" + } + }, + type: "object" + } + }, + served: true, + storage: true, + subresources: { + status: {} + } + }] + } +}; +export const CustomResourceDefinition_ImagesCachingInternalKnativeDev: KubernetesResource = { + apiVersion: "apiextensions.k8s.io/v1", + kind: "CustomResourceDefinition", + metadata: { + labels: { + "app.kubernetes.io/name": "knative-serving", + "app.kubernetes.io/version": "1.22.1", + "knative.dev/crd-install": "true" + }, + name: "images.caching.internal.knative.dev" + }, + spec: { + group: "caching.internal.knative.dev", + names: { + categories: ["knative-internal", "caching"], + kind: "Image", + plural: "images", + singular: "image" + }, + scope: "Namespaced", + versions: [{ + additionalPrinterColumns: [{ + jsonPath: ".spec.image", + name: "Image", + type: "string" + }], + name: "v1alpha1", + schema: { + openAPIV3Schema: { + description: "Image is a Knative abstraction that encapsulates the interface by which Knative\ncomponents express a desire to have a particular image cached.", + properties: { + apiVersion: { + description: "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", + type: "string" + }, + kind: { + description: "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", + type: "string" + }, + metadata: { + type: "object" + }, + spec: { + description: "Spec holds the desired state of the Image (from the client).", + properties: { + image: { + description: "Image is the name of the container image url to cache across the cluster.", + type: "string" + }, + imagePullSecrets: { + description: "ImagePullSecrets contains the names of the Kubernetes Secrets containing login\ninformation used by the Pods which will run this container.", + items: { + description: "LocalObjectReference contains enough information to let you locate the\nreferenced object inside the same namespace.", + properties: { + name: { + default: "", + description: "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", + type: "string" + } + }, + type: "object", + "x-kubernetes-map-type": "atomic" + }, + type: "array" + }, + serviceAccountName: { + description: "ServiceAccountName is the name of the Kubernetes ServiceAccount as which the Pods\nwill run this container. This is potentially used to authenticate the image pull\nif the service account has attached pull secrets. For more information:\nhttps://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#add-imagepullsecrets-to-a-service-account", + type: "string" + } + }, + required: ["image"], + type: "object" + }, + status: { + description: "Status communicates the observed state of the Image (from the controller).", + properties: { + annotations: { + additionalProperties: { + type: "string" + }, + description: "Annotations is additional Status fields for the Resource to save some\nadditional State as well as convey more information to the user. This is\nroughly akin to Annotations on any k8s resource, just the reconciler conveying\nricher information outwards.", + type: "object" + }, + conditions: { + description: "Conditions the latest available observations of a resource's current state.", + items: { + description: "Condition defines a readiness condition for a Knative resource.\nSee: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties", + properties: { + lastTransitionTime: { + description: "LastTransitionTime is the last time the condition transitioned from one status to another.\nWe use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic\ndifferences (all other things held constant).", + type: "string" + }, + message: { + description: "A human readable message indicating details about the transition.", + type: "string" + }, + reason: { + description: "The reason for the condition's last transition.", + type: "string" + }, + severity: { + description: "Severity with which to treat failures of this type of condition.\nWhen this is not specified, it defaults to Error.", + type: "string" + }, + status: { + description: "Status of the condition, one of True, False, Unknown.", + type: "string" + }, + type: { + description: "Type of condition.", + type: "string" + } + }, + required: ["status", "type"], + type: "object" + }, + type: "array" + }, + observedGeneration: { + description: "ObservedGeneration is the 'Generation' of the Service that\nwas last processed by the controller.", + format: "int64", + type: "integer" + } + }, + type: "object" + } + }, + type: "object" + } + }, + served: true, + storage: true, + subresources: { + status: {} + } + }] + } +}; +export const Namespace_KnativeServing: KubernetesResource = { + apiVersion: "v1", + kind: "Namespace", + metadata: { + labels: { + "app.kubernetes.io/name": "knative-serving", + "app.kubernetes.io/version": "1.22.1" + }, + name: "knative-serving" + } +}; +export const Role_KnativeServingActivator: KubernetesResource = { + apiVersion: "rbac.authorization.k8s.io/v1", + kind: "Role", + metadata: { + labels: { + "app.kubernetes.io/name": "knative-serving", + "app.kubernetes.io/version": "1.22.1", + "serving.knative.dev/controller": "true" + }, + name: "knative-serving-activator", + namespace: "knative-serving" + }, + rules: [{ + apiGroups: [""], + resources: ["configmaps", "secrets"], + verbs: ["get", "list", "watch"] + }, { + apiGroups: [""], + resourceNames: ["routing-serving-certs", "knative-serving-certs"], + resources: ["secrets"], + verbs: ["get", "list", "watch"] + }] +}; +export const ClusterRole_KnativeServingActivatorCluster: KubernetesResource = { + apiVersion: "rbac.authorization.k8s.io/v1", + kind: "ClusterRole", + metadata: { + labels: { + "app.kubernetes.io/name": "knative-serving", + "app.kubernetes.io/version": "1.22.1", + "serving.knative.dev/controller": "true" + }, + name: "knative-serving-activator-cluster" + }, + rules: [{ + apiGroups: [""], + resources: ["services", "endpoints"], + verbs: ["get", "list", "watch"] + }, { + apiGroups: ["serving.knative.dev"], + resources: ["revisions"], + verbs: ["get", "list", "watch"] + }] +}; +export const ClusterRole_KnativeServingAggregatedAddressableResolver: KubernetesResource = { + apiVersion: "rbac.authorization.k8s.io/v1", + kind: "ClusterRole", + metadata: { + labels: { + "app.kubernetes.io/name": "knative-serving", + "app.kubernetes.io/version": "1.22.1" + }, + name: "knative-serving-aggregated-addressable-resolver" + }, + aggregationRule: { + clusterRoleSelectors: [{ + matchLabels: { + "duck.knative.dev/addressable": "true" + } + }] + } +}; +export const ClusterRole_KnativeServingAddressableResolver: KubernetesResource = { + apiVersion: "rbac.authorization.k8s.io/v1", + kind: "ClusterRole", + metadata: { + labels: { + "app.kubernetes.io/name": "knative-serving", + "app.kubernetes.io/version": "1.22.1", + "duck.knative.dev/addressable": "true" + }, + name: "knative-serving-addressable-resolver" + }, + rules: [{ + apiGroups: ["serving.knative.dev"], + resources: ["routes", "routes/status", "services", "services/status"], + verbs: ["get", "list", "watch"] + }] +}; +export const ClusterRole_KnativeServingNamespacedAdmin: KubernetesResource = { + apiVersion: "rbac.authorization.k8s.io/v1", + kind: "ClusterRole", + metadata: { + labels: { + "app.kubernetes.io/name": "knative-serving", + "app.kubernetes.io/version": "1.22.1", + "rbac.authorization.k8s.io/aggregate-to-admin": "true" + }, + name: "knative-serving-namespaced-admin" + }, + rules: [{ + apiGroups: ["serving.knative.dev"], + resources: ["*"], + verbs: ["*"] + }, { + apiGroups: ["networking.internal.knative.dev", "autoscaling.internal.knative.dev", "caching.internal.knative.dev"], + resources: ["*"], + verbs: ["get", "list", "watch"] + }] +}; +export const ClusterRole_KnativeServingNamespacedEdit: KubernetesResource = { + apiVersion: "rbac.authorization.k8s.io/v1", + kind: "ClusterRole", + metadata: { + labels: { + "app.kubernetes.io/name": "knative-serving", + "app.kubernetes.io/version": "1.22.1", + "rbac.authorization.k8s.io/aggregate-to-edit": "true" + }, + name: "knative-serving-namespaced-edit" + }, + rules: [{ + apiGroups: ["serving.knative.dev"], + resources: ["*"], + verbs: ["create", "update", "patch", "delete"] + }, { + apiGroups: ["networking.internal.knative.dev", "autoscaling.internal.knative.dev", "caching.internal.knative.dev"], + resources: ["*"], + verbs: ["get", "list", "watch"] + }] +}; +export const ClusterRole_KnativeServingNamespacedView: KubernetesResource = { + apiVersion: "rbac.authorization.k8s.io/v1", + kind: "ClusterRole", + metadata: { + labels: { + "app.kubernetes.io/name": "knative-serving", + "app.kubernetes.io/version": "1.22.1", + "rbac.authorization.k8s.io/aggregate-to-view": "true" + }, + name: "knative-serving-namespaced-view" + }, + rules: [{ + apiGroups: ["serving.knative.dev", "networking.internal.knative.dev", "autoscaling.internal.knative.dev", "caching.internal.knative.dev"], + resources: ["*"], + verbs: ["get", "list", "watch"] + }] +}; +export const ClusterRole_KnativeServingCore: KubernetesResource = { + apiVersion: "rbac.authorization.k8s.io/v1", + kind: "ClusterRole", + metadata: { + labels: { + "app.kubernetes.io/name": "knative-serving", + "app.kubernetes.io/version": "1.22.1", + "serving.knative.dev/controller": "true" + }, + name: "knative-serving-core" + }, + rules: [{ + apiGroups: [""], + resources: ["pods", "namespaces", "secrets", "configmaps", "endpoints", "services", "events", "serviceaccounts"], + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] + }, { + apiGroups: [""], + resources: ["endpoints/restricted"], + verbs: ["create"] + }, { + apiGroups: ["discovery.k8s.io"], + resources: ["endpointslices/restricted"], + verbs: ["create"] + }, { + apiGroups: [""], + resources: ["namespaces/finalizers"], + verbs: ["update"] + }, { + apiGroups: ["discovery.k8s.io"], + resources: ["endpointslices"], + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] + }, { + apiGroups: ["apps"], + resources: ["deployments", "deployments/finalizers"], + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] + }, { + apiGroups: ["admissionregistration.k8s.io"], + resources: ["mutatingwebhookconfigurations", "validatingwebhookconfigurations"], + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] + }, { + apiGroups: ["apiextensions.k8s.io"], + resources: ["customresourcedefinitions", "customresourcedefinitions/status"], + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] + }, { + apiGroups: ["autoscaling"], + resources: ["horizontalpodautoscalers"], + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] + }, { + apiGroups: ["coordination.k8s.io"], + resources: ["leases"], + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] + }, { + apiGroups: ["serving.knative.dev", "autoscaling.internal.knative.dev", "networking.internal.knative.dev"], + resources: ["*", "*/status", "*/finalizers"], + verbs: ["get", "list", "create", "update", "delete", "deletecollection", "patch", "watch"] + }, { + apiGroups: ["caching.internal.knative.dev"], + resources: ["images"], + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] + }, { + apiGroups: ["cert-manager.io"], + resources: ["certificates", "clusterissuers", "certificaterequests", "issuers"], + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] + }, { + apiGroups: ["acme.cert-manager.io"], + resources: ["challenges"], + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] + }, { + apiGroups: ["rbac.authorization.k8s.io"], + resourceNames: ["knative-serving-certmanager"], + resources: ["clusterroles"], + verbs: ["delete"] + }, { + apiGroups: ["*"], + resources: ["*/scale"], + verbs: ["patch"] + }] +}; +export const ClusterRole_KnativeServingPodspecableBinding: KubernetesResource = { + apiVersion: "rbac.authorization.k8s.io/v1", + kind: "ClusterRole", + metadata: { + labels: { + "app.kubernetes.io/name": "knative-serving", + "app.kubernetes.io/version": "1.22.1", + "duck.knative.dev/podspecable": "true" + }, + name: "knative-serving-podspecable-binding" + }, + rules: [{ + apiGroups: ["serving.knative.dev"], + resources: ["configurations", "services"], + verbs: ["list", "watch", "patch"] + }] +}; +export const ServiceAccount_Controller: KubernetesResource = { + apiVersion: "v1", + kind: "ServiceAccount", + metadata: { + labels: { + "app.kubernetes.io/component": "controller", + "app.kubernetes.io/name": "knative-serving", + "app.kubernetes.io/version": "1.22.1" + }, + name: "controller", + namespace: "knative-serving" + } +}; +export const ClusterRole_KnativeServingAdmin: KubernetesResource = { + apiVersion: "rbac.authorization.k8s.io/v1", + kind: "ClusterRole", + metadata: { + labels: { + "app.kubernetes.io/name": "knative-serving", + "app.kubernetes.io/version": "1.22.1" + }, + name: "knative-serving-admin" + }, + aggregationRule: { + clusterRoleSelectors: [{ + matchLabels: { + "serving.knative.dev/controller": "true" + } + }] + } +}; +export const ClusterRoleBinding_KnativeServingControllerAdmin: KubernetesResource = { + apiVersion: "rbac.authorization.k8s.io/v1", + kind: "ClusterRoleBinding", + metadata: { + labels: { + "app.kubernetes.io/component": "controller", + "app.kubernetes.io/name": "knative-serving", + "app.kubernetes.io/version": "1.22.1" + }, + name: "knative-serving-controller-admin" + }, + roleRef: { + apiGroup: "rbac.authorization.k8s.io", + kind: "ClusterRole", + name: "knative-serving-admin" + }, + subjects: [{ + kind: "ServiceAccount", + name: "controller", + namespace: "knative-serving" + }] +}; +export const ClusterRoleBinding_KnativeServingControllerAddressableResolver: KubernetesResource = { + apiVersion: "rbac.authorization.k8s.io/v1", + kind: "ClusterRoleBinding", + metadata: { + labels: { + "app.kubernetes.io/component": "controller", + "app.kubernetes.io/name": "knative-serving", + "app.kubernetes.io/version": "1.22.1" + }, + name: "knative-serving-controller-addressable-resolver" + }, + roleRef: { + apiGroup: "rbac.authorization.k8s.io", + kind: "ClusterRole", + name: "knative-serving-aggregated-addressable-resolver" + }, + subjects: [{ + kind: "ServiceAccount", + name: "controller", + namespace: "knative-serving" + }] +}; +export const ServiceAccount_Activator: KubernetesResource = { + apiVersion: "v1", + kind: "ServiceAccount", + metadata: { + labels: { + "app.kubernetes.io/component": "activator", + "app.kubernetes.io/name": "knative-serving", + "app.kubernetes.io/version": "1.22.1" + }, + name: "activator", + namespace: "knative-serving" + } +}; +export const RoleBinding_KnativeServingActivator: KubernetesResource = { + apiVersion: "rbac.authorization.k8s.io/v1", + kind: "RoleBinding", + metadata: { + labels: { + "app.kubernetes.io/component": "activator", + "app.kubernetes.io/name": "knative-serving", + "app.kubernetes.io/version": "1.22.1" + }, + name: "knative-serving-activator", + namespace: "knative-serving" + }, + roleRef: { + apiGroup: "rbac.authorization.k8s.io", + kind: "Role", + name: "knative-serving-activator" + }, + subjects: [{ + kind: "ServiceAccount", + name: "activator", + namespace: "knative-serving" + }] +}; +export const ClusterRoleBinding_KnativeServingActivatorCluster: KubernetesResource = { + apiVersion: "rbac.authorization.k8s.io/v1", + kind: "ClusterRoleBinding", + metadata: { + labels: { + "app.kubernetes.io/component": "activator", + "app.kubernetes.io/name": "knative-serving", + "app.kubernetes.io/version": "1.22.1" + }, + name: "knative-serving-activator-cluster" + }, + roleRef: { + apiGroup: "rbac.authorization.k8s.io", + kind: "ClusterRole", + name: "knative-serving-activator-cluster" + }, + subjects: [{ + kind: "ServiceAccount", + name: "activator", + namespace: "knative-serving" + }] +}; +export const Certificate_RoutingServingCerts: KubernetesResource = { + apiVersion: "networking.internal.knative.dev/v1alpha1", + kind: "Certificate", + metadata: { + annotations: { + "networking.knative.dev/certificate.class": "cert-manager.certificate.networking.knative.dev" + }, + labels: { + "networking.knative.dev/certificate-type": "system-internal" + }, + name: "routing-serving-certs", + namespace: "knative-serving" + }, + spec: { + dnsNames: ["kn-routing", "data-plane.knative.dev"], + secretName: "routing-serving-certs" + } +}; +export const Image_QueueProxy: KubernetesResource = { + apiVersion: "caching.internal.knative.dev/v1alpha1", + kind: "Image", + metadata: { + labels: { + "app.kubernetes.io/component": "queue-proxy", + "app.kubernetes.io/name": "knative-serving", + "app.kubernetes.io/version": "1.22.1" + }, + name: "queue-proxy", + namespace: "knative-serving" + }, + spec: { + image: "gcr.io/knative-releases/knative.dev/serving/cmd/queue@sha256:b1af8bda6c1d32b1cf5fbf8f1f6068c5007a5cebf091039fdea83b88b1fd87f4" + } +}; +export const ConfigMap_ConfigAutoscaler: KubernetesResource = { + apiVersion: "v1", + kind: "ConfigMap", + metadata: { + annotations: { + "knative.dev/example-checksum": "c727b3e8" + }, + labels: { + "app.kubernetes.io/component": "autoscaler", + "app.kubernetes.io/name": "knative-serving", + "app.kubernetes.io/version": "1.22.1" + }, + name: "config-autoscaler", + namespace: "knative-serving" + }, + data: { + _example: "################################\n# #\n# EXAMPLE CONFIGURATION #\n# #\n################################\n\n# This block is not actually functional configuration,\n# but serves to illustrate the available configuration\n# options and document them in a way that is accessible\n# to users that `kubectl edit` this config map.\n#\n# These sample configuration options may be copied out of\n# this example block and unindented to be in the data block\n# to actually change the configuration.\n\n# The Revision ContainerConcurrency field specifies the maximum number\n# of requests the Container can handle at once. Container concurrency\n# target percentage is how much of that maximum to use in a stable\n# state. E.g. if a Revision specifies ContainerConcurrency of 10, then\n# the Autoscaler will try to maintain 7 concurrent connections per pod\n# on average.\n# Note: this limit will be applied to container concurrency set at every\n# level (ConfigMap, Revision Spec or Annotation).\n# For legacy and backwards compatibility reasons, this value also accepts\n# fractional values in (0, 1] interval (i.e. 0.7 ⇒ 70%).\n# Thus minimal percentage value must be greater than 1.0, or it will be\n# treated as a fraction.\n# NOTE: that this value does not affect actual number of concurrent requests\n# the user container may receive, but only the average number of requests\n# that the revision pods will receive.\ncontainer-concurrency-target-percentage: \"70\"\n\n# The container concurrency target default is what the Autoscaler will\n# try to maintain when concurrency is used as the scaling metric for the\n# Revision and the Revision specifies unlimited concurrency.\n# When revision explicitly specifies container concurrency, that value\n# will be used as a scaling target for autoscaler.\n# When specifying unlimited concurrency, the autoscaler will\n# horizontally scale the application based on this target concurrency.\n# This is what we call \"soft limit\" in the documentation, i.e. it only\n# affects number of pods and does not affect the number of requests\n# individual pod processes.\n# The value must be a positive number such that the value multiplied\n# by container-concurrency-target-percentage is greater than 0.01.\n# NOTE: that this value will be adjusted by application of\n# container-concurrency-target-percentage, i.e. by default\n# the system will target on average 70 concurrent requests\n# per revision pod.\n# NOTE: Only one metric can be used for autoscaling a Revision.\ncontainer-concurrency-target-default: \"100\"\n\n# The requests per second (RPS) target default is what the Autoscaler will\n# try to maintain when RPS is used as the scaling metric for a Revision and\n# the Revision specifies unlimited RPS. Even when specifying unlimited RPS,\n# the autoscaler will horizontally scale the application based on this\n# target RPS.\n# Must be greater than 1.0.\n# NOTE: Only one metric can be used for autoscaling a Revision.\nrequests-per-second-target-default: \"200\"\n\n# The target burst capacity specifies the size of burst in concurrent\n# requests that the system operator expects the system will receive.\n# Autoscaler will try to protect the system from queueing by introducing\n# Activator in the request path if the current spare capacity of the\n# service is less than this setting.\n# If this setting is 0, then Activator will be in the request path only\n# when the revision is scaled to 0.\n# If this setting is > 0 and container-concurrency-target-percentage is\n# 100% or 1.0, then activator will always be in the request path.\n# -1 denotes unlimited target-burst-capacity and activator will always\n# be in the request path.\n# Other negative values are invalid.\ntarget-burst-capacity: \"211\"\n\n# When operating in a stable mode, the autoscaler operates on the\n# average concurrency over the stable window.\n# Stable window must be in whole seconds.\nstable-window: \"60s\"\n\n# When observed average concurrency during the panic window reaches\n# panic-threshold-percentage the target concurrency, the autoscaler\n# enters panic mode. When operating in panic mode, the autoscaler\n# scales on the average concurrency over the panic window which is\n# panic-window-percentage of the stable-window.\n# Must be in the [1, 100] range.\n# When computing the panic window it will be rounded to the closest\n# whole second, at least 1s.\npanic-window-percentage: \"10.0\"\n\n# The percentage of the container concurrency target at which to\n# enter panic mode when reached within the panic window.\npanic-threshold-percentage: \"200.0\"\n\n# Max scale up rate limits the rate at which the autoscaler will\n# increase pod count. It is the maximum ratio of desired pods versus\n# observed pods.\n# Cannot be less or equal to 1.\n# I.e with value of 2.0 the number of pods can at most go N to 2N\n# over single Autoscaler period (2s), but at least N to\n# N+1, if Autoscaler needs to scale up.\nmax-scale-up-rate: \"1000.0\"\n\n# Max scale down rate limits the rate at which the autoscaler will\n# decrease pod count. It is the maximum ratio of observed pods versus\n# desired pods.\n# Cannot be less or equal to 1.\n# I.e. with value of 2.0 the number of pods can at most go N to N/2\n# over single Autoscaler evaluation period (2s), but at\n# least N to N-1, if Autoscaler needs to scale down.\nmax-scale-down-rate: \"2.0\"\n\n# Scale to zero feature flag.\nenable-scale-to-zero: \"true\"\n\n# Scale to zero grace period is the time an inactive revision is left\n# running before it is scaled to zero (must be positive, but recommended\n# at least a few seconds if running with mesh networking).\n# This is the upper limit and is provided not to enforce timeout after\n# the revision stopped receiving requests for stable window, but to\n# ensure network reprogramming to put activator in the path has completed.\n# If the system determines that a shorter period is satisfactory,\n# then the system will only wait that amount of time before scaling to 0.\n# NOTE: this period might actually be 0, if activator has been\n# in the request path sufficiently long.\n# If there is necessity for the last pod to linger longer use\n# scale-to-zero-pod-retention-period flag.\nscale-to-zero-grace-period: \"30s\"\n\n# Scale to zero pod retention period defines the minimum amount\n# of time the last pod will remain after Autoscaler has decided to\n# scale to zero.\n# This flag is for the situations where the pod startup is very expensive\n# and the traffic is bursty (requiring smaller windows for fast action),\n# but patchy.\n# The larger of this flag and `scale-to-zero-grace-period` will effectively\n# determine how the last pod will hang around.\nscale-to-zero-pod-retention-period: \"0s\"\n\n# pod-autoscaler-class specifies the default pod autoscaler class\n# that should be used if none is specified. If omitted,\n# the Knative Pod Autoscaler (KPA) is used by default.\npod-autoscaler-class: \"kpa.autoscaling.knative.dev\"\n\n# The capacity of a single activator task.\n# The `unit` is one concurrent request proxied by the activator.\n# activator-capacity must be at least 1.\n# This value is used for computation of the Activator subset size.\n# See the algorithm here: https://bit.ly/38XiCZ3.\n# TODO(vagababov): tune after actual benchmarking.\nactivator-capacity: \"100.0\"\n\n# initial-scale is the cluster-wide default value for the initial target\n# scale of a revision after creation, unless overridden by the\n# \"autoscaling.knative.dev/initialScale\" annotation.\n# This value must be greater than 0 unless allow-zero-initial-scale is true.\ninitial-scale: \"1\"\n\n# allow-zero-initial-scale controls whether either the cluster-wide initial-scale flag,\n# or the \"autoscaling.knative.dev/initialScale\" annotation, can be set to 0.\nallow-zero-initial-scale: \"false\"\n\n# min-scale is the cluster-wide default value for the min scale of a revision,\n# unless overridden by the \"autoscaling.knative.dev/minScale\" annotation.\nmin-scale: \"0\"\n\n# max-scale is the cluster-wide default value for the max scale of a revision,\n# unless overridden by the \"autoscaling.knative.dev/maxScale\" annotation.\n# If set to 0, the revision has no maximum scale.\nmax-scale: \"0\"\n\n# scale-down-delay is the amount of time that must pass at reduced\n# concurrency before a scale down decision is applied. This can be useful,\n# for example, to maintain replica count and avoid a cold start penalty if\n# more requests come in within the scale down delay period.\n# The default, 0s, imposes no delay at all.\nscale-down-delay: \"0s\"\n\n# max-scale-limit sets the maximum permitted value for the max scale of a revision.\n# When this is set to a positive value, a revision with a maxScale above that value\n# (including a maxScale of \"0\" = unlimited) is disallowed.\n# A value of zero (the default) allows any limit, including unlimited.\nmax-scale-limit: \"0\"\n" + } +}; +export const ConfigMap_ConfigCertmanager: KubernetesResource = { + apiVersion: "v1", + kind: "ConfigMap", + metadata: { + annotations: { + "knative.dev/example-checksum": "b7a9a602" + }, + labels: { + "app.kubernetes.io/component": "controller", + "app.kubernetes.io/name": "knative-serving", + "app.kubernetes.io/version": "1.22.1", + "networking.knative.dev/certificate-provider": "cert-manager" + }, + name: "config-certmanager", + namespace: "knative-serving" + }, + data: { + _example: "################################\n# #\n# EXAMPLE CONFIGURATION #\n# #\n################################\n\n# This block is not actually functional configuration,\n# but serves to illustrate the available configuration\n# options and document them in a way that is accessible\n# to users that `kubectl edit` this config map.\n#\n# These sample configuration options may be copied out of\n# this block and unindented to actually change the configuration.\n\n# issuerRef is a reference to the issuer for external-domain certificates used for ingress.\n# IssuerRef should be either `ClusterIssuer` or `Issuer`.\n# Please refer `IssuerRef` in https://cert-manager.io/docs/concepts/issuer/\n# for more details about IssuerRef configuration.\n# If the issuerRef is not specified, the self-signed `knative-selfsigned-issuer` ClusterIssuer is used.\nissuerRef: |\n kind: ClusterIssuer\n name: letsencrypt-issuer\n\n# clusterLocalIssuerRef is a reference to the issuer for cluster-local-domain certificates used for ingress.\n# clusterLocalIssuerRef should be either `ClusterIssuer` or `Issuer`.\n# Please refer `IssuerRef` in https://cert-manager.io/docs/concepts/issuer/\n# for more details about ClusterInternalIssuerRef configuration.\n# If the clusterLocalIssuerRef is not specified, the self-signed `knative-selfsigned-issuer` ClusterIssuer is used.\nclusterLocalIssuerRef: |\n kind: ClusterIssuer\n name: your-company-issuer\n\n# systemInternalIssuerRef is a reference to the issuer for certificates for system-internal-tls certificates used by Knative internal components.\n# systemInternalIssuerRef should be either `ClusterIssuer` or `Issuer`.\n# Please refer `IssuerRef` in https://cert-manager.io/docs/concepts/issuer/\n# for more details about ClusterInternalIssuerRef configuration.\n# If the systemInternalIssuerRef is not specified, the self-signed `knative-selfsigned-issuer` ClusterIssuer is used.\nsystemInternalIssuerRef: |\n kind: ClusterIssuer\n name: knative-selfsigned-issuer\n" + } +}; +export const ConfigMap_ConfigDefaults: KubernetesResource = { + apiVersion: "v1", + kind: "ConfigMap", + metadata: { + annotations: { + "knative.dev/example-checksum": "5b64ff5c" + }, + labels: { + "app.kubernetes.io/component": "controller", + "app.kubernetes.io/name": "knative-serving", + "app.kubernetes.io/version": "1.22.1" + }, + name: "config-defaults", + namespace: "knative-serving" + }, + data: { + _example: "################################\n# #\n# EXAMPLE CONFIGURATION #\n# #\n################################\n\n# This block is not actually functional configuration,\n# but serves to illustrate the available configuration\n# options and document them in a way that is accessible\n# to users that `kubectl edit` this config map.\n#\n# These sample configuration options may be copied out of\n# this example block and unindented to be in the data block\n# to actually change the configuration.\n\n# revision-timeout-seconds contains the default number of\n# seconds to use for the revision's per-request timeout, if\n# none is specified.\nrevision-timeout-seconds: \"300\" # 5 minutes\n\n# max-revision-timeout-seconds contains the maximum number of\n# seconds that can be used for revision-timeout-seconds.\n# This value must be greater than or equal to revision-timeout-seconds.\n# If omitted, the system default is used (600 seconds).\n#\n# If this value is increased, the activator's terminationGracePeriodSeconds\n# should also be increased to prevent in-flight requests being disrupted.\nmax-revision-timeout-seconds: \"600\" # 10 minutes\n\n# revision-response-start-timeout-seconds contains the default number of\n# seconds a request will be allowed to stay open while waiting to\n# receive any bytes from the user's application, if none is specified.\n#\n# This defaults to 'revision-timeout-seconds'\nrevision-response-start-timeout-seconds: \"300\"\n\n# revision-idle-timeout-seconds contains the default number of\n# seconds a request will be allowed to stay open while not receiving any\n# bytes from the user's application, if none is specified.\nrevision-idle-timeout-seconds: \"0\" # infinite\n\n# revision-cpu-request contains the cpu allocation to assign\n# to revisions by default. If omitted, no value is specified\n# and the system default is used.\n# Below is an example of setting revision-cpu-request.\n# By default, it is not set by Knative.\nrevision-cpu-request: \"400m\" # 0.4 of a CPU (aka 400 milli-CPU)\n\n# revision-memory-request contains the memory allocation to assign\n# to revisions by default. If omitted, no value is specified\n# and the system default is used.\n# Below is an example of setting revision-memory-request.\n# By default, it is not set by Knative.\nrevision-memory-request: \"100M\" # 100 megabytes of memory\n\n# revision-ephemeral-storage-request contains the ephemeral storage\n# allocation to assign to revisions by default. If omitted, no value is\n# specified and the system default is used.\nrevision-ephemeral-storage-request: \"500M\" # 500 megabytes of storage\n\n# revision-cpu-limit contains the cpu allocation to limit\n# revisions to by default. If omitted, no value is specified\n# and the system default is used.\n# Below is an example of setting revision-cpu-limit.\n# By default, it is not set by Knative.\nrevision-cpu-limit: \"1000m\" # 1 CPU (aka 1000 milli-CPU)\n\n# revision-memory-limit contains the memory allocation to limit\n# revisions to by default. If omitted, no value is specified\n# and the system default is used.\n# Below is an example of setting revision-memory-limit.\n# By default, it is not set by Knative.\nrevision-memory-limit: \"200M\" # 200 megabytes of memory\n\n# revision-ephemeral-storage-limit contains the ephemeral storage\n# allocation to limit revisions to by default. If omitted, no value is\n# specified and the system default is used.\nrevision-ephemeral-storage-limit: \"750M\" # 750 megabytes of storage\n\n# container-name-template contains a template for the default\n# container name, if none is specified. This field supports\n# Go templating and is supplied with the ObjectMeta of the\n# enclosing Service or Configuration, so values such as\n# {{.Name}} are also valid.\ncontainer-name-template: \"user-container\"\n\n# init-container-name-template contains a template for the default\n# init container name, if none is specified. This field supports\n# Go templating and is supplied with the ObjectMeta of the\n# enclosing Service or Configuration, so values such as\n# {{.Name}} are also valid.\ninit-container-name-template: \"init-container\"\n\n# container-concurrency specifies the maximum number\n# of requests the Container can handle at once, and requests\n# above this threshold are queued. Setting a value of zero\n# disables this throttling and lets through as many requests as\n# the pod receives.\ncontainer-concurrency: \"0\"\n\n# The container concurrency max limit is an operator setting ensuring that\n# the individual revisions cannot have arbitrary large concurrency\n# values, or autoscaling targets. `container-concurrency` default setting\n# must be at or below this value.\n#\n# Must be greater than 1.\n#\n# Note: even with this set, a user can choose a containerConcurrency\n# of 0 (i.e. unbounded) unless allow-container-concurrency-zero is\n# set to \"false\".\ncontainer-concurrency-max-limit: \"1000\"\n\n# allow-container-concurrency-zero controls whether users can\n# specify 0 (i.e. unbounded) for containerConcurrency.\nallow-container-concurrency-zero: \"true\"\n\n# enable-service-links specifies the default value used for the\n# enableServiceLinks field of the PodSpec, when it is omitted by the user.\n# See: https://kubernetes.io/docs/concepts/services-networking/connect-applications-service/#accessing-the-service\n#\n# This is a tri-state flag with possible values of (true|false|default).\n#\n# In environments with large number of services it is suggested\n# to set this value to `false`.\n# See https://github.com/knative/serving/issues/8498.\nenable-service-links: \"false\"\n" + } +}; +export const ConfigMap_ConfigDeployment: KubernetesResource = { + apiVersion: "v1", + kind: "ConfigMap", + metadata: { + annotations: { + "knative.dev/example-checksum": "555b4826" + }, + labels: { + "app.kubernetes.io/component": "controller", + "app.kubernetes.io/name": "knative-serving", + "app.kubernetes.io/version": "1.22.1" + }, + name: "config-deployment", + namespace: "knative-serving" + }, + data: { + _example: "################################\n# #\n# EXAMPLE CONFIGURATION #\n# #\n################################\n\n# This block is not actually functional configuration,\n# but serves to illustrate the available configuration\n# options and document them in a way that is accessible\n# to users that `kubectl edit` this config map.\n#\n# These sample configuration options may be copied out of\n# this example block and unindented to be in the data block\n# to actually change the configuration.\n\n# List of repositories for which tag to digest resolving should be skipped\nregistries-skipping-tag-resolving: \"kind.local,ko.local,dev.local\"\n\n# Maximum time allowed for an image's digests to be resolved.\ndigest-resolution-timeout: \"10s\"\n\n# Duration we wait for the deployment to be ready before considering it failed.\nprogress-deadline: \"600s\"\n\n# Sets the queue proxy's CPU request.\n# If omitted, a default value (currently \"25m\"), is used.\nqueue-sidecar-cpu-request: \"25m\"\n\n# Sets the queue proxy's CPU limit.\n# If omitted, a default value (currently \"1000m\"), is used when\n# `queueproxy.resource-defaults` is set to `Enabled`.\nqueue-sidecar-cpu-limit: \"1000m\"\n\n# Sets the queue proxy's memory request.\n# If omitted, a default value (currently \"400Mi\"), is used when\n# `queueproxy.resource-defaults` is set to `Enabled`.\nqueue-sidecar-memory-request: \"400Mi\"\n\n# Sets the queue proxy's memory limit.\n# If omitted, a default value (currently \"800Mi\"), is used when\n# `queueproxy.resource-defaults` is set to `Enabled`.\nqueue-sidecar-memory-limit: \"800Mi\"\n\n# Sets the queue proxy's ephemeral storage request.\n# If omitted, no value is specified and the system default is used.\nqueue-sidecar-ephemeral-storage-request: \"512Mi\"\n\n# Sets the queue proxy's ephemeral storage limit.\n# If omitted, no value is specified and the system default is used.\nqueue-sidecar-ephemeral-storage-limit: \"1024Mi\"\n\n# Sets tokens associated with specific audiences for queue proxy - used by QPOptions\n#\n# For example, to add the `service-x` audience:\n# queue-sidecar-token-audiences: \"service-x\"\n# Also supports a list of audiences, for example:\n# queue-sidecar-token-audiences: \"service-x,service-y\"\n# If omitted, or empty, no tokens are created\nqueue-sidecar-token-audiences: \"\"\n\n# Sets rootCA for the queue proxy - used by QPOptions\n# If omitted, or empty, no rootCA is added to the golang rootCAs\nqueue-sidecar-rootca: \"\"\n\n# Sets the minimum TLS version for the queue proxy sidecar's TLS server.\n# Accepted values: \"1.2\", \"1.3\". Default is \"1.3\" if not specified.\nqueue-sidecar-tls-min-version: \"\"\n\n# Sets the maximum TLS version for the queue proxy sidecar's TLS server.\n# Accepted values: \"1.2\", \"1.3\". If omitted, the Go default is used.\nqueue-sidecar-tls-max-version: \"\"\n\n# Sets the cipher suites for the queue proxy sidecar's TLS server.\n# Comma-separated list of cipher suite names (e.g. \"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256\").\n# If omitted, the Go default cipher suites are used.\n# Note: cipher suites are not configurable in TLS 1.3.\nqueue-sidecar-tls-cipher-suites: \"\"\n\n# Sets the elliptic curve preferences for the queue proxy sidecar's TLS server.\n# Comma-separated list of curve names (e.g. \"X25519,CurveP256\").\n# If omitted, the Go default curves are used.\nqueue-sidecar-tls-curve-preferences: \"\"\n\n# If set, it automatically configures pod anti-affinity requirements for all Knative services.\n# It employs the `preferredDuringSchedulingIgnoredDuringExecution` weighted pod affinity term,\n# aligning with the Knative revision label. It yields the configuration below in all workloads' deployments:\n# `\n# affinity:\n# podAntiAffinity:\n# preferredDuringSchedulingIgnoredDuringExecution:\n# - podAffinityTerm:\n# topologyKey: kubernetes.io/hostname\n# labelSelector:\n# matchLabels:\n# serving.knative.dev/revision: {{revision-name}}\n# weight: 100\n# `\n# This may be \"none\" or \"prefer-spread-revision-over-nodes\" (default)\n# default-affinity-type: \"prefer-spread-revision-over-nodes\"\n\n# runtime-class-name contains the selector for which runtimeClassName\n# is selected to put in a revision.\n# By default, it is not set by Knative.\n#\n# Example:\n# runtime-class-name: |\n# \"\":\n# selector:\n# use-default-runc: \"yes\"\n# kata: {}\n# gvisor:\n# selector:\n# use-gvisor: \"please\"\nruntime-class-name: \"\"\n\n# pod-is-always-schedulable can be used to define that Pods in the system will always be\n# scheduled, and a Revision should not be marked unschedulable.\n# Setting this to `true` makes sense if you have cluster-autoscaling set up for your cluster\n# where unschedulable Pods trigger the addition of a new Node and are therefore a short and\n# transient state.\n#\n# See https://github.com/knative/serving/issues/14862\npod-is-always-schedulable: \"false\"", + "queue-sidecar-image": "gcr.io/knative-releases/knative.dev/serving/cmd/queue@sha256:b1af8bda6c1d32b1cf5fbf8f1f6068c5007a5cebf091039fdea83b88b1fd87f4" + } +}; +export const ConfigMap_ConfigDomain: KubernetesResource = { + apiVersion: "v1", + kind: "ConfigMap", + metadata: { + annotations: { + "knative.dev/example-checksum": "26c09de5" + }, + labels: { + "app.kubernetes.io/component": "controller", + "app.kubernetes.io/name": "knative-serving", + "app.kubernetes.io/version": "1.22.1" + }, + name: "config-domain", + namespace: "knative-serving" + }, + data: { + _example: "################################\n# #\n# EXAMPLE CONFIGURATION #\n# #\n################################\n\n# This block is not actually functional configuration,\n# but serves to illustrate the available configuration\n# options and document them in a way that is accessible\n# to users that `kubectl edit` this config map.\n#\n# These sample configuration options may be copied out of\n# this example block and unindented to be in the data block\n# to actually change the configuration.\n\n# Default value for domain.\n# Routes having the cluster domain suffix (by default 'svc.cluster.local')\n# will not be exposed through Ingress. You can define your own label\n# selector to assign that domain suffix to your Route here, or you can set\n# the label\n# \"networking.knative.dev/visibility=cluster-local\"\n# to achieve the same effect. This shows how to make routes having\n# the label app=secret only exposed to the local cluster.\nsvc.cluster.local: |\n selector:\n app: secret\n\n# These are example settings of domain.\n# example.com will be used for all routes, but it is the least-specific rule so it\n# will only be used if no other domain matches.\nexample.com: |\n\n# example.org will be used for routes having app=nonprofit.\nexample.org: |\n selector:\n app: nonprofit\n" + } +}; +export const ConfigMap_ConfigFeatures: KubernetesResource = { + apiVersion: "v1", + kind: "ConfigMap", + metadata: { + annotations: { + "knative.dev/example-checksum": "bee75b26" + }, + labels: { + "app.kubernetes.io/component": "controller", + "app.kubernetes.io/name": "knative-serving", + "app.kubernetes.io/version": "1.22.1" + }, + name: "config-features", + namespace: "knative-serving" + }, + data: { + _example: "################################\n# #\n# EXAMPLE CONFIGURATION #\n# #\n################################\n\n# This block is not actually functional configuration,\n# but serves to illustrate the available configuration\n# options and document them in a way that is accessible\n# to users that `kubectl edit` this config map.\n#\n# These sample configuration options may be copied out of\n# this example block and unindented to be in the data block\n# to actually change the configuration.\n\n# Default SecurityContext settings to secure-by-default values\n# if unset.\n#\n# Disabled - do nothing; no security options are applied\n# AllowRootBounded - Applies secure defaults without enforcing strict policies; sets seccompProfile\n# to RuntimeDefault and drops all capabilities\n# Enabled - Enforces security defaults; sets seccompProfile to RuntimeDefault, drops all capabilities,\n# and sets runAsNonRoot to true if not already specified.\nsecure-pod-defaults: \"disabled\"\n\n# Indicates whether multi container support is enabled\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See: https://knative.dev/docs/serving/configuration/feature-flags/#multiple-containers\nmulti-container: \"enabled\"\n\n# Indicates whether multi container probing is enabled\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See: https://knative.dev/docs/serving/configuration/feature-flags/#multiple-container-probing\nmulti-container-probing: \"disabled\"\n\n# Indicates whether Kubernetes affinity support is enabled\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See: https://knative.dev/docs/serving/feature-flags/#kubernetes-node-affinity\nkubernetes.podspec-affinity: \"disabled\"\n\n# Indicates whether Kubernetes topologySpreadConstraints support is enabled\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See: https://knative.dev/docs/serving/feature-flags/#kubernetes-topology-spread-constraints\nkubernetes.podspec-topologyspreadconstraints: \"disabled\"\n\n# Indicates whether Kubernetes hostAliases support is enabled\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See: https://knative.dev/docs/serving/feature-flags/#kubernetes-host-aliases\nkubernetes.podspec-hostaliases: \"disabled\"\n\n# Indicates whether Kubernetes nodeSelector support is enabled\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See: https://knative.dev/docs/serving/feature-flags/#kubernetes-node-selector\nkubernetes.podspec-nodeselector: \"disabled\"\n\n# Indicates whether Kubernetes tolerations support is enabled\n#\n# WARNING: Cannot safely be disabled once enabled\n# See: https://knative.dev/docs/serving/feature-flags/#kubernetes-toleration\nkubernetes.podspec-tolerations: \"disabled\"\n\n# Indicates whether Kubernetes FieldRef support is enabled\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See: https://knative.dev/docs/serving/feature-flags/#kubernetes-fieldref\nkubernetes.podspec-fieldref: \"disabled\"\n\n# Indicates whether Kubernetes RuntimeClassName support is enabled\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See: https://knative.dev/docs/serving/feature-flags/#kubernetes-runtime-class\nkubernetes.podspec-runtimeclassname: \"disabled\"\n\n# Indicates whether Kubernetes DNSPolicy support is enabled\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See: https://knative.dev/docs/serving/feature-flags/#kubernetes-dnspolicy\nkubernetes.podspec-dnspolicy: \"disabled\"\n\n# Indicates whether Kubernetes DNSConfig support is enabled\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See: https://knative.dev/docs/serving/feature-flags/#kubernetes-dnsconfig\nkubernetes.podspec-dnsconfig: \"disabled\"\n\n# This feature allows end-users to set a subset of fields on the Pod's SecurityContext\n#\n# When set to \"enabled\" or \"allowed\" it allows the following\n# PodSecurityContext properties:\n# - FSGroup\n# - RunAsGroup\n# - RunAsNonRoot\n# - SupplementalGroups\n# - RunAsUser\n# - SeccompProfile\n#\n# This feature flag should be used with caution as the PodSecurityContext\n# properties may have a side-effect on non-user sidecar containers that come\n# from Knative or your service mesh\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See: https://knative.dev/docs/serving/feature-flags/#kubernetes-security-context\nkubernetes.podspec-securitycontext: \"disabled\"\n\n# Indicated whether sharing the process namespace via ShareProcessNamespace pod spec is allowed.\n# This can be especially useful for sharing data from images directly between sidecars\n#\n# See: https://knative.dev/docs/serving/configuration/feature-flags/#kubernetes-share-process-namespace\nkubernetes.podspec-shareprocessnamespace: \"disabled\"\n\n# Indicates whether hostIPC support is enabled\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See https://knative.dev/docs/serving/configuration/feature-flags/#kubernetes-host-ipc\nkubernetes.podspec-hostipc: \"disabled\"\n\n# Indicates whether hostPID support is enabled\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See https://knative.dev/docs/serving/configuration/feature-flags/#kubernetes-host-pid\nkubernetes.podspec-hostpid: \"disabled\"\n\n# Indicates whether hostNetwork support is enabled\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See See https://knative.dev/docs/serving/configuration/feature-flags/#kubernetes-host-network\nkubernetes.podspec-hostnetwork: \"disabled\"\n\n# Indicates whether Kubernetes PriorityClassName support is enabled\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See: https://knative.dev/docs/serving/feature-flags/#kubernetes-priority-class-name\nkubernetes.podspec-priorityclassname: \"disabled\"\n\n# Indicates whether Kubernetes SchedulerName support is enabled\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See: https://knative.dev/docs/serving/feature-flags/#kubernetes-scheduler-name\nkubernetes.podspec-schedulername: \"disabled\"\n\n# This feature flag allows end-users to add a subset of capabilities on the Pod's SecurityContext.\n#\n# When set to \"enabled\" or \"allowed\" it allows capabilities to be added to the container.\n# For a list of possible capabilities, see https://man7.org/linux/man-pages/man7/capabilities.7.html\nkubernetes.containerspec-addcapabilities: \"disabled\"\n\n\n# Controls whether tag header based routing feature are enabled or not.\n# 1. Enabled: enabling tag header based routing\n# 2. Disabled: disabling tag header based routing\n# See: https://knative.dev/docs/serving/feature-flags/#tag-header-based-routing\ntag-header-based-routing: \"disabled\"\n\n# Controls whether http2 auto-detection should be enabled or not.\n# 1. Enabled: http2 connection will be attempted via upgrade.\n# 2. Disabled: http2 connection will only be attempted when port name is set to \"h2c\".\nautodetect-http2: \"disabled\"\n\n# Controls whether volume support for EmptyDir is enabled or not.\n# 1. Enabled: enabling EmptyDir volume support\n# 2. Disabled: disabling EmptyDir volume support\nkubernetes.podspec-volumes-emptydir: \"enabled\"\n\n# Controls whether volume support for image is enabled or not.\n# 1. Enabled: enabling image volume support\n# 2. Disabled: disabling image volume support\nkubernetes.podspec-volumes-image: \"disabled\"\n\n# Controls whether volume support for HostPath is enabled or not.\n# WARNING: Cannot safely be disabled once enabled.\n# WARNING: If you can avoid using a hostPath volume, you should.\n# Please read https://kubernetes.io/docs/concepts/storage/volumes/#hostpath before enabling this feature.\n# 1. Enabled: enabling HostPath volume support\n# 2. Disabled: disabling HostPath volume support\nkubernetes.podspec-volumes-hostpath: \"disabled\"\n\n# Controls whether volume support for CSI is enabled or not.\n# 1. Enabled: enabling CSI volume support\n# 2. Disabled: disabling CSI volume support\nkubernetes.podspec-volumes-csi: \"disabled\"\n\n# Controls whether init containers support is enabled or not.\n# 1. Enabled: enabling init containers support\n# 2. Disabled: disabling init containers support\nkubernetes.podspec-init-containers: \"disabled\"\n\n# Controls whether persistent volume claim support is enabled or not.\n# 1. Enabled: enabling persistent volume claim support\n# 2. Disabled: disabling persistent volume claim support\nkubernetes.podspec-persistent-volume-claim: \"disabled\"\n\n# Controls whether write access for persistent volumes is enabled or not.\n# 1. Enabled: enabling write access for persistent volumes\n# 2. Disabled: disabling write access for persistent volumes\nkubernetes.podspec-persistent-volume-write: \"disabled\"\n\n# Controls whether volume mount propagation support is enabled or not.\n# 1. Enabled: enabling volume mount propagation support\n# 2. Disabled: disabling volume mount propagation support\nkubernetes.podspec-volumes-mount-propagation: \"disabled\"\n\n# Controls if the queue proxy podInfo feature is enabled, allowed or disabled\n#\n# This feature should be enabled/allowed when using queue proxy Options (Extensions)\n# Enabling will mount a podInfo volume to the queue proxy container.\n# The volume will contains an 'annotations' file (from the pod's annotation field).\n# The annotations in this file include the Service annotations set by the client creating the service.\n# If mounted, the annotations can be accessed by queue proxy extensions at /etc/podinfo/annotations\n#\n# 1. \"enabled\": always mount a podInfo volume\n# 2. \"disabled\": never mount a podInfo volume\n# 3. \"allowed\": by default, do not mount a podInfo volume\n# However, a client may mount the podInfo volume on an individual Service by attaching\n# the following metadata annotation to the Service: \"features.knative.dev/queueproxy-podinfo\":\"enabled\".\n#\n# NOTE THAT THIS IS AN EXPERIMENTAL / ALPHA FEATURE\nqueueproxy.mount-podinfo: \"disabled\"\n\n# Default queue proxy resource requests and limits to good values for most cases if set.\nqueueproxy.resource-defaults: \"disabled\"" + } +}; +export const ConfigMap_ConfigGc: KubernetesResource = { + apiVersion: "v1", + kind: "ConfigMap", + metadata: { + annotations: { + "knative.dev/example-checksum": "aa3813a8" + }, + labels: { + "app.kubernetes.io/component": "controller", + "app.kubernetes.io/name": "knative-serving", + "app.kubernetes.io/version": "1.22.1" + }, + name: "config-gc", + namespace: "knative-serving" + }, + data: { + _example: "################################\n# #\n# EXAMPLE CONFIGURATION #\n# #\n################################\n\n# This block is not actually functional configuration,\n# but serves to illustrate the available configuration\n# options and document them in a way that is accessible\n# to users that `kubectl edit` this config map.\n#\n# These sample configuration options may be copied out of\n# this example block and unindented to be in the data block\n# to actually change the configuration.\n\n# ---------------------------------------\n# Garbage Collector Settings\n# ---------------------------------------\n#\n# Active\n# * Revisions which are referenced by a Route are considered active.\n# * Individual revisions may be marked with the annotation\n# \"serving.knative.dev/no-gc\":\"true\" to be permanently considered active.\n# * Active revisions are not considered for GC.\n# Retention\n# * Revisions are retained if they are any of the following:\n# 1. Active\n# 2. Were created within \"retain-since-create-time\"\n# 3. Were last referenced by a route within\n# \"retain-since-last-active-time\"\n# 4. There are fewer than \"min-non-active-revisions\"\n# If none of these conditions are met, or if the count of revisions exceed\n# \"max-non-active-revisions\", they will be deleted by GC.\n# The special value \"disabled\" may be used to turn off these limits.\n#\n# Example config to immediately collect any inactive revision:\n# min-non-active-revisions: \"0\"\n# max-non-active-revisions: \"0\"\n# retain-since-create-time: \"disabled\"\n# retain-since-last-active-time: \"disabled\"\n#\n# Example config to always keep around the last ten non-active revisions:\n# retain-since-create-time: \"disabled\"\n# retain-since-last-active-time: \"disabled\"\n# max-non-active-revisions: \"10\"\n#\n# Example config to disable all garbage collection:\n# retain-since-create-time: \"disabled\"\n# retain-since-last-active-time: \"disabled\"\n# max-non-active-revisions: \"disabled\"\n#\n# Example config to keep recently deployed or active revisions,\n# always maintain the last two in case of rollback, and prevent\n# burst activity from exploding the count of old revisions:\n# retain-since-create-time: \"48h\"\n# retain-since-last-active-time: \"15h\"\n# min-non-active-revisions: \"2\"\n# max-non-active-revisions: \"1000\"\n\n# Duration since creation before considering a revision for GC or \"disabled\".\nretain-since-create-time: \"48h\"\n\n# Duration since active before considering a revision for GC or \"disabled\".\nretain-since-last-active-time: \"15h\"\n\n# Minimum number of non-active revisions to retain.\nmin-non-active-revisions: \"20\"\n\n# Maximum number of non-active revisions to retain\n# or \"disabled\" to disable any maximum limit.\nmax-non-active-revisions: \"1000\"\n" + } +}; +export const ConfigMap_ConfigLeaderElection: KubernetesResource = { + apiVersion: "v1", + kind: "ConfigMap", + metadata: { + annotations: { + "knative.dev/example-checksum": "f4b71f57" + }, + labels: { + "app.kubernetes.io/component": "controller", + "app.kubernetes.io/name": "knative-serving", + "app.kubernetes.io/version": "1.22.1" + }, + name: "config-leader-election", + namespace: "knative-serving" + }, + data: { + _example: "################################\n# #\n# EXAMPLE CONFIGURATION #\n# #\n################################\n\n# This block is not actually functional configuration,\n# but serves to illustrate the available configuration\n# options and document them in a way that is accessible\n# to users that `kubectl edit` this config map.\n#\n# These sample configuration options may be copied out of\n# this example block and unindented to be in the data block\n# to actually change the configuration.\n\n# lease-duration is how long non-leaders will wait to try to acquire the\n# lock; 15 seconds is the value used by core kubernetes controllers.\nlease-duration: \"60s\"\n\n# renew-deadline is how long a leader will try to renew the lease before\n# giving up; 10 seconds is the value used by core kubernetes controllers.\nrenew-deadline: \"40s\"\n\n# retry-period is how long the leader election client waits between tries of\n# actions; 2 seconds is the value used by core kubernetes controllers.\nretry-period: \"10s\"\n\n# buckets is the number of buckets used to partition key space of each\n# Reconciler. If this number is M and the replica number of the controller\n# is N, the N replicas will compete for the M buckets. The owner of a\n# bucket will take care of the reconciling for the keys partitioned into\n# that bucket.\nbuckets: \"1\"\n" + } +}; +export const ConfigMap_ConfigLogging: KubernetesResource = { + apiVersion: "v1", + kind: "ConfigMap", + metadata: { + annotations: { + "knative.dev/example-checksum": "9f25d429" + }, + labels: { + "app.kubernetes.io/component": "logging", + "app.kubernetes.io/name": "knative-serving", + "app.kubernetes.io/version": "1.22.1" + }, + name: "config-logging", + namespace: "knative-serving" + }, + data: { + _example: "################################\n# #\n# EXAMPLE CONFIGURATION #\n# #\n################################\n\n# This block is not actually functional configuration,\n# but serves to illustrate the available configuration\n# options and document them in a way that is accessible\n# to users that `kubectl edit` this config map.\n#\n# These sample configuration options may be copied out of\n# this example block and unindented to be in the data block\n# to actually change the configuration.\n\n# Common configuration for all Knative codebase\nzap-logger-config: |\n {\n \"level\": \"info\",\n \"development\": false,\n \"outputPaths\": [\"stdout\"],\n \"errorOutputPaths\": [\"stderr\"],\n \"encoding\": \"json\",\n \"encoderConfig\": {\n \"timeKey\": \"timestamp\",\n \"levelKey\": \"severity\",\n \"nameKey\": \"logger\",\n \"callerKey\": \"caller\",\n \"messageKey\": \"message\",\n \"stacktraceKey\": \"stacktrace\",\n \"lineEnding\": \"\",\n \"levelEncoder\": \"\",\n \"timeEncoder\": \"iso8601\",\n \"durationEncoder\": \"\",\n \"callerEncoder\": \"\"\n }\n }\n\n# Log level overrides\n# For all components except the queue proxy,\n# changes are picked up immediately.\n# For queue proxy, changes require recreation of the pods.\nloglevel.controller: \"info\"\nloglevel.autoscaler: \"info\"\nloglevel.queueproxy: \"info\"\nloglevel.webhook: \"info\"\nloglevel.activator: \"info\"\nloglevel.hpaautoscaler: \"info\"\nloglevel.net-istio-controller: \"info\"\nloglevel.net-contour-controller: \"info\"\nloglevel.net-kourier-controller: \"info\"\nloglevel.net-gateway-api-controller: \"info\"\n" + } +}; +export const ConfigMap_ConfigNetwork: KubernetesResource = { + apiVersion: "v1", + kind: "ConfigMap", + metadata: { + annotations: { + "knative.dev/example-checksum": "0573e07d" + }, + labels: { + "app.kubernetes.io/component": "networking", + "app.kubernetes.io/name": "knative-serving", + "app.kubernetes.io/version": "1.22.1" + }, + name: "config-network", + namespace: "knative-serving" + }, + data: { + _example: "################################\n# #\n# EXAMPLE CONFIGURATION #\n# #\n################################\n\n# This block is not actually functional configuration,\n# but serves to illustrate the available configuration\n# options and document them in a way that is accessible\n# to users that `kubectl edit` this config map.\n#\n# These sample configuration options may be copied out of\n# this example block and unindented to be in the data block\n# to actually change the configuration.\n\n# ingress-class specifies the default ingress class\n# to use when not dictated by Route annotation.\n#\n# If not specified, will use the Istio ingress.\n#\n# Note that changing the Ingress class of an existing Route\n# will result in undefined behavior. Therefore it is best to only\n# update this value during the setup of Knative, to avoid getting\n# undefined behavior.\ningress-class: \"istio.ingress.networking.knative.dev\"\n\n# certificate-class specifies the default Certificate class\n# to use when not dictated by Route annotation.\n#\n# If not specified, will use the Cert-Manager Certificate.\n#\n# Note that changing the Certificate class of an existing Route\n# will result in undefined behavior. Therefore it is best to only\n# update this value during the setup of Knative, to avoid getting\n# undefined behavior.\ncertificate-class: \"cert-manager.certificate.networking.knative.dev\"\n\n# namespace-wildcard-cert-selector specifies a LabelSelector which\n# determines which namespaces should have a wildcard certificate\n# provisioned.\n#\n# Use an empty value to disable the feature (this is the default):\n# namespace-wildcard-cert-selector: \"\"\n#\n# Use an empty object to enable for all namespaces\n# namespace-wildcard-cert-selector: {}\n#\n# Useful labels include the \"kubernetes.io/metadata.name\" label to\n# avoid provisioning a certificate for the \"kube-system\" namespaces.\n# Use the following selector to match pre-1.0 behavior of using\n# \"networking.knative.dev/disableWildcardCert\" to exclude namespaces:\n#\n# matchExpressions:\n# - key: \"networking.knative.dev/disableWildcardCert\"\n# operator: \"NotIn\"\n# values: [\"true\"]\nnamespace-wildcard-cert-selector: \"\"\n\n# domain-template specifies the golang text template string to use\n# when constructing the Knative service's DNS name. The default\n# value is \"{{.Name}}.{{.Namespace}}.{{.Domain}}\".\n#\n# Valid variables defined in the template include Name, Namespace, Domain,\n# Labels, and Annotations. Name will be the result of the tag-template\n# below, if a tag is specified for the route.\n#\n# Changing this value might be necessary when the extra levels in\n# the domain name generated is problematic for wildcard certificates\n# that only support a single level of domain name added to the\n# certificate's domain. In those cases you might consider using a value\n# of \"{{.Name}}-{{.Namespace}}.{{.Domain}}\", or removing the Namespace\n# entirely from the template. When choosing a new value be thoughtful\n# of the potential for conflicts - for example, when users choose to use\n# characters such as `-` in their service, or namespace, names.\n# {{.Annotations}} or {{.Labels}} can be used for any customization in the\n# go template if needed.\n# We strongly recommend keeping namespace part of the template to avoid\n# domain name clashes:\n# eg. '{{.Name}}-{{.Namespace}}.{{ index .Annotations \"sub\"}}.{{.Domain}}'\n# and you have an annotation {\"sub\":\"foo\"}, then the generated template\n# would be {Name}-{Namespace}.foo.{Domain}\ndomain-template: \"{{.Name}}.{{.Namespace}}.{{.Domain}}\"\n\n# tag-template specifies the golang text template string to use\n# when constructing the DNS name for \"tags\" within the traffic blocks\n# of Routes and Configuration. This is used in conjunction with the\n# domain-template above to determine the full URL for the tag.\ntag-template: \"{{.Tag}}-{{.Name}}\"\n\n# auto-tls is deprecated and replaced by external-domain-tls\nauto-tls: \"Disabled\"\n\n# Controls whether TLS certificates are automatically provisioned and\n# installed in the Knative ingress to terminate TLS connections\n# for cluster external domains (like: app.example.com)\n# - Enabled: enables the TLS certificate provisioning feature for cluster external domains.\n# - Disabled: disables the TLS certificate provisioning feature for cluster external domains.\nexternal-domain-tls: \"Disabled\"\n\n# Controls weather TLS certificates are automatically provisioned and\n# installed in the Knative ingress to terminate TLS connections\n# for cluster local domains (like: app.namespace.svc.)\n# - Enabled: enables the TLS certificate provisioning feature for cluster cluster-local domains.\n# - Disabled: disables the TLS certificate provisioning feature for cluster cluster local domains.\n# NOTE: This flag is in an alpha state and is mostly here to enable internal testing\n# for now. Use with caution.\ncluster-local-domain-tls: \"Disabled\"\n\n# internal-encryption is deprecated and replaced by system-internal-tls\ninternal-encryption: \"false\"\n\n# system-internal-tls controls weather TLS encryption is used for connections between\n# the internal components of Knative:\n# - ingress to activator\n# - ingress to queue-proxy\n# - activator to queue-proxy\n#\n# Possible values for this flag are:\n# - Enabled: enables the TLS certificate provisioning feature for cluster cluster-local domains.\n# - Disabled: disables the TLS certificate provisioning feature for cluster cluster local domains.\n# NOTE: This flag is in an alpha state and is mostly here to enable internal testing\n# for now. Use with caution.\nsystem-internal-tls: \"Disabled\"\n\n# Controls the behavior of the HTTP endpoint for the Knative ingress.\n# It requires auto-tls to be enabled.\n# - Enabled: The Knative ingress will be able to serve HTTP connection.\n# - Redirected: The Knative ingress will send a 301 redirect for all\n# http connections, asking the clients to use HTTPS.\n#\n# \"Disabled\" option is deprecated.\nhttp-protocol: \"Enabled\"\n\n# rollout-duration contains the minimal duration in seconds over which the\n# Configuration traffic targets are rolled out to the newest revision.\nrollout-duration: \"0\"\n\n# autocreate-cluster-domain-claims controls whether ClusterDomainClaims should\n# be automatically created (and deleted) as needed when DomainMappings are\n# reconciled.\n#\n# If this is \"false\" (the default), the cluster administrator is\n# responsible for creating ClusterDomainClaims and delegating them to\n# namespaces via their spec.Namespace field. This setting should be used in\n# multitenant environments which need to control which namespace can use a\n# particular domain name in a domain mapping.\n#\n# If this is \"true\", users are able to associate arbitrary names with their\n# services via the DomainMapping feature.\nautocreate-cluster-domain-claims: \"false\"\n\n# If true, networking plugins can add additional information to deployed\n# applications to make their pods directly accessible via their IPs even if mesh is\n# enabled and thus direct-addressability is usually not possible.\n# Consumers like Knative Serving can use this setting to adjust their behavior\n# accordingly, i.e. to drop fallback solutions for non-pod-addressable systems.\n#\n# NOTE: This flag is in an alpha state and is mostly here to enable internal testing\n# for now. Use with caution.\nenable-mesh-pod-addressability: \"false\"\n\n# mesh-compatibility-mode indicates whether consumers of network plugins\n# should directly contact Pod IPs (most efficient), or should use the\n# Cluster IP (less efficient, needed when mesh is enabled unless\n# `enable-mesh-pod-addressability`, above, is set).\n# Permitted values are:\n# - \"auto\" (default): automatically determine which mesh mode to use by trying Pod IP and falling back to Cluster IP as needed.\n# - \"enabled\": always use Cluster IP and do not attempt to use Pod IPs.\n# - \"disabled\": always use Pod IPs and do not fall back to Cluster IP on failure.\nmesh-compatibility-mode: \"auto\"\n\n# Defines the scheme used for external URLs if auto-tls is not enabled.\n# This can be used for making Knative report all URLs as \"HTTPS\" for example, if you're\n# fronting Knative with an external loadbalancer that deals with TLS termination and\n# Knative doesn't know about that otherwise.\ndefault-external-scheme: \"http\"\n" + } +}; +export const ConfigMap_ConfigObservability: KubernetesResource = { + apiVersion: "v1", + kind: "ConfigMap", + metadata: { + annotations: { + "knative.dev/example-checksum": "59abacb5" + }, + labels: { + "app.kubernetes.io/component": "observability", + "app.kubernetes.io/name": "knative-serving", + "app.kubernetes.io/version": "1.22.1" + }, + name: "config-observability", + namespace: "knative-serving" + }, + data: { + _example: "################################\n# #\n# EXAMPLE CONFIGURATION #\n# #\n################################\n\n# This block is not actually functional configuration,\n# but serves to illustrate the available configuration\n# options and document them in a way that is accessible\n# to users that `kubectl edit` this config map.\n#\n# These sample configuration options may be copied out of\n# this example block and unindented to be in the data block\n# to actually change the configuration.\n\n# logging.enable-var-log-collection defaults to false.\n# The fluentd daemon set will be set up to collect /var/log if\n# this flag is true.\nlogging.enable-var-log-collection: \"false\"\n\n# logging.revision-url-template provides a template to use for producing the\n# logging URL that is injected into the status of each Revision.\nlogging.revision-url-template: \"http://logging.example.com/?revisionUID=${REVISION_UID}\"\n\n# If non-empty, this enables queue proxy writing user request logs to stdout, excluding probe\n# requests.\n# NB: after 0.18 release logging.enable-request-log must be explicitly set to true\n# in order for request logging to be enabled.\n#\n# The value determines the shape of the request logs and it must be a valid go text/template.\n# It is important to keep this as a single line. Multiple lines are parsed as separate entities\n# by most collection agents and will split the request logs into multiple records.\n#\n# The following fields and functions are available to the template:\n#\n# Request: An http.Request (see https://golang.org/pkg/net/http/#Request)\n# representing an HTTP request received by the server.\n#\n# Response:\n# struct {\n# Code int // HTTP status code (see https://www.iana.org/assignments/http-status-codes/http-status-codes.xhtml)\n# Size int // An int representing the size of the response.\n# Latency float64 // A float64 representing the latency of the response in seconds.\n# }\n#\n# Revision:\n# struct {\n# Name string // Knative revision name\n# Namespace string // Knative revision namespace\n# Service string // Knative service name\n# Configuration string // Knative configuration name\n# PodName string // Name of the pod hosting the revision\n# PodIP string // IP of the pod hosting the revision\n# }\n#\nlogging.request-log-template: '{\"httpRequest\": {\"requestMethod\": \"{{.Request.Method}}\", \"requestUrl\": \"{{js .Request.RequestURI}}\", \"requestSize\": \"{{.Request.ContentLength}}\", \"status\": {{.Response.Code}}, \"responseSize\": \"{{.Response.Size}}\", \"userAgent\": \"{{js .Request.UserAgent}}\", \"remoteIp\": \"{{js .Request.RemoteAddr}}\", \"serverIp\": \"{{.Revision.PodIP}}\", \"referer\": \"{{js .Request.Referer}}\", \"latency\": \"{{.Response.Latency}}s\", \"protocol\": \"{{.Request.Proto}}\"}, \"traceId\": \"{{.TraceID}}\"}'\n\n# If true, the request logging will be enabled.\nlogging.enable-request-log: \"false\"\n\n# If true, this enables queue proxy writing request logs for probe requests to stdout.\n# It uses the same template for user requests, i.e. logging.request-log-template.\nlogging.enable-probe-request-log: \"false\"\n\n# metrics-protocol field specifies the protocol used when exporting metrics\n# It supports either 'none' (the default), 'prometheus', 'http/protobuf' (OTLP HTTP), 'grpc' (OTLP gRPC)\nmetrics-protocol: http/protobuf\n\n# metrics-endpoint field specifies the destination metrics should be exporter to.\n#\n# The endpoint MUST be set when the protocol is http/protobuf or grpc.\n# The endpoint MUST NOT be set when the protocol is none.\n#\n# When the protocol is prometheus the endpoint can accept a 'host:port' string to customize the\n# listening host interface and port.\nmetrics-endpoint: http://example.com/v1/traces\n\n# metrics-export-interval specifies the global metrics reporting period for control and data plane components.\n# If a zero or negative value is passed the default reporting OTel period is used (60 secs).\nmetrics-export-interval: 60s\n\n# request-metrics-protocol field specifies the protocol used when exporting queue-proxy metrics\n# It supports either 'none' (the default), 'prometheus', 'http/protobuf' (OTLP HTTP), 'grpc' (OTLP gRPC)\nrequest-metrics-protocol: http/protobuf\n\n# request-metrics-endpoint field specifies the destination metrics from the queue proxy should be exporter to.\n#\n# The endpoint MUST be set when the protocol is http/protobuf or grpc.\n# The endpoint MUST NOT be set when the protocol is none.\n#\n# When the protocol is prometheus the endpoint can accept a 'host:port' string to customize the\n# listening host interface and port.\nrequest-metrics-endpoint: http://promstack-kube-prometheus-prometheus.observability:9090/api/v1/otlp/v1/metrics\n\n# request-metrics-export-interval specifies the global metrics reporting period for the queue-proxy.\n#\n# If a zero or negative value is passed the default reporting OTel period is used (60 secs).\nrequest-metrics-export-interval: 60s\n\n# runtime-profiling indicates whether it is allowed to retrieve runtime profiling data from\n# the pods via an HTTP server in the format expected by the pprof visualization tool. When\n# enabled, the Knative Serving pods expose the profiling data on an alternate HTTP port 8008.\n# The HTTP context root for profiling is then /debug/pprof/.\nruntime-profiling: enabled\n\n# tracing-protocol field specifies the protocol used when exporting traces\n# It supports either 'none' (the default), 'http/protobuf' (OTLP HTTP), 'grpc' (OTLP gRPC)\n# or `stdout` for debugging purposes\ntracing-protocol: http/protobuf\n\n# tracing-endpoint field specifies the destination traces should be exporter to.\n#\n# The endpoint MUST be set when the protocol is http/protobuf or grpc.\n# The endpoint MUST NOT be set when the protocol is none.\ntracing-endpoint: http://jaeger-collector.observability:4318/v1/traces\n\n# tracing-sampling-rate allows the user to specify what percentage of all traces should be exported\n# The value should be between 0 (never sample) to 1 (always sample)\ntracing-sampling-rate: \"1\"\n" + } +}; +export const ConfigMap_ConfigTracing: KubernetesResource = { + apiVersion: "v1", + kind: "ConfigMap", + metadata: { + annotations: { + "knative.dev/example-checksum": "04c7e9a3" + }, + labels: { + "app.kubernetes.io/component": "tracing", + "app.kubernetes.io/name": "knative-serving", + "app.kubernetes.io/version": "1.22.1" + }, + name: "config-tracing", + namespace: "knative-serving" + }, + data: { + _example: "###########################################################\n# #\n# This config is deprecated - use config-observability #\n# #\n###########################################################\n" + } +}; +export const HorizontalPodAutoscaler_Activator: KubernetesResource = { + apiVersion: "autoscaling/v2", + kind: "HorizontalPodAutoscaler", + metadata: { + labels: { + "app.kubernetes.io/component": "activator", + "app.kubernetes.io/name": "knative-serving", + "app.kubernetes.io/version": "1.22.1" + }, + name: "activator", + namespace: "knative-serving" + }, + spec: { + maxReplicas: 20, + metrics: [{ + resource: { + name: "cpu", + target: { + averageUtilization: 100, + type: "Utilization" + } + }, + type: "Resource" + }], + minReplicas: 1, + scaleTargetRef: { + apiVersion: "apps/v1", + kind: "Deployment", + name: "activator" + } + } +}; +export const PodDisruptionBudget_ActivatorPdb: KubernetesResource = { + apiVersion: "policy/v1", + kind: "PodDisruptionBudget", + metadata: { + labels: { + "app.kubernetes.io/component": "activator", + "app.kubernetes.io/name": "knative-serving", + "app.kubernetes.io/version": "1.22.1" + }, + name: "activator-pdb", + namespace: "knative-serving" + }, + spec: { + minAvailable: "80%", + selector: { + matchLabels: { + app: "activator" + } + } + } +}; +export const Deployment_Activator: KubernetesResource = { + apiVersion: "apps/v1", + kind: "Deployment", + metadata: { + labels: { + "app.kubernetes.io/component": "activator", + "app.kubernetes.io/name": "knative-serving", + "app.kubernetes.io/version": "1.22.1" + }, + name: "activator", + namespace: "knative-serving" + }, + spec: { + selector: { + matchLabels: { + app: "activator", + role: "activator" + } + }, + template: { + metadata: { + labels: { + app: "activator", + "app.kubernetes.io/component": "activator", + "app.kubernetes.io/name": "knative-serving", + "app.kubernetes.io/version": "1.22.1", + role: "activator" + } + }, + spec: { + affinity: { + podAntiAffinity: { + preferredDuringSchedulingIgnoredDuringExecution: [{ + podAffinityTerm: { + labelSelector: { + matchLabels: { + app: "activator" + } + }, + topologyKey: "kubernetes.io/hostname" + }, + weight: 100 + }] + } + }, + containers: [{ + env: [{ + name: "GOGC", + value: "500" + }, { + name: "POD_NAME", + valueFrom: { + fieldRef: { + fieldPath: "metadata.name" + } + } + }, { + name: "POD_IP", + valueFrom: { + fieldRef: { + fieldPath: "status.podIP" + } + } + }, { + name: "SYSTEM_NAMESPACE", + valueFrom: { + fieldRef: { + fieldPath: "metadata.namespace" + } + } + }, { + name: "CONFIG_LOGGING_NAME", + value: "config-logging" + }, { + name: "CONFIG_OBSERVABILITY_NAME", + value: "config-observability" + }], + image: "gcr.io/knative-releases/knative.dev/serving/cmd/activator@sha256:5deaef961fef8d1417f6d4a4dfae2fc338f2d30d72c4ad58c3ab392b2c04705b", + livenessProbe: { + failureThreshold: 12, + httpGet: { + port: 8012 + }, + initialDelaySeconds: 15, + periodSeconds: 10 + }, + name: "activator", + ports: [{ + containerPort: 9090, + name: "metrics" + }, { + containerPort: 8008, + name: "profiling" + }, { + containerPort: 8012, + name: "http1" + }, { + containerPort: 8013, + name: "h2c" + }], + readinessProbe: { + failureThreshold: 5, + httpGet: { + port: 8012 + }, + periodSeconds: 5 + }, + resources: { + limits: { + cpu: "1000m", + memory: "600Mi" + }, + requests: { + cpu: "300m", + memory: "60Mi" + } + }, + securityContext: { + allowPrivilegeEscalation: false, + capabilities: { + drop: ["ALL"] + }, + readOnlyRootFilesystem: true, + runAsNonRoot: true, + seccompProfile: { + type: "RuntimeDefault" + } + } + }], + serviceAccountName: "activator", + terminationGracePeriodSeconds: 600 + } + } + } +}; +export const Service_ActivatorService: KubernetesResource = { + apiVersion: "v1", + kind: "Service", + metadata: { + labels: { + app: "activator", + "app.kubernetes.io/component": "activator", + "app.kubernetes.io/name": "knative-serving", + "app.kubernetes.io/version": "1.22.1" + }, + name: "activator-service", + namespace: "knative-serving" + }, + spec: { + ports: [{ + name: "http-metrics", + port: 9090, + targetPort: 9090 + }, { + name: "http-profiling", + port: 8008, + targetPort: 8008 + }, { + name: "http", + port: 80, + targetPort: 8012 + }, { + name: "http2", + port: 81, + targetPort: 8013 + }, { + name: "https", + port: 443, + targetPort: 8112 + }], + selector: { + app: "activator" + }, + type: "ClusterIP" + } +}; +export const Deployment_Autoscaler: KubernetesResource = { + apiVersion: "apps/v1", + kind: "Deployment", + metadata: { + labels: { + "app.kubernetes.io/component": "autoscaler", + "app.kubernetes.io/name": "knative-serving", + "app.kubernetes.io/version": "1.22.1" + }, + name: "autoscaler", + namespace: "knative-serving" + }, + spec: { + replicas: 1, + selector: { + matchLabels: { + app: "autoscaler" + } + }, + strategy: { + rollingUpdate: { + maxUnavailable: 0 + }, + type: "RollingUpdate" + }, + template: { + metadata: { + labels: { + app: "autoscaler", + "app.kubernetes.io/component": "autoscaler", + "app.kubernetes.io/name": "knative-serving", + "app.kubernetes.io/version": "1.22.1" + } + }, + spec: { + affinity: { + podAntiAffinity: { + preferredDuringSchedulingIgnoredDuringExecution: [{ + podAffinityTerm: { + labelSelector: { + matchLabels: { + app: "autoscaler" + } + }, + topologyKey: "kubernetes.io/hostname" + }, + weight: 100 + }] + } + }, + containers: [{ + env: [{ + name: "POD_NAME", + valueFrom: { + fieldRef: { + fieldPath: "metadata.name" + } + } + }, { + name: "POD_IP", + valueFrom: { + fieldRef: { + fieldPath: "status.podIP" + } + } + }, { + name: "SYSTEM_NAMESPACE", + valueFrom: { + fieldRef: { + fieldPath: "metadata.namespace" + } + } + }, { + name: "CONFIG_LOGGING_NAME", + value: "config-logging" + }, { + name: "CONFIG_OBSERVABILITY_NAME", + value: "config-observability" + }], + image: "gcr.io/knative-releases/knative.dev/serving/cmd/autoscaler@sha256:5bae38655d87df86b041083fbe51791816473245f752432ba9b85a7b12f73cd5", + livenessProbe: { + failureThreshold: 6, + httpGet: { + port: 8080 + } + }, + name: "autoscaler", + ports: [{ + containerPort: 9090, + name: "metrics" + }, { + containerPort: 8008, + name: "profiling" + }, { + containerPort: 8080, + name: "websocket" + }], + readinessProbe: { + httpGet: { + port: 8080 + } + }, + resources: { + limits: { + cpu: "1000m", + memory: "1000Mi" + }, + requests: { + cpu: "100m", + memory: "100Mi" + } + }, + securityContext: { + allowPrivilegeEscalation: false, + capabilities: { + drop: ["ALL"] + }, + readOnlyRootFilesystem: true, + runAsNonRoot: true, + seccompProfile: { + type: "RuntimeDefault" + } + } + }], + serviceAccountName: "controller" + } + } + } +}; +export const Service_Autoscaler: KubernetesResource = { + apiVersion: "v1", + kind: "Service", + metadata: { + labels: { + app: "autoscaler", + "app.kubernetes.io/component": "autoscaler", + "app.kubernetes.io/name": "knative-serving", + "app.kubernetes.io/version": "1.22.1" + }, + name: "autoscaler", + namespace: "knative-serving" + }, + spec: { + ports: [{ + name: "http-metrics", + port: 9090, + targetPort: 9090 + }, { + name: "http-profiling", + port: 8008, + targetPort: 8008 + }, { + name: "http", + port: 8080, + targetPort: 8080 + }], + selector: { + app: "autoscaler" + } + } +}; +export const Deployment_Controller: KubernetesResource = { + apiVersion: "apps/v1", + kind: "Deployment", + metadata: { + labels: { + "app.kubernetes.io/component": "controller", + "app.kubernetes.io/name": "knative-serving", + "app.kubernetes.io/version": "1.22.1" + }, + name: "controller", + namespace: "knative-serving" + }, + spec: { + selector: { + matchLabels: { + app: "controller" + } + }, + template: { + metadata: { + labels: { + app: "controller", + "app.kubernetes.io/component": "controller", + "app.kubernetes.io/name": "knative-serving", + "app.kubernetes.io/version": "1.22.1" + } + }, + spec: { + affinity: { + podAntiAffinity: { + preferredDuringSchedulingIgnoredDuringExecution: [{ + podAffinityTerm: { + labelSelector: { + matchLabels: { + app: "controller" + } + }, + topologyKey: "kubernetes.io/hostname" + }, + weight: 100 + }] + } + }, + containers: [{ + env: [{ + name: "POD_NAME", + valueFrom: { + fieldRef: { + fieldPath: "metadata.name" + } + } + }, { + name: "SYSTEM_NAMESPACE", + valueFrom: { + fieldRef: { + fieldPath: "metadata.namespace" + } + } + }, { + name: "CONFIG_LOGGING_NAME", + value: "config-logging" + }, { + name: "CONFIG_OBSERVABILITY_NAME", + value: "config-observability" + }], + image: "gcr.io/knative-releases/knative.dev/serving/cmd/controller@sha256:94329d85200c2fc31ed1166a26568ca1357376c149c147e71f400cf28be3c816", + livenessProbe: { + failureThreshold: 6, + httpGet: { + path: "/health", + port: "probes", + scheme: "HTTP" + }, + periodSeconds: 5 + }, + name: "controller", + ports: [{ + containerPort: 9090, + name: "metrics" + }, { + containerPort: 8008, + name: "profiling" + }, { + containerPort: 8080, + name: "probes" + }], + readinessProbe: { + failureThreshold: 3, + httpGet: { + path: "/readiness", + port: "probes", + scheme: "HTTP" + }, + periodSeconds: 5 + }, + resources: { + limits: { + cpu: "1000m", + memory: "1000Mi" + }, + requests: { + cpu: "100m", + memory: "100Mi" + } + }, + securityContext: { + allowPrivilegeEscalation: false, + capabilities: { + drop: ["ALL"] + }, + readOnlyRootFilesystem: true, + runAsNonRoot: true, + seccompProfile: { + type: "RuntimeDefault" + } + } + }], + serviceAccountName: "controller" + } + } + } +}; +export const Service_Controller: KubernetesResource = { + apiVersion: "v1", + kind: "Service", + metadata: { + labels: { + app: "controller", + "app.kubernetes.io/component": "controller", + "app.kubernetes.io/name": "knative-serving", + "app.kubernetes.io/version": "1.22.1" + }, + name: "controller", + namespace: "knative-serving" + }, + spec: { + ports: [{ + name: "http-metrics", + port: 9090, + targetPort: 9090 + }, { + name: "http-profiling", + port: 8008, + targetPort: 8008 + }], + selector: { + app: "controller" + } + } +}; +export const HorizontalPodAutoscaler_Webhook: KubernetesResource = { + apiVersion: "autoscaling/v2", + kind: "HorizontalPodAutoscaler", + metadata: { + labels: { + "app.kubernetes.io/component": "webhook", + "app.kubernetes.io/name": "knative-serving", + "app.kubernetes.io/version": "1.22.1" + }, + name: "webhook", + namespace: "knative-serving" + }, + spec: { + maxReplicas: 5, + metrics: [{ + resource: { + name: "cpu", + target: { + averageUtilization: 100, + type: "Utilization" + } + }, + type: "Resource" + }], + minReplicas: 1, + scaleTargetRef: { + apiVersion: "apps/v1", + kind: "Deployment", + name: "webhook" + } + } +}; +export const PodDisruptionBudget_WebhookPdb: KubernetesResource = { + apiVersion: "policy/v1", + kind: "PodDisruptionBudget", + metadata: { + labels: { + "app.kubernetes.io/component": "webhook", + "app.kubernetes.io/name": "knative-serving", + "app.kubernetes.io/version": "1.22.1" + }, + name: "webhook-pdb", + namespace: "knative-serving" + }, + spec: { + minAvailable: "80%", + selector: { + matchLabels: { + app: "webhook" + } + } + } +}; +export const Deployment_Webhook: KubernetesResource = { + apiVersion: "apps/v1", + kind: "Deployment", + metadata: { + labels: { + "app.kubernetes.io/component": "webhook", + "app.kubernetes.io/name": "knative-serving", + "app.kubernetes.io/version": "1.22.1" + }, + name: "webhook", + namespace: "knative-serving" + }, + spec: { + selector: { + matchLabels: { + app: "webhook", + role: "webhook" + } + }, + template: { + metadata: { + labels: { + app: "webhook", + "app.kubernetes.io/component": "webhook", + "app.kubernetes.io/name": "knative-serving", + "app.kubernetes.io/version": "1.22.1", + role: "webhook" + } + }, + spec: { + affinity: { + podAntiAffinity: { + preferredDuringSchedulingIgnoredDuringExecution: [{ + podAffinityTerm: { + labelSelector: { + matchLabels: { + app: "webhook" + } + }, + topologyKey: "kubernetes.io/hostname" + }, + weight: 100 + }] + } + }, + containers: [{ + env: [{ + name: "POD_NAME", + valueFrom: { + fieldRef: { + fieldPath: "metadata.name" + } + } + }, { + name: "SYSTEM_NAMESPACE", + valueFrom: { + fieldRef: { + fieldPath: "metadata.namespace" + } + } + }, { + name: "CONFIG_LOGGING_NAME", + value: "config-logging" + }, { + name: "CONFIG_OBSERVABILITY_NAME", + value: "config-observability" + }, { + name: "WEBHOOK_NAME", + value: "webhook" + }, { + name: "WEBHOOK_PORT", + value: "8443" + }], + image: "gcr.io/knative-releases/knative.dev/serving/cmd/webhook@sha256:8470456be214e93a84e3c7b79a632aa9978bd8ecda553feaa47878a2c24ab84d", + livenessProbe: { + failureThreshold: 6, + httpGet: { + port: 8443, + scheme: "HTTPS" + }, + initialDelaySeconds: 20, + periodSeconds: 10 + }, + name: "webhook", + ports: [{ + containerPort: 9090, + name: "metrics" + }, { + containerPort: 8008, + name: "profiling" + }, { + containerPort: 8443, + name: "https-webhook" + }], + readinessProbe: { + httpGet: { + port: 8443, + scheme: "HTTPS" + }, + periodSeconds: 1 + }, + resources: { + limits: { + cpu: "500m", + memory: "500Mi" + }, + requests: { + cpu: "100m", + memory: "100Mi" + } + }, + securityContext: { + allowPrivilegeEscalation: false, + capabilities: { + drop: ["ALL"] + }, + readOnlyRootFilesystem: true, + runAsNonRoot: true, + seccompProfile: { + type: "RuntimeDefault" + } + } + }], + serviceAccountName: "controller", + terminationGracePeriodSeconds: 300 + } + } + } +}; +export const Service_Webhook: KubernetesResource = { + apiVersion: "v1", + kind: "Service", + metadata: { + labels: { + app: "webhook", + "app.kubernetes.io/component": "webhook", + "app.kubernetes.io/name": "knative-serving", + "app.kubernetes.io/version": "1.22.1", + role: "webhook" + }, + name: "webhook", + namespace: "knative-serving" + }, + spec: { + ports: [{ + name: "http-metrics", + port: 9090, + targetPort: 9090 + }, { + name: "http-profiling", + port: 8008, + targetPort: 8008 + }, { + name: "https-webhook", + port: 443, + targetPort: 8443 + }], + selector: { + app: "webhook", + role: "webhook" + } + } +}; +export const ValidatingWebhookConfiguration_ConfigWebhookServingKnativeDev: KubernetesResource = { + apiVersion: "admissionregistration.k8s.io/v1", + kind: "ValidatingWebhookConfiguration", + metadata: { + labels: { + "app.kubernetes.io/component": "webhook", + "app.kubernetes.io/name": "knative-serving", + "app.kubernetes.io/version": "1.22.1" + }, + name: "config.webhook.serving.knative.dev" + }, + webhooks: [{ + admissionReviewVersions: ["v1", "v1beta1"], + clientConfig: { + service: { + name: "webhook", + namespace: "knative-serving" + } + }, + failurePolicy: "Fail", + name: "config.webhook.serving.knative.dev", + objectSelector: { + matchExpressions: [{ + key: "app.kubernetes.io/name", + operator: "In", + values: ["knative-serving"] + }, { + key: "app.kubernetes.io/component", + operator: "In", + values: ["autoscaler", "controller", "logging", "networking", "observability", "tracing", "net-certmanager"] + }] + }, + sideEffects: "None", + timeoutSeconds: 10 + }] +}; +export const MutatingWebhookConfiguration_WebhookServingKnativeDev: KubernetesResource = { + apiVersion: "admissionregistration.k8s.io/v1", + kind: "MutatingWebhookConfiguration", + metadata: { + labels: { + "app.kubernetes.io/component": "webhook", + "app.kubernetes.io/name": "knative-serving", + "app.kubernetes.io/version": "1.22.1" + }, + name: "webhook.serving.knative.dev" + }, + webhooks: [{ + admissionReviewVersions: ["v1", "v1beta1"], + clientConfig: { + service: { + name: "webhook", + namespace: "knative-serving" + } + }, + failurePolicy: "Fail", + name: "webhook.serving.knative.dev", + rules: [{ + apiGroups: ["autoscaling.internal.knative.dev", "networking.internal.knative.dev", "serving.knative.dev"], + apiVersions: ["*"], + operations: ["CREATE", "UPDATE"], + resources: ["metrics", "podautoscalers", "certificates", "ingresses", "serverlessservices", "configurations", "revisions", "routes", "services", "domainmappings", "domainmappings/status"], + scope: "*" + }], + sideEffects: "None", + timeoutSeconds: 10 + }] +}; +export const ValidatingWebhookConfiguration_ValidationWebhookServingKnativeDev: KubernetesResource = { + apiVersion: "admissionregistration.k8s.io/v1", + kind: "ValidatingWebhookConfiguration", + metadata: { + labels: { + "app.kubernetes.io/component": "webhook", + "app.kubernetes.io/name": "knative-serving", + "app.kubernetes.io/version": "1.22.1" + }, + name: "validation.webhook.serving.knative.dev" + }, + webhooks: [{ + admissionReviewVersions: ["v1", "v1beta1"], + clientConfig: { + service: { + name: "webhook", + namespace: "knative-serving" + } + }, + failurePolicy: "Fail", + name: "validation.webhook.serving.knative.dev", + rules: [{ + apiGroups: ["autoscaling.internal.knative.dev", "networking.internal.knative.dev", "serving.knative.dev"], + apiVersions: ["*"], + operations: ["CREATE", "UPDATE", "DELETE"], + resources: ["metrics", "podautoscalers", "certificates", "ingresses", "serverlessservices", "configurations", "revisions", "routes", "services", "domainmappings", "domainmappings/status"], + scope: "*" + }], + sideEffects: "None", + timeoutSeconds: 10 + }] +}; +export const Secret_WebhookCerts: KubernetesResource = { + apiVersion: "v1", + kind: "Secret", + metadata: { + labels: { + "app.kubernetes.io/component": "webhook", + "app.kubernetes.io/name": "knative-serving", + "app.kubernetes.io/version": "1.22.1" + }, + name: "webhook-certs", + namespace: "knative-serving" + } +}; +export const Namespace_KourierSystem: KubernetesResource = { + apiVersion: "v1", + kind: "Namespace", + metadata: { + labels: { + "app.kubernetes.io/component": "net-kourier", + "app.kubernetes.io/name": "knative-serving", + "app.kubernetes.io/version": "1.22.1", + "networking.knative.dev/ingress-provider": "kourier" + }, + name: "kourier-system" + } +}; +export const ConfigMap_KourierBootstrap: KubernetesResource = { + apiVersion: "v1", + kind: "ConfigMap", + metadata: { + labels: { + "app.kubernetes.io/component": "net-kourier", + "app.kubernetes.io/name": "knative-serving", + "app.kubernetes.io/version": "1.22.1", + "networking.knative.dev/ingress-provider": "kourier" + }, + name: "kourier-bootstrap", + namespace: "kourier-system" + }, + data: { + "envoy-bootstrap.yaml": "dynamic_resources:\n ads_config:\n transport_api_version: V3\n api_type: GRPC\n rate_limit_settings: {}\n grpc_services:\n - envoy_grpc: {cluster_name: xds_cluster}\n cds_config:\n resource_api_version: V3\n ads: {}\n lds_config:\n resource_api_version: V3\n ads: {}\nnode:\n cluster: kourier-knative\n id: 3scale-kourier-gateway\nstatic_resources:\n listeners:\n - name: stats_listener\n address:\n socket_address:\n address: 0.0.0.0\n port_value: 9000\n filter_chains:\n - filters:\n - name: envoy.filters.network.http_connection_manager\n typed_config:\n \"@type\": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager\n stat_prefix: stats_server\n http_filters:\n - name: envoy.filters.http.router\n typed_config:\n \"@type\": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router\n route_config:\n virtual_hosts:\n - name: admin_interface\n domains:\n - \"*\"\n routes:\n - match:\n safe_regex:\n regex: '/(certs|stats(/prometheus)?|server_info|clusters|listeners|ready)?'\n headers:\n - name: ':method'\n string_match:\n exact: GET\n route:\n cluster: service_stats\n - match:\n safe_regex:\n regex: '/drain_listeners'\n headers:\n - name: ':method'\n string_match:\n exact: POST\n route:\n cluster: service_stats\n clusters:\n - name: service_stats\n connect_timeout: 0.250s\n type: static\n load_assignment:\n cluster_name: service_stats\n endpoints:\n lb_endpoints:\n endpoint:\n address:\n socket_address:\n address: 127.0.0.1\n port_value: 9901\n - name: xds_cluster\n # This keepalive is recommended by envoy docs.\n # https://www.envoyproxy.io/docs/envoy/latest/api-docs/xds_protocol\n typed_extension_protocol_options:\n envoy.extensions.upstreams.http.v3.HttpProtocolOptions:\n \"@type\": type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions\n explicit_http_config:\n http2_protocol_options:\n connection_keepalive:\n interval: 30s\n timeout: 5s\n connect_timeout: 1s\n load_assignment:\n cluster_name: xds_cluster\n endpoints:\n lb_endpoints:\n endpoint:\n address:\n socket_address:\n address: \"net-kourier-controller.knative-serving\"\n port_value: 18000\n type: STRICT_DNS\nadmin:\n access_log:\n - name: envoy.access_loggers.stdout\n typed_config:\n \"@type\": type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog\n address:\n socket_address:\n address: 127.0.0.1\n port_value: 9901\n" + } +}; +export const ConfigMap_ConfigKourier: KubernetesResource = { + apiVersion: "v1", + kind: "ConfigMap", + metadata: { + labels: { + "app.kubernetes.io/component": "net-kourier", + "app.kubernetes.io/name": "knative-serving", + "app.kubernetes.io/version": "1.22.1", + "networking.knative.dev/ingress-provider": "kourier" + }, + name: "config-kourier", + namespace: "knative-serving" + }, + data: { + _example: "################################\n# #\n# EXAMPLE CONFIGURATION #\n# #\n################################\n\n# This block is not actually functional configuration,\n# but serves to illustrate the available configuration\n# options and document them in a way that is accessible\n# to users that `kubectl edit` this config map.\n#\n# These sample configuration options may be copied out of\n# this example block and unindented to be in the data block\n# to actually change the configuration.\n\n# Specifies whether requests reaching the Kourier gateway\n# in the context of services should be logged. Readiness\n# probes etc. must be configured via the bootstrap config.\nenable-service-access-logging: \"true\"\n\n# Specifies the format of the access log used by the Kourier gateway.\n# This template follows the envoy format.\n# see: https://www.envoyproxy.io/docs/envoy/latest/configuration/observability/access_log/usage#access-logging\nservice-access-log-template: \"\"\n\n# Specifies whether to use proxy-protocol in order to safely\n# transport connection information such as a client's address\n# across multiple layers of TCP proxies.\n# NOTE THAT THIS IS AN EXPERIMENTAL / ALPHA FEATURE\nenable-proxy-protocol: \"false\"\n\n# The server certificates to serve the internal TLS traffic for Kourier Gateway.\n# It is specified by the secret name in controller namespace, which has\n# the \"tls.crt\" and \"tls.key\" data field.\n# Use an empty value to disable the feature (default).\n#\n# NOTE: This flag is in an alpha state and is mostly here to enable internal testing\n# for now. Use with caution.\ncluster-cert-secret: \"\"\n\n# Specifies the amount of time that Kourier waits for the incoming requests.\n# The default, 0s, imposes no timeout at all.\nstream-idle-timeout: \"0s\"\n\n# Specifies whether to use CryptoMB private key provider in order to\n# acclerate the TLS handshake.\n# NOTE THAT THIS IS AN EXPERIMENTAL / ALPHA FEATURE.\nenable-cryptomb: \"false\"\n\n# Configures the number of additional ingress proxy hops from the\n# right side of the x-forwarded-for HTTP header to trust.\ntrusted-hops-count: \"0\"\n\n# Configures the connection manager to use the real remote address\n# of the client connection when determining internal versus external origin and manipulating various headers.\nuse-remote-address: \"false\"\n\n# Specifies the cipher suites for TLS external listener.\n# Use ',' separated values like \"ECDHE-ECDSA-AES128-GCM-SHA256,ECDHE-ECDSA-CHACHA20-POLY1305\"\n# The default uses the default cipher suites of the envoy version.\ncipher-suites: \"\"\n\n# Disable the Envoy server header injection in the response when response has no such header.\ndisable-envoy-server-header: \"false\"\n\n# The external authorization service and port, my-auth:2222.\n# This value overrides environment variable if defined.\nextauthz-host: \"\"\n\n# The protocol used to query the ext auth service. Can be one of : grpc, http, https. Defaults to grpc\n# This value overrides environment variable if defined.\nextauthz-protocol: \"grpc\"\n\n# Allow traffic to go through if the ext auth service is down. Accepts true/false.\n# This value overrides environment variable if defined.\nextauthz-failure-mode-allow: \"\"\n\n# Max request bytes, if not set, defaults to 8192 Bytes. More info Envoy Docs\n# see: https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/http/ext_authz/v3/ext_authz.proto.html#extensions-filters-http-ext-authz-v3-buffersettings\n# This value overrides environment variable if defined.\nextauthz-max-request-body-bytes: 8192\n\n# Max time in ms to wait for the ext authz service. Defaults to 2000 ms\n# This value overrides environment variable if defined.\nextauthz-timeout: 2000\n\n# If extauthz-protocol is equal to http or https, path to query the ext auth service.\n# Example : if set to /verify, it will query /verify/ (notice the trailing /). If not set, it will query /\n# This value overrides environment variable if defined.\nextauthz-path-prefix: \"\"\n\n# If extauthz-protocol is equal to grpc, sends the body as raw bytes instead of a UTF-8 string.\n# Accepts only true/false, t/f or 1/0. Attempting to set another value will throw an error.\n# Defaults to false. More info Envoy Docs.\n# see: https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/http/ext_authz/v3/ext_authz.proto.html#extensions-filters-http-ext-authz-v3-buffersettings\n# This value overrides environment variable if defined.\nextauthz-pack-as-byte: \"false\"\n\n# Specifies the secret that contains the TLS certificate and key pair when using HTTPS communication with Kourier Ingress.\n# This value overrides environment variable if defined.\ncerts-secret-name: \"\"\ncerts-secret-namespace: \"\"\n\n# Specifies the OTLP collector endpoint for distributed tracing.\n# The endpoint format depends on the protocol (see tracing-protocol).\n# Examples:\n# - For HTTP: \"http://otel-collector.observability.svc:4318/v1/traces\"\n# - For gRPC: \"http://otel-collector.observability.svc:4317\"\n# Use an empty value to disable distributed tracing (default).\ntracing-endpoint: \"\"\n\n# Protocol for tracing collector communication.\n# Valid values: http/protobuf, grpc\ntracing-protocol: \"grpc\"\n\n# Tracing sampling rate (0.0 to 1.0)\n# Controls the percentage of requests that are traced.\n# Example: \"1.0\" traces 100% of requests.\ntracing-sampling-rate: \"1.0\"\n\n# Service name for traces\n# This identifies the Kourier gateway in your tracing system.\ntracing-service-name: \"kourier-knative\"\n" + } +}; +export const ServiceAccount_NetKourier: KubernetesResource = { + apiVersion: "v1", + kind: "ServiceAccount", + metadata: { + labels: { + "app.kubernetes.io/component": "net-kourier", + "app.kubernetes.io/name": "knative-serving", + "app.kubernetes.io/version": "1.22.1", + "networking.knative.dev/ingress-provider": "kourier" + }, + name: "net-kourier", + namespace: "knative-serving" + } +}; +export const ClusterRole_NetKourier: KubernetesResource = { + apiVersion: "rbac.authorization.k8s.io/v1", + kind: "ClusterRole", + metadata: { + labels: { + "app.kubernetes.io/component": "net-kourier", + "app.kubernetes.io/name": "knative-serving", + "app.kubernetes.io/version": "1.22.1", + "networking.knative.dev/ingress-provider": "kourier" + }, + name: "net-kourier" + }, + rules: [{ + apiGroups: [""], + resources: ["events"], + verbs: ["create", "update", "patch"] + }, { + apiGroups: [""], + resources: ["pods", "services", "secrets"], + verbs: ["get", "list", "watch"] + }, { + apiGroups: [""], + resources: ["configmaps"], + verbs: ["get", "list", "watch"] + }, { + apiGroups: ["discovery.k8s.io"], + resources: ["endpointslices"], + verbs: ["get", "list", "watch"] + }, { + apiGroups: ["coordination.k8s.io"], + resources: ["leases"], + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] + }, { + apiGroups: ["networking.internal.knative.dev"], + resources: ["ingresses"], + verbs: ["get", "list", "watch", "patch"] + }, { + apiGroups: ["networking.internal.knative.dev"], + resources: ["ingresses/status"], + verbs: ["update"] + }] +}; +export const ClusterRoleBinding_NetKourier: KubernetesResource = { + apiVersion: "rbac.authorization.k8s.io/v1", + kind: "ClusterRoleBinding", + metadata: { + labels: { + "app.kubernetes.io/component": "net-kourier", + "app.kubernetes.io/name": "knative-serving", + "app.kubernetes.io/version": "1.22.1", + "networking.knative.dev/ingress-provider": "kourier" + }, + name: "net-kourier" + }, + roleRef: { + apiGroup: "rbac.authorization.k8s.io", + kind: "ClusterRole", + name: "net-kourier" + }, + subjects: [{ + kind: "ServiceAccount", + name: "net-kourier", + namespace: "knative-serving" + }] +}; +export const Deployment_NetKourierController: KubernetesResource = { + apiVersion: "apps/v1", + kind: "Deployment", + metadata: { + labels: { + "app.kubernetes.io/component": "net-kourier", + "app.kubernetes.io/name": "knative-serving", + "app.kubernetes.io/version": "1.22.1", + "networking.knative.dev/ingress-provider": "kourier" + }, + name: "net-kourier-controller", + namespace: "knative-serving" + }, + spec: { + replicas: 1, + selector: { + matchLabels: { + app: "net-kourier-controller" + } + }, + strategy: { + rollingUpdate: { + maxSurge: "100%", + maxUnavailable: 0 + }, + type: "RollingUpdate" + }, + template: { + metadata: { + annotations: { + "prometheus.io/path": "/metrics", + "prometheus.io/port": "9090", + "prometheus.io/scrape": "true" + }, + labels: { + app: "net-kourier-controller" + } + }, + spec: { + containers: [{ + env: [{ + name: "CERTS_SECRET_NAMESPACE", + value: "" + }, { + name: "CERTS_SECRET_NAME", + value: "" + }, { + name: "SYSTEM_NAMESPACE", + valueFrom: { + fieldRef: { + fieldPath: "metadata.namespace" + } + } + }, { + name: "METRICS_DOMAIN", + value: "knative.dev/samples" + }, { + name: "KOURIER_GATEWAY_NAMESPACE", + value: "kourier-system" + }, { + name: "ENABLE_SECRET_INFORMER_FILTERING_BY_CERT_UID", + value: "false" + }, { + name: "KUBE_API_BURST", + value: "200" + }, { + name: "KUBE_API_QPS", + value: "200" + }], + image: "gcr.io/knative-releases/knative.dev/net-kourier/cmd/kourier@sha256:01abd2070ccf8680885c47990e42c05c09e30bc8595d9246f4dcd37f2220a2a2", + livenessProbe: { + failureThreshold: 6, + grpc: { + port: 18000 + }, + periodSeconds: 10 + }, + name: "controller", + ports: [{ + containerPort: 18000, + name: "http2-xds", + protocol: "TCP" + }, { + containerPort: 9090, + name: "metrics", + protocol: "TCP" + }], + readinessProbe: { + failureThreshold: 3, + grpc: { + port: 18000 + }, + periodSeconds: 10 + }, + resources: { + limits: { + cpu: "1", + memory: "500Mi" + }, + requests: { + cpu: "200m", + memory: "200Mi" + } + }, + securityContext: { + allowPrivilegeEscalation: false, + capabilities: { + drop: ["ALL"] + }, + readOnlyRootFilesystem: true, + runAsNonRoot: true, + seccompProfile: { + type: "RuntimeDefault" + } + } + }], + restartPolicy: "Always", + serviceAccountName: "net-kourier" + } + } + } +}; +export const Service_NetKourierController: KubernetesResource = { + apiVersion: "v1", + kind: "Service", + metadata: { + labels: { + "app.kubernetes.io/component": "net-kourier", + "app.kubernetes.io/name": "knative-serving", + "app.kubernetes.io/version": "1.22.1", + "networking.knative.dev/ingress-provider": "kourier" + }, + name: "net-kourier-controller", + namespace: "knative-serving" + }, + spec: { + ports: [{ + name: "grpc-xds", + port: 18000, + protocol: "TCP", + targetPort: 18000 + }, { + name: "http-metrics", + port: 9090, + protocol: "TCP", + targetPort: 9090 + }], + selector: { + app: "net-kourier-controller" + }, + type: "ClusterIP" + } +}; +export const Deployment_3scaleKourierGateway: KubernetesResource = { + apiVersion: "apps/v1", + kind: "Deployment", + metadata: { + labels: { + "app.kubernetes.io/component": "net-kourier", + "app.kubernetes.io/name": "knative-serving", + "app.kubernetes.io/version": "1.22.1", + "networking.knative.dev/ingress-provider": "kourier" + }, + name: "3scale-kourier-gateway", + namespace: "kourier-system" + }, + spec: { + selector: { + matchLabels: { + app: "3scale-kourier-gateway" + } + }, + strategy: { + rollingUpdate: { + maxSurge: "100%", + maxUnavailable: 0 + }, + type: "RollingUpdate" + }, + template: { + metadata: { + annotations: { + "networking.knative.dev/poke": "v0.26", + "prometheus.io/path": "/stats/prometheus", + "prometheus.io/port": "9000", + "prometheus.io/scrape": "true" + }, + labels: { + app: "3scale-kourier-gateway" + } + }, + spec: { + containers: [{ + args: ["--base-id 1", "-c /tmp/config/envoy-bootstrap.yaml", "--log-level info", "--drain-time-s $(DRAIN_TIME_SECONDS)", "--drain-strategy immediate"], + command: ["/usr/local/bin/envoy"], + env: [{ + name: "DRAIN_TIME_SECONDS", + value: "15" + }], + image: "docker.io/envoyproxy/envoy:v1.37-latest", + lifecycle: { + preStop: { + exec: { + command: ["/bin/sh", "-c", "curl -X POST http://localhost:9901/drain_listeners?graceful; sleep $DRAIN_TIME_SECONDS"] + } + } + }, + livenessProbe: { + failureThreshold: 6, + httpGet: { + httpHeaders: [{ + name: "Host", + value: "internalkourier" + }], + path: "/ready", + port: 8081, + scheme: "HTTP" + }, + initialDelaySeconds: 10, + periodSeconds: 5, + timeoutSeconds: 3 + }, + name: "kourier-gateway", + ports: [{ + containerPort: 8080, + name: "http2-external", + protocol: "TCP" + }, { + containerPort: 8081, + name: "http2-internal", + protocol: "TCP" + }, { + containerPort: 8443, + name: "https-external", + protocol: "TCP" + }, { + containerPort: 8090, + name: "http-probe", + protocol: "TCP" + }, { + containerPort: 9443, + name: "https-probe", + protocol: "TCP" + }, { + containerPort: 9000, + name: "metrics", + protocol: "TCP" + }], + readinessProbe: { + failureThreshold: 3, + httpGet: { + httpHeaders: [{ + name: "Host", + value: "internalkourier" + }], + path: "/ready", + port: 8081, + scheme: "HTTP" + }, + initialDelaySeconds: 10, + periodSeconds: 5, + timeoutSeconds: 3 + }, + resources: { + limits: { + cpu: "1", + memory: "800Mi" + }, + requests: { + cpu: "200m", + memory: "200Mi" + } + }, + securityContext: { + allowPrivilegeEscalation: false, + capabilities: { + drop: ["ALL"] + }, + readOnlyRootFilesystem: false, + runAsGroup: 65534, + runAsNonRoot: true, + runAsUser: 65534, + seccompProfile: { + type: "RuntimeDefault" + } + }, + volumeMounts: [{ + mountPath: "/tmp/config", + name: "config-volume" + }] + }], + restartPolicy: "Always", + terminationGracePeriodSeconds: 30, + volumes: [{ + configMap: { + name: "kourier-bootstrap" + }, + name: "config-volume" + }] + } + } + } +}; +export const Service_Kourier: KubernetesResource = { + apiVersion: "v1", + kind: "Service", + metadata: { + labels: { + "app.kubernetes.io/component": "net-kourier", + "app.kubernetes.io/name": "knative-serving", + "app.kubernetes.io/version": "1.22.1", + "networking.knative.dev/ingress-provider": "kourier" + }, + name: "kourier", + namespace: "kourier-system" + }, + spec: { + ports: [{ + name: "http2", + port: 80, + protocol: "TCP", + targetPort: 8080 + }, { + name: "https", + port: 443, + protocol: "TCP", + targetPort: 8443 + }], + selector: { + app: "3scale-kourier-gateway" + }, + type: "LoadBalancer" + } +}; +export const Service_KourierInternal: KubernetesResource = { + apiVersion: "v1", + kind: "Service", + metadata: { + labels: { + "app.kubernetes.io/component": "net-kourier", + "app.kubernetes.io/name": "knative-serving", + "app.kubernetes.io/version": "1.22.1", + "networking.knative.dev/ingress-provider": "kourier" + }, + name: "kourier-internal", + namespace: "kourier-system" + }, + spec: { + ports: [{ + name: "http2", + port: 80, + protocol: "TCP", + targetPort: 8081 + }, { + name: "https", + port: 443, + protocol: "TCP", + targetPort: 8444 + }], + selector: { + app: "3scale-kourier-gateway" + }, + type: "ClusterIP" + } +}; +export const HorizontalPodAutoscaler_3scaleKourierGateway: KubernetesResource = { + apiVersion: "autoscaling/v2", + kind: "HorizontalPodAutoscaler", + metadata: { + labels: { + "app.kubernetes.io/component": "net-kourier", + "app.kubernetes.io/name": "knative-serving", + "app.kubernetes.io/version": "1.22.1", + "networking.knative.dev/ingress-provider": "kourier" + }, + name: "3scale-kourier-gateway", + namespace: "kourier-system" + }, + spec: { + maxReplicas: 10, + metrics: [{ + resource: { + name: "cpu", + target: { + averageUtilization: 100, + type: "Utilization" + } + }, + type: "Resource" + }], + minReplicas: 1, + scaleTargetRef: { + apiVersion: "apps/v1", + kind: "Deployment", + name: "3scale-kourier-gateway" + } + } +}; +export const PodDisruptionBudget_3scaleKourierGatewayPdb: KubernetesResource = { + apiVersion: "policy/v1", + kind: "PodDisruptionBudget", + metadata: { + labels: { + "app.kubernetes.io/component": "net-kourier", + "app.kubernetes.io/name": "knative-serving", + "app.kubernetes.io/version": "1.22.1", + "networking.knative.dev/ingress-provider": "kourier" + }, + name: "3scale-kourier-gateway-pdb", + namespace: "kourier-system" + }, + spec: { + minAvailable: "80%", + selector: { + matchLabels: { + app: "3scale-kourier-gateway" + } + } + } +}; +export const resources: ReadonlyArray = [CustomResourceDefinition_CertificatesNetworkingInternalKnativeDev, CustomResourceDefinition_ConfigurationsServingKnativeDev, CustomResourceDefinition_ClusterdomainclaimsNetworkingInternalKnativeDev, CustomResourceDefinition_DomainmappingsServingKnativeDev, CustomResourceDefinition_IngressesNetworkingInternalKnativeDev, CustomResourceDefinition_MetricsAutoscalingInternalKnativeDev, CustomResourceDefinition_PodautoscalersAutoscalingInternalKnativeDev, CustomResourceDefinition_RevisionsServingKnativeDev, CustomResourceDefinition_RoutesServingKnativeDev, CustomResourceDefinition_ServerlessservicesNetworkingInternalKnativeDev, CustomResourceDefinition_ServicesServingKnativeDev, CustomResourceDefinition_ImagesCachingInternalKnativeDev, Namespace_KnativeServing, Role_KnativeServingActivator, ClusterRole_KnativeServingActivatorCluster, ClusterRole_KnativeServingAggregatedAddressableResolver, ClusterRole_KnativeServingAddressableResolver, ClusterRole_KnativeServingNamespacedAdmin, ClusterRole_KnativeServingNamespacedEdit, ClusterRole_KnativeServingNamespacedView, ClusterRole_KnativeServingCore, ClusterRole_KnativeServingPodspecableBinding, ServiceAccount_Controller, ClusterRole_KnativeServingAdmin, ClusterRoleBinding_KnativeServingControllerAdmin, ClusterRoleBinding_KnativeServingControllerAddressableResolver, ServiceAccount_Activator, RoleBinding_KnativeServingActivator, ClusterRoleBinding_KnativeServingActivatorCluster, Certificate_RoutingServingCerts, Image_QueueProxy, ConfigMap_ConfigAutoscaler, ConfigMap_ConfigCertmanager, ConfigMap_ConfigDefaults, ConfigMap_ConfigDeployment, ConfigMap_ConfigDomain, ConfigMap_ConfigFeatures, ConfigMap_ConfigGc, ConfigMap_ConfigLeaderElection, ConfigMap_ConfigLogging, ConfigMap_ConfigNetwork, ConfigMap_ConfigObservability, ConfigMap_ConfigTracing, HorizontalPodAutoscaler_Activator, PodDisruptionBudget_ActivatorPdb, Deployment_Activator, Service_ActivatorService, Deployment_Autoscaler, Service_Autoscaler, Deployment_Controller, Service_Controller, HorizontalPodAutoscaler_Webhook, PodDisruptionBudget_WebhookPdb, Deployment_Webhook, Service_Webhook, ValidatingWebhookConfiguration_ConfigWebhookServingKnativeDev, MutatingWebhookConfiguration_WebhookServingKnativeDev, ValidatingWebhookConfiguration_ValidationWebhookServingKnativeDev, Secret_WebhookCerts, Namespace_KourierSystem, ConfigMap_KourierBootstrap, ConfigMap_ConfigKourier, ServiceAccount_NetKourier, ClusterRole_NetKourier, ClusterRoleBinding_NetKourier, Deployment_NetKourierController, Service_NetKourierController, Deployment_3scaleKourierGateway, Service_Kourier, Service_KourierInternal, HorizontalPodAutoscaler_3scaleKourierGateway, PodDisruptionBudget_3scaleKourierGatewayPdb]; +export default { + resources: resources +}; From a4ecef55e60a4725463645f0d150fb5bf474f956 Mon Sep 17 00:00:00 2001 From: Dan Lynch Date: Wed, 12 Aug 2026 16:58:29 -0700 Subject: [PATCH 09/11] fix(client): wait for CRDs to establish before applying custom resources applyAll phases CRDs first, then applies everything else -- but creating a CRD returns as soon as the object is accepted, not when the API server is serving that kind. Establishment is asynchronous, so a custom resource in a later phase can arrive before its own kind exists and fail with 'no matches for kind'. Knative is where this shows: serving-core creates Certificates and Images of kinds serving-crds defines moments earlier. Installing the same manifests by hand with an explicit between them works first time and the webhook rolls out in about fourteen seconds, which is what ruled out both of my earlier theories -- the retry budget and a cert-manager incompatibility. Neither was involved. The manifests are fine; the apply raced itself. A CRD that never establishes is reported rather than fatal, so the failure surfaces as the resource that needed it instead of an opaque wait. --- packages/client/src/apply.ts | 59 ++++++++++++++++++++++++++++++++++++ 1 file changed, 59 insertions(+) diff --git a/packages/client/src/apply.ts b/packages/client/src/apply.ts index 12f52d3..0758c8a 100644 --- a/packages/client/src/apply.ts +++ b/packages/client/src/apply.ts @@ -122,6 +122,17 @@ export class K8sApplier { // Phase 0: CRDs for (const m of parts.crds) await this.apply(m); + // Establishment is asynchronous. Creating a CRD returns as soon as the + // object is accepted, not when the API server is serving that kind — so a + // custom resource applied in a later phase can arrive before its own kind + // exists, and fails with "no matches for kind". + // + // Knative is where this shows: serving-core creates Certificates and Images + // of kinds serving-crds defines moments earlier. + if (parts.crds.length > 0) { + await this.waitForCrdsEstablished(parts.crds); + } + // Phase 1: Namespaces for (const m of parts.namespaces) await this.apply(m); @@ -502,6 +513,54 @@ export class K8sApplier { // former and timed out on the latter: Knative v1.22 ships Certificates in // serving-core.yaml that its own webhook must admit, and the apply failed // before the webhook pod was ready. + /** + * Block until every applied CRD reports Established. + * + * Polls rather than watches, to stay consistent with the other readiness + * helpers here and to avoid holding a connection open across a phase + * boundary. A CRD that never establishes is not fatal: it is reported and the + * apply continues, so the failure surfaces as the resource that needed it + * rather than as an opaque wait. + */ + private async waitForCrdsEstablished( + crds: KubernetesResource[], + timeoutMs = 120_000, + pollMs = 2_000 + ): Promise { + const names = crds + .map((c) => (c.metadata && 'name' in c.metadata ? (c.metadata as any).name : undefined)) + .filter(Boolean) as string[]; + if (names.length === 0) return; + + this.opts.log(`Waiting for ${names.length} CRD(s) to be established...`); + const start = Date.now(); + const pending = new Set(names); + + while (pending.size > 0 && Date.now() - start < timeoutMs) { + for (const name of Array.from(pending)) { + try { + const crd: any = await (this.client as any).get( + `/apis/apiextensions.k8s.io/v1/customresourcedefinitions/${name}` + ); + const established = (crd?.status?.conditions || []).some( + (c: any) => c.type === 'Established' && c.status === 'True' + ); + if (established) pending.delete(name); + } catch { + // Not readable yet; try again on the next tick. + } + } + if (pending.size === 0) break; + await new Promise((r) => setTimeout(r, pollMs)); + } + + if (pending.size > 0) { + this.opts.log( + `CRDs not established after ${Math.round((Date.now() - start) / 1000)}s: ${Array.from(pending).join(', ')}` + ); + } + } + private async postWithRetries(path: string, body: any, ref: string, maxAttempts = 12, baseDelayMs = 2_000) { let attempt = 0; let lastErr: any; From 4a19d861d14b4d96b29d61c6f043b436ac0016ee Mon Sep 17 00:00:00 2001 From: Dan Lynch Date: Wed, 12 Aug 2026 17:24:25 -0700 Subject: [PATCH 10/11] fix(client): give the webhook wait 180s under E2E, not 30s The knative e2e failed because the webhook service wait expired, not because the webhook was broken. E2E_TESTS set the timeout to 30 seconds while every other path gets 240. Thirty seconds is shorter than a cold image pull. Installing the same manifests by hand, Knative's webhook rolls out in about fourteen seconds on a warm machine -- and a CI runner fetching that image for the first time takes longer. So the wait expired, the Certificate that needs the webhook was applied regardless, and the resulting 500 read as a webhook fault rather than as a timeout that had already given up. 180s: long enough for a cold pull, still short enough that a genuinely stuck webhook does not hold a suite for four minutes. --- packages/client/src/apply.ts | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/packages/client/src/apply.ts b/packages/client/src/apply.ts index 0758c8a..51b6edc 100644 --- a/packages/client/src/apply.ts +++ b/packages/client/src/apply.ts @@ -36,8 +36,17 @@ export class K8sApplier { defaultNamespace: opts.defaultNamespace ?? 'default', continueOnError: opts.continueOnError ?? true, log: opts.log ?? (() => {}), + // E2E used to get 30s here, presumably to fail fast. That is shorter than + // a cold image pull: Knative's webhook rolls out in about fourteen + // seconds on a warm machine and comfortably longer on a CI runner + // fetching the image for the first time — so the wait expired, the + // Certificate that needs the webhook was applied anyway, and the failure + // read as a webhook problem rather than as a timeout. + // + // Still shorter than the default, so a genuinely stuck webhook does not + // hold a suite for four minutes. webhookServiceWaitTimeoutMs: - opts.webhookServiceWaitTimeoutMs ?? (process.env.E2E_TESTS === 'true' ? 30_000 : 240_000), + opts.webhookServiceWaitTimeoutMs ?? (process.env.E2E_TESTS === 'true' ? 180_000 : 240_000), }; } From 6084c8623e708f747cdde3320b2ccfea237b1c53 Mon Sep 17 00:00:00 2001 From: Dan Lynch Date: Wed, 12 Aug 2026 17:50:54 -0700 Subject: [PATCH 11/11] fix: hold Knative at v1.15.0, undo the timeout inflation Two corrections, both of my own making. The knative e2e was failing, and my response was to widen timeouts twice: the apply retries from ~34s to ~150s and the E2E webhook wait from 30s to 180s. Multiplied by an outer 3x retry that already existed, that exceeded the test's own 15-minute jest budget -- so the job went from failing in 2.3 minutes with a legible webhook error to hanging for 19 and reporting nothing. A slower failure is bad; a failure that no longer reaches a verdict is worse, and it meant my last two changes were never actually validated. Retries are back to 6/10s. The E2E webhook wait is 60s: longer than the original 30s, which was genuinely too short for a cold image pull, and short enough that the suite reports a verdict well inside its budget. Knative is held at v1.15.0. v1.22.1 is what downstream installs and is where this should land, but the bump fails the e2e in a way that does not reproduce: the same manifests, applied in the same order after cert-manager, install cleanly on a local kind cluster with the webhook up in about fourteen seconds and zero apply errors. That is a client-side apply problem worth chasing on its own, and it should not hold up the work that is actually valuable here -- pinning versions that were previously unpinned or fetched from mutable branches. Kept: the CRD establishment wait, which is a real bug fix. Creating a CRD returns before the API server serves that kind, so a custom resource in a later phase could race its own definition. --- packages/client/src/apply.ts | 46 +- .../manifests/operators/knative-serving.yaml | 1345 +++++++---------- .../{v1.22.1.yaml => v1.15.0.yaml} | 1345 +++++++---------- .../{v1.22.1 => v1.15.0}/01-serving-crds.yaml | 896 +++++------ .../{v1.22.1 => v1.15.0}/02-serving-core.yaml | 337 ++--- .../{v1.22.1 => v1.15.0}/03-kourier.yaml | 112 +- packages/manifests/scripts/pull-manifests.ts | 14 +- packages/manifests/src/generated/index.ts | 4 +- .../src/generated/knative-serving.ts | 935 +++++------- 9 files changed, 1975 insertions(+), 3059 deletions(-) rename packages/manifests/operators/knative-serving/{v1.22.1.yaml => v1.15.0.yaml} (90%) rename packages/manifests/operators/knative-serving/{v1.22.1 => v1.15.0}/01-serving-crds.yaml (91%) rename packages/manifests/operators/knative-serving/{v1.22.1 => v1.15.0}/02-serving-core.yaml (90%) rename packages/manifests/operators/knative-serving/{v1.22.1 => v1.15.0}/03-kourier.yaml (81%) diff --git a/packages/client/src/apply.ts b/packages/client/src/apply.ts index 51b6edc..649e829 100644 --- a/packages/client/src/apply.ts +++ b/packages/client/src/apply.ts @@ -36,17 +36,13 @@ export class K8sApplier { defaultNamespace: opts.defaultNamespace ?? 'default', continueOnError: opts.continueOnError ?? true, log: opts.log ?? (() => {}), - // E2E used to get 30s here, presumably to fail fast. That is shorter than - // a cold image pull: Knative's webhook rolls out in about fourteen - // seconds on a warm machine and comfortably longer on a CI runner - // fetching the image for the first time — so the wait expired, the - // Certificate that needs the webhook was applied anyway, and the failure - // read as a webhook problem rather than as a timeout. - // - // Still shorter than the default, so a genuinely stuck webhook does not - // hold a suite for four minutes. + // 60s under E2E: long enough for a cold image pull, short enough that the + // suite reports a verdict well inside its own 15-minute budget. It was + // 30s (too short for a cold pull) and briefly 180s, which combined with + // the apply retries and an outer 3x retry to exceed the jest timeout -- + // so the run stopped failing and started hanging, which is worse. webhookServiceWaitTimeoutMs: - opts.webhookServiceWaitTimeoutMs ?? (process.env.E2E_TESTS === 'true' ? 180_000 : 240_000), + opts.webhookServiceWaitTimeoutMs ?? (process.env.E2E_TESTS === 'true' ? 60_000 : 240_000), }; } @@ -512,24 +508,16 @@ export class K8sApplier { ); } - // The webhook being waited on is usually created by this same apply — a - // manifest set that contains both an admission webhook and resources it must - // admit. So the wait is not "a rolling webhook briefly unavailable", it is - // "a Deployment scheduling, pulling an image and passing its readiness - // probe", which on a cold cluster is minutes rather than seconds. - // - // The previous budget (6 attempts capped at 10s ≈ 34s) was sized for the - // former and timed out on the latter: Knative v1.22 ships Certificates in - // serving-core.yaml that its own webhook must admit, and the apply failed - // before the webhook pod was ready. /** * Block until every applied CRD reports Established. * - * Polls rather than watches, to stay consistent with the other readiness - * helpers here and to avoid holding a connection open across a phase - * boundary. A CRD that never establishes is not fatal: it is reported and the - * apply continues, so the failure surfaces as the resource that needed it - * rather than as an opaque wait. + * Creating a CRD returns as soon as the object is accepted, not when the API + * server is serving that kind — so a custom resource applied in a later phase + * can arrive before its own kind exists and fail with "no matches for kind". + * + * Not fatal if one never establishes: it is reported and the apply continues, + * so the failure surfaces as the resource that needed it rather than as an + * opaque wait. */ private async waitForCrdsEstablished( crds: KubernetesResource[], @@ -570,7 +558,7 @@ export class K8sApplier { } } - private async postWithRetries(path: string, body: any, ref: string, maxAttempts = 12, baseDelayMs = 2_000) { + private async postWithRetries(path: string, body: any, ref: string, maxAttempts = 6, baseDelayMs = 2_000) { let attempt = 0; let lastErr: any; while (attempt < maxAttempts) { @@ -579,7 +567,7 @@ export class K8sApplier { } catch (err: any) { lastErr = err; if (!this.isAdmissionWebhookTransient(err)) throw err; - const delay = Math.min(baseDelayMs * Math.pow(2, attempt), 15_000); + const delay = Math.min(baseDelayMs * Math.pow(2, attempt), 10_000); this.opts.log(`Retrying ${ref} due to webhook readiness (attempt ${attempt + 1}/${maxAttempts}) in ${delay}ms...`); await new Promise((r) => setTimeout(r, delay)); attempt++; @@ -588,7 +576,7 @@ export class K8sApplier { throw lastErr; } - private async putWithRetries(path: string, body: any, ref: string, maxAttempts = 12, baseDelayMs = 2_000) { + private async putWithRetries(path: string, body: any, ref: string, maxAttempts = 6, baseDelayMs = 2_000) { let attempt = 0; let lastErr: any; while (attempt < maxAttempts) { @@ -597,7 +585,7 @@ export class K8sApplier { } catch (err: any) { lastErr = err; if (!this.isAdmissionWebhookTransient(err)) throw err; - const delay = Math.min(baseDelayMs * Math.pow(2, attempt), 15_000); + const delay = Math.min(baseDelayMs * Math.pow(2, attempt), 10_000); this.opts.log(`Retrying update for ${ref} due to webhook readiness (attempt ${attempt + 1}/${maxAttempts}) in ${delay}ms...`); await new Promise((r) => setTimeout(r, delay)); attempt++; diff --git a/packages/manifests/operators/knative-serving.yaml b/packages/manifests/operators/knative-serving.yaml index bbe9e23..d3590c8 100644 --- a/packages/manifests/operators/knative-serving.yaml +++ b/packages/manifests/operators/knative-serving.yaml @@ -1,4 +1,4 @@ -# Source: https://github.com/knative/serving/releases/download/knative-v1.22.1/serving-crds.yaml +# Source: https://github.com/knative/serving/releases/download/knative-v1.15.0/serving-crds.yaml --- # Copyright 2020 The Knative Authors # @@ -21,7 +21,7 @@ metadata: labels: app.kubernetes.io/name: knative-serving app.kubernetes.io/component: networking - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" knative.dev/crd-install: "true" spec: group: networking.internal.knative.dev @@ -206,7 +206,7 @@ metadata: name: configurations.serving.knative.dev labels: app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" knative.dev/crd-install: "true" duck.knative.dev/podspecable: "true" spec: @@ -342,7 +342,6 @@ spec: type: array items: type: string - x-kubernetes-list-type: atomic command: description: |- Entrypoint array. Not executed within a shell. @@ -356,7 +355,6 @@ spec: type: array items: type: string - x-kubernetes-list-type: atomic env: description: |- List of environment variables to set in the container. @@ -369,9 +367,7 @@ spec: - name properties: name: - description: |- - Name of the environment variable. - May consist of any printable ASCII characters except '='. + description: Name of the environment variable. Must be a C_IDENTIFIER. type: string value: description: |- @@ -401,28 +397,23 @@ spec: name: description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string - default: "" optional: description: Specify whether the ConfigMap or its key must be defined type: boolean x-kubernetes-map-type: atomic fieldRef: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-fieldref + description: This is accessible behind a feature flag - kubernetes.podspec-fieldref type: object - x-kubernetes-map-type: atomic x-kubernetes-preserve-unknown-fields: true + x-kubernetes-map-type: atomic resourceFieldRef: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-fieldref + description: This is accessible behind a feature flag - kubernetes.podspec-fieldref type: object - x-kubernetes-map-type: atomic x-kubernetes-preserve-unknown-fields: true + x-kubernetes-map-type: atomic secretKeyRef: description: Selects a key of a secret in the pod's namespace type: object @@ -435,30 +426,24 @@ spec: name: description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string - default: "" optional: description: Specify whether the Secret or its key must be defined type: boolean x-kubernetes-map-type: atomic - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map envFrom: description: |- List of sources to populate environment variables in the container. - The keys defined within a source may consist of any printable ASCII characters except '='. - When a key exists in multiple + The keys defined within a source must be a C_IDENTIFIER. All invalid keys + will be reported as an event when the container is starting. When a key exists in multiple sources, the value associated with the last source will take precedence. Values defined by an Env with a duplicate key will take precedence. Cannot be updated. type: array items: - description: EnvFromSource represents the source of a set of ConfigMaps or Secrets + description: EnvFromSource represents the source of a set of ConfigMaps type: object properties: configMapRef: @@ -468,20 +453,15 @@ spec: name: description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string - default: "" optional: description: Specify whether the ConfigMap must be defined type: boolean x-kubernetes-map-type: atomic prefix: - description: |- - Optional text to prepend to the name of each environment variable. - May consist of any printable ASCII characters except '='. + description: An optional identifier to prepend to each key in the ConfigMap. Must be a C_IDENTIFIER. type: string secretRef: description: The Secret to select from @@ -490,17 +470,13 @@ spec: name: description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string - default: "" optional: description: Specify whether the Secret must be defined type: boolean x-kubernetes-map-type: atomic - x-kubernetes-list-type: atomic image: description: |- Container image name. @@ -525,7 +501,7 @@ spec: type: object properties: exec: - description: Exec specifies a command to execute in the container. + description: Exec specifies the action to take. type: object properties: command: @@ -538,7 +514,6 @@ spec: type: array items: type: string - x-kubernetes-list-type: atomic failureThreshold: description: |- Minimum consecutive failures for the probe to be considered failed after having succeeded. @@ -546,8 +521,10 @@ spec: type: integer format: int32 grpc: - description: GRPC specifies a GRPC HealthCheckRequest. + description: GRPC specifies an action involving a GRPC port. type: object + required: + - port properties: port: description: Port number of the gRPC service. Number must be in the range 1 to 65535. @@ -558,11 +535,11 @@ spec: Service is the name of the service to place in the gRPC HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + If this is not specified, the default behavior is defined by gRPC. type: string - default: "" httpGet: - description: HTTPGet specifies an HTTP GET request to perform. + description: HTTPGet specifies the http request to perform. type: object properties: host: @@ -588,7 +565,6 @@ spec: value: description: The header field value type: string - x-kubernetes-list-type: atomic path: description: Path to access on the HTTP server. type: string @@ -613,8 +589,7 @@ spec: type: integer format: int32 periodSeconds: - description: |- - How often (in seconds) to perform the probe. + description: How often (in seconds) to perform the probe. type: integer format: int32 successThreshold: @@ -624,7 +599,7 @@ spec: type: integer format: int32 tcpSocket: - description: TCPSocket specifies a connection to a TCP port. + description: TCPSocket specifies an action involving a TCP port. type: object properties: host: @@ -665,6 +640,8 @@ spec: items: description: ContainerPort represents a network port in a single container. type: object + required: + - containerPort properties: containerPort: description: |- @@ -684,6 +661,10 @@ spec: Defaults to "TCP". type: string default: TCP + x-kubernetes-list-map-keys: + - containerPort + - protocol + x-kubernetes-list-type: map readinessProbe: description: |- Periodic probe of container service readiness. @@ -693,7 +674,7 @@ spec: type: object properties: exec: - description: Exec specifies a command to execute in the container. + description: Exec specifies the action to take. type: object properties: command: @@ -706,7 +687,6 @@ spec: type: array items: type: string - x-kubernetes-list-type: atomic failureThreshold: description: |- Minimum consecutive failures for the probe to be considered failed after having succeeded. @@ -714,8 +694,10 @@ spec: type: integer format: int32 grpc: - description: GRPC specifies a GRPC HealthCheckRequest. + description: GRPC specifies an action involving a GRPC port. type: object + required: + - port properties: port: description: Port number of the gRPC service. Number must be in the range 1 to 65535. @@ -726,11 +708,11 @@ spec: Service is the name of the service to place in the gRPC HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + If this is not specified, the default behavior is defined by gRPC. type: string - default: "" httpGet: - description: HTTPGet specifies an HTTP GET request to perform. + description: HTTPGet specifies the http request to perform. type: object properties: host: @@ -756,7 +738,6 @@ spec: value: description: The header field value type: string - x-kubernetes-list-type: atomic path: description: Path to access on the HTTP server. type: string @@ -781,8 +762,7 @@ spec: type: integer format: int32 periodSeconds: - description: |- - How often (in seconds) to perform the probe. + description: How often (in seconds) to perform the probe. type: integer format: int32 successThreshold: @@ -792,7 +772,7 @@ spec: type: integer format: int32 tcpSocket: - description: TCPSocket specifies a connection to a TCP port. + description: TCPSocket specifies an action involving a TCP port. type: object properties: host: @@ -821,6 +801,33 @@ spec: More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ type: object properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + + This field is immutable. It can only be set for containers. + type: array + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + type: object + required: + - name + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map limits: description: |- Limits describes the maximum amount of compute resources allowed. @@ -875,18 +882,12 @@ spec: items: description: Capability represent POSIX capabilities type type: string - x-kubernetes-list-type: atomic drop: description: Removed capabilities type: array items: description: Capability represent POSIX capabilities type type: string - x-kubernetes-list-type: atomic - privileged: - description: |- - Run container in privileged mode. This can only be set to explicitly to 'false' - type: boolean readOnlyRootFilesystem: description: |- Whether this container has a read-only root filesystem. @@ -942,6 +943,7 @@ spec: type indicates which kind of seccomp profile will be applied. Valid options are: + Localhost - a profile defined in a file on the node should be used. RuntimeDefault - the container runtime default profile should be used. Unconfined - no profile should be applied. @@ -958,7 +960,7 @@ spec: type: object properties: exec: - description: Exec specifies a command to execute in the container. + description: Exec specifies the action to take. type: object properties: command: @@ -971,7 +973,6 @@ spec: type: array items: type: string - x-kubernetes-list-type: atomic failureThreshold: description: |- Minimum consecutive failures for the probe to be considered failed after having succeeded. @@ -979,8 +980,10 @@ spec: type: integer format: int32 grpc: - description: GRPC specifies a GRPC HealthCheckRequest. + description: GRPC specifies an action involving a GRPC port. type: object + required: + - port properties: port: description: Port number of the gRPC service. Number must be in the range 1 to 65535. @@ -991,11 +994,11 @@ spec: Service is the name of the service to place in the gRPC HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + If this is not specified, the default behavior is defined by gRPC. type: string - default: "" httpGet: - description: HTTPGet specifies an HTTP GET request to perform. + description: HTTPGet specifies the http request to perform. type: object properties: host: @@ -1021,7 +1024,6 @@ spec: value: description: The header field value type: string - x-kubernetes-list-type: atomic path: description: Path to access on the HTTP server. type: string @@ -1046,8 +1048,7 @@ spec: type: integer format: int32 periodSeconds: - description: |- - How often (in seconds) to perform the probe. + description: How often (in seconds) to perform the probe. type: integer format: int32 successThreshold: @@ -1057,7 +1058,7 @@ spec: type: integer format: int32 tcpSocket: - description: TCPSocket specifies a connection to a TCP port. + description: TCPSocket specifies an action involving a TCP port. type: object properties: host: @@ -1116,10 +1117,6 @@ spec: Path within the container at which the volume should be mounted. Must not contain ':'. type: string - mountPropagation: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-volumes-mount-propagation - type: string name: description: This must match the Name of a Volume. type: string @@ -1133,9 +1130,6 @@ spec: Path within the volume from which the container's volume should be mounted. Defaults to "" (volume's root). type: string - x-kubernetes-list-map-keys: - - mountPath - x-kubernetes-list-type: map workingDir: description: |- Container's working directory. @@ -1144,39 +1138,22 @@ spec: Cannot be updated. type: string dnsConfig: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-dnsconfig + description: This is accessible behind a feature flag - kubernetes.podspec-dnsconfig type: object x-kubernetes-preserve-unknown-fields: true dnsPolicy: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-dnspolicy + description: This is accessible behind a feature flag - kubernetes.podspec-dnspolicy type: string enableServiceLinks: - description: |- - EnableServiceLinks indicates whether information aboutservices should be injected into pod's environment variables, matching the syntax of Docker links. Optional: Knative defaults this to false. + description: 'EnableServiceLinks indicates whether information about services should be injected into pod''s environment variables, matching the syntax of Docker links. Optional: Knative defaults this to false.' type: boolean hostAliases: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-hostaliases + description: This is accessible behind a feature flag - kubernetes.podspec-hostaliases type: array items: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-hostaliases + description: This is accessible behind a feature flag - kubernetes.podspec-hostaliases type: object x-kubernetes-preserve-unknown-fields: true - hostIPC: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-hostipc - type: boolean - hostNetwork: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-hostnetwork - type: boolean - hostPID: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-hostpid - type: boolean idleTimeoutSeconds: description: |- IdleTimeoutSeconds is the maximum duration in seconds a request will be allowed @@ -1199,35 +1176,39 @@ spec: name: description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string - default: "" x-kubernetes-map-type: atomic - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map initContainers: description: |- - This is accessible behind a feature flag - kubernetes.podspec-init-containers + List of initialization containers belonging to the pod. + Init containers are executed in order prior to containers being started. If any + init container fails, the pod is considered to have failed and is handled according + to its restartPolicy. The name for an init container or normal container must be + unique among all containers. + Init containers may not have Lifecycle actions, Readiness probes, Liveness probes, or Startup probes. + The resourceRequirements of an init container are taken into account during scheduling + by finding the highest request/limit for each resource type, and then using the max of + of that value or the sum of the normal containers. Limits are applied to init containers + in a similar fashion. + Init containers cannot currently be added or removed. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/ type: array items: description: This is accessible behind a feature flag - kubernetes.podspec-init-containers type: object x-kubernetes-preserve-unknown-fields: true nodeSelector: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-nodeselector + description: This is accessible behind a feature flag - kubernetes.podspec-nodeselector type: object - additionalProperties: - type: string + x-kubernetes-preserve-unknown-fields: true x-kubernetes-map-type: atomic priorityClassName: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-priorityclassname + description: This is accessible behind a feature flag - kubernetes.podspec-priorityclassname type: string + x-kubernetes-preserve-unknown-fields: true responseStartTimeoutSeconds: description: |- ResponseStartTimeoutSeconds is the maximum duration in seconds that the request @@ -1236,16 +1217,15 @@ spec: type: integer format: int64 runtimeClassName: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-runtimeclassname + description: This is accessible behind a feature flag - kubernetes.podspec-runtimeclassname type: string + x-kubernetes-preserve-unknown-fields: true schedulerName: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-schedulername + description: This is accessible behind a feature flag - kubernetes.podspec-schedulername type: string + x-kubernetes-preserve-unknown-fields: true securityContext: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-securitycontext + description: This is accessible behind a feature flag - kubernetes.podspec-securitycontext type: object x-kubernetes-preserve-unknown-fields: true serviceAccountName: @@ -1254,9 +1234,9 @@ spec: More info: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/ type: string shareProcessNamespace: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-shareprocessnamespace + description: This is accessible behind a feature flag - kubernetes.podspec-shareproccessnamespace type: boolean + x-kubernetes-preserve-unknown-fields: true timeoutSeconds: description: |- TimeoutSeconds is the maximum duration in seconds that the request instance @@ -1268,13 +1248,11 @@ spec: description: This is accessible behind a feature flag - kubernetes.podspec-tolerations type: array items: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-tolerations + description: This is accessible behind a feature flag - kubernetes.podspec-tolerations type: object x-kubernetes-preserve-unknown-fields: true topologySpreadConstraints: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints + description: This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints type: array items: description: This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints @@ -1343,37 +1321,18 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string - x-kubernetes-list-type: atomic name: description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string - default: "" optional: description: optional specify whether the ConfigMap or its keys must be defined type: boolean x-kubernetes-map-type: atomic - csi: - description: This is accessible behind a feature flag - kubernetes.podspec-volumes-csi - type: object - x-kubernetes-preserve-unknown-fields: true emptyDir: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-volumes-emptydir - type: object - x-kubernetes-preserve-unknown-fields: true - hostPath: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-volumes-hostpath - type: object - x-kubernetes-preserve-unknown-fields: true - image: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-volumes-image + description: This is accessible behind a feature flag - kubernetes.podspec-emptydir type: object x-kubernetes-preserve-unknown-fields: true name: @@ -1383,8 +1342,7 @@ spec: More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string persistentVolumeClaim: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-persistent-volume-claim + description: This is accessible behind a feature flag - kubernetes.podspec-persistent-volume-claim type: object x-kubernetes-preserve-unknown-fields: true projected: @@ -1402,14 +1360,10 @@ spec: type: integer format: int32 sources: - description: |- - sources is the list of volume projections. Each entry in this list - handles one source. + description: sources is the list of volume projections type: array items: - description: |- - Projection that may be projected along with other supported volume types. - Exactly one of these fields must be set. + description: Projection that may be projected along with other supported volume types type: object properties: configMap: @@ -1453,16 +1407,12 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string - x-kubernetes-list-type: atomic name: description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string - default: "" optional: description: optional specify whether the ConfigMap or its keys must be defined type: boolean @@ -1481,7 +1431,7 @@ spec: - path properties: fieldRef: - description: 'Required: Selects a field of the pod: only annotations, labels, name, namespace and uid are supported.' + description: 'Required: Selects a field of the pod: only annotations, labels, name and namespace are supported.' type: object required: - fieldPath @@ -1528,7 +1478,6 @@ spec: description: 'Required: resource to select' type: string x-kubernetes-map-type: atomic - x-kubernetes-list-type: atomic secret: description: secret information about the secret data to project type: object @@ -1570,16 +1519,12 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string - x-kubernetes-list-type: atomic name: description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string - default: "" optional: description: optional field specify whether the Secret or its key must be defined type: boolean @@ -1612,7 +1557,6 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string - x-kubernetes-list-type: atomic secret: description: |- secret represents a secret that should populate this volume. @@ -1667,7 +1611,6 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string - x-kubernetes-list-type: atomic optional: description: optional field specify whether the Secret or its keys must be defined type: boolean @@ -1676,9 +1619,6 @@ spec: secretName is the name of the secret in the pod's namespace to use. More info: https://kubernetes.io/docs/concepts/storage/volumes#secret type: string - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map status: description: ConfigurationStatus communicates the observed state of the Configuration (from the controller). type: object @@ -1765,7 +1705,7 @@ metadata: labels: app.kubernetes.io/name: knative-serving app.kubernetes.io/component: networking - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" knative.dev/crd-install: "true" spec: group: networking.internal.knative.dev @@ -1841,7 +1781,7 @@ metadata: name: domainmappings.serving.knative.dev labels: app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" knative.dev/crd-install: "true" spec: group: serving.knative.dev @@ -1895,11 +1835,13 @@ spec: description: |- Ref specifies the target of the Domain Mapping. + The object identified by the Ref must be an Addressable with a URL of the form `{name}.{namespace}.{domain}` where `{domain}` is the cluster domain, and `{name}` and `{namespace}` are the name and namespace of a Kubernetes Service. + This contract is satisfied by Knative types such as Knative Services and Knative Routes, and by Kubernetes Services. type: object @@ -2052,7 +1994,7 @@ metadata: labels: app.kubernetes.io/name: knative-serving app.kubernetes.io/component: networking - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" knative.dev/crd-install: "true" spec: group: networking.internal.knative.dev @@ -2069,6 +2011,7 @@ spec: by a backend. An Ingress can be configured to give services externally-reachable URLs, load balance traffic, offer name based virtual hosting, etc. + This is heavily based on K8s Ingress https://godoc.org/k8s.io/api/networking/v1beta1#Ingress which some highlighted modifications. type: object @@ -2140,6 +2083,7 @@ spec: description: |- A collection of paths that map requests to backends. + If they are multiple matching paths, the first match takes precedence. type: array items: @@ -2155,6 +2099,7 @@ spec: AppendHeaders allow specifying additional HTTP headers to add before forwarding a request to the destination service. + NOTE: This differs from K8s Ingress which doesn't allow header appending. type: object additionalProperties: @@ -2189,6 +2134,7 @@ spec: description: |- RewriteHost rewrites the incoming request's host header. + This field is currently experimental and not supported by all Ingress implementations. type: string @@ -2210,6 +2156,7 @@ spec: AppendHeaders allow specifying additional HTTP headers to add before forwarding a request to the destination service. + NOTE: This differs from K8s Ingress which doesn't allow header appending. type: object additionalProperties: @@ -2219,6 +2166,7 @@ spec: Specifies the split percentage, a number between 0 and 100. If only one split is specified, we default to 100. + NOTE: This differs from K8s Ingress to allow percentage split. type: integer serviceName: @@ -2228,6 +2176,7 @@ spec: description: |- Specifies the namespace of the referenced service. + NOTE: This differs from K8s Ingress to allow routing to different namespaces. type: string servicePort: @@ -2352,6 +2301,7 @@ spec: description: |- DomainInternal is set if there is a cluster-local DNS name to access the Ingress. + NOTE: This differs from K8s Ingress, since we also desire to have a cluster-local DNS name to allow routing in case of not having a mesh. type: string @@ -2387,6 +2337,7 @@ spec: description: |- DomainInternal is set if there is a cluster-local DNS name to access the Ingress. + NOTE: This differs from K8s Ingress, since we also desire to have a cluster-local DNS name to allow routing in case of not having a mesh. type: string @@ -2439,7 +2390,7 @@ metadata: name: metrics.autoscaling.internal.knative.dev labels: app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" knative.dev/crd-install: "true" spec: group: autoscaling.internal.knative.dev @@ -2582,7 +2533,7 @@ metadata: name: podautoscalers.autoscaling.internal.knative.dev labels: app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" knative.dev/crd-install: "true" spec: group: autoscaling.internal.knative.dev @@ -2782,7 +2733,7 @@ metadata: name: revisions.serving.knative.dev labels: app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" knative.dev/crd-install: "true" spec: group: serving.knative.dev @@ -2829,6 +2780,7 @@ spec: references a container image. Revisions are created by updates to a Configuration. + See also: https://github.com/knative/serving/blob/main/docs/spec/overview.md#revision type: object properties: @@ -2894,7 +2846,6 @@ spec: type: array items: type: string - x-kubernetes-list-type: atomic command: description: |- Entrypoint array. Not executed within a shell. @@ -2908,7 +2859,6 @@ spec: type: array items: type: string - x-kubernetes-list-type: atomic env: description: |- List of environment variables to set in the container. @@ -2921,9 +2871,7 @@ spec: - name properties: name: - description: |- - Name of the environment variable. - May consist of any printable ASCII characters except '='. + description: Name of the environment variable. Must be a C_IDENTIFIER. type: string value: description: |- @@ -2953,28 +2901,23 @@ spec: name: description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string - default: "" optional: description: Specify whether the ConfigMap or its key must be defined type: boolean x-kubernetes-map-type: atomic fieldRef: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-fieldref + description: This is accessible behind a feature flag - kubernetes.podspec-fieldref type: object - x-kubernetes-map-type: atomic x-kubernetes-preserve-unknown-fields: true + x-kubernetes-map-type: atomic resourceFieldRef: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-fieldref + description: This is accessible behind a feature flag - kubernetes.podspec-fieldref type: object - x-kubernetes-map-type: atomic x-kubernetes-preserve-unknown-fields: true + x-kubernetes-map-type: atomic secretKeyRef: description: Selects a key of a secret in the pod's namespace type: object @@ -2987,30 +2930,24 @@ spec: name: description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string - default: "" optional: description: Specify whether the Secret or its key must be defined type: boolean x-kubernetes-map-type: atomic - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map envFrom: description: |- List of sources to populate environment variables in the container. - The keys defined within a source may consist of any printable ASCII characters except '='. - When a key exists in multiple + The keys defined within a source must be a C_IDENTIFIER. All invalid keys + will be reported as an event when the container is starting. When a key exists in multiple sources, the value associated with the last source will take precedence. Values defined by an Env with a duplicate key will take precedence. Cannot be updated. type: array items: - description: EnvFromSource represents the source of a set of ConfigMaps or Secrets + description: EnvFromSource represents the source of a set of ConfigMaps type: object properties: configMapRef: @@ -3020,20 +2957,15 @@ spec: name: description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string - default: "" optional: description: Specify whether the ConfigMap must be defined type: boolean x-kubernetes-map-type: atomic prefix: - description: |- - Optional text to prepend to the name of each environment variable. - May consist of any printable ASCII characters except '='. + description: An optional identifier to prepend to each key in the ConfigMap. Must be a C_IDENTIFIER. type: string secretRef: description: The Secret to select from @@ -3042,17 +2974,13 @@ spec: name: description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string - default: "" optional: description: Specify whether the Secret must be defined type: boolean x-kubernetes-map-type: atomic - x-kubernetes-list-type: atomic image: description: |- Container image name. @@ -3077,7 +3005,7 @@ spec: type: object properties: exec: - description: Exec specifies a command to execute in the container. + description: Exec specifies the action to take. type: object properties: command: @@ -3090,7 +3018,6 @@ spec: type: array items: type: string - x-kubernetes-list-type: atomic failureThreshold: description: |- Minimum consecutive failures for the probe to be considered failed after having succeeded. @@ -3098,8 +3025,10 @@ spec: type: integer format: int32 grpc: - description: GRPC specifies a GRPC HealthCheckRequest. + description: GRPC specifies an action involving a GRPC port. type: object + required: + - port properties: port: description: Port number of the gRPC service. Number must be in the range 1 to 65535. @@ -3110,11 +3039,11 @@ spec: Service is the name of the service to place in the gRPC HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + If this is not specified, the default behavior is defined by gRPC. type: string - default: "" httpGet: - description: HTTPGet specifies an HTTP GET request to perform. + description: HTTPGet specifies the http request to perform. type: object properties: host: @@ -3140,7 +3069,6 @@ spec: value: description: The header field value type: string - x-kubernetes-list-type: atomic path: description: Path to access on the HTTP server. type: string @@ -3165,8 +3093,7 @@ spec: type: integer format: int32 periodSeconds: - description: |- - How often (in seconds) to perform the probe. + description: How often (in seconds) to perform the probe. type: integer format: int32 successThreshold: @@ -3176,7 +3103,7 @@ spec: type: integer format: int32 tcpSocket: - description: TCPSocket specifies a connection to a TCP port. + description: TCPSocket specifies an action involving a TCP port. type: object properties: host: @@ -3217,6 +3144,8 @@ spec: items: description: ContainerPort represents a network port in a single container. type: object + required: + - containerPort properties: containerPort: description: |- @@ -3236,6 +3165,10 @@ spec: Defaults to "TCP". type: string default: TCP + x-kubernetes-list-map-keys: + - containerPort + - protocol + x-kubernetes-list-type: map readinessProbe: description: |- Periodic probe of container service readiness. @@ -3245,7 +3178,7 @@ spec: type: object properties: exec: - description: Exec specifies a command to execute in the container. + description: Exec specifies the action to take. type: object properties: command: @@ -3258,7 +3191,6 @@ spec: type: array items: type: string - x-kubernetes-list-type: atomic failureThreshold: description: |- Minimum consecutive failures for the probe to be considered failed after having succeeded. @@ -3266,8 +3198,10 @@ spec: type: integer format: int32 grpc: - description: GRPC specifies a GRPC HealthCheckRequest. + description: GRPC specifies an action involving a GRPC port. type: object + required: + - port properties: port: description: Port number of the gRPC service. Number must be in the range 1 to 65535. @@ -3278,11 +3212,11 @@ spec: Service is the name of the service to place in the gRPC HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + If this is not specified, the default behavior is defined by gRPC. type: string - default: "" httpGet: - description: HTTPGet specifies an HTTP GET request to perform. + description: HTTPGet specifies the http request to perform. type: object properties: host: @@ -3308,7 +3242,6 @@ spec: value: description: The header field value type: string - x-kubernetes-list-type: atomic path: description: Path to access on the HTTP server. type: string @@ -3333,8 +3266,7 @@ spec: type: integer format: int32 periodSeconds: - description: |- - How often (in seconds) to perform the probe. + description: How often (in seconds) to perform the probe. type: integer format: int32 successThreshold: @@ -3344,7 +3276,7 @@ spec: type: integer format: int32 tcpSocket: - description: TCPSocket specifies a connection to a TCP port. + description: TCPSocket specifies an action involving a TCP port. type: object properties: host: @@ -3373,6 +3305,33 @@ spec: More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ type: object properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + + This field is immutable. It can only be set for containers. + type: array + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + type: object + required: + - name + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map limits: description: |- Limits describes the maximum amount of compute resources allowed. @@ -3427,18 +3386,12 @@ spec: items: description: Capability represent POSIX capabilities type type: string - x-kubernetes-list-type: atomic drop: description: Removed capabilities type: array items: description: Capability represent POSIX capabilities type type: string - x-kubernetes-list-type: atomic - privileged: - description: |- - Run container in privileged mode. This can only be set to explicitly to 'false' - type: boolean readOnlyRootFilesystem: description: |- Whether this container has a read-only root filesystem. @@ -3494,6 +3447,7 @@ spec: type indicates which kind of seccomp profile will be applied. Valid options are: + Localhost - a profile defined in a file on the node should be used. RuntimeDefault - the container runtime default profile should be used. Unconfined - no profile should be applied. @@ -3510,7 +3464,7 @@ spec: type: object properties: exec: - description: Exec specifies a command to execute in the container. + description: Exec specifies the action to take. type: object properties: command: @@ -3523,7 +3477,6 @@ spec: type: array items: type: string - x-kubernetes-list-type: atomic failureThreshold: description: |- Minimum consecutive failures for the probe to be considered failed after having succeeded. @@ -3531,8 +3484,10 @@ spec: type: integer format: int32 grpc: - description: GRPC specifies a GRPC HealthCheckRequest. + description: GRPC specifies an action involving a GRPC port. type: object + required: + - port properties: port: description: Port number of the gRPC service. Number must be in the range 1 to 65535. @@ -3543,11 +3498,11 @@ spec: Service is the name of the service to place in the gRPC HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + If this is not specified, the default behavior is defined by gRPC. type: string - default: "" httpGet: - description: HTTPGet specifies an HTTP GET request to perform. + description: HTTPGet specifies the http request to perform. type: object properties: host: @@ -3573,7 +3528,6 @@ spec: value: description: The header field value type: string - x-kubernetes-list-type: atomic path: description: Path to access on the HTTP server. type: string @@ -3598,8 +3552,7 @@ spec: type: integer format: int32 periodSeconds: - description: |- - How often (in seconds) to perform the probe. + description: How often (in seconds) to perform the probe. type: integer format: int32 successThreshold: @@ -3609,7 +3562,7 @@ spec: type: integer format: int32 tcpSocket: - description: TCPSocket specifies a connection to a TCP port. + description: TCPSocket specifies an action involving a TCP port. type: object properties: host: @@ -3668,10 +3621,6 @@ spec: Path within the container at which the volume should be mounted. Must not contain ':'. type: string - mountPropagation: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-volumes-mount-propagation - type: string name: description: This must match the Name of a Volume. type: string @@ -3685,9 +3634,6 @@ spec: Path within the volume from which the container's volume should be mounted. Defaults to "" (volume's root). type: string - x-kubernetes-list-map-keys: - - mountPath - x-kubernetes-list-type: map workingDir: description: |- Container's working directory. @@ -3696,39 +3642,22 @@ spec: Cannot be updated. type: string dnsConfig: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-dnsconfig + description: This is accessible behind a feature flag - kubernetes.podspec-dnsconfig type: object x-kubernetes-preserve-unknown-fields: true dnsPolicy: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-dnspolicy + description: This is accessible behind a feature flag - kubernetes.podspec-dnspolicy type: string enableServiceLinks: - description: |- - EnableServiceLinks indicates whether information aboutservices should be injected into pod's environment variables, matching the syntax of Docker links. Optional: Knative defaults this to false. + description: 'EnableServiceLinks indicates whether information about services should be injected into pod''s environment variables, matching the syntax of Docker links. Optional: Knative defaults this to false.' type: boolean hostAliases: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-hostaliases + description: This is accessible behind a feature flag - kubernetes.podspec-hostaliases type: array items: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-hostaliases + description: This is accessible behind a feature flag - kubernetes.podspec-hostaliases type: object x-kubernetes-preserve-unknown-fields: true - hostIPC: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-hostipc - type: boolean - hostNetwork: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-hostnetwork - type: boolean - hostPID: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-hostpid - type: boolean idleTimeoutSeconds: description: |- IdleTimeoutSeconds is the maximum duration in seconds a request will be allowed @@ -3751,35 +3680,39 @@ spec: name: description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string - default: "" x-kubernetes-map-type: atomic - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map initContainers: description: |- - This is accessible behind a feature flag - kubernetes.podspec-init-containers + List of initialization containers belonging to the pod. + Init containers are executed in order prior to containers being started. If any + init container fails, the pod is considered to have failed and is handled according + to its restartPolicy. The name for an init container or normal container must be + unique among all containers. + Init containers may not have Lifecycle actions, Readiness probes, Liveness probes, or Startup probes. + The resourceRequirements of an init container are taken into account during scheduling + by finding the highest request/limit for each resource type, and then using the max of + of that value or the sum of the normal containers. Limits are applied to init containers + in a similar fashion. + Init containers cannot currently be added or removed. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/ type: array items: description: This is accessible behind a feature flag - kubernetes.podspec-init-containers type: object x-kubernetes-preserve-unknown-fields: true nodeSelector: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-nodeselector + description: This is accessible behind a feature flag - kubernetes.podspec-nodeselector type: object - additionalProperties: - type: string + x-kubernetes-preserve-unknown-fields: true x-kubernetes-map-type: atomic priorityClassName: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-priorityclassname + description: This is accessible behind a feature flag - kubernetes.podspec-priorityclassname type: string + x-kubernetes-preserve-unknown-fields: true responseStartTimeoutSeconds: description: |- ResponseStartTimeoutSeconds is the maximum duration in seconds that the request @@ -3788,16 +3721,15 @@ spec: type: integer format: int64 runtimeClassName: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-runtimeclassname + description: This is accessible behind a feature flag - kubernetes.podspec-runtimeclassname type: string + x-kubernetes-preserve-unknown-fields: true schedulerName: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-schedulername + description: This is accessible behind a feature flag - kubernetes.podspec-schedulername type: string + x-kubernetes-preserve-unknown-fields: true securityContext: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-securitycontext + description: This is accessible behind a feature flag - kubernetes.podspec-securitycontext type: object x-kubernetes-preserve-unknown-fields: true serviceAccountName: @@ -3806,9 +3738,9 @@ spec: More info: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/ type: string shareProcessNamespace: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-shareprocessnamespace + description: This is accessible behind a feature flag - kubernetes.podspec-shareproccessnamespace type: boolean + x-kubernetes-preserve-unknown-fields: true timeoutSeconds: description: |- TimeoutSeconds is the maximum duration in seconds that the request instance @@ -3820,13 +3752,11 @@ spec: description: This is accessible behind a feature flag - kubernetes.podspec-tolerations type: array items: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-tolerations + description: This is accessible behind a feature flag - kubernetes.podspec-tolerations type: object x-kubernetes-preserve-unknown-fields: true topologySpreadConstraints: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints + description: This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints type: array items: description: This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints @@ -3895,37 +3825,18 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string - x-kubernetes-list-type: atomic name: description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string - default: "" optional: description: optional specify whether the ConfigMap or its keys must be defined type: boolean x-kubernetes-map-type: atomic - csi: - description: This is accessible behind a feature flag - kubernetes.podspec-volumes-csi - type: object - x-kubernetes-preserve-unknown-fields: true emptyDir: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-volumes-emptydir - type: object - x-kubernetes-preserve-unknown-fields: true - hostPath: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-volumes-hostpath - type: object - x-kubernetes-preserve-unknown-fields: true - image: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-volumes-image + description: This is accessible behind a feature flag - kubernetes.podspec-emptydir type: object x-kubernetes-preserve-unknown-fields: true name: @@ -3935,8 +3846,7 @@ spec: More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string persistentVolumeClaim: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-persistent-volume-claim + description: This is accessible behind a feature flag - kubernetes.podspec-persistent-volume-claim type: object x-kubernetes-preserve-unknown-fields: true projected: @@ -3954,14 +3864,10 @@ spec: type: integer format: int32 sources: - description: |- - sources is the list of volume projections. Each entry in this list - handles one source. + description: sources is the list of volume projections type: array items: - description: |- - Projection that may be projected along with other supported volume types. - Exactly one of these fields must be set. + description: Projection that may be projected along with other supported volume types type: object properties: configMap: @@ -4005,16 +3911,12 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string - x-kubernetes-list-type: atomic name: description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string - default: "" optional: description: optional specify whether the ConfigMap or its keys must be defined type: boolean @@ -4033,7 +3935,7 @@ spec: - path properties: fieldRef: - description: 'Required: Selects a field of the pod: only annotations, labels, name, namespace and uid are supported.' + description: 'Required: Selects a field of the pod: only annotations, labels, name and namespace are supported.' type: object required: - fieldPath @@ -4080,7 +3982,6 @@ spec: description: 'Required: resource to select' type: string x-kubernetes-map-type: atomic - x-kubernetes-list-type: atomic secret: description: secret information about the secret data to project type: object @@ -4122,16 +4023,12 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string - x-kubernetes-list-type: atomic name: description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string - default: "" optional: description: optional field specify whether the Secret or its key must be defined type: boolean @@ -4164,7 +4061,6 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string - x-kubernetes-list-type: atomic secret: description: |- secret represents a secret that should populate this volume. @@ -4219,7 +4115,6 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string - x-kubernetes-list-type: atomic optional: description: optional field specify whether the Secret or its keys must be defined type: boolean @@ -4228,9 +4123,6 @@ spec: secretName is the name of the secret in the pod's namespace to use. More info: https://kubernetes.io/docs/concepts/storage/volumes#secret type: string - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map status: description: RevisionStatus communicates the observed state of the Revision (from the controller). type: object @@ -4290,7 +4182,7 @@ spec: The digests are resolved during the creation of Revision. ContainerStatuses holds the container name and image digests for both serving and non serving containers. - ref: https://bit.ly/image-digests + ref: http://bit.ly/image-digests type: array items: description: ContainerStatus holds the information of container name and image digest value @@ -4311,7 +4203,7 @@ spec: The digests are resolved during the creation of Revision. ContainerStatuses holds the container name and image digests for both serving and non serving containers. - ref: https://bit.ly/image-digests + ref: http://bit.ly/image-digests type: array items: description: ContainerStatus holds the information of container name and image digest value @@ -4355,7 +4247,7 @@ metadata: name: routes.serving.knative.dev labels: app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" knative.dev/crd-install: "true" duck.knative.dev/addressable: "true" spec: @@ -4625,7 +4517,7 @@ metadata: labels: app.kubernetes.io/name: knative-serving app.kubernetes.io/component: networking - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" knative.dev/crd-install: "true" spec: group: networking.internal.knative.dev @@ -4698,6 +4590,7 @@ spec: the event) or if no container name is specified "spec.containers[2]" (container with index 2 in this pod). This syntax is chosen only to have some well-defined way of referencing a part of an object. + TODO: this design is not final and this field is subject to change in the future. type: string kind: description: |- @@ -4848,7 +4741,7 @@ metadata: name: services.serving.knative.dev labels: app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" knative.dev/crd-install: "true" duck.knative.dev/addressable: "true" duck.knative.dev/podspecable: "true" @@ -4899,9 +4792,11 @@ spec: underlying Routes and Configurations (much as a kubernetes Deployment orchestrates ReplicaSets), and its usage is optional but recommended. + The Service's controller will track the statuses of its owned Configuration and Route, reflecting their statuses and conditions as its own. + See also: https://github.com/knative/serving/blob/main/docs/spec/overview.md#service type: object properties: @@ -5002,7 +4897,6 @@ spec: type: array items: type: string - x-kubernetes-list-type: atomic command: description: |- Entrypoint array. Not executed within a shell. @@ -5016,7 +4910,6 @@ spec: type: array items: type: string - x-kubernetes-list-type: atomic env: description: |- List of environment variables to set in the container. @@ -5029,9 +4922,7 @@ spec: - name properties: name: - description: |- - Name of the environment variable. - May consist of any printable ASCII characters except '='. + description: Name of the environment variable. Must be a C_IDENTIFIER. type: string value: description: |- @@ -5061,28 +4952,23 @@ spec: name: description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string - default: "" optional: description: Specify whether the ConfigMap or its key must be defined type: boolean x-kubernetes-map-type: atomic fieldRef: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-fieldref + description: This is accessible behind a feature flag - kubernetes.podspec-fieldref type: object - x-kubernetes-map-type: atomic x-kubernetes-preserve-unknown-fields: true + x-kubernetes-map-type: atomic resourceFieldRef: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-fieldref + description: This is accessible behind a feature flag - kubernetes.podspec-fieldref type: object - x-kubernetes-map-type: atomic x-kubernetes-preserve-unknown-fields: true + x-kubernetes-map-type: atomic secretKeyRef: description: Selects a key of a secret in the pod's namespace type: object @@ -5095,30 +4981,24 @@ spec: name: description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string - default: "" optional: description: Specify whether the Secret or its key must be defined type: boolean x-kubernetes-map-type: atomic - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map envFrom: description: |- List of sources to populate environment variables in the container. - The keys defined within a source may consist of any printable ASCII characters except '='. - When a key exists in multiple + The keys defined within a source must be a C_IDENTIFIER. All invalid keys + will be reported as an event when the container is starting. When a key exists in multiple sources, the value associated with the last source will take precedence. Values defined by an Env with a duplicate key will take precedence. Cannot be updated. type: array items: - description: EnvFromSource represents the source of a set of ConfigMaps or Secrets + description: EnvFromSource represents the source of a set of ConfigMaps type: object properties: configMapRef: @@ -5128,20 +5008,15 @@ spec: name: description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string - default: "" optional: description: Specify whether the ConfigMap must be defined type: boolean x-kubernetes-map-type: atomic prefix: - description: |- - Optional text to prepend to the name of each environment variable. - May consist of any printable ASCII characters except '='. + description: An optional identifier to prepend to each key in the ConfigMap. Must be a C_IDENTIFIER. type: string secretRef: description: The Secret to select from @@ -5150,17 +5025,13 @@ spec: name: description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string - default: "" optional: description: Specify whether the Secret must be defined type: boolean x-kubernetes-map-type: atomic - x-kubernetes-list-type: atomic image: description: |- Container image name. @@ -5185,7 +5056,7 @@ spec: type: object properties: exec: - description: Exec specifies a command to execute in the container. + description: Exec specifies the action to take. type: object properties: command: @@ -5198,7 +5069,6 @@ spec: type: array items: type: string - x-kubernetes-list-type: atomic failureThreshold: description: |- Minimum consecutive failures for the probe to be considered failed after having succeeded. @@ -5206,8 +5076,10 @@ spec: type: integer format: int32 grpc: - description: GRPC specifies a GRPC HealthCheckRequest. + description: GRPC specifies an action involving a GRPC port. type: object + required: + - port properties: port: description: Port number of the gRPC service. Number must be in the range 1 to 65535. @@ -5218,11 +5090,11 @@ spec: Service is the name of the service to place in the gRPC HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + If this is not specified, the default behavior is defined by gRPC. type: string - default: "" httpGet: - description: HTTPGet specifies an HTTP GET request to perform. + description: HTTPGet specifies the http request to perform. type: object properties: host: @@ -5248,7 +5120,6 @@ spec: value: description: The header field value type: string - x-kubernetes-list-type: atomic path: description: Path to access on the HTTP server. type: string @@ -5273,8 +5144,7 @@ spec: type: integer format: int32 periodSeconds: - description: |- - How often (in seconds) to perform the probe. + description: How often (in seconds) to perform the probe. type: integer format: int32 successThreshold: @@ -5284,7 +5154,7 @@ spec: type: integer format: int32 tcpSocket: - description: TCPSocket specifies a connection to a TCP port. + description: TCPSocket specifies an action involving a TCP port. type: object properties: host: @@ -5325,6 +5195,8 @@ spec: items: description: ContainerPort represents a network port in a single container. type: object + required: + - containerPort properties: containerPort: description: |- @@ -5344,6 +5216,10 @@ spec: Defaults to "TCP". type: string default: TCP + x-kubernetes-list-map-keys: + - containerPort + - protocol + x-kubernetes-list-type: map readinessProbe: description: |- Periodic probe of container service readiness. @@ -5353,7 +5229,7 @@ spec: type: object properties: exec: - description: Exec specifies a command to execute in the container. + description: Exec specifies the action to take. type: object properties: command: @@ -5366,7 +5242,6 @@ spec: type: array items: type: string - x-kubernetes-list-type: atomic failureThreshold: description: |- Minimum consecutive failures for the probe to be considered failed after having succeeded. @@ -5374,8 +5249,10 @@ spec: type: integer format: int32 grpc: - description: GRPC specifies a GRPC HealthCheckRequest. + description: GRPC specifies an action involving a GRPC port. type: object + required: + - port properties: port: description: Port number of the gRPC service. Number must be in the range 1 to 65535. @@ -5386,11 +5263,11 @@ spec: Service is the name of the service to place in the gRPC HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + If this is not specified, the default behavior is defined by gRPC. type: string - default: "" httpGet: - description: HTTPGet specifies an HTTP GET request to perform. + description: HTTPGet specifies the http request to perform. type: object properties: host: @@ -5416,7 +5293,6 @@ spec: value: description: The header field value type: string - x-kubernetes-list-type: atomic path: description: Path to access on the HTTP server. type: string @@ -5441,8 +5317,7 @@ spec: type: integer format: int32 periodSeconds: - description: |- - How often (in seconds) to perform the probe. + description: How often (in seconds) to perform the probe. type: integer format: int32 successThreshold: @@ -5452,7 +5327,7 @@ spec: type: integer format: int32 tcpSocket: - description: TCPSocket specifies a connection to a TCP port. + description: TCPSocket specifies an action involving a TCP port. type: object properties: host: @@ -5481,6 +5356,33 @@ spec: More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ type: object properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + + This field is immutable. It can only be set for containers. + type: array + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + type: object + required: + - name + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map limits: description: |- Limits describes the maximum amount of compute resources allowed. @@ -5535,18 +5437,12 @@ spec: items: description: Capability represent POSIX capabilities type type: string - x-kubernetes-list-type: atomic drop: description: Removed capabilities type: array items: description: Capability represent POSIX capabilities type type: string - x-kubernetes-list-type: atomic - privileged: - description: |- - Run container in privileged mode. This can only be set to explicitly to 'false' - type: boolean readOnlyRootFilesystem: description: |- Whether this container has a read-only root filesystem. @@ -5602,6 +5498,7 @@ spec: type indicates which kind of seccomp profile will be applied. Valid options are: + Localhost - a profile defined in a file on the node should be used. RuntimeDefault - the container runtime default profile should be used. Unconfined - no profile should be applied. @@ -5618,7 +5515,7 @@ spec: type: object properties: exec: - description: Exec specifies a command to execute in the container. + description: Exec specifies the action to take. type: object properties: command: @@ -5631,7 +5528,6 @@ spec: type: array items: type: string - x-kubernetes-list-type: atomic failureThreshold: description: |- Minimum consecutive failures for the probe to be considered failed after having succeeded. @@ -5639,8 +5535,10 @@ spec: type: integer format: int32 grpc: - description: GRPC specifies a GRPC HealthCheckRequest. + description: GRPC specifies an action involving a GRPC port. type: object + required: + - port properties: port: description: Port number of the gRPC service. Number must be in the range 1 to 65535. @@ -5651,11 +5549,11 @@ spec: Service is the name of the service to place in the gRPC HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + If this is not specified, the default behavior is defined by gRPC. type: string - default: "" httpGet: - description: HTTPGet specifies an HTTP GET request to perform. + description: HTTPGet specifies the http request to perform. type: object properties: host: @@ -5681,7 +5579,6 @@ spec: value: description: The header field value type: string - x-kubernetes-list-type: atomic path: description: Path to access on the HTTP server. type: string @@ -5706,8 +5603,7 @@ spec: type: integer format: int32 periodSeconds: - description: |- - How often (in seconds) to perform the probe. + description: How often (in seconds) to perform the probe. type: integer format: int32 successThreshold: @@ -5717,7 +5613,7 @@ spec: type: integer format: int32 tcpSocket: - description: TCPSocket specifies a connection to a TCP port. + description: TCPSocket specifies an action involving a TCP port. type: object properties: host: @@ -5776,10 +5672,6 @@ spec: Path within the container at which the volume should be mounted. Must not contain ':'. type: string - mountPropagation: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-volumes-mount-propagation - type: string name: description: This must match the Name of a Volume. type: string @@ -5793,9 +5685,6 @@ spec: Path within the volume from which the container's volume should be mounted. Defaults to "" (volume's root). type: string - x-kubernetes-list-map-keys: - - mountPath - x-kubernetes-list-type: map workingDir: description: |- Container's working directory. @@ -5804,39 +5693,22 @@ spec: Cannot be updated. type: string dnsConfig: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-dnsconfig + description: This is accessible behind a feature flag - kubernetes.podspec-dnsconfig type: object x-kubernetes-preserve-unknown-fields: true dnsPolicy: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-dnspolicy + description: This is accessible behind a feature flag - kubernetes.podspec-dnspolicy type: string enableServiceLinks: - description: |- - EnableServiceLinks indicates whether information aboutservices should be injected into pod's environment variables, matching the syntax of Docker links. Optional: Knative defaults this to false. + description: 'EnableServiceLinks indicates whether information about services should be injected into pod''s environment variables, matching the syntax of Docker links. Optional: Knative defaults this to false.' type: boolean hostAliases: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-hostaliases + description: This is accessible behind a feature flag - kubernetes.podspec-hostaliases type: array items: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-hostaliases + description: This is accessible behind a feature flag - kubernetes.podspec-hostaliases type: object x-kubernetes-preserve-unknown-fields: true - hostIPC: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-hostipc - type: boolean - hostNetwork: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-hostnetwork - type: boolean - hostPID: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-hostpid - type: boolean idleTimeoutSeconds: description: |- IdleTimeoutSeconds is the maximum duration in seconds a request will be allowed @@ -5859,35 +5731,39 @@ spec: name: description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string - default: "" x-kubernetes-map-type: atomic - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map initContainers: description: |- - This is accessible behind a feature flag - kubernetes.podspec-init-containers + List of initialization containers belonging to the pod. + Init containers are executed in order prior to containers being started. If any + init container fails, the pod is considered to have failed and is handled according + to its restartPolicy. The name for an init container or normal container must be + unique among all containers. + Init containers may not have Lifecycle actions, Readiness probes, Liveness probes, or Startup probes. + The resourceRequirements of an init container are taken into account during scheduling + by finding the highest request/limit for each resource type, and then using the max of + of that value or the sum of the normal containers. Limits are applied to init containers + in a similar fashion. + Init containers cannot currently be added or removed. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/ type: array items: description: This is accessible behind a feature flag - kubernetes.podspec-init-containers type: object x-kubernetes-preserve-unknown-fields: true nodeSelector: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-nodeselector + description: This is accessible behind a feature flag - kubernetes.podspec-nodeselector type: object - additionalProperties: - type: string + x-kubernetes-preserve-unknown-fields: true x-kubernetes-map-type: atomic priorityClassName: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-priorityclassname + description: This is accessible behind a feature flag - kubernetes.podspec-priorityclassname type: string + x-kubernetes-preserve-unknown-fields: true responseStartTimeoutSeconds: description: |- ResponseStartTimeoutSeconds is the maximum duration in seconds that the request @@ -5896,16 +5772,15 @@ spec: type: integer format: int64 runtimeClassName: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-runtimeclassname + description: This is accessible behind a feature flag - kubernetes.podspec-runtimeclassname type: string + x-kubernetes-preserve-unknown-fields: true schedulerName: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-schedulername + description: This is accessible behind a feature flag - kubernetes.podspec-schedulername type: string + x-kubernetes-preserve-unknown-fields: true securityContext: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-securitycontext + description: This is accessible behind a feature flag - kubernetes.podspec-securitycontext type: object x-kubernetes-preserve-unknown-fields: true serviceAccountName: @@ -5914,9 +5789,9 @@ spec: More info: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/ type: string shareProcessNamespace: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-shareprocessnamespace + description: This is accessible behind a feature flag - kubernetes.podspec-shareproccessnamespace type: boolean + x-kubernetes-preserve-unknown-fields: true timeoutSeconds: description: |- TimeoutSeconds is the maximum duration in seconds that the request instance @@ -5928,13 +5803,11 @@ spec: description: This is accessible behind a feature flag - kubernetes.podspec-tolerations type: array items: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-tolerations + description: This is accessible behind a feature flag - kubernetes.podspec-tolerations type: object x-kubernetes-preserve-unknown-fields: true topologySpreadConstraints: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints + description: This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints type: array items: description: This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints @@ -6003,37 +5876,18 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string - x-kubernetes-list-type: atomic name: description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string - default: "" optional: description: optional specify whether the ConfigMap or its keys must be defined type: boolean x-kubernetes-map-type: atomic - csi: - description: This is accessible behind a feature flag - kubernetes.podspec-volumes-csi - type: object - x-kubernetes-preserve-unknown-fields: true emptyDir: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-volumes-emptydir - type: object - x-kubernetes-preserve-unknown-fields: true - hostPath: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-volumes-hostpath - type: object - x-kubernetes-preserve-unknown-fields: true - image: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-volumes-image + description: This is accessible behind a feature flag - kubernetes.podspec-emptydir type: object x-kubernetes-preserve-unknown-fields: true name: @@ -6043,8 +5897,7 @@ spec: More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string persistentVolumeClaim: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-persistent-volume-claim + description: This is accessible behind a feature flag - kubernetes.podspec-persistent-volume-claim type: object x-kubernetes-preserve-unknown-fields: true projected: @@ -6062,14 +5915,10 @@ spec: type: integer format: int32 sources: - description: |- - sources is the list of volume projections. Each entry in this list - handles one source. + description: sources is the list of volume projections type: array items: - description: |- - Projection that may be projected along with other supported volume types. - Exactly one of these fields must be set. + description: Projection that may be projected along with other supported volume types type: object properties: configMap: @@ -6113,16 +5962,12 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string - x-kubernetes-list-type: atomic name: description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string - default: "" optional: description: optional specify whether the ConfigMap or its keys must be defined type: boolean @@ -6141,7 +5986,7 @@ spec: - path properties: fieldRef: - description: 'Required: Selects a field of the pod: only annotations, labels, name, namespace and uid are supported.' + description: 'Required: Selects a field of the pod: only annotations, labels, name and namespace are supported.' type: object required: - fieldPath @@ -6188,7 +6033,6 @@ spec: description: 'Required: resource to select' type: string x-kubernetes-map-type: atomic - x-kubernetes-list-type: atomic secret: description: secret information about the secret data to project type: object @@ -6230,16 +6074,12 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string - x-kubernetes-list-type: atomic name: description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string - default: "" optional: description: optional field specify whether the Secret or its key must be defined type: boolean @@ -6272,7 +6112,6 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string - x-kubernetes-list-type: atomic secret: description: |- secret represents a secret that should populate this volume. @@ -6327,7 +6166,6 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string - x-kubernetes-list-type: atomic optional: description: optional field specify whether the Secret or its keys must be defined type: boolean @@ -6336,9 +6174,6 @@ spec: secretName is the name of the secret in the pod's namespace to use. More info: https://kubernetes.io/docs/concepts/storage/volumes#secret type: string - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map traffic: description: |- Traffic specifies how to distribute traffic over a collection of @@ -6554,7 +6389,7 @@ metadata: name: images.caching.internal.knative.dev labels: app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" knative.dev/crd-install: "true" spec: group: caching.internal.knative.dev @@ -6619,12 +6454,9 @@ spec: name: description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string - default: "" x-kubernetes-map-type: atomic serviceAccountName: description: |- @@ -6692,7 +6524,7 @@ spec: type: string jsonPath: .spec.image --- -# Source: https://github.com/knative/serving/releases/download/knative-v1.22.1/serving-core.yaml +# Source: https://github.com/knative/serving/releases/download/knative-v1.15.0/serving-core.yaml --- # Copyright 2018 The Knative Authors # @@ -6714,7 +6546,7 @@ metadata: name: knative-serving labels: app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" --- # Copyright 2023 The Knative Authors # @@ -6737,7 +6569,7 @@ metadata: namespace: knative-serving labels: serving.knative.dev/controller: "true" - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" app.kubernetes.io/name: knative-serving rules: - apiGroups: [""] @@ -6754,7 +6586,7 @@ metadata: name: knative-serving-activator-cluster labels: serving.knative.dev/controller: "true" - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" app.kubernetes.io/name: knative-serving rules: - apiGroups: [""] @@ -6786,7 +6618,7 @@ metadata: # (which should be identical, but isn't guaranteed to be installed alongside serving). name: knative-serving-aggregated-addressable-resolver labels: - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" app.kubernetes.io/name: knative-serving aggregationRule: clusterRoleSelectors: @@ -6798,7 +6630,7 @@ apiVersion: rbac.authorization.k8s.io/v1 metadata: name: knative-serving-addressable-resolver labels: - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" app.kubernetes.io/name: knative-serving # Labeled to facilitate aggregated cluster roles that act on Addressables. duck.knative.dev/addressable: "true" @@ -6836,7 +6668,7 @@ metadata: name: knative-serving-namespaced-admin labels: rbac.authorization.k8s.io/aggregate-to-admin: "true" - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" app.kubernetes.io/name: knative-serving rules: - apiGroups: ["serving.knative.dev"] @@ -6852,7 +6684,7 @@ metadata: name: knative-serving-namespaced-edit labels: rbac.authorization.k8s.io/aggregate-to-edit: "true" - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" app.kubernetes.io/name: knative-serving rules: - apiGroups: ["serving.knative.dev"] @@ -6868,7 +6700,7 @@ metadata: name: knative-serving-namespaced-view labels: rbac.authorization.k8s.io/aggregate-to-view: "true" - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" app.kubernetes.io/name: knative-serving rules: - apiGroups: ["serving.knative.dev", "networking.internal.knative.dev", "autoscaling.internal.knative.dev", "caching.internal.knative.dev"] @@ -6895,7 +6727,7 @@ metadata: name: knative-serving-core labels: serving.knative.dev/controller: "true" - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" app.kubernetes.io/name: knative-serving rules: - apiGroups: [""] @@ -6904,15 +6736,9 @@ rules: - apiGroups: [""] resources: ["endpoints/restricted"] # Permission for RestrictedEndpointsAdmission verbs: ["create"] - - apiGroups: ["discovery.k8s.io"] - resources: ["endpointslices/restricted"] # Permission for RestrictedEndpointsAdmission - verbs: ["create"] - apiGroups: [""] resources: ["namespaces/finalizers"] # finalizers are needed for the owner reference of the webhook verbs: ["update"] - - apiGroups: ["discovery.k8s.io"] - resources: ["endpointslices"] - verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] - apiGroups: ["apps"] resources: ["deployments", "deployments/finalizers"] # finalizers are needed for the owner reference of the webhook verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] @@ -6944,9 +6770,6 @@ rules: resources: ["clusterroles"] verbs: ["delete"] resourceNames: ["knative-serving-certmanager"] - - apiGroups: ["*"] - resources: ["*/scale"] - verbs: ["patch"] --- # Copyright 2019 The Knative Authors # @@ -6967,7 +6790,7 @@ apiVersion: rbac.authorization.k8s.io/v1 metadata: name: knative-serving-podspecable-binding labels: - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" app.kubernetes.io/name: knative-serving # Labeled to facilitate aggregated cluster roles that act on PodSpecables. duck.knative.dev/podspecable: "true" @@ -7005,7 +6828,7 @@ metadata: labels: app.kubernetes.io/component: controller app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" --- kind: ClusterRole apiVersion: rbac.authorization.k8s.io/v1 @@ -7013,7 +6836,7 @@ metadata: name: knative-serving-admin labels: app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" aggregationRule: clusterRoleSelectors: - matchLabels: @@ -7026,7 +6849,7 @@ metadata: labels: app.kubernetes.io/component: controller app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" subjects: - kind: ServiceAccount name: controller @@ -7043,7 +6866,7 @@ metadata: labels: app.kubernetes.io/component: controller app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" subjects: - kind: ServiceAccount name: controller @@ -7061,7 +6884,7 @@ metadata: labels: app.kubernetes.io/component: activator app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding @@ -7071,7 +6894,7 @@ metadata: labels: app.kubernetes.io/component: activator app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" subjects: - kind: ServiceAccount name: activator @@ -7088,7 +6911,7 @@ metadata: labels: app.kubernetes.io/component: activator app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" subjects: - kind: ServiceAccount name: activator @@ -7135,11 +6958,11 @@ metadata: labels: app.kubernetes.io/component: queue-proxy app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" spec: # This is the Go import path for the binary that is containerized # and substituted here. - image: gcr.io/knative-releases/knative.dev/serving/cmd/queue@sha256:b1af8bda6c1d32b1cf5fbf8f1f6068c5007a5cebf091039fdea83b88b1fd87f4 + image: gcr.io/knative-releases/knative.dev/serving/cmd/queue@sha256:d313c823f25a09326a7c3c2ec9833c5e005791bc3acb4036ebf33735cbb62bee --- # Copyright 2018 The Knative Authors # @@ -7163,9 +6986,9 @@ metadata: labels: app.kubernetes.io/component: autoscaler app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" annotations: - knative.dev/example-checksum: "c727b3e8" + knative.dev/example-checksum: "47c2487f" data: _example: | ################################ @@ -7315,7 +7138,7 @@ data: # The `unit` is one concurrent request proxied by the activator. # activator-capacity must be at least 1. # This value is used for computation of the Activator subset size. - # See the algorithm here: https://bit.ly/38XiCZ3. + # See the algorithm here: http://bit.ly/38XiCZ3. # TODO(vagababov): tune after actual benchmarking. activator-capacity: "100.0" @@ -7373,7 +7196,7 @@ metadata: labels: app.kubernetes.io/name: knative-serving app.kubernetes.io/component: controller - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" networking.knative.dev/certificate-provider: cert-manager annotations: knative.dev/example-checksum: "b7a9a602" @@ -7442,7 +7265,7 @@ metadata: labels: app.kubernetes.io/name: knative-serving app.kubernetes.io/component: controller - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" annotations: knative.dev/example-checksum: "5b64ff5c" data: @@ -7596,13 +7419,13 @@ metadata: labels: app.kubernetes.io/name: knative-serving app.kubernetes.io/component: controller - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" annotations: - knative.dev/example-checksum: "555b4826" + knative.dev/example-checksum: "720ddb97" data: # This is the Go import path for the binary that is containerized # and substituted here. - queue-sidecar-image: gcr.io/knative-releases/knative.dev/serving/cmd/queue@sha256:b1af8bda6c1d32b1cf5fbf8f1f6068c5007a5cebf091039fdea83b88b1fd87f4 + queue-sidecar-image: gcr.io/knative-releases/knative.dev/serving/cmd/queue@sha256:d313c823f25a09326a7c3c2ec9833c5e005791bc3acb4036ebf33735cbb62bee _example: |- ################################ # # @@ -7668,25 +7491,6 @@ data: # If omitted, or empty, no rootCA is added to the golang rootCAs queue-sidecar-rootca: "" - # Sets the minimum TLS version for the queue proxy sidecar's TLS server. - # Accepted values: "1.2", "1.3". Default is "1.3" if not specified. - queue-sidecar-tls-min-version: "" - - # Sets the maximum TLS version for the queue proxy sidecar's TLS server. - # Accepted values: "1.2", "1.3". If omitted, the Go default is used. - queue-sidecar-tls-max-version: "" - - # Sets the cipher suites for the queue proxy sidecar's TLS server. - # Comma-separated list of cipher suite names (e.g. "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"). - # If omitted, the Go default cipher suites are used. - # Note: cipher suites are not configurable in TLS 1.3. - queue-sidecar-tls-cipher-suites: "" - - # Sets the elliptic curve preferences for the queue proxy sidecar's TLS server. - # Comma-separated list of curve names (e.g. "X25519,CurveP256"). - # If omitted, the Go default curves are used. - queue-sidecar-tls-curve-preferences: "" - # If set, it automatically configures pod anti-affinity requirements for all Knative services. # It employs the `preferredDuringSchedulingIgnoredDuringExecution` weighted pod affinity term, # aligning with the Knative revision label. It yields the configuration below in all workloads' deployments: @@ -7718,15 +7522,6 @@ data: # selector: # use-gvisor: "please" runtime-class-name: "" - - # pod-is-always-schedulable can be used to define that Pods in the system will always be - # scheduled, and a Revision should not be marked unschedulable. - # Setting this to `true` makes sense if you have cluster-autoscaling set up for your cluster - # where unschedulable Pods trigger the addition of a new Node and are therefore a short and - # transient state. - # - # See https://github.com/knative/serving/issues/14862 - pod-is-always-schedulable: "false" --- # Copyright 2018 The Knative Authors # @@ -7750,7 +7545,7 @@ metadata: labels: app.kubernetes.io/name: knative-serving app.kubernetes.io/component: controller - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" annotations: knative.dev/example-checksum: "26c09de5" data: @@ -7814,9 +7609,9 @@ metadata: labels: app.kubernetes.io/name: knative-serving app.kubernetes.io/component: controller - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" annotations: - knative.dev/example-checksum: "bee75b26" + knative.dev/example-checksum: "632d47dd" data: _example: |- ################################ @@ -7837,11 +7632,8 @@ data: # Default SecurityContext settings to secure-by-default values # if unset. # - # Disabled - do nothing; no security options are applied - # AllowRootBounded - Applies secure defaults without enforcing strict policies; sets seccompProfile - # to RuntimeDefault and drops all capabilities - # Enabled - Enforces security defaults; sets seccompProfile to RuntimeDefault, drops all capabilities, - # and sets runAsNonRoot to true if not already specified. + # This value will default to "enabled" in a future release, + # probably Knative 1.10 secure-pod-defaults: "disabled" # Indicates whether multi container support is enabled @@ -7935,24 +7727,6 @@ data: # See: https://knative.dev/docs/serving/configuration/feature-flags/#kubernetes-share-process-namespace kubernetes.podspec-shareprocessnamespace: "disabled" - # Indicates whether hostIPC support is enabled - # - # WARNING: Cannot safely be disabled once enabled. - # See https://knative.dev/docs/serving/configuration/feature-flags/#kubernetes-host-ipc - kubernetes.podspec-hostipc: "disabled" - - # Indicates whether hostPID support is enabled - # - # WARNING: Cannot safely be disabled once enabled. - # See https://knative.dev/docs/serving/configuration/feature-flags/#kubernetes-host-pid - kubernetes.podspec-hostpid: "disabled" - - # Indicates whether hostNetwork support is enabled - # - # WARNING: Cannot safely be disabled once enabled. - # See See https://knative.dev/docs/serving/configuration/feature-flags/#kubernetes-host-network - kubernetes.podspec-hostnetwork: "disabled" - # Indicates whether Kubernetes PriorityClassName support is enabled # # WARNING: Cannot safely be disabled once enabled. @@ -7971,6 +7745,15 @@ data: # For a list of possible capabilities, see https://man7.org/linux/man-pages/man7/capabilities.7.html kubernetes.containerspec-addcapabilities: "disabled" + # This feature validates PodSpecs from the validating webhook + # against the K8s API Server. + # + # When "enabled", the server will always run the extra validation. + # When "allowed", the server will not run the dry-run validation by default. + # However, clients may enable the behavior on an individual Service by + # attaching the following metadata annotation: "features.knative.dev/podspec-dryrun":"enabled". + # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-dry-run + kubernetes.podspec-dryrun: "allowed" # Controls whether tag header based routing feature are enabled or not. # 1. Enabled: enabling tag header based routing @@ -7988,24 +7771,6 @@ data: # 2. Disabled: disabling EmptyDir volume support kubernetes.podspec-volumes-emptydir: "enabled" - # Controls whether volume support for image is enabled or not. - # 1. Enabled: enabling image volume support - # 2. Disabled: disabling image volume support - kubernetes.podspec-volumes-image: "disabled" - - # Controls whether volume support for HostPath is enabled or not. - # WARNING: Cannot safely be disabled once enabled. - # WARNING: If you can avoid using a hostPath volume, you should. - # Please read https://kubernetes.io/docs/concepts/storage/volumes/#hostpath before enabling this feature. - # 1. Enabled: enabling HostPath volume support - # 2. Disabled: disabling HostPath volume support - kubernetes.podspec-volumes-hostpath: "disabled" - - # Controls whether volume support for CSI is enabled or not. - # 1. Enabled: enabling CSI volume support - # 2. Disabled: disabling CSI volume support - kubernetes.podspec-volumes-csi: "disabled" - # Controls whether init containers support is enabled or not. # 1. Enabled: enabling init containers support # 2. Disabled: disabling init containers support @@ -8021,18 +7786,13 @@ data: # 2. Disabled: disabling write access for persistent volumes kubernetes.podspec-persistent-volume-write: "disabled" - # Controls whether volume mount propagation support is enabled or not. - # 1. Enabled: enabling volume mount propagation support - # 2. Disabled: disabling volume mount propagation support - kubernetes.podspec-volumes-mount-propagation: "disabled" - # Controls if the queue proxy podInfo feature is enabled, allowed or disabled # # This feature should be enabled/allowed when using queue proxy Options (Extensions) # Enabling will mount a podInfo volume to the queue proxy container. # The volume will contains an 'annotations' file (from the pod's annotation field). # The annotations in this file include the Service annotations set by the client creating the service. - # If mounted, the annotations can be accessed by queue proxy extensions at /etc/podinfo/annotations + # If mounted, the annotations can be accessed by queue proxy extensions at /etc/podinfo/annnotations # # 1. "enabled": always mount a podInfo volume # 2. "disabled": never mount a podInfo volume @@ -8068,7 +7828,7 @@ metadata: labels: app.kubernetes.io/name: knative-serving app.kubernetes.io/component: controller - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" annotations: knative.dev/example-checksum: "aa3813a8" data: @@ -8167,7 +7927,7 @@ metadata: labels: app.kubernetes.io/name: knative-serving app.kubernetes.io/component: controller - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" annotations: knative.dev/example-checksum: "f4b71f57" data: @@ -8226,7 +7986,7 @@ metadata: name: config-logging namespace: knative-serving labels: - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" app.kubernetes.io/component: logging app.kubernetes.io/name: knative-serving annotations: @@ -8308,7 +8068,7 @@ metadata: labels: app.kubernetes.io/name: knative-serving app.kubernetes.io/component: networking - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" annotations: knative.dev/example-checksum: "0573e07d" data: @@ -8512,9 +8272,9 @@ metadata: labels: app.kubernetes.io/name: knative-serving app.kubernetes.io/component: observability - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" annotations: - knative.dev/example-checksum: "59abacb5" + knative.dev/example-checksum: "54abd711" data: _example: | ################################ @@ -8572,70 +8332,42 @@ data: # PodIP string // IP of the pod hosting the revision # } # - logging.request-log-template: '{"httpRequest": {"requestMethod": "{{.Request.Method}}", "requestUrl": "{{js .Request.RequestURI}}", "requestSize": "{{.Request.ContentLength}}", "status": {{.Response.Code}}, "responseSize": "{{.Response.Size}}", "userAgent": "{{js .Request.UserAgent}}", "remoteIp": "{{js .Request.RemoteAddr}}", "serverIp": "{{.Revision.PodIP}}", "referer": "{{js .Request.Referer}}", "latency": "{{.Response.Latency}}s", "protocol": "{{.Request.Proto}}"}, "traceId": "{{.TraceID}}"}' + logging.request-log-template: '{"httpRequest": {"requestMethod": "{{.Request.Method}}", "requestUrl": "{{js .Request.RequestURI}}", "requestSize": "{{.Request.ContentLength}}", "status": {{.Response.Code}}, "responseSize": "{{.Response.Size}}", "userAgent": "{{js .Request.UserAgent}}", "remoteIp": "{{js .Request.RemoteAddr}}", "serverIp": "{{.Revision.PodIP}}", "referer": "{{js .Request.Referer}}", "latency": "{{.Response.Latency}}s", "protocol": "{{.Request.Proto}}"}, "traceId": "{{index .Request.Header "X-B3-Traceid"}}"}' # If true, the request logging will be enabled. + # NB: up to and including Knative version 0.18 if logging.request-log-template is non-empty, this value + # will be ignored. logging.enable-request-log: "false" # If true, this enables queue proxy writing request logs for probe requests to stdout. # It uses the same template for user requests, i.e. logging.request-log-template. logging.enable-probe-request-log: "false" - # metrics-protocol field specifies the protocol used when exporting metrics - # It supports either 'none' (the default), 'prometheus', 'http/protobuf' (OTLP HTTP), 'grpc' (OTLP gRPC) - metrics-protocol: http/protobuf - - # metrics-endpoint field specifies the destination metrics should be exporter to. - # - # The endpoint MUST be set when the protocol is http/protobuf or grpc. - # The endpoint MUST NOT be set when the protocol is none. - # - # When the protocol is prometheus the endpoint can accept a 'host:port' string to customize the - # listening host interface and port. - metrics-endpoint: http://example.com/v1/traces - - # metrics-export-interval specifies the global metrics reporting period for control and data plane components. - # If a zero or negative value is passed the default reporting OTel period is used (60 secs). - metrics-export-interval: 60s + # metrics.backend-destination field specifies the system metrics destination. + # It supports either prometheus (the default) or opencensus. + metrics.backend-destination: prometheus - # request-metrics-protocol field specifies the protocol used when exporting queue-proxy metrics - # It supports either 'none' (the default), 'prometheus', 'http/protobuf' (OTLP HTTP), 'grpc' (OTLP gRPC) - request-metrics-protocol: http/protobuf + # metrics.reporting-period-seconds specifies the global metrics reporting period for control and data plane components. + # If a zero or negative value is passed the default reporting period is used (10 secs). + # If the attribute is not specified a default value is used per metrics backend. + # For the prometheus backend the default reporting period is 5s while for opencensus it is 60s. + metrics.reporting-period-seconds: "5" - # request-metrics-endpoint field specifies the destination metrics from the queue proxy should be exporter to. - # - # The endpoint MUST be set when the protocol is http/protobuf or grpc. - # The endpoint MUST NOT be set when the protocol is none. - # - # When the protocol is prometheus the endpoint can accept a 'host:port' string to customize the - # listening host interface and port. - request-metrics-endpoint: http://promstack-kube-prometheus-prometheus.observability:9090/api/v1/otlp/v1/metrics + # metrics.request-metrics-backend-destination specifies the request metrics + # destination. It enables queue proxy to send request metrics. + # Currently supported values: prometheus (the default), opencensus. + metrics.request-metrics-backend-destination: prometheus - # request-metrics-export-interval specifies the global metrics reporting period for the queue-proxy. - # - # If a zero or negative value is passed the default reporting OTel period is used (60 secs). - request-metrics-export-interval: 60s + # metrics.request-metrics-reporting-period-seconds specifies the request metrics reporting period in sec at queue proxy. + # If a zero or negative value is passed the default reporting period is used (10 secs). + # If the attribute is not specified, it is overridden by the value of metrics.reporting-period-seconds. + metrics.request-metrics-reporting-period-seconds: "5" - # runtime-profiling indicates whether it is allowed to retrieve runtime profiling data from + # profiling.enable indicates whether it is allowed to retrieve runtime profiling data from # the pods via an HTTP server in the format expected by the pprof visualization tool. When # enabled, the Knative Serving pods expose the profiling data on an alternate HTTP port 8008. # The HTTP context root for profiling is then /debug/pprof/. - runtime-profiling: enabled - - # tracing-protocol field specifies the protocol used when exporting traces - # It supports either 'none' (the default), 'http/protobuf' (OTLP HTTP), 'grpc' (OTLP gRPC) - # or `stdout` for debugging purposes - tracing-protocol: http/protobuf - - # tracing-endpoint field specifies the destination traces should be exporter to. - # - # The endpoint MUST be set when the protocol is http/protobuf or grpc. - # The endpoint MUST NOT be set when the protocol is none. - tracing-endpoint: http://jaeger-collector.observability:4318/v1/traces - - # tracing-sampling-rate allows the user to specify what percentage of all traces should be exported - # The value should be between 0 (never sample) to 1 (always sample) - tracing-sampling-rate: "1" + profiling.enable: "false" --- # Copyright 2019 The Knative Authors # @@ -8659,16 +8391,39 @@ metadata: labels: app.kubernetes.io/name: knative-serving app.kubernetes.io/component: tracing - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" annotations: - knative.dev/example-checksum: "04c7e9a3" + knative.dev/example-checksum: "26614636" data: _example: | - ########################################################### - # # - # This config is deprecated - use config-observability # - # # - ########################################################### + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this example block and unindented to be in the data block + # to actually change the configuration. + # + # This may be "zipkin" or "none" (default) + backend: "none" + + # URL to zipkin collector where traces are sent. + # This must be specified when backend is "zipkin" + zipkin-endpoint: "http://zipkin.istio-system.svc.cluster.local:9411/api/v2/spans" + + # Enable zipkin debug mode. This allows all spans to be sent to the server + # bypassing sampling. + debug: "false" + + # Percentage (0-1) of requests to trace + sample-rate: "0.1" --- # Copyright 2020 The Knative Authors # @@ -8692,7 +8447,7 @@ metadata: labels: app.kubernetes.io/component: activator app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" spec: minReplicas: 1 maxReplicas: 20 @@ -8720,7 +8475,7 @@ metadata: labels: app.kubernetes.io/component: activator app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" spec: minAvailable: 80% selector: @@ -8748,7 +8503,7 @@ metadata: namespace: knative-serving labels: app.kubernetes.io/component: activator - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" app.kubernetes.io/name: knative-serving spec: selector: @@ -8762,7 +8517,7 @@ spec: role: activator app.kubernetes.io/component: activator app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" spec: # To avoid node becoming SPOF, spread our replicas to different nodes. affinity: @@ -8779,7 +8534,7 @@ spec: - name: activator # This is the Go import path for the binary that is containerized # and substituted here. - image: gcr.io/knative-releases/knative.dev/serving/cmd/activator@sha256:5deaef961fef8d1417f6d4a4dfae2fc338f2d30d72c4ad58c3ab392b2c04705b + image: gcr.io/knative-releases/knative.dev/serving/cmd/activator@sha256:b6d7d96edd8942d679757249f6aa07373461411104ce7c93309f23fba2884f8f # The numbers are based on performance test results from # https://github.com/knative/serving/issues/1625#issuecomment-511930023 resources: @@ -8809,6 +8564,9 @@ spec: value: config-logging - name: CONFIG_OBSERVABILITY_NAME value: config-observability + # TODO(https://github.com/knative/pkg/pull/953): Remove stackdriver specific config + - name: METRICS_DOMAIN + value: knative.dev/internal/serving securityContext: allowPrivilegeEscalation: false readOnlyRootFilesystem: true @@ -8855,7 +8613,7 @@ metadata: labels: app: activator app.kubernetes.io/component: activator - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" app.kubernetes.io/name: knative-serving spec: selector: @@ -8901,7 +8659,7 @@ metadata: labels: app.kubernetes.io/component: autoscaler app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" spec: replicas: 1 selector: @@ -8917,7 +8675,7 @@ spec: app: autoscaler app.kubernetes.io/component: autoscaler app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" spec: # To avoid node becoming SPOF, spread our replicas to different nodes. affinity: @@ -8934,7 +8692,7 @@ spec: - name: autoscaler # This is the Go import path for the binary that is containerized # and substituted here. - image: gcr.io/knative-releases/knative.dev/serving/cmd/autoscaler@sha256:5bae38655d87df86b041083fbe51791816473245f752432ba9b85a7b12f73cd5 + image: gcr.io/knative-releases/knative.dev/serving/cmd/autoscaler@sha256:119157d871eb3db5a54944464d9920ad378d35292d4c12fd4a765cd016e24f0f resources: requests: cpu: 100m @@ -8959,6 +8717,9 @@ spec: value: config-logging - name: CONFIG_OBSERVABILITY_NAME value: config-observability + # TODO(https://github.com/knative/pkg/pull/953): Remove stackdriver specific config + - name: METRICS_DOMAIN + value: knative.dev/serving securityContext: allowPrivilegeEscalation: false readOnlyRootFilesystem: true @@ -8990,7 +8751,7 @@ metadata: app: autoscaler app.kubernetes.io/component: autoscaler app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" name: autoscaler namespace: knative-serving spec: @@ -9030,7 +8791,7 @@ metadata: labels: app.kubernetes.io/component: controller app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" spec: selector: matchLabels: @@ -9041,7 +8802,7 @@ spec: app: controller app.kubernetes.io/component: controller app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" spec: # To avoid node becoming SPOF, spread our replicas to different nodes. affinity: @@ -9058,7 +8819,7 @@ spec: - name: controller # This is the Go import path for the binary that is containerized # and substituted here. - image: gcr.io/knative-releases/knative.dev/serving/cmd/controller@sha256:94329d85200c2fc31ed1166a26568ca1357376c149c147e71f400cf28be3c816 + image: gcr.io/knative-releases/knative.dev/serving/cmd/controller@sha256:80b9865a585900af6cecead24babe03aa79487e9e6306da1444b04148c21c96f resources: requests: cpu: 100m @@ -9079,6 +8840,9 @@ spec: value: config-logging - name: CONFIG_OBSERVABILITY_NAME value: config-observability + # TODO(https://github.com/knative/pkg/pull/953): Remove stackdriver specific config + - name: METRICS_DOMAIN + value: knative.dev/internal/serving securityContext: allowPrivilegeEscalation: false readOnlyRootFilesystem: true @@ -9117,7 +8881,7 @@ metadata: app: controller app.kubernetes.io/component: controller app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" name: controller namespace: knative-serving spec: @@ -9154,7 +8918,7 @@ metadata: labels: app.kubernetes.io/component: webhook app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" spec: minReplicas: 1 maxReplicas: 5 @@ -9180,7 +8944,7 @@ metadata: labels: app.kubernetes.io/component: webhook app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" spec: minAvailable: 80% selector: @@ -9208,7 +8972,7 @@ metadata: namespace: knative-serving labels: app.kubernetes.io/component: webhook - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" app.kubernetes.io/name: knative-serving spec: selector: @@ -9221,7 +8985,7 @@ spec: app: webhook role: webhook app.kubernetes.io/component: webhook - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" app.kubernetes.io/name: knative-serving spec: # To avoid node becoming SPOF, spread our replicas to different nodes. @@ -9239,7 +9003,7 @@ spec: - name: webhook # This is the Go import path for the binary that is containerized # and substituted here. - image: gcr.io/knative-releases/knative.dev/serving/cmd/webhook@sha256:8470456be214e93a84e3c7b79a632aa9978bd8ecda553feaa47878a2c24ab84d + image: gcr.io/knative-releases/knative.dev/serving/cmd/webhook@sha256:732d9cdf7f5fa5c6055d26b1aa5aad40e3d74ba9f2cb76a1db0f0e4d072b7cd0 resources: requests: cpu: 100m @@ -9264,6 +9028,9 @@ spec: value: webhook - name: WEBHOOK_PORT value: "8443" + # TODO(https://github.com/knative/pkg/pull/953): Remove stackdriver specific config + - name: METRICS_DOMAIN + value: knative.dev/internal/serving securityContext: allowPrivilegeEscalation: false readOnlyRootFilesystem: true @@ -9303,7 +9070,7 @@ metadata: app: webhook role: webhook app.kubernetes.io/component: webhook - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" app.kubernetes.io/name: knative-serving name: webhook namespace: knative-serving @@ -9344,7 +9111,7 @@ metadata: labels: app.kubernetes.io/component: webhook app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" webhooks: - admissionReviewVersions: ["v1", "v1beta1"] clientConfig: @@ -9385,7 +9152,7 @@ metadata: labels: app.kubernetes.io/component: webhook app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" webhooks: - admissionReviewVersions: ["v1", "v1beta1"] clientConfig: @@ -9441,7 +9208,7 @@ metadata: labels: app.kubernetes.io/component: webhook app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" webhooks: - admissionReviewVersions: ["v1", "v1beta1"] clientConfig: @@ -9499,10 +9266,10 @@ metadata: labels: app.kubernetes.io/component: webhook app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" # The data is populated at install time. --- -# Source: https://github.com/knative-extensions/net-kourier/releases/download/knative-v1.22.1/kourier.yaml +# Source: https://github.com/knative-extensions/net-kourier/releases/download/knative-v1.15.0/kourier.yaml --- # Copyright 2020 The Knative Authors # @@ -9526,7 +9293,7 @@ metadata: networking.knative.dev/ingress-provider: kourier app.kubernetes.io/name: knative-serving app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" --- # Copyright 2020 The Knative Authors # @@ -9550,7 +9317,7 @@ metadata: labels: networking.knative.dev/ingress-provider: kourier app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" app.kubernetes.io/name: knative-serving data: envoy-bootstrap.yaml: | @@ -9678,7 +9445,7 @@ metadata: labels: networking.knative.dev/ingress-provider: kourier app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" app.kubernetes.io/name: knative-serving data: _example: | @@ -9702,11 +9469,6 @@ data: # probes etc. must be configured via the bootstrap config. enable-service-access-logging: "true" - # Specifies the format of the access log used by the Kourier gateway. - # This template follows the envoy format. - # see: https://www.envoyproxy.io/docs/envoy/latest/configuration/observability/access_log/usage#access-logging - service-access-log-template: "" - # Specifies whether to use proxy-protocol in order to safely # transport connection information such as a client's address # across multiple layers of TCP proxies. @@ -9735,76 +9497,10 @@ data: # right side of the x-forwarded-for HTTP header to trust. trusted-hops-count: "0" - # Configures the connection manager to use the real remote address - # of the client connection when determining internal versus external origin and manipulating various headers. - use-remote-address: "false" - # Specifies the cipher suites for TLS external listener. # Use ',' separated values like "ECDHE-ECDSA-AES128-GCM-SHA256,ECDHE-ECDSA-CHACHA20-POLY1305" # The default uses the default cipher suites of the envoy version. cipher-suites: "" - - # Disable the Envoy server header injection in the response when response has no such header. - disable-envoy-server-header: "false" - - # The external authorization service and port, my-auth:2222. - # This value overrides environment variable if defined. - extauthz-host: "" - - # The protocol used to query the ext auth service. Can be one of : grpc, http, https. Defaults to grpc - # This value overrides environment variable if defined. - extauthz-protocol: "grpc" - - # Allow traffic to go through if the ext auth service is down. Accepts true/false. - # This value overrides environment variable if defined. - extauthz-failure-mode-allow: "" - - # Max request bytes, if not set, defaults to 8192 Bytes. More info Envoy Docs - # see: https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/http/ext_authz/v3/ext_authz.proto.html#extensions-filters-http-ext-authz-v3-buffersettings - # This value overrides environment variable if defined. - extauthz-max-request-body-bytes: 8192 - - # Max time in ms to wait for the ext authz service. Defaults to 2000 ms - # This value overrides environment variable if defined. - extauthz-timeout: 2000 - - # If extauthz-protocol is equal to http or https, path to query the ext auth service. - # Example : if set to /verify, it will query /verify/ (notice the trailing /). If not set, it will query / - # This value overrides environment variable if defined. - extauthz-path-prefix: "" - - # If extauthz-protocol is equal to grpc, sends the body as raw bytes instead of a UTF-8 string. - # Accepts only true/false, t/f or 1/0. Attempting to set another value will throw an error. - # Defaults to false. More info Envoy Docs. - # see: https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/http/ext_authz/v3/ext_authz.proto.html#extensions-filters-http-ext-authz-v3-buffersettings - # This value overrides environment variable if defined. - extauthz-pack-as-byte: "false" - - # Specifies the secret that contains the TLS certificate and key pair when using HTTPS communication with Kourier Ingress. - # This value overrides environment variable if defined. - certs-secret-name: "" - certs-secret-namespace: "" - - # Specifies the OTLP collector endpoint for distributed tracing. - # The endpoint format depends on the protocol (see tracing-protocol). - # Examples: - # - For HTTP: "http://otel-collector.observability.svc:4318/v1/traces" - # - For gRPC: "http://otel-collector.observability.svc:4317" - # Use an empty value to disable distributed tracing (default). - tracing-endpoint: "" - - # Protocol for tracing collector communication. - # Valid values: http/protobuf, grpc - tracing-protocol: "grpc" - - # Tracing sampling rate (0.0 to 1.0) - # Controls the percentage of requests that are traced. - # Example: "1.0" traces 100% of requests. - tracing-sampling-rate: "1.0" - - # Service name for traces - # This identifies the Kourier gateway in your tracing system. - tracing-service-name: "kourier-knative" --- # Copyright 2020 The Knative Authors # @@ -9828,7 +9524,7 @@ metadata: labels: networking.knative.dev/ingress-provider: kourier app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" app.kubernetes.io/name: knative-serving --- apiVersion: rbac.authorization.k8s.io/v1 @@ -9838,21 +9534,18 @@ metadata: labels: networking.knative.dev/ingress-provider: kourier app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" app.kubernetes.io/name: knative-serving rules: - apiGroups: [""] resources: ["events"] verbs: ["create", "update", "patch"] - apiGroups: [""] - resources: ["pods", "services", "secrets"] + resources: ["pods", "endpoints", "services", "secrets"] verbs: ["get", "list", "watch"] - apiGroups: [""] resources: ["configmaps"] verbs: ["get", "list", "watch"] - - apiGroups: ["discovery.k8s.io"] - resources: ["endpointslices"] - verbs: ["get", "list", "watch"] - apiGroups: ["coordination.k8s.io"] resources: ["leases"] verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] @@ -9870,7 +9563,7 @@ metadata: labels: networking.knative.dev/ingress-provider: kourier app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" app.kubernetes.io/name: knative-serving roleRef: apiGroup: rbac.authorization.k8s.io @@ -9903,7 +9596,7 @@ metadata: labels: networking.knative.dev/ingress-provider: kourier app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" app.kubernetes.io/name: knative-serving spec: strategy: @@ -9925,11 +9618,9 @@ spec: app: net-kourier-controller spec: containers: - - image: gcr.io/knative-releases/knative.dev/net-kourier/cmd/kourier@sha256:01abd2070ccf8680885c47990e42c05c09e30bc8595d9246f4dcd37f2220a2a2 + - image: gcr.io/knative-releases/knative.dev/net-kourier/cmd/kourier@sha256:c9016f34165c5118373c75dcc373d1cd802fe37ffa9e1bce65960942a59bc5f1 name: controller env: - # CERTS_SECRET_NAMESPACE and CERTS_SECRET_NAME can also be configured from a ConfigMap. - # Settings configured in a configmap take precedence over environment variable settings. - name: CERTS_SECRET_NAMESPACE value: "" - name: CERTS_SECRET_NAME @@ -9995,7 +9686,7 @@ metadata: labels: networking.knative.dev/ingress-provider: kourier app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" app.kubernetes.io/name: knative-serving spec: ports: @@ -10033,7 +9724,7 @@ metadata: labels: networking.knative.dev/ingress-provider: kourier app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" app.kubernetes.io/name: knative-serving spec: strategy: @@ -10068,7 +9759,7 @@ spec: env: - name: DRAIN_TIME_SECONDS value: "15" - image: docker.io/envoyproxy/envoy:v1.37-latest + image: docker.io/envoyproxy/envoy:v1.26-latest name: kourier-gateway ports: - name: http2-external @@ -10118,7 +9809,6 @@ spec: initialDelaySeconds: 10 periodSeconds: 5 failureThreshold: 3 - timeoutSeconds: 3 livenessProbe: httpGet: httpHeaders: @@ -10130,7 +9820,6 @@ spec: initialDelaySeconds: 10 periodSeconds: 5 failureThreshold: 6 - timeoutSeconds: 3 resources: requests: cpu: 200m @@ -10154,7 +9843,7 @@ metadata: labels: networking.knative.dev/ingress-provider: kourier app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" app.kubernetes.io/name: knative-serving spec: ports: @@ -10178,7 +9867,7 @@ metadata: labels: networking.knative.dev/ingress-provider: kourier app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" app.kubernetes.io/name: knative-serving spec: ports: @@ -10202,7 +9891,7 @@ metadata: labels: networking.knative.dev/ingress-provider: kourier app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" app.kubernetes.io/name: knative-serving spec: minReplicas: 1 @@ -10228,7 +9917,7 @@ metadata: labels: networking.knative.dev/ingress-provider: kourier app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" app.kubernetes.io/name: knative-serving spec: minAvailable: 80% diff --git a/packages/manifests/operators/knative-serving/v1.22.1.yaml b/packages/manifests/operators/knative-serving/v1.15.0.yaml similarity index 90% rename from packages/manifests/operators/knative-serving/v1.22.1.yaml rename to packages/manifests/operators/knative-serving/v1.15.0.yaml index bbe9e23..d3590c8 100644 --- a/packages/manifests/operators/knative-serving/v1.22.1.yaml +++ b/packages/manifests/operators/knative-serving/v1.15.0.yaml @@ -1,4 +1,4 @@ -# Source: https://github.com/knative/serving/releases/download/knative-v1.22.1/serving-crds.yaml +# Source: https://github.com/knative/serving/releases/download/knative-v1.15.0/serving-crds.yaml --- # Copyright 2020 The Knative Authors # @@ -21,7 +21,7 @@ metadata: labels: app.kubernetes.io/name: knative-serving app.kubernetes.io/component: networking - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" knative.dev/crd-install: "true" spec: group: networking.internal.knative.dev @@ -206,7 +206,7 @@ metadata: name: configurations.serving.knative.dev labels: app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" knative.dev/crd-install: "true" duck.knative.dev/podspecable: "true" spec: @@ -342,7 +342,6 @@ spec: type: array items: type: string - x-kubernetes-list-type: atomic command: description: |- Entrypoint array. Not executed within a shell. @@ -356,7 +355,6 @@ spec: type: array items: type: string - x-kubernetes-list-type: atomic env: description: |- List of environment variables to set in the container. @@ -369,9 +367,7 @@ spec: - name properties: name: - description: |- - Name of the environment variable. - May consist of any printable ASCII characters except '='. + description: Name of the environment variable. Must be a C_IDENTIFIER. type: string value: description: |- @@ -401,28 +397,23 @@ spec: name: description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string - default: "" optional: description: Specify whether the ConfigMap or its key must be defined type: boolean x-kubernetes-map-type: atomic fieldRef: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-fieldref + description: This is accessible behind a feature flag - kubernetes.podspec-fieldref type: object - x-kubernetes-map-type: atomic x-kubernetes-preserve-unknown-fields: true + x-kubernetes-map-type: atomic resourceFieldRef: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-fieldref + description: This is accessible behind a feature flag - kubernetes.podspec-fieldref type: object - x-kubernetes-map-type: atomic x-kubernetes-preserve-unknown-fields: true + x-kubernetes-map-type: atomic secretKeyRef: description: Selects a key of a secret in the pod's namespace type: object @@ -435,30 +426,24 @@ spec: name: description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string - default: "" optional: description: Specify whether the Secret or its key must be defined type: boolean x-kubernetes-map-type: atomic - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map envFrom: description: |- List of sources to populate environment variables in the container. - The keys defined within a source may consist of any printable ASCII characters except '='. - When a key exists in multiple + The keys defined within a source must be a C_IDENTIFIER. All invalid keys + will be reported as an event when the container is starting. When a key exists in multiple sources, the value associated with the last source will take precedence. Values defined by an Env with a duplicate key will take precedence. Cannot be updated. type: array items: - description: EnvFromSource represents the source of a set of ConfigMaps or Secrets + description: EnvFromSource represents the source of a set of ConfigMaps type: object properties: configMapRef: @@ -468,20 +453,15 @@ spec: name: description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string - default: "" optional: description: Specify whether the ConfigMap must be defined type: boolean x-kubernetes-map-type: atomic prefix: - description: |- - Optional text to prepend to the name of each environment variable. - May consist of any printable ASCII characters except '='. + description: An optional identifier to prepend to each key in the ConfigMap. Must be a C_IDENTIFIER. type: string secretRef: description: The Secret to select from @@ -490,17 +470,13 @@ spec: name: description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string - default: "" optional: description: Specify whether the Secret must be defined type: boolean x-kubernetes-map-type: atomic - x-kubernetes-list-type: atomic image: description: |- Container image name. @@ -525,7 +501,7 @@ spec: type: object properties: exec: - description: Exec specifies a command to execute in the container. + description: Exec specifies the action to take. type: object properties: command: @@ -538,7 +514,6 @@ spec: type: array items: type: string - x-kubernetes-list-type: atomic failureThreshold: description: |- Minimum consecutive failures for the probe to be considered failed after having succeeded. @@ -546,8 +521,10 @@ spec: type: integer format: int32 grpc: - description: GRPC specifies a GRPC HealthCheckRequest. + description: GRPC specifies an action involving a GRPC port. type: object + required: + - port properties: port: description: Port number of the gRPC service. Number must be in the range 1 to 65535. @@ -558,11 +535,11 @@ spec: Service is the name of the service to place in the gRPC HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + If this is not specified, the default behavior is defined by gRPC. type: string - default: "" httpGet: - description: HTTPGet specifies an HTTP GET request to perform. + description: HTTPGet specifies the http request to perform. type: object properties: host: @@ -588,7 +565,6 @@ spec: value: description: The header field value type: string - x-kubernetes-list-type: atomic path: description: Path to access on the HTTP server. type: string @@ -613,8 +589,7 @@ spec: type: integer format: int32 periodSeconds: - description: |- - How often (in seconds) to perform the probe. + description: How often (in seconds) to perform the probe. type: integer format: int32 successThreshold: @@ -624,7 +599,7 @@ spec: type: integer format: int32 tcpSocket: - description: TCPSocket specifies a connection to a TCP port. + description: TCPSocket specifies an action involving a TCP port. type: object properties: host: @@ -665,6 +640,8 @@ spec: items: description: ContainerPort represents a network port in a single container. type: object + required: + - containerPort properties: containerPort: description: |- @@ -684,6 +661,10 @@ spec: Defaults to "TCP". type: string default: TCP + x-kubernetes-list-map-keys: + - containerPort + - protocol + x-kubernetes-list-type: map readinessProbe: description: |- Periodic probe of container service readiness. @@ -693,7 +674,7 @@ spec: type: object properties: exec: - description: Exec specifies a command to execute in the container. + description: Exec specifies the action to take. type: object properties: command: @@ -706,7 +687,6 @@ spec: type: array items: type: string - x-kubernetes-list-type: atomic failureThreshold: description: |- Minimum consecutive failures for the probe to be considered failed after having succeeded. @@ -714,8 +694,10 @@ spec: type: integer format: int32 grpc: - description: GRPC specifies a GRPC HealthCheckRequest. + description: GRPC specifies an action involving a GRPC port. type: object + required: + - port properties: port: description: Port number of the gRPC service. Number must be in the range 1 to 65535. @@ -726,11 +708,11 @@ spec: Service is the name of the service to place in the gRPC HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + If this is not specified, the default behavior is defined by gRPC. type: string - default: "" httpGet: - description: HTTPGet specifies an HTTP GET request to perform. + description: HTTPGet specifies the http request to perform. type: object properties: host: @@ -756,7 +738,6 @@ spec: value: description: The header field value type: string - x-kubernetes-list-type: atomic path: description: Path to access on the HTTP server. type: string @@ -781,8 +762,7 @@ spec: type: integer format: int32 periodSeconds: - description: |- - How often (in seconds) to perform the probe. + description: How often (in seconds) to perform the probe. type: integer format: int32 successThreshold: @@ -792,7 +772,7 @@ spec: type: integer format: int32 tcpSocket: - description: TCPSocket specifies a connection to a TCP port. + description: TCPSocket specifies an action involving a TCP port. type: object properties: host: @@ -821,6 +801,33 @@ spec: More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ type: object properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + + This field is immutable. It can only be set for containers. + type: array + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + type: object + required: + - name + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map limits: description: |- Limits describes the maximum amount of compute resources allowed. @@ -875,18 +882,12 @@ spec: items: description: Capability represent POSIX capabilities type type: string - x-kubernetes-list-type: atomic drop: description: Removed capabilities type: array items: description: Capability represent POSIX capabilities type type: string - x-kubernetes-list-type: atomic - privileged: - description: |- - Run container in privileged mode. This can only be set to explicitly to 'false' - type: boolean readOnlyRootFilesystem: description: |- Whether this container has a read-only root filesystem. @@ -942,6 +943,7 @@ spec: type indicates which kind of seccomp profile will be applied. Valid options are: + Localhost - a profile defined in a file on the node should be used. RuntimeDefault - the container runtime default profile should be used. Unconfined - no profile should be applied. @@ -958,7 +960,7 @@ spec: type: object properties: exec: - description: Exec specifies a command to execute in the container. + description: Exec specifies the action to take. type: object properties: command: @@ -971,7 +973,6 @@ spec: type: array items: type: string - x-kubernetes-list-type: atomic failureThreshold: description: |- Minimum consecutive failures for the probe to be considered failed after having succeeded. @@ -979,8 +980,10 @@ spec: type: integer format: int32 grpc: - description: GRPC specifies a GRPC HealthCheckRequest. + description: GRPC specifies an action involving a GRPC port. type: object + required: + - port properties: port: description: Port number of the gRPC service. Number must be in the range 1 to 65535. @@ -991,11 +994,11 @@ spec: Service is the name of the service to place in the gRPC HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + If this is not specified, the default behavior is defined by gRPC. type: string - default: "" httpGet: - description: HTTPGet specifies an HTTP GET request to perform. + description: HTTPGet specifies the http request to perform. type: object properties: host: @@ -1021,7 +1024,6 @@ spec: value: description: The header field value type: string - x-kubernetes-list-type: atomic path: description: Path to access on the HTTP server. type: string @@ -1046,8 +1048,7 @@ spec: type: integer format: int32 periodSeconds: - description: |- - How often (in seconds) to perform the probe. + description: How often (in seconds) to perform the probe. type: integer format: int32 successThreshold: @@ -1057,7 +1058,7 @@ spec: type: integer format: int32 tcpSocket: - description: TCPSocket specifies a connection to a TCP port. + description: TCPSocket specifies an action involving a TCP port. type: object properties: host: @@ -1116,10 +1117,6 @@ spec: Path within the container at which the volume should be mounted. Must not contain ':'. type: string - mountPropagation: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-volumes-mount-propagation - type: string name: description: This must match the Name of a Volume. type: string @@ -1133,9 +1130,6 @@ spec: Path within the volume from which the container's volume should be mounted. Defaults to "" (volume's root). type: string - x-kubernetes-list-map-keys: - - mountPath - x-kubernetes-list-type: map workingDir: description: |- Container's working directory. @@ -1144,39 +1138,22 @@ spec: Cannot be updated. type: string dnsConfig: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-dnsconfig + description: This is accessible behind a feature flag - kubernetes.podspec-dnsconfig type: object x-kubernetes-preserve-unknown-fields: true dnsPolicy: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-dnspolicy + description: This is accessible behind a feature flag - kubernetes.podspec-dnspolicy type: string enableServiceLinks: - description: |- - EnableServiceLinks indicates whether information aboutservices should be injected into pod's environment variables, matching the syntax of Docker links. Optional: Knative defaults this to false. + description: 'EnableServiceLinks indicates whether information about services should be injected into pod''s environment variables, matching the syntax of Docker links. Optional: Knative defaults this to false.' type: boolean hostAliases: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-hostaliases + description: This is accessible behind a feature flag - kubernetes.podspec-hostaliases type: array items: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-hostaliases + description: This is accessible behind a feature flag - kubernetes.podspec-hostaliases type: object x-kubernetes-preserve-unknown-fields: true - hostIPC: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-hostipc - type: boolean - hostNetwork: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-hostnetwork - type: boolean - hostPID: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-hostpid - type: boolean idleTimeoutSeconds: description: |- IdleTimeoutSeconds is the maximum duration in seconds a request will be allowed @@ -1199,35 +1176,39 @@ spec: name: description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string - default: "" x-kubernetes-map-type: atomic - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map initContainers: description: |- - This is accessible behind a feature flag - kubernetes.podspec-init-containers + List of initialization containers belonging to the pod. + Init containers are executed in order prior to containers being started. If any + init container fails, the pod is considered to have failed and is handled according + to its restartPolicy. The name for an init container or normal container must be + unique among all containers. + Init containers may not have Lifecycle actions, Readiness probes, Liveness probes, or Startup probes. + The resourceRequirements of an init container are taken into account during scheduling + by finding the highest request/limit for each resource type, and then using the max of + of that value or the sum of the normal containers. Limits are applied to init containers + in a similar fashion. + Init containers cannot currently be added or removed. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/ type: array items: description: This is accessible behind a feature flag - kubernetes.podspec-init-containers type: object x-kubernetes-preserve-unknown-fields: true nodeSelector: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-nodeselector + description: This is accessible behind a feature flag - kubernetes.podspec-nodeselector type: object - additionalProperties: - type: string + x-kubernetes-preserve-unknown-fields: true x-kubernetes-map-type: atomic priorityClassName: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-priorityclassname + description: This is accessible behind a feature flag - kubernetes.podspec-priorityclassname type: string + x-kubernetes-preserve-unknown-fields: true responseStartTimeoutSeconds: description: |- ResponseStartTimeoutSeconds is the maximum duration in seconds that the request @@ -1236,16 +1217,15 @@ spec: type: integer format: int64 runtimeClassName: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-runtimeclassname + description: This is accessible behind a feature flag - kubernetes.podspec-runtimeclassname type: string + x-kubernetes-preserve-unknown-fields: true schedulerName: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-schedulername + description: This is accessible behind a feature flag - kubernetes.podspec-schedulername type: string + x-kubernetes-preserve-unknown-fields: true securityContext: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-securitycontext + description: This is accessible behind a feature flag - kubernetes.podspec-securitycontext type: object x-kubernetes-preserve-unknown-fields: true serviceAccountName: @@ -1254,9 +1234,9 @@ spec: More info: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/ type: string shareProcessNamespace: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-shareprocessnamespace + description: This is accessible behind a feature flag - kubernetes.podspec-shareproccessnamespace type: boolean + x-kubernetes-preserve-unknown-fields: true timeoutSeconds: description: |- TimeoutSeconds is the maximum duration in seconds that the request instance @@ -1268,13 +1248,11 @@ spec: description: This is accessible behind a feature flag - kubernetes.podspec-tolerations type: array items: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-tolerations + description: This is accessible behind a feature flag - kubernetes.podspec-tolerations type: object x-kubernetes-preserve-unknown-fields: true topologySpreadConstraints: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints + description: This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints type: array items: description: This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints @@ -1343,37 +1321,18 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string - x-kubernetes-list-type: atomic name: description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string - default: "" optional: description: optional specify whether the ConfigMap or its keys must be defined type: boolean x-kubernetes-map-type: atomic - csi: - description: This is accessible behind a feature flag - kubernetes.podspec-volumes-csi - type: object - x-kubernetes-preserve-unknown-fields: true emptyDir: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-volumes-emptydir - type: object - x-kubernetes-preserve-unknown-fields: true - hostPath: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-volumes-hostpath - type: object - x-kubernetes-preserve-unknown-fields: true - image: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-volumes-image + description: This is accessible behind a feature flag - kubernetes.podspec-emptydir type: object x-kubernetes-preserve-unknown-fields: true name: @@ -1383,8 +1342,7 @@ spec: More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string persistentVolumeClaim: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-persistent-volume-claim + description: This is accessible behind a feature flag - kubernetes.podspec-persistent-volume-claim type: object x-kubernetes-preserve-unknown-fields: true projected: @@ -1402,14 +1360,10 @@ spec: type: integer format: int32 sources: - description: |- - sources is the list of volume projections. Each entry in this list - handles one source. + description: sources is the list of volume projections type: array items: - description: |- - Projection that may be projected along with other supported volume types. - Exactly one of these fields must be set. + description: Projection that may be projected along with other supported volume types type: object properties: configMap: @@ -1453,16 +1407,12 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string - x-kubernetes-list-type: atomic name: description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string - default: "" optional: description: optional specify whether the ConfigMap or its keys must be defined type: boolean @@ -1481,7 +1431,7 @@ spec: - path properties: fieldRef: - description: 'Required: Selects a field of the pod: only annotations, labels, name, namespace and uid are supported.' + description: 'Required: Selects a field of the pod: only annotations, labels, name and namespace are supported.' type: object required: - fieldPath @@ -1528,7 +1478,6 @@ spec: description: 'Required: resource to select' type: string x-kubernetes-map-type: atomic - x-kubernetes-list-type: atomic secret: description: secret information about the secret data to project type: object @@ -1570,16 +1519,12 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string - x-kubernetes-list-type: atomic name: description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string - default: "" optional: description: optional field specify whether the Secret or its key must be defined type: boolean @@ -1612,7 +1557,6 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string - x-kubernetes-list-type: atomic secret: description: |- secret represents a secret that should populate this volume. @@ -1667,7 +1611,6 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string - x-kubernetes-list-type: atomic optional: description: optional field specify whether the Secret or its keys must be defined type: boolean @@ -1676,9 +1619,6 @@ spec: secretName is the name of the secret in the pod's namespace to use. More info: https://kubernetes.io/docs/concepts/storage/volumes#secret type: string - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map status: description: ConfigurationStatus communicates the observed state of the Configuration (from the controller). type: object @@ -1765,7 +1705,7 @@ metadata: labels: app.kubernetes.io/name: knative-serving app.kubernetes.io/component: networking - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" knative.dev/crd-install: "true" spec: group: networking.internal.knative.dev @@ -1841,7 +1781,7 @@ metadata: name: domainmappings.serving.knative.dev labels: app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" knative.dev/crd-install: "true" spec: group: serving.knative.dev @@ -1895,11 +1835,13 @@ spec: description: |- Ref specifies the target of the Domain Mapping. + The object identified by the Ref must be an Addressable with a URL of the form `{name}.{namespace}.{domain}` where `{domain}` is the cluster domain, and `{name}` and `{namespace}` are the name and namespace of a Kubernetes Service. + This contract is satisfied by Knative types such as Knative Services and Knative Routes, and by Kubernetes Services. type: object @@ -2052,7 +1994,7 @@ metadata: labels: app.kubernetes.io/name: knative-serving app.kubernetes.io/component: networking - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" knative.dev/crd-install: "true" spec: group: networking.internal.knative.dev @@ -2069,6 +2011,7 @@ spec: by a backend. An Ingress can be configured to give services externally-reachable URLs, load balance traffic, offer name based virtual hosting, etc. + This is heavily based on K8s Ingress https://godoc.org/k8s.io/api/networking/v1beta1#Ingress which some highlighted modifications. type: object @@ -2140,6 +2083,7 @@ spec: description: |- A collection of paths that map requests to backends. + If they are multiple matching paths, the first match takes precedence. type: array items: @@ -2155,6 +2099,7 @@ spec: AppendHeaders allow specifying additional HTTP headers to add before forwarding a request to the destination service. + NOTE: This differs from K8s Ingress which doesn't allow header appending. type: object additionalProperties: @@ -2189,6 +2134,7 @@ spec: description: |- RewriteHost rewrites the incoming request's host header. + This field is currently experimental and not supported by all Ingress implementations. type: string @@ -2210,6 +2156,7 @@ spec: AppendHeaders allow specifying additional HTTP headers to add before forwarding a request to the destination service. + NOTE: This differs from K8s Ingress which doesn't allow header appending. type: object additionalProperties: @@ -2219,6 +2166,7 @@ spec: Specifies the split percentage, a number between 0 and 100. If only one split is specified, we default to 100. + NOTE: This differs from K8s Ingress to allow percentage split. type: integer serviceName: @@ -2228,6 +2176,7 @@ spec: description: |- Specifies the namespace of the referenced service. + NOTE: This differs from K8s Ingress to allow routing to different namespaces. type: string servicePort: @@ -2352,6 +2301,7 @@ spec: description: |- DomainInternal is set if there is a cluster-local DNS name to access the Ingress. + NOTE: This differs from K8s Ingress, since we also desire to have a cluster-local DNS name to allow routing in case of not having a mesh. type: string @@ -2387,6 +2337,7 @@ spec: description: |- DomainInternal is set if there is a cluster-local DNS name to access the Ingress. + NOTE: This differs from K8s Ingress, since we also desire to have a cluster-local DNS name to allow routing in case of not having a mesh. type: string @@ -2439,7 +2390,7 @@ metadata: name: metrics.autoscaling.internal.knative.dev labels: app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" knative.dev/crd-install: "true" spec: group: autoscaling.internal.knative.dev @@ -2582,7 +2533,7 @@ metadata: name: podautoscalers.autoscaling.internal.knative.dev labels: app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" knative.dev/crd-install: "true" spec: group: autoscaling.internal.knative.dev @@ -2782,7 +2733,7 @@ metadata: name: revisions.serving.knative.dev labels: app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" knative.dev/crd-install: "true" spec: group: serving.knative.dev @@ -2829,6 +2780,7 @@ spec: references a container image. Revisions are created by updates to a Configuration. + See also: https://github.com/knative/serving/blob/main/docs/spec/overview.md#revision type: object properties: @@ -2894,7 +2846,6 @@ spec: type: array items: type: string - x-kubernetes-list-type: atomic command: description: |- Entrypoint array. Not executed within a shell. @@ -2908,7 +2859,6 @@ spec: type: array items: type: string - x-kubernetes-list-type: atomic env: description: |- List of environment variables to set in the container. @@ -2921,9 +2871,7 @@ spec: - name properties: name: - description: |- - Name of the environment variable. - May consist of any printable ASCII characters except '='. + description: Name of the environment variable. Must be a C_IDENTIFIER. type: string value: description: |- @@ -2953,28 +2901,23 @@ spec: name: description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string - default: "" optional: description: Specify whether the ConfigMap or its key must be defined type: boolean x-kubernetes-map-type: atomic fieldRef: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-fieldref + description: This is accessible behind a feature flag - kubernetes.podspec-fieldref type: object - x-kubernetes-map-type: atomic x-kubernetes-preserve-unknown-fields: true + x-kubernetes-map-type: atomic resourceFieldRef: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-fieldref + description: This is accessible behind a feature flag - kubernetes.podspec-fieldref type: object - x-kubernetes-map-type: atomic x-kubernetes-preserve-unknown-fields: true + x-kubernetes-map-type: atomic secretKeyRef: description: Selects a key of a secret in the pod's namespace type: object @@ -2987,30 +2930,24 @@ spec: name: description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string - default: "" optional: description: Specify whether the Secret or its key must be defined type: boolean x-kubernetes-map-type: atomic - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map envFrom: description: |- List of sources to populate environment variables in the container. - The keys defined within a source may consist of any printable ASCII characters except '='. - When a key exists in multiple + The keys defined within a source must be a C_IDENTIFIER. All invalid keys + will be reported as an event when the container is starting. When a key exists in multiple sources, the value associated with the last source will take precedence. Values defined by an Env with a duplicate key will take precedence. Cannot be updated. type: array items: - description: EnvFromSource represents the source of a set of ConfigMaps or Secrets + description: EnvFromSource represents the source of a set of ConfigMaps type: object properties: configMapRef: @@ -3020,20 +2957,15 @@ spec: name: description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string - default: "" optional: description: Specify whether the ConfigMap must be defined type: boolean x-kubernetes-map-type: atomic prefix: - description: |- - Optional text to prepend to the name of each environment variable. - May consist of any printable ASCII characters except '='. + description: An optional identifier to prepend to each key in the ConfigMap. Must be a C_IDENTIFIER. type: string secretRef: description: The Secret to select from @@ -3042,17 +2974,13 @@ spec: name: description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string - default: "" optional: description: Specify whether the Secret must be defined type: boolean x-kubernetes-map-type: atomic - x-kubernetes-list-type: atomic image: description: |- Container image name. @@ -3077,7 +3005,7 @@ spec: type: object properties: exec: - description: Exec specifies a command to execute in the container. + description: Exec specifies the action to take. type: object properties: command: @@ -3090,7 +3018,6 @@ spec: type: array items: type: string - x-kubernetes-list-type: atomic failureThreshold: description: |- Minimum consecutive failures for the probe to be considered failed after having succeeded. @@ -3098,8 +3025,10 @@ spec: type: integer format: int32 grpc: - description: GRPC specifies a GRPC HealthCheckRequest. + description: GRPC specifies an action involving a GRPC port. type: object + required: + - port properties: port: description: Port number of the gRPC service. Number must be in the range 1 to 65535. @@ -3110,11 +3039,11 @@ spec: Service is the name of the service to place in the gRPC HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + If this is not specified, the default behavior is defined by gRPC. type: string - default: "" httpGet: - description: HTTPGet specifies an HTTP GET request to perform. + description: HTTPGet specifies the http request to perform. type: object properties: host: @@ -3140,7 +3069,6 @@ spec: value: description: The header field value type: string - x-kubernetes-list-type: atomic path: description: Path to access on the HTTP server. type: string @@ -3165,8 +3093,7 @@ spec: type: integer format: int32 periodSeconds: - description: |- - How often (in seconds) to perform the probe. + description: How often (in seconds) to perform the probe. type: integer format: int32 successThreshold: @@ -3176,7 +3103,7 @@ spec: type: integer format: int32 tcpSocket: - description: TCPSocket specifies a connection to a TCP port. + description: TCPSocket specifies an action involving a TCP port. type: object properties: host: @@ -3217,6 +3144,8 @@ spec: items: description: ContainerPort represents a network port in a single container. type: object + required: + - containerPort properties: containerPort: description: |- @@ -3236,6 +3165,10 @@ spec: Defaults to "TCP". type: string default: TCP + x-kubernetes-list-map-keys: + - containerPort + - protocol + x-kubernetes-list-type: map readinessProbe: description: |- Periodic probe of container service readiness. @@ -3245,7 +3178,7 @@ spec: type: object properties: exec: - description: Exec specifies a command to execute in the container. + description: Exec specifies the action to take. type: object properties: command: @@ -3258,7 +3191,6 @@ spec: type: array items: type: string - x-kubernetes-list-type: atomic failureThreshold: description: |- Minimum consecutive failures for the probe to be considered failed after having succeeded. @@ -3266,8 +3198,10 @@ spec: type: integer format: int32 grpc: - description: GRPC specifies a GRPC HealthCheckRequest. + description: GRPC specifies an action involving a GRPC port. type: object + required: + - port properties: port: description: Port number of the gRPC service. Number must be in the range 1 to 65535. @@ -3278,11 +3212,11 @@ spec: Service is the name of the service to place in the gRPC HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + If this is not specified, the default behavior is defined by gRPC. type: string - default: "" httpGet: - description: HTTPGet specifies an HTTP GET request to perform. + description: HTTPGet specifies the http request to perform. type: object properties: host: @@ -3308,7 +3242,6 @@ spec: value: description: The header field value type: string - x-kubernetes-list-type: atomic path: description: Path to access on the HTTP server. type: string @@ -3333,8 +3266,7 @@ spec: type: integer format: int32 periodSeconds: - description: |- - How often (in seconds) to perform the probe. + description: How often (in seconds) to perform the probe. type: integer format: int32 successThreshold: @@ -3344,7 +3276,7 @@ spec: type: integer format: int32 tcpSocket: - description: TCPSocket specifies a connection to a TCP port. + description: TCPSocket specifies an action involving a TCP port. type: object properties: host: @@ -3373,6 +3305,33 @@ spec: More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ type: object properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + + This field is immutable. It can only be set for containers. + type: array + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + type: object + required: + - name + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map limits: description: |- Limits describes the maximum amount of compute resources allowed. @@ -3427,18 +3386,12 @@ spec: items: description: Capability represent POSIX capabilities type type: string - x-kubernetes-list-type: atomic drop: description: Removed capabilities type: array items: description: Capability represent POSIX capabilities type type: string - x-kubernetes-list-type: atomic - privileged: - description: |- - Run container in privileged mode. This can only be set to explicitly to 'false' - type: boolean readOnlyRootFilesystem: description: |- Whether this container has a read-only root filesystem. @@ -3494,6 +3447,7 @@ spec: type indicates which kind of seccomp profile will be applied. Valid options are: + Localhost - a profile defined in a file on the node should be used. RuntimeDefault - the container runtime default profile should be used. Unconfined - no profile should be applied. @@ -3510,7 +3464,7 @@ spec: type: object properties: exec: - description: Exec specifies a command to execute in the container. + description: Exec specifies the action to take. type: object properties: command: @@ -3523,7 +3477,6 @@ spec: type: array items: type: string - x-kubernetes-list-type: atomic failureThreshold: description: |- Minimum consecutive failures for the probe to be considered failed after having succeeded. @@ -3531,8 +3484,10 @@ spec: type: integer format: int32 grpc: - description: GRPC specifies a GRPC HealthCheckRequest. + description: GRPC specifies an action involving a GRPC port. type: object + required: + - port properties: port: description: Port number of the gRPC service. Number must be in the range 1 to 65535. @@ -3543,11 +3498,11 @@ spec: Service is the name of the service to place in the gRPC HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + If this is not specified, the default behavior is defined by gRPC. type: string - default: "" httpGet: - description: HTTPGet specifies an HTTP GET request to perform. + description: HTTPGet specifies the http request to perform. type: object properties: host: @@ -3573,7 +3528,6 @@ spec: value: description: The header field value type: string - x-kubernetes-list-type: atomic path: description: Path to access on the HTTP server. type: string @@ -3598,8 +3552,7 @@ spec: type: integer format: int32 periodSeconds: - description: |- - How often (in seconds) to perform the probe. + description: How often (in seconds) to perform the probe. type: integer format: int32 successThreshold: @@ -3609,7 +3562,7 @@ spec: type: integer format: int32 tcpSocket: - description: TCPSocket specifies a connection to a TCP port. + description: TCPSocket specifies an action involving a TCP port. type: object properties: host: @@ -3668,10 +3621,6 @@ spec: Path within the container at which the volume should be mounted. Must not contain ':'. type: string - mountPropagation: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-volumes-mount-propagation - type: string name: description: This must match the Name of a Volume. type: string @@ -3685,9 +3634,6 @@ spec: Path within the volume from which the container's volume should be mounted. Defaults to "" (volume's root). type: string - x-kubernetes-list-map-keys: - - mountPath - x-kubernetes-list-type: map workingDir: description: |- Container's working directory. @@ -3696,39 +3642,22 @@ spec: Cannot be updated. type: string dnsConfig: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-dnsconfig + description: This is accessible behind a feature flag - kubernetes.podspec-dnsconfig type: object x-kubernetes-preserve-unknown-fields: true dnsPolicy: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-dnspolicy + description: This is accessible behind a feature flag - kubernetes.podspec-dnspolicy type: string enableServiceLinks: - description: |- - EnableServiceLinks indicates whether information aboutservices should be injected into pod's environment variables, matching the syntax of Docker links. Optional: Knative defaults this to false. + description: 'EnableServiceLinks indicates whether information about services should be injected into pod''s environment variables, matching the syntax of Docker links. Optional: Knative defaults this to false.' type: boolean hostAliases: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-hostaliases + description: This is accessible behind a feature flag - kubernetes.podspec-hostaliases type: array items: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-hostaliases + description: This is accessible behind a feature flag - kubernetes.podspec-hostaliases type: object x-kubernetes-preserve-unknown-fields: true - hostIPC: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-hostipc - type: boolean - hostNetwork: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-hostnetwork - type: boolean - hostPID: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-hostpid - type: boolean idleTimeoutSeconds: description: |- IdleTimeoutSeconds is the maximum duration in seconds a request will be allowed @@ -3751,35 +3680,39 @@ spec: name: description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string - default: "" x-kubernetes-map-type: atomic - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map initContainers: description: |- - This is accessible behind a feature flag - kubernetes.podspec-init-containers + List of initialization containers belonging to the pod. + Init containers are executed in order prior to containers being started. If any + init container fails, the pod is considered to have failed and is handled according + to its restartPolicy. The name for an init container or normal container must be + unique among all containers. + Init containers may not have Lifecycle actions, Readiness probes, Liveness probes, or Startup probes. + The resourceRequirements of an init container are taken into account during scheduling + by finding the highest request/limit for each resource type, and then using the max of + of that value or the sum of the normal containers. Limits are applied to init containers + in a similar fashion. + Init containers cannot currently be added or removed. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/ type: array items: description: This is accessible behind a feature flag - kubernetes.podspec-init-containers type: object x-kubernetes-preserve-unknown-fields: true nodeSelector: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-nodeselector + description: This is accessible behind a feature flag - kubernetes.podspec-nodeselector type: object - additionalProperties: - type: string + x-kubernetes-preserve-unknown-fields: true x-kubernetes-map-type: atomic priorityClassName: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-priorityclassname + description: This is accessible behind a feature flag - kubernetes.podspec-priorityclassname type: string + x-kubernetes-preserve-unknown-fields: true responseStartTimeoutSeconds: description: |- ResponseStartTimeoutSeconds is the maximum duration in seconds that the request @@ -3788,16 +3721,15 @@ spec: type: integer format: int64 runtimeClassName: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-runtimeclassname + description: This is accessible behind a feature flag - kubernetes.podspec-runtimeclassname type: string + x-kubernetes-preserve-unknown-fields: true schedulerName: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-schedulername + description: This is accessible behind a feature flag - kubernetes.podspec-schedulername type: string + x-kubernetes-preserve-unknown-fields: true securityContext: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-securitycontext + description: This is accessible behind a feature flag - kubernetes.podspec-securitycontext type: object x-kubernetes-preserve-unknown-fields: true serviceAccountName: @@ -3806,9 +3738,9 @@ spec: More info: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/ type: string shareProcessNamespace: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-shareprocessnamespace + description: This is accessible behind a feature flag - kubernetes.podspec-shareproccessnamespace type: boolean + x-kubernetes-preserve-unknown-fields: true timeoutSeconds: description: |- TimeoutSeconds is the maximum duration in seconds that the request instance @@ -3820,13 +3752,11 @@ spec: description: This is accessible behind a feature flag - kubernetes.podspec-tolerations type: array items: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-tolerations + description: This is accessible behind a feature flag - kubernetes.podspec-tolerations type: object x-kubernetes-preserve-unknown-fields: true topologySpreadConstraints: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints + description: This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints type: array items: description: This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints @@ -3895,37 +3825,18 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string - x-kubernetes-list-type: atomic name: description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string - default: "" optional: description: optional specify whether the ConfigMap or its keys must be defined type: boolean x-kubernetes-map-type: atomic - csi: - description: This is accessible behind a feature flag - kubernetes.podspec-volumes-csi - type: object - x-kubernetes-preserve-unknown-fields: true emptyDir: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-volumes-emptydir - type: object - x-kubernetes-preserve-unknown-fields: true - hostPath: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-volumes-hostpath - type: object - x-kubernetes-preserve-unknown-fields: true - image: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-volumes-image + description: This is accessible behind a feature flag - kubernetes.podspec-emptydir type: object x-kubernetes-preserve-unknown-fields: true name: @@ -3935,8 +3846,7 @@ spec: More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string persistentVolumeClaim: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-persistent-volume-claim + description: This is accessible behind a feature flag - kubernetes.podspec-persistent-volume-claim type: object x-kubernetes-preserve-unknown-fields: true projected: @@ -3954,14 +3864,10 @@ spec: type: integer format: int32 sources: - description: |- - sources is the list of volume projections. Each entry in this list - handles one source. + description: sources is the list of volume projections type: array items: - description: |- - Projection that may be projected along with other supported volume types. - Exactly one of these fields must be set. + description: Projection that may be projected along with other supported volume types type: object properties: configMap: @@ -4005,16 +3911,12 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string - x-kubernetes-list-type: atomic name: description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string - default: "" optional: description: optional specify whether the ConfigMap or its keys must be defined type: boolean @@ -4033,7 +3935,7 @@ spec: - path properties: fieldRef: - description: 'Required: Selects a field of the pod: only annotations, labels, name, namespace and uid are supported.' + description: 'Required: Selects a field of the pod: only annotations, labels, name and namespace are supported.' type: object required: - fieldPath @@ -4080,7 +3982,6 @@ spec: description: 'Required: resource to select' type: string x-kubernetes-map-type: atomic - x-kubernetes-list-type: atomic secret: description: secret information about the secret data to project type: object @@ -4122,16 +4023,12 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string - x-kubernetes-list-type: atomic name: description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string - default: "" optional: description: optional field specify whether the Secret or its key must be defined type: boolean @@ -4164,7 +4061,6 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string - x-kubernetes-list-type: atomic secret: description: |- secret represents a secret that should populate this volume. @@ -4219,7 +4115,6 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string - x-kubernetes-list-type: atomic optional: description: optional field specify whether the Secret or its keys must be defined type: boolean @@ -4228,9 +4123,6 @@ spec: secretName is the name of the secret in the pod's namespace to use. More info: https://kubernetes.io/docs/concepts/storage/volumes#secret type: string - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map status: description: RevisionStatus communicates the observed state of the Revision (from the controller). type: object @@ -4290,7 +4182,7 @@ spec: The digests are resolved during the creation of Revision. ContainerStatuses holds the container name and image digests for both serving and non serving containers. - ref: https://bit.ly/image-digests + ref: http://bit.ly/image-digests type: array items: description: ContainerStatus holds the information of container name and image digest value @@ -4311,7 +4203,7 @@ spec: The digests are resolved during the creation of Revision. ContainerStatuses holds the container name and image digests for both serving and non serving containers. - ref: https://bit.ly/image-digests + ref: http://bit.ly/image-digests type: array items: description: ContainerStatus holds the information of container name and image digest value @@ -4355,7 +4247,7 @@ metadata: name: routes.serving.knative.dev labels: app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" knative.dev/crd-install: "true" duck.knative.dev/addressable: "true" spec: @@ -4625,7 +4517,7 @@ metadata: labels: app.kubernetes.io/name: knative-serving app.kubernetes.io/component: networking - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" knative.dev/crd-install: "true" spec: group: networking.internal.knative.dev @@ -4698,6 +4590,7 @@ spec: the event) or if no container name is specified "spec.containers[2]" (container with index 2 in this pod). This syntax is chosen only to have some well-defined way of referencing a part of an object. + TODO: this design is not final and this field is subject to change in the future. type: string kind: description: |- @@ -4848,7 +4741,7 @@ metadata: name: services.serving.knative.dev labels: app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" knative.dev/crd-install: "true" duck.knative.dev/addressable: "true" duck.knative.dev/podspecable: "true" @@ -4899,9 +4792,11 @@ spec: underlying Routes and Configurations (much as a kubernetes Deployment orchestrates ReplicaSets), and its usage is optional but recommended. + The Service's controller will track the statuses of its owned Configuration and Route, reflecting their statuses and conditions as its own. + See also: https://github.com/knative/serving/blob/main/docs/spec/overview.md#service type: object properties: @@ -5002,7 +4897,6 @@ spec: type: array items: type: string - x-kubernetes-list-type: atomic command: description: |- Entrypoint array. Not executed within a shell. @@ -5016,7 +4910,6 @@ spec: type: array items: type: string - x-kubernetes-list-type: atomic env: description: |- List of environment variables to set in the container. @@ -5029,9 +4922,7 @@ spec: - name properties: name: - description: |- - Name of the environment variable. - May consist of any printable ASCII characters except '='. + description: Name of the environment variable. Must be a C_IDENTIFIER. type: string value: description: |- @@ -5061,28 +4952,23 @@ spec: name: description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string - default: "" optional: description: Specify whether the ConfigMap or its key must be defined type: boolean x-kubernetes-map-type: atomic fieldRef: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-fieldref + description: This is accessible behind a feature flag - kubernetes.podspec-fieldref type: object - x-kubernetes-map-type: atomic x-kubernetes-preserve-unknown-fields: true + x-kubernetes-map-type: atomic resourceFieldRef: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-fieldref + description: This is accessible behind a feature flag - kubernetes.podspec-fieldref type: object - x-kubernetes-map-type: atomic x-kubernetes-preserve-unknown-fields: true + x-kubernetes-map-type: atomic secretKeyRef: description: Selects a key of a secret in the pod's namespace type: object @@ -5095,30 +4981,24 @@ spec: name: description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string - default: "" optional: description: Specify whether the Secret or its key must be defined type: boolean x-kubernetes-map-type: atomic - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map envFrom: description: |- List of sources to populate environment variables in the container. - The keys defined within a source may consist of any printable ASCII characters except '='. - When a key exists in multiple + The keys defined within a source must be a C_IDENTIFIER. All invalid keys + will be reported as an event when the container is starting. When a key exists in multiple sources, the value associated with the last source will take precedence. Values defined by an Env with a duplicate key will take precedence. Cannot be updated. type: array items: - description: EnvFromSource represents the source of a set of ConfigMaps or Secrets + description: EnvFromSource represents the source of a set of ConfigMaps type: object properties: configMapRef: @@ -5128,20 +5008,15 @@ spec: name: description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string - default: "" optional: description: Specify whether the ConfigMap must be defined type: boolean x-kubernetes-map-type: atomic prefix: - description: |- - Optional text to prepend to the name of each environment variable. - May consist of any printable ASCII characters except '='. + description: An optional identifier to prepend to each key in the ConfigMap. Must be a C_IDENTIFIER. type: string secretRef: description: The Secret to select from @@ -5150,17 +5025,13 @@ spec: name: description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string - default: "" optional: description: Specify whether the Secret must be defined type: boolean x-kubernetes-map-type: atomic - x-kubernetes-list-type: atomic image: description: |- Container image name. @@ -5185,7 +5056,7 @@ spec: type: object properties: exec: - description: Exec specifies a command to execute in the container. + description: Exec specifies the action to take. type: object properties: command: @@ -5198,7 +5069,6 @@ spec: type: array items: type: string - x-kubernetes-list-type: atomic failureThreshold: description: |- Minimum consecutive failures for the probe to be considered failed after having succeeded. @@ -5206,8 +5076,10 @@ spec: type: integer format: int32 grpc: - description: GRPC specifies a GRPC HealthCheckRequest. + description: GRPC specifies an action involving a GRPC port. type: object + required: + - port properties: port: description: Port number of the gRPC service. Number must be in the range 1 to 65535. @@ -5218,11 +5090,11 @@ spec: Service is the name of the service to place in the gRPC HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + If this is not specified, the default behavior is defined by gRPC. type: string - default: "" httpGet: - description: HTTPGet specifies an HTTP GET request to perform. + description: HTTPGet specifies the http request to perform. type: object properties: host: @@ -5248,7 +5120,6 @@ spec: value: description: The header field value type: string - x-kubernetes-list-type: atomic path: description: Path to access on the HTTP server. type: string @@ -5273,8 +5144,7 @@ spec: type: integer format: int32 periodSeconds: - description: |- - How often (in seconds) to perform the probe. + description: How often (in seconds) to perform the probe. type: integer format: int32 successThreshold: @@ -5284,7 +5154,7 @@ spec: type: integer format: int32 tcpSocket: - description: TCPSocket specifies a connection to a TCP port. + description: TCPSocket specifies an action involving a TCP port. type: object properties: host: @@ -5325,6 +5195,8 @@ spec: items: description: ContainerPort represents a network port in a single container. type: object + required: + - containerPort properties: containerPort: description: |- @@ -5344,6 +5216,10 @@ spec: Defaults to "TCP". type: string default: TCP + x-kubernetes-list-map-keys: + - containerPort + - protocol + x-kubernetes-list-type: map readinessProbe: description: |- Periodic probe of container service readiness. @@ -5353,7 +5229,7 @@ spec: type: object properties: exec: - description: Exec specifies a command to execute in the container. + description: Exec specifies the action to take. type: object properties: command: @@ -5366,7 +5242,6 @@ spec: type: array items: type: string - x-kubernetes-list-type: atomic failureThreshold: description: |- Minimum consecutive failures for the probe to be considered failed after having succeeded. @@ -5374,8 +5249,10 @@ spec: type: integer format: int32 grpc: - description: GRPC specifies a GRPC HealthCheckRequest. + description: GRPC specifies an action involving a GRPC port. type: object + required: + - port properties: port: description: Port number of the gRPC service. Number must be in the range 1 to 65535. @@ -5386,11 +5263,11 @@ spec: Service is the name of the service to place in the gRPC HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + If this is not specified, the default behavior is defined by gRPC. type: string - default: "" httpGet: - description: HTTPGet specifies an HTTP GET request to perform. + description: HTTPGet specifies the http request to perform. type: object properties: host: @@ -5416,7 +5293,6 @@ spec: value: description: The header field value type: string - x-kubernetes-list-type: atomic path: description: Path to access on the HTTP server. type: string @@ -5441,8 +5317,7 @@ spec: type: integer format: int32 periodSeconds: - description: |- - How often (in seconds) to perform the probe. + description: How often (in seconds) to perform the probe. type: integer format: int32 successThreshold: @@ -5452,7 +5327,7 @@ spec: type: integer format: int32 tcpSocket: - description: TCPSocket specifies a connection to a TCP port. + description: TCPSocket specifies an action involving a TCP port. type: object properties: host: @@ -5481,6 +5356,33 @@ spec: More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ type: object properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + + This field is immutable. It can only be set for containers. + type: array + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + type: object + required: + - name + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map limits: description: |- Limits describes the maximum amount of compute resources allowed. @@ -5535,18 +5437,12 @@ spec: items: description: Capability represent POSIX capabilities type type: string - x-kubernetes-list-type: atomic drop: description: Removed capabilities type: array items: description: Capability represent POSIX capabilities type type: string - x-kubernetes-list-type: atomic - privileged: - description: |- - Run container in privileged mode. This can only be set to explicitly to 'false' - type: boolean readOnlyRootFilesystem: description: |- Whether this container has a read-only root filesystem. @@ -5602,6 +5498,7 @@ spec: type indicates which kind of seccomp profile will be applied. Valid options are: + Localhost - a profile defined in a file on the node should be used. RuntimeDefault - the container runtime default profile should be used. Unconfined - no profile should be applied. @@ -5618,7 +5515,7 @@ spec: type: object properties: exec: - description: Exec specifies a command to execute in the container. + description: Exec specifies the action to take. type: object properties: command: @@ -5631,7 +5528,6 @@ spec: type: array items: type: string - x-kubernetes-list-type: atomic failureThreshold: description: |- Minimum consecutive failures for the probe to be considered failed after having succeeded. @@ -5639,8 +5535,10 @@ spec: type: integer format: int32 grpc: - description: GRPC specifies a GRPC HealthCheckRequest. + description: GRPC specifies an action involving a GRPC port. type: object + required: + - port properties: port: description: Port number of the gRPC service. Number must be in the range 1 to 65535. @@ -5651,11 +5549,11 @@ spec: Service is the name of the service to place in the gRPC HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + If this is not specified, the default behavior is defined by gRPC. type: string - default: "" httpGet: - description: HTTPGet specifies an HTTP GET request to perform. + description: HTTPGet specifies the http request to perform. type: object properties: host: @@ -5681,7 +5579,6 @@ spec: value: description: The header field value type: string - x-kubernetes-list-type: atomic path: description: Path to access on the HTTP server. type: string @@ -5706,8 +5603,7 @@ spec: type: integer format: int32 periodSeconds: - description: |- - How often (in seconds) to perform the probe. + description: How often (in seconds) to perform the probe. type: integer format: int32 successThreshold: @@ -5717,7 +5613,7 @@ spec: type: integer format: int32 tcpSocket: - description: TCPSocket specifies a connection to a TCP port. + description: TCPSocket specifies an action involving a TCP port. type: object properties: host: @@ -5776,10 +5672,6 @@ spec: Path within the container at which the volume should be mounted. Must not contain ':'. type: string - mountPropagation: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-volumes-mount-propagation - type: string name: description: This must match the Name of a Volume. type: string @@ -5793,9 +5685,6 @@ spec: Path within the volume from which the container's volume should be mounted. Defaults to "" (volume's root). type: string - x-kubernetes-list-map-keys: - - mountPath - x-kubernetes-list-type: map workingDir: description: |- Container's working directory. @@ -5804,39 +5693,22 @@ spec: Cannot be updated. type: string dnsConfig: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-dnsconfig + description: This is accessible behind a feature flag - kubernetes.podspec-dnsconfig type: object x-kubernetes-preserve-unknown-fields: true dnsPolicy: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-dnspolicy + description: This is accessible behind a feature flag - kubernetes.podspec-dnspolicy type: string enableServiceLinks: - description: |- - EnableServiceLinks indicates whether information aboutservices should be injected into pod's environment variables, matching the syntax of Docker links. Optional: Knative defaults this to false. + description: 'EnableServiceLinks indicates whether information about services should be injected into pod''s environment variables, matching the syntax of Docker links. Optional: Knative defaults this to false.' type: boolean hostAliases: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-hostaliases + description: This is accessible behind a feature flag - kubernetes.podspec-hostaliases type: array items: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-hostaliases + description: This is accessible behind a feature flag - kubernetes.podspec-hostaliases type: object x-kubernetes-preserve-unknown-fields: true - hostIPC: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-hostipc - type: boolean - hostNetwork: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-hostnetwork - type: boolean - hostPID: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-hostpid - type: boolean idleTimeoutSeconds: description: |- IdleTimeoutSeconds is the maximum duration in seconds a request will be allowed @@ -5859,35 +5731,39 @@ spec: name: description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string - default: "" x-kubernetes-map-type: atomic - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map initContainers: description: |- - This is accessible behind a feature flag - kubernetes.podspec-init-containers + List of initialization containers belonging to the pod. + Init containers are executed in order prior to containers being started. If any + init container fails, the pod is considered to have failed and is handled according + to its restartPolicy. The name for an init container or normal container must be + unique among all containers. + Init containers may not have Lifecycle actions, Readiness probes, Liveness probes, or Startup probes. + The resourceRequirements of an init container are taken into account during scheduling + by finding the highest request/limit for each resource type, and then using the max of + of that value or the sum of the normal containers. Limits are applied to init containers + in a similar fashion. + Init containers cannot currently be added or removed. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/ type: array items: description: This is accessible behind a feature flag - kubernetes.podspec-init-containers type: object x-kubernetes-preserve-unknown-fields: true nodeSelector: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-nodeselector + description: This is accessible behind a feature flag - kubernetes.podspec-nodeselector type: object - additionalProperties: - type: string + x-kubernetes-preserve-unknown-fields: true x-kubernetes-map-type: atomic priorityClassName: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-priorityclassname + description: This is accessible behind a feature flag - kubernetes.podspec-priorityclassname type: string + x-kubernetes-preserve-unknown-fields: true responseStartTimeoutSeconds: description: |- ResponseStartTimeoutSeconds is the maximum duration in seconds that the request @@ -5896,16 +5772,15 @@ spec: type: integer format: int64 runtimeClassName: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-runtimeclassname + description: This is accessible behind a feature flag - kubernetes.podspec-runtimeclassname type: string + x-kubernetes-preserve-unknown-fields: true schedulerName: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-schedulername + description: This is accessible behind a feature flag - kubernetes.podspec-schedulername type: string + x-kubernetes-preserve-unknown-fields: true securityContext: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-securitycontext + description: This is accessible behind a feature flag - kubernetes.podspec-securitycontext type: object x-kubernetes-preserve-unknown-fields: true serviceAccountName: @@ -5914,9 +5789,9 @@ spec: More info: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/ type: string shareProcessNamespace: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-shareprocessnamespace + description: This is accessible behind a feature flag - kubernetes.podspec-shareproccessnamespace type: boolean + x-kubernetes-preserve-unknown-fields: true timeoutSeconds: description: |- TimeoutSeconds is the maximum duration in seconds that the request instance @@ -5928,13 +5803,11 @@ spec: description: This is accessible behind a feature flag - kubernetes.podspec-tolerations type: array items: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-tolerations + description: This is accessible behind a feature flag - kubernetes.podspec-tolerations type: object x-kubernetes-preserve-unknown-fields: true topologySpreadConstraints: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints + description: This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints type: array items: description: This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints @@ -6003,37 +5876,18 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string - x-kubernetes-list-type: atomic name: description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string - default: "" optional: description: optional specify whether the ConfigMap or its keys must be defined type: boolean x-kubernetes-map-type: atomic - csi: - description: This is accessible behind a feature flag - kubernetes.podspec-volumes-csi - type: object - x-kubernetes-preserve-unknown-fields: true emptyDir: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-volumes-emptydir - type: object - x-kubernetes-preserve-unknown-fields: true - hostPath: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-volumes-hostpath - type: object - x-kubernetes-preserve-unknown-fields: true - image: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-volumes-image + description: This is accessible behind a feature flag - kubernetes.podspec-emptydir type: object x-kubernetes-preserve-unknown-fields: true name: @@ -6043,8 +5897,7 @@ spec: More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string persistentVolumeClaim: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-persistent-volume-claim + description: This is accessible behind a feature flag - kubernetes.podspec-persistent-volume-claim type: object x-kubernetes-preserve-unknown-fields: true projected: @@ -6062,14 +5915,10 @@ spec: type: integer format: int32 sources: - description: |- - sources is the list of volume projections. Each entry in this list - handles one source. + description: sources is the list of volume projections type: array items: - description: |- - Projection that may be projected along with other supported volume types. - Exactly one of these fields must be set. + description: Projection that may be projected along with other supported volume types type: object properties: configMap: @@ -6113,16 +5962,12 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string - x-kubernetes-list-type: atomic name: description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string - default: "" optional: description: optional specify whether the ConfigMap or its keys must be defined type: boolean @@ -6141,7 +5986,7 @@ spec: - path properties: fieldRef: - description: 'Required: Selects a field of the pod: only annotations, labels, name, namespace and uid are supported.' + description: 'Required: Selects a field of the pod: only annotations, labels, name and namespace are supported.' type: object required: - fieldPath @@ -6188,7 +6033,6 @@ spec: description: 'Required: resource to select' type: string x-kubernetes-map-type: atomic - x-kubernetes-list-type: atomic secret: description: secret information about the secret data to project type: object @@ -6230,16 +6074,12 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string - x-kubernetes-list-type: atomic name: description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string - default: "" optional: description: optional field specify whether the Secret or its key must be defined type: boolean @@ -6272,7 +6112,6 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string - x-kubernetes-list-type: atomic secret: description: |- secret represents a secret that should populate this volume. @@ -6327,7 +6166,6 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string - x-kubernetes-list-type: atomic optional: description: optional field specify whether the Secret or its keys must be defined type: boolean @@ -6336,9 +6174,6 @@ spec: secretName is the name of the secret in the pod's namespace to use. More info: https://kubernetes.io/docs/concepts/storage/volumes#secret type: string - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map traffic: description: |- Traffic specifies how to distribute traffic over a collection of @@ -6554,7 +6389,7 @@ metadata: name: images.caching.internal.knative.dev labels: app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" knative.dev/crd-install: "true" spec: group: caching.internal.knative.dev @@ -6619,12 +6454,9 @@ spec: name: description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string - default: "" x-kubernetes-map-type: atomic serviceAccountName: description: |- @@ -6692,7 +6524,7 @@ spec: type: string jsonPath: .spec.image --- -# Source: https://github.com/knative/serving/releases/download/knative-v1.22.1/serving-core.yaml +# Source: https://github.com/knative/serving/releases/download/knative-v1.15.0/serving-core.yaml --- # Copyright 2018 The Knative Authors # @@ -6714,7 +6546,7 @@ metadata: name: knative-serving labels: app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" --- # Copyright 2023 The Knative Authors # @@ -6737,7 +6569,7 @@ metadata: namespace: knative-serving labels: serving.knative.dev/controller: "true" - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" app.kubernetes.io/name: knative-serving rules: - apiGroups: [""] @@ -6754,7 +6586,7 @@ metadata: name: knative-serving-activator-cluster labels: serving.knative.dev/controller: "true" - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" app.kubernetes.io/name: knative-serving rules: - apiGroups: [""] @@ -6786,7 +6618,7 @@ metadata: # (which should be identical, but isn't guaranteed to be installed alongside serving). name: knative-serving-aggregated-addressable-resolver labels: - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" app.kubernetes.io/name: knative-serving aggregationRule: clusterRoleSelectors: @@ -6798,7 +6630,7 @@ apiVersion: rbac.authorization.k8s.io/v1 metadata: name: knative-serving-addressable-resolver labels: - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" app.kubernetes.io/name: knative-serving # Labeled to facilitate aggregated cluster roles that act on Addressables. duck.knative.dev/addressable: "true" @@ -6836,7 +6668,7 @@ metadata: name: knative-serving-namespaced-admin labels: rbac.authorization.k8s.io/aggregate-to-admin: "true" - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" app.kubernetes.io/name: knative-serving rules: - apiGroups: ["serving.knative.dev"] @@ -6852,7 +6684,7 @@ metadata: name: knative-serving-namespaced-edit labels: rbac.authorization.k8s.io/aggregate-to-edit: "true" - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" app.kubernetes.io/name: knative-serving rules: - apiGroups: ["serving.knative.dev"] @@ -6868,7 +6700,7 @@ metadata: name: knative-serving-namespaced-view labels: rbac.authorization.k8s.io/aggregate-to-view: "true" - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" app.kubernetes.io/name: knative-serving rules: - apiGroups: ["serving.knative.dev", "networking.internal.knative.dev", "autoscaling.internal.knative.dev", "caching.internal.knative.dev"] @@ -6895,7 +6727,7 @@ metadata: name: knative-serving-core labels: serving.knative.dev/controller: "true" - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" app.kubernetes.io/name: knative-serving rules: - apiGroups: [""] @@ -6904,15 +6736,9 @@ rules: - apiGroups: [""] resources: ["endpoints/restricted"] # Permission for RestrictedEndpointsAdmission verbs: ["create"] - - apiGroups: ["discovery.k8s.io"] - resources: ["endpointslices/restricted"] # Permission for RestrictedEndpointsAdmission - verbs: ["create"] - apiGroups: [""] resources: ["namespaces/finalizers"] # finalizers are needed for the owner reference of the webhook verbs: ["update"] - - apiGroups: ["discovery.k8s.io"] - resources: ["endpointslices"] - verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] - apiGroups: ["apps"] resources: ["deployments", "deployments/finalizers"] # finalizers are needed for the owner reference of the webhook verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] @@ -6944,9 +6770,6 @@ rules: resources: ["clusterroles"] verbs: ["delete"] resourceNames: ["knative-serving-certmanager"] - - apiGroups: ["*"] - resources: ["*/scale"] - verbs: ["patch"] --- # Copyright 2019 The Knative Authors # @@ -6967,7 +6790,7 @@ apiVersion: rbac.authorization.k8s.io/v1 metadata: name: knative-serving-podspecable-binding labels: - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" app.kubernetes.io/name: knative-serving # Labeled to facilitate aggregated cluster roles that act on PodSpecables. duck.knative.dev/podspecable: "true" @@ -7005,7 +6828,7 @@ metadata: labels: app.kubernetes.io/component: controller app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" --- kind: ClusterRole apiVersion: rbac.authorization.k8s.io/v1 @@ -7013,7 +6836,7 @@ metadata: name: knative-serving-admin labels: app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" aggregationRule: clusterRoleSelectors: - matchLabels: @@ -7026,7 +6849,7 @@ metadata: labels: app.kubernetes.io/component: controller app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" subjects: - kind: ServiceAccount name: controller @@ -7043,7 +6866,7 @@ metadata: labels: app.kubernetes.io/component: controller app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" subjects: - kind: ServiceAccount name: controller @@ -7061,7 +6884,7 @@ metadata: labels: app.kubernetes.io/component: activator app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding @@ -7071,7 +6894,7 @@ metadata: labels: app.kubernetes.io/component: activator app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" subjects: - kind: ServiceAccount name: activator @@ -7088,7 +6911,7 @@ metadata: labels: app.kubernetes.io/component: activator app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" subjects: - kind: ServiceAccount name: activator @@ -7135,11 +6958,11 @@ metadata: labels: app.kubernetes.io/component: queue-proxy app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" spec: # This is the Go import path for the binary that is containerized # and substituted here. - image: gcr.io/knative-releases/knative.dev/serving/cmd/queue@sha256:b1af8bda6c1d32b1cf5fbf8f1f6068c5007a5cebf091039fdea83b88b1fd87f4 + image: gcr.io/knative-releases/knative.dev/serving/cmd/queue@sha256:d313c823f25a09326a7c3c2ec9833c5e005791bc3acb4036ebf33735cbb62bee --- # Copyright 2018 The Knative Authors # @@ -7163,9 +6986,9 @@ metadata: labels: app.kubernetes.io/component: autoscaler app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" annotations: - knative.dev/example-checksum: "c727b3e8" + knative.dev/example-checksum: "47c2487f" data: _example: | ################################ @@ -7315,7 +7138,7 @@ data: # The `unit` is one concurrent request proxied by the activator. # activator-capacity must be at least 1. # This value is used for computation of the Activator subset size. - # See the algorithm here: https://bit.ly/38XiCZ3. + # See the algorithm here: http://bit.ly/38XiCZ3. # TODO(vagababov): tune after actual benchmarking. activator-capacity: "100.0" @@ -7373,7 +7196,7 @@ metadata: labels: app.kubernetes.io/name: knative-serving app.kubernetes.io/component: controller - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" networking.knative.dev/certificate-provider: cert-manager annotations: knative.dev/example-checksum: "b7a9a602" @@ -7442,7 +7265,7 @@ metadata: labels: app.kubernetes.io/name: knative-serving app.kubernetes.io/component: controller - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" annotations: knative.dev/example-checksum: "5b64ff5c" data: @@ -7596,13 +7419,13 @@ metadata: labels: app.kubernetes.io/name: knative-serving app.kubernetes.io/component: controller - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" annotations: - knative.dev/example-checksum: "555b4826" + knative.dev/example-checksum: "720ddb97" data: # This is the Go import path for the binary that is containerized # and substituted here. - queue-sidecar-image: gcr.io/knative-releases/knative.dev/serving/cmd/queue@sha256:b1af8bda6c1d32b1cf5fbf8f1f6068c5007a5cebf091039fdea83b88b1fd87f4 + queue-sidecar-image: gcr.io/knative-releases/knative.dev/serving/cmd/queue@sha256:d313c823f25a09326a7c3c2ec9833c5e005791bc3acb4036ebf33735cbb62bee _example: |- ################################ # # @@ -7668,25 +7491,6 @@ data: # If omitted, or empty, no rootCA is added to the golang rootCAs queue-sidecar-rootca: "" - # Sets the minimum TLS version for the queue proxy sidecar's TLS server. - # Accepted values: "1.2", "1.3". Default is "1.3" if not specified. - queue-sidecar-tls-min-version: "" - - # Sets the maximum TLS version for the queue proxy sidecar's TLS server. - # Accepted values: "1.2", "1.3". If omitted, the Go default is used. - queue-sidecar-tls-max-version: "" - - # Sets the cipher suites for the queue proxy sidecar's TLS server. - # Comma-separated list of cipher suite names (e.g. "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"). - # If omitted, the Go default cipher suites are used. - # Note: cipher suites are not configurable in TLS 1.3. - queue-sidecar-tls-cipher-suites: "" - - # Sets the elliptic curve preferences for the queue proxy sidecar's TLS server. - # Comma-separated list of curve names (e.g. "X25519,CurveP256"). - # If omitted, the Go default curves are used. - queue-sidecar-tls-curve-preferences: "" - # If set, it automatically configures pod anti-affinity requirements for all Knative services. # It employs the `preferredDuringSchedulingIgnoredDuringExecution` weighted pod affinity term, # aligning with the Knative revision label. It yields the configuration below in all workloads' deployments: @@ -7718,15 +7522,6 @@ data: # selector: # use-gvisor: "please" runtime-class-name: "" - - # pod-is-always-schedulable can be used to define that Pods in the system will always be - # scheduled, and a Revision should not be marked unschedulable. - # Setting this to `true` makes sense if you have cluster-autoscaling set up for your cluster - # where unschedulable Pods trigger the addition of a new Node and are therefore a short and - # transient state. - # - # See https://github.com/knative/serving/issues/14862 - pod-is-always-schedulable: "false" --- # Copyright 2018 The Knative Authors # @@ -7750,7 +7545,7 @@ metadata: labels: app.kubernetes.io/name: knative-serving app.kubernetes.io/component: controller - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" annotations: knative.dev/example-checksum: "26c09de5" data: @@ -7814,9 +7609,9 @@ metadata: labels: app.kubernetes.io/name: knative-serving app.kubernetes.io/component: controller - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" annotations: - knative.dev/example-checksum: "bee75b26" + knative.dev/example-checksum: "632d47dd" data: _example: |- ################################ @@ -7837,11 +7632,8 @@ data: # Default SecurityContext settings to secure-by-default values # if unset. # - # Disabled - do nothing; no security options are applied - # AllowRootBounded - Applies secure defaults without enforcing strict policies; sets seccompProfile - # to RuntimeDefault and drops all capabilities - # Enabled - Enforces security defaults; sets seccompProfile to RuntimeDefault, drops all capabilities, - # and sets runAsNonRoot to true if not already specified. + # This value will default to "enabled" in a future release, + # probably Knative 1.10 secure-pod-defaults: "disabled" # Indicates whether multi container support is enabled @@ -7935,24 +7727,6 @@ data: # See: https://knative.dev/docs/serving/configuration/feature-flags/#kubernetes-share-process-namespace kubernetes.podspec-shareprocessnamespace: "disabled" - # Indicates whether hostIPC support is enabled - # - # WARNING: Cannot safely be disabled once enabled. - # See https://knative.dev/docs/serving/configuration/feature-flags/#kubernetes-host-ipc - kubernetes.podspec-hostipc: "disabled" - - # Indicates whether hostPID support is enabled - # - # WARNING: Cannot safely be disabled once enabled. - # See https://knative.dev/docs/serving/configuration/feature-flags/#kubernetes-host-pid - kubernetes.podspec-hostpid: "disabled" - - # Indicates whether hostNetwork support is enabled - # - # WARNING: Cannot safely be disabled once enabled. - # See See https://knative.dev/docs/serving/configuration/feature-flags/#kubernetes-host-network - kubernetes.podspec-hostnetwork: "disabled" - # Indicates whether Kubernetes PriorityClassName support is enabled # # WARNING: Cannot safely be disabled once enabled. @@ -7971,6 +7745,15 @@ data: # For a list of possible capabilities, see https://man7.org/linux/man-pages/man7/capabilities.7.html kubernetes.containerspec-addcapabilities: "disabled" + # This feature validates PodSpecs from the validating webhook + # against the K8s API Server. + # + # When "enabled", the server will always run the extra validation. + # When "allowed", the server will not run the dry-run validation by default. + # However, clients may enable the behavior on an individual Service by + # attaching the following metadata annotation: "features.knative.dev/podspec-dryrun":"enabled". + # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-dry-run + kubernetes.podspec-dryrun: "allowed" # Controls whether tag header based routing feature are enabled or not. # 1. Enabled: enabling tag header based routing @@ -7988,24 +7771,6 @@ data: # 2. Disabled: disabling EmptyDir volume support kubernetes.podspec-volumes-emptydir: "enabled" - # Controls whether volume support for image is enabled or not. - # 1. Enabled: enabling image volume support - # 2. Disabled: disabling image volume support - kubernetes.podspec-volumes-image: "disabled" - - # Controls whether volume support for HostPath is enabled or not. - # WARNING: Cannot safely be disabled once enabled. - # WARNING: If you can avoid using a hostPath volume, you should. - # Please read https://kubernetes.io/docs/concepts/storage/volumes/#hostpath before enabling this feature. - # 1. Enabled: enabling HostPath volume support - # 2. Disabled: disabling HostPath volume support - kubernetes.podspec-volumes-hostpath: "disabled" - - # Controls whether volume support for CSI is enabled or not. - # 1. Enabled: enabling CSI volume support - # 2. Disabled: disabling CSI volume support - kubernetes.podspec-volumes-csi: "disabled" - # Controls whether init containers support is enabled or not. # 1. Enabled: enabling init containers support # 2. Disabled: disabling init containers support @@ -8021,18 +7786,13 @@ data: # 2. Disabled: disabling write access for persistent volumes kubernetes.podspec-persistent-volume-write: "disabled" - # Controls whether volume mount propagation support is enabled or not. - # 1. Enabled: enabling volume mount propagation support - # 2. Disabled: disabling volume mount propagation support - kubernetes.podspec-volumes-mount-propagation: "disabled" - # Controls if the queue proxy podInfo feature is enabled, allowed or disabled # # This feature should be enabled/allowed when using queue proxy Options (Extensions) # Enabling will mount a podInfo volume to the queue proxy container. # The volume will contains an 'annotations' file (from the pod's annotation field). # The annotations in this file include the Service annotations set by the client creating the service. - # If mounted, the annotations can be accessed by queue proxy extensions at /etc/podinfo/annotations + # If mounted, the annotations can be accessed by queue proxy extensions at /etc/podinfo/annnotations # # 1. "enabled": always mount a podInfo volume # 2. "disabled": never mount a podInfo volume @@ -8068,7 +7828,7 @@ metadata: labels: app.kubernetes.io/name: knative-serving app.kubernetes.io/component: controller - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" annotations: knative.dev/example-checksum: "aa3813a8" data: @@ -8167,7 +7927,7 @@ metadata: labels: app.kubernetes.io/name: knative-serving app.kubernetes.io/component: controller - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" annotations: knative.dev/example-checksum: "f4b71f57" data: @@ -8226,7 +7986,7 @@ metadata: name: config-logging namespace: knative-serving labels: - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" app.kubernetes.io/component: logging app.kubernetes.io/name: knative-serving annotations: @@ -8308,7 +8068,7 @@ metadata: labels: app.kubernetes.io/name: knative-serving app.kubernetes.io/component: networking - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" annotations: knative.dev/example-checksum: "0573e07d" data: @@ -8512,9 +8272,9 @@ metadata: labels: app.kubernetes.io/name: knative-serving app.kubernetes.io/component: observability - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" annotations: - knative.dev/example-checksum: "59abacb5" + knative.dev/example-checksum: "54abd711" data: _example: | ################################ @@ -8572,70 +8332,42 @@ data: # PodIP string // IP of the pod hosting the revision # } # - logging.request-log-template: '{"httpRequest": {"requestMethod": "{{.Request.Method}}", "requestUrl": "{{js .Request.RequestURI}}", "requestSize": "{{.Request.ContentLength}}", "status": {{.Response.Code}}, "responseSize": "{{.Response.Size}}", "userAgent": "{{js .Request.UserAgent}}", "remoteIp": "{{js .Request.RemoteAddr}}", "serverIp": "{{.Revision.PodIP}}", "referer": "{{js .Request.Referer}}", "latency": "{{.Response.Latency}}s", "protocol": "{{.Request.Proto}}"}, "traceId": "{{.TraceID}}"}' + logging.request-log-template: '{"httpRequest": {"requestMethod": "{{.Request.Method}}", "requestUrl": "{{js .Request.RequestURI}}", "requestSize": "{{.Request.ContentLength}}", "status": {{.Response.Code}}, "responseSize": "{{.Response.Size}}", "userAgent": "{{js .Request.UserAgent}}", "remoteIp": "{{js .Request.RemoteAddr}}", "serverIp": "{{.Revision.PodIP}}", "referer": "{{js .Request.Referer}}", "latency": "{{.Response.Latency}}s", "protocol": "{{.Request.Proto}}"}, "traceId": "{{index .Request.Header "X-B3-Traceid"}}"}' # If true, the request logging will be enabled. + # NB: up to and including Knative version 0.18 if logging.request-log-template is non-empty, this value + # will be ignored. logging.enable-request-log: "false" # If true, this enables queue proxy writing request logs for probe requests to stdout. # It uses the same template for user requests, i.e. logging.request-log-template. logging.enable-probe-request-log: "false" - # metrics-protocol field specifies the protocol used when exporting metrics - # It supports either 'none' (the default), 'prometheus', 'http/protobuf' (OTLP HTTP), 'grpc' (OTLP gRPC) - metrics-protocol: http/protobuf - - # metrics-endpoint field specifies the destination metrics should be exporter to. - # - # The endpoint MUST be set when the protocol is http/protobuf or grpc. - # The endpoint MUST NOT be set when the protocol is none. - # - # When the protocol is prometheus the endpoint can accept a 'host:port' string to customize the - # listening host interface and port. - metrics-endpoint: http://example.com/v1/traces - - # metrics-export-interval specifies the global metrics reporting period for control and data plane components. - # If a zero or negative value is passed the default reporting OTel period is used (60 secs). - metrics-export-interval: 60s + # metrics.backend-destination field specifies the system metrics destination. + # It supports either prometheus (the default) or opencensus. + metrics.backend-destination: prometheus - # request-metrics-protocol field specifies the protocol used when exporting queue-proxy metrics - # It supports either 'none' (the default), 'prometheus', 'http/protobuf' (OTLP HTTP), 'grpc' (OTLP gRPC) - request-metrics-protocol: http/protobuf + # metrics.reporting-period-seconds specifies the global metrics reporting period for control and data plane components. + # If a zero or negative value is passed the default reporting period is used (10 secs). + # If the attribute is not specified a default value is used per metrics backend. + # For the prometheus backend the default reporting period is 5s while for opencensus it is 60s. + metrics.reporting-period-seconds: "5" - # request-metrics-endpoint field specifies the destination metrics from the queue proxy should be exporter to. - # - # The endpoint MUST be set when the protocol is http/protobuf or grpc. - # The endpoint MUST NOT be set when the protocol is none. - # - # When the protocol is prometheus the endpoint can accept a 'host:port' string to customize the - # listening host interface and port. - request-metrics-endpoint: http://promstack-kube-prometheus-prometheus.observability:9090/api/v1/otlp/v1/metrics + # metrics.request-metrics-backend-destination specifies the request metrics + # destination. It enables queue proxy to send request metrics. + # Currently supported values: prometheus (the default), opencensus. + metrics.request-metrics-backend-destination: prometheus - # request-metrics-export-interval specifies the global metrics reporting period for the queue-proxy. - # - # If a zero or negative value is passed the default reporting OTel period is used (60 secs). - request-metrics-export-interval: 60s + # metrics.request-metrics-reporting-period-seconds specifies the request metrics reporting period in sec at queue proxy. + # If a zero or negative value is passed the default reporting period is used (10 secs). + # If the attribute is not specified, it is overridden by the value of metrics.reporting-period-seconds. + metrics.request-metrics-reporting-period-seconds: "5" - # runtime-profiling indicates whether it is allowed to retrieve runtime profiling data from + # profiling.enable indicates whether it is allowed to retrieve runtime profiling data from # the pods via an HTTP server in the format expected by the pprof visualization tool. When # enabled, the Knative Serving pods expose the profiling data on an alternate HTTP port 8008. # The HTTP context root for profiling is then /debug/pprof/. - runtime-profiling: enabled - - # tracing-protocol field specifies the protocol used when exporting traces - # It supports either 'none' (the default), 'http/protobuf' (OTLP HTTP), 'grpc' (OTLP gRPC) - # or `stdout` for debugging purposes - tracing-protocol: http/protobuf - - # tracing-endpoint field specifies the destination traces should be exporter to. - # - # The endpoint MUST be set when the protocol is http/protobuf or grpc. - # The endpoint MUST NOT be set when the protocol is none. - tracing-endpoint: http://jaeger-collector.observability:4318/v1/traces - - # tracing-sampling-rate allows the user to specify what percentage of all traces should be exported - # The value should be between 0 (never sample) to 1 (always sample) - tracing-sampling-rate: "1" + profiling.enable: "false" --- # Copyright 2019 The Knative Authors # @@ -8659,16 +8391,39 @@ metadata: labels: app.kubernetes.io/name: knative-serving app.kubernetes.io/component: tracing - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" annotations: - knative.dev/example-checksum: "04c7e9a3" + knative.dev/example-checksum: "26614636" data: _example: | - ########################################################### - # # - # This config is deprecated - use config-observability # - # # - ########################################################### + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this example block and unindented to be in the data block + # to actually change the configuration. + # + # This may be "zipkin" or "none" (default) + backend: "none" + + # URL to zipkin collector where traces are sent. + # This must be specified when backend is "zipkin" + zipkin-endpoint: "http://zipkin.istio-system.svc.cluster.local:9411/api/v2/spans" + + # Enable zipkin debug mode. This allows all spans to be sent to the server + # bypassing sampling. + debug: "false" + + # Percentage (0-1) of requests to trace + sample-rate: "0.1" --- # Copyright 2020 The Knative Authors # @@ -8692,7 +8447,7 @@ metadata: labels: app.kubernetes.io/component: activator app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" spec: minReplicas: 1 maxReplicas: 20 @@ -8720,7 +8475,7 @@ metadata: labels: app.kubernetes.io/component: activator app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" spec: minAvailable: 80% selector: @@ -8748,7 +8503,7 @@ metadata: namespace: knative-serving labels: app.kubernetes.io/component: activator - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" app.kubernetes.io/name: knative-serving spec: selector: @@ -8762,7 +8517,7 @@ spec: role: activator app.kubernetes.io/component: activator app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" spec: # To avoid node becoming SPOF, spread our replicas to different nodes. affinity: @@ -8779,7 +8534,7 @@ spec: - name: activator # This is the Go import path for the binary that is containerized # and substituted here. - image: gcr.io/knative-releases/knative.dev/serving/cmd/activator@sha256:5deaef961fef8d1417f6d4a4dfae2fc338f2d30d72c4ad58c3ab392b2c04705b + image: gcr.io/knative-releases/knative.dev/serving/cmd/activator@sha256:b6d7d96edd8942d679757249f6aa07373461411104ce7c93309f23fba2884f8f # The numbers are based on performance test results from # https://github.com/knative/serving/issues/1625#issuecomment-511930023 resources: @@ -8809,6 +8564,9 @@ spec: value: config-logging - name: CONFIG_OBSERVABILITY_NAME value: config-observability + # TODO(https://github.com/knative/pkg/pull/953): Remove stackdriver specific config + - name: METRICS_DOMAIN + value: knative.dev/internal/serving securityContext: allowPrivilegeEscalation: false readOnlyRootFilesystem: true @@ -8855,7 +8613,7 @@ metadata: labels: app: activator app.kubernetes.io/component: activator - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" app.kubernetes.io/name: knative-serving spec: selector: @@ -8901,7 +8659,7 @@ metadata: labels: app.kubernetes.io/component: autoscaler app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" spec: replicas: 1 selector: @@ -8917,7 +8675,7 @@ spec: app: autoscaler app.kubernetes.io/component: autoscaler app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" spec: # To avoid node becoming SPOF, spread our replicas to different nodes. affinity: @@ -8934,7 +8692,7 @@ spec: - name: autoscaler # This is the Go import path for the binary that is containerized # and substituted here. - image: gcr.io/knative-releases/knative.dev/serving/cmd/autoscaler@sha256:5bae38655d87df86b041083fbe51791816473245f752432ba9b85a7b12f73cd5 + image: gcr.io/knative-releases/knative.dev/serving/cmd/autoscaler@sha256:119157d871eb3db5a54944464d9920ad378d35292d4c12fd4a765cd016e24f0f resources: requests: cpu: 100m @@ -8959,6 +8717,9 @@ spec: value: config-logging - name: CONFIG_OBSERVABILITY_NAME value: config-observability + # TODO(https://github.com/knative/pkg/pull/953): Remove stackdriver specific config + - name: METRICS_DOMAIN + value: knative.dev/serving securityContext: allowPrivilegeEscalation: false readOnlyRootFilesystem: true @@ -8990,7 +8751,7 @@ metadata: app: autoscaler app.kubernetes.io/component: autoscaler app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" name: autoscaler namespace: knative-serving spec: @@ -9030,7 +8791,7 @@ metadata: labels: app.kubernetes.io/component: controller app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" spec: selector: matchLabels: @@ -9041,7 +8802,7 @@ spec: app: controller app.kubernetes.io/component: controller app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" spec: # To avoid node becoming SPOF, spread our replicas to different nodes. affinity: @@ -9058,7 +8819,7 @@ spec: - name: controller # This is the Go import path for the binary that is containerized # and substituted here. - image: gcr.io/knative-releases/knative.dev/serving/cmd/controller@sha256:94329d85200c2fc31ed1166a26568ca1357376c149c147e71f400cf28be3c816 + image: gcr.io/knative-releases/knative.dev/serving/cmd/controller@sha256:80b9865a585900af6cecead24babe03aa79487e9e6306da1444b04148c21c96f resources: requests: cpu: 100m @@ -9079,6 +8840,9 @@ spec: value: config-logging - name: CONFIG_OBSERVABILITY_NAME value: config-observability + # TODO(https://github.com/knative/pkg/pull/953): Remove stackdriver specific config + - name: METRICS_DOMAIN + value: knative.dev/internal/serving securityContext: allowPrivilegeEscalation: false readOnlyRootFilesystem: true @@ -9117,7 +8881,7 @@ metadata: app: controller app.kubernetes.io/component: controller app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" name: controller namespace: knative-serving spec: @@ -9154,7 +8918,7 @@ metadata: labels: app.kubernetes.io/component: webhook app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" spec: minReplicas: 1 maxReplicas: 5 @@ -9180,7 +8944,7 @@ metadata: labels: app.kubernetes.io/component: webhook app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" spec: minAvailable: 80% selector: @@ -9208,7 +8972,7 @@ metadata: namespace: knative-serving labels: app.kubernetes.io/component: webhook - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" app.kubernetes.io/name: knative-serving spec: selector: @@ -9221,7 +8985,7 @@ spec: app: webhook role: webhook app.kubernetes.io/component: webhook - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" app.kubernetes.io/name: knative-serving spec: # To avoid node becoming SPOF, spread our replicas to different nodes. @@ -9239,7 +9003,7 @@ spec: - name: webhook # This is the Go import path for the binary that is containerized # and substituted here. - image: gcr.io/knative-releases/knative.dev/serving/cmd/webhook@sha256:8470456be214e93a84e3c7b79a632aa9978bd8ecda553feaa47878a2c24ab84d + image: gcr.io/knative-releases/knative.dev/serving/cmd/webhook@sha256:732d9cdf7f5fa5c6055d26b1aa5aad40e3d74ba9f2cb76a1db0f0e4d072b7cd0 resources: requests: cpu: 100m @@ -9264,6 +9028,9 @@ spec: value: webhook - name: WEBHOOK_PORT value: "8443" + # TODO(https://github.com/knative/pkg/pull/953): Remove stackdriver specific config + - name: METRICS_DOMAIN + value: knative.dev/internal/serving securityContext: allowPrivilegeEscalation: false readOnlyRootFilesystem: true @@ -9303,7 +9070,7 @@ metadata: app: webhook role: webhook app.kubernetes.io/component: webhook - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" app.kubernetes.io/name: knative-serving name: webhook namespace: knative-serving @@ -9344,7 +9111,7 @@ metadata: labels: app.kubernetes.io/component: webhook app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" webhooks: - admissionReviewVersions: ["v1", "v1beta1"] clientConfig: @@ -9385,7 +9152,7 @@ metadata: labels: app.kubernetes.io/component: webhook app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" webhooks: - admissionReviewVersions: ["v1", "v1beta1"] clientConfig: @@ -9441,7 +9208,7 @@ metadata: labels: app.kubernetes.io/component: webhook app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" webhooks: - admissionReviewVersions: ["v1", "v1beta1"] clientConfig: @@ -9499,10 +9266,10 @@ metadata: labels: app.kubernetes.io/component: webhook app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" # The data is populated at install time. --- -# Source: https://github.com/knative-extensions/net-kourier/releases/download/knative-v1.22.1/kourier.yaml +# Source: https://github.com/knative-extensions/net-kourier/releases/download/knative-v1.15.0/kourier.yaml --- # Copyright 2020 The Knative Authors # @@ -9526,7 +9293,7 @@ metadata: networking.knative.dev/ingress-provider: kourier app.kubernetes.io/name: knative-serving app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" --- # Copyright 2020 The Knative Authors # @@ -9550,7 +9317,7 @@ metadata: labels: networking.knative.dev/ingress-provider: kourier app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" app.kubernetes.io/name: knative-serving data: envoy-bootstrap.yaml: | @@ -9678,7 +9445,7 @@ metadata: labels: networking.knative.dev/ingress-provider: kourier app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" app.kubernetes.io/name: knative-serving data: _example: | @@ -9702,11 +9469,6 @@ data: # probes etc. must be configured via the bootstrap config. enable-service-access-logging: "true" - # Specifies the format of the access log used by the Kourier gateway. - # This template follows the envoy format. - # see: https://www.envoyproxy.io/docs/envoy/latest/configuration/observability/access_log/usage#access-logging - service-access-log-template: "" - # Specifies whether to use proxy-protocol in order to safely # transport connection information such as a client's address # across multiple layers of TCP proxies. @@ -9735,76 +9497,10 @@ data: # right side of the x-forwarded-for HTTP header to trust. trusted-hops-count: "0" - # Configures the connection manager to use the real remote address - # of the client connection when determining internal versus external origin and manipulating various headers. - use-remote-address: "false" - # Specifies the cipher suites for TLS external listener. # Use ',' separated values like "ECDHE-ECDSA-AES128-GCM-SHA256,ECDHE-ECDSA-CHACHA20-POLY1305" # The default uses the default cipher suites of the envoy version. cipher-suites: "" - - # Disable the Envoy server header injection in the response when response has no such header. - disable-envoy-server-header: "false" - - # The external authorization service and port, my-auth:2222. - # This value overrides environment variable if defined. - extauthz-host: "" - - # The protocol used to query the ext auth service. Can be one of : grpc, http, https. Defaults to grpc - # This value overrides environment variable if defined. - extauthz-protocol: "grpc" - - # Allow traffic to go through if the ext auth service is down. Accepts true/false. - # This value overrides environment variable if defined. - extauthz-failure-mode-allow: "" - - # Max request bytes, if not set, defaults to 8192 Bytes. More info Envoy Docs - # see: https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/http/ext_authz/v3/ext_authz.proto.html#extensions-filters-http-ext-authz-v3-buffersettings - # This value overrides environment variable if defined. - extauthz-max-request-body-bytes: 8192 - - # Max time in ms to wait for the ext authz service. Defaults to 2000 ms - # This value overrides environment variable if defined. - extauthz-timeout: 2000 - - # If extauthz-protocol is equal to http or https, path to query the ext auth service. - # Example : if set to /verify, it will query /verify/ (notice the trailing /). If not set, it will query / - # This value overrides environment variable if defined. - extauthz-path-prefix: "" - - # If extauthz-protocol is equal to grpc, sends the body as raw bytes instead of a UTF-8 string. - # Accepts only true/false, t/f or 1/0. Attempting to set another value will throw an error. - # Defaults to false. More info Envoy Docs. - # see: https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/http/ext_authz/v3/ext_authz.proto.html#extensions-filters-http-ext-authz-v3-buffersettings - # This value overrides environment variable if defined. - extauthz-pack-as-byte: "false" - - # Specifies the secret that contains the TLS certificate and key pair when using HTTPS communication with Kourier Ingress. - # This value overrides environment variable if defined. - certs-secret-name: "" - certs-secret-namespace: "" - - # Specifies the OTLP collector endpoint for distributed tracing. - # The endpoint format depends on the protocol (see tracing-protocol). - # Examples: - # - For HTTP: "http://otel-collector.observability.svc:4318/v1/traces" - # - For gRPC: "http://otel-collector.observability.svc:4317" - # Use an empty value to disable distributed tracing (default). - tracing-endpoint: "" - - # Protocol for tracing collector communication. - # Valid values: http/protobuf, grpc - tracing-protocol: "grpc" - - # Tracing sampling rate (0.0 to 1.0) - # Controls the percentage of requests that are traced. - # Example: "1.0" traces 100% of requests. - tracing-sampling-rate: "1.0" - - # Service name for traces - # This identifies the Kourier gateway in your tracing system. - tracing-service-name: "kourier-knative" --- # Copyright 2020 The Knative Authors # @@ -9828,7 +9524,7 @@ metadata: labels: networking.knative.dev/ingress-provider: kourier app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" app.kubernetes.io/name: knative-serving --- apiVersion: rbac.authorization.k8s.io/v1 @@ -9838,21 +9534,18 @@ metadata: labels: networking.knative.dev/ingress-provider: kourier app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" app.kubernetes.io/name: knative-serving rules: - apiGroups: [""] resources: ["events"] verbs: ["create", "update", "patch"] - apiGroups: [""] - resources: ["pods", "services", "secrets"] + resources: ["pods", "endpoints", "services", "secrets"] verbs: ["get", "list", "watch"] - apiGroups: [""] resources: ["configmaps"] verbs: ["get", "list", "watch"] - - apiGroups: ["discovery.k8s.io"] - resources: ["endpointslices"] - verbs: ["get", "list", "watch"] - apiGroups: ["coordination.k8s.io"] resources: ["leases"] verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] @@ -9870,7 +9563,7 @@ metadata: labels: networking.knative.dev/ingress-provider: kourier app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" app.kubernetes.io/name: knative-serving roleRef: apiGroup: rbac.authorization.k8s.io @@ -9903,7 +9596,7 @@ metadata: labels: networking.knative.dev/ingress-provider: kourier app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" app.kubernetes.io/name: knative-serving spec: strategy: @@ -9925,11 +9618,9 @@ spec: app: net-kourier-controller spec: containers: - - image: gcr.io/knative-releases/knative.dev/net-kourier/cmd/kourier@sha256:01abd2070ccf8680885c47990e42c05c09e30bc8595d9246f4dcd37f2220a2a2 + - image: gcr.io/knative-releases/knative.dev/net-kourier/cmd/kourier@sha256:c9016f34165c5118373c75dcc373d1cd802fe37ffa9e1bce65960942a59bc5f1 name: controller env: - # CERTS_SECRET_NAMESPACE and CERTS_SECRET_NAME can also be configured from a ConfigMap. - # Settings configured in a configmap take precedence over environment variable settings. - name: CERTS_SECRET_NAMESPACE value: "" - name: CERTS_SECRET_NAME @@ -9995,7 +9686,7 @@ metadata: labels: networking.knative.dev/ingress-provider: kourier app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" app.kubernetes.io/name: knative-serving spec: ports: @@ -10033,7 +9724,7 @@ metadata: labels: networking.knative.dev/ingress-provider: kourier app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" app.kubernetes.io/name: knative-serving spec: strategy: @@ -10068,7 +9759,7 @@ spec: env: - name: DRAIN_TIME_SECONDS value: "15" - image: docker.io/envoyproxy/envoy:v1.37-latest + image: docker.io/envoyproxy/envoy:v1.26-latest name: kourier-gateway ports: - name: http2-external @@ -10118,7 +9809,6 @@ spec: initialDelaySeconds: 10 periodSeconds: 5 failureThreshold: 3 - timeoutSeconds: 3 livenessProbe: httpGet: httpHeaders: @@ -10130,7 +9820,6 @@ spec: initialDelaySeconds: 10 periodSeconds: 5 failureThreshold: 6 - timeoutSeconds: 3 resources: requests: cpu: 200m @@ -10154,7 +9843,7 @@ metadata: labels: networking.knative.dev/ingress-provider: kourier app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" app.kubernetes.io/name: knative-serving spec: ports: @@ -10178,7 +9867,7 @@ metadata: labels: networking.knative.dev/ingress-provider: kourier app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" app.kubernetes.io/name: knative-serving spec: ports: @@ -10202,7 +9891,7 @@ metadata: labels: networking.knative.dev/ingress-provider: kourier app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" app.kubernetes.io/name: knative-serving spec: minReplicas: 1 @@ -10228,7 +9917,7 @@ metadata: labels: networking.knative.dev/ingress-provider: kourier app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" app.kubernetes.io/name: knative-serving spec: minAvailable: 80% diff --git a/packages/manifests/operators/knative-serving/v1.22.1/01-serving-crds.yaml b/packages/manifests/operators/knative-serving/v1.15.0/01-serving-crds.yaml similarity index 91% rename from packages/manifests/operators/knative-serving/v1.22.1/01-serving-crds.yaml rename to packages/manifests/operators/knative-serving/v1.15.0/01-serving-crds.yaml index fabc647..a026f16 100644 --- a/packages/manifests/operators/knative-serving/v1.22.1/01-serving-crds.yaml +++ b/packages/manifests/operators/knative-serving/v1.15.0/01-serving-crds.yaml @@ -1,4 +1,4 @@ -# Source: https://github.com/knative/serving/releases/download/knative-v1.22.1/serving-crds.yaml +# Source: https://github.com/knative/serving/releases/download/knative-v1.15.0/serving-crds.yaml # Copyright 2020 The Knative Authors # # Licensed under the Apache License, Version 2.0 (the "License"); @@ -20,7 +20,7 @@ metadata: labels: app.kubernetes.io/name: knative-serving app.kubernetes.io/component: networking - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" knative.dev/crd-install: "true" spec: group: networking.internal.knative.dev @@ -205,7 +205,7 @@ metadata: name: configurations.serving.knative.dev labels: app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" knative.dev/crd-install: "true" duck.knative.dev/podspecable: "true" spec: @@ -341,7 +341,6 @@ spec: type: array items: type: string - x-kubernetes-list-type: atomic command: description: |- Entrypoint array. Not executed within a shell. @@ -355,7 +354,6 @@ spec: type: array items: type: string - x-kubernetes-list-type: atomic env: description: |- List of environment variables to set in the container. @@ -368,9 +366,7 @@ spec: - name properties: name: - description: |- - Name of the environment variable. - May consist of any printable ASCII characters except '='. + description: Name of the environment variable. Must be a C_IDENTIFIER. type: string value: description: |- @@ -400,28 +396,23 @@ spec: name: description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string - default: "" optional: description: Specify whether the ConfigMap or its key must be defined type: boolean x-kubernetes-map-type: atomic fieldRef: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-fieldref + description: This is accessible behind a feature flag - kubernetes.podspec-fieldref type: object - x-kubernetes-map-type: atomic x-kubernetes-preserve-unknown-fields: true + x-kubernetes-map-type: atomic resourceFieldRef: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-fieldref + description: This is accessible behind a feature flag - kubernetes.podspec-fieldref type: object - x-kubernetes-map-type: atomic x-kubernetes-preserve-unknown-fields: true + x-kubernetes-map-type: atomic secretKeyRef: description: Selects a key of a secret in the pod's namespace type: object @@ -434,30 +425,24 @@ spec: name: description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string - default: "" optional: description: Specify whether the Secret or its key must be defined type: boolean x-kubernetes-map-type: atomic - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map envFrom: description: |- List of sources to populate environment variables in the container. - The keys defined within a source may consist of any printable ASCII characters except '='. - When a key exists in multiple + The keys defined within a source must be a C_IDENTIFIER. All invalid keys + will be reported as an event when the container is starting. When a key exists in multiple sources, the value associated with the last source will take precedence. Values defined by an Env with a duplicate key will take precedence. Cannot be updated. type: array items: - description: EnvFromSource represents the source of a set of ConfigMaps or Secrets + description: EnvFromSource represents the source of a set of ConfigMaps type: object properties: configMapRef: @@ -467,20 +452,15 @@ spec: name: description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string - default: "" optional: description: Specify whether the ConfigMap must be defined type: boolean x-kubernetes-map-type: atomic prefix: - description: |- - Optional text to prepend to the name of each environment variable. - May consist of any printable ASCII characters except '='. + description: An optional identifier to prepend to each key in the ConfigMap. Must be a C_IDENTIFIER. type: string secretRef: description: The Secret to select from @@ -489,17 +469,13 @@ spec: name: description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string - default: "" optional: description: Specify whether the Secret must be defined type: boolean x-kubernetes-map-type: atomic - x-kubernetes-list-type: atomic image: description: |- Container image name. @@ -524,7 +500,7 @@ spec: type: object properties: exec: - description: Exec specifies a command to execute in the container. + description: Exec specifies the action to take. type: object properties: command: @@ -537,7 +513,6 @@ spec: type: array items: type: string - x-kubernetes-list-type: atomic failureThreshold: description: |- Minimum consecutive failures for the probe to be considered failed after having succeeded. @@ -545,8 +520,10 @@ spec: type: integer format: int32 grpc: - description: GRPC specifies a GRPC HealthCheckRequest. + description: GRPC specifies an action involving a GRPC port. type: object + required: + - port properties: port: description: Port number of the gRPC service. Number must be in the range 1 to 65535. @@ -557,11 +534,11 @@ spec: Service is the name of the service to place in the gRPC HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + If this is not specified, the default behavior is defined by gRPC. type: string - default: "" httpGet: - description: HTTPGet specifies an HTTP GET request to perform. + description: HTTPGet specifies the http request to perform. type: object properties: host: @@ -587,7 +564,6 @@ spec: value: description: The header field value type: string - x-kubernetes-list-type: atomic path: description: Path to access on the HTTP server. type: string @@ -612,8 +588,7 @@ spec: type: integer format: int32 periodSeconds: - description: |- - How often (in seconds) to perform the probe. + description: How often (in seconds) to perform the probe. type: integer format: int32 successThreshold: @@ -623,7 +598,7 @@ spec: type: integer format: int32 tcpSocket: - description: TCPSocket specifies a connection to a TCP port. + description: TCPSocket specifies an action involving a TCP port. type: object properties: host: @@ -664,6 +639,8 @@ spec: items: description: ContainerPort represents a network port in a single container. type: object + required: + - containerPort properties: containerPort: description: |- @@ -683,6 +660,10 @@ spec: Defaults to "TCP". type: string default: TCP + x-kubernetes-list-map-keys: + - containerPort + - protocol + x-kubernetes-list-type: map readinessProbe: description: |- Periodic probe of container service readiness. @@ -692,7 +673,7 @@ spec: type: object properties: exec: - description: Exec specifies a command to execute in the container. + description: Exec specifies the action to take. type: object properties: command: @@ -705,7 +686,6 @@ spec: type: array items: type: string - x-kubernetes-list-type: atomic failureThreshold: description: |- Minimum consecutive failures for the probe to be considered failed after having succeeded. @@ -713,8 +693,10 @@ spec: type: integer format: int32 grpc: - description: GRPC specifies a GRPC HealthCheckRequest. + description: GRPC specifies an action involving a GRPC port. type: object + required: + - port properties: port: description: Port number of the gRPC service. Number must be in the range 1 to 65535. @@ -725,11 +707,11 @@ spec: Service is the name of the service to place in the gRPC HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + If this is not specified, the default behavior is defined by gRPC. type: string - default: "" httpGet: - description: HTTPGet specifies an HTTP GET request to perform. + description: HTTPGet specifies the http request to perform. type: object properties: host: @@ -755,7 +737,6 @@ spec: value: description: The header field value type: string - x-kubernetes-list-type: atomic path: description: Path to access on the HTTP server. type: string @@ -780,8 +761,7 @@ spec: type: integer format: int32 periodSeconds: - description: |- - How often (in seconds) to perform the probe. + description: How often (in seconds) to perform the probe. type: integer format: int32 successThreshold: @@ -791,7 +771,7 @@ spec: type: integer format: int32 tcpSocket: - description: TCPSocket specifies a connection to a TCP port. + description: TCPSocket specifies an action involving a TCP port. type: object properties: host: @@ -820,6 +800,33 @@ spec: More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ type: object properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + + This field is immutable. It can only be set for containers. + type: array + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + type: object + required: + - name + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map limits: description: |- Limits describes the maximum amount of compute resources allowed. @@ -874,18 +881,12 @@ spec: items: description: Capability represent POSIX capabilities type type: string - x-kubernetes-list-type: atomic drop: description: Removed capabilities type: array items: description: Capability represent POSIX capabilities type type: string - x-kubernetes-list-type: atomic - privileged: - description: |- - Run container in privileged mode. This can only be set to explicitly to 'false' - type: boolean readOnlyRootFilesystem: description: |- Whether this container has a read-only root filesystem. @@ -941,6 +942,7 @@ spec: type indicates which kind of seccomp profile will be applied. Valid options are: + Localhost - a profile defined in a file on the node should be used. RuntimeDefault - the container runtime default profile should be used. Unconfined - no profile should be applied. @@ -957,7 +959,7 @@ spec: type: object properties: exec: - description: Exec specifies a command to execute in the container. + description: Exec specifies the action to take. type: object properties: command: @@ -970,7 +972,6 @@ spec: type: array items: type: string - x-kubernetes-list-type: atomic failureThreshold: description: |- Minimum consecutive failures for the probe to be considered failed after having succeeded. @@ -978,8 +979,10 @@ spec: type: integer format: int32 grpc: - description: GRPC specifies a GRPC HealthCheckRequest. + description: GRPC specifies an action involving a GRPC port. type: object + required: + - port properties: port: description: Port number of the gRPC service. Number must be in the range 1 to 65535. @@ -990,11 +993,11 @@ spec: Service is the name of the service to place in the gRPC HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + If this is not specified, the default behavior is defined by gRPC. type: string - default: "" httpGet: - description: HTTPGet specifies an HTTP GET request to perform. + description: HTTPGet specifies the http request to perform. type: object properties: host: @@ -1020,7 +1023,6 @@ spec: value: description: The header field value type: string - x-kubernetes-list-type: atomic path: description: Path to access on the HTTP server. type: string @@ -1045,8 +1047,7 @@ spec: type: integer format: int32 periodSeconds: - description: |- - How often (in seconds) to perform the probe. + description: How often (in seconds) to perform the probe. type: integer format: int32 successThreshold: @@ -1056,7 +1057,7 @@ spec: type: integer format: int32 tcpSocket: - description: TCPSocket specifies a connection to a TCP port. + description: TCPSocket specifies an action involving a TCP port. type: object properties: host: @@ -1115,10 +1116,6 @@ spec: Path within the container at which the volume should be mounted. Must not contain ':'. type: string - mountPropagation: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-volumes-mount-propagation - type: string name: description: This must match the Name of a Volume. type: string @@ -1132,9 +1129,6 @@ spec: Path within the volume from which the container's volume should be mounted. Defaults to "" (volume's root). type: string - x-kubernetes-list-map-keys: - - mountPath - x-kubernetes-list-type: map workingDir: description: |- Container's working directory. @@ -1143,39 +1137,22 @@ spec: Cannot be updated. type: string dnsConfig: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-dnsconfig + description: This is accessible behind a feature flag - kubernetes.podspec-dnsconfig type: object x-kubernetes-preserve-unknown-fields: true dnsPolicy: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-dnspolicy + description: This is accessible behind a feature flag - kubernetes.podspec-dnspolicy type: string enableServiceLinks: - description: |- - EnableServiceLinks indicates whether information aboutservices should be injected into pod's environment variables, matching the syntax of Docker links. Optional: Knative defaults this to false. + description: 'EnableServiceLinks indicates whether information about services should be injected into pod''s environment variables, matching the syntax of Docker links. Optional: Knative defaults this to false.' type: boolean hostAliases: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-hostaliases + description: This is accessible behind a feature flag - kubernetes.podspec-hostaliases type: array items: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-hostaliases + description: This is accessible behind a feature flag - kubernetes.podspec-hostaliases type: object x-kubernetes-preserve-unknown-fields: true - hostIPC: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-hostipc - type: boolean - hostNetwork: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-hostnetwork - type: boolean - hostPID: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-hostpid - type: boolean idleTimeoutSeconds: description: |- IdleTimeoutSeconds is the maximum duration in seconds a request will be allowed @@ -1198,35 +1175,39 @@ spec: name: description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string - default: "" x-kubernetes-map-type: atomic - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map initContainers: description: |- - This is accessible behind a feature flag - kubernetes.podspec-init-containers + List of initialization containers belonging to the pod. + Init containers are executed in order prior to containers being started. If any + init container fails, the pod is considered to have failed and is handled according + to its restartPolicy. The name for an init container or normal container must be + unique among all containers. + Init containers may not have Lifecycle actions, Readiness probes, Liveness probes, or Startup probes. + The resourceRequirements of an init container are taken into account during scheduling + by finding the highest request/limit for each resource type, and then using the max of + of that value or the sum of the normal containers. Limits are applied to init containers + in a similar fashion. + Init containers cannot currently be added or removed. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/ type: array items: description: This is accessible behind a feature flag - kubernetes.podspec-init-containers type: object x-kubernetes-preserve-unknown-fields: true nodeSelector: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-nodeselector + description: This is accessible behind a feature flag - kubernetes.podspec-nodeselector type: object - additionalProperties: - type: string + x-kubernetes-preserve-unknown-fields: true x-kubernetes-map-type: atomic priorityClassName: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-priorityclassname + description: This is accessible behind a feature flag - kubernetes.podspec-priorityclassname type: string + x-kubernetes-preserve-unknown-fields: true responseStartTimeoutSeconds: description: |- ResponseStartTimeoutSeconds is the maximum duration in seconds that the request @@ -1235,16 +1216,15 @@ spec: type: integer format: int64 runtimeClassName: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-runtimeclassname + description: This is accessible behind a feature flag - kubernetes.podspec-runtimeclassname type: string + x-kubernetes-preserve-unknown-fields: true schedulerName: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-schedulername + description: This is accessible behind a feature flag - kubernetes.podspec-schedulername type: string + x-kubernetes-preserve-unknown-fields: true securityContext: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-securitycontext + description: This is accessible behind a feature flag - kubernetes.podspec-securitycontext type: object x-kubernetes-preserve-unknown-fields: true serviceAccountName: @@ -1253,9 +1233,9 @@ spec: More info: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/ type: string shareProcessNamespace: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-shareprocessnamespace + description: This is accessible behind a feature flag - kubernetes.podspec-shareproccessnamespace type: boolean + x-kubernetes-preserve-unknown-fields: true timeoutSeconds: description: |- TimeoutSeconds is the maximum duration in seconds that the request instance @@ -1267,13 +1247,11 @@ spec: description: This is accessible behind a feature flag - kubernetes.podspec-tolerations type: array items: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-tolerations + description: This is accessible behind a feature flag - kubernetes.podspec-tolerations type: object x-kubernetes-preserve-unknown-fields: true topologySpreadConstraints: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints + description: This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints type: array items: description: This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints @@ -1342,37 +1320,18 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string - x-kubernetes-list-type: atomic name: description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string - default: "" optional: description: optional specify whether the ConfigMap or its keys must be defined type: boolean x-kubernetes-map-type: atomic - csi: - description: This is accessible behind a feature flag - kubernetes.podspec-volumes-csi - type: object - x-kubernetes-preserve-unknown-fields: true emptyDir: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-volumes-emptydir - type: object - x-kubernetes-preserve-unknown-fields: true - hostPath: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-volumes-hostpath - type: object - x-kubernetes-preserve-unknown-fields: true - image: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-volumes-image + description: This is accessible behind a feature flag - kubernetes.podspec-emptydir type: object x-kubernetes-preserve-unknown-fields: true name: @@ -1382,8 +1341,7 @@ spec: More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string persistentVolumeClaim: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-persistent-volume-claim + description: This is accessible behind a feature flag - kubernetes.podspec-persistent-volume-claim type: object x-kubernetes-preserve-unknown-fields: true projected: @@ -1401,14 +1359,10 @@ spec: type: integer format: int32 sources: - description: |- - sources is the list of volume projections. Each entry in this list - handles one source. + description: sources is the list of volume projections type: array items: - description: |- - Projection that may be projected along with other supported volume types. - Exactly one of these fields must be set. + description: Projection that may be projected along with other supported volume types type: object properties: configMap: @@ -1452,16 +1406,12 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string - x-kubernetes-list-type: atomic name: description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string - default: "" optional: description: optional specify whether the ConfigMap or its keys must be defined type: boolean @@ -1480,7 +1430,7 @@ spec: - path properties: fieldRef: - description: 'Required: Selects a field of the pod: only annotations, labels, name, namespace and uid are supported.' + description: 'Required: Selects a field of the pod: only annotations, labels, name and namespace are supported.' type: object required: - fieldPath @@ -1527,7 +1477,6 @@ spec: description: 'Required: resource to select' type: string x-kubernetes-map-type: atomic - x-kubernetes-list-type: atomic secret: description: secret information about the secret data to project type: object @@ -1569,16 +1518,12 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string - x-kubernetes-list-type: atomic name: description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string - default: "" optional: description: optional field specify whether the Secret or its key must be defined type: boolean @@ -1611,7 +1556,6 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string - x-kubernetes-list-type: atomic secret: description: |- secret represents a secret that should populate this volume. @@ -1666,7 +1610,6 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string - x-kubernetes-list-type: atomic optional: description: optional field specify whether the Secret or its keys must be defined type: boolean @@ -1675,9 +1618,6 @@ spec: secretName is the name of the secret in the pod's namespace to use. More info: https://kubernetes.io/docs/concepts/storage/volumes#secret type: string - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map status: description: ConfigurationStatus communicates the observed state of the Configuration (from the controller). type: object @@ -1764,7 +1704,7 @@ metadata: labels: app.kubernetes.io/name: knative-serving app.kubernetes.io/component: networking - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" knative.dev/crd-install: "true" spec: group: networking.internal.knative.dev @@ -1840,7 +1780,7 @@ metadata: name: domainmappings.serving.knative.dev labels: app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" knative.dev/crd-install: "true" spec: group: serving.knative.dev @@ -1894,11 +1834,13 @@ spec: description: |- Ref specifies the target of the Domain Mapping. + The object identified by the Ref must be an Addressable with a URL of the form `{name}.{namespace}.{domain}` where `{domain}` is the cluster domain, and `{name}` and `{namespace}` are the name and namespace of a Kubernetes Service. + This contract is satisfied by Knative types such as Knative Services and Knative Routes, and by Kubernetes Services. type: object @@ -2051,7 +1993,7 @@ metadata: labels: app.kubernetes.io/name: knative-serving app.kubernetes.io/component: networking - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" knative.dev/crd-install: "true" spec: group: networking.internal.knative.dev @@ -2068,6 +2010,7 @@ spec: by a backend. An Ingress can be configured to give services externally-reachable URLs, load balance traffic, offer name based virtual hosting, etc. + This is heavily based on K8s Ingress https://godoc.org/k8s.io/api/networking/v1beta1#Ingress which some highlighted modifications. type: object @@ -2139,6 +2082,7 @@ spec: description: |- A collection of paths that map requests to backends. + If they are multiple matching paths, the first match takes precedence. type: array items: @@ -2154,6 +2098,7 @@ spec: AppendHeaders allow specifying additional HTTP headers to add before forwarding a request to the destination service. + NOTE: This differs from K8s Ingress which doesn't allow header appending. type: object additionalProperties: @@ -2188,6 +2133,7 @@ spec: description: |- RewriteHost rewrites the incoming request's host header. + This field is currently experimental and not supported by all Ingress implementations. type: string @@ -2209,6 +2155,7 @@ spec: AppendHeaders allow specifying additional HTTP headers to add before forwarding a request to the destination service. + NOTE: This differs from K8s Ingress which doesn't allow header appending. type: object additionalProperties: @@ -2218,6 +2165,7 @@ spec: Specifies the split percentage, a number between 0 and 100. If only one split is specified, we default to 100. + NOTE: This differs from K8s Ingress to allow percentage split. type: integer serviceName: @@ -2227,6 +2175,7 @@ spec: description: |- Specifies the namespace of the referenced service. + NOTE: This differs from K8s Ingress to allow routing to different namespaces. type: string servicePort: @@ -2351,6 +2300,7 @@ spec: description: |- DomainInternal is set if there is a cluster-local DNS name to access the Ingress. + NOTE: This differs from K8s Ingress, since we also desire to have a cluster-local DNS name to allow routing in case of not having a mesh. type: string @@ -2386,6 +2336,7 @@ spec: description: |- DomainInternal is set if there is a cluster-local DNS name to access the Ingress. + NOTE: This differs from K8s Ingress, since we also desire to have a cluster-local DNS name to allow routing in case of not having a mesh. type: string @@ -2438,7 +2389,7 @@ metadata: name: metrics.autoscaling.internal.knative.dev labels: app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" knative.dev/crd-install: "true" spec: group: autoscaling.internal.knative.dev @@ -2581,7 +2532,7 @@ metadata: name: podautoscalers.autoscaling.internal.knative.dev labels: app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" knative.dev/crd-install: "true" spec: group: autoscaling.internal.knative.dev @@ -2781,7 +2732,7 @@ metadata: name: revisions.serving.knative.dev labels: app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" knative.dev/crd-install: "true" spec: group: serving.knative.dev @@ -2828,6 +2779,7 @@ spec: references a container image. Revisions are created by updates to a Configuration. + See also: https://github.com/knative/serving/blob/main/docs/spec/overview.md#revision type: object properties: @@ -2893,7 +2845,6 @@ spec: type: array items: type: string - x-kubernetes-list-type: atomic command: description: |- Entrypoint array. Not executed within a shell. @@ -2907,7 +2858,6 @@ spec: type: array items: type: string - x-kubernetes-list-type: atomic env: description: |- List of environment variables to set in the container. @@ -2920,9 +2870,7 @@ spec: - name properties: name: - description: |- - Name of the environment variable. - May consist of any printable ASCII characters except '='. + description: Name of the environment variable. Must be a C_IDENTIFIER. type: string value: description: |- @@ -2952,28 +2900,23 @@ spec: name: description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string - default: "" optional: description: Specify whether the ConfigMap or its key must be defined type: boolean x-kubernetes-map-type: atomic fieldRef: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-fieldref + description: This is accessible behind a feature flag - kubernetes.podspec-fieldref type: object - x-kubernetes-map-type: atomic x-kubernetes-preserve-unknown-fields: true + x-kubernetes-map-type: atomic resourceFieldRef: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-fieldref + description: This is accessible behind a feature flag - kubernetes.podspec-fieldref type: object - x-kubernetes-map-type: atomic x-kubernetes-preserve-unknown-fields: true + x-kubernetes-map-type: atomic secretKeyRef: description: Selects a key of a secret in the pod's namespace type: object @@ -2986,30 +2929,24 @@ spec: name: description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string - default: "" optional: description: Specify whether the Secret or its key must be defined type: boolean x-kubernetes-map-type: atomic - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map envFrom: description: |- List of sources to populate environment variables in the container. - The keys defined within a source may consist of any printable ASCII characters except '='. - When a key exists in multiple + The keys defined within a source must be a C_IDENTIFIER. All invalid keys + will be reported as an event when the container is starting. When a key exists in multiple sources, the value associated with the last source will take precedence. Values defined by an Env with a duplicate key will take precedence. Cannot be updated. type: array items: - description: EnvFromSource represents the source of a set of ConfigMaps or Secrets + description: EnvFromSource represents the source of a set of ConfigMaps type: object properties: configMapRef: @@ -3019,20 +2956,15 @@ spec: name: description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string - default: "" optional: description: Specify whether the ConfigMap must be defined type: boolean x-kubernetes-map-type: atomic prefix: - description: |- - Optional text to prepend to the name of each environment variable. - May consist of any printable ASCII characters except '='. + description: An optional identifier to prepend to each key in the ConfigMap. Must be a C_IDENTIFIER. type: string secretRef: description: The Secret to select from @@ -3041,17 +2973,13 @@ spec: name: description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string - default: "" optional: description: Specify whether the Secret must be defined type: boolean x-kubernetes-map-type: atomic - x-kubernetes-list-type: atomic image: description: |- Container image name. @@ -3076,7 +3004,7 @@ spec: type: object properties: exec: - description: Exec specifies a command to execute in the container. + description: Exec specifies the action to take. type: object properties: command: @@ -3089,7 +3017,6 @@ spec: type: array items: type: string - x-kubernetes-list-type: atomic failureThreshold: description: |- Minimum consecutive failures for the probe to be considered failed after having succeeded. @@ -3097,8 +3024,10 @@ spec: type: integer format: int32 grpc: - description: GRPC specifies a GRPC HealthCheckRequest. + description: GRPC specifies an action involving a GRPC port. type: object + required: + - port properties: port: description: Port number of the gRPC service. Number must be in the range 1 to 65535. @@ -3109,11 +3038,11 @@ spec: Service is the name of the service to place in the gRPC HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + If this is not specified, the default behavior is defined by gRPC. type: string - default: "" httpGet: - description: HTTPGet specifies an HTTP GET request to perform. + description: HTTPGet specifies the http request to perform. type: object properties: host: @@ -3139,7 +3068,6 @@ spec: value: description: The header field value type: string - x-kubernetes-list-type: atomic path: description: Path to access on the HTTP server. type: string @@ -3164,8 +3092,7 @@ spec: type: integer format: int32 periodSeconds: - description: |- - How often (in seconds) to perform the probe. + description: How often (in seconds) to perform the probe. type: integer format: int32 successThreshold: @@ -3175,7 +3102,7 @@ spec: type: integer format: int32 tcpSocket: - description: TCPSocket specifies a connection to a TCP port. + description: TCPSocket specifies an action involving a TCP port. type: object properties: host: @@ -3216,6 +3143,8 @@ spec: items: description: ContainerPort represents a network port in a single container. type: object + required: + - containerPort properties: containerPort: description: |- @@ -3235,6 +3164,10 @@ spec: Defaults to "TCP". type: string default: TCP + x-kubernetes-list-map-keys: + - containerPort + - protocol + x-kubernetes-list-type: map readinessProbe: description: |- Periodic probe of container service readiness. @@ -3244,7 +3177,7 @@ spec: type: object properties: exec: - description: Exec specifies a command to execute in the container. + description: Exec specifies the action to take. type: object properties: command: @@ -3257,7 +3190,6 @@ spec: type: array items: type: string - x-kubernetes-list-type: atomic failureThreshold: description: |- Minimum consecutive failures for the probe to be considered failed after having succeeded. @@ -3265,8 +3197,10 @@ spec: type: integer format: int32 grpc: - description: GRPC specifies a GRPC HealthCheckRequest. + description: GRPC specifies an action involving a GRPC port. type: object + required: + - port properties: port: description: Port number of the gRPC service. Number must be in the range 1 to 65535. @@ -3277,11 +3211,11 @@ spec: Service is the name of the service to place in the gRPC HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + If this is not specified, the default behavior is defined by gRPC. type: string - default: "" httpGet: - description: HTTPGet specifies an HTTP GET request to perform. + description: HTTPGet specifies the http request to perform. type: object properties: host: @@ -3307,7 +3241,6 @@ spec: value: description: The header field value type: string - x-kubernetes-list-type: atomic path: description: Path to access on the HTTP server. type: string @@ -3332,8 +3265,7 @@ spec: type: integer format: int32 periodSeconds: - description: |- - How often (in seconds) to perform the probe. + description: How often (in seconds) to perform the probe. type: integer format: int32 successThreshold: @@ -3343,7 +3275,7 @@ spec: type: integer format: int32 tcpSocket: - description: TCPSocket specifies a connection to a TCP port. + description: TCPSocket specifies an action involving a TCP port. type: object properties: host: @@ -3372,6 +3304,33 @@ spec: More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ type: object properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + + This field is immutable. It can only be set for containers. + type: array + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + type: object + required: + - name + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map limits: description: |- Limits describes the maximum amount of compute resources allowed. @@ -3426,18 +3385,12 @@ spec: items: description: Capability represent POSIX capabilities type type: string - x-kubernetes-list-type: atomic drop: description: Removed capabilities type: array items: description: Capability represent POSIX capabilities type type: string - x-kubernetes-list-type: atomic - privileged: - description: |- - Run container in privileged mode. This can only be set to explicitly to 'false' - type: boolean readOnlyRootFilesystem: description: |- Whether this container has a read-only root filesystem. @@ -3493,6 +3446,7 @@ spec: type indicates which kind of seccomp profile will be applied. Valid options are: + Localhost - a profile defined in a file on the node should be used. RuntimeDefault - the container runtime default profile should be used. Unconfined - no profile should be applied. @@ -3509,7 +3463,7 @@ spec: type: object properties: exec: - description: Exec specifies a command to execute in the container. + description: Exec specifies the action to take. type: object properties: command: @@ -3522,7 +3476,6 @@ spec: type: array items: type: string - x-kubernetes-list-type: atomic failureThreshold: description: |- Minimum consecutive failures for the probe to be considered failed after having succeeded. @@ -3530,8 +3483,10 @@ spec: type: integer format: int32 grpc: - description: GRPC specifies a GRPC HealthCheckRequest. + description: GRPC specifies an action involving a GRPC port. type: object + required: + - port properties: port: description: Port number of the gRPC service. Number must be in the range 1 to 65535. @@ -3542,11 +3497,11 @@ spec: Service is the name of the service to place in the gRPC HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + If this is not specified, the default behavior is defined by gRPC. type: string - default: "" httpGet: - description: HTTPGet specifies an HTTP GET request to perform. + description: HTTPGet specifies the http request to perform. type: object properties: host: @@ -3572,7 +3527,6 @@ spec: value: description: The header field value type: string - x-kubernetes-list-type: atomic path: description: Path to access on the HTTP server. type: string @@ -3597,8 +3551,7 @@ spec: type: integer format: int32 periodSeconds: - description: |- - How often (in seconds) to perform the probe. + description: How often (in seconds) to perform the probe. type: integer format: int32 successThreshold: @@ -3608,7 +3561,7 @@ spec: type: integer format: int32 tcpSocket: - description: TCPSocket specifies a connection to a TCP port. + description: TCPSocket specifies an action involving a TCP port. type: object properties: host: @@ -3667,10 +3620,6 @@ spec: Path within the container at which the volume should be mounted. Must not contain ':'. type: string - mountPropagation: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-volumes-mount-propagation - type: string name: description: This must match the Name of a Volume. type: string @@ -3684,9 +3633,6 @@ spec: Path within the volume from which the container's volume should be mounted. Defaults to "" (volume's root). type: string - x-kubernetes-list-map-keys: - - mountPath - x-kubernetes-list-type: map workingDir: description: |- Container's working directory. @@ -3695,39 +3641,22 @@ spec: Cannot be updated. type: string dnsConfig: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-dnsconfig + description: This is accessible behind a feature flag - kubernetes.podspec-dnsconfig type: object x-kubernetes-preserve-unknown-fields: true dnsPolicy: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-dnspolicy + description: This is accessible behind a feature flag - kubernetes.podspec-dnspolicy type: string enableServiceLinks: - description: |- - EnableServiceLinks indicates whether information aboutservices should be injected into pod's environment variables, matching the syntax of Docker links. Optional: Knative defaults this to false. + description: 'EnableServiceLinks indicates whether information about services should be injected into pod''s environment variables, matching the syntax of Docker links. Optional: Knative defaults this to false.' type: boolean hostAliases: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-hostaliases + description: This is accessible behind a feature flag - kubernetes.podspec-hostaliases type: array items: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-hostaliases + description: This is accessible behind a feature flag - kubernetes.podspec-hostaliases type: object x-kubernetes-preserve-unknown-fields: true - hostIPC: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-hostipc - type: boolean - hostNetwork: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-hostnetwork - type: boolean - hostPID: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-hostpid - type: boolean idleTimeoutSeconds: description: |- IdleTimeoutSeconds is the maximum duration in seconds a request will be allowed @@ -3750,35 +3679,39 @@ spec: name: description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string - default: "" x-kubernetes-map-type: atomic - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map initContainers: description: |- - This is accessible behind a feature flag - kubernetes.podspec-init-containers + List of initialization containers belonging to the pod. + Init containers are executed in order prior to containers being started. If any + init container fails, the pod is considered to have failed and is handled according + to its restartPolicy. The name for an init container or normal container must be + unique among all containers. + Init containers may not have Lifecycle actions, Readiness probes, Liveness probes, or Startup probes. + The resourceRequirements of an init container are taken into account during scheduling + by finding the highest request/limit for each resource type, and then using the max of + of that value or the sum of the normal containers. Limits are applied to init containers + in a similar fashion. + Init containers cannot currently be added or removed. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/ type: array items: description: This is accessible behind a feature flag - kubernetes.podspec-init-containers type: object x-kubernetes-preserve-unknown-fields: true nodeSelector: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-nodeselector + description: This is accessible behind a feature flag - kubernetes.podspec-nodeselector type: object - additionalProperties: - type: string + x-kubernetes-preserve-unknown-fields: true x-kubernetes-map-type: atomic priorityClassName: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-priorityclassname + description: This is accessible behind a feature flag - kubernetes.podspec-priorityclassname type: string + x-kubernetes-preserve-unknown-fields: true responseStartTimeoutSeconds: description: |- ResponseStartTimeoutSeconds is the maximum duration in seconds that the request @@ -3787,16 +3720,15 @@ spec: type: integer format: int64 runtimeClassName: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-runtimeclassname + description: This is accessible behind a feature flag - kubernetes.podspec-runtimeclassname type: string + x-kubernetes-preserve-unknown-fields: true schedulerName: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-schedulername + description: This is accessible behind a feature flag - kubernetes.podspec-schedulername type: string + x-kubernetes-preserve-unknown-fields: true securityContext: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-securitycontext + description: This is accessible behind a feature flag - kubernetes.podspec-securitycontext type: object x-kubernetes-preserve-unknown-fields: true serviceAccountName: @@ -3805,9 +3737,9 @@ spec: More info: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/ type: string shareProcessNamespace: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-shareprocessnamespace + description: This is accessible behind a feature flag - kubernetes.podspec-shareproccessnamespace type: boolean + x-kubernetes-preserve-unknown-fields: true timeoutSeconds: description: |- TimeoutSeconds is the maximum duration in seconds that the request instance @@ -3819,13 +3751,11 @@ spec: description: This is accessible behind a feature flag - kubernetes.podspec-tolerations type: array items: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-tolerations + description: This is accessible behind a feature flag - kubernetes.podspec-tolerations type: object x-kubernetes-preserve-unknown-fields: true topologySpreadConstraints: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints + description: This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints type: array items: description: This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints @@ -3894,37 +3824,18 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string - x-kubernetes-list-type: atomic name: description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string - default: "" optional: description: optional specify whether the ConfigMap or its keys must be defined type: boolean x-kubernetes-map-type: atomic - csi: - description: This is accessible behind a feature flag - kubernetes.podspec-volumes-csi - type: object - x-kubernetes-preserve-unknown-fields: true emptyDir: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-volumes-emptydir - type: object - x-kubernetes-preserve-unknown-fields: true - hostPath: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-volumes-hostpath - type: object - x-kubernetes-preserve-unknown-fields: true - image: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-volumes-image + description: This is accessible behind a feature flag - kubernetes.podspec-emptydir type: object x-kubernetes-preserve-unknown-fields: true name: @@ -3934,8 +3845,7 @@ spec: More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string persistentVolumeClaim: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-persistent-volume-claim + description: This is accessible behind a feature flag - kubernetes.podspec-persistent-volume-claim type: object x-kubernetes-preserve-unknown-fields: true projected: @@ -3953,14 +3863,10 @@ spec: type: integer format: int32 sources: - description: |- - sources is the list of volume projections. Each entry in this list - handles one source. + description: sources is the list of volume projections type: array items: - description: |- - Projection that may be projected along with other supported volume types. - Exactly one of these fields must be set. + description: Projection that may be projected along with other supported volume types type: object properties: configMap: @@ -4004,16 +3910,12 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string - x-kubernetes-list-type: atomic name: description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string - default: "" optional: description: optional specify whether the ConfigMap or its keys must be defined type: boolean @@ -4032,7 +3934,7 @@ spec: - path properties: fieldRef: - description: 'Required: Selects a field of the pod: only annotations, labels, name, namespace and uid are supported.' + description: 'Required: Selects a field of the pod: only annotations, labels, name and namespace are supported.' type: object required: - fieldPath @@ -4079,7 +3981,6 @@ spec: description: 'Required: resource to select' type: string x-kubernetes-map-type: atomic - x-kubernetes-list-type: atomic secret: description: secret information about the secret data to project type: object @@ -4121,16 +4022,12 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string - x-kubernetes-list-type: atomic name: description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string - default: "" optional: description: optional field specify whether the Secret or its key must be defined type: boolean @@ -4163,7 +4060,6 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string - x-kubernetes-list-type: atomic secret: description: |- secret represents a secret that should populate this volume. @@ -4218,7 +4114,6 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string - x-kubernetes-list-type: atomic optional: description: optional field specify whether the Secret or its keys must be defined type: boolean @@ -4227,9 +4122,6 @@ spec: secretName is the name of the secret in the pod's namespace to use. More info: https://kubernetes.io/docs/concepts/storage/volumes#secret type: string - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map status: description: RevisionStatus communicates the observed state of the Revision (from the controller). type: object @@ -4289,7 +4181,7 @@ spec: The digests are resolved during the creation of Revision. ContainerStatuses holds the container name and image digests for both serving and non serving containers. - ref: https://bit.ly/image-digests + ref: http://bit.ly/image-digests type: array items: description: ContainerStatus holds the information of container name and image digest value @@ -4310,7 +4202,7 @@ spec: The digests are resolved during the creation of Revision. ContainerStatuses holds the container name and image digests for both serving and non serving containers. - ref: https://bit.ly/image-digests + ref: http://bit.ly/image-digests type: array items: description: ContainerStatus holds the information of container name and image digest value @@ -4354,7 +4246,7 @@ metadata: name: routes.serving.knative.dev labels: app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" knative.dev/crd-install: "true" duck.knative.dev/addressable: "true" spec: @@ -4624,7 +4516,7 @@ metadata: labels: app.kubernetes.io/name: knative-serving app.kubernetes.io/component: networking - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" knative.dev/crd-install: "true" spec: group: networking.internal.knative.dev @@ -4697,6 +4589,7 @@ spec: the event) or if no container name is specified "spec.containers[2]" (container with index 2 in this pod). This syntax is chosen only to have some well-defined way of referencing a part of an object. + TODO: this design is not final and this field is subject to change in the future. type: string kind: description: |- @@ -4847,7 +4740,7 @@ metadata: name: services.serving.knative.dev labels: app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" knative.dev/crd-install: "true" duck.knative.dev/addressable: "true" duck.knative.dev/podspecable: "true" @@ -4898,9 +4791,11 @@ spec: underlying Routes and Configurations (much as a kubernetes Deployment orchestrates ReplicaSets), and its usage is optional but recommended. + The Service's controller will track the statuses of its owned Configuration and Route, reflecting their statuses and conditions as its own. + See also: https://github.com/knative/serving/blob/main/docs/spec/overview.md#service type: object properties: @@ -5001,7 +4896,6 @@ spec: type: array items: type: string - x-kubernetes-list-type: atomic command: description: |- Entrypoint array. Not executed within a shell. @@ -5015,7 +4909,6 @@ spec: type: array items: type: string - x-kubernetes-list-type: atomic env: description: |- List of environment variables to set in the container. @@ -5028,9 +4921,7 @@ spec: - name properties: name: - description: |- - Name of the environment variable. - May consist of any printable ASCII characters except '='. + description: Name of the environment variable. Must be a C_IDENTIFIER. type: string value: description: |- @@ -5060,28 +4951,23 @@ spec: name: description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string - default: "" optional: description: Specify whether the ConfigMap or its key must be defined type: boolean x-kubernetes-map-type: atomic fieldRef: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-fieldref + description: This is accessible behind a feature flag - kubernetes.podspec-fieldref type: object - x-kubernetes-map-type: atomic x-kubernetes-preserve-unknown-fields: true + x-kubernetes-map-type: atomic resourceFieldRef: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-fieldref + description: This is accessible behind a feature flag - kubernetes.podspec-fieldref type: object - x-kubernetes-map-type: atomic x-kubernetes-preserve-unknown-fields: true + x-kubernetes-map-type: atomic secretKeyRef: description: Selects a key of a secret in the pod's namespace type: object @@ -5094,30 +4980,24 @@ spec: name: description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string - default: "" optional: description: Specify whether the Secret or its key must be defined type: boolean x-kubernetes-map-type: atomic - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map envFrom: description: |- List of sources to populate environment variables in the container. - The keys defined within a source may consist of any printable ASCII characters except '='. - When a key exists in multiple + The keys defined within a source must be a C_IDENTIFIER. All invalid keys + will be reported as an event when the container is starting. When a key exists in multiple sources, the value associated with the last source will take precedence. Values defined by an Env with a duplicate key will take precedence. Cannot be updated. type: array items: - description: EnvFromSource represents the source of a set of ConfigMaps or Secrets + description: EnvFromSource represents the source of a set of ConfigMaps type: object properties: configMapRef: @@ -5127,20 +5007,15 @@ spec: name: description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string - default: "" optional: description: Specify whether the ConfigMap must be defined type: boolean x-kubernetes-map-type: atomic prefix: - description: |- - Optional text to prepend to the name of each environment variable. - May consist of any printable ASCII characters except '='. + description: An optional identifier to prepend to each key in the ConfigMap. Must be a C_IDENTIFIER. type: string secretRef: description: The Secret to select from @@ -5149,17 +5024,13 @@ spec: name: description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string - default: "" optional: description: Specify whether the Secret must be defined type: boolean x-kubernetes-map-type: atomic - x-kubernetes-list-type: atomic image: description: |- Container image name. @@ -5184,7 +5055,7 @@ spec: type: object properties: exec: - description: Exec specifies a command to execute in the container. + description: Exec specifies the action to take. type: object properties: command: @@ -5197,7 +5068,6 @@ spec: type: array items: type: string - x-kubernetes-list-type: atomic failureThreshold: description: |- Minimum consecutive failures for the probe to be considered failed after having succeeded. @@ -5205,8 +5075,10 @@ spec: type: integer format: int32 grpc: - description: GRPC specifies a GRPC HealthCheckRequest. + description: GRPC specifies an action involving a GRPC port. type: object + required: + - port properties: port: description: Port number of the gRPC service. Number must be in the range 1 to 65535. @@ -5217,11 +5089,11 @@ spec: Service is the name of the service to place in the gRPC HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + If this is not specified, the default behavior is defined by gRPC. type: string - default: "" httpGet: - description: HTTPGet specifies an HTTP GET request to perform. + description: HTTPGet specifies the http request to perform. type: object properties: host: @@ -5247,7 +5119,6 @@ spec: value: description: The header field value type: string - x-kubernetes-list-type: atomic path: description: Path to access on the HTTP server. type: string @@ -5272,8 +5143,7 @@ spec: type: integer format: int32 periodSeconds: - description: |- - How often (in seconds) to perform the probe. + description: How often (in seconds) to perform the probe. type: integer format: int32 successThreshold: @@ -5283,7 +5153,7 @@ spec: type: integer format: int32 tcpSocket: - description: TCPSocket specifies a connection to a TCP port. + description: TCPSocket specifies an action involving a TCP port. type: object properties: host: @@ -5324,6 +5194,8 @@ spec: items: description: ContainerPort represents a network port in a single container. type: object + required: + - containerPort properties: containerPort: description: |- @@ -5343,6 +5215,10 @@ spec: Defaults to "TCP". type: string default: TCP + x-kubernetes-list-map-keys: + - containerPort + - protocol + x-kubernetes-list-type: map readinessProbe: description: |- Periodic probe of container service readiness. @@ -5352,7 +5228,7 @@ spec: type: object properties: exec: - description: Exec specifies a command to execute in the container. + description: Exec specifies the action to take. type: object properties: command: @@ -5365,7 +5241,6 @@ spec: type: array items: type: string - x-kubernetes-list-type: atomic failureThreshold: description: |- Minimum consecutive failures for the probe to be considered failed after having succeeded. @@ -5373,8 +5248,10 @@ spec: type: integer format: int32 grpc: - description: GRPC specifies a GRPC HealthCheckRequest. + description: GRPC specifies an action involving a GRPC port. type: object + required: + - port properties: port: description: Port number of the gRPC service. Number must be in the range 1 to 65535. @@ -5385,11 +5262,11 @@ spec: Service is the name of the service to place in the gRPC HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + If this is not specified, the default behavior is defined by gRPC. type: string - default: "" httpGet: - description: HTTPGet specifies an HTTP GET request to perform. + description: HTTPGet specifies the http request to perform. type: object properties: host: @@ -5415,7 +5292,6 @@ spec: value: description: The header field value type: string - x-kubernetes-list-type: atomic path: description: Path to access on the HTTP server. type: string @@ -5440,8 +5316,7 @@ spec: type: integer format: int32 periodSeconds: - description: |- - How often (in seconds) to perform the probe. + description: How often (in seconds) to perform the probe. type: integer format: int32 successThreshold: @@ -5451,7 +5326,7 @@ spec: type: integer format: int32 tcpSocket: - description: TCPSocket specifies a connection to a TCP port. + description: TCPSocket specifies an action involving a TCP port. type: object properties: host: @@ -5480,6 +5355,33 @@ spec: More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ type: object properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + + This field is immutable. It can only be set for containers. + type: array + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + type: object + required: + - name + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map limits: description: |- Limits describes the maximum amount of compute resources allowed. @@ -5534,18 +5436,12 @@ spec: items: description: Capability represent POSIX capabilities type type: string - x-kubernetes-list-type: atomic drop: description: Removed capabilities type: array items: description: Capability represent POSIX capabilities type type: string - x-kubernetes-list-type: atomic - privileged: - description: |- - Run container in privileged mode. This can only be set to explicitly to 'false' - type: boolean readOnlyRootFilesystem: description: |- Whether this container has a read-only root filesystem. @@ -5601,6 +5497,7 @@ spec: type indicates which kind of seccomp profile will be applied. Valid options are: + Localhost - a profile defined in a file on the node should be used. RuntimeDefault - the container runtime default profile should be used. Unconfined - no profile should be applied. @@ -5617,7 +5514,7 @@ spec: type: object properties: exec: - description: Exec specifies a command to execute in the container. + description: Exec specifies the action to take. type: object properties: command: @@ -5630,7 +5527,6 @@ spec: type: array items: type: string - x-kubernetes-list-type: atomic failureThreshold: description: |- Minimum consecutive failures for the probe to be considered failed after having succeeded. @@ -5638,8 +5534,10 @@ spec: type: integer format: int32 grpc: - description: GRPC specifies a GRPC HealthCheckRequest. + description: GRPC specifies an action involving a GRPC port. type: object + required: + - port properties: port: description: Port number of the gRPC service. Number must be in the range 1 to 65535. @@ -5650,11 +5548,11 @@ spec: Service is the name of the service to place in the gRPC HealthCheckRequest (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + If this is not specified, the default behavior is defined by gRPC. type: string - default: "" httpGet: - description: HTTPGet specifies an HTTP GET request to perform. + description: HTTPGet specifies the http request to perform. type: object properties: host: @@ -5680,7 +5578,6 @@ spec: value: description: The header field value type: string - x-kubernetes-list-type: atomic path: description: Path to access on the HTTP server. type: string @@ -5705,8 +5602,7 @@ spec: type: integer format: int32 periodSeconds: - description: |- - How often (in seconds) to perform the probe. + description: How often (in seconds) to perform the probe. type: integer format: int32 successThreshold: @@ -5716,7 +5612,7 @@ spec: type: integer format: int32 tcpSocket: - description: TCPSocket specifies a connection to a TCP port. + description: TCPSocket specifies an action involving a TCP port. type: object properties: host: @@ -5775,10 +5671,6 @@ spec: Path within the container at which the volume should be mounted. Must not contain ':'. type: string - mountPropagation: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-volumes-mount-propagation - type: string name: description: This must match the Name of a Volume. type: string @@ -5792,9 +5684,6 @@ spec: Path within the volume from which the container's volume should be mounted. Defaults to "" (volume's root). type: string - x-kubernetes-list-map-keys: - - mountPath - x-kubernetes-list-type: map workingDir: description: |- Container's working directory. @@ -5803,39 +5692,22 @@ spec: Cannot be updated. type: string dnsConfig: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-dnsconfig + description: This is accessible behind a feature flag - kubernetes.podspec-dnsconfig type: object x-kubernetes-preserve-unknown-fields: true dnsPolicy: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-dnspolicy + description: This is accessible behind a feature flag - kubernetes.podspec-dnspolicy type: string enableServiceLinks: - description: |- - EnableServiceLinks indicates whether information aboutservices should be injected into pod's environment variables, matching the syntax of Docker links. Optional: Knative defaults this to false. + description: 'EnableServiceLinks indicates whether information about services should be injected into pod''s environment variables, matching the syntax of Docker links. Optional: Knative defaults this to false.' type: boolean hostAliases: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-hostaliases + description: This is accessible behind a feature flag - kubernetes.podspec-hostaliases type: array items: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-hostaliases + description: This is accessible behind a feature flag - kubernetes.podspec-hostaliases type: object x-kubernetes-preserve-unknown-fields: true - hostIPC: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-hostipc - type: boolean - hostNetwork: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-hostnetwork - type: boolean - hostPID: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-hostpid - type: boolean idleTimeoutSeconds: description: |- IdleTimeoutSeconds is the maximum duration in seconds a request will be allowed @@ -5858,35 +5730,39 @@ spec: name: description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string - default: "" x-kubernetes-map-type: atomic - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map initContainers: description: |- - This is accessible behind a feature flag - kubernetes.podspec-init-containers + List of initialization containers belonging to the pod. + Init containers are executed in order prior to containers being started. If any + init container fails, the pod is considered to have failed and is handled according + to its restartPolicy. The name for an init container or normal container must be + unique among all containers. + Init containers may not have Lifecycle actions, Readiness probes, Liveness probes, or Startup probes. + The resourceRequirements of an init container are taken into account during scheduling + by finding the highest request/limit for each resource type, and then using the max of + of that value or the sum of the normal containers. Limits are applied to init containers + in a similar fashion. + Init containers cannot currently be added or removed. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/ type: array items: description: This is accessible behind a feature flag - kubernetes.podspec-init-containers type: object x-kubernetes-preserve-unknown-fields: true nodeSelector: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-nodeselector + description: This is accessible behind a feature flag - kubernetes.podspec-nodeselector type: object - additionalProperties: - type: string + x-kubernetes-preserve-unknown-fields: true x-kubernetes-map-type: atomic priorityClassName: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-priorityclassname + description: This is accessible behind a feature flag - kubernetes.podspec-priorityclassname type: string + x-kubernetes-preserve-unknown-fields: true responseStartTimeoutSeconds: description: |- ResponseStartTimeoutSeconds is the maximum duration in seconds that the request @@ -5895,16 +5771,15 @@ spec: type: integer format: int64 runtimeClassName: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-runtimeclassname + description: This is accessible behind a feature flag - kubernetes.podspec-runtimeclassname type: string + x-kubernetes-preserve-unknown-fields: true schedulerName: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-schedulername + description: This is accessible behind a feature flag - kubernetes.podspec-schedulername type: string + x-kubernetes-preserve-unknown-fields: true securityContext: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-securitycontext + description: This is accessible behind a feature flag - kubernetes.podspec-securitycontext type: object x-kubernetes-preserve-unknown-fields: true serviceAccountName: @@ -5913,9 +5788,9 @@ spec: More info: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/ type: string shareProcessNamespace: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-shareprocessnamespace + description: This is accessible behind a feature flag - kubernetes.podspec-shareproccessnamespace type: boolean + x-kubernetes-preserve-unknown-fields: true timeoutSeconds: description: |- TimeoutSeconds is the maximum duration in seconds that the request instance @@ -5927,13 +5802,11 @@ spec: description: This is accessible behind a feature flag - kubernetes.podspec-tolerations type: array items: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-tolerations + description: This is accessible behind a feature flag - kubernetes.podspec-tolerations type: object x-kubernetes-preserve-unknown-fields: true topologySpreadConstraints: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints + description: This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints type: array items: description: This is accessible behind a feature flag - kubernetes.podspec-topologyspreadconstraints @@ -6002,37 +5875,18 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string - x-kubernetes-list-type: atomic name: description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string - default: "" optional: description: optional specify whether the ConfigMap or its keys must be defined type: boolean x-kubernetes-map-type: atomic - csi: - description: This is accessible behind a feature flag - kubernetes.podspec-volumes-csi - type: object - x-kubernetes-preserve-unknown-fields: true emptyDir: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-volumes-emptydir - type: object - x-kubernetes-preserve-unknown-fields: true - hostPath: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-volumes-hostpath - type: object - x-kubernetes-preserve-unknown-fields: true - image: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-volumes-image + description: This is accessible behind a feature flag - kubernetes.podspec-emptydir type: object x-kubernetes-preserve-unknown-fields: true name: @@ -6042,8 +5896,7 @@ spec: More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string persistentVolumeClaim: - description: |- - This is accessible behind a feature flag - kubernetes.podspec-persistent-volume-claim + description: This is accessible behind a feature flag - kubernetes.podspec-persistent-volume-claim type: object x-kubernetes-preserve-unknown-fields: true projected: @@ -6061,14 +5914,10 @@ spec: type: integer format: int32 sources: - description: |- - sources is the list of volume projections. Each entry in this list - handles one source. + description: sources is the list of volume projections type: array items: - description: |- - Projection that may be projected along with other supported volume types. - Exactly one of these fields must be set. + description: Projection that may be projected along with other supported volume types type: object properties: configMap: @@ -6112,16 +5961,12 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string - x-kubernetes-list-type: atomic name: description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string - default: "" optional: description: optional specify whether the ConfigMap or its keys must be defined type: boolean @@ -6140,7 +5985,7 @@ spec: - path properties: fieldRef: - description: 'Required: Selects a field of the pod: only annotations, labels, name, namespace and uid are supported.' + description: 'Required: Selects a field of the pod: only annotations, labels, name and namespace are supported.' type: object required: - fieldPath @@ -6187,7 +6032,6 @@ spec: description: 'Required: resource to select' type: string x-kubernetes-map-type: atomic - x-kubernetes-list-type: atomic secret: description: secret information about the secret data to project type: object @@ -6229,16 +6073,12 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string - x-kubernetes-list-type: atomic name: description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string - default: "" optional: description: optional field specify whether the Secret or its key must be defined type: boolean @@ -6271,7 +6111,6 @@ spec: path is the path relative to the mount point of the file to project the token into. type: string - x-kubernetes-list-type: atomic secret: description: |- secret represents a secret that should populate this volume. @@ -6326,7 +6165,6 @@ spec: May not contain the path element '..'. May not start with the string '..'. type: string - x-kubernetes-list-type: atomic optional: description: optional field specify whether the Secret or its keys must be defined type: boolean @@ -6335,9 +6173,6 @@ spec: secretName is the name of the secret in the pod's namespace to use. More info: https://kubernetes.io/docs/concepts/storage/volumes#secret type: string - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map traffic: description: |- Traffic specifies how to distribute traffic over a collection of @@ -6553,7 +6388,7 @@ metadata: name: images.caching.internal.knative.dev labels: app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" knative.dev/crd-install: "true" spec: group: caching.internal.knative.dev @@ -6618,12 +6453,9 @@ spec: name: description: |- Name of the referent. - This field is effectively required, but due to backwards compatibility is - allowed to be empty. Instances of this type with an empty value here are - almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? type: string - default: "" x-kubernetes-map-type: atomic serviceAccountName: description: |- diff --git a/packages/manifests/operators/knative-serving/v1.22.1/02-serving-core.yaml b/packages/manifests/operators/knative-serving/v1.15.0/02-serving-core.yaml similarity index 90% rename from packages/manifests/operators/knative-serving/v1.22.1/02-serving-core.yaml rename to packages/manifests/operators/knative-serving/v1.15.0/02-serving-core.yaml index ed066c7..8b7b677 100644 --- a/packages/manifests/operators/knative-serving/v1.22.1/02-serving-core.yaml +++ b/packages/manifests/operators/knative-serving/v1.15.0/02-serving-core.yaml @@ -1,4 +1,4 @@ -# Source: https://github.com/knative/serving/releases/download/knative-v1.22.1/serving-core.yaml +# Source: https://github.com/knative/serving/releases/download/knative-v1.15.0/serving-core.yaml # Copyright 2018 The Knative Authors # # Licensed under the Apache License, Version 2.0 (the "License"); @@ -19,7 +19,7 @@ metadata: name: knative-serving labels: app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" --- # Copyright 2023 The Knative Authors # @@ -42,7 +42,7 @@ metadata: namespace: knative-serving labels: serving.knative.dev/controller: "true" - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" app.kubernetes.io/name: knative-serving rules: - apiGroups: [""] @@ -59,7 +59,7 @@ metadata: name: knative-serving-activator-cluster labels: serving.knative.dev/controller: "true" - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" app.kubernetes.io/name: knative-serving rules: - apiGroups: [""] @@ -91,7 +91,7 @@ metadata: # (which should be identical, but isn't guaranteed to be installed alongside serving). name: knative-serving-aggregated-addressable-resolver labels: - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" app.kubernetes.io/name: knative-serving aggregationRule: clusterRoleSelectors: @@ -103,7 +103,7 @@ apiVersion: rbac.authorization.k8s.io/v1 metadata: name: knative-serving-addressable-resolver labels: - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" app.kubernetes.io/name: knative-serving # Labeled to facilitate aggregated cluster roles that act on Addressables. duck.knative.dev/addressable: "true" @@ -141,7 +141,7 @@ metadata: name: knative-serving-namespaced-admin labels: rbac.authorization.k8s.io/aggregate-to-admin: "true" - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" app.kubernetes.io/name: knative-serving rules: - apiGroups: ["serving.knative.dev"] @@ -157,7 +157,7 @@ metadata: name: knative-serving-namespaced-edit labels: rbac.authorization.k8s.io/aggregate-to-edit: "true" - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" app.kubernetes.io/name: knative-serving rules: - apiGroups: ["serving.knative.dev"] @@ -173,7 +173,7 @@ metadata: name: knative-serving-namespaced-view labels: rbac.authorization.k8s.io/aggregate-to-view: "true" - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" app.kubernetes.io/name: knative-serving rules: - apiGroups: ["serving.knative.dev", "networking.internal.knative.dev", "autoscaling.internal.knative.dev", "caching.internal.knative.dev"] @@ -200,7 +200,7 @@ metadata: name: knative-serving-core labels: serving.knative.dev/controller: "true" - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" app.kubernetes.io/name: knative-serving rules: - apiGroups: [""] @@ -209,15 +209,9 @@ rules: - apiGroups: [""] resources: ["endpoints/restricted"] # Permission for RestrictedEndpointsAdmission verbs: ["create"] - - apiGroups: ["discovery.k8s.io"] - resources: ["endpointslices/restricted"] # Permission for RestrictedEndpointsAdmission - verbs: ["create"] - apiGroups: [""] resources: ["namespaces/finalizers"] # finalizers are needed for the owner reference of the webhook verbs: ["update"] - - apiGroups: ["discovery.k8s.io"] - resources: ["endpointslices"] - verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] - apiGroups: ["apps"] resources: ["deployments", "deployments/finalizers"] # finalizers are needed for the owner reference of the webhook verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] @@ -249,9 +243,6 @@ rules: resources: ["clusterroles"] verbs: ["delete"] resourceNames: ["knative-serving-certmanager"] - - apiGroups: ["*"] - resources: ["*/scale"] - verbs: ["patch"] --- # Copyright 2019 The Knative Authors # @@ -272,7 +263,7 @@ apiVersion: rbac.authorization.k8s.io/v1 metadata: name: knative-serving-podspecable-binding labels: - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" app.kubernetes.io/name: knative-serving # Labeled to facilitate aggregated cluster roles that act on PodSpecables. duck.knative.dev/podspecable: "true" @@ -310,7 +301,7 @@ metadata: labels: app.kubernetes.io/component: controller app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" --- kind: ClusterRole apiVersion: rbac.authorization.k8s.io/v1 @@ -318,7 +309,7 @@ metadata: name: knative-serving-admin labels: app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" aggregationRule: clusterRoleSelectors: - matchLabels: @@ -331,7 +322,7 @@ metadata: labels: app.kubernetes.io/component: controller app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" subjects: - kind: ServiceAccount name: controller @@ -348,7 +339,7 @@ metadata: labels: app.kubernetes.io/component: controller app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" subjects: - kind: ServiceAccount name: controller @@ -366,7 +357,7 @@ metadata: labels: app.kubernetes.io/component: activator app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding @@ -376,7 +367,7 @@ metadata: labels: app.kubernetes.io/component: activator app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" subjects: - kind: ServiceAccount name: activator @@ -393,7 +384,7 @@ metadata: labels: app.kubernetes.io/component: activator app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" subjects: - kind: ServiceAccount name: activator @@ -440,11 +431,11 @@ metadata: labels: app.kubernetes.io/component: queue-proxy app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" spec: # This is the Go import path for the binary that is containerized # and substituted here. - image: gcr.io/knative-releases/knative.dev/serving/cmd/queue@sha256:b1af8bda6c1d32b1cf5fbf8f1f6068c5007a5cebf091039fdea83b88b1fd87f4 + image: gcr.io/knative-releases/knative.dev/serving/cmd/queue@sha256:d313c823f25a09326a7c3c2ec9833c5e005791bc3acb4036ebf33735cbb62bee --- # Copyright 2018 The Knative Authors # @@ -468,9 +459,9 @@ metadata: labels: app.kubernetes.io/component: autoscaler app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" annotations: - knative.dev/example-checksum: "c727b3e8" + knative.dev/example-checksum: "47c2487f" data: _example: | ################################ @@ -620,7 +611,7 @@ data: # The `unit` is one concurrent request proxied by the activator. # activator-capacity must be at least 1. # This value is used for computation of the Activator subset size. - # See the algorithm here: https://bit.ly/38XiCZ3. + # See the algorithm here: http://bit.ly/38XiCZ3. # TODO(vagababov): tune after actual benchmarking. activator-capacity: "100.0" @@ -678,7 +669,7 @@ metadata: labels: app.kubernetes.io/name: knative-serving app.kubernetes.io/component: controller - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" networking.knative.dev/certificate-provider: cert-manager annotations: knative.dev/example-checksum: "b7a9a602" @@ -747,7 +738,7 @@ metadata: labels: app.kubernetes.io/name: knative-serving app.kubernetes.io/component: controller - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" annotations: knative.dev/example-checksum: "5b64ff5c" data: @@ -901,13 +892,13 @@ metadata: labels: app.kubernetes.io/name: knative-serving app.kubernetes.io/component: controller - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" annotations: - knative.dev/example-checksum: "555b4826" + knative.dev/example-checksum: "720ddb97" data: # This is the Go import path for the binary that is containerized # and substituted here. - queue-sidecar-image: gcr.io/knative-releases/knative.dev/serving/cmd/queue@sha256:b1af8bda6c1d32b1cf5fbf8f1f6068c5007a5cebf091039fdea83b88b1fd87f4 + queue-sidecar-image: gcr.io/knative-releases/knative.dev/serving/cmd/queue@sha256:d313c823f25a09326a7c3c2ec9833c5e005791bc3acb4036ebf33735cbb62bee _example: |- ################################ # # @@ -973,25 +964,6 @@ data: # If omitted, or empty, no rootCA is added to the golang rootCAs queue-sidecar-rootca: "" - # Sets the minimum TLS version for the queue proxy sidecar's TLS server. - # Accepted values: "1.2", "1.3". Default is "1.3" if not specified. - queue-sidecar-tls-min-version: "" - - # Sets the maximum TLS version for the queue proxy sidecar's TLS server. - # Accepted values: "1.2", "1.3". If omitted, the Go default is used. - queue-sidecar-tls-max-version: "" - - # Sets the cipher suites for the queue proxy sidecar's TLS server. - # Comma-separated list of cipher suite names (e.g. "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"). - # If omitted, the Go default cipher suites are used. - # Note: cipher suites are not configurable in TLS 1.3. - queue-sidecar-tls-cipher-suites: "" - - # Sets the elliptic curve preferences for the queue proxy sidecar's TLS server. - # Comma-separated list of curve names (e.g. "X25519,CurveP256"). - # If omitted, the Go default curves are used. - queue-sidecar-tls-curve-preferences: "" - # If set, it automatically configures pod anti-affinity requirements for all Knative services. # It employs the `preferredDuringSchedulingIgnoredDuringExecution` weighted pod affinity term, # aligning with the Knative revision label. It yields the configuration below in all workloads' deployments: @@ -1023,15 +995,6 @@ data: # selector: # use-gvisor: "please" runtime-class-name: "" - - # pod-is-always-schedulable can be used to define that Pods in the system will always be - # scheduled, and a Revision should not be marked unschedulable. - # Setting this to `true` makes sense if you have cluster-autoscaling set up for your cluster - # where unschedulable Pods trigger the addition of a new Node and are therefore a short and - # transient state. - # - # See https://github.com/knative/serving/issues/14862 - pod-is-always-schedulable: "false" --- # Copyright 2018 The Knative Authors # @@ -1055,7 +1018,7 @@ metadata: labels: app.kubernetes.io/name: knative-serving app.kubernetes.io/component: controller - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" annotations: knative.dev/example-checksum: "26c09de5" data: @@ -1119,9 +1082,9 @@ metadata: labels: app.kubernetes.io/name: knative-serving app.kubernetes.io/component: controller - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" annotations: - knative.dev/example-checksum: "bee75b26" + knative.dev/example-checksum: "632d47dd" data: _example: |- ################################ @@ -1142,11 +1105,8 @@ data: # Default SecurityContext settings to secure-by-default values # if unset. # - # Disabled - do nothing; no security options are applied - # AllowRootBounded - Applies secure defaults without enforcing strict policies; sets seccompProfile - # to RuntimeDefault and drops all capabilities - # Enabled - Enforces security defaults; sets seccompProfile to RuntimeDefault, drops all capabilities, - # and sets runAsNonRoot to true if not already specified. + # This value will default to "enabled" in a future release, + # probably Knative 1.10 secure-pod-defaults: "disabled" # Indicates whether multi container support is enabled @@ -1240,24 +1200,6 @@ data: # See: https://knative.dev/docs/serving/configuration/feature-flags/#kubernetes-share-process-namespace kubernetes.podspec-shareprocessnamespace: "disabled" - # Indicates whether hostIPC support is enabled - # - # WARNING: Cannot safely be disabled once enabled. - # See https://knative.dev/docs/serving/configuration/feature-flags/#kubernetes-host-ipc - kubernetes.podspec-hostipc: "disabled" - - # Indicates whether hostPID support is enabled - # - # WARNING: Cannot safely be disabled once enabled. - # See https://knative.dev/docs/serving/configuration/feature-flags/#kubernetes-host-pid - kubernetes.podspec-hostpid: "disabled" - - # Indicates whether hostNetwork support is enabled - # - # WARNING: Cannot safely be disabled once enabled. - # See See https://knative.dev/docs/serving/configuration/feature-flags/#kubernetes-host-network - kubernetes.podspec-hostnetwork: "disabled" - # Indicates whether Kubernetes PriorityClassName support is enabled # # WARNING: Cannot safely be disabled once enabled. @@ -1276,6 +1218,15 @@ data: # For a list of possible capabilities, see https://man7.org/linux/man-pages/man7/capabilities.7.html kubernetes.containerspec-addcapabilities: "disabled" + # This feature validates PodSpecs from the validating webhook + # against the K8s API Server. + # + # When "enabled", the server will always run the extra validation. + # When "allowed", the server will not run the dry-run validation by default. + # However, clients may enable the behavior on an individual Service by + # attaching the following metadata annotation: "features.knative.dev/podspec-dryrun":"enabled". + # See: https://knative.dev/docs/serving/feature-flags/#kubernetes-dry-run + kubernetes.podspec-dryrun: "allowed" # Controls whether tag header based routing feature are enabled or not. # 1. Enabled: enabling tag header based routing @@ -1293,24 +1244,6 @@ data: # 2. Disabled: disabling EmptyDir volume support kubernetes.podspec-volumes-emptydir: "enabled" - # Controls whether volume support for image is enabled or not. - # 1. Enabled: enabling image volume support - # 2. Disabled: disabling image volume support - kubernetes.podspec-volumes-image: "disabled" - - # Controls whether volume support for HostPath is enabled or not. - # WARNING: Cannot safely be disabled once enabled. - # WARNING: If you can avoid using a hostPath volume, you should. - # Please read https://kubernetes.io/docs/concepts/storage/volumes/#hostpath before enabling this feature. - # 1. Enabled: enabling HostPath volume support - # 2. Disabled: disabling HostPath volume support - kubernetes.podspec-volumes-hostpath: "disabled" - - # Controls whether volume support for CSI is enabled or not. - # 1. Enabled: enabling CSI volume support - # 2. Disabled: disabling CSI volume support - kubernetes.podspec-volumes-csi: "disabled" - # Controls whether init containers support is enabled or not. # 1. Enabled: enabling init containers support # 2. Disabled: disabling init containers support @@ -1326,18 +1259,13 @@ data: # 2. Disabled: disabling write access for persistent volumes kubernetes.podspec-persistent-volume-write: "disabled" - # Controls whether volume mount propagation support is enabled or not. - # 1. Enabled: enabling volume mount propagation support - # 2. Disabled: disabling volume mount propagation support - kubernetes.podspec-volumes-mount-propagation: "disabled" - # Controls if the queue proxy podInfo feature is enabled, allowed or disabled # # This feature should be enabled/allowed when using queue proxy Options (Extensions) # Enabling will mount a podInfo volume to the queue proxy container. # The volume will contains an 'annotations' file (from the pod's annotation field). # The annotations in this file include the Service annotations set by the client creating the service. - # If mounted, the annotations can be accessed by queue proxy extensions at /etc/podinfo/annotations + # If mounted, the annotations can be accessed by queue proxy extensions at /etc/podinfo/annnotations # # 1. "enabled": always mount a podInfo volume # 2. "disabled": never mount a podInfo volume @@ -1373,7 +1301,7 @@ metadata: labels: app.kubernetes.io/name: knative-serving app.kubernetes.io/component: controller - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" annotations: knative.dev/example-checksum: "aa3813a8" data: @@ -1472,7 +1400,7 @@ metadata: labels: app.kubernetes.io/name: knative-serving app.kubernetes.io/component: controller - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" annotations: knative.dev/example-checksum: "f4b71f57" data: @@ -1531,7 +1459,7 @@ metadata: name: config-logging namespace: knative-serving labels: - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" app.kubernetes.io/component: logging app.kubernetes.io/name: knative-serving annotations: @@ -1613,7 +1541,7 @@ metadata: labels: app.kubernetes.io/name: knative-serving app.kubernetes.io/component: networking - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" annotations: knative.dev/example-checksum: "0573e07d" data: @@ -1817,9 +1745,9 @@ metadata: labels: app.kubernetes.io/name: knative-serving app.kubernetes.io/component: observability - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" annotations: - knative.dev/example-checksum: "59abacb5" + knative.dev/example-checksum: "54abd711" data: _example: | ################################ @@ -1877,70 +1805,42 @@ data: # PodIP string // IP of the pod hosting the revision # } # - logging.request-log-template: '{"httpRequest": {"requestMethod": "{{.Request.Method}}", "requestUrl": "{{js .Request.RequestURI}}", "requestSize": "{{.Request.ContentLength}}", "status": {{.Response.Code}}, "responseSize": "{{.Response.Size}}", "userAgent": "{{js .Request.UserAgent}}", "remoteIp": "{{js .Request.RemoteAddr}}", "serverIp": "{{.Revision.PodIP}}", "referer": "{{js .Request.Referer}}", "latency": "{{.Response.Latency}}s", "protocol": "{{.Request.Proto}}"}, "traceId": "{{.TraceID}}"}' + logging.request-log-template: '{"httpRequest": {"requestMethod": "{{.Request.Method}}", "requestUrl": "{{js .Request.RequestURI}}", "requestSize": "{{.Request.ContentLength}}", "status": {{.Response.Code}}, "responseSize": "{{.Response.Size}}", "userAgent": "{{js .Request.UserAgent}}", "remoteIp": "{{js .Request.RemoteAddr}}", "serverIp": "{{.Revision.PodIP}}", "referer": "{{js .Request.Referer}}", "latency": "{{.Response.Latency}}s", "protocol": "{{.Request.Proto}}"}, "traceId": "{{index .Request.Header "X-B3-Traceid"}}"}' # If true, the request logging will be enabled. + # NB: up to and including Knative version 0.18 if logging.request-log-template is non-empty, this value + # will be ignored. logging.enable-request-log: "false" # If true, this enables queue proxy writing request logs for probe requests to stdout. # It uses the same template for user requests, i.e. logging.request-log-template. logging.enable-probe-request-log: "false" - # metrics-protocol field specifies the protocol used when exporting metrics - # It supports either 'none' (the default), 'prometheus', 'http/protobuf' (OTLP HTTP), 'grpc' (OTLP gRPC) - metrics-protocol: http/protobuf - - # metrics-endpoint field specifies the destination metrics should be exporter to. - # - # The endpoint MUST be set when the protocol is http/protobuf or grpc. - # The endpoint MUST NOT be set when the protocol is none. - # - # When the protocol is prometheus the endpoint can accept a 'host:port' string to customize the - # listening host interface and port. - metrics-endpoint: http://example.com/v1/traces - - # metrics-export-interval specifies the global metrics reporting period for control and data plane components. - # If a zero or negative value is passed the default reporting OTel period is used (60 secs). - metrics-export-interval: 60s + # metrics.backend-destination field specifies the system metrics destination. + # It supports either prometheus (the default) or opencensus. + metrics.backend-destination: prometheus - # request-metrics-protocol field specifies the protocol used when exporting queue-proxy metrics - # It supports either 'none' (the default), 'prometheus', 'http/protobuf' (OTLP HTTP), 'grpc' (OTLP gRPC) - request-metrics-protocol: http/protobuf + # metrics.reporting-period-seconds specifies the global metrics reporting period for control and data plane components. + # If a zero or negative value is passed the default reporting period is used (10 secs). + # If the attribute is not specified a default value is used per metrics backend. + # For the prometheus backend the default reporting period is 5s while for opencensus it is 60s. + metrics.reporting-period-seconds: "5" - # request-metrics-endpoint field specifies the destination metrics from the queue proxy should be exporter to. - # - # The endpoint MUST be set when the protocol is http/protobuf or grpc. - # The endpoint MUST NOT be set when the protocol is none. - # - # When the protocol is prometheus the endpoint can accept a 'host:port' string to customize the - # listening host interface and port. - request-metrics-endpoint: http://promstack-kube-prometheus-prometheus.observability:9090/api/v1/otlp/v1/metrics + # metrics.request-metrics-backend-destination specifies the request metrics + # destination. It enables queue proxy to send request metrics. + # Currently supported values: prometheus (the default), opencensus. + metrics.request-metrics-backend-destination: prometheus - # request-metrics-export-interval specifies the global metrics reporting period for the queue-proxy. - # - # If a zero or negative value is passed the default reporting OTel period is used (60 secs). - request-metrics-export-interval: 60s + # metrics.request-metrics-reporting-period-seconds specifies the request metrics reporting period in sec at queue proxy. + # If a zero or negative value is passed the default reporting period is used (10 secs). + # If the attribute is not specified, it is overridden by the value of metrics.reporting-period-seconds. + metrics.request-metrics-reporting-period-seconds: "5" - # runtime-profiling indicates whether it is allowed to retrieve runtime profiling data from + # profiling.enable indicates whether it is allowed to retrieve runtime profiling data from # the pods via an HTTP server in the format expected by the pprof visualization tool. When # enabled, the Knative Serving pods expose the profiling data on an alternate HTTP port 8008. # The HTTP context root for profiling is then /debug/pprof/. - runtime-profiling: enabled - - # tracing-protocol field specifies the protocol used when exporting traces - # It supports either 'none' (the default), 'http/protobuf' (OTLP HTTP), 'grpc' (OTLP gRPC) - # or `stdout` for debugging purposes - tracing-protocol: http/protobuf - - # tracing-endpoint field specifies the destination traces should be exporter to. - # - # The endpoint MUST be set when the protocol is http/protobuf or grpc. - # The endpoint MUST NOT be set when the protocol is none. - tracing-endpoint: http://jaeger-collector.observability:4318/v1/traces - - # tracing-sampling-rate allows the user to specify what percentage of all traces should be exported - # The value should be between 0 (never sample) to 1 (always sample) - tracing-sampling-rate: "1" + profiling.enable: "false" --- # Copyright 2019 The Knative Authors # @@ -1964,16 +1864,39 @@ metadata: labels: app.kubernetes.io/name: knative-serving app.kubernetes.io/component: tracing - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" annotations: - knative.dev/example-checksum: "04c7e9a3" + knative.dev/example-checksum: "26614636" data: _example: | - ########################################################### - # # - # This config is deprecated - use config-observability # - # # - ########################################################### + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this example block and unindented to be in the data block + # to actually change the configuration. + # + # This may be "zipkin" or "none" (default) + backend: "none" + + # URL to zipkin collector where traces are sent. + # This must be specified when backend is "zipkin" + zipkin-endpoint: "http://zipkin.istio-system.svc.cluster.local:9411/api/v2/spans" + + # Enable zipkin debug mode. This allows all spans to be sent to the server + # bypassing sampling. + debug: "false" + + # Percentage (0-1) of requests to trace + sample-rate: "0.1" --- # Copyright 2020 The Knative Authors # @@ -1997,7 +1920,7 @@ metadata: labels: app.kubernetes.io/component: activator app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" spec: minReplicas: 1 maxReplicas: 20 @@ -2025,7 +1948,7 @@ metadata: labels: app.kubernetes.io/component: activator app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" spec: minAvailable: 80% selector: @@ -2053,7 +1976,7 @@ metadata: namespace: knative-serving labels: app.kubernetes.io/component: activator - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" app.kubernetes.io/name: knative-serving spec: selector: @@ -2067,7 +1990,7 @@ spec: role: activator app.kubernetes.io/component: activator app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" spec: # To avoid node becoming SPOF, spread our replicas to different nodes. affinity: @@ -2084,7 +2007,7 @@ spec: - name: activator # This is the Go import path for the binary that is containerized # and substituted here. - image: gcr.io/knative-releases/knative.dev/serving/cmd/activator@sha256:5deaef961fef8d1417f6d4a4dfae2fc338f2d30d72c4ad58c3ab392b2c04705b + image: gcr.io/knative-releases/knative.dev/serving/cmd/activator@sha256:b6d7d96edd8942d679757249f6aa07373461411104ce7c93309f23fba2884f8f # The numbers are based on performance test results from # https://github.com/knative/serving/issues/1625#issuecomment-511930023 resources: @@ -2114,6 +2037,9 @@ spec: value: config-logging - name: CONFIG_OBSERVABILITY_NAME value: config-observability + # TODO(https://github.com/knative/pkg/pull/953): Remove stackdriver specific config + - name: METRICS_DOMAIN + value: knative.dev/internal/serving securityContext: allowPrivilegeEscalation: false readOnlyRootFilesystem: true @@ -2160,7 +2086,7 @@ metadata: labels: app: activator app.kubernetes.io/component: activator - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" app.kubernetes.io/name: knative-serving spec: selector: @@ -2206,7 +2132,7 @@ metadata: labels: app.kubernetes.io/component: autoscaler app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" spec: replicas: 1 selector: @@ -2222,7 +2148,7 @@ spec: app: autoscaler app.kubernetes.io/component: autoscaler app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" spec: # To avoid node becoming SPOF, spread our replicas to different nodes. affinity: @@ -2239,7 +2165,7 @@ spec: - name: autoscaler # This is the Go import path for the binary that is containerized # and substituted here. - image: gcr.io/knative-releases/knative.dev/serving/cmd/autoscaler@sha256:5bae38655d87df86b041083fbe51791816473245f752432ba9b85a7b12f73cd5 + image: gcr.io/knative-releases/knative.dev/serving/cmd/autoscaler@sha256:119157d871eb3db5a54944464d9920ad378d35292d4c12fd4a765cd016e24f0f resources: requests: cpu: 100m @@ -2264,6 +2190,9 @@ spec: value: config-logging - name: CONFIG_OBSERVABILITY_NAME value: config-observability + # TODO(https://github.com/knative/pkg/pull/953): Remove stackdriver specific config + - name: METRICS_DOMAIN + value: knative.dev/serving securityContext: allowPrivilegeEscalation: false readOnlyRootFilesystem: true @@ -2295,7 +2224,7 @@ metadata: app: autoscaler app.kubernetes.io/component: autoscaler app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" name: autoscaler namespace: knative-serving spec: @@ -2335,7 +2264,7 @@ metadata: labels: app.kubernetes.io/component: controller app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" spec: selector: matchLabels: @@ -2346,7 +2275,7 @@ spec: app: controller app.kubernetes.io/component: controller app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" spec: # To avoid node becoming SPOF, spread our replicas to different nodes. affinity: @@ -2363,7 +2292,7 @@ spec: - name: controller # This is the Go import path for the binary that is containerized # and substituted here. - image: gcr.io/knative-releases/knative.dev/serving/cmd/controller@sha256:94329d85200c2fc31ed1166a26568ca1357376c149c147e71f400cf28be3c816 + image: gcr.io/knative-releases/knative.dev/serving/cmd/controller@sha256:80b9865a585900af6cecead24babe03aa79487e9e6306da1444b04148c21c96f resources: requests: cpu: 100m @@ -2384,6 +2313,9 @@ spec: value: config-logging - name: CONFIG_OBSERVABILITY_NAME value: config-observability + # TODO(https://github.com/knative/pkg/pull/953): Remove stackdriver specific config + - name: METRICS_DOMAIN + value: knative.dev/internal/serving securityContext: allowPrivilegeEscalation: false readOnlyRootFilesystem: true @@ -2422,7 +2354,7 @@ metadata: app: controller app.kubernetes.io/component: controller app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" name: controller namespace: knative-serving spec: @@ -2459,7 +2391,7 @@ metadata: labels: app.kubernetes.io/component: webhook app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" spec: minReplicas: 1 maxReplicas: 5 @@ -2485,7 +2417,7 @@ metadata: labels: app.kubernetes.io/component: webhook app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" spec: minAvailable: 80% selector: @@ -2513,7 +2445,7 @@ metadata: namespace: knative-serving labels: app.kubernetes.io/component: webhook - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" app.kubernetes.io/name: knative-serving spec: selector: @@ -2526,7 +2458,7 @@ spec: app: webhook role: webhook app.kubernetes.io/component: webhook - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" app.kubernetes.io/name: knative-serving spec: # To avoid node becoming SPOF, spread our replicas to different nodes. @@ -2544,7 +2476,7 @@ spec: - name: webhook # This is the Go import path for the binary that is containerized # and substituted here. - image: gcr.io/knative-releases/knative.dev/serving/cmd/webhook@sha256:8470456be214e93a84e3c7b79a632aa9978bd8ecda553feaa47878a2c24ab84d + image: gcr.io/knative-releases/knative.dev/serving/cmd/webhook@sha256:732d9cdf7f5fa5c6055d26b1aa5aad40e3d74ba9f2cb76a1db0f0e4d072b7cd0 resources: requests: cpu: 100m @@ -2569,6 +2501,9 @@ spec: value: webhook - name: WEBHOOK_PORT value: "8443" + # TODO(https://github.com/knative/pkg/pull/953): Remove stackdriver specific config + - name: METRICS_DOMAIN + value: knative.dev/internal/serving securityContext: allowPrivilegeEscalation: false readOnlyRootFilesystem: true @@ -2608,7 +2543,7 @@ metadata: app: webhook role: webhook app.kubernetes.io/component: webhook - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" app.kubernetes.io/name: knative-serving name: webhook namespace: knative-serving @@ -2649,7 +2584,7 @@ metadata: labels: app.kubernetes.io/component: webhook app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" webhooks: - admissionReviewVersions: ["v1", "v1beta1"] clientConfig: @@ -2690,7 +2625,7 @@ metadata: labels: app.kubernetes.io/component: webhook app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" webhooks: - admissionReviewVersions: ["v1", "v1beta1"] clientConfig: @@ -2746,7 +2681,7 @@ metadata: labels: app.kubernetes.io/component: webhook app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" webhooks: - admissionReviewVersions: ["v1", "v1beta1"] clientConfig: @@ -2804,5 +2739,5 @@ metadata: labels: app.kubernetes.io/component: webhook app.kubernetes.io/name: knative-serving - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" # The data is populated at install time. diff --git a/packages/manifests/operators/knative-serving/v1.22.1/03-kourier.yaml b/packages/manifests/operators/knative-serving/v1.15.0/03-kourier.yaml similarity index 81% rename from packages/manifests/operators/knative-serving/v1.22.1/03-kourier.yaml rename to packages/manifests/operators/knative-serving/v1.15.0/03-kourier.yaml index d38be35..6002495 100644 --- a/packages/manifests/operators/knative-serving/v1.22.1/03-kourier.yaml +++ b/packages/manifests/operators/knative-serving/v1.15.0/03-kourier.yaml @@ -1,4 +1,4 @@ -# Source: https://github.com/knative-extensions/net-kourier/releases/download/knative-v1.22.1/kourier.yaml +# Source: https://github.com/knative-extensions/net-kourier/releases/download/knative-v1.15.0/kourier.yaml # Copyright 2020 The Knative Authors # # Licensed under the Apache License, Version 2.0 (the "License"); @@ -21,7 +21,7 @@ metadata: networking.knative.dev/ingress-provider: kourier app.kubernetes.io/name: knative-serving app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" --- # Copyright 2020 The Knative Authors # @@ -45,7 +45,7 @@ metadata: labels: networking.knative.dev/ingress-provider: kourier app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" app.kubernetes.io/name: knative-serving data: envoy-bootstrap.yaml: | @@ -173,7 +173,7 @@ metadata: labels: networking.knative.dev/ingress-provider: kourier app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" app.kubernetes.io/name: knative-serving data: _example: | @@ -197,11 +197,6 @@ data: # probes etc. must be configured via the bootstrap config. enable-service-access-logging: "true" - # Specifies the format of the access log used by the Kourier gateway. - # This template follows the envoy format. - # see: https://www.envoyproxy.io/docs/envoy/latest/configuration/observability/access_log/usage#access-logging - service-access-log-template: "" - # Specifies whether to use proxy-protocol in order to safely # transport connection information such as a client's address # across multiple layers of TCP proxies. @@ -230,76 +225,10 @@ data: # right side of the x-forwarded-for HTTP header to trust. trusted-hops-count: "0" - # Configures the connection manager to use the real remote address - # of the client connection when determining internal versus external origin and manipulating various headers. - use-remote-address: "false" - # Specifies the cipher suites for TLS external listener. # Use ',' separated values like "ECDHE-ECDSA-AES128-GCM-SHA256,ECDHE-ECDSA-CHACHA20-POLY1305" # The default uses the default cipher suites of the envoy version. cipher-suites: "" - - # Disable the Envoy server header injection in the response when response has no such header. - disable-envoy-server-header: "false" - - # The external authorization service and port, my-auth:2222. - # This value overrides environment variable if defined. - extauthz-host: "" - - # The protocol used to query the ext auth service. Can be one of : grpc, http, https. Defaults to grpc - # This value overrides environment variable if defined. - extauthz-protocol: "grpc" - - # Allow traffic to go through if the ext auth service is down. Accepts true/false. - # This value overrides environment variable if defined. - extauthz-failure-mode-allow: "" - - # Max request bytes, if not set, defaults to 8192 Bytes. More info Envoy Docs - # see: https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/http/ext_authz/v3/ext_authz.proto.html#extensions-filters-http-ext-authz-v3-buffersettings - # This value overrides environment variable if defined. - extauthz-max-request-body-bytes: 8192 - - # Max time in ms to wait for the ext authz service. Defaults to 2000 ms - # This value overrides environment variable if defined. - extauthz-timeout: 2000 - - # If extauthz-protocol is equal to http or https, path to query the ext auth service. - # Example : if set to /verify, it will query /verify/ (notice the trailing /). If not set, it will query / - # This value overrides environment variable if defined. - extauthz-path-prefix: "" - - # If extauthz-protocol is equal to grpc, sends the body as raw bytes instead of a UTF-8 string. - # Accepts only true/false, t/f or 1/0. Attempting to set another value will throw an error. - # Defaults to false. More info Envoy Docs. - # see: https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/http/ext_authz/v3/ext_authz.proto.html#extensions-filters-http-ext-authz-v3-buffersettings - # This value overrides environment variable if defined. - extauthz-pack-as-byte: "false" - - # Specifies the secret that contains the TLS certificate and key pair when using HTTPS communication with Kourier Ingress. - # This value overrides environment variable if defined. - certs-secret-name: "" - certs-secret-namespace: "" - - # Specifies the OTLP collector endpoint for distributed tracing. - # The endpoint format depends on the protocol (see tracing-protocol). - # Examples: - # - For HTTP: "http://otel-collector.observability.svc:4318/v1/traces" - # - For gRPC: "http://otel-collector.observability.svc:4317" - # Use an empty value to disable distributed tracing (default). - tracing-endpoint: "" - - # Protocol for tracing collector communication. - # Valid values: http/protobuf, grpc - tracing-protocol: "grpc" - - # Tracing sampling rate (0.0 to 1.0) - # Controls the percentage of requests that are traced. - # Example: "1.0" traces 100% of requests. - tracing-sampling-rate: "1.0" - - # Service name for traces - # This identifies the Kourier gateway in your tracing system. - tracing-service-name: "kourier-knative" --- # Copyright 2020 The Knative Authors # @@ -323,7 +252,7 @@ metadata: labels: networking.knative.dev/ingress-provider: kourier app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" app.kubernetes.io/name: knative-serving --- apiVersion: rbac.authorization.k8s.io/v1 @@ -333,21 +262,18 @@ metadata: labels: networking.knative.dev/ingress-provider: kourier app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" app.kubernetes.io/name: knative-serving rules: - apiGroups: [""] resources: ["events"] verbs: ["create", "update", "patch"] - apiGroups: [""] - resources: ["pods", "services", "secrets"] + resources: ["pods", "endpoints", "services", "secrets"] verbs: ["get", "list", "watch"] - apiGroups: [""] resources: ["configmaps"] verbs: ["get", "list", "watch"] - - apiGroups: ["discovery.k8s.io"] - resources: ["endpointslices"] - verbs: ["get", "list", "watch"] - apiGroups: ["coordination.k8s.io"] resources: ["leases"] verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] @@ -365,7 +291,7 @@ metadata: labels: networking.knative.dev/ingress-provider: kourier app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" app.kubernetes.io/name: knative-serving roleRef: apiGroup: rbac.authorization.k8s.io @@ -398,7 +324,7 @@ metadata: labels: networking.knative.dev/ingress-provider: kourier app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" app.kubernetes.io/name: knative-serving spec: strategy: @@ -420,11 +346,9 @@ spec: app: net-kourier-controller spec: containers: - - image: gcr.io/knative-releases/knative.dev/net-kourier/cmd/kourier@sha256:01abd2070ccf8680885c47990e42c05c09e30bc8595d9246f4dcd37f2220a2a2 + - image: gcr.io/knative-releases/knative.dev/net-kourier/cmd/kourier@sha256:c9016f34165c5118373c75dcc373d1cd802fe37ffa9e1bce65960942a59bc5f1 name: controller env: - # CERTS_SECRET_NAMESPACE and CERTS_SECRET_NAME can also be configured from a ConfigMap. - # Settings configured in a configmap take precedence over environment variable settings. - name: CERTS_SECRET_NAMESPACE value: "" - name: CERTS_SECRET_NAME @@ -490,7 +414,7 @@ metadata: labels: networking.knative.dev/ingress-provider: kourier app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" app.kubernetes.io/name: knative-serving spec: ports: @@ -528,7 +452,7 @@ metadata: labels: networking.knative.dev/ingress-provider: kourier app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" app.kubernetes.io/name: knative-serving spec: strategy: @@ -563,7 +487,7 @@ spec: env: - name: DRAIN_TIME_SECONDS value: "15" - image: docker.io/envoyproxy/envoy:v1.37-latest + image: docker.io/envoyproxy/envoy:v1.26-latest name: kourier-gateway ports: - name: http2-external @@ -613,7 +537,6 @@ spec: initialDelaySeconds: 10 periodSeconds: 5 failureThreshold: 3 - timeoutSeconds: 3 livenessProbe: httpGet: httpHeaders: @@ -625,7 +548,6 @@ spec: initialDelaySeconds: 10 periodSeconds: 5 failureThreshold: 6 - timeoutSeconds: 3 resources: requests: cpu: 200m @@ -649,7 +571,7 @@ metadata: labels: networking.knative.dev/ingress-provider: kourier app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" app.kubernetes.io/name: knative-serving spec: ports: @@ -673,7 +595,7 @@ metadata: labels: networking.knative.dev/ingress-provider: kourier app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" app.kubernetes.io/name: knative-serving spec: ports: @@ -697,7 +619,7 @@ metadata: labels: networking.knative.dev/ingress-provider: kourier app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" app.kubernetes.io/name: knative-serving spec: minReplicas: 1 @@ -723,7 +645,7 @@ metadata: labels: networking.knative.dev/ingress-provider: kourier app.kubernetes.io/component: net-kourier - app.kubernetes.io/version: "1.22.1" + app.kubernetes.io/version: "1.15.0" app.kubernetes.io/name: knative-serving spec: minAvailable: 80% diff --git a/packages/manifests/scripts/pull-manifests.ts b/packages/manifests/scripts/pull-manifests.ts index 43e668f..aab4673 100644 --- a/packages/manifests/scripts/pull-manifests.ts +++ b/packages/manifests/scripts/pull-manifests.ts @@ -98,14 +98,20 @@ const OPERATORS: OperatorConfig[] = [ sources: [ { type: 'urls', - version: 'v1.22.1', + // Held at v1.15.0 for now. v1.22.1 is what downstream installs and is + // where this should land, but bumping it here fails the knative e2e in + // a way that does not reproduce locally -- the same manifests, applied + // in the same order after cert-manager, install cleanly with the + // webhook up in ~14s. That is a client-side apply problem to chase on + // its own, not something to hold the pinning work behind. + version: 'v1.15.0', urls: [ - 'https://github.com/knative/serving/releases/download/knative-v1.22.1/serving-crds.yaml', - 'https://github.com/knative/serving/releases/download/knative-v1.22.1/serving-core.yaml', + 'https://github.com/knative/serving/releases/download/knative-v1.15.0/serving-crds.yaml', + 'https://github.com/knative/serving/releases/download/knative-v1.15.0/serving-core.yaml', // knative-extensions, not knative: the old path redirects, so both // work and neither is obviously wrong — which is how two consumers // came to name different repos for the same file. - 'https://github.com/knative-extensions/net-kourier/releases/download/knative-v1.22.1/kourier.yaml', + 'https://github.com/knative-extensions/net-kourier/releases/download/knative-v1.15.0/kourier.yaml', ], }, ], diff --git a/packages/manifests/src/generated/index.ts b/packages/manifests/src/generated/index.ts index 5c50fd5..4ae7f82 100644 --- a/packages/manifests/src/generated/index.ts +++ b/packages/manifests/src/generated/index.ts @@ -23,7 +23,7 @@ export const OPERATOR_IDS: ReadonlyArray = ["cert-manager", "cloudnative export const OPERATOR_VERSIONS = { "cert-manager": ["v1.17.0"], "cloudnative-pg": ["1.25.2"], - "knative-serving": ["v1.22.1"], + "knative-serving": ["v1.15.0"], "kube-prometheus-stack": ["77.5.0"], "minio-operator": ["7.1.1"], "tekton-pipelines": ["v1.15.0"], @@ -42,7 +42,7 @@ export const OPERATOR_MAP: Record 0 and container-concurrency-target-percentage is\n# 100% or 1.0, then activator will always be in the request path.\n# -1 denotes unlimited target-burst-capacity and activator will always\n# be in the request path.\n# Other negative values are invalid.\ntarget-burst-capacity: \"211\"\n\n# When operating in a stable mode, the autoscaler operates on the\n# average concurrency over the stable window.\n# Stable window must be in whole seconds.\nstable-window: \"60s\"\n\n# When observed average concurrency during the panic window reaches\n# panic-threshold-percentage the target concurrency, the autoscaler\n# enters panic mode. When operating in panic mode, the autoscaler\n# scales on the average concurrency over the panic window which is\n# panic-window-percentage of the stable-window.\n# Must be in the [1, 100] range.\n# When computing the panic window it will be rounded to the closest\n# whole second, at least 1s.\npanic-window-percentage: \"10.0\"\n\n# The percentage of the container concurrency target at which to\n# enter panic mode when reached within the panic window.\npanic-threshold-percentage: \"200.0\"\n\n# Max scale up rate limits the rate at which the autoscaler will\n# increase pod count. It is the maximum ratio of desired pods versus\n# observed pods.\n# Cannot be less or equal to 1.\n# I.e with value of 2.0 the number of pods can at most go N to 2N\n# over single Autoscaler period (2s), but at least N to\n# N+1, if Autoscaler needs to scale up.\nmax-scale-up-rate: \"1000.0\"\n\n# Max scale down rate limits the rate at which the autoscaler will\n# decrease pod count. It is the maximum ratio of observed pods versus\n# desired pods.\n# Cannot be less or equal to 1.\n# I.e. with value of 2.0 the number of pods can at most go N to N/2\n# over single Autoscaler evaluation period (2s), but at\n# least N to N-1, if Autoscaler needs to scale down.\nmax-scale-down-rate: \"2.0\"\n\n# Scale to zero feature flag.\nenable-scale-to-zero: \"true\"\n\n# Scale to zero grace period is the time an inactive revision is left\n# running before it is scaled to zero (must be positive, but recommended\n# at least a few seconds if running with mesh networking).\n# This is the upper limit and is provided not to enforce timeout after\n# the revision stopped receiving requests for stable window, but to\n# ensure network reprogramming to put activator in the path has completed.\n# If the system determines that a shorter period is satisfactory,\n# then the system will only wait that amount of time before scaling to 0.\n# NOTE: this period might actually be 0, if activator has been\n# in the request path sufficiently long.\n# If there is necessity for the last pod to linger longer use\n# scale-to-zero-pod-retention-period flag.\nscale-to-zero-grace-period: \"30s\"\n\n# Scale to zero pod retention period defines the minimum amount\n# of time the last pod will remain after Autoscaler has decided to\n# scale to zero.\n# This flag is for the situations where the pod startup is very expensive\n# and the traffic is bursty (requiring smaller windows for fast action),\n# but patchy.\n# The larger of this flag and `scale-to-zero-grace-period` will effectively\n# determine how the last pod will hang around.\nscale-to-zero-pod-retention-period: \"0s\"\n\n# pod-autoscaler-class specifies the default pod autoscaler class\n# that should be used if none is specified. If omitted,\n# the Knative Pod Autoscaler (KPA) is used by default.\npod-autoscaler-class: \"kpa.autoscaling.knative.dev\"\n\n# The capacity of a single activator task.\n# The `unit` is one concurrent request proxied by the activator.\n# activator-capacity must be at least 1.\n# This value is used for computation of the Activator subset size.\n# See the algorithm here: https://bit.ly/38XiCZ3.\n# TODO(vagababov): tune after actual benchmarking.\nactivator-capacity: \"100.0\"\n\n# initial-scale is the cluster-wide default value for the initial target\n# scale of a revision after creation, unless overridden by the\n# \"autoscaling.knative.dev/initialScale\" annotation.\n# This value must be greater than 0 unless allow-zero-initial-scale is true.\ninitial-scale: \"1\"\n\n# allow-zero-initial-scale controls whether either the cluster-wide initial-scale flag,\n# or the \"autoscaling.knative.dev/initialScale\" annotation, can be set to 0.\nallow-zero-initial-scale: \"false\"\n\n# min-scale is the cluster-wide default value for the min scale of a revision,\n# unless overridden by the \"autoscaling.knative.dev/minScale\" annotation.\nmin-scale: \"0\"\n\n# max-scale is the cluster-wide default value for the max scale of a revision,\n# unless overridden by the \"autoscaling.knative.dev/maxScale\" annotation.\n# If set to 0, the revision has no maximum scale.\nmax-scale: \"0\"\n\n# scale-down-delay is the amount of time that must pass at reduced\n# concurrency before a scale down decision is applied. This can be useful,\n# for example, to maintain replica count and avoid a cold start penalty if\n# more requests come in within the scale down delay period.\n# The default, 0s, imposes no delay at all.\nscale-down-delay: \"0s\"\n\n# max-scale-limit sets the maximum permitted value for the max scale of a revision.\n# When this is set to a positive value, a revision with a maxScale above that value\n# (including a maxScale of \"0\" = unlimited) is disallowed.\n# A value of zero (the default) allows any limit, including unlimited.\nmax-scale-limit: \"0\"\n" + _example: "################################\n# #\n# EXAMPLE CONFIGURATION #\n# #\n################################\n\n# This block is not actually functional configuration,\n# but serves to illustrate the available configuration\n# options and document them in a way that is accessible\n# to users that `kubectl edit` this config map.\n#\n# These sample configuration options may be copied out of\n# this example block and unindented to be in the data block\n# to actually change the configuration.\n\n# The Revision ContainerConcurrency field specifies the maximum number\n# of requests the Container can handle at once. Container concurrency\n# target percentage is how much of that maximum to use in a stable\n# state. E.g. if a Revision specifies ContainerConcurrency of 10, then\n# the Autoscaler will try to maintain 7 concurrent connections per pod\n# on average.\n# Note: this limit will be applied to container concurrency set at every\n# level (ConfigMap, Revision Spec or Annotation).\n# For legacy and backwards compatibility reasons, this value also accepts\n# fractional values in (0, 1] interval (i.e. 0.7 ⇒ 70%).\n# Thus minimal percentage value must be greater than 1.0, or it will be\n# treated as a fraction.\n# NOTE: that this value does not affect actual number of concurrent requests\n# the user container may receive, but only the average number of requests\n# that the revision pods will receive.\ncontainer-concurrency-target-percentage: \"70\"\n\n# The container concurrency target default is what the Autoscaler will\n# try to maintain when concurrency is used as the scaling metric for the\n# Revision and the Revision specifies unlimited concurrency.\n# When revision explicitly specifies container concurrency, that value\n# will be used as a scaling target for autoscaler.\n# When specifying unlimited concurrency, the autoscaler will\n# horizontally scale the application based on this target concurrency.\n# This is what we call \"soft limit\" in the documentation, i.e. it only\n# affects number of pods and does not affect the number of requests\n# individual pod processes.\n# The value must be a positive number such that the value multiplied\n# by container-concurrency-target-percentage is greater than 0.01.\n# NOTE: that this value will be adjusted by application of\n# container-concurrency-target-percentage, i.e. by default\n# the system will target on average 70 concurrent requests\n# per revision pod.\n# NOTE: Only one metric can be used for autoscaling a Revision.\ncontainer-concurrency-target-default: \"100\"\n\n# The requests per second (RPS) target default is what the Autoscaler will\n# try to maintain when RPS is used as the scaling metric for a Revision and\n# the Revision specifies unlimited RPS. Even when specifying unlimited RPS,\n# the autoscaler will horizontally scale the application based on this\n# target RPS.\n# Must be greater than 1.0.\n# NOTE: Only one metric can be used for autoscaling a Revision.\nrequests-per-second-target-default: \"200\"\n\n# The target burst capacity specifies the size of burst in concurrent\n# requests that the system operator expects the system will receive.\n# Autoscaler will try to protect the system from queueing by introducing\n# Activator in the request path if the current spare capacity of the\n# service is less than this setting.\n# If this setting is 0, then Activator will be in the request path only\n# when the revision is scaled to 0.\n# If this setting is > 0 and container-concurrency-target-percentage is\n# 100% or 1.0, then activator will always be in the request path.\n# -1 denotes unlimited target-burst-capacity and activator will always\n# be in the request path.\n# Other negative values are invalid.\ntarget-burst-capacity: \"211\"\n\n# When operating in a stable mode, the autoscaler operates on the\n# average concurrency over the stable window.\n# Stable window must be in whole seconds.\nstable-window: \"60s\"\n\n# When observed average concurrency during the panic window reaches\n# panic-threshold-percentage the target concurrency, the autoscaler\n# enters panic mode. When operating in panic mode, the autoscaler\n# scales on the average concurrency over the panic window which is\n# panic-window-percentage of the stable-window.\n# Must be in the [1, 100] range.\n# When computing the panic window it will be rounded to the closest\n# whole second, at least 1s.\npanic-window-percentage: \"10.0\"\n\n# The percentage of the container concurrency target at which to\n# enter panic mode when reached within the panic window.\npanic-threshold-percentage: \"200.0\"\n\n# Max scale up rate limits the rate at which the autoscaler will\n# increase pod count. It is the maximum ratio of desired pods versus\n# observed pods.\n# Cannot be less or equal to 1.\n# I.e with value of 2.0 the number of pods can at most go N to 2N\n# over single Autoscaler period (2s), but at least N to\n# N+1, if Autoscaler needs to scale up.\nmax-scale-up-rate: \"1000.0\"\n\n# Max scale down rate limits the rate at which the autoscaler will\n# decrease pod count. It is the maximum ratio of observed pods versus\n# desired pods.\n# Cannot be less or equal to 1.\n# I.e. with value of 2.0 the number of pods can at most go N to N/2\n# over single Autoscaler evaluation period (2s), but at\n# least N to N-1, if Autoscaler needs to scale down.\nmax-scale-down-rate: \"2.0\"\n\n# Scale to zero feature flag.\nenable-scale-to-zero: \"true\"\n\n# Scale to zero grace period is the time an inactive revision is left\n# running before it is scaled to zero (must be positive, but recommended\n# at least a few seconds if running with mesh networking).\n# This is the upper limit and is provided not to enforce timeout after\n# the revision stopped receiving requests for stable window, but to\n# ensure network reprogramming to put activator in the path has completed.\n# If the system determines that a shorter period is satisfactory,\n# then the system will only wait that amount of time before scaling to 0.\n# NOTE: this period might actually be 0, if activator has been\n# in the request path sufficiently long.\n# If there is necessity for the last pod to linger longer use\n# scale-to-zero-pod-retention-period flag.\nscale-to-zero-grace-period: \"30s\"\n\n# Scale to zero pod retention period defines the minimum amount\n# of time the last pod will remain after Autoscaler has decided to\n# scale to zero.\n# This flag is for the situations where the pod startup is very expensive\n# and the traffic is bursty (requiring smaller windows for fast action),\n# but patchy.\n# The larger of this flag and `scale-to-zero-grace-period` will effectively\n# determine how the last pod will hang around.\nscale-to-zero-pod-retention-period: \"0s\"\n\n# pod-autoscaler-class specifies the default pod autoscaler class\n# that should be used if none is specified. If omitted,\n# the Knative Pod Autoscaler (KPA) is used by default.\npod-autoscaler-class: \"kpa.autoscaling.knative.dev\"\n\n# The capacity of a single activator task.\n# The `unit` is one concurrent request proxied by the activator.\n# activator-capacity must be at least 1.\n# This value is used for computation of the Activator subset size.\n# See the algorithm here: http://bit.ly/38XiCZ3.\n# TODO(vagababov): tune after actual benchmarking.\nactivator-capacity: \"100.0\"\n\n# initial-scale is the cluster-wide default value for the initial target\n# scale of a revision after creation, unless overridden by the\n# \"autoscaling.knative.dev/initialScale\" annotation.\n# This value must be greater than 0 unless allow-zero-initial-scale is true.\ninitial-scale: \"1\"\n\n# allow-zero-initial-scale controls whether either the cluster-wide initial-scale flag,\n# or the \"autoscaling.knative.dev/initialScale\" annotation, can be set to 0.\nallow-zero-initial-scale: \"false\"\n\n# min-scale is the cluster-wide default value for the min scale of a revision,\n# unless overridden by the \"autoscaling.knative.dev/minScale\" annotation.\nmin-scale: \"0\"\n\n# max-scale is the cluster-wide default value for the max scale of a revision,\n# unless overridden by the \"autoscaling.knative.dev/maxScale\" annotation.\n# If set to 0, the revision has no maximum scale.\nmax-scale: \"0\"\n\n# scale-down-delay is the amount of time that must pass at reduced\n# concurrency before a scale down decision is applied. This can be useful,\n# for example, to maintain replica count and avoid a cold start penalty if\n# more requests come in within the scale down delay period.\n# The default, 0s, imposes no delay at all.\nscale-down-delay: \"0s\"\n\n# max-scale-limit sets the maximum permitted value for the max scale of a revision.\n# When this is set to a positive value, a revision with a maxScale above that value\n# (including a maxScale of \"0\" = unlimited) is disallowed.\n# A value of zero (the default) allows any limit, including unlimited.\nmax-scale-limit: \"0\"\n" } }; export const ConfigMap_ConfigCertmanager: KubernetesResource = { @@ -6232,7 +6081,7 @@ export const ConfigMap_ConfigCertmanager: KubernetesResource = { labels: { "app.kubernetes.io/component": "controller", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1", + "app.kubernetes.io/version": "1.15.0", "networking.knative.dev/certificate-provider": "cert-manager" }, name: "config-certmanager", @@ -6252,7 +6101,7 @@ export const ConfigMap_ConfigDefaults: KubernetesResource = { labels: { "app.kubernetes.io/component": "controller", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1" + "app.kubernetes.io/version": "1.15.0" }, name: "config-defaults", namespace: "knative-serving" @@ -6266,19 +6115,19 @@ export const ConfigMap_ConfigDeployment: KubernetesResource = { kind: "ConfigMap", metadata: { annotations: { - "knative.dev/example-checksum": "555b4826" + "knative.dev/example-checksum": "720ddb97" }, labels: { "app.kubernetes.io/component": "controller", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1" + "app.kubernetes.io/version": "1.15.0" }, name: "config-deployment", namespace: "knative-serving" }, data: { - _example: "################################\n# #\n# EXAMPLE CONFIGURATION #\n# #\n################################\n\n# This block is not actually functional configuration,\n# but serves to illustrate the available configuration\n# options and document them in a way that is accessible\n# to users that `kubectl edit` this config map.\n#\n# These sample configuration options may be copied out of\n# this example block and unindented to be in the data block\n# to actually change the configuration.\n\n# List of repositories for which tag to digest resolving should be skipped\nregistries-skipping-tag-resolving: \"kind.local,ko.local,dev.local\"\n\n# Maximum time allowed for an image's digests to be resolved.\ndigest-resolution-timeout: \"10s\"\n\n# Duration we wait for the deployment to be ready before considering it failed.\nprogress-deadline: \"600s\"\n\n# Sets the queue proxy's CPU request.\n# If omitted, a default value (currently \"25m\"), is used.\nqueue-sidecar-cpu-request: \"25m\"\n\n# Sets the queue proxy's CPU limit.\n# If omitted, a default value (currently \"1000m\"), is used when\n# `queueproxy.resource-defaults` is set to `Enabled`.\nqueue-sidecar-cpu-limit: \"1000m\"\n\n# Sets the queue proxy's memory request.\n# If omitted, a default value (currently \"400Mi\"), is used when\n# `queueproxy.resource-defaults` is set to `Enabled`.\nqueue-sidecar-memory-request: \"400Mi\"\n\n# Sets the queue proxy's memory limit.\n# If omitted, a default value (currently \"800Mi\"), is used when\n# `queueproxy.resource-defaults` is set to `Enabled`.\nqueue-sidecar-memory-limit: \"800Mi\"\n\n# Sets the queue proxy's ephemeral storage request.\n# If omitted, no value is specified and the system default is used.\nqueue-sidecar-ephemeral-storage-request: \"512Mi\"\n\n# Sets the queue proxy's ephemeral storage limit.\n# If omitted, no value is specified and the system default is used.\nqueue-sidecar-ephemeral-storage-limit: \"1024Mi\"\n\n# Sets tokens associated with specific audiences for queue proxy - used by QPOptions\n#\n# For example, to add the `service-x` audience:\n# queue-sidecar-token-audiences: \"service-x\"\n# Also supports a list of audiences, for example:\n# queue-sidecar-token-audiences: \"service-x,service-y\"\n# If omitted, or empty, no tokens are created\nqueue-sidecar-token-audiences: \"\"\n\n# Sets rootCA for the queue proxy - used by QPOptions\n# If omitted, or empty, no rootCA is added to the golang rootCAs\nqueue-sidecar-rootca: \"\"\n\n# Sets the minimum TLS version for the queue proxy sidecar's TLS server.\n# Accepted values: \"1.2\", \"1.3\". Default is \"1.3\" if not specified.\nqueue-sidecar-tls-min-version: \"\"\n\n# Sets the maximum TLS version for the queue proxy sidecar's TLS server.\n# Accepted values: \"1.2\", \"1.3\". If omitted, the Go default is used.\nqueue-sidecar-tls-max-version: \"\"\n\n# Sets the cipher suites for the queue proxy sidecar's TLS server.\n# Comma-separated list of cipher suite names (e.g. \"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256\").\n# If omitted, the Go default cipher suites are used.\n# Note: cipher suites are not configurable in TLS 1.3.\nqueue-sidecar-tls-cipher-suites: \"\"\n\n# Sets the elliptic curve preferences for the queue proxy sidecar's TLS server.\n# Comma-separated list of curve names (e.g. \"X25519,CurveP256\").\n# If omitted, the Go default curves are used.\nqueue-sidecar-tls-curve-preferences: \"\"\n\n# If set, it automatically configures pod anti-affinity requirements for all Knative services.\n# It employs the `preferredDuringSchedulingIgnoredDuringExecution` weighted pod affinity term,\n# aligning with the Knative revision label. It yields the configuration below in all workloads' deployments:\n# `\n# affinity:\n# podAntiAffinity:\n# preferredDuringSchedulingIgnoredDuringExecution:\n# - podAffinityTerm:\n# topologyKey: kubernetes.io/hostname\n# labelSelector:\n# matchLabels:\n# serving.knative.dev/revision: {{revision-name}}\n# weight: 100\n# `\n# This may be \"none\" or \"prefer-spread-revision-over-nodes\" (default)\n# default-affinity-type: \"prefer-spread-revision-over-nodes\"\n\n# runtime-class-name contains the selector for which runtimeClassName\n# is selected to put in a revision.\n# By default, it is not set by Knative.\n#\n# Example:\n# runtime-class-name: |\n# \"\":\n# selector:\n# use-default-runc: \"yes\"\n# kata: {}\n# gvisor:\n# selector:\n# use-gvisor: \"please\"\nruntime-class-name: \"\"\n\n# pod-is-always-schedulable can be used to define that Pods in the system will always be\n# scheduled, and a Revision should not be marked unschedulable.\n# Setting this to `true` makes sense if you have cluster-autoscaling set up for your cluster\n# where unschedulable Pods trigger the addition of a new Node and are therefore a short and\n# transient state.\n#\n# See https://github.com/knative/serving/issues/14862\npod-is-always-schedulable: \"false\"", - "queue-sidecar-image": "gcr.io/knative-releases/knative.dev/serving/cmd/queue@sha256:b1af8bda6c1d32b1cf5fbf8f1f6068c5007a5cebf091039fdea83b88b1fd87f4" + _example: "################################\n# #\n# EXAMPLE CONFIGURATION #\n# #\n################################\n\n# This block is not actually functional configuration,\n# but serves to illustrate the available configuration\n# options and document them in a way that is accessible\n# to users that `kubectl edit` this config map.\n#\n# These sample configuration options may be copied out of\n# this example block and unindented to be in the data block\n# to actually change the configuration.\n\n# List of repositories for which tag to digest resolving should be skipped\nregistries-skipping-tag-resolving: \"kind.local,ko.local,dev.local\"\n\n# Maximum time allowed for an image's digests to be resolved.\ndigest-resolution-timeout: \"10s\"\n\n# Duration we wait for the deployment to be ready before considering it failed.\nprogress-deadline: \"600s\"\n\n# Sets the queue proxy's CPU request.\n# If omitted, a default value (currently \"25m\"), is used.\nqueue-sidecar-cpu-request: \"25m\"\n\n# Sets the queue proxy's CPU limit.\n# If omitted, a default value (currently \"1000m\"), is used when\n# `queueproxy.resource-defaults` is set to `Enabled`.\nqueue-sidecar-cpu-limit: \"1000m\"\n\n# Sets the queue proxy's memory request.\n# If omitted, a default value (currently \"400Mi\"), is used when\n# `queueproxy.resource-defaults` is set to `Enabled`.\nqueue-sidecar-memory-request: \"400Mi\"\n\n# Sets the queue proxy's memory limit.\n# If omitted, a default value (currently \"800Mi\"), is used when\n# `queueproxy.resource-defaults` is set to `Enabled`.\nqueue-sidecar-memory-limit: \"800Mi\"\n\n# Sets the queue proxy's ephemeral storage request.\n# If omitted, no value is specified and the system default is used.\nqueue-sidecar-ephemeral-storage-request: \"512Mi\"\n\n# Sets the queue proxy's ephemeral storage limit.\n# If omitted, no value is specified and the system default is used.\nqueue-sidecar-ephemeral-storage-limit: \"1024Mi\"\n\n# Sets tokens associated with specific audiences for queue proxy - used by QPOptions\n#\n# For example, to add the `service-x` audience:\n# queue-sidecar-token-audiences: \"service-x\"\n# Also supports a list of audiences, for example:\n# queue-sidecar-token-audiences: \"service-x,service-y\"\n# If omitted, or empty, no tokens are created\nqueue-sidecar-token-audiences: \"\"\n\n# Sets rootCA for the queue proxy - used by QPOptions\n# If omitted, or empty, no rootCA is added to the golang rootCAs\nqueue-sidecar-rootca: \"\"\n\n# If set, it automatically configures pod anti-affinity requirements for all Knative services.\n# It employs the `preferredDuringSchedulingIgnoredDuringExecution` weighted pod affinity term,\n# aligning with the Knative revision label. It yields the configuration below in all workloads' deployments:\n# `\n# affinity:\n# podAntiAffinity:\n# preferredDuringSchedulingIgnoredDuringExecution:\n# - podAffinityTerm:\n# topologyKey: kubernetes.io/hostname\n# labelSelector:\n# matchLabels:\n# serving.knative.dev/revision: {{revision-name}}\n# weight: 100\n# `\n# This may be \"none\" or \"prefer-spread-revision-over-nodes\" (default)\n# default-affinity-type: \"prefer-spread-revision-over-nodes\"\n\n# runtime-class-name contains the selector for which runtimeClassName\n# is selected to put in a revision.\n# By default, it is not set by Knative.\n#\n# Example:\n# runtime-class-name: |\n# \"\":\n# selector:\n# use-default-runc: \"yes\"\n# kata: {}\n# gvisor:\n# selector:\n# use-gvisor: \"please\"\nruntime-class-name: \"\"", + "queue-sidecar-image": "gcr.io/knative-releases/knative.dev/serving/cmd/queue@sha256:d313c823f25a09326a7c3c2ec9833c5e005791bc3acb4036ebf33735cbb62bee" } }; export const ConfigMap_ConfigDomain: KubernetesResource = { @@ -6291,7 +6140,7 @@ export const ConfigMap_ConfigDomain: KubernetesResource = { labels: { "app.kubernetes.io/component": "controller", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1" + "app.kubernetes.io/version": "1.15.0" }, name: "config-domain", namespace: "knative-serving" @@ -6305,18 +6154,18 @@ export const ConfigMap_ConfigFeatures: KubernetesResource = { kind: "ConfigMap", metadata: { annotations: { - "knative.dev/example-checksum": "bee75b26" + "knative.dev/example-checksum": "632d47dd" }, labels: { "app.kubernetes.io/component": "controller", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1" + "app.kubernetes.io/version": "1.15.0" }, name: "config-features", namespace: "knative-serving" }, data: { - _example: "################################\n# #\n# EXAMPLE CONFIGURATION #\n# #\n################################\n\n# This block is not actually functional configuration,\n# but serves to illustrate the available configuration\n# options and document them in a way that is accessible\n# to users that `kubectl edit` this config map.\n#\n# These sample configuration options may be copied out of\n# this example block and unindented to be in the data block\n# to actually change the configuration.\n\n# Default SecurityContext settings to secure-by-default values\n# if unset.\n#\n# Disabled - do nothing; no security options are applied\n# AllowRootBounded - Applies secure defaults without enforcing strict policies; sets seccompProfile\n# to RuntimeDefault and drops all capabilities\n# Enabled - Enforces security defaults; sets seccompProfile to RuntimeDefault, drops all capabilities,\n# and sets runAsNonRoot to true if not already specified.\nsecure-pod-defaults: \"disabled\"\n\n# Indicates whether multi container support is enabled\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See: https://knative.dev/docs/serving/configuration/feature-flags/#multiple-containers\nmulti-container: \"enabled\"\n\n# Indicates whether multi container probing is enabled\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See: https://knative.dev/docs/serving/configuration/feature-flags/#multiple-container-probing\nmulti-container-probing: \"disabled\"\n\n# Indicates whether Kubernetes affinity support is enabled\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See: https://knative.dev/docs/serving/feature-flags/#kubernetes-node-affinity\nkubernetes.podspec-affinity: \"disabled\"\n\n# Indicates whether Kubernetes topologySpreadConstraints support is enabled\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See: https://knative.dev/docs/serving/feature-flags/#kubernetes-topology-spread-constraints\nkubernetes.podspec-topologyspreadconstraints: \"disabled\"\n\n# Indicates whether Kubernetes hostAliases support is enabled\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See: https://knative.dev/docs/serving/feature-flags/#kubernetes-host-aliases\nkubernetes.podspec-hostaliases: \"disabled\"\n\n# Indicates whether Kubernetes nodeSelector support is enabled\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See: https://knative.dev/docs/serving/feature-flags/#kubernetes-node-selector\nkubernetes.podspec-nodeselector: \"disabled\"\n\n# Indicates whether Kubernetes tolerations support is enabled\n#\n# WARNING: Cannot safely be disabled once enabled\n# See: https://knative.dev/docs/serving/feature-flags/#kubernetes-toleration\nkubernetes.podspec-tolerations: \"disabled\"\n\n# Indicates whether Kubernetes FieldRef support is enabled\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See: https://knative.dev/docs/serving/feature-flags/#kubernetes-fieldref\nkubernetes.podspec-fieldref: \"disabled\"\n\n# Indicates whether Kubernetes RuntimeClassName support is enabled\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See: https://knative.dev/docs/serving/feature-flags/#kubernetes-runtime-class\nkubernetes.podspec-runtimeclassname: \"disabled\"\n\n# Indicates whether Kubernetes DNSPolicy support is enabled\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See: https://knative.dev/docs/serving/feature-flags/#kubernetes-dnspolicy\nkubernetes.podspec-dnspolicy: \"disabled\"\n\n# Indicates whether Kubernetes DNSConfig support is enabled\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See: https://knative.dev/docs/serving/feature-flags/#kubernetes-dnsconfig\nkubernetes.podspec-dnsconfig: \"disabled\"\n\n# This feature allows end-users to set a subset of fields on the Pod's SecurityContext\n#\n# When set to \"enabled\" or \"allowed\" it allows the following\n# PodSecurityContext properties:\n# - FSGroup\n# - RunAsGroup\n# - RunAsNonRoot\n# - SupplementalGroups\n# - RunAsUser\n# - SeccompProfile\n#\n# This feature flag should be used with caution as the PodSecurityContext\n# properties may have a side-effect on non-user sidecar containers that come\n# from Knative or your service mesh\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See: https://knative.dev/docs/serving/feature-flags/#kubernetes-security-context\nkubernetes.podspec-securitycontext: \"disabled\"\n\n# Indicated whether sharing the process namespace via ShareProcessNamespace pod spec is allowed.\n# This can be especially useful for sharing data from images directly between sidecars\n#\n# See: https://knative.dev/docs/serving/configuration/feature-flags/#kubernetes-share-process-namespace\nkubernetes.podspec-shareprocessnamespace: \"disabled\"\n\n# Indicates whether hostIPC support is enabled\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See https://knative.dev/docs/serving/configuration/feature-flags/#kubernetes-host-ipc\nkubernetes.podspec-hostipc: \"disabled\"\n\n# Indicates whether hostPID support is enabled\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See https://knative.dev/docs/serving/configuration/feature-flags/#kubernetes-host-pid\nkubernetes.podspec-hostpid: \"disabled\"\n\n# Indicates whether hostNetwork support is enabled\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See See https://knative.dev/docs/serving/configuration/feature-flags/#kubernetes-host-network\nkubernetes.podspec-hostnetwork: \"disabled\"\n\n# Indicates whether Kubernetes PriorityClassName support is enabled\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See: https://knative.dev/docs/serving/feature-flags/#kubernetes-priority-class-name\nkubernetes.podspec-priorityclassname: \"disabled\"\n\n# Indicates whether Kubernetes SchedulerName support is enabled\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See: https://knative.dev/docs/serving/feature-flags/#kubernetes-scheduler-name\nkubernetes.podspec-schedulername: \"disabled\"\n\n# This feature flag allows end-users to add a subset of capabilities on the Pod's SecurityContext.\n#\n# When set to \"enabled\" or \"allowed\" it allows capabilities to be added to the container.\n# For a list of possible capabilities, see https://man7.org/linux/man-pages/man7/capabilities.7.html\nkubernetes.containerspec-addcapabilities: \"disabled\"\n\n\n# Controls whether tag header based routing feature are enabled or not.\n# 1. Enabled: enabling tag header based routing\n# 2. Disabled: disabling tag header based routing\n# See: https://knative.dev/docs/serving/feature-flags/#tag-header-based-routing\ntag-header-based-routing: \"disabled\"\n\n# Controls whether http2 auto-detection should be enabled or not.\n# 1. Enabled: http2 connection will be attempted via upgrade.\n# 2. Disabled: http2 connection will only be attempted when port name is set to \"h2c\".\nautodetect-http2: \"disabled\"\n\n# Controls whether volume support for EmptyDir is enabled or not.\n# 1. Enabled: enabling EmptyDir volume support\n# 2. Disabled: disabling EmptyDir volume support\nkubernetes.podspec-volumes-emptydir: \"enabled\"\n\n# Controls whether volume support for image is enabled or not.\n# 1. Enabled: enabling image volume support\n# 2. Disabled: disabling image volume support\nkubernetes.podspec-volumes-image: \"disabled\"\n\n# Controls whether volume support for HostPath is enabled or not.\n# WARNING: Cannot safely be disabled once enabled.\n# WARNING: If you can avoid using a hostPath volume, you should.\n# Please read https://kubernetes.io/docs/concepts/storage/volumes/#hostpath before enabling this feature.\n# 1. Enabled: enabling HostPath volume support\n# 2. Disabled: disabling HostPath volume support\nkubernetes.podspec-volumes-hostpath: \"disabled\"\n\n# Controls whether volume support for CSI is enabled or not.\n# 1. Enabled: enabling CSI volume support\n# 2. Disabled: disabling CSI volume support\nkubernetes.podspec-volumes-csi: \"disabled\"\n\n# Controls whether init containers support is enabled or not.\n# 1. Enabled: enabling init containers support\n# 2. Disabled: disabling init containers support\nkubernetes.podspec-init-containers: \"disabled\"\n\n# Controls whether persistent volume claim support is enabled or not.\n# 1. Enabled: enabling persistent volume claim support\n# 2. Disabled: disabling persistent volume claim support\nkubernetes.podspec-persistent-volume-claim: \"disabled\"\n\n# Controls whether write access for persistent volumes is enabled or not.\n# 1. Enabled: enabling write access for persistent volumes\n# 2. Disabled: disabling write access for persistent volumes\nkubernetes.podspec-persistent-volume-write: \"disabled\"\n\n# Controls whether volume mount propagation support is enabled or not.\n# 1. Enabled: enabling volume mount propagation support\n# 2. Disabled: disabling volume mount propagation support\nkubernetes.podspec-volumes-mount-propagation: \"disabled\"\n\n# Controls if the queue proxy podInfo feature is enabled, allowed or disabled\n#\n# This feature should be enabled/allowed when using queue proxy Options (Extensions)\n# Enabling will mount a podInfo volume to the queue proxy container.\n# The volume will contains an 'annotations' file (from the pod's annotation field).\n# The annotations in this file include the Service annotations set by the client creating the service.\n# If mounted, the annotations can be accessed by queue proxy extensions at /etc/podinfo/annotations\n#\n# 1. \"enabled\": always mount a podInfo volume\n# 2. \"disabled\": never mount a podInfo volume\n# 3. \"allowed\": by default, do not mount a podInfo volume\n# However, a client may mount the podInfo volume on an individual Service by attaching\n# the following metadata annotation to the Service: \"features.knative.dev/queueproxy-podinfo\":\"enabled\".\n#\n# NOTE THAT THIS IS AN EXPERIMENTAL / ALPHA FEATURE\nqueueproxy.mount-podinfo: \"disabled\"\n\n# Default queue proxy resource requests and limits to good values for most cases if set.\nqueueproxy.resource-defaults: \"disabled\"" + _example: "################################\n# #\n# EXAMPLE CONFIGURATION #\n# #\n################################\n\n# This block is not actually functional configuration,\n# but serves to illustrate the available configuration\n# options and document them in a way that is accessible\n# to users that `kubectl edit` this config map.\n#\n# These sample configuration options may be copied out of\n# this example block and unindented to be in the data block\n# to actually change the configuration.\n\n# Default SecurityContext settings to secure-by-default values\n# if unset.\n#\n# This value will default to \"enabled\" in a future release,\n# probably Knative 1.10\nsecure-pod-defaults: \"disabled\"\n\n# Indicates whether multi container support is enabled\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See: https://knative.dev/docs/serving/configuration/feature-flags/#multiple-containers\nmulti-container: \"enabled\"\n\n# Indicates whether multi container probing is enabled\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See: https://knative.dev/docs/serving/configuration/feature-flags/#multiple-container-probing\nmulti-container-probing: \"disabled\"\n\n# Indicates whether Kubernetes affinity support is enabled\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See: https://knative.dev/docs/serving/feature-flags/#kubernetes-node-affinity\nkubernetes.podspec-affinity: \"disabled\"\n\n# Indicates whether Kubernetes topologySpreadConstraints support is enabled\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See: https://knative.dev/docs/serving/feature-flags/#kubernetes-topology-spread-constraints\nkubernetes.podspec-topologyspreadconstraints: \"disabled\"\n\n# Indicates whether Kubernetes hostAliases support is enabled\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See: https://knative.dev/docs/serving/feature-flags/#kubernetes-host-aliases\nkubernetes.podspec-hostaliases: \"disabled\"\n\n# Indicates whether Kubernetes nodeSelector support is enabled\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See: https://knative.dev/docs/serving/feature-flags/#kubernetes-node-selector\nkubernetes.podspec-nodeselector: \"disabled\"\n\n# Indicates whether Kubernetes tolerations support is enabled\n#\n# WARNING: Cannot safely be disabled once enabled\n# See: https://knative.dev/docs/serving/feature-flags/#kubernetes-toleration\nkubernetes.podspec-tolerations: \"disabled\"\n\n# Indicates whether Kubernetes FieldRef support is enabled\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See: https://knative.dev/docs/serving/feature-flags/#kubernetes-fieldref\nkubernetes.podspec-fieldref: \"disabled\"\n\n# Indicates whether Kubernetes RuntimeClassName support is enabled\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See: https://knative.dev/docs/serving/feature-flags/#kubernetes-runtime-class\nkubernetes.podspec-runtimeclassname: \"disabled\"\n\n# Indicates whether Kubernetes DNSPolicy support is enabled\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See: https://knative.dev/docs/serving/feature-flags/#kubernetes-dnspolicy\nkubernetes.podspec-dnspolicy: \"disabled\"\n\n# Indicates whether Kubernetes DNSConfig support is enabled\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See: https://knative.dev/docs/serving/feature-flags/#kubernetes-dnsconfig\nkubernetes.podspec-dnsconfig: \"disabled\"\n\n# This feature allows end-users to set a subset of fields on the Pod's SecurityContext\n#\n# When set to \"enabled\" or \"allowed\" it allows the following\n# PodSecurityContext properties:\n# - FSGroup\n# - RunAsGroup\n# - RunAsNonRoot\n# - SupplementalGroups\n# - RunAsUser\n# - SeccompProfile\n#\n# This feature flag should be used with caution as the PodSecurityContext\n# properties may have a side-effect on non-user sidecar containers that come\n# from Knative or your service mesh\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See: https://knative.dev/docs/serving/feature-flags/#kubernetes-security-context\nkubernetes.podspec-securitycontext: \"disabled\"\n\n# Indicated whether sharing the process namespace via ShareProcessNamespace pod spec is allowed.\n# This can be especially useful for sharing data from images directly between sidecars\n#\n# See: https://knative.dev/docs/serving/configuration/feature-flags/#kubernetes-share-process-namespace\nkubernetes.podspec-shareprocessnamespace: \"disabled\"\n\n# Indicates whether Kubernetes PriorityClassName support is enabled\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See: https://knative.dev/docs/serving/feature-flags/#kubernetes-priority-class-name\nkubernetes.podspec-priorityclassname: \"disabled\"\n\n# Indicates whether Kubernetes SchedulerName support is enabled\n#\n# WARNING: Cannot safely be disabled once enabled.\n# See: https://knative.dev/docs/serving/feature-flags/#kubernetes-scheduler-name\nkubernetes.podspec-schedulername: \"disabled\"\n\n# This feature flag allows end-users to add a subset of capabilities on the Pod's SecurityContext.\n#\n# When set to \"enabled\" or \"allowed\" it allows capabilities to be added to the container.\n# For a list of possible capabilities, see https://man7.org/linux/man-pages/man7/capabilities.7.html\nkubernetes.containerspec-addcapabilities: \"disabled\"\n\n# This feature validates PodSpecs from the validating webhook\n# against the K8s API Server.\n#\n# When \"enabled\", the server will always run the extra validation.\n# When \"allowed\", the server will not run the dry-run validation by default.\n# However, clients may enable the behavior on an individual Service by\n# attaching the following metadata annotation: \"features.knative.dev/podspec-dryrun\":\"enabled\".\n# See: https://knative.dev/docs/serving/feature-flags/#kubernetes-dry-run\nkubernetes.podspec-dryrun: \"allowed\"\n\n# Controls whether tag header based routing feature are enabled or not.\n# 1. Enabled: enabling tag header based routing\n# 2. Disabled: disabling tag header based routing\n# See: https://knative.dev/docs/serving/feature-flags/#tag-header-based-routing\ntag-header-based-routing: \"disabled\"\n\n# Controls whether http2 auto-detection should be enabled or not.\n# 1. Enabled: http2 connection will be attempted via upgrade.\n# 2. Disabled: http2 connection will only be attempted when port name is set to \"h2c\".\nautodetect-http2: \"disabled\"\n\n# Controls whether volume support for EmptyDir is enabled or not.\n# 1. Enabled: enabling EmptyDir volume support\n# 2. Disabled: disabling EmptyDir volume support\nkubernetes.podspec-volumes-emptydir: \"enabled\"\n\n# Controls whether init containers support is enabled or not.\n# 1. Enabled: enabling init containers support\n# 2. Disabled: disabling init containers support\nkubernetes.podspec-init-containers: \"disabled\"\n\n# Controls whether persistent volume claim support is enabled or not.\n# 1. Enabled: enabling persistent volume claim support\n# 2. Disabled: disabling persistent volume claim support\nkubernetes.podspec-persistent-volume-claim: \"disabled\"\n\n# Controls whether write access for persistent volumes is enabled or not.\n# 1. Enabled: enabling write access for persistent volumes\n# 2. Disabled: disabling write access for persistent volumes\nkubernetes.podspec-persistent-volume-write: \"disabled\"\n\n# Controls if the queue proxy podInfo feature is enabled, allowed or disabled\n#\n# This feature should be enabled/allowed when using queue proxy Options (Extensions)\n# Enabling will mount a podInfo volume to the queue proxy container.\n# The volume will contains an 'annotations' file (from the pod's annotation field).\n# The annotations in this file include the Service annotations set by the client creating the service.\n# If mounted, the annotations can be accessed by queue proxy extensions at /etc/podinfo/annnotations\n#\n# 1. \"enabled\": always mount a podInfo volume\n# 2. \"disabled\": never mount a podInfo volume\n# 3. \"allowed\": by default, do not mount a podInfo volume\n# However, a client may mount the podInfo volume on an individual Service by attaching\n# the following metadata annotation to the Service: \"features.knative.dev/queueproxy-podinfo\":\"enabled\".\n#\n# NOTE THAT THIS IS AN EXPERIMENTAL / ALPHA FEATURE\nqueueproxy.mount-podinfo: \"disabled\"\n\n# Default queue proxy resource requests and limits to good values for most cases if set.\nqueueproxy.resource-defaults: \"disabled\"" } }; export const ConfigMap_ConfigGc: KubernetesResource = { @@ -6329,7 +6178,7 @@ export const ConfigMap_ConfigGc: KubernetesResource = { labels: { "app.kubernetes.io/component": "controller", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1" + "app.kubernetes.io/version": "1.15.0" }, name: "config-gc", namespace: "knative-serving" @@ -6348,7 +6197,7 @@ export const ConfigMap_ConfigLeaderElection: KubernetesResource = { labels: { "app.kubernetes.io/component": "controller", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1" + "app.kubernetes.io/version": "1.15.0" }, name: "config-leader-election", namespace: "knative-serving" @@ -6367,7 +6216,7 @@ export const ConfigMap_ConfigLogging: KubernetesResource = { labels: { "app.kubernetes.io/component": "logging", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1" + "app.kubernetes.io/version": "1.15.0" }, name: "config-logging", namespace: "knative-serving" @@ -6386,7 +6235,7 @@ export const ConfigMap_ConfigNetwork: KubernetesResource = { labels: { "app.kubernetes.io/component": "networking", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1" + "app.kubernetes.io/version": "1.15.0" }, name: "config-network", namespace: "knative-serving" @@ -6400,18 +6249,18 @@ export const ConfigMap_ConfigObservability: KubernetesResource = { kind: "ConfigMap", metadata: { annotations: { - "knative.dev/example-checksum": "59abacb5" + "knative.dev/example-checksum": "54abd711" }, labels: { "app.kubernetes.io/component": "observability", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1" + "app.kubernetes.io/version": "1.15.0" }, name: "config-observability", namespace: "knative-serving" }, data: { - _example: "################################\n# #\n# EXAMPLE CONFIGURATION #\n# #\n################################\n\n# This block is not actually functional configuration,\n# but serves to illustrate the available configuration\n# options and document them in a way that is accessible\n# to users that `kubectl edit` this config map.\n#\n# These sample configuration options may be copied out of\n# this example block and unindented to be in the data block\n# to actually change the configuration.\n\n# logging.enable-var-log-collection defaults to false.\n# The fluentd daemon set will be set up to collect /var/log if\n# this flag is true.\nlogging.enable-var-log-collection: \"false\"\n\n# logging.revision-url-template provides a template to use for producing the\n# logging URL that is injected into the status of each Revision.\nlogging.revision-url-template: \"http://logging.example.com/?revisionUID=${REVISION_UID}\"\n\n# If non-empty, this enables queue proxy writing user request logs to stdout, excluding probe\n# requests.\n# NB: after 0.18 release logging.enable-request-log must be explicitly set to true\n# in order for request logging to be enabled.\n#\n# The value determines the shape of the request logs and it must be a valid go text/template.\n# It is important to keep this as a single line. Multiple lines are parsed as separate entities\n# by most collection agents and will split the request logs into multiple records.\n#\n# The following fields and functions are available to the template:\n#\n# Request: An http.Request (see https://golang.org/pkg/net/http/#Request)\n# representing an HTTP request received by the server.\n#\n# Response:\n# struct {\n# Code int // HTTP status code (see https://www.iana.org/assignments/http-status-codes/http-status-codes.xhtml)\n# Size int // An int representing the size of the response.\n# Latency float64 // A float64 representing the latency of the response in seconds.\n# }\n#\n# Revision:\n# struct {\n# Name string // Knative revision name\n# Namespace string // Knative revision namespace\n# Service string // Knative service name\n# Configuration string // Knative configuration name\n# PodName string // Name of the pod hosting the revision\n# PodIP string // IP of the pod hosting the revision\n# }\n#\nlogging.request-log-template: '{\"httpRequest\": {\"requestMethod\": \"{{.Request.Method}}\", \"requestUrl\": \"{{js .Request.RequestURI}}\", \"requestSize\": \"{{.Request.ContentLength}}\", \"status\": {{.Response.Code}}, \"responseSize\": \"{{.Response.Size}}\", \"userAgent\": \"{{js .Request.UserAgent}}\", \"remoteIp\": \"{{js .Request.RemoteAddr}}\", \"serverIp\": \"{{.Revision.PodIP}}\", \"referer\": \"{{js .Request.Referer}}\", \"latency\": \"{{.Response.Latency}}s\", \"protocol\": \"{{.Request.Proto}}\"}, \"traceId\": \"{{.TraceID}}\"}'\n\n# If true, the request logging will be enabled.\nlogging.enable-request-log: \"false\"\n\n# If true, this enables queue proxy writing request logs for probe requests to stdout.\n# It uses the same template for user requests, i.e. logging.request-log-template.\nlogging.enable-probe-request-log: \"false\"\n\n# metrics-protocol field specifies the protocol used when exporting metrics\n# It supports either 'none' (the default), 'prometheus', 'http/protobuf' (OTLP HTTP), 'grpc' (OTLP gRPC)\nmetrics-protocol: http/protobuf\n\n# metrics-endpoint field specifies the destination metrics should be exporter to.\n#\n# The endpoint MUST be set when the protocol is http/protobuf or grpc.\n# The endpoint MUST NOT be set when the protocol is none.\n#\n# When the protocol is prometheus the endpoint can accept a 'host:port' string to customize the\n# listening host interface and port.\nmetrics-endpoint: http://example.com/v1/traces\n\n# metrics-export-interval specifies the global metrics reporting period for control and data plane components.\n# If a zero or negative value is passed the default reporting OTel period is used (60 secs).\nmetrics-export-interval: 60s\n\n# request-metrics-protocol field specifies the protocol used when exporting queue-proxy metrics\n# It supports either 'none' (the default), 'prometheus', 'http/protobuf' (OTLP HTTP), 'grpc' (OTLP gRPC)\nrequest-metrics-protocol: http/protobuf\n\n# request-metrics-endpoint field specifies the destination metrics from the queue proxy should be exporter to.\n#\n# The endpoint MUST be set when the protocol is http/protobuf or grpc.\n# The endpoint MUST NOT be set when the protocol is none.\n#\n# When the protocol is prometheus the endpoint can accept a 'host:port' string to customize the\n# listening host interface and port.\nrequest-metrics-endpoint: http://promstack-kube-prometheus-prometheus.observability:9090/api/v1/otlp/v1/metrics\n\n# request-metrics-export-interval specifies the global metrics reporting period for the queue-proxy.\n#\n# If a zero or negative value is passed the default reporting OTel period is used (60 secs).\nrequest-metrics-export-interval: 60s\n\n# runtime-profiling indicates whether it is allowed to retrieve runtime profiling data from\n# the pods via an HTTP server in the format expected by the pprof visualization tool. When\n# enabled, the Knative Serving pods expose the profiling data on an alternate HTTP port 8008.\n# The HTTP context root for profiling is then /debug/pprof/.\nruntime-profiling: enabled\n\n# tracing-protocol field specifies the protocol used when exporting traces\n# It supports either 'none' (the default), 'http/protobuf' (OTLP HTTP), 'grpc' (OTLP gRPC)\n# or `stdout` for debugging purposes\ntracing-protocol: http/protobuf\n\n# tracing-endpoint field specifies the destination traces should be exporter to.\n#\n# The endpoint MUST be set when the protocol is http/protobuf or grpc.\n# The endpoint MUST NOT be set when the protocol is none.\ntracing-endpoint: http://jaeger-collector.observability:4318/v1/traces\n\n# tracing-sampling-rate allows the user to specify what percentage of all traces should be exported\n# The value should be between 0 (never sample) to 1 (always sample)\ntracing-sampling-rate: \"1\"\n" + _example: "################################\n# #\n# EXAMPLE CONFIGURATION #\n# #\n################################\n\n# This block is not actually functional configuration,\n# but serves to illustrate the available configuration\n# options and document them in a way that is accessible\n# to users that `kubectl edit` this config map.\n#\n# These sample configuration options may be copied out of\n# this example block and unindented to be in the data block\n# to actually change the configuration.\n\n# logging.enable-var-log-collection defaults to false.\n# The fluentd daemon set will be set up to collect /var/log if\n# this flag is true.\nlogging.enable-var-log-collection: \"false\"\n\n# logging.revision-url-template provides a template to use for producing the\n# logging URL that is injected into the status of each Revision.\nlogging.revision-url-template: \"http://logging.example.com/?revisionUID=${REVISION_UID}\"\n\n# If non-empty, this enables queue proxy writing user request logs to stdout, excluding probe\n# requests.\n# NB: after 0.18 release logging.enable-request-log must be explicitly set to true\n# in order for request logging to be enabled.\n#\n# The value determines the shape of the request logs and it must be a valid go text/template.\n# It is important to keep this as a single line. Multiple lines are parsed as separate entities\n# by most collection agents and will split the request logs into multiple records.\n#\n# The following fields and functions are available to the template:\n#\n# Request: An http.Request (see https://golang.org/pkg/net/http/#Request)\n# representing an HTTP request received by the server.\n#\n# Response:\n# struct {\n# Code int // HTTP status code (see https://www.iana.org/assignments/http-status-codes/http-status-codes.xhtml)\n# Size int // An int representing the size of the response.\n# Latency float64 // A float64 representing the latency of the response in seconds.\n# }\n#\n# Revision:\n# struct {\n# Name string // Knative revision name\n# Namespace string // Knative revision namespace\n# Service string // Knative service name\n# Configuration string // Knative configuration name\n# PodName string // Name of the pod hosting the revision\n# PodIP string // IP of the pod hosting the revision\n# }\n#\nlogging.request-log-template: '{\"httpRequest\": {\"requestMethod\": \"{{.Request.Method}}\", \"requestUrl\": \"{{js .Request.RequestURI}}\", \"requestSize\": \"{{.Request.ContentLength}}\", \"status\": {{.Response.Code}}, \"responseSize\": \"{{.Response.Size}}\", \"userAgent\": \"{{js .Request.UserAgent}}\", \"remoteIp\": \"{{js .Request.RemoteAddr}}\", \"serverIp\": \"{{.Revision.PodIP}}\", \"referer\": \"{{js .Request.Referer}}\", \"latency\": \"{{.Response.Latency}}s\", \"protocol\": \"{{.Request.Proto}}\"}, \"traceId\": \"{{index .Request.Header \"X-B3-Traceid\"}}\"}'\n\n# If true, the request logging will be enabled.\n# NB: up to and including Knative version 0.18 if logging.request-log-template is non-empty, this value\n# will be ignored.\nlogging.enable-request-log: \"false\"\n\n# If true, this enables queue proxy writing request logs for probe requests to stdout.\n# It uses the same template for user requests, i.e. logging.request-log-template.\nlogging.enable-probe-request-log: \"false\"\n\n# metrics.backend-destination field specifies the system metrics destination.\n# It supports either prometheus (the default) or opencensus.\nmetrics.backend-destination: prometheus\n\n# metrics.reporting-period-seconds specifies the global metrics reporting period for control and data plane components.\n# If a zero or negative value is passed the default reporting period is used (10 secs).\n# If the attribute is not specified a default value is used per metrics backend.\n# For the prometheus backend the default reporting period is 5s while for opencensus it is 60s.\nmetrics.reporting-period-seconds: \"5\"\n\n# metrics.request-metrics-backend-destination specifies the request metrics\n# destination. It enables queue proxy to send request metrics.\n# Currently supported values: prometheus (the default), opencensus.\nmetrics.request-metrics-backend-destination: prometheus\n\n# metrics.request-metrics-reporting-period-seconds specifies the request metrics reporting period in sec at queue proxy.\n# If a zero or negative value is passed the default reporting period is used (10 secs).\n# If the attribute is not specified, it is overridden by the value of metrics.reporting-period-seconds.\nmetrics.request-metrics-reporting-period-seconds: \"5\"\n\n# profiling.enable indicates whether it is allowed to retrieve runtime profiling data from\n# the pods via an HTTP server in the format expected by the pprof visualization tool. When\n# enabled, the Knative Serving pods expose the profiling data on an alternate HTTP port 8008.\n# The HTTP context root for profiling is then /debug/pprof/.\nprofiling.enable: \"false\"\n" } }; export const ConfigMap_ConfigTracing: KubernetesResource = { @@ -6419,18 +6268,18 @@ export const ConfigMap_ConfigTracing: KubernetesResource = { kind: "ConfigMap", metadata: { annotations: { - "knative.dev/example-checksum": "04c7e9a3" + "knative.dev/example-checksum": "26614636" }, labels: { "app.kubernetes.io/component": "tracing", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1" + "app.kubernetes.io/version": "1.15.0" }, name: "config-tracing", namespace: "knative-serving" }, data: { - _example: "###########################################################\n# #\n# This config is deprecated - use config-observability #\n# #\n###########################################################\n" + _example: "################################\n# #\n# EXAMPLE CONFIGURATION #\n# #\n################################\n\n# This block is not actually functional configuration,\n# but serves to illustrate the available configuration\n# options and document them in a way that is accessible\n# to users that `kubectl edit` this config map.\n#\n# These sample configuration options may be copied out of\n# this example block and unindented to be in the data block\n# to actually change the configuration.\n#\n# This may be \"zipkin\" or \"none\" (default)\nbackend: \"none\"\n\n# URL to zipkin collector where traces are sent.\n# This must be specified when backend is \"zipkin\"\nzipkin-endpoint: \"http://zipkin.istio-system.svc.cluster.local:9411/api/v2/spans\"\n\n# Enable zipkin debug mode. This allows all spans to be sent to the server\n# bypassing sampling.\ndebug: \"false\"\n\n# Percentage (0-1) of requests to trace\nsample-rate: \"0.1\"\n" } }; export const HorizontalPodAutoscaler_Activator: KubernetesResource = { @@ -6440,7 +6289,7 @@ export const HorizontalPodAutoscaler_Activator: KubernetesResource = { labels: { "app.kubernetes.io/component": "activator", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1" + "app.kubernetes.io/version": "1.15.0" }, name: "activator", namespace: "knative-serving" @@ -6472,7 +6321,7 @@ export const PodDisruptionBudget_ActivatorPdb: KubernetesResource = { labels: { "app.kubernetes.io/component": "activator", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1" + "app.kubernetes.io/version": "1.15.0" }, name: "activator-pdb", namespace: "knative-serving" @@ -6493,7 +6342,7 @@ export const Deployment_Activator: KubernetesResource = { labels: { "app.kubernetes.io/component": "activator", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1" + "app.kubernetes.io/version": "1.15.0" }, name: "activator", namespace: "knative-serving" @@ -6511,7 +6360,7 @@ export const Deployment_Activator: KubernetesResource = { app: "activator", "app.kubernetes.io/component": "activator", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1", + "app.kubernetes.io/version": "1.15.0", role: "activator" } }, @@ -6562,8 +6411,11 @@ export const Deployment_Activator: KubernetesResource = { }, { name: "CONFIG_OBSERVABILITY_NAME", value: "config-observability" + }, { + name: "METRICS_DOMAIN", + value: "knative.dev/internal/serving" }], - image: "gcr.io/knative-releases/knative.dev/serving/cmd/activator@sha256:5deaef961fef8d1417f6d4a4dfae2fc338f2d30d72c4ad58c3ab392b2c04705b", + image: "gcr.io/knative-releases/knative.dev/serving/cmd/activator@sha256:b6d7d96edd8942d679757249f6aa07373461411104ce7c93309f23fba2884f8f", livenessProbe: { failureThreshold: 12, httpGet: { @@ -6629,7 +6481,7 @@ export const Service_ActivatorService: KubernetesResource = { app: "activator", "app.kubernetes.io/component": "activator", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1" + "app.kubernetes.io/version": "1.15.0" }, name: "activator-service", namespace: "knative-serving" @@ -6669,7 +6521,7 @@ export const Deployment_Autoscaler: KubernetesResource = { labels: { "app.kubernetes.io/component": "autoscaler", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1" + "app.kubernetes.io/version": "1.15.0" }, name: "autoscaler", namespace: "knative-serving" @@ -6693,7 +6545,7 @@ export const Deployment_Autoscaler: KubernetesResource = { app: "autoscaler", "app.kubernetes.io/component": "autoscaler", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1" + "app.kubernetes.io/version": "1.15.0" } }, spec: { @@ -6740,8 +6592,11 @@ export const Deployment_Autoscaler: KubernetesResource = { }, { name: "CONFIG_OBSERVABILITY_NAME", value: "config-observability" + }, { + name: "METRICS_DOMAIN", + value: "knative.dev/serving" }], - image: "gcr.io/knative-releases/knative.dev/serving/cmd/autoscaler@sha256:5bae38655d87df86b041083fbe51791816473245f752432ba9b85a7b12f73cd5", + image: "gcr.io/knative-releases/knative.dev/serving/cmd/autoscaler@sha256:119157d871eb3db5a54944464d9920ad378d35292d4c12fd4a765cd016e24f0f", livenessProbe: { failureThreshold: 6, httpGet: { @@ -6799,7 +6654,7 @@ export const Service_Autoscaler: KubernetesResource = { app: "autoscaler", "app.kubernetes.io/component": "autoscaler", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1" + "app.kubernetes.io/version": "1.15.0" }, name: "autoscaler", namespace: "knative-serving" @@ -6830,7 +6685,7 @@ export const Deployment_Controller: KubernetesResource = { labels: { "app.kubernetes.io/component": "controller", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1" + "app.kubernetes.io/version": "1.15.0" }, name: "controller", namespace: "knative-serving" @@ -6847,7 +6702,7 @@ export const Deployment_Controller: KubernetesResource = { app: "controller", "app.kubernetes.io/component": "controller", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1" + "app.kubernetes.io/version": "1.15.0" } }, spec: { @@ -6887,8 +6742,11 @@ export const Deployment_Controller: KubernetesResource = { }, { name: "CONFIG_OBSERVABILITY_NAME", value: "config-observability" + }, { + name: "METRICS_DOMAIN", + value: "knative.dev/internal/serving" }], - image: "gcr.io/knative-releases/knative.dev/serving/cmd/controller@sha256:94329d85200c2fc31ed1166a26568ca1357376c149c147e71f400cf28be3c816", + image: "gcr.io/knative-releases/knative.dev/serving/cmd/controller@sha256:80b9865a585900af6cecead24babe03aa79487e9e6306da1444b04148c21c96f", livenessProbe: { failureThreshold: 6, httpGet: { @@ -6953,7 +6811,7 @@ export const Service_Controller: KubernetesResource = { app: "controller", "app.kubernetes.io/component": "controller", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1" + "app.kubernetes.io/version": "1.15.0" }, name: "controller", namespace: "knative-serving" @@ -6980,7 +6838,7 @@ export const HorizontalPodAutoscaler_Webhook: KubernetesResource = { labels: { "app.kubernetes.io/component": "webhook", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1" + "app.kubernetes.io/version": "1.15.0" }, name: "webhook", namespace: "knative-serving" @@ -7012,7 +6870,7 @@ export const PodDisruptionBudget_WebhookPdb: KubernetesResource = { labels: { "app.kubernetes.io/component": "webhook", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1" + "app.kubernetes.io/version": "1.15.0" }, name: "webhook-pdb", namespace: "knative-serving" @@ -7033,7 +6891,7 @@ export const Deployment_Webhook: KubernetesResource = { labels: { "app.kubernetes.io/component": "webhook", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1" + "app.kubernetes.io/version": "1.15.0" }, name: "webhook", namespace: "knative-serving" @@ -7051,7 +6909,7 @@ export const Deployment_Webhook: KubernetesResource = { app: "webhook", "app.kubernetes.io/component": "webhook", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1", + "app.kubernetes.io/version": "1.15.0", role: "webhook" } }, @@ -7098,8 +6956,11 @@ export const Deployment_Webhook: KubernetesResource = { }, { name: "WEBHOOK_PORT", value: "8443" + }, { + name: "METRICS_DOMAIN", + value: "knative.dev/internal/serving" }], - image: "gcr.io/knative-releases/knative.dev/serving/cmd/webhook@sha256:8470456be214e93a84e3c7b79a632aa9978bd8ecda553feaa47878a2c24ab84d", + image: "gcr.io/knative-releases/knative.dev/serving/cmd/webhook@sha256:732d9cdf7f5fa5c6055d26b1aa5aad40e3d74ba9f2cb76a1db0f0e4d072b7cd0", livenessProbe: { failureThreshold: 6, httpGet: { @@ -7163,7 +7024,7 @@ export const Service_Webhook: KubernetesResource = { app: "webhook", "app.kubernetes.io/component": "webhook", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1", + "app.kubernetes.io/version": "1.15.0", role: "webhook" }, name: "webhook", @@ -7196,7 +7057,7 @@ export const ValidatingWebhookConfiguration_ConfigWebhookServingKnativeDev: Kube labels: { "app.kubernetes.io/component": "webhook", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1" + "app.kubernetes.io/version": "1.15.0" }, name: "config.webhook.serving.knative.dev" }, @@ -7232,7 +7093,7 @@ export const MutatingWebhookConfiguration_WebhookServingKnativeDev: KubernetesRe labels: { "app.kubernetes.io/component": "webhook", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1" + "app.kubernetes.io/version": "1.15.0" }, name: "webhook.serving.knative.dev" }, @@ -7264,7 +7125,7 @@ export const ValidatingWebhookConfiguration_ValidationWebhookServingKnativeDev: labels: { "app.kubernetes.io/component": "webhook", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1" + "app.kubernetes.io/version": "1.15.0" }, name: "validation.webhook.serving.knative.dev" }, @@ -7296,7 +7157,7 @@ export const Secret_WebhookCerts: KubernetesResource = { labels: { "app.kubernetes.io/component": "webhook", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1" + "app.kubernetes.io/version": "1.15.0" }, name: "webhook-certs", namespace: "knative-serving" @@ -7309,7 +7170,7 @@ export const Namespace_KourierSystem: KubernetesResource = { labels: { "app.kubernetes.io/component": "net-kourier", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1", + "app.kubernetes.io/version": "1.15.0", "networking.knative.dev/ingress-provider": "kourier" }, name: "kourier-system" @@ -7322,7 +7183,7 @@ export const ConfigMap_KourierBootstrap: KubernetesResource = { labels: { "app.kubernetes.io/component": "net-kourier", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1", + "app.kubernetes.io/version": "1.15.0", "networking.knative.dev/ingress-provider": "kourier" }, name: "kourier-bootstrap", @@ -7339,14 +7200,14 @@ export const ConfigMap_ConfigKourier: KubernetesResource = { labels: { "app.kubernetes.io/component": "net-kourier", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1", + "app.kubernetes.io/version": "1.15.0", "networking.knative.dev/ingress-provider": "kourier" }, name: "config-kourier", namespace: "knative-serving" }, data: { - _example: "################################\n# #\n# EXAMPLE CONFIGURATION #\n# #\n################################\n\n# This block is not actually functional configuration,\n# but serves to illustrate the available configuration\n# options and document them in a way that is accessible\n# to users that `kubectl edit` this config map.\n#\n# These sample configuration options may be copied out of\n# this example block and unindented to be in the data block\n# to actually change the configuration.\n\n# Specifies whether requests reaching the Kourier gateway\n# in the context of services should be logged. Readiness\n# probes etc. must be configured via the bootstrap config.\nenable-service-access-logging: \"true\"\n\n# Specifies the format of the access log used by the Kourier gateway.\n# This template follows the envoy format.\n# see: https://www.envoyproxy.io/docs/envoy/latest/configuration/observability/access_log/usage#access-logging\nservice-access-log-template: \"\"\n\n# Specifies whether to use proxy-protocol in order to safely\n# transport connection information such as a client's address\n# across multiple layers of TCP proxies.\n# NOTE THAT THIS IS AN EXPERIMENTAL / ALPHA FEATURE\nenable-proxy-protocol: \"false\"\n\n# The server certificates to serve the internal TLS traffic for Kourier Gateway.\n# It is specified by the secret name in controller namespace, which has\n# the \"tls.crt\" and \"tls.key\" data field.\n# Use an empty value to disable the feature (default).\n#\n# NOTE: This flag is in an alpha state and is mostly here to enable internal testing\n# for now. Use with caution.\ncluster-cert-secret: \"\"\n\n# Specifies the amount of time that Kourier waits for the incoming requests.\n# The default, 0s, imposes no timeout at all.\nstream-idle-timeout: \"0s\"\n\n# Specifies whether to use CryptoMB private key provider in order to\n# acclerate the TLS handshake.\n# NOTE THAT THIS IS AN EXPERIMENTAL / ALPHA FEATURE.\nenable-cryptomb: \"false\"\n\n# Configures the number of additional ingress proxy hops from the\n# right side of the x-forwarded-for HTTP header to trust.\ntrusted-hops-count: \"0\"\n\n# Configures the connection manager to use the real remote address\n# of the client connection when determining internal versus external origin and manipulating various headers.\nuse-remote-address: \"false\"\n\n# Specifies the cipher suites for TLS external listener.\n# Use ',' separated values like \"ECDHE-ECDSA-AES128-GCM-SHA256,ECDHE-ECDSA-CHACHA20-POLY1305\"\n# The default uses the default cipher suites of the envoy version.\ncipher-suites: \"\"\n\n# Disable the Envoy server header injection in the response when response has no such header.\ndisable-envoy-server-header: \"false\"\n\n# The external authorization service and port, my-auth:2222.\n# This value overrides environment variable if defined.\nextauthz-host: \"\"\n\n# The protocol used to query the ext auth service. Can be one of : grpc, http, https. Defaults to grpc\n# This value overrides environment variable if defined.\nextauthz-protocol: \"grpc\"\n\n# Allow traffic to go through if the ext auth service is down. Accepts true/false.\n# This value overrides environment variable if defined.\nextauthz-failure-mode-allow: \"\"\n\n# Max request bytes, if not set, defaults to 8192 Bytes. More info Envoy Docs\n# see: https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/http/ext_authz/v3/ext_authz.proto.html#extensions-filters-http-ext-authz-v3-buffersettings\n# This value overrides environment variable if defined.\nextauthz-max-request-body-bytes: 8192\n\n# Max time in ms to wait for the ext authz service. Defaults to 2000 ms\n# This value overrides environment variable if defined.\nextauthz-timeout: 2000\n\n# If extauthz-protocol is equal to http or https, path to query the ext auth service.\n# Example : if set to /verify, it will query /verify/ (notice the trailing /). If not set, it will query /\n# This value overrides environment variable if defined.\nextauthz-path-prefix: \"\"\n\n# If extauthz-protocol is equal to grpc, sends the body as raw bytes instead of a UTF-8 string.\n# Accepts only true/false, t/f or 1/0. Attempting to set another value will throw an error.\n# Defaults to false. More info Envoy Docs.\n# see: https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/http/ext_authz/v3/ext_authz.proto.html#extensions-filters-http-ext-authz-v3-buffersettings\n# This value overrides environment variable if defined.\nextauthz-pack-as-byte: \"false\"\n\n# Specifies the secret that contains the TLS certificate and key pair when using HTTPS communication with Kourier Ingress.\n# This value overrides environment variable if defined.\ncerts-secret-name: \"\"\ncerts-secret-namespace: \"\"\n\n# Specifies the OTLP collector endpoint for distributed tracing.\n# The endpoint format depends on the protocol (see tracing-protocol).\n# Examples:\n# - For HTTP: \"http://otel-collector.observability.svc:4318/v1/traces\"\n# - For gRPC: \"http://otel-collector.observability.svc:4317\"\n# Use an empty value to disable distributed tracing (default).\ntracing-endpoint: \"\"\n\n# Protocol for tracing collector communication.\n# Valid values: http/protobuf, grpc\ntracing-protocol: \"grpc\"\n\n# Tracing sampling rate (0.0 to 1.0)\n# Controls the percentage of requests that are traced.\n# Example: \"1.0\" traces 100% of requests.\ntracing-sampling-rate: \"1.0\"\n\n# Service name for traces\n# This identifies the Kourier gateway in your tracing system.\ntracing-service-name: \"kourier-knative\"\n" + _example: "################################\n# #\n# EXAMPLE CONFIGURATION #\n# #\n################################\n\n# This block is not actually functional configuration,\n# but serves to illustrate the available configuration\n# options and document them in a way that is accessible\n# to users that `kubectl edit` this config map.\n#\n# These sample configuration options may be copied out of\n# this example block and unindented to be in the data block\n# to actually change the configuration.\n\n# Specifies whether requests reaching the Kourier gateway\n# in the context of services should be logged. Readiness\n# probes etc. must be configured via the bootstrap config.\nenable-service-access-logging: \"true\"\n\n# Specifies whether to use proxy-protocol in order to safely\n# transport connection information such as a client's address\n# across multiple layers of TCP proxies.\n# NOTE THAT THIS IS AN EXPERIMENTAL / ALPHA FEATURE\nenable-proxy-protocol: \"false\"\n\n# The server certificates to serve the internal TLS traffic for Kourier Gateway.\n# It is specified by the secret name in controller namespace, which has\n# the \"tls.crt\" and \"tls.key\" data field.\n# Use an empty value to disable the feature (default).\n#\n# NOTE: This flag is in an alpha state and is mostly here to enable internal testing\n# for now. Use with caution.\ncluster-cert-secret: \"\"\n\n# Specifies the amount of time that Kourier waits for the incoming requests.\n# The default, 0s, imposes no timeout at all.\nstream-idle-timeout: \"0s\"\n\n# Specifies whether to use CryptoMB private key provider in order to\n# acclerate the TLS handshake.\n# NOTE THAT THIS IS AN EXPERIMENTAL / ALPHA FEATURE.\nenable-cryptomb: \"false\"\n\n# Configures the number of additional ingress proxy hops from the\n# right side of the x-forwarded-for HTTP header to trust.\ntrusted-hops-count: \"0\"\n\n# Specifies the cipher suites for TLS external listener.\n# Use ',' separated values like \"ECDHE-ECDSA-AES128-GCM-SHA256,ECDHE-ECDSA-CHACHA20-POLY1305\"\n# The default uses the default cipher suites of the envoy version.\ncipher-suites: \"\"\n" } }; export const ServiceAccount_NetKourier: KubernetesResource = { @@ -7356,7 +7217,7 @@ export const ServiceAccount_NetKourier: KubernetesResource = { labels: { "app.kubernetes.io/component": "net-kourier", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1", + "app.kubernetes.io/version": "1.15.0", "networking.knative.dev/ingress-provider": "kourier" }, name: "net-kourier", @@ -7370,7 +7231,7 @@ export const ClusterRole_NetKourier: KubernetesResource = { labels: { "app.kubernetes.io/component": "net-kourier", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1", + "app.kubernetes.io/version": "1.15.0", "networking.knative.dev/ingress-provider": "kourier" }, name: "net-kourier" @@ -7381,16 +7242,12 @@ export const ClusterRole_NetKourier: KubernetesResource = { verbs: ["create", "update", "patch"] }, { apiGroups: [""], - resources: ["pods", "services", "secrets"], + resources: ["pods", "endpoints", "services", "secrets"], verbs: ["get", "list", "watch"] }, { apiGroups: [""], resources: ["configmaps"], verbs: ["get", "list", "watch"] - }, { - apiGroups: ["discovery.k8s.io"], - resources: ["endpointslices"], - verbs: ["get", "list", "watch"] }, { apiGroups: ["coordination.k8s.io"], resources: ["leases"], @@ -7412,7 +7269,7 @@ export const ClusterRoleBinding_NetKourier: KubernetesResource = { labels: { "app.kubernetes.io/component": "net-kourier", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1", + "app.kubernetes.io/version": "1.15.0", "networking.knative.dev/ingress-provider": "kourier" }, name: "net-kourier" @@ -7435,7 +7292,7 @@ export const Deployment_NetKourierController: KubernetesResource = { labels: { "app.kubernetes.io/component": "net-kourier", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1", + "app.kubernetes.io/version": "1.15.0", "networking.knative.dev/ingress-provider": "kourier" }, name: "net-kourier-controller", @@ -7497,7 +7354,7 @@ export const Deployment_NetKourierController: KubernetesResource = { name: "KUBE_API_QPS", value: "200" }], - image: "gcr.io/knative-releases/knative.dev/net-kourier/cmd/kourier@sha256:01abd2070ccf8680885c47990e42c05c09e30bc8595d9246f4dcd37f2220a2a2", + image: "gcr.io/knative-releases/knative.dev/net-kourier/cmd/kourier@sha256:c9016f34165c5118373c75dcc373d1cd802fe37ffa9e1bce65960942a59bc5f1", livenessProbe: { failureThreshold: 6, grpc: { @@ -7557,7 +7414,7 @@ export const Service_NetKourierController: KubernetesResource = { labels: { "app.kubernetes.io/component": "net-kourier", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1", + "app.kubernetes.io/version": "1.15.0", "networking.knative.dev/ingress-provider": "kourier" }, name: "net-kourier-controller", @@ -7588,7 +7445,7 @@ export const Deployment_3scaleKourierGateway: KubernetesResource = { labels: { "app.kubernetes.io/component": "net-kourier", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1", + "app.kubernetes.io/version": "1.15.0", "networking.knative.dev/ingress-provider": "kourier" }, name: "3scale-kourier-gateway", @@ -7627,7 +7484,7 @@ export const Deployment_3scaleKourierGateway: KubernetesResource = { name: "DRAIN_TIME_SECONDS", value: "15" }], - image: "docker.io/envoyproxy/envoy:v1.37-latest", + image: "docker.io/envoyproxy/envoy:v1.26-latest", lifecycle: { preStop: { exec: { @@ -7647,8 +7504,7 @@ export const Deployment_3scaleKourierGateway: KubernetesResource = { scheme: "HTTP" }, initialDelaySeconds: 10, - periodSeconds: 5, - timeoutSeconds: 3 + periodSeconds: 5 }, name: "kourier-gateway", ports: [{ @@ -7688,8 +7544,7 @@ export const Deployment_3scaleKourierGateway: KubernetesResource = { scheme: "HTTP" }, initialDelaySeconds: 10, - periodSeconds: 5, - timeoutSeconds: 3 + periodSeconds: 5 }, resources: { limits: { @@ -7738,7 +7593,7 @@ export const Service_Kourier: KubernetesResource = { labels: { "app.kubernetes.io/component": "net-kourier", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1", + "app.kubernetes.io/version": "1.15.0", "networking.knative.dev/ingress-provider": "kourier" }, name: "kourier", @@ -7769,7 +7624,7 @@ export const Service_KourierInternal: KubernetesResource = { labels: { "app.kubernetes.io/component": "net-kourier", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1", + "app.kubernetes.io/version": "1.15.0", "networking.knative.dev/ingress-provider": "kourier" }, name: "kourier-internal", @@ -7800,7 +7655,7 @@ export const HorizontalPodAutoscaler_3scaleKourierGateway: KubernetesResource = labels: { "app.kubernetes.io/component": "net-kourier", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1", + "app.kubernetes.io/version": "1.15.0", "networking.knative.dev/ingress-provider": "kourier" }, name: "3scale-kourier-gateway", @@ -7833,7 +7688,7 @@ export const PodDisruptionBudget_3scaleKourierGatewayPdb: KubernetesResource = { labels: { "app.kubernetes.io/component": "net-kourier", "app.kubernetes.io/name": "knative-serving", - "app.kubernetes.io/version": "1.22.1", + "app.kubernetes.io/version": "1.15.0", "networking.knative.dev/ingress-provider": "kourier" }, name: "3scale-kourier-gateway-pdb",